Bug 735198
| Summary: | selinux-policy denies write for sulogin to /dev/pts/0 in single user mode | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Jeremy Miller <csf1dsh> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> |
| Severity: | medium | Docs Contact: | |
| Priority: | high | ||
| Version: | 6.1 | CC: | csf1dsh, dwalsh, gcharles, mmalik |
| Target Milestone: | rc | ||
| Target Release: | 6.1 | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-3.7.19-110.el6 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2011-12-06 10:18:11 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Thanks guys! Miroslav lets back port the changes I made to F16 this week. I am backporting these changes. Fixed in selinux-policy-3.7.19-110.el6 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2011-1511.html |
Description of problem: On a vanilla RHEL 6.1 system installed on HP Proliant hardware and using a serial console via the VSP ilo, booting to Single User Mode results in this error message on the console: type=1400 audit(1296260632.174:5): avc: denied { write } for pid=1544 comm="sulogin" path="/dev/pts/0" dev=devpts ino=3 scontext=system_u:system_r:sulogin_t:s0 tcontext=system_u:object_r:devpts_t:s0 tclass=chr_file This prevents the user from getting the normal prompt: Give root password for maintenance (or type Control-D to continue): Setting selinux mode to permissive or disabled fixes the problem. Version-Release number of selected component (if applicable): # sestatus SELinux status: enabled SELinuxfs mount: /selinux Current mode: enforcing Mode from config file: enforcing Policy version: 24 Policy from config file: targeted # cat /etc/redhat-release Red Hat Enterprise Linux Server release 6.1 (Santiago) # How reproducible: Steps to Reproduce: 1. Configure the system with serial console output via the HP ILO Virtual Serial Port. 2. Edit grub menu or select single user mode grub entry. 3. Wait until init calls sulogin to prompt for password then hand out a shell prompt. Actual results: type=1400 audit(1296260632.174:5): avc: denied { write } for pid=1544 comm="sulogin" path="/dev/pts/0" dev=devpts ino=3 scontext=system_u:system_r:sulogin_t:s0 tcontext=system_u:object_r:devpts_t:s0 tclass=chr_file and no password prompt is displayed to the user Expected results: a password prompt like so: Give root password for maintenance (or type Control-D to continue): Additional info: