can not boot with strict policy

[Ken YANG <spng.yang@gmail.com>]

hi all:

i run in FC7 Rawhide with strict policy, which is built from svn
refpolicy:

TYPE = strict-mcs
DIRECT_INITRC=y
MONOLITHIC=n
MLS_SENS=16
MLS_CATS=1024
MCS_CATS=1024

after i loaded the policy:

make && make install && make load && \
"modify /etc/selinux/config to use new policy" && \
touch /.autorelabel


and reboot, but "kernel panic" occur:

"......
avc: denied {execute} for pid=1 comm="init" name="libsepol.so.1"
scontext=system_u:system_r:init_t:s0 tcontext=user_u:object_r:lib_t:s0
tclass=file
Kernel panic - not syncing: Attempted to kill init!
......"


i think the reason of above "execute error" is due to the following
policy:

allow files_unconfined_type file_type:{ file chr_file } ~execmod;
......
ifdef(`targeted_policy',`
	unconfined_domain(init_t)
')
......
files_type(lib_t)



is that right?

i made some tests, in which i removed the "targed_policy" conditions.
the "execute error" disappear, but there are more avc denied during
init process, and after following avc denied, the system restarting:

"
avc: denied { execute } ... comm="init" name="/lib/libblkid.so.1.0"
Restarting system.
"


i don't know what's wrong with my method?

thanks in advance


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.