Stupid F7 boot loop

[Jonathan Allen]

Hi All,

I have a stupid F7 box that won't boot.  It keeps wittering about a clutch
of selinux errors:

  udevd-event[1187]: selinux_setfscreatecon: matchpathcon(/dev/loop3) failed

and screenfuls of similar garbage.  Then it tells me that an error occured
during the file system check - which it didn't.  I give the root password
and run fsck and there are no errors.  Reboot simply goes back into the
same loop.  I can't edit /etc/selinux/config to disable selinux because the
filestore is read-only and the live CD doesn't seem to want to let me mount
the hard-disc to edit it that way.

How can I return the machine to some kind of sanity without reinstalling ?
This feels scarily like the monster from Redmond ...

Jonathan

[Mark Haney]

Jonathan Allen wrote:
>  Hi All,
>  
>  I have a stupid F7 box that won't boot.  It keeps wittering about a clutch
>  of selinux errors:
>  
>    udevd-event[1187]: selinux_setfscreatecon: matchpathcon(/dev/loop3) failed
>  
>  and screenfuls of similar garbage.  Then it tells me that an error occured
>  during the file system check - which it didn't.  I give the root password
>  and run fsck and there are no errors.  Reboot simply goes back into the
>  same loop.  I can't edit /etc/selinux/config to disable selinux because the
>  filestore is read-only and the live CD doesn't seem to want to let me mount
>  the hard-disc to edit it that way.
>  
>  How can I return the machine to some kind of sanity without reinstalling ?
>  This feels scarily like the monster from Redmond ...
>  
>  Jonathan
>   
Have you tried the rescue cd?  Generally you can remount / as RW from there.


-- 
Recedite, plebes! Gero rem imperialem!


Mark Haney
Sr. Systems Administrator
ERC Broadband
[phone]

Call (866) ERC-7110 for after hours support

[Jonathan Allen]

On Wed, Aug 29, 2007 at 10:27:15AM -0400, Mark Haney wrote:
>  Have you tried the rescue cd?  Generally you can remount / as RW from
> there. 
Thank you - sanity restored.  I downloaded the rescue CD, edited the config
file to disable selinux and it booted.  I'll keep the rescue CD on hand ...

Jonathan

[Andy Green]

Somebody in the thread at some point said:

>  same loop.  I can't edit /etc/selinux/config to disable selinux
> because the
>  filestore is read-only and the live CD doesn't seem to want to let me mount
>  the hard-disc to edit it that way. 
If that is actually the correct filesystem being mounted read-only, you
can re-mount it rw in place, like this for example

mount /dev/sda2 / -oremount,rw

(change the first two params to match your situation) or come up in
rescue mode of the install media as Mark suggests.

BTW on one machine here udev blows a ton of debug messages to the
console during boot, without ill effect apparently.

-Andy

[Jonathan Allen]

On Wed, Aug 29, 2007 at 03:35:58PM +0100, Andy Green wrote:
>  If that is actually the correct filesystem being mounted read-only,
> you
>  can re-mount it rw in place, like this for example
>  
>  mount /dev/sda2 / -oremount,rw 
It was the right and sane filesystem, and I knew mount could probably
do this, but my mind had gone blank.  I went for Mark's rescue CD
suggestion instead.

Jonathan

[Mikkel]

Jonathan Allen wrote:
>  Hi All,
>  
>  I have a stupid F7 box that won't boot.  It keeps wittering about a clutch
>  of selinux errors:
>  
>    udevd-event[1187]: selinux_setfscreatecon: matchpathcon(/dev/loop3) failed
>  
>  and screenfuls of similar garbage.  Then it tells me that an error occured
>  during the file system check - which it didn't.  I give the root password
>  and run fsck and there are no errors.  Reboot simply goes back into the
>  same loop.  I can't edit /etc/selinux/config to disable selinux because the
>  filestore is read-only and the live CD doesn't seem to want to let me mount
>  the hard-disc to edit it that way.
>  
>  How can I return the machine to some kind of sanity without reinstalling ?
>  This feels scarily like the monster from Redmond ...
>  
>  Jonathan
>   
You can disable selinux to let you boot and relabel. When you get
the boot screen, hit a key so you get the boot menu. Then highlight
the first Linux entry, (up/down arrows) and hit e (for edit). Then
highlight the line that starts with kernel, and hit e again. Then
add selinux=0 to the end of the line. Hit b (for boot) and the
system should come up. From there you can deside if you want to
disable selinux, or relabel the system so selinux works correctly.

Mikkel
-- 

  Do not meddle in the affairs of dragons,
for thou art crunchy and taste good with Ketchup!

[Jonathan Allen]

On Wed, Aug 29, 2007 at 09:41:19AM -0500, Mikkel L. Ellertson wrote:
>  From there you can deside if you want to disable selinux, or relabel
>  the system so selinux works correctly. 
How is that (easily) done - I haev to admit that now it is running
disabled, I'm very much tempted to leave it that way rather then
mess about "in flight" so to speak.  Presumably I'll save a little
mill time at a fairly minimal risk on a secure system ...

Jonathan

[Mikkel]

Jonathan Allen wrote:
>  On Wed, Aug 29, 2007 at 09:41:19AM -0500, Mikkel L. Ellertson wrote:
> > From there you can deside if you want to disable selinux, or relabel
> > the system so selinux works correctly.
>  
>  How is that (easily) done - I haev to admit that now it is running
>  disabled, I'm very much tempted to leave it that way rather then
>  mess about "in flight" so to speak.  Presumably I'll save a little
>  mill time at a fairly minimal risk on a secure system ...
>  
>  Jonathan
>   
One way is to run, as root, "touch /.autorelabel ; reboot". Be aware
that this will do a shutdown and reboot when you enter it, so do not
do it if you have anything important running.

Mikkel
-- 

  Do not meddle in the affairs of dragons,
for thou art crunchy and taste good with Ketchup!

[Tim]

Mikkel L. Ellertson:
> > From there you can deside if you want to disable selinux, or
> relabel
> > the system so selinux works correctly. 
Jonathan Allen:
>  How is that (easily) done - I haev to admit that now it is running
>  disabled, I'm very much tempted to leave it that way rather then
>  mess about "in flight" so to speak.  Presumably I'll save a little
>  mill time at a fairly minimal risk on a secure system ... 
You've got the how in the next post, so I won't repeat that.  But, I'd
suggest it's worth trying to see if a relabel is all you need to fix
your problem.  If it doesn't work, you can just carry on with leaving it
disabled, like you've just done.  Though I'd suggest it's better to try
and get it working properly.

-- 
(This box runs FC5, my others run FC4 & FC6, in case that's
 important to the thread.)

Don't send private replies to my address, the mailbox is ignored.
I read messages from the public lists.