Discuss

discuss@lists.centos.org

34758 discussions

Re: [CentOS] SELinux vs. logwatch and virsh
by Bill Gee 20 Aug '14

20 Aug '14

Hi Dan - "ausearch -m avc -ts recent" produces no output. If I run it as "ausearch -f virsh" then it produces output similar to this. Each day's run of logwatch produces three of these audit log entries. The a1 and a2 values are different for each entry, but everything else is the same. =============== time->Mon Aug 18 03:21:03 2014 type=SYSCALL msg=audit(1408350063.257:7492): arch=c000003e syscall=21 success=no exit=-13 a0=11ee230 a1=4 a2=7fff722837b0 a3=7fff72283640 items=0 ppid=2815 pid=2816 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=981 comm="bash" exe="/usr/bin/bash" subj=system_u:system_r:logwatch_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1408350063.257:7492): avc: denied { read } for pid=2816 comm="bash" name="virsh" dev="dm-0" ino=135911290 scontext=system_u:system_r:logwatch_t:s0-s0:c0.c1023 tcontext=system_u:object_r:virsh_exec_t:s0 tclass=file =============== I thought about using audit2allow as you suggest. The problem is then I don't really know what change is required. What exactly will it do? And is there a guarantee that it will work? Regarding your general question ... It seems to me that logwatch can be used to provide feedback on operational status of almost anything on the system. If you go beyond the typical reading of log files, then that often requires running some script or utility program or something. Anytime that is done, I think this kind of problem will appear. Much of what logwatch does is running files through "cat". That process runs as "bin_t" which must be a general type. I wonder what would happen if I changed virsh to the same type. For what it is worth, I have another computer running CentOS 6.5 and VirtualBox. The VBoxManage program must run as the same user which is running the virtual machines, which frustrates me to no end. I finally figured out a way to work around it by setting up a user cron job under that user. It saves the output to a text file. The logwatch script then comes along and reads that file into its output. It works, but it is not ideal. There are obvious problems with synchronization, plus if a computer is running VMs under multiple user accounts, then multiple user cron jobs are needed. Thanks - Bill Gee ============================= > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org > http://lists.centos.org/mailman/listinfo/centos What AVC messages are you seeing? ausearch -m avc -ts recent. I would put the machine in permissive mode, run your tests and then add the allow rules using audit2allow -M mylogwatch Message: 8 Date: Fri, 15 Aug 2014 11:22:40 -0400 From: Daniel J Walsh <dwalsh(a)redhat.com> Subject: Re: [CentOS] SELinux vs. logwatch and virsh To: CentOS mailing list <centos(a)centos.org> Message-ID: <53EE25C0.3040404(a)redhat.com> Content-Type: text/plain; charset=windows-1252 On 08/14/2014 11:02 AM, Bill Gee wrote: > Hello everyone - > > I am stumped ... Does anyone have suggestions on how to proceed? Is there a way > to get what I want? > > The environment: CentOS 7.0 with latest patches. > > The goal: I want logwatch to include a report on the status of kvm virtual computers. > > The problem: When run from anacron, SELinux denies permission for the virsh utility. > Here is a portion of the logwatch output: > > --------------------- KVM libvirt status report Begin ------------------------ > > Date Range: yesterday > /etc/logwatch/scripts/services/libvirt: line 15: /usr/bin/virsh: Permission denied > > ---------------------- KVM libvirt status report End ------------------------- > > If I "run-parts /etc/cron.daily" from a root console, it all works. Same if I run "logwatch" > from a root console. > > I set SELinux to permissive and that allows virsh to run. Therefore I know it is > something to do with SELinux. > > The logwatch script is: > > #Lots of comments > /usr/bin/virsh list --all > > I see the selinux security context of virsh is > > system_u:object_r:virsh_exec_t:s0 > > while logwatch.pl runs as > > system_u:object_r:logwatch_exec_t:s0 > > As I understand it, selinux does not permit having multiple type settings for a file. Any > file can have exactly one type setting. > > I ran this command hoping it would add another type to the virsh program. > > semanage fcontext -a -t logwatch_exec_t /usr/bin/virsh > > semanage fcontext --list /usr/bin/virsh | grep virsh > /usr/bin/virsh all files > system_u:object_r:logwatch_exec_t:s0 > /usr/bin/virsh regular file system_u:object_r:virsh_exec_t:s0 > /usr/sbin/xl regular file system_u:object_r:virsh_exec_t:s0 > /usr/sbin/xm regular file system_u:object_r:virsh_exec_t:s0 > > Semanage did add the new type, but that did not fix the problem. Virsh still gets > "permission denied" when logwatch tries to run it. > > Thanks - Bill Gee > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org > http://lists.centos.org/mailman/listinfo/centos BTW if you think this is something we should do in general in such a way as logwatch can only look at the content in Read Only mode, then we might want it to become default. ------------------------------

