Re: selinux without sysvinit

On Saturday 06 November 2004 01:58, Alejandro Mery <amery@geeks.cl> wrote:
> > Yes, that should work as well, and I think some people have actually
> > used that approach in the past. But if you decide to move aside
> > /sbin/init and replace it with a small program that loads policy and
> > then runs the real init program, be careful that telinit is then
> > redirected to the real init program.
>
> i was thinking in a /sbin/seinit with proper init= on loader, hardcoded
> to execve /sbin/init and /bin/sh after that.

I've done that, it works. It's a minor PITA though, you need to have your boot loader pass init=/sbin/seinit though. If your boot loader is something like the boot loader in a Cobalt machine it's even more painful as BIOS upgrades etc can lose the boot loader config.

Best to just patch /sbin/init, I only patched init after trying all the other options and finding them to be worse.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.