Re: [gentoo-hardened] locked out of selinux

[Mike Edenfield]

Markus Bartl wrote:

>>> max wrote:

>>>> If i compile a policy on Fedora this is always set to allow, if not I
>>>> usually run into problems like your having, I don't know enough about
>>>> gentoo to know if this is supposed to be this way here or not, perhaps
>>>> someone else can supply the answer. The description in the build.conf file:

The current policy being used by Gentoo is a few months behind the one 
in Fedora (for technical reasons that hopefully will be resolved soon). 
  But that wouldn't be causing your problem.  Those dmesg warnings just 
mean the kernel you're running knows about the permissions and classes 
that have been added since the policy snapshot was taken.  The base 
policy from portage *is* bootable in enforcing mode.

> I know this wont help, but i got exactly the same issue.
> If i try to boot in enforcing mode, init is blocked and the boot sequence stops.

Some things to try:

1. Relabel everything.  Improper file labels cause no end of problems 
and *especially* in the boot process, since the wrong file context leads 
to the wrong process context and everything just falls apart.  The 
safest way to do this is to switch to permissive mode, then do:

rlpkg -a -r
reboot
rlpkg -a -r # in case anything got created on shutdown/restart.

2. Once you've done that, check the following (still in permissive mode):

# ls -lZ /sbin/init /sbin/rc
(They should be labeled init_exec_t and initrc_exec_t, respectively.)

# cat /etc/selinux/strict/context/run_init_type
(should be run_init_t)

# ps axZ | grep init
(should be running as init_t)

# id -Z
(your user, role, and type should all match, like 
staff_u:staff_r:staff_t, and not be something like kernel_t, sshd_t, etc.)

--Mike