web/html/docs/selinux-faq index.html,1.1,1.2
by sradvan
Author: sradvan
Update of /cvs/fedora/web/html/docs/selinux-faq
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv531
Modified Files:
index.html
Log Message:
new changes, removal of fc5 specificity, clean up <screen> and <computeroutput> blocks all over the thing
Index: index.html
===================================================================
RCS file: /cvs/fedora/web/html/docs/selinux-faq/index.html,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- index.html 20 Jan 2010 00:27:38 -0000 1.1
+++ index.html 21 Jan 2010 03:33:24 -0000 1.2
@@ -2,7 +2,7 @@
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>SELinux FAQ</title><link rel="stylesheet" href="./Common_Content/css/default.css" type="text/css" /><meta name="generator" content="publican 1.3" /><meta name="package" content="Fedora-SELinux_FAQ-12-en-US-0-0" /><meta name="description" content="This FAQ answers many questions about Security-Enhanced Linux. The information in this FAQ is valuable for those who are new to SELinux." /></head><body class=""><p id="title"><a class="left" href="http://www.fedoraproject.org"><img src="Common_Content/images/image_left.png" alt="Product Site" /></a><a class="right" href="http://docs.fedoraproject.org"><img src="Common_Content/images/image_right.png" alt="Documentation Site" /></a></p><div xml:lang="en-US" class="article" title="SELinux FAQ" lang="en-US"><div class="titlepage"><div><div class="producttitle"><span class="productname">Fedora</span> <span class="
productnumber">12</span></div><div><h1 id="chap-SELinux-FAQ-FAQ" class="title">SELinux FAQ</h1></div><div><h2 class="subtitle">Frequently-asked questions about Security Enhanced Linux</h2></div><div><h3 class="corpauthor">
<span class="inlinemediaobject"><object data="Common_Content/images/title_logo.svg" type="image/svg+xml"> </object></span>
- </h3></div><div><div xml:lang="en-US" class="authorgroup" lang="en-US"><div class="author"><h3 class="author"><span class="firstname">Karsten</span> <span class="surname">Wade</span></h3><div class="affiliation"><span class="orgname">Fedora</span> <span class="orgdiv">Documentation Project</span></div><code class="email"><a class="email" href="mailto:quaid@fedoraproject.org">quaid(a)fedoraproject.org</a></code></div><div class="author"><h3 class="author"><span class="firstname">Paul W.</span> <span class="surname">Frields</span></h3><div class="affiliation"><span class="orgname">Fedora</span> <span class="orgdiv">Documentation Project</span></div><code class="email"><a class="email" href="mailto:pfrields@fedoraproject.org">pfrields(a)fedoraproject.org</a></code></div><div class="author"><h3 class="author"><span class="firstname">Scott</span> <span class="surname">Radvan</span></h3><div class="affiliation"><span class="orgname">Red Hat</span> <span class="orgdiv">Engineering Con
tent Services</span></div><code class="email"><a class="email" href="mailto:sradvan@redhat.com">sradvan(a)redhat.com</a></code></div></div></div><div><div id="id3043795" class="legalnotice"><h1 class="legalnotice">Legal Notice</h1><div class="para">
+ </h3></div><div><div xml:lang="en-US" class="authorgroup" lang="en-US"><div class="author"><h3 class="author"><span class="firstname">Karsten</span> <span class="surname">Wade</span></h3><div class="affiliation"><span class="orgname">Fedora</span> <span class="orgdiv">Documentation Project</span></div><code class="email"><a class="email" href="mailto:quaid@fedoraproject.org">quaid(a)fedoraproject.org</a></code></div><div class="author"><h3 class="author"><span class="firstname">Paul W.</span> <span class="surname">Frields</span></h3><div class="affiliation"><span class="orgname">Fedora</span> <span class="orgdiv">Documentation Project</span></div><code class="email"><a class="email" href="mailto:pfrields@fedoraproject.org">pfrields(a)fedoraproject.org</a></code></div><div class="author"><h3 class="author"><span class="firstname">Scott</span> <span class="surname">Radvan</span></h3><div class="affiliation"><span class="orgname">Red Hat</span> <span class="orgdiv">Engineering Con
tent Services</span></div><code class="email"><a class="email" href="mailto:sradvan@redhat.com">sradvan(a)redhat.com</a></code></div></div></div><div><div id="id3115757" class="legalnotice"><h1 class="legalnotice">Legal Notice</h1><div class="para">
Copyright <span class="trademark"></span>© 2010 Red Hat, Inc..
</div><div class="para">
The text of and illustrations in this document are licensed by Red Hat under a Creative Commons Attribution–Share Alike 3.0 Unported license ("CC-BY-SA"). An explanation of CC-BY-SA is available at <a href="http://creativecommons.org/licenses/by-sa/3.0/">http://creativecommons.org/licenses/by-sa/3.0/</a>. The original authors of this document, and Red Hat, designate the Fedora Project as the "Attribution Party" for purposes of CC-BY-SA. In accordance with CC-BY-SA, if you distribute this document or an adaptation of it, you must provide the URL for the original version.
@@ -20,162 +20,164 @@
This FAQ answers many questions about Security-Enhanced Linux. The
information in this FAQ is valuable for those who are new to SELinux.
</div></div></div></div><hr /></div><div class="toc"><dl><dt><span class="section"><a href="#SELinux_FAQ-FAQ-SELinux">1. SELinux</a></span></dt></dl></div><div class="para">
- For more information about how SELinux works, how to use SELinux for general and specific Linux distributions, and how to write policy, these resources are useful:
+ For further information about how SELinux works, how to use SELinux for general and specific Linux distributions, and how to write policy, these resources are useful:
</div><div class="itemizedlist"><h6>External Link List</h6><ul><li class="listitem"><div class="para">
- NSA SELinux main website — <a href="http://www.nsa.gov/selinux/">http://www.nsa.gov/selinux/</a>
+ NSA SELinux main website — <a href="http://www.nsa.gov/research/selinux/index.shtml">http://www.nsa.gov/research/selinux/index.shtml</a>
</div></li><li class="listitem"><div class="para">
- NSA SELinux FAQ — <a href="http://www.nsa.gov/selinux/info/faq.cfm">http://www.nsa.gov/selinux/info/faq.cfm</a>
+ NSA SELinux FAQ — <a href="http://www.nsa.gov/research/selinux/faqs.shtml">http://www.nsa.gov/research/selinux/faqs.shtml</a>
</div></li><li class="listitem"><div class="para">
- SELinux community page — <a href="http://selinux.sourceforge.net">http://selinux.sourceforge.net</a>
+ SELinux project wiki — <a href="http://selinuxproject.org/">http://selinuxproject.org/</a>
</div></li><li class="listitem"><div class="para">
- UnOfficial FAQ — <a href="http://www.crypt.gen.nz/selinux/faq.html">http://www.crypt.gen.nz/selinux/faq.html</a>
+ SELinux Wikipedia page — <a href="http://en.wikipedia.org/wiki/Security-Enhanced_Linux">http://en.wikipedia.org/wiki/Security-Enhanced_Linux</a>
</div></li><li class="listitem"><div class="para">
- Writing traditional SE Linux policy HOWTO — <a href="https://sourceforge.net/docman/display_doc.php?docid=21959&group_id=2...">https://sourceforge.net/docman/display_doc.php?docid=21959&group_id=2...</a>
+ SELinux community page — <a href="http://selinux.sourceforge.net">http://selinux.sourceforge.net</a>
</div></li><li class="listitem"><div class="para">
- Reference Policy (the new policy found in Fedora 5) — <a href="http://serefpolicy.sourceforge.net/">http://serefpolicy.sourceforge.net/</a>
+ Unofficial SELinux FAQ — <a href="http://www.crypt.gen.nz/selinux/faq.html">http://www.crypt.gen.nz/selinux/faq.html</a>
</div></li><li class="listitem"><div class="para">
- SELinux policy development training courses — <a href="http://tresys.com/services/training.shtml">http://tresys.com/services/training.shtml</a> and <a href="https://www.redhat.com/training/security/courses/rhs429.html">https://www.redhat.com/training/security/courses/rhs429.html</a>
+ Reference Policy — <a href="http://oss.tresys.com/">http://oss.tresys.com/</a>
</div></li><li class="listitem"><div class="para">
- Getting Started with SE Linux HOWTO: the new SELinux (Debian) — <a href="https://sourceforge.net/docman/display_doc.php?docid=20372&group_id=2...">https://sourceforge.net/docman/display_doc.php?docid=20372&group_id=2...</a>
+ SELinux policy development training course — <a href="https://www.redhat.com/training/security/courses/rhs429.html">https://www.redhat.com/training/security/courses/rhs429.html</a>
</div></li><li class="listitem"><div class="para">
- List of SELinux object classes and permissions — <a href="http://tresys.com/selinux/obj_perms_help.shtml">http://tresys.com/selinux/obj_perms_help.shtml</a>
+ Getting Started with SE Linux — <a href="http://www.linuxtopia.org/online_books/getting_started_with_SELinux/index...">http://www.linuxtopia.org/online_books/getting_started_with_SELinux/index...</a>
</div></li><li class="listitem"><div class="para">
- On IRC - irc.freenode.net, #fedora-selinux
+ List of SELinux object classes and permissions — <a href="http://tresys.com/selinux/obj_perms_help.shtml">http://tresys.com/selinux/obj_perms_help.shtml</a>
</div></li><li class="listitem"><div class="para">
Fedora mailing list — <a href="mailto:fedora-selinux-list@redhat.com">mailto:fedora-selinux-list@redhat.com</a>; read the archives or subscribe at <a href="http://www.redhat.com/mailman/listinfo/fedora-selinux-list">http://www.redhat.com/mailman/listinfo/fedora-selinux-list</a>
- </div></li></ul></div><div class="section" title="1. SELinux"><div class="titlepage"><div><div><h2 class="title" id="SELinux_FAQ-FAQ-SELinux">1. SELinux</h2></div></div></div><div class="qandaset" title="Frequently Asked Questions" id="id2913416"><dl><dt></dt><dd><dl><dt>Q: <a href="#id2913421">
+ </div></li><li class="listitem"><div class="para">
+ On IRC - irc.freenode.net, #fedora-selinux and #selinux
+ </div></li></ul></div><div class="section" title="1. SELinux"><div class="titlepage"><div><div><h2 class="title" id="SELinux_FAQ-FAQ-SELinux">1. SELinux</h2></div></div></div><div class="qandaset" title="Frequently Asked Questions" id="id3022703"><dl><dt></dt><dd><dl><dt>Q: <a href="#id3022708">
What is SELinux?
- </a></dt><dt>Q: <a href="#id2914799">
+ </a></dt><dt>Q: <a href="#id2952428">
What is SELinux policy?
- </a></dt><dt>Q: <a href="#id3057481">
+ </a></dt><dt>Q: <a href="#id2948223">
What happened to the strict policy?
- </a></dt><dt>Q: <a href="#id2898184">
+ </a></dt><dt>Q: <a href="#id2948251">
What programs are protected by the SELinux policy?
</a></dt><dt>Q: <a href="#faq-entry-whatis-refpolicy">
What is the Reference Policy?
- </a></dt><dt>Q: <a href="#id2898287">
+ </a></dt><dt>Q: <a href="#id2953893">
What are file contexts?
- </a></dt><dt>Q: <a href="#id2916596">
+ </a></dt><dt>Q: <a href="#id2953953">
How do I view the security context of a file, user, or process?
- </a></dt><dt>Q: <a href="#id2916634">
+ </a></dt><dt>Q: <a href="#id3078024">
What is the difference between a domain and a type?
</a></dt><dt>Q: <a href="#faq-entry-whatare-policy-modules">
What are policy modules?
</a></dt><dt>Q: <a href="#faq-entry-whatis-managed-policy">
What is managed policy?
- </a></dt></dl></dd><dt>1.2. <a href="#id2929042">Controlling SELinux</a></dt><dd><dl><dt>Q: <a href="#id2929048">
+ </a></dt></dl></dd><dt>1.2. <a href="#id3016692">Controlling SELinux</a></dt><dd><dl><dt>Q: <a href="#id3016698">
How do I install/not install SELinux?
- </a></dt><dt>Q: <a href="#id2929075">
+ </a></dt><dt>Q: <a href="#id3016724">
As an administrator, what do I need to do to configure SELinux for my system?
</a></dt><dt>Q: <a href="#qa-using-s-c-securitylevel">
How do I enable/disable SELinux protection on specific daemons under the targeted policy?
</a></dt><dt>Q: <a href="#faq-entry-local.te">
- In the past I have written local.te file in policy sources for my own local customization to policy, how do I do this in Fedora 5?
- </a></dt><dt>Q: <a href="#id2929497">
+ In the past I have written local.te file in policy sources for my own local customization to policy, how do I do this now?
+ </a></dt><dt>Q: <a href="#id3017163">
I have some avc denials that I would like to allow, how do I do this?
- </a></dt><dt>Q: <a href="#id2929670">
+ </a></dt><dt>Q: <a href="#id2993909">
How can I help write policy?
- </a></dt><dt>Q: <a href="#id3069707">
+ </a></dt><dt>Q: <a href="#id2994188">
How do I switch the policy I am currently using?
- </a></dt><dt>Q: <a href="#id3069893">
+ </a></dt><dt>Q: <a href="#id2994374">
How can I back up files from an SELinux file system?
</a></dt><dt>Q: <a href="#faq-entry-public_html">
How do I make a user public_html directory work under SELinux?
- </a></dt><dt>Q: <a href="#id3070107">
+ </a></dt><dt>Q: <a href="#id2994596">
How do I turn SELinux off at boot?
- </a></dt><dt>Q: <a href="#id3070170">
+ </a></dt><dt>Q: <a href="#id2994660">
How do I turn enforcing on/off at boot?
- </a></dt><dt>Q: <a href="#id3070271">
+ </a></dt><dt>Q: <a href="#id2994760">
How do I temporarily turn off enforcing mode without having to reboot?
- </a></dt><dt>Q: <a href="#id3070304">
+ </a></dt><dt>Q: <a href="#id2994793">
How do I turn system call auditing on/off at boot?
- </a></dt><dt>Q: <a href="#id3070350">
+ </a></dt><dt>Q: <a href="#id2994839">
How do I temporarily turn off system-call auditing without having to reboot?
- </a></dt><dt>Q: <a href="#id3070377">
+ </a></dt><dt>Q: <a href="#id2994866">
How do I get status info about my SELinux installation?
- </a></dt><dt>Q: <a href="#id3070407">
+ </a></dt><dt>Q: <a href="#id2994896">
How do I write policy to allow a domain to use pam_unix.so?
- </a></dt><dt>Q: <a href="#id3070489">
+ </a></dt><dt>Q: <a href="#id2994979">
I created a new Policy Package, where do I put it to make sure that it gets loaded into the kernel?
- </a></dt></dl></dd><dt>1.3. <a href="#faq-div-resolving-problems">Resolving Problems</a></dt><dd><dl><dt>Q: <a href="#id3070551">
+ </a></dt></dl></dd><dt>1.3. <a href="#faq-div-resolving-problems">Resolving Problems</a></dt><dd><dl><dt>Q: <a href="#id2995041">
Where are SELinux AVC messages (denial logs, etc.) stored?
- </a></dt><dt>Q: <a href="#id3070593">
+ </a></dt><dt>Q: <a href="#id2995078">
My application isn't working as expected and I am seeing avc: denied messages. How do I fix this?
- </a></dt><dt>Q: <a href="#id3070681">
+ </a></dt><dt>Q: <a href="#id2995166">
I installed Fedora on a system with an existing /home partition, and now I can't log in.
- </a></dt><dt>Q: <a href="#id3070768">
+ </a></dt><dt>Q: <a href="#id2995253">
After relabeling my /home using setfiles or fixfiles, am I still be able to read /home with a non-SELinux-enabled system?
- </a></dt><dt>Q: <a href="#id3070818">
+ </a></dt><dt>Q: <a href="#id2995304">
How do I share directories using NFS between Fedora and non-SELinux systems?
- </a></dt><dt>Q: <a href="#id3070880">
- How can I create a new Linux user account with the user's home
- </a></dt><dt>Q: <a href="#id3070962">
+ </a></dt><dt>Q: <a href="#id2995365">
+ How can I create a new Linux user account with the user's home?
+ </a></dt><dt>Q: <a href="#id2995455">
Does the su command change my SELinux identity and role?
- </a></dt><dt>Q: <a href="#id3071028">
+ </a></dt><dt>Q: <a href="#id2995522">
I'm having troubles with avc errors filling my logs for a particular program. How do I choose not to audit the access for it?
- </a></dt><dt>Q: <a href="#id3071089">
+ </a></dt><dt>Q: <a href="#id2995582">
Even running in permissive mode, I'm getting a large number of avc denied messages.
- </a></dt><dt>Q: <a href="#id3071133">
+ </a></dt><dt>Q: <a href="#id2995626">
I get a specific permission denial only when SELinux is in enforcing mode, but I don't see any audit messages in /var/log/messages (or /var/log/audit/audit.log if using the audit daemon). How can I identify the cause of these silent denials?
- </a></dt><dt>Q: <a href="#id3071241">
+ </a></dt><dt>Q: <a href="#id2995734">
Why do I not see the output when I run certain daemons in debug or interactive mode?
- </a></dt><dt>Q: <a href="#id3071332">
+ </a></dt><dt>Q: <a href="#id2995825">
When I do an upgrade of the policy package (for example, using yum), what happens with the policy? Is it updated automatically?
- </a></dt><dt>Q: <a href="#id3071420">
+ </a></dt><dt>Q: <a href="#id2995914">
If the policy shipping with an application package changes in a way that requires relabeling, will RPM handle relabeling the files owned by the package?
- </a></dt><dt>Q: <a href="#id3071498">
+ </a></dt><dt>Q: <a href="#id2995992">
Why do binary policies distributed with Fedora, such as /etc/selinux/<policyname>/policy/policy.<version>, and those I compile myself have different sizes and MD5 checksums?
- </a></dt><dt>Q: <a href="#id3071561">
+ </a></dt><dt>Q: <a href="#id2996054">
Will new policy packages disable my system?
- </a></dt><dt>Q: <a href="#id3071597">
+ </a></dt><dt>Q: <a href="#id2996090">
My console is being flooded with messages. How do I turn them off?
- </a></dt><dt>Q: <a href="#id3071628">
+ </a></dt><dt>Q: <a href="#id2996121">
Can I test the default policy without installing the policy source?
- </a></dt><dt>Q: <a href="#id3071712">
+ </a></dt><dt>Q: <a href="#id2996205">
Why are some of my KDE applications having trouble under SELinux?
- </a></dt><dt>Q: <a href="#id3071784">
+ </a></dt><dt>Q: <a href="#id2996277">
Why does SELINUX=disabled not work for me?
</a></dt><dt>Q: <a href="#faq-entry-unconfined_t">
I have a process running as unconfined_t, and SELinux is still preventing my application from running.
- </a></dt><dt>Q: <a href="#id3071992">
+ </a></dt><dt>Q: <a href="#id3029652">
What do these rpm errors mean?
- </a></dt><dt>Q: <a href="#id3072060">
+ </a></dt><dt>Q: <a href="#id3029720">
I want to run a daemon on a non standard port but SELinux will not allow me. How do get this to work?
- </a></dt><dt>Q: <a href="#id3072095">
- I am writing a php script that needs to create files and possibly execute them. SELinux policy is preventing this. What should I do?
- </a></dt><dt>Q: <a href="#id3072149">
+ </a></dt><dt>Q: <a href="#id3029755">
+ I am writing a PHP script that needs to create files and possibly execute them. SELinux policy is preventing this. What should I do?
+ </a></dt><dt>Q: <a href="#id3029810">
I am setting up swapping to a file, but I am seeing AVC messages in my log files?
- </a></dt><dt>Q: <a href="#id3072186">
+ </a></dt><dt>Q: <a href="#id3029847">
Please explain the relabelto/relabelfrom permissions?
- </a></dt></dl></dd><dt>1.4. <a href="#faq-div-deploying-selinux">Deploying SELinux</a></dt><dd><dl><dt>Q: <a href="#id3072295">
+ </a></dt></dl></dd><dt>1.4. <a href="#faq-div-deploying-selinux">Deploying SELinux</a></dt><dd><dl><dt>Q: <a href="#id3029955">
What file systems can I use for SELinux?
- </a></dt><dt>Q: <a href="#id3072333">
+ </a></dt><dt>Q: <a href="#id3029988">
How does SELinux impact system performance?
- </a></dt><dt>Q: <a href="#id3072362">
+ </a></dt><dt>Q: <a href="#id3030022">
What types of deployments, applications, and systems should I leverage SELinux in?
- </a></dt><dt>Q: <a href="#id3072425">
+ </a></dt><dt>Q: <a href="#id3030073">
How does SELinux affect third-party applications?
- </a></dt></dl></dd></dl><div class="qandaset"><div class="toc"><dl><dt>Q: <a href="#id2913421">
+ </a></dt></dl></dd></dl><div class="qandaset"><div class="toc"><dl><dt>Q: <a href="#id3022708">
What is SELinux?
- </a></dt><dt>Q: <a href="#id2914799">
+ </a></dt><dt>Q: <a href="#id2952428">
What is SELinux policy?
- </a></dt><dt>Q: <a href="#id3057481">
+ </a></dt><dt>Q: <a href="#id2948223">
What happened to the strict policy?
- </a></dt><dt>Q: <a href="#id2898184">
+ </a></dt><dt>Q: <a href="#id2948251">
What programs are protected by the SELinux policy?
</a></dt><dt>Q: <a href="#faq-entry-whatis-refpolicy">
What is the Reference Policy?
- </a></dt><dt>Q: <a href="#id2898287">
+ </a></dt><dt>Q: <a href="#id2953893">
What are file contexts?
- </a></dt><dt>Q: <a href="#id2916596">
+ </a></dt><dt>Q: <a href="#id2953953">
How do I view the security context of a file, user, or process?
- </a></dt><dt>Q: <a href="#id2916634">
+ </a></dt><dt>Q: <a href="#id3078024">
What is the difference between a domain and a type?
</a></dt><dt>Q: <a href="#faq-entry-whatare-policy-modules">
What are policy modules?
</a></dt><dt>Q: <a href="#faq-entry-whatis-managed-policy">
What is managed policy?
- </a></dt></dl></div><div class="qandadiv"><div class="qandaentry"><div class="question" id="id2913421"><label>Q:</label><div class="data"><div class="para">
+ </a></dt></dl></div><div class="qandadiv"><div class="qandaentry"><div class="question" id="id3022708"><label>Q:</label><div class="data"><div class="para">
What is SELinux?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
SELinux (<em class="firstterm">Security-Enhanced Linux</em>) in Fedora is an implementation of <em class="firstterm">mandatory access control</em> in the Linux kernel using the <em class="firstterm">Linux Security Modules</em> (<abbr class="abbrev">LSM</abbr>) framework. Standard Linux security is a <em class="firstterm">discretionary access control</em> model.
@@ -191,49 +193,52 @@
MAC under SELinux allows you to provide granular permissions for all <em class="firstterm">subjects</em> (users, programs, processes) and <em class="firstterm">objects</em> (files, devices). In practice, think of subjects as processes, and objects as the target of a process operation. You can safely grant a process only the permissions it needs to perform its function, and no more.
</div><div class="para">
The SELinux implementation uses <em class="firstterm">role-based access control</em> (<abbr class="abbrev">RBAC</abbr>), which provides abstracted user-level control based on roles, and <em class="firstterm"><span class="trademark">Type Enforcement</span>®</em> (<abbr class="abbrev">TE</abbr>). TE uses a table, or <em class="firstterm">matrix</em> to handle access controls, enforcing policy rules based on the types of processes and objects. Process types are called <em class="firstterm">domains</em>, and a cross-reference on the matrix of the process's domain and the object's type defines their interaction. This system provides extremely granular control for actors in a Linux system.
- </div></div></div></div><div class="qandaentry"><div class="question" id="id2914799"><label>Q:</label><div class="data"><div class="para">
+ </div></div></div></div><div class="qandaentry"><div class="question" id="id2952428"><label>Q:</label><div class="data"><div class="para">
What is SELinux policy?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
The SELinux policy describes the access permissions for all subjects and objects, that is, the entire system of users, programs, and processes and the files and devices they act upon. Fedora policy is delivered in a package, with an associated source package. Current shipping policy packages are:
</div><div class="variablelist"><dl><dt><span class="term"><code class="filename">selinux-policy-<em class="replaceable"><code><version></code></em>.noarch.rpm</code></span></dt><dd><div class="para">
This package is common to all types of policy and contains config files/man pages. This includes the interface files for the development environment. This replaces the -sources package from the past. This package contains the interface files used in Reference Policy along with a Makefile and a small tool called <code class="command">sepolgen</code> used to generate a policy template file. The interface files reside in <code class="filename">/usr/share/selinux/devel/include</code> directory. If you want to see all of the policy files used to build the Reference Policy you need to install the src.rpm.
- </div></dd></dl></div></div></div></div><div class="qandaentry"><div class="question" id="id3057481"><label>Q:</label><div class="data"><div class="para">
+ </div></dd></dl></div></div></div></div><div class="qandaentry"><div class="question" id="id2948223"><label>Q:</label><div class="data"><div class="para">
What happened to the strict policy?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
- Strict policy since RHEL5 and Fedora Core 5 has been the equivalent of targeted policy with the unconfined domains removed. This means all users had to have a type defined for them like staff_t or user_t. And all processes started by init would need to have policy written for them. As of Fedora Core 9, the strict policy was removed and merged into targeted policy.
- </div></div></div></div><div class="qandaentry"><div class="question" id="id2898184"><label>Q:</label><div class="data"><div class="para">
+ Strict policy since Red Hat Enterprise Linux 5 and Fedora Core 5 has been the equivalent of targeted policy with the unconfined domains removed. This means all users had to have a type defined for them like staff_t or user_t. Also, all processes started by init would need to have policy written for them. As of Fedora Core 9, the strict policy was removed and merged into targeted policy.
+ </div></div></div></div><div class="qandaentry"><div class="question" id="id2948251"><label>Q:</label><div class="data"><div class="para">
What programs are protected by the SELinux policy?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
The number of programs that have SELinux policy defined for them is constantly changing and evolving. Different versions of policy have more or less executables covered. By convention all confined executables have a label type that ends with exec_t. The SELinux tools package (setools) includes the seinfo application which allows you to examine the installed policy.
<pre class="screen">
-<code class="computeroutput"> # seinfo -t | grep exec_t | wc -l 572 </code>
+<code class="computeroutput"># seinfo -t | grep exec_t | wc -l</code>
+<code class="computeroutput">537</code>
</pre>
</div></div></div></div><div class="qandaentry"><div class="question" id="faq-entry-whatis-refpolicy"><label>Q:</label><div class="data"><div class="para">
What is the Reference Policy?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
- The <em class="firstterm">Reference Policy</em> is a new project maintained by Tresys Technology (<a href="http://www.tresys.com/">http://www.tresys.com/</a>) designed to rewrite the entire SELinux policy in a way that is easier to use and understand. To do this, it uses the concepts of modularity, abstraction, and well-defined interfaces. Refer to <a href="http://serefpolicy.sourceforge.net/">http://serefpolicy.sourceforge.net/</a> for more information on the Reference Policy.
+ The <em class="firstterm">Reference Policy</em> is a new project maintained by Tresys Technology (<a href="http://www.tresys.com/">http://www.tresys.com/</a>) designed to rewrite the entire SELinux policy in a way that is easier to use and understand. To do this, it uses the concepts of modularity, abstraction, and well-defined interfaces. Refer to <a href="http://oss.tresys.com/">http://oss.tresys.com/</a> for more information on the Reference Policy.
</div><div class="para">
Note that Reference Policy is not a new type of policy. Rather, it is a new base that policies can be built from.
- </div></div></div></div><div class="qandaentry"><div class="question" id="id2898287"><label>Q:</label><div class="data"><div class="para">
+ </div></div></div></div><div class="qandaentry"><div class="question" id="id2953893"><label>Q:</label><div class="data"><div class="para">
What are file contexts?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
<em class="firstterm">File contexts</em> are used by the <code class="command">setfiles</code> command to generate persistent labels which describe the security context for a file or directory.
</div><div class="para">
Fedora ships with the <code class="command">fixfiles</code> script, which supports three options: <code class="option">check</code>, <code class="option">restore</code>, and <code class="option">relabel</code>. This script allows users to relabel the file system without having the <code class="filename">selinux-policy-targeted-sources</code> package installed. The command line usage is more friendly than the standard <code class="command">setfiles</code> command.
- </div></div></div></div><div class="qandaentry"><div class="question" id="id2916596"><label>Q:</label><div class="data"><div class="para">
+ </div></div></div></div><div class="qandaentry"><div class="question" id="id2953953"><label>Q:</label><div class="data"><div class="para">
How do I view the security context of a file, user, or process?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
The new option <code class="option">-Z</code> is the short method for displaying the context of a subject or object:
</div><pre class="screen">
-<code class="command">ls -alZ <em class="replaceable"><code>file.foo</code></em> id -Z ps -eZ</code>
-</pre></div></div></div><div class="qandaentry"><div class="question" id="id2916634"><label>Q:</label><div class="data"><div class="para">
+<code class="command">ls -alZ <em class="replaceable"><code>file.foo</code></em> </code>
+<code class="computeroutput">id -Z</code>
+<code class="computeroutput">ps -eZ</code>
+</pre></div></div></div><div class="qandaentry"><div class="question" id="id3078024"><label>Q:</label><div class="data"><div class="para">
What is the difference between a <em class="firstterm">domain</em> and a <em class="firstterm">type</em>?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
There is no difference between a domain and a type, although domain is sometimes used to refer to the type of a process. The use of domain in this way stems from Domain and Type Enforcement (DTE) models, where domains and types are separate.
</div></div></div></div><div class="qandaentry"><div class="question" id="faq-entry-whatare-policy-modules"><label>Q:</label><div class="data"><div class="para">
What are policy modules?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
- Prior to Fedora 5, SELinux policies were monolithic, meaning making a change required getting the entire policy source, modifying it, compiling it, and replacing the current policy with it. With Fedora 5, the policy is now modular. This means that third party developers can ship policy modules with their applications, and then they can be added to the policy without having to switch out the entire policy. The new module is then added to the module store, which results in a new policy binary that is a combination of the previous policy and the new module.
+ SELinux policies are modular, meaning making a change does not require getting entire policy source, modifying it, compiling it, and replacing the current policy with it. This means that third party developers can ship policy modules with their applications, and then they can be added to the policy without having to switch out the entire policy. The new module is then added to the module store, which results in a new policy binary that is a combination of the previous policy and the new module.
</div><div class="para">
This actually works by separating out compile and link steps in the policy build procedure. Policy modules are compiled from source, and linked when installed into the module store (see <a class="xref" href="#faq-entry-whatis-managed-policy" title="Q:">Managed Policy</a>). This linked policy is then loaded into the kernel for enforcement.
</div><div class="para">
@@ -245,53 +250,53 @@
</div></div></div></div><div class="qandaentry"><div class="question" id="faq-entry-whatis-managed-policy"><label>Q:</label><div class="data"><div class="para">
What is managed policy?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
- Prior to Fedora 5, SELinux policies were handled as user-editable config files in etc. Unfortunately, this made it difficult to address many of the usability issues arising with SELinux. So, a new library, <code class="filename">libsemanage</code>, was added to provide userspace tools an interface to making policy management easier. All policy management should use this library to access the policy store. The policy store holds all the policy information, and is found at <code class="filename">/etc/selinux/<em class="replaceable"><code>policyname</code></em>/modules/</code>.
+ A library, <code class="filename">libsemanage</code>, exists to provide userspace tools an interface to making policy management easier. All policy management should use this library to access the policy store. The policy store holds all the policy information, and is found at <code class="filename">/etc/selinux/<em class="replaceable"><code>policyname</code></em>/modules/</code>.
</div><div class="para">
You should never have to edit the store directly. Instead, you should use tools that link against libsemanage. One example tool is <code class="command">semanage</code>, which is a command line tool for managing much of the policy such as SELinux user mappings, SELinux port mappings, and file contexts entries. Other examples of tools that use libsemanage include <code class="command">semodule</code> which uses it to manage the SELinux policy modules installed to the policy store and <code class="command">setsebool</code> which uses it manage SELinux policy booleans. Additionally, graphical tools are currently being developed to utilize the functionality provided by libsemanage.
- </div></div></div></div></div><div class="qandadiv"><h4 class="title" id="id2929042">1.2. Controlling SELinux</h4></div><div class="toc"><dl><dt>Q: <a href="#id2929048">
+ </div></div></div></div></div><div class="qandadiv"><h4 class="title" id="id3016692">1.2. Controlling SELinux</h4></div><div class="toc"><dl><dt>Q: <a href="#id3016698">
How do I install/not install SELinux?
- </a></dt><dt>Q: <a href="#id2929075">
+ </a></dt><dt>Q: <a href="#id3016724">
As an administrator, what do I need to do to configure SELinux for my system?
</a></dt><dt>Q: <a href="#qa-using-s-c-securitylevel">
How do I enable/disable SELinux protection on specific daemons under the targeted policy?
</a></dt><dt>Q: <a href="#faq-entry-local.te">
- In the past I have written local.te file in policy sources for my own local customization to policy, how do I do this in Fedora 5?
- </a></dt><dt>Q: <a href="#id2929497">
+ In the past I have written local.te file in policy sources for my own local customization to policy, how do I do this now?
+ </a></dt><dt>Q: <a href="#id3017163">
I have some avc denials that I would like to allow, how do I do this?
- </a></dt><dt>Q: <a href="#id2929670">
+ </a></dt><dt>Q: <a href="#id2993909">
How can I help write policy?
- </a></dt><dt>Q: <a href="#id3069707">
+ </a></dt><dt>Q: <a href="#id2994188">
How do I switch the policy I am currently using?
- </a></dt><dt>Q: <a href="#id3069893">
+ </a></dt><dt>Q: <a href="#id2994374">
How can I back up files from an SELinux file system?
</a></dt><dt>Q: <a href="#faq-entry-public_html">
How do I make a user public_html directory work under SELinux?
- </a></dt><dt>Q: <a href="#id3070107">
+ </a></dt><dt>Q: <a href="#id2994596">
How do I turn SELinux off at boot?
- </a></dt><dt>Q: <a href="#id3070170">
+ </a></dt><dt>Q: <a href="#id2994660">
How do I turn enforcing on/off at boot?
- </a></dt><dt>Q: <a href="#id3070271">
+ </a></dt><dt>Q: <a href="#id2994760">
How do I temporarily turn off enforcing mode without having to reboot?
- </a></dt><dt>Q: <a href="#id3070304">
+ </a></dt><dt>Q: <a href="#id2994793">
How do I turn system call auditing on/off at boot?
- </a></dt><dt>Q: <a href="#id3070350">
+ </a></dt><dt>Q: <a href="#id2994839">
How do I temporarily turn off system-call auditing without having to reboot?
- </a></dt><dt>Q: <a href="#id3070377">
+ </a></dt><dt>Q: <a href="#id2994866">
How do I get status info about my SELinux installation?
- </a></dt><dt>Q: <a href="#id3070407">
+ </a></dt><dt>Q: <a href="#id2994896">
How do I write policy to allow a domain to use pam_unix.so?
- </a></dt><dt>Q: <a href="#id3070489">
+ </a></dt><dt>Q: <a href="#id2994979">
I created a new Policy Package, where do I put it to make sure that it gets loaded into the kernel?
- </a></dt></dl></div><div class="qandadiv"><div class="qandaentry"><div class="question" id="id2929048"><label>Q:</label><div class="data"><div class="para">
+ </a></dt></dl></div><div class="qandadiv"><div class="qandaentry"><div class="question" id="id3016698"><label>Q:</label><div class="data"><div class="para">
How do I install/not install SELinux?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
The installer follows the choice you make in the <span class="guilabel"><strong>Firewall Configuration</strong></span> screen. The default running policy is the targeted policy, and it is on by default.
- </div></div></div></div><div class="qandaentry"><div class="question" id="id2929075"><label>Q:</label><div class="data"><div class="para">
+ </div></div></div></div><div class="qandaentry"><div class="question" id="id3016724"><label>Q:</label><div class="data"><div class="para">
As an administrator, what do I need to do to configure SELinux for my system?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
- The answer might be nothing. There are many Fedora users that don't even realize that they are using SELinux. SELinux provides protection for their systems with an out-of-the-box configuration. That said, there are a couple of things an administrator might want to do to configure their system. These include:
+ The answer might be nothing! There are many Fedora users that don't even realize that they are using SELinux. SELinux provides protection for their systems with an out-of-the-box configuration. That said, there are a couple of things an administrator might want to do to configure their system. These include:
</div><div class="variablelist"><dl><dt><span class="term">booleans</span></dt><dd><div class="para">
- Booleans are settings that can be flipped to alter SELinux policy behavior without having to write new policy. There are many booleans that can be set in Fedora, and they allow an administrator to configure SELinux to a great degree. To view the available booleans and modify their settings, use <code class="command">system-config-selinux</code> or the command line tool <code class="command">setsebool</code>.
