Re: f10 vs selinux again.

[Dominick Grift]

On Sat, 2009-02-28 at 14:15 -0500, Gene Heskett wrote:
> On Saturday 28 February 2009, Dominick Grift wrote:
> > On Sat, 2009-02-28 at 12:53 -0500, Gene Heskett wrote:
> > > Greetings all;
> > >
> > > I have just upgraded then updated as much as possible, an F8

install to
> > > F10. selinux is now denying ConsoleKit and friends, and awstats.

F10 will
> > > run without console-kit-daemon I find, but I went so far as to

touch
> > > /.autorelabel & reboot & leave it to contemplate its sins for an

hour or
> > > so as there is nearly 2TB of drives here.  Didn't help.
> > >
> > > So Now I have selinux disabled, and everything it working.  Can

this be
> > > addressed?
> >
> > Can you show use the avc denials related to your issues? avc denials

are
> > sent to /var/log/audit/audit.log and can be retrieved with the

ausearch
> > command. For example use: ausearch -m avc -ts today, to retrieve

today's
> > avc denials.
>
> None today, I turned it off, yesterdays is attached.
> > You state that you updated as much as possible. What did you not

update?
> About 70 packages are left, all the java stuff cuz I've installed from

Sun,
> I've nuked fedora's firefox cuz I already had 3.0.6 (had to fix that

up by
> hand and some of the menus are still fubar) and anytime I do a -devel,

it
> barfs over strigi.  What the heck does that thing do anywho?
>
> I also am not running the F10 kernel cuz I have to set stakes and call

a
> surveyer to measure screen scrolling speed, so I'm running 2.6.28.7

and am
> building the xorg drm and xf86-r6xx-r7xx-radeonhd trees.  Now glxgears

says
> 275-300 fps and I can tolerate it.  Anyway, from the yumex screen:
>
> 14:05:14 : Error in Dependency Resolution
> 14:05:14 : Missing Dependency: xine-lib(plugin-abi) = 1.25 is needed

by
> package xine-lib-extras-freeworld-1.1.16.2-1.fc10.i386

(rpmfusion-free-
> updates)
> Missing Dependency: kernel-uname-r = 2.6.27.15-170.2.24.fc10.i686 is

needed by
> package

kmod-fglrx-2.6.27.15-170.2.24.fc10.i686-8.573-1.9.1.fc10.1.i686
> (rpmfusion-nonfree-updates)
> Missing Dependency: strigi-libs = 0.5.11-1.fc10 is needed by package

strigi-
> devel-0.5.11-1.fc10.i386 (fedora)
>
> I might be able to get a list of updates (if you need them) not done

from yum.
> I use yumex most of the time.
>
> Thanks Dominick

No that is fine, thanks. Which version of selinux-policy is currently
installed?

I picked a few of the denials out of there and both were allowed in the
rawhide policy.

This leads me to think that either you are running a old version of the
selinux-policy or that the fixes in rawhide policy have not been pushed 
to Fedora 10 policy yet.

I either case you can create custom policies to allow these denials.

A quick (and dirty) way is to "cat avc-denials.txt | audit2allow -M
mydenials; /usr/sbin/semodule -i mydenials.pp

caution: i did not review all denials in your list, however most look
like they should be allowed.

You should not let issues like these persuade you to disable SELinux.
You can also run SELinux is permissive mode which will act as an
intrusion detection system but will not prevent policy violations.

hth , Dominick