diff --git a/libselinux.changes b/libselinux.changes index 407a06c..5abd001 100644 --- a/libselinux.changes +++ b/libselinux.changes @@ -1,25 +1,3 @@ -------------------------------------------------------------------- -Fri Apr 9 07:27:27 UTC 2010 - thomas@novell.com - -- selinux-ready: added function to check for restorecond in - runlevel 3/5 - -------------------------------------------------------------------- -Thu Apr 8 06:37:34 UTC 2010 - thomas@novell.com - -- selinux-ready: added functions for checking PAM config and - policy boolean init_upstart - -------------------------------------------------------------------- -Wed Apr 7 13:26:59 UTC 2010 - thomas@novell.com - -- selinux-ready: fixed init ramfs checking - -------------------------------------------------------------------- -Wed Apr 7 12:59:41 UTC 2010 - thomas@novell.com - -- added new selinux-ready script - ------------------------------------------------------------------- Thu Feb 25 14:57:16 UTC 2010 - prusnak@suse.cz diff --git a/selinux-ready b/selinux-ready index 48b59a3..3139506 100644 --- a/selinux-ready +++ b/selinux-ready @@ -22,7 +22,7 @@ check_dir() check_filesystem() { FSPATH="/proc/filesystems" - FSNAME="securityfs" + FSNAME="selinuxfs" grep -w $FSNAME $FSPATH 1>&2 >/dev/null @@ -37,11 +37,11 @@ check_filesystem() check_boot() { - BPARAM="selinux=1" + BPARAM="security=selinux.*selinux=1.*enforcing=?" # XXX order not mandatory printf "\tcheck_boot: Assuming GRUB as bootloader.\n" - BLINE=$(grep -- $BPARAM /boot/grub/menu.lst 2>/dev/null) # XXX check for multiple lines in config + BLINE=$(grep -E $BPARAM /boot/grub/menu.lst 2>/dev/null) # XXX check for multiple lines in config if [ $? == 0 ]; then K=$(echo $BLINE | awk -F' ' '{print $2}') @@ -80,99 +80,20 @@ check_mkinitrd() cd initrd-extracted gunzip -c $TD/i.cpio.gz | cpio -i --force-local --no-absolute-filenames 2>/dev/null grep -E -- $MCMD boot/* 2>&1 >/dev/null - FLG1=$? - grep -E -- load_policy boot/* 2>&1 >/dev/null - FLG2=$? + FLG=$? popd 2>&1>/dev/null - if [ $FLG1 == 0 -a $FLG2 == 0 ];then + if [ $FLG == 0 ];then printf "\tcheck_mkinitrd: OK. Your initrd seems to be correct.\n" return 0 else printf "\tcheck_mkinitrd: ERR. Your initrd seems not to mount /proc of\n" - printf "\t the root filesystem during boot and/or load_policy\n" - printf "\t is missing,\n" - printf "\t this may be a reason for SELinux not working.\n" + printf "\t the root filesystem during boot, this may be a\n" + printf "\t reason for SELinux not working.\n" return 1 fi } -check_pam() -{ - AA_PAM=0 - SE_PAM=0 - - # test for AA pam module - grep apparmor /etc/pam.d/* 2>&1 >/dev/null - FLG=$? - if [ $FLG == 0 ]; then - AA_PAM=1 - fi - - # test for SELinux pam module - grep selinux /etc/pam.d/* 2>&1 >/dev/null - FLG=$? - if [ $FLG == 0 ]; then - SE_PAM=1 - fi - - # suggest config - if [ $SE_PAM == 1 ] && [ $AA_PAM == 0 ]; then - printf "\tcheck_pam: OK. Your PAM configuration seems to be correct.\n" - return 0 - fi - printf "\tcheck_pam: ERR. Your PAM configuration seems to be incorrect.\n" - if [ $AA_PAM == 1 ]; then - printf " execute 'pam-config -d --apparmor' as root\n" - fi - if [ $SE_PAM == 0 ]; then - printf " execute 'pam-config -a --selinux' as root\n" - fi - - return 1 -} - -check_initupstart() -{ - CFGFILE="/etc/selinux/config" - - if ! [ -f $CFGFILE ]; then - printf "\tcheck_initupstart: ERR. $CFGFILE does not exist.\n" - return 1; - fi - - POL=$(grep SELINUXTYPE $CFGFILE | sed "s/SELINUXTYPE\s*=\s*"//) - - if ! [ -f /etc/selinux/$POL/booleans ]; then - printf "\tcheck_initupstart: ERR. booleans file for policy $POL does not exist.\n" - return 1 - fi - - INITUS=$(grep init_upstart /etc/selinux/$POL/booleans | sed "s/.*init_upstart\s*=\s*//") - - if [ "$INITUS" == 1 ]; then - printf "\tcheck_initupstart: OK. init_upstart in $POL/booleans is set to 1.\n" - return 0 - else - printf "\tcheck_initupstart: ERR. init_upstart in $POL/booleans is NOT set to 1 ($INITUS).\n" - return 1 - fi - -} - -check_runlevel() -{ - #ls -q /etc/rc.d/rc[35].d/S*restorecond 1>&2 >/dev/null - - #if [ $? == 0 ]; then - if [ -x /etc/rc.d/rc3.d/S*restorecond ] || [ -x /etc/rc.d/rc5.d/S*restorecond ]; then - printf "\tcheck_runlevel: OK. your system is using restorecond in runlevel 3 and/or 5.\n" - return 0; - fi - printf "\tcheck_runlevel: ERR. please execute 'yast2 runlevel' and enable restorecond.\n" - return 1 -} - check_packages() { PKGLST="checkpolicy policycoreutils selinux-tools libselinux1 libsepol1 libsemanage1 selinux-policy" @@ -199,13 +120,8 @@ check_config() { CF="/etc/selinux/config" - if [ -f $CF ];then printf "\tcheck_config: OK. Config file seems to be there.\n" - if ! [ $(stat --printf=%a $CF) -eq "644" ]; then - printf "\tcheck_config: ERR. Config file '$CF' has wrong permissions.\n" - return 1 - fi return 0 else printf "\tcheck_config: ERR. Config file '$CF' is missing.\n" @@ -222,8 +138,6 @@ check_boot check_mkinitrd check_packages check_config -check_initupstart -check_pam -check_runlevel rm -rf $TD +