Mike Edenfield schrieb:
Markus Bartl wrote:
max wrote:
If i compile a policy on Fedora this is always set to allow, if not I
usually run into problems like your having, I don't know enough about
gentoo to know if this is supposed to be this way here or not,
perhaps
someone else can supply the answer. The description in the
build.conf file:
The current policy being used by Gentoo is a few months behind the one
in Fedora (for technical reasons that hopefully will be resolved
soon). But that wouldn't be causing your problem. Those dmesg
warnings just mean the kernel you're running knows about the
permissions and classes that have been added since the policy snapshot
was taken. The base policy from portage *is* bootable in enforcing mode.
I know this wont help, but i got exactly the same issue.
If i try to boot in enforcing mode, init is blocked and the boot
sequence stops.
Some things to try:
1. Relabel everything. Improper file labels cause no end of problems
and *especially* in the boot process, since the wrong file context
leads to the wrong process context and everything just falls apart.
The safest way to do this is to switch to permissive mode, then do:
rlpkg -a -r
reboot
rlpkg -a -r # in case anything got created on shutdown/restart.
2. Once you've done that, check the following (still in permissive mode):
# ls -lZ /sbin/init /sbin/rc
(They should be labeled init_exec_t and initrc_exec_t, respectively.)
# cat /etc/selinux/strict/context/run_init_type
(should be run_init_t)
# ps axZ | grep init
(should be running as init_t)
# id -Z
(your user, role, and type should all match, like
staff_u:staff_r:staff_t, and not be something like kernel_t, sshd_t,
etc.)
--Mike
Hello.
Ok I did all the checks and everything is like it should be.
If i check my avc.log from the last reboot I get following entries:
Sep 29 20:20:22 odin type=1400 audit(1222712401.300:3): avc: denied {
read write } for pid=1 comm="init" path="/dev/console" dev=sda3
ino=1485226 scontext=system_u:system_r:init_t
tcontext=system_u:object_r:file_t tclass=chr_file
Sep 29 20:20:22 odin type=1400 audit(1222712401.304:4): avc: denied {
ioctl } for pid=1 comm="init" path="/dev/tty0" dev=sda3 ino=1485112
scontext=system_u:system_r:init_t tcontext=system_u:object_r:file_t
tclass=chr_file
Sep 29 20:20:22 odin type=1400 audit(1222712401.316:5): avc: denied {
read write } for pid=1081 comm="rc" name="console" dev=sda3 ino=1485226
scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:file_t
tclass=chr_file
Sep 29 20:20:22 odin type=1400 audit(1222712401.364:6): avc: denied {
read write } for pid=1083 comm="consoletype" name="console" dev=sda3
ino=1485226 scontext=system_u:system_r:consoletype_t
tcontext=system_u:object_r:file_t tclass=chr_file
Sep 29 20:20:22 odin type=1400 audit(1222712401.364:7): avc: denied {
getattr } for pid=1083 comm="consoletype" path="/dev/console" dev=sda3
ino=1485226 scontext=system_u:system_r:consoletype_t
tcontext=system_u:object_r:file_t tclass=chr_file
Maybe that helps to locate the problem.
Thanks all for your help!
Regards,
Markus
