Discuss April 2015

discuss@lists.centos.org

168 participants
185 discussions

Broken Selinux Postfix Policy?
by E.B. 26 Apr '15

26 Apr '15

Trying to restart postfix installed from yum. Restart fails, I get: type=AVC msg=audit(1430429813.721:12167): avc: denied { unlink } for pid=31624 comm="master" name="defer" dev="dm-0" ino=981632 scontext=system_u:system_r:postfix_master_t:s0 tcontext=system_u:object_r:postfix_spool_maildrop_t:s0 tclass=sock_file I guess it needs to remove the /var/spool/postfix/defer socket file. audit2allow says this will fix it: allow postfix_master_t postfix_spool_maildrop_t:sock_file unlink; But how do I add this permission to the existing Postfix Selinux policy??? Why was it missing??? By the way, I also had AVCs when I tried to add another instance of Postfix smtpd on local port 20025. Very frustrating there is no docs how to add a rule for this common change. I don't know if I did the right thing: semanage port -a -t smtp_port_t -p tcp 20025 Is this the right way? Why isn't this documented somewhere?

2 2

25 Apr '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I use a dual headed system with one screen on the digital and the other on the analogue ports. Since 7.1 the update the login has switched from the analogue to the digital. This wouldn't be a problem, but I have the digital rotated 90 degrees into a portrait mode. Login is thus best done lying down! Once I've logged in there is no problem, the screens are easily configured in the settings menu. Can I set it globally though? I've had a look at xrandr and can't see anything. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQIcBAEBAgAGBQJVPAi2AAoJEAF3yXsqtyBlZzMP/3in2vFd8whbrZrghVhRF61V IPKEK2E3gYg4jYTa7j5ewwVic9sRU5ix6Hx0ZmqK5dSFqpBY6llK4+zcpmvqq1fR 91uwY/o8o+wEPppyvNm43i01Vb/nwuFeLfyfsn4IHak2ss0mMn76z71EsWw6yfU2 spAHxkkhwWN5YjXpgP0jVj0ot7h5l20d08vjRZ8uwK+cWjlGk2xZBoN4K9L4yyhu TwJAVDivS/VVztJ3ag8ZA413vk5+jl8AjsJELDD+JD7Wab9zpU4HHKk7odga9ekJ TI6FEZub9k46532O0cjnPYrzv/qoh2IxWgMOSp6egObwJs0oENadSl4Zhw3SsmiE yiH/ZjnYcoTzp3c/+To/ZkdFLw+aNn3OxiBgKv1p4mtxLovtPIaiok+XU2tLXIap MHu/rQnFUmMhdR1c5y2rsTIHg2X0uZmBZskr5SLfLTCD+1IdIvu2Av5tYYyaswIT ctHRqSL2dC4ViJnA5IgBoXPDT4Hz0AsTNOvXfWpNNPdUPqV4Ppsa+d8xyE+EM7Sp +6/4l26qZ4NVlYfNodvU38YoR0lvtVwhe73OSLuYHusYAAeT9WQj68svOiS5bhuD 1Jux7m0Df3UgxsxG9mH66GzgIMOIuRkBoQNYNXEN5PxOMZBgXly6WS+zdiys+iXW w3Meq+Ym8DgNiClIAyuc =+WI9 -----END PGP SIGNATURE-----

1 0

Re: [CentOS] Forcing yum update
by Александр Кириллов 25 Apr '15

25 Apr '15

>>> I have tried launching yum shell and then remove libmodplug, >>> install >>> libmodplug while having made sure epel is available. This after >>> having >>> read that it is a bad idea to use no-deps with yum. My attempt, >>> however, fails with a not found message. >>> >>> What would the correct approach be? >> >> The correct approach would be to use yum-plugin-priorities, set >> rpmforge >> priority to a higher value (lower priority) than epel and run yum >> distro-sync. > > Thank you. Unfortunately distro-sync fails with not found which seems > to apply to libmodplug at epel. Check if you have exclude=libmodplug in /etc/yum.repos.d/epel.repo and comment this line out.

1 0

Forcing yum update
by H 25 Apr '15

25 Apr '15

New to CentOS and running 6.6. I have previously installed gstreamer with plugins including libmodplug from rpmforge to listen to mp3 streams. Yum now tells me that a later version of libmodplug is available from epel but I am having problems forcing updating libmodplug from epel. I have tried launching yum shell and then remove libmodplug, install libmodplug while having made sure epel is available. This after having read that it is a bad idea to use no-deps with yum. My attempt, however, fails with a not found message. What would the correct approach be? Thank you.

