selinux October 2008

selinux@lists.fedoraproject.org

32 participants
46 discussions

Memory protection and system-config-securitylevel
by Kamil J. Dudek 28 Sep '09

28 Sep '09

Hello everybody Forgive me, if this subject has already been mentioned here, but I simply couldn't find answer anywhere. Few days ago I started system-config-securitylevel. I found something interesting in "Modify SELinux policies". A memory protection - there are four options in there. Two of them are enabled, with a description that if having this enabled is required by some program, it should be reported to bugzilla. I didn't do it, because of very strange effects after turning it off. Disabling "Allow all executable files to map memory areas as executable and readable, which is dangerous and such program should be reported to bugzilla" and "Allow all executable files to mark stack as executable.That shouldn't ever be required" option(translation from polish) made system act very strange. First thing I've observed was that Kobo game stopped working. GMPC stopped playing. Also stuff outside of Fedora like Java and NVidia drivers failed. So I should have "reported to bugzilla" to many application to make it have any sense. Such bug report would be only annoying but according to system-config-securitylevel... What is it with these two options? To make everything work properly they should be enabled, but their description that they should be disabled is confusing. Thank you and forgive me any mess I've done by this post -- Pozdrawiam - Kamil J. Dudek

2 3

mount point labels
by Clarkson, Mike R (US SSA) 14 Sep '09

14 Sep '09

I'm attempting to create the labeled mount point with the following command: mount -t nfs -o context=system_u:object_r:import_file_t:s0 nas:/vol/home /home/SimulatedImport/output/home The mount point is created without any errors, but the label that I specify in the mount command is not used. Instead of system_u:object_r:import_file_t, the context of the /home/SimulatedImport/output/home is system_u:object_r:nfs_t:s0. ls -dZ /home/SimulatedImport/output/home drwxr-xr-x root root system_u:object_r:nfs_t:s0 /home/m252/SimulatedImport/output/home I'm running RHEL5 with a policy built as mls off of the targeted policy. Does anyone know why the context label is not taking? Thanks

3 7

using apol
by Douglas Sikora 30 Oct '08

30 Oct '08

Hi all, I am using apol on a fedora9 box to analyze policy(s) copied over from a rhel5.2 box. when doing file-->open and selecting modular policy I can load base.pp just fine. when going back again to do the same but adding precompiled modules (these modules are known good) I click on Add, then select the "whatever.pp" module the module version and path is populated and all looks good, but when I click on OK to actually load the policy and the modules I get: "The selected file does not appear to be a valid SELinux POlicy Could not open policy" Any suggestions?

1 0

pptp 1.7.2
by Paul Howarth 29 Oct '08

29 Oct '08

pptp 1.7.2 has been in Fedora for some time now and I had some local policy tweaks to make it work for ages but never got round to mentioning them here. So here goes. I add these to make my ADSL link work: # pptp 1.7.2 # Calls /sbin/ip via popen() to read and modify routes corecmd_exec_shell(pptp_t) sysnet_domtrans_ifconfig(pptp_t) # Needs to look up names auth_use_nsswitch(pptp_t) # Calls getsockopt() allow pptp_t self:fifo_file getattr; # Not sure what this is about kernel_read_system_state(pptp_t) I also get this at startup, which is an SELinux issue but I'm unsire what to do about it as it doesn't stop things working: Warning: can't open options file /root/.ppprc: Permission denied Paul.

1 0

File contexts and how are files labeled?
by Timothy Renner 28 Oct '08

28 Oct '08

First off, thanks for the answers about finding out the SELinux transactions... autrace was the way to go.... Now I have a more fundamental problem... In the file context labels, there are two rules that conflict: /sbin/.* all files system_u:object_r:bin_t:s0 and /sbin/mount.mymounter regular file system_u:object_r:myfile_exec_t:s0 The problem though is that the file gets labeled under the blanket /sbin/.* context, rather than the more specific one: > ls -lZ /sbin/mount.mymounter lrwxrwxrwx root root system_u:object_r:bin_t /sbin/mount.mymounter -> /myproject/sbin/mymounter Any thoughts on this? Can someone explain how the file context is derived from the rules? Is it as simple as whichever matches first? And does anyone know a way around this labeling problem, assuming I cannot remove the /sbin/.* rule, but can only add rules through a policy module. Thanks again, -Tim

