devbox
我家自动化
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

selinux-policy-default（2:2.20231119-2）软件包内容详细介绍（3）

作者：我家自动化 | 2024-05-22 12:11:10

赞

踩

selinux-policy-default（2:2.20231119-2）软件包内容详细介绍（3）

接前一篇文章：selinux-policy-default（2:2.20231119-2）软件包内容详细介绍（2）

4. 重点文件内容解析

（1）control/postist文件

上一回讲解了postinst文件的前一部分内容，本回继续往下解析。为了便于理解，再次贴出postinst完整代码：

  1. #!/bin/sh
  2. set -e
  3.  
  4. # summary of how this script can be called:
  5. #        * <postinst> `configure' <most-recently-configured-version>
  6. #        * <old-postinst> `abort-upgrade' <new version>
  7. #        * <conflictor's-postinst> `abort-remove' `in-favour' <package>
  8. #          <new-version>
  9. #        * <postinst> `abort-remove'
  10. #        * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
  11. #          <failed-install-package> <version> `removing'
  12. #          <conflicting-package> <version>
  13. # for details, see http://www.debian.org/doc/debian-policy/ or
  14. # the debian-policy package
  15.  
  16. # Will be replaced by the binary package flavour in debian/rules
  17. flavour="default"
  18. priority=100
  19.  
  20. # modules which are not enabled by default, because they are usually
  21. # not needed on a debian system
  22. notdefault="aisexec amtu bugzilla cobbler condor cyphesis git ksmtuned likewise livecd nessus numad oddjob openca rlogin rshd soundserver telnet publicfile thunderbird updfstab usernetctl"
  23.  
  24. platform=$(hostnamectl chassis) || true
  25. case "$platform" in
  26.   handset|watch|embedded)
  27. # dont need staff role
  28.     notdefault="$notdefault staff"
  29. # dont need hardware specific things for non phone hardware
  30.     notdefault="$notdefault acpi cdrecord fcoe iscsi isns openct raid rasdaemon tgtd tvtime vbetool"
  31. # dont need VM things
  32.     notdefault="$notdefault hypervkvp"
  33. # dont need serious server daemons
  34.     notdefault="$notdefault afs aide amanda amavis apcupsd aptcacher asterisk awstats bacula bind bird bitlbee boinc cachefilesd calamaris certbot cfengine clamav cockpit corosync couchdb courier ctdb cvs cyrus dbadm dictd distcc djbdns dkim dmidecode docker dovecot drbd fetchmail gitosis glance glusterfs inn irc ircd jabber kerberos keystone ldap lightsquid mailman matrixd mediawiki memcached milter minidlna mojomojo mongodb monop mrtg munin nagios nis nsd nslcd ntop nut openhpi openvswitch pacemaker passenger pcscd pegasus perdition pingd portmap portslave postfixpolicyd postgresql postgrey prelude procmail puppet pxe pyzor qemu qmail qpid quantum rabbitmq radius radvd razor realmd redis rsync samba samhain sanlock sasl sblim secadm shibboleth snort spamassassin squid stunnel svnserve sympa tftp tripwire uml uucp uwimap varnishd virt vmware wdmd webadm webalizer xen zabbix zarafa zebra"
  35. # dont need time sharing system daemons
  36.     notdefault="$notdefault comsat finger oident rwho slocate slrnpull uptime quota"
  37.   ;;
  38.   vm|container)
  39. # dont need hardware specific things for vms
  40.     notdefault="$notdefault acpi cdrecord fcoe iscsi isns openct raid rasdaemon tgtd tvtime vbetool"
  41. # dont need handset stuff
  42.     notdefault="$notdefault eg25manager feedbackd geoclue iiosensorproxy"
  43.   ;;
  44.   desktop)
  45. # dont need VM things
  46.     notdefault="$notdefault hypervkvp"
  47. # dont need portable stuff
  48.     notdefault="$notdefault geoclue"
  49. # dont need handset stuff
  50.     notdefault="$notdefault eg25manager feedbackd iiosensorproxy"
  51.   ;;
  52.   laptop|convertible)
  53. # dont need VM things
  54.     notdefault="$notdefault hypervkvp"
  55. # dont need handset stuff
  56.     notdefault="$notdefault eg25manager feedbackd iiosensorproxy"
  57.   ;;
  58.   server)
  59. # dont need handset stuff
  60.     notdefault="$notdefault eg25manager feedbackd iiosensorproxy"
  61.   ;;
  62.   *)
  63.     echo "Unknown output from hostnamectl or not running systemd"
  64.   ;;
  65. esac
  66.  
  67. . /etc/selinux/config
  68.  
  69. case "$1" in
  70.     configure)
  71. 	echo -n "Updating selinux ${flavour} policy (this step might take a moment)..."
  72.  
  73. 	# list all the modules that are already installed with our priority
  74. 	already_installed=`semodule -s ${flavour} --list-modules=full | grep -e "^${priority} " | cut -d' ' -f2`
  75.  
