Hi guys, I'm trying to get a system to boot up with initramfs (without the initramfs all things work just fine, but we need to get initramfs supported) with SELinux running in enforcing mode, and without relying on unconfined domains. However, it looks to be quite challenging. An initramfs' /init will run in the kernel_t domain (and unconfined until load_policy is called ?) but does quite a lot of activities before it can even call load_policy (get /dev in shape, including starting udev, mounting root file system, etc.) because load_policy needs access to the policy.26 file on the root file system. But because all of this, udev doesn't run in the proper domain (also in kernel_t), device entries are wrongly labeled (and relabeling fails because kernel_t does not have relabel privileges) and the system just doesn't want to boot. Is it correct to say that load_policy should occur as soon as possible (even before udev starts)? If so, does that mean than a SELinux-supporting initramfs should actually include the policy.26 file in the initramfs? Wkr, Sven Vermeulen -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
