selinux alerts and livecd doesn't boot

[Chitlesh GOORAH]

Hello there,

i did a clean installation of the FEL F8T2 livecd.
then did the updates
then yum install livecd-tools (012)

I created a livecd like i used to do.
however during the installation of the packages for the livecd, there
are lots of selinux denial notification popped on the system tray.

it's nice to see the selinux notifier being integrated into the KDE desktop.

however, non of my 7 livecds I recreated was bootable.
during the build i can see restorecon /proc/1xxxx : permission denied.

I'm wondering if the livecd creation procedures have been changed
again that im unaware of or it's a bug.


see attachments.

chitlesh

-- 
http://clunixchit.blogspot.com

[Chitlesh GOORAH]

On 9/30/07, Chitlesh GOORAH wrote:
>  Hello there,
>
>  i did a clean installation of the FEL F8T2 livecd.
>  then did the updates
>  then yum install livecd-tools (012)
>
>  I created a livecd like i used to do.
>  however during the installation of the packages for the livecd, there
>  are lots of selinux denial notification popped on the system tray.
>
>  it's nice to see the selinux notifier being integrated into the KDE desktop.
>
>  however, non of my 7 livecds I recreated was bootable.
>  during the build i can see restorecon /proc/1xxxx : permission denied.
>
>  I'm wondering if the livecd creation procedures have been changed
>  again that im unaware of or it's a bug. 
On a F7 box with all the updates, it doesn't even build :

/sbin/restorecon reset /root/.tcshrc context
root:object_r:user_home_t:s0->root:object_r:sysadm_home_t:s0
/sbin/restorecon reset /lib/udev/devices context
system_u:object_r:lib_t:s0->system_u:object_r:device_t:s0
/sbin/restorecon reset /lib/dbus-1/dbus-daemon-launch-helper context
system_u:object_r:lib_t:s0->system_u:object_r:bin_t:s0
Read error on pipe.
Building an initramfs at /boot/livecd-initramfs.img for kernel
2.6.23-0.214.rc8.git2.fc8
Done; initramfs is 4.5M.

Traceback (most recent call last):
  File "/usr/bin/livecd-creator", line 1480, in <module>
    sys.exit(main())
  File "/usr/bin/livecd-creator", line 1460, in main
    target.unmount()
  File "/usr/bin/livecd-creator", line 484, in unmount
    self.ayum.close()
  File "/usr/lib/python2.5/site-packages/yum/__init__.py", line 92, in close
    self._repos.close()
  File "/usr/lib/python2.5/site-packages/yum/repos.py", line 76, in close
    repo.close()
  File "/usr/lib/python2.5/site-packages/yum/yumRepo.py", line 257, in close
    self.sack.close()
  File "/usr/lib/python2.5/site-packages/yum/sqlitesack.py", line 233, in close
    del self.pkgobjlist
AttributeError: pkgobjlist


-- 
http://clunixchit.blogspot.com

Livecd doesn't boot ... in my case it reports a bad MBR

[Tim Wood]

Strange timing.  I've got a linux machine (running under vmware)  
that's dedicated to livecd's.  I've been working on a livecd project  
around other things.  I created several LiveCDs a day successfully  
over the last few weeks.  Then, starting sometime yesterday, every  
one causes vmware to report a bad MBR when I try to boot them.  It  
may or may not be related to Chitlesh's problem...

I'll call the machine I"m using to create the LiveCDs 'dev'.  Here's 

what I've been able to locate that seems remotely relevant.

dev runs fedora 7 and is set to automatically update with the latest  
patches (i.e. yum may have gone and installed an update yesterday  
that caused the problem)
SE Linux is off on dev

/var/log/messages on dev:
* "... localhost kernel: SELinux: Disabled at runtime."
* Just before the install: "localhost kernel: CIFS VFS: Send error in  
SETFSUnixInfo = -5" may not be relevant but the kickstarts are on a  
mounted samba share
* in the middle of installing packages reports "... localhost init:  
Trying to re-exec init"

/var/log/yum.log on dev
* nothing in the last several weeks

/var/log/revisor.log on dev
* mirrors the messages that /srv/revisor and /var/tmp/revisor already  
exist

When I'm building the livecd's, I'm manually unchecking the SELinux  
checkbox at the appropriate screen.

