[patch] Re: enforcement and initrds

[Colin Walters <walters@verbum.org>]

[-- Attachment #1: Type: text/plain, Size: 1130 bytes --]

On Tue, 2003-07-15 at 13:15, Stephen Smalley wrote:
> On Mon, 2003-07-14 at 16:31, Colin Walters wrote:
> > That's a good point, but then again we could just make DEVELOP=n instead
> > mean that once enforcing mode was switched on, it couldn't be switched
> > off.
> 
> I'd prefer to be able to compile out the permissive mode support
> entirely for production kernels.

I can understand that.

> romfs or ramfs?  

romfs, sorry about my initial misstatement.

> It isn't an issue whether it is labeled before the
> policy is loaded; all permission checks are allowed until the policy is
> loaded and the security server is initialized.  

Ahh, I see.  Ok.  

I've created an initrd.te which appears to work for me.  I put it in
types/initrd.te.

> At some point, we'd like
> to generate an initial bootstrapping policy that is built into the
> security server, but there isn't any point in doing that until things
> stabilize a bit more, and that initial policy could be dependent on your
> particular kernel configuration and your initrd setup.

Yeah...I think this initrd.te is a first step towards that bootstrapping
policy.


[-- Attachment #2: initrd.te --]
[-- Type: text/plain, Size: 659 bytes --]

#
# Description: allow ramfs/cramfs initrd bootstrapping from unlabeled_t
# Authors: Colin Walters <walters@verbum.org>

# Operate on unlabeled files.
allow kernel_t unlabeled_t:file_class_set create_file_perms;
allow kernel_t unlabeled_t:dir create_dir_perms;
# Allow running scripts and such on the initrd.
can_exec(kernel_t, unlabeled_t);

# Mount permissions, stolen from mount.te
allow kernel_t unlabeled_t:filesystem mount_fs_perms;
allow kernel_t unlabeled_t:dir mounton;
allow kernel_t proc_t:dir mounton;

# Operate on tmpfs.
allow kernel_t tmpfs_t:file_class_set create_file_perms;
allow kernel_t tmpfs_t:dir create_dir_perms;