Re: [gentoo-hardened] SeLinux system_u:system_r:initrc_t inside KDE

[Sven Vermeulen]

On Sun, Aug 14, 2011 at 09:02:43AM -0400, Mike Edenfield wrote:
> It fixed my KDM logins to be unconfined, but it appears to break a bunch of
> other things:
>
> kutulu@platypus ~ $ id -Z
> unconfined_u:unconfined_r:unconfined_t
> kutulu@platypus ~ $ sudo -s
> Password:
> platypus kutulu # id -Z
> unconfined_u:unconfined_r:bootloader_t
>
> bootloader_t seems pretty random so its possible I screwed up my policy in
> some unrelated way. I'm reinstalling all the policy packages and
> relabeling, we'll see what happens.

This is usually the sign that the default context for the SELinux user (in
your case "unconfined_u") isn't set properly or that there is an issue with
it.

When I look at the default context information, I notice that there is none
for kdm_t (there is for xdm_t though):

~# grep xdm_t /etc/selinux/strict/contexts/default_contexts
system_r:xdm_t          user_r:user_t staff_r:staff_t sysadm_r:sysadm_t unconfined_r:unconfined_t

Since you work with unconfined, you'll need to use
/etc/selinux/targeted/contexts of course.

To find out if the initial context is set correctly, you can use getseuser:

~# getseuser swift system_u:system_r:xdm_t
seuser:  staff_u, level (null)
Context 0     staff_u:staff_r:staff_t

When I try it with kdm_t, I get an incorrect result as well (in my case, it
would use sysadm_t which is definitely not something I would like to happen
;-)

Wkr,
	Sven Vermeulen