This section discusses common configuration errors and how to resolve them.
multilabel flag does not stay
enabled on the root (/)
partition:The following steps may resolve this transient error:
Edit /etc/fstab and set the
root partition to ro for
read-only.
Reboot into single user mode.
Run tunefs -l
enable on /.
Reboot the system.
Run mount -urw
/ and change the
ro back to rw in
/etc/fstab and reboot the system
again.
Double-check the output from
mount to ensure that
multilabel has been properly set on
the root file system.
This could be caused by the MAC
partition policy or by a mislabeling
in one of the MAC labeling policies.
To debug, try the following:
Check the error message. If the user is in the
insecure class, the
partition policy may be the
culprit. Try setting the user's class back to the
default class and rebuild the
database with cap_mkdb. If this
does not alleviate the problem, go to step two.
Double-check that the label policies are set
correctly for the user,
Xorg, and the
/dev entries.
If neither of these resolve the problem, send the error message and a description of the environment to the FreeBSD general questions mailing list.
This error can appear when a user attempts to switch
from the root
user to another user in the system. This message
usually occurs when the user has a higher label setting
than that of the user they are attempting to become.
For instance, if joe has a default label
of biba/low and root has a label of
biba/high, root cannot view
joe's home
directory. This will happen whether or not root has used
su to become joe as the Biba
integrity model will not permit root to view objects set
at a lower integrity level.
root:When this occurs, whoami returns
0 and su returns
who are you?.
This can happen if a labeling policy has been
disabled by sysctl(8) or the policy module was
unloaded. If the policy is disabled, the login
capabilities database needs to be reconfigured. Double
check /etc/login.conf to ensure
that all label options have been
removed and rebuild the database with
cap_mkdb.
This may also happen if a policy restricts access to
master.passwd. This is usually
caused by an administrator altering the file under a
label which conflicts with the general policy being used
by the system. In these cases, the user information
would be read by the system and access would be blocked
as the file has inherited the new label. Disable the
policy using sysctl(8) and everything should return
to normal.
All FreeBSD documents are available for download at http://ftp.FreeBSD.org/pub/FreeBSD/doc/
Questions that are not answered by the
documentation may be
sent to <[email protected]>.
Send questions about this document to <[email protected]>.