How is SELinux loaded on boot?

Question

I understand that a configuration file is in:

/etc/selinux/config

But how is it processed at boot? How does SELinux start, is it a daemon? Which startup script starts SELinux?

score 2 · Accepted Answer · answered Oct 03 '18 at 08:44

2

SELinux policy is loaded by init in early boot. Init checks that SELinux is enabeld, after which it loads the policy and re-executes itself in correct security context.

Sources: RHEL4 documentation, Ubuntu Hardy, systemd

answered Oct 03 '18 at 08:44

sebasth

14,872

Is there a syscall can be used by userspace to load selinux policy? And it's usually called by init? – 炸鱼薯条德里克 Oct 03 '18 at 09:44
systemd seems to use selinux_init_load_policy provided in SELinux C API – sebasth Oct 03 '18 at 09:51
So init is responsible for selinux policy (probably reads the file in /etc/selinux/config) . There is no additional init scripts related with selinux, and no additional daemon. Right ? Thx! – ransh Oct 03 '18 at 10:02
Exactly, it is explained in detail in RHEL4 link. – sebasth Oct 03 '18 at 10:04

How is SELinux loaded on boot?

1 Answers1