audit log for "setenforce" changes?

[Chuck Anderson]

Is there any way to tell from the audit log or elsewhere when 
someone/something changed SELinux from enforcing to permissive or vice 
versa?

[Stephen Smalley]

On Fri, 2008-01-11 at 16:06 -0500, Chuck Anderson wrote:
>  Is there any way to tell from the audit log or elsewhere when 
>  someone/something changed SELinux from enforcing to permissive or vice 
>  versa? 
Look for MAC_STATUS records in the audit log, e.g.
	/sbin/ausearch -m MAC_STATUS

These include changes to enforcing mode, with the enforcing= and
old_enforcing= values.

-- 
Stephen Smalley
National Security Agency

[Chuck Anderson]

On Fri, Jan 11, 2008 at 04:16:21PM -0500, Stephen Smalley wrote:
>  
>  On Fri, 2008-01-11 at 16:06 -0500, Chuck Anderson wrote:
>  > Is there any way to tell from the audit log or elsewhere when 
>  > someone/something changed SELinux from enforcing to permissive or vice 
>  > versa?
>  
>  Look for MAC_STATUS records in the audit log, e.g.
>  	/sbin/ausearch -m MAC_STATUS
>  
>  These include changes to enforcing mode, with the enforcing= and
>  old_enforcing= values. 
This doesn't work apparently:

#cat /etc/fedora-release 
Fedora release 8 (Werewolf)

#ausearch -m MAC_STATUS
<no matches>
#sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   permissive
Mode from config file:          enforcing
Policy version:                 21
Policy from config file:        targeted
#setenforce 1
#sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   enforcing
Mode from config file:          enforcing
Policy version:                 21
Policy from config file:        targeted
[root@gkar 17:09:19 /var/log/audit]#ausearch -m MAC_STATUS
<no matches>
#setenforce 0
#sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   permissive
Mode from config file:          enforcing
Policy version:                 21
Policy from config file:        targeted
#ausearch -m MAC_STATUS
<no matches>

[Eric Paris]

On Fri, 2008-01-11 at 17:10 -0500, Chuck Anderson wrote:
>  On Fri, Jan 11, 2008 at 04:16:21PM -0500, Stephen Smalley wrote:
>  > 
>  > On Fri, 2008-01-11 at 16:06 -0500, Chuck Anderson wrote:
>  > > Is there any way to tell from the audit log or elsewhere when 
>  > > someone/something changed SELinux from enforcing to permissive or vice 
>  > > versa?
>  > 
>  > Look for MAC_STATUS records in the audit log, e.g.
>  > 	/sbin/ausearch -m MAC_STATUS
>  > 
>  > These include changes to enforcing mode, with the enforcing= and
>  > old_enforcing= values.
>  
>  This doesn't work apparently:
>  
>  #cat /etc/fedora-release 
>  Fedora release 8 (Werewolf)
>  
>  #ausearch -m MAC_STATUS
>  <no matches>
>  #sestatus
>  SELinux status:                 enabled
>  SELinuxfs mount:                /selinux
>  Current mode:                   permissive
>  Mode from config file:          enforcing
>  Policy version:                 21
>  Policy from config file:        targeted
>  #setenforce 1
>  #sestatus
>  SELinux status:                 enabled
>  SELinuxfs mount:                /selinux
>  Current mode:                   enforcing
>  Mode from config file:          enforcing
>  Policy version:                 21
>  Policy from config file:        targeted
>  [root@gkar 17:09:19 /var/log/audit]#ausearch -m MAC_STATUS
>  <no matches>
>  #setenforce 0
>  #sestatus
>  SELinux status:                 enabled
>  SELinuxfs mount:                /selinux
>  Current mode:                   permissive
>  Mode from config file:          enforcing
>  Policy version:                 21
>  Policy from config file:        targeted
>  #ausearch -m MAC_STATUS
>  <no matches> 
Do you have auditd running?  If not look in dmesg or /var/log/messages
instead of ausearch because it seems to be working fine for me....

[root@localhost ~]# cat /etc/fedora-release
Fedora release 8 (Werewolf)
[root@localhost ~]# setenforce 1
[root@localhost ~]# ausearch -m MAC_STATUS
----
time->Sat Jan 12 08:33:04 2008
type=SYSCALL msg=audit(1200144784.891:24): arch=40000003 syscall=4
success=yes exit=1 a0=3 a1=bf83f1e4 a2=1 a3=bf83f1e4 items=0 ppid=3155
pid=3394 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=pts1 comm="setenforce" exe="/usr/sbin/setenforce"
subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=MAC_STATUS msg=audit(1200144784.891:24): enforcing=0
old_enforcing=1 auid=500
----
time->Sat Jan 12 08:33:39 2008
type=SYSCALL msg=audit(1200144819.882:26): arch=40000003 syscall=4
success=yes exit=1 a0=3 a1=bfb534f4 a2=1 a3=bfb534f4 items=0 ppid=3155
pid=3399 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=pts1 comm="setenforce" exe="/usr/sbin/setenforce"
subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=MAC_STATUS msg=audit(1200144819.882:26): enforcing=1
old_enforcing=0 auid=500
[root@localhost ~]#

[Chuck Anderson]

On Sat, Jan 12, 2008 at 08:37:04AM -0500, Eric Paris wrote:
>  Do you have auditd running?  If not look in dmesg or
> /var/log/messages
>  instead of ausearch because it seems to be working fine for me.... 
Yes, I do have auditd running.

#service auditd status
auditd (pid 2523) is running...
#service rsyslog status
rsyslogd (pid 19658) is running...
rklogd (pid 19664) is running...
#ausearch  -m MAC_STATUS
<no matches>
#setenforce 0
#ausearch -m MAC_STATUS
<no matches>
#setenforce 1
#ausearch -m MAC_STATUS
<no matches>
#setenforce 0
#ausearch -m MAC_STATUS
<no matches>
#grep setenforce /var/log/messages
#grep setenforce /var/log/syslog
#grep setenforce /var/log/secure
#dmesg|grep setenforce

[Eric Paris]

hmmm, are you getting any audit messages?  Maybe a long time back your
ran out of disk space and auditd stopped logging?  If you service auditd
restart and it can't log for some reason it should tell you
in /var/log/messages...

maybe auditd is turned off?  what do you get from auditctl -s ??  is it
enabled?  maybe you ran auditctl -e 0 at some time?

assuming audit isn't running the message in dmesg looks like:
type=1404 audit(1200447974.622:247): enforcing=0 old_enforcing=1
auid=4294967295 ses=4294967295

and the corresponding /var/log/messages:
Jan 15 20:46:14 dhcp231-146 kernel: type=1404 audit(1200447974.622:247):
enforcing=0 old_enforcing=1 auid=4294967295 ses=4294967295

start telling me about all of your versions, are they all stock or did
you build some of these parts yourself.  Because I can't find a way to
reproduce the problem to fix it....

