Re: init patch for loading policy

[Joubert Berger <joubert@berger-family.org>]

Could you not hard code enough of a policy in the kernel to get init(8)
up and running?  Then let init run a script that loads the complete
policy and then runs /etc/rc.d/rc.sysinit or just have rc.sysinit load
it as it's first step.

--joubert

On Tue, 2003-10-21 at 13:50, Daniel J Walsh wrote:
> Stephen Smalley wrote:
> > On Tue, 2003-10-21 at 10:43, Russell Coker wrote: 
> >   
> > > The results I have so far indicate that this approach has significant 
> > > problems.
> > > 
> > > Diverting /sbin/init with a shell script works better than this.
> > >     
> > Ok, thanks for looking into it.  So what exactly is the problem with
> > diverting /sbin/init again?  
> > 
> >   
> I still believe that the patch to /sbin/init is simple enough that all
> the rest of this stuff is complicating matters.  It allows too many
> ways for someone to make a modification that breaks security.  I have
> updated the files on people.redhat.com/dwalsh to use the modified
> init.  I have passed this by Bill Nottingham (Red Hat maintainer) and
> he is ok with it.
> 
> Of course if someone comes up with a simpler solution we would look at
> it.
> 
> Dan
> 
> 


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.