Discuss October 2017

discuss@lists.centos.org

128 participants
115 discussions

prevent users from fiddling with network?
by Valeri Galtsev 02 Oct '17

02 Oct '17

Dear Experts, "this is system from the hell!" Than was my first reaction when I realized that logged in with GUI (X11) user can turn off (and on) network interfaces. Without being in sudoers file. Wow, this is scary to see on workstations I manage centrally. Even though I did consider local user to be able to execute the command "shutdown" (which distinguished RedHat and CentOS from other Linux flavors: after all local user can yank power cord off the wall). Sorry about my little rant above. Could someone point me into right direction as to how do I disable the ability of (local, logged in through X11) users to fiddle with network interfaces. Even worse, they can create new profile and define for interfaces to behave differently... In the past I could just add USERCTL="no" into interface ifcfg-... file inside /etc/sysconfig/network-scripts which doesn't seen to have any effect on latest CentOS 7. What is my pilot error here? (Ignorant in new shiny extremely MS Windows like for _ignorant_ person - me - system). Thanks a lot for all your help! Valeri ++++++++++++++++++++++++++++++++++++++++ Valeri Galtsev Sr System Administrator Department of Astronomy and Astrophysics Kavli Institute for Cosmological Physics University of Chicago Phone: 773-702-4247 ++++++++++++++++++++++++++++++++++++++++

6 13

Network scripts ifup-post
by Thomas Plant 02 Oct '17

02 Oct '17

Hello, since updating to Centos 7.4 the ifup-post script in /etc/sysconfig/network-scripts does not behave as it did before the update. I use it to configure additional routes via /sbin/ifup-local with the parameter of the interface being upped, but it seems to pass only 'lo' as interface name. Before it passed correctly 'eth0:0' of the virtual interface. Added a line in /etc/sysconfig/network-scripts/ifup-post, near the end when it calls the ifup-local, echoing the variable of ${DEVICE} to a file and all that showed up was 'lo'. Is this a bug? Or how can I correct this behaviour? Thanks, Thomas

1 1

NUMA split mode?
by hw 02 Oct '17

02 Oct '17

Hi, HP says that what they call "NUMA split mode" should be disabled in the BIOS of the Z800 workstation when running Linux. They are reasoning that Linux kernels do not support this feature and even might not boot if it´s enabled. Since it apparently was years ago since they made this statement, I´m wondering if I should still leave this feature disabled or not. More recent kernels might support it, and it´s supposed to improve performance. Could someone explain what this feature actually is or does, and if Centos kernels support it? -- "Didn't work" is an error.

2 5

MP4/H.264 codec for Firefox?
by Roman Kennke 02 Oct '17

02 Oct '17

Hello, I am trying to get MP4/H.264 playback in Firefox to work on my CentOS laptop (for vimeo). I installed the gstreamer plugins as described here: https://wiki.centos.org/TipsAndTricks/MultimediaOnCentOS7 (No, I did not install Flash, VLC and all the other stuff. I only want HTML5 MP4 playback..) I enabled the nux repos. I did install all available gstreamer plugins, i.e. -good -bad -ugly -ffmpeg etc. No success. Has anybody got mp4 playback working? Here's a test page: https://www.quirksmode.org/html5/tests/video.html Help would be appreciated! Best regards, Roman

6 8

[Fwd: Re: [HEADS UP] Default value of SELinux boolean httpd_graceful_shutdown will changed.]
by m.roth＠5-cent.us 01 Oct '17

01 Oct '17

---------------------------- Original Message ---------------------------- Subject: Re: [HEADS UP] Default value of SELinux boolean httpd_graceful_shutdown will changed. From: "Lukas Vrabec" <lvrabec(a)redhat.com> Date: Fri, September 29, 2017 10:26 To: devel(a)lists.fedoraproject.org "Selinux List at Fedora Project" <selinux(a)lists.fedoraproject.org> -------------------------------------------------------------------------- On 09/29/2017 03:57 PM, Alexander Bokovoy wrote: > On pe, 29 syys 2017, Lukas Vrabec wrote: >> I'm planning change the default value of httpd_graceful_shutdown >> boolean in Fedora Rawhide because of improving SELinux configuration. >> Rawhide builds with this change will be available in ~5 days. >> >> Together with Dan Walsh, we agreed on that httpd_graceful_shutdown >> boolean should be by default turned off. This boolean allows HTTPD to >> connect to port 80 for graceful shutdown, but it's breaking the >> functionality of another boolean called: httpd_can_network_connect. >> This boolean allows HTTPD scripts and modules to connect to the >> network using TCP and it's turned off by default. >> >> Turning this boolean off can cause some troubles, on web-servers where >> processes with httpd_t SELinux domain connecting to tcp ports: 80, 81, >> 443, 488, 8008, 8009, 8443, 9000 >> >> If you would like to turn in on again, use semanage command: >> # semanage boolean -m --on httpd_graceful_shutdown > In FreeIPA we have httpd_can_network_connect enabled. I just checked a F26 > system and I have both booleans enabled. > > # getsebool -a|egrep 'httpd_graceful_shutdown|httpd_can_network_connect ' > httpd_can_network_connect --> on > httpd_graceful_shutdown --> on > > So I'm a bit confused: disabling httpd_graceful_shutdown will have or > wouldn't have an effect on httpd_can_network_connect being enabled? > httpd_graceful_shutdown is subset of httpd_can_network_connect. Turning on httpd_graceful_shutdown you allow httpd_t domain connecting just to ports labeled as httpd_port_t. Turning on httpd_can_network_connect you allow httpd_t domain connecting to all ports from SELinux POV. Right now, we ship selinux-policy with httpd_graceful_shutdown turned on and httpd_can_network_connect turned off. But it's confusing for users because they have httpd_can_connect turned off but httpd_t domain can still connect co http_port_t ports becuase of httpd_gracefull_shudown. I hope it's more clear now. > Do I need to do anything in FreeIPA setup? > No if httpd_can_network_connect is enabled during FreeIPA setup, you don't need to change anything. Lukas. -- Lukas Vrabec Software Engineer, Security Technologies Red Hat, Inc. _______________________________________________ selinux mailing list -- selinux(a)lists.fedoraproject.org To unsubscribe send an email to selinux-leave(a)lists.fedoraproject.org

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss October 2017