If you install FC (including FC6T2) with /var as a separate partition,
you will get lots of the following at boot:
audit(1155060024.471:4): avc: denied { search } for pid=496
comm="pam_console_app" name="var" dev=hda2 ino=251905
scontext=system_u:system_r:pam_console_t:s0-s0:c0.c255
tcontext=system_u:object_r:file_t:s0 tclass=dir
This is because pam_console_apply is being run before /var is mounted
and the unmounted /var directory does not have the appropriate selinux
context (var_t). pam_console_apply is apparently looking for the fine
/var/run/console.lock.
I believe pam_console_apply is being run before /var is mounted by udev.
udev is started before /var is mounted, and the following udev rule
exists:
# cat /etc/udev/rules.d/95-pam-console.rules
ACTION=="add", SYSFS{dev}=="?*", KERNEL=="?*",
RUN+="/sbin/pam_console_apply $env{DEVNAME} $env{DEVLINKS}"
Which appears to run pam_console_apply for every device, which would
explain why there are so many messages.
Now, I think the proper solution is to have anaconda properly label the
/var mount point var_t. Indeed, putting "restorecon /var" early in
rc.sysinit and rebooting a couple times has been to favored hack to this
point and doesn't not appear to result in any other error messages. But
I'm posting this here so that hopefully all of the various parties
(initscripts, udev, anaconda, selinux, pam) have a chance to weigh in.
--
Orion Poplawski
System Administrator 303-415-9701 x222
NWRA/CoRA Division FAX: 303-415-9702
3380 Mitchell Lane orion@xxxxxxxxxxxxx
Boulder, CO 80301 http://www.cora.nwra.com
--
fedora-devel-list mailing list
fedora-devel-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-devel-list
