cannot change password after enabling selinux

[aioshin]

after I enabled SELINUX in a Centos box, It does not allow me anymore to change my password, wether as root or as regular user, or It wont allow me to change the root passwd, though I still able to login as root. the following errors occurs:

 

when as root:

 

[root@centos01 user]# passwd

Changing password for user root.

New UNIX password:

Retype new UNIX password:

passwd: Authentication failure

 

when as reg user:

[user@centos01 ~]$ passwd

Changing password for user user.

Changing password for user

(current) UNIX password:

New UNIX password:

Retype new UNIX password:

passwd: Authentication token manipulation error

 

have'nt really familiarized yet this SELinux, so Im not really sure how to fix it, I'd enable it the other day, but only today I realized that there's a problem.

any idea?

 

[moved from Everything Linux by spinynorman]

Edited May 18, 2005 by aioshin

[Guest anon]

I know very little about SElinux, but as i recall from dabbling with it, it doesn't like you logging in as root.

You should use sudo instead to carry out root chores. If you want to disable Selinux until you find out more, i believe the command is:

echo 1>/selinux/disable

......or something like that.

[Guest Adriano1]

No, this problem is caused by an incompatibility between selinux and reiserfs (and perhaps other journaled filesystems). You can't use selinux on a reiser filesystem. I had the same problem installing Fedora Core 3.

[jlc]

You actually shouldn't have the ability to install CentOS on reiserfs. My guess is you are using ext3 right?

 

After you enabled SELinux, did you relabled the file system before reboot? If you haven't, this is what I would do,

 

Boot your box, edit the kernel runline with "selinux=0" appended to the end of it,

 

touch /.autorelabel; reboot

 

For more on SELinux

 

 

http://fedora.redhat.com/docs/selinux-faq-....html#id2825207

 

http://www.redhat.com/docs/manuals/enterpr.../selinux-guide/

[jlc]

As far as ricerfs, I should have stated it.

 

"RHEL does not support or give you the ability to do anything other than ext2/3, there for, CentOS does not support or give you the ability to do anything other than ext2/3" :D

 

So if your using ricerfs, good look on how you installed that and got it to boot :P

[Guest Adriano1]

Easy. It was fedora, not RHEL. You can install other filesystems, you just have to boot the install with "linux reiserfs" or "linux xfs" for example.

[aioshin]

You actually shouldn't have the ability to install CentOS on reiserfs.  My guess is you are using ext3 right?

 

After you enabled SELinux, did you relabled the file system before reboot?  If you haven't, this is what I would do,

 

Boot your box, edit the kernel runline with "selinux=0" appended to the end of it,

 

touch /.autorelabel; reboot

 

For more on SELinux

 

 

http://fedora.redhat.com/docs/selinux-faq-....html#id2825207

 

http://www.redhat.com/docs/manuals/enterpr.../selinux-guide/

<{POST_SNAPBACK}>

 

thanks cybrjacle, it works, yeah ur right, i am using ext3... and after doing the autorelabel, as what what you've said, I am now able to change the passwd of users and root... actually, I did it like this: disable selinux first via system-config-security then reboot, then enabled it again, then touch /.autorelabel then reboot. now its ok...

 

for the replies

[jlc]

Easy. It was fedora, not RHEL. You can install other filesystems, you just have to boot the install with "linux reiserfs" or "linux xfs" for example.

<{POST_SNAPBACK}>

 

Well, he clairly stated he was using CentOS, so I was stating an FYI, ext3 is it buddy :D

 

No ricer on CentOS

[Guest Adriano1]

I thought you were asking me. I didn't know about CentOS using only ext3.

 

As an aside, shouldn't a secure system not use a journaled fs _at_all_? I read somewhere about some kinds of security risks inherent to journaled filesystems, because information about files is kept not only in the files themselves but also on the journal file.

[jlc]

dunno, I would have to read what you read for better understanding of what you are talking about.

 

There really isn't much of an option though, ext2 really isn't geared to be used for large drives and enterprise situation.