Initial policy load from load_policy
PATCH 1/1 Initial policy load from load_policy
The below patch adds a -i option to load_policy to perform the initial policy load. The inital policy load is currently done in systems using sysvinit by init itself, which then re-exec's itself. Ubuntu uses upstart instead of sysvinit. In talks with the Ubuntu folks, they'd prefer to load policy from initramfs before upstart starts rather than patching upstart.
---
load_policy.8 | 19 ++++++++++++++++++- load_policy.c | 29 +++++++++++++++++++++++++---- 2 files changed, 43 insertions(+), 5 deletions(-)
load_policy/load_policy.c (working copy) renamed from load_policy/load_policy.c (revision 2679) +0 -0
@@ -19,13 +19,13 @@
void usage(char *progname)
{
- fprintf(stderr, _("usage: %s [-q]\n"), progname);
+ fprintf(stderr, _("usage: %s [-qi]\n"), progname);
exit(1);
}int main(int argc, char **argv)
{
- int ret, opt, quiet = 0, nargs;
+ int ret, opt, quiet = 0, nargs, init=0, enforce=0;
#ifdef USE_NLS
setlocale(LC_ALL, "");
@@ -33,7 +33,7 @@
textdomain(PACKAGE);#endif
- while ((opt = getopt(argc, argv, "bq")) > 0) {
+ while ((opt = getopt(argc, argv, "bqi")) > 0) {
switch (opt) {
case 'b':
fprintf(stderr, "%s: Warning! The -b option is no longer
supported, booleans are always preserved across reloads. Continuing...\n",
@@ -43,6 +43,9 @@
quiet = 1;
sepol_debug(0);
break;
+ case 'i':
+ init = 1;
+ break;
default:
usage(argv[0]);
}
@@ -62,7 +65,25 @@
argv[0], argv[optind++]);
}- ret = selinux_mkload_policy(1);
+ if (init) {
+ if (is_selinux_enabled() == 1) {
+ /* SELinux is already enabled, we should not do an initial load again */
+ fprintf(stderr,
+ _("%s: Policy is already loaded and initial load requested\n"),
+ argv[0]);
+ exit(2);
+ }
+ ret = selinux_init_load_policy(&enforce);
+ if (ret != 0 ) {+ if (enforce > 0) {
+ /* SELinux in enforcing mode but load_policy failed */
+ exit(3);
+ }
+ }
+ }
+ else {
+ ret = selinux_mkload_policy(1);
+ }
if (ret < 0) {
fprintf(stderr, _("%s: Can't load policy: %s\n"),
argv[0], strerror(errno));load_policy/load_policy.8 (working copy) renamed from load_policy/load_policy.8 (revision 2679) +0 -0
@@ -4,7 +4,7 @@
.SH SYNOPSIS
.B load_policy
-[-q]
+[-qi]
.br
.SH DESCRIPTION
.PP
@@ -17,7 +17,24 @@
.TP
.B \-q
suppress warning messages.
+.TP
+.B \-i
+inital policy load. Only use this if this is the first time policy is being loaded since boot (usually called from initramfs).
