Re: SE-Linux packages

[Anton Emmerfors <anton@vegasys.com>]

On Fri, Sep 20, 2002 at 05:47:53PM +0200, Russell Coker wrote:
> 
> > [3] If installing packages after the SE-Linux version of dpkg has
> > been installed, but a SE-Linux kernel is not yet booted,
> > /etc/dpkg/postinst.d/selinux broke badly, and I had to disable it.
> 
> Yes, you could have just removed the "-e" in that script though...
> 
> Probably should make the script check for a running SE kernel and only try to 
> do anything if it's running.

I encountered the same problem and hacked the script as follows. Not
sure if it is the best test but it works for me...


	/Anton

-8<--8=--

#!/bin/sh -e

SELINUX=$(avc_enforcing 2>&1)
if [ "x$SELINUX" = "xpermissive" -o "x$SELINUX" = "xenforcing" ]; then
  if [ -e /etc/selinux ]; then
    make -s -C /etc/selinux file_contexts/file_contexts
    SETFILES=/usr/sbin/setfiles
    if [ -x /usr/sbin/setfiles.old ]; then
      SETFILES=/usr/sbin/setfiles.old
    fi
    dpkg -L $1 | grep ^/.. | $SETFILES -q -s /etc/selinux/file_contexts/file_contexts
    if [ -x /usr/sbin/setfiles.old -a "$1" = "selinux" ]; then
      rm /usr/sbin/setfiles.old
    fi
  fi
else
  echo "Not running on SELinux-enabled kernel, files not relabeled."
  echo "Run 'make -C /etc/selinux/ relabel' manually to relabel."
fi

-8<--8=--
						

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.