RepoMirrors/selinux-refpolicy
1
0
Fork 0
mirror of https://github.com/SELinuxProject/refpolicy synced 2025-01-22 23:22:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Vagrantfile: remove sudo

Browse Source 
The provisioning scripts are already run as root.

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
This commit is contained in:
Nicolas Iooss 2019-12-22 18:12:34 +01:00
parent d82115ac48
commit d1f92dae04
No known key found for this signature in database
GPG Key ID: C191415F340DAAA0
1 changed files with 13 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
Vagrantfile vendored
View File

@ -15,43 +15,43 @@ $install_refpolicy = <<-SHELL
sudo -su vagrant make -C /vagrant conf
sudo -su vagrant make -C /vagrant all
sudo -su vagrant make -C /vagrant validate
sudo -s make -C /vagrant install
sudo -s make -C /vagrant install-headers
sudo -s semodule -s refpolicy -i /usr/share/selinux/refpolicy/*.pp
make -C /vagrant install
make -C /vagrant install-headers
semodule -s refpolicy -i /usr/share/selinux/refpolicy/*.pp
if ! (LANG=C sestatus -v | grep '^Loaded policy name:\s*refpolicy$' > /dev/null)
then
# Use the reference policy
sed -i -e 's/^\\(SELINUXTYPE=\\).*/SELINUXTYPE=refpolicy/' /etc/selinux/config
fi
sudo -s semodule --reload
semodule --reload
# allow every domain to use /dev/urandom
sudo -s semanage boolean --modify --on global_ssp
semanage boolean --modify --on global_ssp
# allow systemd-tmpfiles to manage every file
sudo -s semanage boolean --modify --on systemd_tmpfiles_manage_all
semanage boolean --modify --on systemd_tmpfiles_manage_all
# make vagrant user use unconfined_u context
if ! (sudo -s semanage login -l | grep '^vagrant' > /dev/null)
if ! (semanage login -l | grep '^vagrant' > /dev/null)
then
echo "Configuring SELinux context for vagrant user"
sudo -s semanage login -a -s unconfined_u vagrant
semanage login -a -s unconfined_u vagrant
fi
# label /vagrant as vagrant's home files
if sudo -s semanage fcontext --list | grep '^/vagrant(/\.\*)?'
if semanage fcontext --list | grep '^/vagrant(/\.\*)?'
then
sudo -s semanage fcontext -m -s unconfined_u -t user_home_t '/vagrant(/.*)?'
semanage fcontext -m -s unconfined_u -t user_home_t '/vagrant(/.*)?'
else
sudo -s semanage fcontext -a -s unconfined_u -t user_home_t '/vagrant(/.*)?'
semanage fcontext -a -s unconfined_u -t user_home_t '/vagrant(/.*)?'
fi
# Update interface_info
sudo -s sepolgen-ifgen -o /var/lib/sepolgen/interface_info -i /usr/share/selinux/refpolicy
sepolgen-ifgen -o /var/lib/sepolgen/interface_info -i /usr/share/selinux/refpolicy
echo "Relabelling the system..."
sudo -s restorecon -RF /
restorecon -RF /
echo "If this is a fresh install, you need to reboot in order to enable enforcing mode"
SHELL