2

I am using Debian 6 with SELinux enabled.

After enabling "enforcing" mode in SElinux, I have tried to login into another user account by 'login' command. But, I have been restricted by selinux.

Terminal Screen:

debian:~# id -Z
root:sysadm_r:sysadm_t
debian:~# login Test_Unix_User
Password: 
Linux debian 2.6.32-5-686 #1 SMP Tue Mar 8 21:36:00 UTC 2011 i686

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Would you like to enter a security context? [N]  N
Authentication failure

So, I have tried to capture and compile audit log using audit2allow. But, while installing .pp file, I have got the following error.

.pp installing error message:

debian:~# semodule -i loginSecurityContextProblemAuditLog.pp
libsepol.check_assertion_helper: neverallow violated by allow sysadm_t scsi_generic_device_t:chr_file { write };
libsemanage.semanage_expand_sandbox: Expand module failed
semodule:  Failed!

Why am I being prevented from logging into another account, even if I am in root account?

Thanks in advance!

0

I have disabled PAM in linux and security context wont be asked at bootup.

Comment the following line in "/etc/pam.d/login" file.

session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.