CentOS Sources
2 years ago
committed by
MSVSphere Packaging Team
commit
9a9f730204
@ -0,0 +1,7 @@
|
|||||||
|
SOURCES/gui-po.tgz
|
||||||
|
SOURCES/policycoreutils-po.tgz
|
||||||
|
SOURCES/python-po.tgz
|
||||||
|
SOURCES/sandbox-po.tgz
|
||||||
|
SOURCES/selinux-3.5.tar.gz
|
||||||
|
SOURCES/sepolicy-icons.tgz
|
||||||
|
SOURCES/system-config-selinux.png
|
||||||
@ -0,0 +1,7 @@
|
|||||||
|
f9342645227d02f617924de0bb0dbfa9c67ebb43 SOURCES/gui-po.tgz
|
||||||
|
04e31eca7c25edb3a896637aba5b81b61d572995 SOURCES/policycoreutils-po.tgz
|
||||||
|
2395f9e7d3a01715f103a04fed37468ba0d3da5a SOURCES/python-po.tgz
|
||||||
|
65f89d944d50c59dd5a35453e9a94916db076b3d SOURCES/sandbox-po.tgz
|
||||||
|
28e8c0a58e01436b1c931559da3844d5774f8186 SOURCES/selinux-3.5.tar.gz
|
||||||
|
d849fa76cc3ef4a26047d8a69fef3a55d2f3097f SOURCES/sepolicy-icons.tgz
|
||||||
|
611a5d497efaddd45ec0dcc3e9b2e5b0f81ebc41 SOURCES/system-config-selinux.png
|
||||||
@ -0,0 +1,27 @@
|
|||||||
|
From 31ccf6f0fc5e77870f496fac4bea94a6ba2e5c30 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
Date: Thu, 20 Aug 2015 12:58:41 +0200
|
||||||
|
Subject: [PATCH] sandbox: add -reset to Xephyr as it works better with it in
|
||||||
|
recent Fedoras
|
||||||
|
Content-type: text/plain
|
||||||
|
|
||||||
|
---
|
||||||
|
sandbox/sandboxX.sh | 2 +-
|
||||||
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/sandbox/sandboxX.sh b/sandbox/sandboxX.sh
|
||||||
|
index eaa500d08143..4774528027ef 100644
|
||||||
|
--- a/sandbox/sandboxX.sh
|
||||||
|
+++ b/sandbox/sandboxX.sh
|
||||||
|
@@ -20,7 +20,7 @@ cat > ~/.config/openbox/rc.xml << EOF
|
||||||
|
</openbox_config>
|
||||||
|
EOF
|
||||||
|
|
||||||
|
-(/usr/bin/Xephyr -resizeable -title "$TITLE" -terminate -screen $SCREENSIZE -dpi $DPI -nolisten tcp -displayfd 5 5>&1 2>/dev/null) | while read D; do
|
||||||
|
+(/usr/bin/Xephyr -resizeable -title "$TITLE" -terminate -reset -screen $SCREENSIZE -dpi $DPI -nolisten tcp -displayfd 5 5>&1 2>/dev/null) | while read D; do
|
||||||
|
export DISPLAY=:$D
|
||||||
|
cat > ~/seremote << __EOF
|
||||||
|
#!/bin/sh
|
||||||
|
--
|
||||||
|
2.39.1
|
||||||
|
|
||||||
@ -0,0 +1,47 @@
|
|||||||
|
From 837c347bbee5db90d11144363525113edc8baed3 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Dan Walsh <dwalsh@redhat.com>
|
||||||
|
Date: Mon, 21 Apr 2014 13:54:40 -0400
|
||||||
|
Subject: [PATCH] Fix STANDARD_FILE_CONTEXT section in man pages
|
||||||
|
Content-type: text/plain
|
||||||
|
|
||||||
|
Signed-off-by: Miroslav Grepl <mgrepl@redhat.com>
|
||||||
|
---
|
||||||
|
python/sepolicy/sepolicy/manpage.py | 7 +++++--
|
||||||
|
1 file changed, 5 insertions(+), 2 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py
|
||||||
|
index a488dcbf54f2..7d90ffb5a22f 100755
|
||||||
|
--- a/python/sepolicy/sepolicy/manpage.py
|
||||||
|
+++ b/python/sepolicy/sepolicy/manpage.py
|
||||||
|
@@ -679,10 +679,13 @@ Default Defined Ports:""")
|
||||||
|
|
||||||
|
def _file_context(self):
|
||||||
|
flist = []
|
||||||
|
+ flist_non_exec = []
|
||||||
|
mpaths = []
|
||||||
|
for f in self.all_file_types:
|
||||||
|
if f.startswith(self.domainname):
|
||||||
|
flist.append(f)
|
||||||
|
+ if not file_type_is_executable(f) or not file_type_is_entrypoint(f):
|
||||||
|
+ flist_non_exec.append(f)
|
||||||
|
if f in self.fcdict:
|
||||||
|
mpaths = mpaths + self.fcdict[f]["regex"]
|
||||||
|
if len(mpaths) == 0:
|
||||||
|
@@ -741,12 +744,12 @@ SELinux %(domainname)s policy is very flexible allowing users to setup their %(d
|
||||||
|
SELinux defines the file context types for the %(domainname)s, if you wanted to
|
||||||
|
store files with these types in a different paths, you need to execute the semanage command to specify alternate labeling and then use restorecon to put the labels on disk.
