selinux 1:0.11 / etc / init.d / selinux

#!/bin/sh

### BEGIN INIT INFO
# Provides:        selinux
# Required-Start:
# Required-Stop:
# Default-Start:   2 3 4 5
# Default-Stop:    0 6
# Short-Description: Relabel the filesystem before reboot
### END INIT INFO

# Name of the file to create if requesting relabeling
statusfile=/.autorelabel
switchfile=/.switchpolicy

# Source function library
. /lib/lsb/init-functions

# Get the selinux configuration variables
SELINUXTYPE=""
if [ -e $switchfile ]; then
	. $switchfile
elif [ -e /etc/selinux/config ]; then
	. /etc/selinux/config 
fi

SETFILES=/sbin/setfiles
LOAD_POLICY=/usr/sbin/load_policy

# From fixfiles - determine what filesystems can be relabeled
FILESYSTEMSRW=`/bin/mount | /bin/grep -v "context=" | /bin/egrep -v '\((|.*,)bind(,.*|)\)' | /usr/bin/awk '/(ext[234]| xfs | jfs ).*\(rw/{print $3}';`
FILESYSTEMSRO=`/bin/mount | /bin/grep -v "context=" | /bin/egrep -v '\((|.*,)bind(,.*|)\)' | /usr/bin/awk '/(ext[234]| xfs | jfs ).*\(ro/{print $3}';`
FILESYSTEMS="$FILESYSTEMSRW $FILESYSTEMSRO"

lockdir=/var/lock/selinux-relabel

# Start only creates the lock
start() {
	log_daemon_msg "Starting SELinux autorelabel"
	if [ -e $statusfile ]; then
		log_warning_msg "A relabel has already been requested. Please reboot to finish relabeling your system."
		log_end_msg 0
	else
		mkdir $lockdir 2>/dev/null || true
		log_end_msg 0
	fi
}

# Stop performs the relabeling and removes the request to relabel
stop() {
	if [ -e $statusfile ]; then
		if [ "x${SELINUXTYPE}" = "x" ]; then
			log_failure_msg "No SELinux policy found"
			/bin/rmdir $lockdir
			exit 5  # LSB defines this as 'program is not installed'
		fi
		if [ `/usr/sbin/getenforce` != "Disabled" ]; then
			echo "0" > /selinux/enforce
		fi
		log_warning_msg "If you are not already running SELinux, then you can"
		log_warning_msg "safely ignore the following error message."
 		${LOAD_POLICY} && log_action_msg "Policy loaded successfully"
 		log_warning_msg "SELinux ${SELINUXTYPE} policy relabel is required."
	 	log_warning_msg "Relabeling could take a very long time, depending"
		log_warning_msg "on file system size and speed of hard drives."
		/bin/sed -i -f $statusfile /etc/selinux/config
		log_action_begin_msg "Relabeling files"
		${SETFILES} /etc/selinux/${SELINUXTYPE}/contexts/files/file_contexts ${FILESYSTEMS}
		log_action_end_msg $?
		/bin/rm -f $statusfile $switchfile
	fi
	/bin/rmdir $lockdir
}

# Restart does nothing
restart() {
	start
}

# Determine if relabel has been requested
status() {
	if [ -d $lockdir ] ; then
		if [ -e $statusfile ]; then
			echo "Filesystem will be relabeled using policy ${SELINUXTYPE}."
		else
			echo "No relabeling requested."
		fi
		exit 0
	else
		echo "Not started"
		exit 3   # LSB defines this as 'program is not running'
	fi
}

# This creates the file 
relabel() {
	log_success_msg "File relabel will occur upon next shutdown/reboot."
	/usr/bin/touch $statusfile
}

# This causes the policy to change before relabeling
switch() {
	if [ ! -z $1 ]; then 
		relabel
		echo "s/^SELINUXTYPE=.*/SELINUXTYPE=$1/" > $statusfile
		echo "SELINUXTYPE=$1" > $switchfile
		if [ ! -z $2 ]; then
			echo "s/^SELINUX=.*/SELINUX=$2/" >> $statusfile
			echo "SELINUX=$2" >> $switchfile
		fi
	else
		echo "No policy specified"
		exit 1
	fi
}

cancel() {
	/bin/rm -f $statusfile $switchfile
}

help() {
	echo
	echo "$0: Automatic relabel on reboot."
	echo
	echo "This script will cause automatic relabeling of the filesystem before"
	echo "a reboot upon request." 
	echo
	echo "Options:"
	echo
	echo "   status   Check if relabeling has been requested"
	echo
	echo "   relabel  Request that the filesystem be relabeled"
	echo
	echo "   switch POLICY [ENFORCING]"
	echo "            Request to switch to POLICY and set to ENFORCING (implies relabel)"
	echo
	echo "   cancel   Cancel a previous request to relabel"
	echo "            If no request exists, this option does nothing"
	echo
	echo "   help     Display this help message"
	echo
}

case "$1" in 
	start)
		start
		;;
	stop)
		stop
		;;
	status)
		status
		;;
	restart|try-restart|reload|force-reload)
		restart
		;;
	relabel)
		relabel
		;;
	switch)
		# syntax: selinux switch <new_policy_name> <"enforcing"|"permissive">
		switch $2 $3
		;;
	cancel)
		cancel
		;;
	help)
		help
		;;
	*)
		log_failure_msg "Usage: $0 (status|relabel|switch|cancel|help)"
		exit 2  # LSB defines this as 'invalid argument'
esac

exit 0