LAB 4.1 - SELinux logs
Hello everyone,
I've managed to do the lab exercise, however I have a question concerning SELinux.
By default, SELinux was disabled on my VM so I've changed enforce mode to Permissive (by editing /etc/sysconfig/selinux file), rebooted and changed root password again, just to see what would happen. After reboot, the password was successfully updated but I couldn't find any SELinux reports. I've checked with getenforce and SELinux is indeed in Permissive mode.
Next, I try setting SELinux to Enforcing mode and either I don't get the login prompt for student, either it doesn't accept the password. So, I guess SELinux is working (?)
Why don't I get any warning messages when in Permissive mode ?
In /var/log/messages I get messages like:
Jun 10 09:38:26 second kernel: SELinux: Initializing. Jun 10 09:38:26 second systemd[1]: systemd 219 running in system mode. (+PAM +AUDIT +SELINUX +IMA -APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 -SECCOMP +BLKID +ELFUTILS +KMOD +IDN) Jun 10 09:38:27 second systemd[1]: Successfully loaded SELinux policy in 137.817ms. Jun 10 09:38:27 second systemd: systemd 219 running in system mode. (+PAM +AUDIT +SELINUX +IMA -APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 -SECCOMP +BLKID +ELFUTILS +KMOD +IDN)
/var/log/audit is empty and /var/log/avc* doesn't exist...
Comments
-
Hi k0dard,
Can you please confirm the course number and version on the cover of the manual? Thanks.The "audit" package should be installed, check with "systemctl status auditd" It will create entries in the file /var/log/audit/audit.log. Messages from SELinux generally show up as "AVC". If auditd is running and "setroubleshoot-server" installed, then the system errolog (/var/log/messages on CentOS) will have more verbose entries for the SELinux messages.
I'm not sure why you are changing the root password. Let me know.
Regards Lee
0 -
Hello Lee,
And thanks for your answer!
I'm changing the root password because it's a lab exercise in LFS 216...
Regards k0dard0
Categories
- All Categories
- 177 LFX Mentorship
- 177 LFX Mentorship: Linux Kernel
- 768 Linux Foundation IT Professional Programs
- 379 Cloud Engineer IT Professional Program
- 175 Advanced Cloud Engineer IT Professional Program
- 75 DevOps IT Professional Program - Discontinued
- 7 DevOps & GitOps IT Professional Program
- 101 Cloud Native Developer IT Professional Program
- 7.6K Training Courses & Learning Paths
- 4 AI & ML Training
- 1 Blockchain & Decentralized Identity Training
- 11 Cloud & Containers Training
- 1 Cybersecurity Training
- 2 DevOps & Site-Reliability Training
- 1 Linux Kernel Development Training
- 1 Networking Training
- 2 Open Source Best Practice Training
- 3 System Administration Training
- 1 System Engineering Training
- 1 Web & Application Development Training
- 796 Hardware
- 202 Drivers
- 68 I/O Devices
- 37 Monitors
- 95 Multimedia
- 173 Networking
- 91 Printers & Scanners
- 91 Storage
- 771 Linux Distributions
- 81 Debian
- 68 Fedora
- 23 Linux Mint
- 13 Mageia
- 24 openSUSE
- 151 Red Hat Enterprise
- 31 Slackware
- 13 SUSE Enterprise
- 356 Ubuntu
- 465 Linux System Administration
- 31 Cloud Computing
- 73 Command Line/Scripting
- Github systems admin projects
- 98 Linux Security
- 78 Network Management
- 101 System Management
- 46 Web Management
- 120 Mobile Computing
- 20 Android
- 85 Development
- 1.2K New to Linux
- 1K Getting Started with Linux
- 395 Off Topic
- 121 Introductions
- 30 Study Material
- 1K Programming and Development
- 310 Kernel Development
- 692 Software Development
- 1K Software
- 400 Applications
- 182 Command Line
- 5 Compiling/Installing
- 69 Games
- 318 Installation
- Archived
- 183 Small Talk
- 2 LFD140 Class Forum
- 1.4K LFS258 Class Forum
Upcoming Training
-
August 20, 2018
Kubernetes Administration (LFS458)
-
August 20, 2018
Linux System Administration (LFS301)
-
August 27, 2018
Open Source Virtualization (LFS462)
-
August 27, 2018
Linux Kernel Debugging and Security (LFD440)
