Re: SELinux Understanding

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, Oct 16, 2007 at 08:59:36 -0400,
  Claude Jones <cjones@xxxxxxxxxxxxxx> wrote:
> On Mon October 15 2007, Bruno Wolff III wrote:
> > On Mon, Oct 15, 2007 at 13:57:11 -0400,
> >
> >   Claude Jones <cjones@xxxxxxxxxxxxxx> wrote:
> > > On Monday October 15 2007 1:35:17 pm Nigel Henry wrote:
> > > > but as
> > > > re-enabling SELinux, in either permissive, or enforcing mode
> > > > results in the relabelling process being run, it's almost
> > > > impossible to know if the relabelling has resolved a genuine
> > > > problem or not.
> > >
> > > This is where you're mistaken. It's perfectly possible to set
> > > permissive and enforcing modes, without relabeling - relabeling
> > > is only forced after some updates, and that not very often -
> > > perhaps, this is something that should be addressed. Perhaps a
> > > warning message when you turn on enforcing, with instructions to
> > > relabel if you've run in permissive mode for some period of
> > > time...
> >
> > If you have run with selinux disabled, when you reenable it you are going
> > to need to check file labels. Any files created while selinux was disabled
> > are not going to be properly labelled.
> >
> > Even rebooting a machine can fix a problem, since that will effectively
> > relabel processes. So if an update didn't happen correctly, a reboot may
> > fix the problem and getting back to the preupdate state may take some
> > work.
> 
> Are you objecting to what I said? I'm not sure, really. All I'm saying is that 
> re-enabling SELinux doesn't automagically run the relabelling process as 
> Nigel seems to be asserting - there are several ways to trigger a relabel on 
> next reboot, but one has to issue a command to make that happen, or at least 
> that's the way it used to work - I keep SELinux on, and have for a couple of 
> years, now, so things may have changed since I last had it disabled. 

In the context of testing I am suggesting there are some of reasons that
you might not get back to the same conditions you had previously which
might make it harder to reproduce a problem then was suggested by your
commentary.

You are correct that normally when updating or when switching back and forth
between permissive and enforcing you aren't supposed to need to do a relabel.
And that a mass relabel is not done automatically. (Updates may relabel some
files or processes as part of doing the update.)

-- 
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
[Index of Archives]     [Older Fedora Users]     [Fedora Announce]     [Fedora Package Announce]     [EPEL Announce]     [Fedora Magazine]     [Fedora News]     [Fedora Summer Coding]     [Fedora Laptop]     [Fedora Cloud]     [Fedora Advisory Board]     [Fedora Education]     [Fedora Security]     [Fedora Scitech]     [Fedora Robotics]     [Fedora Maintainers]     [Fedora Infrastructure]     [Fedora Websites]     [Anaconda Devel]     [Fedora Devel Java]     [Fedora Legacy]     [Fedora Desktop]     [Fedora Fonts]     [ATA RAID]     [Fedora Marketing]     [Fedora Management Tools]     [Fedora Mentors]     [SSH]     [Fedora Package Review]     [Fedora R Devel]     [Fedora PHP Devel]     [Kickstart]     [Fedora Music]     [Fedora Packaging]     [Centos]     [Fedora SELinux]     [Fedora Legal]     [Fedora Kernel]     [Fedora OCaml]     [Coolkey]     [Virtualization Tools]     [ET Management Tools]     [Yum Users]     [Tux]     [Yosemite News]     [Gnome Users]     [KDE Users]     [Fedora Art]     [Fedora Docs]     [Asterisk PBX]     [Fedora Sparc]     [Fedora Universal Network Connector]     [Libvirt Users]     [Fedora ARM]

  Powered by Linux