# selinux won't boot in enforcing mode

## dengel

I've followed the directions for installing selinux (install base gentoo system, then convert, following directions). Things seem fine, except that when I try to boot with "enforcing=1" I get a whole lot of "denied" audits of the following form:

 *Quote:*   

> audit(1219210362.052:58): avc: denied { search } for pid=947 comm="agetty" name="dev" dev=hda2 ino=475137 scontext=system_u:system_r:getty_t tcontext=system_u:object_r:file_t tclass=dir

 

Of course, the timestamp changes and the pid changes for each one, but a whole bunch of them fly by, after which the system just halts forever. Usually, the last line is different. It says:

 *Quote:*   

> Clocksource tsc unstable (delta=1027943091 ns)

 

I don't think the delta # is the same each time, but I don't think that line actually has anything to do with the system halting, since that line sometimes is further up than the end.

My system is an ASUS M2N SLI motherboard with an AMD Athlon 64 dual core CPU.

CFLAGS (and CXXFLAGS) are "-march=athlon64 -O2 -pipe"

USE is "-X mmx sse sse2"

The kernel config settings are set according to the SELinux conversion documentation.

What's really weird is that the audit denials that I'm getting when I boot "enforcing=1" don't even show up when I boot permissive. I thought that the only difference between permissive and enforcing was that the denials aren't enforced, but that they're still reported.

Here is the dmesg from a successful boot. I don't know how to capture one from an unsuccessful boot. Is it possible that one of the denials in here, when enforced, is causing the set of agetty denials that I see when I boot enforcing? It seems as thought many of these could result from the initial mounting of the filesystem as read-only. Does that make sense?

 *Quote:*   

> Linux version 2.6.24-hardened-r3 (root@peter) (gcc version 4.1.2 (Gentoo 4.1.2 p1.0.2)) #2 SMP Tue Aug 19 15:17:24 EDT 2008
> 
> Command line: root=/dev/hda2 vga=791 noapic
> 
> BIOS-provided physical RAM map:
> ...

 

Any help would be appreciated.

Thanks in advance.

-Dan

----------

