31 lines
1.2 KiB
Bash
31 lines
1.2 KiB
Bash
command -v getenforce >/dev/null || refuse "SELinux tools aren't installed"
|
|
[ "$(getenforce)" = Enforcing ] || refuse "SELinux isn't enforcing; set SELINUX=enforcing in /etc/selinux/config, reboot, and start again"
|
|
grep -Eq '^[[:space:]]*SELINUX=enforcing' /etc/selinux/config || refuse "/etc/selinux/config doesn't set SELINUX=enforcing; set it and start again"
|
|
cat /proc/sys/kernel/random/boot_id >"$LAB_STATE/setup-boot"
|
|
mkdir -p /usr/local/lib/le-lab
|
|
cat >/usr/local/lib/le-lab/watch.sh <<'X'
|
|
#!/bin/bash
|
|
# Notes each change of what snap prints, with the boot it happened in.
|
|
log=$1 prev=''
|
|
boot=$(cat /proc/sys/kernel/random/boot_id)
|
|
snap() { echo "$(getenforce) $(grep -E '^[[:space:]]*SELINUX=' /etc/selinux/config | tail -n1 | tr -d ' ')"; }
|
|
while :; do
|
|
cur=$(snap)
|
|
[ "$cur" = "$prev" ] || { printf '%s %s\n' "$boot" "$cur" >>"$log"; prev=$cur; }
|
|
sleep 1
|
|
done
|
|
X
|
|
cat >/etc/systemd/system/le-lab-watch.service <<X
|
|
[Unit]
|
|
Description=LINUXexpert practice lab: note the SELinux mode
|
|
|
|
[Service]
|
|
ExecStart=/bin/bash /usr/local/lib/le-lab/watch.sh $LAB_STATE/watch.log
|
|
Restart=always
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
X
|
|
systemctl daemon-reload
|
|
systemctl enable --now --quiet le-lab-watch.service
|