Re: [gentoo-hardened] Can't log into my selinux system

[Chris PeBenito]

On Wed, 2004-04-28 at 09:54, Ed Wildgoose wrote:
> Chris PeBenito wrote:
> >On Wed, 2004-04-28 at 07:58, Ed Wildgoose wrote:
> >
> >
> >>Oh dear.  I can't log into my new selinux system.  Keeps saying it can't
> >>find a context for root, and would I like to enter a security
> >>context....
>
> On a session which is *still* logged in from before this started, I get
> something similar to your results.  The difference is that Current
> context is system_u:system_r:kernel_t and Controlling term is
> system_u:object_r:tty_device_t  (I'm logged in as the default root user
> by the way)
>
> I hear what you say, about login contexts, but I'm still not sure where
> to look to fix this?  How does se search for a users context?  Any help
> really appreciated (pointers to the docs I should have read will also be
> appreciated!)  I'm also not sure what I did that started this... It may
> have been something I emerged...?

Login contexts are determined by the running policy, so login gets them
by requesting them through selinuxfs (/selinux).  So to correctly login
locally you need:

1. correctly setup policy
2. agetty is in getty_t
3. /bin/login is login_exec_t
4. selinuxfs is mounted

These aren't all the requirements, but the ones that are needed to get
login contexts.  ps -AZ and look at all the agetty's to make sure
they're all running in the right context (since sestatus only shows
one).  But since your logged in the kernel_t context, and your
controlling term is wrong, you should probably restart, so everything
can get into the right context.

-- 
Chris PeBenito
<pebenito@g.o>
Developer,
Hardened Gentoo Linux
Embedded Gentoo Linux
 
Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
Key fingerprint = B0E6 877A 883F A57A 8E6A  CB00 BC8E E42D E6AF 9243