Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
[SOLVED] Can't change context label (SELinux)
View unanswered posts
View posts from last 24 hours

Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message

Joined: 22 May 2007
Posts: 38

PostPosted: Wed May 24, 2017 8:23 pm    Post subject: [SOLVED] Can't change context label (SELinux) Reply with quote


I have set up Hardened Gentoo with SELinux.
I basically used these guides:
(did it all on a fresh install, selecting a hardened profile at the begining)

After a while I noticed this:
[    8.694689] audit: type=1400 audit(1495656549.961:13): avc:  denied  { unlink } for  pid=3710 comm="quotacheck" name="aquota.user" dev="md124" ino=12 scontext=system_u:system_r:quota_t tcontext=system_u:object_r:default_t tclass=file permissive=1

(md124 is /home)

Of course aquota.user does not have the right context label.
But I can't seem to change the context label on any file or directory:
semanage fcontext -a -t quota_db_t "/home/"
Traceback (most recent call last):
  File "/usr/lib/python-exec/python2.7/semanage", line 933, in <module>
  File "/usr/lib/python-exec/python2.7/semanage", line 912, in do_parser
  File "/usr/lib/python-exec/python2.7/semanage", line 364, in handleFcontext
    OBJECT.add(args.file_spec, args.type, args.ftype, args.range, args.seuser)
  File "/usr/lib64/python2.7/site-packages/", line 1933, in add
    self.__add(target, type, ftype, serange, seuser)
  File "/usr/lib64/python2.7/site-packages/", line 1929, in __add
    self.mylog.log_change("resrc=fcontext op=add %s ftype=%s tcontext=%s:%s:%s:%s" % (audit.audit_encode_nv_string("tglob", target, 0), ftype_to_audit[ftype], seuser, "object_r", type, serange))
NameError: global name 'audit' is not defined

Somehow I managed to get the right context label (this might have fixed it: )
But 'semanage fcontext -a -t var_t "/var/www"' gives the same error, so I can't change any context labels.

Now there was a problem with the SELinux instalation, that is why I switched to Python 2.7 because I remembered that long time ago SELinux was not working with Gentoo and newer Python.
I was not able to execute this: "semanage login -a -s staff_u john"
After switching to Python 2.7 I was able to execute it, but I think that could have caused much deeper problems, like now.

Any help is much appreciated!

It seems that by default the SELinux profile does not set all needed USE flags.
I did not want to figure out which exactly but I have a hunch that this is required:
sys-process/audit python

But I did take the ugly way and added "audit" flag to /etc/portage/make.conf
After rebuilding all packages (emerge --update --changed-use --deep @world) that have this USE flag, setting context labels started working.
Maybe a bug?
Hope this will help someone else too!

[Moderator edit: changed [quote] tags to [code] tags to preserve output layout. -Hu]
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum