On 11/28/2010 09:31 AM, Benjamin Franz wrote:
> [...]
> And then, one day, it won't work. Worse - it doesn't always *log* what
> it is doing in a way that you can figure out. Occasionally not at all.
> So you spend a few hours poking at the system until you try the magic of
> turning off SELinux. And then it starts working again.
>
> My experience is that *unless you have a system configured exactly like
> the defaults*, SELinux is prone to suddenly deciding after an update
> that it doesn't like your configuration anymore. Once because an update
> to SELinux changed the labeling on an existing directory tree - blowing
> away my own applied labeling with no warning. And there are even RH
> supplied rpms that *do not work* with SELinux without being SELinux
> being tweaked first.
>
And in an exact example of this, today I needed to update some WordPress
(WP) installations. Only, for "some reason" the FTP based autoupdater
didn't work today.
You guessed it - SELinux had struck again. I have left SELinux active on
this machine because I don't trust WP not to get hacked. I went out of
my way to make the system as SELinux friendly as I could when I built it
because of this. It has had SELinux active right from the start.
But something in the normal yum system updates or other routine system
operation over the last several months apparently caused the system to
mis-label part of the directory tree making it so that FTP (which is
only allowed from the localhost to support WP updating) could no longer
access some directory trees. No idea why: I'm the only person who has
logged into the machine since March - and I only log in to run updates.
It worked on April 26th - but not today.
My fix today? I temporarily disabled SELinux, ran the WP updates,
touched /.autorelabel and rebooted the machine. And "mysteriously" the
FTP problem is gone now. This isn't the first time this has happened on
this machine.
If I wasn't so specifically paranoid about WP, SELinux would be disabled
on this machine as well.
--
Benjamin Franz
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos
