#!/bin/sh
# Refresh from this RPM's source, never a previous install's generated module.
# SC-581: an unowned cached .pp otherwise preserves obsolete entrypoint labels.
set -eu

[ -e /sys/fs/selinux/enforce ] || exit 0

src=/usr/share/selinux/packages
makefile=/usr/share/selinux/devel/Makefile
for file in "$src/shcpd.te" "$src/shcpd.fc" "$makefile"; do
    if [ ! -f "$file" ]; then
        echo "shcp-selinux-refresh: required policy source missing: $file" >&2
        exit 1
    fi
done

work=$(mktemp -d /var/tmp/shcpd-selinux.XXXXXX)
trap 'rm -rf -- "$work"' EXIT
trap 'exit 1' HUP INT TERM
cp "$src/shcpd.te" "$src/shcpd.fc" "$work/"
(
    cd "$work"
    make -f "$makefile" shcpd.pp
)
# A compilation/load failure must never fall back to the old cached module.
semodule -i "$work/shcpd.pp"
install -m 0644 "$work/shcpd.pp" "$src/shcpd.pp"

for path in /usr/sbin/shcpd /etc/shcp /var/lib/shcp /var/log/shcpd; do
    [ -e "$path" ] || continue
    restorecon -R "$path"
done