|
||||||
|
|
||||||
|
-.B semanage fcontext -a -t %(type)s '/srv/%(domainname)s/content(/.*)?'
|
||||||
|
+.B semanage fcontext -a -t %(type)s '/srv/my%(domainname)s_content(/.*)?'
|
||||||
|
.br
|
||||||
|
.B restorecon -R -v /srv/my%(domainname)s_content
|
||||||
|
|
||||||
|
Note: SELinux often uses regular expressions to specify labels that match multiple files.
|
||||||
|
-""" % {'domainname': self.domainname, "type": flist[0]})
|
||||||
|
+""" % {'domainname': self.domainname, "type": flist_non_exec[-1]})
|
||||||
|
|
||||||
|
self.fd.write(r"""
|
||||||
|
.I The following file types are defined for %(domainname)s:
|
||||||
|
--
|
||||||
|
2.39.1
|
||||||
|
|
||||||
@ -0,0 +1,28 @@
|
|||||||
|
From f21d5f9316094015c81339d25d69d3dc7150bd8a Mon Sep 17 00:00:00 2001
|
||||||
|
From: Miroslav Grepl <mgrepl@redhat.com>
|
||||||
|
Date: Mon, 12 May 2014 14:11:22 +0200
|
||||||
|
Subject: [PATCH] If there is no executable we don't want to print a part of
|
||||||
|
STANDARD FILE CONTEXT
|
||||||
|
Content-type: text/plain
|
||||||
|
|
||||||
|
---
|
||||||
|
python/sepolicy/sepolicy/manpage.py | 3 ++-
|
||||||
|
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py
|
||||||
|
index 7d90ffb5a22f..11809dcede43 100755
|
||||||
|
--- a/python/sepolicy/sepolicy/manpage.py
|
||||||
|
+++ b/python/sepolicy/sepolicy/manpage.py
|
||||||
|
@@ -737,7 +737,8 @@ SELinux %(domainname)s policy is very flexible allowing users to setup their %(d
|
||||||
|
.PP
|
||||||
|
""" % {'domainname': self.domainname, 'equiv': e, 'alt': e.split('/')[-1]})
|
||||||
|
|
||||||
|
- self.fd.write(r"""
|
||||||
|
+ if flist_non_exec:
|
||||||
|
+ self.fd.write(r"""
|
||||||
|
.PP
|
||||||
|
.B STANDARD FILE CONTEXT
|
||||||
|
|
||||||
|
--
|
||||||
|
2.39.1
|
||||||
|
|
||||||
@ -0,0 +1,25 @@
|
|||||||
|
From 9e22ab3619d68277c89926f3f31e37a9101ca082 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Dan Walsh <dwalsh@redhat.com>
|
||||||
|
Date: Fri, 14 Feb 2014 12:32:12 -0500
|
||||||
|
Subject: [PATCH] Don't be verbose if you are not on a tty
|
||||||
|
Content-type: text/plain
|
||||||
|
|
||||||
|
---
|
||||||
|
policycoreutils/scripts/fixfiles | 1 +
|
||||||
|
1 file changed, 1 insertion(+)
|
||||||
|
|
||||||
|
diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
|
||||||
|
index 166af6f360a2..ebe64563c7d7 100755
|
||||||
|
--- a/policycoreutils/scripts/fixfiles
|
||||||
|
+++ b/policycoreutils/scripts/fixfiles
|
||||||
|
@@ -108,6 +108,7 @@ exclude_dirs_from_relabelling() {
|
||||||
|
fullFlag=0
|
||||||
|
BOOTTIME=""
|
||||||
|
VERBOSE="-p"
|
||||||
|
