Blame SOURCES/daemon-scl-helper.sh

c7586b
#!/bin/sh
c7586b
c7586b
# This helper script is necessary for having proper SELinux context of daemon
c7586b
# process run in SCL environment via systemd unit file.
c7586b
# Without this script the process looses SELinux type because /usr/bin/scl
c7586b
# has context bin_t and unit_t -> bin_t results in unconfined process running.
c7586b
# If this helper script has the same SELinux context as the original binary,
c7586b
# the process will have proper SELinux context.
c7586b
#
c7586b
# This script was designed to be usable the same as the scl command is used,
c7586b
# including the collections given as more arguments, separated from binary
c7586b
# itself by -- separator.
c7586b
# So it is possible to use the list of collections to be enabled via
c7586b
# environment file.
c7586b
# Thus, instead of:
c7586b
#   /usr/bin/scl enable scl1 scl2 -- /path/to/bin arg1 arg2
c7586b
# you can use:
c7586b
#   /usr/bin/this-script enable scl1 scl2 -- /path/to/bin arg1 arg2
c7586b
#
c7586b
# Notice: do not forget to set proper SELinux context for this file.
c7586b
# The context should be the same as the binary running has.
c7586b
c7586b
action="$1"
c7586b
shift
c7586b
c7586b
while [ -n "$1" ] && [ "$1" != "--" ] ; do
c7586b
  source scl_source "$action" "$1"
c7586b
  shift
c7586b
done
c7586b
c7586b
if [ $# -le 2 ] ; then
c7586b
  echo "Usage `basename $0` enable sclname [sclname ...] -- /path/to/bin [arg ...]" >&2
c7586b
  exit 1
c7586b
fi
c7586b
c7586b
shift
c7586b
c7586b
exec "$@"
c7586b
c7586b
c7586b