Long XFS filesystem avc errors on boot

[Dennis Gilmore]

Ok ill try again.  first post was denied for being to big so ill cut it back.

on a fully updated system that has XFS as the filesystem  i reenabled selinux  
booted into single user mode and relabeled my filesystem.  then rebooted.

Postfix failed to start as did X.  i am using kdm as my login manager  seems 
its being denied access to some resources it needs.  sorry is so long  but i 
thought id show it in its context  that is what was logged 
in /var/log/messages for the boot secqunce up until the point of x failing to 
start

Dennis

some of the messages for boot up are as follows


Apr 15 11:26:06 asgard kernel: audit(1081992347.449:0): avc:  denied  
{ getattr } for  pid=774 exe=/sbin/pam_console_apply path=/dev/input/js2 
dev=hde2 ino=234962788 scontext=system_u:system_r:pam_console_t 
tcontext=system_u:object_r:unlabeled_t tclass=chr_file 
Apr 15 11:26:06 asgard kernel: audit(1081992347.464:0): avc:  denied  
{ dac_override } for  pid=774 exe=/sbin/pam_console_apply capability=1 
scontext=system_u:system_r:pam_console_t 
tcontext=system_u:system_r:pam_console_t tclass=capability 
Apr 15 11:26:06 asgard kernel: audit(1081992347.464:0): avc:  denied  
{ dac_read_search } for  pid=774 exe=/sbin/pam_console_apply capability=2 
scontext=system_u:system_r:pam_console_t 
tcontext=system_u:system_r:pam_console_t tclass=capability 
Apr 15 11:26:06 asgard kernel: inode_doinit_with_dentry:  getxattr returned 13 
for dev=hde2 ino=234962799 
Apr 15 11:26:06 asgard kernel: audit(1081992347.464:0): avc:  denied  
{ getattr } for  pid=774 exe=/sbin/pam_console_apply path=/dev/input/js3 
dev=hde2 ino=234962799 scontext=system_u:system_r:pam_console_t 
tcontext=system_u:object_r:unlabeled_t tclass=chr_file 
Apr 15 11:26:06 asgard kernel: audit(1081992347.546:0): avc:  denied  
{ dac_override } for  pid=774 exe=/sbin/pam_console_apply capability=1 
scontext=system_u:system_r:pam_console_t 
tcontext=system_u:system_r:pam_console_t tclass=capability 





