2.6.2-mm1, selinux, and initrd

2.6.2-mm1, selinux, and initrd

[Valdis.Kletnieks]

[-- Attachment #1: Type: text/plain, Size: 2243 bytes --]

On my laptop, I use an initrd to get things started (mostly SElinux
and LVM).  (I've attached the 'linuxrc' below).

Under 2.6.2-rc3-mm1, I got the following while booting:

Feb  5 09:40:34 turing-police kernel: RAMDISK: Compressed image found at block 0
Feb  5 09:40:34 turing-police kernel: VFS: Mounted root (ext2 filesystem).
Feb  5 09:40:34 turing-police kernel: Mounted devfs on /dev
Feb  5 09:40:34 turing-police kernel: security:  3 users, 5 roles, 1039 types
Feb  5 09:40:34 turing-police kernel: security:  30 classes, 128126 rules
Feb  5 09:40:35 turing-police kernel: SELinux:  Completing initialization.
Feb  5 09:40:35 turing-police kernel: SELinux:  Setting up existing superblocks.
Feb  5 09:40:35 turing-police kernel: SELinux: initialized (dev , type selinuxfs), uses genfs_contexts
Feb  5 09:40:35 turing-police kernel: SELinux: initialized (dev ram0, type ext2), uses xattr

Booting 2.6.2-mm1, I get:

RAMDISK: Compressed image found at block 0
VFS: Mounted root (ext2 filesystem).
Mounted devfs on /dev
VFS: Cannot open root device 

and things come to a screeching halt.  Absolutely nothing in the linuxrc
seems to happen - and since the real root is on an LVM, we come to a
screeching halt.

The system boots OK (minus selinux functionality of course)if I pass
'selinux=0' as a kernel parameter, so I'm suspecting these 3 patches:

+selinux-01-context-mount-support.patch
+selinux-02-nfs-context-mounts.patch
+selinux-03-context-mounts-selinux.patch

I'm suspecting that try_context_mount() is choking because we haven't
loaded the policy or anything, so we hit this:

       rc = try_context_mount(sb, data);
        if (rc)
                goto out;

and die a horrid death...

Oh, and the linuxrc:

#!/bin/nash

echo Loading policy
mount -t selinuxfs none /selinux
/bin/load_policy /etc/security/selinux/policy.15
umount /selinux

echo Mounting /proc filesystem
mount -t proc /proc /proc
echo Creating block devices
mkdevices /dev
echo Scanning logical volumes
lvm vgscan
echo Activating logical volumes
lvm vgchange -ay
echo 0x0100 > /proc/sys/kernel/real-root-dev
echo Mounting root filesystem
mount -o noatime,nodev --ro -t ext3 /dev/rootvg/root /sysroot
pivot_root /sysroot /sysroot/initrd
umount /initrd/proc




[-- Attachment #2: Type: application/pgp-signature, Size: 226 bytes --]

Re: 2.6.2-mm1, selinux, and initrd

[James Morris]

On Thu, 5 Feb 2004 Valdis.Kletnieks@vt.edu wrote:

> Booting 2.6.2-mm1, I get:
> 
> RAMDISK: Compressed image found at block 0
> VFS: Mounted root (ext2 filesystem).
> Mounted devfs on /dev
> VFS: Cannot open root device 
> 
> and things come to a screeching halt.  Absolutely nothing in the linuxrc
> seems to happen - and since the real root is on an LVM, we come to a
> screeching halt.
> 

Are you able to try this without devfs?


- James
-- 
James Morris
<jmorris@redhat.com>

Re: 2.6.2-mm1, selinux, and initrd

[James Morris]

On Thu, 5 Feb 2004 Valdis.Kletnieks@vt.edu wrote:

> The system boots OK (minus selinux functionality of course)if I pass
> 'selinux=0' as a kernel parameter, so I'm suspecting these 3 patches:
> 
> +selinux-01-context-mount-support.patch
> +selinux-02-nfs-context-mounts.patch
> +selinux-03-context-mounts-selinux.patch
> 
> I'm suspecting that try_context_mount() is choking because we haven't
> loaded the policy or anything, so we hit this:
> 
>        rc = try_context_mount(sb, data);
>         if (rc)
>                 goto out;

I'm not sure how you reach this conclusion.

try_context_mount will not return an error unless you specify a context
mount option (which I assume you are not doing) and then have something go
wrong.



