Discuss December 2017

discuss@lists.centos.org

82 participants
61 discussions

Fwd: Qwery regarding Selinux Change Id context
by Aman Sharma 04 Dec '17

04 Dec '17

Hi All, Thanks for the information. But after resetting the semanage User/login, and moving the targeted folder to old one and then install the default target. then also its still showing the Id context as context=*system_u:system_r:unconfined_t:s0-s0:c0.c1023.* *What I observed is after changing the permission using semanage command also, its still showing the system_u:system_r. * *Check the semanage login/User output :* *semanage login -l* *Login Name SELinux User MLS/MCS Range Service* *__default__ unconfined_u s0-s0:c0.c1023 ** *root unconfined_u s0-s0:c0.c1023 ** *system_u system_u s0-s0:c0.c1023 ** *semanage user -l* * Labeling MLS/ MLS/ * *SELinux User Prefix MCS Level MCS Range SELinux Roles* *guest_u user s0 s0 guest_r* *root user s0 s0-s0:c0.c1023 staff_r sysadm_r system_r unconfined_r* *staff_u user s0 s0-s0:c0.c1023 staff_r sysadm_r system_r unconfined_r* *sysadm_u user s0 s0-s0:c0.c1023 sysadm_r* *system_u user s0 s0-s0:c0.c1023 system_r unconfined_r* *unconfined_u user s0 s0-s0:c0.c1023 system_r unconfined_r* *user_u user s0 s0 user_r* *xguest_u user s0 s0 xguest_r* Looks like its related to some other issue. What you think about this. Thanks Aman On Sat, Dec 2, 2017 at 1:05 AM, Simon Sekidde <ssekidde(a)redhat.com> wrote: > > > ----- Original Message ----- > > From: "Stephen Smalley" <sds(a)tycho.nsa.gov> > > To: "Simon Sekidde" <ssekidde(a)redhat.com>, "Aman Sharma" < > amansh.sharma5(a)gmail.com> > > Cc: "SELinux" <selinux(a)tycho.nsa.gov> > > Sent: Friday, December 1, 2017 2:28:17 PM > > Subject: Re: Qwery regarding Selinux Change Id context > > > > On Fri, 2017-12-01 at 14:16 -0500, Simon Sekidde wrote: > > > > > > ----- Original Message ----- > > > > From: "Aman Sharma" <amansh.sharma5(a)gmail.com> > > > > To: "SELinux" <selinux(a)tycho.nsa.gov> > > > > Sent: Thursday, November 30, 2017 11:26:21 PM > > > > Subject: Re: Fwd: Qwery regarding Selinux Change Id context > > > > > > > > Hi , > > > > > > > > mv /var/lib/selinux/targeted /var/lib/selinux/targeted.old > > > > > > > > This targeted folder is not there. > > > > > > > > After searching I got the below result : > > > > > > > > find / -type d -name "*targeted" -print > > > > > > > > /usr/share/selinux/targeted > > > > /etc/selinux/targeted > > > > > > > > Pleas let me know your comments. > > > > > > > > > > Run > > > > > > mv /etc/selinux/targeted /etc/selinux/targeted.old > > > yum reinstall selinux-policy-targeted > > > > He already tried that and it allegedly didn't help. It also seems to > > leave you without a /etc/selinux/targeted/active/seusers file for some > > reason, such that semanage login -l shows nothing. But you can recover > > by copying /etc/selinux/targeted/seusers to > > /etc/selinux/targeted/active/seusers. That's a bug. > > > > Interesting. Thanks for spotting this. > > > > > > > Also what does this output show > > > > > > ps -aelfZ | grep -i ssh > > > > > > > > > > > On Fri, Dec 1, 2017 at 1:49 AM, Dominick Grift <dac.override@gmail. > > > > com> > > > > wrote: > > > > > > > > > On Thu, Nov 30, 2017 at 11:10:43AM +0530, Aman Sharma wrote: > > > > > > Hi Stephen, > > > > > > > > > > > > After reseting Selinux targeted folder also (the steps you > > > > > > mentioned in > > > > > > > > > > the > > > > > > earlier mail), Still its showing the same Id context i.e. > > > > > > > > > > > > *id* > > > > > > *uid=0(root) gid=0(root) groups=0(root) > > > > > > context=system_u:system_r:unconfined_t:s0-s0:c0.c1023* > > > > > > *[root@cucm2 ~]# id -Z* > > > > > > *system_u:system_r:unconfined_t:s0-s0:c0.c1023* > > > > > > > > > > > > *And semanage login -l is showing blank output. * > > > > > > > > > > > > *Do you have any idea about this.* > > > > > > > > > > > > *Thanks* > > > > > > *Aman* > > > > > > > > > > Try the same procedure again but this time also do before > > > > > reinstalling: > > > > > > > > > > mv /var/lib/selinux/targeted /var/lib/selinux/targeted.old > > > > > > > > > > > > > > > > > > > > > > > On Wed, Nov 29, 2017 at 11:04 PM, Stephen Smalley <sds(a)tycho.ns > > > > > > a.gov> > > > > > > > > > > wrote: > > > > > > > > > > > > > On Wed, 2017-11-29 at 22:01 +0530, Aman Sharma wrote: > > > > > > > > After resetting boolean also, showing the same id context. > > > > > > > > > > > > > > And did you try fully resetting your policy as I suggested: > > > > > > > mv /etc/selinux/targeted /etc/selinux/targeted.old > > > > > > > yum reinstall selinux-policy-targeted > > > > > > > reboot > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > On Wed, Nov 29, 2017 at 9:50 PM, Stephen Smalley <sds@tycho > > > > > > > > .nsa.gov> > > > > > > > > wrote: > > > > > > > > > On Wed, 2017-11-29 at 21:39 +0530, Aman Sharma wrote: > > > > > > > > > > Hi Stephen, > > > > > > > > > > > > > > > > > > > > After enabling the unconfined module and after reboot > > > > > > > > > > also, Still > > > > > > > > > > showing the same id context. > > > > > > > > > > > > > > > > > > > > Is there any way to make the id context to normal state > > > > > > > > > > again ? > > > > > > > > > > > > > > > > > > Hmmm...try resetting all booleans too? semanage boolean > > > > > > > > > -D > > > > > > > > > > > > > > > > > > Or you could be drastic and completely reset your policy: > > > > > > > > > mv /etc/selinux/targeted /etc/selinux/targeted.old > > > > > > > > > yum reinstall selinux-policy-targeted > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > -- > > > > > > > > > > > > > > > > Thanks > > > > > > > > Aman > > > > > > > > Cell: +91 9990296404 | Email ID : amansh.sharma5(a)gmail.com > > > > > > > > > > > > > > > > > > > > > > > > -- > > > > > > > > > > > > Thanks > > > > > > Aman > > > > > > Cell: +91 9990296404 | Email ID : amansh.sharma5(a)gmail.com > > > > > > > > > > -- > > > > > Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B > > > > > 6B02 > > > > > https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7 > > > > > B6B02 > > > > > Dominick Grift > > > > > > > > > > > > > > > > > > > > > -- > > > > > > > > Thanks > > > > Aman > > > > Cell: +91 9990296404 | Email ID : amansh.sharma5(a)gmail.com > > > > > > > > > > > > > > -- > Simon Sekidde > gpg: 5848 958E 73BA 04D3 7C06 F096 1BA1 2DBF 94BC 377E > > > -- Thanks Aman Cell: +91 9990296404 | Email ID : amansh.sharma5(a)gmail.com -- Thanks Aman Cell: +91 9990296404 | Email ID : amansh.sharma5(a)gmail.com -- Thanks Aman Cell: +91 9990296404 | Email ID : amansh.sharma5(a)gmail.com