Apr 15 11:27:19 asgard /sbin/mingetty[1796]: tty1: Operation not permitted 
Apr 15 11:27:19 asgard /sbin/mingetty[1797]: tty2: Operation not permitted 
Apr 15 11:27:19 asgard /sbin/mingetty[1798]: tty3: Operation not permitted 
Apr 15 11:27:19 asgard kernel: audit(1081992439.217:0): avc:  denied  
{ fowner } for  pid=1796 exe=/sbin/mingetty capability=3 
scontext=system_u:system_r:getty_t tcontext=system_u:system_r:getty_t 
tclass=capability 
Apr 15 11:27:19 asgard kernel: audit(1081992439.221:0): avc:  denied  
{ fowner } for  pid=1797 exe=/sbin/mingetty capability=3 
scontext=system_u:system_r:getty_t tcontext=system_u:system_r:getty_t 
tclass=capability 
Apr 15 11:27:19 asgard kernel: audit(1081992439.225:0): avc:  denied  
{ fowner } for  pid=1798 exe=/sbin/mingetty capability=3 
scontext=system_u:system_r:getty_t tcontext=system_u:system_r:getty_t 
tclass=capability 
Apr 15 11:27:19 asgard kdm_config[1817]: Unrecognized section name [Desktop0] 
at /usr/share/config/kdm/kdmrc:42 
Apr 15 11:27:19 asgard kdm_config[1817]: Unrecognized key 'SessionTypes' in 
section [X-*-Greeter] at /usr/share/config/kdm/kdmrc:266 
Apr 15 11:27:19 asgard kernel: audit(1081992439.880:0): avc:  denied  { read } 
for  pid=1802 exe=/usr/bin/kdm name=mem dev=hde2 ino=33580795 
scontext=system_u:system_r:xdm_t tcontext=system_u:object_r:memory_device_t 
tclass=chr_file 
Apr 15 11:27:19 asgard kdm[1802]: Cannot read randomFile "/dev/mem"; X cookies 
may be easily guessable 
Apr 15 11:27:19 asgard kernel: audit(1081992439.921:0): avc:  denied  
{ getattr } for  pid=1818 exe=/usr/X11R6/bin/Xorg path=/var/log/Xorg.0.log 
dev=hde2 ino=302135865 scontext=system_u:system_r:xdm_t 
tcontext=system_u:object_r:var_log_t tclass=file 
Apr 15 11:27:19 asgard kernel: audit(1081992439.921:0): avc:  denied  
{ write } for  pid=1818 exe=/usr/X11R6/bin/Xorg name=Xorg.0.log dev=hde2 
ino=302135865 scontext=system_u:system_r:xdm_t 
tcontext=system_u:object_r:var_log_t tclass=file 
Apr 15 11:27:21 asgard kdm[1802]: X server died during startup 
Apr 15 11:27:21 asgard kdm[1802]: X server for display :0 can't be started, 
session disabled 
Apr 15 11:27:22 asgard kdm_config[1834]: Unrecognized section name [Desktop0] 
at /usr/share/config/kdm/kdmrc:42 
Apr 15 11:27:22 asgard kdm_config[1834]: Unrecognized key 'SessionTypes' in 
section [X-*-Greeter] at /usr/share/config/kdm/kdmrc:266 
Apr 15 11:27:22 asgard kernel: audit(1081992442.419:0): avc:  denied  { read } 
for  pid=1819 exe=/usr/bin/kdm name=mem dev=hde2 ino=33580795 
scontext=system_u:system_r:xdm_t tcontext=system_u:object_r:memory_device_t 
tclass=chr_file 
Apr 15 11:27:22 asgard kdm[1819]: Cannot read randomFile "/dev/mem"; X cookies 
may be easily guessable 
Apr 15 11:27:22 asgard kernel: audit(1081992442.427:0): avc:  denied  
{ getattr } for  pid=1835 exe=/usr/X11R6/bin/Xorg path=/var/log/Xorg.0.log 
dev=hde2 ino=302135865 scontext=system_u:system_r:xdm_t 
tcontext=system_u:object_r:var_log_t tclass=file 
Apr 15 11:27:22 asgard kernel: audit(1081992442.427:0): avc:  denied  
{ write } for  pid=1835 exe=/usr/X11R6/bin/Xorg name=Xorg.0.log dev=hde2 
ino=302135865 scontext=system_u:system_r:xdm_t 
tcontext=system_u:object_r:var_log_t tclass=file 
Apr 15 11:27:23 asgard kdm[1819]: X server died during startup 
Apr 15 11:27:23 asgard kdm[1819]: X server for display :0 can't be started, 
session disabled 
Apr 15 11:27:23 asgard kdm_config[1851]: Unrecognized section name [Desktop0] 
at /usr/share/config/kdm/kdmrc:42 
Apr 15 11:27:23 asgard kdm_config[1851]: Unrecognized key 'SessionTypes' in 
section [X-*-Greeter] at /usr/share/config/kdm/kdmrc:266 
Apr 15 11:27:23 asgard kernel: AVC: 1 messages suppressed. 
Apr 15 11:27:23 asgard kernel: audit(1081992443.946:0): avc:  denied  { read } 
for  pid=1836 exe=/usr/bin/kdm name=mem dev=hde2 ino=33580795 
scontext=system_u:system_r:xdm_t tcontext=system_u:object_r:memory_device_t 
tclass=chr_file 
Apr 15 11:27:23 asgard kdm[1836]: Cannot read randomFile "/dev/mem"; X cookies 
may be easily guessable 
Apr 15 11:27:23 asgard kernel: audit(1081992443.956:0): avc:  denied  
{ getattr } for  pid=1852 exe=/usr/X11R6/bin/Xorg path=/var/log/Xorg.0.log 
dev=hde2 ino=302135865 scontext=system_u:system_r:xdm_t 
tcontext=system_u:object_r:var_log_t tclass=file 
Apr 15 11:27:23 asgard kernel: audit(1081992443.957:0): avc:  denied  
{ write } for  pid=1852 exe=/usr/X11R6/bin/Xorg name=Xorg.0.log dev=hde2 
