17 lines
873 B
Bash
17 lines
873 B
Bash
LOG=$LAB_STATE/watch.log
|
|
# The first line of each boot: the mode that boot started in.
|
|
boot_modes() { awk '!s[$1]++' "$LOG" 2>/dev/null; }
|
|
now_enforcing() {
|
|
need "/etc/selinux/config sets SELINUX=enforcing" 'grep -Eq "^[[:space:]]*SELINUX=enforcing[[:space:]]*$" /etc/selinux/config'
|
|
need "getenforce prints Enforcing now" '[ "$(getenforce)" = Enforcing ]'
|
|
need "the kernel command line doesn't override it" '! grep -Eq "(^| )(enforcing=0|selinux=0)( |$)" /proc/cmdline'
|
|
}
|
|
|
|
task 1 "Permissive until the next reboot, enforcing at boot"
|
|
need "SELinux was permissive while the config said enforcing" 'grep -q " Permissive SELINUX=enforcing$" "$LOG"'
|
|
now_enforcing
|
|
|
|
task 2 "Booted in permissive mode once, then enforcing again"
|
|
need "a boot since the lab started ran in permissive mode from the config" 'boot_modes | grep -q " Permissive SELINUX=permissive$"'
|
|
now_enforcing
|