init problem

init problem

[Michal Svoboda]

[-- Attachment #1: Type: text/plain, Size: 1125 bytes --]

Hello,

I just tried to boot a selinux installation in the plain old way (ie.
without initramfs) and it seems there is a bug in the init mechanism.
Sysvinit has a

#ifdef WITH_SELINUX
        if (getenv("SELINUX_INIT") == NULL && !is_selinux_enabled()) {
          putenv("SELINUX_INIT=YES");
          if (selinux_init_load_policy(&enforce) == 0 ) {
            execv(myname, argv);

whereas the is_selinux_enabled man page says "returns 1 if SELinux is
running or 0 if it is not.".

The problem is that init is the first process and at that very early
point neither /selinux nor /proc is mounted. The function uses these to
determine the state of things and if it can't it returns a -1, which is
an undocumented value and thus a value not accounted for.

So I think that either is_selinux_enabled should return 0 if it can't
tell (or use some other mechanism to tell), or -1 should be documented
in the man page and the sysvinit code should be changed to read 

  if (getenv("SELINUX_INIT") == NULL && (0 == is_selinux_enabled())) {
                                         ^^^^

Michal Svoboda

[-- Attachment #2: Type: application/pgp-signature, Size: 198 bytes --]

Re: init problem

[Daniel J Walsh]

[-- Attachment #1: Type: text/plain, Size: 1673 bytes --]

On 03/07/2010 05:15 AM, Michal Svoboda wrote:
> Hello,
>
> I just tried to boot a selinux installation in the plain old way (ie.
> without initramfs) and it seems there is a bug in the init mechanism.
> Sysvinit has a
>
> #ifdef WITH_SELINUX
>          if (getenv("SELINUX_INIT") == NULL&&  !is_selinux_enabled()) {
>            putenv("SELINUX_INIT=YES");
>            if (selinux_init_load_policy(&enforce) == 0 ) {
>              execv(myname, argv);
>
> whereas the is_selinux_enabled man page says "returns 1 if SELinux is
> running or 0 if it is not.".
>
> The problem is that init is the first process and at that very early
> point neither /selinux nor /proc is mounted. The function uses these to
> determine the state of things and if it can't it returns a -1, which is
> an undocumented value and thus a value not accounted for.
>
> So I think that either is_selinux_enabled should return 0 if it can't
> tell (or use some other mechanism to tell), or -1 should be documented
> in the man page and the sysvinit code should be changed to read
>
>    if (getenv("SELINUX_INIT") == NULL&&  (0 == is_selinux_enabled())) {
>                                           ^^^^
>
> Michal Svoboda
>    
man is_selinux_enabled()
...
        is_selinux_enabled  returns  1 if SELinux is running or 0 if it 
is not.
        May change soon.
...
russell@coker.com.au            1 January 2004           
is_selinux_enabled(3)

I guess it depends on your definition of soon.

/usr/include/selinux/selinux.h  has

/* Return 1 if we are running on a SELinux kernel, or 0 if not or -1 if 
we get an error. */
extern int is_selinux_enabled(void);

Attached patch to fix man page.



[-- Attachment #2: libselinux-manpage.patch --]
[-- Type: text/plain, Size: 814 bytes --]

diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/is_selinux_enabled.3 libselinux-2.0.92/man/man3/is_selinux_enabled.3
--- nsalibselinux/man/man3/is_selinux_enabled.3	2009-03-06 14:41:45.000000000 -0500
+++ libselinux-2.0.92/man/man3/is_selinux_enabled.3	2010-03-07 07:40:57.000000000 -0500
@@ -1,4 +1,4 @@
-.TH "is_selinux_enabled" "3" "1 January 2004" "russell@coker.com.au" "SELinux API documentation"
+.TH "is_selinux_enabled" "3" "7 Mar 2010" "russell@coker.com.au" "SELinux API documentation"
 .SH "NAME"
 is_selinux_enabled \- check whether SELinux is enabled
 
@@ -14,6 +14,7 @@
 .SH "DESCRIPTION"
 .B is_selinux_enabled
 returns 1 if SELinux is running or 0 if it is not. 
+On error, \-1 is returned.
 
 .B is_selinux_mls_enabled
 returns 1 if SELinux is running in MLS mode or 0 if it is not. 

Re: init problem

[Michal Svoboda]

[-- Attachment #1: Type: text/plain, Size: 459 bytes --]

Daniel J Walsh wrote:
> /* Return 1 if we are running on a SELinux kernel, or 0 if not or -1
> if we get an error. */
> extern int is_selinux_enabled(void);
> 
> Attached patch to fix man page.

Okay. In that case, sysvinit needs the following fix (tested to solve
the issue):

   if (getenv("SELINUX_INIT") == NULL&&  (1 != is_selinux_enabled())) {
                                          ^

(I got the original fix wrong.)

Michal Svoboda

[-- Attachment #2: Type: application/pgp-signature, Size: 198 bytes --]

init problem

[somshekar chandrashekar kadam]

hi,

    i have created ramdisk image my kernel is able to detect the
ramdisk when init is run ,its saying
  attempting to kill init rebooting in 180 sec

is it problem of some missing  library
regards
somshekar

_________________________________________________________
There is always a better job for you at Monsterindia.com.
Go now http://monsterindia.com/rediffin/


** Sent via the linuxppc-embedded mail list. See http://lists.linuxppc.org/

Re: init problem

[Alex Zeffertt]

Show us the console messages.

Alex

somshekar chandrashekar kadam wrote:

>
> hi,
>
>    i have created ramdisk image my kernel is able to detect the
> ramdisk when init is run ,its saying
>  attempting to kill init rebooting in 180 sec
>
> is it problem of some missing  library
> regards
> somshekar
>
> _________________________________________________________
> There is always a better job for you at Monsterindia.com.
> Go now http://monsterindia.com/rediffin/
>
>
>


** Sent via the linuxppc-embedded mail list. See http://lists.linuxppc.org/

Re: init problem

[Tom Rini]

On Mon, Jun 24, 2002 at 03:15:14PM -0000, somshekar chandrashekar kadam wrote:

>    i have created ramdisk image my kernel is able to detect the
> ramdisk when init is run ,its saying
>  attempting to kill init rebooting in 180 sec
>
> is it problem of some missing  library

Well, it does sound like your initrd isn't correct (it is mounting the
ramdisk fine, but /sbin/init isn't running correctly).

--
Tom Rini (TR1265)
http://gate.crashing.org/~trini/

** Sent via the linuxppc-embedded mail list. See http://lists.linuxppc.org/