Trouble booting kernel after building a kernel on a SELinux enabled system

[Jochen Schmitt]

Hello,

After I have create a kernel image on a SELinux enabled system,
grub complaint a access to a invalid block when the compiled
kernel should be booted.

But when I turn off SELinux via a boot parameter this issue
didn't occured.

It will nice, if anyone give me a hint.

Best Regards:

Jochen Schmitt

[Bob Gustafson]

Can you capture (or reproduce here) the text of grub's complaint?

There may also be something in /var/log/messages or /var/log/boot.log which
would be interesting.

Also, assuming that you have used the boot parameters
  selinux=1 enforcing=0
to get your system up and running, there may be some 'audit .. denied'
messages recorded or on your console during boot which might indicate what
security feature is being ignored by setting 'enforcing=0'

BobG

> Hello,
>
> After I have create a kernel image on a SELinux enabled system,
> grub complaint a access to a invalid block when the compiled
> kernel should be booted.
>
> But when I turn off SELinux via a boot parameter this issue
> didn't occured.
>
> It will nice, if anyone give me a hint.
>
> Best Regards:
>
> Jochen Schmitt
>

[Jochen Schmitt]

On Mon, 10 May 2004 13:29:45 -0500, you wrote:

> There may also be something in /var/log/messages or /var/log/boot.log
> which
> would be interesting. 
How can be anything in /var/log/message or /var/log/boot.log,
when grub was not able to load the kernel image?

> to get your system up and running, there may be some 'audit ..
> denied'
> messages recorded or on your console during boot which might indicate what
> security feature is being ignored by setting 'enforcing=0' 
Sorry, I don't get any access denied message, becouse the kernel
could not be loaded.

Best Regards:

Jochen Schmitt

[Bob Gustafson]

On Tue, 11 May 2004 19:46:47 +0200 Jochen Schmitt wrote:
> On Mon, 10 May 2004 13:29:45 -0500, you wrote: 
snip

> Sorry, I don't get any access denied message, becouse the kernel
> could not be loaded.
>  
Boot your kernel with the grub boot line parameter 'selinux=0' (no quotes).
You have the opportunity to put this parameter in by pressing the 'a' key
when the Grub splash screen comes up. Enter on the line starting with
'kernel..'

This parameter removes the selinux stuff from the kernel (more or less - as
I understand it). If your kernel does not boot, then the problem is
probably somewhere else other than selinux.

Good Luck

BobG

[Thomas Bleher]

* Jochen Schmitt <Jochen(a)herr-schmitt.de&gt; [2004-05-10 18:08]:
>  After I have create a kernel image on a SELinux enabled system,
>  grub complaint a access to a invalid block when the compiled
>  kernel should be booted. 
Any chance that the grub menu entry points to a symlink? If yes then try
to replace the symlink with a real copy of the kernel image and see if
the problem goes away.
I have seen this problem (Debian, ext3) but haven't looked into grub yet
to see what's causing this.

Thomas

-- 
http://www.cip.ifi.lmu.de/~bleher/selinux/ - my SELinux pages
GPG-Fingerprint: BC4F BB16 30D6 F253 E3EA  D09E C562 2BAE B2F4 ABE7

[Jochen Schmitt]

On Tue, 11 May 2004 10:21:46 +0200, you wrote:

> Any chance that the grub menu entry points to a symlink? If yes then
> try
> to replace the symlink with a real copy of the kernel image and see if
> the problem goes away.
> I have seen this problem (Debian, ext3) but haven't looked into grub yet
> to see what's causing this. 
I think, it was a grub related issue. After I have updated grub
to the lastest rawhide release, i could not reproduce the issue.

Best Regards:

Jochen Schmitt