2 1

google-earth crashes on CentOS 6.6
by Mark LaPierre 25 Apr '15

25 Apr '15

Hey all, With google-earth-stable.x86_64 0:7.1.2.2041-0 [mlapier@peach /]$ /usr/bin/google-earth [0425/000212:ERROR:net_util.cc(2195)] Not implemented reached in bool net::HaveOnlyLoopbackAddresses() Failed to load "/opt/google/earth/free/libinput_plugin.so" because "/usr/lib64/libstdc++.so.6: version `GLIBCXX_3.4.14' not found (required by ./libLeap.so)" [0425/000213:ERROR:nss_ocsp.cc(581)] No URLRequestContext for OCSP handler. [0425/000213:ERROR:nss_ocsp.cc(581)] No URLRequestContext for OCSP handler. <SNIP> Another crash happened while handling crash! [mlapier@peach /]$ NOTE: google-earth-stable.x86_64 0:7.1.2.2041-0 was running on my system a couple of weeks ago. With google-earth-stable.x86_64 0:6.0.3.2197-0 [mlapier@peach ~]$ /usr/bin/google-earth libGL error: failed to load driver: swrast [mlapier@peach ~]$ NOTE: GE starts and runs but there is no Earth in GE, just a black box. Googling gets me no useful answers. Do any of you CentOD 6.6 users have GE operating on your system? If so, what version are you using? -- _ °v° /(_)\ ^ ^ Mark LaPierre Registered Linux user No #267004 https://linuxcounter.net/ ****

1 1

CentOS 7 Installer Fail With 3Ware Controller
by Kirk Bocek 25 Apr '15

25 Apr '15

I thought I'd post to the mail list because I know there are some that only respond this way. I have a new SuperMicro X10-DRI host with a 3Ware controller that hangs when I try to install CentOS 7 on it. I've documented everything here: https://www.centos.org/forums/viewtopic.php?f=49&t=52231 CentOS 6.6 installs just fine. I'd appreciate any feedback anyone has, either to the list or the forum. Thanks, Kirk Bocek

1 0

CentOS 7 NFS client problems
by Devin Reade 24 Apr '15

24 Apr '15

#define TL;DR Despite idmapd running, usernames/IDs don't get mapped properly. Looking for a workaround. #undef TL;DR I'm trying to get a new CentOS 7.1 workstation running, and having some problems with NFS filesystems. The server is a fully patched CentOS 6 server. On the NFS filesystem, there are two subdirectories owned by a regular user (joe). (There are actually more and by multiple users, but I'll just show the two.) That user exists on both the NFS server and this CentOS 7 NFS client. However, the user on the client machine is unable to perform various operations. (The operations work when logged into the server.) $ whoami joe $ cd /nfs $ ls -l drwx------. 6 joe joe 4096 Apr 23 11:20 one drwxr-xr-x. 4 joe joe 4096 Dec 14 2011 two $ cd one one: Permission denied. $ cd two $ ls subdir1 subdir2 $ touch testfile touch: cannot touch testfile: Permission denied mount(1) shows that the filesystem is mounted rw. The server has it exported rw to the entire subnet. Other machines (CentOS 5) mount the same filesystems without a problem. Looks a lot like an idmapd issue, right? On the server: # id joe uid=501(joe) gid=501(joe) groups=501(joe) Back on the client: $ ps auxww | grep idmap | grep -v grep $ id joe uid=1000(joe) gid=1000(joe) groups=1000(joe) $ cd /nfs $ ls -n drwx------. 6 1000 1000 4096 Apr 23 11:20 one drwxr-xr-x. 4 1000 1000 4096 Dec 14 2011 two So it looks like even though the name/UID mapping is correct even though the idmapd daemon isn't running on the client. (It looks like CentOS7 only starts idmapd when it's running an NFS *server*.) # systemctl list-units | grep nfs nfs.mount loaded active mounted /nfs proc-fs-nfsd.mount loaded active mounted NFSD configuration filesystem var-lib-nfs-rpc_pipefs.mount loaded active mounted RPC Pipe File System nfs-config.service loaded active exited Preprocess NFS configuration nfs-client.target loaded active active NFS client services The behavior was tested again with SELinux in permissive mode; no change. Splunking a bit more shows some similar behavior for other distros: <https://bugs.launchpad.net/ubuntu/+source/nfs-utils/+bug/966734> <https://bugzilla.linux-nfs.org/show_bug.cgi?id=226> Yep, this is a situation where LDAP and Kerberos aren't in play. And the CentOS 5, CentOS 6, and other UNIXen boxes are using consistent UID/GID mappings. However, CentOS7 (well, RHEL7) changed the minimum UID/GID for regular accounts, so when the account was created on the latter, the UID is out of sync. So much for idmapd (without the fixes involved in the above URLs). Has anyone else run into this and have a solution other than forcing UIDs to match? Devin