+ Booleans are runtime settings that can be toggled to alter SELinux policy behavior without having to write new policy. There are many Booleans that can be set in Fedora, and they allow an administrator to configure SELinux in very fine detail depending on requirements. To view the available booleans and modify their settings, use <code class="command">system-config-selinux</code> or the command line tools <code class="command">getsebool</code> and <code class="command">setsebool</code>.
</div></dd><dt><span class="term">setting customizable file contexts</span></dt><dd><div class="para">
Files on an SELinux system have a security context which is stored in the extended attribute of the file (behavior can vary from filesystem to filesystem, but this is how ext3 works). These are set by <code class="command">rpm</code> automatically, but sometimes a user might want to set a particular context on a file. An example would be setting the context on a <code class="filename">public_html</code> directory so that <code class="command">apache</code> can access it, as illustrated in <a class="xref" href="#faq-entry-public_html" title="Q:">How do I make a user public_html directory work under SELinux</a>.
</div><div class="para">
@@ -303,13 +308,14 @@
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
Use <code class="command">system-config-selinux</code>, also known as the <span class="application"><strong>Security Level Configuration</strong></span> graphical tool, to control the Boolean values of specific daemons. For example, if you need to disable SELinux for Apache to run correctly in your environment, you can disable the value in <code class="command">system-config-selinux</code>. This change disables the transition to the policy defined in <code class="filename">apache.te</code>, allowing <code class="command">httpd</code> to remain under regular Linux DAC security.
</div></div></div></div><div class="qandaentry"><div class="question" id="faq-entry-local.te"><label>Q:</label><div class="data"><div class="para">
- In the past I have written local.te file in policy sources for my own local customization to policy, how do I do this in Fedora 5?
+ In the past I have written local.te file in policy sources for my own local customization to policy, how do I do this now?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
- Since Fedora 5 uses a modular policy, you don't have to have the complete policy source any more. Now, you can just create a local policy module for your local policy customizations. To do this, follow these steps.
+ Since Fedora 5, a modular policy is used, so you don't have to have the complete policy source any more. Now, you can just create a local policy module for your local policy customizations. To do this, follow these steps.
</div><div class="procedure"><ol class="1"><li class="step" title="Step 1"><div class="para">
Create a temporary directory, and change into it.
</div><pre class="screen">
-<code class="computeroutput">$ mkdir foo $ cd foo</code>
+<code class="computeroutput">$ mkdir foo</code>
+<code class="computeroutput">$ cd foo</code>
</pre></li><li class="step" title="Step 2"><div class="para">
Create empty te, if, and fc files.
</div><pre class="screen">
@@ -349,10 +355,12 @@
</div></li><li class="step" title="Step 5"><div class="para">
Become root, and install the policy module with <code class="command">semodule</code>.
</div><pre class="screen">
-<code class="computeroutput">$ su Password: # semodule -i local.pp</code>
+<code class="computeroutput">$ su -</code>
+<code class="computeroutput">Password:</code>
+<code class="computeroutput"># semodule -i local.pp</code>
</pre></li></ol></div><div class="note"><h2>Module are uniquely identified by name</h2><div class="para">
This means that if you later insert another <code class="filename">local.pp</code>, it will replace the one you just loaded. So, you should keep this <code class="filename">local.te</code> around, and just add to it if you need to make later policy customizations. If you lose it, but want to keep your previous policy around, just call the new local policy module something else (say local2.te).
- </div></div></div></div></div><div class="qandaentry"><div class="question" id="id2929497"><label>Q:</label><div class="data"><div class="para">
+ </div></div></div></div></div><div class="qandaentry"><div class="question" id="id3017163"><label>Q:</label><div class="data"><div class="para">
I have some avc denials that I would like to allow, how do I do this?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
If you have specific AVC messages you can use <code class="command">audit2allow</code> to generate a Type Enforcement file that is ready to load as a policy module.
@@ -387,18 +395,18 @@
In order to load this newly created policy package into the kernel, you are required to execute <code class="command">semodule -i local.pp</code>
</div><div class="para">
Note that if you later install another module called local, it will replace this module. If you want to keep these rules around, then you either need to append future customizations to this local.te, or give future customizations a different name.
- </div></div></div></div></div><div class="qandaentry"><div class="question" id="id2929670"><label>Q:</label><div class="data"><div class="para">
+ </div></div></div></div></div><div class="qandaentry"><div class="question" id="id2993909"><label>Q:</label><div class="data"><div class="para">
How can I help write policy?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
Your help is definitely appreciated.
</div><div class="itemizedlist"><ul><li class="listitem"><div class="para">
You can start by joining the Fedora SELinux mailing list. You can subscribe and read the archives at <a href="http://www.redhat.com/mailman/listinfo/fedora-selinux-list">http://www.redhat.com/mailman/listinfo/fedora-selinux-list</a>.
</div></li><li class="listitem"><div class="para">
- The Unofficial FAQ has some generic policy writing HOWTO information. Refer to <a href="http://sourceforge.net/docman/display_doc.php?docid=14882&group_id=21...">http://sourceforge.net/docman/display_doc.php?docid=14882&group_id=21...</a> for more information.
+ The Unofficial FAQ has some generic policy writing HOWTO information. Refer to <a href="http://www.crypt.gen.nz/selinux/faq.html">http://www.crypt.gen.nz/selinux/faq.html</a> for more information.
</div></li><li class="listitem"><div class="para">
- Another new resource is the Writing SE Linux policy HOWTO, located online at <a href="https://sourceforge.net/docman/display_doc.php?docid=21959&group_id=2...">https://sourceforge.net/docman/display_doc.php?docid=21959&group_id=2...</a>.
+ Another resource is the Writing SE Linux policy HOWTO, located online at <a href="http://www.lurking-grue.org/writingselinuxpolicyHOWTO.html">http://www.lurking-grue.org/writingselinuxpolicyHOWTO.html</a>.
</div></li></ul></div><div class="para">
- Also, since the Fedora policy is based on the <a class="xref" href="#faq-entry-whatis-refpolicy" title="Q:">Reference Policy</a>, you should look at the documentation on its project page. Another excellent source of information is the example policy files in <code class="filename">/usr/share/doc/selinux-policy-<em class="replaceable"><code>>version<</code></em></code> and <code class="filename">/usr/share/selinux/devel</code>.
+ Also, since the Fedora policy is based on the <a class="xref" href="#faq-entry-whatis-refpolicy" title="Q:">Reference Policy</a>, you should look at the documentation on its project page. Another excellent source of information is the example policy files in <code class="filename">/usr/share/selinux/devel</code>.
</div><div class="para">
If you want to create a new policy domain, you can look at the interface files in the <code class="filename">/usr/share/selinux/devel</code> sub-directories. There is also a tool there to help you get started. The following procedure is an example:
</div><div class="procedure"><ol class="1"><li class="step" title="Step 1"><div class="para">
@@ -423,7 +431,7 @@
<code class="command">service <em class="replaceable"><code>mydaemon</code></em> restart</code>
</pre></li></ol></div><div class="para">
Now you can collect avc messages. You can use <code class="command">audit2allow</code> to translate the avc messages to allow rules and begin updating your <code class="filename">mydaemon.te</code> file. You should search for interface macros in the <code class="filename">/usr/share/selinux/devel/include</code> directory and use these instead of using the allow rules directly, whenever possible. <code class="command">audit2allow -R</code> will attempt to find interfaces that match the allow rule. If you want more examples of policy, you could always install the selinux-policy src rpm, which contains all of the policy te files for the reference policy.
- </div></div></div></div><div class="qandaentry"><div class="question" id="id3069707"><label>Q:</label><div class="data"><div class="para">
+ </div></div></div></div><div class="qandaentry"><div class="question" id="id2994188"><label>Q:</label><div class="data"><div class="para">
How do I switch the policy I am currently using?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="caution"><h2>Use caution when switching policy</h2><div class="para">
Other than trying out a new policy on a test machine for research purposes, you should seriously consider your situation before switching to a different policy on a production system. The act of switching is straightforward. This method is fairly safe, but you should try it first on a test system.
@@ -451,18 +459,20 @@
With the new system running in <code class="computeroutput">permissive</code> mode, check <code class="filename">/var/log/messages</code> for <code class="computeroutput">avc: denied</code> messages. These may indicate a problem that needs to be solved for the system to run without trouble under the new policy.
</div></li><li class="step" title="Step 5"><div class="para">
When you are satisfied that the system runs stable under the new policy, enable enforcing by changing <code class="computeroutput">SELINUX=enforcing</code>. You can either reboot or run <code class="command">setenforce 1</code> to turn enforcing on in real time.
- </div></li></ol></div></div></div></div><div class="qandaentry"><div class="question" id="id3069893"><label>Q:</label><div class="data"><div class="para">
+ </div></li></ol></div></div></div></div><div class="qandaentry"><div class="question" id="id2994374"><label>Q:</label><div class="data"><div class="para">
How can I back up files from an SELinux file system?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
- You can now use the <code class="command">tar</code> command, you do not need to use <code class="command">star</code>.
+ You can now use the <code class="command">tar</code> command as normal, you no longer need to use <code class="command">star</code>.
</div></div></div></div><div class="qandaentry"><div class="question" id="faq-entry-public_html"><label>Q:</label><div class="data"><div class="para">
How do I make a user <code class="filename">public_html</code> directory work under SELinux?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
- This process presumes that you have enabled user public HTML directories in your Apache configuration file, <code class="filename">/etc/httpd/conf/httpd.conf</code>. This process only covers serving static Web content. For more information about Apache; and SELinux, refer to <a href="http://fedora.redhat.com/docs/selinux-apache-fc3/">http://fedora.redhat.com/docs/selinux-apache-fc3/</a>.
+ This process presumes that you have enabled user public HTML directories in your Apache configuration file, <code class="filename">/etc/httpd/conf/httpd.conf</code>. This process only covers serving static Web content. For more information about Apache; and SELinux, refer to the SELinux Managing Confined Services Guide at <a href="http://docs.fedoraproject.org">http://docs.fedoraproject.org</a>.
</div><div class="procedure"><ol class="1"><li class="step" title="Step 1"><div class="para">
If you do not already have a <code class="filename">~/public_html</code> directory, create it and populate it with the files and folders to be served.
</div><pre class="screen">
-<strong class="userinput"><code>cd ~ mkdir public_html cp /path/to/content ~/public_html</code></strong>
+<strong class="userinput"><code>cd ~</code></strong>
+<strong class="userinput"><code>mkdir public_html</code></strong>
+<strong class="userinput"><code>cp /path/to/content ~/public_html</code></strong>
</pre></li><li class="step" title="Step 2"><div class="para">
At this point, <code class="command">httpd</code> is configured to serve the contents, but you still receive a <code class="computeroutput">403 forbidden</code> error. This is because <code class="command">httpd</code> is not allowed to read the security type for the directory and files as they are created in the user's home directory. Change the security context of the folder and its contents recursively using the <code class="option">-R</code> option:
</div><pre class="screen">
@@ -478,7 +488,7 @@
You may notice at a later date that the user field, set here to <code class="computeroutput">user_u</code>, is changed to <code class="computeroutput">system_u</code>. This does not affect how the targeted policy works. The field that matters is the type field.
</div></li><li class="step" title="Step 3"><div class="para">
Your static webpages should now be served correctly. If you continue to have errors, ensure that the Boolean which enables user home directories is enabled. You can set it using <code class="command">system-config-selinux</code>. Select the <span class="guilabel"><strong>SELinux</strong></span> tab, and then select the <span class="guilabel"><strong>Modify SELinux Policy</strong></span> area. Select <code class="computeroutput">Allow HTTPD to read home directories</code>. The changes take effect immediately.
- </div></li></ol></div></div></div></div><div class="qandaentry"><div class="question" id="id3070107"><label>Q:</label><div class="data"><div class="para">
+ </div></li></ol></div></div></div></div><div class="qandaentry"><div class="question" id="id2994596"><label>Q:</label><div class="data"><div class="para">
How do I turn SELinux off at boot?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
Set <code class="computeroutput">SELINUX=disabled</code> in <code class="filename">/etc/selinux/config</code>.
@@ -486,7 +496,7 @@
Alternatively, you can add <code class="option">selinux=0</code> to your kernel boot parameters. However, this option is not recommended.
</div><div class="caution"><h2>Be careful when disabling SELinux</h2><div class="para">
If you boot with <code class="option">selinux=0</code>, any files you create while SELinux is disabled do not have SELinux context information. The file system is marked for relabeling at the next boot. If an unforeseen problem prevents you from rebooting normally, you may need to boot in single-user mode for recovery. Add the option <code class="option">emergency</code> to your kernel boot parameters.
- </div></div></div></div></div><div class="qandaentry"><div class="question" id="id3070170"><label>Q:</label><div class="data"><div class="para">
+ </div></div></div></div></div><div class="qandaentry"><div class="question" id="id2994660"><label>Q:</label><div class="data"><div class="para">
How do I turn enforcing on/off at boot?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
You can specify the SELinux mode using the configuration file <code class="filename">/etc/sysconfig/selinux</code>.
@@ -507,25 +517,25 @@
However, setting the value to <code class="computeroutput">disabled</code> is not the same as the <code class="option">selinux=0</code> kernel boot parameter. Rather than fully disabling SELinux in the kernel, the <code class="computeroutput">disabled</code> setting instead turns enforcing off and skips loading a policy.
</div><div class="important"><h2>SELinux Configuration Precedence</h2><div class="para">
The command line kernel parameter overrides the configuration file.
- </div></div></div></div></div><div class="qandaentry"><div class="question" id="id3070271"><label>Q:</label><div class="data"><div class="para">
+ </div></div></div></div></div><div class="qandaentry"><div class="question" id="id2994760"><label>Q:</label><div class="data"><div class="para">
How do I temporarily turn off enforcing mode without having to reboot?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
Occasionally you may need to perform an action that is normally prevented by policy. Run the command <code class="command">setenforce 0</code> to turn off enforcing mode in real time. When you are finished, run <code class="command">setenforce 1</code> to turn enforcing back on.
- </div></div></div></div><div class="qandaentry"><div class="question" id="id3070304"><label>Q:</label><div class="data"><div class="para">
+ </div></div></div></div><div class="qandaentry"><div class="question" id="id2994793"><label>Q:</label><div class="data"><div class="para">
How do I turn system call auditing on/off at boot?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
Add <code class="option">audit=1</code> to your kernel command line to turn system call auditing on. Add <code class="option">audit=0</code> to your kernel command line to turn system call auditing off.
</div><div class="para">
System-call auditing is <span class="emphasis"><em>on</em></span> by default. When on, it provides information about the system call that was executing when SELinux generated a <code class="computeroutput">denied</code> message. The error message is helpful when debugging policy.
- </div></div></div></div><div class="qandaentry"><div class="question" id="id3070350"><label>Q:</label><div class="data"><div class="para">
+ </div></div></div></div><div class="qandaentry"><div class="question" id="id2994839"><label>Q:</label><div class="data"><div class="para">
How do I temporarily turn off system-call auditing without having to reboot?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
Run <code class="command">auditctl -e 0</code>. Note that this command does not affect auditing of SELinux AVC denials.
- </div></div></div></div><div class="qandaentry"><div class="question" id="id3070377"><label>Q:</label><div class="data"><div class="para">
+ </div></div></div></div><div class="qandaentry"><div class="question" id="id2994866"><label>Q:</label><div class="data"><div class="para">
How do I get status info about my SELinux installation?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
As root, execute the command <code class="command">/usr/sbin/sestatus -v</code>. For more information, refer to the <code class="filename">sestatus(8)</code> manual page.
- </div></div></div></div><div class="qandaentry"><div class="question" id="id3070407"><label>Q:</label><div class="data"><div class="para">
+ </div></div></div></div><div class="qandaentry"><div class="question" id="id2994896"><label>Q:</label><div class="data"><div class="para">
How do I write policy to allow a domain to use pam_unix.so?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
Very few domains in the SELinux world are allowed to read the <code class="filename">/etc/shadow</code> file. There are constraint rules that prevent policy writers from writing code like
@@ -538,10 +548,10 @@
</pre><div class="para">
This would create a context where vsftpd_t -> chkpwd_exec_t -> system_chkpwd_t which can read <code class="filename">/etc/shadow</code>, while vsftpd_t is not able to read it.
</div><div class="para">
- In Fedora /RHEL5, add the rule
+ In Fedora and Red Hat Enterprise Linux 5 and above, add the rule
</div><pre class="screen">
<code class="command">auth_domtrans_chk_passwd(vsftpd_t)</code>
-</pre></div></div></div><div class="qandaentry"><div class="question" id="id3070489"><label>Q:</label><div class="data"><div class="para">
+</pre></div></div></div><div class="qandaentry"><div class="question" id="id2994979"><label>Q:</label><div class="data"><div class="para">
I created a new Policy Package, where do I put it to make sure that it gets loaded into the kernel?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
You need to execute the command <code class="command">semodule -i myapp.pp</code>. This modifies the policy that is stored on the machine. Your policy module now is loaded with the rest of the policy. You can even remove the pp file from the system.
@@ -551,61 +561,61 @@
<code class="computeroutput">#semodule -i myapp 1.2.1</code>
</pre><div class="para">
If you later would like to remove the policy package, you can execute <code class="command">semodule -r myapp</code>.
- </div></div></div></div></div><div class="qandadiv"><h4 class="title" id="faq-div-resolving-problems">1.3. Resolving Problems</h4></div><div class="toc"><dl><dt>Q: <a href="#id3070551">
+ </div></div></div></div></div><div class="qandadiv"><h4 class="title" id="faq-div-resolving-problems">1.3. Resolving Problems</h4></div><div class="toc"><dl><dt>Q: <a href="#id2995041">
Where are SELinux AVC messages (denial logs, etc.) stored?
- </a></dt><dt>Q: <a href="#id3070593">
+ </a></dt><dt>Q: <a href="#id2995078">
My application isn't working as expected and I am seeing avc: denied messages. How do I fix this?
- </a></dt><dt>Q: <a href="#id3070681">
+ </a></dt><dt>Q: <a href="#id2995166">
I installed Fedora on a system with an existing /home partition, and now I can't log in.
- </a></dt><dt>Q: <a href="#id3070768">
+ </a></dt><dt>Q: <a href="#id2995253">
After relabeling my /home using setfiles or fixfiles, am I still be able to read /home with a non-SELinux-enabled system?
- </a></dt><dt>Q: <a href="#id3070818">
+ </a></dt><dt>Q: <a href="#id2995304">
How do I share directories using NFS between Fedora and non-SELinux systems?
- </a></dt><dt>Q: <a href="#id3070880">
- How can I create a new Linux user account with the user's home
- </a></dt><dt>Q: <a href="#id3070962">
+ </a></dt><dt>Q: <a href="#id2995365">
+ How can I create a new Linux user account with the user's home?
+ </a></dt><dt>Q: <a href="#id2995455">
Does the su command change my SELinux identity and role?
- </a></dt><dt>Q: <a href="#id3071028">
+ </a></dt><dt>Q: <a href="#id2995522">
I'm having troubles with avc errors filling my logs for a particular program. How do I choose not to audit the access for it?
- </a></dt><dt>Q: <a href="#id3071089">
+ </a></dt><dt>Q: <a href="#id2995582">
Even running in permissive mode, I'm getting a large number of avc denied messages.
- </a></dt><dt>Q: <a href="#id3071133">
+ </a></dt><dt>Q: <a href="#id2995626">
I get a specific permission denial only when SELinux is in enforcing mode, but I don't see any audit messages in /var/log/messages (or /var/log/audit/audit.log if using the audit daemon). How can I identify the cause of these silent denials?
- </a></dt><dt>Q: <a href="#id3071241">
+ </a></dt><dt>Q: <a href="#id2995734">
Why do I not see the output when I run certain daemons in debug or interactive mode?
- </a></dt><dt>Q: <a href="#id3071332">
+ </a></dt><dt>Q: <a href="#id2995825">
When I do an upgrade of the policy package (for example, using yum), what happens with the policy? Is it updated automatically?
- </a></dt><dt>Q: <a href="#id3071420">
+ </a></dt><dt>Q: <a href="#id2995914">
If the policy shipping with an application package changes in a way that requires relabeling, will RPM handle relabeling the files owned by the package?
- </a></dt><dt>Q: <a href="#id3071498">
+ </a></dt><dt>Q: <a href="#id2995992">
Why do binary policies distributed with Fedora, such as /etc/selinux/<policyname>/policy/policy.<version>, and those I compile myself have different sizes and MD5 checksums?
- </a></dt><dt>Q: <a href="#id3071561">
+ </a></dt><dt>Q: <a href="#id2996054">
Will new policy packages disable my system?
- </a></dt><dt>Q: <a href="#id3071597">
+ </a></dt><dt>Q: <a href="#id2996090">
My console is being flooded with messages. How do I turn them off?
- </a></dt><dt>Q: <a href="#id3071628">
+ </a></dt><dt>Q: <a href="#id2996121">
Can I test the default policy without installing the policy source?
- </a></dt><dt>Q: <a href="#id3071712">
+ </a></dt><dt>Q: <a href="#id2996205">
Why are some of my KDE applications having trouble under SELinux?
- </a></dt><dt>Q: <a href="#id3071784">
+ </a></dt><dt>Q: <a href="#id2996277">
Why does SELINUX=disabled not work for me?
</a></dt><dt>Q: <a href="#faq-entry-unconfined_t">
I have a process running as unconfined_t, and SELinux is still preventing my application from running.
- </a></dt><dt>Q: <a href="#id3071992">
+ </a></dt><dt>Q: <a href="#id3029652">
What do these rpm errors mean?
- </a></dt><dt>Q: <a href="#id3072060">
+ </a></dt><dt>Q: <a href="#id3029720">
I want to run a daemon on a non standard port but SELinux will not allow me. How do get this to work?
- </a></dt><dt>Q: <a href="#id3072095">
- I am writing a php script that needs to create files and possibly execute them. SELinux policy is preventing this. What should I do?
- </a></dt><dt>Q: <a href="#id3072149">
+ </a></dt><dt>Q: <a href="#id3029755">
+ I am writing a PHP script that needs to create files and possibly execute them. SELinux policy is preventing this. What should I do?
+ </a></dt><dt>Q: <a href="#id3029810">
I am setting up swapping to a file, but I am seeing AVC messages in my log files?
- </a></dt><dt>Q: <a href="#id3072186">
+ </a></dt><dt>Q: <a href="#id3029847">
Please explain the relabelto/relabelfrom permissions?
- </a></dt></dl></div><div class="qandadiv"><div class="qandaentry"><div class="question" id="id3070551"><label>Q:</label><div class="data"><div class="para">
+ </a></dt></dl></div><div class="qandadiv"><div class="qandaentry"><div class="question" id="id2995041"><label>Q:</label><div class="data"><div class="para">
Where are SELinux AVC messages (denial logs, etc.) stored?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
- In Fedora 2 and 3, SELinux AVC messages could be found in <code class="filename">/var/log/messages</code>. In Fedora 4, the audit daemon was added, and these messages moved to <code class="filename">/var/log/audit/audit.log</code>. In Fedora 5, the audit daemon is not installed by default, and consequently these messages can be found in <code class="filename">/var/log/messages</code> unless you choose to install and enable the audit daemon, in which case AVC messages will be in <code class="filename">/var/log/audit/audit.log</code>.
- </div></div></div></div><div class="qandaentry"><div class="question" id="id3070593"><label>Q:</label><div class="data"><div class="para">
+ Messages can be found in <code class="filename">/var/log/messages</code> unless you choose to install and enable the <code class="systemitem">audit</code> daemon, in which case AVC messages will be in <code class="filename">/var/log/audit/audit.log</code>.
+ </div></div></div></div><div class="qandaentry"><div class="question" id="id2995078"><label>Q:</label><div class="data"><div class="para">
My application isn't working as expected and I am seeing <code class="computeroutput">avc: denied</code> messages. How do I fix this?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
This message means that the current SELinux policy is not allowing the application to do something. There are a number of reasons this could happen.
@@ -615,7 +625,7 @@
Denials are sometimes due to a configuration change in the program that triggered the denial message. For example, if you change Apache to also listen on port 8800, you must also change the security policy, <code class="filename">apache.te</code>.
</div><div class="para">
If you are having trouble getting a specific application like Apache to work, refer to <a class="xref" href="#qa-using-s-c-securitylevel" title="Q:">How to use system-config-selinux</a> for information on disabling enforcement just for that application.
- </div></div></div></div><div class="qandaentry"><div class="question" id="id3070681"><label>Q:</label><div class="data"><div class="para">
+ </div></div></div></div><div class="qandaentry"><div class="question" id="id2995166"><label>Q:</label><div class="data"><div class="para">
I installed Fedora on a system with an existing <code class="filename">/home</code> partition, and now I can't log in.
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
Your <code class="filename">/home</code> partition is not labeled correctly. You can easily fix this two different ways.
@@ -629,11 +639,11 @@
<code class="command">/sbin/fixfiles relabel</code>
</pre><div class="para">
You must have the <code class="filename">policycoreutils</code> package installed to use <code class="command">fixfiles</code>.
- </div></div></div></div><div class="qandaentry"><div class="question" id="id3070768"><label>Q:</label><div class="data"><div class="para">
+ </div></div></div></div><div class="qandaentry"><div class="question" id="id2995253"><label>Q:</label><div class="data"><div class="para">
After relabeling my <code class="filename">/home</code> using <code class="command">setfiles</code> or <code class="command">fixfiles</code>, am I still be able to read <code class="filename">/home</code> with a non-SELinux-enabled system?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
You can read the files from a non-SELinux distribution, or one with SELinux disabled. However, files created by a system not using SELinux systems do not have a security context, nor do any files you remove and recreate. This could be a challenge with files such as <code class="filename">~/.bashrc</code>. You may have to relabel <code class="filename">/home</code> when you reboot the SELinux enabled Fedora system.
- </div></div></div></div><div class="qandaentry"><div class="question" id="id3070818"><label>Q:</label><div class="data"><div class="para">
+ </div></div></div></div><div class="qandaentry"><div class="question" id="id2995304"><label>Q:</label><div class="data"><div class="para">
How do I share directories using NFS between Fedora and non-SELinux systems?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
Just as NFS transparently supports many file system types, it can be used to share directories between SELinux and non-SELinux systems.
@@ -643,26 +653,28 @@
<code class="command">mount -t nfs -o context=system_u:object_r:tmp_t server:/shared/foo /mnt/foo</code>
</pre><div class="para">
When SELinux exports a file system via NFS, newly created files have the context of the directory they were created in. In other words, the presence of SELinux on the remote mounting system has no effect on the local security contexts.
- </div></div></div></div><div class="qandaentry"><div class="question" id="id3070880"><label>Q:</label><div class="data"><div class="para">
- How can I create a new Linux user account with the user's home
+ </div></div></div></div><div class="qandaentry"><div class="question" id="id2995365"><label>Q:</label><div class="data"><div class="para">
+ How can I create a new Linux user account with the user's home?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
You can create your new user with the standard <code class="command">useradd</code> command. First you must become <code class="systemitem">root</code>.
</div><div class="para">
For the targeted policy:
</div><pre class="screen">
-<strong class="userinput"><code>su - root id -Z</code></strong>
+<strong class="userinput"><code>su - root</code></strong>
+<strong class="userinput"><code>id -Z</code></strong>
<code class="computeroutput">root:system_r:unconfined_t</code>
-<strong class="userinput"><code>useradd auser ls -Z /home</code></strong>
+<strong class="userinput"><code>useradd auser</code></strong>
+<strong class="userinput"><code>ls -Z /home</code></strong>
<code class="computeroutput">drwx------ auser auser root:object_r:user_home_dir_t /home/auser</code>
</pre><div class="para">
The initial context for a new user directory has an identity of <code class="computeroutput">root</code>. Subsequent relabeling of the file system changes the identity to <code class="computeroutput">system_u</code>. These are functionally the same since the role and type are identical (<code class="computeroutput">object_r:user_home_dir_t</code>.)
- </div></div></div></div><div class="qandaentry"><div class="question" id="id3070962"><label>Q:</label><div class="data"><div class="para">
+ </div></div></div></div><div class="qandaentry"><div class="question" id="id2995455"><label>Q:</label><div class="data"><div class="para">
Does the <code class="command">su</code> command change my SELinux identity and role?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
- In previous versions of Fedora, security context transitions were integrated into the <code class="command">su</code> via <code class="computeroutput">pam_selinux</code>. This turned out to be more trouble than it was worth, and is quite unnecessary on a system running targeted policy. So, this is no longer the case. Now, <code class="command">su</code>/<code class="command">sudo</code> only change the Linux identy. You will need to use <code class="command">newrole</code> to change the SELinux identity, role, or level.
+ In older versions of Fedora, security context transitions were integrated into the <code class="command">su</code> via <code class="computeroutput">pam_selinux</code>. This turned out to be more trouble than it was worth, and is quite unnecessary on a system running targeted policy. So, this is no longer the case. Now, <code class="command">su</code>/<code class="command">sudo</code> only change the Linux identity. You will need to use <code class="command">newrole</code> to change the SELinux identity, role, or level.
</div><div class="para">
Other forms of Linux/<span class="trademark">UNIX</span>® identity change, for example <code class="command">setuid(2)</code>, also do not cause an SELinux identity change.
- </div></div></div></div><div class="qandaentry"><div class="question" id="id3071028"><label>Q:</label><div class="data"><div class="para">
+ </div></div></div></div><div class="qandaentry"><div class="question" id="id2995522"><label>Q:</label><div class="data"><div class="para">
I'm having troubles with <code class="command">avc</code> errors filling my logs for a particular program. How do I choose not to audit the access for it?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
If you wanted to not audit <code class="command">dmesg</code>, for example, you would put this in your <code class="filename">dmesg.te</code> file:
@@ -670,13 +682,13 @@
<strong class="userinput"><code>dontaudit dmesg_t userdomain:fd { use };</code></strong>
</pre><div class="para">
This eliminates the error output to the terminal for all user domains, including <code class="varname">user</code>, <code class="varname">staff</code> and <code class="varname">sysadm</code>.
- </div></div></div></div><div class="qandaentry"><div class="question" id="id3071089"><label>Q:</label><div class="data"><div class="para">
+ </div></div></div></div><div class="qandaentry"><div class="question" id="id2995582"><label>Q:</label><div class="data"><div class="para">
Even running in permissive mode, I'm getting a large number of <code class="computeroutput">avc denied</code> messages.
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
In a non-enforcing mode, you should actually receive <span class="emphasis"><em>more</em></span> messages than in enforcing mode. The kernel logs each access denial as if you were in an enforcing mode. Since you are not restricted by policy enforcement, you can perform more actions, which results in more denials being logged.
</div><div class="para">
If an application running under an enforcing mode is denied access to read a number of files in a directory, it is stopped once at the beginning of the action. In a non-enforcing mode, the application is not stopped from traversing the directory tree, and generates a denial message for each file read in the directory.
- </div></div></div></div><div class="qandaentry"><div class="question" id="id3071133"><label>Q:</label><div class="data"><div class="para">
+ </div></div></div></div><div class="qandaentry"><div class="question" id="id2995626"><label>Q:</label><div class="data"><div class="para">
I get a specific permission denial only when SELinux is in enforcing mode, but I don't see any audit messages in <code class="filename">/var/log/messages</code> (or <code class="filename">/var/log/audit/audit.log</code> if using the audit daemon). How can I identify the cause of these silent denials?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
The most common reason for a silent denial is when the policy contains an explicit <code class="computeroutput">dontaudit</code> rule to suppress audit messages. The <code class="computeroutput">dontaudit</code> rule is often used this way when a benign denial is filling the audit logs.
@@ -692,7 +704,7 @@
Once you have found your problem you can reset to the default mode by executing
</div><pre class="screen">
<code class="command">semodule -b /usr/share/selinux/targeted/base.pp</code>
-</pre></div></div></div><div class="qandaentry"><div class="question" id="id3071241"><label>Q:</label><div class="data"><div class="para">
+</pre></div></div></div><div class="qandaentry"><div class="question" id="id2995734"><label>Q:</label><div class="data"><div class="para">
Why do I not see the output when I run certain daemons in debug or interactive mode?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
SELinux intentionally disables access to the tty devices to stop daemons from communicating back with the controlling terminal. This communication is a potential security hole because such daemons could insert commands into the controlling terminal. A broken or compromised program could use this hole to cause serious problems.
@@ -704,7 +716,7 @@
When debugging a daemon, you may want to turn off the transition of the daemon to its specific domain. You can do this using <code class="command">system-config-selinux</code> or <code class="command">setsebool</code> on the command line.
</div><div class="para">
A final option is to turn off enforcing mode while debugging. Issue the command <code class="command">setenforce 0</code> to turn off enforcing mode, and use the command <code class="command">setenforce 1</code> to re-enable SELinux when you are finished debugging.
- </div></div></div></div><div class="qandaentry"><div class="question" id="id3071332"><label>Q:</label><div class="data"><div class="para">
+ </div></div></div></div><div class="qandaentry"><div class="question" id="id2995825"><label>Q:</label><div class="data"><div class="para">
When I do an upgrade of the policy package (for example, using <code class="command">yum</code>), what happens with the policy? Is it updated automatically?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
Policy reloads itself when the package is updated. This behavior replaces the manual <code class="command">make load</code>.
@@ -720,25 +732,25 @@
Alternately, use the <code class="filename">/.autorelabel</code> mechanism:
</div><pre class="screen">
<code class="command">touch /.autorelabel reboot</code>
-</pre></div></div></div><div class="qandaentry"><div class="question" id="id3071420"><label>Q:</label><div class="data"><div class="para">
+</pre></div></div></div><div class="qandaentry"><div class="question" id="id2995914"><label>Q:</label><div class="data"><div class="para">
If the policy shipping with an application package changes in a way that requires relabeling, will RPM handle relabeling the files owned by the package?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
Yes. The security contexts for the files owned by the package are stored in the header data for the package. The file contexts are set directly after the <code class="command">cpio</code> copy, as the package files are being put on the disk.
- </div></div></div></div><div class="qandaentry"><div class="question" id="id3071498"><label>Q:</label><div class="data"><div class="para">
+ </div></div></div></div><div class="qandaentry"><div class="question" id="id2995992"><label>Q:</label><div class="data"><div class="para">
Why do binary policies distributed with Fedora, such as <code class="filename">/etc/selinux/<em class="replaceable"><code><policyname></code></em>/policy/policy.<em class="replaceable"><code><version></code></em></code>, and those I compile myself have different sizes and MD5 checksums?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
When you install a policy package, pre-compiled binary policy files are put directly into <code class="filename">/etc/selinux</code>. The different build environments will make target files that have different sizes and MD5 checksums.
- </div></div></div></div><div class="qandaentry"><div class="question" id="id3071561"><label>Q:</label><div class="data"><div class="para">
+ </div></div></div></div><div class="qandaentry"><div class="question" id="id2996054"><label>Q:</label><div class="data"><div class="para">
Will new policy packages disable my system?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
There is a possibility that changes in the policy package or in the policy shipping with an application package can cause errors, more denials, or other unknown behaviors. You can discover which package caused the breakage by reverting policy and application packages one at a time. If you don't want to return to the previous package, the older version of the configuration files will be saved with the extension <code class="filename">.rpmsave</code>. Use the mailing lists, bugzilla, and IRC to help you work through your problem. If you are able, write or fix policy to resolve your problem.
- </div></div></div></div><div class="qandaentry"><div class="question" id="id3071597"><label>Q:</label><div class="data"><div class="para">
+ </div></div></div></div><div class="qandaentry"><div class="question" id="id2996090"><label>Q:</label><div class="data"><div class="para">
My console is being flooded with messages. How do I turn them off?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
To regain useful control, turn off kernel messages to the console with this command:
</div><pre class="screen">
<code class="command">dmesg -n 1</code>
-</pre></div></div></div><div class="qandaentry"><div class="question" id="id3071628"><label>Q:</label><div class="data"><div class="para">
+</pre></div></div></div><div class="qandaentry"><div class="question" id="id2996121"><label>Q:</label><div class="data"><div class="para">
Can I test the default policy without installing the policy source?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
You can test SELinux default policy by installing just the <code class="filename">selinux-policy-<em class="replaceable"><code>policyname</code></em></code> and <code class="filename">policycoreutils</code> packages. Without the policy source installed, the <code class="command">fixfiles</code> command automates the file system relabeling.
@@ -746,7 +758,7 @@
The command <code class="command">fixfiles relabel</code> is the equivalent of <code class="command">make relabel</code>. During the relabeling, it will delete all of the files in <code class="filename">/tmp</code>, cleaning up files which may have old file context labels.
