#!/bin/sh

PREREQ="_load_selinux_policy"
prereqs()
{
	echo "$PREREQ"
}

case $1 in
	prereqs)
		prereqs
		exit 0
		;;
esac

. /scripts/functions

SECURITY_MNT_DIR=/sys/kernel/security

KYLIN_SECURITY_CONF=${rootmnt}/etc/kylin-security.conf
LSM=$SECURITY_MNT_DIR/lsm

[ ! -e $KYLIN_SECURITY_CONF -o ! -e $LSM ] && exit 0

SECURITY=$(awk -F '[ ="]' '/security|lsm/{gsub(",", " ", $5); print $5}' "$KYLIN_SECURITY_CONF")
SECURITY_LSM=$(awk -F , '{gsub(",", " ", $0); print $0}' $LSM)

#security_in_grub=0
#selinux_in_grub=0
enforcing_in_grub=0
kysec_status_in_grub=0
kysec_exectl_in_grub=0
kysec_netctl_in_grub=0
kysec_3adm_in_grub=0
kysec_ppro_in_grub=0
kic_status_in_grub=0

for x in $(cat /proc/cmdline)
do
	case $x in
		#security=*|lsm=*)
		#	security_in_grub=1
		#	;;
		#selinux=*)
		#	selinux_in_grub=1
		#	;;
		enforcing=*)
			enforcing_in_grub=1
			;;
		kysec_status=*)
			kysec_status_in_grub=1
			;;
		kysec_exectl=*)
			kysec_exectl_in_grub=1
			;;
		kysec_netctl=*)
			kysec_netctl_in_grub=1
			;;
		kysec_3adm=*)
			kysec_3adm_in_grub=1
			;;
		kysec_ppro=*)
			kysec_ppro_in_grub=1
			;;
		kic_status=*)
			kic_status_in_grub=1
			;;
	esac
done

for mod in $SECURITY_LSM
do
	for i in $SECURITY
	do
		if [ "$mod" = "$i" ]; then
			case "$i" in
				"selinux")
					#SE_FS_DIR=/sys/fs/selinux
					#SE_ENFORCE_F=$SE_FS_DIR/enforce
					SE_CONFIG_F=${rootmnt}/etc/selinux/config

					# SElinux 不能通过写/sys/fs/selinux下的文件修改其状态
					#se_status=$(awk -F = '/selinux/&&/[0-9]$/{gsub(" ", "", $0); print $2}' "$KYLIN_SECURITY_CONF")
					#if [ -n $se_status ]; then
					#	echo "se_status=$se_status"
					#fi
					#mount -t selinuxfs none $SE_FS_DIR
					enforcing=$(awk -F = '/enforcing/&&/[0-9]$/{gsub(" ", "", $0); print $2}' "$KYLIN_SECURITY_CONF")
					if [ -n $enforcing ]; then
						#echo "enforcing=$enforcing"
						# 设置SElinux enforcing值
						#[ $enforcing_in_grub -eq 0 ] && \
						#	echo $enforcing > $SE_ENFORCE_F
						if [ $enforcing_in_grub -eq 0 ]; then
							if [ $enforcing -eq 0 ]; then
								sed -i /^SELINUX=/cSELINUX=permissive $SE_CONFIG_F
							elif [ $enforcing -eq 1 ]; then
								sed -i /^SELINUX=/cSELINUX=enforcing $SE_CONFIG_F
							fi
						fi
					fi
					break
					;;
				"kysec")
					KYSEC_STATUS_DIR=$SECURITY_MNT_DIR/kysec
					KYSEC_STATUS_F=$KYSEC_STATUS_DIR/status
					KYSEC_EXECTL_F=$KYSEC_STATUS_DIR/exectl
					KYSEC_NETCTL_F=$KYSEC_STATUS_DIR/netctl
					KYSEC_FPRO_F=$KYSEC_STATUS_DIR/fpro
					KYSEC_KMOD_F=$KYSEC_STATUS_DIR/kmod
					KYSEC_3ADM_F=$KYSEC_STATUS_DIR/3adm
					KYSEC_PPRO_F=$KYSEC_STATUS_DIR/ppro

