On 11/8/18 4:50 PM, Ed Greshko wrote: > On 11/9/18 8:48 AM, Rick Stevens wrote: >> On 11/8/18 4:27 PM, Ed Greshko wrote: >>> On 11/9/18 8:16 AM, Rick Stevens wrote: >>>> If disabling SELinux fixes the connection issue, I'd sure-as-tootin' >>>> file a bugzilla about it. >>> I need to remove this phrase from my "it goes without saying" list. :-) >>> >>> As I've said before "I" haven't had an case where "Permissive" didn't >>> reveal the issue. >>> >>> I have been bitten by cases where modules are marked "Do Not Audit" such >>> that an selinux >>> AVC blocks an operation but does so silently. >> And I've hit those too, but again, there are certain things that >> "permissive" still blocks. You get the denial but it still blocks. I'll >> be interested in seeing if a full SELinux disable permits the thing to >> work. That'd prove it one way or another. > > Yes, as I pointed out elsewhere, a bit of research (that dirty word) > reveals.... > > When we said that running in permissive mode has the system run as if SELinux > was not > enabled, we weren't really lying... well, perhaps a bit. > > There is the matter of SELinux-aware applications. These are applications > that know about > SELinux on a system, and behave differently when SELinux is enabled or not. > Most of these > applications however do not change their behavior based on the permissive or > enforcing > mode - only if SELinux is truly disabled. But that does mean that running > your system in > permissive might still have applications behave as if SELinux was in > enforcing mode, or at > least behave differently than when SELinux is disabled.
Thanks for finding that, Ed. So it may be strongswan or stroke at fault and not SELinux. But the point is, "permissive" != "enforcing without blocking". "It's only illegal if you get caught......" ---------------------------------------------------------------------- - Rick Stevens, Systems Engineer, AllDigital ri...@alldigital.com - - AIM/Skype: therps2 ICQ: 226437340 Yahoo: origrps2 - - - - To iterate is human, to recurse, divine. - ---------------------------------------------------------------------- _______________________________________________ users mailing list -- users@lists.fedoraproject.org To unsubscribe send an email to users-le...@lists.fedoraproject.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/users@lists.fedoraproject.org
