Hello Eric. On Fri, 2011-09-23 at 17:17 -0400, Eric Paris wrote: > On Fri, 2011-09-23 at 23:12 +0200, Guido Trentalancia wrote: > > > You seem to suggest that load_policy -i (and not the kernel) should make > > sure that init has transitioned to its designated context... > > Can't speak for Justin's system. That's for sure. But it seems to me that he already stated that it just loaded plain refpolicy from git on a plain F15 system. Since we are on the list he might even confirm once again... > But that's not what I said. I said > it's /sbin/init's problem to make sure it did the right thing and to > handle errors correctly if it failed. If Justin has his box enforcing > and can boot without loading a policy that's a bug and needs to be > filed. He has loaded the policy. The point is that when init does not transition to init_t nothing happens and the system keeps running with all processes in kernel_t or insmod_t. It surely use to happen with upstream components and policy back at the beginning of this year (I did test that and reported it to the refpolicy mailing list). Apparently it also happens with Fedora 15 according to what Justin reported on here when he started this thread... Earlier on Daniel Walsh said Fedora and RHEL would crash in such case (init has not transitioned properly to init_t). I said "very good" (as that is what I expect from a SELinux system) and asked "how did you achieved that ?" because I believe such behavior should be definitely be imported in upstream. But then I thought Daniel's statement doesn't match with what Justin reported. Regards, Guido -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
