Re: init patch for loading policy

[Russell Coker <russell@coker.com.au>]

On Wed, 22 Oct 2003 00:59, Stephen Smalley wrote:
> On Tue, 2003-10-21 at 10:43, Russell Coker wrote:
> > The results I have so far indicate that this approach has significant
> > problems.
> >
> > Diverting /sbin/init with a shell script works better than this.
>
> Ok, thanks for looking into it.  So what exactly is the problem with
> diverting /sbin/init again?

No insurmountable problem.  I have the following script as /sbin/init, I have 
the real init as /sbin/init.real, and I modified the telinit sym-link 
accordingly.  It seems that init gets re-exec'd for some reason I'm still not 
sure about.  That means that bash gets run in init_t and wants some extra 
access.  But that's not significant.

Diverting /sbin/init may be our best option.

allow init_t devtty_t:chr_file { read write };
allow init_t proc_t:file { read };


#!/bin/sh

if [ ! -d /proc/1 ]; then
  mount -n /proc
fi
grep -q selinuxfs /proc/filesystems || exec /sbin/init.real "$@"
if [ ! -f /selinux/enforce ]; then
  mount -n /selinux
  /usr/sbin/load_policy /etc/security/selinux/policy.15
  if [ -f /selinux/enforce ]; then
    echo 1 > /selinux/enforce
  else
    echo "Can't set enforcing mode"
  fi
fi
exec /sbin/init.real "$@"


-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.