I have a number of testing systems installed with Fedora 14. They were installed with the minimal profile, have no 3rd party repositories or rpm's installed, are fully up-to-date, and were exhibiting some strange behavior with the corosync/pacemaker packages.
The problems with corosync are a direct result of the system not respecting the /etc/sysconfog/selinux directives. I have attached some sessions below to show the errant behavior.
Boot 1: [root@tiny ~]# uptime 08:30:43 up 0 min, 1 user, load average: 0.15, 0.06, 0.02 [root@tiny ~]# getenforce Enforcing [root@tiny ~]# more /etc/sysconfig/selinux
# This file controls the state of SELinux on the system. # SELINUX= can take one of these three values: # enforcing - SELinux security policy is enforced. # permissive - SELinux prints warnings instead of enforcing. # disabled - No SELinux policy is loaded. SELINUX=permissive # SELINUXTYPE= can take one of these two values: # targeted - Targeted processes are protected, # mls - Multi Level Security protection. SELINUXTYPE=targeted
Boot 2: [root@tiny ~]# uptime 08:33:01 up 0 min, 1 user, load average: 0.30, 0.06, 0.02 [root@tiny ~]# getenforce Enforcing [root@tiny ~]# cat /etc/sysconfig/selinux
# This file controls the state of SELinux on the system. # SELINUX= can take one of these three values: # enforcing - SELinux security policy is enforced. # permissive - SELinux prints warnings instead of enforcing. # disabled - No SELinux policy is loaded. SELINUX=disabled # SELINUXTYPE= can take one of these two values: # targeted - Targeted processes are protected, # mls - Multi Level Security protection. SELINUXTYPE=targeted
After a call to setenforce 0 [root@tiny ~]# getenforce Permissive
As you can clearly see the SELINUX directive is being ignored during boot. I have had to move startup of the affected packages to /etc/rc.local after a call to setenforce 0.
Cheers, Eric Warnke Research IT Group SUNY at Albany
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 05/11/2011 04:31 PM, Eric Warnke wrote:
The problems with corosync are a direct result of the system not respecting the /etc/sysconfog/selinux directives.
Is /etc/sysconfig/selinux also a symbolic links to /etc/selinux/config on your system?
This is what i see on rawhide:
lrwxrwxrwx. root root system_u:object_r:etc_t:s0 selinux -> ../selinux/config
rpm -qf /etc/sysconfig/selinux selinux-policy-3.9.16-15.fc16.noarch
My fedora 14 configuration seems to not even have a /etc/sysconfig/selinux softlink. Although rpm -qf /etc/sysconfig/selinux does return the selinux-policy package.
What happens if you modify /etc/selinux/config directly?
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 05/11/2011 04:41 PM, Dominick Grift wrote:
On 05/11/2011 04:31 PM, Eric Warnke wrote:
The problems with corosync are a direct result of the system not respecting the /etc/sysconfog/selinux directives.
Is /etc/sysconfig/selinux also a symbolic links to /etc/selinux/config on your system?
This is what i see on rawhide:
lrwxrwxrwx. root root system_u:object_r:etc_t:s0 selinux -> ../selinux/config
rpm -qf /etc/sysconfig/selinux selinux-policy-3.9.16-15.fc16.noarch
My fedora 14 configuration seems to not even have a /etc/sysconfig/selinux softlink. Although rpm -qf /etc/sysconfig/selinux does return the selinux-policy package.
What happens if you modify /etc/selinux/config directly?
- -- selinux mailing list selinux@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/selinux
Yes I would suspect you broke the link. /etc/selinux/config is the correct location to modify with /etc/sysconfig/selinux a symbolic link
( Sent this yesterday from the wrong account, didn't make the list )
Nailed it in one. I guess I had presumed that /etc/sysconfig/selinux was authoritative.
-rw-r--r--. 1 root root 457 May 11 08:32 selinux lrwxrwxrwx. 1 root root 17 May 10 08:12 selinux.gres -> ../selinux/config
Looks like I ran sed on the wrong file.
Eric
On 5/11/11 5:37 PM, "Daniel J Walsh" dwalsh@redhat.com wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 05/11/2011 04:41 PM, Dominick Grift wrote:
On 05/11/2011 04:31 PM, Eric Warnke wrote:
The problems with corosync are a direct result of the system not respecting the /etc/sysconfog/selinux directives.
Is /etc/sysconfig/selinux also a symbolic links to /etc/selinux/config on your system?
This is what i see on rawhide:
lrwxrwxrwx. root root system_u:object_r:etc_t:s0 selinux -> ../selinux/config
rpm -qf /etc/sysconfig/selinux selinux-policy-3.9.16-15.fc16.noarch
My fedora 14 configuration seems to not even have a /etc/sysconfig/selinux softlink. Although rpm -qf /etc/sysconfig/selinux does return the selinux-policy package.
What happens if you modify /etc/selinux/config directly?
selinux mailing list selinux@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/selinux
Yes I would suspect you broke the link. /etc/selinux/config is the correct location to modify with /etc/sysconfig/selinux a symbolic link -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAk3LAZcACgkQrlYvE4MpobMlggCg5uZMoZ8ZD56YOl9+TAp8jTvF yNgAni/6FMRqAXcF1bm64/xIlkSIMLrN =pN7+
-----END PGP SIGNATURE-----
selinux mailing list selinux@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/selinux
selinux@lists.fedoraproject.org
-
Daniel J Walsh -
Dominick Grift -
Eric Warnke