论坛徽章:: 0

电梯直达

1楼 [收藏(0)] [报告]

发表于 2009-01-07 11:33 |只看该作者 |倒序浏览

最近在做实验中遇到图形启动问题，希望大家可以能帮忙看一下。
环境：系统是2.6.18-53和2.6.18-92双内核，selinux是强制模式，在2.6.18-92内核作为默认启动内核时                                                                                                    ，重启后不能自动进入到X图形界面，报selinux错误。（setroubleshoot的错误日志在附件里面）。在启动时登录到虚拟控制台，然后用startx命令启动图形，selinux依旧报同样错误，但是可以进入图形界面。
按照setroubleshoot里面告诉的解决方案，更改bool值后，错误依旧。
关闭selinux后，在2.6.18-92内核可以正常启动到图形界面。
在2.6.28-53内核环境中，图形界面可以正常启动。
下面是setroubleshootd这个图形工具对上述错误进行的报告
Summary
SELinux is preventing /usr/bin/Xorg (xdm_t) "mmap_zero" access to <Unknown>
(xdm_t).

Detailed Description
SELinux denied access requested by /usr/bin/Xorg. It is not expected that
this access is required by /usr/bin/Xorg and this access may signal an
intrusion attempt. It is also possible that the specific version or
configuration of the application is causing it to require additional access.
Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this
package.

Allowing Access
Sometimes labeling problems can cause SELinux denials.  You could try to
restore the default system file context for <Unknown>, restorecon -v
<Unknown>. There is currently no automatic way to allow this access.
Instead, you can generate a local policy module to allow this access - see
http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 - or you can
disable SELinux protection entirely for the application. Disabling SELinux
protection is not recommended. Please file a
http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.
Changing the "xdm_disable_trans" boolean to true will disable SELinux
protection this application: "setsebool -P xdm_disable_trans=1."

The following command will allow this access:
setsebool -P xdm_disable_trans=1

Additional Information

Source Context             system_u:system_r

dm_t:SystemLow-SystemHigh
Target Context system_u:system_r

dm_t:SystemLow-SystemHigh
Target Objects             None [ memprotect ]
Affected RPM Packages       xorg-x11-server-Xorg-1.1.1-48.26.el5 [application]
Policy RPM                   selinux-policy-2.4.6-104.el5
Selinux Enabled             True
Policy Type                targeted
MLS Enabled                True
Enforcing Mode             Enforcing
Plugin Name                plugins.disable_trans
Host Name                   station4.example.com
Platform                   Linux station4.example.com 2.6.18-92.1.6.el5 #1
                           SMP Fri Jun 20 02:36:16 EDT 2008 i686 i686
Alert Count                15
Line Numbers

Raw Audit Messages

avc: denied { mmap_zero } for comm="Xorg" egid=0 euid=0 exe="/usr/bin/Xorg"
exit=-13 fsgid=0 fsuid=0 gid=0 items=0 pid=3149
scontext=system_u:system_r

dm_t:s0-s0:c0.c1023 sgid=0
subj=system_u:system_r

dm_t:s0-s0:c0.c1023 suid=0 tclass=memprotect
tcontext=system_u:system_r

dm_t:s0-s0:c0.c1023 tty=tty7 uid=0