ino=302135865 scontext=system_u:system_r:xdm_t 
tcontext=system_u:object_r:var_log_t tclass=file 
Apr 15 11:27:24 asgard /sbin/mingetty[1853]: tty1: Operation not permitted 
Apr 15 11:27:24 asgard kernel: audit(1081992444.224:0): avc:  denied  
{ fowner } for  pid=1853 exe=/sbin/mingetty capability=3 
scontext=system_u:system_r:getty_t tcontext=system_u:system_r:getty_t 
tclass=capability 
Apr 15 11:27:24 asgard kernel: audit(1081992444.230:0): avc:  denied  
{ fowner } for  pid=1854 exe=/sbin/mingetty capability=3 
scontext=system_u:system_r:getty_t tcontext=system_u:system_r:getty_t 
tclass=capability 
Apr 15 11:27:24 asgard /sbin/mingetty[1854]: tty2: Operation not permitted 
Apr 15 11:27:24 asgard kernel: audit(1081992444.237:0): avc:  denied  
{ fowner } for  pid=1855 exe=/sbin/mingetty capability=3 
scontext=system_u:system_r:getty_t tcontext=system_u:system_r:getty_t 
tclass=capability 
Apr 15 11:27:24 asgard /sbin/mingetty[1855]: tty3: Operation not permitted 
Apr 15 11:27:24 asgard kdm[1836]: X server died during startup 
Apr 15 11:27:24 asgard kdm[1836]: X server for display :0 can't be started, 
session disabled 
Apr 15 11:27:25 asgard kdm_config[1871]: Unrecognized section name [Desktop0] 
at /usr/share/config/kdm/kdmrc:42 
Apr 15 11:27:25 asgard kdm_config[1871]: Unrecognized key 'SessionTypes' in 
section [X-*-Greeter] at /usr/share/config/kdm/kdmrc:266 
Apr 15 11:27:25 asgard kernel: audit(1081992445.088:0): avc:  denied  { read } 
for  pid=1856 exe=/usr/bin/kdm name=mem dev=hde2 ino=33580795 
scontext=system_u:system_r:xdm_t tcontext=system_u:object_r:memory_device_t 
tclass=chr_file 
Apr 15 11:27:25 asgard kdm[1856]: Cannot read randomFile "/dev/mem"; X cookies 
may be easily guessable 
Apr 15 11:27:25 asgard kernel: audit(1081992445.098:0): avc:  denied  
{ getattr } for  pid=1872 exe=/usr/X11R6/bin/Xorg path=/var/log/Xorg.0.log 
dev=hde2 ino=302135865 scontext=system_u:system_r:xdm_t 
tcontext=system_u:object_r:var_log_t tclass=file 
Apr 15 11:27:25 asgard kernel: audit(1081992445.098:0): avc:  denied  
{ write } for  pid=1872 exe=/usr/X11R6/bin/Xorg name=Xorg.0.log dev=hde2 
ino=302135865 scontext=system_u:system_r:xdm_t 
tcontext=system_u:object_r:var_log_t tclass=file 
Apr 15 11:27:26 asgard kdm[1856]: X server died during startup 
Apr 15 11:27:26 asgard kdm[1856]: X server for display :0 can't be started, 
session disabled 
Apr 15 11:27:26 asgard kdm_config[1888]: Unrecognized section name [Desktop0] 
at /usr/share/config/kdm/kdmrc:42 
Apr 15 11:27:26 asgard kdm_config[1888]: Unrecognized key 'SessionTypes' in 
section [X-*-Greeter] at /usr/share/config/kdm/kdmrc:266 
Apr 15 11:27:26 asgard kernel: audit(1081992446.224:0): avc:  denied  { read } 
for  pid=1873 exe=/usr/bin/kdm name=mem dev=hde2 ino=33580795 
scontext=system_u:system_r:xdm_t tcontext=system_u:object_r:memory_device_t 
tclass=chr_file 
Apr 15 11:27:26 asgard kdm[1873]: Cannot read randomFile "/dev/mem"; X cookies 
may be easily guessable 
Apr 15 11:27:26 asgard kernel: audit(1081992446.234:0): avc:  denied  
{ getattr } for  pid=1889 exe=/usr/X11R6/bin/Xorg path=/var/log/Xorg.0.log 
dev=hde2 ino=302135865 scontext=system_u:system_r:xdm_t 
tcontext=system_u:object_r:var_log_t tclass=file 
Apr 15 11:27:26 asgard kernel: audit(1081992446.234:0): avc:  denied  
{ write } for  pid=1889 exe=/usr/X11R6/bin/Xorg name=Xorg.0.log dev=hde2 
ino=302135865 scontext=system_u:system_r:xdm_t 
tcontext=system_u:object_r:var_log_t tclass=file 
Apr 15 11:27:27 asgard kdm[1873]: X server died during startup 
Apr 15 11:27:27 asgard kdm[1873]: X server for display :0 can't be started, 
session disabled 
Apr 15 11:27:27 asgard kdm_config[1905]: Unrecognized section name [Desktop0] 
at /usr/share/config/kdm/kdmrc:42 
Apr 15 11:27:27 asgard kdm_config[1905]: Unrecognized key 'SessionTypes' in 
section [X-*-Greeter] at /usr/share/config/kdm/kdmrc:266 
Apr 15 11:27:27 asgard kernel: audit(1081992447.358:0): avc:  denied  { read } 
for  pid=1890 exe=/usr/bin/kdm name=mem dev=hde2 ino=33580795 
scontext=system_u:system_r:xdm_t tcontext=system_u:object_r:memory_device_t 
tclass=chr_file 
Apr 15 11:27:27 asgard kdm[1890]: Cannot read randomFile "/dev/mem"; X cookies 
may be easily guessable 
Apr 15 11:27:27 asgard kernel: audit(1081992447.368:0): avc:  denied  
{ getattr } for  pid=1906 exe=/usr/X11R6/bin/Xorg path=/var/log/Xorg.0.log 
dev=hde2 ino=302135865 scontext=system_u:system_r:xdm_t 
tcontext=system_u:object_r:var_log_t tclass=file 
Apr 15 11:27:27 asgard kernel: audit(1081992447.368:0): avc:  denied  
{ write } for  pid=1906 exe=/usr/X11R6/bin/Xorg name=Xorg.0.log dev=hde2 
ino=302135865 scontext=system_u:system_r:xdm_t 
tcontext=system_u:object_r:var_log_t tclass=file 
Apr 15 11:27:28 asgard kdm[1890]: X server died during startup 
Apr 15 11:27:28 asgard kdm[1890]: X server for display :0 can't be started, 
session disabled 
Apr 15 11:27:28 asgard kdm_config[1922]: Unrecognized section name [Desktop0] 
at /usr/share/config/kdm/kdmrc:42 
Apr 15 11:27:28 asgard kdm_config[1922]: Unrecognized key 'SessionTypes' in 
section [X-*-Greeter] at /usr/share/config/kdm/kdmrc:266 
Apr 15 11:27:28 asgard kernel: audit(1081992448.495:0): avc:  denied  { read } 
for  pid=1907 exe=/usr/bin/kdm name=mem dev=hde2 ino=33580795 
scontext=system_u:system_r:xdm_t tcontext=system_u:object_r:memory_device_t 
tclass=chr_file 
Apr 15 11:27:28 asgard kdm[1907]: Cannot read randomFile "/dev/mem"; X cookies 
may be easily guessable 
Apr 15 11:27:28 asgard kernel: audit(1081992448.503:0): avc:  denied  
{ getattr } for  pid=1923 exe=/usr/X11R6/bin/Xorg path=/var/log/Xorg.0.log 
dev=hde2 ino=302135865 scontext=system_u:system_r:xdm_t 
tcontext=system_u:object_r:var_log_t tclass=file 
Apr 15 11:27:28 asgard kernel: audit(1081992448.504:0): avc:  denied  
{ write } for  pid=1923 exe=/usr/X11R6/bin/Xorg name=Xorg.0.log dev=hde2 
ino=302135865 scontext=system_u:system_r:xdm_t 
tcontext=system_u:object_r:var_log_t tclass=file 
Apr 15 11:27:29 asgard /sbin/mingetty[1924]: tty1: Operation not permitted 
Apr 15 11:27:29 asgard kernel: AVC: 17 messages suppressed. 
Apr 15 11:27:29 asgard kernel: audit(1081992449.230:0): avc:  denied  
{ fowner } for  pid=1924 exe=/sbin/mingetty capability=3 
scontext=system_u:system_r:getty_t tcontext=system_u:system_r:getty_t 
tclass=capability 
Apr 15 11:27:29 asgard kernel: audit(1081992449.238:0): avc:  denied  
{ fowner } for  pid=1925 exe=/sbin/mingetty capability=3 
scontext=system_u:system_r:getty_t tcontext=system_u:system_r:getty_t 
tclass=capability 
Apr 15 11:27:29 asgard /sbin/mingetty[1925]: tty2: Operation not permitted 
Apr 15 11:27:29 asgard kernel: audit(1081992449.244:0): avc:  denied  
{ fowner } for  pid=1926 exe=/sbin/mingetty capability=3 
scontext=system_u:system_r:getty_t tcontext=system_u:system_r:getty_t 
tclass=capability 
Apr 15 11:27:29 asgard /sbin/mingetty[1926]: tty3: Operation not permitted 
Apr 15 11:27:29 asgard kdm[1907]: X server died during startup 
Apr 15 11:27:29 asgard kdm[1907]: X server for display :0 can't be started, 
session disabled 
Apr 15 11:27:29 asgard kdm_config[1942]: Unrecognized section name [Desktop0] 
at /usr/share/config/kdm/kdmrc:42 
Apr 15 11:27:29 asgard kdm_config[1942]: Unrecognized key 'SessionTypes' in 
section [X-*-Greeter] at /usr/share/config/kdm/kdmrc:266 
Apr 15 11:27:29 asgard kernel: audit(1081992449.635:0): avc:  denied  { read } 
for  pid=1927 exe=/usr/bin/kdm name=mem dev=hde2 ino=33580795 
scontext=system_u:system_r:xdm_t tcontext=system_u:object_r:memory_device_t 
tclass=chr_file 
Apr 15 11:27:29 asgard kdm[1927]: Cannot read randomFile "/dev/mem"; X cookies 
may be easily guessable 
Apr 15 11:27:29 asgard kernel: audit(1081992449.644:0): avc:  denied  
{ getattr } for  pid=1943 exe=/usr/X11R6/bin/Xorg path=/var/log/Xorg.0.log 
dev=hde2 ino=302135865 scontext=system_u:system_r:xdm_t 
tcontext=system_u:object_r:var_log_t tclass=file 
Apr 15 11:27:29 asgard kernel: audit(1081992449.646:0): avc:  denied  
{ write } for  pid=1943 exe=/usr/X11R6/bin/Xorg name=Xorg.0.log dev=hde2 
ino=302135865 scontext=system_u:system_r:xdm_t 
tcontext=system_u:object_r:var_log_t tclass=file 
Apr 15 11:27:30 asgard kdm[1927]: X server died during startup 
Apr 15 11:27:30 asgard kdm[1927]: X server for display :0 can't be started, 
session disabled 
Apr 15 11:27:30 asgard kdm_config[1959]: Unrecognized section name [Desktop0] 
at /usr/share/config/kdm/kdmrc:42 
Apr 15 11:27:30 asgard kdm_config[1959]: Unrecognized key 'SessionTypes' in 
section [X-*-Greeter] at /usr/share/config/kdm/kdmrc:266 
Apr 15 11:27:30 asgard kernel: audit(1081992450.771:0): avc:  denied  { read } 
for  pid=1944 exe=/usr/bin/kdm name=mem dev=hde2 ino=33580795 
scontext=system_u:system_r:xdm_t tcontext=system_u:object_r:memory_device_t 
tclass=chr_file 
Apr 15 11:27:30 asgard kdm[1944]: Cannot read randomFile "/dev/mem"; X cookies 
