On Thu, Oct 21, 2010 at 10:15 AM, Justin P. Mattock <justinmattock@xxxxxxxxx> wrote: > On 10/20/2010 07:44 PM, Serge E. Hallyn wrote: >> >> Quoting Justin P. Mattock (justinmattock@xxxxxxxxx): >>> >>> o.k. finally connected the dots that I needed to create a initrd.img >>> in order for this to load(im a total newbie!!) >>> >>> Anyways the policy loads everything went in and am now in full >>> enforcement mode.. only real issue is with lxde >>> same bug here: >>> https://bugzilla.redhat.com/show_bug.cgi?id=552885 >>> >>> seems lxde is in /usr/sbin reason probably for the wrong filelabel.. >> >> Cool, so does following the steps outlined in that bug make it >> work for you? >> > > What I normally have is /boot/System.map-* and vmlinuz-* to load the > kernel.. Seems sysvinit knows how to take things there and load_policy() > > for upstart whatever it's doing(like what you said) needs to go through > initrd. Yesterday I though thats what I had done with: > fakeroot make-kpkg --initrd --append-to-version=-custom kernel_image > kernel_headers > > but missed one last step: > mkinitramfs -k -o initrd.img-2.6.36-rc8-custom-00022-g2b666ca > then after doing this everything loaded as is.. > > Note: guess this is whats being called to do all of this: > /usr/share/initramfs-tools/scripts/init-bottom/_load_selinux_policy > > As for the file labels in /var/run seems most of the files in there are > labeled with initrc_t (keep in mind I chose debian as the distro in > build.conf, so maybe this is why).. > > As for lxde, before using chcon I was getting a login context of > name:staff_r:netutils_t:s0 then after relabeling those files: > > (chcon to this context like the bug report had shown) > system_u:object_r:xdm_exec_t:s0 /usr/sbin/lxdm > system_u:object_r:xdm_exec_t:s0 /usr/sbin/lxdm-binary > system_u:object_r:xdm_var_run_t:s0 lxdm.pid > > I login with the proper context that I chose: > name:staff_r:staff_t:s0 > > Right now I think everything is running o.k. on this operating system.. > (nice,small, and functional..with a touch of SELinux on top...) Dear Justin, "initrd" helps to load selinux and label "init" so that transitions can take effect. Be it upstart or sysvinit! If this is not done then all your processes will be loaded with unconfined_t. Rest of the details you are considering should not matter and they might be confusing if you tried to load selinux with experimentation rather then proper bootstrap through initrd. Hope this helps. -- Shahbaz Khan Assit. R&D Engineer, SERG, IM|Sciences. http://shazkhan.wordpress.com/ http://pk.linkedin.com/pub/shahbaz-khan/20/116/b49 http://imsciences.edu.pk/serg/ http://csrdu.org/ -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
