#526133 Document how not to break policy while trying to remove unconfined_t

Package:
selinux-policy-default
Source:
refpolicy
Submitter:
Bastian Blank
Date:
2026-08-04 03:21:02 UTC
Severity:
wishlist
#526133#5
Date:
2009-04-29 13:29:21 UTC
From:
To:
I have a machine where the unconfined policy is loaded but not used, so
my only way in is staff_u with staff_r and transition to sysadm_r:

| # id
| uid=0(root) gid=0(root) groups=0(root) context=staff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023

Now dpkg fails to execute initrc_exec_t with the following audit
message:

| audit(1241011095.115:260): security_compute_sid:  invalid context staff_u:sysadm_r:initrc_t:s0 for scontext=staff_u:sysadm_r:dpkg_t:s0-s0:c0.c1023 tcontext=system_u:object_r:initrc_exec_t:s0 tclass=process

This makes it impossible to install/remove any package which wants to
use invoke-rc.d.

Bastian
#526133#8
Date:
2009-06-23 05:42:45 UTC
From:
To:
Hi,

        You are getting this message since you filed a bug against the
 selinux reference policy packages, and I have not been able to
 reproduce your bug or determine that it is not longer valid.  I would
 appreciate it if you could test the latest version of
 selinux-policy-default, 0.0.20090621-1, and see if your issue has been
 resolved.

        I'll continue working on the issues, but in a lot of these cases
 my ability to setup the packages in question is limited, and I need
 your help to resolve this.

        Thanks,

        manoj
#526133#13
Date:
2009-06-26 18:00:29 UTC
From:
To:
Hi,

        Hmm. This is not the default, so the bug in the policy package
 is not grave.

        And not only is the change nothe default, it is weird: Either
 you use targeted policy, which means you load and use unconfined policy
 module, or you unload the unconfined module to make it strict. The
 hybrid approach is .. unusual.

        You are, of course, free to change policy any way you want, but
 if that policy then breaks, you can't file bugs against the package.

        In kernel terms, if you use make-kpkg, or yourkernel is tainted,
 or you change the kernel config, you can't bug the kernel team; similar
 logic applies here.

        manoj
#526133#18
Date:
2009-06-27 06:39:37 UTC
From:
To:
reopen 526133
thanks

Please explain how a transition from a setup with unconfined and
unconfined_u users to staff_u and sysadm_u should work if not the
following way:
- Change user.
- Remove unconfined policy.

No, it is not. All policy modules are shipped by this package. So you
must document conflicts at least.

Bastian
#526133#29
Date:
2009-06-30 20:01:29 UTC
From:
To:
severity 526133 grave
title 526133 selinux-policy-default - dpkg fails to execute initrc_exec_t with invalid context
thanks

Pardon, this is no documentation bug.

Bastian
#526133#44
Date:
2026-08-04 03:13:55 UTC
From:
To:
close 526133
thanks

https://wiki.debian.org/SELinux/Setup

This is now section 7.2 in the above wiki page.