Just wondering if i'm going to move 2x160GB sata drives in raid 1 that
are on there own volume with SELinux turned on. Can I simply move
these to another box and be able to read them or does this become
really tricky?
Worst comes to worst I can mv the 80GB of data to another box, mv the
harddrives and then mv the data back just wondering if it could be as
easy to do it the other way.
I recently downloaded Bastille and was unable to get
the PSAD portion to install. [Bastille is trying to
install /usr/sbin/psad (among others)].
[root@lankhmar log]# ls -ldZ /usr/sbin
drwxr-xr-x root root system_u:object_r:sbin_t
So I would *expect* an SELinux error if the psad isn't of sbin_t.
[But I don't see any avc messages in the log.]
Here's a portion of Bastille's error log:
{Fri Mar 4 11:15:28 2005} Failed to place /psad as /usr/sbin/psad
{Fri Mar 4 11:15:28 2005} #ERROR: chmod: File /usr/sbin/psad doesn't exist!
{Fri Mar 4 11:15:28 2005} Failed to place /psadwatchd as
/usr/sbin/psadwatchd
{Fri Mar 4 11:15:28 2005} #ERROR: chmod: File /usr/sbin/psadwatchd
doesn't exist!
{Fri Mar 4 11:15:28 2005} Failed to place /kmsgsd as /usr/sbin/kmsgsd
{Fri Mar 4 11:15:28 2005} #ERROR: chmod: File /usr/sbin/kmsgsd doesn't
exist!
Does this look like an SELinux issue or just Bastille?
Richard.
This is a new strict policy for the razor spam filter. It is based on
the selinux-policy-strict-sources-1.23.2-1 fedora RPM. This policy
requires the definition of a razor reserved port that was in the
net_contexts diff I sent last Wednesday. Please let me know if there
are any problems with or changes needed to this policy.
David
Here are some additions to net_contexts to define additional privileged
ports. I'll be submitting policies that reference these ports over the
next week or so as I get them cleaned up. This is based on the file
from the selinux-policy-strict-sources-1.22.1-2 rpm on my FC3 system.
David
hi,
i try to use nscd with ldap and tls. in this case you should define a
cacert, cert and key file for nss. but afaik there is no default palce
to put these file and there is no default policy to allow nscd to read
any kind of pem file(s). it'd be useful to define a standard place for
these cert files and allow nscd to read these files.
yours.
--
Levente "Si vis pacem para bellum!"
Ahem, with the proper subject this time around...
Hi,
Apologies if this is not the proper mailing list...
I have a FC3 with day-before-yesterday pull from Linus and
selinux-policy-targeted installed from rawhide. Everything seems to be
working fine ecxept for my wireless card (prism54), which can't get
it's firmware loaded. It looks like selinux policy prevents firmware
loader to create "firmware" class device. I get avc denied search
message for process /sbin/ip (which is ifconfig_t) and tcontext is
sysfs_t. It looks like the rights are inherited from "ip" markings
whereas I would say that firmware loader is should operate in
completely different context.
Anyone have any pointers?
Thank you in advance,
Dmitry
P.S. I would appreciate if you CC me as I am not subscribed to the list.
>Is there any simple way of upgrading to Fedora from redhat 9.
>I already have redhat9 installed on my m/c
I did this recently (RH9->FC3). It almost worked. I can say a few things that
will help you. First, make sure your machine boots to init 3 first. When you do
the upgrade, tell it to let you pick the packages. Make sure policycoreutils and
targeted policy are selected. On a normal upgrade they weren't picked up by
dependencies. Look around for the other SE Linux tools and make sure they are
selected. Also make sure yum is selected.
The first time it boots, it should try to relabel the filesystem. If not, you'll
need to boot to single user mode and touch /.autorelabel.
Then there's gnome...It didn't pick up everything that it needed. I had to
manually install several packages and configure the panels by hand. I still don't
have the same icons for web browser that a clean install does. Maybe upgrading to
FC4 will resync the missing pieces for me.
In short it was an adventure. But you can get it almost working.
-Steve Grubb
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
hi,
after i having played a few days with selinux, apache and other daemons
and programs the whole selinux configuration seems to me a bit
confusing. if i found any kind of problem with the "default" selinux
setup which is not big thing since most systems are different and there
are a lots of program which are not included in the core distro. i have
to report it and the next update will include it. my question why
selinux include the default policies? why selinux-policy-* contains the
right acces rights for all included deamons, programs? wouldn't it be
much better to all package include it's own policy and in the rpm
postinstall session reload/add/modify the new policies. this is
something similar to the libs. i only install only those lib which
needed for me and at the postinstall session run an ldconfig. i wouldn't
like to install all libs! why should i install policies for eg. apache
when i don't run apache? why should i update selinux-policy-* just
because there was a bug in the apache part of the policy when i don't
run apache? the current case is something one big monolitic policy
configuration which most of the time not suitable for anyone (anyone who
run anything else then the default need to modify it or run any
webscript or). of course my main problem not with apache policies rather
then the whole system and way of configuration of selinux. wouldn't be
any easier and modularized way to use selinux and configure it for the
needed thing. probably there is need for some core policy but all others
policy can be modularized. or do i missed something?
just my 2c.
yours.
--
Levente "Si vis pacem para bellum!"
Hi ,
Is there any simple way of upgrading to Fedora from redhat 9.
I already have redhat9 installed on my m/c
------------------
Hari Haran
9886484326
26588360 ext: 3134
------------------
