前往小程序,Get更优阅读体验!
立即前往
首页
学习
活动
专区
工具
TVP
发布
社区首页 >专栏 >SELinux: Could not downgrade policy file

SELinux: Could not downgrade policy file

作者头像
Leshami
发布2018-08-13 09:33:08
1.3K0
发布2018-08-13 09:33:08
举报
文章被收录于专栏:乐沙弥的世界乐沙弥的世界

在配置nfs服务器,设定selinux时,碰到了SELinux: Could not downgrade policy file的错误提示,下文是其解决方案。

一、故障现象

代码语言:javascript
复制
[root@system1 ~]# semanage fcontext -a -t 'public_content_t' '/protected(/.*)?'
SELinux: Could not downgrade policy file /etc/selinux/targeted/policy/policy.29, searching for an older version.
SELinux: Could not open policy file <= /etc/selinux/targeted/policy/policy.29: No such file or directory
/sbin/load_policy: Can't load policy: No such file or directory
libsemanage.semanage_reload_policy: load_policy returned error code 2.
SELinux: Could not downgrade policy file /etc/selinux/targeted/policy/policy.29, searching for an older version.
SELinux: Could not open policy file <= /etc/selinux/targeted/policy/policy.29: No such file or directory
/sbin/load_policy: Can't load policy: No such file or directory
libsemanage.semanage_reload_policy: load_policy returned error code 2.
ValueError: Could not commit semanage transaction

二、解决方案

代码语言:javascript
复制
从故障的提示来看,说不能够降级策略文件,以及找不到policy.29这个文件

[root@system1 ~]# more /etc/redhat-release
Red Hat Enterprise Linux Server release 7.0 (Maipo)
[root@system1 ~]# uname -r
3.10.0-123.el7.x86_64

###下面查看selinux配置,如下,为disabled状态

[root@system1 ~]# sestatus
SELinux status: disabled

[root@system1 ~]# getenforce
Disabled

[root@system1 ~]# rpm -q libsepol libsemanage libselinux
libsepol-2.1.9-3.el7.x86_64
libsemanage-2.1.10-16.el7.x86_64
libselinux-2.2.2-6.el7.x86_64

### 临时修改selinux 配置
[root@system1 ~]# setenforce 1 ###尝试设置为1,依旧提示关闭
setenforce: SELinux is disabled

[root@system1 ~]# getenforce
Disabled

### 查看enforce配置文件
[root@system1 ~]# more /etc/sysconfig/selinux

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
#SELINUX=permissive
SELINUX=disabled
# SELINUXTYPE= can take one of these two values:
# targeted - Targeted processes are protected,
# minimum - Modification of targeted policy. Only selected processes are protected.
# mls - Multi Level Security protection.
SELINUXTYPE=targeted

### 手工修改配置文件

[root@system1 ~]# vi /etc/sysconfig/selinux

SELINUX=enforce

[root@system1 ~]# getenforce ###依旧为关闭
Disabled

###不知道什么原因导致配置修改无法生效,于是尝试重启Linux

[root@system1 ~]# reboot

### 再次修改和执行都OK
[root@system1 ~]# getenforce
Permissive
[root@system1 ~]#
[root@system1 ~]#
[root@system1 ~]# setenforce 1
[root@system1 ~]#
[root@system1 ~]# getenforce
Enforcing

### 再次执行semanage成功
[root@system1 ~]# semanage fcontext -a -t 'public_content_t' '/protected(/.*)?'
[root@system1 ~]#
本文参与 腾讯云自媒体分享计划,分享自作者个人站点/博客。
原始发表:2017年07月18日,如有侵权请联系 cloudcommunity@tencent.com 删除

本文分享自 作者个人站点/博客 前往查看

如有侵权,请联系 cloudcommunity@tencent.com 删除。

本文参与 腾讯云自媒体分享计划  ,欢迎热爱写作的你一起参与!

评论
登录后参与评论
0 条评论
热度
最新
推荐阅读
目录
  • 一、故障现象
  • 二、解决方案
领券
问题归档专栏文章快讯文章归档关键词归档开发者手册归档开发者手册 Section 归档