Re: [gentoo-hardened] locked out of selinux

[Markus Bartl]

Mike Edenfield schrieb: Markus Bartl wrote: Sep 29 20:20:22 odin type=1400 audit(1222712401.300:3): avc:  denied  { read write } for  pid=1 comm="init" path="/dev/console" dev=sda3 ino=1485226 scontext=system_u:system_r:init_t tcontext=system_u:object_r:file_t tclass=chr_file Sep 29 20:20:22 odin type=1400 audit(1222712401.304:4): avc:  denied  { ioctl } for  pid=1 comm="init" path="/dev/tty0" dev=sda3 ino=1485112 scontext=system_u:system_r:init_t tcontext=system_u:object_r:file_t tclass=chr_file Sep 29 20:20:22 odin type=1400 audit(1222712401.316:5): avc:  denied  { read write } for  pid=1081 comm="rc" name="console" dev=sda3 ino=1485226 scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:file_t tclass=chr_file Sep 29 20:20:22 odin type=1400 audit(1222712401.364:6): avc:  denied  { read write } for  pid=1083 comm="consoletype" name="console" dev=sda3 ino=1485226 scontext=system_u:system_r:consoletype_t tcontext=system_u:object_r:file_t tclass=chr_file Sep 29 20:20:22 odin type=1400 audit(1222712401.364:7): avc:  denied  { getattr } for  pid=1083 comm="consoletype" path="/dev/console" dev=sda3 ino=1485226 scontext=system_u:system_r:consoletype_t tcontext=system_u:object_r:file_t tclass=chr_file These are actually pretty harmless -- it just means your static /dev isn't labeled correctly.  This is because the stage3 tarballs don't have any SELinux information in them, so when you unpack it the /dev files are there with no labels, but by the time you get SELinux working enough to relabel your filesystems, udev has taken over /dev. If you want to get rid of these AVC's from your dmesg, you just need to relabel the static dev entries.  It's a bit tricky but you only need to do it once: # mkdir -p /mnt/realroot # mount -o bind / /mnt/realroot # setfiles -r /mnt/realroot \   /etc/selinux/strict/contexts/files/file_contexts \   /mnt/realroot/dev # umount /mnt/realroot *However*, I don't this this is really the cause of your problems. Gentoo's boot process is capable of continuing without access to /dev/console (though /dev/null may give it problems), and very early on udev mounted and everything fixes itself. Have you manually unmasked any packages related to booting?  In particular, openrc/baselayout2 won't work with the SELinux userland from portage, and have given me similar boot failures. Also, can you be more precise about what failed on boot?  How far does your boot process get? Do you get any of the normal Gentoo boot messages (the colorized ones)? --Mike Hi Folks! Thanks Mike. The above procedure solved the boot problem. Im now able to boot up in enforcing mode. What i still get is Sep 30 10:20:01 odin type=1400 audit(1222762783.108:5): avc:  denied  { read write } for  pid=1278 comm="modprobe" path="/dev/null" dev=tmpfs ino=1330 scontext=system_u:system_r:insmod_t tcontext=system_u:object_r:device_t tclass=chr_file ... Sep 30 10:20:01 odin type=1400 audit(1222762796.338:19): avc:  denied  { write } for  pid=2882 comm="runscript.sh" name="resolv.conf" dev=sda3 ino=1999328 scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:net_conf_t tclass=file Sep 30 10:20:01 odin type=1400 audit(1222762801.746:21): avc:  denied  { search } for  pid=3681 comm="syslog-ng" name="lib" dev=sda3 ino=770262 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_lib_t tclass=dir Sep 30 10:35:05 odin type=1400 audit(1222763686.716:3): avc:  denied  { write } for  pid=1150 comm="bash" name="null" dev=tmpfs ino=1330 scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:device_t tclass=chr_file Im not quite sure if the /dev/null thing is really a problem, but the reslov.conf thing is one, because i dont get an IP from DHCP later on during boot. Again any ideas are welcome. Regards, Markus