Chris PeBenito wrote:
On Tue, 2007-03-06 at 15:33 -0500, Mike Edenfield wrote:
Sorry for the slow response. These messages are likely due to the
static device nodes under a udev /dev. There isn't a good way to
automatically relabel these device nodes. The best way would be to
reboot with udev temporarily disabled, then do `restorecon -R /dev`,
then boot up with udev reenabled. I believe gentoo=noudev on the kernel
command line will still disable udev during booting. Alternatively you
can use the RC_DEVICES setting in /etc/conf.d/rc to enable or disable
udev on boot.
Thanks for this, and also to the person who wrote the
previous reply recommending a static /dev. (I meant to
reply sooner but have been on vacation). This actually
eliminated a big chunk of my problems.
I'm still hoping someone can point me to a more general
tutorial on troubleshooting these types of errors. Now that
I'm trying to get actual services running on the system, I'm
obviously having more of them, and I don't want to waste
this list's time trying to explain every one of them to me
:x Things like this (two of which I assume are being
generated because I'm running dhcpcd on this machine at boot):
Mar 13 06:39:09 [kernel] audit(1173782339.840:57): avc:
denied { write } for pid=2775 comm="runscript.sh"
name="resolv.conf" dev=hda3 ino=1556987
scontext=system_u:system_r:initrc_t
tcontext=system_u:object_r:net_conf_t tclass=file
Mar 13 06:39:09 [kernel] audit(1173782339.850:58): avc:
denied { setattr } for pid=2989 comm="chmod"
name="resolv.conf" dev=hda3 ino=1556987
scontext=system_u:system_r:initrc_t
tcontext=system_u:object_r:net_conf_t tclass=file
Mar 13 06:39:09 [kernel] audit(1173782348.950:59): avc:
denied { ptrace } for pid=4000 comm="pidof"
scontext=system_u:system_r:initrc_t
tcontext=system_u:system_r:init_t tclass=process
Mar 13 06:39:09 [kernel] audit(1173782348.950:60): avc:
denied { ptrace } for pid=4000 comm="pidof"
scontext=system_u:system_r:initrc_t
tcontext=system_u:system_r:kernel_t tclass=process
Obviously, I can get rid of these by adding rules like this:
allow initrc_t init_t:process ptrace;
allow initrc_t kernel_t:process ptrace;
allow initrc_t net_conf_t:file { setattr write };
My question is more theoretical, that is, is there a reason
why those rules aren't *already* there? Is it normal to
have to tweak the policy files right out of the box, or
after installing a new ebuild, and I should feel "ok" with
doing it? Or does it point to a bigger problem with my
install that I messed up and need to fix?
Thanks for being patient with me :)
--
-- Mike
Still using IE? Get Firefox!
http://www.spreadfirefox.com/?q=affiliates&id=6492&t=1
--
[email protected] mailing list
