init labeling question for targeted policy

[Karsten Wade]

On Sat, 2004-11-27 at 09:30, Colin Walters wrote:
> On Sat, 2004-11-27 at 05:03 -0800, Karsten Wade wrote:
> 
> > init is started with the unconfined_t context?  Was this behavior that
> > changed between FC2 and FC3, or am I missing something fundamental here?
> 
> I think the distinction is just targeted vs. strict policy; FC2 didn't
> have targeted.  So basically everything just starts out as unconfined,
> including the kernel, and then transitions happen for a few specific
> domains like httpd_t.  For strict policy, I think it's pretty much as
> Russell described it.  Does that answer your question?

Almost, as we work backwards. :)

When the kernel starts, it doesn't know anything about the status of
SELinux until init mounts /proc and checks for the selinuxfs type. 
Right?  

Once the kernel knows that SELinux is enabled, init is coded to rexec
itself under whatever default domain it has.  Is that right?

And the strict policy has a rule to tell make sure init doesn't come
back as kernel_t but as init_t?

Where the targeted policy aliases unconfined_t to a whole group that
includes kernel_t and init_t.

thx - Karsten
-- 
Karsten Wade, RHCE, Tech Writer
a lemon is just a melon in disguise
http://people.redhat.com/kwade/
gpg fingerprint: 2680 DBFD D968 3141 0115  5F1B D992 0E06 AD0E 0C41