From f1f5cf751c72b658bae08161934ffac13aee8c5f Mon Sep 17 00:00:00 2001 From: "Richard W.M. Jones" Date: Mon, 4 Jul 2016 13:15:08 +0100 Subject: [PATCH] Use generator approach to fix autorelabel. See: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/CHCEGB2RUPHFCE4FVGIRO3CJYGNS75T7/ --- policycoreutils.spec | 13 ++++++++++--- selinux-autorelabel-generator.sh | 29 +++++++++++++++++++++++++++++ selinux-autorelabel.service | 9 +++------ selinux-autorelabel.target | 7 +++++++ 4 files changed, 49 insertions(+), 9 deletions(-) create mode 100755 selinux-autorelabel-generator.sh create mode 100644 selinux-autorelabel.target diff --git a/policycoreutils.spec b/policycoreutils.spec index a77c243..cb784d9 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -4,10 +4,12 @@ %global libselinuxver 2.5-7 %global sepolgenver 1.2.3 +%global generatorsdir %{_prefix}/lib/systemd/system-generators + Summary: SELinux policy core utilities Name: policycoreutils Version: 2.5 -Release: 11%{?dist} +Release: 11.rwmj1%{?dist} License: GPLv2 Group: System Environment/Base # https://github.com/SELinuxProject/selinux/wiki/Releases @@ -20,6 +22,8 @@ Source4: sepolicy-icons.tgz Source5: selinux-autorelabel Source6: selinux-autorelabel.service Source7: selinux-autorelabel-mark.service +Source8: selinux-autorelabel.target +Source9: selinux-autorelabel-generator.sh # download https://raw.githubusercontent.com/fedora-selinux/scripts/master/selinux/make-fedora-selinux-patch.sh # run: # $ VERSION=2.5 ./make-fedora-selinux-patch.sh policycoreutils @@ -123,10 +127,12 @@ rm -f %{buildroot}%{_datadir}/system-config-selinux/system-config-selinux.deskto # https://bugzilla.redhat.com/show_bug.cgi?id=1328825 mkdir -m 755 -p %{buildroot}/%{_unitdir}/basic.target.wants/ +mkdir -m 755 -p %{buildroot}/%{generatorsdir} install -m 644 -p %{SOURCE6} %{buildroot}/%{_unitdir}/ install -m 644 -p %{SOURCE7} %{buildroot}/%{_unitdir}/ +install -m 644 -p %{SOURCE8} %{buildroot}/%{_unitdir}/ +install -m 755 -p %{SOURCE9} %{buildroot}/%{generatorsdir}/ install -m 755 -p %{SOURCE5} %{buildroot}/%{_libexecdir}/selinux/ -ln -s ../selinux-autorelabel.service %{buildroot}/%{_unitdir}/basic.target.wants/ ln -s ../selinux-autorelabel-mark.service %{buildroot}/%{_unitdir}/basic.target.wants/ %find_lang %{name} @@ -371,7 +377,8 @@ fi %{_unitdir}/selinux-autorelabel-mark.service %{_unitdir}/basic.target.wants/selinux-autorelabel-mark.service %{_unitdir}/selinux-autorelabel.service -%{_unitdir}/basic.target.wants/selinux-autorelabel.service +%{_unitdir}/selinux-autorelabel.target +%{generatorsdir}/selinux-autorelabel-generator.sh %config(noreplace) %{_sysconfdir}/sestatus.conf # selinux-policy Requires: policycoreutils, so we own this set of directories and our files within them %{_mandir}/man5/selinux_config.5.gz diff --git a/selinux-autorelabel-generator.sh b/selinux-autorelabel-generator.sh new file mode 100755 index 0000000..be60487 --- /dev/null +++ b/selinux-autorelabel-generator.sh @@ -0,0 +1,29 @@ +#!/bin/sh + +# This systemd.generator(7) detects if SELinux is running and if the +# user requested an autorelabel, and if so sets the default target to +# selinux-autorelabel.target, which will cause the filesystem to be +# relabelled and then the system will reboot again and boot into the +# real default target. + +PATH=/usr/sbin:$PATH +unitdir=/usr/lib/systemd/system + +# If invoked with no arguments (for testing) write to /tmp. +earlydir="/tmp" +if [ -n "$2" ]; then + earlydir="$2" +fi + +set_target () +{ + ln -sf "$unitdir/selinux-autorelabel.target" "$earlydir/default.target" +} + +if selinuxenabled; then + if test -f /.autorelabel; then + set_target + elif grep -sqE "\bautorelabel\b" /proc/cmdline; then + set_target + fi +fi diff --git a/selinux-autorelabel.service b/selinux-autorelabel.service index a6cc332..b8461e6 100644 --- a/selinux-autorelabel.service +++ b/selinux-autorelabel.service @@ -1,13 +1,10 @@ [Unit] -Description=Relabel all filesystems, if necessary +Description=Relabel all filesystems DefaultDependencies=no -Requires=local-fs.target Conflicts=shutdown.target -After=local-fs.target -Before=sysinit.target shutdown.target +After=sysinit.target +Before=shutdown.target ConditionSecurity=selinux -ConditionKernelCommandLine=|autorelabel -ConditionPathExists=|/.autorelabel [Service] ExecStart=/usr/libexec/selinux/selinux-autorelabel diff --git a/selinux-autorelabel.target b/selinux-autorelabel.target new file mode 100644 index 0000000..a4f63ab --- /dev/null +++ b/selinux-autorelabel.target @@ -0,0 +1,7 @@ +[Unit] +Description=Relabel all filesystems and reboot +DefaultDependencies=no +Requires=sysinit.target selinux-autorelabel.service +Conflicts=shutdown.target +After=sysinit.target selinux-autorelabel.service +ConditionSecurity=selinux -- 2.7.4