5 4

init_script_type versus init_script_file
by David Carter 27 Oct '08

27 Oct '08

Good morning. I'm trying to build a module package but I'm running into issues with these macros. When I build in my FC9 development environment, I require init_script_file. When I use mock, it will only build using init_script_type. Why the difference, and what do I do about it? While I might expect issues across versions, I don't expect a difference when my mock target and my build environment are the same. Also, if FC10 is different from FC9, how do I handle that? TIA - Dave

2 2

myexim01.te contents: Does it look ok?
by Frank Murphy 27 Oct '08

27 Oct '08

Scenario Rebuilt server fresh F8 install then yum update. Below follows myexim01.te Original AVC(s) can be included if necessary. ====================================================== module myexim01 1.0; require { type system_crond_t; type system_mail_t; type system_crond_var_run_t; type audisp_t; type system_mail_tmp_t; type exim_t; class capability sys_nice; class fifo_file getattr; class file { read append }; } #============= audisp_t ============== allow audisp_t self:capability sys_nice; #============= exim_t ============== allow exim_t system_crond_t:fifo_file getattr; allow exim_t system_mail_tmp_t:file read; #============= system_mail_t ============== allow system_mail_t system_crond_var_run_t:file append; ========================================================= Frank -- gpg id EB547226 Revoked Forgot Password :( aMSN: Frankly3D http://www.frankly3d.com

3 2

logrotate problems, again.
by Gene Heskett 27 Oct '08

27 Oct '08

Greetings; Like most who run fetchmail, I have cobbled up a script for logrotate to maintain the logs. Unforch, every time I think I have it running correctly for about a month, then selinux has to get into the act. From an email I got this morning: ------ /etc/cron.daily/logrotate: system_u:system_r:unconfined_t:s0 is not a valid context error: error running non-shared postrotate script for /var/log/fetchmail.log of '/var/log/fetchmail.log ' -------- So I assume its failed again. ------------------- [root@coyote ~]# ls -l --lcontext /var/log/fetchmail.* -rw------- 1 system_u:object_r:var_log_t:s0 gene gene 0 2008-10-26 03:13 /var/log/fetchmail.log -rw-r--r-- 1 system_u:object_r:var_log_t:s0 gene gene 80343007 2008-09-28 06:13 /var/log/fetchmail.log-20080928 -rw------- 1 system_u:object_r:var_log_t:s0 gene gene 202387 2008-10-05 05:09 /var/log/fetchmail.log-20081005.gz -rw------- 1 system_u:object_r:var_log_t:s0 gene gene 197849 2008-10-12 05:09 /var/log/fetchmail.log-20081012.gz -rw------- 1 system_u:object_r:var_log_t:s0 gene gene 196517 2008-10-19 05:09 /var/log/fetchmail.log-20081019.gz -rw------- 1 system_u:object_r:var_log_t:s0 gene gene 3298789 2008-10-26 03:13 /var/log/fetchmail.log-20081026 -------------------- And I haven't fixed anything. And as can be seen from the size, it did fail. Here is that stanza of logrotate's input 'mail' script: --------------------------------- # Logrotate file for fetchmail.log and procmail.log /var/log/fetchmail.log { missingok compress notifempty weekly rotate 5 create 0600 gene gene postrotate /usr/bin/killall fetchmail sleep 1 ======== # It appears that the non-logged in syntax is incorrect, so it did not restart # fetchmail, causing the email above. runcon -t unconfined_t -- runuser -l -c "fetchmail -d 90 --fetchmailrc /home/gene/.fetchmailrc" gene # So the above line has been commented, and this line substituted, which # worked to restart fetchmail right now. su gene -c "fetchmail -d 90 --fetchmailrc /home/gene/.fetchmailrc" # Which explains the email message from anacron, but this still leaves the # question as to why the log was NOT rotated. It was not. Next question: # Does anacron have rights to su to gene? ======== endscript } /var/log/procmail.log { missingok compress notifempty weekly rotate 5 create 0600 gene gene } ----------------------------- Its a bit confusing to me because the syntax I must use when I launch fetchmail from rc.local, where no one is logged in yet during the bootup, is different from the syntax I have to use when I'm logged in, usually as root. And here, since it runs 24/7, there is me logged in. What is the permanent cure for this problem please? Thanks. -- Cheers, Gene "There are four boxes to be used in defense of liberty: soap, ballot, jury, and ammo. Please use in that order." -Ed Howdershelt (Author) Where does it go when you flush?