3 3

Resetting tcp timestamp
by James B. Byrne 24 Apr '15

24 Apr '15

TCP timestamps on some (but not all?) of our CentOs hosts are being reported as a vulnerability by OSSIM. I have looked into the matter briefly and cannot say that I consider this a serious security issue. The vulnerability seems limited to determining the uptime of the target host. The question therefore arises as to whether or not there is any way to reset the tcp timestamp present value to zero or some randomly determined value. If not then what are the technical impediments? I am cognisant of the role of tcp timestamps in handling serial number rollovers. However, since the timestamp itself also must rollover, given sufficient uptime (~288 days I believe I read), what prevents one from manually forcing that event? Is there such a means provided in CentOS6? -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

1 0

Cluster gets stopped
by Jatin Davey 24 Apr '15

24 Apr '15

Hi I am using a two node cluster to achieve high availability. I am basically testing a scenario where in if i shutdown my node (node-1) then the other node (node-2) should start functioning like node-1. Currently what i am observing is that the entire cluster gets into "Stopped" state. Here is my cluster.conf file ************************ <?xml version="1.0"?> <cluster config_version="4" name="****"> <clusternodes> <clusternode name="node-103" nodeid="1"> <fence> <method name="Method01"> <device name="node-103"/> </method> </fence> </clusternode> <clusternode name="node-105" nodeid="2"> <fence> <method name="Method02"> <device name="node-105"/> </method> </fence> </clusternode> </clusternodes> <cman expected_votes="1" two_node="1"/> <fencedevices> <fencedevice agent="fence_ipmilan" auth="password" ipaddr="x.x.x.x" lanplus="on" login="admin" name="node-103" passwd="*****" privlvl="ADMINISTRATOR"/> <fencedevice agent="fence_ipmilan" auth="password" ipaddr="x.x.x.x" lanplus="on" login="admin" name="node-105" passwd="******" privlvl="ADMINISTRATOR"/> </fencedevices> <fence_daemon post_join_delay="120"/> <rm> <resources> <netfs export="/test" force_unmount="1" fstype="nfs" host="x.x.x.x" mountpoint="/test/test/test" name="test123"/> <ip address="x.x.x.x" sleeptime="5"/> <script file="/opt/infra/appliance-mgr/bin/am_svcs.sh" name="am_svcs"/> </resources> <failoverdomains> <failoverdomain name="Failover01" nofailback="1" ordered="1"> <failoverdomainnode name="node-103" priority="1"/> <failoverdomainnode name="node-105" priority="2"/> </failoverdomain> </failoverdomains> <service domain="Failover01" name="Service01" recovery="relocate"> <ip ref="x.x.x.x"/> <netfs ref="test123"/> <script ref="am_svcs"/> </service> </rm> </cluster> **************************************** Thanks Jatin

1 0

How to stagger fsck executions
by Hugh E Cruickshank 23 Apr '15

23 Apr '15

CentOS 6 Hi All: Over the weekend I had to reboot one of my systems and got hit with fsck runs on all of the filesystems. I would not mind so much except doing them all at once took over an hour. I would like to be able to stagger these, ideally only execute one fsck per reboot. I have been able to think of two possible solutions but neither is terrific. My first idea was to manually run fsck on each filesystem, one every couple of weeks. That way they will not all come due at the same time if we reboot on a regular basis. The second idea was to set each filesystem to a different random count value. This would run the risk of having two or more executions at the same time but it would probably not be very frequent. Does anyone have a suggestion for a better way of doing this? TIA Regards, Hugh -- Hugh E Cruickshank, Forward Software, www.forward-software.com

5 13

← Newer
1
2
3
4
5
6
7
...
19
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss April 2015