Re: [gentoo-hardened] locked out of selinux

[Matt Harrison]

Matt Harrison wrote:
> Hi all,
>
> I've recently converted one of our firewall/router/proxies to a hardened
> system.
>
> I changed the profile, rebuilt a kernel with selinux and recompiled all
> necessary packages.
>
> Everything seems to be ok until I set enforcing mode to on, then I get
> locked out of everything:
>
> permission denied on many binaries, ls, cat, echo etc.
> permission on some directories ie, /root missing.
> unable to login as perms on bash are gone.
>
> I also notice that courier-imap refuses to run in the right context and
> always runs as system_u:system_r:initrc_t.
>
> I previously installed a virtual machine with selinux etc to see if I
> could get my head round it and it all worked fine.
>
> What could be the reason for me getting locked out of my system when
> enforce mode is enabled?
>
> BTW I have relabeled filesystems several times as it looked originally
> like things just weren't labeled, however they seem fine until enforce
> mode is enabled.
>
> Grateful for any help.
>
> Thanks
>
> Matt
>

No-one has any clues on this? selinux seems like a good idea for our
firewalls and routers but i don't want to get locked out when running
enforced.

Thanks

Matt