may be easily guessable 
Apr 15 11:27:30 asgard kernel: audit(1081992450.781:0): avc:  denied  
{ getattr } for  pid=1960 exe=/usr/X11R6/bin/Xorg path=/var/log/Xorg.0.log 
dev=hde2 ino=302135865 scontext=system_u:system_r:xdm_t 
tcontext=system_u:object_r:var_log_t tclass=file 
Apr 15 11:27:30 asgard kernel: audit(1081992450.782:0): avc:  denied  
{ write } for  pid=1960 exe=/usr/X11R6/bin/Xorg name=Xorg.0.log dev=hde2 
ino=302135865 scontext=system_u:system_r:xdm_t 
tcontext=system_u:object_r:var_log_t tclass=file 
Apr 15 11:27:31 asgard kdm[1944]: X server died during startup 
Apr 15 11:27:31 asgard kdm[1944]: X server for display :0 can't be started, 
session disabled 
Apr 15 11:27:31 asgard kdm_config[1976]: Unrecognized section name [Desktop0] 
at /usr/share/config/kdm/kdmrc:42 
Apr 15 11:27:31 asgard kdm_config[1976]: Unrecognized key 'SessionTypes' in 
section [X-*-Greeter] at /usr/share/config/kdm/kdmrc:266 
Apr 15 11:27:31 asgard kernel: audit(1081992451.907:0): avc:  denied  { read } 
for  pid=1961 exe=/usr/bin/kdm name=mem dev=hde2 ino=33580795 
scontext=system_u:system_r:xdm_t tcontext=system_u:object_r:memory_device_t 
tclass=chr_file 
Apr 15 11:27:31 asgard kdm[1961]: Cannot read randomFile "/dev/mem"; X cookies 
may be easily guessable 
Apr 15 11:27:31 asgard kernel: audit(1081992451.917:0): avc:  denied  
{ getattr } for  pid=1977 exe=/usr/X11R6/bin/Xorg path=/var/log/Xorg.0.log 
dev=hde2 ino=302135865 scontext=system_u:system_r:xdm_t 
tcontext=system_u:object_r:var_log_t tclass=file 
Apr 15 11:27:31 asgard kernel: audit(1081992451.918:0): avc:  denied  
{ write } for  pid=1977 exe=/usr/X11R6/bin/Xorg name=Xorg.0.log dev=hde2 
ino=302135865 scontext=system_u:system_r:xdm_t 
tcontext=system_u:object_r:var_log_t tclass=file 
Apr 15 11:27:32 asgard kdm[1961]: X server died during startup 
Apr 15 11:27:32 asgard kdm[1961]: X server for display :0 can't be started, 
session disabled 
Apr 15 11:27:32 asgard init: Id "x" respawning too fast: disabled for 5 
minutes 
Apr 15 11:27:34 asgard /sbin/mingetty[1978]: tty1: Operation not permitted 
Apr 15 11:27:34 asgard kernel: AVC: 11 messages suppressed. 
Apr 15 11:27:34 asgard kernel: audit(1081992454.236:0): avc:  denied  
{ fowner } for  pid=1978 exe=/sbin/mingetty capability=3 
scontext=system_u:system_r:getty_t tcontext=system_u:system_r:getty_t 
tclass=capability 
Apr 15 11:27:34 asgard /sbin/mingetty[1979]: tty2: Operation not permitted 
Apr 15 11:27:34 asgard kernel: audit(1081992454.245:0): avc:  denied  
{ fowner } for  pid=1979 exe=/sbin/mingetty capability=3 
scontext=system_u:system_r:getty_t tcontext=system_u:system_r:getty_t 
tclass=capability 
Apr 15 11:27:34 asgard /sbin/mingetty[1980]: tty3: Operation not permitted 
Apr 15 11:27:34 asgard kernel: audit(1081992454.252:0): avc:  denied  
{ fowner } for  pid=1980 exe=/sbin/mingetty capability=3 
scontext=system_u:system_r:getty_t tcontext=system_u:system_r:getty_t 
tclass=capability 
Apr 15 11:27:39 asgard /sbin/mingetty[1981]: tty1: Operation not permitted 
Apr 15 11:27:39 asgard kernel: AVC: 2 messages suppressed. 
Apr 15 11:27:39 asgard kernel: audit(1081992459.242:0): avc:  denied  
{ fowner } for  pid=1981 exe=/sbin/mingetty capability=3 
scontext=system_u:system_r:getty_t tcontext=system_u:system_r:getty_t 
tclass=capability 
Apr 15 11:27:39 asgard /sbin/mingetty[1982]: tty2: Operation not permitted 
Apr 15 11:27:39 asgard kernel: audit(1081992459.251:0): avc:  denied  
{ fowner } for  pid=1982 exe=/sbin/mingetty capability=3 
scontext=system_u:system_r:getty_t tcontext=system_u:system_r:getty_t 
tclass=capability 
Apr 15 11:27:39 asgard /sbin/mingetty[1983]: tty3: Operation not permitted 
Apr 15 11:27:39 asgard kernel: audit(1081992459.258:0): avc:  denied  
{ fowner } for  pid=1983 exe=/sbin/mingetty capability=3 
scontext=system_u:system_r:getty_t tcontext=system_u:system_r:getty_t 
tclass=capability 
Apr 15 11:27:44 asgard /sbin/mingetty[1984]: tty1: Operation not permitted 
Apr 15 11:27:44 asgard kernel: AVC: 2 messages suppressed. 
Apr 15 11:27:44 asgard kernel: audit(1081992464.248:0): avc:  denied  
{ fowner } for  pid=1984 exe=/sbin/mingetty capability=3 
scontext=system_u:system_r:getty_t tcontext=system_u:system_r:getty_t 
tclass=capability 
Apr 15 11:27:44 asgard /sbin/mingetty[1985]: tty2: Operation not permitted 
Apr 15 11:27:44 asgard kernel: audit(1081992464.258:0): avc:  denied  
{ fowner } for  pid=1985 exe=/sbin/mingetty capability=3 