</div><div class="para">
Other commands are <code class="command">fixfiles check</code>, which checks for mislabeled files, and <code class="command">fixfiles restore</code>, which fixes the mislabeled files but does not delete the files in <code class="filename">/tmp</code>. The <code class="command">fixfiles</code> command does not take a list of directories as an argument, because it relabels the entire file system. If you need to relabel a specific directory path, use <code class="command">restorecon</code>.
- </div></div></div></div><div class="qandaentry"><div class="question" id="id3071712"><label>Q:</label><div class="data"><div class="para">
+ </div></div></div></div><div class="qandaentry"><div class="question" id="id2996205"><label>Q:</label><div class="data"><div class="para">
Why are some of my KDE applications having trouble under SELinux?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
KDE executables always appear as <code class="command">kdeinit</code>, which limits what can be done with SELinux policy. This is because every KDE application runs in the domain for <code class="command">kdeinit</code>.
@@ -758,7 +770,7 @@
<code class="command">rm -rf /var/tmp/kdecache-<em class="replaceable"><code><username></code></em> rm -rf /var/tmp/<em class="replaceable"><code><other_kde_files></code></em></code>
</pre><div class="para">
At your next login, your problem should be fixed.
- </div></div></div></div><div class="qandaentry"><div class="question" id="id3071784"><label>Q:</label><div class="data"><div class="para">
+ </div></div></div></div><div class="qandaentry"><div class="question" id="id2996277"><label>Q:</label><div class="data"><div class="para">
Why does <code class="option">SELINUX=disabled</code> not work for me?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
Be careful of white space in the file <code class="filename">/etc/sysconfig/selinux</code>. The code is very sensitive to white space, even trailing space.
@@ -779,14 +791,14 @@
# /usr/sbin/semanage fcontext -a -t textrel_shlib_t '/usr/lib/libavutil.so.49.0.0'
# /sbin/restorecon -v /usr/lib/libavutil.so.49.0.0
</pre><div class="para">
- with the particular library at fault in place of <code class="filename">/usr/lib/libavutil.so.49.0.0</code>. Now your application should be able to run. Please report this as a bugzilla.
+ with the particular library at fault in place of <code class="filename">/usr/lib/libavutil.so.49.0.0</code>. Now your application should be able to run. Please report this as a bug in <a href="http://bugzilla.redhat.com">http://bugzilla.redhat.com</a>.
</div></dd><dt><span class="term"><code class="computeroutput">execstack</code></span></dt><dd><div class="para">
- Attempt to <code class="command">execstack -c <em class="replaceable"><code>LIBRARY</code></em></code>. Now try your application again. If the application now works, the library was mistakenly marked as requiring <code class="computeroutput">execstack</code>. Please report this as a bugzilla.
+ Attempt to <code class="command">execstack -c <em class="replaceable"><code>LIBRARY</code></em></code>. Now try your application again. If the application now works, the library was mistakenly marked as requiring <code class="computeroutput">execstack</code>. Please report this as a bug in <a href="http://bugzilla.redhat.com">http://bugzilla.redhat.com</a>.
</div></dd><dt><span class="term"><code class="computeroutput">execmem, execheap</code></span></dt><dd><div class="para">
- A boolean for each one of these memory check errors have been provided. So if you need to run an application requiring either of these permissions, you can set the boolean allow_exec* to fix the problem. For instance if you try to run an application and you get an AVC message containing an <code class="computeroutput">execstack</code> failure. You can set the boolean with
+ A boolean for each one of these memory check errors have been provided. So if you need to run an application requiring either of these permissions, you can set the boolean allow_exec* to fix the problem. For instance if you try to run an application and you get an AVC message containing an <code class="computeroutput">execstack</code> failure. You can set the Boolean with:
</div><pre class="screen">
<code class="command">setsebool -P allow_execstack=1</code>
-</pre></dd></dl></div></div></div></div><div class="qandaentry"><div class="question" id="id3071992"><label>Q:</label><div class="data"><div class="para">
+</pre></dd></dl></div></div></div></div><div class="qandaentry"><div class="question" id="id3029652"><label>Q:</label><div class="data"><div class="para">
What do these rpm errors mean?
</div></div></div><div class="answer"><label>A:</label><div class="data"><pre class="screen">
restorecon reset /etc/modprobe.conf context system_u:object_r:etc_runtime_t->system_u:object_r:modules_conf_t
@@ -797,25 +809,25 @@
<code class="computeroutput">libsepol.sepol_genbools_array: boolean hidd_disable_trans no longer in policy</code>
</pre><div class="para">
This indicates that the updated policy has removed the boolean from policy.
- </div></div></div></div><div class="qandaentry"><div class="question" id="id3072060"><label>Q:</label><div class="data"><div class="para">
+ </div></div></div></div><div class="qandaentry"><div class="question" id="id3029720"><label>Q:</label><div class="data"><div class="para">
I want to run a daemon on a non standard port but SELinux will not allow me. How do get this to work?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
You can use the <code class="command">semanage</code> command to define additional ports. So say you want httpd to be able to listen on port 8082. You could enter the command.
</div><pre class="screen">
<code class="command">semanage port -a -p tcp -t http_port_t 8082</code>
-</pre></div></div></div><div class="qandaentry"><div class="question" id="id3072095"><label>Q:</label><div class="data"><div class="para">
- I am writing a php script that needs to create files and possibly execute them. SELinux policy is preventing this. What should I do?
+</pre></div></div></div><div class="qandaentry"><div class="question" id="id3029755"><label>Q:</label><div class="data"><div class="para">
+ I am writing a PHP script that needs to create files and possibly execute them. SELinux policy is preventing this. What should I do?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
First, you should never allow a system service to execute anything it can write. This gives an attacker the ability to upload malicious code to the server and then execute it, which is something we want to prevent.
</div><div class="para">
If you merely need to allow your script to create (non-executable) files, this is possible. That said, you should avoid having system applications writing to the <code class="filename">/tmp</code> directory, since users tend to use the <code class="filename">/tmp</code> directory also. It would be better to create a directory elsewhere which could be owned by the apache process and allow your script to write to it. You should label the directory <code class="computeroutput">httpd_sys_script_rw_t</code>, which will allow apache to read and write files to that directory. This directory could be located anywhere that apache can get to (even <code class="filename">$HOME/public_html/</code>).
- </div></div></div></div><div class="qandaentry"><div class="question" id="id3072149"><label>Q:</label><div class="data"><div class="para">
+ </div></div></div></div><div class="qandaentry"><div class="question" id="id3029810"><label>Q:</label><div class="data"><div class="para">
I am setting up swapping to a file, but I am seeing AVC messages in my log files?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
You need to identify the swapfile to SELinux by setting its file context to <code class="computeroutput">swapfile_t</code>.
</div><pre class="screen">
<code class="command">chcon -t swapfile_t <em class="replaceable"><code>SWAPFILE</code></em></code>
-</pre></div></div></div><div class="qandaentry"><div class="question" id="id3072186"><label>Q:</label><div class="data"><div class="para">
+</pre></div></div></div><div class="qandaentry"><div class="question" id="id3029847"><label>Q:</label><div class="data"><div class="para">
Please explain the <code class="computeroutput">relabelto</code>/<code class="computeroutput">relabelfrom</code> permissions?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
For files, <code class="computeroutput">relabelfrom</code> means "Can domain D relabel a file from (i.e. currently in) type T1?" and <code class="computeroutput">relabelto</code> means "Can domain D relabel a file to type T2?", so both checks are applied upon a file relabeling, where T1 is the original type of the type and T2 is the new type specified by the program.
@@ -827,25 +839,25 @@
Implementing SELinux as an LSM technical report (describes permission checks on a per-hook basis) <a href="http://www.nsa.gov/selinux/papers/module-abs.cfm">http://www.nsa.gov/selinux/papers/module-abs.cfm</a>. This is also available in the selinux-doc package (and more up-to-date there).
</div></li><li class="listitem"><div class="para">
Integrating Flexible Support for Security Policies into the Linux Operating System - technical report (describes original design and implementation, including summary tables of classes, permissions, and what permission checks are applied to what system calls. It is not entirely up-to-date with current implementation, but a good resource nonetheless). <a href="http://www.nsa.gov/selinux/papers/slinux-abs.cfm">http://www.nsa.gov/selinux/papers/slinux-abs.cfm</a>
- </div></li></ul></div></div></div></div></div><div class="qandadiv"><h4 class="title" id="faq-div-deploying-selinux">1.4. Deploying SELinux</h4></div><div class="toc"><dl><dt>Q: <a href="#id3072295">
+ </div></li></ul></div></div></div></div></div><div class="qandadiv"><h4 class="title" id="faq-div-deploying-selinux">1.4. Deploying SELinux</h4></div><div class="toc"><dl><dt>Q: <a href="#id3029955">
What file systems can I use for SELinux?
- </a></dt><dt>Q: <a href="#id3072333">
+ </a></dt><dt>Q: <a href="#id3029988">
How does SELinux impact system performance?
- </a></dt><dt>Q: <a href="#id3072362">
+ </a></dt><dt>Q: <a href="#id3030022">
What types of deployments, applications, and systems should I leverage SELinux in?
- </a></dt><dt>Q: <a href="#id3072425">
+ </a></dt><dt>Q: <a href="#id3030073">
How does SELinux affect third-party applications?
- </a></dt></dl></div><div class="qandadiv"><div class="qandaentry"><div class="question" id="id3072295"><label>Q:</label><div class="data"><div class="para">
+ </a></dt></dl></div><div class="qandadiv"><div class="qandaentry"><div class="question" id="id3029955"><label>Q:</label><div class="data"><div class="para">
What file systems can I use for SELinux?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
- The file system must support <code class="computeroutput">xattr</code> labels in the right <em class="parameter"><code>security.*</code></em> namespace. In addition to ext2/ext3, XFS has recently added support for the necessary labels.
+ The file system must support <code class="computeroutput">xattr</code> labels in the right <em class="parameter"><code>security.*</code></em> namespace. In addition to ext2/ext3/ext4, XFS has recently added support for the necessary labels.
</div><div class="para">
- Note that XFS SELinux support is broken in upstream kernel 2.6.14 and 2.6.15, but fixed (worked around) in 2.6.16. Your kernel must include this fix if you choose to use XFS with SELinux.
- </div></div></div></div><div class="qandaentry"><div class="question" id="id3072333"><label>Q:</label><div class="data"><div class="para">
+ Note that XFS SELinux support was broken in the upstream Linux kernel versions 2.6.14 and 2.6.15, but fixed (worked around) in version 2.6.16. Your kernel must be of this version or later if you choose to use XFS with SELinux.
+ </div></div></div></div><div class="qandaentry"><div class="question" id="id3029988"><label>Q:</label><div class="data"><div class="para">
How does SELinux impact system performance?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
- This is a variable that is hard to measure, and is heavily dependent on the tuning and usage of the system running SELinux. When performance was last measured, the impact was around 7% for completely untuned code. Subsequent changes in system components such as networking are likely to have made that worse in some cases. SELinux performance tuning continues to be a priority of the development team.
- </div></div></div></div><div class="qandaentry"><div class="question" id="id3072362"><label>Q:</label><div class="data"><div class="para">
+ This is a metric that is hard to measure, and is heavily dependent on the tuning and usage of the system running SELinux. When performance was last measured, the impact was around 7% for completely untuned code. Subsequent changes in system components such as networking are likely to have made that worse in some cases. SELinux performance tuning continues to be a priority of the development team.
+ </div></div></div></div><div class="qandaentry"><div class="question" id="id3030022"><label>Q:</label><div class="data"><div class="para">
What types of deployments, applications, and systems should I leverage SELinux in?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
Initially, SELinux has been used on Internet facing servers that are performing a few specialized functions, where it is critical to keep extremely tight security. Administrators typically strip such a box of all extra software and services, and run a very small, focused set of services. A Web server or mail server is a good example.
@@ -853,9 +865,7 @@
In these edge servers, you can lock down the policy very tightly. The smaller number of interactions with other components makes such a lock down easier. A dedicated system running a specialized third-party application would also be a good candidate.
</div><div class="para">
In the future, SELinux will be targeted at all environments. In order to achieve this goal, the community and <em class="firstterm">independent software vendors</em> (<abbr class="abbrev">ISV</abbr>s) must work with the SELinux developers to produce the necessary policy.
- </div><div class="para">
- For more information about these policies, refer to <a class="xref" href="#qa-whatis-policy" title="Q:">What is SELinux policy?</a>.
- </div></div></div></div><div class="qandaentry"><div class="question" id="id3072425"><label>Q:</label><div class="data"><div class="para">
+ </div></div></div></div><div class="qandaentry"><div class="question" id="id3030073"><label>Q:</label><div class="data"><div class="para">
How does SELinux affect third-party applications?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
One goal of implementing a targeted SELinux policy in Fedora is to allow third-party applications to work without modification. The targeted policy is transparent to those unaddressed applications, and it falls back on standard Linux DAC security. These applications, however, will not be running in an extra-secure manner. You or another provider must write policy to protect these applications with MAC security.
14 years, 2 months
Branch 'f12-tx' - po/ru.po
by Transifex System User
po/ru.po | 108 ++++++++++++++++++++++++++++-----------------------------------
1 file changed, 49 insertions(+), 59 deletions(-)
New commits:
commit e64f2d2fd6f26af42ec878baa50e26befc3ecb3a
Author: ypoyarko <ypoyarko(a)fedoraproject.org>
Date: Thu Jan 21 02:01:20 2010 +0000
Sending translation for Russian
diff --git a/po/ru.po b/po/ru.po
index eeda333..48f209e 100644
--- a/po/ru.po
+++ b/po/ru.po
@@ -8,7 +8,7 @@ msgstr ""
"Project-Id-Version: ru\n"
"Report-Msgid-Bugs-To: http://bugs.kde.org\n"
"POT-Creation-Date: 2009-09-30 11:04+0000\n"
-"PO-Revision-Date: 2010-01-20 16:45+1100\n"
+"PO-Revision-Date: 2010-01-21 12:59+1100\n"
"Last-Translator: Yulia <ypoyarko(a)redhat.com>\n"
"Language-Team: Russian\n"
"MIME-Version: 1.0\n"
@@ -16039,7 +16039,7 @@ msgid ""
"zone, and networking configuration options in addition to the default ones."
msgstr ""
"<command>--reconfig</command> — разрешает запуск "
-"<application>Помощника по настройке</application> в режиме перенастройки. "
+"<application>помощника по настройке</application> в режиме перенастройки. "
"Помимо стандартных параметров конфигурации, этот режим позволяет изменить "
"настройки мыши, клавиатуры, языковые параметры, пароль root, уровень "
"безопасности, часовой пояс и настройки сети."
@@ -16068,9 +16068,9 @@ msgid ""
"command> option is used as default."
msgstr ""
"Останавливает систему после успешного завершения установки. Это похоже на "
-"установку вручную, когда Anaconda выводит сообщение и ждет, пока "
-"пользователь не нажмет клавишу, и только затем перегружает компьютер. Если "
-"при кикстарт-установке не указан метод завершения, по умолчанию выбирается "
+"ручную установку, когда Anaconda выводит сообщение и ждет, пока "
+"пользователь не нажмет клавишу, и только затем перезагружает компьютер. Если "
+"при кикстарт-установке не указано завершающее действие, по умолчанию выбирается "
"режим <command>reboot</command>."
#. Tag: para
@@ -16140,7 +16140,7 @@ msgid ""
msgstr ""
"Определяет, что выполняется установка новой системы, а не обновление "
"существующей. Этот параметр установлен по умолчанию. Для установки вы должны "
-"указать тип установки: с <command>cdrom</command>, <command>harddrive</"
+"указать тип установки: <command>cdrom</command>, <command>harddrive</"
"command>, <command>nfs</command> или <command>url</command> (для установок "
"по FTP ил HTTP). Команда <command>install</command> и команда метода "
"установки должны располагаться на разных строках."
@@ -16159,7 +16159,7 @@ msgid ""
"<command>cdrom</command> — Install from the first CD-ROM drive on the "
"system."
msgstr ""
-"<command>cdrom</command> — устаналивает систему с первого привода CD-"
+"<command>cdrom</command> — устаналивает систему из первого привода CD-"
"ROM."
#. Tag: para
@@ -16257,7 +16257,7 @@ msgstr "--opts="
#, no-c-format
msgid "Mount options to use for mounting the NFS export. (optional)"
msgstr ""
-"Параметры подключения, используемые при монтировании экспорта NFS "
+"Параметры подключения, используемые при монтировании экспортируемого ресурса NFS "
"(необязательны)"
#. Tag: screen
@@ -16328,7 +16328,7 @@ msgstr ""
"Использует во время установки информацию, определенную в файле кикстарта, но "
"допускает проверку и изменение заданных значений. В каждом диалоге программы "
"установки вы будете наблюдать значения, полученные из файла кикстарта. Вы "
-"можете либо согласиться с этими значениями, нажав <guibutton>Далее</"
+"можете либо принять эти значения, нажав <guibutton>Далее</"
"guibutton>, либо изменить их и нажать <guibutton>Далее</guibutton> для "
"продолжения. Обратитесь к описанию команды <command>autostep</command>."
@@ -16516,7 +16516,7 @@ msgid ""
msgstr ""
"Некоторые языки, в частности, китайский, японский, корейский и языки "
"индийской группы, не поддерживаются текстовой установкой. Если один из "
-"перечисленных языков задан с помощью команды \"lang\", то установка будет "
+"перечисленных языков задан с помощью команды «lang», то установка будет "
"продолжена на английском, несмотря на то, что указанный язык будет "
"использоваться позднее в качестве языка системы."
@@ -16525,7 +16525,7 @@ msgstr ""
#: Kickstart2.xml:1127
#, no-c-format
msgid "<command>langsupport</command> (deprecated)"
-msgstr "<command>langsupport</command> (устаревшее)"
+msgstr "<command>langsupport</command> (устаревший)"
#. Tag: command
#: Kickstart2.xml:1130
@@ -16966,7 +16966,7 @@ msgid ""
"use DHCP:"
msgstr ""
"В режиме DHCP для получения сетевой конфигурации используется DHCP-сервер. "
-"Как вы могли догадаться, в случае с BOOTP для получения сетевых настроек "
+"Как можно догадаться, в случае с BOOTP для получения сетевых настроек "
"подобным образом используется сервер BOOTP. Чтобы настроить компьютер на "
"использование DHCP, укажите:"
@@ -17005,10 +17005,10 @@ msgid ""
"information on one line. You must specify the IP address, netmask, gateway, "
"and nameserver."
msgstr ""
-"В случае статической конфигурации потребуется определить в файле кикстарта "
-"все необходимые сетевые параметры. Как и следует из имени, эти параметры "
+"В случае статической конфигурации в файле кикстарта "
+"потребуется определить все необходимые сетевые параметры. Как и следует из имени, эти параметры "
"являются статическими и используются как во время, так и после установки. "
-"Строка для статической настройки выглядит более сложной, так как все сетевые "
+"Строка статической настройки выглядит более сложной, так как все сетевые "
"параметры должны быть указаны в одной строке. Необходимо указать IP-адрес, "
"маску сети, шлюз и сервер имен."
@@ -17021,7 +17021,7 @@ msgid ""
"a single line with no break."
msgstr ""
"В этом примере строка разбита на две исключительно для удобства "
-"представления; в действительности вся информация должна помещаться на одной "
+"представления; в действительности вся информация должна помещаться в одной "
"строке:"
#. Tag: screen
@@ -17261,9 +17261,7 @@ msgstr ""
msgid ""
"For a detailed example of <command>part</command> in action, refer to <xref "
"linkend=\"s2-kickstart2-options-part-examples\"/>."
-msgstr ""
-"Подробный пример действия <command>part</command> может быть найден в <xref "
-"linkend=\"s2-kickstart2-options-part-examples\"/>."
+msgstr "<xref linkend=\"s2-kickstart2-options-part-examples\"/> содержит подробный пример использования <command>part</command>."
# Where <replaceable><n></replaceable> is one of the following:
#. Tag: para
@@ -17611,7 +17609,7 @@ msgid ""
"kickstart installation, if no completion method is specified, the "
"<command>reboot</command> option is used as default."
msgstr ""
-"После установки завершает работу системы и отключает питание компьютера. "
+"После установки завершает работу системы и выключает компьютер. "
"Обычно при установке вручную Anaconda выводит на экран сообщение и ждет "
"нажатия клавиши для перезагрузки. Если при кикстарт-установке не указан "
"метод завершения, по умолчанию выбирается режим <command>reboot</command>."
@@ -17679,7 +17677,7 @@ msgstr "<command>raid</command> (необязательный)"
#: Kickstart2.xml:1778
#, no-c-format
msgid "Assembles a software RAID device. This command is of the form:"
-msgstr "Собирает программный RAID-массив. Формат:"
+msgstr "Собирает программное RAID-устройство. Формат:"
# <command>DNS=<replaceable><server1></replaceable>:<replaceable><server2></replaceable>:…:<replaceable><serverN></replaceable></command>
#. Tag: screen
@@ -17690,7 +17688,7 @@ msgid ""
"level></replaceable> --device=<replaceable><mddevice></replaceable> "
"<replaceable><partitions*></replaceable>"
msgstr ""
-"raid <replaceable><точка_подключения></replaceable> --"
+"raid <replaceable><точка></replaceable> --"
"level=<replaceable><уровень></replaceable> --device=<replaceable><"
"mdN></replaceable> <replaceable><разделы*></replaceable>"
@@ -17707,7 +17705,7 @@ msgid ""
"denotes that multiple partitions can be listed) lists the RAID identifiers "
"to add to the RAID array."
msgstr ""
-"<replaceable><файл></replaceable> — точка, в которую монтируется "
+"<replaceable><точка></replaceable> — точка, в которую монтируется "
"файловая система RAID. Если это <filename>/</filename>, уровень RAID должен "
"быть равен 1, если только не определен загрузочный раздел (<filename>/boot</"
"filename>). Если загрузочный раздел определен, раздел <filename>/boot</"
@@ -17813,7 +17811,7 @@ msgid ""
"<command>--encrypted</command> — Specifies that this RAID device "
"should be encrypted."
msgstr ""
-"<command>--encrypted</command> — форматировать заданное устройство "
+"<command>--encrypted</command> — зашифровать заданное устройство "
"RAID."
#. Tag: para
@@ -17830,7 +17828,7 @@ msgstr ""
"шифрования устройства RAID. При этом должен быть задан параметр <command>--"
"encrypted</command>, в противном случае эта опция будет проигнорирована. "
"Если парольная фраза на задана, будет использоваться стандартное значение, "
-"определенное для системы. Если же стандартная фраза также не определена, "
+"определенное для системы. Если же стандартная фраза не определена, "
"программа установки запросит ее ввод."
#. Tag: para
@@ -17900,9 +17898,7 @@ msgstr ""
msgid ""
"For a detailed example of <command>raid</command> in action, refer to <xref "
"linkend=\"s2-kickstart2-options-part-examples\"/>."
-msgstr ""
-"Подробный пример действия <command>raid</command> рассматривается в <xref "
-"linkend=\"s2-kickstart2-options-part-examples\"/>."
+msgstr "<xref linkend=\"s2-kickstart2-options-part-examples\"/> содержит подробный пример <command>raid</command> в действии."
# <command>reboot=b</command>
#. Tag: term
@@ -17982,8 +17978,7 @@ msgid ""
"package installation. Multiple repo lines may be specified."
msgstr ""
"Задает дополнительные хранилища yum, которые могут использоваться в качестве "
-"источников для установки пакетов. Возможно указание нескольких строк "
-"хранилищ."
+"источников для установки пакетов. Можно указать несколько репозиториев, по одному на строку."
# <command>DNS=<replaceable><server1></replaceable>:<replaceable><server2></replaceable>:…:<replaceable><serverN></replaceable></command>
#. Tag: screen
@@ -18053,8 +18048,8 @@ msgid ""
"Sets the system's root password to the <replaceable><password></"
"replaceable> argument."
msgstr ""
-"Определяет для пользователя root пароль <replaceable><пароль></"
-"replaceable>."
+"Определяет <replaceable><пароль></"
+"replaceable> для пользователя root ."
# <command>root=<replaceable><file-system></replaceable></command>
#. Tag: screen
@@ -18153,7 +18148,7 @@ msgid ""
"<citetitle>Fedora &PRODVER; Security-Enhanced Linux User Guide</citetitle>."
msgstr ""
"Полную информацию о SELinux в Fedora можно найти в <citetitle>Руководстве "
-"пользователя по SELinux для по Fedora &PRODVER;</citetitle>."
+"пользователя по SELinux Fedora &PRODVER;</citetitle>."
# <command>serial</command>
#. Tag: term
@@ -18177,9 +18172,9 @@ msgid ""
"runlevel. The services listed in the disabled list will be disabled before "
"the services listed in the enabled list are enabled."
msgstr ""
-"Изменяет стандартный набор сервисов, выполняющихся на текущем уровне "
-"выполнения. Перечисленные сервисы в списке отключений будут отключены до "
-"активации сервисов, заданных в списке подключения."
+"Изменяет стандартный набор служб, выполняющихся на текущем уровне "
+"выполнения. Перечисленные в списке отключений службы будут отключены до "
+"активации служб, заданных в списке подключения."
#. Tag: para
#: Kickstart2.xml:2028
@@ -18214,7 +18209,7 @@ msgid ""
"If you include spaces in the comma-separated list, kickstart will enable or "
"disable only the services up to the first space. For example:"
msgstr ""
-"Так как в противном случае будут обработаны службы только до первого "
+"В противном случае будут обработаны службы только до первого "
"пробела. Пример:"
#. Tag: command
@@ -18351,15 +18346,15 @@ msgid ""
"Sets the system time zone to <replaceable><timezone></replaceable> "
"which may be any of the time zones listed by <command>timeconfig</command>."
msgstr ""
-"Определяет часовой пояс <replaceable><timezone></replaceable> "
-"(аргумент может быть одним из приведенных в <command>timeconfig</command>)."
+"Определяет часовой <replaceable><пояс></replaceable> "
+"(аргумент может быть одним из значений команды <command>timeconfig</command>)."
# <command>root=<replaceable><file-system></replaceable></command>
#. Tag: screen
#: Kickstart2.xml:2123
#, no-c-format
msgid "timezone [--utc] <replaceable><timezone></replaceable>"
-msgstr "timezone [--utc] <replaceable><часовой_пояс></replaceable>"
+msgstr "timezone [--utc] <replaceable><пояс></replaceable>"
#. Tag: para
#: Kickstart2.xml:2127
@@ -18538,7 +18533,7 @@ msgid ""
msgstr ""
"Позволяет наблюдать за графической установкой через VNC. Этот метод более "
"предпочтителен по сравнению с текстовым режимом установки, поскольку при "
-"текстовой установке существуют определенные ограничения (например, языковые "
+"текстовой установке существуют определенные ограничения (языковые "
"и пр.). Если параметры не заданы, данная команда запустит VNC-сервер на "
"машине без пароля и выведет команду, необходимую для подключения к "
"удаленному компьютеру."
@@ -18641,7 +18636,7 @@ msgid ""
"reformat it."
msgstr ""
"<command>--useexisting</command> — использует существующую группу "
-"томов и переформатирует ее."
+"томов и повторно ее форматирует."
#. Tag: para
#: Kickstart2.xml:2284
@@ -18667,9 +18662,7 @@ msgstr ""
msgid ""
"For a detailed example of <command>volgroup</command> in action, refer to "
"<xref linkend=\"s2-kickstart2-options-part-examples\"/>."
-msgstr ""
-"Подробный пример действия <command>volgroup</command> вы найдете в <xref "
-"linkend=\"s2-kickstart2-options-part-examples\"/>."
+msgstr "<xref linkend=\"s2-kickstart2-options-part-examples\"/> содержит подробный пример <command>volgroup</command> в действии."
# <command>nofb</command>
#. Tag: term
@@ -18786,7 +18779,7 @@ msgid ""
"found on disks are initialized. This destroys all of the contents of disks "
"with invalid partition tables."
msgstr ""
-"Если указан параметр <command>zerombr</command>, все неправильные таблицы "
+"Если указан параметр <command>zerombr</command>, все неверные таблицы "
"разделов, обнаруженные на дисках, будут очищены. Это приведет к потере всех "
"данных, расположенных на дисках с этими таблицами."
@@ -18866,8 +18859,7 @@ msgid ""
msgstr ""
"Используйте команду <command>%include <replaceable>/путь/к/файлу</"
"replaceable></command>, чтобы включить в файл кикстарта содержимое другого "
-"файла, как если бы содержимое было непосредственно было вставлено в файл "
-"вместо команды <command>%include</command>."
+"файла, как если бы содержимое было непосредственно было вставлено в файл."
#. Tag: title
#: Kickstart2.xml:2446
@@ -18891,8 +18883,7 @@ msgid ""
"command>, <command>volgroup</command>, and <command>logvol</command> "
"kickstart options in action:"
msgstr ""
-"Ниже показан комплексный пример, иллюстрирующий параметры кикстарта "
-"<command>clearpart</command>, <command>raid</command>, <command>part</"
+"Ниже показан комплексный пример, иллюстрирующий параметры <command>clearpart</command>, <command>raid</command>, <command>part</"
"command>, <command>volgroup</command> и <command>logvol</command> в действии:"
#. Tag: screen
@@ -18960,14 +18951,14 @@ msgid ""
"This advanced example implements LVM over RAID, as well as the ability to "
"resize various directories for future growth."
msgstr ""
-"В этом примере реализован LVM поверх RAID, а также показаны возможности, "
+"В этом примере LVM реализован поверх RAID, а также показаны возможности, "
"позволяющие увеличивать размер каталогов в будущем."
#. Tag: secondary
#: Kickstart2.xml:2466
#, no-c-format
msgid "package selection specification"
-msgstr "процедура выбора пакетов"
+msgstr "выбор пакетов"
#. Tag: para
#: Kickstart2.xml:2468
@@ -18978,7 +18969,7 @@ msgid ""
"installations only, as package selection during upgrades is not supported)."
msgstr ""
"Используйте команду <command>%packages</command> для обозначения начала "
-"секции, в которой вы опишете пакеты для установки (эта команда подходит "
+"секции списка пакетов для установки (эта команда подходит "
"только для установки, так как выбор пакетов во время обновления системы не "
"поддерживается)."
@@ -19017,9 +19008,8 @@ msgid ""
"<command>Base</command> groups are always selected by default, so it is not "
"necessary to specify them in the <command>%packages</command> section."
msgstr ""
-"В большинстве случаев вполне достаточно устанавливать нужные группы, а не "
-"отдельные пакеты. Обратите внимание, что группы <command>Базовая система</"
-"command> и <command>Основа</command> выбраны по умолчанию, поэтому их "
+"В большинстве случаев вполне достаточно указать нужные группы, а не "
+"отдельные пакеты. Обратите внимание, что группы основные группы пакетов выбраны по умолчанию, поэтому их "
"указывать в разделе %packages не требуется."
#. Tag: para
@@ -19101,7 +19091,7 @@ msgid ""
"a very small system."
msgstr ""
"Не устанавливает группу @Base. Используйте этот параметр, если вашей целью "
-"является создание как можно более компактной системы.ы"
+"является создание как можно более компактной системы."
# recommended
#. Tag: command
@@ -19398,8 +19388,8 @@ msgstr ""
"У вас есть возможность задать команды, которые будут выполнены сразу после "
"завершения установки. Такая секция должна располагаться в конце файла "
"кикстарта и начинаться с команды %post. Использование секции %post может "
-"особенно пригодиться при выполнении таких операций, как установка "
-"дополнительного программного обеспечения и настройка дополнительного сервера "
+"особенно пригодиться при установке "
+"дополнительного программного обеспечения и настройке дополнительного сервера "
"имен."
#. Tag: para
14 years, 2 months
Branch 'f12-tx' - po/ru.po
by Transifex System User
po/ru.po | 147 ++++++++++++++++++++++++++++++++-------------------------------
1 file changed, 76 insertions(+), 71 deletions(-)
New commits:
commit 4756348a4d8e5bb817be72517cc5510ba532cbea
Author: ypoyarko <ypoyarko(a)fedoraproject.org>
Date: Wed Jan 20 06:03:33 2010 +0000
Sending translation for Russian
diff --git a/po/ru.po b/po/ru.po
index fd70e49..eeda333 100644
--- a/po/ru.po
+++ b/po/ru.po
@@ -8,9 +8,9 @@ msgstr ""
"Project-Id-Version: ru\n"
"Report-Msgid-Bugs-To: http://bugs.kde.org\n"
"POT-Creation-Date: 2009-09-30 11:04+0000\n"
-"PO-Revision-Date: 2010-01-19 16:50+1100\n"
+"PO-Revision-Date: 2010-01-20 16:45+1100\n"
"Last-Translator: Yulia <ypoyarko(a)redhat.com>\n"
-"Language-Team: Russian <fedora-trans-ru(a)redhat.com>\n"
+"Language-Team: Russian\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
@@ -9034,9 +9034,10 @@ msgid ""
"sure how you want your system to be partitioned, read <xref linkend=\"ch-"
"partitions-x86\"/> for more information."
msgstr ""
-"Разбиение диска позволяет разделить его на изолированные разделы, при "
-"этом каждый раздел подобен отдельному жесткому диску. Особенно такое разбиение важно, если вы работаете в нескольких операционных системах. "
-"<xref linkend=\"ch-partitions-x86\"/> содержит подробную информацию о создании разделов."
+"Разбиение диска позволяет разделить его на изолированные разделы, при этом "
+"каждый раздел подобен отдельному жесткому диску. Особенно такое разбиение "
+"важно, если вы работаете в нескольких операционных системах. <xref linkend="
+"\"ch-partitions-x86\"/> содержит подробную информацию о создании разделов."
#. Tag: para
#: Disk_Partitioning_Setup-x86.xml:26
@@ -9047,8 +9048,9 @@ msgid ""
"button. For more information refer to <xref linkend=\"s1-advanced-storage-x86"
"\"/>."
msgstr ""
-"Для выполнения установки можно настроить цель iSCSI или отключить устройство dmraid, нажав кнопку «Дополнительная "
-"настройка накопителей». <xref linkend=\"s1-advanced-storage-ppc\" /> содержит дальнейшую информацию."
+"Для выполнения установки можно настроить цель iSCSI или отключить устройство "
+"dmraid, нажав кнопку «Дополнительная настройка накопителей». <xref linkend="
+"\"s1-advanced-storage-ppc\" /> содержит дальнейшую информацию."
# If you chose to manually partition using <application>Disk Druid</application>, refer to <xref linkend="s1-diskpartitioning">.
#. Tag: para
@@ -9169,8 +9171,8 @@ msgid ""
"> for more information."
msgstr ""
"Наличие нескольких небольших разделов вместо одного большого корневого "
-"раздела (<filename class=\"partition\">/</filename>) облегчит обновление системы в будущем "
-"(см. <xref linkend=\"s2-diskpartitioning-dd-x86\"/>)."
+"раздела (<filename class=\"partition\">/</filename>) облегчит обновление "
+"системы в будущем (см. <xref linkend=\"s2-diskpartitioning-dd-x86\"/>)."
#. Tag: para
#: Disk_Partitioning_X86_Partitions.xml:77
@@ -9327,8 +9329,8 @@ msgid ""
msgstr ""
"Если вы еще не решили, как создать свои разделы, просмотрите <xref linkend="
"\"ch-partitions-x86\"/> и <xref linkend=\"s2-diskpartrecommend-x86\"/>. Как "
-"минимум понадобится корневой раздел root соответствующего размера и "
-"раздел swap, равный по размеру удвоенному объему памяти вашего компьютера. "
+"минимум понадобится корневой раздел root соответствующего размера и раздел "
+"swap, равный по размеру удвоенному объему памяти вашего компьютера. "
"Пользователям компьютеров Itanium понадобится раздел <filename>/boot/efi/</"
"filename>, имеющий объем примерно 100 МБ и тип FAT (VFAT), раздел swap "
"(минимум 512 МБ) и корневой раздел (<filename>/</filename>) соответствующего "
@@ -10802,13 +10804,13 @@ msgid ""
"Note that NFS installations may also be performed in GUI mode."
msgstr ""
"Вы можете воспользоваться этим методом при выполнении установки с NFS-"
-"сервера с использованием ISO-образов или зеркального образа Fedora. Потребуется "
-"загрузочный диск (используйте параметр загрузки <command>linux askmethod</"
-"command> или <command>linux repo=nfs:<replaceable>сервер</replaceable> "
-"<replaceable>:параметры</replaceable>:/<replaceable>путь</replaceable></"
-"command>). <xref linkend=\"s1-begininstall-nfs-x86\"/> содержит инструкции "
-"по сетевой установке. Стоит заметить, что NFS установка может также "
-"выполняться в графическом режиме."
+"сервера с использованием ISO-образов или зеркального образа Fedora. "
+"Потребуется загрузочный диск (используйте параметр загрузки <command>linux "
+"askmethod</command> или <command>linux repo=nfs:<replaceable>сервер</"
+"replaceable> <replaceable>:параметры</replaceable>:/<replaceable>путь</"
+"replaceable></command>). <xref linkend=\"s1-begininstall-nfs-x86\"/> "
+"содержит инструкции по сетевой установке. Стоит заметить, что NFS установка "
+"может также выполняться в графическом режиме."
