#!/bin/bash
set -e

#PREREQ="framebuffer console_setup"
PREREQ=""

prereqs () {
	echo "$PREREQ"
}

case $1 in
	prereqs)
		prereqs
		exit 0
		;;
esac

. /scripts/functions
. /scripts/security-functions

kag_enable=0
check_kag_param(){
        # check security or lsm  include kag param
        if grep -Eq '(^| )(lsm|security)=[^ ]*kag' /proc/cmdline ;then
                        kag_enable=1
        fi

}

check_kag_param
if [ ${kag_enable} -eq 0 ];then
        exit 0
fi
set +e

securityfs_mnt=/sys/kernel/security

mount -t sysfs -o nodev,noexec,nosuid sysfs ${rootmnt}/sys
mount -t proc -o nodev,noexec,nosuid proc ${rootmnt}/proc
mount -t devtmpfs udev "$rootmnt/dev"
mount -t securityfs -o nodev,noexec,nosuid none ${rootmnt}/sys/kernel/security/


chroot ${rootmnt} /usr/bin/kagsec-init --policy

umount ${rootmnt}/proc
umount ${rootmnt}/sys
umount $rootmnt/dev
clear
