init labeling question for targeted policy

[Colin Walters]

On Sat, 2004-11-27 at 15:56 -0800, Karsten Wade wrote:

> When the kernel starts, it doesn't know anything about the status of
> SELinux until init mounts /proc and checks for the selinuxfs type. 
> Right?  

Well, no; SELinux is enabled as far as the kernel is aware (unless
selinux=0 was specified on the grub boot line), but no policy is loaded
until init starts and loads it.

> Once the kernel knows that SELinux is enabled, init is coded to rexec
> itself under whatever default domain it has.  Is that right?

init reexecutes itself if it determines SELinux is enabled and loading
the initial policy worked, and in the strict policy that will cause a
domain transition.

> And the strict policy has a rule to tell make sure init doesn't come
> back as kernel_t but as init_t?

Right, because of the domain_auto_trans you posted originally.

> Where the targeted policy aliases unconfined_t to a whole group that
> includes kernel_t and init_t.

Right.