2 1

/dev/disk/by-uuid missing
by Michael Schumacher 20 Aug '14

20 Aug '14

hi! I got a problem with one of my servers where the boot process fails, because it cannot find its root partition. My /boot/grub/grub.conf uses to look like ---8<--- title CentOS (2.6.32-431.17.1.el6.x86_64) root (hd0,0) kernel /vmlinuz-2.6.32-431.17.1.el6.x86_64 ro root=UUID=8ef1f6cb-5dfc-497e-83d0-8d91cbbe4939 rd_NO_LUKS LANG=en_US.UTF-8 rd_NO_MD quiet SYSFONT=latarcyrheb-sun16 rhgb crashkernel=auto rd_NO_DM rd_NO_LVM KEYBOARDTYPE=pc KEYTABLE=de initrd /initramfs-2.6.32-431.17.1.el6.x86_64.img ---8<-- I could get the system to boot again by just replacing the "root=UUID-..." part with "root=/dev/sdb3" when I started looking around, I noticed that the "/dev/disk"by-uuid" directory was not there. The "by-id" as well as the "by-path" directories were both there. I tried to create directory and the links in the directory manually, but they were gone after the next reboot. I assume that these /dev/disk/ entries are created by some process at boot time, but I have no clue how this is done nor what is wrong with my system. I checked what blkid -L says, but this seems to be OK. ---8<--- device fs_type label mount point UUID ----------------------------------------------------------------------------------------- /dev/sda1 ext4 /mnt/raid a574f30b-fa43-4e34-8498-1cb29c4c261f /dev/sdb1 ext4 /boot 01746f38-6289-4b03-8011-bfac89ed89bd /dev/sdb2 swap <swap> 903a51b7-393d-4df9-9b58-f06a0a80a748 /dev/sdb3 ext4 / 8ef1f6cb-5dfc-497e-83d0-8d91cbbe4939 ---8<--- Any help? btw., the problem appeared when I installed a 18TB raid array. I had to compile the e2fsprogs from the most recent sources using this recipe http://blog.ronnyegner-consulting.de/2011/08/18/ext4-and-the-16-tb-limit-no… to install a very large ext4 file system on the raid disk. best regards --- Michael Schumacher PAMAS Partikelmess- und Analysesysteme GmbH Dieselstr.10, D-71277 Rutesheim Tel +49-7152-99630 Fax +49-7152-996333 Geschäftsführer: Gerhard Schreck Handelsregister B Stuttgart HRB 252024

1 1

systemd session abandoned
by Steven Stern 20 Aug '14

20 Aug '14

Things like this keep showing up in my my logs. Any idea what to look for to (1) figure out why and (2) track it to a particular service? systemd: Failed to mark scope session-19.scope as abandoned : Stale file handle -- -- Steve

3 3

Re: [CentOS] Java plugin (icedtea-web) does not load
by James B. Byrne 20 Aug '14

