[SOLVED] Should SELinux be enabled?

[tarazed]

Mageia 2 fully updated

Yesterday this message appeared in a gnome terminal:

** (gnome-system-monitor:4870): WARNING **: SELinux was found but is not enabled

This morning:
[lcl@belexeuli ~]$ gnome-system-monitor

** (gnome-system-monitor:17055): WARNING **: SELinux was found but is not enabled.

Should the following command output look different were SELinux enabled?

Code: Select all

[lcl@belexeuli menu]$ ls -Z
? commandlist  ? commandlist.bak  ? helplist


I am also puzzled by the appearance of the "live" group.

Code: Select all

[lcl@belexeuli menu]$ ls -l
total 12
-rw-r--r-- 1 lcl live 1264 May 20 10:28 commandlist
-rw-r--r-- 1 lcl live  242 May  9 23:01 commandlist.bak
-rw-r--r-- 1 lcl live  284 Jun  4 10:56 helplist


This system was built, I think (a bit confused after installing on
four different machines by various means), from the GNOME live CD.
/etc/release now says "Mageia release 2 (Official) for x86_64".

[doktor5000]

Should the following command output look different were SELinux enabled?

Code: Select all

[lcl@belexeuli menu]$ ls -Z
? commandlist  ? commandlist.bak  ? helplist


Yep, it would show the SELinux security context as documented in f.ex. http://docs.redhat.com/docs/en-US/Red_H ... texts.html

I am also puzzled by the appearance of the "live" group.

Code: Select all

[lcl@belexeuli menu]$ ls -l
total 12
-rw-r--r-- 1 lcl live 1264 May 20 10:28 commandlist
-rw-r--r-- 1 lcl live  242 May  9 23:01 commandlist.bak
-rw-r--r-- 1 lcl live  284 Jun  4 10:56 helplist


Well, depends how you setup that user. But IIRC "live" is the default user in livecds, and normally in Mageia each user has it's private group which is named after the user. So if you changed that username, but kep the group that would be normal.

[tarazed]

Thanks doktor5000. Your answer to the "live" question confirms what I thought. That SELinux stuff at RedHat is too much for me to take on board but my diagnostics indicate that we are running a kernel without SELinux enabled. It is not something I have ever had to worry about in the past so shall ignore it. The query marks in the ls -Z listings would indicate that there is no SELinux user policy.
[code[lcl@belexeuli ~]$ id -Z
id: --context (-Z) works only on an SELinux-enabled kernel
][/code]

[tarazed]

By the way, gnome-system-monitor seems to have been replaced by ksysguard in the release version. Looks better.

[doktor5000]

Well, no the former is for GNOME and the latter is for KDE, those should be the default system monitors. KDE one can be called via Ctrl+Esc by default. Not sure for the GNOME one, though.

Care to mark the thread as [SOLVED] then?

[tarazed]

Yes, solved it is. I run under GNOME and on the laptop installation could not find gnome-system-monitor (no such command) and the menu icon invoked ksystemguard. There have been a couple of other instances where I have dragged and dropped a system icon onto the panel and found it pointing to a KDE utility. I started getting messages about no system tray. I think it was the release candidate. Anyway, water under the bridge now.