I just finished debugging an issue with kdump startup. (systemd was
unable to load the kdump kernel, even though using the kdumpctl command
from a shell worked just fine.) These symptoms immediately made me
think that the problem might be SELinux-related, and my /boot directory
was indeed not labeled correctly.
It took me quite a bit longer than it should have to figure out what was
going on, however, because no denials were reported -- either in the
audit log or by ausearch. It was only when I put SELinux in permissive
mode "just to doublecheck" that anything was reported:
time->Sun Nov 18 22:42:13 2012
type=SYSCALL msg=audit(1353300133.076:93): arch=c000003e syscall=5
success=yes exit=0 a0=3 a1=7fff0a12e0e0 a2=7fff0a12e0e0 a3=7fff0a12de70
items=0 ppid=3402 pid=3422 auid=4294967295 uid=0 gid=0 euid=0 suid=0
fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="kexec"
exe="/usr/sbin/kexec" subj=system_u:system_r:kdump_t:s0 key=(null)
type=AVC msg=audit(1353300133.076:93): avc: denied { getattr } for
pid=3422 comm="kexec"
path="/boot/initramfs-3.6.6-1.fc17.x86_64kdump.img" dev="md0" ino=19
scontext=system_u:system_r:kdump_t:s0
tcontext=system_u:object_r:file_t:s0 tclass=file
----
time->Sun Nov 18 22:42:13 2012
type=SYSCALL msg=audit(1353300133.076:92): arch=c000003e syscall=2
success=yes exit=3 a0=7fff0a12fee4 a1=0 a2=a a3=7fff0a12de70 items=0
ppid=3402 pid=3422 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="kexec"
exe="/usr/sbin/kexec" subj=system_u:system_r:kdump_t:s0 key=(null)
type=AVC msg=audit(1353300133.076:92): avc: denied { open } for
pid=3422 comm="kexec"
path="/boot/initramfs-3.6.6-1.fc17.x86_64kdump.img" dev="md0" ino=19
scontext=system_u:system_r:kdump_t:s0
tcontext=system_u:object_r:file_t:s0 tclass=file
type=AVC msg=audit(1353300133.076:92): avc: denied { read } for
pid=3422 comm="kexec" name="initramfs-3.6.6-1.fc17.x86_64kdump.img"
dev="md0" ino=19 scontext=system_u:system_r:kdump_t:s0
tcontext=system_u:object_r:file_t:s0 tclass=file
Is this expected behavior for some reason? Anyone ever seen anything
like this?
--
========================================================================
Ian Pilcher arequipeno@xxxxxxxxx
Sometimes there's nothing left to do but crash and burn...or die trying.
========================================================================
--
selinux mailing list
selinux@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/selinux
