On Mon, 2004-11-15 at 11:12, Serge Hallyn wrote:
> Thanks for your help, Stephen. I've *briefly* looked around at the
> inird and /bin/init sources, and can't find an initiial policy that
> would be loaded before the root filesystem pivot_root. I expect to
> have more time at the end of this week to figure it out, though.

In Fedora, policy is loaded from the real root filesystem by /sbin/init, not from the initrd. We did use an initrd originally when we first overhauled SELinux for mainline inclusion and moved the initial policy load into userspace, but RedHat encountered practical issues with using an initrd and migrated to a patched /sbin/init. So /sbin/init is loading policy from /etc/security/selinux/policy.NN under FC2 or /etc/selinux/(strict|targeted)/policy/policy.NN under FC3. The question is whether you are subsequently loading a different policy, possibly too late, after /bin/login has already been looked up and brought incore.

-- 
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.