James Pulver
CLASSE Computer Group
Cornell University
On 06/29/2016 06:12 AM, David Sommerseth wrote:
> On 29/06/16 10:00, Bill Maidment wrote:
>> My final attempt was successful, sort of.
>> I switched SElinux to enabled and rebooted, then the install worked OK.
>> Then I had to use a live CD to be able to boot, changed SElinux to disabled, and reboot again.
>> Then I had to us lpoptions to set the default parameters as the CUPS gui tool refused to change anything.
>> Phew. What a tortuous route.
>> Back to sleep now.........
>
> <rant>
>
> Let this be an example why NOT to disable SELinux. SELinux has been (if
> my memory serves me right) available since Fedora 6 (released in 2006)
> and RHEL *4*! I believe it was turned on by default in Fedora 8 and
> RHEL 5. And in RHEL 6 you could no longer disable SELinux at install time.
>
> SELinux is not the obstacle it once was over a decade ago. So if you
> have issues when it is enabled, learn to use the proper tools to debug
> and fix it correctly. (audit2why, audit2allow, semanage, restorecon,
> etc, etc)
>
> Disabling SELinux is in 2016 *not* a solution and can barely be
> considered a workaround.
>
> Refusing to to use, accept and learn SELinux will serve you no good in
> the long run.
>
> Seriously, I've been running a various amount of Fedora, RHEL/SL/CentOS
> installations and versions over the last 8-9 years. In SL7 SELinux have
> not bitten me much at all (only one issue with logrotate on servers
> running Zimbra Collaboration Suite, that's all). I have the last 6-7
> years never needed to disable SELinux to accomplish my tasks. Yes, I've
> put systems into permissive modes to see if SELinux was to blame, but
> mostly that was not the issue.
>
> So if you are badly hit by SELinux troubles, you need to look into if
> you or the software you use are doing the right things.
>
> </rant>
>
We always disable SELinux. Makes life much better IMO. Pretty much all
our commercial software starts with "Disable SELinux", and the time I
tried to enable it (well, it was enabled by default) on a SL7.1 home
desktop I didn't get 1 day into setting up things until it just blocked
something. In my case it was READ ACCESS to an OpenVPN cert in my home
directory. I was running OpenVPN at the time via the GUI under my user.
So I disabled it so I could actually use my PC.
Now somehow it's turned back on after some reboots at home, but for
other reasons I'm using old fashioned OpenVPN so I'm not immediately
looking at how to disable it. I think it may have blocked Thunar from
prompting me to provide the root password to mount an internal drive,
but I've now added them to /etc/fstab and used symlinks from
/run/media/user so that my existing configurations of software still work.
Honestly, SELinux is something I'd like to use, but I think someone
needs to make it like Comodo Internet Security HIPS on Windows - a GUI
running as root, or preferentially given permissions some how - that
pops up when SELinux is going to block something and lets you click
"Allow / Deny / Terminate program" with a checkbox "remember my answer".
Right now the barrier to use is too high when you can simply turn it
off. It's the same reason we disable UAC in Windows.
>
> --
> kind regards,
>
> David Sommerseth
>
>
>>
>> -----Original message-----
>>> From:Bill Maidment <[log in to unmask]>
>>> Sent: Wednesday 29th June 2016 16:34
>>> To: Akemi Yagi <[log in to unmask]>; SL Users <[log in to unmask]>
>>> Subject: RE: SL7 CUPS/SELinux problem trying to install Brother HL-3150CDN printer driver
>>>
>>> Well I've heard back from Brother and they suggest that my SElinux set up has a problem. They recommended that I do
>>> semodule -vR
>>> This gave me exactly the same error messages. Then I did semodule -vB which worked OK, but repeating semodule -vR still gives
>>>
>>> [root@ferguson src]# semodule -vB
>>> Committing changes:
>>> Ok: transaction number 0.
>>> [root@ferguson src]# semodule -vR
>>> SELinux: Could not downgrade policy file /etc/selinux/targeted/policy/policy.29, searching for an older version.
>>> SELinux: Could not open policy file <= /etc/selinux/targeted/policy/policy.29: No such file or directory
>>> /sbin/load_policy: Can't load policy: No such file or directory
>>> libsemanage.semanage_reload_policy: load_policy returned error code 2. (No such file or directory).
>>> [root@ferguson src]#
>>>
>>> This is happening on two different SL 7.2 machines with SElinux installed but disabled.
>>>
>>> I even tried uninstalling selinux* but that got me into deeper trouble.
>>>
>>> [root@ferguson src]# rpm -qv selinux-policy
>>> selinux-policy-3.13.1-60.el7_2.7.noarch
>>>
>>> Is there an issue with this version of selinux???
>>>
>>> Cheers
>>> Bill
>>>
>>> -----Original message-----
>>>> From:Bill Maidment <[log in to unmask]>
>>>> Sent: Saturday 25th June 2016 17:26
>>>> To: Akemi Yagi <[log in to unmask]>; SL Users <[log in to unmask]>
>>>> Subject: RE: SL7 CUPS/SELinux problem trying to install Brother HL-3150CDN printer driver
>>>>
>>>> Thanks for the suggestion Akemi.
>>>> Unfortunately, it made no difference.
>>>> I'm awaiting comment from Brother, but I suspect they will say change to Ubuntu :-(
>>>> Cheers
>>>> Bill
>>>>
>>>> -----Original message-----
>>>>> From:Akemi Yagi <[log in to unmask]>
>>>>> Sent: Saturday 25th June 2016 1:10
>>>>> To: SL Users <[log in to unmask]>
>>>>> Subject: Re: SL7 CUPS/SELinux problem trying to install Brother HL-3150CDN printer driver
>>>>>
>>>>> On Fri, Jun 24, 2016 at 2:33 AM, Bill Maidment <[log in to unmask]> wrote:
>>>>>> Has anyone any suggestions how to get a Brother HL-3150CDN printer driver installed on SL7.
>>>>>> I have been trying to install using the Brother supplied installation script, which worked OK on SL6.
>>>>>>
>>>>>> With SL7 I get error messages such as:
>>>>>> SELinux: Could not downgrade policy file /etc/selinux/targeted/policy/policy.29, searching for an older version.
>>>>>> SELinux: Could not open policy file <= /etc/selinux/targeted/policy/policy.29: No such file or directory /sbin/load_policy: Can't load policy: No such file or directory
>>>>>>
>>>>>> The file in question does exist, but I have selinux disabled anyway.
>>>>>>
>>>>>> SL7 is using cups version 1.6 whereas SL6 uses cups version 1.4. Is that an issue?
>>>>>> I guess the Brother script is a bit out of date as it was created in 2012.
>>>>>>
>>>>>> Any help would be appreciated.
>>>>>>
>>>>>> Cheers
>>>>>> Bill Maidment
>>>>>
>>>>> Can you try reinstalling selinux-policy packages and see if that fixes
>>>>> the issue?
>>>>>
>>>>> yum reinstall selinux-policy\*
>>>>>
>>>>> Akemi
>>>>>
>>>>>
>>>
>>>
|
