Fedora 14 does not respect /etc/sysconfig/selinux?

[Eric Warnke]

I have a number of testing systems installed with Fedora 14.  They were
installed with the minimal profile, have no 3rd party repositories or
rpm's installed, are fully up-to-date, and were exhibiting some strange
behavior with the corosync/pacemaker packages.

The problems with corosync are a direct result of the system not
respecting the /etc/sysconfog/selinux directives.  I have attached some
sessions below to show the errant behavior.

Boot 1:
[root@tiny ~]# uptime
08:30:43 up 0 min,  1 user,  load average: 0.15, 0.06, 0.02
[root@tiny ~]# getenforce
Enforcing
[root@tiny ~]# more /etc/sysconfig/selinux

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=permissive
# SELINUXTYPE= can take one of these two values:
#     targeted - Targeted processes are protected,
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted

Boot 2:
[root@tiny ~]# uptime
08:33:01 up 0 min,  1 user,  load average: 0.30, 0.06, 0.02
[root@tiny ~]# getenforce
Enforcing
[root@tiny ~]# cat /etc/sysconfig/selinux

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=disabled
# SELINUXTYPE= can take one of these two values:
#     targeted - Targeted processes are protected,
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted

After a call to setenforce 0
[root@tiny ~]# getenforce
Permissive

As you can clearly see the SELINUX directive is being ignored during boot.
 I have had to move startup of the affected packages to /etc/rc.local
after a call to setenforce 0.

Cheers,
Eric Warnke
Research IT Group
SUNY at Albany

[Dominick Grift]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 05/11/2011 04:31 PM, Eric Warnke wrote:

>  The problems with corosync are a direct result of the system not
>  respecting the /etc/sysconfog/selinux directives. 
Is /etc/sysconfig/selinux also a symbolic links to /etc/selinux/config
on your system?

This is what i see on rawhide:

lrwxrwxrwx. root root system_u:object_r:etc_t:s0       selinux ->
../selinux/config

rpm -qf /etc/sysconfig/selinux
selinux-policy-3.9.16-15.fc16.noarch

My fedora 14 configuration seems to not even have a
/etc/sysconfig/selinux softlink. Although rpm -qf /etc/sysconfig/selinux
does return the selinux-policy package.

What happens if you modify /etc/selinux/config directly?


> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.16 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAk3Kri4ACgkQMlxVo39jgT9q8QCZAdIOTz1jq/fRv+s21wYXp5S/
> DSgAnjDLH7BaYYjiS/8k2YR73kxcoC47
> =bHo6
> -----END PGP SIGNATURE-----

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 05/11/2011 04:41 PM, Dominick Grift wrote:
>  On 05/11/2011 04:31 PM, Eric Warnke wrote:
>  
> > The problems with corosync are a direct result of the system not
> > respecting the /etc/sysconfog/selinux directives.
>  
>  Is /etc/sysconfig/selinux also a symbolic links to /etc/selinux/config
>  on your system?
>  
>  This is what i see on rawhide:
>  
>  lrwxrwxrwx. root root system_u:object_r:etc_t:s0       selinux ->
>  ../selinux/config
>  
>  rpm -qf /etc/sysconfig/selinux
>  selinux-policy-3.9.16-15.fc16.noarch
>  
>  My fedora 14 configuration seems to not even have a
>  /etc/sysconfig/selinux softlink. Although rpm -qf /etc/sysconfig/selinux
>  does return the selinux-policy package.
>  
>  What happens if you modify /etc/selinux/config directly?
>  
>   
- --
selinux mailing list
selinux(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux

Yes I would suspect you broke the link.  /etc/selinux/config is the
correct location to modify with /etc/sysconfig/selinux a symbolic link
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAk3LAZcACgkQrlYvE4MpobMlggCg5uZMoZ8ZD56YOl9+TAp8jTvF
> yNgAni/6FMRqAXcF1bm64/xIlkSIMLrN
> =pN7+
> -----END PGP SIGNATURE-----

[Eric Warnke]

( Sent this yesterday from the wrong account, didn't make the list )

Nailed it in one.  I guess I had presumed that /etc/sysconfig/selinux was
authoritative.

-rw-r--r--.  1 root root  457 May 11 08:32 selinux
lrwxrwxrwx.  1 root root   17 May 10 08:12 selinux.gres ->
../selinux/config

Looks like I ran sed on the wrong file.


Eric




On 5/11/11 5:37 PM, "Daniel J Walsh" <dwalsh(a)redhat.com&gt; wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 05/11/2011 04:41 PM, Dominick Grift wrote:
> > On 05/11/2011 04:31 PM, Eric Warnke wrote:
> > 
> >> The problems with corosync are a direct result of the system not
> >> respecting the /etc/sysconfog/selinux directives.
> > 
> > Is /etc/sysconfig/selinux also a symbolic links to /etc/selinux/config
> > on your system?
> > 
> > This is what i see on rawhide:
> > 
> > lrwxrwxrwx. root root system_u:object_r:etc_t:s0       selinux ->
> > ../selinux/config
> > 
> > rpm -qf /etc/sysconfig/selinux
> > selinux-policy-3.9.16-15.fc16.noarch
> > 
> > My fedora 14 configuration seems to not even have a
> > /etc/sysconfig/selinux softlink. Although rpm -qf /etc/sysconfig/selinux
> > does return the selinux-policy package.
> > 
> > What happens if you modify /etc/selinux/config directly?
> > 
> > 
> - --
> selinux mailing list
> selinux(a)lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/selinux
>
> Yes I would suspect you broke the link.  /etc/selinux/config is the
> correct location to modify with /etc/sysconfig/selinux a symbolic link
> > -----BEGIN PGP SIGNATURE-----
> > Version: GnuPG v1.4.11 (GNU/Linux)
> > Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
> >
> > iEYEARECAAYFAk3LAZcACgkQrlYvE4MpobMlggCg5uZMoZ8ZD56YOl9+TAp8jTvF
> > yNgAni/6FMRqAXcF1bm64/xIlkSIMLrN
> > =pN7+
> > -----END PGP SIGNATURE----- 
> --
> selinux mailing list
> selinux(a)lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/selinux