Re: [gentoo-hardened] Problem with seLinux install

[sebastien Pastor]

Thanks Petre,

I switched to static dev, relabled all that and i have far less denied
message now (3 in all :-D)  i will dig those out ....

Thanks again.

Seb.


Petre Rodan wrote:
> Hi,
>
> On Wed, Jun 07, 2006 at 04:27:39PM +0200, sebastien Pastor wrote:
>
>> Hello guys,
>>
>> This is my very first POST to the list. I ve been reading a lot on
>> selinux for a week now, so i felt i could start installing one system
>> based on the gentoo selinux project of course.
>> I followed the handbook and now i have a system up and runnig except
>> that straight from the begining i have avc access denied message during
>> the boot. Basically every access from the init process is denied : like
>>
>> "avc denied {read write } for pid=1 comm="init"  name="console" dev=hda4
>> ino=301684 scontect=system_u:system_r:init_t
>> tcontext=system_u:object_r:file_t tclass=chr_file"
>>
>
> init tries to read and write to /dev/console, but /dev/console has a wrong label.
>
> this is how it should look like:
>
> muttley ~ # ls -alZ /dev/console
> crw-------  root     tty      system_u:object_r:console_device_t /dev/console
>
> yours is system_u:object_r:file_t, which is a bad thing.
>
> I presume you're using udev, maybe someone else can guide you on that path.
> I can only recommend switching to static dev.
>
> cheers,
> peter
>
>

-- 
gentoo-hardened@g.o mailing list