# EXACT MATCH
#. Tag: term
@@ -11773,9 +11775,9 @@ msgstr ""
"<emphasis>Этап 1.5. Загрузчик первого этапа считывает загрузчик этапа 1.5 в "
"память.</emphasis> Этот промежуточный этап необходим для некоторых типов "
"оборудования, а также в случае, если границы раздела <filename>/boot/</"
-"filename> уходят за 1024 цилиндр или используется режим LBA. Загрузчик "
-"этапа 1.5 обычно расположен либо полностью в разделе <filename>/boot/</"
-"filename>, либо в MBR и <filename>/boot/</filename>."
+"filename> уходят за 1024 цилиндр или используется режим LBA. Загрузчик этапа "
+"1.5 обычно расположен либо полностью в разделе <filename>/boot/</filename>, "
+"либо в MBR и <filename>/boot/</filename>."
#. Tag: para
#: Grub.xml:220
@@ -12212,9 +12214,9 @@ msgid ""
"specifies the MBR on the fourth device."
msgstr ""
"Чтобы определить целое устройство без учета разделов, опустите указание "
-"номера раздела. Это особенно важно, если нужно настроить MBR на "
-"заданном диске. Например, <command>(hd0)</command> задает MBR на первом "
-"устройстве, а <command>(hd3)</command> — на четвертом."
+"номера раздела. Это особенно важно, если нужно настроить MBR на заданном "
+"диске. Например, <command>(hd0)</command> задает MBR на первом устройстве, а "
+"<command>(hd3)</command> — на четвертом."
#. Tag: para
#: Grub.xml:406
@@ -12347,9 +12349,9 @@ msgid ""
msgstr ""
"Понимание структуры списков блоков может пригодиться при настройке GRUB для "
"загрузки операционных систем, требующих последовательной загрузки. Указание "
-"начального блока может быть опущено, если участок начинается с нулевого блока. Например, "
-"файл последовательной загрузки первого раздела первого диска будет описан "
-"так:"
+"начального блока может быть опущено, если участок начинается с нулевого "
+"блока. Например, файл последовательной загрузки первого раздела первого "
+"диска будет описан так:"
# <command>dd</command>
#. Tag: screen
@@ -12563,7 +12565,9 @@ msgstr ""
msgid ""
"Refer to <xref linkend=\"s1-grub-configfile\"/> for more information on "
"configuring this interface."
-msgstr "<xref linkend=\"s1-grub-configfile\"/> содержит дополнительную информацию о настройке этого интерфейса."
+msgstr ""
+"<xref linkend=\"s1-grub-configfile\"/> содержит дополнительную информацию о "
+"настройке этого интерфейса."
#. Tag: emphasis
#: Grub.xml:552
@@ -12583,9 +12587,9 @@ msgid ""
"one (<keycap>e</keycap>), or deleting one (<keycap>d</keycap>)."
msgstr ""
"Для доступа к редактору нажмите <keycap>e</keycap> в меню загрузчика. Будут "
-"показаны команды GRUB, которые можно изменить путем добавления "
-"новой командной строки (нажмите <keycap>o</keycap> для вставки новой строки "
-"после текущей или <keycap>O</keycap> для вставки перед текущей строкой), "
+"показаны команды GRUB, которые можно изменить путем добавления новой "
+"командной строки (нажмите <keycap>o</keycap> для вставки новой строки после "
+"текущей или <keycap>O</keycap> для вставки перед текущей строкой), "
"редактирования (<keycap>e</keycap>) или удаления строки (<keycap>d</keycap>)."
#. Tag: para
@@ -12609,7 +12613,9 @@ msgstr ""
msgid ""
"For information about changing runlevels using the GRUB menu entry editor, "
"refer to <xref linkend=\"s1-grub-runlevels\"/>."
-msgstr "<xref linkend=\"s1-grub-runlevels\"/> содержит информацию об изменении уровней выполнения с помощью меню редактора GRUB."
+msgstr ""
+"<xref linkend=\"s1-grub-runlevels\"/> содержит информацию об изменении "
+"уровней выполнения с помощью меню редактора GRUB."
#. Tag: emphasis
#: Grub.xml:573
@@ -12825,9 +12831,9 @@ msgid ""
"Installs GRUB to the system MBR."
msgstr ""
"<command>install <replaceable><стадия-1></replaceable> "
-"<replaceable><диск></replaceable> <replaceable><стадия-2>"
-"</replaceable> <option>p</option> <replaceable>файл</replaceable></"
-"command> — устанавливает GRUB в MBR."
+"<replaceable><диск></replaceable> <replaceable><стадия-2></"
+"replaceable> <option>p</option> <replaceable>файл</replaceable></command> "
+"— устанавливает GRUB в MBR."
#. Tag: para
#: Grub.xml:667
@@ -12878,7 +12884,8 @@ msgid ""
msgstr ""
"<option>p</option> <command><replaceable><config-file></replaceable></"
"command> — указывает команде <command>install</command> выполнить "
-"поиск файла конфигурации меню, например, <command>(hd0,0)/grub/grub.conf</command>."
+"поиск файла конфигурации меню, например, <command>(hd0,0)/grub/grub.conf</"
+"command>."
#. Tag: para
#: Grub.xml:695
@@ -13030,8 +13037,9 @@ msgid ""
msgstr ""
"Файл конфигурации (<filename>/boot/grub/grub.conf</filename>), используемый "
"для создания списка доступных для загрузки операционных систем, позволяет "
-"выбрать определенную заранее группу команд. <xref linkend=\"s1-grub-commands\"/> содержит описание некоторых команд. Также могут "
-"использоваться специальные команды."
+"выбрать определенную заранее группу команд. <xref linkend=\"s1-grub-commands"
+"\"/> содержит описание некоторых команд. Также могут использоваться "
+"специальные команды."
#. Tag: title
#: Grub.xml:754
@@ -13146,8 +13154,8 @@ msgid ""
"example, change the <command>default=0</command> to <command>default=1</"
"command>."
msgstr ""
-"Обратите внимание, что целое значение переменной default относится к первой строке "
-"<command>title</command> файла конфигурации. Чтобы установить "
+"Обратите внимание, что целое значение переменной default относится к первой "
+"строке <command>title</command> файла конфигурации. Чтобы установить "
"<command>Windows</command> в качестве системы по умолчанию, надо изменить "
"<command>default=0</command> на <command>default=1</command>."
@@ -13494,8 +13502,8 @@ msgid ""
"To change the runlevel of a single boot session, use the following "
"instructions:"
msgstr ""
-"Чтобы изменить уровень выполнения на время сеанса, следуйте "
-"следующим инструкциям:"
+"Чтобы изменить уровень выполнения на время сеанса, следуйте следующим "
+"инструкциям:"
#. Tag: para
#: Grub.xml:960
@@ -14206,13 +14214,13 @@ msgstr ""
"Interface) позволяет компьютеру взаимодействовать с устройствами хранения за "
"счет обмена запросами и ответами SCSI по TCP/IP. Так как в основу iSCSI "
"положены стандартные протоколы SCSI, он использует терминологию SCSI. "
-"Устройство на шине SCSI, к которому направляются запросы и которое на них "
+"Устройство на шине SCSI, которому направляются запросы и которое на них "
"отвечает, называется <firstterm>целью</firstterm>. Устройство, отправляющее "
"запросы, называется <firstterm>инициатором</firstterm>. Другими словами, "
"диск iSCSI представляет собой цель, а программный аналог SCSI-контроллера "
"или адаптера HBA представляет собой инициатор. В этом приложении "
-"рассматривается роль Linux только в качестве инициатора: как Linux "
-"использует диски iSCSI, а не как Linux обслуживает и предоставляет доступ к "
+"рассматривается роль Linux только в качестве инициатора, то есть будет рассмотрено как Linux "
+"использует диски iSCSI, а не обслуживает и предоставляет доступ к "
"дискам iSCSI."
#. Tag: para
@@ -14335,7 +14343,7 @@ msgstr ""
"application> копирует базу данных в устанавливаемую систему и отмечает все "
"цели iSCSI, которые не используются для <filename>/</filename> так, чтобы "
"система могла автоматически авторизоваться на них. Если <filename>/</"
-"filename> размещается на цели iSCSI, <application>initrd</application> "
+"filename> размещается в цели iSCSI, <application>initrd</application> "
"авторизуется в этой цели, а <application>anaconda</application> не будет "
"включать эту цель в сценарии запуска с целью избежания одновременных попыток "
"авторизации в одной и той же цели."
@@ -14354,7 +14362,7 @@ msgid ""
msgstr ""
"Если <filename>/</filename> размещается на цели iSCSI, "
"<application>anaconda</application> заставит <application>NetworkManager</"
-"application> игнорировать любые активные в процессе установке сетевые "
+"application> игнорировать любые активные в процессе установки сетевые "
"интерфейсы. <application>initrd</application> настраивает такие интерфейсы "
"при запуске системы. Их повторная настройка приложением "
"<application>NetworkManager</application> привела бы к потере соединения "
@@ -14398,11 +14406,11 @@ msgid ""
"any iSCSI targets are used for <filename>/</filename>, or if any targets in "
"the iSCSI database are marked to be logged in to automatically."
msgstr ""
-"После монтирования корневой файловой системы и запуска различных сценариев "
-"инициализации будет вызван сценарий, который вызовет <application>iscsid</"
-"application> (если есть цели iSCSI, используемые для <filename>/</filename>, "
+"После монтирования корневой файловой системы и запуска сценариев "
+"инициализации будет запущен сценарий, который вызовет <application>iscsid</"
+"application> в случае, если есть цели iSCSI, используемые для <filename>/</filename>, "
"или в базе данных iSCSI задана автоматическая авторизация для каких-либо "
-"целей)."
+"целей."
#. Tag: para
#: iSCSI.xml:48
@@ -14442,7 +14450,7 @@ msgid ""
msgstr ""
"Так как <application>NetworkManager</application> установлен в <filename>/"
"usr</filename>, с его помощью нельзя настроить сетевой доступ, если "
-"<filename>/usr</filename> расположен на подключенной к сети цели iSCSI."
+"<filename>/usr</filename> расположен в подключенной к сети цели iSCSI."
#. Tag: para
#: iSCSI.xml:58
@@ -14453,7 +14461,7 @@ msgid ""
"application>, <application>iscsiadm</application> will start "
"<application>iscsid</application> in turn."
msgstr ""
-"<application>iscsid</application> не будет запускаться, если в нем нет "
+"<application>iscsid</application> не будет запускаться, если в этом нет "
"необходимости. Если же вы запустили приложение <application>iscsiadm</"
"application>, оно запустит <application>iscsid</application>."
@@ -14466,8 +14474,8 @@ msgid ""
"for the keyboard you would prefer to use for the installation and as the "
"system default (refer to the figure below)."
msgstr ""
-"С помощью мыши выберите раскладку клавиатуры (например, Russian), которую вы "
-"желаете использовать для установки и назначить в системе по умолчанию (см. "
+"Выберите раскладку клавиатуры (например, Russian), которую вы "
+"хотите использовать для установки и назначить в системе по умолчанию (см. "
"рисунок)."
# Keyboard configuration screen.
@@ -14497,7 +14505,7 @@ msgstr ""
"Например, большинство европейских языков будут включать вариант раскладки "
"<literal>latin1</literal>, что позволяет использовать некоторые клавиши для "
"ввода нестандартных символов. Так, чтобы ввести <literal>é</literal>, надо "
-"будет нажать и отпустить клавишу <keycap>'</keycap>, а затем <literal>E</"
+"нажать и отпустить клавишу <keycap>'</keycap>, а затем <literal>E</"
"literal>. На других же раскладках этот символ можно ввести нажав комбинацию "
"клавиш (например, <keycap>Alt-Gr</keycap>) и <literal>E</literal>. Третьи "
"раскладки вообще могут иметь эту букву по умолчанию."
@@ -14774,7 +14782,7 @@ msgid ""
"The section order is:"
msgstr ""
"Секции файла должны быть строго <emphasis>упорядочены</emphasis>. Элементы "
-"внутри секций могут быть в любом порядке. Порядок секций следующий:"
+"внутри секций могут быть в любом порядке. Порядок секций следующий: "
#. Tag: para
#: Kickstart2.xml:100
@@ -14930,7 +14938,7 @@ msgid ""
"arguments for the command."
msgstr ""
"Если за параметром указан знак равенства (=), после него должно быть указано "
-"значение. В приведенных примерах команд параметры, указанные в скобках ([ ]) "
+"значение. В приведенных примерах команд параметры в скобках ([ ]) "
"являются необязательными."
# <command>updates</command>
@@ -15019,9 +15027,7 @@ msgstr ""
msgid ""
"The <literal>ignoredisk</literal> option is also useful if you have multiple "
"paths to your disks."
-msgstr ""
-"Параметр <literal>ignoredisk</literal> может пригодиться в случае, если "
-"существует несколько путей к дискам."
+msgstr "Параметр <literal>ignoredisk</literal> может пригодиться при наличии нескольких путей к дискам."
#. Tag: para
#: Kickstart2.xml:259
@@ -15242,8 +15248,7 @@ msgid ""
"passwords to an LDAP server before authentication."
msgstr ""
"<command>--enableldaptls</command> — разрешает использовать при "
-"обращении к серверу протокол безопасности на транспортном уровне (TLS, "
-"Transport Layer Security). Этот параметр позволяет передавать зашифрованные "
+"обращении к серверу протокол TLS (Transport Layer Security). Этот параметр позволяет передавать зашифрованные "
"имена пользователей и пароли серверу LDAP до их аутентификации."
#. Tag: para
@@ -15298,8 +15303,8 @@ msgid ""
msgstr ""
"<command>--krb5adminserver=</command> — сервер KDC в вашей области, "
"также выполняющий процесс kadmind. Этот сервер обрабатывает смену паролей и "
-"другие административные запросы. Процесс должен быть запущен на главном "
-"сервере KDC, если у вас несколько таких серверов."
+"другие административные запросы. Если есть несколько таких серверов, процесс должен быть запущен на главном "
+"сервере KDC."
#. Tag: para
#: Kickstart2.xml:403
@@ -15623,8 +15628,8 @@ msgid ""
"installation program does not ask if it should initialize the disk label if "
"installing to a brand new hard drive."
msgstr ""
-"<command>--initlabel</command> — задает метку диска, как принято по "
-"умолчанию в архитектуре вашего компьютера (например, <command>msdos</"
+"<command>--initlabel</command> — задает метку диска, которая используется по "
+"умолчанию для заданной архитектуры (например, <command>msdos</"
"command> для x86 и <command>gpt</command> для Itanium). Может применяться "
"для того, чтобы программа установки не запрашивала, инициализировать ли "
"метку диска при установке на совершенно новый жесткий диск."
@@ -15666,9 +15671,9 @@ msgid ""
"Any prompts for interaction halts the install. This mode is useful on IBM "
"System z systems with the x3270 console."
msgstr ""
-"Выполняет установку в полностью неинтерактивном режиме командной строки. "
+"Выполняет установку в неинтерактивном режиме командной строки. "
"Любой запрос взаимодействия приводит к прекращению установки. Этот режим "
-"полезен для платформ System z с консолью x3270."
+"может использоваться для платформ System z с консолью x3270."
# <command>vnc</command>
#. Tag: term
@@ -15695,7 +15700,7 @@ msgid ""
"modules, is in this format:"
msgstr ""
"В большинстве компьютеров с шиной PCI программа установки автоматически "
-"корректно определяет Ethernet и SCSI-платы. На старых компьютерах и в "
+"определяет Ethernet и SCSI-платы. На старых компьютерах и в "
"некоторых конфигурациях PCI, тем не менее, кикстарт-установке потребуется "
"помощь при определении соответствующих устройств. Команда <command>device</"
"command>, указывающая программе установки подключить дополнительные модули, "
@@ -15721,7 +15726,7 @@ msgid ""
"<command>scsi</command> or <command>eth</command>."
msgstr ""
"<replaceable><тип></replaceable> — может принимать значения "
-"<command>scsi</command> или <command>eth</command>"
+"<command>scsi</command> и <command>eth</command>"
#. Tag: para
#: Kickstart2.xml:624
14 years, 2 months
web/html/docs/selinux-faq/images - New directory
by sradvan
Author: sradvan
Update of /cvs/fedora/web/html/docs/selinux-faq/images
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv24845/images
Log Message:
Directory /cvs/fedora/web/html/docs/selinux-faq/images added to the repository
14 years, 2 months
web/html/docs/selinux-faq/Common_Content/images 1.png, NONE, 1.1 1.svg, NONE, 1.1 10.png, NONE, 1.1 10.svg, NONE, 1.1 11.png, NONE, 1.1 11.svg, NONE, 1.1 12.png, NONE, 1.1 12.svg, NONE, 1.1 13.png, NONE, 1.1 13.svg, NONE, 1.1 14.png, NONE, 1.1 14.svg, NONE, 1.1 15.png, NONE, 1.1 15.svg, NONE, 1.1 16.png, NONE, 1.1 16.svg, NONE, 1.1 17.png, NONE, 1.1 17.svg, NONE, 1.1 18.png, NONE, 1.1 18.svg, NONE, 1.1 19.png, NONE, 1.1 19.svg, NONE, 1.1 2.png, NONE, 1.1 2.svg, NONE, 1.1 20.png, NONE, 1.1 20.svg, NONE, 1.1
by sradvan
Author: sradvan
Update of /cvs/fedora/web/html/docs/selinux-faq/Common_Content/images
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv24789
Added Files:
1.png 1.svg 10.png 10.svg 11.png 11.svg 12.png 12.svg 13.png
13.svg 14.png 14.svg 15.png 15.svg 16.png 16.svg 17.png 17.svg
18.png 18.svg 19.png 19.svg 2.png 2.svg 20.png 20.svg 21.png
21.svg 22.png 22.svg 23.png 23.svg 3.png 3.svg 4.png 4.svg
5.png 5.svg 6.png 6.svg 7.png 7.svg 8.png 8.svg 9.png 9.svg
bkgrnd_greydots.png bullet_arrowblue.png documentation.png
dot.png dot2.png h1-bg.png image_left.png image_right.png
important.png important.svg logo.png note.png note.svg
shade.png shine.png stock-go-back.png stock-go-forward.png
stock-go-up.png stock-home.png title_logo.png title_logo.svg
warning.png warning.svg watermark-draft.png
Log Message:
--- NEW FILE 1.svg ---
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
xmlns:svg="http://www.w3.org/2000/svg"
xmlns="http://www.w3.org/2000/svg"
version="1.0"
width="32"
height="32"
id="svg2">
<defs
id="defs15" />
<circle
cx="16"
cy="16"
r="14"
id="circle"
style="fill:#aa0000" />
<path
d="M 17.993,22.013004 L 17.993,10.113004 L 15.239,10.113004 C 14.899001,11.218003 14.286999,11.643004 12.757,11.728004 L 12.757,13.819004 L 14.763,13.819004 L 14.763,22.013004 L 17.993,22.013004"
id="text2207"
style="fill:#ffffff" />
</svg>
--- NEW FILE 10.svg ---
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
xmlns:svg="http://www.w3.org/2000/svg"
xmlns="http://www.w3.org/2000/svg"
version="1.0"
width="32"
height="32"
id="svg2">
<defs
id="defs15" />
<circle
cx="16"
cy="16"
r="14"
id="circle"
style="fill:#aa0000" />
<path
d="M 12.252562,22 L 12.252562,10.1 L 9.4985624,10.1 C 9.1585628,11.204999 8.5465609,11.63 7.0165624,11.715 L 7.0165624,13.806 L 9.0225624,13.806 L 9.0225624,22 L 12.252562,22 M 24.983438,16.033 C 24.983438,12.072004 22.705435,9.913 19.611438,9.913 C 16.517441,9.913 14.205438,12.106004 14.205438,16.067 C 14.205438,20.027996 16.483441,22.187 19.577438,22.187 C 22.671435,22.187 24.983438,19.993996 24.983438,16.033 M 21.600438,16.067 C 21.600438,18.242998 20.886437,19.348 19.611438,19.348 C 18.336439,19.348 17.588438,18.208998 17.588438,16.033 C 17.588438,13.857002 18.302439,12.752 19.577438,12.752 C 20.852437,12.752 21.600438,13.891002 21.600438,16.067"
id="text2219"
style="fill:#ffffff" />
</svg>
--- NEW FILE 11.svg ---
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
xmlns:svg="http://www.w3.org/2000/svg"
xmlns="http://www.w3.org/2000/svg"
version="1.0"
width="32"
height="32"
id="svg2">
<defs
id="defs15" />
<circle
cx="16"
cy="16"
r="14"
id="circle"
style="fill:#aa0000" />
<path
d="M 14.623052,22 L 14.623052,10.1 L 11.869052,10.1 C 11.529053,11.204999 10.917051,11.63 9.3870527,11.715 L 9.3870527,13.806 L 11.393052,13.806 L 11.393052,22 L 14.623052,22 M 21.794928,22 L 21.794928,10.1 L 19.040928,10.1 C 18.700928,11.204999 18.088926,11.63 16.558928,11.715 L 16.558928,13.806 L 18.564928,13.806 L 18.564928,22 L 21.794928,22"
id="text2219"
style="fill:#ffffff" />
</svg>
--- NEW FILE 12.svg ---
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
xmlns:svg="http://www.w3.org/2000/svg"
xmlns="http://www.w3.org/2000/svg"
version="1.0"
width="32"
height="32"
id="svg2">
<defs
id="defs15" />
<circle
cx="16"
cy="16"
r="14"
id="circle"
style="fill:#aa0000" />
<path
d="M 12.677562,22 L 12.677562,10.1 L 9.9235624,10.1 C 9.5835628,11.204999 8.9715609,11.63 7.4415624,11.715 L 7.4415624,13.806 L 9.4475624,13.806 L 9.4475624,22 L 12.677562,22 M 24.558438,22 L 24.558438,19.314 L 18.353438,19.314 C 18.608438,18.600001 19.27144,17.936999 21.651438,16.832 C 23.929436,15.778001 24.473438,14.825998 24.473438,13.262 C 24.473438,11.103002 22.926435,9.913 19.968438,9.913 C 17.92844,9.913 16.381436,10.491001 14.868438,11.46 L 16.381438,13.891 C 17.571437,13.092001 18.727439,12.684 19.917438,12.684 C 20.869437,12.684 21.243438,12.973001 21.243438,13.5 C 21.243438,13.976 21.056437,14.163001 19.798438,14.724 C 16.823441,16.049999 14.936438,17.988004 14.834438,22 L 24.558438,22"
id="text2219"
style="fill:#ffffff" />
</svg>
--- NEW FILE 13.svg ---
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
xmlns:svg="http://www.w3.org/2000/svg"
xmlns="http://www.w3.org/2000/svg"
version="1.0"
width="32"
height="32"
id="svg2">
<defs
id="defs15" />
<circle
cx="16"
cy="16"
r="14"
id="circle"
style="fill:#aa0000" />
<path
d="M 12.550062,22 L 12.550062,10.1 L 9.7960624,10.1 C 9.4560628,11.204999 8.8440609,11.63 7.3140624,11.715 L 7.3140624,13.806 L 9.3200624,13.806 L 9.3200624,22 L 12.550062,22 M 24.685938,18.226 C 24.685938,16.713002 23.716937,15.914 22.611938,15.659 C 23.427937,15.268 24.192938,14.638999 24.192938,13.33 C 24.192938,10.814003 22.288935,9.913 19.432938,9.913 C 17.35894,9.913 15.930937,10.610001 14.825938,11.46 L 16.389938,13.602 C 17.307937,12.939001 18.191939,12.582 19.347938,12.582 C 20.520937,12.582 20.996938,12.922001 20.996938,13.551 C 20.996938,14.332999 20.656937,14.554 19.619938,14.554 L 18.089938,14.554 L 18.089938,17.121 L 19.806938,17.121 C 21.013937,17.121 21.489938,17.427001 21.489938,18.26 C 21.489938,19.075999 20.911937,19.467 19.534938,19.467 C 18.225939,19.467 17.120937,18.973999 16.151938,18.226 L 14.451938,20.368 C 15.726937,21.489999 17.44394,22.187 19.466938,22.187 C 22.696935,22.187 24.685938,20.979997 24.685938,18.226"
id="text2219"
style="fill:#ffffff" />
</svg>
--- NEW FILE 14.svg ---
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
xmlns:svg="http://www.w3.org/2000/svg"
xmlns="http://www.w3.org/2000/svg"
version="1.0"
width="32"
height="32"
id="svg2">
<defs
id="defs15" />
<circle
cx="16"
cy="16"
r="14"
id="circle"
style="fill:#aa0000" />
<path
d="M 12.040062,22 L 12.040062,10.1 L 9.2860624,10.1 C 8.9460628,11.204999 8.3340609,11.63 6.8040624,11.715 L 6.8040624,13.806 L 8.8100624,13.806 L 8.8100624,22 L 12.040062,22 M 25.195938,19.96 L 25.195938,17.172 L 23.665938,17.172 L 23.665938,10.1 L 20.401938,10.1 L 13.992938,17.461 L 13.992938,19.875 L 20.707938,19.875 L 20.707938,22 L 23.665938,22 L 23.665938,19.96 L 25.195938,19.96 M 20.758938,13.432 C 20.724938,13.992999 20.707938,15.302001 20.707938,15.999 L 20.707938,17.172 L 19.823938,17.172 C 19.007939,17.172 18.191937,17.189 17.596938,17.223 C 18.038938,16.798 18.531939,16.253999 19.160938,15.489 L 19.330938,15.285 C 20.112937,14.350001 20.435938,13.925 20.758938,13.432"
id="text2219"
style="fill:#ffffff" />
</svg>
--- NEW FILE 15.svg ---
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
xmlns:svg="http://www.w3.org/2000/svg"
xmlns="http://www.w3.org/2000/svg"
version="1.0"
width="32"
height="32"
id="svg2">
<defs
id="defs15" />
<circle
cx="16"
cy="16"
r="14"
id="circle"
style="fill:#aa0000" />
<path
d="M 12.388562,22 L 12.388562,10.1 L 9.6345624,10.1 C 9.2945628,11.204999 8.6825609,11.63 7.1525624,11.715 L 7.1525624,13.806 L 9.1585624,13.806 L 9.1585624,22 L 12.388562,22 M 24.847438,17.852 C 24.847438,15.200003 23.164435,13.908 20.597438,13.908 C 19.407439,13.908 18.693437,14.112 18.030438,14.435 L 18.132438,12.786 L 24.133438,12.786 L 24.133438,10.1 L 15.463438,10.1 L 15.055438,16.271 L 17.877438,17.223 C 18.472437,16.798 19.067439,16.543 20.070438,16.543 C 21.090437,16.543 21.668438,17.019001 21.668438,17.937 C 21.668438,18.888999 21.107436,19.45 19.577438,19.45 C 18.302439,19.45 16.891437,18.956999 15.752438,18.277 L 14.409438,20.742 C 15.871436,21.625999 17.43544,22.187 19.492438,22.187 C 22.875435,22.187 24.847438,20.622997 24.847438,17.852"
id="text2219"
style="fill:#ffffff" />
</svg>
--- NEW FILE 16.svg ---
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
xmlns:svg="http://www.w3.org/2000/svg"
xmlns="http://www.w3.org/2000/svg"
version="1.0"
width="32"
height="32"
id="svg2">
<defs
id="defs15" />
<circle
cx="16"
cy="16"
r="14"
id="circle"
style="fill:#aa0000" />
<path
d="M 12.405562,22 L 12.405562,10.1 L 9.6515624,10.1 C 9.3115628,11.204999 8.6995609,11.63 7.1695624,11.715 L 7.1695624,13.806 L 9.1755624,13.806 L 9.1755624,22 L 12.405562,22 M 24.830438,17.903 C 24.830438,15.387003 23.096435,14.214 20.631438,14.214 C 19.203439,14.214 18.336437,14.486 17.571438,14.911 C 18.472437,13.534001 20.104441,12.616 23.215438,12.616 L 23.215438,9.913 C 16.415445,9.913 14.341438,14.112003 14.341438,17.257 C 14.341438,20.537997 16.415441,22.187 19.407438,22.187 C 22.773435,22.187 24.830438,20.588997 24.830438,17.903 M 21.651438,18.124 C 21.651438,19.075999 20.818437,19.586 19.577438,19.586 C 18.132439,19.586 17.486438,18.990999 17.486438,18.141 C 17.486438,17.206001 18.183439,16.645 19.645438,16.645 C 20.903437,16.645 21.651438,17.206001 21.651438,18.124"
id="text2219"
style="fill:#ffffff" />
</svg>
--- NEW FILE 17.svg ---
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
xmlns:svg="http://www.w3.org/2000/svg"
xmlns="http://www.w3.org/2000/svg"
version="1.0"
width="32"
height="32"
id="svg2">
<defs
id="defs15" />
<circle
cx="16"
cy="16"
r="14"
id="circle"
style="fill:#aa0000" />
<path
d="M 12.652062,22 L 12.652062,10.1 L 9.8980624,10.1 C 9.5580628,11.204999 8.9460609,11.63 7.4160624,11.715 L 7.4160624,13.806 L 9.4220624,13.806 L 9.4220624,22 L 12.652062,22 M 24.583938,12.48 L 24.583938,10.1 L 14.740938,10.1 L 14.740938,12.786 L 20.656938,12.786 C 18.36194,15.131998 17.239938,17.920004 17.205938,22 L 20.435938,22 C 20.435938,18.141004 21.098941,15.675997 24.583938,12.48"
id="text2219"
style="fill:#ffffff" />
</svg>
--- NEW FILE 18.svg ---
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
xmlns:svg="http://www.w3.org/2000/svg"
xmlns="http://www.w3.org/2000/svg"
version="1.0"
width="32"
height="32"
id="svg2">
<defs
id="defs15" />
<circle
cx="16"
cy="16"
r="14"
id="circle"
style="fill:#aa0000" />
<path
d="M 12.176062,22 L 12.176062,10.1 L 9.4220624,10.1 C 9.0820628,11.204999 8.4700609,11.63 6.9400624,11.715 L 6.9400624,13.806 L 8.9460624,13.806 L 8.9460624,22 L 12.176062,22 M 25.059938,18.294 C 25.059938,16.764002 23.971937,15.948 23.206938,15.642 C 23.954937,15.166 24.549938,14.519999 24.549938,13.449 C 24.549938,11.171002 22.526935,9.913 19.653938,9.913 C 16.780941,9.913 14.723938,11.171002 14.723938,13.449 C 14.723938,14.519999 15.352939,15.251 16.066938,15.676 C 15.301939,15.982 14.213938,16.764002 14.213938,18.294 C 14.213938,20.707998 16.287941,22.187 19.619938,22.187 C 22.951935,22.187 25.059938,20.707998 25.059938,18.294 M 21.387938,13.5 C 21.387938,14.094999 20.945937,14.639 19.653938,14.639 C 18.361939,14.639 17.885938,14.094999 17.885938,13.5 C 17.885938,12.905001 18.327939,12.31 19.619938,12.31 C 20.911937,12.31 21.387938,12.905001 21.387938,13.5 M 21.897938,18.26 C 21.897938,19.075999 21.149936,19.688 19.653938,19.688 C 18.157939,19.688 17.375938,19.075999
17.375938,18.26 C 17.375938,17.444001 18.106939,16.849 19.619938,16.849 C 21.115936,16.849 21.897938,17.444001 21.897938,18.26"
id="text2219"
style="fill:#ffffff" />
</svg>
--- NEW FILE 19.svg ---
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
xmlns:svg="http://www.w3.org/2000/svg"
xmlns="http://www.w3.org/2000/svg"
version="1.0"
width="32"
height="32"
id="svg2">
<defs
id="defs15" />
<circle
cx="16"
cy="16"
r="14"
id="circle"
style="fill:#aa0000" />
<path
d="M 12.414062,22 L 12.414062,10.1 L 9.6600624,10.1 C 9.3200628,11.204999 8.7080609,11.63 7.1780624,11.715 L 7.1780624,13.806 L 9.1840624,13.806 L 9.1840624,22 L 12.414062,22 M 24.821938,14.843 C 24.821938,11.562003 22.747935,9.913 19.755938,9.913 C 16.389941,9.913 14.332938,11.511003 14.332938,14.197 C 14.332938,16.712997 16.06694,17.886 18.531938,17.886 C 19.959937,17.886 20.826939,17.614 21.591938,17.189 C 20.690939,18.565999 19.058935,19.484 15.947938,19.484 L 15.947938,22.187 C 22.747931,22.187 24.821938,17.987997 24.821938,14.843 M 21.676938,13.959 C 21.676938,14.893999 20.979936,15.455 19.517938,15.455 C 18.259939,15.455 17.511938,14.893999 17.511938,13.976 C 17.511938,13.024001 18.344939,12.514 19.585938,12.514 C 21.030936,12.514 21.676938,13.109001 21.676938,13.959"
id="text2219"
style="fill:#ffffff" />
</svg>
--- NEW FILE 2.svg ---
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
xmlns:svg="http://www.w3.org/2000/svg"
xmlns="http://www.w3.org/2000/svg"
version="1.0"
width="32"
height="32"
id="svg2">
<defs
id="defs15" />
<circle
cx="16"
cy="16"
r="14"
id="circle"
style="fill:#aa0000" />
<path
d="M 20.862,22.013004 L 20.862,19.327004 L 14.657,19.327004 C 14.912,18.613005 15.575003,17.950003 17.955,16.845004 C 20.232998,15.791005 20.777,14.839003 20.777,13.275004 C 20.777,11.116006 19.229997,9.9260043 16.272,9.9260043 C 14.232002,9.9260043 12.684999,10.504005 11.172,11.473004 L 12.685,13.904004 C 13.874999,13.105005 15.031001,12.697004 16.221,12.697004 C 17.172999,12.697004 17.547,12.986005 17.547,13.513004 C 17.547,13.989004 17.359999,14.176005 16.102,14.737004 C 13.127003,16.063003 11.24,18.001008 11.138,22.013004 L 20.862,22.013004"
id="text2207"
style="fill:#ffffff" />
</svg>
--- NEW FILE 20.svg ---
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
xmlns:svg="http://www.w3.org/2000/svg"
xmlns="http://www.w3.org/2000/svg"
version="1.0"
width="32"
height="32"
id="svg2">
<defs
id="defs15" />
<circle
cx="16"
cy="16"
r="14"
id="circle"
style="fill:#aa0000" />
<path
d="M 14.685,22 L 14.685,19.314 L 8.4799999,19.314 C 8.7349997,18.600001 9.3980023,17.936999 11.778,16.832 C 14.055998,15.778001 14.6,14.825998 14.6,13.262 C 14.6,11.103002 13.052997,9.913 10.095,9.913 C 8.055002,9.913 6.5079984,10.491001 4.9949999,11.46 L 6.5079999,13.891 C 7.6979988,13.092001 8.8540011,12.684 10.044,12.684 C 10.995999,12.684 11.37,12.973001 11.37,13.5 C 11.37,13.976 11.182999,14.163001 9.9249999,14.724 C 6.9500029,16.049999 5.0629998,17.988004 4.9609999,22 L 14.685,22 M 27.421719,16.033 C 27.421719,12.072004 25.143716,9.913 22.049719,9.913 C 18.955722,9.913 16.643719,12.106004 16.643719,16.067 C 16.643719,20.027996 18.921722,22.187 22.015719,22.187 C 25.109716,22.187 27.421719,19.993996 27.421719,16.033 M 24.038719,16.067 C 24.038719,18.242998 23.324717,19.348 22.049719,19.348 C 20.77472,19.348 20.026719,18.208998 20.026719,16.033 C 20.026719,13.857002 20.74072,12.752 22.015719,12.752 C 23.290717,12.752 24.038719,13.891002 24.038719,16.067"
