December 2007

SELinux

One of my colleagues gave me a VMWare image to use to test authenticating Linux (CentOS in this case) with Active Directory. Unfortunately the image in question is about 10GB and after the existing images on the machine there was not enough for it in /var (a 17GB partition on a 20GB disk). As I could not find any more space on the existing drive I clearly needed to add another disk to the machine. Three dead disks later I finally found a (250GB! – effectively winning the hard-drive lottery) hard disk which no-one was using. Now just to move /var to the new disk.

I partitioned and formatted an 80GB partition, mounted it and copied the existing contents of /var accross. One edit to fstab later, I rebooted. The disk mounted fine, but various services refused to initialise with “permission denied” errors on /var. I checked the permissions against the old /var and they appeared to be identical. Some head scratching later I decided to go an ask the advice of one of my colleagues. He was equally bemused, but suggested that I tar up the old /var and untar it over the new partition incase the copy had not preserved the permissions (even though it had been told to, and they appeared to be correct). I did this however it had no effect. When I returned to my colleagues office, another one of my colleagues was talking to the first and the first suggested that he take a look. He had a quick glance at the problem and asked if SELinux was enabled. It was. One quick `restorecon -R /var` later everything worked. We then proceded to have a rant from colleague #2 about how Fedora and RHEL now had SELinux in enforcing mode by default where as it used to just warn by default, which was better in a production environment where it needs to be run in warning only mode for a while to check nothing is hitting it that should be allowed. Still it is all good fun.

CentOS
Linux
Rants
Work

Comments (0)

Permalink

About time for another post.

Having written nothing on my blog since the 1st of September I feel it’s about time to flex my inability to spell (made worse by the fact that my sister has stolen“borrowed” the dictionary I keep by my computer) again and write something.

Since my last post:

  • I have quit my job.
  • I have started a new job (“IT Services Specialist”) at Loughborough University, part time.
  • I have returned to my job at Startin Tractors for the other half of the week.
  • my sister has been moved to a more secure secure ward – she’s now locked up with the likes of mentally ill prisoners.

Still it’s all good.

I only wish I had something interesting to put here, but I can not think of anything so instead I’m just going to provide a link to http://bash.org, to annoy anyone trying to work at this point.

Blog
Life
Work

Comments (1)

Permalink