On Fri, 16 Nov 2007 17:24:26 +0800 Ken YANG <spng.yang@xxxxxxxxx> wrote: > Markelov Andrey wrote: > > Hello! > > > > My system: > > Fedora 8, selinux-policy-3.0.8-44 in targeted mode. > > > > I log in to the system as ordinary user and then do su -. > > When I try to start sshd daemon in Fedora 8 by typing "service sshd start" > > I receive "Permission denied" message and this entry in audit.log: > > > > type=SELINUX_ERR msg=audit(1194792116.506:236): security_compute_sid: invalid context unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 for scontext=unconfined_u:system_r:initrc_t:s0 tcontext=system_u:object_r:sshd_exec_t:s0 tclass=process > > type=SYSCALL msg=audit(1194792116.506:236): arch=40000003 syscall=11 success=yes exit=0 a0=8f58ab0 a1=8f58658 a2=8f451c0 a3=0 items=0 ppid=11059 pid=11068 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts4 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null) > > > > When I try to start sshd my id -Z is: > > unconfined_u:system_r:unconfined_t > > > > I have some questions: > > 1) How can I explain that SELINUX_ERR message and "subj=..." in SYSCALL message? > > above messages is not selinux err messages, is audit log. > > > 2) Is it normal situation? In RHEL5 the "su -; service sshd start" commands work fine. > > is abnormal, i can start sshd in 42 selinux-policy > > > 3) How can I enable "service sshd start" in that situation? > > as i said above, what avc(selinux err) you got? > did you run setroubleshoot? That was my problem. No AVC messages. Only two audit messages. But now with selinux-policy-3.0.8-47.fc8 I don't have this problem. > > > ____ > > Andrey Markelov > > Plus Communications > > Phone: +7(495)777-0-111 ext.533 > > > > > > -- > > fedora-selinux-list mailing list > > fedora-selinux-list@xxxxxxxxxx > > https://www.redhat.com/mailman/listinfo/fedora-selinux-list > > > -- Andrey Markelov, Plus Communications Phone: +7(495)777-0-111 ext.533 -- fedora-selinux-list mailing list fedora-selinux-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-selinux-list