  76. 	# record which non-default modules do not yet exist for disabling them later
  77. 	to_disable=""
  78. 	for module in ${notdefault}; do
  79. 	installed=0
  80. 	for inst_module in ${already_installed}; do
  81. 	    if [ $module = $inst_module ]; then
  82. 		installed=1
  83. 		break
  84. 	    fi
  85. 	done
  86. 	if [ $installed -ne 1 ]; then
  87. 	    to_disable="$to_disable -d${module}"
  88. 	fi
  89. 	done
  90.  
  91. 	# List all the modules that we are going to install
  92. 	to_install=""
  93. 	for module in `cat /usr/share/selinux/${flavour}/.modules`; do
  94. 	    to_install="$to_install -i/usr/share/selinux/${flavour}/${module}.pp.bz2"
  95. 	done
  96.  
  97. 	# Now build a list of the modules that we were shipping before but that we are not
  98. 	# anymore and that we need to remove
  99. 	to_remove=""
  100. 	for inst_module in $already_installed; do
  101. 	    remove_module=1
  102. 	    for pkg_module in `cat /usr/share/selinux/${flavour}/.modules`; do
  103. 		if [ $inst_module = $pkg_module ]; then
  104. 		    remove_module=0
  105. 		    break
  106. 		fi
  107. 	    done
  108. 	    if [ $remove_module -eq 1 ]; then
  109. 		to_remove="$to_remove -r${inst_module}"
  110. 	    fi
  111. 	done
  112.  
  113. 	# Now load policy into the kernel if it is the configured policy
  114. 	# and we are running selinux
  115. 	if [ "${SELINUXTYPE}" != "${flavour}" ] || ! selinuxenabled; then
  116. 	    noreload='-n'
  117. 	fi
  118.  
  119. 	ret=0
  120. 	semodule -X $priority $noreload -s $flavour $to_remove $to_install $to_disable || ret=$?
  121. 	if [ $ret -eq 0 ]; then
  122. 	    echo " done."
  123. 	else
  124. 	    echo " failed."
  125. 	    exit $ret
  126. 	fi
  127. 	FC=/etc/selinux/$flavour/contexts/files/file_contexts
  128. 	OLDFC=$FC.old
  129. 	if [ -f $OLDFC ]; then
  130. 	    OLDSORT=$(mktemp)
  131. 	    NEWSORT=$(mktemp)
  132. 	    sort < $OLDFC > $OLDSORT
  133. 	    sort < $FC > $NEWSORT
  134. 	    ORIGDIFF=$(mktemp)
  135. 	    diff $OLDSORT $NEWSORT | grep -v ^[0-9] > $ORIGDIFF || true
  136. 	    rm $OLDSORT $NEWSORT
  137. 	    if [ -s $ORIGDIFF ]; then
  138. 		DIFF=$(mktemp)
  139. 		cut -f2 -d\  < $ORIGDIFF > $DIFF
  140. 		GOOD=$(mktemp)
  141. 		grep -v ^/run $DIFF |grep -v ^/dev | grep "/.*/" > $GOOD || true
  142. 		if [ -s $GOOD ]; then
  143. 		    echo ""
  144. 		    echo "Relabeling matches for the following file context changes:"
  145. 		    cat $GOOD
  146. 		    echo ""
  147. 		    DIRS=$(cat $GOOD | sed -e 's/(\.\*\/).*$//' -e 's/(.*$//' -e 's/\/[^/]*$//' -e 's/\/[0-9a-z]*\[.*$//' | sort -u | /usr/libexec/selinux/remove-leaf-dirs)
  148. 		    echo The following directories: $DIRS
  149. 		    restorecon -R -v $DIRS || echo "restorecon gave an error but package is still ok"
  150. 		fi
  151. 		rm $GOOD
  152. 		PROB=$(mktemp)
  153. 		grep ^../run $ORIGDIFF > $PROB || true
  154. 		grep ^../dev $ORIGDIFF >> $PROB || true
  155. 		grep -v "/.*/" $ORIGDIFF >> $PROB || true
  156.  
  157. 		if [ -s $PROB ]; then
  158. 		    echo "The following lines have changes that can't be automatically applied, consider"
  159. 		    echo "manually relabelling them if appropriate:"
  160. 		    cat $PROB
  161. 		fi
  162. 		rm $DIFF $PROB
  163. 	    else
  164. 		echo "No changes to file contexts"
  165. 	    fi
  166. 	    rm $ORIGDIFF $OLDFC
  167. 	fi
  168.     ;;
  169.  
  170.     abort-upgrade|abort-remove|abort-deconfigure)
  171.     ;;
  172.  
  173.     *)
  174.         echo "postinst called with unknown argument \`$1'" >&2
  175.         exit 1
  176.     ;;
  177. esac
  178.  
  179. # dh_installdeb will replace this with shell code automatically
  180. # generated by other debhelper scripts.
  181.  
  182. # Automatically added by dh_installdeb/13.11.8
  183. dpkg-maintscript-helper rm_conffile /etc/selinux/default/users/local.users 2:2.20140421-10\~ -- "$@"
  184. dpkg-maintscript-helper rm_conffile /etc/selinux/default/users/system.users 2:2.20140421-10\~ -- "$@"
  185. dpkg-maintscript-helper rm_conffile /etc/selinux/default/modules/semanage.read.LOCK 2:2.20140421-10\~ -- "$@"
  186. dpkg-maintscript-helper rm_conffile /etc/selinux/default/modules/semanage.trans.LOCK 2:2.20140421-10\~ -- "$@"
  187. dpkg-maintscript-helper rm_conffile /etc/selinux/default/modules/active/file_contexts.local 2:2.20140421-10\~ -- "$@"
  188. # End automatically added section
  189.  
  190.  
  191. exit 0

7）执行/etc/selinux/config

接下来的一行代码是执行/etc/selinux/config：

. /etc/selinux/config

/etc/selinux/config文件的代码如下：

  1. # This file controls the state of SELinux on the system.
  2. # SELINUX= can take one of these three values:
  3. # enforcing - SELinux security policy is enforced.
  4. # permissive - SELinux prints warnings instead of enforcing.
  5. # disabled - No SELinux policy is loaded.
  6. SELINUX=permissive
  7. # SELINUXTYPE= can take one of these two values:
  8. # default - equivalent to the old strict and targeted policies
  9. # mls     - Multi-Level Security (for military and educational use)
  10. # src     - Custom policy built from source
  11. SELINUXTYPE=default
  12.  
  13. # SETLOCALDEFS= Check local definition changes
  14. SETLOCALDEFS=0

/etc/selinux/config文件控制系统上SELinux的状态。

SELINUX项

SELINUX可以取以下三个值之一：

  • enforcing —— SELinux安全策略已强制执行。
  • permissive —— SELinux打印警告但并不强制执行。
  • disabled —— 未加载SELinux策略。

SELINUXTYPE项

SELINUTYPE可以取以下两个值之一：

  • default —— 相当于旧（版本）的strict和target策略。
  • mls —— 多级安全（用于军事和教育用途）。
  • src —— 从源代码生成的自定义策略。

SETLOCALDEFS项

检查本地定义更改。

8）进入configure分支

postinst脚本代码接下来走进了case分支。由于这部分代码较长，因此分段来看。

  1. case "$1" in
  2.     configure)

$1是调用postinst脚本时传入的第1个参数（从0开始）。参考上一回3）中的注释：

  1. # summary of how this script can be called:
  2. #        * <postinst> `configure' <most-recently-configured-version>
  3. #        * <old-postinst> `abort-upgrade' <new version>
  4. #        * <conflictor's-postinst> `abort-remove' `in-favour' <package>
  5. #          <new-version>
  6. #        * <postinst> `abort-remove'
  7. #        * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
  8. #          <failed-install-package> <version> `removing'
  9. #          <conflicting-package> <version>
  10. # for details, see http://www.debian.org/doc/debian-policy/ or
  11. # the debian-policy package

