From 8307ad8493637b9c8f20a1fe8446997ebe82b873 Mon Sep 17 00:00:00 2001 From: Christian Boltz Date: Wed, 6 Aug 2025 19:07:27 +0000 Subject: [PATCH] Merge nss-systemd: Grant access to the GDM user database GDM 49~beta implements a userdb VarLink service for managing the unix users running the greeter shell, as well as the gnome-initial-setup users. ``` gdm-launch-environment][1892]: Gdm: GdmSessionWorker: determining if authenticated user (password required:0) is authorized to session unix_chkpwd[1897]: could not obtain user info (gdm-greeter) kernel: audit: type=1400 audit(1754399331.488:211): apparmor="DENIED" operation="connect" class="file" profile="unix-chkpwd" name="/run/systemd/userdb/org.gnome.DisplayManager" pid=1897 comm="unix_chkpwd" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=0 gdm-launch-environment][1892]: Gdm: GdmSessionWorker: user is not authorized to log in: Authentication failure ``` MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1761 Approved-by: Ryan Lee Merged-by: John Johansen (cherry picked from commit fedcab2ad0e4101eeec55164ce8a75a1d189b1e8) b6caed3b nss-systemd: Grant access to the GDM user database Co-authored-by: John Johansen --- profiles/apparmor.d/abstractions/nss-systemd | 1 + 1 file changed, 1 insertion(+) diff --git a/profiles/apparmor.d/abstractions/nss-systemd b/profiles/apparmor.d/abstractions/nss-systemd index 0d2683c88..7a4551483 100644 --- a/profiles/apparmor.d/abstractions/nss-systemd +++ b/profiles/apparmor.d/abstractions/nss-systemd @@ -25,6 +25,7 @@ @{run}/systemd/userdb/io.systemd.Home rw, # systemd-home dirs @{run}/systemd/userdb/io.systemd.NameServiceSwitch rw, # UNIX/glibc NSS @{run}/systemd/userdb/io.systemd.Machine rw, # systemd-machined + @{run}/systemd/userdb/org.gnome.DisplayManager rw, # GDM implements a user database for its greeter @{PROC}/sys/kernel/random/boot_id r,