RE: [gentoo-hardened] Non-initrd SELinux initial policy loading

[Tad]

First let me say that seinit is a great idea. It'll make working on the
policy a little more convenient.

I just tried it, however, and it didn't work. All the really useful error
messages zipped by too fast to read, but as far as I could tell the policy
loaded but everything after that failed due to permission denied.

I tried re-labeling seinit so its context type was init_exec_t instead of
sbin_t but that didn't work.

Is there a policy change needed for this to work?

-Tad

> -----Original Message-----
> From: Chris PeBenito [mailto:pebenito@g.o]
> Sent: Monday, November 24, 2003 10:15 AM
> To: Hardened Gentoo Mail List
> Subject: [gentoo-hardened] Non-initrd SELinux initial policy loading
>
> For those interested in not using the initrd for doing the initial
> SELinux policy load, its now possible.  For those who still want to
> continue to use the initrd, you can simply ignore this email.
> /sbin/seinit will load the policy, and then exec the real init
> (/sbin/init).  No more forgetting to regenerate the initrd :) .  If you
> choose to not use the initrd anymore, you can also unmerge mkinitrd.
>
> Instructions:
> 1. make sure you have policycoreutils-1.2-r2 (/sbin/seinit should exist)
> 2. remove the initrd line from your bootloader, and add
> init=/sbin/seinit to the kernel command line.
>
> GRUB Example:
>
> title=linux
> root (hd0,0)
> kernel /bzImage root=/dev/hda3 init=/sbin/seinit gentoo=nodevfs
>
>
> LILO Example:
>
> image=/boot/bzImage
> 	label=linux
> 	read-only
> 	root=/dev/hda3
> 	append="init=/sbin/seinit gentoo=nodevfs"
>
>
> --
> Chris PeBenito
> <pebenito@g.o>
> Developer,
> Hardened Gentoo Linux
> Embedded Gentoo Linux
>
> Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
> Key fingerprint = B0E6 877A 883F A57A 8E6A  CB00 BC8E E42D E6AF 9243


--
gentoo-hardened@g.o mailing list