Built kernel-2.6.16.20 for ntfs driver; now SELinux won't let me in

[Daniel J Walsh]

Matthew Munro wrote:
> Matthew Munro wrote:
>>> try booting with enforcing=0 on the end of your
>>> kernel line.
>>
>>> incidentally, for the ntfs stuff you can just as
>>> easily use the livna
>>> repository and install kmod-ntfs
>>
>> Thanks for the livna tip.  I think my kernel build was
>> mainly inspired by ntfs, but I soon began to enjoy
>> snicking out the bulk of the FC5 `.config'.
>>
>> As for getting in to inspect the logs, I have already
>> entered KDE as non-root, then `su'd to root to dig
>> around.  I built a module to allow hotplug_t to login,
>> but then I found it banned from just about everything
>> else.
>>
>> I haven't booted that kernel in a little while, and I
>> don't have any logs handy, but I'll gladly provide
>> some example avc messages when I boot again.
>>
>
> Here's one.  So I've built and installed this new kernel, and then 
> rebooted into it, and then I get this.
>
> Jun 13 12:08:24 north kernel: audit(1150196904.915:6): avc:  denied  { 
> entrypoint } for  pid=1873 comm="login" name="bash" dev=hda7 ino=49158 
> scontext=root:sysadm_r:hotplug_t:s0-s0:c0.c255 
> tcontext=system_u:object_r:file_t:s0 tclass=file
>
> And that's probably as much help as I can be on this matter, since I 
> have now re-installed FC5 from scratch.  Thanks for your attention.
>
>      in
tcontext=system_u:object_r:file_t:s0 indicates that you have a labeling 
problem on  your system.  When a file does not have a security label 
(Extended Attribute), the kernel
substitutes file_t.  file_t is not accessable from any confined domain, 
thus the failure.  The best way to fix this is to label the entire system.

touch /.autorelabel
reboot

>     
>        
> ___________________________________________________________ All new 
> Yahoo! Mail "The new Interface is stunning in its simplicity and ease 
> of use." - PC Magazine http://uk.docs.yahoo.com/nowyoucan.html
>