20 Aug '14

On Mon, August 18, 2014 09:05, Valeri Galtsev wrote: > > On Mon, August 18, 2014 5:50 am, Toralf Lund wrote: > >> >> This e-mail, including any attachments and response string, may contain >> proprietary information which is confidential and may be legally >> privileged. It is for the intended recipient only. If you are not the >> intended recipient or transmission error has misdirected this e-mail, >> please notify the author by return e-mail and delete this message and any >> attachment immediately. If you are not the intended recipient you must not >> use, disclose, distribute, forward, copy, print or rely on this e-mail in >> any way except as permitted by the author. > > I'm sorry if that offends anyone, the the BS nature of e-mail footers like > this one always offends my intelligence. As a recipient of e-mail I didn't > give my consent to be obliged to anything. whatever you sent me was at > your sole discretion. You want any obligations from the recipient of your > message, you should contact the recipient first and get him agree to be > obliged to anything you request. > > Who is the idiot lawyer who wrote it? He shouldn't even have layer degree > for incompetence! Even I, not lawyer, do understand that you can not make > the person obliged to do or not do anything by unilaterally doing > something (sending that person e-mail with idiotic footer). > You mean like forcing someone to agree to the terms of a license through the act opening the package that contains the text of said license? You would be amazed as what corporate interests have twisted the courts into doing for them through sponsored legislation (DMCA for example). I agree about the BS part but that does not make it unenforceable BS in some jurisdictions. And then there is always the threat of impoverishment through litigation. A big enough complainant can simply litigate frivolous torts to impose an economic penalty on its victim regardless of the outcome. Those sorts of disclaimers simple provide a pretext. I just delete messages with such things; unread whenever I notice them in time, otherwise ignoring the contents if I do not. -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

5 5

Hulu requires Flash Player 10.1.53.64
by Michael Hennebry 20 Aug '14

20 Aug '14

I'm running firefox on Centos 6 and am trying to watch a movie on hulu. Hulu requires Flash Player 10.1.53.64 or higher What to do? My recollection is that dealing with flash has always been a pain and that it recently got worse when Adobe EOLed flash for linux. Is this correct? [hennebry@localhost grease]$ uname -a Linux localhost.localdomain 2.6.32-431.20.3.el6.x86_64 #1 SMP Thu Jun 19 21:14:45 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux [hennebry@localhost grease]$ A pointer to instructions would be good. -- Michael hennebry(a)web.cs.ndsu.NoDak.edu "SCSI is NOT magic. There are *fundamental technical reasons* why it is necessary to sacrifice a young goat to your SCSI chain now and then." -- John Woods

2 1

your memcached problem
by Eero Volotinen 19 Aug '14

19 Aug '14

Hi Tim, Sorry, but I cannot access the original email, but your problems is in the rpm optimization flags. fixed spec: http://pastebin.com/KfW78RGd see the line beginning of %{__make} , replace it with: %{__make} CFLAGS='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=0 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic' -- Eero

