Re: learning about policies/transitions

[Serge Hallyn <serge.hallyn@gmail.com>]

Thanks for your help, Stephen.  I've *briefly* looked around at the
inird and /bin/init sources, and can't find an initiial policy that
would be loaded before the root filesystem pivot_root.  I expect to
have more time at the end of this week to figure it out, though.

thanks,
-serge

On Fri, 05 Nov 2004 07:26:15 -0500, Stephen Smalley <sds@epoch.ncsc.mil> wrote:
> On Thu, 2004-11-04 at 21:23, Serge Hallyn wrote:
> > Addendum:  running setfilecon works once.  After each reboot, I must again run
> > setfilecon.before /bin/login will cause the transition to login_d.
> > Again, running
> > /bin/ls -Z /bin/login shows no difference before and after the
> > setifilecon - it is always
> > of type login_et.
> 
> Two scenarios:
> 1) At boot time (e.g. usual policy load by /sbin/init), you are loading
> a policy that does not define login_et, /bin/login inode is brought
> incore and mapped to the unlabeled SID, and you then load a policy that
> does define login_et, but this doesn't automatically fix the incore
> inode SID.
> 2) At boot time, you are loading a policy that does define login_et,
> /bin/login inode is brought incore and mapped to the correct SID, you
> then load a policy that does not define login_et (e.g. Fedora policy),
> invalidating that SID, and you later reload a policy that does define
> login_et, but this doesn't automatically fix the incore inode SID.
> 
> While it would be possible to walk the inode lists upon a policy reload
> and retry mapping of the on-disk xattr for any inode with the unlabeled
> SID, I'm not sure it is worthwhile to do so.
> 
> --
> 
> 
> Stephen Smalley <sds@epoch.ncsc.mil>
> National Security Agency
> 
>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.