Re: suggestion to help transition to selinux: dynamic loading of libselinux

[Russell Coker <russell@coker.com.au>]

On Tue, 18 May 2004 21:31, Stephen Smalley <sds@epoch.ncsc.mil> wrote:
> On Mon, 2004-05-17 at 15:10, Russell Coker wrote:
> > The first candidate for such changes would be init.  We would have to
> > hard-code a check for selinux=0 in the init source to avoid having init
> > just not enable SE Linux if file system corruption causes libselinux.so
> > to disappear.
> >
> > I think that init is the program that needs such changes most, the
> > current situation makes libselinux one of the most important packages in
> > the system (can't boot without it).
>
> I'm surprised that /sbin/init isn't statically linked in Fedora.
> Rationale?

When fsck, getty, login, /bin/sh, cat etc, and all the other programs that are 
necessary for booting and allowing a root login are dynamically linked it 
doesn't seem to provide much benefit to have init statically linked.

To have all those programs dynamically linked would significantly increase 
disk space for small systems, or require having two versions of each with the 
static version being optional.  So in ancient Linux history it was decided to 
use dynamically linked programs for all of those and almost everyone has 
followed.  Some people have built custom distributions at various times to 
have statically linked /sbin programs but have not apparently received a 
benefit to justify the effort.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.