Re: Clean install of Fedora 39 on Dell notebook was working, but recent update not getting 50 selerts??
On 12/9/23 07:36, Michael D. Setzer II via users wrote:
On 9 Dec 2023 at 18:02, Tim wrote:
Subject: Re: Clean install of Fedora 39 on Dell notebook
was working, but
recent update not getting 50 selerts??
From: Tim <ignored_mailbox(a)yahoo.com.au>
To: mikes(a)guam.net, Community support for Fedora
users
<users(a)lists.fedoraproject.org>
Date sent: Sat, 09 Dec 2023 18:02:43 +1030
Did a dnf reinstall * to see if maybe somethings had installed
before something else. Then reenabled selinux and rebooted.
Originally go then 50 messages again that seemed to be same.
Unfortunately, the setrouble browser has a option to show the 50
messages summary, but I can do a ctrl-a to highlight them all but
ctrl-C does not work to copy them..
Deleted them all. They didn't immediately come back.
Did just get 12 pop up, and these are for sshd and mandb?
last one is mandb
setattr
index.db
SELINUX Alert browser doesn't let on copy top part or if you were
trying part? also doesn't let copy the list of all info??
Does let one copy this part, but have no clue what FILE_TYPE
would be used, or where this index.db file is located?
First 3 are sshd with read, open, getattr all with inactive.mod
Then 9 with mandb with create, write, ioctl, read, open, rename,
unlink, lock, setattr. with 29605, 29605, xscreensaver.1.gz (3
times), 29605, index.db, 29605, index.db.
Did have 2 earlier ones that were with boinc, and talked about
missing selinux type boinc_t??
Since can't copy stuff from here is what would copy for last one?
You need to change the label on index.db
# semanage fcontext -a -t FILE_TYPE 'index.db'
where FILE_TYPE is one of the following: boot_t, cert_t, device_t,
dhcpc_state_t, etc_aliases_t, etc_mail_t, etc_runtime_t, faillog_t,
fonts_t, getty_lock_t, httpd_lock_t, initrc_state_t, initrc_tmp_t,
initrc_var_log_t, initrc_var_run_t, ipsec_mgmt_lock_t,
ipsec_var_run_t, iptables_lock_t, krb5_host_rcache_t,
krb5kdc_lock_t, lastlog_t, local_login_lock_t, locale_t, lvm_lock_t,
mnt_t, net_conf_t, postgresql_db_t, postgresql_lock_t,
semanage_read_lock_t, semanage_trans_lock_t, sshd_key_t,
sysctl_fs_t, sysctl_t, system_conf_t, system_dbusd_var_lib_t,
systemd_passwd_var_run_t, udev_rules_t, udev_var_run_t,
user_home_dir_t, user_home_t, var_lib_t, var_lock_t, var_log_t,
var_spool_t, wtmp_t, xdm_lock_t.
Then execute:
restorecon -v 'index.db'
The files should inherit either the label of the directory they're
created in, or if a specific context has been set for a filename, it
should get that context.
Normally, if something's incorrectly labeled, you can just restorecon -v
the file to see what it was changed to. In this example, I created an
index.html in root's home directory and them moved it to /var/www/html.
When I restorecon -vR /var/www it shows me what it WAS labeled, and what
it was changed to:
[root@haproxy ~]# restorecon -vR /var/www/
Relabeled /var/www/html/index.html from
unconfined_u:object_r:admin_home_t:s0 to
unconfined_u:object_r:httpd_sys_content_t:s0
So if you're getting errors on mislabeled files, the first bet is to
just do a restorecon -v on it, or restorecon -vR on the parent directory.
https://www.youtube.com/watch?v=_WOKRaM-HI4 for a less than 45 minute
lesson on the basics of SELinux.
If you're running something which was compiled from source, for
instance, it may not understand what SELinux label it's supposed to
have, or even just not understand SELinux.
You might want to set the app to run unconfined. Description on how to
do this is here:
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
Hope this is helpful.
Thomas