Hi,
I have a few problems with FC4 and wonder whether any of them has something to do with SElinux.
1) smb and nfs share won't start at boot (reported OK, but doesn't work). I have to manually restart the service to make them work. 2) My printer doesn't work since my last update (at least I think that's the cause as last week it worked well and I haven't changed a thing on the system besides an update). 3) nvidia driver goes funny when I switch terminal (crtl-alt-F1).
Of the above problems I couldn't find any obvious reason why they would fail. I know little about SElinux and suspect it's the cause for wasting my time. I'd like to disable it and when I'm sure it works fine for me enabling it again. Is this possible without any risk to my files (I don't care about security risks) ?
Regards, Marcel
Hi
Is this possible without any risk to my files (I don't care about security risks) ?
Switching off SELinux wont affect your data if you dont care about security. However I would recommend running "setenforce 0" or looking into /var/log/messages to check whether SELinux is the reason behind your problems before turning it off. Posting to fedora-selinux with the details would give developers a chance to tackle and fix the problems. If you are doing this temporarily then setting it to permissive in /etc/selinux/config is recommended over disabling it. See the FC3 SELinux FAQ for details
regards Rahul
On Sunday 03 July 2005 21:07, Rahul Sundaram wrote:
Hi
Is this possible without any risk to my files (I don't care about security risks) ?
Switching off SELinux wont affect your data if you dont care about security. However I would recommend running "setenforce 0" or looking into /var/log/messages to check whether SELinux is the reason behind your problems before turning it off. Posting to fedora-selinux with the details would give developers a chance to tackle and fix the problems. If you are doing this temporarily then setting it to permissive in /etc/selinux/config is recommended over disabling it. See the FC3 SELinux FAQ for details
There are no problems reported via /var/log/messages. So this indicates something else is broken. I won't mess around with SElinux as long as I don't find an obvious reason to do so than.
Regards, Marcel
Marcel:
Switching off SELinux wont affect your data if you dont care about security. However I would recommend running "setenforce 0" or looking into /var/log/messages to check whether SELinux is the reason behind your problems before turning it off. Posting to fedora-selinux with the details would give developers a chance to tackle and fix the problems. If you are doing this temporarily then setting it to permissive in /etc/selinux/config is recommended over disabling it. See the FC3 SELinux FAQ for details
There are no problems reported via /var/log/messages. So this indicates something else is broken.
No. If you have the service "auditd" running (switched on by default I believe), then the SElinux error messages end up in the file "/var/log/audit/audit.log", not in "/var/log/messages". There is something broken in SElinux with respect to samba. I can start smbd and nmbd daemons, but I can't print via samba, and I can't access user directories either from windows98, or via "smbclient". There are error messages in audit.log such as:
type=AVC msg=audit(1120010995.261:14912381): avc: denied { write } for pid=14117 comm="smbd" name=[22081] dev=pipefs ino=22081 scontext=root:system_r:smbd_t tcontext=system_u:system_r:unconfined_t tclass=fifo_file
which I think mean that SElinux interferes with samba. Until this is fixed, I have set SELINUX=permissive in /etc/selinux/config which allows samba to work as it used to in Fedora Core 3.
Best regards, Erwin
On Sun, 2005-07-03 at 17:42 -0500, Erwin J. Prinz wrote:
There is something broken in SElinux with respect to samba. I can start smbd and nmbd daemons, but I can't print via samba, and I can't access user directories either from windows98, or via "smbclient". There are error messages in audit.log such as:
type=AVC msg=audit(1120010995.261:14912381): avc: denied { write } for pid=14117 comm="smbd" name=[22081] dev=pipefs ino=22081 scontext=root:system_r:smbd_t tcontext=system_u:system_r:unconfined_t tclass=fifo_file
which I think mean that SElinux interferes with samba. Until this is fixed, I have set SELINUX=permissive in /etc/selinux/config which allows samba to work as it used to in Fedora Core 3.
Try: $ man man samba_selinux
There are some selinux booleans you need to set if you want to share directories using samba in FC4.
Paul.