+.SH "EXIT STATUS"
+.TP
+.B 0
+Success
+.TP
+.B 1
+Invalid option
+.TP
+.B 2
+Policy load failed
+.TP
+.B 3
+Initial policy load failed and enforcing mode requested +
.SH SEE ALSO
.B booleans
(8),
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 9 lines · Chad Sellers
The below patch adds a -i option to
load_policyto perform the initial policy load. The inital policy load is currently done in systems using sysvinit by init itself, which then re-exec's itself. Ubuntu uses upstart instead of sysvinit. In talks with the Ubuntu folks, they'd prefer to load policy from initramfs before upstart starts rather than patching upstart.Signed-off-by Chad Sellers <[email protected]>---
Quoted 101 lines
load_policy.8 | 19 ++++++++++++++++++- load_policy.c | 29 +++++++++++++++++++++++++---- 2 files changed, 43 insertions(+), 5 deletions(-)Index:
policycoreutils/load_policy/load_policy.c
===================================================================load_policy/load_policy.c (working copy) @@ renamed from load_policy/load_policy.c (revision 2679) +3
-4-19,13 +19,13 @@ void usage(char *progname) { - fprintf(stderr, _("usage: %s [-q]\n"), progname); + fprintf(stderr, _("usage: %s [-qi]\n"), progname); exit(1); } int main(int argc, char **argv) { - int ret, opt, quiet = 0, nargs; + int ret, opt, quiet = 0, nargs, init=0, enforce=0; #ifdef USE_NLS setlocale(LC_ALL, "");@@ -33,7 +33,7 @@ textdomain(PACKAGE); #endif - while ((opt = getopt(argc, argv, "bq")) > 0) { + while ((opt = getopt(argc, argv, "bqi")) > 0) { switch (opt) { case 'b': fprintf(stderr, "%s: Warning! The -b option isno longer supported, booleans are always preserved across reloads. Continuing...\n", @@ -43,6 +43,9 @@
quiet = 1; sepol_debug(0); break;load_policy/load_policy.c (working copy) @@ renamed from load_policy/load_policy.c (revision 2679) +6
-1+ case 'i': + init = 1; + break; default: usage(argv[0]); }@@ -62,7 +65,25 @@ argv[0], argv[optind++]); } - ret = selinux_mkload_policy(1); + if (init) { + if (is_selinux_enabled() == 1) { + /* SELinux is already enabled, we should not doan initial
load again */load_policy/load_policy.c (working copy) @@ renamed from load_policy/load_policy.c (revision 2679) +2
-0+ fprintf(stderr, + _("%s: Policy is already loaded and initial loadrequested\n"), + argv[0]);
load_policy/load_policy.c (working copy) @@ renamed from load_policy/load_policy.c (revision 2679) +6
-0+ exit(2); + } + ret = selinux_init_load_policy(&enforce); + if (ret != 0 ) { + if (enforce > 0) { + /* SELinux in enforcing mode but load_policyfailed */
load_policy/load_policy.c (working copy) @@ renamed from load_policy/load_policy.c (revision 2679) +7
-0+ exit(3); + } + } + } + else { + ret = selinux_mkload_policy(1); + } if (ret < 0) { fprintf(stderr, _("%s: Can't load policy: %s\n"), argv[0], strerror(errno));Index: policycoreutils/load_policy/load_policy.8
===================================================================load_policy/load_policy.8 (working copy) @@ renamed from load_policy/load_policy.8 (revision 2679) +4
-2-4,7 +4,7 @@ .SH SYNOPSIS .B load_policy -[-q] +[-qi] .br .SH DESCRIPTION .PP@@ -17,7 +17,24 @@ .TP .B \-q suppress warning messages. +.TP +.B \-i +inital policy load. Only use this if this is the first time policy isbeing loaded since boot (usually called from initramfs).
