Re: Selinux: Blocked-Messages in permissive mode?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Peter Gordon wrote:
On Sat, 2008-02-16 at 15:19 +0100, Roger Grosswiler wrote:
So, now, what is fact? is this blocking or just saying that it is
blocking?

My understanding is that you are correct about this. "Permissive" only
logs these denials of what _would_ happen should you switch the SELinux
configuration to "enforcing" mode. However, the access is still granted.
Further to what Peter said:
Because selinux is permitting the first item, sometimes this leads to a second or more selinux denial warning. If selinux were enforcing, you would only see the first message, where it blocked a certain access - end of story.

What does sestatus say ?
# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   enforcing
Mode from config file:          enforcing
Policy version:                 21
Policy from config file:        targeted

Some issues might be resolved with restorecon: {don't apply, recurse, verbose}
# restorecon -nrv /

, which could let you see files with bad contexts as a diagnostic, before actually doing {suggested best to do during reboot}:

http://docs.fedoraproject.org/selinux-faq-fc5/#id2961890

DaveT.


[Index of Archives]     [Current Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [Yosemite Photos]     [KDE Users]     [Fedora Tools]     [Fedora Docs]

  Powered by Linux