* [PATCH]selinux: load_policy script fix
@ 2013-05-30 6:19 dyoung-H+wXaHxf7aLQT0dZR+AlfA
[not found] ` <51a6ef54.GAPY7ltVyx5aFKm7%dyoung-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
0 siblings, 1 reply; 2+ messages in thread
From: dyoung-H+wXaHxf7aLQT0dZR+AlfA @ 2013-05-30 6:19 UTC (permalink / raw)
To: bhe-H+wXaHxf7aLQT0dZR+AlfA, vgoyal-H+wXaHxf7aLQT0dZR+AlfA,
initramfs-u79uwXL29TY76Z2rM5mHXA, harald-H+wXaHxf7aLQT0dZR+AlfA
chroot load_policy will use selinuxfs which should be mounted
in $NEWROOT/sys/fs/selinux for Fedora 19, but because there's
no $NEWROOT/sys/fs, so later process will fail.
Fixing this by bind mount /sys to $NEWROOT/sys.
Signed-off-by: Dave Young <dyoung-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
---
modules.d/98selinux/selinux-loadpolicy.sh | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- dracut.orig/modules.d/98selinux/selinux-loadpolicy.sh
+++ dracut/modules.d/98selinux/selinux-loadpolicy.sh
@@ -24,7 +24,8 @@ rd_load_policy()
local ret=0
local out
info "Loading SELinux policy"
- # load_policy does mount /proc and /selinux in
+ mount -o bind /sys $NEWROOT/sys
+ # load_policy does mount /proc and /sys/fs/selinux in
# libselinux,selinux_init_load_policy()
if [ -x "$NEWROOT/sbin/load_policy" ]; then
out=$(LANG=C chroot "$NEWROOT" /sbin/load_policy -i 2>&1)
@@ -35,6 +36,8 @@ rd_load_policy()
ret=$?
info $out
fi
+ umount $NEWROOT/sys/fs/selinux
+ umount $NEWROOT/sys
if [ "$SELINUX" = "disabled" ]; then
return 0;
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH]selinux: load_policy script fix
[not found] ` <51a6ef54.GAPY7ltVyx5aFKm7%dyoung-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
@ 2013-05-30 6:29 ` Harald Hoyer
0 siblings, 0 replies; 2+ messages in thread
From: Harald Hoyer @ 2013-05-30 6:29 UTC (permalink / raw)
To: dyoung-H+wXaHxf7aLQT0dZR+AlfA
Cc: bhe-H+wXaHxf7aLQT0dZR+AlfA, vgoyal-H+wXaHxf7aLQT0dZR+AlfA,
initramfs-u79uwXL29TY76Z2rM5mHXA
On 05/30/2013 08:19 AM, dyoung-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org wrote:
> chroot load_policy will use selinuxfs which should be mounted
> in $NEWROOT/sys/fs/selinux for Fedora 19, but because there's
> no $NEWROOT/sys/fs, so later process will fail.
>
> Fixing this by bind mount /sys to $NEWROOT/sys.
>
> Signed-off-by: Dave Young <dyoung-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
> ---
> modules.d/98selinux/selinux-loadpolicy.sh | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> --- dracut.orig/modules.d/98selinux/selinux-loadpolicy.sh
> +++ dracut/modules.d/98selinux/selinux-loadpolicy.sh
> @@ -24,7 +24,8 @@ rd_load_policy()
> local ret=0
> local out
> info "Loading SELinux policy"
> - # load_policy does mount /proc and /selinux in
> + mount -o bind /sys $NEWROOT/sys
> + # load_policy does mount /proc and /sys/fs/selinux in
> # libselinux,selinux_init_load_policy()
> if [ -x "$NEWROOT/sbin/load_policy" ]; then
> out=$(LANG=C chroot "$NEWROOT" /sbin/load_policy -i 2>&1)
> @@ -35,6 +36,8 @@ rd_load_policy()
> ret=$?
> info $out
> fi
> + umount $NEWROOT/sys/fs/selinux
> + umount $NEWROOT/sys
>
> if [ "$SELINUX" = "disabled" ]; then
> return 0;
Applied, thanks!
commit cf8b1b785366e0a7c2ae1b3781d66b0f99d6f8fe
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2013-05-30 6:29 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-05-30 6:19 [PATCH]selinux: load_policy script fix dyoung-H+wXaHxf7aLQT0dZR+AlfA
[not found] ` <51a6ef54.GAPY7ltVyx5aFKm7%dyoung-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
2013-05-30 6:29 ` Harald Hoyer
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox