|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
#!/bin/bash
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
### varrun-convert.sh
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
### convert legacy filecontext entries containing /var/run to /run
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
### and load an extra selinux module with the new content
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
### the script takes a policy name as an argument
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
# Set DEBUG=yes before running the script to get more verbose output
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
f84cade |
# on the terminal and to the $LOG file
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
if [ "${DEBUG}" = "yes" ]; then
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
set -x
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
fi
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
f84cade |
# Auxiliary and log files will be created in OUTPUTDIR
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
OUTPUTDIR="/run/selinux-policy"
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
LOG="$OUTPUTDIR/log"
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
mkdir -p ${OUTPUTDIR}
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
if [ -z ${1} ]; then
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
[ "${DEBUG}" = "yes" ] && echo "Error: Policy name required as an argument (e.g. targeted)" >> $LOG
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
exit
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
fi
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
f84cade |
SEMODULEOPT="-s ${1}"
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
f84cade |
[ "${DEBUG}" = "yes" ] && SEMODULEOPT="-v ${SEMODULEOPT}"
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
f84cade |
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
f84cade |
# Take current file_contexts and unify whitespace separators
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
FILE_CONTEXTS="/etc/selinux/${1}/contexts/files/file_contexts"
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
f84cade |
FILE_CONTEXTS_UNIFIED="$OUTPUTDIR/file_contexts_unified"
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
if [ ! -f ${FILE_CONTEXTS} ]; then
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
[ "${DEBUG}" = "yes" ] && echo "Error: File context database file does not exist" >> $LOG
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
exit
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
fi
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
if ! grep -q ^/var/run ${FILE_CONTEXTS}; then
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
[ "${DEBUG}" = "yes" ] && echo "Info: No entries containing /var/run" >> $LOG
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
exit
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
fi
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
f84cade |
EXTRA_VARRUN_ENTRIES_WITHDUP="$OUTPUTDIR/extra_varrun_entries_dup.txt"
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
EXTRA_VARRUN_ENTRIES="$OUTPUTDIR/extra_varrun_entries.txt"
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
f84cade |
EXTRA_VARRUN_CIL="$OUTPUTDIR/extra_varrun.cil"
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
# Print only /var/run entries
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
f84cade |
grep ^/var/run ${FILE_CONTEXTS} > ${EXTRA_VARRUN_ENTRIES_WITHDUP}
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
# Unify whitespace separators
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
f84cade |
sed -i 's/[ \t]\+/ /g' ${EXTRA_VARRUN_ENTRIES_WITHDUP}
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
f84cade |
sed 's/[ \t]\+/ /g' ${FILE_CONTEXTS} > ${FILE_CONTEXTS_UNIFIED}
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
f84cade |
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
f84cade |
# Deduplicate already existing /var/run=/run entries
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
f84cade |
while read line
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
f84cade |
do
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
f84cade |
subline="${line#/var}"
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
f84cade |
if ! grep -q "^${subline}" ${FILE_CONTEXTS_UNIFIED}; then
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
f84cade |
echo "$line"
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
f84cade |
fi
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
f84cade |
done < ${EXTRA_VARRUN_ENTRIES_WITHDUP} > ${EXTRA_VARRUN_ENTRIES}
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
# Change /var/run to /run
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
sed -i 's|^/var/run|/run|' ${EXTRA_VARRUN_ENTRIES}
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
# Exception handling: packages with already duplicate entries
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
sed -i '/^\/run\/snapd/d' ${EXTRA_VARRUN_ENTRIES}
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
sed -i '/^\/run\/vfrnav/d' ${EXTRA_VARRUN_ENTRIES}
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
sed -i '/^\/run\/waydroid/d' ${EXTRA_VARRUN_ENTRIES}
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
# Change format to cil
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
sed -i 's/^\([^ ]\+\) \([^-]\)/\1 any \2/' ${EXTRA_VARRUN_ENTRIES}
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
sed -i 's/^\([^ ]\+\) -- /\1 file /' ${EXTRA_VARRUN_ENTRIES}
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
sed -i 's/^\([^ ]\+\) -b /\1 block /' ${EXTRA_VARRUN_ENTRIES}
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
sed -i 's/^\([^ ]\+\) -c /\1 char /' ${EXTRA_VARRUN_ENTRIES}
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
sed -i 's/^\([^ ]\+\) -d /\1 dir /' ${EXTRA_VARRUN_ENTRIES}
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
sed -i 's/^\([^ ]\+\) -l /\1 symlink /' ${EXTRA_VARRUN_ENTRIES}
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
sed -i 's/^\([^ ]\+\) -p /\1 pipe /' ${EXTRA_VARRUN_ENTRIES}
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
sed -i 's/^\([^ ]\+\) -s /\1 socket /' ${EXTRA_VARRUN_ENTRIES}
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
sed -i 's/^\([^ ]\+\) /(filecon "\1" /' ${EXTRA_VARRUN_ENTRIES}
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
sed -i 's/system_u:object_r:\([^:]*\):\(.*\)$/(system_u object_r \1 ((\2) (\2))))/' ${EXTRA_VARRUN_ENTRIES}
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
# Handle entries with <<none>> which do not match previous regexps
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
sed -i s'/ <<none>>$/ ())/' ${EXTRA_VARRUN_ENTRIES}
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
# Wrap each line with an optional block
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
1cbbaa6 |
i=1
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
while read line
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
do
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
echo "(optional extra_var_run_${i}"
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
echo " $line"
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
echo ")"
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
((i++))
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
done < ${EXTRA_VARRUN_ENTRIES} > ${EXTRA_VARRUN_CIL}
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
# Load module
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
f84cade |
[ -s ${EXTRA_VARRUN_CIL} ] &&
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
/usr/sbin/semodule ${SEMODULEOPT} -i ${EXTRA_VARRUN_CIL}
|
|
![](https://seccdn.libravatar.org/avatar/f5f39686c696f412e8ed564241807306fff38278b276da30a2d3c41583d69f2a?s=16&d=retro) |
0a14f83 |
|