Re: You mentioned somewhere there is a step by step guide to getting the MLS policy installed on a machine?

On Thu, Apr 14, 2005 at 04:38:13PM -0400, Stephen Smalley wrote:

> 3) Rather than immediately booting the MLS-enabled kernel into multi-
> user mode, you should instead boot with enforcing=0 single to fix up the
> context on /etc/mtab, which is re-created by the shutdown while you were
> still running with selinux=0. You can run /sbin/restorecon /etc/mtab
> from single-user mode, then /usr/sbin/setenforce 1 and exit the single-
> user shell to come up multi-user.

 /etc/mtab is/was an issue (not in MLS) iirc with debian - it  was the cause of much grief - esp. when a program didn't exit  at shutdown, locked the partition (e.g. /usr), caused umount  to fail, cascade-caused /etc/mtab to not be updated, there's  a bug in /etc/init.d/mountvirtfs.sh where it incorrectly  detect(s/ed?) that /etc/mtab wasn't writeable, cascade-caused  mountvirtfs.sh to think that /usr was still mounted read-write  from the prior shutdown, and it went pear-shaped from there.

 l.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.