Yu Watanabe
b49a4696c4
If sh is not bash, some builtin command behave slightly differently. E.g. if sh is provided by busybox, its builtin test command does not check if the path is a mount point or not, and 'test -w' only checks the access mode of the inode. So, even if a readonly filesystem is mounted on a directory, the test command may succeed. To avoid such confusion, let's unconditionally use bash.
31 lines
1.1 KiB
Desktop File
31 lines
1.1 KiB
Desktop File
# SPDX-License-Identifier: LGPL-2.1-or-later
|
|
|
|
# We use a custom autorelabel service instead of the SELinux provided set of
|
|
# units & a generator, since the generator overrides the default target to the
|
|
# SELinux one when it detects /.autorelabel. However, we use systemd.unit= on
|
|
# the kernel command cmdline which always takes precedence, rendering all
|
|
# SELinux efforts useless. Also, pulling in selinux-autorelabel.service
|
|
# explicitly doesn't work either, as it doesn't check for the presence of
|
|
# /.autorelabel and does the relabeling unconditionally which always ends with
|
|
# a reboot, so we end up in a reboot loop (and it also spews quite a lot of
|
|
# errors as it wants /etc/fstab and dracut-initramfs-restore).
|
|
|
|
[Unit]
|
|
Description=Relabel all filesystems
|
|
DefaultDependencies=no
|
|
Requires=local-fs.target
|
|
After=local-fs.target
|
|
Conflicts=shutdown.target
|
|
Before=shutdown.target basic.target
|
|
ConditionSecurity=selinux
|
|
ConditionPathExists=|/.autorelabel
|
|
SuccessAction=reboot
|
|
|
|
[Service]
|
|
ExecStart=bash -xec 'echo 0 >/sys/fs/selinux/enforce; fixfiles -f -F relabel; rm /.autorelabel;'
|
|
Type=oneshot
|
|
TimeoutSec=infinity
|
|
|
|
[Install]
|
|
WantedBy=basic.target
|