-Eric

On Mon, 2008-01-14 at 12:35 -0500, Chuck Anderson wrote:
>  On Sat, Jan 12, 2008 at 08:37:04AM -0500, Eric Paris wrote:
>  > Do you have auditd running?  If not look in dmesg or /var/log/messages
>  > instead of ausearch because it seems to be working fine for me....
>  
>  Yes, I do have auditd running.
>  
>  #service auditd status
>  auditd (pid 2523) is running...
>  #service rsyslog status
>  rsyslogd (pid 19658) is running...
>  rklogd (pid 19664) is running...
>  #ausearch  -m MAC_STATUS
>  <no matches>
>  #setenforce 0
>  #ausearch -m MAC_STATUS
>  <no matches>
>  #setenforce 1
>  #ausearch -m MAC_STATUS
>  <no matches>
>  #setenforce 0
>  #ausearch -m MAC_STATUS
>  <no matches>
>  #grep setenforce /var/log/messages
>  #grep setenforce /var/log/syslog
>  #grep setenforce /var/log/secure
>  #dmesg|grep setenforce
>  
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-selinux-list

[Chuck Anderson]

On Mon, Jan 14, 2008 at 12:46:52PM -0500, Eric Paris wrote:
>  hmmm, are you getting any audit messages? 
It appears that the last message I got was on Dec 12:

#ausearch -m AVC -i | tail -1
type=AVC msg=audit(12/12/2007 06:05:58.434:68533739) : avc:  denied  { 
getattr } for  pid=31687 comm=named path=/var/log/named/queries 
dev=dm-3 ino=10944781 scontext=system_u:system_r:named_t:s0 
tcontext=system_u:object_r:var_log_t:s0 tclass=file 


>   Maybe a long time back your
>   ran out of disk space and auditd stopped logging?   
I don't think I ran out of space:

#df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/mapper/VolGroup00-root
                       39G  301M   37G   1% /
/dev/sda2             494M   32M  438M   7% /boot
tmpfs                 1.5G     0  1.5G   0% /dev/shm
/dev/mapper/VolGroup00-home
                       97G  9.3G   83G  11% /home
/dev/mapper/VolGroup00-usr
                       97G  1.3G   91G   2% /usr
/dev/mapper/VolGroup00-var
                       97G   15G   78G  16% /var

>  If you service auditd
>  restart and it can't log for some reason it should tell you
>  in /var/log/messages...
>  
>  maybe auditd is turned off?  what do you get from auditctl -s ??  is it
>  enabled?  maybe you ran auditctl -e 0 at some time? 
#auditctl -s
AUDIT_STATUS: enabled=1 flag=1 pid=2523 rate_limit=0 backlog_limit=256 
lost=0 backlog=0

>  assuming audit isn't running the message in dmesg looks like:
>  type=1404 audit(1200447974.622:247): enforcing=0 old_enforcing=1
>  auid=4294967295 ses=4294967295
>  
>  and the corresponding /var/log/messages:
>  Jan 15 20:46:14 dhcp231-146 kernel: type=1404 audit(1200447974.622:247):
>  enforcing=0 old_enforcing=1 auid=4294967295 ses=4294967295 
#grep enforcing /var/log/messages
#dmesg | grep enforcing

Ok, I restarted auditd:

#service auditd restart
Stopping auditd:                                           [  OK  ]
Starting auditd:                                           [  OK  ]
#ausearch -m AVC -i | tail -1
type=AVC msg=audit(01/14/2008 13:25:32.903:137848459) : avc:  denied  
{ getattr } for  pid=31227 comm=radiusd 
path=/var/log/radius/radius.log dev=dm-3 ino=10944744 
scontext=unconfined_u:system_r:radiusd_t:s0 
tcontext=system_u:object_r:user_home_t:s0 tclass=file 

>  start telling me about all of your versions, are they all stock or
> did
>  you build some of these parts yourself.  Because I can't find a way to
>  reproduce the problem to fix it.... 
Stock Fedora 8 with updates:

#uname -r ; rpm -q kernel audit selinux-policy selinux-policy-targeted setools
policycoreutils
2.6.23.8-63.fc8
kernel-2.6.23.8-63.fc8
kernel-2.6.23.9-85.fc8
audit-1.6.2-4.fc8
selinux-policy-3.0.8-73.fc8
selinux-policy-targeted-3.0.8-73.fc8
setools-3.3.1-7.fc8
policycoreutils-2.0.33-2.fc8
policycoreutils-2.0.33-3.fc8

Here is what updated on Dec 12 when the audit logging stopped:

Dec 12 05:59:52 Updated: yum - 3.2.8-2.fc8.noarch
Dec 12 06:05:20 Updated: cyrus-sasl-lib - 2.1.22-8.fc8.i386
Dec 12 06:05:20 Updated: libsepol - 2.0.15-1.fc8.i386
Dec 12 06:05:20 Updated: libsemanage - 2.0.12-2.fc8.i386
Dec 12 06:05:21 Updated: policycoreutils - 2.0.32-2.fc8.i386
Dec 12 06:05:23 Updated: samba-common - 3.0.28-0.fc8.i386
Dec 12 06:05:23 Updated: cyrus-sasl-md5 - 2.1.22-8.fc8.i386
Dec 12 06:05:23 Updated: cyrus-sasl-plain - 2.1.22-8.fc8.i386
Dec 12 06:05:24 Updated: samba-client - 3.0.28-0.fc8.i386
Dec 12 06:05:24 Updated: cyrus-sasl - 2.1.22-8.fc8.i386
Dec 12 06:05:25 Updated: selinux-policy - 3.0.8-64.fc8.noarch
Dec 12 06:06:05 Updated: selinux-policy-targeted - 3.0.8-64.fc8.noarch

I wonder if this is when it somehow got flipped back to enforcing=1 
since I had been running with a manual "setenforce 0" since November.