id="text2219"
style="fill:#ffffff" />
</svg>
--- NEW FILE 21.svg ---
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
xmlns:svg="http://www.w3.org/2000/svg"
xmlns="http://www.w3.org/2000/svg"
version="1.0"
width="32"
height="32"
id="svg2">
<defs
id="defs15" />
<circle
cx="16"
cy="16"
r="14"
id="circle"
style="fill:#aa0000" />
<path
d="M 16.648141,22 L 16.648141,19.314 L 10.44314,19.314 C 10.69814,18.600001 11.361143,17.936999 13.741141,16.832 C 16.019139,15.778001 16.563141,14.825998 16.563141,13.262 C 16.563141,11.103002 15.016138,9.913 12.058141,9.913 C 10.018143,9.913 8.471139,10.491001 6.9581405,11.46 L 8.4711405,13.891 C 9.661139,13.092001 10.817142,12.684 12.007141,12.684 C 12.95914,12.684 13.333141,12.973001 13.333141,13.5 C 13.333141,13.976 13.14614,14.163001 11.88814,14.724 C 8.9131435,16.049999 7.0261404,17.988004 6.9241405,22 L 16.648141,22 M 23.82586,22 L 23.82586,10.1 L 21.07186,10.1 C 20.73186,11.204999 20.119858,11.63 18.58986,11.715 L 18.58986,13.806 L 20.59586,13.806 L 20.59586,22 L 23.82586,22"
id="text2219"
style="fill:#ffffff" />
</svg>
--- NEW FILE 22.svg ---
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
xmlns:svg="http://www.w3.org/2000/svg"
xmlns="http://www.w3.org/2000/svg"
version="1.0"
width="32"
height="32"
id="svg2">
<defs
id="defs15" />
<circle
cx="16"
cy="16"
r="14"
id="circle"
style="fill:#aa0000" />
<path
d="M 14.685,22 L 14.685,19.314 L 8.4799999,19.314 C 8.7349997,18.600001 9.3980023,17.936999 11.778,16.832 C 14.055998,15.778001 14.6,14.825998 14.6,13.262 C 14.6,11.103002 13.052997,9.913 10.095,9.913 C 8.055002,9.913 6.5079984,10.491001 4.9949999,11.46 L 6.5079999,13.891 C 7.6979988,13.092001 8.8540011,12.684 10.044,12.684 C 10.995999,12.684 11.37,12.973001 11.37,13.5 C 11.37,13.976 11.182999,14.163001 9.9249999,14.724 C 6.9500029,16.049999 5.0629998,17.988004 4.9609999,22 L 14.685,22 M 26.571719,22 L 26.571719,19.314 L 20.366719,19.314 C 20.621718,18.600001 21.284721,17.936999 23.664719,16.832 C 25.942716,15.778001 26.486719,14.825998 26.486719,13.262 C 26.486719,11.103002 24.939716,9.913 21.981719,9.913 C 19.941721,9.913 18.394717,10.491001 16.881719,11.46 L 18.394719,13.891 C 19.584718,13.092001 20.74072,12.684 21.930719,12.684 C 22.882718,12.684 23.256719,12.973001 23.256719,13.5 C 23.256719,13.976 23.069717,14.163001 21.811719,14.724 C 18.836722,16.049999 16.949719
,17.988004 16.847719,22 L 26.571719,22"
id="number"
style="fill:#ffffff" />
</svg>
--- NEW FILE 23.svg ---
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
xmlns:svg="http://www.w3.org/2000/svg"
xmlns="http://www.w3.org/2000/svg"
version="1.0"
width="32"
height="32"
id="svg2">
<defs
id="defs15" />
<circle
cx="16"
cy="16"
r="14"
id="circle"
style="fill:#aa0000" />
<path
d="M 15.32239,22.013004 L 15.32239,19.327004 L 9.1173907,19.327004 C 9.3723904,18.613005 10.035393,17.950003 12.41539,16.845004 C 14.693388,15.791005 15.23739,14.839003 15.23739,13.275004 C 15.23739,11.116006 13.690387,9.9260043 10.73239,9.9260043 C 8.6923927,9.9260043 7.1453891,10.504005 5.6323906,11.473004 L 7.1453906,13.904004 C 8.3353896,13.105005 9.4913919,12.697004 10.68139,12.697004 C 11.633389,12.697004 12.00739,12.986005 12.00739,13.513004 C 12.00739,13.989004 11.820389,14.176005 10.56239,14.737004 C 7.5873937,16.063003 5.7003905,18.001008 5.5983906,22.013004 L 15.32239,22.013004 M 26.401609,18.239004 C 26.401609,16.726006 25.432608,15.927004 24.327609,15.672004 C 25.143608,15.281005 25.908609,14.652003 25.908609,13.343004 C 25.908609,10.827007 24.004606,9.9260043 21.148609,9.9260043 C 19.074611,9.9260043 17.646608,10.623005 16.541609,11.473004 L 18.105609,13.615004 C 19.023608,12.952005 19.90761,12.595004 21.063609,12.595004 C 22.236608,12.595004 22.712609,12.9
35005 22.712609,13.564004 C 22.712609,14.346004 22.372608,14.567004 21.335609,14.567004 L 19.805609,14.567004 L 19.805609,17.134004 L 21.522609,17.134004 C 22.729608,17.134004 23.205609,17.440005 23.205609,18.273004 C 23.205609,19.089003 22.627608,19.480004 21.250609,19.480004 C 19.94161,19.480004 18.836608,18.987004 17.867609,18.239004 L 16.167609,20.381004 C 17.442608,21.503003 19.159611,22.200004 21.182609,22.200004 C 24.412606,22.200004 26.401609,20.993002 26.401609,18.239004"
id="text2207"
style="fill:#ffffff" />
</svg>
--- NEW FILE 3.svg ---
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
xmlns:svg="http://www.w3.org/2000/svg"
xmlns="http://www.w3.org/2000/svg"
version="1.0"
width="32"
height="32"
id="svg2">
<defs
id="defs15" />
<circle
cx="16"
cy="16"
r="14"
id="circle"
style="fill:#aa0000" />
<path
d="M 21.117,18.239004 C 21.117,16.726006 20.147999,15.927004 19.043,15.672004 C 19.858999,15.281005 20.624,14.652003 20.624,13.343004 C 20.624,10.827007 18.719997,9.9260043 15.864,9.9260043 C 13.790002,9.9260043 12.361999,10.623005 11.257,11.473004 L 12.821,13.615004 C 13.738999,12.952005 14.623001,12.595004 15.779,12.595004 C 16.951999,12.595004 17.428,12.935005 17.428,13.564004 C 17.428,14.346004 17.087999,14.567004 16.051,14.567004 L 14.521,14.567004 L 14.521,17.134004 L 16.238,17.134004 C 17.444999,17.134004 17.921,17.440005 17.921,18.273004 C 17.921,19.089003 17.342999,19.480004 15.966,19.480004 C 14.657002,19.480004 13.551999,18.987004 12.583,18.239004 L 10.883,20.381004 C 12.157999,21.503003 13.875002,22.200004 15.898,22.200004 C 19.127997,22.200004 21.117,20.993002 21.117,18.239004"
id="text2207"
style="fill:#ffffff" />
</svg>
--- NEW FILE 4.svg ---
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
xmlns:svg="http://www.w3.org/2000/svg"
xmlns="http://www.w3.org/2000/svg"
version="1.0"
width="32"
height="32"
id="svg2">
<defs
id="defs15" />
<circle
cx="16"
cy="16"
r="14"
id="circle"
style="fill:#aa0000" />
<path
d="M 20.573772,19.96 L 20.573772,17.172 L 19.043772,17.172 L 19.043772,10.1 L 15.779772,10.1 L 9.3707718,17.461 L 9.3707718,19.875 L 16.085772,19.875 L 16.085772,22 L 19.043772,22 L 19.043772,19.96 L 20.573772,19.96 M 16.136772,13.432 C 16.102772,13.992999 16.085772,15.302001 16.085772,15.999 L 16.085772,17.172 L 15.201772,17.172 C 14.385773,17.172 13.569771,17.189 12.974772,17.223 C 13.416772,16.798 13.909773,16.253999 14.538772,15.489 L 14.708772,15.285 C 15.490771,14.350001 15.813772,13.925 16.136772,13.432"
id="text2219"
style="fill:#ffffff" />
</svg>
--- NEW FILE 5.svg ---
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
xmlns:svg="http://www.w3.org/2000/svg"
xmlns="http://www.w3.org/2000/svg"
version="1.0"
width="32"
height="32"
id="svg2">
<defs
id="defs15" />
<circle
cx="16"
cy="16"
r="14"
id="circle"
style="fill:#aa0000" />
<path
d="M 21.219,17.852 C 21.219,15.200003 19.535997,13.908 16.969,13.908 C 15.779001,13.908 15.064999,14.112 14.402,14.435 L 14.504,12.786 L 20.505,12.786 L 20.505,10.1 L 11.835,10.1 L 11.427,16.271 L 14.249,17.223 C 14.843999,16.798 15.439001,16.543 16.442,16.543 C 17.461999,16.543 18.04,17.019001 18.04,17.937 C 18.04,18.888999 17.478998,19.45 15.949,19.45 C 14.674001,19.45 13.262999,18.956999 12.124,18.277 L 10.781,20.742 C 12.242999,21.625999 13.807002,22.187 15.864,22.187 C 19.246997,22.187 21.219,20.622997 21.219,17.852"
id="text2219"
style="fill:#ffffff" />
</svg>
--- NEW FILE 6.svg ---
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
xmlns:svg="http://www.w3.org/2000/svg"
xmlns="http://www.w3.org/2000/svg"
version="1.0"
width="32"
height="32"
id="svg2">
<defs
id="defs15" />
<circle
cx="16"
cy="16"
r="14"
id="circle"
style="fill:#aa0000" />
<path
d="M 21.2445,17.903 C 21.2445,15.387003 19.510497,14.214 17.0455,14.214 C 15.617501,14.214 14.750499,14.486 13.9855,14.911 C 14.886499,13.534001 16.518503,12.616 19.6295,12.616 L 19.6295,9.913 C 12.829507,9.913 10.7555,14.112003 10.7555,17.257 C 10.7555,20.537997 12.829503,22.187 15.8215,22.187 C 19.187497,22.187 21.2445,20.588997 21.2445,17.903 M 18.0655,18.124 C 18.0655,19.075999 17.232499,19.586 15.9915,19.586 C 14.546501,19.586 13.9005,18.990999 13.9005,18.141 C 13.9005,17.206001 14.597501,16.645 16.0595,16.645 C 17.317499,16.645 18.0655,17.206001 18.0655,18.124"
id="text2219"
style="fill:#ffffff" />
</svg>
--- NEW FILE 7.svg ---
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
xmlns:svg="http://www.w3.org/2000/svg"
xmlns="http://www.w3.org/2000/svg"
version="1.0"
width="32"
height="32"
id="svg2">
<defs
id="defs15" />
<circle
cx="16"
cy="16"
r="14"
id="circle"
style="fill:#aa0000" />
<path
d="M 20.9215,12.48 L 20.9215,10.1 L 11.0785,10.1 L 11.0785,12.786 L 16.9945,12.786 C 14.699502,15.131998 13.5775,17.920004 13.5435,22 L 16.7735,22 C 16.7735,18.141004 17.436503,15.675997 20.9215,12.48"
id="text2219"
style="fill:#ffffff" />
</svg>
--- NEW FILE 8.svg ---
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
xmlns:svg="http://www.w3.org/2000/svg"
xmlns="http://www.w3.org/2000/svg"
version="1.0"
width="32"
height="32"
id="svg2">
<defs
id="defs15" />
<circle
cx="16"
cy="16"
r="14"
id="circle"
style="fill:#aa0000" />
<path
d="M 21.423,18.294 C 21.423,16.764002 20.334999,15.948 19.57,15.642 C 20.317999,15.166 20.913,14.519999 20.913,13.449 C 20.913,11.171002 18.889997,9.913 16.017,9.913 C 13.144003,9.913 11.087,11.171002 11.087,13.449 C 11.087,14.519999 11.716001,15.251 12.43,15.676 C 11.665001,15.982 10.577,16.764002 10.577,18.294 C 10.577,20.707998 12.651003,22.187 15.983,22.187 C 19.314997,22.187 21.423,20.707998 21.423,18.294 M 17.751,13.5 C 17.751,14.094999 17.308999,14.639 16.017,14.639 C 14.725001,14.639 14.249,14.094999 14.249,13.5 C 14.249,12.905001 14.691001,12.31 15.983,12.31 C 17.274999,12.31 17.751,12.905001 17.751,13.5 M 18.261,18.26 C 18.261,19.075999 17.512998,19.688 16.017,19.688 C 14.521001,19.688 13.739,19.075999 13.739,18.26 C 13.739,17.444001 14.470002,16.849 15.983,16.849 C 17.478998,16.849 18.261,17.444001 18.261,18.26"
id="text2219"
style="fill:#ffffff" />
</svg>
--- NEW FILE 9.svg ---
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
xmlns:svg="http://www.w3.org/2000/svg"
xmlns="http://www.w3.org/2000/svg"
version="1.0"
width="32"
height="32"
id="svg2">
<defs
id="defs15" />
<circle
cx="16"
cy="16"
r="14"
id="circle"
style="fill:#aa0000" />
<path
d="M 22.128383,14.843 C 22.128383,11.562003 20.05438,9.913 17.062383,9.913 C 13.696386,9.913 11.639383,11.511003 11.639383,14.197 C 11.639383,16.712997 13.373385,17.886 15.838383,17.886 C 17.266382,17.886 18.133384,17.614 18.898383,17.189 C 17.997384,18.565999 16.36538,19.484 13.254383,19.484 L 13.254383,22.187 C 20.054376,22.187 22.128383,17.987997 22.128383,14.843 M 18.983383,13.959 C 18.983383,14.893999 18.286381,15.455 16.824383,15.455 C 15.566384,15.455 14.818383,14.893999 14.818383,13.976 C 14.818383,13.024001 15.651384,12.514 16.892383,12.514 C 18.337381,12.514 18.983383,13.109001 18.983383,13.959"
id="text2219"
style="fill:#ffffff" />
</svg>
--- NEW FILE important.svg ---
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
xmlns:dc="http://purl.org/dc/elements/1.1/"
xmlns:cc="http://creativecommons.org/ns#"
xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
xmlns:svg="http://www.w3.org/2000/svg"
xmlns="http://www.w3.org/2000/svg"
xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
version="1.0"
width="48"
height="48"
id="svg5921"
sodipodi:version="0.32"
inkscape:version="0.46"
sodipodi:docname="important.svg"
inkscape:output_extension="org.inkscape.output.svg.inkscape"
inkscape:export-filename="/home/jfearn/Build/src/fedora/publican/trunk/publican-fedora/en-US/images/important.png"
inkscape:export-xdpi="111.32"
inkscape:export-ydpi="111.32">
<metadata
id="metadata2611">
<rdf:RDF>
<cc:Work
rdf:about="">
<dc:format>image/svg+xml</dc:format>
<dc:type
rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
</cc:Work>
</rdf:RDF>
</metadata>
<sodipodi:namedview
inkscape:window-height="681"
inkscape:window-width="738"
inkscape:pageshadow="2"
inkscape:pageopacity="0.0"
guidetolerance="10.0"
gridtolerance="10.0"
objecttolerance="10.0"
borderopacity="1.0"
bordercolor="#666666"
pagecolor="#ffffff"
id="base"
showgrid="false"
inkscape:zoom="11.5"
inkscape:cx="20"
inkscape:cy="20"
inkscape:window-x="0"
inkscape:window-y="51"
inkscape:current-layer="svg5921" />
<defs
id="defs5923">
<inkscape:perspective
sodipodi:type="inkscape:persp3d"
inkscape:vp_x="0 : 20 : 1"
inkscape:vp_y="0 : 1000 : 0"
inkscape:vp_z="40 : 20 : 1"
inkscape:persp3d-origin="20 : 13.333333 : 1"
id="perspective2613" />
</defs>
<g
transform="matrix(0.4626799,0,0,0.4626799,-5.2934127,-3.3160376)"
id="g5485">
<path
d="M 29.97756,91.885882 L 55.586992,80.409826 L 81.231619,91.807015 L 78.230933,63.90468 L 96.995009,43.037218 L 69.531053,37.26873 L 55.483259,12.974592 L 41.510292,37.311767 L 14.064204,43.164717 L 32.892392,63.97442 L 29.97756,91.885882 z"
id="path6799"
style="fill:#f3de82;fill-opacity:1;enable-background:new" />
<path
d="M 55.536215,56.538729 L 55.48324,12.974601 L 41.51028,37.311813 L 55.536215,56.538729 z"
id="path6824"
style="opacity:0.91005291;fill:#f9f2cb;fill-opacity:1;enable-background:new" />
<path
d="M 55.57947,56.614318 L 78.241135,63.937979 L 96.976198,43.044318 L 55.57947,56.614318 z"
id="use6833"
style="opacity:1;fill:#d0bc64;fill-opacity:1;enable-background:new" />
<path
d="M 55.523838,56.869126 L 55.667994,80.684281 L 81.379011,91.931065 L 55.523838,56.869126 z"
id="use6835"
style="opacity:1;fill:#e0c656;fill-opacity:1;enable-background:new" />
<path
d="M 55.283346,56.742618 L 13.877363,43.200977 L 32.640089,64.069652 L 55.283346,56.742618 z"
id="use6831"
style="opacity:1;fill:#d1ba59;fill-opacity:1;enable-background:new" />
<path
d="M 55.472076,56.869126 L 55.32792,80.684281 L 29.616903,91.931065 L 55.472076,56.869126 z"
id="use6837"
style="opacity:1;fill:#d2b951;fill-opacity:1;enable-background:new" />
<path
d="M 55.57947,56.614318 L 96.976198,43.044318 L 69.504294,37.314027 L 55.57947,56.614318 z"
id="path7073"
style="opacity:1;fill:#f6e7a3;fill-opacity:1;enable-background:new" />
<path
d="M 55.523838,56.869126 L 81.379011,91.931065 L 78.214821,64.046881 L 55.523838,56.869126 z"
id="path7075"
style="opacity:1;fill:#f6e7a3;fill-opacity:1;enable-background:new" />
<path
d="M 55.283346,56.742618 L 41.341708,37.434209 L 13.877363,43.200977 L 55.283346,56.742618 z"
id="path7077"
style="opacity:1;fill:#f6e59d;fill-opacity:1;enable-background:new" />
<path
d="M 55.472076,56.869126 L 29.616903,91.931065 L 32.781093,64.046881 L 55.472076,56.869126 z"
id="path7079"
style="opacity:1;fill:#f3df8b;fill-opacity:1;enable-background:new" />
</g>
</svg>
--- NEW FILE note.svg ---
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
xmlns:dc="http://purl.org/dc/elements/1.1/"
xmlns:cc="http://creativecommons.org/ns#"
xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
xmlns:svg="http://www.w3.org/2000/svg"
xmlns="http://www.w3.org/2000/svg"
xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
version="1.0"
width="48"
height="48"
id="svg5921"
sodipodi:version="0.32"
inkscape:version="0.46"
sodipodi:docname="note.svg"
inkscape:output_extension="org.inkscape.output.svg.inkscape"
inkscape:export-filename="/home/jfearn/Build/src/fedora/publican/trunk/publican-fedora/en-US/images/note.png"
inkscape:export-xdpi="111.32"
inkscape:export-ydpi="111.32">
<metadata
id="metadata16">
<rdf:RDF>
<cc:Work
rdf:about="">
<dc:format>image/svg+xml</dc:format>
<dc:type
rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
</cc:Work>
</rdf:RDF>
</metadata>
<sodipodi:namedview
inkscape:window-height="1024"
inkscape:window-width="1205"
inkscape:pageshadow="2"
inkscape:pageopacity="0.0"
guidetolerance="10.0"
gridtolerance="10.0"
objecttolerance="10.0"
borderopacity="1.0"
bordercolor="#666666"
pagecolor="#ffffff"
id="base"
showgrid="false"
inkscape:zoom="11.5"
inkscape:cx="22.217181"
inkscape:cy="20"
inkscape:window-x="334"
inkscape:window-y="51"
inkscape:current-layer="svg5921" />
<defs
id="defs5923">
<inkscape:perspective
sodipodi:type="inkscape:persp3d"
inkscape:vp_x="0 : 20 : 1"
inkscape:vp_y="0 : 1000 : 0"
inkscape:vp_z="40 : 20 : 1"
inkscape:persp3d-origin="20 : 13.333333 : 1"
id="perspective18" />
</defs>
<g
transform="matrix(0.468275,0,0,0.468275,-5.7626904,-7.4142703)"
id="layer1">
<g
transform="matrix(0.115136,0,0,0.115136,9.7283,21.77356)"
id="g8014"
style="enable-background:new">
<g
id="g8518"
style="opacity:1">
<path
d="M -2512.4524,56.33197 L 3090.4719,56.33197 L 3090.4719,4607.3813 L -2512.4524,4607.3813 L -2512.4524,56.33197 z"
transform="matrix(0.1104659,-2.3734892e-2,2.2163258e-2,0.1031513,308.46782,74.820675)"
id="rect8018"
style="fill:#ffe680;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.1;stroke-linecap:butt;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1" />
</g>
<g
transform="matrix(0.5141653,-7.1944682e-2,7.1944682e-2,0.5141653,146.04015,-82.639785)"
id="g8020">
<path
d="M 511.14114,441.25315 C 527.3248,533.52772 464.31248,622.82928 370.39916,640.71378 C 276.48584,658.59828 187.23462,598.29322 171.05095,506.01865 C 154.86728,413.74408 217.8796,324.44253 311.79292,306.55803 C 405.70624,288.67353 494.95747,348.97858 511.14114,441.25315 z"
id="path8022"
style="opacity:1;fill:#e0c96f;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.0804934;stroke-linecap:butt;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1" />
<path
d="M 527.8214,393.1416 C 527.8214,461.31268 472.55783,516.57625 404.38675,516.57625 C 336.21567,516.57625 280.9521,461.31268 280.9521,393.1416 C 280.9521,324.97052 336.21567,269.70695 404.38675,269.70695 C 472.55783,269.70695 527.8214,324.97052 527.8214,393.1416 z"
transform="matrix(1.2585415,-0.2300055,0.2168789,1.1867072,-248.76141,68.254424)"
id="path8024"
style="opacity:1;fill:#c00000;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.0804934;stroke-linecap:butt;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1" />
<path
d="M 358.5625,281.15625 C 348.09597,281.05155 337.43773,281.94729 326.71875,283.90625 C 240.96686,299.57789 183.37901,377.92385 198.15625,458.78125 C 209.70749,521.98673 262.12957,567.92122 325.40625,577.5625 L 357.25,433.6875 L 509.34375,405.875 C 509.14405,404.58166 509.0804,403.29487 508.84375,402 C 495.91366,331.24978 431.82821,281.88918 358.5625,281.15625 z"
id="path8026"
style="opacity:1;fill:#b60000;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.1;stroke-linecap:butt;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1" />
<path
d="M 294.2107,361.9442 L 282.79367,370.38482 L 261.73414,386.13346 C 253.13706,404.40842 254.3359,423.7989 259.7176,444.39774 C 273.6797,497.83861 313.42636,523.96124 369.50989,517.58957 C 398.21848,514.32797 424.51832,504.67345 440.64696,484.15958 L 469.89512,447.48298 L 294.2107,361.9442 z"
id="path8028"
style="fill:#750000;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.09999999;stroke-linecap:butt;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1" />
<path
d="M 527.8214,393.1416 C 527.8214,461.31268 472.55783,516.57625 404.38675,516.57625 C 336.21567,516.57625 280.9521,461.31268 280.9521,393.1416 C 280.9521,324.97052 336.21567,269.70695 404.38675,269.70695 C 472.55783,269.70695 527.8214,324.97052 527.8214,393.1416 z"
transform="matrix(0.9837071,-0.1797787,0.1695165,0.9275553,-78.013985,79.234385)"
id="path8030"
style="opacity:1;fill:#d40000;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.10298239;stroke-linecap:butt;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1" />
<path
d="M 527.8214,393.1416 C 527.8214,461.31268 472.55783,516.57625 404.38675,516.57625 C 336.21567,516.57625 280.9521,461.31268 280.9521,393.1416 C 280.9521,324.97052 336.21567,269.70695 404.38675,269.70695 C 472.55783,269.70695 527.8214,324.97052 527.8214,393.1416 z"
transform="matrix(0.9837071,-0.1797787,0.1695165,0.9275553,-69.306684,71.273294)"
id="path8032"
style="opacity:1;fill:#e11212;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.10298239;stroke-linecap:butt;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1" />
</g>
</g>
</g>
</svg>
--- NEW FILE title_logo.svg ---
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
xmlns:dc="http://purl.org/dc/elements/1.1/"
xmlns:cc="http://creativecommons.org/ns#"
xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
xmlns:svg="http://www.w3.org/2000/svg"
xmlns="http://www.w3.org/2000/svg"
xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
version="1.0"
width="220"
height="70"
id="svg6180"
sodipodi:version="0.32"
inkscape:version="0.46"
sodipodi:docname="title_logo.svg"
inkscape:output_extension="org.inkscape.output.svg.inkscape">
<metadata
id="metadata16">
<rdf:RDF>
<cc:Work
rdf:about="">
<dc:format>image/svg+xml</dc:format>
<dc:type
rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
</cc:Work>
</rdf:RDF>
</metadata>
<sodipodi:namedview
inkscape:window-height="990"
inkscape:window-width="1680"
inkscape:pageshadow="2"
inkscape:pageopacity="0.0"
guidetolerance="10.0"
gridtolerance="10.0"
objecttolerance="10.0"
borderopacity="1.0"
bordercolor="#666666"
pagecolor="#ffffff"
id="base"
showgrid="false"
showguides="true"
inkscape:guide-bbox="true"
inkscape:zoom="7.4053365"
inkscape:cx="173.22629"
inkscape:cy="36.314321"
inkscape:window-x="-5"
inkscape:window-y="-3"
inkscape:current-layer="svg6180" />
<defs
id="defs6182">
<inkscape:perspective
sodipodi:type="inkscape:persp3d"
inkscape:vp_x="0 : 35 : 1"
inkscape:vp_y="0 : 1000 : 0"
inkscape:vp_z="220 : 35 : 1"
inkscape:persp3d-origin="110 : 23.333333 : 1"
id="perspective18" />
</defs>
<g
transform="translate(-266.55899,-345.34488)"
id="layer1">
<path
d="M 316.7736,397.581 C 316.7736,397.581 316.7736,397.581 296.23471,397.581 C 296.56741,402.03345 300.15628,405.35709 304.94186,405.35709 C 308.33169,405.35709 311.25642,403.96093 313.5828,401.70202 C 314.04833,401.23523 314.58006,401.1024 315.17799,401.1024 C 315.9758,401.1024 316.7736,401.50172 317.30491,402.16628 C 317.63761,402.63181 317.83707,403.16354 317.83707,403.69485 C 317.83707,404.42603 317.50437,405.22342 316.90601,405.82219 C 314.11411,408.81271 309.39515,410.80722 304.74198,410.80722 C 296.30049,410.80722 289.52124,404.02755 289.52124,395.58564 C 289.52124,387.14415 296.10146,380.3649 304.54295,380.3649 C 312.91824,380.3649 319.16618,386.87807 319.16618,395.45239 C 319.16618,396.71657 318.03694,397.581 316.7736,397.581 z M 304.54295,385.81588 C 300.08966,385.81588 297.0321,388.74061 296.36796,392.99319 C 306.40422,392.99319 312.71879,392.99319 312.71879,392.99319 C 312.12043,388.93964 308.93005,385.81588 304.54295,385.81588 z"
id="path11"
style="fill:#3c6eb4" />
<path
d="M 375.46344,410.80807 C 367.02238,410.80807 360.2427,404.02839 360.2427,395.58648 C 360.2427,387.14499 367.02238,380.36574 375.46344,380.36574 C 383.90578,380.36574 390.68503,387.14499 390.68503,395.58648 C 390.68461,404.02797 383.90535,410.80807 375.46344,410.80807 z M 375.46344,386.14815 C 370.14656,386.14815 366.68967,390.40242 366.68967,395.58648 C 366.68967,400.77012 370.14656,405.02481 375.46344,405.02481 C 380.78075,405.02481 384.23848,400.77012 384.23848,395.58648 C 384.23806,390.40242 380.78075,386.14815 375.46344,386.14815 z"
id="path13"
style="fill:#3c6eb4" />
<path
d="M 412.66183,380.36574 C 408.2022,380.36574 405.25217,381.68474 402.64792,384.9953 L 402.40756,383.45535 L 402.40756,383.45535 C 402.20558,381.84792 400.8343,380.60609 399.17374,380.60609 C 397.37235,380.60609 395.91168,382.06509 395.91168,383.8669 C 395.91168,383.86943 395.91168,383.87196 395.91168,383.87449 L 395.91168,383.87449 L 395.91168,383.87744 L 395.91168,383.87744 L 395.91168,407.28456 C 395.91168,409.0792 397.37362,410.54199 399.16868,410.54199 C 400.96333,410.54199 402.42612,409.0792 402.42612,407.28456 L 402.42612,394.72247 C 402.42612,389.00626 407.41114,386.14815 412.66225,386.14815 C 414.25744,386.14815 415.51951,384.81862 415.51951,383.223 C 415.51951,381.62739 414.25744,380.36574 412.66183,380.36574 z"
id="path15"
style="fill:#3c6eb4" />
<path
d="M 447.02614,395.58648 C 447.09277,387.41107 441.24288,380.36574 431.80414,380.36574 C 423.36222,380.36574 416.51635,387.14499 416.51635,395.58648 C 416.51635,404.02839 423.16319,410.80807 431.2062,410.80807 C 435.22054,410.80807 438.83302,408.74186 440.44466,406.58289 L 441.23825,408.59723 L 441.23825,408.59723 C 441.66414,409.729 442.75585,410.5344 444.03605,410.5344 C 445.68606,410.5344 447.02361,409.19769 447.02614,407.54895 L 447.02614,407.54895 L 447.02614,399.74208 L 447.02614,399.74208 L 447.02614,395.58648 z M 431.80414,405.02481 C 426.48641,405.02481 423.02995,400.77012 423.02995,395.58648 C 423.02995,390.40242 426.48599,386.14815 431.80414,386.14815 C 437.12144,386.14815 440.57833,390.40242 440.57833,395.58648 C 440.57833,400.77012 437.12144,405.02481 431.80414,405.02481 z"
id="path17"
style="fill:#3c6eb4" />
<path
d="M 355.01479,368.3337 C 355.01479,366.5399 353.55285,365.14373 351.7582,365.14373 C 349.96398,365.14373 348.50077,366.54032 348.50077,368.3337 L 348.50077,385.4836 C 346.8398,382.42604 343.25051,380.36574 338.99582,380.36574 C 330.3553,380.36574 324.57246,386.87892 324.57246,395.58648 C 324.57246,404.29405 330.55475,410.80807 338.99582,410.80807 C 342.76137,410.80807 346.02639,409.25378 347.98169,406.55253 L 348.70486,408.38681 C 349.15268,409.64593 350.35403,410.54705 351.76537,410.54705 C 353.55158,410.54705 355.01521,409.0927 355.01521,407.2989 C 355.01521,407.29384 355.01521,407.29004 355.01521,407.28498 L 355.01521,407.28498 L 355.01521,368.3337 L 355.01479,368.3337 z M 339.79363,405.02481 C 334.47632,405.02481 331.08648,400.77012 331.08648,395.58648 C 331.08648,390.40242 334.47632,386.14815 339.79363,386.14815 C 345.11136,386.14815 348.50077,390.20255 348.50077,395.58648 C 348.50077,400.96957 345.11136,405.02481 339.79363,405.02481 z"
id="path19"
style="fill:#3c6eb4" />
<path
d="M 287.21553,365.34023 C 286.62139,365.25253 286.01587,365.20825 285.41456,365.20825 C 278.68338,365.20825 273.2071,370.68495 273.2071,377.41613 L 273.2071,381.22933 L 269.21807,381.22933 C 267.7557,381.22933 266.55899,382.42604 266.55899,383.88714 C 266.55899,385.35035 267.7557,386.82452 269.21807,386.82452 L 273.20626,386.82452 L 273.20626,407.28456 C 273.20626,409.0792 274.66862,410.54199 276.46284,410.54199 C 278.25791,410.54199 279.72028,409.0792 279.72028,407.28456 L 279.72028,386.82452 L 284.13014,386.82452 C 285.59208,386.82452 286.78837,385.35035 286.78837,383.88714 C 286.78837,382.42562 285.59208,381.22891 284.13014,381.22891 L 279.72281,381.22891 L 279.72281,377.41571 C 279.72281,374.27719 282.27604,371.30102 285.41456,371.30102 C 285.6975,371.30102 285.98213,371.3221 286.26128,371.363 C 288.04159,371.62655 289.69708,370.82031 289.96147,369.03958 C 290.22417,367.26054 288.99541,365.6042 287.21553,365.34023 z"
id="path21"
style="fill:#3c6eb4" />
<path
d="M 482.01243,363.57426 C 482.01243,353.50638 473.85135,345.34488 463.78346,345.34488 C 453.72064,345.34488 445.56167,353.49963 445.55492,363.56119 L 445.5545,363.56077 L 445.5545,377.66787 L 445.55492,377.66829 C 445.5604,379.95292 447.41324,381.80238 449.69955,381.80238 C 449.7063,381.80238 449.71221,381.80154 449.71895,381.80154 L 449.72022,381.80238 L 463.79105,381.80238 L 463.79105,381.80238 C 473.85514,381.79817 482.01243,373.63962 482.01243,363.57426 z"
id="path25"
style="fill:#294172" />
<path
d="M 469.13577,349.66577 C 464.41049,349.66577 460.58001,353.49626 460.58001,358.22154 C 460.58001,358.22322 460.58001,358.22533 460.58001,358.22744 L 460.58001,362.7558 L 456.06557,362.7558 C 456.06472,362.7558 456.06472,362.7558 456.0643,362.7558 C 451.33902,362.7558 447.50854,366.56773 447.50854,371.29258 C 447.50854,376.01786 451.33902,379.84835 456.0643,379.84835 C 460.78916,379.84835 464.61964,376.01786 464.61964,371.29258 C 464.61964,371.2909 464.61964,371.28879 464.61964,371.28668 L 464.61964,366.73935 L 469.13408,366.73935 C 469.13493,366.73935 469.13535,366.73935 469.13577,366.73935 C 473.86063,366.73935 477.69111,362.94639 477.69111,358.22154 C 477.69111,353.49626 473.86063,349.66577 469.13577,349.66577 z M 460.58001,371.3006 C 460.57621,373.79058 458.55555,375.80871 456.0643,375.80871 C 453.57052,375.80871 451.53004,373.78678 451.53004,371.29301 C 451.53004,368.7988 453.57052,366.73935 456.0643,366.73935 C 456.06641,366.73935 456.06852,366.73977 456.0702,36
6.73977 L 459.93991,366.73977 C 459.94117,366.73977 459.94201,366.73935 459.94286,366.73935 C 460.29495,366.73935 460.58085,367.0244 460.58085,367.3765 C 460.58085,367.37692 460.58043,367.37734 460.58043,367.37776 L 460.58043,371.3006 L 460.58001,371.3006 z M 469.13535,362.7558 C 469.13408,362.7558 469.1324,362.7558 469.13113,362.7558 L 465.2589,362.7558 C 465.25806,362.7558 465.25721,362.7558 465.25679,362.7558 C 464.90427,362.7558 464.61922,362.47074 464.61922,362.11822 L 464.61922,362.1178 L 464.61922,358.21437 C 464.62344,355.72354 466.64368,353.70583 469.13493,353.70583 C 471.62871,353.70583 473.66961,355.72776 473.66961,358.22196 C 473.67003,360.71532 471.62913,362.7558 469.13535,362.7558 z"
id="path29"
style="fill:#3c6eb4" />
<path
d="M 460.58001,362.7558 L 460.58001,358.22744 C 460.58001,358.22533 460.58001,358.22322 460.58001,358.22154 C 460.58001,353.49626 464.41049,349.66577 469.13577,349.66577 C 469.85262,349.66577 470.362,349.74631 471.02529,349.92046 C 471.99303,350.17431 472.78325,350.96664 472.78367,351.88968 C 472.78409,353.00543 471.97448,353.81589 470.76427,353.81589 C 470.18785,353.81589 469.97954,353.70541 469.13535,353.70541 C 466.6441,353.70541 464.62386,355.72312 464.61964,358.21395 L 464.61964,362.1178 L 464.61964,362.11822 C 464.61964,362.47074 464.90469,362.7558 465.25721,362.7558 C 465.25764,362.7558 465.25848,362.7558 465.25932,362.7558 L 468.22453,362.7558 C 469.32974,362.7558 470.222,363.64047 470.22285,364.74863 C 470.22285,365.85679 469.32932,366.73977 468.22453,366.73977 L 464.61964,366.73977 L 464.61964,371.2871 C 464.61964,371.28921 464.61964,371.29132 464.61964,371.29343 C 464.61964,376.01828 460.78916,379.84877 456.0643,379.84877 C 455.34746,379.84877 454.83807,379.
