fuqnbastard
n00b
Joined: 13 Apr 2004
Posts: 46
|
 Posted: Sun Nov 13, 2005 1:18 pm Post subject: emerge can't wget anymore with selinux/permissive |
 |
|
I've just installed selinux and still have it run in permissive mode. Yet emerge doesn't seem to be able to download new packages anymore:
| Code: |
>>> emerge (2 of 6) sys-devel/binutils-2.16.1 to /
>>> Downloading http://ftp.du.se/pub/os/gentoo/distfiles/binutils-2.16.1-patches-1.4.tar.bz2
Traceback (most recent call last):
File "/usr/bin/emerge", line 3200, in ?
mydepgraph.merge(mydepgraph.altlist())
File "/usr/bin/emerge", line 1912, in merge
retval=portage.doebuild(y,"merge",myroot,self.pkgsettings,edebug)
File "/usr/lib/portage/pym/portage.py", line 2664, in doebuild
if mydo!="manifest" and not fetch(fetchme, mysettings, listonly=listonly, fetchonly=fetchonly):
File "/usr/lib/portage/pym/portage.py", line 1904, in fetch
selinux.setexec(con)
File "selinux.prx", line 218, in selinux.setexec
OSError: setexec: Failed setting exec context.
|
It works if I manually wget the file into /usr/portage/distfiles and run emerge afterwards.
dmesg during the emerge process gives me the following:
| Code: |
audit(1131885602.351:0): avc: denied { read } for pid=19569 exe=/bin/bash name=urandom dev=tmpfs ino=5206 scontext=system_u:system_r:crond_t tcontext=system_u:object_r:tmpfs_t tclass=chr_file
audit(1131885602.351:0): avc: denied { write } for pid=19569 exe=/bin/bash name=tty dev=tmpfs ino=5470 scontext=system_u:system_r:crond_t tcontext=system_u:object_r:tmpfs_t tclass=chr_file
audit(1131885840.443:0): security_compute_sid: invalid context system_u:system_r:portage_t for scontext=system_u:system_r:sysadm_t tcontext=system_u:object_r:portage_exec_t tclass=process
|
I haven't changed the policy files, however they've been around for a while from my previous attempt to install selinux. I'm afraid I'll have to run "make relabel" again if I remove the /etc/security/selinux directory and remerge the policies. Would saving the modification to the Makefile (POLICYCOMPAT) and genfs_contexts be enough to avoid that step? Wouldn't differences to the orginal configuration show up in "etc-update" after an "emerge policycoreutils" anyway? |
|
Networking & Security
