/opt/jp-secure/siteguardlite
Edit: /opt/jp-secure/siteguardlite/set_secontext.sh (4755B)
#!/bin/sh
#
# SELinux setting and removing for SiteGuard Lite
#
# by JP-Secure
#
PREFIX=/opt/jp-secure/siteguardlite
check_command()
{
if ! type $1 >/dev/null 2>&1; then
show_error "$1 command not found."
fi
}
# exist check SELinux command
check_secommand()
{
check_command getenforce
check_command semanage
check_command chcon
check_command checkmodule
check_command semodule_package
check_command semodule
}
show_error()
{
if [ "X$1" != "X" ]; then
echo
echo "#### ERROR #### " $1
fi
echo "-----------------------------------------------------"
echo "+ Setup failure. +"
echo "-----------------------------------------------------"
echo
exit
}
check_syscontent()
{
# httpd_sys_rw_content_t exist check
semanage fcontext -l | grep "httpd_sys_rw_content_t" >/dev/null 2>&1
if [ $? -eq 0 ]; then
SYSCONTENT=httpd_sys_rw_content_t
else
SYSCONTENT=httpd_sys_content_t
fi
}
setup()
{
# tomcat port
echo "tomcat settings"
semanage port -l | grep "http_port_t" | grep "9016" >/dev/null 2>&1
if [ $? -ne 0 ]; then
semanage port -a -t http_port_t -p tcp 9016
fi
# for modules
echo "modules settings"
chcon -R -u system_u -t httpd_modules_t $PREFIX/modules
semanage fcontext -a -s system_u -t httpd_modules_t "$PREFIX/modules(\.*)?"
# for java jre
if [ -e $PREFIX/java/lib/i386/client/libjvm.so ]; then
echo "jre settings"
chcon -t textrel_shlib_t $PREFIX/java/lib/i386/client/libjvm.so
semanage fcontext -a -t textrel_shlib_t $PREFIX/java/lib/i386/client/libjvm.so
fi
# for log
echo "logs settings"
chcon -R -t httpd_log_t $PREFIX/logs/http
semanage fcontext -a -t httpd_log_t "$PREFIX/logs/http(\.*)?"
chcon -R -t var_log_t $PREFIX/logs/admin
chcon -R -t var_log_t $PREFIX/logs/notify
chcon -t var_log_t $PREFIX/logs/dbupdate_waf.log
semanage fcontext -a -t var_log_t "$PREFIX/logs/admin(\.*)?"
semanage fcontext -a -t var_log_t "$PREFIX/logs/notify(\.*)?"
semanage fcontext -a -t var_log_t $PREFIX/logs/dbupdate_waf.log
# for tmp dir
echo "tmp settings"
chcon -R -t $SYSCONTENT $PREFIX/tmp
semanage fcontext -a -t $SYSCONTENT "$PREFIX/tmp(\.*)?"
# for notify dir
echo "notify settings"
chcon -R -t $SYSCONTENT $PREFIX/notify/detect
chcon -R -t $SYSCONTENT $PREFIX/notify/fault
semanage fcontext -a -t $SYSCONTENT "$PREFIX/notify/detect(\.*)?"
semanage fcontext -a -t $SYSCONTENT "$PREFIX/notify/fault(\.*)?"
#for statistics dir
echo "statistics settings"
chcon -R -t $SYSCONTENT $PREFIX/statistics
semanage fcontext -a -t $SYSCONTENT "$PREFIX/statistics(\.*)?"
# for expire.txt
echo "expire.txt settings"
chcon -t $SYSCONTENT $PREFIX/conf/expire.txt
semanage fcontext -a -t $SYSCONTENT $PREFIX/conf/expire.txt
# policy install
echo "policy settings"
cd conf
checkmodule -M -m -o siteguardlite.m siteguardlite.te >/dev/null 2>&1
semodule_package -o siteguardlite.pa -m siteguardlite.m
semodule -i siteguardlite.pa
echo "-----------------------------------------------------"
echo "+ Setup done. +"
echo "-----------------------------------------------------"
echo
}
remove()
{
# tomcat port
echo "tomcat settings"
semanage port -d -t http_port_t -p tcp 9016
# for modules
echo "modules settings"
semanage fcontext -d -s system_u -t httpd_modules_t "$PREFIX/modules(\.*)?"
# for java jre
if [ -e $PREFIX/java/lib/i386/client/libjvm.so ]; then
echo "jre settings"
semanage fcontext -d -t textrel_shlib_t $PREFIX/java/lib/i386/client/libjvm.so
fi
# for log
echo "logs settings"
semanage fcontext -d -t httpd_log_t "$PREFIX/logs/http(\.*)?"
semanage fcontext -d -t var_log_t "$PREFIX/logs/admin(\.*)?"
semanage fcontext -d -t var_log_t "$PREFIX/logs/notify(\.*)?"
semanage fcontext -d -t var_log_t $PREFIX/logs/dbupdate_waf.log
# for tmp dir
echo "tmp settings"
semanage fcontext -d -t $SYSCONTENT "$PREFIX/tmp(\.*)?"
# for expire.txt
echo "expire.txt settings"
semanage fcontext -d -t $SYSCONTENT $PREFIX/conf/expire.txt
# policy uninstall
echo "policy settings"
cd conf
semodule -r siteguardlite
echo "-----------------------------------------------------"
echo "+ Remove done. +"
echo "-----------------------------------------------------"
echo
}
# admin check
if [ $(id -u) -ne 0 ]; then
show_error "You should be root for setup."
fi
# command existing check
check_secommand
# check SELinux disabled
answer=`getenforce`
if [ $answer == "Disabled" ]; then
echo
echo "SELinux is disabled"
echo "Nothing to do for setup."
exit
fi
# exist check httpd_sys_rw_content_t
check_syscontent
if [ $# -ne 0 ]; then
if [ "X$1" = "X--remove" ]; then
remove
exit
fi
fi
setup