rpms/policycoreutils
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Use StandardInput=tty when AUTORELABEL=0

Browse Source 
selinux-autorelabel service can be configured to drop to a shell to allow
administrator to manually relabel a filesystem, see selinux_config(5). In
this case, the service needs to have a tty attached to stdin. Given that
tty should not be attached to the service by default, see
https://bugzilla.redhat.com/show_bug.cgi?id=1634661 , the
selinux-autorelabel-generator.sh will configure the service to attach
tty only if AUTORELABEL=0

Resolves: rhbz#2165508
This commit is contained in:
Petr Lautrbach 2023-02-08 11:27:20 +01:00
parent df8ecd9392
commit 0d980e2bff
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
selinux-autorelabel-generator.sh
View File

@ -18,6 +18,15 @@ fi
set_target () set_target ()
{ {
ln -sf "$unitdir/selinux-autorelabel.target" "$earlydir/default.target" ln -sf "$unitdir/selinux-autorelabel.target" "$earlydir/default.target"
AUTORELABEL="1"
source /etc/selinux/config
if [ "$AUTORELABEL" = "0" ]; then
mkdir -p "$earlydir/selinux-autorelabel.service.d"
cat > "$earlydir/selinux-autorelabel.service.d/tty.conf" <<EOF
[Service]
StandardInput=tty
EOF
fi
} }
if selinuxenabled; then if selinuxenabled; then