-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 12/07/2011 09:53 AM, JB wrote: > Daniel J Walsh <dwalsh <at> redhat.com> writes: > >> >> >> On 12/07/2011 03:14 AM, JB wrote: >>> JB <jb.1234abcd <at> gmail.com> writes: >>> >>>> ... >>> >>> To make my point clear. >>> >>> In general, the resuce mode turns all services off for the >>> purpose of preserving the original troubled environment >>> (machine state) and preventing any worsening of it until it can >>> be investigated or fixed. >>> >>> So it seems a rescue mode should not allow execution of >>> selinux relabeling right before it, under any circumstances. >>> >>> JB >>> >>> >> My understanding is when you are in rescue mode SELinux should >> be disabled and no relabeling should take place. What does >> happen is the flag gets set (/.autorelabel). So theoretically >> when you reboot the machine with SELinux enabled, the first thing >> it will do is make sure all the labels are correct so SELinux >> will work properly. If you see a system that you boot in rescue >> mode trying to relabel, then I would guess this is a bug. >> > > OK. We are on the same page with regard to the principle: In rescue > mode SELinux should be disabled and no relabeling should take > place. > > But the issue is how to enforce it. You say "should be", but I > showed in that Case scenario that I constructed few posts above > that SELinux can be enabled by chance (sysadmin is doing her job, > there are problems, boom, ...), followed by reboot to rescue mode, > which gets preceded by actual relabeling due to SELinux being > enabled as above. > > I would like to see it enforced "the hard way", so that the > principle does not get violated by chance or even intention (at > least easily via selinux config file or manual entry). > > I thought about using unit file directive(s) to do that, making > relabeling serice and emergency or rescue services (targets) > mutually exclusive. > > I am not an expert on systemd :-) but it seems that Conflicts= and > ConflictedBy= can do the job. > > Can that be done ? > > JB > > I thought the rescure kernel would boot with selinux=0. I am no expert on systemd either. Perhaps should discuss on systemd list. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk7fhsgACgkQrlYvE4MpobOBEACgnv63IYoM/qR6JXHvLVB66PnH Jt8AmgNSUPT2nAT8Rbfv+A2gP06yNk/c =KGal -----END PGP SIGNATURE----- -- users mailing list users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe or change subscription options: https://admin.fedoraproject.org/mailman/listinfo/users Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines Have a question? Ask away: http://ask.fedoraproject.org
