Re: SELinux log

[Ricardo Wurmus <rekado@elephly.net>]

Hi Laura,

> --8<---------------cut here---------------start------------->8---
> type=FS_RELABEL msg=audit(1559947443.686:26389): pid=2658 uid=0 auid=1000
> ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
> msg='op=mass relabel exe="/usr/sbin/setfiles"
> hostname=localhost.localdomain addr=? terminal=pts/1 res=failed'UID="root"
> AUID="laura"
> type=MAC_POLICY_LOAD msg=audit(1559947618.423:26390): auid=1000 ses=3
> lsm=selinux res=1AUID="laura"
>
> type=USER_AVC msg=audit(1559947745.466:39283): pid=1 uid=0 auid=4294967295
> ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  received
> policyload notice (seqno=3)  exe="/usr/lib/systemd/systemd" sauid=0
> hostname=? addr=? terminal=?'UID="root" AUID="unset" SAUID="root"
> type=USER_AVC msg=audit(1559947745.467:39284): pid=1 uid=0 auid=4294967295
> ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  received
> policyload notice (seqno=4)  exe="/usr/lib/systemd/systemd" sauid=0
> hostname=? addr=? terminal=?'UID="root" AUID="unset" SAUID="root"
> type=AVC msg=audit(1559947746.785:39285): avc:  denied { relabelto } for
>  pid=2688 comm="restorecon" name="guix" dev="dm-0" ino=311508
> scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
> tcontext=unconfined_u:object_r:guix_daemon.guix_daemon_conf_t:s0 tclass=dir
> permissive=0
> type=AVC msg=audit(1559947746.787:39286): avc:  denied { relabelto } for
>  pid=2688 comm="restorecon" name="acl" dev="dm-0" ino=306189
> scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
> tcontext=unconfined_u:object_r:guix_daemon.guix_daemon_conf_t:s0
> tclass=file permissive=0
> --8<---------------cut here---------------end--------------->8---

Uhm, that’s weird, but you’re not in permissive mode, are you?  What
does “getenforce” say?

To relabel your whole file system according to installed policies run
this:

    touch /.autorelabel
    reboot

as root.  Upon rebooting all your files will be relabeled.  Before doing
this better double check that the guix-daemon policy has in fact been
installed, because labeling takes a very long time.

--
Ricardo