1.1
  #   ˆl–Ü4ý(”†»â‚fãa¸ÛÊbÑ¿Á„™yßÀÄ 0c    #!/usr/bin/bash
# fixfiles
#
# Script to restore labels on a SELinux box
#
# Copyright (C) 2004-2013 Red Hat, Inc.
# Authors: Dan Walsh <dwalsh@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

set -o nounset

#
# seclabel support was added in 2.6.30.  This function will return a positive
# number if the current kernel version is greater than 2.6.30, a negative
# number if the current is less than 2.6.30 and 0 if they are the same.
#
function useseclabel {
	VER=`uname -r`
	SUP=2.6.30
	expr '(' "$VER" : '\([^.]*\)' ')' '-' '(' "$SUP" : '\([^.]*\)' ')' '|' \
	     '(' "$VER.0" : '[^.]*[.]\([^.]*\)' ')' '-' '(' "$SUP.0" : '[^.]*[.]\([^.]*\)' ')' '|' \
	     '(' "$VER.0.0" : '[^.]*[.][^.]*[.]\([^.]*\)' ')' '-' '(' "$SUP.0.0" : '[^.]*[.][^.]*[.]\([^.]*\)' ')'
}

#
# Get all mount points that support labeling.  Use the 'seclabel' field if it
# is available.  Else fall back to known fs types which likely support xattrs
# and we know were not context mounted.
#
get_all_labeled_mounts() {
FS="`cat /proc/self/mounts | sort | uniq | awk '{print $2}'`"
for i in $FS; do
	if [ `useseclabel` -ge 0 ]
	then
		grep " $i " /proc/self/mounts | awk '{print $4}' | grep -E --silent '(^|,)seclabel(,|$)' && echo $i
	else
		grep " $i " /proc/self/mounts | grep -v "context=" | grep -E --silent '(ext[234]| ext4dev | gfs2 | xfs | jfs | btrfs )' && echo $i
	fi
done
}

get_rw_labeled_mounts() {
FS=`get_all_labeled_mounts | sort | uniq`
for i in $FS; do
	grep " $i " /proc/self/mounts | awk '{print $4}' | grep -E --silent '(^|,)rw(,|$)' && echo $i
done
}

get_ro_labeled_mounts() {
FS=`get_all_labeled_mounts | sort | uniq`
for i in $FS; do
	grep " $i " /proc/self/mounts | awk '{print $4}' | grep -E --silent '(^|,)ro(,|$)' && echo $i
done
}

#
# Get the default label returned from the kernel for a file with a label the
# kernel does not understand
#
get_undefined_type() {
	SELINUXMNT=`grep selinuxfs /proc/self/mountinfo | head -1 | awk '{ print $5 }'`
	cat ${SELINUXMNT}/initial_contexts/unlabeled | secon -t
}

#
# Get the default label for a file without a label
#
get_unlabeled_type() {
	SELINUXMNT=`grep selinuxfs /proc/self/mountinfo | head -1 | awk '{ print $5 }'`
	cat $SELINUXMNT/initial_contexts/file | secon -t
}

exclude_dirs_from_relabelling() {
    exclude_from_relabelling=
    if [ -e /etc/selinux/fixfiles_exclude_dirs ]
    then
	while read i
	do
	  # skip blank line and comment
	  # skip not absolute path
	  # skip not directory
	  [ -z "${i}" ] && continue
	  [[ "${i}" =~ ^[[:blank:]]*# ]] && continue
	  [[ ! "${i}" =~ ^/.* ]] && continue
	  [[ ! -d "${i}" ]] && continue
	  exclude_from_relabelling="$exclude_from_relabelling -e $i"
	done < /etc/selinux/fixfiles_exclude_dirs
    fi
    echo "$exclude_from_relabelling"
}

#
# Set global Variables
#
fullFlag=0
BOOTTIME=""
VERBOSE="-p"
[ -t 1 ] || VERBOSE=""
FORCEFLAG=""
THREADS=""
RPMFILES=""
PREFC=""
RESTORE_MODE=""
BIND_MOUNT_FILESYSTEMS=""
SETFILES=/sbin/setfiles
RESTORECON=/sbin/restorecon
FILESYSTEMSRW=`get_rw_labeled_mounts`
FILESYSTEMSRO=`get_ro_labeled_mounts`
SELINUXTYPE="targeted"
if [ -e /etc/selinux/config ]; then
    . /etc/selinux/config
    FC=/etc/selinux/${SELINUXTYPE}/contexts/files/file_contexts
else
    FC=/etc/security/selinux/file_contexts
fi

#
# Log all Read Only file systems
#
LogReadOnly() {
if [ ! -z "$FILESYSTEMSRO" ]; then
    echo "Warning: Skipping the follow