diff options
| author | Mark Asselstine <mark.asselstine@windriver.com> | 2019-08-23 14:19:53 -0400 |
|---|---|---|
| committer | Joe MacDonald <joe_macdonald@mentor.com> | 2019-08-28 10:28:06 -0400 |
| commit | b0d31db104d9a4e94bc1409c2ffcc1d82f4a780f (patch) | |
| tree | efd7892420692eea1e4d9217a082b1aa1b241161 /recipes-security/selinux/selinux-python/fix-sepolicy-install-path.patch | |
| parent | a41f48260654e0e444603c6a595444c450e6c3f5 (diff) | |
| download | meta-selinux-b0d31db104d9a4e94bc1409c2ffcc1d82f4a780f.tar.gz | |
selinux-init: use systemd (re)labelling
Boot loops were being seen when booting with selinux enabled, when the
init system in use is systemd. Once logs were retrieved from the
failing system the error was found to be
selinux-init.sh[284]: /sbin/restorecon: Could not set context for /sys/fs/cgroup/cpuacct: Read-only file system
selinux-init.sh[284]: /sbin/restorecon: Could not set context for /sys/fs/cgroup/cpu: Read-only file system
Systemd mounts /sys/fs/cgroup read-only and the (re)labelling code
used by selinux-init.sh is unable to handle this. On top of this the
system is basically presenting two methods of (re)labelling; using the
built in systemd approach via selinux-autorelabel.service *and* the
code we have in selinux-init.sh. This can get confusing especially
given that most online resources will speak to the systemd approach
using selinux-autorelabel.service and /.autorelabel.
These changes leave the current approach in place when sysvinit is the
init system used, but if systemd is being used we make use of it's
internal (re)labelling functionality. Overall the workflow remains the
same but we now avoid boot loops (systemd remounts /sys/fs/cgroup rw
during the (re)labelling procedure).
Signed-off-by: Mark Asselstine <mark.asselstine@windriver.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
Diffstat (limited to 'recipes-security/selinux/selinux-python/fix-sepolicy-install-path.patch')
0 files changed, 0 insertions, 0 deletions