Skip to content

Implement SELinux context adjustments in preflight.sh #550

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mr-mihu wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Implement SELinux context adjustments in preflight.sh #550

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b758782
Implement SELinux context adjustments in preflight.sh
mr-mihu Apr 26, 2026
238b942
Modify clashctl.sh for SELinux context
mr-mihu Apr 26, 2026
bd67f4b
Fix the issue where the commands do not work after installation
mr-mihu Apr 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 3 additions & 4 deletions install.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,6 @@ clashsecret "$(_get_random_val)" >/dev/null
clashsecret

_okcat '🎉' 'enjoy 🎉'
clashctl

_valid_config "$CLASH_CONFIG_BASE" && CLASH_CONFIG_URL="file://$CLASH_CONFIG_BASE"
_quit "clashsub add $CLASH_CONFIG_URL && clashsub use 1"
echo
_okcat '📌' '立即生效：请执行: source ~/.bashrc'
clashctl -h
9 changes: 8 additions & 1 deletion scripts/cmd/clashctl.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -479,7 +479,7 @@ EOF
clashstatus >&/dev/null || clashon >/dev/null
_okcat '⏳' "请求内核升级..."
[ "$log_flag" = true ] && {
log_cmd=(placeholder_follow_log)
log_cmd=(journalctl -u mihomo -q -f -n 0)
("${log_cmd[@]}" &)

}
Expand All @@ -494,6 +494,13 @@ EOF
[ "$log_flag" = true ] && pkill -9 -f "${log_cmd[*]}"

grep '"status":"ok"' <<<"$res" && {
# SELinux 上下文修复：升级后二进制文件可能丢失上下文
if command -v chcon >/dev/null 2>&1; then
chcon -t bin_t "$BIN_KERNEL" 2>/dev/null
getenforce 2>/dev/null | grep -qiE '^Enforcing' && {
command -v restorecon >/dev/null 2>&1 && restorecon -v "$BIN_KERNEL" 2>/dev/null
}
fi
_okcat "内核升级成功"
return 0
}
Expand Down
14 changes: 14 additions & 0 deletions scripts/preflight.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -170,6 +170,20 @@ _unzip_zip() {
tar -xf "$ZIP_SUBCONVERTER" -C "$BIN_BASE_DIR"
/bin/cp "$BIN_SUBCONVERTER_DIR/pref.example.yml" "$BIN_SUBCONVERTER_CONFIG"
unzip -oqq "$ZIP_UI" -d "$RESOURCES_BASE_DIR" 2>/dev/null || tar -xf "$ZIP_UI" -C "$RESOURCES_BASE_DIR"

# ========== SELinux 上下文修复 ==========
# Rocky Linux /home 目录下的二进制文件默认是 user_home_t
# systemd 以 init_t 运行，无法执行非 bin_t 的文件
if command -v chcon >/dev/null 2>&1; then
chcon -t bin_t "$BIN_KERNEL" 2>/dev/null
# 持久化：仅 SELinux 启用时生效
getenforce 2>/dev/null | grep -qiE '^Enforcing' && {
command -v semanage >/dev/null 2>&1 && \
semanage fcontext -a -t bin_t "$BIN_KERNEL" 2>/dev/null
command -v restorecon >/dev/null 2>&1 && \
restorecon -v "$BIN_KERNEL" 2>/dev/null
}
fi
}

# shellcheck disable=SC2206
Expand Down