From cf60872eaef477c1510bc1f9881c29ed0b6fc57b Mon Sep 17 00:00:00 2001 From: Nyr Date: Sat, 13 Feb 2016 19:09:16 +0100 Subject: [PATCH] SELinux improvements - Now the port exception is removed when uninstalling. - sestatus seems to be more widely available. --- openvpn-install.sh | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index 10f69c4..49f7617 100644 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -146,6 +146,11 @@ if [[ -e /etc/openvpn/server.conf ]]; then sed -i "/iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT/d" $RCLOCAL fi sed -i '/iptables -t nat -A POSTROUTING -s 10.8.0.0\/24 -j SNAT --to /d' $RCLOCAL + if sestatus | grep "Current mode" | grep -qs "enforcing"; then + if [[ "$PORT" != '1194' ]]; then + semanage port -d -t openvpn_port_t -p udp $PORT + fi + fi if [[ "$OS" = 'debian' ]]; then apt-get remove --purge -y openvpn openvpn-blacklist else @@ -309,7 +314,7 @@ crl-verify crl.pem" >> /etc/openvpn/server.conf sed -i "1 a\iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" $RCLOCAL fi # If SELinux is enabled and a custom port was selected, we need this - if getenforce | grep -qs "Enforcing"; then + if sestatus | grep "Current mode" | grep -qs "enforcing"; then if [[ "$PORT" != '1194' ]]; then # semanage isn't available in CentOS 6 by default if ! which semanage > /dev/null 2>&1; then