+.SH "EXIT STATUS"
+.TP
+.B 0load_policy/load_policy.8 (working copy) @@ renamed from load_policy/load_policy.8 (revision 2679) +3
-0+Success +.TP +.B 1
load_policy/load_policy.8 (working copy) @@
Quoted 10 lines
load_policy/load_policy.8 (working copy) @@ renamed from load_policy/load_policy.8 (revision 2679) +7
-0+Invalid option +.TP +.B 2 +Policy load failed +.TP +.B 3 +Initial policy load failed and enforcing mode requested + .SH SEE ALSO .B booleans (8),
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 66 lines · Chad Sellers
The below patch adds a -i option to
load_policyto perform the initial policy load. The inital policy load is currently done in systems using sysvinit by init itself, which then re-exec's itself. Ubuntu uses upstart instead of sysvinit. In talks with the Ubuntu folks, they'd prefer to load policy from initramfs before upstart starts rather than patching upstart.Signed-off-by Chad Sellers <[email protected]>---
load_policy.8 | 19 ++++++++++++++++++- load_policy.c | 29 +++++++++++++++++++++++++---- 2 files changed, 43 insertions(+), 5 deletions(-)Index:
policycoreutils/load_policy/load_policy.c
===================================================================load_policy/load_policy.c (working copy) renamed from load_policy/load_policy.c (revision 2679) +3
-3@@ -19,13 +19,13 @@ void usage(char *progname) { - fprintf(stderr, _("usage: %s [-q]\n"), progname); + fprintf(stderr, _("usage: %s [-qi]\n"), progname); exit(1); } int main(int argc, char **argv) { - int ret, opt, quiet = 0, nargs; + int ret, opt, quiet = 0, nargs, init=0, enforce=0; #ifdef USE_NLS setlocale(LC_ALL, "");@@ -33,7 +33,7 @@ textdomain(PACKAGE); #endif - while ((opt = getopt(argc, argv, "bq")) > 0) { + while ((opt = getopt(argc, argv, "bqi")) > 0) { switch (opt) { case 'b': fprintf(stderr, "%s: Warning! The -b option is no longersupported, booleans are always preserved across reloads. Continuing...\n",
load_policy/load_policy.c (working copy) renamed from load_policy/load_policy.c (revision 2679) +6
-1@@ -43,6 +43,9 @@ quiet = 1; sepol_debug(0); break; + case 'i': + init = 1; + break; default: usage(argv[0]); }@@ -62,7 +65,25 @@ argv[0], argv[optind++]); } - ret = selinux_mkload_policy(1); + if (init) { + if (is_selinux_enabled() == 1) { + /* SELinux is already enabled, we should not do an initialload again */
load_policy/load_policy.c (working copy) renamed from load_policy/load_policy.c (revision 2679) +2
-0+ fprintf(stderr, + _("%s: Policy is already loaded and initial loadrequested\n"),
load_policy/load_policy.c (working copy)
Quoted 7 lines
load_policy/load_policy.c (working copy) renamed from load_policy/load_policy.c (revision 2679) +7
-0+ argv[0]); + exit(2); + } + ret = selinux_init_load_policy(&enforce); + if (ret != 0 ) { + if (enforce > 0) { + /* SELinux in enforcing mode but load_policy failed */
An error message here would be helpful, assuming that such error messages are displayed at all on the console.
How do you plan to handle an error in the caller? System should be halted in this case.
Quoted 55 lines
load_policy/load_policy.c (working copy) renamed from load_policy/load_policy.c (revision 2679) +7
-0+ exit(3); + } + } + } + else { + ret = selinux_mkload_policy(1); + } if (ret < 0) { fprintf(stderr, _("%s: Can't load policy: %s\n"), argv[0], strerror(errno));Index: policycoreutils/load_policy/load_policy.8
===================================================================load_policy/load_policy.8 (working copy) renamed from load_policy/load_policy.8 (revision 2679) +4
-1@@ -4,7 +4,7 @@ .SH SYNOPSIS .B load_policy -[-q] +[-qi] .br .SH DESCRIPTION .PP@@ -17,7 +17,24 @@ .TP .B \-q suppress warning messages. +.TP +.B \-i +inital policy load. Only use this if this is the first time policy isbeing loaded since boot (usually called from initramfs).