[Eric Paris]

On Mon, 2008-01-14 at 13:31 -0500, Chuck Anderson wrote:
>  On Mon, Jan 14, 2008 at 12:46:52PM -0500, Eric Paris wrote:
>  > hmmm, are you getting any audit messages?
>  
>  It appears that the last message I got was on Dec 12:
>  
>  #ausearch -m AVC -i | tail -1
>  type=AVC msg=audit(12/12/2007 06:05:58.434:68533739) : avc:  denied  { 
>  getattr } for  pid=31687 comm=named path=/var/log/named/queries 
>  dev=dm-3 ino=10944781 scontext=system_u:system_r:named_t:s0 
>  tcontext=system_u:object_r:var_log_t:s0 tclass=file 
>  
>  
>  >  Maybe a long time back your
>  >  ran out of disk space and auditd stopped logging?  
>  
>  I don't think I ran out of space:
>  
>  #df -h
>  Filesystem            Size  Used Avail Use% Mounted on
>  /dev/mapper/VolGroup00-root
>                         39G  301M   37G   1% /
>  /dev/sda2             494M   32M  438M   7% /boot
>  tmpfs                 1.5G     0  1.5G   0% /dev/shm
>  /dev/mapper/VolGroup00-home
>                         97G  9.3G   83G  11% /home
>  /dev/mapper/VolGroup00-usr
>                         97G  1.3G   91G   2% /usr
>  /dev/mapper/VolGroup00-var
>                         97G   15G   78G  16% /var
>  
>  > If you service auditd
>  > restart and it can't log for some reason it should tell you
>  > in /var/log/messages...
>  > 
>  > maybe auditd is turned off?  what do you get from auditctl -s ??  is it
>  > enabled?  maybe you ran auditctl -e 0 at some time?
>  
>  #auditctl -s
>  AUDIT_STATUS: enabled=1 flag=1 pid=2523 rate_limit=0 backlog_limit=256 
>  lost=0 backlog=0
>  
>  > assuming audit isn't running the message in dmesg looks like:
>  > type=1404 audit(1200447974.622:247): enforcing=0 old_enforcing=1
>  > auid=4294967295 ses=4294967295
>  > 
>  > and the corresponding /var/log/messages:
>  > Jan 15 20:46:14 dhcp231-146 kernel: type=1404 audit(1200447974.622:247):
>  > enforcing=0 old_enforcing=1 auid=4294967295 ses=4294967295
>  
>  #grep enforcing /var/log/messages
>  #dmesg | grep enforcing
>  
>  Ok, I restarted auditd:
>  
>  #service auditd restart
>  Stopping auditd:                                           [  OK  ]
>  Starting auditd:                                           [  OK  ]
>  #ausearch -m AVC -i | tail -1
>  type=AVC msg=audit(01/14/2008 13:25:32.903:137848459) : avc:  denied  
>  { getattr } for  pid=31227 comm=radiusd 
>  path=/var/log/radius/radius.log dev=dm-3 ino=10944744 
>  scontext=unconfined_u:system_r:radiusd_t:s0 
>  tcontext=system_u:object_r:user_home_t:s0 tclass=file 
>  
>  > start telling me about all of your versions, are they all stock or did
>  > you build some of these parts yourself.  Because I can't find a way to
>  > reproduce the problem to fix it....
>  
>  Stock Fedora 8 with updates:
>  
>  #uname -r ; rpm -q kernel audit selinux-policy selinux-policy-targeted setools
> policycoreutils
>  2.6.23.8-63.fc8
>  kernel-2.6.23.8-63.fc8
>  kernel-2.6.23.9-85.fc8
>  audit-1.6.2-4.fc8
>  selinux-policy-3.0.8-73.fc8
>  selinux-policy-targeted-3.0.8-73.fc8
>  setools-3.3.1-7.fc8
>  policycoreutils-2.0.33-2.fc8
>  policycoreutils-2.0.33-3.fc8
>  
>  Here is what updated on Dec 12 when the audit logging stopped:
>  
>  Dec 12 05:59:52 Updated: yum - 3.2.8-2.fc8.noarch
>  Dec 12 06:05:20 Updated: cyrus-sasl-lib - 2.1.22-8.fc8.i386
>  Dec 12 06:05:20 Updated: libsepol - 2.0.15-1.fc8.i386
>  Dec 12 06:05:20 Updated: libsemanage - 2.0.12-2.fc8.i386
>  Dec 12 06:05:21 Updated: policycoreutils - 2.0.32-2.fc8.i386
>  Dec 12 06:05:23 Updated: samba-common - 3.0.28-0.fc8.i386
>  Dec 12 06:05:23 Updated: cyrus-sasl-md5 - 2.1.22-8.fc8.i386
>  Dec 12 06:05:23 Updated: cyrus-sasl-plain - 2.1.22-8.fc8.i386
>  Dec 12 06:05:24 Updated: samba-client - 3.0.28-0.fc8.i386
>  Dec 12 06:05:24 Updated: cyrus-sasl - 2.1.22-8.fc8.i386
>  Dec 12 06:05:25 Updated: selinux-policy - 3.0.8-64.fc8.noarch
>  Dec 12 06:06:05 Updated: selinux-policy-targeted - 3.0.8-64.fc8.noarch
>  
>  I wonder if this is when it somehow got flipped back to enforcing=1 
>  since I had been running with a manual "setenforce 0" since November 
Maybe on policy reload it read /etc/selinux/config and pulled that
setting?

Anyway, you have some serious labeling issue there in /var...

try restorecon -R /var

-Eric

[Stephen Smalley]