最主要的就是configure。这里也是将参数1分成了两类：configure和其它。先来看configure分支中的代码。

9）提示信息

通过以下一行代码在终端给出提示信息：

echo -n "Updating selinux ${flavour} policy (this step might take a moment)..."

flavour之前赋值为default：

flavour="default"

那么此处在终端显示的提示信息为“Updating selinux default policy (this step might take a moment)...”。

10）列出当前策略下已安装模块并赋值给already_installed

  1. # list all the modules that are already installed with our priority
  2. already_installed=`semodule -s ${flavour} --list-modules=full | grep -e "^${priority} " | cut -d' ' -f2`

semodule详细介绍参见笔者这篇博客：

semodule工具详解（1）

-s选项代表要操作的存储的名称；flavor是default；--list-modules选项的作用是显示已安装模块的列表（基本模块除外）。

单独执行这一部分命令的结果如下：

  1. $ sudo semodule -s default --list-modules=full 
  2. libsemanage.semanage_create_store: Could not create module store at /var/lib/selinux/default. (No such file or directory).
  3. libsemanage.semanage_direct_connect: could not establish direct connection (No such file or directory).
  4. semodule:  Could not connect to policy handler

手工创建/var/lib/selinux/default文件：

  1. $ sudo mkdir  /var/lib/selinux
  2. $ sudo touch /var/lib/selinux/defaut

再次执行以上命令，结果如下：

  1. $ sudo semodule -s default --list-modules=full 
  2. No modules.

笔者的电脑不是debian系统，因此结果并非预期。但并不耽误对于postinst脚本的分析。

11）记录哪些非默认模块还不在notdefault列表中，以便以后禁用

代码片段如下：

  1.     # record which non-default modules do not yet exist for disabling them later
  2. 	to_disable=""
  3. 	for module in ${notdefault}; do
  4. 	installed=0
  5. 	for inst_module in ${already_installed}; do
  6. 	    if [ $module = $inst_module ]; then
  7. 		installed=1
  8. 		break
  9. 	    fi
  10. 	done
  11. 	if [ $installed -ne 1 ]; then
  12. 	    to_disable="$to_disable -d${module}"
  13. 	fi
  14. 	done

将目前系统已安装、但应该不安装的模块记录到to_disable变量中。

12）列出要安装的所有模块

代码片段如下：

  1.     # List all the modules that we are going to install
  2. 	to_install=""
  3. 	for module in `cat /usr/share/selinux/${flavour}/.modules`; do
  4. 	    to_install="$to_install -i/usr/share/selinux/${flavour}/${module}.pp.bz2"
  5. 	done

由于是postinst脚本，因此/usr/share/selinux/这个目录对应的实际上是此deb包中的data/usr/share/selinux目录。该目录下的内容为：