+.SH "EXIT STATUS"
+.TP
+.B 0load_policy/load_policy.8 (working copy) renamed from load_policy/load_policy.8 (revision 2679) +11
-1+Success +.TP +.B 1 +Invalid option +.TP +.B 2 +Policy load failed +.TP +.B 3 +Initial policy load failed and enforcing mode requested + .SH SEE ALSO .B booleans (8), --This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Signature · 8 lines
Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 69 lines · Stephen Smalley
Quoted 68 lines · Chad Sellers
The below patch adds a -i option to
load_policyto perform the initial policy load. The inital policy load is currently done in systems using sysvinit by init itself, which then re-exec's itself. Ubuntu uses upstart instead of sysvinit. In talks with the Ubuntu folks, they'd prefer to load policy from initramfs before upstart starts rather than patching upstart.Signed-off-by Chad Sellers <[email protected]>---
load_policy.8 | 19 ++++++++++++++++++- load_policy.c | 29 +++++++++++++++++++++++++---- 2 files changed, 43 insertions(+), 5 deletions(-)Index:
policycoreutils/load_policy/load_policy.c
===================================================================load_policy/load_policy.c (working copy) renamed from load_policy/load_policy.c (revision 2679) +3
-3@@ -19,13 +19,13 @@ void usage(char *progname) { - fprintf(stderr, _("usage: %s [-q]\n"), progname); + fprintf(stderr, _("usage: %s [-qi]\n"), progname); exit(1); } int main(int argc, char **argv) { - int ret, opt, quiet = 0, nargs; + int ret, opt, quiet = 0, nargs, init=0, enforce=0; #ifdef USE_NLS setlocale(LC_ALL, "");@@ -33,7 +33,7 @@ textdomain(PACKAGE); #endif - while ((opt = getopt(argc, argv, "bq")) > 0) { + while ((opt = getopt(argc, argv, "bqi")) > 0) { switch (opt) { case 'b': fprintf(stderr, "%s: Warning! The -b option is no longersupported, booleans are always preserved across reloads. Continuing...\n",
load_policy/load_policy.c (working copy) renamed from load_policy/load_policy.c (revision 2679) +6
-1@@ -43,6 +43,9 @@ quiet = 1; sepol_debug(0); break; + case 'i': + init = 1; + break; default: usage(argv[0]); }@@ -62,7 +65,25 @@ argv[0], argv[optind++]); } - ret = selinux_mkload_policy(1); + if (init) { + if (is_selinux_enabled() == 1) { + /* SELinux is already enabled, we should not do an initialload again */
load_policy/load_policy.c (working copy) renamed from load_policy/load_policy.c (revision 2679) +2
-0+ fprintf(stderr, + _("%s: Policy is already loaded and initial loadrequested\n"),
load_policy/load_policy.c (working copy) renamed from load_policy/load_policy.c (revision 2679) +2
-0+ argv[0]); + exit(2);
Quoted 9 lines
load_policy/load_policy.c (working copy)
Quoted 5 lines
load_policy/load_policy.c (working copy) renamed from load_policy/load_policy.c (revision 2679) +5
-0+ } + ret = selinux_init_load_policy(&enforce); + if (ret != 0 ) { + if (enforce > 0) { + /* SELinux in enforcing mode but load_policy failed */An error message here would be helpful, assuming that such error messages are displayed at all on the console.
I was planning to just display the error in the caller, as the caller will be the one to halt the system (not load_policy).
Quoted 3 lines
How do you plan to handle an error in the caller? System should be halted in this case.
I plan to check the return value in the caller and halt in this case. That's why I added a new return value (3). Basically, something like this:
set +e
chroot /root load_policy -i
RET=$?
if [ $RET -eq 3 ]; then echo "SELinux policy load failed and enforcing mode requested, halting now"; halt;
elif [ $RET -ne 0 ]; then echo "SELinux policy load failed, continuing"; fi
Quoted 51 lines
Quoted 51 lines
load_policy/load_policy.c (working copy) renamed from load_policy/load_policy.c (revision 2679) +7
-0+ exit(3); + } + } + } + else { + ret = selinux_mkload_policy(1); + } if (ret < 0) { fprintf(stderr, _("%s: Can't load policy: %s\n"), argv[0], strerror(errno));Index: policycoreutils/load_policy/load_policy.8
===================================================================load_policy/load_policy.8 (working copy) renamed from load_policy/load_policy.8 (revision 2679) +4
-1@@ -4,7 +4,7 @@ .SH SYNOPSIS .B load_policy -[-q] +[-qi] .br .SH DESCRIPTION .PP@@ -17,7 +17,24 @@ .TP .B \-q suppress warning messages. +.TP +.B \-i +inital policy load. Only use this if this is the first time policy isbeing loaded since boot (usually called from initramfs).
