weird stuff happening on server-help

drillsar · 02-20-2017, 12:41 PM

when I install any package and do a ls -Z

this is what I get:

see the ? mark.. in logrotate this happens with any packages being installed and don't know why.

drwxr-xr-x. root root system_u

bject_r:var_lib_t:s0 initramfs
drwxr-xr-x root root ? logrotate
drwx------. root root system_u

bject_r:var_lib_t:s0 machines
drwxr-xr-x. root root system_u

bject_r:var_lib_t:s0 misc
drwx------. root root system_u

bject_r:NetworkManager_var_lib_t:s0 NetworkManager

frankbell · 02-20-2017, 01:59 PM

Just to clarify, do the files really have smilies in them, or do they have the text equivalent (a colon and whatever makes the open mouth). (As an aside, my question could have been avoided with the use of "code" tags, which become available when you click "Go Advanced" just below the "compost post" window.)

My first guess is that this is a "LANG" issue of some sort. What is the output of the locale command?

drillsar · 02-20-2017, 05:18 PM

no reads like this; I don't know how to fix the unconfined _u

Code:

drwxr-xr-x. redis          redis          unconfined_u:object_r:redis_var_lib_t:s0 redis-6379

drillsar · 02-20-2017, 05:22 PM

LANG=en_US.UTF-8
LC_CTYPE="en_US.UTF-8"
LC_NUMERIC="en_US.UTF-8"
LC_TIME="en_US.UTF-8"
LC_COLLATE="en_US.UTF-8"
LC_MONETARY="en_US.UTF-8"
LC_MESSAGES="en_US.UTF-8"
LC_PAPER="en_US.UTF-8"
LC_NAME="en_US.UTF-8"
LC_ADDRESS="en_US.UTF-8"
LC_TELEPHONE="en_US.UTF-8"
LC_MEASUREMENT="en_US.UTF-8"
LC_IDENTIFICATION="en_US.UTF-8"
LC_ALL=

michaelk · 02-20-2017, 06:10 PM

Its not a LANG problem. My knowledge of selinux is limited and at the moment I do not know why installing packages would change the security context of logrotate.

https://www.cyberciti.biz/faq/rhel-c...xt/#more-11302

https://docs.fedoraproject.org/en-US...ing_Files.html

frankbell · 02-20-2017, 07:11 PM

Thanks for the text snippet. It removes a distraction.

I am also lttle experienced with SELinux, but, just for fun, I did this on my Slackware system:

Code:

$ ls -Zl
total 22068
-rwxr-xr-x 1 root root ?    8704 Oct 23  2013 accton
-rwxr-xr-x 1 root root ?   44360 Feb  9 17:34 adjtimex
-rwxr-xr-x 1 root root ?   53384 Feb  9 17:34 agetty
-rwxr-xr-x 1 root root ?   55360 Jul 26  2012 arp
-rwxr-xr-x 1 root root ?   47752 Feb  7 14:00 arpd
-rwxr-xr-x 1 root root ?   19312 Aug 20  2015 arping
-rwxr-xr-x 1 root root ?   27024 Sep 15 18:47 badblocks
-r-xr-xr-x 1 root root ?   13721 Dec 13 15:06 blkdeactivate
-rwxr-xr-x 1 root root ?   27048 Feb  9 17:34 blkdiscard
(snip rest of output, which is similar)

Then I did this as root:

Code:

# ls -Zl 
total 22068
-rwxr-xr-x 1 root root ?    8704 Oct 23  2013 accton
-rwxr-xr-x 1 root root ?   44360 Feb  9 17:34 adjtimex
-rwxr-xr-x 1 root root ?   53384 Feb  9 17:34 agetty
-rwxr-xr-x 1 root root ?   55360 Jul 26  2012 arp
-rwxr-xr-x 1 root root ?   47752 Feb  7 14:00 arpd
-rwxr-xr-x 1 root root ?   19312 Aug 20  2015 arping
-rwxr-xr-x 1 root root ?   27024 Sep 15 18:47 badblocks
-r-xr-xr-x 1 root root ?   13721 Dec 13 15:06 blkdeactivate
(snip rest of output, which is similar)

This leads me to ask, are you running the ls -Z command as user or as root?

drillsar · 02-20-2017, 07:22 PM

yes if SELinux is disabled you get a ? mark. However, I think disabled is a security risk. Right now I have it in permissive mode. I think I solved it..

I am guessing your SELinux is disabled

The thing is what I read if you make dir's that aren't commong loccations you get unconfined_u

running command:
semanage -a -t redis_var_lib_t '/var/lib/redis-6379(/.*)?'
restorecon -RF /var/lib/redis-6379

fixed it for me
of course you have to make sure the file type..
for some reason restorecon -Rv didn't work

frankbell · 02-20-2017, 08:05 PM

Quote:

I am guessing your SELinux is disabled

As I mentioned, I'm using Slackware, which does not include SELinux by default.

At least in my case, I conclude that user is not permitted to see the security context, whereas root is.

Sorry I can't help more.

drillsar · 02-21-2017, 10:49 AM

I didn't think of that. you maybe correct