On Wed, 2004-11-03 at 19:54, Alejandro Mery wrote:
> > You either need to load a policy prior to running your runit program
> > (e.g. via an initrd, which is what we originally did), or modify your
> > runit program to load a policy and re-exec itself into the correct
> > security domain (as is done by the sysvinit patch).
>
> what do you think about an selinux init to load policy and replace
> itself with /sbin/init (any) after that?

Yes, that should work as well, and I think some people have actually used that approach in the past. But if you decide to move aside /sbin/init and replace it with a small program that loads policy and then runs the real init program, be careful that telinit is then redirected to the real init program.

-- 
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.