SELinux revisited

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Greetings;

Running 2.6.23 here, on a AMD XP-2800, gig of ram, lots of drive.

I thought maybe I should give selinux another chance here.  So I removed the 
selinux=0 in my grub.conf, and edited its .conf file in /etc/sysconfig to set 
it for permissive.

On the reboot, the relabel wasn't done, so I looked around and reset a 
fresh /.autorelabel file and rebooted again.  It was already present however.

This time it did a very short autorelabel, maybe 2 screens full and was done 
in just a couple of seconds, at which point it went into yet another reboot 
cycle making me think it was stuck in a loop or something.

But the next reboot then had auditd advise me there was an error in line 16 
of /etc/audit/auditd.rules.
------------
# This file contains the auditctl rules that are loaded
# whenever the audit daemon is started via the initscripts.
# The rules are simply the parameters that would be passed
# to auditctl.

# First rule - delete all
-D

# Increase the buffers to survive stress events.
# Make this bigger for busy systems
-b 320

# Feel free to add below this line. See auditctl man page

-a exit,always -S chroot
-a exit,always -S chdir -F obj_type=dhclient_t
-a exit,always -S chdir -F obj_type=sendmail_t
-a exit,always -S chdir -F obj_type=mcstransd_t
-a exit,always -S chdir -F obj_type=sshd_t
-a exit,always -S chdir -F obj_type=ntpd_t
-a exit,always -S chdir -F obj_type=samba_t
-a exit,always -S chdir -F obj_type=named_t
-a exit,always -S chdir -F obj_type=klogd_t
-a exit,always -S chdir -F obj_type=crond_t
-a exit,always -S chdir -F obj_type=httpd_t
-a exit,always -S chdir -F obj_type=auditd_t
-a exit,always -S chdir -F obj_type=portmap_t
-a exit,always -S chdir -F obj_type=syslogd_t
-----------
Not having any idea if it counts lines by lf's, or if it ignores commented 
lines in its line count, so I have NDI what its fussing about.  FWIW, I am 
not running a dhcp network, just a server so my lappy can log in.  Everything 
else is in my /etc/hosts file.

Watching the audit.log with a tail, res=success seems to be a 100% answer so 
far.

1. The last time I watched an autorelabel, it took about 10 minutes, why was 
it done this time in <2 secs?

2. What can I do about the rules error?

-- 
Cheers, Gene
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
The difference between reality and unreality is that reality has so
little to recommend it.
		-- Allan Sherman


[Index of Archives]     [Current Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [Yosemite Photos]     [KDE Users]     [Fedora Tools]     [Fedora Docs]

  Powered by Linux