release: fix prepare-local dependencies

In order for `setfiles` to work, the SELinux file contexts must have been copied into `/etc`. The dependency is specified with "Wants" rather than "Requires" to avoid restarting the service if selinux-policy-files is restarted for any reason. Subsequent runs would fail and put the system in a bad state until the next reboot. Add RefuseManualStop / RefuseManualStart to both services to indicate the risk during interactive use by an administrator. Signed-off-by: Ben Cressey <bcressey@amazon.com>
bottlerocket-os · Jan 6, 2022 · f793284 · f793284
1 parent 90de2ee
commit f793284
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/packages/release/prepare-local.service b/packages/release/prepare-local.service
@@ -1,7 +1,11 @@
 [Unit]
 Description=Prepare Local Directory (/local)
 DefaultDependencies=no
+After=selinux-policy-files.service
+Wants=selinux-policy-files.service
 RequiresMountsFor=/local
+RefuseManualStart=true
+RefuseManualStop=true
 
 [Service]
 Type=oneshot

diff --git a/packages/selinux-policy/selinux-policy-files.service b/packages/selinux-policy/selinux-policy-files.service
@@ -1,6 +1,8 @@
 [Unit]
 Description=Copy SELinux policy files
 DefaultDependencies=no
+RefuseManualStart=true
+RefuseManualStop=true
 
 [Service]
 Type=oneshot