2 1

How can I find out what all the SELinux transactions are?
by Timothy Renner 27 Oct '08

27 Oct '08

Is there any debug stream available that can tell me what is being processed by the SELinux system? Specifically, I'd like to be able to follow the trail from starting an executable, through its state transitions, what files it reads, and what their file contexts are, and what transitions happen as it calls external programs. Thanks, -Tim

4 3

knotify4, NetworkManager (NetworkManager_t) "read write" unconfined_t., ..
by Antonio Olivares 25 Oct '08

25 Oct '08

Dear all(selinux experts and testers) , despite updating selinux-policy packages and relabeling, I am still seeing denied avcs from setroubleshoot Selinux preventing all of the above plus ip (ifconfig_t) "read write" unconfined_t :( Summary: SELinux is preventing ip (ifconfig_t) "read write" unconfined_t. Detailed Description: SELinux denied access requested by ip. It is not expected that this access is required by ip and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context unconfined_u:system_r:ifconfig_t Target Context unconfined_u:unconfined_r:unconfined_t:SystemLow- SystemHigh Target Objects socket [ unix_stream_socket ] Source ip Source Path /sbin/ip Port <Unknown> Host localhost.localdomain Source RPM Packages iproute-2.6.26-1.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-3.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.27.3-34.rc1.fc10.i686 #1 SMP Tue Oct 21 01:39:53 EDT 2008 i686 i686 Alert Count 43 First Seen Fri 24 Oct 2008 01:33:46 PM CDT Last Seen Fri 24 Oct 2008 01:33:53 PM CDT Local ID 16290580-6020-4615-908e-c7b32e828a7a Line Numbers Raw Audit Messages node=localhost.localdomain type=AVC msg=audit(1224873233.717:83): avc: denied { read write } for pid=3912 comm="ip" path="socket:[11145]" dev=sockfs ino=11145 scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=localhost.localdomain type=AVC msg=audit(1224873233.717:83): avc: denied { read write } for pid=3912 comm="ip" path="socket:[11145]" dev=sockfs ino=11145 scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=localhost.localdomain type=AVC msg=audit(1224873233.717:83): avc: denied { read write } for pid=3912 comm="ip" path="socket:[11145]" dev=sockfs ino=11145 scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=localhost.localdomain type=AVC msg=audit(1224873233.717:83): avc: denied { read write } for pid=3912 comm="ip" path="socket:[11145]" dev=sockfs ino=11145 scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=localhost.localdomain type=AVC msg=audit(1224873233.717:83): avc: denied { read write } for pid=3912 comm="ip" path="socket:[11145]" dev=sockfs ino=11145 scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=localhost.localdomain type=SYSCALL msg=audit(1224873233.717:83): arch=40000003 syscall=11 success=yes exit=0 a0=9ddcb98 a1=9dadeb0 a2=9ddcd60 a3=0 items=0 ppid=3901 pid=3912 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=1 comm="ip" exe="/sbin/ip" subj=unconfined_u:system_r:ifconfig_t:s0 key=(null) Summary: SELinux is preventing NetworkManager (NetworkManager_t) "read write" unconfined_t. Detailed Description: SELinux denied access requested by NetworkManager. It is not expected that this access is required by NetworkManager and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context unconfined_u:system_r:NetworkManager_t Target Context unconfined_u:unconfined_r:unconfined_t:SystemLow- SystemHigh Target Objects socket [ unix_stream_socket ] Source NetworkManager Source Path /usr/sbin/NetworkManager Port <Unknown> Host localhost.localdomain Source RPM Packages NetworkManager-0.7.0-0.11.svn4201.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-3.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.27.3-34.rc1.fc10.i686 #1 SMP Tue Oct 21 01:39:53 EDT 2008 i686 i686 Alert Count 1 First Seen Fri 24 Oct 2008 01:35:56 PM CDT Last Seen Fri 24 Oct 2008 01:35:56 PM CDT Local ID 6f715f57-6bca-45b3-aa02-dc34581b3423 Line Numbers Raw Audit Messages node=localhost.localdomain type=AVC msg=audit(1224873356.766:92): avc: denied { read write } for pid=4004 comm="NetworkManager" path="socket:[11145]" dev=sockfs ino=11145 scontext=unconfined_u:system_r:NetworkManager_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=localhost.localdomain type=AVC msg=audit(1224873356.766:92): avc: denied { read write } for pid=4004 comm="NetworkManager" path="socket:[11145]" dev=sockfs