First selinux problem, help!

[Mark Haney]

Paul Howarth wrote:
> Mark Haney wrote:
>> Paul Howarth wrote:
>>> Mark Haney wrote:
>>>> I just encountered my first problem with selinux.  As I'm just now 
>>>> losing my selinux virginity, I need help.  I have a process that I 
>>>> can't kill since apparently the SIGKILL permission wasn't granted 
>>>> to it.  How do I go about fixing that?
>>>
>>> You need to post the selinux denial message you're getting, so that 
>>> we can see what is trying to send a signal to what.
>>>
>>> Paul.
>>>
>> Duh.  Sorry.  I'm trying to do about a million things here.  Here it is:
>>
>> Nov  8 10:34:26 localhost kernel: audit(1163000066.441:216): avc:  
>> denied  { sigkill } for  pid=28872 comm="bash" 
>> scontext=user_u:system_r:unconfined_t:s0 
>> tcontext=root:system_r:unconfined_t:s0-s0:c0.c255 tclass=process
>>
>> What I'm trying to kill is a perl script (rsnapshot).
>
> Well that's a curious one. It would be allowed by policy here. Try 
> piping that error log entry through /usr/sbin/audit2why at your end.
>
> Paul.
>
/usr/sbin/audit2why < audit.meh
Nov  8 10:34:26 localhost kernel: audit(1163000066.441:216): avc:  
denied  { sigkill } for  pid=28872 comm="bash" 
scontext=user_u:system_r:unconfined_t:s0 
tcontext=root:system_r:unconfined_t:s0-s0:c0.c255 tclass=process
        Was caused by:
                Constraint violation.
                Check policy/constraints.
                Typically, you just need to add a type attribute to the 
domain to satisfy the constraint.


This is what I get when I piped it through audit2why.


-- 
Ceterum censeo, Carthago delenda est.

Mark Haney
Sr. Systems Administrator
ERC Broadband
(828) 350-2415