Re: [systemd-devel] [PATCH] selinux: Only attempt to load policy exactly once, in the real root

[Eric Paris <eparis@parisplace.org>]

I think the idea was

if we are not in the initrd - try to load policy
if we are in the initrd and we find selinux_path() - try to load policy

Thus embeded/thin who put everything inside the initrd will work (and
the kernel enforce=1 will mean what is should)
And where we don't put anything inside the initrd will still be
correct since we'll try to load no matter what in the real root

On Thu, Feb 20, 2014 at 3:52 PM, Colin Walters <walters@verbum.org> wrote:
> On Thu, Feb 20, 2014 at 2:45 PM, Daniel J Walsh <dwalsh@redhat.com> wrote:
>
> You mean "!in_initrd() || access(selinux_path(), F_OK) >= 0"?
>
>
> I don't think so - that would mean we would silently continue if
> enforcing=1, but we happen to not find a policy on disk.  Right?
>
> I think my patch is better than this - systemd will attempt to load policy
> from *only* the real root (not the initramfs), using the exact same logic as
> is in libselinux currently.
>
> For example, it would allow explicitly specifying enforcing=1 on the kernel
> command line, and that would continue to cause an explicit failure if policy
> is not found.
>
>
>
> _______________________________________________
> Selinux mailing list
> Selinux@tycho.nsa.gov
> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov.
> To get help, send an email containing "help" to
> Selinux-request@tycho.nsa.gov.
>