On Mon, 2008-01-14 at 13:42 -0500, Eric Paris wrote:
>  On Mon, 2008-01-14 at 13:31 -0500, Chuck Anderson wrote:
>  > On Mon, Jan 14, 2008 at 12:46:52PM -0500, Eric Paris wrote:
>  > > hmmm, are you getting any audit messages?
>  > 
>  > It appears that the last message I got was on Dec 12:
>  > 
>  > #ausearch -m AVC -i | tail -1
>  > type=AVC msg=audit(12/12/2007 06:05:58.434:68533739) : avc:  denied  { 
>  > getattr } for  pid=31687 comm=named path=/var/log/named/queries 
>  > dev=dm-3 ino=10944781 scontext=system_u:system_r:named_t:s0 
>  > tcontext=system_u:object_r:var_log_t:s0 tclass=file 
>  > 
>  > 
>  > >  Maybe a long time back your
>  > >  ran out of disk space and auditd stopped logging?  
>  > 
>  > I don't think I ran out of space:
>  > 
>  > #df -h
>  > Filesystem            Size  Used Avail Use% Mounted on
>  > /dev/mapper/VolGroup00-root
>  >                        39G  301M   37G   1% /
>  > /dev/sda2             494M   32M  438M   7% /boot
>  > tmpfs                 1.5G     0  1.5G   0% /dev/shm
>  > /dev/mapper/VolGroup00-home
>  >                        97G  9.3G   83G  11% /home
>  > /dev/mapper/VolGroup00-usr
>  >                        97G  1.3G   91G   2% /usr
>  > /dev/mapper/VolGroup00-var
>  >                        97G   15G   78G  16% /var
>  > 
>  > > If you service auditd
>  > > restart and it can't log for some reason it should tell you
>  > > in /var/log/messages...
>  > > 
>  > > maybe auditd is turned off?  what do you get from auditctl -s ??  is it
>  > > enabled?  maybe you ran auditctl -e 0 at some time?
>  > 
>  > #auditctl -s
>  > AUDIT_STATUS: enabled=1 flag=1 pid=2523 rate_limit=0 backlog_limit=256 
>  > lost=0 backlog=0
>  > 
>  > > assuming audit isn't running the message in dmesg looks like:
>  > > type=1404 audit(1200447974.622:247): enforcing=0 old_enforcing=1
>  > > auid=4294967295 ses=4294967295
>  > > 
>  > > and the corresponding /var/log/messages:
>  > > Jan 15 20:46:14 dhcp231-146 kernel: type=1404 audit(1200447974.622:247):
>  > > enforcing=0 old_enforcing=1 auid=4294967295 ses=4294967295
>  > 
>  > #grep enforcing /var/log/messages
>  > #dmesg | grep enforcing
>  > 
>  > Ok, I restarted auditd:
>  > 
>  > #service auditd restart
>  > Stopping auditd:                                           [  OK  ]
>  > Starting auditd:                                           [  OK  ]
>  > #ausearch -m AVC -i | tail -1
>  > type=AVC msg=audit(01/14/2008 13:25:32.903:137848459) : avc:  denied  
>  > { getattr } for  pid=31227 comm=radiusd 
>  > path=/var/log/radius/radius.log dev=dm-3 ino=10944744 
>  > scontext=unconfined_u:system_r:radiusd_t:s0 
>  > tcontext=system_u:object_r:user_home_t:s0 tclass=file 
>  > 
>  > > start telling me about all of your versions, are they all stock or did
>  > > you build some of these parts yourself.  Because I can't find a way to
>  > > reproduce the problem to fix it....
>  > 
>  > Stock Fedora 8 with updates:
>  > 
>  > #uname -r ; rpm -q kernel audit selinux-policy selinux-policy-targeted setools
> policycoreutils
>  > 2.6.23.8-63.fc8
>  > kernel-2.6.23.8-63.fc8
>  > kernel-2.6.23.9-85.fc8
>  > audit-1.6.2-4.fc8
>  > selinux-policy-3.0.8-73.fc8
>  > selinux-policy-targeted-3.0.8-73.fc8
>  > setools-3.3.1-7.fc8
>  > policycoreutils-2.0.33-2.fc8
>  > policycoreutils-2.0.33-3.fc8
>  > 
>  > Here is what updated on Dec 12 when the audit logging stopped:
>  > 
>  > Dec 12 05:59:52 Updated: yum - 3.2.8-2.fc8.noarch
>  > Dec 12 06:05:20 Updated: cyrus-sasl-lib - 2.1.22-8.fc8.i386
>  > Dec 12 06:05:20 Updated: libsepol - 2.0.15-1.fc8.i386
>  > Dec 12 06:05:20 Updated: libsemanage - 2.0.12-2.fc8.i386
>  > Dec 12 06:05:21 Updated: policycoreutils - 2.0.32-2.fc8.i386
>  > Dec 12 06:05:23 Updated: samba-common - 3.0.28-0.fc8.i386
>  > Dec 12 06:05:23 Updated: cyrus-sasl-md5 - 2.1.22-8.fc8.i386
>  > Dec 12 06:05:23 Updated: cyrus-sasl-plain - 2.1.22-8.fc8.i386
>  > Dec 12 06:05:24 Updated: samba-client - 3.0.28-0.fc8.i386
>  > Dec 12 06:05:24 Updated: cyrus-sasl - 2.1.22-8.fc8.i386
>  > Dec 12 06:05:25 Updated: selinux-policy - 3.0.8-64.fc8.noarch
>  > Dec 12 06:06:05 Updated: selinux-policy-targeted - 3.0.8-64.fc8.noarch
>  > 
>  > I wonder if this is when it somehow got flipped back to enforcing=1 
>  > since I had been running with a manual "setenforce 0" since November
>  
>  Maybe on policy reload it read /etc/selinux/config and pulled that
>  setting? 
load_policy doesn't touch the enforcing status.

>  Anyway, you have some serious labeling issue there in /var...
>  
>  try restorecon -R /var 
-- 
Stephen Smalley
National Security Agency

[Chuck Anderson]

On Mon, Jan 14, 2008 at 01:46:17PM -0500, Stephen Smalley wrote:
>  load_policy doesn't touch the enforcing status.
>  
>  > Anyway, you have some serious labeling issue there in /var...
>  > 
>  > try restorecon -R /var 
The labelleing issues I would (perhaps incorrectly) expect from 
running SELinux in permissive mode.  I decided to relabel and reboot 
into enforcing mode.  What a disaster.  The system couldn't boot 
enough to run the "fixfiles restore" from /etc/rc.sysinit, not even in 
single user mode.  I had to eventually boot into single user mode with 
the selinux=0 kernel parameter and run "fixfiles restore" manully.  
Then I discovered that somehow a bunch of bogus "unconfined" entries 
had appeared in 
/etc/selinux/targeted/contexts/files/file_contexts.homedirs:

#
#
# User-specific file contexts, generated via libsemanage
# use semanage command to manage system users to change the file_context
#
#


#
# Home Context for user unconfined_u
#

/etc/[^/]*/.+	unconfined_u:object_r:unconfined_home_t:s0
/etc/[^/]*/.gnome2(/.*)?	unconfined_u:object_r:unconfined_gnome_home_t:s0
/etc/[^/]*/.*/plugins/nprhapengine\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
/etc/[^/]*/.*/plugins/libflashplayer\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
/etc/[^/]*/((www)|(web)|(public_html))(/.+)?	unconfined_u:object_r:httpd_unconfined_content_t:s0
/etc/[^/]*/\.java(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
/etc/[^/]*/\.galeon(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
/etc/[^/]*/\.mozilla(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
/etc/[^/]*/\.phoenix(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
/etc/[^/]*/\.mozilla(/.*)?/plugins/libflashplayer\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
/etc/[^/]*/\.netscape(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
/etc/[^/]*/\.gstreamer-.*/[^/]*\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
/etc/[^/]*/\.config/gtk-.*	unconfined_u:object_r:unconfined_gnome_home_t:s0
/etc/[^/]*	-d	unconfined_u:object_r:unconfined_home_dir_t:s0
/etc/[^/]*	-l	unconfined_u:object_r:unconfined_home_dir_t:s0
/etc/lost\+found/.*	<<none>>
/etc	-d	system_u:object_r:home_root_t:s0
/etc/\.journal	<<none>>
/etc/lost\+found	-d	system_u:object_r:lost_found_t:s0


