Discuss

discuss@lists.centos.org

34753 discussions

read only root file system
by Fred Noz 24 May '08

24 May '08

Responding to a question posted earlier this month, Centos 5.1 includes configuration files for enabling the read-only root filesystem. Actually, all filesystems can be mounted read-only with particular files and directories mounted on a read-write tmpfs (in RAM). This capability comes directly from the upstream provider. You can have your Centos system running read-only root in two easy steps: 1. Edit /etc/sysconfig/readonly-root and change READONLY=no to READONLY=yes 2. Reboot When your computer comes back up, the root and any other system partitions will be mounted read-only. All the files and directories listed in /etc/rwtab will be mounted read-write on a tmpfs filesystem. You can add additional files and directories to rwtab to make them writable after reboot. Note that this system is stateless. When you reboot again, everything written to the tmpfs filesystem vanishes and the system will be exactly as it was the last time it was booted. You could add a writable filesystem on disk or NFS for writing files you want to retain after rebooting. Take a look at /etc/rc.d/rc.sysinit to see how the magic is done. This capability is a "technology preview" (beta) and is buggy. Note that /etc/mtab and thus "mount" do not show the complete list of filesystems because the /etc directory is on a read-only filesystem. /proc/mounts always shows the correct mount information. You could update /etc/mtab from /proc/mounts to correct it both after boot and after running the mount or umount commands to change mounts. Run "fgrep -v rootfs /proc/mounts >/etc/mtab" to correct /etc/mtab. Note that mounting or symlinking /proc/mounts to /etc/mtab causes other problems such as breaking the df command. You can change your read-only root filesystem to read-write mode immediately with this command run by the root user: mount -n -o remount,rw / - Fred

2 1

sed
by Scott McClanahan 24 May '08

24 May '08

Not specific to CentOS but I know you guys would be really helpful anyhow. Basically, I have a file which has been editted in the past very similarly to the hosts file only now I want to use it as a hosts file and need to run some fancy sed to massage the data into shape. Currently, the data in the file is in the form of <ip address> <tab> <short hostname> <space> <short hostname alias>. In some cases there may not be any aliases so the end of line would be right after the short hostname (no space at the end either). In other cases there could be many space separated short hostname aliases. What I have been trying to do without success is add our domain name to the first string after the ip address and tab character. As an example, == Before == 1.1.1.1 foo 10.10.10.10 bar bar2 100.100.100.100 foobar foobar2 foobar3 == After == 1.1.1.1 foo.contoso.com 10.10.10.10 bar.contoso.com bar2 100.100.100.100 foobar.contoso.com foobar2 foobar3 Any advice on how to pull this off? Thanks.

8 9

More recent GDE on CentOS 5+
by MHR 23 May '08

23 May '08

I have not had any success building a more recent version of GDE than 2.16.0 on CentOS. I tried jhbuild, and went line by line using the how-to web page for jhbuild (http://www.gnome.org/~jamesh/jhbuild.html) and I get hung up on dbus-glib-l (which does not appear to be in CentOS or available for it, at least from base, updates, extras, KB & rpmforge). Garnome is another possibility that I haven't looked at yet 'cuz jhbuild is supposed to be easy and fully automated (it might be, if everything it needs is already there, but it doesn't tell you up front what that means or how to get it or ...). Gnome "says" we should use the GDE that ships with our distribution, but RH (CentOS) has to oldest revision available. To get a newer one, the Gnome people recommend building my own. Has anyone tried this successfully? How? Thanks. mhr

2 1

Re:Re:Re:Can't get past the splash screen
by Eon Strife 23 May '08

23 May '08

Hi, Thanks, I check those folders, and they are already empty. Now, I tried to remove the freenx by using yum, and then I removed the files it left behind manually in: /usr/bin/nxserver /usr/lib/nx /var/lib/nxserver /etc/nxserver along with the nx user and group and reinstall. The problem worsen, no matter what user I tried, I always got Session Startup Failed: === NX> 700 Session id: cluster.hpc.org-1014-084919CE7F9816540BDEDD5A7928084E NX> 705 Session display: 1014 NX> 703 Session type: unix-gnome NX> 701 Proxy cookie: ee398e9cedaf3adbba4dc966d4433dee NX> 702 Proxy IP: 127.0.0.1 NX> 706 Agent cookie: ee398e9cedaf3adbba4dc966d4433dee NX> 704 Session cache: unix-gnome NX> 707 SSL tunneling: 1 NX> 105 /usr/bin/nxserver: line 1077: 8588 Terminated sleep $AGENT_STARTUP_TIMEOUT NX> 596 Session startup failed. NX> 1004 Error: NX Agent exited with exit status 1. NX> 1006 Session status: closed Can't open /var/lib/nxserver/db/running/sessionId{084919CE7F9816540BDEDD5A7928084E}: No such file or directory. mv: cannot stat `/var/lib/nxserver/db/running/sessionId{084919CE7F9816540BDEDD5A7928084E}': No such file or directory NX> 280 Exiting on signal: 15 === I tried alternative solution by using VNC. In order to have access to desktop, I modifed the content of the Xstartup file (for the root in /root/.vnc/xstartup and for the regular user in /home/EonStrife/.vnc/xstartup) to be : === #!/bin/sh # Uncomment the following two lines for normal desktop: # unset SESSION_MANAGER # exec /etc/X11/xinit/xinitrc [ -x /etc/vnc/xstartup ] && exec /etc/vnc/xstartup [ -r $HOME/.Xresources ] && xrdb $HOME/.Xresources xsetroot -solid grey vncconfig -iconic & xterm -geometry 80x24+10+10 -ls -title "$VNCDESKTOP Desktop" & #startx & exec gnome-session & #twm & === The funny thing is that for regular user I can access the desktop, but for the root I'm only treated with the terminal. (BTW, the client I used are tightVNC and RealVNC) Thanks. ===Previous Message=== Eon Strife wrote: > Hi, > Thanks, it's Gnome, and I'm stuck when I login as root. > By using Putty, I managed to create a new user, and then I tried to login to desktop(using nomachine) as that user, and yes, it works. The problem now is that I stuck when I login as the root. > > NX> 596 Session startup failed. <- The additional line in the sshlog of the root > NX> 1004 Error: NX Agent exited with exit status 1. > Can't open /var/lib/nxserver/db/running/sessionId{0C2C8B077AB56ED37F7A5A72FE8FA7BF}: No such file or directory. > mv: cannot stat `/var/lib/nxserver/db/running/sessionId{0C2C8B077AB56ED37F7A5A72FE8FA7BF}': No such file or directory > NX> 1006 Session status: closed > Exited with status 0. User pressed Ok. As a regular user you shouldn't be able to look into that directory, so that's normal. Only root and nx can do that. Interesting (at least to me) is that you get an error concerning a session that I do not believe it should be looking for. It's like it's attempting to reattach to a session that doesn't exist and then it fails. I could be incorrect, but at this point it's simply a data point. On the client machine (assuming it is linux), have you removed all session data from the user's home directory? By default this is ~/.nx/cache-unix-windowmanagername (for you that is likely gnome) and ~/.nx/letter-hostname-screen-somerandomhashIthink/ Don't remove the config directory or else you'll have to set up the nx information again. See if that doesn't fix the issue. It may not, and I'm sorry if it doesn't, but I am not entirely sure about this particular issue. If the client machine is a windows machine there is a .nx directory, but I am not sure where it's kept. C:\documents and settings\user\.nx maybe. That is where it resides on my windows install at work on XP. I may or may not have changed the directory so you might have to look around a bit. HTH Alex White -- ethericalzen at gmail.com Life is a prison, death is a release Send instant messages to your online friends http://uk.messenger.yahoo.com

