Re: selinux hasn't been running for over a week

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 09/18/2009 08:35 AM, Stephen Smalley wrote:
> On Fri, 2009-09-18 at 07:34 -0400, Daniel J Walsh wrote:
>> On 09/17/2009 09:39 PM, Yuan Yijun wrote:
>>> 2009/9/18 Steve Grubb <sgrubb@xxxxxxxxxx>:
>>>> hi,
>>>>
>>>> What's happened in our rawhide boot sequence that cause selinux to not be
>>>> running anymore? Selinux is not disabled in the grub.conf kernel line and
>>>> sestatus shows its disabled. There is nothing in the system logs saying that
>>>> there was a problem.
>>>>
>>>
>>> I encountered this problem as well, but don't know why. It happens
>>> when I am trying different kernels among some recent builds (starting
>>> from 0.104 to 1.14). I guess there is a incompatible between older
>>> kernels and the policy; when you install a kernel while SELinux is
>>> disabled, it may cause future problems. Do you expect SELinux to be
>>> enabled automatically? I usually enable SELinux by doing a relabel,
>>> then install the kernel again.
>>>
>>>
>>>
>> Hopefully this is just a problem of coordination between the old way of doing things and the new new. 
>> Dracut found a bug where it could not load_policy on separate /usr partitions because it needed to execute
>> /usr/sbin/load_policy (obviously).  I moved load_policy from /usr/sbin to /sbin. This caused some other apps
>> problems because they were hard coded to look for /usr/sbin.  Recently I fixed this by adding a symbolic link
>> and fixing the libraries that blew up.
> 
> Why can't dracut just directly invoke the libselinux interface
> (selinux_init_load_policy)?  Then you don't have to care where the
> load_policy program lives.
> 
The beauty of load_policy is that we don't end up having to suck the libsemanage and friends into the initrd.

I think it is much saner then what we were doing in F11.


-- 
fedora-devel-list mailing list
fedora-devel-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-devel-list

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Fedora Announce]     [Fedora Kernel]     [Fedora Testing]     [Fedora Formulas]     [Fedora PHP Devel]     [Kernel Development]     [Fedora Legacy]     [Fedora Maintainers]     [Fedora Desktop]     [PAM]     [Red Hat Development]     [Gimp]     [Yosemite News]
  Powered by Linux