Hi
I'd like to change some policy booleans. For example httpd_can_network_connect. So I tried this (as root):
/usr/sbin/setsebool -P httpd_can_network_connect=1
But than I get "Could not change policy booleans".
This works:
/usr/sbin/setsebool httpd_can_network_connect=1
I could put this into a boot script ;)
In /var/log/messages, I get the following entry:
Jun 3 00:02:56 localhost dbus: Can't send to audit system: USER_AVC
avc: received policyload notice (seqno=3) : exe="/bin/dbus-daemon" (sauid=500, hostname=?, addr=?, terminal=?)
Have you any ideas?
Cu Nils
So I tried this (as root): /usr/sbin/setsebool -P httpd_can_network_connect=1 But than I get "Could not change policy booleans".
That should have worked. That should be the correct syntax. Was there an avc associated with trying to set this? Also, are you completed updated on selinux packages?
This works: /usr/sbin/setsebool httpd_can_network_connect=1 I could put this into a boot script ;)
You shouldn't have to do that. I just checked this on a fully updated fc6 machine and it works fine.
In /var/log/messages, I get the following entry: Jun 3 00:02:56 localhost dbus: Can't send to audit system: USER_AVC avc: received policyload notice (seqno=3) : exe="/bin/dbus-daemon" (sauid=500, hostname=?, addr=?, terminal=?)
That should have been solved by an update to dbus in fc6 a month ago. What Fedora release are you running? Are you completely updated?
-Steve
____________________________________________________________________________________ Pinpoint customers who are looking for what you sell. http://searchmarketing.yahoo.com/
That should have been solved by an update to dbus in fc6 a month ago.
What Fedora
release are you running? Are you completely updated?
I'm running a full updated fedora 7.
That should have worked. That should be the correct syntax. Was there
an avc
associated with trying to set this?
There was no other warning.
I have the same problem in an other fedora 7 VM. Maybe it's a fedora 7 bug... :(
Nils Caspar wrote:
That should have been solved by an update to dbus in fc6 a month ago.
What Fedora
release are you running? Are you completely updated?
I'm running a full updated fedora 7.
That should have worked. That should be the correct syntax. Was there
an avc
associated with trying to set this?
There was no other warning.
I have the same problem in an other fedora 7 VM. Maybe it's a fedora 7 bug... :(
I've just hit the same problem on a fresh Fedora 7 install, with all released updates.
Paul.
Paul Howarth wrote:
Nils Caspar wrote:
That should have been solved by an update to dbus in fc6 a month ago.
What Fedora
release are you running? Are you completely updated?
I'm running a full updated fedora 7.
That should have worked. That should be the correct syntax. Was there
an avc
associated with trying to set this?
There was no other warning.
I have the same problem in an other fedora 7 VM. Maybe it's a fedora 7 bug... :(
I've just hit the same problem on a fresh Fedora 7 install, with all released updates.
Paul.
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-selinux-list
Does this fix the problem?
restorecon -R -v /etc/selinux/targeted
Daniel J Walsh wrote:
Paul Howarth wrote:
Nils Caspar wrote:
That should have been solved by an update to dbus in fc6 a month ago.
What Fedora
release are you running? Are you completely updated?
I'm running a full updated fedora 7.
That should have worked. That should be the correct syntax. Was there
an avc
associated with trying to set this?
There was no other warning.
I have the same problem in an other fedora 7 VM. Maybe it's a fedora 7 bug... :(
I've just hit the same problem on a fresh Fedora 7 install, with all released updates.
Paul.
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-selinux-list
Does this fix the problem?
restorecon -R -v /etc/selinux/targeted
No; there are no AVC denials in the audit log (at least not relating to this...) so I don't think it's an SELinux permissions issue.
Updating to the latest selinux package updates from updates-testing hasn't helped either.
Paul.
On Wed, 2007-06-13 at 10:00 +0100, Paul Howarth wrote:
Daniel J Walsh wrote:
Paul Howarth wrote:
Nils Caspar wrote:
That should have been solved by an update to dbus in fc6 a month ago.
What Fedora
release are you running? Are you completely updated?
I'm running a full updated fedora 7.
That should have worked. That should be the correct syntax. Was there
an avc
associated with trying to set this?
There was no other warning.
I have the same problem in an other fedora 7 VM. Maybe it's a fedora 7 bug... :(
I've just hit the same problem on a fresh Fedora 7 install, with all released updates.
Paul.
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-selinux-list
Does this fix the problem?
restorecon -R -v /etc/selinux/targeted
No; there are no AVC denials in the audit log (at least not relating to this...) so I don't think it's an SELinux permissions issue.
Updating to the latest selinux package updates from updates-testing hasn't helped either.
Bug in setsebool (it is actually succeeding, but falling through to the error path and thus incorrectly saying that it failed, as a result of a "build fix"). Fixed in policycoreutils 2.0.21.
Stephen Smalley wrote:
On Wed, 2007-06-13 at 10:00 +0100, Paul Howarth wrote:
Daniel J Walsh wrote:
Paul Howarth wrote:
Nils Caspar wrote:
That should have been solved by an update to dbus in fc6 a month ago.
What Fedora
release are you running? Are you completely updated?
I'm running a full updated fedora 7.
That should have worked. That should be the correct syntax. Was there
an avc
associated with trying to set this?
There was no other warning.
I have the same problem in an other fedora 7 VM. Maybe it's a fedora 7 bug... :(
I've just hit the same problem on a fresh Fedora 7 install, with all released updates.
Paul.
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-selinux-list
Does this fix the problem?
restorecon -R -v /etc/selinux/targeted
No; there are no AVC denials in the audit log (at least not relating to this...) so I don't think it's an SELinux permissions issue.
Updating to the latest selinux package updates from updates-testing hasn't helped either.
Bug in setsebool (it is actually succeeding, but falling through to the error path and thus incorrectly saying that it failed, as a result of a "build fix"). Fixed in policycoreutils 2.0.21.
Ah, saves me having to put something in an initscript :-)
FC7 has policycoreutils-2.0.16-5.fc7 (from updates-testing), which seems a long way behind 2.0.21. Is a fix likely any time soon?
Paul.
On Wed, 2007-06-13 at 14:35 +0100, Paul Howarth wrote:
Stephen Smalley wrote:
On Wed, 2007-06-13 at 10:00 +0100, Paul Howarth wrote:
Daniel J Walsh wrote:
Paul Howarth wrote:
Nils Caspar wrote:
> That should have been solved by an update to dbus in fc6 a month ago. What Fedora > release are you running? Are you completely updated? I'm running a full updated fedora 7.
> That should have worked. That should be the correct syntax. Was there an avc > associated with trying to set this? There was no other warning.
I have the same problem in an other fedora 7 VM. Maybe it's a fedora 7 bug... :(
I've just hit the same problem on a fresh Fedora 7 install, with all released updates.
Paul.
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-selinux-list
Does this fix the problem?
restorecon -R -v /etc/selinux/targeted
No; there are no AVC denials in the audit log (at least not relating to this...) so I don't think it's an SELinux permissions issue.
Updating to the latest selinux package updates from updates-testing hasn't helped either.
Bug in setsebool (it is actually succeeding, but falling through to the error path and thus incorrectly saying that it failed, as a result of a "build fix"). Fixed in policycoreutils 2.0.21.
Ah, saves me having to put something in an initscript :-)
FC7 has policycoreutils-2.0.16-5.fc7 (from updates-testing), which seems a long way behind 2.0.21. Is a fix likely any time soon?
I sent Dan the patch separately as well, in case he wants to just apply it without updating otherwise.
Stephen Smalley wrote:
I sent Dan the patch separately as well, in case he wants to just apply it without updating otherwise.
It looks to be applied to the F-7 branch for 2.0.16-6:
https://www.redhat.com/archives/fedora-extras-commits/2007-June/msg02348.htm...
