This seems to be some basic 'issue' with this image. See below
On 12/22/2015 10:52 AM, Robert Moskowitz wrote:
> I ran yum update via an ssh session and saw the updated included:
>
> selinux-policy.noarch 0:3.13.1-60.el7
> selinux-policy-targeted.noarch 0:3.13.1-60.el7
>
>
> Then on my serial console I see:
>
> [41323.407978] SELinux: Class netlink_iscsi_socket not defined in
> policy.
> [41323.414925] SELinux: Class netlink_fib_lookup_socket not defined
> in policy.
> [41323.422242] SELinux: Class netlink_connector_socket not defined in
> policy.
> [41323.429483] SELinux: Class netlink_netfilter_socket not defined in
> policy.
> [41323.436736] SELinux: Class netlink_generic_socket not defined in
> policy.
> [41323.443793] SELinux: Class netlink_scsitransport_socket not
> defined in policy.
> [41323.451346] SELinux: Class netlink_rdma_socket not defined in policy.
> [41323.458115] SELinux: Class netlink_crypto_socket not defined in
> policy.
> [41323.465102] SELinux: Permission audit_read in class capability2
> not defined in policy.
> [41323.473425] SELinux: Class binder not defined in policy.
> [41323.479019] SELinux: the above unknown classes and permissions will
> be allowed
> [41638.997450] Ebtables v2.0 unregistered
> [41641.121256] nf_conntrack version 0.5.0 (15901 buckets, 63604 max)
> [41641.191453] ip6_tables: (C) 2000-2006 Netfilter Core Team
> [41641.449223] Ebtables v2.0 registered
>
I just set up a new image on a sata HD, resized everything as I wanted
with gparted, set selinux to switch to enforcing during first boot. I
logged all the serial output, and see the following BEFORE it hit the
selinux switch:
[ OK ] Reached target Switch Root.
Starting Switch Root...
[ 12.606603] systemd-journald[120]: Received SIGTERM from PID 1 (systemd).
[ 13.913090] SELinux: Class netlink_iscsi_socket not defined in policy.
[ 13.926948] SELinux: Class netlink_fib_lookup_socket not defined in
policy.
[ 13.940976] SELinux: Class netlink_connector_socket not defined in
policy.
[ 13.954902] SELinux: Class netlink_netfilter_socket not defined in
policy.
[ 13.968771] SELinux: Class netlink_generic_socket not defined in policy.
[ 13.982346] SELinux: Class netlink_scsitransport_socket not defined
in policy.
[ 13.996377] SELinux: Class netlink_rdma_socket not defined in policy.
[ 14.009635] SELinux: Class netlink_crypto_socket not defined in policy.
[ 14.023223] SELinux: Permission audit_read in class capability2 not
defined in policy.
[ 14.038156] SELinux: Class binder not defined in policy.
[ 14.050349] SELinux: the above unknown classes and permissions will
be allowed
[ 14.108739] audit: type=1403 audit(14.085:2): policy loaded
auid=4294967295 ses=4294967295
[ 14.154072] systemd[1]: Successfully loaded SELinux policy in 991.684ms.
[ 14.713847] systemd[1]: Relabelled /dev and /run in 298.064ms.
[ 14.780982] random: nonblocking pool is initialized
So this is something in the image. In fact when the system rebooted
after the selinux switch these messages occured again:
[ 402.784167] SELinux: Class netlink_iscsi_socket not defined in policy.
[ 402.791081] SELinux: Class netlink_fib_lookup_socket not defined in
policy.
[ 402.798389] SELinux: Class netlink_connector_socket not defined in
policy.
[ 402.805623] SELinux: Class netlink_netfilter_socket not defined in
policy.
[ 402.812855] SELinux: Class netlink_generic_socket not defined in policy.
[ 402.819921] SELinux: Class netlink_scsitransport_socket not defined
in policy.
[ 402.827472] SELinux: Class netlink_rdma_socket not defined in policy.
[ 402.834248] SELinux: Class netlink_crypto_socket not defined in policy.
[ 402.841235] SELinux: Permission audit_read in class capability2 not
defined in policy.
[ 402.849552] SELinux: Class binder not defined in policy.
[ 402.855145] SELinux: the above unknown classes and permissions will
be allowed
Finally these messages occured related to the selinux switch:
Welcome to CentOS Linux 7 (Core)!
*** Warning -- SELinux targeted policy relabel is required.
*** Relabeling could take a very long time, depending on file
*** system size and speed of hard drives.
Warning: Skipping the following R/O filesystems:
/sys/fs/cgroup
4.0%[ 136.228323] systemd-readahead[353]:
open(/etc/selinux/targeted/modules/active/policy.kern) failed: Too many
levels of symbolic links
Do these warnings matter?
thanks