  1. $ ls
  2. default
  3.  
  4. $ ls default/
  5. accountsd.pp.bz2        feedbackd.pp.bz2         ncftool.pp.bz2         setroubleshoot.pp.bz2
  6. acct.pp.bz2             fetchmail.pp.bz2         nessus.pp.bz2          seunshare.pp.bz2
  7. acpi.pp.bz2             finger.pp.bz2            netlabel.pp.bz2        shibboleth.pp.bz2
  8. afs.pp.bz2              firewalld.pp.bz2         netutils.pp.bz2        shorewall.pp.bz2
  9. aide.pp.bz2             fprintd.pp.bz2           networkmanager.pp.bz2  shutdown.pp.bz2
  10. aisexec.pp.bz2          ftp.pp.bz2               nis.pp.bz2             slocate.pp.bz2
  11. alsa.pp.bz2             fwupd.pp.bz2             nscd.pp.bz2            slpd.pp.bz2
  12. amanda.pp.bz2           games.pp.bz2             nsd.pp.bz2             slrnpull.pp.bz2
  13. amavis.pp.bz2           gatekeeper.pp.bz2        nslcd.pp.bz2           smartmon.pp.bz2
  14. amtu.pp.bz2             gdomap.pp.bz2            ntop.pp.bz2            smokeping.pp.bz2
  15. apache.pp.bz2           geoclue.pp.bz2           ntp.pp.bz2             smstools.pp.bz2
  16. apcupsd.pp.bz2          getty.pp.bz2             numad.pp.bz2           snmp.pp.bz2
  17. aptcacher.pp.bz2        gitosis.pp.bz2           nut.pp.bz2             snort.pp.bz2
  18. apt.pp.bz2              git.pp.bz2               nx.pp.bz2              sosreport.pp.bz2
  19. arpwatch.pp.bz2         glance.pp.bz2            obex.pp.bz2            soundserver.pp.bz2
  20. asterisk.pp.bz2         glusterfs.pp.bz2         oddjob.pp.bz2          spamassassin.pp.bz2
  21. auditadm.pp.bz2         gnomeclock.pp.bz2        oident.pp.bz2          squid.pp.bz2
  22. automount.pp.bz2        gnome.pp.bz2             openca.pp.bz2          ssh.pp.bz2
  23. avahi.pp.bz2            gpg.pp.bz2               openct.pp.bz2          sssd.pp.bz2
  24. awstats.pp.bz2          gpm.pp.bz2               openhpi.pp.bz2         staff.pp.bz2
  25. backup.pp.bz2           gpsd.pp.bz2              openvpn.pp.bz2         stunnel.pp.bz2
  26. bacula.pp.bz2           guest.pp.bz2             openvswitch.pp.bz2     sudo.pp.bz2
  27. base.pp.bz2             hddtemp.pp.bz2           pacemaker.pp.bz2       su.pp.bz2
  28. bind.pp.bz2             hostname.pp.bz2          pads.pp.bz2            svnserve.pp.bz2
  29. bird.pp.bz2             hypervkvp.pp.bz2         passenger.pp.bz2       switcheroo.pp.bz2
  30. bitlbee.pp.bz2          i18n_input.pp.bz2        pcscd.pp.bz2           sxid.pp.bz2
  31. blueman.pp.bz2          icecast.pp.bz2           pegasus.pp.bz2         sympa.pp.bz2
  32. bluetooth.pp.bz2        ifplugd.pp.bz2           perdition.pp.bz2       sysstat.pp.bz2
  33. boinc.pp.bz2            iiosensorproxy.pp.bz2    pingd.pp.bz2           systemtap.pp.bz2
  34. bootloader.pp.bz2       inetd.pp.bz2             pkcs.pp.bz2            tcpd.pp.bz2
  35. brctl.pp.bz2            inn.pp.bz2               plymouthd.pp.bz2       tcsd.pp.bz2
  36. bubblewrap.pp.bz2       iodine.pp.bz2            policykit.pp.bz2       telepathy.pp.bz2
  37. bugzilla.pp.bz2         ipsec.pp.bz2             portmap.pp.bz2         telnet.pp.bz2
  38. cachefilesd.pp.bz2      iptables.pp.bz2          portreserve.pp.bz2     tftp.pp.bz2
  39. calamaris.pp.bz2        ircd.pp.bz2              portslave.pp.bz2       tgtd.pp.bz2
  40. canna.pp.bz2            irc.pp.bz2               postfixpolicyd.pp.bz2  thunderbird.pp.bz2
  41. cdrecord.pp.bz2         irqbalance.pp.bz2        postfix.pp.bz2         thunderbolt.pp.bz2
  42. certbot.pp.bz2          iscsi.pp.bz2             postgresql.pp.bz2      timidity.pp.bz2
  43. certmonger.pp.bz2       isns.pp.bz2              postgrey.pp.bz2        tmpreaper.pp.bz2
  44. cfengine.pp.bz2         jabber.pp.bz2            powerprofiles.pp.bz2   tor.pp.bz2
  45. cgroup.pp.bz2           java.pp.bz2              ppp.pp.bz2             transproxy.pp.bz2
  46. chromium.pp.bz2         kdump.pp.bz2             prelink.pp.bz2         tripwire.pp.bz2
