[PATCH 0/4] fix autorelabeling with systemd

[Michal Schmidt]

In Fedora 15 if you boot with SELinux disabled and then reboot with it enabled,
the usual automatic relabeling does not happen.
This fixes it. It depends on a new systemd feature that will be in v23.
Some cleanups for the fedora-autorelabel script are also included.

---

Michal Schmidt (4):
      bump the required systemd version in the .spec
      separate "touch /.autorelabel" to a new unit
      simplify the check for plymouth in fedora-autorelabel
      let systemd check the conditions for fedora-autorelabel


 Makefile                                       |    1 +
 initscripts.spec                               |    4 ++-
 systemd/fedora-autorelabel                     |   30 +++---------------------
 systemd/system/fedora-autorelabel-mark.service |   15 ++++++++++++
 systemd/system/fedora-autorelabel.service      |    1 +
 5 files changed, 23 insertions(+), 28 deletions(-)
 create mode 100644 systemd/system/fedora-autorelabel-mark.service

-- 
Michal

[PATCH 1/4] let systemd check the conditions for fedora-autorelabel

[Michal Schmidt]

The service unit file already checks whether /.autorelabel or the
"autorelabel" parameter are present. No need to recheck in the script.
Using the new "ConditionSecurity=" feature systemd can also check
whether SELinux is enabled.
---

 systemd/fedora-autorelabel                |   21 +++------------------
 systemd/system/fedora-autorelabel.service |    1 +
 2 files changed, 4 insertions(+), 18 deletions(-)

diff --git a/systemd/fedora-autorelabel b/systemd/fedora-autorelabel
index 326837b..d83040a 100755
--- a/systemd/fedora-autorelabel
+++ b/systemd/fedora-autorelabel
@@ -8,17 +8,6 @@
 PLYMOUTH=
 [ -x /usr/bin/plymouth ] && PLYMOUTH=yes
 
-# Check SELinux status
-SELINUX_STATE=
-if [ -e "/selinux/enforce" ] && [ "$(cat
/proc/self/attr/current)" != "kernel" ]; then
-	if [ -r "/selinux/enforce" ] ; then
-		SELINUX_STATE=$(cat "/selinux/enforce")
-	else
-		# assume enforcing if you can't read it
-		SELINUX_STATE=1
-	fi
-fi
-
 relabel_selinux() {
     # if /sbin/init is not labeled correctly this process is running in the
     # wrong context, so a reboot will be required after relabel
@@ -47,14 +36,10 @@ relabel_selinux() {
     systemctl --force reboot
 }
 
-[ -z "${cmdline}" ] && cmdline=$(cat /proc/cmdline)
-
 # Check to see if a full relabel is needed
-if [ -n "$SELINUX_STATE" -a "$READONLY" != "yes" ]; then
-    if strstr "$cmdline" autorelabel || [ -f /.autorelabel ] ; then
-	restorecon $(awk '!/^#/ && $4 !~ /noauto/ && $2 ~ /^\// { print $2
}' /etc/fstab) >/dev/null 2>&1
-	relabel_selinux
-    fi
+if [ "$READONLY" != "yes" ]; then
+    restorecon $(awk '!/^#/ && $4 !~ /noauto/ && $2 ~ /^\// { print
$2 }' /etc/fstab) >/dev/null 2>&1
+    relabel_selinux
 else
     if [ "$READONLY" != "yes" ] && [ -d /etc/selinux ]; then
         [ -f /.autorelabel ] || touch /.autorelabel
diff --git a/systemd/system/fedora-autorelabel.service
b/systemd/system/fedora-autorelabel.service
index cd6a84b..c98a40f 100644
--- a/systemd/system/fedora-autorelabel.service
+++ b/systemd/system/fedora-autorelabel.service
@@ -5,6 +5,7 @@ Requires=local-fs.target
 Conflicts=shutdown.target
 After=local-fs.target
 Before=sysinit.target shutdown.target
+ConditionSecurity=selinux
 ConditionKernelCommandLine=|autorelabel
 ConditionPathExists=|/.autorelabel

[PATCH 2/4] simplify the check for plymouth in fedora-autorelabel

[Michal Schmidt]

The result of the check is needed only once, so there's no advantage in
caching it in a variable.
---

 systemd/fedora-autorelabel |    5 +----
 1 files changed, 1 insertions(+), 4 deletions(-)

diff --git a/systemd/fedora-autorelabel b/systemd/fedora-autorelabel
index d83040a..204c576 100755
--- a/systemd/fedora-autorelabel
+++ b/systemd/fedora-autorelabel
@@ -5,16 +5,13 @@
 
 . /etc/init.d/functions
 
-PLYMOUTH=
-[ -x /usr/bin/plymouth ] && PLYMOUTH=yes
-
 relabel_selinux() {
     # if /sbin/init is not labeled correctly this process is running in the
     # wrong context, so a reboot will be required after relabel
     AUTORELABEL=
     . /etc/selinux/config
     echo "0" > /selinux/enforce
-    [ -n "$PLYMOUTH" ] && plymouth --hide-splash
+    [ -x /usr/bin/plymouth ] && plymouth --hide-splash
 
     if [ "$AUTORELABEL" = "0" ]; then
 	echo

[PATCH 3/4] separate "touch /.autorelabel" to a new unit

[Michal Schmidt]

Writing /.autorelabel from fedora-autorelabel does not work because the
script is executed only if relabel was already requested.

