Help: Which file invokes policy configuration in RHEl4?

matrixdipu · 02-29-2008, 12:27 AM

Hi,
I am working RHEL4 and want to know which file invokes the /etc/selinux/targeted/policy/policy.<ver> i.e a policy configuration file?
I have to make change to the interface file.
Thanks

unSpawn · 02-29-2008, 05:54 AM

IIRC with "targeted" policy if you want to make changes you write a local policy that overrules whatever necessary?

matrixdipu · 02-29-2008, 06:24 AM

Yes it's correct that we can't have Mandatory access control(MAC) over all the resources in the targeted mode but still we can have MAC over some Deamons like httpd, dhcpd.
For more information

http://www.redhat.com/magazine/006ap...tures/selinux/

But the real question is still there which file invokes Policy in RHEL?

alan_ri · 02-29-2008, 08:17 AM

The config file,but it looks to me that you don't have your policy configured and that's way you can't see it.

matrixdipu · 03-02-2008, 10:11 PM

The Policy has been configured and I can view it or can change it any time. The thing I want to know which file or script invokes or starts the policy configuration file.

alan_ri · 03-03-2008, 08:26 AM

Kernel does and then it pass it on to init.

matrixdipu · 03-03-2008, 10:04 PM

Exactly the Kernel does and pass it on to init. I am finding out which file in kernel loads/invokes policy before passing it on to init.I have make changes to that file. If anyone finds it plz let me know. Thanks.

unSpawn · 03-05-2008, 01:37 AM

Moved: This thread is more suitable in the kernel forum and has been moved accordingly to help your thread/question get the exposure it deserves.

unSpawn · 03-05-2008, 06:36 PM

Quote:

Originally Posted by matrixdipu

I am finding out which file in kernel loads/invokes policy before passing it on to init.I have make changes to that file.

Apparently init does with load_policy(), see IBM Developerworks: SELinux from scratch.

matrixdipu · 03-06-2008, 12:46 AM

Thanks for the information. I have got some additional information regarding the loading of policy.

In the first step kernel checks for the version of policy in the file /selinux/policyvers.

Next part is done by init, init determines which policy is active in the /etc/selinux/config and then
loads the associated policy file at /etc/selinux/targeted/policy/policy.<ver>

unSpawn · 03-06-2008, 04:43 AM

Quote:

Originally Posted by matrixdipu

In the first step kernel checks for the version of policy in the file /selinux/policyvers.

Could you post that documents URI? I was under the impression you could only access the /selinux filesystem only once init made it available?

matrixdipu · 03-06-2008, 04:56 AM

Quote:

Originally Posted by unSpawn

Could you post that documents URI? I was under the impression you could only access the /selinux filesystem only once init made it available?

This is the URI:

http://www.redhat.com/docs/manuals/e...tion-0016.html

The main reason to find the file which loads/invokes policy is to customize that particular file to load any customize policy files.

alan_ri · 03-06-2008, 05:18 AM

Quote:

Originally Posted by matrixdipu

The main reason to find the file which loads/invokes policy is to customize that particular file to load any customize policy files.

I think that you are trying to do something that can't be done.What you want to customize is just a line in a kernel or init,and the only thing that you can customize there is; will kernel load the policy or not.What you want to customize is nothing else then your policy.

matrixdipu · 03-06-2008, 07:26 AM

Quote:

Originally Posted by alan_ri

I think that you are trying to do something that can't be done.What you want to customize is just a line in a kernel or init,and the only thing that you can customize there is; will kernel load the policy or not.What you want to customize is nothing else then your policy.

Can you provide URI for this that kernel or init only have option that they can load policy or not?

What I want to do is to customise the file which loads policy or init script such that we have a choice such that which policy file to load? It's some generic kind of thing. If you can suggest any other way the same can be achived then it will very much appreciated. Thanks.

unSpawn · 03-06-2008, 12:08 PM

Why would you *want* to choose which policy to load?
I think it's time you elaborate on what you *really* want to do.