sig_cloud/diskimage-builder
11
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Relabel filesystem if SELinux is available

Browse Source 
Relabel the filesystem during image builds if SELinux is supported
in the kernel of the build machine and userspace tools are available.

Otherwise touch /.autorelabel to schedule a relabel the first time
the image boots. We relabel when possible because it decreases first
boot time.

Change-Id: I0bec885d6e5d4f4e1106f3bd2a90ba5f86395b07
Partial-Bug: 1347845
This commit is contained in:
Victor Lowther 2014-07-21 08:31:55 -05:00 committed by Richard Su
parent fc5e791a6b
commit e92398a318
1 changed files with 5 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
elements/rpm-distro/finalise.d/11-selinux-fixfiles-restore
View File

@ -3,16 +3,14 @@
set -eux
set -o pipefail
CONFIGURED_SELINUX=$(grep ^SELINUX= /etc/selinux/config | awk -F = '{print $2}')
if [ "$CONFIGURED_SELINUX" == "enforcing" ]; then
if [ -d /sys/fs/selinux -a /etc/selinux/targeted/contexts/files/file_context\
s -a -x /usr/sbin/setfiles ]; then
# Without fixing selinux file labels, sshd will run in the kernel_t domain
# instead of the sshd_t domain, making ssh connections fail with
# "Unable to get valid context for <user>" error message
setfiles /etc/selinux/targeted/contexts/files/file_contexts /
else
echo "Skipping SELinux relabel, since it is not Enforcing."
echo "To relabel once the image is running, use:"
echo "setfiles /etc/selinux/targeted/contexts/files/file_contexts /"
echo "fixfiles restore"
echo "Skipping SELinux relabel, since setfiles is not available."
echo "Touching /.autorelabel to schedule a relabel when the image boots."
touch /.autorelabel
fi