cros deploy: set selinux to permissive.
File labels are not recovered on `cros deploy` currently. It may
prevent processes accessing to some file, executing some executables, or
automatic domain transition upon execution.
Before fixing the bug to recover SELinux file labels. We workaround to
set SELinux to permissive to make quick test and checking possible again
on enforced domains with `cros deploy` without the need to build_images.
BUG=chromium:932156
TEST=cros deploy crash-reporter
TEST=getenforce => Permissive
TEST=grep permissive /etc/selinux/config
Change-Id: Ie2b482d992db4ecabe208037fad48d1942a59788
Reviewed-on: https://chromium-review.googlesource.com/1485632
Commit-Ready: Qijiang Fan <fqj@google.com>
Tested-by: Qijiang Fan <fqj@google.com>
Reviewed-by: Mike Frysinger <vapier@chromium.org>
diff --git a/cli/deploy.py b/cli/deploy.py
index 533ebce..3609703 100644
--- a/cli/deploy.py
+++ b/cli/deploy.py
@@ -797,6 +797,29 @@
logging.notice('%s has been installed.', pkg_name)
+def _SetSELinuxPermissive(device):
+ """Set SELinux to permissive on target device.
+
+ Args:
+ device: A ChromiumOSDevice object.
+ """
+ try:
+ enforce = device.CatFile('/sys/fs/selinux/enforce', max_size=None)
+ # See if SELinux is already disabled.
+ if enforce.strip() == '0':
+ return
+ except remote_access.CatFileError:
+ # Assume SELinux is not enabled.
+ return
+ device.RunCommand(['setenforce', '0'], remote_sudo=True)
+ device.RunCommand(['sed', '-i', 's/SELINUX=.*/SELINUX=permissive/',
+ '/etc/selinux/config'], remote_sudo=True)
+ logging.notice('SELinux is set to permissive(crbug.com/932156). '
+ 'Use build_image to test whether the change works '
+ 'with current SELinux policy, or to test SELinux-'
+ 'related changes.')
+
+
def _GetPackagesByCPV(cpvs, strip, sysroot):
"""Returns paths to binary packages corresponding to |cpvs|.
@@ -1003,6 +1026,8 @@
else:
func()
+ _SetSELinuxPermissive(device)
+
logging.warning('Please restart any updated services on the device, '
'or just reboot it.')
except Exception: