aboutsummaryrefslogtreecommitdiffstats
path: root/systemd/system
diff options
context:
space:
mode:
authorMichal Schmidt <mschmidt@redhat.com>2011-04-04 09:57:08 +0200
committerBill Nottingham <notting@redhat.com>2011-04-04 11:33:11 -0400
commitd88e9d09a6570fe729735740a966ed758ff81141 (patch)
treee9109be38c7a07a5b6197a419f2bed47dc6a9f36 /systemd/system
parent4c34204a40e0369442adb9e595ee3d5df5c1bb3f (diff)
downloadinitscripts-d88e9d09a6570fe729735740a966ed758ff81141.tar
initscripts-d88e9d09a6570fe729735740a966ed758ff81141.tar.gz
initscripts-d88e9d09a6570fe729735740a966ed758ff81141.tar.bz2
initscripts-d88e9d09a6570fe729735740a966ed758ff81141.tar.xz
initscripts-d88e9d09a6570fe729735740a966ed758ff81141.zip
separate "touch /.autorelabel" to a new unit
Writing /.autorelabel from fedora-autorelabel does not work because the script is executed only if relabel was already requested. Create a new unit fedora-autorelabel-mark.service which will be responsible for creating /.autorelabel if SELinux is disabled. The unit takes advantage of the new "ConditionSecurity=" support in systemd. The old script checked for a read-only filesystem first. The new unit does not do that. If / is read-only, touch will simply fail. This should not be considered as a failure of the unit, so "-" is used in ExecStart. There have been arguments on systemd-devel that the root directory should not be abused for flag files like /.autorelabel. It has a long tradition in Fedora though (since 2005). Maybe we can change it eventually, but let's keep it where it is for now.
Diffstat (limited to 'systemd/system')
-rw-r--r--systemd/system/fedora-autorelabel-mark.service15
1 files changed, 15 insertions, 0 deletions
diff --git a/systemd/system/fedora-autorelabel-mark.service b/systemd/system/fedora-autorelabel-mark.service
new file mode 100644
index 00000000..33b5147b
--- /dev/null
+++ b/systemd/system/fedora-autorelabel-mark.service
@@ -0,0 +1,15 @@
+[Unit]
+Description=Mark the need to relabel after reboot
+DefaultDependencies=no
+Requires=local-fs.target
+Conflicts=shutdown.target
+After=local-fs.target
+Before=sysinit.target shutdown.target
+ConditionSecurity=!selinux
+ConditionPathIsDirectory=/etc/selinux
+ConditionPathExists=!/.autorelabel
+
+[Service]
+ExecStart=-/bin/touch /.autorelabel
+Type=oneshot
+RemainAfterExit=yes