| #!/bin/sh | |
| # SPDX-License-Identifier: GPL-2.0 | |
| if [ `id -u` -ne 0 ]; then | |
| echo "$0: must be root to install the selinux policy" | |
| exit 1 | |
| fi | |
| SF=`which setfiles` | |
| if [ $? -eq 1 ]; then | |
| if [ -f /sbin/setfiles ]; then | |
| SF="/usr/setfiles" | |
| else | |
| echo "no selinux tools installed: setfiles" | |
| exit 1 | |
| fi | |
| fi | |
| cd mdp | |
| CP=`which checkpolicy` | |
| VERS=`$CP -V | awk '{print $1}'` | |
| ./mdp policy.conf file_contexts | |
| $CP -o policy.$VERS policy.conf | |
| mkdir -p /etc/selinux/dummy/policy | |
| mkdir -p /etc/selinux/dummy/contexts/files | |
| cp file_contexts /etc/selinux/dummy/contexts/files | |
| cp dbus_contexts /etc/selinux/dummy/contexts | |
| cp policy.$VERS /etc/selinux/dummy/policy | |
| FC_FILE=/etc/selinux/dummy/contexts/files/file_contexts | |
| if [ ! -d /etc/selinux ]; then | |
| mkdir -p /etc/selinux | |
| fi | |
| if [ ! -f /etc/selinux/config ]; then | |
| cat > /etc/selinux/config << EOF | |
| SELINUX=enforcing | |
| SELINUXTYPE=dummy | |
| EOF | |
| else | |
| TYPE=`cat /etc/selinux/config | grep "^SELINUXTYPE" | tail -1 | awk -F= '{ print $2 '}` | |
| if [ "eq$TYPE" != "eqdummy" ]; then | |
| selinuxenabled | |
| if [ $? -eq 0 ]; then | |
| echo "SELinux already enabled with a non-dummy policy." | |
| echo "Exiting. Please install policy by hand if that" | |
| echo "is what you REALLY want." | |
| exit 1 | |
| fi | |
| mv /etc/selinux/config /etc/selinux/config.mdpbak | |
| grep -v "^SELINUXTYPE" /etc/selinux/config.mdpbak >> /etc/selinux/config | |
| echo "SELINUXTYPE=dummy" >> /etc/selinux/config | |
| fi | |
| fi | |
| cd /etc/selinux/dummy/contexts/files | |
| $SF file_contexts / | |
| mounts=`cat /proc/$$/mounts | egrep "ext2|ext3|xfs|jfs|ext4|ext4dev|gfs2" | awk '{ print $2 '}` | |
| $SF file_contexts $mounts | |
| dodev=`cat /proc/$$/mounts | grep "/dev "` | |
| if [ "eq$dodev" != "eq" ]; then | |
| mount --move /dev /mnt | |
| $SF file_contexts /dev | |
| mount --move /mnt /dev | |
| fi |