Can't log in to KDE

[lucasmz-dev]

I use Tavi's Brace (well my own fork that replaces a few configs) and it recommends the usage of fapolicyd, however it has not been possible to use it for me, as logging it does not work.

https://gitlab.com/divested/brace/-/issues/1

The relevant log I believe is:

jul 12 14:35:11 fedora fapolicyd[1574]: rule=13 dec=deny_log perm=execute auid=1000 pid=2441 exe=/usr/libexec/sddm-helper : path=/etc/sddm/wayland-session ftype=text/plain trust=0

Note: Brace enables integrity mode "sha256" or "size", neither work

[PhysicsIsAwesome]

I can confirm this is an issue on Fedora 42 fapolicyd-1.3.4-2.fc42.src.rpm. There seems to be a mismatch in file type and it's not in the trustdb, despite being shipped by the package manager.

File type:

admin@fedora:~$ file /etc/sddm/wayland-session
/etc/sddm/wayland-session: a /usr/bin/sh script, ASCII text executable
admin@fedora:~$ xdg-mime query filetype /etc/sddm/wayland-session
application/x-shellscript
admin@fedora:~$ fapolicyd-cli --ftype /etc/sddm/wayland-session
/usr/share/fapolicyd/fapolicyd-magic.mgc, 1: Warning: offset `�' invalid
/usr/share/fapolicyd/fapolicyd-magic.mgc, 3: Warning: offset `' invalid
������' invalidlicyd/fapolicyd-magic.mgc, 4: Warning: offset `
�' invalid/fapolicyd/fapolicyd-magic.mgc, 5: Warning: offset `
/usr/share/fapolicyd/fapolicyd-magic.mgc, 6: Warning: type `' invalid
B' invalid/fapolicyd/fapolicyd-magic.mgc, 7: Warning: offset `
o' invalid/fapolicyd/fapolicyd-magic.mgc, 8: Warning: offset `
text/plain

Are these warnings normal behavior?

Database:

sudo dnf provides /etc/sddm/wayland-session
sddm-0.21.0-9.fc42.x86_64 : QML based desktop and login manager
Repo         : @System
Matched From : 
Filename     : /etc/sddm/wayland-session

sddm-0.21.0-9.fc42.x86_64 : QML based desktop and login manager
Repo         : fedora
Matched From : 
Filename     : /etc/sddm/wayland-session

sudo fapolicyd-cli --dump-db | grep /etc/sddm/wayland-session

Integrity:
I also manually downloaded the RPM and compared sha256 hashes with the one installed on the system. They match, so this should not be an issue.

[radosroka]

If the file is not in the trustdb it was filtered out by /etc/fapolicyd/fapolicyd-filter.conf.

[PhysicsIsAwesome]

If the file is not in the trustdb it was filtered out by /etc/fapolicyd/fapolicyd-filter.conf.

I don't see where there is a filter matching the file:

cat fapolicyd-filter.conf 
# default filter file for fedora

+ /
 - usr/include/
 - usr/share/
  # Python byte code
  + *.py?
  # Python text files
  + *.py
  # Some apps have a private libexec
  + */libexec/*
  # Ruby
  + *.rb
  # Perl
  + *.pl
  # System tap
  + *.stp
  # Javascript
  + *.js
  # Java archive
  + *.jar
  # M4
  + *.m4
  # PHP
  + *.php
  # Perl Modules
  + *.pm
  # Lua
  + *.lua
  # Java
  + *.class
  # Typescript
  + *.ts
  # Typescript JSX
  + *.tsx
  # Lisp
  + *.el
  # Compiled Lisp
  + *.elc
 - usr/src/kernel*/
  + */scripts/*
  + */tools/objtool/*