Create a new unit fedora-autorelabel-mark.service which will be
responsible for creating /.autorelabel if SELinux is disabled.
The unit takes advantage of the new "ConditionSecurity=" support in
systemd.

The old script checked for a read-only filesystem first. The new unit
does not do that. If / is read-only, touch will simply fail. This should
not be considered as a failure of the unit, so "-" is used in ExecStart.

There have been arguments on systemd-devel that the root directory
should not be abused for flag files like /.autorelabel. It has a long
tradition in Fedora though (since 2005). Maybe we can change it
eventually, but let's keep it where it is for now.
---

 Makefile                                       |    1 +
 systemd/fedora-autorelabel                     |    4 ----
 systemd/system/fedora-autorelabel-mark.service |   15 +++++++++++++++
 3 files changed, 16 insertions(+), 4 deletions(-)
 create mode 100644 systemd/system/fedora-autorelabel-mark.service

diff --git a/Makefile b/Makefile
index a788e0a..39dd84e 100644
--- a/Makefile
+++ b/Makefile
@@ -126,6 +126,7 @@ install:
 	ln -s ../fedora-loadmodules.service $(ROOT)/lib/systemd/system/basic.target.wants
 	ln -s ../fedora-autoswap.service $(ROOT)/lib/systemd/system/basic.target.wants
 	ln -s ../fedora-autorelabel.service $(ROOT)/lib/systemd/system/basic.target.wants
+	ln -s ../fedora-autorelabel-mark.service $(ROOT)/lib/systemd/system/basic.target.wants
 	ln -s ../fedora-sysinit-hack.service $(ROOT)/lib/systemd/system/basic.target.wants
 	ln -s ../fedora-readonly.service $(ROOT)/lib/systemd/system/local-fs.target.wants
 	ln -s ../fedora-storage-init.service $(ROOT)/lib/systemd/system/local-fs.target.wants
diff --git a/systemd/fedora-autorelabel b/systemd/fedora-autorelabel
index 204c576..dad7a91 100755
--- a/systemd/fedora-autorelabel
+++ b/systemd/fedora-autorelabel
@@ -37,8 +37,4 @@ relabel_selinux() {
 if [ "$READONLY" != "yes" ]; then
     restorecon $(awk '!/^#/ && $4 !~ /noauto/ && $2 ~ /^\// { print
$2 }' /etc/fstab) >/dev/null 2>&1
     relabel_selinux
-else
-    if [ "$READONLY" != "yes" ] && [ -d /etc/selinux ]; then
-        [ -f /.autorelabel ] || touch /.autorelabel
-    fi
 fi
diff --git a/systemd/system/fedora-autorelabel-mark.service
b/systemd/system/fedora-autorelabel-mark.service
new file mode 100644
index 0000000..33b5147
--- /dev/null
+++ b/systemd/system/fedora-autorelabel-mark.service
@@ -0,0 +1,15 @@
+[Unit]
+Description=Mark the need to relabel after reboot
+DefaultDependencies=no
+Requires=local-fs.target
+Conflicts=shutdown.target
+After=local-fs.target
+Before=sysinit.target shutdown.target
+ConditionSecurity=!selinux
+ConditionPathIsDirectory=/etc/selinux
+ConditionPathExists=!/.autorelabel
+
+[Service]
+ExecStart=-/bin/touch /.autorelabel
+Type=oneshot
+RemainAfterExit=yes

[PATCH 4/4] bump the required systemd version in the .spec

[Michal Schmidt]

"ConditionSecurity=selinux" will be supported in systemd-23.
---

 initscripts.spec |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/initscripts.spec b/initscripts.spec
index 1785b28..674badf 100644
--- a/initscripts.spec
+++ b/initscripts.spec
@@ -27,8 +27,8 @@ Requires: upstart-sysvinit
 %endif
 %endif
 %if %{_with_systemd}
-Conflicts: systemd < 12-1
-Conflicts: systemd-units < 12-1
+Conflicts: systemd < 23-1
+Conflicts: systemd-units < 23-1
 %if ! %{_with_upstart}
 Requires: systemd-sysvinit
 %endif

[Bill Nottingham]

Michal Schmidt (mschmidt(a)redhat.com) said: 
>  In Fedora 15 if you boot with SELinux disabled and then reboot with
> it enabled,
>  the usual automatic relabeling does not happen.
>  This fixes it. It depends on a new systemd feature that will be in v23.
>  Some cleanups for the fedora-autorelabel script are also included. 
Thanks!  Applied.

Bill