On Sat, Apr 24, 2010 at 04:56:00PM -0400, Steve Blackwell wrote: > I've always had problems with SELinux but I set it to permissive and > moved on. Now I want to see if I can fix it. > > My logwatch report gives me 20 or 30 lines of : > > NULL security context for user, but SELinux in permissive mode, > continuing () > > in the cron section. Then I looked in /var/log/dmesg and I see this > line: > > SELinux: 8 users, 12 roles, 2527 types, 119 bools, 1 sens, 1024 cats > > System->Administration->SELinux Management, select SELinux User, shows > 8 SELinux users: > guest_u, > root, > staff_u, > sysadm_u, > system_u, > unconfined_u, > user_u > xguest_u > > OK, that looks good but when, as root, I run: > > # semanage login -l > > Login Name SELinux User MLS/MCS Range > > __default__ unconfined_u s0-s0:c0.c1023 > root unconfined_u s0-s0:c0.c1023 > system_u system_u s0-s0:c0.c1023 > > hmmm... only 3 users. It this a problem or is it telling me that only 3 > SELinuux users are currently in use (ie assign to any Linux user) > because I'm running in permissive mode? This should not be a problem because new users get mapped under __default__ by default, which is mapped to unconfined_u selinux user. > > How can I find out which user has a "NULL security context"? Good question, my gut feeling tells me it unconfined_u but i am not sure. If there is no bug in Fedora 11 selinux policy then you could consider reinstalling the policy. The procedure for reinstalling policy is as follows. 1. setenforce 0 (put selinux in permisive mode) 2. rpm -ev selinux-policy selinux-policy-targeted (de-install selinux policy) 3. mv /etc/selinux/targeted /etc/selinux/targeted.backup (remove -backup- the old selinux policy config) 4. yum install selinux-policy selinux-policy-targeted (-re- install fresh selinux policy) 5. fixfiles restore (restore contexts) 6. reboot But try at your own risk. Also just a file system relabeling *may* fix the issue: fixfiles restore; reboot (but i am not sure there either) hth > > Thanks, > Steve > -- > selinux mailing list > selinux@xxxxxxxxxxxxxxxxxxxxxxx > https://admin.fedoraproject.org/mailman/listinfo/selinux
Attachment:
pgpxTWN7HrIbR.pgp
Description: PGP signature
-- selinux mailing list selinux@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/selinux
