Peter Gordon wrote:
On Sat, 2008-02-16 at 15:19 +0100, Roger Grosswiler wrote:
So, now, what is fact? is this blocking or just saying that it is
blocking?
My understanding is that you are correct about this. "Permissive" only
logs these denials of what _would_ happen should you switch the SELinux
configuration to "enforcing" mode. However, the access is still granted.
Further to what Peter said:
Because selinux is permitting the first item, sometimes this leads to a
second or more selinux denial warning. If selinux were enforcing, you
would only see the first message, where it blocked a certain access -
end of story.
What does sestatus say ?
# sestatus
SELinux status: enabled
SELinuxfs mount: /selinux
Current mode: enforcing
Mode from config file: enforcing
Policy version: 21
Policy from config file: targeted
Some issues might be resolved with restorecon: {don't apply, recurse,
verbose}
# restorecon -nrv /
, which could let you see files with bad contexts as a diagnostic,
before actually doing {suggested best to do during reboot}:
http://docs.fedoraproject.org/selinux-faq-fc5/#id2961890
DaveT.
