Re: [gentoo-hardened] locked out of selinux

[Markus Bartl]

  
  


Mike Edenfield schrieb:
Markus
Bartl wrote:
  
  
  Sep 29 20:20:22 odin type=1400
audit(1222712401.300:3): avc:  denied  { read write } for  pid=1
comm="init" path="/dev/console" dev=sda3 ino=1485226
scontext=system_u:system_r:init_t tcontext=system_u:object_r:file_t
tclass=chr_file
    
Sep 29 20:20:22 odin type=1400 audit(1222712401.304:4): avc:  denied  {
ioctl } for  pid=1 comm="init" path="/dev/tty0" dev=sda3 ino=1485112
scontext=system_u:system_r:init_t tcontext=system_u:object_r:file_t
tclass=chr_file
    
Sep 29 20:20:22 odin type=1400 audit(1222712401.316:5): avc:  denied  {
read write } for  pid=1081 comm="rc" name="console" dev=sda3
ino=1485226 scontext=system_u:system_r:initrc_t
tcontext=system_u:object_r:file_t tclass=chr_file
    
Sep 29 20:20:22 odin type=1400 audit(1222712401.364:6): avc:  denied  {
read write } for  pid=1083 comm="consoletype" name="console" dev=sda3
ino=1485226 scontext=system_u:system_r:consoletype_t
tcontext=system_u:object_r:file_t tclass=chr_file
    
Sep 29 20:20:22 odin type=1400 audit(1222712401.364:7): avc:  denied  {
getattr } for  pid=1083 comm="consoletype" path="/dev/console" dev=sda3
ino=1485226 scontext=system_u:system_r:consoletype_t
tcontext=system_u:object_r:file_t tclass=chr_file
    
  
  
These are actually pretty harmless -- it just means your static /dev
isn't labeled correctly.  This is because the stage3 tarballs don't
have any SELinux information in them, so when you unpack it the /dev
files are there with no labels, but by the time you get SELinux working
enough to relabel your filesystems, udev has taken over /dev.
  
  
If you want to get rid of these AVC's from your dmesg, you just need to
relabel the static dev entries.  It's a bit tricky but you only need to
do it once:
  
  
# mkdir -p /mnt/realroot
  
# mount -o bind / /mnt/realroot
  
# setfiles -r /mnt/realroot \
  
  /etc/selinux/strict/contexts/files/file_contexts \
  
  /mnt/realroot/dev
  
# umount /mnt/realroot
  
  
*However*, I don't this this is really the cause of your problems.
Gentoo's boot process is capable of continuing without access to
/dev/console (though /dev/null may give it problems), and very early on
udev mounted and everything fixes itself.
  
  
Have you manually unmasked any packages related to booting?  In
particular, openrc/baselayout2 won't work with the SELinux userland
from portage, and have given me similar boot failures.
  
  
Also, can you be more precise about what failed on boot?  How far does
your boot process get? Do you get any of the normal Gentoo boot
messages (the colorized ones)?
  
  
--Mike
  
  

Hi Folks!

Thanks Mike. The above procedure solved the boot problem.
Im now able to boot up in enforcing mode.

What i still get is
Sep 30 10:20:01 odin type=1400 audit(1222762783.108:5): avc:  denied  {
read write } for  pid=1278 comm="modprobe" path="/dev/null" dev=tmpfs
ino=1330 scontext=system_u:system_r:insmod_t
tcontext=system_u:object_r:device_t tclass=chr_file
...
Sep 30 10:20:01 odin type=1400 audit(1222762796.338:19): avc:  denied 
{ write } for  pid=2882 comm="runscript.sh" name="resolv.conf" dev=sda3
ino=1999328 scontext=system_u:system_r:initrc_t
tcontext=system_u:object_r:net_conf_t tclass=file
Sep 30 10:20:01 odin type=1400 audit(1222762801.746:21): avc:  denied 
{ search } for  pid=3681 comm="syslog-ng" name="lib" dev=sda3
ino=770262 scontext=system_u:system_r:syslogd_t
tcontext=system_u:object_r:var_lib_t tclass=dir
Sep 30 10:35:05 odin type=1400 audit(1222763686.716:3): avc:  denied  {
write } for  pid=1150 comm="bash" name="null" dev=tmpfs ino=1330
scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:device_t
tclass=chr_file

Im not quite sure if the /dev/null thing is really a problem, but the
reslov.conf thing is one, because i dont get an IP from DHCP later on
during boot.
Again any ideas are welcome.

Regards,
Markus