Steven Stern wrote:
On Fri, 12 Nov 2004 11:07:00 -0500, Daniel J Walsh <dwalsh@xxxxxxxxxx> wrote:
Steven Stern wrote:
Edit /etc/selinux/config and change the type of policy to
SELINUXTYPE=policyname.
What should "policyname" be?
targeted
You can try to convert to an SELinux environment by doing the following.
yum install selinux-policy-targeted
touch /.autorelabel
reboot
I tried it. On startup, NFSD failed, my milters failed, and nothing was
logging to /var/log/messages.
I changed to permissive and extracted all "avc:" messages from the log. The
log is attached as avc.txt. For now, I've changed the config to disabled. It
looks like SELINUX was either incompletely installed or not completely
configured. I suppose that enabling it only on fresh installs is a very good
idea!
------------------------------------------------------------------------
Nov 14 11:46:15 ciscy kernel: audit(1100454372.950:0): avc: denied { read } for pid=2337 exe=/sbin/syslogd name=ld.so.cache dev=hda2 ino=228954 scontext=user_u:system_r:syslogd_t tcontext=system_u:object_r:file_t tclass=file
Nov 14 11:46:15 ciscy kernel: audit(1100454372.950:0): avc: denied { getattr } for pid=2337 exe=/sbin/syslogd path=/etc/ld.so.cache dev=hda2 ino=228954 scontext=user_u:system_r:syslogd_t tcontext=system_u:object_r:file_t tclass=file
Nov 14 11:46:15 ciscy kernel: audit(1100454372.972:0): avc: denied { append } for pid=2338 exe=/sbin/syslogd name=messages dev=hda2 ino=589040 scontext=user_u:system_r:syslogd_t tcontext=system_u:object_r:file_t tclass=file
Nov 14 11:46:15 ciscy kernel: audit(1100454372.972:0): avc: denied { ioctl } for pid=2338 exe=/sbin/syslogd path=/var/log/messages dev=hda2 ino=589040 scontext=user_u:system_r:syslogd_t tcontext=system_u:object_r:file_t tclass=file
Nov 14 11:46:15 ciscy kernel: audit(1100454372.988:0): avc: denied { write } for pid=2338 exe=/sbin/syslogd dev=tmpfs ino=866 scontext=user_u:system_r:syslogd_t tcontext=user_u:object_r:tmpfs_t tclass=dir
Nov 14 11:46:15 ciscy kernel: audit(1100454372.988:0): avc: denied { remove_name } for pid=2338 exe=/sbin/syslogd name=log dev=tmpfs ino=7502 scontext=user_u:system_r:syslogd_t tcontext=user_u:object_r:tmpfs_t tclass=dir
Nov 14 11:46:15 ciscy kernel: audit(1100454372.988:0): avc: denied { unlink } for pid=2338 exe=/sbin/syslogd name=log dev=tmpfs ino=7502 scontext=user_u:system_r:syslogd_t tcontext=user_u:object_r:tmpfs_t tclass=sock_file
Nov 14 11:46:15 ciscy kernel: audit(1100454372.989:0): avc: denied { add_name } for pid=2338 exe=/sbin/syslogd name=log scontext=user_u:system_r:syslogd_t tcontext=user_u:object_r:tmpfs_t tclass=dir
Nov 14 11:46:15 ciscy kernel: audit(1100454372.989:0): avc: denied { create } for pid=2338 exe=/sbin/syslogd name=log scontext=user_u:system_r:syslogd_t tcontext=user_u:object_r:tmpfs_t tclass=sock_file
Nov 14 11:46:15 ciscy kernel: audit(1100454372.989:0): avc: denied { setattr } for pid=2338 exe=/sbin/syslogd name=log dev=tmpfs ino=7518 scontext=user_u:system_r:syslogd_t tcontext=user_u:object_r:tmpfs_t tclass=sock_file
Nov 14 11:46:15 ciscy kernel: audit(1100454373.620:0): avc: denied { search } for pid=2367 exe=/sbin/portmap dev=hda2 ino=2 scontext=user_u:system_r:portmap_t tcontext=system_u:object_r:file_t tclass=dir
Nov 14 11:46:15 ciscy kernel: audit(1100454373.620:0): avc: denied { read } for pid=2367 exe=/sbin/portmap name=ld.so.cache dev=hda2 ino=228954 scontext=user_u:system_r:portmap_t tcontext=system_u:object_r:file_t tclass=file
Nov 14 11:46:15 ciscy kernel: audit(1100454373.620:0): avc: denied { getattr } for pid=2367 exe=/sbin/portmap path=/etc/ld.so.cache dev=hda2 ino=228954 scontext=user_u:system_r:portmap_t tcontext=system_u:object_r:file_t tclass=file
Nov 14 11:46:15 ciscy kernel: audit(1100454373.653:0): avc: denied { search } for pid=2368 exe=/sbin/portmap dev=tmpfs ino=866 scontext=user_u:system_r:portmap_t tcontext=user_u:object_r:tmpfs_t tclass=dir
Nov 14 11:46:26 ciscy kernel: audit(1100454386.173:0): avc: denied { search } for pid=2619 exe=/usr/sbin/ntpdate dev=hda2 ino=2 scontext=user_u:system_r:ntpd_t tcontext=system_u:object_r:file_t tclass=dir
Nov 14 11:46:26 ciscy kernel: audit(1100454386.174:0): avc: denied { read } for pid=2619 exe=/usr/sbin/ntpdate name=ld.so.cache dev=hda2 ino=228954 scontext=user_u:system_r:ntpd_t tcontext=system_u:object_r:file_t tclass=file
Nov 14 11:46:26 ciscy kernel: audit(1100454386.174:0): avc: denied { getattr } for pid=2619 exe=/usr/sbin/ntpdate path=/etc/ld.so.cache dev=hda2 ino=228954 scontext=user_u:system_r:ntpd_t tcontext=system_u:object_r:file_t tclass=file
Nov 14 11:46:26 ciscy kernel: audit(1100454386.198:0): avc: denied { search } for pid=2619 exe=/usr/sbin/ntpdate dev=tmpfs ino=866 scontext=user_u:system_r:ntpd_t tcontext=user_u:object_r:tmpfs_t tclass=dir
Nov 14 11:46:26 ciscy kernel: audit(1100454386.198:0): avc: denied { write } for pid=2619 exe=/usr/sbin/ntpdate name=log dev=tmpfs ino=7518 scontext=user_u:system_r:ntpd_t tcontext=user_u:object_r:tmpfs_t tclass=sock_file
Nov 14 11:46:27 ciscy kernel: audit(1100454387.426:0): avc: denied { read } for pid=2622 exe=/usr/sbin/ntpd name=libcrypto.so.4 dev=hda2 ino=588932 scontext=user_u:system_r:ntpd_t tcontext=system_u:object_r:file_t tclass=lnk_file
Nov 14 11:49:01 ciscy dbus: avc: 1 AV entries and 1/512 buckets used, longest chain length 1
It does not look like the relabel was successful.
Try booting as single user, run fixfiles relabel and reboot.
Dan