scontext=system_u:system_r:getty_t tcontext=system_u:system_r:getty_t 
tclass=capability 
Apr 15 11:27:44 asgard /sbin/mingetty[1986]: tty3: Operation not permitted 
Apr 15 11:27:44 asgard kernel: audit(1081992464.265:0): avc:  denied  
{ fowner } for  pid=1986 exe=/sbin/mingetty capability=3 
scontext=system_u:system_r:getty_t tcontext=system_u:system_r:getty_t 
tclass=capability 
Apr 15 11:27:49 asgard /sbin/mingetty[1987]: tty1: Operation not permitted 
Apr 15 11:27:49 asgard kernel: AVC: 2 messages suppressed. 
Apr 15 11:27:49 asgard kernel: audit(1081992469.255:0): avc:  denied  
{ fowner } for  pid=1987 exe=/sbin/mingetty capability=3 
scontext=system_u:system_r:getty_t tcontext=system_u:system_r:getty_t 
tclass=capability 
Apr 15 11:27:49 asgard /sbin/mingetty[1988]: tty2: Operation not permitted 
Apr 15 11:27:49 asgard kernel: audit(1081992469.265:0): avc:  denied  
{ fowner } for  pid=1988 exe=/sbin/mingetty capability=3 
scontext=system_u:system_r:getty_t tcontext=system_u:system_r:getty_t 
tclass=capability 
Apr 15 11:27:49 asgard /sbin/mingetty[1989]: tty3: Operation not permitted 
Apr 15 11:27:49 asgard kernel: audit(1081992469.272:0): avc:  denied  
{ fowner } for  pid=1989 exe=/sbin/mingetty capability=3 
scontext=system_u:system_r:getty_t tcontext=system_u:system_r:getty_t 
tclass=capability 
Apr 15 11:27:54 asgard /sbin/mingetty[1990]: tty1: Operation not permitted 
Apr 15 11:27:54 asgard kernel: AVC: 2 messages suppressed. 
Apr 15 11:27:54 asgard kernel: audit(1081992474.262:0): avc:  denied  
{ fowner } for  pid=1990 exe=/sbin/mingetty capability=3 
scontext=system_u:system_r:getty_t tcontext=system_u:system_r:getty_t 
tclass=capability 
Apr 15 11:27:54 asgard /sbin/mingetty[1991]: tty2: Operation not permitted 
Apr 15 11:27:54 asgard kernel: audit(1081992474.272:0): avc:  denied  
{ fowner } for  pid=1991 exe=/sbin/mingetty capability=3 
scontext=system_u:system_r:getty_t tcontext=system_u:system_r:getty_t 
tclass=capability 
Apr 15 11:27:54 asgard /sbin/mingetty[1992]: tty3: Operation not permitted 
Apr 15 11:27:54 asgard kernel: audit(1081992474.279:0): avc:  denied  
{ fowner } for  pid=1992 exe=/sbin/mingetty capability=3 
scontext=system_u:system_r:getty_t tcontext=system_u:system_r:getty_t 
tclass=capability 
Apr 15 11:27:59 asgard /sbin/mingetty[1993]: tty1: Operation not permitted 
Apr 15 11:27:59 asgard kernel: AVC: 2 messages suppressed. 
Apr 15 11:27:59 asgard kernel: audit(1081992479.269:0): avc:  denied  
{ fowner } for  pid=1993 exe=/sbin/mingetty capability=3 
scontext=system_u:system_r:getty_t tcontext=system_u:system_r:getty_t 
tclass=capability 
Apr 15 11:27:59 asgard /sbin/mingetty[1994]: tty2: Operation not permitted 
Apr 15 11:27:59 asgard kernel: audit(1081992479.279:0): avc:  denied  
{ fowner } for  pid=1994 exe=/sbin/mingetty capability=3 
scontext=system_u:system_r:getty_t tcontext=system_u:system_r:getty_t 
tclass=capability 
Apr 15 11:27:59 asgard kernel: audit(1081992479.287:0): avc:  denied  
{ fowner } for  pid=1995 exe=/sbin/mingetty capability=3 
scontext=system_u:system_r:getty_t tcontext=system_u:system_r:getty_t 
tclass=capability 
Apr 15 11:27:59 asgard /sbin/mingetty[1995]: tty3: Operation not permitted 
Apr 15 11:28:04 asgard kernel: AVC: 2 messages suppressed. 
Apr 15 11:28:04 asgard kernel: audit(1081992484.277:0): avc:  denied  
{ fowner } for  pid=1996 exe=/sbin/mingetty capability=3 
scontext=system_u:system_r:getty_t tcontext=system_u:system_r:getty_t 
tclass=capability 
Apr 15 11:28:04 asgard /sbin/mingetty[1996]: tty1: Operation not permitted 
Apr 15 11:28:04 asgard kernel: audit(1081992484.286:0): avc:  denied  
{ fowner } for  pid=1997 exe=/sbin/mingetty capability=3 
scontext=system_u:system_r:getty_t tcontext=system_u:system_r:getty_t 
tclass=capability 
Apr 15 11:28:04 asgard /sbin/mingetty[1997]: tty2: Operation not permitted 
Apr 15 11:28:04 asgard /sbin/mingetty[1998]: tty3: Operation not permitted 
Apr 15 11:28:04 asgard kernel: audit(1081992484.295:0): avc:  denied  
{ fowner } for  pid=1998 exe=/sbin/mingetty capability=3 
scontext=system_u:system_r:getty_t tcontext=system_u:system_r:getty_t 
tclass=capability 
Apr 15 11:28:09 asgard init: Id "1" respawning too fast: disabled for 5 
minutes 
Apr 15 11:28:09 asgard init: Id "2" respawning too fast: disabled for 5 
minutes 
Apr 15 11:28:09 asgard init: Id "3" respawning too fast: disabled for 5 
minutes

