Right, that did it (after i started the oddjobd service, that is).<br><br>Now, the original reason i turned selinux back on was to use xguest....saddly, this isn't working still...<br><br><div class="gmail_quote">On Tue, Nov 4, 2008 at 11:21 AM, Daniel J Walsh <span dir="ltr"><<a href="mailto:dwalsh@redhat.com">dwalsh@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA1<br>
<div class="Ih2E3d"><br>
Matt Nicholson wrote:<br>
> So, I have an environment, where we pull user data/auth from ldap/kerberos<br>
> for a bunch of fedora workstations. I would love to have selinux turned on<br>
> on these, but, right now it jsut doesn't work with our setup.<br>
><br>
> See, your users home directories are in a few different places. for the most<br>
> part, LDAP think their home is at /n/home, or /n/data/home. So, i have /home<br>
> bind mounted to those locations, and, sith selinux off, its all nice and<br>
> happy. Another weird thing, is that /home is local on these workstations, so<br>
> when a user sits at a workstation for the first time, an empty homedir must<br>
> be created. We hope to move to nfs /home soon, but not yet.<br>
><br>
</div>Can you look at using pam_oddjob_mkhomedir rather then pam_mkhomedir<br>
<br>
yum install oddjob\*<br>
<br>
Should fix the problem.<br>
<div><div></div><div class="Wj3C7c"><br>
> once i turn it on, however, users cannot log in, and the home directoies<br>
> cannot be created. I get selinux messages like:<br>
><br>
> Summary:<br>
><br>
> SELinux is preventing sshd (sshd_t) "create" to ./nichols2 (home_root_t).<br>
><br>
> Detailed Description:<br>
><br>
> SELinux denied access requested by sshd. It is not expected that this access<br>
> is<br>
> required by sshd and this access may signal an intrusion attempt. It is also<br>
> possible that the specific version or configuration of the application is<br>
> causing it to require additional access.<br>
><br>
> Allowing Access:<br>
><br>
> Sometimes labeling problems can cause SELinux denials. You could try to<br>
> restore<br>
> the default system file context for ./nichols2,<br>
><br>
> restorecon -v './nichols2'<br>
><br>
> If this does not work, there is currently no automatic way to allow this<br>
> access.<br>
> Instead, you can generate a local policy module to allow this access - see<br>
> FAQ<br>
> (<a href="http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385" target="_blank">http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385</a>) Or you can<br>
> disable<br>
> SELinux protection altogether. Disabling SELinux protection is not<br>
> recommended.<br>
> Please file a bug report (<a href="http://bugzilla.redhat.com/bugzilla/enter_bug.cgi" target="_blank">http://bugzilla.redhat.com/bugzilla/enter_bug.cgi</a>)<br>
> against this package.<br>
><br>
> Additional Information:<br>
><br>
> Source Context system_u:system_r:sshd_t:s0-s0:c0.c1023<br>
> Target Context system_u:object_r:home_root_t:s0<br>
> Target Objects ./nichols2 [ dir ]<br>
> Source sshd<br>
> Source Path /usr/sbin/sshd<br>
> Port <Unknown><br>
> Host dhcp-0016533596-c5-74<br>
> Source RPM Packages openssh-server-5.1p1-2.fc9<br>
> Target RPM Packages<br>
> Policy RPM selinux-policy-3.3.1-103.fc9<br>
> Selinux Enabled True<br>
> Policy Type targeted<br>
> MLS Enabled True<br>
> Enforcing Mode Enforcing<br>
> Plugin Name catchall_file<br>
> Host Name dhcp-0016533596-c5-74<br>
> Platform Linux dhcp-0016533596-c5-74<br>
> 2.6.26.6-79.fc9.i686<br>
> #1 SMP Fri Oct 17 14:52:14 EDT 2008 i686 i686<br>
> Alert Count 1<br>
> First Seen Tue Nov 4 10:49:41 2008<br>
> Last Seen Tue Nov 4 10:49:41 2008<br>
> Local ID 803e925f-1d6e-4473-9054-dbaf0c0f3abd<br>
> Line Numbers<br>
><br>
> Raw Audit Messages<br>
><br>
> host=dhcp-0016533596-c5-74 type=AVC msg=audit(1225813781.838:89): avc:<br>
> denied { create } for pid=4956 comm="sshd" name="nichols2"<br>
> scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023<br>
> tcontext=system_u:object_r:home_root_t:s0 tclass=dir<br>
><br>
> host=dhcp-0016533596-c5-74 type=SYSCALL msg=audit(1225813781.838:89):<br>
> arch=40000003 syscall=39 success=no exit=-13 a0=b9b4f058 a1=1ed a2=8209e4<br>
> a3=b9b7d230 items=0 ppid=2341 pid=4956 auid=4294967295 uid=0 gid=0 euid=0<br>
> suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sshd"<br>
> exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)<br>
><br>
> Thats for an ssh login attempt. I get the same for one via GDM. I've tried<br>
> adding "context=system_r:object_r:home_root_t" when i bind mount the /home<br>
> on /n/home etc, and no luck so far. do I need to relabel /n ? what/how<br>
> should I? any help would be awesome.<br>
><br>
> Thanks,<br>
><br>
> Matt<br>
><br>
><br>
<br>
</div></div>-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v1.4.9 (GNU/Linux)<br>
Comment: Using GnuPG with Fedora - <a href="http://enigmail.mozdev.org" target="_blank">http://enigmail.mozdev.org</a><br>
<br>
iEYEARECAAYFAkkQdnUACgkQrlYvE4MpobPlnQCeI054kP0QjzCP1u4X5mr1yD9v<br>
/jgAoJLJ3lfNDoBwnlk4CcyLyw0s3qdh<br>
=Ly01<br>
-----END PGP SIGNATURE-----<br>
<font color="#888888"><br>
--<br>
fedora-list mailing list<br>
<a href="mailto:fedora-list@redhat.com">fedora-list@redhat.com</a><br>
To unsubscribe: <a href="https://www.redhat.com/mailman/listinfo/fedora-list" target="_blank">https://www.redhat.com/mailman/listinfo/fedora-list</a><br>
Guidelines: <a href="http://fedoraproject.org/wiki/Communicate/MailingListGuidelines" target="_blank">http://fedoraproject.org/wiki/Communicate/MailingListGuidelines</a><br>
</font></blockquote></div><br>