Re: init patch for loading policy

[Daniel J Walsh <dwalsh@redhat.com>]

[-- Attachment #1.1: Type: text/plain, Size: 408 bytes --]

Stephen Smalley wrote:

>On Tue, 2003-10-21 at 10:43, Russell Coker wrote: 
>  
>
>>The results I have so far indicate that this approach has significant 
>>problems.
>>
>>Diverting /sbin/init with a shell script works better than this.
>>    
>>
>
>Ok, thanks for looking into it.  So what exactly is the problem with
>diverting /sbin/init again?  
>  
>

Here is my patch to init to load initial policy.



[-- Attachment #1.2: Type: text/html, Size: 859 bytes --]

[-- Attachment #2: sysvinit-selinux.patch --]
[-- Type: text/plain, Size: 3586 bytes --]

--- sysvinit-2.85/src/init.c.selinux	2003-10-21 11:01:52.000000000 -0400
+++ sysvinit-2.85/src/init.c	2003-10-21 11:18:20.000000000 -0400
@@ -78,6 +78,87 @@
 			sigemptyset(&sa.sa_mask); \
 			sigaction(sig, &sa, NULL); \
 		} while(0)
+#ifdef WITH_SELINUX
+#include <sys/mman.h>
+#include <selinux/selinux.h>
+#include <sys/mount.h>
+
+#define POLICY_FILE "/etc/security/selinux/policy"
+#define DEFAULT_POLICY_VERSION 15
+#define SELINUXMNT "/selinux"
+#define POLICY_VERSION_FILE "/selinux/policyvers"
+#define SELINUX_ENFORCE_FILE "/selinux/enforce"
+static int load_policy(int *enforce) 
+{
+  int fd,ret=-1;
+  struct stat sb;
+  void *map;
+  char policy_file[PATH_MAX];
+  int policy_version=DEFAULT_POLICY_VERSION;
+  FILE *fp;
+
+  log(L_VB, "Loading security policy\n");
+  if (mount("none", SELINUXMNT, "selinuxfs", 0, 0) < 0) {
+    if (errno == ENODEV) {
+      log(L_VB, "SELinux not supported by kernel: %s\n",SELINUXMNT,strerror(errno));
+    } 
+    else {
+      log(L_VB, "Failed to mount %s: %s\n",SELINUXMNT,strerror(errno));
+      exit(1);
+    }
+    return ret; /* Never gets here */
+  }
+
+  /* Check policy version file.  For now this will default to 15.  When all 
+     kernel supports POLICY_VERSION_FILE, this should become an error */
+  fp = fopen(POLICY_VERSION_FILE, "r");
+  if(fp)
+    {
+      fscanf(fp,"%d",&policy_version);
+      fclose(fp); 
+    }
+  
+  fp = fopen(SELINUX_ENFORCE_FILE, "r");
+  if(fp)
+    {
+      fscanf(fp,"%d",enforce);
+      fclose(fp); 
+    }
+  else {
+    log(L_VB,  "Can't open '%s':  %s\n",
+	    SELINUX_ENFORCE_FILE, strerror(errno));
+    goto UMOUNT;
+  }
+  snprintf(policy_file,sizeof(policy_file),"%s.%d",POLICY_FILE,policy_version);
+  fd = open(policy_file, O_RDONLY);
+  if (fd < 0) {
+    log(L_VB,  "Can't open '%s':  %s\n",
+	    policy_file, strerror(errno));
+    goto UMOUNT;
+  }
+  
+  if (fstat(fd, &sb) < 0) {
+    log(L_VB, "Can't stat '%s':  %s\n",
+	    policy_file, strerror(errno));
+    goto UMOUNT;
+  }
+  
+  map = mmap(NULL, sb.st_size, PROT_READ, MAP_SHARED, fd, 0);
+  if (map == MAP_FAILED) {
+    log(L_VB,  "Can't map '%s':  %s\n",
+	    policy_file, strerror(errno));
+    goto UMOUNT;
+  }
+  ret=security_load_policy(map, sb.st_size);
+  if (ret < 0) {
+    log(L_VB, "security_load_policy failed\n");
+  }
+
+ UMOUNT:
+  umount(SELINUXMNT); 
+  return(ret);
+}
+#endif
 
 /* Version information */
 char *Version = "@(#) init " VERSION "  " DATE "  miquels@cistron.nl";
@@ -2576,6 +2657,20 @@
 		maxproclen += strlen(argv[f]) + 1;
 	}
 
+#ifdef WITH_SELINUX
+  	if (getenv("SELINUX_INIT") == NULL) {
+	  putenv("SELINUX_INIT=YES");
+	  int enforce=0;
+	  if (load_policy(&enforce) == 0 ) {
+	    execv(myname, argv);
+	  } else {
+	    if (enforce) 
+	      /* SELinux in enforcing mode but load_policy failed */
+	      exit(1);
+	  }
+	}
+#endif
+  
 	/* Start booting. */
 	argv0 = argv[0];
 	argv[1] = NULL;
--- sysvinit-2.85/src/Makefile.selinux	2003-10-21 11:01:52.000000000 -0400
+++ sysvinit-2.85/src/Makefile	2003-10-21 11:01:52.000000000 -0400
@@ -32,7 +32,7 @@
 all:		$(PROGS)
 
 init:		init.o init_utmp.o
-		$(CC) $(LDFLAGS) $(STATIC) -o $@ init.o init_utmp.o
+		$(CC) $(LDFLAGS) $(STATIC) -o $@ init.o init_utmp.o -lselinux
 
 halt:		halt.o ifdown.o hddown.o utmp.o reboot.h
 		$(CC) $(LDFLAGS) -o $@ halt.o ifdown.o hddown.o utmp.o
@@ -62,7 +62,7 @@
 		$(CC) $(LDFLAGS) -o $@ bootlogd.o
 
 init.o:		init.c init.h set.h reboot.h
-		$(CC) -c $(CFLAGS) init.c
+		$(CC) -c $(CFLAGS) -DWITH_SELINUX init.c
 
 utmp.o:		utmp.c init.h
 		$(CC) -c $(CFLAGS) utmp.c