ino=11145 scontext=unconfined_u:system_r:NetworkManager_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=localhost.localdomain type=AVC msg=audit(1224873356.766:92): avc: denied { read write } for pid=4004 comm="NetworkManager" path="socket:[11145]" dev=sockfs ino=11145 scontext=unconfined_u:system_r:NetworkManager_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=localhost.localdomain type=AVC msg=audit(1224873356.766:92): avc: denied { read write } for pid=4004 comm="NetworkManager" path="socket:[11145]" dev=sockfs ino=11145 scontext=unconfined_u:system_r:NetworkManager_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=localhost.localdomain type=AVC msg=audit(1224873356.766:92): avc: denied { read write } for pid=4004 comm="NetworkManager" path="socket:[11145]" dev=sockfs ino=11145 scontext=unconfined_u:system_r:NetworkManager_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=localhost.localdomain type=SYSCALL msg=audit(1224873356.766:92): arch=40000003 syscall=11 success=yes exit=0 a0=8642bd8 a1=8642a20 a2=8642ee8 a3=0 items=0 ppid=4003 pid=4004 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=1 comm="NetworkManager" exe="/usr/sbin/NetworkManager" subj=unconfined_u:system_r:NetworkManager_t:s0 key=(null) Summary: SELinux is preventing knotify4 from making the program stack executable. Detailed Description: The knotify4 application attempted to make its stack executable. This is a potential security problem. This should never ever be necessary. Stack memory is not executable on most OSes these days and this will not change. Executable stack memory is one of the biggest security problems. An execstack error might in fact be most likely raised by malicious code. Applications are sometimes coded incorrectly and request this permission. The SELinux Memory Protection Tests (http://people.redhat.com/drepper/selinux-mem.html) web page explains how to remove this requirement. If knotify4 does not work and you need it to work, you can configure SELinux temporarily to allow this access until the application is fixed. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Allowing Access: Sometimes a library is accidentally marked with the execstack flag, if you find a library with this flag you can clear it with the execstack -c LIBRARY_PATH. Then retry your application. If the app continues to not work, you can turn the flag back on with execstack -s LIBRARY_PATH. Otherwise, if you trust knotify4 to run correctly, you can change the context of the executable to unconfined_execmem_exec_t. "chcon -t unconfined_execmem_exec_t '/usr/bin/knotify4'" You must also change the default file context files on the system in order to preserve them even on a full relabel. "semanage fcontext -a -t unconfined_execmem_exec_t '/usr/bin/knotify4'" Fix Command: chcon -t unconfined_execmem_exec_t '/usr/bin/knotify4' Additional Information: Source Context unconfined_u:unconfined_r:unconfined_t:SystemLow- SystemHigh Target Context unconfined_u:unconfined_r:unconfined_t:SystemLow- SystemHigh Target Objects None [ process ] Source nspluginscan Source Path /usr/bin/nspluginscan Port <Unknown> Host localhost.localdomain Source RPM Packages kdebase-runtime-4.1.2-5.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-5.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name allow_execstack Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.27.3-39.fc10.i686 #1 SMP Wed Oct 22 21:35:19 EDT 2008 i686 i686 Alert Count 38 First Seen Mon 28 Jul 2008 10:50:50 PM CDT Last Seen Fri 24 Oct 2008 03:15:46 PM CDT Local ID d1193200-ba21-44ee-bdf0-5b24a80cdb04 Line Numbers Raw Audit Messages node=localhost.localdomain type=AVC msg=audit(1224879346.180:21): avc: denied { execstack } for pid=2823 comm="knotify4" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process node=localhost.localdomain type=SYSCALL msg=audit(1224879346.180:21): arch=40000003 syscall=125 success=no exit=-13 a0=bfdef000 a1=1000 a2=1000007 a3=fffff000 items=0 ppid=1 pid=2823 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="knotify4" exe="/usr/bin/knotify4" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) Summary: SELinux is preventing dhclient (dhcpc_t) "read write" unconfined_t. Detailed Description: SELinux denied access requested by dhclient. It is not expected that this access is required by dhclient and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context unconfined_u:system_r:dhcpc_t:SystemLow-SystemHigh Target Context unconfined_u:unconfined_r:unconfined_t:SystemLow- SystemHigh Target Objects socket [ unix_stream_socket ] Source dhclient Source Path /sbin/dhclient Port <Unknown> Host localhost.localdomain Source RPM Packages dhclient-4.0.0-30.