Stephen Smalley wrote:
On Wed, 2007-06-13 at 14:35 +0100, Paul Howarth wrote:
Stephen Smalley wrote:
On Wed, 2007-06-13 at 10:00 +0100, Paul Howarth wrote:
Daniel J Walsh wrote:
Paul Howarth wrote:
Nils Caspar wrote:
>> That should have been solved by an update to dbus in fc6 a month ago. >> > What Fedora > >> release are you running? Are you completely updated? >> > I'm running a full updated fedora 7. > > >> That should have worked. That should be the correct syntax. Was there >> > an avc > >> associated with trying to set this? >> > There was no other warning. > > I have the same problem in an other fedora 7 VM. Maybe it's a fedora 7 > bug... :( > I've just hit the same problem on a fresh Fedora 7 install, with all released updates.
Paul.
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-selinux-list
Does this fix the problem?
restorecon -R -v /etc/selinux/targeted
No; there are no AVC denials in the audit log (at least not relating to this...) so I don't think it's an SELinux permissions issue.
Updating to the latest selinux package updates from updates-testing hasn't helped either.
Bug in setsebool (it is actually succeeding, but falling through to the error path and thus incorrectly saying that it failed, as a result of a "build fix"). Fixed in policycoreutils 2.0.21.
Ah, saves me having to put something in an initscript :-)
FC7 has policycoreutils-2.0.16-5.fc7 (from updates-testing), which seems a long way behind 2.0.21. Is a fix likely any time soon?
I sent Dan the patch separately as well, in case he wants to just apply it without updating otherwise.
Fixed in policycoreutils https://admin.fedoraproject.org/updates/policycoreutils-2.0.16-6.fc7
Daniel J Walsh wrote:
Stephen Smalley wrote:
On Wed, 2007-06-13 at 14:35 +0100, Paul Howarth wrote:
Stephen Smalley wrote:
On Wed, 2007-06-13 at 10:00 +0100, Paul Howarth wrote:
Daniel J Walsh wrote:
Paul Howarth wrote:
> Nils Caspar wrote: > >>> That should have been solved by an update to dbus in fc6 a >>> month ago. >>> >> What Fedora >> >>> release are you running? Are you completely updated? >>> >> I'm running a full updated fedora 7. >> >> >>> That should have worked. That should be the correct syntax. Was >>> there >>> >> an avc >> >>> associated with trying to set this? >>> >> There was no other warning. >> >> I have the same problem in an other fedora 7 VM. Maybe it's a >> fedora 7 >> bug... :( >> > I've just hit the same problem on a fresh Fedora 7 install, with > all released updates. > > Paul. > > -- > fedora-selinux-list mailing list > fedora-selinux-list@redhat.com > https://www.redhat.com/mailman/listinfo/fedora-selinux-list > Does this fix the problem?
restorecon -R -v /etc/selinux/targeted
No; there are no AVC denials in the audit log (at least not relating to this...) so I don't think it's an SELinux permissions issue.
Updating to the latest selinux package updates from updates-testing hasn't helped either.
Bug in setsebool (it is actually succeeding, but falling through to the error path and thus incorrectly saying that it failed, as a result of a "build fix"). Fixed in policycoreutils 2.0.21.
Ah, saves me having to put something in an initscript :-)
FC7 has policycoreutils-2.0.16-5.fc7 (from updates-testing), which seems a long way behind 2.0.21. Is a fix likely any time soon?
I sent Dan the patch separately as well, in case he wants to just apply it without updating otherwise.
Fixed in policycoreutils https://admin.fedoraproject.org/updates/policycoreutils-2.0.16-6.fc7
Thanks.
On an unrelated issue, where does the version number in the selinux-policy package come from? Upstream seems to do date-based releases rather than version number-based. I ask because I need to update my policy module for mod_fcgid and I'll need different versions for F7 (using patterns) and older releases (using create_file_perms etc.).
Paul.
