init patch for loading policy

[Russell Coker <russell@coker.com.au>]

[-- Attachment #1: Type: text/plain, Size: 1432 bytes --]

I've attached a patch for /sbin/init to load the policy and set enforcing 
mode.  Here's a quick summary of the algorithm:

0)  Only reach our code if the PIPE code for detecting "telinit u" does not 
get a hit.  Therefore we know that we are executed on either a SEGV of the 
original init or the initial boot.
1)  Check for readability of /selinux/enforce, if it's readable then we have 
just exec'd ourselves so go to FINISH.
2)  Mount /selinux, if success then go to 5.
3)  Mount /proc, if error then go to FINISH (*).
4)  Check /proc/filesystems for selinuxfs entry, if it's not there then we 
aren't running an SE Linux kernel so go to FINISH.  If it's there then we 
have a serious error condition so go to ERR (I forgot to close a file handle, 
not that it matters much - I'll fix it later).
5)  load_policy - if error then go to ERR.
6)  Set enforcing mode, if error then go to ERR.
7)  Exec itself to get init_t, if can't exec then fall through to ERR.
ERR) Sleep for 60 seconds after displaying message then halt machine (*).
FINISH) Continue with regular init startup.

The (*)'s indicate issues that are open for discussion.  The exact actions may 
be contentious.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

[-- Attachment #2: init.diff --]
[-- Type: text/x-diff, Size: 1603 bytes --]

diff -ru orig/sysvinit-2.85/src/init.c sysvinit-2.85/src/init.c
--- orig/sysvinit-2.85/src/init.c	2003-10-19 20:25:32.000000000 +1000
+++ sysvinit-2.85/src/init.c	2003-10-20 01:00:47.000000000 +1000
@@ -2508,6 +2508,7 @@
 	char			*p;
 	int			f;
 	int			isinit;
+	FILE			*fp;
 
 	/* Get my own name */
 	if ((p = strrchr(argv[0], '/')) != NULL)
@@ -2551,6 +2552,55 @@
 		init_main();
 	}
 
+#ifdef WITH_SELINUX
+	if(!access("/selinux/enforce", R_OK))
+		goto finished;
+
+	if(system("mount -n none /selinux -t selinuxfs"))
+	{
+		char buf[64];
+		if(system("mount -n none /proc -t proc"))
+		{
+			fprintf(stderr, "Can't mount /selinux or /proc\n");
+			goto finished;
+		}
+		fp = fopen("/proc/filesystems", "r");
+		if(!fp)
+		{
+			fprintf(stderr, "Can't open /proc/filesystems");
+			goto err;
+		}
+		while(fgets(buf, sizeof(buf), fp))
+		{
+			if(strstr(buf, "selinuxfs"))
+			{
+				fprintf(stderr, "SE Linux is enabled but can't mount /selinux");
+				goto err;
+			}
+		}
+		fclose(fp); /* non-SE kernel */
+		goto finished;
+	}
+	if(system("/usr/sbin/load_policy /etc/security/selinux/policy.15"))
+	{
+		fprintf(stderr, "Can't load policy");
+		goto err;
+	}
+	fp = fopen("/selinux/enforce", "w");
+	if(!fp || 1 != fwrite("1", 1, 1, fp))
+	{
+		fprintf(stderr, "Can't set enforcing mode.\n");
+		goto err;
+	}
+	fclose(fp);
+	execv("/sbin/init", argv);
+	fprintf(stderr, "Can't re-exec init to get right context.\n");
+err:
+	sleep(60);
+	init_reboot(BMAGIC_HALT);
+finished:
+#endif
+
   	/* Check command line arguments */
 	maxproclen = strlen(argv[0]) + 1;
   	for(f = 1; f < argc; f++) {