Re: Kernel + Selinux + Udev + selinux=0

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Yuan Yijun wrote:
2008/3/4, Johann B. Gudmundsson <johannbg@xxxxx>:
Anyone else noticing this...

 The kernels get stuck at UDEV loading...

 kernel-2.6.25-0.82.rc3.git2.fc9.i686
 kernel-2.6.25-0.73.rc3.git1.fc9.i686

 Have selinux disabled in /etc/selinux/config...
 and the kernel get stuck at UDEV

 But if I pass the selinux=0 kernel parameter
 to the kernel(s) they load just fine..

 Best regards.
                     Johann B.

 PS. the radeon driver sorta works now for [ Mobility Radeon X300]
       had to switch to vesa driver with the previous version to get into X
        It does not offer correct resolution for my screen though
       ( Dell inspiron 6000/Dell 1600x1200/Driver/Display only offers/
 1680x1050 )
       xorg-x11-drv-ati-6.8.0-3.fc9.i386



Boot a second time and it will be fine, I have met with this several times.

BTW, I find that one must have selinux=enforcing when installing
kernel. I started with selinux=0, and changed /etc/sysconfig/selinux
to permissive, then reboot to single mode, relabel, setenforce 1, then
install the kernel, change /etc/sysconfig/selinux to enforcing and
reboot: that fixes boot problem for ever.

I have a problem that how to specify selinux=permissive at grub
prompt, when /etc/sysconfig/selinux=enforcing?




Selinux related Kernel Parameters..

autorelabel=1 # Forces system to relabel

enforcing=0 #Sets selinux to Permissive (log only, no denials).

Yuan the above is what you want selinux=permissive does not exist..

enforcing=1 # Sets selinux to Enforcing (deny and log).

selinux=0 # THIS IS NOT SAME AS ENFORCING this will cause
the kernel to not load any of the selinux infrastructure hence files that
are created at boot time will not get a label and are market as file_t ( Unlabeled file).

After booting with selinux=0 make sure that you do "touch /.autorelabel"
( This should be done by default but hey this is rawhide we are talking about :) ) or better yet do "echo 0 > /selinux/enforce && fixfiles relabel " or on next reboot
pass the "enforcing=0 autorelabel=1" to the kernel.

( That is if you are gonna run selinux in either permissive or enforcing mode )

selinux=1 # Turns the selinux infrastructure on ( Default )...

selinux_compat_net=0 # Sets selinux to use new secmark-based packet controls ( default )

selinux_compat_net=1 # Sets selinux to use legacy packet controls

If you wanna change the value of selinux at runtime do....

echo 0 > /selinux/enforce # Sets selinux in permissive mode

echo 1 > /selinux/enforce #Sets selinux to enforce again..

For compat_net do..

echo 0 > /selinux/compat_net # secmark-based packet controls

echo 1 > /selinux/compat_net # legacy packet controls

To get the status of selinux use "getenforce"

To permanently change the status of selinux either edit
/etc/selinux/config manually ( disabled,permissive,enabled )
or use setenforce=0 ( permissive ) or setenforce=1 (enabled )
or set kernel parameters to grub.conf

Best regards
                Johann B.

PS. Could somebody put this on the wiki --> Testers page



begin:vcard
fn:Johann B.  Gudmundsson
n:Gudmundsson;Johann B. 
org:Reiknistofnun - University of Iceland;IT Management
adr:Dunhagi 5;;Taeknigardur;Reykavik;;107;Iceland
email;internet:johannbg@xxxxx
title:Unix System Engineer RHCE,CCSA
tel;work:+3545254267
tel;fax:+3545528801
tel;pager:N/A
tel;home:N/A
tel;cell:N/A
url:http://www.rhi.hi.is
version:2.1
end:vcard

-- 
fedora-test-list mailing list
fedora-test-list@xxxxxxxxxx
To unsubscribe: 
https://www.redhat.com/mailman/listinfo/fedora-test-list

[Index of Archives]     [Fedora Desktop]     [Fedora SELinux]     [Photo Sharing]     [Yosemite Forum]     [KDE Users]

  Powered by Linux