Re: Help: SELinux causing(?) boot failures...

[Paul Moore <paul.moore@hp.com>]

On Friday 08 August 2008 1:19:26 pm Mike Edenfield wrote:
> Paul Moore wrote:
> > On Friday 08 August 2008 11:46:23 am Mike Edenfield wrote:
> >> The reason I strongly suspect SELinux is the problem (or at least
> >> a major factor), is that adding "selinux=0" to my boot command
> >> line corrects the problem, and the system boots fine.  Everything
> >> appears to be installed and configured correctly, except obviously
> >> SELinux is now disabled.  The filesystems are all labeled
> >> correctly, and even on the failing boot the AVC messages display
> >> the correct labels, like tty_device_t and urandom_device_t.
> >
> > Hi Mike,
> >
> > In general, you are better off using "enforcing=0", which keeps
> > SELinux enabled but puts it into permissive mode, on the kernel
> > command line instead of "selinux=0", which disables SELinux
> > entirely.  Have you tried rebooting with "enforcing=0" and
> > capturing the AVC messages from the console/audit/syslog output and
> > seeing if anything looks awry?  If not go ahead and do so and send
> > them to the list, this will tell us what actions are being denied
> > and why.
>
> I have SELinux configured for permissive mode to begin with, but I
> tried adding "enforcing=0" to the boot command line to no effect.

Sorry, based on the problems you were seeing I assumed you were running 
in enforcing mode, I guess the old adage about "assuming" applies 
here :(

> Here are the denials I am getting:
>
> (transcribed by hand since neither syslog nor auditd are starting)

Since you went to the trouble to transcribe all the messages by hand I 
really need to apologize!  Since you are running in permissive mode I 
doubt SELinux is the source of all the strange behavior you are seeing; 
in permissive mode SELinux will alert you of access denials (AVC 
messages) but it won't actually deny the access.

What I don't understand is why you are seeing such a substantial 
difference between disabling SELinux entirely and running it in 
permissive mode.  Have you contacted the Gentoo folks about the 
problem?  I'm beginning to think your problems may be distro related.

> avc: denied { execute_no_trans } for pid=1 comm="init"
> path="/sbin/init" dev=sda3 ino=920038
> scontext=system_u:system_r:kernel_t
> tcontext=system_u:object_r:file_t tclass=file
> avc: denied { read } for pid=1 comm="init" name="ld-linux.so.2"
> dev=sda3 ino=1785880 scontext=system_u:system_r:kernel_t
> tcontext=system_u:object_r:file_t tclass=lnk_file
> avc: denied { getattr } for pid=1 comm="init" path="/etc/ld.so.cache"
> dev=sda3 ino=1090186 scontext=system_u:system_r:kernel_t
> tcontext=system_t:object_r:file_t tclass=file
> avc: denied { read } for pid=1 comm="init" name="udanrom" dev=sda3
> ino=126002 scontext=system_u:system_r:kernel_t
> tcontext=system_u:object_r:urandom_device_t tclass=chr_file
> avc: denied { getattr } for pid=1 comm="init" name="/" dev=selinuxfs
> ino=1 scontext=system_u:system_r:kernel_t
> tcontext=system_t:object_r:security_t tclass=filesystem
> avc: denied { read write } for pid=1 comm="init" name="tty0" dev=sda3
> ino=126327 scontext=system_u:system_r:kernel_t
> tcontext=system_u:object_r:tty_device_t tclass=chr_file

-- 
paul moore
linux @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.