[Gene Czarcinski]

On Thursday 15 April 2004 04:33, Dennis Gilmore wrote:
>  Ok ill try again.  first post was denied for being to big so ill cut
> it
>  back. 
Long messages to the mailing list are likely to get more people annoyed than 
getting their help.  I suggest that you should put this information into a 
bugzilla report (along with your avc messages as an attachment).

You will then get a report in that the developers will be able to track.  If 
you want to discuss the problem on the mailing list, you can put in a url 
pointing to the bugzilla report.

Gene

[Russell Coker]

On Thu, 15 Apr 2004 18:33, Dennis Gilmore <dennis(a)ausil.us&gt; wrote:
>  Apr 15 11:26:06 asgard kernel: audit(1081992347.449:0): avc:  denied
>  { getattr } for  pid=774 exe=/sbin/pam_console_apply path=/dev/input/js2
>  dev=hde2 ino=234962788 scontext=system_u:system_r:pam_console_t
>  tcontext=system_u:object_r:unlabeled_t tclass=chr_file 
/dev/input/js* should have the type mouse_device_t.  Please do a "ls -Z" on 
them and tell me what it says.  NB It is not going to say unlabeled_t, it 
will say whatever is on disk, the kernel uses unlabeled_t if what's on disk 
makes no sense with the currently loaded policy.

>  Apr 15 11:26:06 asgard kernel: audit(1081992347.464:0): avc:  denied
>  { dac_override } for  pid=774 exe=/sbin/pam_console_apply capability=1
>  scontext=system_u:system_r:pam_console_t
>  tcontext=system_u:system_r:pam_console_t tclass=capability 
What is it trying to do here?

>  Apr 15 11:26:06 asgard kernel: audit(1081992347.464:0): avc:  denied
>  { dac_read_search } for  pid=774 exe=/sbin/pam_console_apply capability=2
>  scontext=system_u:system_r:pam_console_t
>  tcontext=system_u:system_r:pam_console_t tclass=capability 
The fact that it tries both in quick succession means that all it really 
wanted is read.

>  Apr 15 11:26:06 asgard kernel: inode_doinit_with_dentry:  getxattr
> returned
>  13 for dev=hde2 ino=234962799 
13 == EACCES?  That can't be right.  Steve, what do you think about this?

>  Apr 15 11:27:19 asgard /sbin/mingetty[1796]: tty1: Operation not
> permitted
>  Apr 15 11:27:19 asgard /sbin/mingetty[1797]: tty2: Operation not permitted
>  Apr 15 11:27:19 asgard /sbin/mingetty[1798]: tty3: Operation not permitted
>  Apr 15 11:27:19 asgard kernel: audit(1081992439.217:0): avc:  denied
>  { fowner } for  pid=1796 exe=/sbin/mingetty capability=3
>  scontext=system_u:system_r:getty_t tcontext=system_u:system_r:getty_t
>  tclass=capability 
Interesting.  Who owns your tty devices?

Granting this capability should not cause a problem so please test allowing 
this and see if it does some good.  We don't want to grant capabilities 
wildly, but this will be OK if there are cases that need it.

>  Apr 15 11:27:19 asgard kernel: audit(1081992439.880:0): avc:  denied 
> {
>  read } for  pid=1802 exe=/usr/bin/kdm name=mem dev=hde2 ino=33580795
>  scontext=system_u:system_r:xdm_t tcontext=system_u:object_r:memory_device_t
>  tclass=chr_file
>  Apr 15 11:27:19 asgard kdm[1802]: Cannot read randomFile "/dev/mem"; X
>  cookies may be easily guessable 
This one is already in bugzilla.  You could put an allow rule in custom.te if 
you want to reduce the noise.  But we deliberately don't want to allow this 
in the default policy.  kdm needs to be fixed (it was always broken).

>  Apr 15 11:27:19 asgard kernel: audit(1081992439.921:0): avc:  denied
>  { getattr } for  pid=1818 exe=/usr/X11R6/bin/Xorg path=/var/log/Xorg.0.log
>  dev=hde2 ino=302135865 scontext=system_u:system_r:xdm_t
>  tcontext=system_u:object_r:var_log_t tclass=file 
Put the following in file_contexts/program/xserver.fc
/var/log/XOrg.*         --      system_u:object_r:xserver_log_t

I have attached a suitable xserver.fc file.

Then you have to relabel /var/log after rebuilding the file_contexts file.

Regarding the long message, all the messages after 11:27:19 appeared to be 
repeats.  The X server and getty will continue restarting forever so will 
produce an unlimited amount of messages if they can't startup correctly.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

[Stephen Smalley]

On Thu, 2004-04-15 at 05:16, Russell Coker wrote:
>  > Apr 15 11:26:06 asgard kernel: inode_doinit_with_dentry: 
> getxattr returned
>  > 13 for dev=hde2 ino=234962799
>  
>  13 == EACCES?  That can't be right.  Steve, what do you think about this? 
Is XFS internally performing its own permission check on getxattr for
the security namespace?  If so, then that is a bug in XFS, as access
checking needs to be handled by the security module so that it can
internally call the handlers without restriction.

