Gentoo Archives: gentoo-hardened

From: petre rodan <kaiowas@g.o>
To: gentoo-hardened@l.g.o
Subject: Re: [gentoo-hardened] [SELINUX]: Postgresql don't start
Date: Wed, 27 Apr 2005 07:16:25
Message-Id: 426F3C5C.6040600@gentoo.org
In Reply to: [gentoo-hardened] [SELINUX]: Postgresql don't start by Grob Team
1 Hi
2
3 Grob Team wrote:
4 > Hi,
5 >
6 > When trying to start postgresql (run_init /etc/init.d/postgre start) I
7 > got the "Starting PostGreSql" and nothing after, when I do a ps to see
8 > what happens, I got this:
9 >
10 > system_u:system_r:initrc_su_t root 5879 0.0 0.2 2224 932
11 > tty1 S+ 14:16 0:00 su - postgres -c /usr/bin/pg_ctl start -D
12 > '/var/lib/postgresql/data' -s -l
13 > '/var/lib/postgresql/data/postgresql.log' -o ''
14 > system_u:system_r:system_chkpwd_t root 5880 0.0 0.0 0 0
15 > tty1 Z+ 14:16 0:00 [unix_chkpwd] <defunct>
16 >
17 > So, I tried to do: so - postgres and it "freeze" too. So maybe its not
18 > postgres but a problem with pam/su. In the logfile, I have this:
19 > Apr 26 14:55:34 [unix_chkpwd] could not get username from shadow (postgres))
20 >
21 > However, postgres is a valid user
22 > # cat /etc/passwd | grep postgres
23 > postgres:x:70:70::/var/lib/postgresql:/bin/false
24 >
25 > My version of pam is: 0.77-r6
26 >
27 > This is the output of the context of /etc/passwd and /etc/shadow
28 >
29 > -rw-r--r-- root root system_u:object_r:etc_t /etc/passwd
30 > -rw------- root root system_u:object_r:shadow_t /etc/shadow
31 >
32 > Someone have an idea about the problem?
33 > Thank you.
34
35 there has to be a postgres line in /etc/shadow
36
37 so go ahead and do smth like
38 echo 0 > /selinux/enforce
39 echo 'postgres:!:12000:0:99999:7:::' >> /etc/shadow
40 /usr/sbin/setfiles -v /etc/security/selinux/src/policy/file_contexts/file_contexts /etc/shadow
41 echo 1 > /selinux/enforce
42
43 and please don't ask why that line is missing :)
44
45 bye,
46 peter
47
48 --
49 petre rodan
50 <kaiowas@g.o>
51 Developer,
52 Hardened Gentoo Linux

Attachments

File name MIME type
signature.asc application/pgp-signature

Replies

Subject Author
Re: [gentoo-hardened] [SELINUX]: Postgresql don't start Grob Team <grobteam@×××××.com>