Craig White wrote: 
On Wed, 2009-01-28 at 23:00 -0500, Rob Kampen wrote:
  
Last resort was the 'touch /.autorelabel' and reboot. This took nearly
an hour but once it came up all was well.
Thanks for the pointers Filipe.
At what point would it be safe to go to enforcing? What logs should I
be inspecting for warnings?
I find SELinux real hard to get my head around, extensive reading and
still I don't get it clearly enough to where I understand it and feel
safe committing my business server to it. And when something like this
occurs and it takes the server down for an hour to clean it up.... not
really production ready. 
I'm getting ready to head for PCI-DSS audit and thought SELinux
enforcing would be a help......any comments from those with more
experience??
    
----
you shouldn't have to relabel a filesystem unless you had turned SELinux
off for a while. So that shouldn't be necessary again.

I also gathered that the RHEL 5.3 release has a bunch of the newer tools
from virtually current Fedora like SETroubleShooter which should make
life a lot easier.

I gather that CentOS 5.3 will be released in the next week or so and I
would probably wait until you have it running fine for a week or two in
permissive mode and have squashed any alerts and you should be good to
move to enforcing.

Craig

_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos
I have five other machines that will be updated to 5.3 prior to risking this server, once they're all going okay I'll move to this one.
Thanks for the pointers Craig.
One thing I have learned is that mv is not very safe, cp is better - particularly across directories.
I will need to play with SETroubleShooter. I have not used SELinux on my work-stations / laptops, and only leave it in permissive mode on my servers, thus I don't really have somewhere to play with it.
Does anyone use SELinux on their work-station i.e. the place where you try things out, debug things etc?? or is it really only for stable systems where not many OS changes and new program trials occur?
I know that asterisk doesn't play nice with SELinux, even in permissive mode it fails to work, and yet this is one area where I would like to have it work as my phone system is VITAL to my business!
Thanks
Rob