SELinux error with -584 kernel

[Michel Salim]

Hi,

I get audit errors when booting up (and similar messages when shutting
down) with the -1.584 kernel:

audit(1095879279.586:0): avc:  denied  { read write } for  pid=1701
exe=/sbin/minilogd name=console dev=tmpfs ino=993
scontext=user_u:system_r:syslogd_t tcontext=user_u:object_r:tmpfs_t
tclass=chr_file

(and lots of other messages like this one)

This does not happen under the -1.541 kernel that shipped with the
install media; is this normal, should I file a bug, and against the
kernel, selinux-policy-targetd, or mkinitrd?

Thanks,

[Colin Walters]

On Wed, 2004-09-22 at 19:04 -0500, Michel Salim wrote:
> Hi,
>
> I get audit errors when booting up (and similar messages when shutting
> down) with the -1.584 kernel:
>
> audit(1095879279.586:0): avc:  denied  { read write } for  pid=1701
> exe=/sbin/minilogd name=console dev=tmpfs ino=993
> scontext=user_u:system_r:syslogd_t tcontext=user_u:object_r:tmpfs_t
> tclass=chr_file

Dan says it's because the tmpfs xattr support was pulled for some
reason, it should be fixed in the next kernel revision.

[Gabriel Moreno]

I too was wondering since after recompiling my kernel I started to get
these errors.  will have to wait for next kernel release.  Its a pain
because you cant do anything on CLI all the messages wash up your
screen.

On Wed, 22 Sep 2004 20:17:39 -0400, Colin Walters  wrote:
> On Wed, 2004-09-22 at 19:04 -0500, Michel Salim wrote:
> > Hi,
> >
> > I get audit errors when booting up (and similar messages when shutting
> > down) with the -1.584 kernel:
> >
> > audit(1095879279.586:0): avc:  denied  { read write } for  pid=1701
> > exe=/sbin/minilogd name=console dev=tmpfs ino=993
> > scontext=user_u:system_r:syslogd_t tcontext=user_u:object_r:tmpfs_t
> > tclass=chr_file
>
> Dan says it's because the tmpfs xattr support was pulled for some
> reason, it should be fixed in the next kernel revision.
>
> --
> fedora-test-list mailing list
> [e-mail]
> To unsubscribe:
> http://www.redhat.com/mailman/listinfo/fedora-test-list

[Jon Savage]

> > > I get audit errors when booting up (and similar messages when shutting
> > > down) with the -1.584 kernel:
> >
> > Dan says it's because the tmpfs xattr support was pulled for some
> > reason, it should be fixed in the next kernel revision.

--snip--
2.6.8-1.541 kernel is current, the 584 was pulled. See if reverting to
541 solves your problem.

[Chuck Anderson]

On Sun, Oct 03, 2004 at 10:31:08AM -0700, Gabriel Moreno wrote:
> I too was wondering since after recompiling my kernel I started to get
> these errors.  will have to wait for next kernel release.  Its a pain
> because you cant do anything on CLI all the messages wash up your
> screen.

You can change the kernel log level with the Magic SysRq key sequence:

alt-sysrq-0 (loglevel 0) through alt-sysrq-8 (loglevel 8)

Firts enable Magic SysRq in /etc/sysctl.conf:

# Controls the System Request debugging functionality of the kernel
kernel.sysrq = 1

or manually:

sysctl -w kernel.sysrq=1