After updating to Fedora 43, no one can log in to Thinlinc. They get Connecetion error: Thinlinc login failed. (No agent server was available).
The agent server is working fine. In the vsmagent.log is the error: WARNING tl-session: mkdir: Permission denied.
Tracing this error shows that it is trying to create a directory under /var/opt/thinlinc/sessions/ and fails. If the user directory exists it can’t create the session directory. If the user directory doesn’t exist, it can’t create the user directory.
This occurs under 4.18 and 4.19. This appears to be a selinux permission issue. I have rerun the thinlinc selinux config, but it didn’t fix it.
The selinux context of /var/opt/thinlinc/sessions is “system_u:object_r:usr_t:s0”
Changing the selinux context of /var/opt/thinlinc/sessions to “system_u:object_r:thinlinc_user_t:s0” fixes the directory creation problem, but it then fails again when it tries to create a symlink “.last.tl-session” to the newly created session directory.
Changing the selinux context of /var/opt/thinlinc/sessions to “system_u:object_r:thinlinc_session_root_t:s0” and removing all files under /var/opt/thinlinc/sessions fixed it. It’s odd, the selinux thinlinc policy was fine, it was loaded, but a restorecon would restore the contexts I listed originally. I just have to see if this sticks.
Thanks @michaelo, glad to hear you solved it. The SELinux context you mention in your last post looks correct, although I’m not sure why an OS upgrade would affect things in this way.
It sounds like the ThinLinc SELinux setup did not complete fully for some reason. I would suggest having a look in /var/log/tlsetup.log to see if there are any errors or warnings.
