I think the idea was if we are not in the initrd - try to load policy if we are in the initrd and we find selinux_path() - try to load policy Thus embeded/thin who put everything inside the initrd will work (and the kernel enforce=1 will mean what is should) And where we don't put anything inside the initrd will still be correct since we'll try to load no matter what in the real root On Thu, Feb 20, 2014 at 3:52 PM, Colin Walters <walters@xxxxxxxxxx> wrote: > On Thu, Feb 20, 2014 at 2:45 PM, Daniel J Walsh <dwalsh@xxxxxxxxxx> wrote: > > You mean "!in_initrd() || access(selinux_path(), F_OK) >= 0"? > > > I don't think so - that would mean we would silently continue if > enforcing=1, but we happen to not find a policy on disk. Right? > > I think my patch is better than this - systemd will attempt to load policy > from *only* the real root (not the initramfs), using the exact same logic as > is in libselinux currently. > > For example, it would allow explicitly specifying enforcing=1 on the kernel > command line, and that would continue to cause an explicit failure if policy > is not found. > > > > _______________________________________________ > Selinux mailing list > Selinux@xxxxxxxxxxxxx > To unsubscribe, send email to Selinux-leave@xxxxxxxxxxxxx. > To get help, send an email containing "help" to > Selinux-request@xxxxxxxxxxxxx. > _______________________________________________ Selinux mailing list Selinux@xxxxxxxxxxxxx To unsubscribe, send email to Selinux-leave@xxxxxxxxxxxxx. To get help, send an email containing "help" to Selinux-request@xxxxxxxxxxxxx.
