Check SELinux state from /selinux/enforce instead of /usr/sbin/getenforce.

Cleans up an error message when getenforce is not installed, and fixes wrong
outcome from selinuxEnabled() when SELinux is additionally disabled.

1 files changed, 7 insertions, 8 deletions

diff --git a/py/mock/util.py b/py/mock/util.py
index 3322cd5..764ed04 100644
--- a/py/mock/util.py
+++ b/py/mock/util.py
@@ -263,14 +263,13 @@ def logOutput(fds, logger, returnOutput=1, start=0, timeout=0):
 
 decorate(traceLog())
 def selinuxEnabled():
-    p = subprocess.Popen(["/usr/sbin/getenforce"], 
-                         shell=True, 
-                         stdout=subprocess.PIPE, 
-                         close_fds=True)
-    p.wait()
-    if p.stdout.read().strip() == "Disabled":
-        return False
-    return True
+    """Check if SELinux is enabled (enforcing or permissive)."""
+    try:
+        if open("/selinux/enforce").read().strip() in ("1", "0"):
+            return True
+    except:
+        pass
+    return False
 
 # logger =
 # output = [1|0]