- James
-- 
James Morris
<jmorris@redhat.com>

Re: 2.6.2-mm1, selinux, and initrd

[James Morris]

On Thu, 5 Feb 2004 Valdis.Kletnieks@vt.edu wrote:

> Booting 2.6.2-mm1, I get:
> 
> RAMDISK: Compressed image found at block 0
> VFS: Mounted root (ext2 filesystem).
> Mounted devfs on /dev
> VFS: Cannot open root device 
> 
> and things come to a screeching halt.  Absolutely nothing in the linuxrc
> seems to happen - and since the real root is on an LVM, we come to a
> screeching halt.

Vladis, 

Can you please try the patch below against  the 2.6.2-mm1 kernel and let 
me know if you still see the problem.


- James
-- 
James Morris
<jmorris@redhat.com>

diff -urN -X dontdiff linux-2.6.2-mm1.o/fs/super.c linux-2.6.2-mm1.w/fs/super.c
--- linux-2.6.2-mm1.o/fs/super.c	2004-02-05 09:24:12.000000000 -0500
+++ linux-2.6.2-mm1.w/fs/super.c	2004-02-06 22:32:43.309927664 -0500
@@ -709,7 +709,6 @@
 	struct super_block *sb = ERR_PTR(-ENOMEM);
 	struct vfsmount *mnt;
 	int error;
-	char *secdata = NULL;
 
 	if (!type)
 		return ERR_PTR(-ENODEV);
@@ -718,24 +717,10 @@
 	if (!mnt)
 		goto out;
 
-	if (data) {
-		secdata = alloc_secdata();
-		if (!secdata) {
-			sb = ERR_PTR(-ENOMEM);
-			goto out_mnt;
-		}
-
-		error = security_sb_copy_data(fstype, data, secdata);
-		if (error) {
-			sb = ERR_PTR(error);
-			goto out_free_secdata;
-		}
-	}
-
 	sb = type->get_sb(type, flags, name, data);
 	if (IS_ERR(sb))
-		goto out_free_secdata;
- 	error = security_sb_kern_mount(sb, secdata);
+		goto out_mnt;
+ 	error = security_sb_kern_mount(sb, NULL);
  	if (error)
  		goto out_sb;
 	mnt->mnt_sb = sb;
@@ -749,8 +734,6 @@
 	up_write(&sb->s_umount);
 	deactivate_super(sb);
 	sb = ERR_PTR(error);
-out_free_secdata:
-	free_secdata(secdata);
 out_mnt:
 	free_vfsmnt(mnt);
 out:

Re: 2.6.2-mm1, selinux, and initrd

[Valdis.Kletnieks]

[-- Attachment #1: Type: text/plain, Size: 646 bytes --]

On Fri, 06 Feb 2004 22:39:45 EST, James Morris said:

> Can you please try the patch below against  the 2.6.2-mm1 kernel and let 
> me know if you still see the problem.

> diff -urN -X dontdiff linux-2.6.2-mm1.o/fs/super.c linux-2.6.2-mm1.w/fs/super
.c
> --- linux-2.6.2-mm1.o/fs/super.c	2004-02-05 09:24:12.000000000 -0500
> +++ linux-2.6.2-mm1.w/fs/super.c	2004-02-06 22:32:43.309927664 -0500
> @@ -709,7 +709,6 @@
>  	struct super_block *sb = ERR_PTR(-ENOMEM);
>  	struct vfsmount *mnt;
>  	int error;
> -	char *secdata = NULL;

Yes, backing out that part of the 3 patches that hits fs/super.c makes
a kernel that boots with selinux enabled.

[-- Attachment #2: Type: application/pgp-signature, Size: 226 bytes --]

Re: 2.6.2-mm1, selinux, and initrd

[James Morris]

On Sat, 7 Feb 2004 Valdis.Kletnieks@vt.edu wrote:

> On Fri, 06 Feb 2004 22:39:45 EST, James Morris said:
> 
> > Can you please try the patch below against  the 2.6.2-mm1 kernel and let 
> > me know if you still see the problem.
> 
> > diff -urN -X dontdiff linux-2.6.2-mm1.o/fs/super.c linux-2.6.2-mm1.w/fs/super
> .c
> > --- linux-2.6.2-mm1.o/fs/super.c	2004-02-05 09:24:12.000000000 -0500
> > +++ linux-2.6.2-mm1.w/fs/super.c	2004-02-06 22:32:43.309927664 -0500
> > @@ -709,7 +709,6 @@
> >  	struct super_block *sb = ERR_PTR(-ENOMEM);
> >  	struct vfsmount *mnt;
> >  	int error;
> > -	char *secdata = NULL;
> 
> Yes, backing out that part of the 3 patches that hits fs/super.c makes
> a kernel that boots with selinux enabled.

Ok, looks like a problem where devfs is passing an empty string to 
do_mount when it expects a page.

Please try the patch below against 2.6.2-mm1.


- James
-- 
James Morris
<jmorris@redhat.com>

diff -urN -X dontdiff linux-2.6.2-mm1.o/fs/devfs/base.c linux-2.6.2-mm1.w/fs/devfs/base.c
--- linux-2.6.2-mm1.o/fs/devfs/base.c	2004-02-05 09:24:12.000000000 -0500
+++ linux-2.6.2-mm1.w/fs/devfs/base.c	2004-02-07 08:39:17.000000000 -0500
@@ -2832,7 +2832,7 @@
     int err;
 
     if ( !(boot_options & OPTION_MOUNT) ) return;
-    err = do_mount ("none", "/dev", "devfs", 0, "");
+    err = do_mount ("none", "/dev", "devfs", 0, NULL);
     if (err == 0) printk (KERN_INFO "Mounted devfs on /dev\n");
     else PRINTK ("(): unable to mount devfs, err: %d\n", err);
 }   /*  End Function mount_devfs_fs  */

Re: 2.6.2-mm1, selinux, and initrd

[Valdis.Kletnieks]

[-- Attachment #1: Type: text/plain, Size: 256 bytes --]

On Sat, 07 Feb 2004 08:49:28 EST, James Morris said:

> Ok, looks like a problem where devfs is passing an empty string to 
> do_mount when it expects a page.
> 
> Please try the patch below against 2.6.2-mm1.

OK, thanks.. that's a "confirmed working"...

[-- Attachment #2: Type: application/pgp-signature, Size: 226 bytes --]

Re: 2.6.2-mm1, selinux, and initrd

[Andrew Morton]

Valdis.Kletnieks@vt.edu wrote:
>
> On Sat, 07 Feb 2004 08:49:28 EST, James Morris said:
> 
> > Ok, looks like a problem where devfs is passing an empty string to 
> > do_mount when it expects a page.
> > 
> > Please try the patch below against 2.6.2-mm1.
> 
> OK, thanks.. that's a "confirmed working"...
> 


So I queue up the below patch, yes?



From: James Morris <jmorris@redhat.com>

devfs is passing an empty string to do_mount when it expects a page.



---

 fs/devfs/base.c |    2 +-
 1 files changed, 1 insertion(+), 1 deletion(-)

diff -puN fs/devfs/base.c~devfs-do_mount-fix fs/devfs/base.c
--- 25/fs/devfs/base.c~devfs-do_mount-fix	2004-02-07 07:37:51.000000000 -0800
+++ 25-akpm/fs/devfs/base.c	2004-02-07 07:37:51.000000000 -0800
@@ -2840,7 +2840,7 @@ void __init mount_devfs_fs (void)
     int err;
 
     if ( !(boot_options & OPTION_MOUNT) ) return;
-    err = do_mount ("none", "/dev", "devfs", 0, "");
+    err = do_mount ("none", "/dev", "devfs", 0, NULL);
     if (err == 0) printk (KERN_INFO "Mounted devfs on /dev\n");
     else PRINTK ("(): unable to mount devfs, err: %d\n", err);
 }   /*  End Function mount_devfs_fs  */

_

Re: 2.6.2-mm1, selinux, and initrd

[James Morris]

On Sat, 7 Feb 2004, Andrew Morton wrote:

> Valdis.Kletnieks@vt.edu wrote:
> >
> > On Sat, 07 Feb 2004 08:49:28 EST, James Morris said:
> > 
> > > Ok, looks like a problem where devfs is passing an empty string to 
> > > do_mount when it expects a page.
> > > 
> > > Please try the patch below against 2.6.2-mm1.
> > 
> > OK, thanks.. that's a "confirmed working"...
> > 
> 
> 
> So I queue up the below patch, yes?

Yes, please.



- James
-- 
James Morris
<jmorris@redhat.com>