On Thu, 2003-10-16 at 14:57, Carlos Anisio Monteiro wrote:
Hi.
The system have many process running in the following context:
system_u:system_r:kernel_t (see example below).
<snip>
This is happen in the time of boot.
Is this correct? Any process, p.ex. init, syslogd, klogd, shouldn't
they running in the proper context?
P.ex.:
init - system_u:system_r:init_t
klogd - system_u:system_r:klogd_t
cron - system_u:system_r:cron_t
If yes. How I resolve ???
The possible scenarios are:
1) You never labeled /sbin/init with system_u:object_r:init_exec_t.
Based on your prior email, you have labeled /sbin/init, so this is not
the cause.
2) You labeled /sbin/init initially, but you are running prelink on your
system and do not have the patched prelink program, so prelink is
cheerfully unlinking it and re-creating it with the default type,
causing it to fall back into sbin_t. You can check for this by doing a
'ls --context /sbin/init' again. Dan Walsh has a patched prelink
program that preserves security contexts available from his site,
ftp://people.redhat.com/dwalsh/SELinux. prelink is enabled by default
in Fedora Core.
3) /sbin/init is labeled correctly, but the policy is not loaded prior
to starting it, so the domain transition rule isn't defined when the
execution occurs. This would happen if you failed to load the policy
from an initrd prior to execution of /sbin/init, or if you are trying to
perform the initial policy load via /sbin/init itself without
re-exec'ing it after performing the load.
I loaded the policy in the initrd image and the boot process and the
contexts
are fine. The policies must be loaded prior to init process.