2 1

Re: [CentOS] Re: Need help with rsync. [solved]
by James B. Byrne 23 May '08

23 May '08

In-Reply-To: <f4e013870805211022r36194b29gb74ca4421dc2ee77(a)mail.gmail.com> On: Wed, 21 May 2008 10:22:19 -0700, MHR <mhullrich(a)gmail.com> wrote: >> On Wed, May 21, 2008 at 8:37 AM, James B. Byrne <byrnejb(a)harte-lyne.ca> >> wrote: >> >> This indeed turned out to be an SELinux policy problem which I have since >> resolved. > > Whoa, whoa, whoa, nice shooting, Tex! (Ghostbusters) > > Not so fast - please post the solution, too, for posterity (and those > of us who don't use SELinux but might, someday, in the not too distant > far future...). > > Thanks. > > mhr Dealings with SELinux issues typically do not lend themselves to short answers. SELinux is like an onion, each each exception blocks access until resolved. Thus each policy change has to be made individually and then the process retested so that the next impediment evidences itself. On CentOS-5 your friends are: # grep avc /var/log/messages # grep <process> /var/log/audit/audit.log and some of the more useful utilities are: # audit2allow # audit2why # chcon # restorecon # sealert # semanage When I suspect (and that is often the hardest part of the whole exercise, realizing that SELinux is the problem) that SELinux is involved in a problem I start by checking the system log file /var/log/messages with grep avc. If I see things like this: # grep avc /var/log/messages May 16 04:02:33 inet01 kernel: audit(1210924952.785:22973): avc: denied { read } for pid=22282 comm="prelink" name="setserial" dev=dm-0 ino=3309644 scontext=user_u:system_r:prelink_t:s0 tcontext=system_u:object_r:rsync_data_t:s0 tclass=file Then I infer that I have a problem with either the SELinux file contexts or the system policy file. If the SELinux problem is announced at the desktop then you may also find it useful to check for this: # grep setroubleshoot /var/log/messages In which case you may see something like this: Dec 17 14:13:24 inet01 setroubleshoot: SELinux is preventing /usr/sbin/httpd (httpd_t) "write" to virtual.d (etc_t). For complete SELinux messages. run sealert -l 15618e2e-044c-4c4c-b3fc-ec1eba554d02 In this case you can follow the suggestion given in the log message and run sealert: # sealert -l 15618e2e-044c-4c4c-b3fc-ec1eba554d02 Summary SELinux is preventing /usr/sbin/httpd (httpd_t) "write" to virtual.d (etc_t). Detailed Description SELinux is preventing /usr/sbin/httpd (httpd_t) "write" to virtual.d (etc_t). The SELinux type %TARGET_TYPE, is a generic type for all files in the directory and very few processes (SELinux Domains) are allowed to write ... yada-yada-yada... ... Allowing Access You can attempt to fix file context by executing restorecon -v virtual.d The following command will allow this access: restorecon virtual.d And then you can try that, although I have rarely had a problem with SELinux solved so simply: # cd /path/to/virtual.d # restorecon virtual.d Anyway, if that does not work, or one never received an setroubleshoot report to begin with, then I end up turning to audit2allow. I do something like this (where rsync is the process that I am having difficulty with, it could be httpd, vsftp or anything else): # grep rsync /var/log/audit/audit.log | audit2allow Which may yield a report something like this: #============= prelink_t ============== allow prelink_t rsync_data_t:file read; Now, if this does not look too alarming in terms of the access that rsync seems to be seeking (being able to read files to be transferred seems a logical enough expectation and the benefit/limitations of prelink seem to require access in this instance) then we can add this permission to our policy via a local module. You make one of these in this fashion: # # grep rsync /var/log/audit/audit.log | audit2allow -M localrsyncmod ******************** IMPORTANT *********************** To make this policy package active, execute: semodule -i localrsyncmod.pp # Again, you simply follow the instructions given in the report. # semodule -i localrsyncmod.pp Now you do yet another test and check the log files. If the problem is fixed, then great, you are finished. Usually, however, SELinux issues continually reveal one permission problem after another, sometimes with different processes, until, at last, they have all been accommodated. Consequently you end up re-running your tests, checking the audit files, and modifying the local policy one item at a time. Note that simply overriding what SELinux is prohibiting is not what I am advocating here. Sometimes the problem is that the software needs its file system access expectations trimmed back and that requires filing a bug report with the maintainers. However, in a production environment you normally just have to get things working and what I usually do is weigh what the program is requesting against what I want it to do for me. Often the problem is that the default policy is simply too restrictive. On rare occasions I do actually file a bug report but almost always override the local policy anyway just to get on with the job. I hope this helps. -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