1 0

failure building memcached rpm
by Tim Dunphy 19 Aug '14

19 Aug '14

Hi all, I need to install the latest memcached version (1.4.20) on a number of machines in this environment. There are only rpm's of this app for RHEL 6. But we need to install the latest memcached on a number of RHEL 5 machines. To be specific, they are OEL 5.7 hosts. I've installed all of the developers tools that I would need. But when I go to build the RPM I am getting the following error: gcc -std=gnu99 -DHAVE_CONFIG_H -I. -DNDEBUG -m64 -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic -pthread -pthread -Wall -Werror -pedantic -Wmissing-prototypes -Wmissing-declarations -Wredundant-decls -c -o memcached-items.o `test -f 'items.c' || echo './'`items.c cc1: warnings being treated as errors memcached.c: In function 'process_bin_get_or_touch': memcached.c:1277: warning: ignoring return value of 'fwrite', declared with attribute warn_unused_result make[2]: *** [memcached-memcached.o] Error 1 make[2]: *** Waiting for unfinished jobs.... make[2]: Leaving directory `/home/makerpm/rpmbuild/BUILD/memcached-1.4.20' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/home/makerpm/rpmbuild/BUILD/memcached-1.4.20' make: *** [all] Error 2 error: Bad exit status from /var/tmp/rpm-tmp.56803 (%build) RPM build errors: Bad exit status from /var/tmp/rpm-tmp.56803 (%build) And I'm hoping if I share with you the spec file that I'm using, I might be able to get some help with this. I am not sure where the problem is. Here's the spec file I'm using: # Authority: dag # Upstream: Brad Fitzpatrick <brad$danga,com> ### perl-AnyEvent is rfx on EL5, and so memcached must be as well %{?el5:# Tag: rfx} ### EL6 ships with memcached-1.4.4-3.el6 %{?el6:# Tag: rfx} %ifarch %{ix86} %define build_64bit --disable-64bit %else %define build_64bit --enable-64bit %endif Summary: Distributed memory object caching system Name: memcached Version: 1.4.20 Release: 1%{?dist} License: BSD Group: System Environment/Daemons URL: http://memcached.org/ Source: http://memcached.googlecode.com/files/memcached-%{version}.tar.gz BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root BuildRequires: cyrus-sasl-devel BuildRequires: libevent-devel Requires(post): /sbin/chkconfig Requires(preun): /sbin/chkconfig, /sbin/service Requires(postun): /sbin/service %description memcached is a high-performance, distributed memory object caching system, generic in nature, but intended for use in speeding up dynamic web applications by alleviating database load. %package devel Group: Development/Tools Summary: Header files for memcached %description devel Install this package if you want to develop programs that link against memcached. %prep %setup %{__cat} <<EOF >memcached.sysconfig PORT="11211" USER="nobody" MAXCONN="1024" CACHESIZE="64" OPTIONS="" EOF %build %configure \ --program-prefix="%{?_program_prefix}" \ --disable-dependency-tracking \ --enable-sasl \ %{build_64bit} %{__make} %{?