enforce mode problems

enforce mode problems

[Carlos Anísio Monteiro]

Hi.

When I switch to enforce mode (echo 1 > /selinux/enforce), a lot of 
messages "avc" running in the console and the computer "freeze".
I am not succeeding in to resolve this avc messages. I note that this 
avc messages, mostly,  are associate to the system_u:system_r:kernel_t 
context trying access another context.

Please, anyone could me help.

Thanks.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: enforce mode problems

[Stephen Smalley]

On Wed, 2003-10-15 at 07:11, Carlos Anísio Monteiro wrote:
> Hi.
> 
> When I switch to enforce mode (echo 1 > /selinux/enforce), a lot of 
> messages "avc" running in the console and the computer "freeze".
> I am not succeeding in to resolve this avc messages. I note that this 
> avc messages, mostly,  are associate to the system_u:system_r:kernel_t 
> context trying access another context.
> 
> Please, anyone could me help.

You need to address the avc messages before switching into enforcing
mode.  From the sound of it, you still haven't labeled your
filesystems.  Did you run 'make relabel' to completion?  What does ls -Z
/sbin/init show?

-- 
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: enforce mode problems

[Carlos Anísio Monteiro]

[-- Attachment #1: Type: text/plain, Size: 532 bytes --]

Stephen Smalley wrote:

>You need to address the avc messages before switching into enforcing
>mode.  From the sound of it, you still haven't labeled your
>filesystems.  Did you run 'make relabel' to completion?  What does ls -Z
>/sbin/init show?
>
>  
>
1) Yes, 'make relabel' to completion. I think that all filesystem  is 
labeled, except /selinux and /proc directories.

2) ls -Z /sbin/init
    invalid option.

obs.:
ls --context /sbin/init
-rwxr-xr-x  root     root     system_u:object_r:init_exec_t    /sbin/init

Regards.



[-- Attachment #2: Type: text/html, Size: 871 bytes --]