On 10/20/2010 11:26 PM, Shaz wrote:
On Thu, Oct 21, 2010 at 10:15 AM, Justin P. Mattock
<justinmattock@xxxxxxxxx> wrote:
On 10/20/2010 07:44 PM, Serge E. Hallyn wrote:
Quoting Justin P. Mattock (justinmattock@xxxxxxxxx):
o.k. finally connected the dots that I needed to create a initrd.img
in order for this to load(im a total newbie!!)
Anyways the policy loads everything went in and am now in full
enforcement mode.. only real issue is with lxde
same bug here:
https://bugzilla.redhat.com/show_bug.cgi?id=552885
seems lxde is in /usr/sbin reason probably for the wrong filelabel..
Cool, so does following the steps outlined in that bug make it
work for you?
What I normally have is /boot/System.map-* and vmlinuz-* to load the
kernel.. Seems sysvinit knows how to take things there and load_policy()
for upstart whatever it's doing(like what you said) needs to go through
initrd. Yesterday I though thats what I had done with:
fakeroot make-kpkg --initrd --append-to-version=-custom kernel_image
kernel_headers
but missed one last step:
mkinitramfs -k -o initrd.img-2.6.36-rc8-custom-00022-g2b666ca
then after doing this everything loaded as is..
Note: guess this is whats being called to do all of this:
/usr/share/initramfs-tools/scripts/init-bottom/_load_selinux_policy
As for the file labels in /var/run seems most of the files in there are
labeled with initrc_t (keep in mind I chose debian as the distro in
build.conf, so maybe this is why)..
As for lxde, before using chcon I was getting a login context of
name:staff_r:netutils_t:s0 then after relabeling those files:
(chcon to this context like the bug report had shown)
system_u:object_r:xdm_exec_t:s0 /usr/sbin/lxdm
system_u:object_r:xdm_exec_t:s0 /usr/sbin/lxdm-binary
system_u:object_r:xdm_var_run_t:s0 lxdm.pid
I login with the proper context that I chose:
name:staff_r:staff_t:s0
Right now I think everything is running o.k. on this operating system..
(nice,small, and functional..with a touch of SELinux on top...)
Dear Justin,
"initrd" helps to load selinux and label "init" so that transitions
can take effect. Be it upstart or sysvinit!
If this is not done then all your processes will be loaded with
unconfined_t. Rest of the details you are considering should not
matter and they might be confusing if you tried to load selinux with
experimentation rather then proper bootstrap through initrd.
Hope this helps.
well my other machines do not use an initrd image file in /boot only
System.map and vmlinuz(I guess doing make, make install for the kernel
is a bit outdated these days)..
Anyways sysvinit always loaded the policy just fine and had the
processes correct, as for upstart seems I needed to do the whole
make-kpkg,dpkg,mkinitramfs thing..(which is fine... but would rather
keep it more simpler).
Justin P. Mattock
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.
