Re: enforcement and initrds

[Colin Walters <walters@verbum.org>]

On Mon, 2003-07-14 at 08:33, Stephen Smalley wrote:

> If CONFIG_SECURITY_SELINUX_DEVELOP=n, then the kernel is always in
> enforcing mode, so you won't be able to defer setting enforcing mode to
> the initrd. 

That's a good point, but then again we could just make DEVELOP=n instead
mean that once enforcing mode was switched on, it couldn't be switched
off.

>  You can assign a single type to all of the ramfs entries
> via genfs_contexts (but nothing more granular without further support
> either in the ramfs code or in the SELinux module) and then grant
> permissions to it. 

I tried this, but there appears to be a bootstrapping problem; the
policy says that romfs uses genfs; but the policy has to be loaded from
the initrd, which isn't labeled until we know what the policy is.

>  Or you can grant permissions to unlabeled_t to
> permit booting.

How?  Again that's part of the policy, so we face the same bootstrapping
problem.  

One other alternative would be to make kernel_t (SECINITSID_KERNEL) a
special SID that can do anything.  Anything with that type is a kernel
thread anyways, right?  So it could really do anything.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.