76823 454.17478,379.59408 C 453.20704,379.34065 452.4164,378.5479 452.41598,377.62528 C 452.41598,376.50953 453.22517,375.69865 454.4358,375.69865 C 455.0118,375.69865 455.22053,375.80913 456.0643,375.80913 C 458.55555,375.80913 460.57621,373.79142 460.58043,371.30102 C 460.58043,371.30102 460.58043,367.37734 460.58043,367.37692 C 460.58043,367.02524 460.29453,366.74019 459.94244,366.74019 C 459.94201,366.74019 459.94159,366.74019 459.94075,366.74019 L 456.97554,366.73977 C 455.87033,366.73977 454.97723,365.85763 454.97723,364.74947 C 454.9768,363.63414 455.87961,362.7558 456.99662,362.7558 L 460.58001,362.7558 L 460.58001,362.7558 z"
id="path31"
style="fill:#ffffff" />
<path
d="M 477.41661,378.55292 L 480.23219,378.55292 L 480.23219,378.9319 L 479.05067,378.9319 L 479.05067,381.88125 L 478.59813,381.88125 L 478.59813,378.9319 L 477.41661,378.9319 L 477.41661,378.55292 M 480.67805,378.55292 L 481.34906,378.55292 L 482.19843,380.81788 L 483.05224,378.55292 L 483.72326,378.55292 L 483.72326,381.88125 L 483.28409,381.88125 L 483.28409,378.95865 L 482.42581,381.24144 L 481.97326,381.24144 L 481.11499,378.95865 L 481.11499,381.88125 L 480.67805,381.88125 L 480.67805,378.55292"
id="text6223"
style="fill:#294172;enable-background:new" />
</g>
<path
d="M 181.98344,61.675273 L 184.79902,61.675273 L 184.79902,62.054253 L 183.6175,62.054253 L 183.6175,65.003603 L 183.16496,65.003603 L 183.16496,62.054253 L 181.98344,62.054253 L 181.98344,61.675273 M 185.24488,61.675273 L 185.91589,61.675273 L 186.76526,63.940233 L 187.61907,61.675273 L 188.29009,61.675273 L 188.29009,65.003603 L 187.85092,65.003603 L 187.85092,62.081003 L 186.99264,64.363793 L 186.54009,64.363793 L 185.68182,62.081003 L 185.68182,65.003603 L 185.24488,65.003603 L 185.24488,61.675273"
id="path2391"
style="fill:#294172;enable-background:new" />
</svg>
--- NEW FILE warning.svg ---
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
xmlns:dc="http://purl.org/dc/elements/1.1/"
xmlns:cc="http://creativecommons.org/ns#"
xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
xmlns:svg="http://www.w3.org/2000/svg"
xmlns="http://www.w3.org/2000/svg"
xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
version="1.0"
width="48"
height="48"
id="svg5921"
sodipodi:version="0.32"
inkscape:version="0.46"
sodipodi:docname="warning.svg"
inkscape:output_extension="org.inkscape.output.svg.inkscape"
inkscape:export-filename="/home/jfearn/Build/src/fedora/publican/trunk/publican-fedora/en-US/images/warning.png"
inkscape:export-xdpi="111.32"
inkscape:export-ydpi="111.32">
<metadata
id="metadata2482">
<rdf:RDF>
<cc:Work
rdf:about="">
<dc:format>image/svg+xml</dc:format>
<dc:type
rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
</cc:Work>
</rdf:RDF>
</metadata>
<sodipodi:namedview
inkscape:window-height="910"
inkscape:window-width="1284"
inkscape:pageshadow="2"
inkscape:pageopacity="0.0"
guidetolerance="10.0"
gridtolerance="10.0"
objecttolerance="10.0"
borderopacity="1.0"
bordercolor="#666666"
pagecolor="#ffffff"
id="base"
showgrid="false"
inkscape:zoom="11.5"
inkscape:cx="20"
inkscape:cy="20"
inkscape:window-x="0"
inkscape:window-y="51"
inkscape:current-layer="svg5921" />
<defs
id="defs5923">
<inkscape:perspective
sodipodi:type="inkscape:persp3d"
inkscape:vp_x="0 : 20 : 1"
inkscape:vp_y="0 : 1000 : 0"
inkscape:vp_z="40 : 20 : 1"
inkscape:persp3d-origin="20 : 13.333333 : 1"
id="perspective2484" />
</defs>
<g
transform="matrix(0.4536635,0,0,0.4536635,-5.1836431,-4.6889387)"
id="layer1">
<g
transform="translate(2745.6887,-1555.5977)"
id="g8304"
style="enable-background:new">
<path
d="M -1603,1054.4387 L -1577.0919,1027.891 L -1540,1027.4387 L -1513.4523,1053.3468 L -1513,1090.4387 L -1538.9081,1116.9864 L -1576,1117.4387 L -1602.5477,1091.5306 L -1603,1054.4387 z"
transform="matrix(0.8233528,8.9983906e-3,-8.9983906e-3,0.8233528,-1398.5561,740.7914)"
id="path8034"
style="opacity:1;fill:#efd259;fill-opacity:1;stroke:#efd259;stroke-opacity:1" />
<path
d="M -1603,1054.4387 L -1577.0919,1027.891 L -1540,1027.4387 L -1513.4523,1053.3468 L -1513,1090.4387 L -1538.9081,1116.9864 L -1576,1117.4387 L -1602.5477,1091.5306 L -1603,1054.4387 z"
transform="matrix(0.6467652,7.0684723e-3,-7.0684723e-3,0.6467652,-1675.7492,927.16391)"
id="path8036"
style="opacity:1;fill:#a42324;fill-opacity:1;stroke:#a42324;stroke-opacity:1" />
<path
d="M -2686.7886,1597.753 C -2686.627,1596.5292 -2686.5462,1595.6987 -2686.5462,1595.218 C -2686.5462,1593.1637 -2688.0814,1592.0711 -2690.9899,1592.0711 C -2693.8985,1592.0711 -2695.4336,1593.12 -2695.4336,1595.218 C -2695.4336,1595.961 -2695.3528,1596.7914 -2695.1912,1597.753 L -2692.929,1614.4491 L -2689.0508,1614.4491 L -2686.7886,1597.753"
id="path8038"
style="font-size:107.13574219px;font-style:normal;font-weight:normal;text-align:center;text-anchor:middle;fill:#ffffff;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Charter" />
<path
d="M -2690.9899,1617.8197 C -2693.6124,1617.8197 -2695.8118,1619.9346 -2695.8118,1622.6416 C -2695.8118,1625.3486 -2693.6124,1627.4635 -2690.9899,1627.4635 C -2688.2829,1627.4635 -2686.168,1625.264 -2686.168,1622.6416 C -2686.168,1619.9346 -2688.2829,1617.8197 -2690.9899,1617.8197"
id="path8040"
style="font-size:107.13574219px;font-style:normal;font-weight:normal;text-align:center;text-anchor:middle;fill:#ffffff;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Charter" />
</g>
</g>
</svg>
14 years, 2 months
web/html/docs/selinux-faq/Common_Content/images - New directory
by sradvan
Author: sradvan
Update of /cvs/fedora/web/html/docs/selinux-faq/Common_Content/images
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv24674/images
Log Message:
Directory /cvs/fedora/web/html/docs/selinux-faq/Common_Content/images added to the repository
14 years, 2 months
web/html/docs/selinux-faq/Common_Content/css common.css, NONE, 1.1 default.css, NONE, 1.1 overrides.css, NONE, 1.1
by sradvan
Author: sradvan
Update of /cvs/fedora/web/html/docs/selinux-faq/Common_Content/css
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv24591
Added Files:
common.css default.css overrides.css
Log Message:
--- NEW FILE common.css ---
body, h1, h2, h3, h4, h5, h6, pre, li, div {
line-height: 1.29em;
}
body {
background-color: white;
margin:0 auto;
font-family: "liberation sans", "Myriad ", "Bitstream Vera Sans", "Lucida Grande", "Luxi Sans", "Trebuchet MS", helvetica, verdana, arial, sans-serif;
font-size:12px;
max-width:55em;
color:black;
}
body.toc_embeded {
/*for web hosting system only*/
margin-left: 300px;
}
object.toc {
/*for web hosting system only*/
border-style:none;
position:fixed;
width:290px;
height:99.99%;
top:0;
left:0;
z-index: 100;
border-style:none;
border-right:1px solid #999;
}
/* desktop styles */
body.desktop {
margin-left: 26em;
}
body.desktop .book > .toc {
display:block;
width:24em;
height:99%;
position:fixed;
overflow:auto;
top:0px;
left:0px;
padding-left:1em;
background-color:#EEEEEE;
}
.toc {
line-height:1.35em;
}
.toc .chapter, .toc .appendix, .toc .glossary {
margin-top:1em;
}
.toc .part {
margin-top:1em;
display:block;
}
span.appendix, span.glossary {
display:block;
margin-top:0.5em;
}
div {
padding-top:0px;
}
div.section {
padding-top:1em;
}
p, div.para, div.formalpara {
padding-top:0px;
margin-top:0.3em;
padding-bottom:0px;
margin-bottom:1em;
}
/*Links*/
a:link {
text-decoration:none;
border-bottom: 1px dotted ;
color:#3366cc;
}
a:visited {
text-decoration:none;
border-bottom: 1px dotted ;
color:#003366;
}
div.longdesc-link {
float:right;
color:#999;
}
.toc a, .qandaset a {
font-weight:normal;
}
/*headings*/
h1, h2, h3, h4, h5, h6 {
color: #336699;
margin-top: 0em;
margin-bottom: 0em;
background-color: transparent;
}
h1 {
font-size:2.0em;
}
.titlepage h1.title {
font-size: 3.0em;
padding-top: 1em;
text-align:left;
}
.book > .titlepage h1.title {
text-align:center;
}
.article > .titlepage h1.title {
text-align:center;
}
.set .titlepage > div > div > h1.title {
text-align:center;
}
.producttitle {
margin-top: 0em;
margin-bottom: 0em;
font-size: 3.0em;
font-weight: bold;
background: #003d6e url(../images/h1-bg.png) top left repeat-x;
color: white;
text-align: center;
padding: 0.7em;
}
.titlepage .corpauthor {
margin-top: 1em;
text-align: center;
}
.section h1.title {
font-size: 1.6em;
padding: 0em;
color: #336699;
text-align: left;
background: white;
}
h2 {
font-size:1.6em;
}
h2.subtitle, h3.subtitle {
margin-top: 1em;
margin-bottom: 1em;
font-size: 1.4em;
text-align: center;
}
.preface > div > div > div > h2.title {
margin-top: 1em;
font-size: 2.0em;
}
.appendix h2 {
margin-top: 1em;
font-size: 2.0em;
}
h3 {
font-size:1.3em;
padding-top:0em;
padding-bottom:0em;
}
h4 {
font-size:1.1em;
padding-top:0em;
padding-bottom:0em;
}
h5 {
font-size:1em;
}
h6 {
font-size:1em;
}
h5.formalpara {
font-size:1em;
margin-top:2em;
margin-bottom:.8em;
}
.abstract h6 {
margin-top:1em;
margin-bottom:.5em;
font-size:2em;
}
/*element rules*/
hr {
border-collapse: collapse;
border-style:none;
border-top: 1px dotted #ccc;
width:100%;
margin-top: 3em;
}
sup {
color:#999;
}
/* web site rules */
ul.languages, .languages li {
display:inline;
padding:0em;
}
.languages li a {
padding:0em .5em;
text-decoration: none;
}
.languages li p, .languages li div.para {
display:inline;
}
.languages li a:link, .languages li a:visited {
color:#444;
}
.languages li a:hover, .languages li a:focus, .languages li a:active {
color:black;
}
ul.languages {
display:block;
background-color:#eee;
padding:.5em;
}
/*supporting stylesheets*/
/*unique to the webpage only*/
.article ul {
padding-left:2em;
list-style: disc;
}
.article li {
margin:0em;
padding-left:0em;
}
.books {
position:relative;
}
.versions li {
width:100%;
clear:both;
display:block;
}
a.version {
font-size:2em;
text-decoration:none;
width:100%;
display:block;
padding:1em 0em .2em 0em;
clear:both;
}
a.version:before {
content:"Version";
font-size:smaller;
}
a.version:visited, a.version:link {
color:#666;
}
a.version:focus, a.version:hover {
color:black;
}
.books {
display:block;
position:relative;
clear:both;
width:100%;
}
.books li {
display:block;
width:200px;
float:left;
position:relative;
clear: none ;
}
.books .html {
width:170px;
display:block;
}
.books .pdf {
position:absolute;
left:170px;
top:0px;
font-size:smaller;
}
.books .pdf:link, .books .pdf:visited {
color:#555;
}
.books .pdf:hover, .books .pdf:focus {
color:#000;
}
.books li a {
text-decoration:none;
}
.books li a:hover {
color:black;
}
/*products*/
.products li {
display: block;
width:300px;
float:left;
}
.products li a {
width:300px;
padding:.5em 0em;
}
.products ul {
clear:both;
}
/*revision history*/
.revhistory {
display:block;
}
.revhistory table {
background-color:transparent;
border-color:#fff;
padding:0em;
margin: 0;
border-collapse:collapse;
border-style:none;
}
.revhistory td {
text-align:right;
padding:0em;
border-top: 1px solid #fff;
}
.revhistory tr td:first-child {
text-align:left;
}
.revhistory tr td p, .revhistory tr td div.para {
text-align:left;
font-weight:bold;
display:block;
margin:0em;
padding:0em;
padding-bottom:0.7em;
border-bottom:1px solid #eee;
}
.revhistory table th {
background-color:transparent;
color:#336699;
font-size:2em;
padding: 1em 0em;
border-bottom:1px solid #eee;
}
/*credits*/
.authorgroup div {
clear:both;
text-align: center;
}
h3.author {
margin: 0em;
padding: 0em;
padding-top: 1em;
}
.authorgroup h4 {
padding: 0em;
margin: 0em;
padding-top: 1em;
margin-top: 1em;
}
.author,
.editor,
.translator,
.othercredit,
.contrib {
display: block;
}
.revhistory .author {
display: inline;
}
.othercredit h3 {
padding-top: 1em;
}
.othercredit {
margin:0em;
padding:0em;
}
.releaseinfo {
clear: both;
}
.copyright {
margin-top: 1em;
}
/* qanda sets */
.answer {
margin-bottom:1em;
border-bottom:1px dotted #ccc;
}
.qandaset .toc {
border-bottom:1px dotted #ccc;
}
.question {
font-weight:bold;
}
.answer .data, .question .data {
padding-left: 2.6em;
}
.answer label, .question label {
float:left;
font-weight:bold;
}
/* inline syntax highlighting */
.perl_Alert {
color: #0000ff;
}
.perl_BaseN {
color: #007f00;
}
.perl_BString {
color: #5C3566;
}
.perl_Char {
color: #ff00ff;
}
.perl_Comment {
color: #FF00FF;
}
.perl_DataType {
color: #0000ff;
}
.perl_DecVal {
color: #00007f;
}
.perl_Error {
color: #ff0000;
}
.perl_Float {
color: #00007f;
}
.perl_Function {
color: #007f00;
}
.perl_IString {
color: #5C3566;
}
.perl_Keyword {
color: #002F5D;
}
.perl_Operator {
color: #ffa500;
}
.perl_Others {
color: #b03060;
}
.perl_RegionMarker {
color: #96b9ff;
}
.perl_Reserved {
color: #9b30ff;
}
.perl_String {
color: #5C3566;
}
.perl_Variable {
color: #0000ff;
}
.perl_Warning {
color: #0000ff;
}
/*Lists*/
ul {
padding-left:1.6em;
list-style-image:url(../images/dot.png);
list-style-type: circle;
}
ul ul {
list-style-image:url(../images/dot2.png);
list-style-type: circle;
}
ol {
list-style-image:none;
list-style-type: decimal;
}
ol ol {
list-style-type: lower-alpha;
}
ol.arabic {
list-style-type: decimal;
}
ol.loweralpha {
list-style-type: lower-alpha;
}
ol.lowerroman {
list-style-type: lower-roman;
}
ol.upperalpha {
list-style-type: upper-alpha;
}
ol.upperroman {
list-style-type: upper-roman;
}
dt {
font-weight:bold;
margin-bottom:0em;
padding-bottom:0em;
}
dd {
margin:0em;
margin-left:2em;
padding-top:0em;
padding-bottom: 1em;
}
li {
padding-top:0px;
margin-top:0em;
padding-bottom:0px;
margin-bottom:0.4em;
}
li p, li div.para {
padding-top:0px;
margin-top:0em;
padding-bottom:0px;
margin-bottom:0.3em;
}
/*images*/
img {
display:block;
margin:2em 0;
}
.inlinemediaobject, .inlinemediaobject img {
display:inline;
margin:0em;
}
.figure img {
display:block;
margin:0;
}
.figure .title {
margin:0em;
margin-bottom:2em;
padding:0px;
}
/*document modes*/
.confidential {
background-color:#900;
color:White;
padding:.5em .5em;
text-transform:uppercase;
text-align:center;
}
.longdesc-link {
display:none;
}
.longdesc {
display:none;
}
.prompt {
background-color:#ede7c8;
padding:0em .3em;
}
/*user interface styles*/
.screen .replaceable {
color:#444;
}
.guibutton, .guilabel {
font-family:"liberation mono", "bitstream vera mono", "dejavu mono", monospace;
font-weight:bold;
white-space:nowrap;
}
.example {
background-color:#dc9f2e;
padding:5px;
margin-bottom:10px;
}
/*terminal/console text*/
.computeroutput,
.option {
font-family:"liberation mono", "bitstream vera mono", "dejavu mono", monospace;
font-weight:bold;
}
.replaceable {
font-family:"liberation mono", "bitstream vera mono", "dejavu mono", monospace;
font-style: italic;
}
.command, .filename, .keycap, .classname, .literal {
font-family:"liberation mono", "bitstream vera mono", "dejavu mono", monospace;
font-weight:bold;
}
pre {
font-family:"liberation mono", "bitstream vera mono", "dejavu mono", monospace;
display:block;
background-color:#eeeeee;
margin-bottom: 0.3em;
padding:.5em 1em;
white-space: pre-wrap; /* css-3 */
white-space: -moz-pre-wrap !important; /* Mozilla, since 1999 */
white-space: -pre-wrap; /* Opera 4-6 */
white-space: -o-pre-wrap; /* Opera 7 */
word-wrap: break-word; /* Internet Explorer 5.5+ */
font-size: 0.9em;
}
pre .replaceable,
pre .keycap {
color:white;
}
code {
font-family:"liberation mono", "bitstream vera mono", "dejavu mono", monospace;
white-space: nowrap;
font-weight:bold;
}
/*Notifications*/
div.note, div.important, div.warning {
padding:1em;
padding-bottom:20px;
margin-top:.5em;
margin-bottom:1.5em;
background-repeat:no-repeat;
background-position:1em 1em;
}
div.note pre, div.important pre, div.warning pre {
background-color: #333;
color: white;
margin-left: 4.5em;
}
div.note {
background-image:url(../images/note.png);
background-color:#8e9f00;
color:white;
}
div.important {
background-color:#d08e13;
color:white;
background-image:url(../images/important.png);
}
div.warning {
background-color:#9e292b;
color:white;
background-image:url(../images/warning.png);
}
/* Admonition Headings */
div.note h2, div.important h2, div.warning h2 {
height:32px;
font-size:1.3em;
}
div.note h2, div.important h2, div.warning h2 {
color:white;
}
/* Admonition Inlines */
div.note .replaceable, div.important .replaceable, div.warning .replaceable {
color:#e3dcc0;
}
pre .replaceable, tt .replaceable {
color:#444;
}
div.note .guilabel, div.important .guilabel, div.warning .guilabel {
color:#e3dcc0;
}
/* Admonition Lists ... really? */
div.note li, div.warning li, div.important li {
padding-left:10px;
margin:0em;
}
div.note ul, div.warning ul, div.important ul {
padding-left:40px;
margin:0em;
}
/* Admonition links in verbatim ... *really* */
div.note pre pre a:visited, div.important pre pre a:visited,
div.warning pre pre a:visited, div.note pre a:link, div.important pre a:link, div.warning pre a:link {
color:#0066cc;
}
/* Admonition links */
div.note a:visited, div.important a:visited, div.warning a:visited, div.note a:link , div.important a:link , div.warning a:link {
color:#f7f2d0;
}
/*notification icons*/
div.note h2, div.note p, div.note div.para, div.warning h2, div.warning p, div.warning div.para, div.important h2, .important p, .important div.para {
padding:0em;
margin:0em;
padding-left:56px;
}
/*Page Title*/
#title {
display:block;
height:45px;
padding-bottom:1em;
margin:0em;
}
#title a.left{
display:inline;
border:none;
padding-left:200px;
}
#title a.left img{
border:none;
float:left;
margin:0em;
margin-top:.7em;
}
#title a.right {
padding-bottom:1em;
}
#title a.right img {
border:none;
float:right;
margin:0em;
}
/*Table*/
table {
border:1px solid #6c614b;
width:100%;
border-collapse:collapse;
}
table.simplelist, .calloutlist table {
border-style: none;
}
table th {
text-align:left;
background-color:#6699cc;
padding:.3em .5em;
color:white;
}
table td {
padding:.15em .5em;
}
table tr.even td {
background-color:#f5f5f5;
}
table th p:first-child, table td p:first-child, table li p:first-child,
table th div.para:first-child, table td div.para:first-child, table li div.para:first-child {
margin-top:0em;
padding-top:0em;
display:inline;
}
th, td {
border-style:none;
vertical-align: top;
}
table table td {
border-bottom:1px dotted #aaa;
background-color:white;
padding:.6em 0em;
}
table table {
border:1px solid white;
}
td.remarkval {
color:#444;
}
td.fieldval {
font-weight:bold;
}
.lbname, .lbtype, .lbdescr, .lbdriver, .lbhost {
color:white;
font-weight:bold;
background-color:#999;
width:120px;
}
td.remarkval {
width:230px;
}
td.tname {
font-weight:bold;
}
th.dbfield {
width:120px;
}
th.dbtype {
width:70px;
}
th.dbdefault {
width:70px;
}
th.dbnul {
width:70px;
}
th.dbkey {
width:70px;
}
span.book {
margin-top:4em;
display:block;
}
span.chapter {
display:block;
margin-top:0.5em;
}
/*Breadcrumbs*/
#breadcrumbs ul li.first:before {
content:" ";
}
#breadcrumbs {
color:#900;
padding:3px;
margin-bottom:25px;
}
#breadcrumbs ul {
margin-left:0;
padding-left:0;
display:inline;
border:none;
}
#breadcrumbs ul li {
margin-left:0;
padding-left:2px;
border:none;
list-style:none;
display:inline;
}
#breadcrumbs ul li:before {
content:"\0020 \0020 \0020 \00BB \0020";
color:#333;
}
/*index*/
.glossary h3,
.index h3 {
font-size: 2em;
color:#aaa;
margin:0em;
}
.indexdiv {
margin-bottom:1em;
}
.glossary dt, .index dt {
color:#444;
padding-top:.5em;
}
.glossary dl dl dt,
.index dl dl dt {
color:#777;
font-weight:normal;
padding-top:0em;
}
.index dl dl dt:before {
content:"- ";
color:#ccc;
}
/*changes*/
.footnote {
padding:.2em 1em;
background-color:#c8c5ac;
font-size: .7em;
margin:0em;
margin-bottom:.5em;
color:#222;
}
table .footnote {
margin:1em .5em;
}
sup {
padding:0em .3em;
padding-left:0em;
}
.footnote {
position:relative;
}
.footnote sup {
color:#e3dcc0;
position:absolute;
left: .4em;
}
.footnote sup a:link,
.footnote sup a:visited {
color:#92917d;
text-decoration:none;
}
.footnote:hover sup a {
color:#fff;
text-decoration:none;
}
.footnote p,.footnote div.para {
padding-left:5em;
}
.footnote a:link,
.footnote a:visited {
color:#00537c;
}
.footnote a:hover {
color:white;
}
/**/
div.chapter {
margin-top:3em;
}
div.section {
margin-top:1em;
}
div.note .replaceable,
div.important .replaceable,
div.warning .replaceable,
div.note .keycap,
div.important .keycap,
div.warning .keycap
{
color:white;
}
ul li p:last-child, ul li div.para:last-child {
margin-bottom:0em;
padding-bottom:0em;
}
/*document navigation*/
.docnav a, .docnav strong {
border:none;
text-decoration:none;
font-weight:normal;
}
.docnav {
list-style:none;
margin:0em;
padding:0em;
position:relative;
width:100%;
padding-bottom:2em;
padding-top:1em;
border-top:1px dotted #ccc;
}
.docnav li {
list-style:none;
margin:0em;
padding:0em;
display:inline;
font-size:.8em;
}
.docnav li:before {
content:" ";
}
.docnav li.previous, .docnav li.next {
position:absolute;
top:1em;
}
.docnav li.up, .docnav li.home {
margin:0em 1.5em;
}
.docnav li.previous {
left:0px;
text-align:left;
}
.docnav li.next {
right:0px;
text-align:right;
}
.docnav li.previous strong, .docnav li.next strong {
height:22px;
display:block;
}
.docnav {
margin:0 auto;
text-align:center;
}
.docnav li.next a strong {
background: url(../images/stock-go-forward.png) top right no-repeat;
padding-top:3px;
padding-bottom:4px;
padding-right:28px;
font-size:1.2em;
}
.docnav li.previous a strong {
background: url(../images/stock-go-back.png) top left no-repeat;
padding-top:3px;
padding-bottom:4px;
padding-left:28px;
padding-right:0.5em;
font-size:1.2em;
}
.docnav li.home a strong {
background: url(../images/stock-home.png) top left no-repeat;
padding:5px;
padding-left:28px;
font-size:1.2em;
}
.docnav li.up a strong {
background: url(../images/stock-go-up.png) top left no-repeat;
padding:5px;
padding-left:28px;
font-size:1.2em;
}
.docnav a:link, .docnav a:visited {
color:#666;
}
.docnav a:hover, .docnav a:focus, .docnav a:active {
color:black;
}
.docnav a {
max-width: 10em;
overflow:hidden;
}
.docnav a:link strong {
text-decoration:none;
}
.docnav {
margin:0 auto;
text-align:center;
}
ul.docnav {
margin-bottom: 1em;
}
/* Reports */
.reports ul {
list-style:none;
margin:0em;
padding:0em;
}
.reports li{
margin:0em;
padding:0em;
}
.reports li.odd {
background-color: #eeeeee;
margin:0em;
padding:0em;
}
.reports dl {
display:inline;
margin:0em;
padding:0em;
float:right;
margin-right: 17em;
margin-top:-1.3em;
}
.reports dt {
display:inline;
margin:0em;
padding:0em;
}
.reports dd {
display:inline;
margin:0em;
padding:0em;
padding-right:.5em;
}
.reports h2, .reports h3{
display:inline;
padding-right:.5em;
font-size:10pt;
font-weight:normal;
}
.reports div.progress {
display:inline;
float:right;
width:16em;
background:#c00 url(../images/shine.png) top left repeat-x;
margin:0em;
margin-top:-1.3em;
padding:0em;
border:none;
}
/*uniform*/
body.results, body.reports {
max-width:57em ;
padding:0em;
}
/*Progress Bar*/
div.progress {
display:block;
float:left;
width:16em;
background:#c00 url(../images/shine.png) top left repeat-x;
height:1em;
}
div.progress span {
height:1em;
float:left;
}
div.progress span.translated {
background:#6c3 url(../images/shine.png) top left repeat-x;
}
div.progress span.fuzzy {
background:#ff9f00 url(../images/shine.png) top left repeat-x;
}
/*Results*/
.results ul {
list-style:none;
margin:0em;
padding:0em;
}
.results li{
margin:0em;
padding:0em;
}
.results li.odd {
background-color: #eeeeee;
margin:0em;
padding:0em;
}
.results dl {
display:inline;
margin:0em;
padding:0em;
float:right;
margin-right: 17em;
margin-top:-1.3em;
}
.results dt {
display:inline;
margin:0em;
padding:0em;
}
.results dd {
display:inline;
margin:0em;
padding:0em;
padding-right:.5em;
}
.results h2, .results h3{
display:inline;
padding-right:.5em;
font-size:10pt;
font-weight:normal;
}
.results div.progress {
display:inline;
float:right;
width:16em;
background:#c00 url(../images/shine.png) top left repeat-x;
margin:0em;
margin-top:-1.3em;
padding:0em;
border:none;
}
/* Dirty EVIL Mozilla hack for round corners */
pre {
-moz-border-radius:11px;
-webkit-border-radius:11px;
border-radius: 11px;
}
.example {
-moz-border-radius:15px;
-webkit-border-radius:15px;
border-radius: 15px;
}
.term{
color:#336699;
}
.package, .citetitle {
font-style: italic;
}
.edition {
color: #336699;
background-color: transparent;
margin-top: 1em;
margin-bottom: 1em;
font-size: 1.4em;
font-weight: bold;
text-align: center;
}
span.remark {
background-color: #ff00ff;
}
.draft {
background-image: url(../images/watermark-draft.png);
background-repeat: repeat-y;
background-position: center;
}
.foreignphrase {
font-style: inherit;
}
dt {
clear:both;
}
dt img {
border-style: none;
max-width: 112px;
}
dt object {
max-width: 112px;
}
dt .inlinemediaobject, dt object {
display: inline;
float: left;
margin-bottom: 1em;
padding-right: 1em;
width: 112px;
}
dl:after {
display: block;
clear: both;
content: "";
}
.toc dd {
padding-bottom: 0em;
margin-bottom: 1em;
padding-left: 1.3em;
margin-left: 0em;
}
div.toc > dl > dt {
padding-bottom: 0em;
margin-bottom: 0em;
margin-top: 1em;
}
.strikethrough {
text-decoration: line-through;
}
.underline {
text-decoration: underline;
}
.calloutlist img, .callout {
padding: 0em;
margin: 0em;
width: 12pt;
display: inline;
}
.stepalternatives {
list-style-image: none;
list-style-type: none;
}
--- NEW FILE default.css ---
@import url("common.css");
@import url("overrides.css");
@import url("lang.css");
--- NEW FILE overrides.css ---
a:link {
color:#0066cc;
}
a:hover, a:active {
color:#003366;
}
a:visited {
color:#6699cc;
}
h1 {
color:#3c6eb4
}
.producttitle {
background: #3c6eb4 url(../images/h1-bg.png) top left repeat;
}
.section h1.title {
color:#3c6eb4;
}
h2,h3,h4,h5,h6 {
color:#3c6eb4;
}
table {
border:1px solid #3c6eb4;
}
table th {
background-color:#3c6eb4;
}
table tr.even td {
background-color:#f5f5f5;
}
.term{
color:#3c6eb4
}
.revhistory table th {
color:#3c6eb4;
}
.edition {
color: #3c6eb4;
}
14 years, 2 months
web/html/docs/selinux-faq/Common_Content/css - New directory
by sradvan
Author: sradvan
Update of /cvs/fedora/web/html/docs/selinux-faq/Common_Content/css
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv24494/css
Log Message:
Directory /cvs/fedora/web/html/docs/selinux-faq/Common_Content/css added to the repository
14 years, 2 months
web/html/docs/selinux-faq/Common_Content - New directory
by sradvan
Author: sradvan
Update of /cvs/fedora/web/html/docs/selinux-faq/Common_Content
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv24449/Common_Content
Log Message:
Directory /cvs/fedora/web/html/docs/selinux-faq/Common_Content added to the repository
14 years, 2 months
web/html/docs/selinux-faq index.html,NONE,1.1
by sradvan
Author: sradvan
Update of /cvs/fedora/web/html/docs/selinux-faq
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv24364
Added Files:
index.html
Log Message:
--- NEW FILE index.html ---
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>SELinux FAQ</title><link rel="stylesheet" href="./Common_Content/css/default.css" type="text/css" /><meta name="generator" content="publican 1.3" /><meta name="package" content="Fedora-SELinux_FAQ-12-en-US-0-0" /><meta name="description" content="This FAQ answers many questions about Security-Enhanced Linux. The information in this FAQ is valuable for those who are new to SELinux." /></head><body class=""><p id="title"><a class="left" href="http://www.fedoraproject.org"><img src="Common_Content/images/image_left.png" alt="Product Site" /></a><a class="right" href="http://docs.fedoraproject.org"><img src="Common_Content/images/image_right.png" alt="Documentation Site" /></a></p><div xml:lang="en-US" class="article" title="SELinux FAQ" lang="en-US"><div class="titlepage"><div><div class="producttitle"><span class="productname">Fedora</span> <span class="p
roductnumber">12</span></div><div><h1 id="chap-SELinux-FAQ-FAQ" class="title">SELinux FAQ</h1></div><div><h2 class="subtitle">Frequently-asked questions about Security Enhanced Linux</h2></div><div><h3 class="corpauthor">
<span class="inlinemediaobject"><object data="Common_Content/images/title_logo.svg" type="image/svg+xml"> </object></span>
</h3></div><div><div xml:lang="en-US" class="authorgroup" lang="en-US"><div class="author"><h3 class="author"><span class="firstname">Karsten</span> <span class="surname">Wade</span></h3><div class="affiliation"><span class="orgname">Fedora</span> <span class="orgdiv">Documentation Project</span></div><code class="email"><a class="email" href="mailto:quaid@fedoraproject.org">quaid(a)fedoraproject.org</a></code></div><div class="author"><h3 class="author"><span class="firstname">Paul W.</span> <span class="surname">Frields</span></h3><div class="affiliation"><span class="orgname">Fedora</span> <span class="orgdiv">Documentation Project</span></div><code class="email"><a class="email" href="mailto:pfrields@fedoraproject.org">pfrields(a)fedoraproject.org</a></code></div><div class="author"><h3 class="author"><span class="firstname">Scott</span> <span class="surname">Radvan</span></h3><div class="affiliation"><span class="orgname">Red Hat</span> <span class="orgdiv">Engineering Cont
ent Services</span></div><code class="email"><a class="email" href="mailto:sradvan@redhat.com">sradvan(a)redhat.com</a></code></div></div></div><div><div id="id3043795" class="legalnotice"><h1 class="legalnotice">Legal Notice</h1><div class="para">
Copyright <span class="trademark"></span>© 2010 Red Hat, Inc..
</div><div class="para">
The text of and illustrations in this document are licensed by Red Hat under a Creative Commons Attribution–Share Alike 3.0 Unported license ("CC-BY-SA"). An explanation of CC-BY-SA is available at <a href="http://creativecommons.org/licenses/by-sa/3.0/">http://creativecommons.org/licenses/by-sa/3.0/</a>. The original authors of this document, and Red Hat, designate the Fedora Project as the "Attribution Party" for purposes of CC-BY-SA. In accordance with CC-BY-SA, if you distribute this document or an adaptation of it, you must provide the URL for the original version.
</div><div class="para">
Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert, Section 4d of CC-BY-SA to the fullest extent permitted by applicable law.
</div><div class="para">
Red Hat, Red Hat Enterprise Linux, the Shadowman logo, JBoss, MetaMatrix, Fedora, the Infinity Logo, and RHCE are trademarks of Red Hat, Inc., registered in the United States and other countries.
</div><div class="para">
For guidelines on the permitted uses of the Fedora trademarks, refer to <a href="https://fedoraproject.org/wiki/Legal:Trademark_guidelines">https://fedoraproject.org/wiki/Legal:Trademark_guidelines</a>.
</div><div class="para">
<span class="trademark">Linux</span>® is the registered trademark of Linus Torvalds in the United States and other countries.
</div><div class="para">
All other trademarks are the property of their respective owners.
</div></div></div><div><div class="abstract" title="Abstract"><h6>Abstract</h6><div class="para">
This FAQ answers many questions about Security-Enhanced Linux. The
information in this FAQ is valuable for those who are new to SELinux.
</div></div></div></div><hr /></div><div class="toc"><dl><dt><span class="section"><a href="#SELinux_FAQ-FAQ-SELinux">1. SELinux</a></span></dt></dl></div><div class="para">
For more information about how SELinux works, how to use SELinux for general and specific Linux distributions, and how to write policy, these resources are useful:
</div><div class="itemizedlist"><h6>External Link List</h6><ul><li class="listitem"><div class="para">
NSA SELinux main website — <a href="http://www.nsa.gov/selinux/">http://www.nsa.gov/selinux/</a>
</div></li><li class="listitem"><div class="para">
NSA SELinux FAQ — <a href="http://www.nsa.gov/selinux/info/faq.cfm">http://www.nsa.gov/selinux/info/faq.cfm</a>
</div></li><li class="listitem"><div class="para">
SELinux community page — <a href="http://selinux.sourceforge.net">http://selinux.sourceforge.net</a>
</div></li><li class="listitem"><div class="para">
UnOfficial FAQ — <a href="http://www.crypt.gen.nz/selinux/faq.html">http://www.crypt.gen.nz/selinux/faq.html</a>
</div></li><li class="listitem"><div class="para">
Writing traditional SE Linux policy HOWTO — <a href="https://sourceforge.net/docman/display_doc.php?docid=21959&group_id=2...">https://sourceforge.net/docman/display_doc.php?docid=21959&group_id=2...</a>
</div></li><li class="listitem"><div class="para">
Reference Policy (the new policy found in Fedora 5) — <a href="http://serefpolicy.sourceforge.net/">http://serefpolicy.sourceforge.net/</a>
</div></li><li class="listitem"><div class="para">
SELinux policy development training courses — <a href="http://tresys.com/services/training.shtml">http://tresys.com/services/training.shtml</a> and <a href="https://www.redhat.com/training/security/courses/rhs429.html">https://www.redhat.com/training/security/courses/rhs429.html</a>
</div></li><li class="listitem"><div class="para">
Getting Started with SE Linux HOWTO: the new SELinux (Debian) — <a href="https://sourceforge.net/docman/display_doc.php?docid=20372&group_id=2...">https://sourceforge.net/docman/display_doc.php?docid=20372&group_id=2...</a>
</div></li><li class="listitem"><div class="para">
List of SELinux object classes and permissions — <a href="http://tresys.com/selinux/obj_perms_help.shtml">http://tresys.com/selinux/obj_perms_help.shtml</a>
</div></li><li class="listitem"><div class="para">
On IRC - irc.freenode.net, #fedora-selinux
</div></li><li class="listitem"><div class="para">
Fedora mailing list — <a href="mailto:fedora-selinux-list@redhat.com">mailto:fedora-selinux-list@redhat.com</a>; read the archives or subscribe at <a href="http://www.redhat.com/mailman/listinfo/fedora-selinux-list">http://www.redhat.com/mailman/listinfo/fedora-selinux-list</a>
</div></li></ul></div><div class="section" title="1. SELinux"><div class="titlepage"><div><div><h2 class="title" id="SELinux_FAQ-FAQ-SELinux">1. SELinux</h2></div></div></div><div class="qandaset" title="Frequently Asked Questions" id="id2913416"><dl><dt></dt><dd><dl><dt>Q: <a href="#id2913421">
What is SELinux?
