Gentoo Archives: gentoo-hardened

From: Krzysztof Nowicki <krissn@××.pl>
To: gentoo-hardened@l.g.o
Cc: Sven Vermeulen <swift@g.o>
Subject: Re: [gentoo-hardened] Using sys-kernel/dracut with SELinux
Date: Wed, 06 Mar 2013 19:10:16
Message-Id: 5137939B.5010704@op.pl
In Reply to: Re: [gentoo-hardened] Using sys-kernel/dracut with SELinux by Sven Vermeulen
1 On 06.03.2013 15:13, Sven Vermeulen wrote:
2 > If dracut doesn't use the fstab options then you'll need to find where
3 > it gets mounted and update that. Perhaps creating an additional dracut
4 > module to remount with the correct options works as well and is more
5 > manageable in the longer term?
6 > --
7 > Sent from my Android phone with K-9 Mail. Please excuse my brevity.
8 Hi,
9
10 I've actually tried that. The problem is that SELinux-enabled mount
11 (which gets pulled into the initramfs from the system) will filter out
12 SELinux-related mount options (like rootcontext) if it finds that
13 SELinux is not running (it will call is_selinux_running() from libselinux).
14
15 One of the checks it makes is for a mounted /selinux filesystem, but
16 mounting it alone has no impact. I'll have to dig further.
17
18 As for remounting I tried to remount /run by adding the rootcontext
19 option, but mount fails with the error "mount: /run not mounted or bad
20 option". I have a suspicion that you cannot add/change the rootcontext
21 mount option during a remount. This is actually what OpenRC is trying to
22 do in /etc/init.d/root, but fails with the same error.
23
24 Regards
25 Chris

Replies

Subject Author
Re: [gentoo-hardened] Using sys-kernel/dracut with SELinux Krzysztof Nowicki <krissn@××.pl>