-
Notifications
You must be signed in to change notification settings - Fork 156
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add support for systemd-homed #2018
base: rawhide
Are you sure you want to change the base?
Conversation
Thank you for the PR, I am afraid it will take me some time to go through it. What did you use for testing? |
Building a new home with systemd-homed on fedora Tested on:
|
Also tested on
|
Thank you, the link is also quite helpful. I meant if it was "testing by usage" or some automated test or features which can be automated. We have very basic test. |
@zpytela, I have tried almost every combination available to the homectl tool for the last 3 years. This policy has more than basic support to function properly. Every now and then upstream modifies the code, and I have adjusted the policy along side them to maintain robustness. |
Thank you, that sounds very good, so you think this is ready to merge to F40? |
Yes Sir. |
…into systemd-homed
Feb 12 15:47:33 fedora audit[930]: USER_AVC pid=930 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for scontext=system_u:system_r:systemd_homed_t:s0 tcontext=system_u:system_r:policykit_t:s0 tclass=dbus permissive=1 exe="/usr/bin/dbus-broker" sauid=81 hostname=? addr=? terminal=?' Feb 12 17:30:56 fedora audit[32148]: AVC avc: denied { mounton } for pid=32148 comm="(mkfs)" path="/proc/32148/mounts" dev="proc" ino=211005 scontext=system_u:system_r:systemd_homework_t:s0 tcontext=system_u:system_r:systemd_homework_t:s0 tclass=file permissive=1
Cockpit tests failed for commit 7d68e9e. @martinpitt, @jelly, @mvollmer please check. |
This breaks a lot of Cockpit tests, all which want to connect to the user's session bus:
I picked a random journal and it has a lot of
Note that these tests don't run with homed, this is a "classic" user account. Aside from this: I'm really excited, thanks for this work! I've run homed on my laptop for many years now, and switched off SELinux because of it. |
Reproducer without cockpit, in a standard Fedora 40 VM: Install the COPR:
Then log in as user. This doesn't start the user's systemd session, nor a D-Bus, and the journal says
(and lots more) |
This repo policy for some reason didn't include the systemd-homed module for testing. sudo semanage module -l | grep systemd-homed
|
Cockpit tests failed for commit 6de9bf4. @martinpitt, @jelly, @mvollmer please check. |
This last run still fails all tests. The journal shows lots of
(and maybe I missed some more) |
Cockpit tests failed for commit e032607. @martinpitt, @jelly, @mvollmer please check. |
The rawhide failures still look very grim. Pretty much all cockpit tests fail on
I think this is still a regression in this PR. selinux/rawhide has been broken for a longer time already, see e.g. this recent run. But that "only" broke two tests, not all of them, and the failure is much more specific. |
Cockpit tests failed for commit e2378ed. @martinpitt, @jelly, @mvollmer please check. |
Cockpit tests failed for commit 17042b1. @martinpitt, @jelly, @mvollmer please check. |
This still breaks the user bus:
|
Testing
Enable homed features on Fedora
sudo systemctl enable --now \ systemd-homed
Relabel homed context
Create a testuser for homed