On Thu, Feb 20, 2014 at 1:06 PM, Stephen Smalley &lt;sds@tycho.nsa.gov&gt; wrote:<br>
<blockquote type="cite"><div class="plaintext" style="white-space: pre-wrap;">
Wouldn't it be better (and more correct) to probe both the initramfs and
the real root, and if neither one can load policy successfully and
enforcing=1, then halt?</div></blockquote><br><div>So you're saying we should handle -ENOENT specially in the initramfs? &nbsp;Something like being sure we preserve errno and returning it to the caller of selinux_init_load_policy()? &nbsp;That would introduce a subtle version dependency.</div><div><br></div><div>Or alternatively, just try in the initramfs, ignore any errors, and only abort if we also fail to load in the real root?</div><div><br></div><div>I think both of these (particularly the second) are worse than my patch - we don't (to my knowledge) support putting policy in the initramfs now with Fedora or Red Hat Enterprise Linux, so attempting to find it there by default on every bootup is wrong. &nbsp;</div><div><br></div><div>To turn it around, what is the possible value in also probing the initramfs? &nbsp;Does anyone out there load policy from it with systemd?</div><div><br></div><div>&nbsp;&nbsp;</div>