init labeling question for targeted policy

[Karsten Wade]

My question about the targeted policy presumes that init re-execs itself
after loading the policy, whereby it picks up the unconfined_t domain
from the policy, as defined by a rule in
/etc/selinux/targeted/src/policy/domains/unconfined.te.

  role system_r types unconfined_t;

What rule tells init to re-exec itself in the targeted policy?  Or is
init doing something differently now?

Here is how far I've gotten in figuring this out.

In the strict policy there is an explicit transition rule for init. The
file programs/misc/kernel.te has this rule:

  domain_auto_trans(kernel_t, init_exec_t, init_t)

In the targeted policy, kernel.te is in domains/misc/unused, so is not
called into play.  Correct?  The transition behavior certainly isn't
used, i.e., init transitions to unconfined_t instead of init_t. 
Therefore, I'm looking for a default behavior that init falls back on
since it doesn't have specific SELinux coverage.

In macros/global_macros.te the macro domain_auto_trans(init_t,
$1_exec_t, $1_t) is defined.  However, I don't find that macro used,
i.e., domain_auto_trans(init_t) or somesuch.  In addition, I'm not even
sure that init would be in the domain init_t to qualify for this macro
since in targeted it's in unconfined_t.

In define(`unconfined_domain',  there is this rule:

  allow $1 self:process transition;

That says that init is allowed to transition to itself, but it doesn't
tell init to do the transition and seems otherwise unrelated.

Which one of these paths, if any, is leading in the right direction?

thx - Karsten
-- 
Karsten Wade, RHCE, Tech Writer
a lemon is just a melon in disguise
http://people.redhat.com/kwade/
gpg fingerprint: 2680 DBFD D968 3141 0115  5F1B D992 0E06 AD0E 0C41