WIP/HACK: get things working on fc43 silverblue with some hacks#11
Draft
RonnyPfannschmidt wants to merge 12 commits into
Draft
WIP/HACK: get things working on fc43 silverblue with some hacks#11RonnyPfannschmidt wants to merge 12 commits into
RonnyPfannschmidt wants to merge 12 commits into
Conversation
Trying to use howdy-beta on my Fedora 41 system results in SELinux
/var/log/audit/audit.log errors like:
```
type=AVC msg=audit(1731249683.384:270): avc: denied { map } for pid=2191 comm="python3" path="/dev/video2" dev="devtmpfs" ino=975 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:v4l_device_t:s0 tclass=chr_file permissive=0
```
I used `audit2allow` to create a working policy and have included it in
the package here.
Added dlib for fedora 43 temporarily, because dlib was retired
- Merge upstream PR principis#1 for SELinux policy - Add udev rules for video device permissions (video group) - Add gdm user to video group in %post for GDM login support - Reload udev rules after installation
A gruesome hack to work around authselect's "all or nothing" profile problem. Patches pam_howdy.so into existing authselect config rather than maintaining full profile copies. Includes systemd path unit to auto-reapply after authselect changes. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
…iles - Add systemd preset file (90-howdy-authselect.preset) to auto-enable the path unit on install - Run howdy-authselect enable during post-install to patch PAM immediately - Run howdy-authselect disable during pre-uninstall to clean up PAM - Patch both system-auth (sudo) and password-auth (GDM, login) - Watch both files for authselect changes 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The SELinux policy module was being installed to the wrong location (contexts/files/) which is for file contexts, not policy modules. This prevented the module from being loaded, causing GDM to be blocked from accessing the camera for face recognition. - Fix install path: selinux/targeted/howdy.pp (not contexts/files/) - Fix postun: use semodule -r (remove) instead of -d (disable) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
this draft pr is a hack/demo - i merged a few of the prs already here plus added some automation for most pam settings to get things working
in particular the hacks around the authselect should give people pause
I just let opus make this nasty hacks as i'm unaware of the popper way to do it and i just wanted it working first
now there’s some need to get rid of the disgust