scripts/selinux/install_policy.sh

0001 #!/bin/sh
0002 # SPDX-License-Identifier: GPL-2.0
0003 set -e
0004 if [ `id -u` -ne 0 ]; then
0005         echo "$0: must be root to install the selinux policy"
0006         exit 1
0007 fi
0008
0009 SF=`which setfiles`
0010 if [ $? -eq 1 ]; then
0011         echo "Could not find setfiles"
0012         echo "Do you have policycoreutils installed?"
0013         exit 1
0014 fi
0015
0016 CP=`which checkpolicy`
0017 if [ $? -eq 1 ]; then
0018         echo "Could not find checkpolicy"
0019         echo "Do you have checkpolicy installed?"
0020         exit 1
0021 fi
0022 VERS=`$CP -V | awk '{print $1}'`
0023
0024 ENABLED=`which selinuxenabled`
0025 if [ $? -eq 1 ]; then
0026         echo "Could not find selinuxenabled"
0027         echo "Do you have libselinux-utils installed?"
0028         exit 1
0029 fi
0030
0031 if selinuxenabled; then
0032     echo "SELinux is already enabled"
0033     echo "This prevents safely relabeling all files."
0034     echo "Boot with selinux=0 on the kernel command-line or"
0035     echo "SELINUX=disabled in /etc/selinux/config."
0036     exit 1
0037 fi
0038
0039 cd mdp
0040 ./mdp -m policy.conf file_contexts
0041 $CP -U allow -M -o policy.$VERS policy.conf
0042
0043 mkdir -p /etc/selinux/dummy/policy
0044 mkdir -p /etc/selinux/dummy/contexts/files
0045
0046 echo "__default__:user_u:s0" > /etc/selinux/dummy/seusers
0047 echo "base_r:base_t:s0" > /etc/selinux/dummy/contexts/failsafe_context
0048 echo "base_r:base_t:s0 base_r:base_t:s0" > /etc/selinux/dummy/default_contexts
0049 cat > /etc/selinux/dummy/contexts/x_contexts <<EOF
0050 client * user_u:base_r:base_t:s0
0051 property * user_u:object_r:base_t:s0
0052 extension * user_u:object_r:base_t:s0
0053 selection * user_u:object_r:base_t:s0
0054 event * user_u:object_r:base_t:s0
0055 EOF
0056 touch /etc/selinux/dummy/contexts/virtual_domain_context
0057 touch /etc/selinux/dummy/contexts/virtual_image_context
0058
0059 cp file_contexts /etc/selinux/dummy/contexts/files
0060 cp dbus_contexts /etc/selinux/dummy/contexts
0061 cp policy.$VERS /etc/selinux/dummy/policy
0062 FC_FILE=/etc/selinux/dummy/contexts/files/file_contexts
0063
0064 if [ ! -d /etc/selinux ]; then
0065         mkdir -p /etc/selinux
0066 fi
0067 if [ -f /etc/selinux/config ]; then
0068     echo "/etc/selinux/config exists, moving to /etc/selinux/config.bak."
0069     mv /etc/selinux/config /etc/selinux/config.bak
0070 fi
0071 echo "Creating new /etc/selinux/config for dummy policy."
0072 cat > /etc/selinux/config << EOF
0073 SELINUX=permissive
0074 SELINUXTYPE=dummy
0075 EOF
0076
0077 cd /etc/selinux/dummy/contexts/files
0078 $SF -F file_contexts /
0079
0080 mounts=`cat /proc/$$/mounts | \
0081         egrep "ext[234]|jfs|xfs|reiserfs|jffs2|gfs2|btrfs|f2fs|ocfs2" | \
0082         awk '{ print $2 '}`
0083 $SF -F file_contexts $mounts
0084
0085 echo "-F" > /.autorelabel