On Wed, 2010-02-17 at 11:34 -0500, Alan Rouse wrote:
> Renaming didn't work for me in the image we've been discussing... However, after building another clean OpenSuse 11.2 image, installing the previously mentioned list of packages, and editing the grub menu.lst for selinux, I created a symlink named "targeted" to the refpolicy-standard directory, and it now boots into the desktop nicely (using the version of policy in the OpenSuse 11.2 repository.) Sestatus shows selinux active and in permissive mode. There are no AVC messages in /var/log/audit/audit.log. Audit2allow -al gives
>
> allow kernel_t file_t:file execmod;
> allow kernel_t self:process { execstack execmem };
>
> I don't understand why those are suggested since there are no AVC messages... But this looks far better than before!
>
> Thanks Justin. Now we just need to find out where it's hard coded to "targeted" and get that fixed...
libselinux will default to "targeted" if there is no SELINUXTYPE=
definition in /etc/selinux/config.
Or your /etc/dbus-1/system.conf might have a hardcoded path to it rather
than using selinux_root_relative="yes". Or the version of dbus shipped
in OpenSUSE 11.2 might not support that (I don't know).
Check /var/log/messages as well for avc messages; if you aren't running
auditd or before auditd starts, the avc messages will go
to /var/log/messages or wherever syslog is configured to report
kern.warn.
What does sestatus -v and pstree -Z show now?
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.
