SELinux with initramfs

[Sven Vermeulen <sven.vermeulen@siphos.be>]

Hi guys,

I'm trying to get a system to boot up with initramfs (without the initramfs
all things work just fine, but we need to get initramfs supported) with
SELinux running in enforcing mode, and without relying on unconfined
domains.

However, it looks to be quite challenging. 

An initramfs' /init will run in the kernel_t domain (and unconfined until
load_policy is called ?) but does quite a lot of activities before it can
even call load_policy (get /dev in shape, including starting udev, mounting
root file system, etc.) because load_policy needs access to the policy.26
file on the root file system.

But because all of this, udev doesn't run in the proper domain (also in
kernel_t), device entries are wrongly labeled (and relabeling fails because
kernel_t does not have relabel privileges) and the system just doesn't want
to boot.

Is it correct to say that load_policy should occur as soon as possible (even
before udev starts)? If so, does that mean than a SELinux-supporting
initramfs should actually include the policy.26 file in the initramfs?

Wkr,
	Sven Vermeulen

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.