FWIW... being the stodgy type I am, I'm trying to wait for FC8 to hit  
release before switching.  Revisor under 7 (2.041) has issues but I  
know what they are and how to work with them.

I've tried this roughly four times with identical results.  To make  
sure that I didn't forget to do it, I've just restarted dev and  
manually deleted /var/tmp/revisor* and /srv/revsior*.   I'm re- 
running a build to see what happens.  Assuming that doesn't solve  
things, any suggestions on running this down?

Tim



On Sep 30, 2007, at 4:57 AM, Chitlesh GOORAH wrote:

>  On 9/30/07, Chitlesh GOORAH wrote:
> > Hello there,
> >
> > i did a clean installation of the FEL F8T2 livecd.
> > then did the updates
> > then yum install livecd-tools (012)
> >
> > I created a livecd like i used to do.
> > however during the installation of the packages for the livecd, there
> > are lots of selinux denial notification popped on the system tray.
> >
> > it's nice to see the selinux notifier being integrated into the  
> > KDE desktop.
> >
> > however, non of my 7 livecds I recreated was bootable.
> > during the build i can see restorecon /proc/1xxxx : permission  
> > denied.
> >
> > I'm wondering if the livecd creation procedures have been changed
> > again that im unaware of or it's a bug.
>
>  On a F7 box with all the updates, it doesn't even build :
>
>  /sbin/restorecon reset /root/.tcshrc context
>  root:object_r:user_home_t:s0->root:object_r:sysadm_home_t:s0
>  /sbin/restorecon reset /lib/udev/devices context
>  system_u:object_r:lib_t:s0->system_u:object_r:device_t:s0
>  /sbin/restorecon reset /lib/dbus-1/dbus-daemon-launch-helper context
>  system_u:object_r:lib_t:s0->system_u:object_r:bin_t:s0
>  Read error on pipe.
>  Building an initramfs at /boot/livecd-initramfs.img for kernel
>  2.6.23-0.214.rc8.git2.fc8
>  Done; initramfs is 4.5M.
>
>  Traceback (most recent call last):
>    File "/usr/bin/livecd-creator", line 1480, in <module>
>      sys.exit(main())
>    File "/usr/bin/livecd-creator", line 1460, in main
>      target.unmount()
>    File "/usr/bin/livecd-creator", line 484, in unmount
>      self.ayum.close()
>    File "/usr/lib/python2.5/site-packages/yum/__init__.py", line 92,  
>  in close
>      self._repos.close()
>    File "/usr/lib/python2.5/site-packages/yum/repos.py", line 76, in  
>  close
>      repo.close()
>    File "/usr/lib/python2.5/site-packages/yum/yumRepo.py", line 257,  
>  in close
>      self.sack.close()
>    File "/usr/lib/python2.5/site-packages/yum/sqlitesack.py", line  
>  233, in close
>      del self.pkgobjlist
>  AttributeError: pkgobjlist
>
>
>  -- 
>  http://clunixchit.blogspot.com
>
>  --
>  Fedora-livecd-list mailing list
>  Fedora-livecd-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-livecd-list
>

[Jeremy Katz]

On Sun, 2007-09-30 at 12:20 +0200, Chitlesh GOORAH wrote:
>  I created a livecd like i used to do.
>  however during the installation of the packages for the livecd, there
>  are lots of selinux denial notification popped on the system tray. 
Yeah, most of this is just noise due to chroots and SELinux not being
very smart with chroots :(

>  however, non of my 7 livecds I recreated was bootable.
>  during the build i can see restorecon /proc/1xxxx : permission denied. 
It might be that policy has changed such that creating F7 live images
with F8 isn't working.  I haven't tried an F7 image in a while.  I'll
try to kick one off to see what happens after I finish getting the test3
images taken care of.

Jeremy

[Chitlesh GOORAH]

On 10/1/07, Jeremy Katz <katzj(a)redhat.com&gt; wrote:
>  > however, non of my 7 livecds I recreated was bootable.
>  > during the build i can see restorecon /proc/1xxxx : permission denied.
>
>  It might be that policy has changed such that creating F7 live images
>  with F8 isn't working.  I haven't tried an F7 image in a while.  I'll
>  try to kick one off to see what happens after I finish getting the test3
>  images taken care of. 
By "7", I mean 7 (the number) and not F7.
I'm unable to create rawhide images since this weekend.

