<div dir="ltr"><br><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Mar 8, 2013 at 1:21 PM, Paul Wouters <span dir="ltr"><<a href="mailto:pwouters@redhat.com" target="_blank">pwouters@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">On Fri, 8 Mar 2013, T.J. Yang wrote:<br>
<br>
</div><div class="im"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
That does not mean it is disabled. Run "getenforce" instead.<br>
<br>
Sorry, I wasn't able to hide my ignorance about SELinux.<br>
<br>
[root@mlab-centos6-01 ~]# getenforce<br>
Permissive<br>
[root@mlab-centos6-01 ~]# setenforce Permissive<br>
[root@mlab-centos6-01 ~]#<br>
<br>
Once I set it to Permissive mode by setenforce, I am able to see the connection log in /var/log/ipsec.log when restarting ipsec.<br>
</blockquote>
<br></div>
Good. So that is a fix that went into the selinux-policy package, and<br>
should make it to your next fedora/rhel package update for<br>
selinux-policy.<span class="HOEnZb"><font color="#888888"><br>
<br></font></span></blockquote><div><br></div><div style>For 3.1 release, do you have time to incorporate selinux checking into "ipsec verify" command ?</div><div> </div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<span class="HOEnZb"><font color="#888888">
Paul<br>
</font></span></blockquote></div><br><br clear="all"><div><br></div>-- <br>T.J. Yang
</div></div>