setting boolean values

setting boolean values

[Greg Norris]

Stupid question... which component is responsible for setting the 
initial value for booleans during system startup?  I'm guessing this 
would be init's job, but am not absolutely certain.  I'm trying to 
determine why they aren't being set properly on my Debian system... 
hopefully it's not something embarrassingly stupid (nah, that NEVER 
happens! ;-).

My /etc/selinux/config contains the following:

   # used by init
   SELINUX=enforcing
   # Debian does not support using a config file to switch between policies
   SELINUXTYPE=.

My /etc/selinux/booleans contains:

   spamassasin_can_network=1

Any thoughts?


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: setting boolean values

[Stephen Smalley]

On Thu, 2004-12-16 at 20:36, Greg Norris wrote:
> Stupid question... which component is responsible for setting the 
> initial value for booleans during system startup?  I'm guessing this 
> would be init's job, but am not absolutely certain.  I'm trying to 
> determine why they aren't being set properly on my Debian system... 
> hopefully it's not something embarrassingly stupid (nah, that NEVER 
> happens! ;-).

Yes, the current patch for /sbin/init calls sepol_genbools() to rewrite
the boolean initial values in the binary policy based on your booleans
config file prior to calling security_load_policy().  That was
introduced during FC3 development, so the Debian patch for init might
not be up-to-date.  BTW, Fedora Core now has a public CVS repository, so
people who want to track the SELinux-related patches there can do so
much more easily.

-- 
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: setting boolean values

[Greg Norris]

[-- Attachment #1: Type: text/plain, Size: 494 bytes --]

On Fri, Dec 17, 2004 at 08:47:02AM -0500, Stephen Smalley wrote:
> Yes, the current patch for /sbin/init calls sepol_genbools() to rewrite
> the boolean initial values in the binary policy based on your booleans
> config file prior to calling security_load_policy().  That was
> introduced during FC3 development, so the Debian patch for init might
> not be up-to-date.

Yep, that was it.  I'll see about rebuilding sysvinit with the updated 
patch over the next few days.

Thanx!


[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]