Nigel Henry wrote:
On Monday 15 October 2007 19:57, Claude Jones wrote:
On Monday October 15 2007 1:35:17 pm Nigel Henry wrote:
but as
re-enabling SELinux, in either permissive, or enforcing mode
results in the relabelling process being run, it's almost
impossible to know if the relabelling has resolved a genuine
problem or not.
This is where you're mistaken. It's perfectly possible to set
permissive and enforcing modes, without relabeling - relabeling
is only forced after some updates, and that not very often -
perhaps, this is something that should be addressed. Perhaps a
warning message when you turn on enforcing, with instructions to
relabel if you've run in permissive mode for some period of
time...
--
Claude Jones
Brunswick, MD, USA
Well I disabled SELinux some weeks ago for some reason or other. I didn't want
to, as it had been behaving itself. Sorry, but I forget stuff easily these
days, and can't remember why I disabled it. Anyway when I re-enabled it as
forcing, and rebooted, it did the relabelling stuff. As I've said. I'm not
too clued up on SELinux, but it was running in enforcing mode, then I
disabled it (for some reason or other), and rebooted. Then I re-enabled it as
enforcing, rebooted, and by default it ran it's relabelling program.
Now I'm not too bothered about SELinux. I've seen it around since FC2, but for
the first time on Fedora 7 I've given it a try. I'm only a home user, so
nothing critical going on, and apart from the little FTP problem it's working
ok.
I'm not sure what you're saying though in your reply above. From what I
understand, if you disable SELinux (not sure if a reboot has to occur before
the next step), then re-enable SELinux in enforcing mode (as it was
previously). I found that re-enabling SELinux in enforcing mode, then
rebooting, resulted in the relabelling stuff being done. So is there some
incantation you can apply to the kernel on bootup to prevent SELinux doing
it's relabel stuff?
Nigel.
Hi Nigel, I think you can tell the SELinux loader not to relabel;
but once saying that I am pretty sure you WANT to relabel any time you
turn SELinux on, after it has been off. If you think your memory is
short my 72 year old head is overflowing with stuff and it has moved
down causing my tummy to be too round
I am running with SELinux on and will keep book on how long it runs
without a problem. The fellow with trouble in his http area sounds like
he made a lot of new directories and SELinux didn't like it. This sort
of thing may well hit me.
--
Karl F. Larsen, AKA K5DI
Linux User
#450462 http://counter.li.org.
