Bug 861145 - System won't boot in MLS mode
System won't boot in MLS mode
Status: CLOSED CURRENTRELEASE
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
18
Unspecified Unspecified
high Severity high
: ---
: ---
Assigned To: Miroslav Grepl
Fedora Extras Quality Assurance
:
Depends On:
Blocks: 853068
  Show dependency treegraph
 
Reported: 2012-09-27 12:00 EDT by Steve Grubb
Modified: 2013-04-25 14:55 EDT (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-04-25 14:55:44 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Steve Grubb 2012-09-27 12:00:43 EDT
Description of problem:
When MLS policy is installed and configured to be on, the system does not boot.
Comment 1 Miroslav Grepl 2012-10-01 08:03:17 EDT
Ok, I was able to get F18-minimal install to boot in permissive mode.

I see a lot AVC msgs related to /dev/log as kernel_t. So all domains are not able to send to kernel_t because this domain is not mls trusted object.
Comment 2 Daniel Walsh 2012-10-01 10:26:37 EDT
I think we need to move some of the syslog and dbus policies into the "base" modules for minimal.
Comment 3 Stephan Mueller 2012-10-01 14:31:27 EDT
Not sure whether I hijack the bug, but I see some more MLS related concerns:

What about systemd? As systemd is much different in architecture than SysV init, I thought that also the interactions that systemd has causes some problems.

/etc/security/namespace.conf contains $HOME/$USER.inst as backend for $HOME -- in RHEL 6 we had /home/home-inst; now, is that directory automatically created with the right permissions -- home-inst had the DAC permissions of 0 and some special SELinux labels?


the suggested configuration in the default namespace.conf wrt /tmp is not equivalent to the old RHEL6 config -- is this intentional?:
/tmp     /tmp-parent/tmp-inst/          level     root,adm
/dev/shm /dev/shm               tmpfs

when configuring the old polyinstantiated /tmp dirs, I get the following error:
[root@fedora18 ~]# semanage fcontext -a -e /tmp /tmp-parent
/sbin/semanage: File spec /tmp-parent conflicts with equivalency rule '/tmp-parent/tmp-inst/ /tmp'

who mounts /dev/shm and /run? They need polyinstantiated dirs too, i.e. we need to disable the regular mount during boot and replace it with the line in namespace.conf using the example above for /dev/shm
Comment 4 Miroslav Grepl 2013-04-25 14:55:44 EDT
We have a booting MLS system. I would open a new bug for another issues if needed.

Note You need to log in before you can comment on or make changes to this bug.