bugSystem V style init programs - Bugs: bug #30396, sysvinit 2.88 fails to load...

 
 

bug #30396: sysvinit 2.88 fails to load selinux policy

Submitted by:  None
Submitted on:  Thu 08 Jul 2010 09:10:15 PM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: Fixed
Privacy: PublicAssigned to: Dr. Werner Fink <wfink>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Tue 13 Jul 2010 08:53:51 AM UTC, comment #6:

Thanks for the feedback, I'll set this on to closed.

Dr. Werner Fink <wfink>
Project AdministratorIn charge of this item.
Tue 13 Jul 2010 12:49:56 AM UTC, comment #5:

Well, I guess I'm getting senile or something. The first two times I applied the patch, my system puked all over the carpet but now it's running quite happily.

Chris Richards <gizmo>
Mon 12 Jul 2010 12:00:45 PM UTC, comment #4:

AFAIK and understood this patch comes from the Debian people
with the help of the SELinux people. And so far as I can
see it should work even if there is no /proc mounted[1]. This
because if /proc is not mounted then is_selinux_enabled()
does return -1 (not 0 nor 1) which indeed cause that the
selinux_init_load_policy() will be executed and from the
source tar ball of selinux I can see that in this case the
/proc and selinuxfs file systems will be mounted[2].

Please could you give this solution a try? It seems that it
works on Debian as well as on openSUSE.

[1]: the `int is_selinux_enabled(void)' simply tries to open
/proc/filesystems to search for the tag selinuxfs
[2]: in `int selinux_init_load_policy(int *enforce)' the
/proc file system will be mounted if not already done
... if the mount systm call succeeds the umount2()
system call with MNT_DETACH as second argument for
cleaning out this intermediate step

Dr. Werner Fink <wfink>
Project AdministratorIn charge of this item.
Fri 09 Jul 2010 02:40:55 PM UTC, comment #3:

The attachment does NOT work for me. That is the patch that is proposed for the Debian bug, also (and which I guess originated with you?).

It fails on Gentoo because /proc is not mounted at the time the test is made. I'm guessing this is due to the fact that (on my system at least) I'm not using an initrd, so my /proc doesn't get mounted until rc runs, and by then it's too late to load policy.

Chris Richards <gizmo>
Fri 09 Jul 2010 07:51:44 AM UTC, comment #2:

Chris? Please test out the attachment file #20930 as
this is what is currently part of the SVN head. Does
this work for you?

Dr. Werner Fink <wfink>
Project AdministratorIn charge of this item.
Thu 08 Jul 2010 10:13:54 PM UTC, comment #1:

please delete the attachment 'server.txt'. I don't know how it got selected for upload, but it should not have been.

Chris Richards <gizmo>
Thu 08 Jul 2010 09:10:15 PM UTC, original submission:

Running Gentoo, ~amd64, hardened profile, kernel 2.6.32-r10.

As in subject, SELinux policy does not get loaded by sysvinit 2.88dsf, however sysvinit 2.87dsf loads policy just fine.

Examination of code reveals the following:

#ifdef WITH_SELINUX
if (getenv("SELINUX_INIT") == NULL) {
const int rc = mount("proc", "/proc", "proc", 0, 0);
if (is_selinux_enabled() > 0) {
putenv("SELINUX_INIT=YES");
if (rc == 0) umount2("/proc", MNT_DETACH);
if (selinux_init_load_policy(&enforce) == 0) {
execv(myname, argv);
} else {
if (enforce > 0) {
/* SELinux in enforcing mode but load_policy failed */
/* At this point, we probably can't open /dev/console, so log() won't work */
fprintf(stderr,"Unable to load SELinux Policy. Machine is in enforcing mode. Halting now.\n");
exit(1);
}
}
}
if (rc == 0) umount2("/proc", MNT_DETACH);
}
#endif

Specifically, the portion of the code that checks is_selinux_enabled() is wrong. is_selinux_enabled() returns 1 if selinux policy has already been loaded (meaning there is no need to load it again), 0 if selinux policy has NOT been loaded, and -1 if it was unable to determine the state of selinux on the system (e.g. if SELinux is disabled altogether, or /proc is not mounted, among others). This means the test should actually be

if(is_selinux_enabled < 1)
{
//do selinux policy-related stuff
}

The attached patch implements this change.

Note that there is an issue open on Debian for this same problem: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=580272

However, the change recommended by Michael Svoboda does NOT work on my Gentoo system (which is not using an initrd, a point Michael mentions should work but which he has not tested). (Note that the attached patch is essentially just a stripped-down version of Michael's, the key difference being that Michael's patch removes the logic that allows init to load /proc, whereas I'm leaving that logic in place).

I have opened a bug report with Gentoo as well: https://bugs.gentoo.org/attachment.cgi?id=237335&action=edit

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #20930:  x added by wfink (1KiB - application/octet-stream - sysvinit-2.88-selinux-init.patch from current SVN head)
file #20928:  sysvinit-2.88-selinux-init.patch added by None (595B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by gizmo (Posted a comment)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 8 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 11 Mar 2011 02:22:05 PM UTCwfinkStatusNeed Info=>Fixed
    Tue 13 Jul 2010 08:53:51 AM UTCwfinkOpen/ClosedOpen=>Closed
    Fri 09 Jul 2010 07:51:44 AM UTCwfinkStatusNone=>Need Info
      Assigned toNone=>wfink
    Fri 09 Jul 2010 07:45:12 AM UTCwfinkAttached File-=>Added x, #20930
    Fri 09 Jul 2010 07:40:20 AM UTCwfinkAttached File#20927=>Removed
    Thu 08 Jul 2010 09:27:30 PM UTCNoneAttached File-=>Added sysvinit-2.88-selinux-init.patch, #20928
    Thu 08 Jul 2010 09:10:15 PM UTCNoneAttached File-=>Added server.txt, #20927

    Back to the top


    Powered by Savane 3.1-cleanup1