Re: [gentoo-hardened] SELinux Disable

[Philipp Riegger]

On 16.03.2007, at 17:40, Stephen Fromm wrote:

> Aside from disabling selinux entirely with the kernel paramater
> selinux=0 (as previously described), you can also run selinux in
> permissive mode.  In this case, it will allow anything and log what
> would have been denied in enforcing mode.

I wanted to try out SELinux but not lock me out of my system.  
Therefore i used permissive mode. Now the 100s of error messages in  
dmesg

"
audit(1175815400.344:300): avc:  denied  { read write } for  pid=7223  
comm="su" name="access" dev=selinuxfs ino=6 ipaddr=*censored*  
scontext=user_u:user_r:user_t tcontext=system_u:object_r:security_t  
tclass=file
"

got on my nerves, so i decided to disable SELinux until i find more  
time to read all the docs and solve theese issues:

"
chris ~ # cat /proc/cmdline
root=/dev/hda3 noexec=on selinux=0
chris ~ # selinuxenabled && echo 1
1
"

Well... looks like it did not work. Any idea what i could do?

Philipp
-- 
gentoo-hardened@g.o mailing list