Currently on at least Fedora, SELinux policy does not come in<div>the initramfs.  systemd will attempt to load *both* in the</div><div>initramfs and in the real root.</div><div><br></div><div>Now, the selinux_init_load_policy() API has a regular error return</div><div>value, as well as an "enforcing" boolean.  To determine enforcing</div><div>state, it looks for /etc/selinux/config as well as the presence</div><div>of "enforcing=" on the kernel command line.</div><div><br></div><div>Ordinarily, neither of those exist in the initramfs, so it will return</div><div>"unknown" for enforcing, and systemd will simply ignore the failure to</div><div>load policy.</div><div><br></div><div>Then later after we switch to the real root, we have the config file,</div><div>and all will work properly.</div><div><br></div><div>Except...this all blows up if someone explicitly specifies enforcing=1</div><div>on the kernel command line.  Then systemd will fail to load the</div><div>nonexistent policy in the initramfs and freeze.</div><div><br></div><div>What this patch does is quite simple - we add an internal API that</div><div>says where we expect to find policy, and attempt to load it exactly</div><div>from there.  Right now since I'm not aware of anyone who does</div><div>policy-in-initramfs, this function is hardcoded to return false.</div><div><br></div><div>Lots-of-very-painful-debugging-by: Colin Walters &lt;walters@verbum.org&gt;</div><div>---</div><div>&nbsp;src/core/main.c          |  6 ++++--</div><div>&nbsp;src/core/selinux-setup.c | 10 ++++++++++</div><div>&nbsp;src/core/selinux-setup.h |  2 ++</div><div>&nbsp;3 files changed, 16 insertions(+), 2 deletions(-)</div><div><br></div><div><br></div>