Bug 208765

Summary:	kernel panic - system freeze - changed selinux-policy-strict
Product:	[Fedora] Fedora	Reporter:	C. Moffatt <the.moffatts>
Component:	selinux-policy-strict	Assignee:	Daniel Walsh <dwalsh>
Status:	CLOSED NOTABUG	QA Contact:	Ben Levenson <benl>
Severity:	urgent	Docs Contact:
Priority:	medium
Version:	5
Target Milestone:	---
Target Release:	---
Hardware:	i686
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2006-10-02 18:34:15 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description C. Moffatt 2006-10-01 19:33:58 UTC

Description of problem: System froze twice when I changed the selinux policy to
strict.  I could access anything to fix it, I had to rebuild my system twice.


Version-Release number of selected component (if applicable):
selininx-policy-strict 2.2.23-15

How reproducible: Happened twice using the kernel 2.6.17-1.2187_FC5smp, and the
other optional kernel-similar to the above kernel.


Steps to Reproduce:
1.installed selinux strict policy using kyum first time, and konsole the second time
2.Changed policy to strict in selinux
3.Rebooted-system froze twice!!!
  
Actual results:System froze had to rebuild system twice.  It couldn't kill init!

Expected results: selinux to work in a stricter/safer way.


Additional info:  here is the info the computer gave me:  /sbin/init: error
while loading shared libraries: libsepol.so.1: failed to map segment from shared
object: Permission denied  kernel panic-not syncing: Attempting to kill init!

Comment 1 Daniel Walsh 2006-10-02 18:34:15 UTC

In order to switch to strict policy, you need to follow the following steps

install selinux-policy-strict
change /etc/selinux/config to strict policy
touch /.autorelabel
reboot in permissive mode, so the relabeling will success
reboot in enforcing mode.

Good luck.