</a></dt><dt>Q: <a href="#id2914799">
What is SELinux policy?
</a></dt><dt>Q: <a href="#id3057481">
What happened to the strict policy?
</a></dt><dt>Q: <a href="#id2898184">
What programs are protected by the SELinux policy?
</a></dt><dt>Q: <a href="#faq-entry-whatis-refpolicy">
What is the Reference Policy?
</a></dt><dt>Q: <a href="#id2898287">
What are file contexts?
</a></dt><dt>Q: <a href="#id2916596">
How do I view the security context of a file, user, or process?
</a></dt><dt>Q: <a href="#id2916634">
What is the difference between a domain and a type?
</a></dt><dt>Q: <a href="#faq-entry-whatare-policy-modules">
What are policy modules?
</a></dt><dt>Q: <a href="#faq-entry-whatis-managed-policy">
What is managed policy?
</a></dt></dl></dd><dt>1.2. <a href="#id2929042">Controlling SELinux</a></dt><dd><dl><dt>Q: <a href="#id2929048">
How do I install/not install SELinux?
</a></dt><dt>Q: <a href="#id2929075">
As an administrator, what do I need to do to configure SELinux for my system?
</a></dt><dt>Q: <a href="#qa-using-s-c-securitylevel">
How do I enable/disable SELinux protection on specific daemons under the targeted policy?
</a></dt><dt>Q: <a href="#faq-entry-local.te">
In the past I have written local.te file in policy sources for my own local customization to policy, how do I do this in Fedora 5?
</a></dt><dt>Q: <a href="#id2929497">
I have some avc denials that I would like to allow, how do I do this?
</a></dt><dt>Q: <a href="#id2929670">
How can I help write policy?
</a></dt><dt>Q: <a href="#id3069707">
How do I switch the policy I am currently using?
</a></dt><dt>Q: <a href="#id3069893">
How can I back up files from an SELinux file system?
</a></dt><dt>Q: <a href="#faq-entry-public_html">
How do I make a user public_html directory work under SELinux?
</a></dt><dt>Q: <a href="#id3070107">
How do I turn SELinux off at boot?
</a></dt><dt>Q: <a href="#id3070170">
How do I turn enforcing on/off at boot?
</a></dt><dt>Q: <a href="#id3070271">
How do I temporarily turn off enforcing mode without having to reboot?
</a></dt><dt>Q: <a href="#id3070304">
How do I turn system call auditing on/off at boot?
</a></dt><dt>Q: <a href="#id3070350">
How do I temporarily turn off system-call auditing without having to reboot?
</a></dt><dt>Q: <a href="#id3070377">
How do I get status info about my SELinux installation?
</a></dt><dt>Q: <a href="#id3070407">
How do I write policy to allow a domain to use pam_unix.so?
</a></dt><dt>Q: <a href="#id3070489">
I created a new Policy Package, where do I put it to make sure that it gets loaded into the kernel?
</a></dt></dl></dd><dt>1.3. <a href="#faq-div-resolving-problems">Resolving Problems</a></dt><dd><dl><dt>Q: <a href="#id3070551">
Where are SELinux AVC messages (denial logs, etc.) stored?
</a></dt><dt>Q: <a href="#id3070593">
My application isn't working as expected and I am seeing avc: denied messages. How do I fix this?
</a></dt><dt>Q: <a href="#id3070681">
I installed Fedora on a system with an existing /home partition, and now I can't log in.
</a></dt><dt>Q: <a href="#id3070768">
After relabeling my /home using setfiles or fixfiles, am I still be able to read /home with a non-SELinux-enabled system?
</a></dt><dt>Q: <a href="#id3070818">
How do I share directories using NFS between Fedora and non-SELinux systems?
</a></dt><dt>Q: <a href="#id3070880">
How can I create a new Linux user account with the user's home
</a></dt><dt>Q: <a href="#id3070962">
Does the su command change my SELinux identity and role?
</a></dt><dt>Q: <a href="#id3071028">
I'm having troubles with avc errors filling my logs for a particular program. How do I choose not to audit the access for it?
</a></dt><dt>Q: <a href="#id3071089">
Even running in permissive mode, I'm getting a large number of avc denied messages.
</a></dt><dt>Q: <a href="#id3071133">
I get a specific permission denial only when SELinux is in enforcing mode, but I don't see any audit messages in /var/log/messages (or /var/log/audit/audit.log if using the audit daemon). How can I identify the cause of these silent denials?
</a></dt><dt>Q: <a href="#id3071241">
Why do I not see the output when I run certain daemons in debug or interactive mode?
</a></dt><dt>Q: <a href="#id3071332">
When I do an upgrade of the policy package (for example, using yum), what happens with the policy? Is it updated automatically?
</a></dt><dt>Q: <a href="#id3071420">
If the policy shipping with an application package changes in a way that requires relabeling, will RPM handle relabeling the files owned by the package?
</a></dt><dt>Q: <a href="#id3071498">
Why do binary policies distributed with Fedora, such as /etc/selinux/<policyname>/policy/policy.<version>, and those I compile myself have different sizes and MD5 checksums?
</a></dt><dt>Q: <a href="#id3071561">
Will new policy packages disable my system?
</a></dt><dt>Q: <a href="#id3071597">
My console is being flooded with messages. How do I turn them off?
</a></dt><dt>Q: <a href="#id3071628">
Can I test the default policy without installing the policy source?
</a></dt><dt>Q: <a href="#id3071712">
Why are some of my KDE applications having trouble under SELinux?
</a></dt><dt>Q: <a href="#id3071784">
Why does SELINUX=disabled not work for me?
</a></dt><dt>Q: <a href="#faq-entry-unconfined_t">
I have a process running as unconfined_t, and SELinux is still preventing my application from running.
</a></dt><dt>Q: <a href="#id3071992">
What do these rpm errors mean?
</a></dt><dt>Q: <a href="#id3072060">
I want to run a daemon on a non standard port but SELinux will not allow me. How do get this to work?
</a></dt><dt>Q: <a href="#id3072095">
I am writing a php script that needs to create files and possibly execute them. SELinux policy is preventing this. What should I do?
</a></dt><dt>Q: <a href="#id3072149">
I am setting up swapping to a file, but I am seeing AVC messages in my log files?
</a></dt><dt>Q: <a href="#id3072186">
Please explain the relabelto/relabelfrom permissions?
</a></dt></dl></dd><dt>1.4. <a href="#faq-div-deploying-selinux">Deploying SELinux</a></dt><dd><dl><dt>Q: <a href="#id3072295">
What file systems can I use for SELinux?
</a></dt><dt>Q: <a href="#id3072333">
How does SELinux impact system performance?
</a></dt><dt>Q: <a href="#id3072362">
What types of deployments, applications, and systems should I leverage SELinux in?
</a></dt><dt>Q: <a href="#id3072425">
How does SELinux affect third-party applications?
</a></dt></dl></dd></dl><div class="qandaset"><div class="toc"><dl><dt>Q: <a href="#id2913421">
What is SELinux?
</a></dt><dt>Q: <a href="#id2914799">
What is SELinux policy?
</a></dt><dt>Q: <a href="#id3057481">
What happened to the strict policy?
</a></dt><dt>Q: <a href="#id2898184">
What programs are protected by the SELinux policy?
</a></dt><dt>Q: <a href="#faq-entry-whatis-refpolicy">
What is the Reference Policy?
</a></dt><dt>Q: <a href="#id2898287">
What are file contexts?
</a></dt><dt>Q: <a href="#id2916596">
How do I view the security context of a file, user, or process?
</a></dt><dt>Q: <a href="#id2916634">
What is the difference between a domain and a type?
</a></dt><dt>Q: <a href="#faq-entry-whatare-policy-modules">
What are policy modules?
</a></dt><dt>Q: <a href="#faq-entry-whatis-managed-policy">
What is managed policy?
</a></dt></dl></div><div class="qandadiv"><div class="qandaentry"><div class="question" id="id2913421"><label>Q:</label><div class="data"><div class="para">
What is SELinux?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
SELinux (<em class="firstterm">Security-Enhanced Linux</em>) in Fedora is an implementation of <em class="firstterm">mandatory access control</em> in the Linux kernel using the <em class="firstterm">Linux Security Modules</em> (<abbr class="abbrev">LSM</abbr>) framework. Standard Linux security is a <em class="firstterm">discretionary access control</em> model.
</div><div class="variablelist"><dl><dt><span class="term">Discretionary access control (<abbr class="abbrev">DAC</abbr>)</span></dt><dd><div class="para">
DAC is standard Linux security, and it provides no protection from broken software or malware running as a normal user or root. Users can grant risky levels of access to files they own.
</div></dd><dt><span class="term">Mandatory access control (<abbr class="abbrev">MAC</abbr>)</span></dt><dd><div class="para">
MAC provides full control over all interactions of software. Administratively defined policy closely controls user and process interactions with the system, and can provide protection from broken software or malware running as any user.
</div></dd></dl></div><div class="para">
In a DAC model, file and resource decisions are based solely on user identity and ownership of the objects. Each user and program run by that user has complete discretion over the user's objects. Malicious or flawed software can do anything with the files and resources it controls through the user that started the process. If the user is the super-user or the application is <code class="command">setuid</code> or <code class="command">setgid</code> to root, the process can have root level control over the entire file system.
</div><div class="para">
A MAC system does not suffer from these problems. First, you can administratively define a security policy over all processes and objects. Second, you control all processes and objects, in the case of SELinux through the kernel. Third, decisions are based on all the security relevant information available, and not just authenticated user identity.
</div><div class="para">
MAC under SELinux allows you to provide granular permissions for all <em class="firstterm">subjects</em> (users, programs, processes) and <em class="firstterm">objects</em> (files, devices). In practice, think of subjects as processes, and objects as the target of a process operation. You can safely grant a process only the permissions it needs to perform its function, and no more.
</div><div class="para">
The SELinux implementation uses <em class="firstterm">role-based access control</em> (<abbr class="abbrev">RBAC</abbr>), which provides abstracted user-level control based on roles, and <em class="firstterm"><span class="trademark">Type Enforcement</span>®</em> (<abbr class="abbrev">TE</abbr>). TE uses a table, or <em class="firstterm">matrix</em> to handle access controls, enforcing policy rules based on the types of processes and objects. Process types are called <em class="firstterm">domains</em>, and a cross-reference on the matrix of the process's domain and the object's type defines their interaction. This system provides extremely granular control for actors in a Linux system.
</div></div></div></div><div class="qandaentry"><div class="question" id="id2914799"><label>Q:</label><div class="data"><div class="para">
What is SELinux policy?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
The SELinux policy describes the access permissions for all subjects and objects, that is, the entire system of users, programs, and processes and the files and devices they act upon. Fedora policy is delivered in a package, with an associated source package. Current shipping policy packages are:
</div><div class="variablelist"><dl><dt><span class="term"><code class="filename">selinux-policy-<em class="replaceable"><code><version></code></em>.noarch.rpm</code></span></dt><dd><div class="para">
This package is common to all types of policy and contains config files/man pages. This includes the interface files for the development environment. This replaces the -sources package from the past. This package contains the interface files used in Reference Policy along with a Makefile and a small tool called <code class="command">sepolgen</code> used to generate a policy template file. The interface files reside in <code class="filename">/usr/share/selinux/devel/include</code> directory. If you want to see all of the policy files used to build the Reference Policy you need to install the src.rpm.
</div></dd></dl></div></div></div></div><div class="qandaentry"><div class="question" id="id3057481"><label>Q:</label><div class="data"><div class="para">
What happened to the strict policy?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
Strict policy since RHEL5 and Fedora Core 5 has been the equivalent of targeted policy with the unconfined domains removed. This means all users had to have a type defined for them like staff_t or user_t. And all processes started by init would need to have policy written for them. As of Fedora Core 9, the strict policy was removed and merged into targeted policy.
</div></div></div></div><div class="qandaentry"><div class="question" id="id2898184"><label>Q:</label><div class="data"><div class="para">
What programs are protected by the SELinux policy?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
The number of programs that have SELinux policy defined for them is constantly changing and evolving. Different versions of policy have more or less executables covered. By convention all confined executables have a label type that ends with exec_t. The SELinux tools package (setools) includes the seinfo application which allows you to examine the installed policy.
<pre class="screen">
<code class="computeroutput"> # seinfo -t | grep exec_t | wc -l 572 </code>
</pre>
</div></div></div></div><div class="qandaentry"><div class="question" id="faq-entry-whatis-refpolicy"><label>Q:</label><div class="data"><div class="para">
What is the Reference Policy?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
The <em class="firstterm">Reference Policy</em> is a new project maintained by Tresys Technology (<a href="http://www.tresys.com/">http://www.tresys.com/</a>) designed to rewrite the entire SELinux policy in a way that is easier to use and understand. To do this, it uses the concepts of modularity, abstraction, and well-defined interfaces. Refer to <a href="http://serefpolicy.sourceforge.net/">http://serefpolicy.sourceforge.net/</a> for more information on the Reference Policy.
</div><div class="para">
Note that Reference Policy is not a new type of policy. Rather, it is a new base that policies can be built from.
</div></div></div></div><div class="qandaentry"><div class="question" id="id2898287"><label>Q:</label><div class="data"><div class="para">
What are file contexts?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
<em class="firstterm">File contexts</em> are used by the <code class="command">setfiles</code> command to generate persistent labels which describe the security context for a file or directory.
</div><div class="para">
Fedora ships with the <code class="command">fixfiles</code> script, which supports three options: <code class="option">check</code>, <code class="option">restore</code>, and <code class="option">relabel</code>. This script allows users to relabel the file system without having the <code class="filename">selinux-policy-targeted-sources</code> package installed. The command line usage is more friendly than the standard <code class="command">setfiles</code> command.
</div></div></div></div><div class="qandaentry"><div class="question" id="id2916596"><label>Q:</label><div class="data"><div class="para">
How do I view the security context of a file, user, or process?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
The new option <code class="option">-Z</code> is the short method for displaying the context of a subject or object:
</div><pre class="screen">
<code class="command">ls -alZ <em class="replaceable"><code>file.foo</code></em> id -Z ps -eZ</code>
</pre></div></div></div><div class="qandaentry"><div class="question" id="id2916634"><label>Q:</label><div class="data"><div class="para">
What is the difference between a <em class="firstterm">domain</em> and a <em class="firstterm">type</em>?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
There is no difference between a domain and a type, although domain is sometimes used to refer to the type of a process. The use of domain in this way stems from Domain and Type Enforcement (DTE) models, where domains and types are separate.
</div></div></div></div><div class="qandaentry"><div class="question" id="faq-entry-whatare-policy-modules"><label>Q:</label><div class="data"><div class="para">
What are policy modules?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
Prior to Fedora 5, SELinux policies were monolithic, meaning making a change required getting the entire policy source, modifying it, compiling it, and replacing the current policy with it. With Fedora 5, the policy is now modular. This means that third party developers can ship policy modules with their applications, and then they can be added to the policy without having to switch out the entire policy. The new module is then added to the module store, which results in a new policy binary that is a combination of the previous policy and the new module.
</div><div class="para">
This actually works by separating out compile and link steps in the policy build procedure. Policy modules are compiled from source, and linked when installed into the module store (see <a class="xref" href="#faq-entry-whatis-managed-policy" title="Q:">Managed Policy</a>). This linked policy is then loaded into the kernel for enforcement.
</div><div class="para">
The primary command for dealing with modules is <code class="command">semodule</code>, which lets you perform basic functions such as installing, upgrading, or removing modules. Other useful commands include <code class="command">checkmodule</code>, which is the module compiler and is installed with the checkpolicy rpm, as well as <code class="command">semodule_package</code>, which creates a policy package file (.pp) from a compiled policy module.
</div><div class="para">
Modules are usually stored as policy package file (.pp extension) in <code class="filename">/usr/share/selinux/<em class="replaceable"><code>policyname</code></em>/</code>. There you should at least find the base.pp, which is the base module.
</div><div class="para">
To see how to write a simple policy module, check out <a class="xref" href="#faq-entry-local.te" title="Q:">Local Policy Customizations</a>.
</div></div></div></div><div class="qandaentry"><div class="question" id="faq-entry-whatis-managed-policy"><label>Q:</label><div class="data"><div class="para">
What is managed policy?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
Prior to Fedora 5, SELinux policies were handled as user-editable config files in etc. Unfortunately, this made it difficult to address many of the usability issues arising with SELinux. So, a new library, <code class="filename">libsemanage</code>, was added to provide userspace tools an interface to making policy management easier. All policy management should use this library to access the policy store. The policy store holds all the policy information, and is found at <code class="filename">/etc/selinux/<em class="replaceable"><code>policyname</code></em>/modules/</code>.
</div><div class="para">
You should never have to edit the store directly. Instead, you should use tools that link against libsemanage. One example tool is <code class="command">semanage</code>, which is a command line tool for managing much of the policy such as SELinux user mappings, SELinux port mappings, and file contexts entries. Other examples of tools that use libsemanage include <code class="command">semodule</code> which uses it to manage the SELinux policy modules installed to the policy store and <code class="command">setsebool</code> which uses it manage SELinux policy booleans. Additionally, graphical tools are currently being developed to utilize the functionality provided by libsemanage.
</div></div></div></div></div><div class="qandadiv"><h4 class="title" id="id2929042">1.2. Controlling SELinux</h4></div><div class="toc"><dl><dt>Q: <a href="#id2929048">
How do I install/not install SELinux?
</a></dt><dt>Q: <a href="#id2929075">
As an administrator, what do I need to do to configure SELinux for my system?
</a></dt><dt>Q: <a href="#qa-using-s-c-securitylevel">
How do I enable/disable SELinux protection on specific daemons under the targeted policy?
</a></dt><dt>Q: <a href="#faq-entry-local.te">
In the past I have written local.te file in policy sources for my own local customization to policy, how do I do this in Fedora 5?
</a></dt><dt>Q: <a href="#id2929497">
I have some avc denials that I would like to allow, how do I do this?
</a></dt><dt>Q: <a href="#id2929670">
How can I help write policy?
</a></dt><dt>Q: <a href="#id3069707">
How do I switch the policy I am currently using?
</a></dt><dt>Q: <a href="#id3069893">
How can I back up files from an SELinux file system?
</a></dt><dt>Q: <a href="#faq-entry-public_html">
How do I make a user public_html directory work under SELinux?
</a></dt><dt>Q: <a href="#id3070107">
How do I turn SELinux off at boot?
</a></dt><dt>Q: <a href="#id3070170">
How do I turn enforcing on/off at boot?
</a></dt><dt>Q: <a href="#id3070271">
How do I temporarily turn off enforcing mode without having to reboot?
</a></dt><dt>Q: <a href="#id3070304">
How do I turn system call auditing on/off at boot?
</a></dt><dt>Q: <a href="#id3070350">
How do I temporarily turn off system-call auditing without having to reboot?
</a></dt><dt>Q: <a href="#id3070377">
How do I get status info about my SELinux installation?
</a></dt><dt>Q: <a href="#id3070407">
How do I write policy to allow a domain to use pam_unix.so?
</a></dt><dt>Q: <a href="#id3070489">
I created a new Policy Package, where do I put it to make sure that it gets loaded into the kernel?
</a></dt></dl></div><div class="qandadiv"><div class="qandaentry"><div class="question" id="id2929048"><label>Q:</label><div class="data"><div class="para">
How do I install/not install SELinux?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
The installer follows the choice you make in the <span class="guilabel"><strong>Firewall Configuration</strong></span> screen. The default running policy is the targeted policy, and it is on by default.
</div></div></div></div><div class="qandaentry"><div class="question" id="id2929075"><label>Q:</label><div class="data"><div class="para">
As an administrator, what do I need to do to configure SELinux for my system?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
The answer might be nothing. There are many Fedora users that don't even realize that they are using SELinux. SELinux provides protection for their systems with an out-of-the-box configuration. That said, there are a couple of things an administrator might want to do to configure their system. These include:
</div><div class="variablelist"><dl><dt><span class="term">booleans</span></dt><dd><div class="para">
Booleans are settings that can be flipped to alter SELinux policy behavior without having to write new policy. There are many booleans that can be set in Fedora, and they allow an administrator to configure SELinux to a great degree. To view the available booleans and modify their settings, use <code class="command">system-config-selinux</code> or the command line tool <code class="command">setsebool</code>.
</div></dd><dt><span class="term">setting customizable file contexts</span></dt><dd><div class="para">
Files on an SELinux system have a security context which is stored in the extended attribute of the file (behavior can vary from filesystem to filesystem, but this is how ext3 works). These are set by <code class="command">rpm</code> automatically, but sometimes a user might want to set a particular context on a file. An example would be setting the context on a <code class="filename">public_html</code> directory so that <code class="command">apache</code> can access it, as illustrated in <a class="xref" href="#faq-entry-public_html" title="Q:">How do I make a user public_html directory work under SELinux</a>.
</div><div class="para">
For a list of types that you might want to assign to files, see <code class="filename">/etc/selinux/targeted/contexts/customizable_types</code>. These are types commonly assigned to files by users and administrators. To set these, use the <code class="command">chcon</code> command. Note that the types in <code class="filename">customizable_types</code> are also preserved after a relabel, so relabeling the system will not undo this.
</div></dd><dt><span class="term">making badly behaving libraries work</span></dt><dd><div class="para">
There are many libraries around that behave badly and try to break the memory protections SELinux provides. These libraries should really be fixed, so please file a bug with the library maintainer. That said, they can be made to work. More information and solutions to make the libraries work can be found in <a class="xref" href="#faq-entry-unconfined_t" title="Q:">I have a process running as unconfined_t, and SELinux is still preventing my application from running</a>.
</div></dd></dl></div></div></div></div><div class="qandaentry"><div class="question" id="qa-using-s-c-securitylevel"><label>Q:</label><div class="data"><div class="para">
How do I enable/disable SELinux protection on specific daemons under the targeted policy?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
Use <code class="command">system-config-selinux</code>, also known as the <span class="application"><strong>Security Level Configuration</strong></span> graphical tool, to control the Boolean values of specific daemons. For example, if you need to disable SELinux for Apache to run correctly in your environment, you can disable the value in <code class="command">system-config-selinux</code>. This change disables the transition to the policy defined in <code class="filename">apache.te</code>, allowing <code class="command">httpd</code> to remain under regular Linux DAC security.
</div></div></div></div><div class="qandaentry"><div class="question" id="faq-entry-local.te"><label>Q:</label><div class="data"><div class="para">
In the past I have written local.te file in policy sources for my own local customization to policy, how do I do this in Fedora 5?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
Since Fedora 5 uses a modular policy, you don't have to have the complete policy source any more. Now, you can just create a local policy module for your local policy customizations. To do this, follow these steps.
</div><div class="procedure"><ol class="1"><li class="step" title="Step 1"><div class="para">
Create a temporary directory, and change into it.
</div><pre class="screen">
<code class="computeroutput">$ mkdir foo $ cd foo</code>
</pre></li><li class="step" title="Step 2"><div class="para">
Create empty te, if, and fc files.
</div><pre class="screen">
<code class="computeroutput">$ touch local.te local.if local.fc</code>
</pre></li><li class="step" title="Step 3"><div class="para">
Edit the local.te file, adding appropriate content. For example:
</div><pre class="screen">
policy_module(local, 1.0)
require {
attribute httpdcontent;
type smbd_t;
}
allow smbd_t httpdcontent:dir create_dir_perms;
allow smbd_t httpdcontent:{ file lnk_file } create_file_perms;
</pre><div class="para">
There are 3 parts to this file.
</div><div class="itemizedlist"><ul><li class="listitem"><div class="para">
The <code class="computeroutput">policy_module</code> call inserts statements to make the module work, including declaring the module and requiring system roles, classes, and permissions. Make sure the name declared here (local in this case) matches the name you gave the file (local.te).
</div></li><li class="listitem"><div class="para">
The <code class="computeroutput">require</code> block lists the symbols that this module uses that must be declared in other modules. In this case, we require the attribute <code class="computeroutput">httpdcontent</code> and the type <code class="computeroutput">smbd_t</code>. Note that all types and attributes you use in rules must be required here unless you are declaring them yourself below.
</div></li><li class="listitem"><div class="para">
The rest of the file is the policy, in this case consisting only of a couple of allow rules. You could also place type declarations, dontaudit statements, interface calls, or most things that can go in a normal te file here.
</div></li></ul></div></li><li class="step" title="Step 4"><div class="para">
Build the policy module.
</div><pre class="screen">
$ make -f /usr/share/selinux/devel/Makefile
Compliling targeted local module
/usr/bin/checkmodule: loading policy configuration from tmp/local.tmp
/usr/bin/checkmodule: policy configuration loaded
/usr/bin/checkmodule: writing binary representation (version 5) to tmp/local.mod
Creating targeted local.pp policy package
rm tmp/local.mod.fc tmp/local.mod
</pre><div class="para">
Note that this uses <code class="command">checkmodule</code>, which is part of the checkpolicy rpm. So, make sure you install this rpm before doing this.
</div></li><li class="step" title="Step 5"><div class="para">
Become root, and install the policy module with <code class="command">semodule</code>.
</div><pre class="screen">
<code class="computeroutput">$ su Password: # semodule -i local.pp</code>
</pre></li></ol></div><div class="note"><h2>Module are uniquely identified by name</h2><div class="para">
This means that if you later insert another <code class="filename">local.pp</code>, it will replace the one you just loaded. So, you should keep this <code class="filename">local.te</code> around, and just add to it if you need to make later policy customizations. If you lose it, but want to keep your previous policy around, just call the new local policy module something else (say local2.te).
</div></div></div></div></div><div class="qandaentry"><div class="question" id="id2929497"><label>Q:</label><div class="data"><div class="para">
I have some avc denials that I would like to allow, how do I do this?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
If you have specific AVC messages you can use <code class="command">audit2allow</code> to generate a Type Enforcement file that is ready to load as a policy module.
</div><pre class="screen">
<code class="command">audit2allow -M local < /tmp/avcs</code>
</pre><div class="para">
This creates a <code class="filename">local.pp</code> which you can then load into the kernel using <code class="command">semodule -i local.pp</code>. You can also edit the <code class="filename">local.te</code> to make additional customizations. To create a module allowing all the denials since the last reboot that you can then customize, execute the following:
</div><pre class="screen">
<code class="command">audit2allow -m local -l -i /var/log/messages > local.te</code>
</pre><div class="para">
Note that the above assumes you are not using the audit daemon. If you were using the audit daemon, then you should use <code class="filename">/var/log/audit/audit.log</code> instead of <code class="filename">/var/log/messages</code> as your log file. This generates a <code class="filename">local.te</code> file, that looks similar to the following:
</div><pre class="screen">
module local 1.0;
require {
class file { append execute execute_no_trans getattr ioctl read write };
type httpd_t;
type httpd_w3c_script_exec_t;
};
allow httpd_t httpd_w3c_script_exec_t:file { execute execute_no_trans getattr ioctl read };
</pre><div class="para">
You can hand edit this file, removing allow statements that you don't want to allow, and then recompile and reload it using
</div><div class="itemizedlist"><ul><li class="listitem"><div class="para">
<code class="command">checkmodule -M -m -o local.mod local.te</code> to compile the te file. Note that <code class="command">checkmodule</code> is part of the checkpolicy rpm, so you need to have it installed.
</div></li><li class="listitem"><div class="para">
<code class="command">semodule_package -o local.pp -m local.mod</code> to create a policy package.
</div></li><li class="listitem"><div class="para">
<code class="command">semodule -i local.pp</code> to add it to the current machine's running policy. This installs a new module called local with these rules into the module store.
</div></li></ul></div><div class="note"><h2>Important</h2><div class="para">
In order to load this newly created policy package into the kernel, you are required to execute <code class="command">semodule -i local.pp</code>
</div><div class="para">
Note that if you later install another module called local, it will replace this module. If you want to keep these rules around, then you either need to append future customizations to this local.te, or give future customizations a different name.
</div></div></div></div></div><div class="qandaentry"><div class="question" id="id2929670"><label>Q:</label><div class="data"><div class="para">
How can I help write policy?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
Your help is definitely appreciated.
</div><div class="itemizedlist"><ul><li class="listitem"><div class="para">
You can start by joining the Fedora SELinux mailing list. You can subscribe and read the archives at <a href="http://www.redhat.com/mailman/listinfo/fedora-selinux-list">http://www.redhat.com/mailman/listinfo/fedora-selinux-list</a>.
</div></li><li class="listitem"><div class="para">
The Unofficial FAQ has some generic policy writing HOWTO information. Refer to <a href="http://sourceforge.net/docman/display_doc.php?docid=14882&group_id=21...">http://sourceforge.net/docman/display_doc.php?docid=14882&group_id=21...</a> for more information.
</div></li><li class="listitem"><div class="para">
Another new resource is the Writing SE Linux policy HOWTO, located online at <a href="https://sourceforge.net/docman/display_doc.php?docid=21959&group_id=2...">https://sourceforge.net/docman/display_doc.php?docid=21959&group_id=2...</a>.
</div></li></ul></div><div class="para">
Also, since the Fedora policy is based on the <a class="xref" href="#faq-entry-whatis-refpolicy" title="Q:">Reference Policy</a>, you should look at the documentation on its project page. Another excellent source of information is the example policy files in <code class="filename">/usr/share/doc/selinux-policy-<em class="replaceable"><code>>version<</code></em></code> and <code class="filename">/usr/share/selinux/devel</code>.
</div><div class="para">
If you want to create a new policy domain, you can look at the interface files in the <code class="filename">/usr/share/selinux/devel</code> sub-directories. There is also a tool there to help you get started. The following procedure is an example:
</div><div class="procedure"><ol class="1"><li class="step" title="Step 1"><div class="para">
Use the <code class="command">sepolgen</code> command to generate your own <code class="filename">te</code>, <code class="filename">fc</code> and <code class="filename">if</code> files. The <code class="command">sepolgen</code> command takes two parameters: the name of the policy module and the full path to the executable. The following command gives a usage example:
</div><pre class="screen">
<code class="command">sepolgen <em class="replaceable"><code>mydaemon /usr/sbin/mydaemon</code></em></code>
</pre><div class="para">
It will prompt you for a few common domain characteristics, and will create three files: <code class="filename">mydaemon.te</code>, <code class="filename">mydaemon.fc</code> and <code class="filename">mydaemon.if</code>.
</div></li><li class="step" title="Step 2"><div class="para">
After you generate the policy files, use the supplied Makefile, <code class="filename">/usr/share/selinux/devel/Makefile</code>, to build a policy package (<code class="filename">mydaemon.pp</code>):
</div><pre class="screen">
<code class="command">make -f /usr/share/selinux/devel/Makefile</code>
</pre></li><li class="step" title="Step 3"><div class="para">
Now you can load the policy module, using <code class="command">semodule</code>, and relabel the executable using <code class="command">restorecon</code>:
</div><pre class="screen">
<code class="command">semodule -i <em class="replaceable"><code>mydaemon.pp</code></em></code>
<code class="command">restorecon -v <em class="replaceable"><code>/usr/sbin/mydaemon</code></em></code>
</pre></li><li class="step" title="Step 4"><div class="para">
Since you have very limited policy for your executable, SELinux will prevent it from doing much. Turn on permissive mode and then use the init script to start your daemon:
</div><pre class="screen">
<code class="command">setenforce 0</code>
<code class="command">service <em class="replaceable"><code>mydaemon</code></em> restart</code>
</pre></li></ol></div><div class="para">
Now you can collect avc messages. You can use <code class="command">audit2allow</code> to translate the avc messages to allow rules and begin updating your <code class="filename">mydaemon.te</code> file. You should search for interface macros in the <code class="filename">/usr/share/selinux/devel/include</code> directory and use these instead of using the allow rules directly, whenever possible. <code class="command">audit2allow -R</code> will attempt to find interfaces that match the allow rule. If you want more examples of policy, you could always install the selinux-policy src rpm, which contains all of the policy te files for the reference policy.
</div></div></div></div><div class="qandaentry"><div class="question" id="id3069707"><label>Q:</label><div class="data"><div class="para">
How do I switch the policy I am currently using?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="caution"><h2>Use caution when switching policy</h2><div class="para">
Other than trying out a new policy on a test machine for research purposes, you should seriously consider your situation before switching to a different policy on a production system. The act of switching is straightforward. This method is fairly safe, but you should try it first on a test system.
</div></div><div class="para">
To use the automated method, run the <span class="application"><strong>Security Level Configuration</strong></span> tool. From the GUI Main Menu, select <span class="guimenu"><strong>Desktop</strong></span> → <span class="guisubmenu"><strong>System Settings</strong></span> → <span class="guimenuitem"><strong>Security level</strong></span>, or from a terminal, run <code class="command">system-config-selinux</code>. Change the policy as desired and ensure that the <span class="guilabel"><strong>Relabel on next reboot</strong></span> option is enabled.
</div><div class="para">
You can also perform these steps manually with the following procedure:
</div><div class="procedure"><ol class="1"><li class="step" title="Step 1"><div class="para">
Edit <code class="filename">/etc/selinux/config</code> and change the type and the mode of policy:
</div><pre class="screen">
<strong class="userinput"><code>SELINUXTYPE=<em class="replaceable"><code>policyname</code></em> SELINUX=permissive</code></strong>
</pre><div class="para">
This step ensures are not locked out after rebooting. SELinux runs under the correct policy, but does allow you to login if there is a problem such as incorrect file context labeling.
</div></li><li class="step" title="Step 2"><div class="para">
Set the system to relabel the file system on reboot:
</div><pre class="screen">
<code class="command">touch /.autorelabel</code>
</pre></li><li class="step" title="Step 3"><div class="para">
Reboot the system. A clean restart under the new policy allows all system processes to be started in the proper context, and reveals any problems in the policy change.
</div></li><li class="step" title="Step 4"><div class="para">
Confirm your changes took effect with the following command:
</div><pre class="screen">
<code class="command">sestatus -v</code>
</pre><div class="para">
With the new system running in <code class="computeroutput">permissive</code> mode, check <code class="filename">/var/log/messages</code> for <code class="computeroutput">avc: denied</code> messages. These may indicate a problem that needs to be solved for the system to run without trouble under the new policy.
</div></li><li class="step" title="Step 5"><div class="para">
When you are satisfied that the system runs stable under the new policy, enable enforcing by changing <code class="computeroutput">SELINUX=enforcing</code>. You can either reboot or run <code class="command">setenforce 1</code> to turn enforcing on in real time.
</div></li></ol></div></div></div></div><div class="qandaentry"><div class="question" id="id3069893"><label>Q:</label><div class="data"><div class="para">
How can I back up files from an SELinux file system?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
You can now use the <code class="command">tar</code> command, you do not need to use <code class="command">star</code>.
</div></div></div></div><div class="qandaentry"><div class="question" id="faq-entry-public_html"><label>Q:</label><div class="data"><div class="para">
How do I make a user <code class="filename">public_html</code> directory work under SELinux?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
This process presumes that you have enabled user public HTML directories in your Apache configuration file, <code class="filename">/etc/httpd/conf/httpd.conf</code>. This process only covers serving static Web content. For more information about Apache; and SELinux, refer to <a href="http://fedora.redhat.com/docs/selinux-apache-fc3/">http://fedora.redhat.com/docs/selinux-apache-fc3/</a>.
</div><div class="procedure"><ol class="1"><li class="step" title="Step 1"><div class="para">
If you do not already have a <code class="filename">~/public_html</code> directory, create it and populate it with the files and folders to be served.