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-5.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.27.3-39.fc10.i686 #1 SMP Wed Oct 22 21:35:19 EDT 2008 i686 i686 Alert Count 2 First Seen Fri 24 Oct 2008 01:45:01 PM CDT Last Seen Fri 24 Oct 2008 03:17:34 PM CDT Local ID 4c789a6b-2778-4d68-bb82-4fa4b8547db5 Line Numbers Raw Audit Messages node=localhost.localdomain type=AVC msg=audit(1224879454.396:26): avc: denied { read write } for pid=3115 comm="dhclient" path="socket:[10645]" dev=sockfs ino=10645 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=localhost.localdomain type=AVC msg=audit(1224879454.396:26): avc: denied { read write } for pid=3115 comm="dhclient" path="socket:[10645]" dev=sockfs ino=10645 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=localhost.localdomain type=AVC msg=audit(1224879454.396:26): avc: denied { read write } for pid=3115 comm="dhclient" path="socket:[10645]" dev=sockfs ino=10645 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=localhost.localdomain type=AVC msg=audit(1224879454.396:26): avc: denied { read write } for pid=3115 comm="dhclient" path="socket:[10645]" dev=sockfs ino=10645 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=localhost.localdomain type=SYSCALL msg=audit(1224879454.396:26): arch=40000003 syscall=11 success=yes exit=0 a0=96aa660 a1=96aa6d0 a2=96a4b68 a3=0 items=0 ppid=3066 pid=3115 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=1 comm="dhclient" exe="/sbin/dhclient" subj=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 key=(null) I had a very difficult time updating this machine because i could not get a connection. [olivares@localhost ~]$ su - Password: [root@localhost ~]# ifconfig -a eth0 Link encap:Ethernet HWaddr 00:00:00:00:00:00 BROADCAST MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) Interrupt:18 Base address:0xe000 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:32 errors:0 dropped:0 overruns:0 frame:0 TX packets:32 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:1760 (1.7 KiB) TX bytes:1760 (1.7 KiB) pan0 Link encap:Ethernet HWaddr 36:F3:C2:B0:9B:46 BROADCAST MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) wlan0 Link encap:Ethernet HWaddr 00:16:E3:F3:09:DB UP BROADCAST MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) wmaster0 Link encap:UNSPEC HWaddr 00-16-E3-F3-09-DB-F4-EF-00-00-00-00-00-00-00-00 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) [root@localhost ~]# ifconfig -a | more eth0 Link encap:Ethernet HWaddr 00:00:00:00:00:00 BROADCAST MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) Interrupt:18 Base address:0xe000 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:32 errors:0 dropped:0 overruns:0 frame:0 TX packets:32 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:1760 (1.7 KiB) TX bytes:1760 (1.7 KiB) pan0 Link encap:Ethernet HWaddr 36:F3:C2:B0:9B:46 BROADCAST MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 [root@localhost ~]# dhclient eth0 Nothing to flush. PING 10.154.19.1 (10.154.19.1) from 10.154.19.179 eth0: 56(84) bytes of data. --- 10.154.19.1 ping statistics --- 4 packets transmitted, 0 received, +3 errors, 100% packet loss, time 3000ms pipe 3 [root@localhost ~]# ifconfig -a | more eth0 Link encap:Ethernet HWaddr 00:00:00:00:00:00 BROADCAST MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) Interrupt:18 Base address:0xe000 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:35 errors:0 dropped:0 overruns:0 frame:0 TX packets:35 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:2096 (2.0 KiB) TX bytes:2096 (2.0 KiB) pan0 Link encap:Ethernet HWaddr 36:F3:C2:B0:9B:46 BROADCAST MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 I had to change the mac address of the machine to another one that could get access so that I could apply the updates. First one knotify is a bug that I have reported: https://bugzilla.redhat.com/show_bug.cgi?id=467210 but was closed because it was not an selinux bug, who has the hot potato now? I keep seeing this on two of my three machines :( Has someone else seen this? Thanks, Antonio

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux October 2008