openstack/diskimage-builder
Code Issues Proposed changes

Merge "Skip relabel unless SELinux is enforcing"

Browse Source
This commit is contained in:
Jenkins 2014-01-30 08:03:01 +00:00 committed by Gerrit Code Review
commit f43f0eea85
1 changed files with 17 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
elements/rpm-distro/finalise.d/11-selinux-fixfiles-restore
View File

@ -2,11 +2,20 @@
set -x
# Without fixing selinux file labels, sshd will run in the kernel_t domain
# instead of the sshd_t domain, making ssh connections fail with
# "Unable to get valid context for <user>" error message
setfiles /etc/selinux/targeted/contexts/files/file_contexts /
FIXFILES_LOG=$(mktemp)
fixfiles -l $FIXFILES_LOG restore
cat $FIXFILES_LOG
rm $FIXFILES_LOG
CONFIGURED_SELINUX=$(grep ^SELINUX= /etc/selinux/config | awk -F = '{print $2}')
if [ "$CONFIGURED_SELINUX" == "enforcing" ]; then
# Without fixing selinux file labels, sshd will run in the kernel_t domain
# instead of the sshd_t domain, making ssh connections fail with
# "Unable to get valid context for <user>" error message
setfiles /etc/selinux/targeted/contexts/files/file_contexts /
FIXFILES_LOG=$(mktemp)
fixfiles -l $FIXFILES_LOG restore
cat $FIXFILES_LOG
rm $FIXFILES_LOG
else
echo "Skipping SELinux relabel, since it is not Enforcing."
echo "To relabel once the image is running, use:"
echo "setfiles /etc/selinux/targeted/contexts/files/file_contexts /"
echo "fixfiles restore"
fi