Remove the SELinux configuration option.

Since the default policy is no longer available in Jessie.

3 files changed, 0 insertions, 50 deletions

diff --git a/preseed.cfg b/preseed.cfg
index 05f027d..66b1426 100644
--- a/preseed.cfg
+++ b/preseed.cfg
@@ -47,11 +47,6 @@ d-i fripost/partition-script string /cdrom/include/partition.sh
 # for dropbear. (Default: false)
 #d-i fripost/dropbear-use-openssh-key boolean false
 
-# Install and activate (in enforcing mode) SELinux?  Note that activating
-# SELinux requires a dummy reboot to label all files.  So if you have full-disk
-# encryption, you'll have to send the password twice to dropbear. (Default: false)
-#d-i fripost/activate-selinux boolean false
-
 # Keep /media and its kids' entries in the fstab?  /media (and its related
 # entries in the fstab) can safely be removed on a headless server. (Default:
 # false)
diff --git a/src/fripost-postinst-udeb/debian/templates b/src/fripost-postinst-udeb/debian/templates
index 1be33c0..9adf898 100644
--- a/src/fripost-postinst-udeb/debian/templates
+++ b/src/fripost-postinst-udeb/debian/templates
@@ -17,14 +17,6 @@ Default: false
 Description: Use the same key for dropbear and OpenSSH?
  If False, generate a dedicated key for dropbear.
 
-Template: fripost/activate-selinux
-Type: boolean
-Default: false
-Description: Install and activate (in enforcing mode) SELinux?
- Note that activating SELinux requires a dummy reboot to label all
- files.  So if you have full-disk encryption, you'll have to send the
- password twice to dropbear.
-
 Template: fripost/keep-media-directory
 Type: boolean
 Default: false
diff --git a/src/fripost-postinst-udeb/finish-install.d/07fripost b/src/fripost-postinst-udeb/finish-install.d/07fripost
index d4e05bb..e583d5a 100755
--- a/src/fripost-postinst-udeb/finish-install.d/07fripost
+++ b/src/fripost-postinst-udeb/finish-install.d/07fripost
@@ -133,43 +133,6 @@ cp /var/lib/fripost/sshd_config /target/etc/ssh/sshd_config
 
 
 #######################################################################
-# Install and activate SELinux
-# TODO: would be better to have our own policy instead of amending the
-# default one.
-
-db_get fripost/activate-selinux
-if [ "$RET" = true ]; then
-    progress "Installing SELinux"
-    # Recommended packages include graphical tools...
-    /bin/in-target /usr/bin/debconf-apt-progress --no-progress -- \
-        apt-get -y install --no-install-recommends \
-            selinux-basics selinux-policy-default selinux-policy-dev auditd
-    progress "Activating SELinux"
-    /bin/in-target /usr/sbin/selinux-activate
-
-    sed -ri 's/^#?\s*(FSCKFIX)=(yes|no)\s*(\s#.*)?$/\1=yes/' \
-            /target/etc/default/rcS
-
-    progress "Running update-grub"
-    grep -q '^GRUB_CMDLINE_LINUX=' /target/etc/default/grub \
-        || fatal "Missing definition of 'GRUB_CMDLINE_LINUX' in /etc/default/grub"
-    GRUB_CMDLINE="console=tty0 security=selinux enforcing=1"
-    # ^ TODO: we should leave (non SELinux-related) existing
-    # configuration options
-    sed -ri "s/^(GRUB_CMDLINE_LINUX)=.*/\1=\"$GRUB_CMDLINE\"/" \
-            /target/etc/default/grub
-    /bin/in-target /usr/sbin/update-grub
-
-    if /bin/in-target /bin/sh -c "dpkg-query -s postfix >/dev/null 2>&1"; then
-        progress "Running postfix-nochroot"
-        echo 'SYNC_CHROOT=n' >> /target/etc/default/postfix
-        /bin/in-target /usr/sbin/postfix-nochroot
-    fi
-    # TODO: in a crontab: check-selinux-installation
-fi
-
-
-#######################################################################
 # Remove unnecessary packages
 
 # TODO: check for dummy packages / RCs in a weekly crontab.