On Wed, Jan 07, 2009 at 03:41:55PM -0500, Stephen Smalley wrote:
Then any subsequent login attempt via ssh would be similarly botched,
because sshd is running in system_crond_t, and thus the starting domain
isn't what the system expects and when we ask the system what user
contexts are reachable from that starting domain, it gets rather
puzzled.
I was not that surprised with specific results, as they were
consistent with what was showing up after all, as rather how I got
there.
Reboot the system, then login and look at pstree -Z output.
This time it actually helped. Thanks! This is the first time
the system got rebooted after selinux-policy-targeted got
reinstalled yesterday. Maybe this made a difference? Before
that rebooting did not seem to have any discernible effects.
I attach the current output from 'pstree -Z'; it looks to me as what
I would roughly expect to see.`
As to the original cause, I assume that this is due to:
1) The rather major changes that took place in the policy across these
versions ....
....
2) The (mis)use of semanage by the selinux-policy package to manage
the
seuser definitions ....
....
What for me is most disconcerting is that I went through the same
exercise a few times and results were not consistent. Also I still
would not know for sure how to repair a botched upgrade. It appears
that this time I ended up with something which looks sane but why
this reboot changed things while previous one were ineffective I am
not sure.
Thanks,
Michal