Re: [gentoo-hardened] Can't log into my selinux system

[Ed Wildgoose]

Chris PeBenito wrote:

>On Wed, 2004-04-28 at 07:58, Ed Wildgoose wrote:
>
>
>>Oh dear.  I can't log into my new selinux system.  Keeps saying it can't
>>find a context for root, and would I like to enter a security
>>context....  Obviously I saw the note about this situation in the FAQ,
>>and have reloaded the entire policy and relabeled the entire fs a few
>>times.  Any pointers on what is happening here please?  (It's not in
>>enforcing mode, so why is this happening at all?)
>>
>>
>
>This happens because regardless of permissive/enforcing, the security
>functions that tell login what a user's login contexts are, always work
>the same.  If login isn't in the right context, then it won't return any
>contexts.  I wrote sestatus for these situations; run sestatus -v, and
>the contexts should look like this:
>
>Process contexts:
>Current context:        pebenito:sysadm_r:sysadm_t
>Init context:           system_u:system_r:init_t
>/sbin/mingetty          system_u:system_r:getty_t
>/sbin/agetty            system_u:system_r:getty_t
>/usr/sbin/sshd          system_u:system_r:sshd_t
>
>File contexts:
>Controlling term:       pebenito:object_r:sysadm_devpts_t
>/etc/passwd             system_u:object_r:etc_t
>/etc/shadow             system_u:object_r:shadow_t
>/bin/bash               system_u:object_r:shell_exec_t
>/bin/login              system_u:object_r:login_exec_t
>/bin/sh                 system_u:object_r:bin_t -> system_u:object_r:shell_exec_t
>/sbin/agetty            system_u:object_r:getty_exec_t
>/sbin/init              system_u:object_r:init_exec_t
>/sbin/mingetty          system_u:object_r:getty_exec_t
>/usr/sbin/sshd          system_u:object_r:sshd_exec_t
>/lib/libc.so.6          system_u:object_r:lib_t -> system_u:object_r:shlib_t
>/lib/ld.so.1            system_u:object_r:lib_t -> system_u:object_r:ld_so_t
>
>

Hi Chris,

On a session which is *still* logged in from before this started, I get 
something similar to your results.  The difference is that Current 
context is system_u:system_r:kernel_t and Controlling term is 
system_u:object_r:tty_device_t  (I'm logged in as the default root user 
by the way)

I hear what you say, about login contexts, but I'm still not sure where 
to look to fix this?  How does se search for a users context?  Any help 
really appreciated (pointers to the docs I should have read will also be 
appreciated!)  I'm also not sure what I did that started this... It may 
have been something I emerged...?

Thanks

Ed W

--
gentoo-hardened@g.o mailing list