Re: [gentoo-hardened] Coming back to the fold

[Thomas Bleher]

* Dale Pontius <DEPontius@××××××.net> [2006-05-05 03:25]:
> 2: I've had a very bad time getting avc warnings - to the point that I'm
> not sure I've ever gotten any, after booting native. Part of the problem
> was the way I partitioned, and had /var be a symlink. But that's fixed
> now, I've done the relabel, and still no warnings. A few months back I
> juggled the partitioning, did another relabel, and still no warnings.
> I'm not really sure where to start debugging this one.

SELinux needs the audit kernel subsystem to generate avc messages. Did
you disable CONFIG_AUDIT by any chance?

Thomas

PS: You can also enable CONFIG_AUDIT_SYSCALL, this should give you some
more information in case of a avc denial. I think that in newer kernels,
SELinux already depends on the audit system.