#
# Home Context for user unconfined_u
#

/home/[^/]*/.+	unconfined_u:object_r:unconfined_home_t:s0
/home/[^/]*/.gnome2(/.*)?	unconfined_u:object_r:unconfined_gnome_home_t:s0
/home/[^/]*/.*/plugins/nprhapengine\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
/home/[^/]*/.*/plugins/libflashplayer\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
/home/[^/]*/((www)|(web)|(public_html))(/.+)?	unconfined_u:object_r:httpd_unconfined_content_t:s0
/home/[^/]*/\.java(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
/home/[^/]*/\.galeon(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
/home/[^/]*/\.mozilla(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
/home/[^/]*/\.phoenix(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
/home/[^/]*/\.mozilla(/.*)?/plugins/libflashplayer\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
/home/[^/]*/\.netscape(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
/home/[^/]*/\.gstreamer-.*/[^/]*\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
/home/[^/]*/\.config/gtk-.*	unconfined_u:object_r:unconfined_gnome_home_t:s0
/home/[^/]*	-d	unconfined_u:object_r:unconfined_home_dir_t:s0
/home/[^/]*	-l	unconfined_u:object_r:unconfined_home_dir_t:s0
/home/lost\+found/.*	<<none>>
/home	-d	system_u:object_r:home_root_t:s0
/home/\.journal	<<none>>
/home/lost\+found	-d	system_u:object_r:lost_found_t:s0


#
# Home Context for user unconfined_u
#

/opt/[^/]*/.+	unconfined_u:object_r:unconfined_home_t:s0
/opt/[^/]*/.gnome2(/.*)?	unconfined_u:object_r:unconfined_gnome_home_t:s0
/opt/[^/]*/.*/plugins/nprhapengine\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
/opt/[^/]*/.*/plugins/libflashplayer\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
/opt/[^/]*/((www)|(web)|(public_html))(/.+)?	unconfined_u:object_r:httpd_unconfined_content_t:s0
/opt/[^/]*/\.java(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
/opt/[^/]*/\.galeon(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
/opt/[^/]*/\.mozilla(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
/opt/[^/]*/\.phoenix(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
/opt/[^/]*/\.mozilla(/.*)?/plugins/libflashplayer\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
/opt/[^/]*/\.netscape(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
/opt/[^/]*/\.gstreamer-.*/[^/]*\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
/opt/[^/]*/\.config/gtk-.*	unconfined_u:object_r:unconfined_gnome_home_t:s0
/opt/[^/]*	-d	unconfined_u:object_r:unconfined_home_dir_t:s0
/opt/[^/]*	-l	unconfined_u:object_r:unconfined_home_dir_t:s0
/opt/lost\+found/.*	<<none>>
/opt	-d	system_u:object_r:home_root_t:s0
/opt/\.journal	<<none>>
/opt/lost\+found	-d	system_u:object_r:lost_found_t:s0


#
# Home Context for user unconfined_u
#

/usr/libexec/[^/]*/.+	unconfined_u:object_r:unconfined_home_t:s0
/usr/libexec/[^/]*/.gnome2(/.*)?	unconfined_u:object_r:unconfined_gnome_home_t:s0
/usr/libexec/[^/]*/.*/plugins/nprhapengine\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
/usr/libexec/[^/]*/.*/plugins/libflashplayer\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
/usr/libexec/[^/]*/((www)|(web)|(public_html))(/.+)?	unconfined_u:object_r:httpd_unconfined_content_t:s0
/usr/libexec/[^/]*/\.java(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
/usr/libexec/[^/]*/\.galeon(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
/usr/libexec/[^/]*/\.mozilla(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
/usr/libexec/[^/]*/\.phoenix(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
/usr/libexec/[^/]*/\.mozilla(/.*)?/plugins/libflashplayer\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
/usr/libexec/[^/]*/\.netscape(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
/usr/libexec/[^/]*/\.gstreamer-.*/[^/]*\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
/usr/libexec/[^/]*/\.config/gtk-.*	unconfined_u:object_r:unconfined_gnome_home_t:s0
/usr/libexec/[^/]*	-d	unconfined_u:object_r:unconfined_home_dir_t:s0
/usr/libexec/[^/]*	-l	unconfined_u:object_r:unconfined_home_dir_t:s0
/usr/libexec/lost\+found/.*	<<none>>
/usr/libexec	-d	system_u:object_r:home_root_t:s0
/usr/libexec/\.journal	<<none>>
/usr/libexec/lost\+found	-d	system_u:object_r:lost_found_t:s0


#
# Home Context for user unconfined_u
#

/var/log/[^/]*/.+	unconfined_u:object_r:unconfined_home_t:s0
/var/log/[^/]*/.gnome2(/.*)?	unconfined_u:object_r:unconfined_gnome_home_t:s0
/var/log/[^/]*/.*/plugins/nprhapengine\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
/var/log/[^/]*/.*/plugins/libflashplayer\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
/var/log/[^/]*/((www)|(web)|(public_html))(/.+)?	unconfined_u:object_r:httpd_unconfined_content_t:s0
/var/log/[^/]*/\.java(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
/var/log/[^/]*/\.galeon(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
/var/log/[^/]*/\.mozilla(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
/var/log/[^/]*/\.phoenix(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
/var/log/[^/]*/\.mozilla(/.*)?/plugins/libflashplayer\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
/var/log/[^/]*/\.netscape(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
/var/log/[^/]*/\.gstreamer-.*/[^/]*\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
/var/log/[^/]*/\.config/gtk-.*	unconfined_u:object_r:unconfined_gnome_home_t:s0
/var/log/[^/]*	-d	unconfined_u:object_r:unconfined_home_dir_t:s0
/var/log/[^/]*	-l	unconfined_u:object_r:unconfined_home_dir_t:s0
/var/log/lost\+found/.*	<<none>>
/var/log	-d	system_u:object_r:home_root_t:s0
/var/log/\.journal	<<none>>
/var/log/lost\+found	-d	system_u:object_r:lost_found_t:s0
/tmp/gconfd-.*	-d	unconfined_u:object_r:unconfined_tmp_t:s0


