|
 |
5b70e6 |
#!/bin/bash
|
|
|
5b70e6 |
#
|
|
|
5b70e6 |
# Do automatic relabelling
|
|
|
5b70e6 |
#
|
|
|
5b70e6 |
|
|
|
5b70e6 |
# . /etc/init.d/functions
|
|
|
5b70e6 |
|
|
|
5b70e6 |
# If the user has this (or similar) UEFI boot order:
|
|
|
5b70e6 |
#
|
|
|
5b70e6 |
# Windows | grub | Linux
|
|
|
5b70e6 |
#
|
|
|
5b70e6 |
# And decides to boot into grub/Linux, then the reboot at the end of autorelabel
|
|
|
5b70e6 |
# would cause the system to boot into Windows again, if the autorelabel was run.
|
|
|
5b70e6 |
#
|
|
|
5b70e6 |
# This function restores the UEFI boot order, so the user will boot into the
|
|
|
5b70e6 |
# previously set (and expected) partition.
|
|
|
5b70e6 |
efi_set_boot_next() {
|
|
|
5b70e6 |
# NOTE: The [ -x /usr/sbin/efibootmgr ] test is not sufficent -- it could
|
|
|
5b70e6 |
# succeed even on system which is not EFI-enabled...
|
|
|
5b70e6 |
if ! efibootmgr > /dev/null 2>&1; then
|
|
|
5b70e6 |
return
|
|
|
5b70e6 |
fi
|
|
|
5b70e6 |
|
|
|
5b70e6 |
# NOTE: It it possible that some other services might be setting the
|
|
|
5b70e6 |
# 'BootNext' item for any reasons, and we shouldn't override it if so.
|
|
|
5b70e6 |
if ! efibootmgr | grep --quiet -e 'BootNext'; then
|
|
|
5b70e6 |
CURRENT_BOOT="$(efibootmgr | grep -e 'BootCurrent' | sed -re 's/(^.+:[[:space:]]*)([[:xdigit:]]+)/\2/')"
|
|
|
5b70e6 |
efibootmgr -n "${CURRENT_BOOT}" > /dev/null 2>&1
|
|
|
5b70e6 |
fi
|
|
|
5b70e6 |
}
|
|
|
5b70e6 |
|
|
|
5b70e6 |
relabel_selinux() {
|
|
|
5b70e6 |
# if /sbin/init is not labeled correctly this process is running in the
|
|
|
5b70e6 |
# wrong context, so a reboot will be required after relabel
|
|
|
5b70e6 |
AUTORELABEL=
|
|
|
5b70e6 |
. /etc/selinux/config
|
|
|
5b70e6 |
echo "0" > /sys/fs/selinux/enforce
|
|
|
5b70e6 |
[ -x /bin/plymouth ] && plymouth --quit
|
|
|
5b70e6 |
|
|
|
5b70e6 |
if [ "$AUTORELABEL" = "0" ]; then
|
|
|
5b70e6 |
echo
|
|
|
5b70e6 |
echo $"*** Warning -- SELinux ${SELINUXTYPE} policy relabel is required. "
|
|
|
5b70e6 |
echo $"*** /etc/selinux/config indicates you want to manually fix labeling"
|
|
|
5b70e6 |
echo $"*** problems. Dropping you to a shell; the system will reboot"
|
|
|
5b70e6 |
echo $"*** when you leave the shell."
|
|
|
5b70e6 |
sulogin
|
|
|
5b70e6 |
|
|
|
5b70e6 |
else
|
|
|
5b70e6 |
echo
|
|
|
5b70e6 |
echo $"*** Warning -- SELinux ${SELINUXTYPE} policy relabel is required."
|
|
|
5b70e6 |
echo $"*** Relabeling could take a very long time, depending on file"
|
|
|
5b70e6 |
echo $"*** system size and speed of hard drives."
|
|
|
5b70e6 |
|
|
|
5b70e6 |
FORCE=`cat /.autorelabel`
|
|
|
5b70e6 |
[ -x "/usr/sbin/quotaoff" ] && /usr/sbin/quotaoff -aug
|
|
|
5b70e6 |
/sbin/fixfiles $FORCE restore
|
|
|
5b70e6 |
fi
|
|
|
5b70e6 |
|
|
|
5b70e6 |
rm -f /.autorelabel
|
|
|
5b70e6 |
/usr/lib/dracut/dracut-initramfs-restore
|
|
|
5b70e6 |
efi_set_boot_next
|
|
|
5b70e6 |
if [ -x /usr/bin/grub2-editenv ]; then
|
|
|
5b70e6 |
grub2-editenv - incr boot_indeterminate >/dev/null 2>&1
|
|
|
5b70e6 |
fi
|
|
|
5b70e6 |
sync
|
|
|
5b70e6 |
systemctl --force reboot
|
|
|
5b70e6 |
}
|
|
|
5b70e6 |
|
|
|
5b70e6 |
# Check to see if a full relabel is needed
|
|
|
5b70e6 |
if [ "$READONLY" != "yes" ]; then
|
|
|
5b70e6 |
restorecon $(awk '!/^#/ && $4 !~ /noauto/ && $2 ~ /^\// { print $2 }' /etc/fstab) >/dev/null 2>&1
|
|
|
5b70e6 |
relabel_selinux
|
|
|
5b70e6 |
fi
|