+.SH "EXIT STATUS"
+.TP
+.B 0load_policy/load_policy.8 (working copy) renamed from load_policy/load_policy.8 (revision 2679) +11
-0+Success +.TP +.B 1 +Invalid option +.TP +.B 2 +Policy load failed +.TP +.B 3 +Initial policy load failed and enforcing mode requested + .SH SEE ALSO .B booleans (8),
Quoted 4 lines
Quoted 4 lines
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 4 lines · Chad Sellers
Quoted 4 lines
Quoted 4 lines
sysvinit by init itself, which then re-exec's itself. Ubuntu uses upstart instead of sysvinit. In talks with the Ubuntu folks, they'd prefer to load policy from initramfs before upstart starts rather than patching upstart
Of course this means that you might need policy to allow the initramfs to do things. But I guess an option is to just do it after the pivot_root but before executing upstart.
Your idea of running load_policy is better than the previous incarnation of this which had the policy loaded from a file in the initramfs (which meant an initramfs rebuild was required for significant policy changes and having a cut down policy for it was desired).
One thing that the Ubuntu people might consider is whether they want their distribution to work on systems that don't have an initramfs. For example on Cobalt hardware the kernel is loaded by the BIOS and there is no support for loading an initramfs. There are some new developments in terms of Linux BIOS etc in the pipeline at the moment, it would be bad to exclude them from SE Linux support. One of the reasons for modifying init was to support such platforms (which incidentally includes a significant range of embedded devices).
Signature · 9 lines
[email protected] http://etbe.coker.com.au/ My Blog http://www.coker.com.au/sponsorship.html Sponsoring Free Software development -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 12 lines · Chad Sellers
Quoted 9 lines · Stephen Smalley
Quoted 7 lines · Chad Sellers
The below patch adds a -i option to
load_policyto perform the initial policy load. The inital policy load is currently done in systems using sysvinit by init itself, which then re-exec's itself. Ubuntu uses upstart instead of sysvinit. In talks with the Ubuntu folks, they'd prefer to load policy from initramfs before upstart starts rather than patching upstart.
Quoted 2 lines
Quoted 2 lines
Quoted 2 lines
Signed-off-by Chad Sellers <[email protected]>
Is this ready to be merged or are there outstanding issues?
Quoted 141 lines
Quoted 60 lines
Quoted 60 lines
---
load_policy.8 | 19 ++++++++++++++++++- load_policy.c | 29 +++++++++++++++++++++++++---- 2 files changed, 43 insertions(+), 5 deletions(-)Index:
policycoreutils/load_policy/load_policy.c
===================================================================load_policy/load_policy.c (working copy) renamed from load_policy/load_policy.c (revision 2679) +3
-3@@ -19,13 +19,13 @@ void usage(char *progname) { - fprintf(stderr, _("usage: %s [-q]\n"), progname); + fprintf(stderr, _("usage: %s [-qi]\n"), progname); exit(1); } int main(int argc, char **argv) { - int ret, opt, quiet = 0, nargs; + int ret, opt, quiet = 0, nargs, init=0, enforce=0; #ifdef USE_NLS setlocale(LC_ALL, "");@@ -33,7 +33,7 @@ textdomain(PACKAGE); #endif - while ((opt = getopt(argc, argv, "bq")) > 0) { + while ((opt = getopt(argc, argv, "bqi")) > 0) { switch (opt) { case 'b': fprintf(stderr, "%s: Warning! The -b option is no longersupported, booleans are always preserved across reloads. Continuing...\n",
load_policy/load_policy.c (working copy) renamed from load_policy/load_policy.c (revision 2679) +6
-1@@ -43,6 +43,9 @@ quiet = 1; sepol_debug(0); break; + case 'i': + init = 1; + break; default: usage(argv[0]); }@@ -62,7 +65,25 @@ argv[0], argv[optind++]); } - ret = selinux_mkload_policy(1); + if (init) { + if (is_selinux_enabled() == 1) { + /* SELinux is already enabled, we should not do an initialload again */
load_policy/load_policy.c (working copy) renamed from load_policy/load_policy.c (revision 2679) +2
-0+ fprintf(stderr, + _("%s: Policy is already loaded and initial loadrequested\n"),
load_policy/load_policy.c (working copy) renamed from load_policy/load_policy.c (revision 2679) +2
-0+ argv[0]); + exit(2);Quoted 10 lines
load_policy/load_policy.c (working copy)
Quoted 6 lines
load_policy/load_policy.c (working copy) renamed from load_policy/load_policy.c (revision 2679) +5
-0+ } + ret = selinux_init_load_policy(&enforce); + if (ret != 0 ) { + if (enforce > 0) { + /* SELinux in enforcing mode but load_policy failed */An error message here would be helpful, assuming that such error messages are displayed at all on the console.
