There may be a dontaudit clause in either the base or the ccs modules. Try inserting the enableaudit.pp module and see what happens. I'm not sure if RHEL5.3 supports "semodule -DB" but that would turn off dontaudit also.<br> <br><div class="gmail_quote">On Wed, Aug 12, 2009 at 10:50 AM, de Jong, MarkJan <span dir="ltr"><<a href="mailto:deJongm@teoco.com">deJongm@teoco.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> <div link="blue" vlink="purple" lang="EN-US"> <div> <p><span style="font-size: 11pt; color: rgb(31, 73, 125);">That’s just it. There are no logs being generated in audit.log. I’m pretty well versed in creating custom SELInux policies.</span></p> <p><span style="font-size: 11pt; color: rgb(31, 73, 125);"> </span></p> <p><span style="font-size: 11pt; color: rgb(31, 73, 125);">I’ve reported on issues in the past where SELinux does not generate logs. It was a while ago and have since forgotten what the resolution was but I was fixed by the devs.. I’ll be more than happy to file a bug report.</span></p> <p><span style="font-size: 11pt; color: rgb(31, 73, 125);"> </span></p> <p><span style="font-size: 11pt; color: rgb(31, 73, 125);">Thx,</span></p> <p><span style="font-size: 11pt; color: rgb(31, 73, 125);">M</span></p> <p><span style="font-size: 11pt; color: rgb(31, 73, 125);"> </span></p> <div style="border-style: solid none none; border-color: rgb(181, 196, 223) -moz-use-text-color -moz-use-text-color; border-width: 1pt medium medium; padding: 3pt 0in 0in;"> <p><b><span style="font-size: 10pt;">From:</span></b><span style="font-size: 10pt;"> <a href="mailto:linux-cluster-bounces@redhat.com" target="_blank">linux-cluster-bounces@redhat.com</a> [mailto:<a href="mailto:linux-cluster-bounces@redhat.com" target="_blank">linux-cluster-bounces@redhat.com</a>] <b>On Behalf Of </b>Ian Hayes<br> <b>Sent:</b> Wednesday, August 12, 2009 1:26 PM<br> <b>To:</b> linux clustering<br> <b>Subject:</b> Re: [Linux-cluster] RHEL 5.3: Joining fence domain hangs when selinux is enabled</span></p> </div><div><div></div><div class="h5"> <p> </p> <p style="margin-bottom: 12pt;">I'm assuming that you're running the Targeted policy and not the strict policy...<br> <br> RHEL5 has a module for ccs, but I haven't taken it apart. The files for fencing may be incorrectly labeled or the policy doesn't allow fenced to run correctly.<br> <br> Look at your /var/log/audit/audit.log files and see what's being denied. You may want to install sealert and setroubleshootd so you can browse the messages. First, check the file contexts of the files that are appearing in your audit logs. Nothing should be default_t. If anything looks out of whack, try restoring the correct file contexts with restorecon and see if the file contexts have changed. If you're feeling brave, you can start writing a custom policy module to permit fenced to start up.<br> <br> The audit logs will tell you everything, and where you will need to start. I managed to knock out a policy for 389Server in about an hour, but I had the benefit of just coming back from Redhat's SELinux class.<br> <br> </p> <div> <p>On Wed, Aug 12, 2009 at 9:15 AM, de Jong, MarkJan <<a href="mailto:deJongm@teoco.com" target="_blank">deJongm@teoco.com</a>> wrote:</p> <div> <div> <p>It seems that with selinux enabled, fencing hangs during ‘service cman start’.</p> <p> </p> <p>When selinux is set to enforcing, the cman startup script hangs at “Starting fencing ….” and never times out.</p> <p>There are NO logs related to the event in /var/log/audit/audit.log, nor anything telling in /var/log/messages. ‘fence_tool dump’ also does not provide any further details.</p> <p> </p> <p>After setting selinux to permissive, fencing starts up without incident.</p> <p> </p> <p>I’m using the following packages:</p> <p> </p> <p>kernel-xen-2.6.18-128.4.1.el5</p> <p>cman-2.0.98-1.el5_3.4</p> <p> </p> <p>Let me know if I can provide any further info.</p> <p> </p> <p>thanks,</p> <p>Mark de Jong</p> <p> </p> <p> </p> <p> </p> <p> </p> </div> <p> </p> <div style="text-align: center;" align="center"> <hr align="center" size="2" width="100%"> </div> <p><span style="font-size: 7.5pt; color: green;">PRIVILEGED AND CONFIDENTIAL<br> PLEASE NOTE: The information contained in this message is privileged and confidential, and is intended only for the use of the individual to whom it is addressed and others who have been specifically authorized to receive it. If you are not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, or if any problems occur with transmission, please contact sender. Thank you.</span></p> </div> <p><br> --<br> Linux-cluster mailing list<br> <a href="mailto:Linux-cluster@redhat.com" target="_blank">Linux-cluster@redhat.com</a><br> <a href="https://www.redhat.com/mailman/listinfo/linux-cluster" target="_blank">https://www.redhat.com/mailman/listinfo/linux-cluster</a></p> </div> <p> </p> </div></div></div><div><div></div><div class="h5"> <br> <hr> <font color="Green" face="Arial" size="1">PRIVILEGED AND CONFIDENTIAL<br> PLEASE NOTE: The information contained in this message is privileged and confidential, and is intended only for the use of the individual to whom it is addressed and others who have been specifically authorized to receive it. If you are not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, or if any problems occur with transmission, please contact sender. Thank you.<br> </font> </div></div></div> <br>--<br> Linux-cluster mailing list<br> <a href="mailto:Linux-cluster@redhat.com">Linux-cluster@redhat.com</a><br> <a href="https://www.redhat.com/mailman/listinfo/linux-cluster" target="_blank">https://www.redhat.com/mailman/listinfo/linux-cluster</a><br></blockquote></div><br>