#
# Home Context for user root
#

/root/.+	root:object_r:sysadm_home_t:s0
/root/.gnome2(/.*)?	root:object_r:sysadm_gnome_home_t:s0
/root/.*/plugins/nprhapengine\.so.*	--	root:object_r:textrel_shlib_t:s0
/root/.*/plugins/libflashplayer\.so.*	--	root:object_r:textrel_shlib_t:s0
/root/((www)|(web)|(public_html))(/.+)?	root:object_r:httpd_sysadm_content_t:s0
/root/\.ssh(/.*)?	root:object_r:sysadm_home_ssh_t:s0
/root/\.uml(/.*)?	root:object_r:sysadm_uml_rw_t:s0
/root/\.java(/.*)?	root:object_r:sysadm_mozilla_home_t:s0
/root/\.xauth.*	--	root:object_r:sysadm_xauth_home_t:s0
/root/\.fonts(/.*)?	root:object_r:sysadm_fonts_t:s0
/root/\.pyzor(/.*)?	root:object_r:sysadm_pyzor_home_t:s0
/root/\.razor(/.*)?	root:object_r:sysadm_razor_home_t:s0
/root/vmware(/.*)?	root:object_r:sysadm_vmware_file_t:s0
/root/\.galeon(/.*)?	root:object_r:sysadm_mozilla_home_t:s0
/root/\.vmware(/.*)?	root:object_r:sysadm_vmware_file_t:s0
/root/\.vmware[^/]*/.*\.cfg	--	root:object_r:sysadm_vmware_conf_t:s0
/root/\.mozilla(/.*)?	root:object_r:sysadm_mozilla_home_t:s0
/root/\.phoenix(/.*)?	root:object_r:sysadm_mozilla_home_t:s0
/root/\.mplayer(/.*)?	root:object_r:sysadm_mplayer_home_t:s0
/root/\.mozilla(/.*)?/plugins/libflashplayer\.so.*	--	root:object_r:textrel_shlib_t:s0
/root/\.ethereal(/.*)?	root:object_r:sysadm_ethereal_home_t:s0
/root/\.netscape(/.*)?	root:object_r:sysadm_mozilla_home_t:s0
/root/\.Xauthority.*	--	root:object_r:sysadm_xauth_home_t:s0
/root/\.fonts/auto(/.*)?	root:object_r:sysadm_fonts_cache_t:s0
/root/\.gstreamer-.*/[^/]*\.so.*	--	root:object_r:textrel_shlib_t:s0
/root/\.config/gtk-.*	root:object_r:sysadm_gnome_home_t:s0
/root/\.fonts\.cache-.*	--	root:object_r:sysadm_fonts_cache_t:s0
/root/\.ICEauthority.*	--	root:object_r:sysadm_iceauth_home_t:s0
/root/\.spamassassin(/.*)?	root:object_r:sysadm_spamassassin_home_t:s0
/root	-d	root:object_r:sysadm_home_dir_t:s0
/root	-l	root:object_r:sysadm_home_dir_t:s0
/root/\.ircmotd	--	root:object_r:sysadm_irc_home_t:s0
/root/\.screenrc	--	root:object_r:sysadm_screen_ro_home_t:s0
/root/\.fonts\.conf	--	root:object_r:sysadm_fonts_config_t:s0
/tmp/gconfd-root	-d	root:object_r:sysadm_tmp_t:s0


I deleted all the sections head up with "Home Context for user 
unconfined_u" then re-ran "fixfiles restore".

The conclusion I draw is that running SELinux in permissive mode for 
an extended period of time isn't well supported at all, and shouldn't 
be recommended ever.  Perhaps more testing should go into running a 
system in permissive mode while yum updates apply selinux packages, 
etc. to find these types of issues.

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Chuck Anderson wrote:
>  On Mon, Jan 14, 2008 at 01:46:17PM -0500, Stephen Smalley wrote:
> > load_policy doesn't touch the enforcing status.
> >
> >> Anyway, you have some serious labeling issue there in /var...
> >>
> >> try restorecon -R /var
>  
>  The labelleing issues I would (perhaps incorrectly) expect from 
>  running SELinux in permissive mode.  I decided to relabel and reboot 
>  into enforcing mode.  What a disaster.  The system couldn't boot 
>  enough to run the "fixfiles restore" from /etc/rc.sysinit, not even in 
>  single user mode.  I had to eventually boot into single user mode with 
>  the selinux=0 kernel parameter and run "fixfiles restore" manully.  
>  Then I discovered that somehow a bunch of bogus "unconfined" entries 
>  had appeared in 
>  /etc/selinux/targeted/contexts/files/file_contexts.homedirs:
>  
>  #
>  #
>  # User-specific file contexts, generated via libsemanage
>  # use semanage command to manage system users to change the file_context
>  #
>  #
>  
>  
>  #
>  # Home Context for user unconfined_u
>  #
>  
>  /etc/[^/]*/.+	unconfined_u:object_r:unconfined_home_t:s0
>  /etc/[^/]*/.gnome2(/.*)?	unconfined_u:object_r:unconfined_gnome_home_t:s0
>  /etc/[^/]*/.*/plugins/nprhapengine\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
>  /etc/[^/]*/.*/plugins/libflashplayer\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
>
> /etc/[^/]*/((www)|(web)|(public_html))(/.+)?	unconfined_u:object_r:httpd_unconfined_content_t:s0
>  /etc/[^/]*/\.java(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
>  /etc/[^/]*/\.galeon(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
>  /etc/[^/]*/\.mozilla(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
>  /etc/[^/]*/\.phoenix(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
>
> /etc/[^/]*/\.mozilla(/.*)?/plugins/libflashplayer\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
>  /etc/[^/]*/\.netscape(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
>  /etc/[^/]*/\.gstreamer-.*/[^/]*\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
>  /etc/[^/]*/\.config/gtk-.*	unconfined_u:object_r:unconfined_gnome_home_t:s0
>  /etc/[^/]*	-d	unconfined_u:object_r:unconfined_home_dir_t:s0
>  /etc/[^/]*	-l	unconfined_u:object_r:unconfined_home_dir_t:s0
>  /etc/lost\+found/.*	<<none>>
>  /etc	-d	system_u:object_r:home_root_t:s0
>  /etc/\.journal	<<none>>
>  /etc/lost\+found	-d	system_u:object_r:lost_found_t:s0
>  
>  
>  #
>  # Home Context for user unconfined_u
>  #
>  
>  /home/[^/]*/.+	unconfined_u:object_r:unconfined_home_t:s0
>  /home/[^/]*/.gnome2(/.*)?	unconfined_u:object_r:unconfined_gnome_home_t:s0
>  /home/[^/]*/.*/plugins/nprhapengine\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
>  /home/[^/]*/.*/plugins/libflashplayer\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
>
> /home/[^/]*/((www)|(web)|(public_html))(/.+)?	unconfined_u:object_r:httpd_unconfined_content_t:s0
>  /home/[^/]*/\.java(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
>  /home/[^/]*/\.galeon(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
>  /home/[^/]*/\.mozilla(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
>  /home/[^/]*/\.phoenix(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
>
> /home/[^/]*/\.mozilla(/.*)?/plugins/libflashplayer\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
>  /home/[^/]*/\.netscape(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
>  /home/[^/]*/\.gstreamer-.*/[^/]*\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
>  /home/[^/]*/\.config/gtk-.*	unconfined_u:object_r:unconfined_gnome_home_t:s0
>  /home/[^/]*	-d	unconfined_u:object_r:unconfined_home_dir_t:s0
>  /home/[^/]*	-l	unconfined_u:object_r:unconfined_home_dir_t:s0
>  /home/lost\+found/.*	<<none>>
>  /home	-d	system_u:object_r:home_root_t:s0
>  /home/\.journal	<<none>>
>  /home/lost\+found	-d	system_u:object_r:lost_found_t:s0
>  
>  
>  #
>  # Home Context for user unconfined_u
>  #
>  
>  /opt/[^/]*/.+	unconfined_u:object_r:unconfined_home_t:s0
>  /opt/[^/]*/.gnome2(/.*)?	unconfined_u:object_r:unconfined_gnome_home_t:s0
>  /opt/[^/]*/.*/plugins/nprhapengine\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
>  /opt/[^/]*/.*/plugins/libflashplayer\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
>
> /opt/[^/]*/((www)|(web)|(public_html))(/.+)?	unconfined_u:object_r:httpd_unconfined_content_t:s0
>  /opt/[^/]*/\.java(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
>  /opt/[^/]*/\.galeon(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
>  /opt/[^/]*/\.mozilla(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
>  /opt/[^/]*/\.phoenix(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
>
> /opt/[^/]*/\.mozilla(/.*)?/plugins/libflashplayer\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
>  /opt/[^/]*/\.netscape(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
>  /opt/[^/]*/\.gstreamer-.*/[^/]*\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
>  /opt/[^/]*/\.config/gtk-.*	unconfined_u:object_r:unconfined_gnome_home_t:s0
>  /opt/[^/]*	-d	unconfined_u:object_r:unconfined_home_dir_t:s0
>  /opt/[^/]*	-l	unconfined_u:object_r:unconfined_home_dir_t:s0
>  /opt/lost\+found/.*	<<none>>
>  /opt	-d	system_u:object_r:home_root_t:s0
>  /opt/\.journal	<<none>>
>  /opt/lost\+found	-d	system_u:object_r:lost_found_t:s0
>  
>  
>  #
>  # Home Context for user unconfined_u
>  #
>  
>  /usr/libexec/[^/]*/.+	unconfined_u:object_r:unconfined_home_t:s0
>  /usr/libexec/[^/]*/.gnome2(/.*)?	unconfined_u:object_r:unconfined_gnome_home_t:s0
>
> /usr/libexec/[^/]*/.*/plugins/nprhapengine\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
>
> /usr/libexec/[^/]*/.*/plugins/libflashplayer\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
>
> /usr/libexec/[^/]*/((www)|(web)|(public_html))(/.+)?	unconfined_u:object_r:httpd_unconfined_content_t:s0
>  /usr/libexec/[^/]*/\.java(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
>  /usr/libexec/[^/]*/\.galeon(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
>  /usr/libexec/[^/]*/\.mozilla(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
>  /usr/libexec/[^/]*/\.phoenix(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
>
> /usr/libexec/[^/]*/\.mozilla(/.*)?/plugins/libflashplayer\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
>  /usr/libexec/[^/]*/\.netscape(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
>
> /usr/libexec/[^/]*/\.gstreamer-.*/[^/]*\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
>  /usr/libexec/[^/]*/\.config/gtk-.*	unconfined_u:object_r:unconfined_gnome_home_t:s0
>  /usr/libexec/[^/]*	-d	unconfined_u:object_r:unconfined_home_dir_t:s0
>  /usr/libexec/[^/]*	-l	unconfined_u:object_r:unconfined_home_dir_t:s0
>  /usr/libexec/lost\+found/.*	<<none>>
>  /usr/libexec	-d	system_u:object_r:home_root_t:s0
>  /usr/libexec/\.journal	<<none>>
>  /usr/libexec/lost\+found	-d	system_u:object_r:lost_found_t:s0
>  
>  
>  #
>  # Home Context for user unconfined_u
>  #
>  
>  /var/log/[^/]*/.+	unconfined_u:object_r:unconfined_home_t:s0
>  /var/log/[^/]*/.gnome2(/.*)?	unconfined_u:object_r:unconfined_gnome_home_t:s0
>  /var/log/[^/]*/.*/plugins/nprhapengine\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
>
> /var/log/[^/]*/.*/plugins/libflashplayer\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
>
> /var/log/[^/]*/((www)|(web)|(public_html))(/.+)?	unconfined_u:object_r:httpd_unconfined_content_t:s0
>  /var/log/[^/]*/\.java(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
>  /var/log/[^/]*/\.galeon(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
>  /var/log/[^/]*/\.mozilla(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
>  /var/log/[^/]*/\.phoenix(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
>
> /var/log/[^/]*/\.mozilla(/.*)?/plugins/libflashplayer\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
>  /var/log/[^/]*/\.netscape(/.*)?	unconfined_u:object_r:unconfined_mozilla_home_t:s0
>  /var/log/[^/]*/\.gstreamer-.*/[^/]*\.so.*	--	unconfined_u:object_r:textrel_shlib_t:s0
>  /var/log/[^/]*/\.config/gtk-.*	unconfined_u:object_r:unconfined_gnome_home_t:s0
>  /var/log/[^/]*	-d	unconfined_u:object_r:unconfined_home_dir_t:s0
>  /var/log/[^/]*	-l	unconfined_u:object_r:unconfined_home_dir_t:s0
>  /var/log/lost\+found/.*	<<none>>
>  /var/log	-d	system_u:object_r:home_root_t:s0
>  /var/log/\.journal	<<none>>
>  /var/log/lost\+found	-d	system_u:object_r:lost_found_t:s0
>  /tmp/gconfd-.*	-d	unconfined_u:object_r:unconfined_tmp_t:s0
>  
>  
>  #
>  # Home Context for user root
>  #
>  
>  /root/.+	root:object_r:sysadm_home_t:s0
>  /root/.gnome2(/.*)?	root:object_r:sysadm_gnome_home_t:s0
>  /root/.*/plugins/nprhapengine\.so.*	--	root:object_r:textrel_shlib_t:s0
>  /root/.*/plugins/libflashplayer\.so.*	--	root:object_r:textrel_shlib_t:s0
>  /root/((www)|(web)|(public_html))(/.+)?	root:object_r:httpd_sysadm_content_t:s0
>  /root/\.ssh(/.*)?	root:object_r:sysadm_home_ssh_t:s0
>  /root/\.uml(/.*)?	root:object_r:sysadm_uml_rw_t:s0
>  /root/\.java(/.*)?	root:object_r:sysadm_mozilla_home_t:s0
>  /root/\.xauth.*	--	root:object_r:sysadm_xauth_home_t:s0
>  /root/\.fonts(/.*)?	root:object_r:sysadm_fonts_t:s0
>  /root/\.pyzor(/.*)?	root:object_r:sysadm_pyzor_home_t:s0
>  /root/\.razor(/.*)?	root:object_r:sysadm_razor_home_t:s0
>  /root/vmware(/.*)?	root:object_r:sysadm_vmware_file_t:s0
>  /root/\.galeon(/.*)?	root:object_r:sysadm_mozilla_home_t:s0
>  /root/\.vmware(/.*)?	root:object_r:sysadm_vmware_file_t:s0
>  /root/\.vmware[^/]*/.*\.cfg	--	root:object_r:sysadm_vmware_conf_t:s0
>  /root/\.mozilla(/.*)?	root:object_r:sysadm_mozilla_home_t:s0
>  /root/\.phoenix(/.*)?	root:object_r:sysadm_mozilla_home_t:s0
>  /root/\.mplayer(/.*)?	root:object_r:sysadm_mplayer_home_t:s0
>  /root/\.mozilla(/.*)?/plugins/libflashplayer\.so.*	--	root:object_r:textrel_shlib_t:s0
>  /root/\.ethereal(/.*)?	root:object_r:sysadm_ethereal_home_t:s0
>  /root/\.netscape(/.*)?	root:object_r:sysadm_mozilla_home_t:s0
>  /root/\.Xauthority.*	--	root:object_r:sysadm_xauth_home_t:s0
>  /root/\.fonts/auto(/.*)?	root:object_r:sysadm_fonts_cache_t:s0
>  /root/\.gstreamer-.*/[^/]*\.so.*	--	root:object_r:textrel_shlib_t:s0
>  /root/\.config/gtk-.*	root:object_r:sysadm_gnome_home_t:s0
>  /root/\.fonts\.cache-.*	--	root:object_r:sysadm_fonts_cache_t:s0
>  /root/\.ICEauthority.*	--	root:object_r:sysadm_iceauth_home_t:s0
>  /root/\.spamassassin(/.*)?	root:object_r:sysadm_spamassassin_home_t:s0
>  /root	-d	root:object_r:sysadm_home_dir_t:s0
>  /root	-l	root:object_r:sysadm_home_dir_t:s0
>  /root/\.ircmotd	--	root:object_r:sysadm_irc_home_t:s0
>  /root/\.screenrc	--	root:object_r:sysadm_screen_ro_home_t:s0
>  /root/\.fonts\.conf	--	root:object_r:sysadm_fonts_config_t:s0
>  /tmp/gconfd-root	-d	root:object_r:sysadm_tmp_t:s0
>  
>  
>  I deleted all the sections head up with "Home Context for user 
>  unconfined_u" then re-ran "fixfiles restore".
>  
>  The conclusion I draw is that running SELinux in permissive mode for 
>  an extended period of time isn't well supported at all, and shouldn't 
>  be recommended ever.  Perhaps more testing should go into running a 
>  system in permissive mode while yum updates apply selinux packages, 
>  etc. to find these types of issues.
>  
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-selinux-list 
Do you have user
accounts setup in /var/log? /lib/libexec?

