scripts/selinux/install_policy.sh

   1 #!/bin/sh
   2 # SPDX-License-Identifier: GPL-2.0
   3 set -e
   4 if [ `id -u` -ne 0 ]; then
   5         echo "$0: must be root to install the selinux policy"
   6         exit 1
   7 fi
   8
   9 SF=`which setfiles`
  10 if [ $? -eq 1 ]; then
  11         echo "Could not find setfiles"
  12         echo "Do you have policycoreutils installed?"
  13         exit 1
  14 fi
  15
  16 CP=`which checkpolicy`
  17 if [ $? -eq 1 ]; then
  18         echo "Could not find checkpolicy"
  19         echo "Do you have checkpolicy installed?"
  20         exit 1
  21 fi
  22 VERS=`$CP -V | awk '{print $1}'`
  23
  24 ENABLED=`which selinuxenabled`
  25 if [ $? -eq 1 ]; then
  26         echo "Could not find selinuxenabled"
  27         echo "Do you have libselinux-utils installed?"
  28         exit 1
  29 fi
  30
  31 if selinuxenabled; then
  32     echo "SELinux is already enabled"
  33     echo "This prevents safely relabeling all files."
  34     echo "Boot with selinux=0 on the kernel command-line or"
  35     echo "SELINUX=disabled in /etc/selinux/config."
  36     exit 1
  37 fi
  38
  39 cd mdp
  40 ./mdp -m policy.conf file_contexts
  41 $CP -U allow -M -o policy.$VERS policy.conf
  42
  43 mkdir -p /etc/selinux/dummy/policy
  44 mkdir -p /etc/selinux/dummy/contexts/files
  45
  46 echo "__default__:user_u:s0" > /etc/selinux/dummy/seusers
  47 echo "base_r:base_t:s0" > /etc/selinux/dummy/contexts/failsafe_context
  48 echo "base_r:base_t:s0 base_r:base_t:s0" > /etc/selinux/dummy/default_contexts
  49 cat > /etc/selinux/dummy/contexts/x_contexts <<EOF
  50 client * user_u:base_r:base_t:s0
  51 property * user_u:object_r:base_t:s0
  52 extension * user_u:object_r:base_t:s0
  53 selection * user_u:object_r:base_t:s0
  54 event * user_u:object_r:base_t:s0
  55 EOF
  56 touch /etc/selinux/dummy/contexts/virtual_domain_context
  57 touch /etc/selinux/dummy/contexts/virtual_image_context
  58
  59 cp file_contexts /etc/selinux/dummy/contexts/files
  60 cp dbus_contexts /etc/selinux/dummy/contexts
  61 cp policy.$VERS /etc/selinux/dummy/policy
  62 FC_FILE=/etc/selinux/dummy/contexts/files/file_contexts
  63
  64 if [ ! -d /etc/selinux ]; then
  65         mkdir -p /etc/selinux
  66 fi
  67 if [ -f /etc/selinux/config ]; then
  68     echo "/etc/selinux/config exists, moving to /etc/selinux/config.bak."
  69     mv /etc/selinux/config /etc/selinux/config.bak
  70 fi
  71 echo "Creating new /etc/selinux/config for dummy policy."
  72 cat > /etc/selinux/config << EOF
  73 SELINUX=permissive
  74 SELINUXTYPE=dummy
  75 EOF
  76
  77 cd /etc/selinux/dummy/contexts/files
  78 $SF -F file_contexts /
  79
  80 mounts=`cat /proc/$$/mounts | \
  81         egrep "ext[234]|jfs|xfs|reiserfs|jffs2|gfs2|btrfs|f2fs|ocfs2" | \
  82         awk '{ print $2 '}`
  83 $SF -F file_contexts $mounts
  84
  85 echo "-F" > /.autorelabel