_smp_mflags} %install %{__rm} -rf %{buildroot} %{__make} install DESTDIR="%{buildroot}" %{__install} -Dp -m0755 scripts/memcached.sysv %{buildroot}%{_sysconfdir}/rc.d/init.d/memcached %{__install} -Dp -m0644 memcached.sysconfig %{buildroot}%{_sysconfdir}/sysconfig/memcached %{__install} -Dp -m0755 scripts/memcached-tool %{buildroot}%{_bindir} %{__install} -Dp -m0755 scripts/mc_slab_mover %{buildroot}%{_bindir} %{__install} -Dp -m0755 scripts/damemtop %{buildroot}%{_bindir} %{__install} -Dp -m0644 scripts/damemtop.yaml %{buildroot}%{_sysconfdir} %post /sbin/chkconfig --add memcached %preun if [ $1 -eq 0 ]; then /sbin/service memcached stop &> /dev/null || : /sbin/chkconfig --del memcached fi %postun /sbin/service memcached condrestart &>/dev/null || : %clean %{__rm} -rf %{buildroot} %files %defattr(-, root, root, 0755) %doc AUTHORS COPYING ChangeLog doc/*.txt NEWS scripts/README.damemtop %doc %{_mandir}/man?/* %config(noreplace) %{_sysconfdir}/sysconfig/memcached %config(noreplace) %{_sysconfdir}/damemtop.yaml %config %{_initrddir}/memcached %{_bindir}/damemtop %{_bindir}/memcached %{_bindir}/memcached-tool %{_bindir}/mc_slab_mover %files devel %{_includedir}/memcached %changelog * Wed Aug 22 2012 Steve Huff <shuff(a)vecna.org> - 1.4.14-1 - Updated to 1.4.14. - Replace custom SysV init script with stock. - Install mc_slab_mover utility. * Thu Aug 25 2011 Steve Huff <shuff(a)vecna.org> - 1.4.7-1 - Updated to 1.4.7. - Install damemtop in a sensible place. * Fri Aug 05 2011 Steve Huff <shuff(a)vecna.org> - 1.4.6-1 - Updated to 1.4.6. - Tagged as RFX in el5 as well (due to perl-AnyEvent dependency). * Fri Apr 16 2010 Steve Huff <shuff(a)vecna.org> - 1.4.5-1 - Updated to 1.4.5. * Wed Mar 31 2010 Steve Huff <shuff(a)vecna.org> - 1.4.4-2 - Rebuild against libevent-1.4.13 on EL5. * Mon Feb 08 2010 Steve Huff <shuff(a)vecna.org> - 1.4.4-1 - Updated to 1.4.4. - Split off include files into memcached-devel. - Install memcached-tool in %{_bindir}, install damemtop in %{_docdir}. * Wed Aug 20 2008 Michael Best <mbest(a)pendragon.org> 1.2.6 - Update to 1.2.6. * Tue May 29 2007 Matthias Saou <http://freshrpms.net/> 1.2.2-1 - Update to 1.2.2. - Enable new threads feature. * Sun Mar 25 2007 Dag Wieers <dag(a)wieers.com> - 1.2.1-4 - Rebuild against libevent-1.1a on EL5. * Wed Mar 07 2007 Dag Wieers <dag(a)wieers.com> - 1.2.1-3 - Rebuild against libevent-1.3b. * Tue Feb 20 2007 Dag Wieers <dag(a)wieers.com> - 1.2.1-2 - Rebuild against libevent-1.3a. * Mon Feb 19 2007 Dag Wieers <dag(a)wieers.com> - 1.2.1-1 - Updated to release 1.2.1. * Wed Nov 01 2006 Dag Wieers <dag(a)wieers.com> - 1.1.13-1 - Updated to release 1.1.13. * Sat Aug 19 2006 Dag Wieers <dag(a)wieers.com> - 1.1.12-3 - Rebuild against libevent-1.1b. * Mon Apr 03 2006 Dag Wieers <dag(a)wieers.com> - 1.1.12-2 - Rebuild against libevent-1.1a. * Wed Jan 11 2006 Matthias Saou <http://freshrpms.net/> 1.1.12-1 - Update to 1.1.12. - Remove no longer needed segfault patch. - Add Requires(foo):... - Remove INSTALL from %%doc. - Don't have the init script be tagged as config, the config part is all in the sysconfig file. - make install now works again. - Fix non working reload in the init script. * Mon Mar 07 2005 Dag Wieers <dag(a)wieers.com> - 1.1.11-1 - Cosmetic changes. * Thu Feb 24 2005 Rob Starkey <falcon(a)rasterburn.com> - 1.1.11-1 - Initial package. Can I please get some help with this problem? Thanks -- GPG me!! gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B

1 0

Java plugin (icedtea-web) does not load
by Toralf Lund 19 Aug '14

19 Aug '14

Hi, After some recent upgrade or the other, the browser plugin for java no longer works in my CentOS 6 x86_64 setup - using Firefox. Applets won't load, and no java plugin is mentioned in "about:plugins". The "openjdk" Java packages as well as icetea-web are installed, though, and everything worked just fine a few weeks ago. Has anyone else seen this? Any idea what may be wrong and/or how to diagnose the problem? Should I expect error messages anywhere if the plugin just won't load (can't see anything in the browser console)? Note that when I talk about upgrades, I mean that I generally install all "notified" system updates. - Toralf This e-mail, including any attachments and response string, may contain proprietary information which is confidential and may be legally privileged. It is for the intended recipient only. If you are not the intended recipient or transmission error has misdirected this e-mail, please notify the author by return e-mail and delete this message and any attachment immediately. If you are not the intended recipient you must not use, disclose, distribute, forward, copy, print or rely on this e-mail in any way except as permitted by the author.

4 8

CentOS 6, Postfix, and Procmail -- how do I get it to work?
by Robert Heller 19 Aug '14

19 Aug '14

What is the trick to get Postfix's local command to pipe mail through procmail? I have: -bash-4.1$ grep allow_mail_to_commands /etc/postfix/main.cf allow_mail_to_commands = alias, forward and -bash-4.1$ cat .forward |/usr/bin/procmail and a .procmailrc file: -bash-4.1$ cat .procmailrc PATH=/usr/bsd:/bin:/usr/bin:/exp/rcf/share/bin MAILDIR=/var/lib/amanda/Mail #you'd better make sure it exists DEFAULT=$ORGMAIL #completely optional LOGFILE=$MAILDIR/from #recommended :0 * ^From.*no-reply(a)sns.amazonaws.com |$HOME/retrieveArchive.tcl :0 ! heller(a)deepsoft.com Basically I want all mail to the Amanda Backup account, except messages from Amazon SNS, to be forwarded to me (the system admin). The retrieveArchive.tcl is a script to process Amazon SNS messages. -- Robert Heller -- 978-544-6933 Deepwoods Software -- Custom Software Services http://www.deepsoft.com/ -- Linux Administration Services heller(a)deepsoft.com -- Webhosting Services

3 3

Re: [CentOS] CentOS 6, Postfix, and Procmail -- how do I get it to work?
by Mike Burger 19 Aug '14

19 Aug '14

On 2014-08-18 3:42 pm, Robert Heller wrote: > At Mon, 18 Aug 2014 13:39:49 -0400 Mike Burger > <mburger(a)bubbanfriends.org> wrote: > >> >> On 2014-08-18 1:26 pm, Robert Heller wrote: >> > What is the trick to get Postfix's local command to pipe mail through >> > procmail? >> > >> > I have: >> > >> > -bash-4.1$ grep allow_mail_to_commands /etc/postfix/main.cf >> > allow_mail_to_commands = alias, forward >> > >> > and >> > >> > -bash-4.1$ cat .forward >> > |/usr/bin/procmail >> > >> > and a .procmailrc file: >> > >> > -bash-4.1$ cat .procmailrc >> > PATH=/usr/bsd:/bin:/usr/bin:/exp/rcf/share/bin >> > MAILDIR=/var/lib/amanda/Mail #you'd better make sure it exists >> > DEFAULT=$ORGMAIL #completely optional >> > LOGFILE=$MAILDIR/from #recommended >> > >> > :0 >> > * ^From.*no-reply(a)sns.amazonaws.com >> > |$HOME/retrieveArchive.tcl >> > >> > :0 >> > ! heller(a)deepsoft.com >> > >> > Basically I want all mail to the Amanda Backup account, except messages >> > from >> > Amazon SNS, to be forwarded to me (the system admin). The >> > retrieveArchive.tcl >> > is a script to process Amazon SNS messages. >> >> It's this simple: >> >> Instead of putting a call to procmail in your .forward, first, set up >> /etc/postfix/main.cf with the following line: >> >> mailbox_command = /usr/bin/procmail >> >> and reload postfix. Now, postfix will default to using procmail as its >> local delivery agent. >> >> Now, set up /etc/procmailrc like so: >> >> USER=`whoami` >> >> :0 fw >> | spamc >> >> :0 e >> { >> EXITCODE=$? >> } > > I don't have spamassin set up -- it is not needed, since this is not a > public > facing E-Mail server, it is internal only. Do I need this file? > >> >> Now, set up the amanda user's .procmailrc rules like so: >> >> :0: >> * ^From.*no-reply(a)sns.amazonaws.com >> |$HOME/retrieveArchive.tcl >> >> :0: >> * >> ! heller(a)deepsoft.com >> >> Voila! > > Actually not. Postfix is now using procmail, but procmail is not > processing > .procmailrc... My bad...no, you can skip the /etc/procmail recipe portion that calls spamc...you don't need that. Comment/remove that bit, and then give it a go. Remember to issue "service postfix reload" after editing the main.cf file. -- Mike Burger http://www.bubbanfriends.org "It's always suicide-mission this, save-the-planet that. No one ever just stops by to say 'hi' anymore." --Colonel Jack O'Neill, SG1

2 2

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss