37cf7d
# Copyright (C) 2017 Red Hat, Inc. All rights reserved.
37cf7d
#
37cf7d
#   Author: Petr Lautrbach <plautrba@redhat.com>
37cf7d
#   Author: Lukáš Vrabec <lvrabec@redhat.com>
c49229
#
c49229
# This program is free software; you can redistribute it and/or
c49229
# modify it under the terms of the GNU General Public License
c49229
# as published by the Free Software Foundation; either version 2
c49229
# of the License, or (at your option) any later version.
c49229
#
c49229
# This program is distributed in the hope that it will be useful,
c49229
# but WITHOUT ANY WARRANTY; without even the implied warranty of
c49229
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
c49229
# GNU General Public License for more details.
c49229
#
c49229
# You should have received a copy of the GNU General Public License
c49229
# along with this program.  If not, see <http: www.gnu.org="" licenses=""/>.
c49229
c49229
# RPM macros for packages installing SELinux modules
c49229
c49229
%_selinux_policy_version SELINUXPOLICYVERSION
c49229
5c9722
%_selinux_store_path SELINUXSTOREPATH
b68c75
%_selinux_store_policy_path %{_selinux_store_path}/${_policytype}
5c9722
c49229
%_file_context_file %{_sysconfdir}/selinux/${SELINUXTYPE}/contexts/files/file_contexts
c49229
%_file_context_file_pre %{_localstatedir}/lib/rpm-state/file_contexts.pre
c49229
b68c75
%_file_custom_defined_booleans %{_selinux_store_policy_path}/rpmbooleans.custom
b68c75
%_file_custom_defined_booleans_tmp %{_selinux_store_policy_path}/rpmbooleans.custom.tmp
29c9d8
723bc0
# %selinux_requires
723bc0
%selinux_requires \
723bc0
Requires: selinux-policy >= %{_selinux_policy_version} \
723bc0
BuildRequires: git \
723bc0
BuildRequires: pkgconfig(systemd) \
723bc0
BuildRequires: selinux-policy \
723bc0
BuildRequires: selinux-policy-devel \
723bc0
Requires(post): selinux-policy-base >= %{_selinux_policy_version} \
723bc0
Requires(post): libselinux-utils \
723bc0
Requires(post): policycoreutils \
b68c75
%if 0%{?fedora} || 0%{?rhel} > 7\
723bc0
Requires(post): policycoreutils-python-utils \
723bc0
%else \
723bc0
Requires(post): policycoreutils-python \
723bc0
%endif \
723bc0
%{nil}
723bc0
37cf7d
# %selinux_modules_install [-s <policytype>] [-p <modulepriority>] module [module]...
37cf7d
%selinux_modules_install("s:p:") \
c49229
. /etc/selinux/config \
c49229
_policytype=%{-s*} \
c49229
if [ -z "${_policytype}" ]; then \
c49229
  _policytype="targeted" \
c49229
fi \
b68c75
if [ "${SELINUXTYPE}" = "${_policytype}" ]; then \
b68c75
  %{_sbindir}/semodule -n -s ${_policytype} -X %{!-p:200}%{-p*} -i %* \
b68c75
  %{_sbindir}/selinuxenabled && %{_sbindir}/load_policy \
c49229
fi \
c49229
%{nil}
c49229
37cf7d
# %selinux_modules_uninstall [-s <policytype>] [-p <modulepriority>] module [module]...
37cf7d
%selinux_modules_uninstall("s:p:") \
c49229
. /etc/selinux/config \
c49229
_policytype=%{-s*} \
c49229
if [ -z "${_policytype}" ]; then \
c49229
  _policytype="targeted" \
c49229
fi \
c49229
if [ $1 -eq 0 ]; then \
b68c75
  if [ "${SELINUXTYPE}" = "${_policytype}" ]; then \
b68c75
    %{_sbindir}/semodule -n -X %{!-p:200}%{-p*} -s ${_policytype} -r %* &> /dev/null || : \
b68c75
    %{_sbindir}/selinuxenabled && %{_sbindir}/load_policy \
c49229
  fi \
c49229
fi \
c49229
%{nil}
c49229
c49229
# %selinux_relabel_pre [-s <policytype>]
c49229
%selinux_relabel_pre("s:") \
c49229
. /etc/selinux/config \
c49229
_policytype=%{-s*} \
c49229
if [ -z "${_policytype}" ]; then \
c49229
  _policytype="targeted" \
c49229
fi \
c49229
if %{_sbindir}/selinuxenabled && [ "${SELINUXTYPE}" = "${_policytype}" ]; then \
c49229
  [ -f %{_file_context_file_pre} ] || cp -f %{_file_context_file} %{_file_context_file_pre} \