  47. chronyd.pp.bz2          kerberos.pp.bz2          prelude.pp.bz2         tuned.pp.bz2
  48. clamav.pp.bz2           kerneloops.pp.bz2        privoxy.pp.bz2         tvtime.pp.bz2
  49. clock.pp.bz2            keystone.pp.bz2          procmail.pp.bz2        tzdata.pp.bz2
  50. cobbler.pp.bz2          kismet.pp.bz2            psad.pp.bz2            ucspitcp.pp.bz2
  51. cockpit.pp.bz2          ksmtuned.pp.bz2          publicfile.pp.bz2      ulogd.pp.bz2
  52. collectd.pp.bz2         l2tp.pp.bz2              pulseaudio.pp.bz2      uml.pp.bz2
  53. colord.pp.bz2           ldap.pp.bz2              puppet.pp.bz2          unconfined.pp.bz2
  54. comsat.pp.bz2           lightsquid.pp.bz2        pwauth.pp.bz2          unprivuser.pp.bz2
  55. condor.pp.bz2           likewise.pp.bz2          pxe.pp.bz2             updfstab.pp.bz2
  56. container.pp.bz2        lircd.pp.bz2             pyzor.pp.bz2           uptime.pp.bz2
  57. corosync.pp.bz2         livecd.pp.bz2            qemu.pp.bz2            usbmodules.pp.bz2
  58. couchdb.pp.bz2          lldpad.pp.bz2            qmail.pp.bz2           usbmuxd.pp.bz2
  59. courier.pp.bz2          loadkeys.pp.bz2          qpid.pp.bz2            userhelper.pp.bz2
  60. cpucontrol.pp.bz2       logadm.pp.bz2            quantum.pp.bz2         usernetctl.pp.bz2
  61. cpufreqselector.pp.bz2  logrotate.pp.bz2         quota.pp.bz2           uucp.pp.bz2
  62. cron.pp.bz2             logwatch.pp.bz2          rabbitmq.pp.bz2        uuidd.pp.bz2
  63. ctdb.pp.bz2             lowmemorymonitor.pp.bz2  radius.pp.bz2          uwimap.pp.bz2
  64. cups.pp.bz2             lpd.pp.bz2               radvd.pp.bz2           varnishd.pp.bz2
  65. cvs.pp.bz2              lvm.pp.bz2               raid.pp.bz2            vbetool.pp.bz2
  66. cyphesis.pp.bz2         mailman.pp.bz2           rasdaemon.pp.bz2       vdagent.pp.bz2
  67. cyrus.pp.bz2            man2html.pp.bz2          razor.pp.bz2           virt.pp.bz2
  68. daemontools.pp.bz2      mandb.pp.bz2             rdisc.pp.bz2           vlock.pp.bz2
  69. dante.pp.bz2            matrixd.pp.bz2           realmd.pp.bz2          vmware.pp.bz2
  70. dbadm.pp.bz2            mediawiki.pp.bz2         redis.pp.bz2           vnstatd.pp.bz2
  71. dbskk.pp.bz2            memcached.pp.bz2         remotelogin.pp.bz2     vpn.pp.bz2
  72. ddclient.pp.bz2         memlockd.pp.bz2          rlogin.pp.bz2          watchdog.pp.bz2
  73. devicekit.pp.bz2        milter.pp.bz2            rngd.pp.bz2            wdmd.pp.bz2
  74. dhcp.pp.bz2             minidlna.pp.bz2          rpcbind.pp.bz2         webadm.pp.bz2
  75. dictd.pp.bz2            minissdpd.pp.bz2         rpc.pp.bz2             webalizer.pp.bz2
  76. dirmngr.pp.bz2          modemmanager.pp.bz2      rshd.pp.bz2            wine.pp.bz2
  77. distcc.pp.bz2           mojomojo.pp.bz2          rssh.pp.bz2            wireshark.pp.bz2
  78. djbdns.pp.bz2           mongodb.pp.bz2           rsync.pp.bz2           wm.pp.bz2
  79. dkim.pp.bz2             monit.pp.bz2             rtkit.pp.bz2           xdg.pp.bz2
  80. dmidecode.pp.bz2        mono.pp.bz2              rwho.pp.bz2            xen.pp.bz2
  81. dnsmasq.pp.bz2          monop.pp.bz2             samba.pp.bz2           xfs.pp.bz2
  82. docker.pp.bz2           mon.pp.bz2               samhain.pp.bz2         xguest.pp.bz2
  83. dovecot.pp.bz2          mozilla.pp.bz2           sanlock.pp.bz2         xscreensaver.pp.bz2
  84. drbd.pp.bz2             mpd.pp.bz2               sasl.pp.bz2            xserver.pp.bz2
  85. eg25manager.pp.bz2      mplayer.pp.bz2           sblim.pp.bz2           zabbix.pp.bz2
  86. entropyd.pp.bz2         mrtg.pp.bz2              screen.pp.bz2          zarafa.pp.bz2
  87. evolution.pp.bz2        mta.pp.bz2               secadm.pp.bz2          zebra.pp.bz2
  88. exim.pp.bz2             munin.pp.bz2             sendmail.pp.bz2        zosremote.pp.bz2
  89. fail2ban.pp.bz2         mysql.pp.bz2             sensord.pp.bz2
  90. fcoe.pp.bz2             nagios.pp.bz2            setrans.pp.bz2