+[ -t 1 ] || VERBOSE=""
|
||||||
|
FORCEFLAG=""
|
||||||
|
THREADS=""
|
||||||
|
RPMFILES=""
|
||||||
|
--
|
||||||
|
2.39.1
|
||||||
|
|
||||||
@ -0,0 +1,72 @@
|
|||||||
|
From be8bd714f37e6114661f02df4ddb7cb7b25cd0a1 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Masatake YAMATO <yamato@redhat.com>
|
||||||
|
Date: Thu, 14 Dec 2017 15:57:58 +0900
|
||||||
|
Subject: [PATCH] sepolicy-generate: Handle more reserved port types
|
||||||
|
Content-type: text/plain
|
||||||
|
|
||||||
|
Currently only reserved_port_t, port_t and hi_reserved_port_t are
|
||||||
|
handled as special when making a ports-dictionary. However, as fas as
|
||||||
|
corenetwork.te.in of serefpolicy, unreserved_port_t and
|
||||||
|
ephemeral_port_t should be handled in the same way, too.
|
||||||
|
|
||||||
|
(Details) I found the need of this change when I was using
|
||||||
|
selinux-polgengui. Though tcp port 12345, which my application may
|
||||||
|
use, was given to the gui, selinux-polgengui generates expected te
|
||||||
|
file and sh file which didn't utilize the tcp port.
|
||||||
|
|
||||||
|
selinux-polgengui checks whether a port given via gui is already typed
|
||||||
|
or not.
|
||||||
|
|
||||||
|
If it is already typed, selinux-polgengui generates a te file having
|
||||||
|
rules to allow the application to use the port. (A)
|
||||||
|
|
||||||
|
If not, it seems for me that selinux-polgengui is designed to generate
|
||||||
|
a te file having rules to allow the application to own(?) the port;
|
||||||
|
and a sh file having a command line to assign the application own type
|
||||||
|
to the port. (B)
|
||||||
|
|
||||||
|
As we can see the output of `semanage port -l' some of ports for
|
||||||
|
specified purpose have types already. The important point is that the
|
||||||
|
rest of ports also have types already:
|
||||||
|
|
||||||
|
hi_reserved_port_t tcp 512-1023
|
||||||
|
hi_reserved_port_t udp 512-1023
|
||||||
|
unreserved_port_t tcp 1024-32767, 61001-65535
|
||||||
|
unreserved_port_t udp 1024-32767, 61001-65535
|
||||||
|
ephemeral_port_t tcp 32768-61000
|
||||||
|
ephemeral_port_t udp 32768-61000
|
||||||
|
|
||||||
|
As my patch shows, the original selinux-polgengui ignored
|
||||||
|
hi_reserved_port_t; though hi_reserved_port_t is assigned,
|
||||||
|
selinux-polgengui considered ports 512-1023 are not used. As the
|
||||||
|
result selinux-polgengui generates file sets of (B).
|
||||||
|
|
||||||
|
For the purpose of selinux-polgengui, I think unreserved_port_t and
|
||||||
|
ephemeral_port_t are treated as the same as hi_reserved_port_t.
|
||||||
|
|
||||||
|
Signed-off-by: Masatake YAMATO <yamato@redhat.com>
|
||||||
|
|
||||||
|
Fedora only patch:
|
||||||
|
https://lore.kernel.org/selinux/20150610.190635.1866127952891120915.yamato@redhat.com/
|
||||||
|
---
|
||||||
|
python/sepolicy/sepolicy/generate.py | 4 +++-
|
||||||
|
1 file changed, 3 insertions(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py
|
||||||
|
index b6df3e91160b..36a3ea1196b1 100644
|
||||||
|
--- a/python/sepolicy/sepolicy/generate.py
|
||||||
|
+++ b/python/sepolicy/sepolicy/generate.py
|
||||||
|
@@ -100,7 +100,9 @@ def get_all_ports():
|
||||||
|
for p in sepolicy.info(sepolicy.PORT):
|
||||||
|
if p['type'] == "reserved_port_t" or \
|
||||||
|
p['type'] == "port_t" or \
|
||||||
|
- p['type'] == "hi_reserved_port_t":
|
||||||
|
+ p['type'] == "hi_reserved_port_t" or \
|
||||||
|
+ p['type'] == "ephemeral_port_t" or \
|
||||||
|
+ p['type'] == "unreserved_port_t":
|
||||||
|
continue
|
||||||
|
dict[(p['low'], p['high'], p['protocol'])] = (p['type'], p.get('range'))
|
||||||
|
return dict
|
||||||
|
--
|
||||||
|
2.39.1
|
||||||
|
|
||||||
@ -0,0 +1,75 @@
|
|||||||
|
From f4b78eeb59ae1ef4b5926c004debce04ee28dfe7 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
Date: Wed, 18 Jul 2018 09:09:35 +0200
|
||||||
|
Subject: [PATCH] sandbox: Use matchbox-window-manager instead of openbox
|
||||||
|
Content-type: text/plain
|
||||||
|
|
||||||
|
---
|
||||||
|
sandbox/sandbox | 4 ++--
|
||||||
|
sandbox/sandbox.8 | 2 +-
|
||||||
|
sandbox/sandboxX.sh | 14 --------------
|
||||||
|
3 files changed, 3 insertions(+), 17 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/sandbox/sandbox b/sandbox/sandbox
|
||||||
|
index a2762a7d215a..a32a33ea3cf6 100644
|
||||||
|
--- a/sandbox/sandbox
|
||||||
|
+++ b/sandbox/sandbox
|
||||||
|
@@ -270,7 +270,7 @@ class Sandbox:
|
||||||
|
copyfile(f, "/tmp", self.__tmpdir)
|
||||||
|
copyfile(f, "/var/tmp", self.__tmpdir)
|
||||||
|
|
||||||
|
- def __setup_sandboxrc(self, wm="/usr/bin/openbox"):
|
||||||
|
+ def __setup_sandboxrc(self, wm="/usr/bin/matchbox-window-manager"):
|
||||||
|
execfile = self.__homedir + "/.sandboxrc"
|
||||||
|
fd = open(execfile, "w+")
|
||||||
|
if self.__options.session:
|
||||||
|
@@ -369,7 +369,7 @@ sandbox [-h] [-l level ] [-[X|M] [-H homedir] [-T tempdir]] [-I includefile ] [-
|
||||||
|
|
||||||
|
parser.add_option("-W", "--windowmanager", dest="wm",
|
||||||
|
type="string",
|
||||||
|
- default="/usr/bin/openbox",
|
||||||
|
+ default="/usr/bin/matchbox-window-manager",
|
||||||
|
help=_("alternate window manager"))
|
||||||
|
|
||||||
|
parser.add_option("-l", "--level", dest="level",
|
||||||
|
diff --git a/sandbox/sandbox.8 b/sandbox/sandbox.8
|
||||||
|
index 1ee0ecea96d1..775e4b231204 100644
|
||||||
|
--- a/sandbox/sandbox.8
|
||||||
|
+++ b/sandbox/sandbox.8
|
||||||
|
@@ -80,7 +80,7 @@ Specifies the windowsize when creating an X based Sandbox. The default windowsiz
|
||||||
|
\fB\-W\fR \fB\-\-windowmanager\fR
|
||||||
|
Select alternative window manager to run within
|
||||||
|
.B sandbox \-X.
|
||||||
|
-Default to /usr/bin/openbox.
|
||||||
|
+Default to /usr/bin/matchbox-window-manager.