1 0

Fwd: Default User in Selinux
by Aman Sharma 04 Dec '17

04 Dec '17

Hi All, During System boot up, I am running some semanage commands to change the User to sysadm_u. But in Cent OS 7.3 , Below error message is coming i.e. *ValueError: Login mapping for __default__ is not defined.* /usr/sbin/semanage login -m -S targeted -s user_u -r s0 __default__ ValueError: Login mapping for __default__ is not defined But the same command is working fine in Cent OS 6.8. Please let me know why this error message is coming for Cent OS 7. -- Thanks Aman Cell: +91 9990296404 | Email ID : amansh.sharma5(a)gmail.com -- Thanks Aman Cell: +91 9990296404 | Email ID : amansh.sharma5(a)gmail.com

1 0

Re: [CentOS] Good linux software RAID primer advise
by Arun Khan 03 Dec '17

03 Dec '17

On Fri, Dec 1, 2017 at 7:38 AM, Miguel Medalha <medalist(a)sapo.pt> wrote: >>> Could someone recommend good Linux software RAID primer. It would >> be good if it has good coverage of monitoring and dealing with failures. > > https://raid.wiki.kernel.org/index.php/Linux_Raid +1 and practice recovery scenarios using VMs with virtual disks. -- Arun Khan

1 0

Firefox print to file fail silent & side notes of cms4all.
by Andreas Benzler 02 Dec '17

02 Dec '17

Hello everyone, in time when i start to rebuilt my csm4all-media, I tryed to print into file from firefox. The print box close but no pdf is created. With cups-pdf works, but: - You can not name the printout - can not change the directory from userland, only with cups configuration. Where is the hunt? I only wanne tell, that is not my domain. Side note: cms4all-kernel, cms4-all-drivers, cms4all-mesa is in takt, but I will push information when cms4all-gstreamer an cms4all-media closed in my private Project. My aspect "best of" isn't closed yet, still experimental. Will take addional weeks, as i did it 2016 for centos. @Nux, my VLC is still more stable as yours and I don't no why. Yes I'm still there, but private and work takes to much time. I'm still there ... Sincrely Andy

2 1

time foo
by hw 02 Dec '17

02 Dec '17

Hi, isn´t this weird: # time foo real 43m39.841s user 15m31.109s sys 0m44.136s Almost 30 minutes have disappeared, but it actually took about that long, so what happened?

5 8

C7 and docker storage
by m.roth＠5-cent.us 01 Dec '17

01 Dec '17

Was working on docker on a server, and on startup, I see Nov 29 10:58:27 <servername> dockerd-current: time="2017-11-29T10:58:27.612849959-05:00" level=warning msg="devmapper: Usage of loopback devices is strongly discouraged for production use. Please use `--storage-opt dm.thinpooldev` or use `man docker` to refer to dm.thinpooldev section." Nov 29 10:58:27 <servername> dockerd-current: time="2017-11-29T10:58:27.655600686-05:00" level=warning msg="devmapper: Base device already exists and has filesystem xfs on it. User specified filesystem will be ignored." The latter would explain the message my user's job gave him when it tried to umount / A bit of googling, and I see something called overlayFS can be used... but I know nothing about that, or how dangerous it is. Anyone got a pointed to something more than the minimal how to configure docker to use it? mark

3 2

Re: [CentOS] C7 and docker storage
by m.roth＠5-cent.us 01 Dec '17

01 Dec '17

Gianluca Cecchi <gianluca.cecchi(a)gmail.com> wrote: > Date: Thu, 30 Nov 2017 09:55:58 +0100 > On Wed, Nov 29, 2017 at 10:23 PM, <m.roth(a)5-cent.us> wrote: > >> The latter would explain the message my user's job gave him when it tried >> to umount / >> >> A bit of googling, and I see something called overlayFS can be used... but >> I know nothing about that, or how dangerous it is. Anyone got a pointed >> to something more than the minimal how to configure docker to use it? >> > You could follow CentOS Atomic SIG > https://wiki.centos.org/SpecialInterestGroup/Atomic > http://www.projectatomic.io/download/ > > and/or read here and adapt in case for your storage needs: > http://www.projectatomic.io/docs/docker-storage-recommendation/ > > See also here for overlayfs addiction in CentOS Atomic Host in September > this year > https://seven.centos.org/2017/09/new-centos-atomic-host-with-overlayfs-stor… > Interesting, but it doesn't help me: I can't rebuild the server, it's in use, and I yum installed docker from the std. repos. What I see from the links tells me how to switch storage, not how to manually configure overlay2 storage, and whether I can do as I said, and point it to an NFS-mounted location. mark

1 1

Re: [CentOS] Good linux software RAID primer advise
by Miguel Medalha 01 Dec '17

01 Dec '17

>> Could someone recommend good Linux software RAID primer. It would >> be good if it has good coverage of monitoring and dealing with failures. https://raid.wiki.kernel.org/index.php/Linux_Raid

1 0

Partition advice
by Kenneth Porter 01 Dec '17

01 Dec '17

I'm setting up a new mail server (dovecot + sendmail + SpamAssassin + ClamAV + MIMEDefang) to replace an aging CentOS 6 box. The new box is a low-end PowerEdge with an SSD, 3 4TB red drives on a PERC RAID controller which I'll probably set up RAID5, and possibly mirrored internal SD cards as a boot device. I'm debating how to partition it and am soliciting advice. My initial instinct is to put /boot and the OS on the SSD and the home directories with their mail store on the RAID array. I might put a rescue partition on the internal SD drive (which is normally intended for a VM host). Does anyone see anything wrong with that? Should I do something different? Anything I should avoid putting on the SSD, such as swap, /tmp, and /var/tmp? I've been running Red Hat as a small office server since 5.2 back in the 90's. I'm trying to create a system that's easy to fix when it breaks. I find that's the real power of Linux over any other OS: It's easy to fix when it breaks. Oh, and backup will be to an external USB drive using BackupPC, with the drive regularly swapped off-site, plus an off-site rsync mirror.

1 0

Good linux software RAID primer advise
by Valeri Galtsev 01 Dec '17

01 Dec '17

Dear Experts, Could someone recommend good Linux software RAID primer. It would be good if it has good coverage of monitoring and dealing with failures. I inherited a couple of boxes with big bunch of software RAIDs each, and I even may have some problems, but I don't want to bother anybody with specifics unless I really hit brick wall, not just my own ignorance. Thanks in advance for all your answers! Valeri ++++++++++++++++++++++++++++++++++++++++ Valeri Galtsev Sr System Administrator Department of Astronomy and Astrophysics Kavli Institute for Cosmological Physics University of Chicago Phone: 773-702-4247 ++++++++++++++++++++++++++++++++++++++++

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss December 2017