Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a bootable DVD which boots the same Kernel as the Hard Drive (which uses SELinux). I have copied /etc/selinux and all kernel modules to my ramdisk, and have tried various combinations of selinux=1 and selinux 1 with enforcing 1 and enforcing 0. as Kernel boot parameters. All files contained in the checkpolicy, libselinux, policycoreutils, selinux-policy and selinux-policy-targeted rpms have also been copied into the ramdisk tree.

After the system boots from the ramdisk, I check dmesg:

% dmesg | grep -i selinux
Kernel command line: initrd=idrd.img ramdisk_size=110476 selinux=1
SELinux: Initializing.
SELinux: Starting in permissive mode
selinux_register_security: Registering secondary module capability
SElinux: Registering netfilter hooks

But SELinux isn't running:

% /usr/sbin/getenforce
Disabled
% /usr/sbin/setenforce 1
/usr/sbin/setenforce: SELinux is disabled

Neither /var/log/messages nor /proc/kmsg hold clues.

share|improve this question

2 Answers 2

up vote 1 down vote accepted

What's not immediately obvious is that SELINUX requires selinuxfs to be mounted. When mounted, selinuxfs appears in /proc/mounts but not in the output of the mount command.

Mounting selinuxfs in my initrd did the trick

share|improve this answer

Not really sure. What distro, out of curiosity? Perhaps enforcing=1 will do the trick. Dan Walsh is pretty knowledgeable on this, I think he does the policy for SELinux @ Fedora. I also base it off the Fedora Docs wiki page.

share|improve this answer
    
This is for RHEL5.4, I already saw the Dan Walsh article. I've tried adding enforcing=0. My Boot CD mounts the hard drive and changes files, and needs to do things without interference from SELinux. Relabeling everything is not an option for this, so I was hoping to run the restorecond daemon to clean things up. There are too many changes for running restorecon on individual files to practical. The restorecond daemon will not run unless SELinux is enabled, so I need to run it in permissive mode. –  JeffG Mar 3 '11 at 23:47
    
@JeffG Sorry I could not be of more help, I was just taking a shot in the dark there. –  ajstein Mar 4 '11 at 12:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.