2 1

Interface bonding?
by Timothy Selivanow 23 May '08

23 May '08

I'm try to bond a few interfaces together with the hopes of getting increased throughput, and I'm using a cisco Catalyst 2900 as the switch. I've tried using mode 0, 5, and 6 with nothing special on the switch, and mode 4 with some ports "trunked" together (I have a feeling that the "trunking" that the 2900 does is not 802.3ad, as it disabled the ports it saw as redundant), yet xfer speeds always cap out at about 10MB/s. Has any body accomplished bonding with increased throughput as the goal, with or without (without might be preferable) doing something special on the switch (preferably the afore-mentioned Catalyst 2900, as that is what I have to work with as a non-sactioned side-project ;)? --Tim ___________________________________________________ < When pleasure remains, does it remain a pleasure? > --------------------------------------------------- \ \ \ \ /\ ( ) .( o ).

10 42

CentOS-announce Digest, Vol 39, Issue 11
by centos-announce-request＠centos.org 23 May '08

23 May '08

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2008:0492 Important CentOS 4 i386 gnutls Update (Johnny Hughes) 2. CESA-2008:0492 Important CentOS 4 x86_64 gnutls Update (Johnny Hughes) 3. CESA-2008:0287 Important CentOS 4 i386 libxslt Update (Johnny Hughes) 4. CESA-2008:0287 Important CentOS 4 x86_64 libxslt Update (Johnny Hughes) 5. CEEA-2008:0274 CentOS 5 i386 xenpv Update (Karanbir Singh) 6. CEEA-2008:0274 CentOS 5 x86_64 xenpv Update (Karanbir Singh) ---------------------------------------------------------------------- Message: 1 Date: Thu, 22 May 2008 08:49:09 -0500 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CESA-2008:0492 Important CentOS 4 i386 gnutls Update To: CentOS-Announce <centos-announce(a)centos.org> Message-ID: <483579D5.3090501(a)centos.org> Content-Type: text/plain; charset="iso-8859-1" CentOS Errata and Security Advisory 2008:0492 Imporant Upstream details at : https://rhn.redhat.com/errata/RHSA-2008-0492.html The following updated files have been uploaded and are currently syncing to the mirrors: i386: gnutls-1.0.20-4.el4_6.i386.rpm gnutls-devel-1.0.20-4.el4_6.i386.rpm src: gnutls-1.0.20-4.el4_6.src.rpm

1 0

kaffeine installation
by secrookie＠gmail.com 23 May '08

23 May '08

Anyone got kaffeine installed. When I do a #yum install kaffeine I get a transaction check error with kde-libs. Is this a known issue and is their a workaround? regards, secrookie

2 1

centos sparc distro?
by tblader 23 May '08

23 May '08

Hello All. I've a couple Sun SPARC Ultra 60 machines I'd like to install Linux on. Is the Centos 4.2 Beta distro* still in development? Looks like 2005 was the last beta release. Thanks, Thomas [*] - http://beta.centos.org/centos/4.2beta/isos/sparc/ -- Flambeau Inc. Technology Center - Baraboo, WI Email : tblader(a)flambeau.com Keyserver: http://pgp.mit.edu KeyID: 0x00E9EC2C

