Thu 08 Jul 2010 09:10:15 PM UTC, original submission:
Running Gentoo, ~amd64, hardened profile, kernel 2.6.32-r10.
As in subject, SELinux policy does not get loaded by sysvinit 2.88dsf, however sysvinit 2.87dsf loads policy just fine.
Examination of code reveals the following:
#ifdef WITH_SELINUX
if (getenv("SELINUX_INIT") == NULL) {
const int rc = mount("proc", "/proc", "proc", 0, 0);
if (is_selinux_enabled() > 0) {
putenv("SELINUX_INIT=YES");
if (rc == 0) umount2("/proc", MNT_DETACH);
if (selinux_init_load_policy(&enforce) == 0) {
execv(myname, argv);
} else {
if (enforce > 0) {
/* SELinux in enforcing mode but load_policy failed */
/* At this point, we probably can't open /dev/console, so log() won't work */
fprintf(stderr,"Unable to load SELinux Policy. Machine is in enforcing mode. Halting now.\n");
exit(1);
}
}
}
if (rc == 0) umount2("/proc", MNT_DETACH);
}
#endif
Specifically, the portion of the code that checks is_selinux_enabled() is wrong. is_selinux_enabled() returns 1 if selinux policy has already been loaded (meaning there is no need to load it again), 0 if selinux policy has NOT been loaded, and -1 if it was unable to determine the state of selinux on the system (e.g. if SELinux is disabled altogether, or /proc is not mounted, among others). This means the test should actually be
if(is_selinux_enabled < 1)
{
//do selinux policy-related stuff
}
The attached patch implements this change.
Note that there is an issue open on Debian for this same problem: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=580272
However, the change recommended by Michael Svoboda does NOT work on my Gentoo system (which is not using an initrd, a point Michael mentions should work but which he has not tested). (Note that the attached patch is essentially just a stripped-down version of Michael's, the key difference being that Michael's patch removes the logic that allows init to load /proc, whereas I'm leaving that logic in place).
I have opened a bug report with Gentoo as well: https://bugs.gentoo.org/attachment.cgi?id=237335&action=edit
|