Re: RFC: earlyinit_t

On 6/18/26 10:34 AM, Rahul Sandhu wrote:
> Hi all,
>
> I'm writing this RFC with reference to the comment that I made earlier
> with reference to userspace_initial_context[1]. This is a fairly big
> change, but hopefully—once some of the details are ironed out—a future
> patch could be included in the next release or possibly the one after.
> I would be happy to author such a patch myself after some discussion.
>
> kernel_t is currently a bit overloaded in terms of scope; the domain is
> used both for kernel threads and early userspace, before the transition
> that is done (typically) by the init system.
>
> In terms of the permissions granted via kernel_t, I personally am not
> overly concerned. They are _both_, by their nature, highly privileged.
>
> Kernel threads run in the processor's most privileged execution state,
> meaning that they have raw access to all memory, disk IO, and various
> other pieces of system hardware. This makes SELinux _confinement_ of
> said domain somewhat useless.
>
> Early userspace processors are most likely started before policy load
> has even occured, meaning that trying to restrict the permissions given
> to their domain doesn't really achieve much; the majority, if not all,
> of their tasks occur before SELinux is performing any checks.
>
> However, this makes access of other processes _to_ these targets quite
> concerning. Given their privileged nature, such domains should be, in
> my opinion, considered high value targets.
>
> Unfortunately, these targets differ in terms of the level of access
> other domains require to them. Just as an example, modern systems that
> are running systemd create a plethora of sockets and other objects in
> the initramfs, so long as systemd itself is running there, that persist
> for the system's entire boot and onwards. systemd-journald's socket is
> a good example of a socket created early, which as a result ends up as
> kernel_t. For another example, I have this recent denial from udev[2].
>
> Hence, I propose creating a new domain, earlyinit_t, and changing the
> init sid to use that instead of kernel_t.

There is an alternate proposal here: 
https://github.com/SELinuxProject/refpolicy/pull/1168

Findings in this PR seem to point to earlyinit_t being unnecessary, but 
I would like further consensus before we decide on the final direction.

-- 
Chris PeBenito