FC5 LDAP issues

[Jason L Tibbitts III]

>>>>> "DJW" == Daniel J Walsh <Daniel> writes:

DJW> Looks like you have a labeling problem.

The system relabeled itself as part of the boot.  But I've forced
another relabel and there are eight fewer messages:

audit(1143750802.325:2): avc:  denied  { search } for  pid=636 comm="pam_console_app" name="var" dev=dm-0 ino=98305 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c255 tcontext=system_u:object_r:file_t:s0 tclass=dir
audit(1143751052.509:3): avc:  denied  { search } for  pid=1723 comm="dbus-daemon" name="pki" dev=dm-0 ino=163878 scontext=system_u:system_r:system_dbusd_t:s0 tcontext=system_u:object_r:cert_t:s0 tclass=dir
audit(1143751052.509:4): avc:  denied  { read } for  pid=1723 comm="dbus-daemon" name="cacert.pem" dev=dm-0 ino=165663 scontext=system_u:system_r:system_dbusd_t:s0 tcontext=system_u:object_r:cert_t:s0 tclass=file
audit(1143751052.517:5): avc:  denied  { getattr } for  pid=1723 comm="dbus-daemon" name="cacert.pem" dev=dm-0 ino=165663 scontext=system_u:system_r:system_dbusd_t:s0 tcontext=system_u:object_r:cert_t:s0 tclass=file
audit(1143751052.521:6): avc:  denied  { read } for  pid=1723 comm="dbus-daemon" name="cert.pem" dev=dm-0 ino=164178 scontext=system_u:system_r:system_dbusd_t:s0 tcontext=system_u:object_r:cert_t:s0 tclass=lnk_file
audit(1143751053.465:7): avc:  denied  { mounton } for  pid=1777 comm="mount" name="mail" dev=dm-4 ino=589827 scontext=system_u:system_r:mount_t:s0 tcontext=system_u:object_r:mail_spool_t:s0 tclass=dir
audit(1143751055.021:8): avc:  denied  { read } for  pid=1954 comm="automount" name="cacert.pem" dev=dm-0 ino=165663 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:object_r:cert_t:s0 tclass=file
audit(1143751055.021:9): avc:  denied  { getattr } for  pid=1954 comm="automount" name="cacert.pem" dev=dm-0 ino=165663 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:object_r:cert_t:s0 tclass=file
audit(1143751055.025:10): avc:  denied  { read } for  pid=1954 comm="automount" name="cert.pem" dev=dm-0 ino=164178 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:object_r:cert_t:s0 tclass=lnk_file
audit(1143751064.226:11): avc:  denied  { getattr } for  pid=2244 comm="hald" name="/" dev=dm-1 ino=2 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:default_t:s0 tclass=dir
audit(1143751064.230:12): avc:  denied  { search } for  pid=2244 comm="hald" name="spool" dev=dm-4 ino=589825 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:var_spool_t:s0 tclass=dir
audit(1143751066.602:13): avc:  denied  { write } for  pid=2341 comm="mount" name="socket" dev=dm-4 ino=917527 scontext=system_u:system_r:mount_t:s0 tcontext=system_u:object_r:nscd_var_run_t:s0 tclass=sock_file
audit(1143751066.602:14): avc:  denied  { connectto } for  pid=2341 comm="mount" name="socket" scontext=system_u:system_r:mount_t:s0 tcontext=system_u:system_r:nscd_t:s0 tclass=unix_stream_socket
audit(1143751066.606:15): avc:  denied  { use } for  pid=2341 comm="mount" name="hosts" dev=dm-4 ino=622598 scontext=system_u:system_r:mount_t:s0 tcontext=system_u:system_r:nscd_t:s0 tclass=fd
audit(1143751066.606:16): avc:  denied  { read } for  pid=2341 comm="mount" name="hosts" dev=dm-4 ino=622598 scontext=system_u:system_r:mount_t:s0 tcontext=system_u:object_r:nscd_var_run_t:s0 tclass=file
audit(1143751066.606:17): avc:  denied  { getattr } for  pid=2341 comm="mount" name="hosts" dev=dm-4 ino=622598 scontext=system_u:system_r:mount_t:s0 tcontext=system_u:object_r:nscd_var_run_t:s0 tclass=file

I had been running with selinux disabled for some time, but when I
enabled it earlier today the system relabeled itself and then it did
so again when I switched to permissive.  Does the boot-time relabel
log the changes it makes?  I'd like to see why the third relabel
changed things.

In any case, there are still the cert failures which will keep the
machine from booting.

 - J<