I compiled vanilla kernel 2.6.30.2 with the TOMOYO security module and installed sys-apps/ccs-tools. However, the boot process failed a the point where /sys should be mounted. The reason seems to be that /sbin/tomoyo-init mounts /sys and /sys/kernel/securityfs, while the init system expects sysfs not to be mounted at this time. Reproducible: Always Steps to Reproduce: 1. Install a kernel with TOMOYO support compiled in. 2. Install sys-apps/ccs-tools. 3. Initialize the TOMOYO policy. 4. Reboot. Actual Results: The init system drops to maintenance mode after failing to mount /sys because it is already mounted. Expected Results: Normal boot after running /sbin/tomoyo-init. I'm using Baselayout 1 and a custom initramfs to mount an encrypted root partition. The initramfs-init execs busybox switch_root to get to /sbin/init. I found this at the end of /sbin/tomoyo-init: # [ $SECURITY_UNMOUNT -eq 1 ] && umount -n /sys/kernel/security # [ $SYS_UNMOUNT -eq 1 ] && umount -n /sys [ $PROC_UNMOUNT -eq 1 ] && umount -n /proc exit 0 I suspect that uncommenting those two lines might solve the problem, but I'm new to TOMOYO and might be missing something.
I got response from upstream. http://sourceforge.jp/projects/tomoyo/lists/archive/dev/2009-July/001189.html Yes. Uncommenting those two lines will solve the problem. TOMOYO's management tools assume that securityfs is mounted on /sys/kernel/security/ . But many systems don't mount securityfs on /sys/kernel/security/ upon boot. If securityfs is not mounted, TOMOYO's management tools (e.g. ccs-editpolicy) can't work. Therefore, the author decided that /sbin/tomoyo-init leaves securityfs mounted on /sys/kernel/security/ . But in your environment, it causes problems... Should we ask users to add an entry to /etc/fstab so that /sys/kernel/security/ is mounted? Or, should we let TOMOYO's management tools try to mount /sys/kernel/security/ when the tools are executed?
In uncommented those two lines, works now. Thanks! :-) Looks like this is fixed in tomoyo-tools 2.2.0: http://sourceforge.jp/projects/tomoyo/lists/archive/users-en/2009-July/000080.html
sys-apps/tomoyo-tools-2.2.0_p20090727 in cvs.
Created attachment 208419 [details] tomoyo-init script
