TencentOS
/
TencentOS-kernel
mirror of https://github.com/Tencent/TencentOS-kernel
0
0
Fork 4
Code Issues Projects Releases Wiki Activity

dist: tk4: add the function of disabling selinux 

When kernel rpm is installed, if selinux in the host is not set,
the function of selinux will be disabled.

Signed-off-by: Chun Liu <kaicliu@tencent.com>
This commit is contained in:
liuchun 2022-10-17 15:12:00 +08:00 committed by Kairui Song
parent 1014f31426
commit 83267df9d1
1 changed files with 23 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
dist/templates/kernel.template.spec vendored
View File

@ -1122,6 +1122,29 @@ elif command -v new-kernel-pkg > /dev/null; then
else
echo "NOTICE: No available kernel install handler found. Please make sure boot loader and initramfs are properly configured after the installation." > /dev/stderr
fi
# If match, the selinux will be disabled.
is_set_selinux=0
if [ -e /proc/config.gz ]; then
zcat /proc/config.gz | grep -q "^CONFIG_SECURITY_SELINUX=y"
is_set_selinux=$?
elif [ -e /boot/config-$(uname -r) ]; then
cat /boot/config-$(uname -r) | grep -q "^CONFIG_SECURITY_SELINUX=y"
is_set_selinux=$?
elif [ -e /proc/kallsyms ]; then
cat /proc/kallsyms | grep -q " selinux_init$"
is_set_selinux=$?
else
echo "Ignore selinux adjustments"
fi
# if CONFIG_SECURITY_SELINUX is not set, we should disable selinux.
[ $is_set_selinux -ne 0 ] && {
echo "Selinux is not supported by current running kernel, disabling SELinux globally to avoid potential system failure."
echo "Please update /etc/selinux/config manually after testing SELinux functionality. Now setting SELINUX=disabled"
grep -q "^SELINUX *= *.*$" /etc/selinux/config && sed -ri "s/^ *SELINUX *= *enforcing *$/SELINUX=disabled/" /etc/selinux/config || echo "SELINUX=disabled" >> /etc/selinux/config
}
# Just in case kernel-install didn't depmod
depmod -A %{kernel_unamer}