|
||||||
|
.TP
|
||||||
|
\fB\-X\fR
|
||||||
|
Create an X based Sandbox for gui apps, temporary files for
|
||||||
|
diff --git a/sandbox/sandboxX.sh b/sandbox/sandboxX.sh
|
||||||
|
index 4774528027ef..c211ebc14549 100644
|
||||||
|
--- a/sandbox/sandboxX.sh
|
||||||
|
+++ b/sandbox/sandboxX.sh
|
||||||
|
@@ -6,20 +6,6 @@ export TITLE="Sandbox $context -- `grep ^#TITLE: ~/.sandboxrc | /usr/bin/cut -b8
|
||||||
|
[ -z $2 ] && export DPI="96" || export DPI="$2"
|
||||||
|
trap "exit 0" HUP
|
||||||
|
|
||||||
|
-mkdir -p ~/.config/openbox
|
||||||
|
-cat > ~/.config/openbox/rc.xml << EOF
|
||||||
|
-<openbox_config xmlns="http://openbox.org/3.4/rc"
|
||||||
|
- xmlns:xi="http://www.w3.org/2001/XInclude">
|
||||||
|
-<applications>
|
||||||
|
- <application class="*">
|
||||||
|
- <decor>no</decor>
|
||||||
|
- <desktop>all</desktop>
|
||||||
|
- <maximized>yes</maximized>
|
||||||
|
- </application>
|
||||||
|
-</applications>
|
||||||
|
-</openbox_config>
|
||||||
|
-EOF
|
||||||
|
-
|
||||||
|
(/usr/bin/Xephyr -resizeable -title "$TITLE" -terminate -reset -screen $SCREENSIZE -dpi $DPI -nolisten tcp -displayfd 5 5>&1 2>/dev/null) | while read D; do
|
||||||
|
export DISPLAY=:$D
|
||||||
|
cat > ~/seremote << __EOF
|
||||||
|
--
|
||||||
|
2.39.1
|
||||||
|
|
||||||
@ -0,0 +1,64 @@
|
|||||||
|
From b9b94a3254905518f00c4746c0bd712921af31cb Mon Sep 17 00:00:00 2001
|
||||||
|
From: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
Date: Mon, 27 Feb 2017 17:12:39 +0100
|
||||||
|
Subject: [PATCH] sepolicy: Drop old interface file_type_is_executable(f) and
|
||||||
|
file_type_is_entrypoint(f)
|
||||||
|
Content-type: text/plain
|
||||||
|
|
||||||
|
- use direct queries
|
||||||
|
- load exec_types and entry_types only once
|
||||||
|
---
|
||||||
|
python/sepolicy/sepolicy/manpage.py | 22 ++++++++++++++++++++--
|
||||||
|
1 file changed, 20 insertions(+), 2 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py
|
||||||
|
index 11809dcede43..543fef6c8d13 100755
|
||||||
|
--- a/python/sepolicy/sepolicy/manpage.py
|
||||||
|
+++ b/python/sepolicy/sepolicy/manpage.py
|
||||||
|
@@ -127,8 +127,24 @@ def gen_domains():
|
||||||
|
domains.sort()
|
||||||
|
return domains
|
||||||
|
|
||||||
|
-types = None
|
||||||
|
|
||||||
|
+exec_types = None
|
||||||
|
+
|
||||||
|
+def _gen_exec_types():
|
||||||
|
+ global exec_types
|
||||||
|
+ if exec_types is None:
|
||||||
|
+ exec_types = next(sepolicy.info(sepolicy.ATTRIBUTE, "exec_type"))["types"]
|
||||||
|
+ return exec_types
|
||||||
|
+
|
||||||
|
+entry_types = None
|
||||||
|
+
|
||||||
|
+def _gen_entry_types():
|
||||||
|
+ global entry_types
|
||||||
|
+ if entry_types is None:
|
||||||
|
+ entry_types = next(sepolicy.info(sepolicy.ATTRIBUTE, "entry_type"))["types"]
|
||||||
|
+ return entry_types
|
||||||
|
+
|
||||||
|
+types = None
|
||||||
|
|
||||||
|
def _gen_types():
|
||||||
|
global types
|
||||||
|
@@ -368,6 +384,8 @@ class ManPage:
|
||||||
|
self.all_file_types = sepolicy.get_all_file_types()
|
||||||
|
self.role_allows = sepolicy.get_all_role_allows()
|
||||||
|
self.types = _gen_types()
|
||||||
|
+ self.exec_types = _gen_exec_types()
|
||||||
|
+ self.entry_types = _gen_entry_types()
|
||||||
|
|
||||||
|
if self.source_files:
|
||||||
|
self.fcpath = self.root + "file_contexts"
|
||||||
|
@@ -684,7 +702,7 @@ Default Defined Ports:""")
|
||||||
|
for f in self.all_file_types:
|
||||||
|
if f.startswith(self.domainname):
|
||||||
|
flist.append(f)
|
||||||
|
- if not file_type_is_executable(f) or not file_type_is_entrypoint(f):
|
||||||
|
+ if f not in self.exec_types or f not in self.entry_types:
|
||||||
|
flist_non_exec.append(f)
|
||||||
|
if f in self.fcdict:
|
||||||
|
mpaths = mpaths + self.fcdict[f]["regex"]