</div><pre class="screen">
<strong class="userinput"><code>cd ~ mkdir public_html cp /path/to/content ~/public_html</code></strong>
</pre></li><li class="step" title="Step 2"><div class="para">
At this point, <code class="command">httpd</code> is configured to serve the contents, but you still receive a <code class="computeroutput">403 forbidden</code> error. This is because <code class="command">httpd</code> is not allowed to read the security type for the directory and files as they are created in the user's home directory. Change the security context of the folder and its contents recursively using the <code class="option">-R</code> option:
</div><pre class="screen">
<strong class="userinput"><code>ls -Z -d public_html/</code></strong>
<code class="computeroutput">drwxrwxr-x auser auser user_u:object_r:user_home_t public_html</code>
<strong class="userinput"><code>chcon -R -t httpd_user_content_t public_html/ ls -Z -d public_html/</code></strong>
<code class="computeroutput">drwxrwxr-x auser auser user_u:object_r:httpd_user_content_t public_html/</code>
<strong class="userinput"><code>ls -Z public_html/</code></strong>
<code class="computeroutput">-rw-rw-r-- auser auser user_u:object_r:httpd_user_content_t bar.html</code>
<code class="computeroutput">-rw-rw-r-- auser auser user_u:object_r:httpd_user_content_t baz.html</code>
<code class="computeroutput">-rw-rw-r-- auser auser user_u:object_r:httpd_user_content_t foo.html</code>
</pre><div class="para">
You may notice at a later date that the user field, set here to <code class="computeroutput">user_u</code>, is changed to <code class="computeroutput">system_u</code>. This does not affect how the targeted policy works. The field that matters is the type field.
</div></li><li class="step" title="Step 3"><div class="para">
Your static webpages should now be served correctly. If you continue to have errors, ensure that the Boolean which enables user home directories is enabled. You can set it using <code class="command">system-config-selinux</code>. Select the <span class="guilabel"><strong>SELinux</strong></span> tab, and then select the <span class="guilabel"><strong>Modify SELinux Policy</strong></span> area. Select <code class="computeroutput">Allow HTTPD to read home directories</code>. The changes take effect immediately.
</div></li></ol></div></div></div></div><div class="qandaentry"><div class="question" id="id3070107"><label>Q:</label><div class="data"><div class="para">
How do I turn SELinux off at boot?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
Set <code class="computeroutput">SELINUX=disabled</code> in <code class="filename">/etc/selinux/config</code>.
</div><div class="para">
Alternatively, you can add <code class="option">selinux=0</code> to your kernel boot parameters. However, this option is not recommended.
</div><div class="caution"><h2>Be careful when disabling SELinux</h2><div class="para">
If you boot with <code class="option">selinux=0</code>, any files you create while SELinux is disabled do not have SELinux context information. The file system is marked for relabeling at the next boot. If an unforeseen problem prevents you from rebooting normally, you may need to boot in single-user mode for recovery. Add the option <code class="option">emergency</code> to your kernel boot parameters.
</div></div></div></div></div><div class="qandaentry"><div class="question" id="id3070170"><label>Q:</label><div class="data"><div class="para">
How do I turn enforcing on/off at boot?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
You can specify the SELinux mode using the configuration file <code class="filename">/etc/sysconfig/selinux</code>.
</div><pre class="screen">
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=<strong class="userinput"><code><em class="replaceable"><code>enforcing</code></em></code></strong>
# SELINUXTYPE= can take one of these two values:
# targeted - Only targeted network daemons are protected.
# mls - Multi Level Security protection.
SELINUXTYPE=<strong class="userinput"><code><em class="replaceable"><code>targeted</code></em></code></strong>
</pre><div class="para">
Setting the value to <code class="computeroutput">enforcing</code> is the same as adding <code class="option">enforcing=1</code> to the kernel boot parameters. Setting the value to <code class="computeroutput">permissive</code> is the same as adding <code class="option">enforcing=0</code> to the kernel boot parameters.
</div><div class="para">
However, setting the value to <code class="computeroutput">disabled</code> is not the same as the <code class="option">selinux=0</code> kernel boot parameter. Rather than fully disabling SELinux in the kernel, the <code class="computeroutput">disabled</code> setting instead turns enforcing off and skips loading a policy.
</div><div class="important"><h2>SELinux Configuration Precedence</h2><div class="para">
The command line kernel parameter overrides the configuration file.
</div></div></div></div></div><div class="qandaentry"><div class="question" id="id3070271"><label>Q:</label><div class="data"><div class="para">
How do I temporarily turn off enforcing mode without having to reboot?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
Occasionally you may need to perform an action that is normally prevented by policy. Run the command <code class="command">setenforce 0</code> to turn off enforcing mode in real time. When you are finished, run <code class="command">setenforce 1</code> to turn enforcing back on.
</div></div></div></div><div class="qandaentry"><div class="question" id="id3070304"><label>Q:</label><div class="data"><div class="para">
How do I turn system call auditing on/off at boot?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
Add <code class="option">audit=1</code> to your kernel command line to turn system call auditing on. Add <code class="option">audit=0</code> to your kernel command line to turn system call auditing off.
</div><div class="para">
System-call auditing is <span class="emphasis"><em>on</em></span> by default. When on, it provides information about the system call that was executing when SELinux generated a <code class="computeroutput">denied</code> message. The error message is helpful when debugging policy.
</div></div></div></div><div class="qandaentry"><div class="question" id="id3070350"><label>Q:</label><div class="data"><div class="para">
How do I temporarily turn off system-call auditing without having to reboot?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
Run <code class="command">auditctl -e 0</code>. Note that this command does not affect auditing of SELinux AVC denials.
</div></div></div></div><div class="qandaentry"><div class="question" id="id3070377"><label>Q:</label><div class="data"><div class="para">
How do I get status info about my SELinux installation?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
As root, execute the command <code class="command">/usr/sbin/sestatus -v</code>. For more information, refer to the <code class="filename">sestatus(8)</code> manual page.
</div></div></div></div><div class="qandaentry"><div class="question" id="id3070407"><label>Q:</label><div class="data"><div class="para">
How do I write policy to allow a domain to use pam_unix.so?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
Very few domains in the SELinux world are allowed to read the <code class="filename">/etc/shadow</code> file. There are constraint rules that prevent policy writers from writing code like
</div><pre class="screen">
<code class="command">allow mydomain_t shadow_t:file read;</code>
</pre><div class="para">
In RHEL4 you can setup your domain to use the <code class="command">unix_chkpwd</code> command. The easiest way is to use the <code class="command">unix_chkpwd</code> attribute. So if you were writing policy for an ftpd daemon you would write something like
</div><pre class="screen">
<code class="command">daemon_domain(vsftpd, `auth_chkpwd')</code>
</pre><div class="para">
This would create a context where vsftpd_t -> chkpwd_exec_t -> system_chkpwd_t which can read <code class="filename">/etc/shadow</code>, while vsftpd_t is not able to read it.
</div><div class="para">
In Fedora /RHEL5, add the rule
</div><pre class="screen">
<code class="command">auth_domtrans_chk_passwd(vsftpd_t)</code>
</pre></div></div></div><div class="qandaentry"><div class="question" id="id3070489"><label>Q:</label><div class="data"><div class="para">
I created a new Policy Package, where do I put it to make sure that it gets loaded into the kernel?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
You need to execute the command <code class="command">semodule -i myapp.pp</code>. This modifies the policy that is stored on the machine. Your policy module now is loaded with the rest of the policy. You can even remove the pp file from the system.
</div><div class="para">
<code class="command">semodule -l</code> lists the currently loaded modules.
</div><pre class="screen">
<code class="computeroutput">#semodule -i myapp 1.2.1</code>
</pre><div class="para">
If you later would like to remove the policy package, you can execute <code class="command">semodule -r myapp</code>.
</div></div></div></div></div><div class="qandadiv"><h4 class="title" id="faq-div-resolving-problems">1.3. Resolving Problems</h4></div><div class="toc"><dl><dt>Q: <a href="#id3070551">
Where are SELinux AVC messages (denial logs, etc.) stored?
</a></dt><dt>Q: <a href="#id3070593">
My application isn't working as expected and I am seeing avc: denied messages. How do I fix this?
</a></dt><dt>Q: <a href="#id3070681">
I installed Fedora on a system with an existing /home partition, and now I can't log in.
</a></dt><dt>Q: <a href="#id3070768">
After relabeling my /home using setfiles or fixfiles, am I still be able to read /home with a non-SELinux-enabled system?
</a></dt><dt>Q: <a href="#id3070818">
How do I share directories using NFS between Fedora and non-SELinux systems?
</a></dt><dt>Q: <a href="#id3070880">
How can I create a new Linux user account with the user's home
</a></dt><dt>Q: <a href="#id3070962">
Does the su command change my SELinux identity and role?
</a></dt><dt>Q: <a href="#id3071028">
I'm having troubles with avc errors filling my logs for a particular program. How do I choose not to audit the access for it?
</a></dt><dt>Q: <a href="#id3071089">
Even running in permissive mode, I'm getting a large number of avc denied messages.
</a></dt><dt>Q: <a href="#id3071133">
I get a specific permission denial only when SELinux is in enforcing mode, but I don't see any audit messages in /var/log/messages (or /var/log/audit/audit.log if using the audit daemon). How can I identify the cause of these silent denials?
</a></dt><dt>Q: <a href="#id3071241">
Why do I not see the output when I run certain daemons in debug or interactive mode?
</a></dt><dt>Q: <a href="#id3071332">
When I do an upgrade of the policy package (for example, using yum), what happens with the policy? Is it updated automatically?
</a></dt><dt>Q: <a href="#id3071420">
If the policy shipping with an application package changes in a way that requires relabeling, will RPM handle relabeling the files owned by the package?
</a></dt><dt>Q: <a href="#id3071498">
Why do binary policies distributed with Fedora, such as /etc/selinux/<policyname>/policy/policy.<version>, and those I compile myself have different sizes and MD5 checksums?
</a></dt><dt>Q: <a href="#id3071561">
Will new policy packages disable my system?
</a></dt><dt>Q: <a href="#id3071597">
My console is being flooded with messages. How do I turn them off?
</a></dt><dt>Q: <a href="#id3071628">
Can I test the default policy without installing the policy source?
</a></dt><dt>Q: <a href="#id3071712">
Why are some of my KDE applications having trouble under SELinux?
</a></dt><dt>Q: <a href="#id3071784">
Why does SELINUX=disabled not work for me?
</a></dt><dt>Q: <a href="#faq-entry-unconfined_t">
I have a process running as unconfined_t, and SELinux is still preventing my application from running.
</a></dt><dt>Q: <a href="#id3071992">
What do these rpm errors mean?
</a></dt><dt>Q: <a href="#id3072060">
I want to run a daemon on a non standard port but SELinux will not allow me. How do get this to work?
</a></dt><dt>Q: <a href="#id3072095">
I am writing a php script that needs to create files and possibly execute them. SELinux policy is preventing this. What should I do?
</a></dt><dt>Q: <a href="#id3072149">
I am setting up swapping to a file, but I am seeing AVC messages in my log files?
</a></dt><dt>Q: <a href="#id3072186">
Please explain the relabelto/relabelfrom permissions?
</a></dt></dl></div><div class="qandadiv"><div class="qandaentry"><div class="question" id="id3070551"><label>Q:</label><div class="data"><div class="para">
Where are SELinux AVC messages (denial logs, etc.) stored?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
In Fedora 2 and 3, SELinux AVC messages could be found in <code class="filename">/var/log/messages</code>. In Fedora 4, the audit daemon was added, and these messages moved to <code class="filename">/var/log/audit/audit.log</code>. In Fedora 5, the audit daemon is not installed by default, and consequently these messages can be found in <code class="filename">/var/log/messages</code> unless you choose to install and enable the audit daemon, in which case AVC messages will be in <code class="filename">/var/log/audit/audit.log</code>.
</div></div></div></div><div class="qandaentry"><div class="question" id="id3070593"><label>Q:</label><div class="data"><div class="para">
My application isn't working as expected and I am seeing <code class="computeroutput">avc: denied</code> messages. How do I fix this?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
This message means that the current SELinux policy is not allowing the application to do something. There are a number of reasons this could happen.
</div><div class="para">
First, one of the files the application is trying to access could be mislabeled. If the AVC message refers to a specific file, inspect its current label with <code class="command">ls -alZ <em class="replaceable"><code>/path/to/file</code></em></code>. If it seems wrong, use the command <code class="command">restorecon -v <em class="replaceable"><code>/path/to/file</code></em></code> to restore the file's default context. If you have a large number of denials related to files, you may want to use <code class="command">fixfiles relabel</code>, or run <code class="command">restorecon -R <em class="replaceable"><code>/path</code></em></code> to recursively relabel a directory path.
</div><div class="para">
Denials are sometimes due to a configuration change in the program that triggered the denial message. For example, if you change Apache to also listen on port 8800, you must also change the security policy, <code class="filename">apache.te</code>.
</div><div class="para">
If you are having trouble getting a specific application like Apache to work, refer to <a class="xref" href="#qa-using-s-c-securitylevel" title="Q:">How to use system-config-selinux</a> for information on disabling enforcement just for that application.
</div></div></div></div><div class="qandaentry"><div class="question" id="id3070681"><label>Q:</label><div class="data"><div class="para">
I installed Fedora on a system with an existing <code class="filename">/home</code> partition, and now I can't log in.
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
Your <code class="filename">/home</code> partition is not labeled correctly. You can easily fix this two different ways.
</div><div class="para">
If you just want to relabel <code class="filename">/home</code> recursively:
</div><pre class="screen">
<code class="command">/sbin/restorecon -v -R /home</code>
</pre><div class="para">
If you want to be sure there are no other files incorrectly labeled, you can relabel the entire file system:
</div><pre class="screen">
<code class="command">/sbin/fixfiles relabel</code>
</pre><div class="para">
You must have the <code class="filename">policycoreutils</code> package installed to use <code class="command">fixfiles</code>.
</div></div></div></div><div class="qandaentry"><div class="question" id="id3070768"><label>Q:</label><div class="data"><div class="para">
After relabeling my <code class="filename">/home</code> using <code class="command">setfiles</code> or <code class="command">fixfiles</code>, am I still be able to read <code class="filename">/home</code> with a non-SELinux-enabled system?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
You can read the files from a non-SELinux distribution, or one with SELinux disabled. However, files created by a system not using SELinux systems do not have a security context, nor do any files you remove and recreate. This could be a challenge with files such as <code class="filename">~/.bashrc</code>. You may have to relabel <code class="filename">/home</code> when you reboot the SELinux enabled Fedora system.
</div></div></div></div><div class="qandaentry"><div class="question" id="id3070818"><label>Q:</label><div class="data"><div class="para">
How do I share directories using NFS between Fedora and non-SELinux systems?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
Just as NFS transparently supports many file system types, it can be used to share directories between SELinux and non-SELinux systems.
</div><div class="para">
When you mount a non-SELinux file system via NFS, by default SELinux treats all the files in the share as having a context of <code class="computeroutput">nfs_t</code>. You can override the default context by setting it manually, using the <code class="option">context=</code> option. The following command makes the files in the NFS mounted directory appear to have a context of <code class="computeroutput">system_u:object_r:tmp_t</code> to SELinux:
</div><pre class="screen">
<code class="command">mount -t nfs -o context=system_u:object_r:tmp_t server:/shared/foo /mnt/foo</code>
</pre><div class="para">
When SELinux exports a file system via NFS, newly created files have the context of the directory they were created in. In other words, the presence of SELinux on the remote mounting system has no effect on the local security contexts.
</div></div></div></div><div class="qandaentry"><div class="question" id="id3070880"><label>Q:</label><div class="data"><div class="para">
How can I create a new Linux user account with the user's home
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
You can create your new user with the standard <code class="command">useradd</code> command. First you must become <code class="systemitem">root</code>.
</div><div class="para">
For the targeted policy:
</div><pre class="screen">
<strong class="userinput"><code>su - root id -Z</code></strong>
<code class="computeroutput">root:system_r:unconfined_t</code>
<strong class="userinput"><code>useradd auser ls -Z /home</code></strong>
<code class="computeroutput">drwx------ auser auser root:object_r:user_home_dir_t /home/auser</code>
</pre><div class="para">
The initial context for a new user directory has an identity of <code class="computeroutput">root</code>. Subsequent relabeling of the file system changes the identity to <code class="computeroutput">system_u</code>. These are functionally the same since the role and type are identical (<code class="computeroutput">object_r:user_home_dir_t</code>.)
</div></div></div></div><div class="qandaentry"><div class="question" id="id3070962"><label>Q:</label><div class="data"><div class="para">
Does the <code class="command">su</code> command change my SELinux identity and role?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
In previous versions of Fedora, security context transitions were integrated into the <code class="command">su</code> via <code class="computeroutput">pam_selinux</code>. This turned out to be more trouble than it was worth, and is quite unnecessary on a system running targeted policy. So, this is no longer the case. Now, <code class="command">su</code>/<code class="command">sudo</code> only change the Linux identy. You will need to use <code class="command">newrole</code> to change the SELinux identity, role, or level.
</div><div class="para">
Other forms of Linux/<span class="trademark">UNIX</span>® identity change, for example <code class="command">setuid(2)</code>, also do not cause an SELinux identity change.
</div></div></div></div><div class="qandaentry"><div class="question" id="id3071028"><label>Q:</label><div class="data"><div class="para">
I'm having troubles with <code class="command">avc</code> errors filling my logs for a particular program. How do I choose not to audit the access for it?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
If you wanted to not audit <code class="command">dmesg</code>, for example, you would put this in your <code class="filename">dmesg.te</code> file:
</div><pre class="screen">
<strong class="userinput"><code>dontaudit dmesg_t userdomain:fd { use };</code></strong>
</pre><div class="para">
This eliminates the error output to the terminal for all user domains, including <code class="varname">user</code>, <code class="varname">staff</code> and <code class="varname">sysadm</code>.
</div></div></div></div><div class="qandaentry"><div class="question" id="id3071089"><label>Q:</label><div class="data"><div class="para">
Even running in permissive mode, I'm getting a large number of <code class="computeroutput">avc denied</code> messages.
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
In a non-enforcing mode, you should actually receive <span class="emphasis"><em>more</em></span> messages than in enforcing mode. The kernel logs each access denial as if you were in an enforcing mode. Since you are not restricted by policy enforcement, you can perform more actions, which results in more denials being logged.
</div><div class="para">
If an application running under an enforcing mode is denied access to read a number of files in a directory, it is stopped once at the beginning of the action. In a non-enforcing mode, the application is not stopped from traversing the directory tree, and generates a denial message for each file read in the directory.
</div></div></div></div><div class="qandaentry"><div class="question" id="id3071133"><label>Q:</label><div class="data"><div class="para">
I get a specific permission denial only when SELinux is in enforcing mode, but I don't see any audit messages in <code class="filename">/var/log/messages</code> (or <code class="filename">/var/log/audit/audit.log</code> if using the audit daemon). How can I identify the cause of these silent denials?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
The most common reason for a silent denial is when the policy contains an explicit <code class="computeroutput">dontaudit</code> rule to suppress audit messages. The <code class="computeroutput">dontaudit</code> rule is often used this way when a benign denial is filling the audit logs.
</div><div class="para">
To look for your particular denial, enable auditing of all <code class="computeroutput">dontaudit</code> rules:
</div><pre class="screen">
<code class="command">semodule -b /usr/share/selinux/targeted/enableaudit.pp</code>
</pre><div class="caution"><h2>Enabled <code class="computeroutput">dontaudit</code> output is verbose</h2><div class="para">
Enabling auditing of all <code class="computeroutput">dontaudit</code> rules likely produce a large amount of audit information, most of which is irrelevant to your denial.
</div><div class="para">
Use this technique only if you are specifically looking for an audit message for a denial that seems to occur silently. You want to re-enable <code class="computeroutput">dontaudit</code> rules as soon as possible.
</div></div><div class="para">
Once you have found your problem you can reset to the default mode by executing
</div><pre class="screen">
<code class="command">semodule -b /usr/share/selinux/targeted/base.pp</code>
</pre></div></div></div><div class="qandaentry"><div class="question" id="id3071241"><label>Q:</label><div class="data"><div class="para">
Why do I not see the output when I run certain daemons in debug or interactive mode?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
SELinux intentionally disables access to the tty devices to stop daemons from communicating back with the controlling terminal. This communication is a potential security hole because such daemons could insert commands into the controlling terminal. A broken or compromised program could use this hole to cause serious problems.
</div><div class="para">
There are a few ways you can capture standard output from daemons. One method is to pipe the output to the cat command.
</div><pre class="screen">
<code class="command">snmpd -v | cat</code>
</pre><div class="para">
When debugging a daemon, you may want to turn off the transition of the daemon to its specific domain. You can do this using <code class="command">system-config-selinux</code> or <code class="command">setsebool</code> on the command line.
</div><div class="para">
A final option is to turn off enforcing mode while debugging. Issue the command <code class="command">setenforce 0</code> to turn off enforcing mode, and use the command <code class="command">setenforce 1</code> to re-enable SELinux when you are finished debugging.
</div></div></div></div><div class="qandaentry"><div class="question" id="id3071332"><label>Q:</label><div class="data"><div class="para">
When I do an upgrade of the policy package (for example, using <code class="command">yum</code>), what happens with the policy? Is it updated automatically?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
Policy reloads itself when the package is updated. This behavior replaces the manual <code class="command">make load</code>.
</div><div class="para">
In certain situations, you may need to relabel the file system. This might occur as part of an SELinux bug fix where file contexts become invalid, or when the policy update makes changes to the file <code class="filename">/etc/selinux/targeted/contexts/files/file_contexts</code>.
</div><div class="para">
After the file system is relabeled, a <code class="command">reboot</code> is not required, but is useful in ensuring every process and program is running in the proper domain. This is highly dependent on the changes in the updated policy.
</div><div class="para">
To relabel, you have several options. You may use the <code class="command">fixfiles</code> command:
</div><pre class="screen">
<code class="command">fixfiles relabel reboot</code>
</pre><div class="para">
Alternately, use the <code class="filename">/.autorelabel</code> mechanism:
</div><pre class="screen">
<code class="command">touch /.autorelabel reboot</code>
</pre></div></div></div><div class="qandaentry"><div class="question" id="id3071420"><label>Q:</label><div class="data"><div class="para">
If the policy shipping with an application package changes in a way that requires relabeling, will RPM handle relabeling the files owned by the package?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
Yes. The security contexts for the files owned by the package are stored in the header data for the package. The file contexts are set directly after the <code class="command">cpio</code> copy, as the package files are being put on the disk.
</div></div></div></div><div class="qandaentry"><div class="question" id="id3071498"><label>Q:</label><div class="data"><div class="para">
Why do binary policies distributed with Fedora, such as <code class="filename">/etc/selinux/<em class="replaceable"><code><policyname></code></em>/policy/policy.<em class="replaceable"><code><version></code></em></code>, and those I compile myself have different sizes and MD5 checksums?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
When you install a policy package, pre-compiled binary policy files are put directly into <code class="filename">/etc/selinux</code>. The different build environments will make target files that have different sizes and MD5 checksums.
</div></div></div></div><div class="qandaentry"><div class="question" id="id3071561"><label>Q:</label><div class="data"><div class="para">
Will new policy packages disable my system?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
There is a possibility that changes in the policy package or in the policy shipping with an application package can cause errors, more denials, or other unknown behaviors. You can discover which package caused the breakage by reverting policy and application packages one at a time. If you don't want to return to the previous package, the older version of the configuration files will be saved with the extension <code class="filename">.rpmsave</code>. Use the mailing lists, bugzilla, and IRC to help you work through your problem. If you are able, write or fix policy to resolve your problem.
</div></div></div></div><div class="qandaentry"><div class="question" id="id3071597"><label>Q:</label><div class="data"><div class="para">
My console is being flooded with messages. How do I turn them off?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
To regain useful control, turn off kernel messages to the console with this command:
</div><pre class="screen">
<code class="command">dmesg -n 1</code>
</pre></div></div></div><div class="qandaentry"><div class="question" id="id3071628"><label>Q:</label><div class="data"><div class="para">
Can I test the default policy without installing the policy source?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
You can test SELinux default policy by installing just the <code class="filename">selinux-policy-<em class="replaceable"><code>policyname</code></em></code> and <code class="filename">policycoreutils</code> packages. Without the policy source installed, the <code class="command">fixfiles</code> command automates the file system relabeling.
</div><div class="para">
The command <code class="command">fixfiles relabel</code> is the equivalent of <code class="command">make relabel</code>. During the relabeling, it will delete all of the files in <code class="filename">/tmp</code>, cleaning up files which may have old file context labels.
</div><div class="para">
Other commands are <code class="command">fixfiles check</code>, which checks for mislabeled files, and <code class="command">fixfiles restore</code>, which fixes the mislabeled files but does not delete the files in <code class="filename">/tmp</code>. The <code class="command">fixfiles</code> command does not take a list of directories as an argument, because it relabels the entire file system. If you need to relabel a specific directory path, use <code class="command">restorecon</code>.
</div></div></div></div><div class="qandaentry"><div class="question" id="id3071712"><label>Q:</label><div class="data"><div class="para">
Why are some of my KDE applications having trouble under SELinux?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
KDE executables always appear as <code class="command">kdeinit</code>, which limits what can be done with SELinux policy. This is because every KDE application runs in the domain for <code class="command">kdeinit</code>.
</div><div class="para">
Problems often arise when installing SELinux because it is not possible to relabel <code class="filename">/tmp</code> and <code class="filename">/var/tmp</code>. There is no good method of determining which file should have which context.
</div><div class="para">
The solution is to fully log out of KDE and remove all KDE temporary files:
</div><pre class="screen">
<code class="command">rm -rf /var/tmp/kdecache-<em class="replaceable"><code><username></code></em> rm -rf /var/tmp/<em class="replaceable"><code><other_kde_files></code></em></code>
</pre><div class="para">
At your next login, your problem should be fixed.
</div></div></div></div><div class="qandaentry"><div class="question" id="id3071784"><label>Q:</label><div class="data"><div class="para">
Why does <code class="option">SELINUX=disabled</code> not work for me?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
Be careful of white space in the file <code class="filename">/etc/sysconfig/selinux</code>. The code is very sensitive to white space, even trailing space.
</div></div></div></div><div class="qandaentry"><div class="question" id="faq-entry-unconfined_t"><label>Q:</label><div class="data"><div class="para">
I have a process running as <code class="computeroutput">unconfined_t</code>, and SELinux is still preventing my application from running.
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
We have begun to confine the <code class="computeroutput">unconfined_t</code> domain somewhat. SELinux restricts certain memory protection operation. Following is a list of those denials, as well as possible reasons and solutions for those denials. For more information on these restrictions, see <a href="http://people.redhat.com/drepper/selinux-mem.html">http://people.redhat.com/drepper/selinux-mem.html</a>.
</div><div class="para">
These show up in <code class="filename">/var/log/messages</code> (or <code class="filename">/var/log/audit/audit.log</code> if using the audit daemon) as avc denials. These can also show up when running programs with errors like
</div><pre class="screen">
error while loading shared libraries: /usr/lib/libavutil.so.49:
cannot restore segment prot after reloc: Permission denied
</pre><div class="para">
which indicates that the library is trying to perform a text relocation and failing. Text relocations are bad, but can be allowed via the first hint below. Below are the SELinux memory permissions that are denied, as well as hints at how to address these denials.
</div><div class="variablelist"><dl><dt><span class="term"><code class="computeroutput">execmod</code></span></dt><dd><div class="para">
This is usually based on a library label. You can permanently change the context on the library with the following commands
</div><pre class="screen">
# /usr/sbin/semanage fcontext -a -t textrel_shlib_t '/usr/lib/libavutil.so.49.0.0'
# /sbin/restorecon -v /usr/lib/libavutil.so.49.0.0
</pre><div class="para">
with the particular library at fault in place of <code class="filename">/usr/lib/libavutil.so.49.0.0</code>. Now your application should be able to run. Please report this as a bugzilla.
</div></dd><dt><span class="term"><code class="computeroutput">execstack</code></span></dt><dd><div class="para">
Attempt to <code class="command">execstack -c <em class="replaceable"><code>LIBRARY</code></em></code>. Now try your application again. If the application now works, the library was mistakenly marked as requiring <code class="computeroutput">execstack</code>. Please report this as a bugzilla.
</div></dd><dt><span class="term"><code class="computeroutput">execmem, execheap</code></span></dt><dd><div class="para">
A boolean for each one of these memory check errors have been provided. So if you need to run an application requiring either of these permissions, you can set the boolean allow_exec* to fix the problem. For instance if you try to run an application and you get an AVC message containing an <code class="computeroutput">execstack</code> failure. You can set the boolean with
</div><pre class="screen">
<code class="command">setsebool -P allow_execstack=1</code>
</pre></dd></dl></div></div></div></div><div class="qandaentry"><div class="question" id="id3071992"><label>Q:</label><div class="data"><div class="para">
What do these rpm errors mean?
</div></div></div><div class="answer"><label>A:</label><div class="data"><pre class="screen">
restorecon reset /etc/modprobe.conf context system_u:object_r:etc_runtime_t->system_u:object_r:modules_conf_t
restorecon reset /etc/cups/ppd/homehp.ppd context user_u:object_r:cupsd_etc_t->system_u:object_r:cupsd_rw_etc_t
</pre><div class="para">
During the update process, the selinux package runs restorecon on the difference between the previously install policy file_context and the newly install policy context. This maintains the correct file context on disk.
</div><pre class="screen">
<code class="computeroutput">libsepol.sepol_genbools_array: boolean hidd_disable_trans no longer in policy</code>
</pre><div class="para">
This indicates that the updated policy has removed the boolean from policy.
</div></div></div></div><div class="qandaentry"><div class="question" id="id3072060"><label>Q:</label><div class="data"><div class="para">
I want to run a daemon on a non standard port but SELinux will not allow me. How do get this to work?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
You can use the <code class="command">semanage</code> command to define additional ports. So say you want httpd to be able to listen on port 8082. You could enter the command.
</div><pre class="screen">
<code class="command">semanage port -a -p tcp -t http_port_t 8082</code>
</pre></div></div></div><div class="qandaentry"><div class="question" id="id3072095"><label>Q:</label><div class="data"><div class="para">
I am writing a php script that needs to create files and possibly execute them. SELinux policy is preventing this. What should I do?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
First, you should never allow a system service to execute anything it can write. This gives an attacker the ability to upload malicious code to the server and then execute it, which is something we want to prevent.
</div><div class="para">
If you merely need to allow your script to create (non-executable) files, this is possible. That said, you should avoid having system applications writing to the <code class="filename">/tmp</code> directory, since users tend to use the <code class="filename">/tmp</code> directory also. It would be better to create a directory elsewhere which could be owned by the apache process and allow your script to write to it. You should label the directory <code class="computeroutput">httpd_sys_script_rw_t</code>, which will allow apache to read and write files to that directory. This directory could be located anywhere that apache can get to (even <code class="filename">$HOME/public_html/</code>).
</div></div></div></div><div class="qandaentry"><div class="question" id="id3072149"><label>Q:</label><div class="data"><div class="para">
I am setting up swapping to a file, but I am seeing AVC messages in my log files?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
You need to identify the swapfile to SELinux by setting its file context to <code class="computeroutput">swapfile_t</code>.
</div><pre class="screen">
<code class="command">chcon -t swapfile_t <em class="replaceable"><code>SWAPFILE</code></em></code>
</pre></div></div></div><div class="qandaentry"><div class="question" id="id3072186"><label>Q:</label><div class="data"><div class="para">
Please explain the <code class="computeroutput">relabelto</code>/<code class="computeroutput">relabelfrom</code> permissions?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
For files, <code class="computeroutput">relabelfrom</code> means "Can domain D relabel a file from (i.e. currently in) type T1?" and <code class="computeroutput">relabelto</code> means "Can domain D relabel a file to type T2?", so both checks are applied upon a file relabeling, where T1 is the original type of the type and T2 is the new type specified by the program.
</div><div class="para">
Useful documents to look at:
</div><div class="itemizedlist"><ul><li class="listitem"><div class="para">
Object class and permission summary by Tresys <a href="http://tresys.com/selinux/obj_perms_help.shtml">http://tresys.com/selinux/obj_perms_help.shtml</a>
</div></li><li class="listitem"><div class="para">
Implementing SELinux as an LSM technical report (describes permission checks on a per-hook basis) <a href="http://www.nsa.gov/selinux/papers/module-abs.cfm">http://www.nsa.gov/selinux/papers/module-abs.cfm</a>. This is also available in the selinux-doc package (and more up-to-date there).
</div></li><li class="listitem"><div class="para">
Integrating Flexible Support for Security Policies into the Linux Operating System - technical report (describes original design and implementation, including summary tables of classes, permissions, and what permission checks are applied to what system calls. It is not entirely up-to-date with current implementation, but a good resource nonetheless). <a href="http://www.nsa.gov/selinux/papers/slinux-abs.cfm">http://www.nsa.gov/selinux/papers/slinux-abs.cfm</a>
</div></li></ul></div></div></div></div></div><div class="qandadiv"><h4 class="title" id="faq-div-deploying-selinux">1.4. Deploying SELinux</h4></div><div class="toc"><dl><dt>Q: <a href="#id3072295">
What file systems can I use for SELinux?
</a></dt><dt>Q: <a href="#id3072333">
How does SELinux impact system performance?
</a></dt><dt>Q: <a href="#id3072362">
What types of deployments, applications, and systems should I leverage SELinux in?
</a></dt><dt>Q: <a href="#id3072425">
How does SELinux affect third-party applications?
</a></dt></dl></div><div class="qandadiv"><div class="qandaentry"><div class="question" id="id3072295"><label>Q:</label><div class="data"><div class="para">
What file systems can I use for SELinux?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
The file system must support <code class="computeroutput">xattr</code> labels in the right <em class="parameter"><code>security.*</code></em> namespace. In addition to ext2/ext3, XFS has recently added support for the necessary labels.
</div><div class="para">
Note that XFS SELinux support is broken in upstream kernel 2.6.14 and 2.6.15, but fixed (worked around) in 2.6.16. Your kernel must include this fix if you choose to use XFS with SELinux.
</div></div></div></div><div class="qandaentry"><div class="question" id="id3072333"><label>Q:</label><div class="data"><div class="para">
How does SELinux impact system performance?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
This is a variable that is hard to measure, and is heavily dependent on the tuning and usage of the system running SELinux. When performance was last measured, the impact was around 7% for completely untuned code. Subsequent changes in system components such as networking are likely to have made that worse in some cases. SELinux performance tuning continues to be a priority of the development team.
</div></div></div></div><div class="qandaentry"><div class="question" id="id3072362"><label>Q:</label><div class="data"><div class="para">
What types of deployments, applications, and systems should I leverage SELinux in?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
Initially, SELinux has been used on Internet facing servers that are performing a few specialized functions, where it is critical to keep extremely tight security. Administrators typically strip such a box of all extra software and services, and run a very small, focused set of services. A Web server or mail server is a good example.
</div><div class="para">
In these edge servers, you can lock down the policy very tightly. The smaller number of interactions with other components makes such a lock down easier. A dedicated system running a specialized third-party application would also be a good candidate.
</div><div class="para">
In the future, SELinux will be targeted at all environments. In order to achieve this goal, the community and <em class="firstterm">independent software vendors</em> (<abbr class="abbrev">ISV</abbr>s) must work with the SELinux developers to produce the necessary policy.
</div><div class="para">
For more information about these policies, refer to <a class="xref" href="#qa-whatis-policy" title="Q:">What is SELinux policy?</a>.
</div></div></div></div><div class="qandaentry"><div class="question" id="id3072425"><label>Q:</label><div class="data"><div class="para">
How does SELinux affect third-party applications?
</div></div></div><div class="answer"><label>A:</label><div class="data"><div class="para">
One goal of implementing a targeted SELinux policy in Fedora is to allow third-party applications to work without modification. The targeted policy is transparent to those unaddressed applications, and it falls back on standard Linux DAC security. These applications, however, will not be running in an extra-secure manner. You or another provider must write policy to protect these applications with MAC security.
</div><div class="para">
It is impossible to predict how every third-party application might behave with SELinux, even running the targeted policy. You may be able to fix issues that arise by changing the policy. You may find that SELinux exposes previously unknown security issues with your application. You may have to modify the application to work under SELinux.
</div><div class="para">
Note that with the addition of <a class="xref" href="#faq-entry-whatare-policy-modules" title="Q:">Policy Modules</a>, it is now possible for third-party developers to include policy modules with their application. If you are a third-party developer or a package-maintainer, please consider including a policy module in your package. This will allow you to secure the behavior of your application with the power of SELinux for any user installing your package.
</div><div class="para">
One important value that Fedora testers and users bring to the community is extensive testing of third-party applications. With that in mind, please bring your experiences to the appropriate mailing list, such as the fedora-selinux list, for discussion. For more information about that list, refer to <a href="http://www.redhat.com/mailman/listinfo/fedora-selinux-list/">http://www.redhat.com/mailman/listinfo/fedora-selinux-list/</a>.
</div></div></div></div></div></div></div></div></div></body></html>
14 years, 2 months