If you have system accounts with homedirs and real shells, you can
confuse SELinux.  Any system account should have a UID < 500 or a shell
of /bin/false or /sbin/nologin.

You also look like you have root account setup to login as system_u.
You probably want to execute

semanage login -m -s unconfined_u root


> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.8 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
>
> iEYEARECAAYFAkeLucwACgkQrlYvE4MpobMbWQCgjv+H0sqo1AwqbozQuXxQ6gfw
> WpwAnj7rx4yavBgSPaAIEphpyUiZr/Ud
> =QQOb
> -----END PGP SIGNATURE-----

[Chuck Anderson]

On Mon, Jan 14, 2008 at 02:36:45PM -0500, Daniel J Walsh wrote:
>  Do you have user accounts setup in /var/log? /lib/libexec?
>  If you have system accounts with homedirs and real shells, you can
>  confuse SELinux.  Any system account should have a UID < 500 or a shell
>  of /bin/false or /sbin/nologin. 
I fixed all accounts to meet these expectations.

There were these which I changed to use shells of /sbin/nologin:

oracle:x:1003:1003:Oracle User:/opt/oracle:/bin/sh
netsaint:x:1005:1005:netsaint:/usr/libexec/netsaint:/bin/sh
autores:x:2000:2000:Autores:/opt/autores:
dhcpd:x:2001:2001:DHCP Daemon:/etc/dhcpd:/bin/bash
autostat:x:2003:2003:Autostatus:/etc/autostatus:/bin/false
nagios:x:2004:2004:nagios:/var/log/nagios:/bin/sh

>  You also look like you have root account setup to login as system_u.
>  You probably want to execute
>  
>  semanage login -m -s unconfined_u root 
Done.

Thanks for all the help.  It sounds like I should go through all my 
systems to be sure they meet current SELinux standards.

[Stephen Smalley]

On Mon, 2008-01-14 at 12:35 -0500, Chuck Anderson wrote:
>  On Sat, Jan 12, 2008 at 08:37:04AM -0500, Eric Paris wrote:
>  > Do you have auditd running?  If not look in dmesg or /var/log/messages
>  > instead of ausearch because it seems to be working fine for me....
>  
>  Yes, I do have auditd running.
>  
>  #service auditd status
>  auditd (pid 2523) is running...
>  #service rsyslog status
>  rsyslogd (pid 19658) is running...
>  rklogd (pid 19664) is running...
>  #ausearch  -m MAC_STATUS
>  <no matches>
>  #setenforce 0
>  #ausearch -m MAC_STATUS
>  <no matches>
>  #setenforce 1
>  #ausearch -m MAC_STATUS
>  <no matches>
>  #setenforce 0
>  #ausearch -m MAC_STATUS
>  <no matches>
>  #grep setenforce /var/log/messages
>  #grep setenforce /var/log/syslog
>  #grep setenforce /var/log/secure
>  #dmesg|grep setenforce 
kernel version?
audit version?

-- 
Stephen Smalley
National Security Agency