diff options
Diffstat (limited to 'modules.d/98selinux')
-rwxr-xr-x | modules.d/98selinux/module-setup.sh | 17 | ||||
-rwxr-xr-x | modules.d/98selinux/selinux-loadpolicy.sh | 70 |
2 files changed, 87 insertions, 0 deletions
diff --git a/modules.d/98selinux/module-setup.sh b/modules.d/98selinux/module-setup.sh new file mode 100755 index 0000000..3574b12 --- /dev/null +++ b/modules.d/98selinux/module-setup.sh @@ -0,0 +1,17 @@ +#!/bin/bash + +# called by dracut +check() { + return 255 +} + +# called by dracut +depends() { + return 0 +} + +# called by dracut +install() { + inst_hook pre-pivot 50 "$moddir/selinux-loadpolicy.sh" + inst_multiple setenforce chroot +} diff --git a/modules.d/98selinux/selinux-loadpolicy.sh b/modules.d/98selinux/selinux-loadpolicy.sh new file mode 100755 index 0000000..0235b8e --- /dev/null +++ b/modules.d/98selinux/selinux-loadpolicy.sh @@ -0,0 +1,70 @@ +#!/bin/sh + +# FIXME: load selinux policy. this should really be done after we switchroot + +rd_load_policy() { + # If SELinux is disabled exit now + getarg "selinux=0" > /dev/null && return 0 + + SELINUX="enforcing" + # shellcheck disable=SC1090 + [ -e "$NEWROOT/etc/selinux/config" ] && . "$NEWROOT/etc/selinux/config" + + # Check whether SELinux is in permissive mode + permissive=0 + + if getarg "enforcing=0" > /dev/null || [ "$SELINUX" = "permissive" ]; then + permissive=1 + fi + + # Attempt to load SELinux Policy + if [ -x "$NEWROOT/usr/sbin/load_policy" -o -x "$NEWROOT/sbin/load_policy" ]; then + local ret=0 + local out + info "Loading SELinux policy" + mount -o bind /sys "$NEWROOT"/sys + # load_policy does mount /proc and /sys/fs/selinux in + # libselinux,selinux_init_load_policy() + if [ -x "$NEWROOT/sbin/load_policy" ]; then + out=$(LANG=C chroot "$NEWROOT" /sbin/load_policy -i 2>&1) + ret=$? + info "$out" + else + out=$(LANG=C chroot "$NEWROOT" /usr/sbin/load_policy -i 2>&1) + ret=$? + info "$out" + fi + umount "$NEWROOT"/sys/fs/selinux + umount "$NEWROOT"/sys + + if [ "$SELINUX" = "disabled" ]; then + return 0 + fi + + if [ $ret -eq 0 -o $ret -eq 2 ]; then + # If machine requires a relabel, force to permissive mode + [ -e "$NEWROOT"/.autorelabel ] && LANG=C /usr/sbin/setenforce 0 + mount --rbind /dev "$NEWROOT/dev" + LANG=C chroot "$NEWROOT" /sbin/restorecon -R /dev + umount -R "$NEWROOT/dev" + return 0 + fi + + warn "Initial SELinux policy load failed." + if [ $ret -eq 3 -o $permissive -eq 0 ]; then + warn "Machine in enforcing mode." + warn "Not continuing" + emergency_shell -n selinux + exit 1 + fi + return 0 + elif [ $permissive -eq 0 -a "$SELINUX" != "disabled" ]; then + warn "Machine in enforcing mode and cannot execute load_policy." + warn "To disable selinux, add selinux=0 to the kernel command line." + warn "Not continuing" + emergency_shell -n selinux + exit 1 + fi +} + +rd_load_policy |