rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Revert "Add check for config file consistency"

Browse Source 
This reverts commit 7fd6024816.
This commit is contained in:
Lukas Vrabec 2019-04-12 10:03:08 +02:00
parent cba3e984f6
commit f1ed716369
No known key found for this signature in database
GPG Key ID: 47201AC42F29CE06
1 changed files with 0 additions and 73 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

73
selinux-policy.spec
View File

@ -342,58 +342,6 @@ mkdir -p %{buildroot}/%{_libexecdir}/selinux/ \
#install -m 644 -p %{SOURCE101} %{buildroot}/%{_unitdir}/ \
#ln -s ../selinux-factory-reset@.service %{buildroot}/%{_unitdir}/basic.target.wants/selinux-factory-reset@%1.service
# Make sure the config is consistent with what packages are installed in the system
# this covers cases when system is installed with selinux-policy-{mls,minimal}
# or selinux-policy-{targeted,mls,minimal} where switched but the machine has not
# been rebooted yet.
# The macro should be called at the beginning of "post" (to make sure load_policy does not fail)
# and in "posttrans" (to make sure that the store is consistent when all package transitions are done)
# Parameter determines the policy type to be set in case of miss-configuration (if backup value is not usable)
# Steps:
# * load values from config and its backup
# * check whether SELINUXTYPE from backup is usable and make sure that it's set in the config if so
# * use "targeted" if it's being installed and BACKUP_SELINUXTYPE cannot be used
# * check whether SELINUXTYPE in the config is usable and change it to newly installed policy if it isn't
%define checkConfigConsistency() \
. %{_sysconfdir}/selinux/config; \
if [ -f %{_sysconfdir}/selinux/.config_backup ]; then \
. %{_sysconfdir}/selinux/.config_backup; \
else \
BACKUP_SELINUXTYPE=targeted; \
fi; \
if ls %{_sysconfdir}/selinux/$BACKUP_SELINUXTYPE/policy/policy.* &>/dev/null; then \
if [ "$BACKUP_SELINUXTYPE" != "$SELINUXTYPE" ]; then \
sed -i 's/^SELINUXTYPE=.*/SELINUXTYPE='"$BACKUP_SELINUXTYPE"'/g' %{_sysconfdir}/selinux/config; \
fi; \
elif [ "%1" = "targeted" ]; then \
if [ "%1" != "$SELINUXTYPE" ]; then \
sed -i 's/^SELINUXTYPE=.*/SELINUXTYPE=%1/g' %{_sysconfdir}/selinux/config; \
fi; \
elif ! ls %{_sysconfdir}/selinux/$SELINUXTYPE/policy/policy.* &>/dev/null; then \
if [ "%1" != "$SELINUXTYPE" ]; then \
sed -i 's/^SELINUXTYPE=.*/SELINUXTYPE=%1/g' %{_sysconfdir}/selinux/config; \
fi; \
fi;
# Create hidden backup of /etc/selinux/config and prepend BACKUP_ to names
# of variables inside so that they are easy to use later
# This should be done in "pretrans" because config content can change during RPM operations
# The macro has to be used in a script slot with "-p <lua>"
%define backupConfigLua() \
local sysconfdir = rpm.expand("%{_sysconfdir}") \
local config_file = sysconfdir .. "/selinux/config" \
local config_backup = sysconfdir .. "/selinux/.config_backup" \
os.remove(config_backup) \
if posix.stat(config_file) then \
local f = assert(io.open(config_file, "r"), "Failed to read " .. config_file) \
local content = f:read("*all") \
f:close() \
local backup = content:gsub("SELINUX", "BACKUP_SELINUX") \
local bf = assert(io.open(config_backup, "w"), "Failed to open " .. config_backup) \
bf:write(backup) \
bf:close() \
end
%build
%prep
@ -553,20 +501,13 @@ Conflicts: container-selinux < 2:1.12.1-22
%description targeted
SELinux Reference policy targeted base module.
%pretrans targeted -p <lua>
%backupConfigLua
%pre targeted
%preInstall targeted
%post targeted
%checkConfigConsistency targeted
%postInstall $1 targeted
exit 0
%posttrans targeted
%checkConfigConsistency targeted
%postun targeted
if [ $1 = 0 ]; then
source /etc/selinux/config
@ -632,9 +573,6 @@ Conflicts: container-selinux <= 1.9.0-9
%description minimum
SELinux Reference policy minimum base module.
%pretrans minimum -p <lua>
%backupConfigLua
%pre minimum
%preInstall minimum
if [ $1 -ne 1 ]; then
@ -642,7 +580,6 @@ if [ $1 -ne 1 ]; then
fi
%post minimum
%checkConfigConsistency minimum
contribpackages=`cat /usr/share/selinux/minimum/modules-contrib.lst`
basepackages=`cat /usr/share/selinux/minimum/modules-base.lst`
if [ ! -d /var/lib/selinux/minimum/active/modules/disabled ]; then
@ -674,9 +611,6 @@ done
fi
exit 0
%posttrans minimum
%checkConfigConsistency minimum
%postun minimum
if [ $1 = 0 ]; then
source /etc/selinux/config
@ -734,20 +668,13 @@ Conflicts: container-selinux <= 1.9.0-9
%description mls
SELinux Reference policy mls base module.
%pretrans mls -p <lua>
%backupConfigLua
%pre mls
%preInstall mls
%post mls
%checkConfigConsistency mls
%postInstall $1 mls
exit 0
%posttrans mls
%checkConfigConsistency mls
%postun mls
if [ $1 = 0 ]; then
source /etc/selinux/config