[ 4.064447] SELinux: inode_doinit_with_dentry: context_to_sid(u:object_r:sgdisk_exec:s0) returned 12 for dev=dm-0 ino=666
这是什么意思?暂且不管,我们先跟下代码在security/selinux/hooks.c:
1271/* The inode's security attributes must be initialized before first use. */ 1272staticintinode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry) 1273 { ... 1377 } else { 1378 rc = security_context_to_sid_default(context, rc, &sid, 1379 sbsec->def_sid, 1380 GFP_NOFS); 1381if (rc) { 1382char *dev = inode->i_sb->s_id; 1383unsignedlong ino = inode->i_ino; 1384 1385if (rc == -EINVAL) { 1386if (printk_ratelimit()) 1387 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid " 1388"context=%s. This indicates you may need to relabel the inode or the " 1389"filesystem in question.\n", ino, dev, context); 1390 } else { 1391 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) " 1392"returned %d for dev=%s ino=%ld\n", 1393 __func__, context, -rc, dev, ino); 1394 } 1395 kfree(context); 1396/* Leave with the unlabeled SID */ 1397 rc = 0; 1398break; 1399 } 1400 } 1401 kfree(context); 1402 isec->sid = sid; 1403break;
1391行出错,continue to track:
1486/** 1487 * security_context_to_sid_default - Obtain a SID for a given security context, 1488 * falling back to specified default if needed. 1489 * 1490 * @scontext: security context 1491 * @scontext_len: length in bytes 1492 * @sid: security identifier, SID 1493 * @def_sid: default SID to assign on error 1494 * 1495 * Obtains a SID associated with the security context that 1496 * has the string representation specified by @scontext. 1497 * The default SID is passed to the MLS layer to be used to allow 1498 * kernel labeling of the MLS field if the MLS field is not present 1499 * (for upgrading to MLS without full relabel). 1500 * Implicitly forces adding of the context even if it cannot be mapped yet. 1501 * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient 1502 * memory is available, or 0 on success. 1503 */ 1504intsecurity_context_to_sid_default(constchar *scontext, u32 scontext_len, 1505 u32 *sid, u32 def_sid, gfp_t gfp_flags) 1506 { 1507return security_context_to_sid_core(scontext, scontext_len, 1508 sid, def_sid, gfp_flags, 1); 1509 }
if (write_file("/sys/fs/selinux/checkreqprot", "0") == -1) { security_failure(); }
NOTICE("(Initializing SELinux %s took %.2fs.)\n", is_enforcing ? "enforcing" : "non-enforcing", t.duration()); } else { ERROR("init all handles...\n"); selinux_init_all_handles(); } }
intmain(int argc, char** argv){ ... NOTICE("init %s started!\n", is_first_stage ? "first stage" : "second stage"); ... // Set up SELinux, including loading the SELinux policy if we're in the kernel domain. selinux_initialize(is_first_stage); }