3 2

Re:Re:Can't get past the splash screen
by Eon Strife 22 May '08

22 May '08

Hi, Thanks, it's Gnome, and I'm stuck when I login as root. By using Putty, I managed to create a new user, and then I tried to login to desktop(using nomachine) as that user, and yes, it works. The problem now is that I stuck when I login as the root. Then, I compared the runlog (the one I wrote in that previous email), between the root's and the new user's and, they're the same. Then, I compared the sshlog, and I found discrepancies. In the sshlog of the root, there are some additional lines saying unable to open a file and unable to start the sesion: === NX> 285 Identified internal connection NX> 285 Using default mode encrypted NX> 285 Identified options: nx/nx,options=/cygdrive/C/Users/EONSTR~1/NX73F8~1/S-8728~1.ORG/options:1000 NX> 280 Proxy opened with local: 7 remote: 8 NX> 285 Switching descriptors: 4 and: 5 to: 7 NX> 287 Redirected I/O to channel descriptors NX> 280 Proxy in: 4 out: 5 transport in: 8 out: 8 NX> 596 Session startup failed. <- The additional line in the sshlog of the root NX> 1004 Error: NX Agent exited with exit status 1. Can't open /var/lib/nxserver/db/running/sessionId{0C2C8B077AB56ED37F7A5A72FE8FA7BF}: No such file or directory. mv: cannot stat `/var/lib/nxserver/db/running/sessionId{0C2C8B077AB56ED37F7A5A72FE8FA7BF}': No such file or directory NX> 1006 Session status: closed Exited with status 0. User pressed Ok. === I checked the permission of that var/lib/nxserver/ (and folders (including /db/running/ ) and files inside it), the permission is 0700 (read,write,execute enabled for the owner), with the group is root and owner is the nx. And yes, also using the root I can view the content of the var/lib/nxserver. If I login using that new user, I can't view the content. Oh,yeah, pressing start and leaving for few hours don't solve the problem. Checking the .bash_history file, these are the commands I issued around the time when I messed up : === useradd aaa useradd --help useradd abc passwd aaa useradd --help useradd -d /home/aaaa/ -p aaaaaa aaa which useradd /etc/rc.d/init.d/autofs stop /etc/rc.d/init.d/autofs start /etc/rc.d/init.d/autofs stop /etc/rc.d/init.d/autofs start /etc/rc.d/init.d/autofs stop /etc/rc.d/init.d/autofs start /etc/rc.d/init.d/autofs stop etc/rc.d/init.d/autofs start /etc/rc.d/init.d/autofs start /etc/rc.d/init.d/autofs stop userdel --help userdel aaa passwd aaa /etc/rc.d/init.d/autofs start /etc/rc.d/init.d/autofs stop cd /home/ ls rmdir --help cd aaa ls del --help delfile --help cd \. cd /. cd /home/ rm -r /home/aaa/ ls /etc/rc.d/init.d/autofs start /etc/rc.d/init.d/autofs reload /etc/rc.d/init.d/autofs start /etc/rc.d/init.d/autofs start /etc/rc.d/init.d/autofs stop /etc/rc.d/init.d/autofs start ls /etc/rc.d/init.d/autofs stop exit ypcat ypcat group group grouplist groupls groups users uname uname -s -n -m -r id whoami w root w ps ps ps -f ps -a === Thanks. === I am not in front of a machine with the nxclient on it, I will be in the morning and can see what some of the logs look like there; however, the ling concerning automatic reconnect to true makes me think the device is attempting to start up a session that doesn't exist. I can't prove that, but I will have more information tomorrow. Concerning your screen shot, I've only ever been stuck at that screen once and simply hitting enter at the keyboard made it vanish. The splash screen should time out anyhow once the start up stuff times out if gnome/kde/xfce's initialization routine takes too long. What desktop (window manager?) are you using? Is it Gnome, KDE or something else? I've not seen selinux create an issue, but for posterity is it running? Does it log anything on the system you're attempting to connect with? Oh, what about permissions for the user? Does the user have the ability to write to his/her home directory properly? You could be getting stuck on the splash screen because the user can't write any data for the initialization. Sincerely, Alex White === Send instant messages to your online friends http://uk.messenger.yahoo.com

3 2

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss