Re: [gentoo-hardened] Can't log into my selinux system

[Ed Wildgoose]

>Login contexts are determined by the running policy, so login gets them
>by requesting them through selinuxfs (/selinux).  So to correctly login
>locally you need:
>
>1. correctly setup policy
>2. agetty is in getty_t
>3. /bin/login is login_exec_t
>4. selinuxfs is mounted
>
>These aren't all the requirements, but the ones that are needed to get
>login contexts.  ps -AZ and look at all the agetty's to make sure
>they're all running in the right context (since sestatus only shows
>one).  But since your logged in the kernel_t context, and your
>controlling term is wrong, you should probably restart, so everything
>can get into the right context.
>
>

Hmm, ok, this looks like the problem then.  2) agetty is running in 
system_u:system_r:kernel_t?  Should that be happening?  1), 3) and 4) 
are fine

Tested rebooting and I can log in then.  However, the policy is clearly 
not auto loading, ps -AZ shows everything running as "kernel".  cd 
/etc/blah/policy and doing make reload sets agetty back as described 
above and no more consoles can login...  SSH into the machine doesn't 
work then either, with an error in syslog which looks like basically the 
same thing, no default security context found for user root...

Before testing any of this I reloaded the security policy and re-applied 
it to the whole fs.  Then rebooted.

ls -AZ /sbin/agetty
system_u:object_r:getty_exec_t

Is this correct ^^^?  I'm still not getting how it ends up with the 
context that it does, unless it simply inherits it from the fact that it 
was previously running as root?  I can't see any reference to agetty in 
the policy dirs

Thanks for any insight

Ed W

--
gentoo-hardened@g.o mailing list