|
||||||
|
--
|
||||||
|
2.39.1
|
||||||
|
|
||||||
@ -0,0 +1,79 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
#
|
||||||
|
# Do automatic relabelling
|
||||||
|
#
|
||||||
|
|
||||||
|
# . /etc/init.d/functions
|
||||||
|
|
||||||
|
# If the user has this (or similar) UEFI boot order:
|
||||||
|
#
|
||||||
|
# Windows | grub | Linux
|
||||||
|
#
|
||||||
|
# And decides to boot into grub/Linux, then the reboot at the end of autorelabel
|
||||||
|
# would cause the system to boot into Windows again, if the autorelabel was run.
|
||||||
|
#
|
||||||
|
# This function restores the UEFI boot order, so the user will boot into the
|
||||||
|
# previously set (and expected) partition.
|
||||||
|
efi_set_boot_next() {
|
||||||
|
# NOTE: The [ -x /usr/sbin/efibootmgr ] test is not sufficent -- it could
|
||||||
|
# succeed even on system which is not EFI-enabled...
|
||||||
|
if ! efibootmgr > /dev/null 2>&1; then
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
|
||||||
|
# NOTE: It it possible that some other services might be setting the
|
||||||
|
# 'BootNext' item for any reasons, and we shouldn't override it if so.
|
||||||
|
if ! efibootmgr | grep --quiet -e 'BootNext'; then
|
||||||
|
CURRENT_BOOT="$(efibootmgr | grep -e 'BootCurrent' | sed -re 's/(^.+:[[:space:]]*)([[:xdigit:]]+)/\2/')"
|
||||||
|
efibootmgr -n "${CURRENT_BOOT}" > /dev/null 2>&1
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
relabel_selinux() {
|
||||||
|
# if /sbin/init is not labeled correctly this process is running in the
|
||||||
|
# wrong context, so a reboot will be required after relabel
|
||||||
|
AUTORELABEL=
|
||||||
|
. /etc/selinux/config
|
||||||
|
echo "0" > /sys/fs/selinux/enforce
|
||||||
|
[ -x /bin/plymouth ] && plymouth --quit
|
||||||
|
|
||||||
|
if [ "$AUTORELABEL" = "0" ]; then
|
||||||
|
echo
|
||||||
|
echo $"*** Warning -- SELinux ${SELINUXTYPE} policy relabel is required. "
|
||||||
|
echo $"*** /etc/selinux/config indicates you want to manually fix labeling"
|
||||||
|
echo $"*** problems. Dropping you to a shell; the system will reboot"
|
||||||
|
echo $"*** when you leave the shell."
|
||||||
|
sulogin
|
||||||
|
|
||||||
|
else
|
||||||
|
echo
|
||||||
|
echo $"*** Warning -- SELinux ${SELINUXTYPE} policy relabel is required."
|
||||||
|
echo $"*** Relabeling could take a very long time, depending on file"
|
||||||
|
echo $"*** system size and speed of hard drives."
|
||||||
|
|
||||||
|
OPTS=`cat /.autorelabel`
|
||||||
|
# by default, use as many threads as there are available
|
||||||
|
# another -T X in $OPTS will override the default value
|
||||||
|
OPTS="-T 0 $OPTS"
|
||||||
|
|
||||||
|
[ -x "/usr/sbin/quotaoff" ] && /usr/sbin/quotaoff -aug
|
||||||
|
echo
|
||||||
|
echo $"Running: /sbin/fixfiles $OPTS restore"
|
||||||
|
/sbin/fixfiles $OPTS restore
|
||||||
|
fi
|
||||||
|
|
||||||
|
rm -f /.autorelabel
|
||||||
|
/usr/lib/dracut/dracut-initramfs-restore
|
||||||
|
efi_set_boot_next
|
||||||
|
if [ -x /usr/bin/grub2-editenv ]; then
|
||||||
|
grub2-editenv - incr boot_indeterminate >/dev/null 2>&1
|
||||||
|
fi
|
||||||
|
sync
|
||||||
|
systemctl reboot
|
||||||
|
}
|
||||||
|
|
||||||
|
# Check to see if a full relabel is needed
|
||||||
|
if [ "$READONLY" != "yes" ]; then
|
||||||
|
restorecon $(awk '!/^#/ && $4 !~ /noauto/ && $2 ~ /^\// { print $2 }' /etc/fstab) >/dev/null 2>&1
|
||||||
|
relabel_selinux
|
||||||
|
fi
|
||||||
@ -0,0 +1,38 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
# This systemd.generator(7) detects if SELinux is running and if the
|
||||||
|
# user requested an autorelabel, and if so sets the default target to
|
||||||
|
# selinux-autorelabel.target, which will cause the filesystem to be
|
||||||
|
# relabelled and then the system will reboot again and boot into the
|
||||||
|
# real default target.
|
||||||
|
|
||||||
|
PATH=/usr/sbin:$PATH
|
||||||
|
unitdir=/usr/lib/systemd/system
|
||||||
|
|
||||||
|
# If invoked with no arguments (for testing) write to /tmp.
|
||||||
|
earlydir="/tmp"
|
||||||
|
if [ -n "$2" ]; then
|
||||||
|
earlydir="$2"
|
||||||
|
fi
|
||||||
|
|
||||||
|
set_target ()
|
||||||
|
{
|
||||||
|
ln -sf "$unitdir/selinux-autorelabel.target" "$earlydir/default.target"
|
||||||
|
AUTORELABEL="1"
|
||||||
|
source /etc/selinux/config
|
||||||
|
if [ "$AUTORELABEL" = "0" ]; then
|
||||||
|
mkdir -p "$earlydir/selinux-autorelabel.service.d"
|
||||||
|
cat > "$earlydir/selinux-autorelabel.service.d/tty.conf" <<EOF
|
||||||
|
[Service]
|
||||||
|
StandardInput=tty
|
||||||
|
EOF
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
if selinuxenabled; then
|
||||||
|
if test -f /.autorelabel; then
|
||||||
|
set_target
|
||||||
|
elif grep -sqE "\bautorelabel\b" /proc/cmdline; then
|
||||||
|
set_target
|
||||||
|
fi
|
||||||
|
fi
|
||||||
@ -0,0 +1,18 @@
|
|||||||
|
[Unit]
|
||||||
|
Description=Mark the need to relabel after reboot
|
||||||
|
DefaultDependencies=no
|
||||||
|
Requires=local-fs.target
|
||||||
|
Conflicts=shutdown.target
|
||||||
|
After=local-fs.target
|
||||||
|
Before=sysinit.target shutdown.target
|
||||||
|
ConditionSecurity=!selinux
|
||||||
|
ConditionPathIsDirectory=/etc/selinux
|
||||||
|
ConditionPathExists=!/.autorelabel
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
ExecStart=-/bin/touch /.autorelabel
|
||||||
|
Type=oneshot
|
||||||
|
RemainAfterExit=yes
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=sysinit.target
|
||||||
@ -0,0 +1,14 @@
|
|||||||
|
[Unit]
|
||||||
|
Description=Relabel all filesystems
|
||||||
|
DefaultDependencies=no
|
||||||
|
Conflicts=shutdown.target
|
||||||
|
After=sysinit.target
|
||||||
|
Before=shutdown.target
|
||||||
|
ConditionSecurity=selinux
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
ExecStart=/usr/libexec/selinux/selinux-autorelabel
|
||||||
|
Type=oneshot
|
||||||
|
TimeoutSec=0
|
||||||
|
RemainAfterExit=yes
|
||||||
|
StandardOutput=journal+console
|
||||||
@ -0,0 +1,7 @@
|
|||||||
|
[Unit]
|
||||||
|
Description=Relabel all filesystems and reboot
|
||||||
|
DefaultDependencies=no
|
||||||
|
Requires=sysinit.target selinux-autorelabel.service
|
||||||
|
Conflicts=shutdown.target
|
||||||
|
After=sysinit.target selinux-autorelabel.service
|
||||||
|
ConditionSecurity=selinux
|
||||||
File diff suppressed because it is too large
Load Diff
Loading…
Reference in new issue