1

I have a bootable DVD which boots the same Kernel as the Hard Drive (which uses SELinux). I have copied /etc/selinux and all kernel modules to my ramdisk, and have tried various combinations of selinux=1 and selinux 1 with enforcing 1 and enforcing 0. as Kernel boot parameters. All files contained in the checkpolicy, libselinux, policycoreutils, selinux-policy and selinux-policy-targeted rpms have also been copied into the ramdisk tree.

After the system boots from the ramdisk, I check dmesg:

% dmesg | grep -i selinux
Kernel command line: initrd=idrd.img ramdisk_size=110476 selinux=1
SELinux: Initializing.
SELinux: Starting in permissive mode
selinux_register_security: Registering secondary module capability
SElinux: Registering netfilter hooks

But SELinux isn't running:

% /usr/sbin/getenforce
Disabled
% /usr/sbin/setenforce 1
/usr/sbin/setenforce: SELinux is disabled

Neither /var/log/messages nor /proc/kmsg hold clues.

Improve this question

2 Answers 2

Reset to default
1

What's not immediately obvious is that SELINUX requires selinuxfs to be mounted. When mounted, selinuxfs appears in /proc/mounts but not in the output of the mount command.

Mounting selinuxfs in my initrd did the trick

Improve this answer
0

Not really sure. What distro, out of curiosity? Perhaps enforcing=1 will do the trick. Dan Walsh is pretty knowledgeable on this, I think he does the policy for SELinux @ Fedora. I also base it off the Fedora Docs wiki page.

Improve this answer
2
  • This is for RHEL5.4, I already saw the Dan Walsh article. I've tried adding enforcing=0. My Boot CD mounts the hard drive and changes files, and needs to do things without interference from SELinux. Relabeling everything is not an option for this, so I was hoping to run the restorecond daemon to clean things up. There are too many changes for running restorecon on individual files to practical. The restorecond daemon will not run unless SELinux is enabled, so I need to run it in permissive mode.
    – JeffG
    Mar 3, 2011 at 23:47
  • @JeffG Sorry I could not be of more help, I was just taking a shot in the dark there.
    – songei2f
    Mar 4, 2011 at 12:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .