9:14 a.m.
Hi,
What is the safest method to reset SELinux to its default configuration without
reinstalling the operating system?
Regards,
Mahmood
9:23 a.m.
On 11/08/2018 04:14 PM, Mahmood Naderan wrote:
Hi,
What is the safest method to reset SELinux to its default
configuration without reinstalling the operating system?
For filesystem labels:
touch /./autorelabel
reboot/
/
/
/For modules I don't know how it could be achieved./
/Some time semanage supports --local/
/semanage ports --list --local/
/semanage booleans --list --local/
/Which should list what was modified from default policy.
/
/- Thomas
/
9:46 a.m.
On 11/8/18 9:14 AM, Mahmood Naderan wrote:
Hi,
What is the safest method to reset SELinux to its default configuration
without reinstalling the operating system?
Generally, when you make changes to SELinux, a file with the extension
.local is created under /etc/selinux.
So to see all the changes that have been made, you can do
find /etc/selinux -name "*.local"
Then you can read those files and back out any changes which have been
made.
On my system, for instance, I have a file:
/etc/selinux/targeted/contexts/files/file_contexts.local
I just tested, and the booleans.local no longer seems to be created... I
know there used to be a booleans.local file created when you ran
setsebool -P. Has that gone away?
Thomas
9:49 a.m.
On 11/8/18 9:46 AM, Thomas Cameron wrote:
I just tested, and the booleans.local no longer seems to be
created... I
know there used to be a booleans.local file created when you ran
setsebool -P. Has that gone away?
Never mind, sorry - it's under /var/lib/selinux now.
So you can see changes to file contexts and booleans under:
/var/lib/selinux
Look for files with the extension .local. You can read them and see what
changes have been made if you want to back them out and get a "default
config."
TC
10:11 a.m.
For filesystem labels:
touch /.autorelabel
reboot
OK I did that. What is the effect then?! How can I find out that something has been
reset?
So to see all the changes that have been made, you can do
find /etc/selinux -name "*.local"
Yes I can see this for example
[root@sn snadmin]# cat /etc/selinux/targeted/active/booleans.local
# This file is auto-generated by libsemanage
# Do not edit directly.
httpd_unified=1
httpd_read_user_content=1
ftpd_full_access=1
httpd_can_connect_ftp=1
httpd_can_network_connect=1
httpd_can_sendmail=1
Regards,
Mahmood
10:18 a.m.
On 11/08/2018 05:11 PM, Mahmood Naderan wrote:
>For filesystem labels:
>touch /./autorelabel
>reboot/
OK I did that. What is the effect then?! How can I find out that
something has been reset?
Good question. the relabling is handled by the /etc/rc.d/rc.sysinit
script and calls
/sbin/fixfiles -F restore >/dev/null 2>&1
so if anything would have been printed, it is redirected to /dev/null.
- Thomas
10:25 a.m.
On 11/8/18 10:11 AM, Mahmood Naderan wrote:
>For filesystem labels:
>touch /./autorelabel
>reboot/
OK I did that. What is the effect then?! How can I find out that
something has been reset?
Relabeling only sets the filesystem to the defined SELinux labels. It
doesn't change any custom file contexts you've set up.
You can also run:
semanage fcontext -C -l
to see what local file context changes have been made, as well as
looking at the file_contexts.local file.
Then you can remove them if you want to go back to the default config
that came with the distro.
>So to see all the changes that have been made, you can do
>find /etc/selinux -name "*.local"
Yes I can see this for example
[root@sn snadmin]# cat /etc/selinux/targeted/active/booleans.local
# This file is auto-generated by libsemanage
# Do not edit directly.
httpd_unified=1
httpd_read_user_content=1
ftpd_full_access=1
httpd_can_connect_ftp=1
httpd_can_network_connect=1
httpd_can_sendmail=1
Well, if you want to go back to the default config from when you first
installed the OS, you could back those out. For instance,
setsebool -P httpd_unified 0
will revert the boolean back to the default setting.
But before we go any further, what are you actually trying to
accomplish? Any fcontext changes or boolean changes made were probably
made for a reason. It might make more sense to discover what's been
changed and then determine if that change is appropriate.
As an aside, I learned today that you can also run:
semanage boolean -C -l
to see all the changed booleans. So you can look at the *.local files,
or use the command line. Thanks for asking this question, it made me
learn something new. :-)
Once you've determined what changed, you could change them back to
"factory default" if that's what you're trying to do.
I do recommend that you see what's been changed, then determine if it
makes sense to change it back rather than blindly setting the system
back to defaults.
Thomas
10:33 a.m.
/sbin/fixfiles -F restore >/dev/null 2>&1
so if anything would have been printed, it is redirected to /dev/null.
But before we go any further, what are you actually trying to
accomplish?
Earlier I asked about an SELinux prevention message. After running "touch
/.autorelabel && reboot" I don't see such messages in the log and ALSO it
seems that the problem has been solved! Because I can upload files on the server via
browser.
So, I wonder if there are still some messages that are redirected to /dev/null!!
Regards,
Mahmood
10:42 a.m.
On 11/8/18 10:33 AM, Mahmood Naderan wrote:
>/sbin/fixfiles -F restore >/dev/null 2>&1
>so if anything would have been printed, it is redirected to /dev/null.
>But before we go any further, what are you actually trying to
>accomplish?
Earlier I asked about an SELinux prevention message. After running
"touch /.autorelabel && reboot" I don't see such messages in the
log and
ALSO it seems that the problem has been solved! Because I can upload
files on the server via browser.
Heh - are you sure you understand the implications of being able to
upload random files to your computer?
So, I wonder if there are still some messages that are redirected to
/dev/null
Any SELinux messages should be stored in /var/log/audit/audit.log
You can use tools like ausearch and aureport to see what's going on.
TC
10:54 a.m.
On 11/08/2018 05:42 PM, Thomas Cameron wrote:
On 11/8/18 10:33 AM, Mahmood Naderan wrote:
>> /sbin/fixfiles -F restore >/dev/null 2>&1
>> so if anything would have been printed, it is redirected to /dev/null.
>
>
>
>> But before we go any further, what are you actually trying to
>> accomplish?
>
> Earlier I asked about an SELinux prevention message. After running
> "touch /.autorelabel && reboot" I don't see such messages in
the log and
> ALSO it seems that the problem has been solved! Because I can upload
> files on the server via browser.
Heh - are you sure you understand the implications of being able to
upload random files to your computer?
maybe he added the semange fcontext for the one folder that needs rw
rights and autorelable fixed all the other issues that arose because of
moving files from $HOME to /var/www.
- Thomas
10:57 a.m.
On 11/8/18 10:54 AM, Thomas Mueller wrote:
>
maybe he added the semange fcontext for the one folder that needs rw
rights and autorelable fixed all the other issues that arose because of
moving files from $HOME to /var/www.
Absolutely possible! That is literally the most common issue I hear
about from the field, is folks moving instead of copying.
This may be a case of having used a sledgehammer to fix it. :-)
2001
days inactive
2001
days old
selinux@lists.fedoraproject.org
10 comments
3 participants
participants (3)
-
Mahmood Naderan -
Thomas Cameron -
Thomas Mueller