From: jason anderssen <jna_at_vasco.com>
Date: Thu, 11 Sep 2003 15:29:19 +1000

Hi all,

I have decided to upgrade my old selinux to the latest. So I went with RH9.0 and downloaded the latest and greatest off of nsa.gov.

However, I am a little new to the initrd style of booting, and I have concerns with step 7 which is as follows:

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

7) Create an initrd with load_policy, the binary policy file, and a /linuxrc that will perform the initial policy load prior to mounting the root filesystem. For example, you might modify your mkinitrd script in a similar manner to this patch for the RH9 mkinitrd script:

• /sbin/mkinitrd- 2003-02-18 12:41:17.000000000 -0500
  +++ /sbin/mkinitrd 2003-08-05 08:45:46.000000000 -0400
  @@ -517,6 +517,12 @@ inst /sbin/insmod.static "$MNTIMAGE/bin/insmod" ln -s /sbin/nash $MNTIMAGE/sbin/modprobe

+# Binary policy file and load_policy utility for loading it.
+mkdir -p $MNTIMAGE/selinux
+mkdir -p $MNTIMAGE/etc/security/selinux
+inst /etc/security/selinux/policy.15

"$MNTIMAGE/etc/security/selinux/policy.15"
+inst /usr/sbin/load_policy "$MNTIMAGE/bin/load_policy"
+

 for MODULE in $MODULES; do

     cp $verbose -a /lib/modules/$kernel/$MODULE $MNTIMAGE/lib  done
@@ -570,6 +576,11 @@

     fi
 done

+echo "echo Loading policy" >> $RCFILE
+echo "mount -t selinuxfs none /selinux" >> $RCFILE
+echo "/bin/load_policy /etc/security/selinux/policy.15" >> $RCFILE
+echo "umount /selinux" >> $RCFILE
+

 echo "echo Mounting /proc filesystem" >> $RCFILE  echo "mount -t proc /proc /proc" >> $RCFILE

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

I find it a little confusing in the instructions, but all I think I need to understand is the following:

In the mkinitrd script supplied, which is the same as above, why does load_policy have two different paths, ie: /usr/sbin/load_policy > "$MNTIMAGE/bin/load_policy"?

what is a linuxrc?

Does anyone care to eleborate this step a bit more for me, this I would very much appreciates.

Anyways, to cut a long story short, I stuffed my installation, so re-installation has begun.

Cheers
Jason
Vasco Data Security
Brisbane Australia

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Received on Wed 10 Sep 2003 - 17:33:39 EDT