data/usr/share/selinux/default/.modules文件的内容为：

  1. $ cat default/.modules 
  2. accountsd
  3. acct
  4. acpi
  5. afs
  6. aide
  7. aisexec
  8. alsa
  9. amanda
  10. amavis
  11. amtu
  12. apache
  13. apcupsd
  14. apt
  15. aptcacher
  16. arpwatch
  17. asterisk
  18. auditadm
  19. automount
  20. avahi
  21. awstats
  22. backup
  23. bacula
  24. base
  25. bind
  26. bird
  27. bitlbee
  28. blueman
  29. bluetooth
  30. boinc
  31. bootloader
  32. brctl
  33. bubblewrap
  34. bugzilla
  35. cachefilesd
  36. calamaris
  37. canna
  38. cdrecord
  39. certbot
  40. certmonger
  41. cfengine
  42. cgroup
  43. chromium
  44. chronyd
  45. clamav
  46. clock
  47. cobbler
  48. cockpit
  49. collectd
  50. colord
  51. comsat
  52. condor
  53. container
  54. corosync
  55. couchdb
  56. courier
  57. cpucontrol
  58. cpufreqselector
  59. cron
  60. ctdb
  61. cups
  62. cvs
  63. cyphesis
  64. cyrus
  65. daemontools
  66. dante
  67. dbadm
  68. dbskk
  69. ddclient
  70. devicekit
  71. dhcp
  72. dictd
  73. dirmngr
  74. distcc
  75. djbdns
  76. dkim
  77. dmidecode
  78. dnsmasq
  79. docker
  80. dovecot
  81. drbd
  82. eg25manager
  83. entropyd
  84. evolution
  85. exim
  86. fail2ban
  87. fcoe
  88. feedbackd
  89. fetchmail
  90. finger
  91. firewalld
  92. fprintd
  93. ftp
  94. fwupd
  95. games
  96. gatekeeper
  97. gdomap
  98. geoclue
  99. getty
  100. git
  101. gitosis
  102. glance
  103. glusterfs
  104. gnome
  105. gnomeclock
  106. gpg
  107. gpm
  108. gpsd
  109. guest
  110. hddtemp
  111. hostname
  112. hypervkvp
  113. i18n_input
  114. icecast
  115. ifplugd
  116. iiosensorproxy
  117. inetd
  118. inn
  119. iodine
  120. ipsec
  121. iptables
  122. irc
  123. ircd
  124. irqbalance
  125. iscsi
  126. isns
  127. jabber
  128. java
  129. kdump
  130. kerberos
  131. kerneloops
  132. keystone
  133. kismet
  134. ksmtuned
  135. l2tp
  136. ldap
  137. lightsquid
  138. likewise
  139. lircd
  140. livecd
  141. lldpad
  142. loadkeys
  143. logadm
  144. logrotate
  145. logwatch
  146. lowmemorymonitor
  147. lpd
  148. lvm
  149. mailman
  150. man2html
  151. mandb
  152. matrixd
  153. mediawiki
  154. memcached
  155. memlockd
  156. milter
  157. minidlna
  158. minissdpd
  159. modemmanager
  160. mojomojo
  161. mon
  162. mongodb
  163. monit
  164. mono
  165. monop
  166. mozilla
  167. mpd
  168. mplayer
  169. mrtg
  170. mta
  171. munin
  172. mysql
  173. nagios
  174. ncftool
  175. nessus
  176. netlabel
  177. netutils
  178. networkmanager
  179. nis
  180. nscd
  181. nsd
  182. nslcd
  183. ntop
  184. ntp
  185. numad
  186. nut
  187. nx
  188. obex
  189. oddjob
  190. oident
  191. openca
  192. openct
  193. openhpi
  194. openvpn
  195. openvswitch
  196. pacemaker
  197. pads
  198. passenger
  199. pcscd
  200. pegasus
  201. perdition
  202. pingd
  203. pkcs
  204. plymouthd
  205. policykit
  206. portmap
  207. portreserve
  208. portslave
  209. postfix
  210. postfixpolicyd
  211. postgresql
  212. postgrey
  213. powerprofiles
  214. ppp
  215. prelink
  216. prelude
  217. privoxy
  218. procmail
  219. psad
  220. publicfile
  221. pulseaudio
  222. puppet
  223. pwauth
  224. pxe
  225. pyzor
  226. qemu
  227. qmail
  228. qpid
  229. quantum
  230. quota
  231. rabbitmq
  232. radius
  233. radvd
  234. raid
  235. rasdaemon
  236. razor
  237. rdisc
  238. realmd
  239. redis
  240. remotelogin
  241. rlogin
  242. rngd
  243. rpc
  244. rpcbind
  245. rshd
  246. rssh
  247. rsync
  248. rtkit
  249. rwho
  250. samba
  251. samhain
  252. sanlock
  253. sasl
  254. sblim
  255. screen
  256. secadm
  257. sendmail
  258. sensord
  259. setrans
  260. setroubleshoot
  261. seunshare
  262. shibboleth
  263. shorewall
  264. shutdown
  265. slocate
  266. slpd
  267. slrnpull
  268. smartmon
  269. smokeping
  270. smstools
  271. snmp
  272. snort
  273. sosreport
  274. soundserver
  275. spamassassin
  276. squid
  277. ssh
  278. sssd
  279. staff
  280. stunnel
  281. su
  282. sudo
  283. svnserve
  284. switcheroo
  285. sxid
  286. sympa
  287. sysstat
  288. systemtap
  289. tcpd
  290. tcsd
  291. telepathy
  292. telnet
  293. tftp
  294. tgtd
  295. thunderbird
  296. thunderbolt
  297. timidity
  298. tmpreaper
  299. tor
  300. transproxy
  301. tripwire
  302. tuned
  303. tvtime
  304. tzdata
  305. ucspitcp
  306. ulogd
  307. uml
  308. unconfined
  309. unprivuser
  310. updfstab
  311. uptime
  312. usbmodules
  313. usbmuxd
  314. userhelper
  315. usernetctl
  316. uucp
  317. uuidd
  318. uwimap
  319. varnishd
  320. vbetool
  321. vdagent
  322. virt
  323. vlock
  324. vmware
  325. vnstatd
  326. vpn
  327. watchdog
  328. wdmd
  329. webadm
  330. webalizer
  331. wine
  332. wireshark
  333. wm
  334. xdg
  335. xen
  336. xfs
  337. xguest
  338. xscreensaver
  339. xserver
  340. zabbix
  341. zarafa
  342. zebra
  343. zosremote