Are you using something special ?

I'm just trying to create live images on an updated rawhide box, but in vain.

Chitlesh
-- 
http://clunixchit.blogspot.com

[Douglas McClendon]

Jeremy Katz wrote:
>  On Sun, 2007-09-30 at 12:20 +0200, Chitlesh GOORAH wrote:
>    
> > I created a livecd like i used to do.
> > however during the installation of the packages for the livecd, there
> > are lots of selinux denial notification popped on the system tray.
> >     
>
>  Yeah, most of this is just noise due to chroots and SELinux not being
>  very smart with chroots :(
>
>    
> > however, non of my 7 livecds I recreated was bootable.
> > during the build i can see restorecon /proc/1xxxx : permission denied.
> >     
>
>  It might be that policy has changed such that creating F7 live images
>  with F8 isn't working.  I haven't tried an F7 image in a while.  I'll
>  try to kick one off to see what happens after I finish getting the test3
>  images taken care of.
>     
FWIW, I'm trying the following, for the first time-  (this has nothing 
to do with my other selinux problems)

f7+updates install, selinux enabled

git livecd-tools
rawhide pykickstart srcrpm rebuilt (parse error otherwise on 
livecd-fedora-desktop.ks)

simple build of livecd-fedora-desktop as is (with cachedir)

It died on me once early, and then twice at the end with the output 
pasted below (haven't been able to get it to work).

I just got these (and others) in my setroubleshoot-  (note, the system 
was just installed prior to this, so it is unlikely something that I 
have misconfigured along the way)

avc: denied { write } for comm="ldconfig" dev=loop1 egid=0 euid=0 
exe="/sbin/ldconfig" exit=-13 fsgid=0 fsuid=0 gid=0 items=0 
name="ldconfig" pid=8518 scontext=user_u:system_r:ldconfig_t:s0 sgid=0 
subj=user_u:system_r:ldconfig_t:s0 suid=0 tclass=dir 
tcontext=system_u:object_r:var_t:s0 tty=pts4 uid=0

I figured I'd post all of this, since it seems to be the inverse of what 
was described.  I.e. this is building F8 on F7+updates (not building F7 
on F8).  

  Installing: anaconda                     ##################### [850/851]
  Installing: system-config-boot           ##################### [851/851]
error reading information on service dhcdbd: No such file or directory
Building an initramfs at /boot/livecd-initramfs.img for kernel 
2.6.23-0.214.rc8.git2.fc8
Done; initramfs is 4.5M.

Traceback (most recent call last):
  File "./livecd-creator", line 1503, in <module>
    sys.exit(main())
  File "./livecd-creator", line 1483, in main
    target.unmount()
  File "./livecd-creator", line 503, in unmount
    self.ayum.close()
  File "/usr/lib/python2.5/site-packages/yum/__init__.py", line 92, in close
    self._repos.close()
  File "/usr/lib/python2.5/site-packages/yum/repos.py", line 76, in close
    repo.close()
  File "/usr/lib/python2.5/site-packages/yum/yumRepo.py", line 257, in close
    self.sack.close()
  File "/usr/lib/python2.5/site-packages/yum/sqlitesack.py", line 233, 
in close
    del self.pkgobjlist
AttributeError: pkgobjlist

>  Jeremy
>
>  --
>  Fedora-livecd-list mailing list
>  Fedora-livecd-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-livecd-list
>

More on MBR Problem

[Tim Wood]

Following up on my email from yesterday...

The error (if that wasn't clear in my previous email) was: The MBR  
doesn't contain valid bootstrap code.  The rest of the VMWare error  
message is somewhere between useless and misleadingly inaccurate.   
The CIFS (samba) error I saw happens when the samba share with the  
kickstart is mounted so I doubt it's related.

Since there hasn't been an entry in the yum log for almost two weeks,  
I don't think the problem is a screwy package causing issues.  I  
can't see anything else in any of the other logs.  I suspect setting  
up a new machine with Fedora 8 will be a way to deal with the issue.   
BUT, that doesn't solve the problem.  Next time it occurs, I'll be  
back to solving problems windows tech support style.

Besides going to Fedora 8, does anyone have any suggestions on  
running this down?