yum update / SELinux problem?

Daniel J Walsh dwalsh at redhat.com
Fri Mar 2 15:08:37 UTC 2007


Stephen Smalley wrote:
> On Fri, 2007-03-02 at 07:05 -0500, Stephen Smalley wrote:
>   
>> On Fri, 2007-03-02 at 00:06 +0000, Jonathan Rawle wrote:
>>     
>>> I have a problem installing updates via yum. I usually type
>>> sudo yum update
>>> and have sudoers set up to allow this. However, I've recently started to see
>>> messages of the form:
>>> error: %pre(packagename) scriptlet failed, exit status 255
>>> It seems to install the new package, but does not remove the old one, which
>>> has taken some sorting out!
>>>
>>> It also doesn't work if I su to root and type yum update. But it DOES work
>>> if I disable SELinux with setenforce 0
>>>
>>> I'm seeing the following AVC messages in dmesg:
>>>
>>> audit(1172787681.632:38): avc:  denied  { transition } for  pid=7147
>>> comm="yum" name="bash" dev=sda1 ino=2154415
>>> scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023
>>> tcontext=system_u:system_r:rpm_script_t:s0-s0:c0.c1023 tclass=process
>>>
>>> Seeing as we don't have everyone complaining that yum is broken, I assume my
>>> filesystem is wrongly labelled or something. I did fixfiles check and
>>> couldn't see anything that looked significant...
>>>
>>> Why is it xdm_t? Is it something to do with me using kdm as my login manager
>>> (most people use gdm)?
>>>
>>> So I wondered if anyone has any ideas of how to fix this? I don't want to
>>> have to switch off enforcing every time I do an update!
>>>       
>> It shouldn't be running in xdm_t.  Update pam and logout and then back
>> in again.  Then check id -Z and make sure it isn't xdm_t.
>>     
>
> Note btw that the problem is limited to programs that use pam_selinux,
> which kdm does (but gdm does not - gdm required direct integration of
> selinux support to set the context in the right process).
>
>   
I believe this is a problem with mcstrans translating root logins 
incorrectly.  Should be fixed by mcstrans-0.2.5, in todays rawhide.




More information about the fedora-list mailing list