I was planning to just display the error in the caller, as the caller will be the one to halt the system (not
load_policy).Quoted 4 lines
How do you plan to handle an error in the caller? System should be halted in this case.
I plan to check the return value in the caller and halt in this case. That's why I added a new return value (3). Basically, something like this:
set +e
chroot /rootload_policy-i
RET=$?
if [ $RET -eq 3 ]; then echo "SELinux policy load failed and enforcing mode requested, halting now"; halt;
elif [ $RET -ne 0 ]; then echo "SELinux policy load failed, continuing"; fiQuoted 51 lines
Quoted 51 lines
load_policy/load_policy.c (working copy) renamed from load_policy/load_policy.c (revision 2679) +7
-0+ exit(3); + } + } + } + else { + ret = selinux_mkload_policy(1); + } if (ret < 0) { fprintf(stderr, _("%s: Can't load policy: %s\n"), argv[0], strerror(errno));Index: policycoreutils/load_policy/load_policy.8
===================================================================load_policy/load_policy.8 (working copy) renamed from load_policy/load_policy.8 (revision 2679) +4
-1@@ -4,7 +4,7 @@ .SH SYNOPSIS .B load_policy -[-q] +[-qi] .br .SH DESCRIPTION .PP@@ -17,7 +17,24 @@ .TP .B \-q suppress warning messages. +.TP +.B \-i +inital policy load. Only use this if this is the first time policy isbeing loaded since boot (usually called from initramfs).
+.SH "EXIT STATUS"
+.TP
+.B 0load_policy/load_policy.8 (working copy) renamed from load_policy/load_policy.8 (revision 2679) +11
-0+Success +.TP +.B 1 +Invalid option +.TP +.B 2 +Policy load failed +.TP +.B 3 +Initial policy load failed and enforcing mode requested + .SH SEE ALSO .B booleans (8),
Quoted 14 lines
Quoted 5 lines
Quoted 5 lines
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 13 lines · Joshua Brindle
Quoted 12 lines · Chad Sellers
Quoted 9 lines · Stephen Smalley
Quoted 7 lines · Chad Sellers
The below patch adds a -i option to
load_policyto perform the initial policy load. The inital policy load is currently done in systems using sysvinit by init itself, which then re-exec's itself. Ubuntu uses upstart instead of sysvinit. In talks with the Ubuntu folks, they'd prefer to load policy from initramfs before upstart starts rather than patching upstart.
Quoted 4 lines
Quoted 2 lines
Quoted 2 lines
Quoted 2 lines
Signed-off-by Chad Sellers <[email protected]>Is this ready to be merged or are there outstanding issues?
I'd still suggest adding an error message to that code path - silently exiting with an error status considered confusing, even if the initial user will be checking the exit status and providing an error message itself.
