Right, that did it (after i started the oddjobd service, that is). Now, the original reason i turned selinux back on was to use xguest....saddly, this isn't working still... <div class="gmail_quote">On Tue, Nov 4, 2008 at 11:21 AM, Daniel J Walsh <<a href="mailto:dwalsh@redhat.com">dwalsh@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 <div class="Ih2E3d"> Matt Nicholson wrote: > So, I have an environment, where we pull user data/auth from ldap/kerberos > for a bunch of fedora workstations. I would love to have selinux turned on > on these, but, right now it jsut doesn't work with our setup. > > See, your users home directories are in a few different places. for the most > part, LDAP think their home is at /n/home, or /n/data/home. So, i have /home > bind mounted to those locations, and, sith selinux off, its all nice and > happy. Another weird thing, is that /home is local on these workstations, so > when a user sits at a workstation for the first time, an empty homedir must > be created. We hope to move to nfs /home soon, but not yet. > </div>Can you look at using pam_oddjob_mkhomedir rather then pam_mkhomedir yum install oddjob\* Should fix the problem. <div><div></div><div class="Wj3C7c"> > once i turn it on, however, users cannot log in, and the home directoies > cannot be created. I get selinux messages like: > > Summary: > > SELinux is preventing sshd (sshd_t) "create" to ./nichols2 (home_root_t). > > Detailed Description: > > SELinux denied access requested by sshd. It is not expected that this access > is > required by sshd and this access may signal an intrusion attempt. It is also > possible that the specific version or configuration of the application is > causing it to require additional access. > > Allowing Access: > > Sometimes labeling problems can cause SELinux denials. You could try to > restore > the default system file context for ./nichols2, > > restorecon -v './nichols2' > > If this does not work, there is currently no automatic way to allow this > access. > Instead, you can generate a local policy module to allow this access - see > FAQ > (<a href="http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385" target="_blank">http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385</a>) Or you can > disable > SELinux protection altogether. Disabling SELinux protection is not > recommended. > Please file a bug report (<a href="http://bugzilla.redhat.com/bugzilla/enter_bug.cgi" target="_blank">http://bugzilla.redhat.com/bugzilla/enter_bug.cgi</a>) > against this package. > > Additional Information: > > Source Context system_u:system_r:sshd_t:s0-s0:c0.c1023 > Target Context system_u:object_r:home_root_t:s0 > Target Objects ./nichols2 [ dir ] > Source sshd > Source Path /usr/sbin/sshd > Port <Unknown> > Host dhcp-0016533596-c5-74 > Source RPM Packages openssh-server-5.1p1-2.fc9 > Target RPM Packages > Policy RPM selinux-policy-3.3.1-103.fc9 > Selinux Enabled True > Policy Type targeted > MLS Enabled True > Enforcing Mode Enforcing > Plugin Name catchall_file > Host Name dhcp-0016533596-c5-74 > Platform Linux dhcp-0016533596-c5-74 > 2.6.26.6-79.fc9.i686 > #1 SMP Fri Oct 17 14:52:14 EDT 2008 i686 i686 > Alert Count 1 > First Seen Tue Nov 4 10:49:41 2008 > Last Seen Tue Nov 4 10:49:41 2008 > Local ID 803e925f-1d6e-4473-9054-dbaf0c0f3abd > Line Numbers > > Raw Audit Messages > > host=dhcp-0016533596-c5-74 type=AVC msg=audit(1225813781.838:89): avc: > denied { create } for pid=4956 comm="sshd" name="nichols2" > scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 > tcontext=system_u:object_r:home_root_t:s0 tclass=dir > > host=dhcp-0016533596-c5-74 type=SYSCALL msg=audit(1225813781.838:89): > arch=40000003 syscall=39 success=no exit=-13 a0=b9b4f058 a1=1ed a2=8209e4 > a3=b9b7d230 items=0 ppid=2341 pid=4956 auid=4294967295 uid=0 gid=0 euid=0 > suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sshd" > exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null) > > Thats for an ssh login attempt. I get the same for one via GDM. I've tried > adding "context=system_r:object_r:home_root_t" when i bind mount the /home > on /n/home etc, and no luck so far. do I need to relabel /n ? what/how > should I? any help would be awesome. > > Thanks, > > Matt > > </div></div>-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Fedora - <a href="http://enigmail.mozdev.org" target="_blank">http://enigmail.mozdev.org</a> iEYEARECAAYFAkkQdnUACgkQrlYvE4MpobPlnQCeI054kP0QjzCP1u4X5mr1yD9v /jgAoJLJ3lfNDoBwnlk4CcyLyw0s3qdh =Ly01 -----END PGP SIGNATURE----- -- fedora-list mailing list <a href="mailto:fedora-list@redhat.com">fedora-list@redhat.com</a> To unsubscribe: <a href="https://www.redhat.com/mailman/listinfo/fedora-list" target="_blank">https://www.redhat.com/mailman/listinfo/fedora-list</a> Guidelines: <a href="http://fedoraproject.org/wiki/Communicate/MailingListGuidelines" target="_blank">http://fedoraproject.org/wiki/Communicate/MailingListGuidelines</a> </blockquote></div>