My question about the targeted policy presumes that init re-execs itself after loading the policy, whereby it picks up the unconfined_t domain from the policy, as defined by a rule in /etc/selinux/targeted/src/policy/domains/unconfined.te. role system_r types unconfined_t; What rule tells init to re-exec itself in the targeted policy? Or is init doing something differently now? Here is how far I've gotten in figuring this out. In the strict policy there is an explicit transition rule for init. The file programs/misc/kernel.te has this rule: domain_auto_trans(kernel_t, init_exec_t, init_t) In the targeted policy, kernel.te is in domains/misc/unused, so is not called into play. Correct? The transition behavior certainly isn't used, i.e., init transitions to unconfined_t instead of init_t. Therefore, I'm looking for a default behavior that init falls back on since it doesn't have specific SELinux coverage. In macros/global_macros.te the macro domain_auto_trans(init_t, $1_exec_t, $1_t) is defined. However, I don't find that macro used, i.e., domain_auto_trans(init_t) or somesuch. In addition, I'm not even sure that init would be in the domain init_t to qualify for this macro since in targeted it's in unconfined_t. In define(`unconfined_domain', there is this rule: allow $1 self:process transition; That says that init is allowed to transition to itself, but it doesn't tell init to do the transition and seems otherwise unrelated. Which one of these paths, if any, is leading in the right direction? thx - Karsten -- Karsten Wade, RHCE, Tech Writer a lemon is just a melon in disguise http://people.redhat.com/kwade/ gpg fingerprint: 2680 DBFD D968 3141 0115 5F1B D992 0E06 AD0E 0C41
