From b6caed3b57090126ad3cf8cfd7843a76ede06ec9 Mon Sep 17 00:00:00 2001 From: Alessandro Astone Date: Tue, 5 Aug 2025 15:31:56 +0200 Subject: [PATCH] nss-systemd: Grant access to the GDM user database GDM 49~beta implements a userdb VarLink service for managing the unix users running the greeter shell, as well as the gnome-initial-setup users. gdm-launch-environment][1892]: Gdm: GdmSessionWorker: determining if authenticated user (password required:0) is authorized to session unix_chkpwd[1897]: could not obtain user info (gdm-greeter) kernel: audit: type=1400 audit(1754399331.488:211): apparmor="DENIED" operation="connect" class="file" profile="unix-chkpwd" name="/run/systemd/userdb/org.gnome.DisplayManager" pid=1897 comm="unix_chkpwd" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=0 gdm-launch-environment][1892]: Gdm: GdmSessionWorker: user is not authorized to log in: Authentication failure LP: #2119541 --- profiles/apparmor.d/abstractions/nss-systemd | 1 + 1 file changed, 1 insertion(+) diff --git a/profiles/apparmor.d/abstractions/nss-systemd b/profiles/apparmor.d/abstractions/nss-systemd index 0d2683c88..7a4551483 100644 --- a/profiles/apparmor.d/abstractions/nss-systemd +++ b/profiles/apparmor.d/abstractions/nss-systemd @@ -25,6 +25,7 @@ @{run}/systemd/userdb/io.systemd.Home rw, # systemd-home dirs @{run}/systemd/userdb/io.systemd.NameServiceSwitch rw, # UNIX/glibc NSS @{run}/systemd/userdb/io.systemd.Machine rw, # systemd-machined + @{run}/systemd/userdb/org.gnome.DisplayManager rw, # GDM implements a user database for its greeter @{PROC}/sys/kernel/random/boot_id r,