					kysec_status=$(awk -F = '/kysec_status/&&/[0-9]$/{gsub(" ", "", $0); print $2}' "$KYLIN_SECURITY_CONF")
					if [ -n $kysec_status ]; then
						#echo "kysec_status=$kysec_status"
						[ $kysec_status_in_grub -eq 0 ] && \
							echo $kysec_status > $KYSEC_STATUS_F
					fi

					kysec_exectl=$(awk -F = '/kysec_exectl/&&/[0-9]$/{gsub(" ", "", $0); print $2}' "$KYLIN_SECURITY_CONF")
					if [ -n $kysec_exectl ]; then
						#echo "kysec_exectl=$kysec_exectl"
						[ $kysec_exectl_in_grub -eq 0 ] && \
							echo $kysec_exectl > $KYSEC_EXECTL_F
					fi

					kysec_netctl=$(awk -F = '/kysec_netctl/&&/[0-9]$/{gsub(" ", "", $0); print $2}' "$KYLIN_SECURITY_CONF")
					if [ -n $kysec_netctl ]; then
						#echo "kysec_netctl=$kysec_netctl"
						[ $kysec_netctl_in_grub -eq 0 ] && \
							echo $kysec_netctl > $KYSEC_NETCTL_F
					fi

					kysec_fpro=$(awk -F = '/kysec_fpro/&&/[0-9]$/{gsub(" ", "", $0); print $2}' "$KYLIN_SECURITY_CONF")
					if [ -n $kysec_fpro ]; then
						#echo "kysec_fpro=$kysec_fpro"
						echo $kysec_fpro > $KYSEC_FPRO_F
					fi

					kysec_kmodpro=$(awk -F = '/kysec_kmodpro/&&/[0-9]$/{gsub(" ", "", $0); print $2}' "$KYLIN_SECURITY_CONF")
					if [ -n $kysec_kmodpro ]; then
						#echo "kysec_kmodpro=$kysec_kmodpro"
						echo $kysec_kmodpro > $KYSEC_KMOD_F
					fi

					kysec_3adm=$(awk -F = '/kysec_3adm/&&/[0-9]$/{gsub(" ", "", $0); print $2}' "$KYLIN_SECURITY_CONF")
					if [ -n $kysec_3adm ]; then
						#echo "kysec_3adm=$kysec_3adm"
						if [ $kysec_3adm_in_grub -eq 0 ]; then
							echo $kysec_3adm > $KYSEC_3ADM_F
							echo $kysec_3adm > /.3adm
						fi
					fi

					kysec_ppro=$(awk -F = '/kysec_ppro/&&/[0-9]$/{gsub(" ", "", $0); print $2}' "$KYLIN_SECURITY_CONF")
					if [ -n $kysec_ppro ]; then
						#echo "kysec_ppro=$kysec_ppro"
						[ $kysec_ppro_in_grub -eq 0 ] && \
							echo $kysec_ppro > $KYSEC_PPRO_F
					fi
					break
					;;
				"kic")
					KIC_STATUS_DIR=$SECURITY_MNT_DIR/kic
					KIC_STATUS_F=$KIC_STATUS_DIR/status

					kic_status=$(awk -F = '/kic_status/{gsub(" ", "", $0); print $2}' "$KYLIN_SECURITY_CONF")
					if [ -n $kic_status ]; then
						#echo "kic_status=$kic_status"
						[ $kic_status_in_grub -eq 0 ] && \
							echo $kic_status > $KIC_STATUS_F
					fi
					break
					;;
				#"apparmor")
				#	# apparmor 不能通过写/sys/kernel/security/apparmor下的文件修改其状态
				#	;;
				#"box")
				#	# apparmor 不能通过写/sys/kernel/security/box/status文件修改其状态
				#	BOX_STATUS_DIR=$SECURITY_MNT_DIR/box
				#	BOX_STATUS_F=$BOX_STATUS_DIR/status
				#
				#	box_status=$(awk -F = '/box_status/{gsub(" ", "", $0); print $2}' "$KYLIN_SECURITY_CONF")
				#	if [ -n $box_status ]; then
				#		echo "box_status=$box_status"
				#		echo $box_status > $BOX_STATUS_F
				#	fi
				#	break
				#	;;
			esac
		fi
	done
done
