Markus Bartl wrote:
max wrote:
If i compile a policy on Fedora this is always set to allow, if not I
usually run into problems like your having, I don't know enough about
gentoo to know if this is supposed to be this way here or not, perhaps
someone else can supply the answer. The description in the build.conf file:
The current policy being used by Gentoo is a few months behind the one
in Fedora (for technical reasons that hopefully will be resolved soon).
But that wouldn't be causing your problem. Those dmesg warnings just
mean the kernel you're running knows about the permissions and classes
that have been added since the policy snapshot was taken. The base
policy from portage *is* bootable in enforcing mode.
I know this wont help, but i got exactly the same issue.
If i try to boot in enforcing mode, init is blocked and the boot sequence stops.
Some things to try:
1. Relabel everything. Improper file labels cause no end of problems
and *especially* in the boot process, since the wrong file context leads
to the wrong process context and everything just falls apart. The
safest way to do this is to switch to permissive mode, then do:
rlpkg -a -r
reboot
rlpkg -a -r # in case anything got created on shutdown/restart.
2. Once you've done that, check the following (still in permissive mode):
# ls -lZ /sbin/init /sbin/rc
(They should be labeled init_exec_t and initrc_exec_t, respectively.)
# cat /etc/selinux/strict/context/run_init_type
(should be run_init_t)
# ps axZ | grep init
(should be running as init_t)
# id -Z
(your user, role, and type should all match, like
staff_u:staff_r:staff_t, and not be something like kernel_t, sshd_t, etc.)
--Mike