-- 
Stephen Smalley <sds(a)epoch.ncsc.mil&gt;
National Security Agency

[Aleksey Nogin]

On Thu, Apr 15, 2004 at 07:16:25PM +1000, Russell Coker wrote:

>  > Apr 15 11:27:19 asgard kernel: audit(1081992439.880:0): avc: 
> denied  {
>  > read } for  pid=1802 exe=/usr/bin/kdm name=mem dev=hde2 ino=33580795
>  > scontext=system_u:system_r:xdm_t tcontext=system_u:object_r:memory_device_t
>  > tclass=chr_file
>  > Apr 15 11:27:19 asgard kdm[1802]: Cannot read randomFile "/dev/mem"; X
>  > cookies may be easily guessable
>  
>  This one is already in bugzilla.   
Yes, bug #118051.

>  You could put an allow rule in custom.te if you want to reduce the
> noise. 
A better workaround is to add a line "RandomDevice=/dev/urandom" to the
"General" section of your /etc/X11/xdm/kdmrc file.

-- 
Aleksey Nogin

Home Page: http://nogin.org/
E-Mail: nogin(a)cs.caltech.edu (office), aleksey(a)nogin.org (personal)
Office: Jorgensen 70, tel: [phone]

[Dennis Gilmore]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Once upon a time Thursday 15 April 2004 7:16 pm, Russell Coker wrote:
>  On Thu, 15 Apr 2004 18:33, Dennis Gilmore <dennis(a)ausil.us&gt;
> wrote:
>  > Apr 15 11:26:06 asgard kernel: audit(1081992347.449:0): avc:  denied
>  > { getattr } for  pid=774 exe=/sbin/pam_console_apply path=/dev/input/js2
>  > dev=hde2 ino=234962788 scontext=system_u:system_r:pam_console_t
>  > tcontext=system_u:object_r:unlabeled_t tclass=chr_file
>
>  /dev/input/js* should have the type mouse_device_t.  Please do a "ls -Z" on
>  them and tell me what it says.  NB It is not going to say unlabeled_t, it
>  will say whatever is on disk, the kernel uses unlabeled_t if what's on disk
>  makes no sense with the currently loaded policy.
>  
system_u:object_r:mouse_device_t

>  > Apr 15 11:26:06 asgard kernel: audit(1081992347.464:0): avc: 
> denied
>  > { dac_override } for  pid=774 exe=/sbin/pam_console_apply capability=1
>  > scontext=system_u:system_r:pam_console_t
>  > tcontext=system_u:system_r:pam_console_t tclass=capability
>
>  What is it trying to do here? 
that im not sure of  there is lots of them logged but
they dont seem to be 
affecting things too much just thought i would bring it up


>  > Apr 15 11:26:06 asgard kernel: inode_doinit_with_dentry: 
> getxattr
>  > returned 13 for dev=hde2 ino=234962799
>
>  13 == EACCES?  That can't be right.  Steve, what do you think about this?
>
>  > Apr 15 11:27:19 asgard /sbin/mingetty[1796]: tty1: Operation not
>  > permitted Apr 15 11:27:19 asgard /sbin/mingetty[1797]: tty2: Operation
>  > not permitted Apr 15 11:27:19 asgard /sbin/mingetty[1798]: tty3:
>  > Operation not permitted Apr 15 11:27:19 asgard kernel:
>  > audit(1081992439.217:0): avc:  denied { fowner } for  pid=1796
>  > exe=/sbin/mingetty capability=3
>  > scontext=system_u:system_r:getty_t tcontext=system_u:system_r:getty_t
>  > tclass=capability
>
>  Interesting.  Who owns your tty devices? 
root:root
>  Granting this capability should not cause a problem so please test
> allowing
>  this and see if it does some good.  We don't want to grant capabilities
>  wildly, but this will be OK if there are cases that need it.
>  
<snip>
>  > Apr 15 11:27:19 asgard kernel: audit(1081992439.921:0): avc: 
> denied
>  > { getattr } for  pid=1818 exe=/usr/X11R6/bin/Xorg
>  > path=/var/log/Xorg.0.log dev=hde2 ino=302135865
>  > scontext=system_u:system_r:xdm_t
>  > tcontext=system_u:object_r:var_log_t tclass=file
>
>  Put the following in file_contexts/program/xserver.fc
>  /var/log/XOrg.*         --      system_u:object_r:xserver_log_t
>
>  I have attached a suitable xserver.fc file.
>
>  Then you have to relabel /var/log after rebuilding the file_contexts file.
>
>  Regarding the long message, all the messages after 11:27:19 appeared to be
>  repeats.  The X server and getty will continue restarting forever so will
>  produce an unlimited amount of messages if they can't startup correctly. 

Sorry i should have picked up the repeats and sorry it took me so long to get 
back i had a hdd failure in my server.  

With latest updates all seems ok except when i log in x dies and restarts  so 
i efectivly cant log in i treid starting at  run level 3  and x would start 
but hang

Dennis













> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.4 (GNU/Linux)
>
> iD8DBQFAhlQmkSxm47BaWfcRAtXNAJ4kPPoegHGsxryF/3M93JkHXrmphQCgi1gI
> dJUnl1YZW4FCntUzkyfFBIs=
> =kDiD
> -----END PGP SIGNATURE-----