Paul Howarth wrote:
Daniel J Walsh wrote:
Stephen Smalley wrote:
On Wed, 2007-06-13 at 14:35 +0100, Paul Howarth wrote:
Stephen Smalley wrote:
On Wed, 2007-06-13 at 10:00 +0100, Paul Howarth wrote:
Daniel J Walsh wrote:
> Paul Howarth wrote: > >> Nils Caspar wrote: >> >>>> That should have been solved by an update to dbus in fc6 a >>>> month ago. >>>> >>> What Fedora >>> >>>> release are you running? Are you completely updated? >>>> >>> I'm running a full updated fedora 7. >>> >>> >>>> That should have worked. That should be the correct syntax. >>>> Was there >>>> >>> an avc >>> >>>> associated with trying to set this? >>>> >>> There was no other warning. >>> >>> I have the same problem in an other fedora 7 VM. Maybe it's a >>> fedora 7 >>> bug... :( >>> >> I've just hit the same problem on a fresh Fedora 7 install, >> with all released updates. >> >> Paul. >> >> -- >> fedora-selinux-list mailing list >> fedora-selinux-list@redhat.com >> https://www.redhat.com/mailman/listinfo/fedora-selinux-list >> > Does this fix the problem? > > restorecon -R -v /etc/selinux/targeted > No; there are no AVC denials in the audit log (at least not relating to this...) so I don't think it's an SELinux permissions issue.
Updating to the latest selinux package updates from updates-testing hasn't helped either.
Bug in setsebool (it is actually succeeding, but falling through to the error path and thus incorrectly saying that it failed, as a result of a "build fix"). Fixed in policycoreutils 2.0.21.
Ah, saves me having to put something in an initscript :-)
FC7 has policycoreutils-2.0.16-5.fc7 (from updates-testing), which seems a long way behind 2.0.21. Is a fix likely any time soon?
I sent Dan the patch separately as well, in case he wants to just apply it without updating otherwise.
Fixed in policycoreutils https://admin.fedoraproject.org/updates/policycoreutils-2.0.16-6.fc7
Thanks.
On an unrelated issue, where does the version number in the selinux-policy package come from? Upstream seems to do date-based releases rather than version number-based. I ask because I need to update my policy module for mod_fcgid and I'll need different versions for F7 (using patterns) and older releases (using create_file_perms etc.).
Paul.
It comes from me.
selinux-policy-2.3.4
Everytime I release My own modifications I increment the last digit, everytime I merge with upstream I update the middle number, and reset the last digit to 1. Everytime there is a major change to policy example-reference I increment the first. digit. If you do a
rpm -qi selinux-policy It will show you the revision this policy is based off of.
BTW, I am working on merging strict and targeted policy in Rawhide which will increment the major number. selinux-policy-3.0.1 will be released soon.
Daniel J Walsh wrote:
Paul Howarth wrote:
On an unrelated issue, where does the version number in the selinux-policy package come from? Upstream seems to do date-based releases rather than version number-based. I ask because I need to update my policy module for mod_fcgid and I'll need different versions for F7 (using patterns) and older releases (using create_file_perms etc.).
Paul.
It comes from me.
selinux-policy-2.3.4
Everytime I release My own modifications I increment the last digit, everytime I merge with upstream I update the middle number, and reset the last digit to 1. Everytime there is a major change to policy example-reference I increment the first. digit. If you do a
rpm -qi selinux-policy It will show you the revision this policy is based off of.
That works on F7 but not on FC6 or earlier, where the latest update doesn't include the svn revision in %description.
I'll check through cvs and figure out which selinux-policy package version the things I need came in at.
BTW, I am working on merging strict and targeted policy in Rawhide which will increment the major number. selinux-policy-3.0.1 will be released soon.
More fun to look forward to!
Paul.
selinux@lists.fedoraproject.org
-
Daniel J Walsh -
Nils Caspar -
Paul Howarth -
Stephen Smalley -
Steve G -
Todd Zullinger