When I upgraded my fedora boxes in a cluster to fedora 13, I found that I can nolonger login locally via graphical interface, and remote login dropped me to \/ since it could not change dir to user home.<\/p>\n
I then<\/p>\n
setenforce 0<\/p>\n
All back to normal.<\/p>\n
However,<\/p>\n
audit2allow -m local -l -i \/var\/log\/audit\/audit.log<\/p>\n
did not show any error, so do<\/p>\n
grep seal \/var\/log\/messages<\/p>\n
And I did not find any reasonable solution from internet.<\/p>\n
For order version of fedora, I used to use local.te to enable \/home through nfs.\u00a0 Now in version 13 it can be done by<\/p>\n
setsebool -P use_nfs_home_dirs=1<\/p>\n
But this did not change anything here.<\/p>\n
So I went to check the path of real \/home, and found that “home” has nfs_t attibute since it is a nfs mount.\u00a0 This is supposed to be resolved by the above means.\u00a0 However, “home” is not mounted under \/, but under \/data, which is attributed default_t.\u00a0 I believe that this is the cause of the failure.<\/p>\n
To solve this, I made a local.te file as<\/p>\n
module local 1.0;<\/p>\n
require {
\ntype local_login_t;
\ntype default_t;
\ntype xauth_t;
\ntype sshd_t;
\nclass dir search;
\n}<\/p>\n
#============= sshd_t ==============
\nallow sshd_t default_t:dir search;<\/p>\n
#============= xauth_t ==============
\nallow xauth_t default_t:dir search;<\/p>\n
#============= local_login_t ==============
\nallow local_login_t default_t:dir search;<\/p>\n
This allows sshd, xauth and local_login to go through default_t.<\/p>\n
By inserting this to the selinux policy, the issue is fixed.<\/p>\n","protected":false},"excerpt":{"rendered":"
When I upgraded my fedora boxes in a cluster to fedora 13, I found that I can nolonger login locally via graphical interface, and remote login dropped me to \/ since it could not change dir to user home. I then setenforce 0 All back to normal. However, audit2allow -m local -l -i \/var\/log\/audit\/audit.log did […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21,3],"tags":[],"class_list":["post-125","post","type-post","status-publish","format-standard","hentry","category-computer-tips","category-mri-technical-support","post-blog"],"_links":{"self":[{"href":"https:\/\/csic.som.emory.edu\/~lzhou\/blogs\/index.php?rest_route=\/wp\/v2\/posts\/125","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/csic.som.emory.edu\/~lzhou\/blogs\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/csic.som.emory.edu\/~lzhou\/blogs\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/csic.som.emory.edu\/~lzhou\/blogs\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/csic.som.emory.edu\/~lzhou\/blogs\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=125"}],"version-history":[{"count":0,"href":"https:\/\/csic.som.emory.edu\/~lzhou\/blogs\/index.php?rest_route=\/wp\/v2\/posts\/125\/revisions"}],"wp:attachment":[{"href":"https:\/\/csic.som.emory.edu\/~lzhou\/blogs\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=125"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/csic.som.emory.edu\/~lzhou\/blogs\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=125"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/csic.som.emory.edu\/~lzhou\/blogs\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=125"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}