Re: [gentoo-hardened] SeLinux system_u:system_r:initrc_t inside KDE

[Mike Edenfield]

On 8/14/2011 5:25 AM, Sven Vermeulen wrote:
> On Sat, Aug 13, 2011 at 8:33 PM, Mike Edenfield
> <kutulu@××××××.org <mailto:kutulu@××××××.org>> wrote:
>
>     My system-auth doesn't have anything about SELinux in
>     it. The pam_selinux.so
>     calls are in system-login. This looks like what pambase
>     is supposed to be
>     doing. system-login.in <http://system-login.in> has these:
>
>     #if HAVE_SELINUX
>     session         required        pam_selinux.so close
>     #endif
>
>     and system-auth.in <http://system-auth.in> doesn't.
>
>     Which one should kdm/gdm be using? Right now
>     /etc/pam.d/kde pulls in system-
>     auth. Can I just move the pam_selinux calls?
>
>
> If you do, does it break things (like logon through terminals)?
> If not, does it fix the KDM logons?

It fixed my KDM logins to be unconfined, but it appears to 
break a bunch of other things:

kutulu@platypus ~ $ id -Z
unconfined_u:unconfined_r:unconfined_t
kutulu@platypus ~ $ sudo -s
Password:
platypus kutulu # id -Z
unconfined_u:unconfined_r:bootloader_t

bootloader_t seems pretty random so its possible I screwed 
up my policy in some unrelated way. I'm reinstalling all the 
policy packages and relabeling, we'll see what happens.

--Mike