按照以上脚本最终得到to_install的值为：

"-i/usr/share/selinux/default/accountsd.pp.bz2 -i/usr/share/selinux/default/acct.pp.bz2 -i/usr/share/selinux/default/acpi.pp.bz2

……

-i/usr/share/selinux/default/zebra.pp.bz2 -i/usr/share/selinux/default/zosremote.pp.bz2"

13）列出要移除的所有模块

代码片段如下：

  1.     # Now build a list of the modules that we were shipping before but that we are not
  2. 	# anymore and that we need to remove
  3. 	to_remove=""
  4. 	for inst_module in $already_installed; do
  5. 	    remove_module=1
  6. 	    for pkg_module in `cat /usr/share/selinux/${flavour}/.modules`; do
  7. 		if [ $inst_module = $pkg_module ]; then
  8. 		    remove_module=0
  9. 		    break
  10. 		fi
  11. 	    done
  12. 	    if [ $remove_module -eq 1 ]; then
  13. 		to_remove="$to_remove -r${inst_module}"
  14. 	    fi
  15. 	done

already_installed在上边得到，详见10）：

  1. # list all the modules that are already installed with our priority
  2. already_installed=`semodule -s ${flavour} --list-modules=full | grep -e "^${priority} " | cut -d' ' -f2`

postinst的其余代码请看下回。

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/我家自动化/article/detail/608190
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号