Attachment 589515 Details for Bug 712048 – Fix selinux to allow ecryptfs-migrate-home

Fix selinux to allow ecryptfs-migrate-home

fixecryptfs.sh (text/plain), 2.29 KB, created by Flemming from Banana hill on 2012-06-05 12:23:56 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Flemming from Banana hill

Created: 2012-06-05 12:23:56 UTC

Size: 2.29 KB

patch

obsolete

>#!/bin/bash
>
>yum -y install ecryptfs-utils
>
>cat > custom-ecryptfspol.te << EOF
>module custom-ecryptfspol 1.0;
>require {
>	type ecryptfs_t;
>	type system_dbusd_t;
>	class file read;
>}
>allow system_dbusd_t ecryptfs_t:file read;
>EOF
>checkmodule -M -m -o custom-ecryptfspol.mod custom-ecryptfspol.te
>semodule_package -o custom-ecryptfspol.pp -m custom-ecryptfspol.mod
>semodule -i custom-ecryptfspol.pp
>
>cat > custom-mount.ecryptfs_private.te << EOF
>module custom-mount.ecryptfs_private 1.0;
>require {
>	type unconfined_t;
>	type mount_t;
>	type system_cronjob_t;
>	class key write;
>}
>allow mount_t system_cronjob_t:key write;
>allow mount_t unconfined_t:key write;
>EOF
>checkmodule -M -m -o custom-mount.ecryptfs_private.mod custom-mount.ecryptfs_private.te
>semodule_package -o custom-mount.ecryptfs_private.pp -m custom-mount.ecryptfs_private.mod
>semodule -i custom-mount.ecryptfs_private.pp
>
>cat > custom-gdm-session-worker.te << EOF
>module custom-gdm-session-worker 1.0;
>require {
>	type home_root_t;
>	type user_home_t;
>        type modules_object_t;
>	type xdm_t;
>	type ecryptfs_t;
>	class lnk_file read;
>	class file { read getattr rename setattr read create write getattr unlink open append };
>	class dir { write read remove_name add_name };
>}
>allow xdm_t ecryptfs_t:dir { write remove_name add_name };
>allow xdm_t ecryptfs_t:file { write rename create unlink append setattr };
>allow xdm_t ecryptfs_t:lnk_file read;
>allow xdm_t home_root_t:file { rename setattr append read create write getattr unlink open };
>allow xdm_t user_home_t:file { write rename create setattr };
>allow xdm_t modules_object_t:file { read getattr open };
>EOF
>checkmodule -M -m -o custom-gdm-session-worker.mod custom-gdm-session-worker.te
>semodule_package -o custom-gdm-session-worker.pp -m custom-gdm-session-worker.mod
>semodule -i custom-gdm-session-worker.pp
>
>cat > custom-colord.te << EOF
>module custom-colord 1.0;
>require {
>        type home_root_t;
>        type colord_t;
>        class file getattr;
>}
>allow colord_t home_root_t:file getattr;
>EOF
>checkmodule -M -m -o custom-colord.mod custom-colord.te
>semodule_package -o custom-colord.pp -m custom-colord.mod
>semodule -i custom-colord.pp
>
>setsebool -P allow_polyinstantiation 1
>
>authconfig --enableecryptfs --updateall
>
># Workaround Bug 754703: ecryptfs.ko loaded too late
>echo ecryptfs > /etc/modules-load.d/ecryptfs.conf
>

Actions: View

Attachments on bug 712048: 503872 | 504024 | 504025 | 526446 | 526448 | 534831 | 589308 | 589515