[master 1/1] Create an empty selinux config file (#1243168)

Adam Williamson awilliam at redhat.com
Sat Jul 18 00:27:28 UTC 2015


On Fri, 2015-07-17 at 00:13 +0000, bcl wrote:
> From: "Brian C. Lane" <bcl at redhat.com>
> 
> In order for selinux to properly label the system it needs to see 
> that
> the config file exists.
> 
> Also remove the old code trying to copy in a selinux config file, it
> never worked -- the removepkg would remove it.
> ---
>  share/runtime-cleanup.tmpl     | 5 +++++
>  share/runtime-postinstall.tmpl | 3 ---
>  2 files changed, 5 insertions(+), 3 deletions(-)
> 
> diff --git a/share/runtime-cleanup.tmpl b/share/runtime-cleanup.tmpl
> index 1dc720c..8869656 100644
> --- a/share/runtime-cleanup.tmpl
> +++ b/share/runtime-cleanup.tmpl
> @@ -26,6 +26,11 @@ removefrom dracut --allbut 
> /usr/lib/dracut/modules.d/30convertfs/convertfs.sh \
>                    /usr/lib/dracut/dracut-initramfs-restore
>  ## we don't run SELinux (not in enforcing, anyway)
>  removepkg checkpolicy selinux-policy libselinux-utils
> +
> +## selinux checks for the /etc/selinux/config file's existance
> +## The removepkg above removes it, create an empty one. See 
> rhbz#1243168
> +append etc/selinux/config ""
> +
>  ## anaconda has its own repo files
>  removefrom fedora-release --allbut /etc/os-release /usr/lib/os
> -release \
>                                     /usr/lib/os.release.d/*
> diff --git a/share/runtime-postinstall.tmpl b/share/runtime
> -postinstall.tmpl
> index 83373bf..7c6ec4e 100644
> --- a/share/runtime-postinstall.tmpl
> +++ b/share/runtime-postinstall.tmpl
> @@ -61,9 +61,6 @@ install ${configdir}/sysctl.conf 
> etc/sysctl.d/anaconda.conf
>  install ${configdir}/spice-vdagentd etc/sysconfig
>  mkdir etc/NetworkManager/conf.d
>  install ${configdir}/91-anaconda-autoconnect-slaves.conf 
> etc/NetworkManager/conf.d
> -%if exists(root+"/etc/selinux/targeted"):
> -    install ${configdir}/selinux.config etc/selinux/config
> -%endif
>  
>  ## set up sshd
>  install ${configdir}/sshd_config.anaconda etc/ssh

As the one who figured out the problem here, this looks good to me,
it's pretty much exactly what I had in mind. Yes, it's a bit silly that
libselinux simply checks whether the file exists (so a completely empty
file fools it), but that is definitely what it does, I checked that.
-- 
Adam Williamson
Fedora QA Community Monkey
IRC: adamw | Twitter: AdamW_Fedora | XMPP: adamw AT happyassassin . net
http://www.happyassassin.net



More information about the anaconda-patches mailing list