#!/bin/bash

if grep -q "^sysadm:" /etc/passwd && grep -q "^secadm:" /etc/passwd && grep -q "^audadm:" /etc/passwd; then

    touch /.autorelabel

    # bind SELinux role and SELinux user
    # 检查并创建三权用户
    if ! semanage user -l 2>/dev/null | grep -q "^sysadm_u"; then
        semanage user -a -R 'sysadm_r system_r' -r s0-s0:c0.c1023 sysadm_u
    fi
    if ! semanage user -l 2>/dev/null | grep -q "^secadm_u"; then
        semanage user -a -R secadm_r -r s0-s0:c0.c1023 secadm_u
    fi
    if ! semanage user -l 2>/dev/null | grep -q "^auditadm_u"; then
        semanage user -a -R auditadm_r -r s0-s0:c0.c1023 auditadm_u
    fi

    # 检查并创建登录映射
    if ! semanage login -l 2>/dev/null | grep -q "^sysadm "; then
        semanage login -a -s sysadm_u sysadm
    fi
    if ! semanage login -l 2>/dev/null | grep -q "^secadm "; then
        semanage login -a -s secadm_u secadm
    fi
    if ! semanage login -l 2>/dev/null | grep -q "^audadm "; then
        semanage login -a -s auditadm_u audadm
    fi

    # add pam_root
    for file in lightdm login sshd;
    do
            if [ -f "/etc/pam.d/${file}" ];then
                    sed -i '/account *required *pam_nologin.so/iaccount    required     pam_root.so' /etc/pam.d/${file}
            fi
    done
    for file in password-auth system-auth;
    do
            if [ -f "/etc/pam.d/${file}" ];then
                    sed -i '/account *required *pam_unix.so/iaccount     required      pam_root.so' /etc/pam.d/${file}
            fi
    done
    if [ -f "/etc/pam.d/xserver" ];then
            sed -i '/account *required\tpam_permit.so/iaccount    required     pam_root.so' /etc/pam.d/xserver
    fi
fi