Quoted 163 lines
Quoted 142 lines
Quoted 61 lines
Quoted 61 lines
---
load_policy.8 | 19 ++++++++++++++++++- load_policy.c | 29 +++++++++++++++++++++++++---- 2 files changed, 43 insertions(+), 5 deletions(-)Index:
policycoreutils/load_policy/load_policy.c
===================================================================load_policy/load_policy.c (working copy) renamed from load_policy/load_policy.c (revision 2679) +3
-3@@ -19,13 +19,13 @@ void usage(char *progname) { - fprintf(stderr, _("usage: %s [-q]\n"), progname); + fprintf(stderr, _("usage: %s [-qi]\n"), progname); exit(1); } int main(int argc, char **argv) { - int ret, opt, quiet = 0, nargs; + int ret, opt, quiet = 0, nargs, init=0, enforce=0; #ifdef USE_NLS setlocale(LC_ALL, "");@@ -33,7 +33,7 @@ textdomain(PACKAGE); #endif - while ((opt = getopt(argc, argv, "bq")) > 0) { + while ((opt = getopt(argc, argv, "bqi")) > 0) { switch (opt) { case 'b': fprintf(stderr, "%s: Warning! The -b option is no longersupported, booleans are always preserved across reloads. Continuing...\n",
load_policy/load_policy.c (working copy) renamed from load_policy/load_policy.c (revision 2679) +6
-1@@ -43,6 +43,9 @@ quiet = 1; sepol_debug(0); break; + case 'i': + init = 1; + break; default: usage(argv[0]); }@@ -62,7 +65,25 @@ argv[0], argv[optind++]); } - ret = selinux_mkload_policy(1); + if (init) { + if (is_selinux_enabled() == 1) { + /* SELinux is already enabled, we should not do an initialload again */
load_policy/load_policy.c (working copy) renamed from load_policy/load_policy.c (revision 2679) +2
-0+ fprintf(stderr, + _("%s: Policy is already loaded and initial loadrequested\n"),
load_policy/load_policy.c (working copy) renamed from load_policy/load_policy.c (revision 2679) +2
-0+ argv[0]); + exit(2);Quoted 10 lines
load_policy/load_policy.c (working copy)
Quoted 6 lines
load_policy/load_policy.c (working copy) renamed from load_policy/load_policy.c (revision 2679) +5
-0+ } + ret = selinux_init_load_policy(&enforce); + if (ret != 0 ) { + if (enforce > 0) { + /* SELinux in enforcing mode but load_policy failed */An error message here would be helpful, assuming that such error messages are displayed at all on the console.
I was planning to just display the error in the caller, as the caller will be the one to halt the system (not
load_policy).Quoted 4 lines
How do you plan to handle an error in the caller? System should be halted in this case.
I plan to check the return value in the caller and halt in this case. That's why I added a new return value (3). Basically, something like this:
set +e
chroot /rootload_policy-i
RET=$?
if [ $RET -eq 3 ]; then echo "SELinux policy load failed and enforcing mode requested, halting now"; halt;
elif [ $RET -ne 0 ]; then echo "SELinux policy load failed, continuing"; fiQuoted 51 lines
Quoted 51 lines
load_policy/load_policy.c (working copy) renamed from load_policy/load_policy.c (revision 2679) +7
-0+ exit(3); + } + } + } + else { + ret = selinux_mkload_policy(1); + } if (ret < 0) { fprintf(stderr, _("%s: Can't load policy: %s\n"), argv[0], strerror(errno));Index: policycoreutils/load_policy/load_policy.8
===================================================================load_policy/load_policy.8 (working copy) renamed from load_policy/load_policy.8 (revision 2679) +4
-1@@ -4,7 +4,7 @@ .SH SYNOPSIS .B load_policy -[-q] +[-qi] .br .SH DESCRIPTION .PP@@ -17,7 +17,24 @@ .TP .B \-q suppress warning messages. +.TP +.B \-i +inital policy load. Only use this if this is the first time policy isbeing loaded since boot (usually called from initramfs).
+.SH "EXIT STATUS"
+.TP
+.B 0load_policy/load_policy.8 (working copy) renamed from load_policy/load_policy.8 (revision 2679) +11
-0+Success +.TP +.B 1 +Invalid option +.TP +.B 2 +Policy load failed +.TP +.B 3 +Initial policy load failed and enforcing mode requested + .SH SEE ALSO .B booleans (8),Quoted 14 lines
Quoted 5 lines
Quoted 5 lines
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Signature · 8 lines
Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.