Re: [refpolicy] pam_selinux(gdm-password:session): Security Context justin:staff_r:insmod_t:s0 Assigned

[Guido Trentalancia <guido@trentalancia.com>]

Hello Eric.

On Fri, 2011-09-23 at 17:17 -0400, Eric Paris wrote:
> On Fri, 2011-09-23 at 23:12 +0200, Guido Trentalancia wrote:
> 
> > You seem to suggest that load_policy -i (and not the kernel) should make
> > sure that init has transitioned to its designated context...
> 
> Can't speak for Justin's system.  

That's for sure. But it seems to me that he already stated that it just
loaded plain refpolicy from git on a plain F15 system. Since we are on
the list he might even confirm once again...

> But that's not what I said.  I said
> it's /sbin/init's problem to make sure it did the right thing and to
> handle errors correctly if it failed.  If Justin has his box enforcing
> and can boot without loading a policy that's a bug and needs to be
> filed.

He has loaded the policy.

The point is that when init does not transition to init_t nothing
happens and the system keeps running with all processes in kernel_t or
insmod_t.

It surely use to happen with upstream components and policy back at the
beginning of this year (I did test that and reported it to the refpolicy
mailing list).

Apparently it also happens with Fedora 15 according to what Justin
reported on here when he started this thread...

Earlier on Daniel Walsh said Fedora and RHEL would crash in such case
(init has not transitioned properly to init_t). I said "very good" (as
that is what I expect from a SELinux system) and asked "how did you
achieved that ?" because I believe such behavior should be definitely be
imported in upstream. But then I thought Daniel's statement doesn't
match with what Justin reported.

Regards,

Guido


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.