CentOS

Hi,

I'm running in ec2, attempting to build a CentOS 5.8 AMI from scratch, and use the local kernel and ramdisk.

I'm noticing some behavior which I don't really know how problematic it is. I'm hoping someone here can help me figure out what to look at to "fix" this. The problem is trying to read any file under /proc/pid/attr. for example:

host03# cat /proc/1414/attr/current
cat: /proc/1414/attr/current: Invalid argument
host03# getenforce
Disabled
host03# uname -a
Linux host03 2.6.18-308.11.1.el5xen #1 SMP Tue Jul 10 09:29:47 EDT 2012 x86_64 x86_64 x86_64 GNU/Linux

This host03 is running a new AMI I built using CentOS 5.8. My intention here is to disable selinux on this AMI. The way I disabled it is to set "SELINUX=disabled" in /etc/selinux/config.


The reason we spotted this problem is we tried running auditd for something, noticed some problems with it. Strace of the process showed it getting the "Invalid argument" when trying to read /proc/pid/attr/current.

The kernel host03 is running exists on the local filesystem, and the AMI is registered with a pv-grub kernel.
fwiw, /boot/grub/menu.lst:

default=0
timeout=2
title CentOS-5.8-xen
root (hd0)
kernel /boot/vmlinuz-2.6.18-308.11.1.el5xen ro root=/dev/sda1 console=hvc0
initrd /boot/initrd-2.6.18-308.11.1.el5xenramdisk.img

Also fwiw, the ramdisk in the grub config was built using:

mkinitrd -f -v --allow-missing --builtin uhci-hcd --builtin ohci-hcd \
--builtin ehci-hcd --preload xennet --preload xenblk --preload dm-mod \
--preload linear --force-lvm-probe \
/boot/initrd-2.6.18-308.11.1.el5xenramdisk.img 2.6.18-308.11.1.el5xen


As a comparison, a host I have running on an AMI from RightScale and running an Amazon kernel does not display this behavior.

host99# cat /proc/10890/attr/current
kernel
host99# getenforce
Disabled
host99# uname -a
Linux host99 2.6.21.7-2.fc8xen #1 SMP Fri Feb 15 12:34:28 EST 2008 x86_64 x86_64 x86_64 GNU/Linux

host99's AMI is registered with Amazon kernel and ramdisk:
aki-b51cf9dc ec2-public-images/ec2-vmlinuz-2.6.21.7-2.fc8xen.x86_64.manifest.xml
ari-b31cf9da ec2-public-images/ec2-initrd-2.6.21.7-2.fc8xen.x86_64.manifest.xml


Any clues out there? Thanks in advance,
kallen

I tested `cat /proc/self/attr/current` on systems running with selinux enforcing, permissive and disabled and on the disabled system I get the same error as you. That was on a mixture of physical machines and xen guests, made no difference to the results, it's selinux=disabled that causes it.

It really shouldn't be necessary to disable it anyway, why not try to fix any problems you have rather than just taking the lazy way out.

I'll not comment on your judgment of "lazy" ...

In contrast to your example where you say selinux=disabled causes the "Invalid argument" error, in my example, I show a system (host99) which is selinux=disabled but I do not get that error. ::shrug::

thanks