Add SELinux/ssh fixer

Signed-off-by: Jan Pokorný <jpokorny@redhat.com>

1 files changed, 25 insertions, 0 deletions

diff --git a/scripts/selinux/fix.sh b/scripts/selinux/fix.sh
new file mode 100755
index 0000000..6309deb
--- /dev/null
+++ b/scripts/selinux/fix.sh
@@ -0,0 +1,25 @@
+#!/bin/bash
+
+WHICH='ssh'  # pipe-delimited
+WHERE='~/.ssh'  # space delimited
+
+SEHOMEPOLICY='/etc/selinux/targeted/contexts/files/file_contexts.homedirs'
+
+TMPFILE=$(mktemp /tmp/.XXXXX)
+#SETFILESCMD="setfiles -n -s -v -o - ${TMPFILE}"  # dry-run
+SETFILESCMD="setfiles -s -v -o - ${TMPFILE}"
+
+
+# prologue: unrelated to SELinux, but affects password-less ssh in the same way
+chmod 700 -- ~/.ssh
+CURDIR="$(dirname $(readlink -f ~/.ssh))"
+HOMEINODE=$(stat --printf %i ~)
+while [ $(stat --printf %i "${CURDIR}") -ne "${HOMEINODE}" ]; do
+	chmod 700 -- "${CURDIR}"
+	CURDIR="$(dirname ${CURDIR})"
+done
+
+grep -E "${WHICH}" -- "${SEHOMEPOLICY}" >>${TMPFILE}
+${SETFILESCMD} < \
+  <(echo "${WHERE}" | xargs -I '{}' sh -c '[ -d {} ] && echo "{}/"; echo "{}"')
+rm -f -- "${TMPFILE}"