c49229
fi \
c49229
%{nil}
c49229
c49229
c49229
# %selinux_relabel_post [-s <policytype>]
c49229
%selinux_relabel_post("s:") \
c49229
. /etc/selinux/config \
c49229
_policytype=%{-s*} \
c49229
if [ -z "${_policytype}" ]; then \
c49229
  _policytype="targeted" \
c49229
fi \
21c53d
if %{_sbindir}/selinuxenabled && [ "${SELINUXTYPE}" = "${_policytype}" ]; then \
c49229
   if [ -f %{_file_context_file_pre} ]; then \
5c9722
     %{_sbindir}/fixfiles -C %{_file_context_file_pre} restore &> /dev/null \
c49229
     rm -f %{_file_context_file_pre} \
c49229
   fi \
c49229
fi \
c49229
%{nil}
6fa7bc
6fa7bc
# %selinux_set_booleans [-s <policytype>] boolean [boolean]...
6fa7bc
%selinux_set_booleans("s:") \
6fa7bc
. /etc/selinux/config \
6fa7bc
_policytype=%{-s*} \
6fa7bc
if [ -z "${_policytype}" ]; then \
6fa7bc
  _policytype="targeted" \
6fa7bc
fi \
b68c75
if [ -d "%{_selinux_store_policy_path}" ]; then \
b68c75
  LOCAL_MODIFICATIONS=$(%{_sbindir}/semanage boolean -E) \
b68c75
  if [ ! -f %_file_custom_defined_booleans ]; then \
b68c75
      /bin/echo "# This file is managed by macros.selinux-policy. Do not edit it manually" > %_file_custom_defined_booleans \
b68c75
  fi \
b68c75
  semanage_import='' \
b68c75
  for boolean in %*; do \
b68c75
      boolean_name=${boolean%=*} \
b68c75
      boolean_value=${boolean#*=} \
b68c75
      boolean_local_string=$(grep "$boolean_name\$" <<<$LOCAL_MODIFICATIONS) \
b68c75
      if [ -n "$boolean_local_string" ]; then \
b68c75
          semanage_import="${semanage_import}\\nboolean -m -$boolean_value $boolean_name" \
b68c75
          boolean_customized_string=$(grep "$boolean_name\$" %_file_custom_defined_booleans | tail -n 1) \
b68c75
          if [ -n "$boolean_customized_string" ]; then \
b68c75
              /bin/echo $boolean_customized_string >> %_file_custom_defined_booleans \
b68c75
          else \
b68c75
              /bin/echo $boolean_local_string >> %_file_custom_defined_booleans \
b68c75
          fi \
b68c75
      else \
b68c75
          semanage_import="${semanage_import}\\nboolean -m -$boolean_value $boolean_name" \
b68c75
          boolean_default_value=$(LC_ALL=C %{_sbindir}/semanage boolean -l | grep "^$boolean_name " | sed 's/[^(]*([^,]*, *\\(on\\|off\\).*/\\1/') \
b68c75
          /bin/echo "boolean -m --$boolean_default_value $boolean_name" >> %_file_custom_defined_booleans \
b68c75
      fi \
b68c75
  done; \
b68c75
  if %{_sbindir}/selinuxenabled && [ "${SELINUXTYPE}" = "${_policytype}" ]; then \
b68c75
      /bin/echo -e "$semanage_import" | %{_sbindir}/semanage import -S "${_policytype}" \
b68c75
  elif test -d /usr/share/selinux/"${_policytype}"/base.lst; then \
b68c75
      /bin/echo -e "$semanage_import" | %{_sbindir}/semanage import -S "${_policytype}" -N \
b68c75
  fi \
6fa7bc
fi \
6fa7bc
%{nil}
6fa7bc
6fa7bc
# %selinux_unset_booleans [-s <policytype>] boolean [boolean]...
6fa7bc
%selinux_unset_booleans("s:") \
6fa7bc
. /etc/selinux/config \
6fa7bc
_policytype=%{-s*} \
6fa7bc
if [ -z "${_policytype}" ]; then \
6fa7bc
  _policytype="targeted" \
6fa7bc
fi \
b68c75
if [ -d "%{_selinux_store_policy_path}" ]; then \
b68c75
  semanage_import='' \
b68c75
  for boolean in %*; do \
b68c75
      boolean_name=${boolean%=*} \
b68c75
      boolean_customized_string=$(grep "$boolean_name\$" %_file_custom_defined_booleans | tail -n 1) \
b68c75
      if [ -n "$boolean_customized_string" ]; then \
b68c75
          awk "/$boolean_customized_string/ && !f{f=1; next} 1" %_file_custom_defined_booleans > %_file_custom_defined_booleans_tmp && mv %_file_custom_defined_booleans_tmp %_file_custom_defined_booleans \
b68c75
          if ! grep -q "$boolean_name\$" %_file_custom_defined_booleans; then \
b68c75
              semanage_import="${semanage_import}\\n${boolean_customized_string}" \
b68c75
          fi \
b68c75
      fi \
b68c75
  done; \
b68c75
  if %{_sbindir}/selinuxenabled && [ "${SELINUXTYPE}" = "${_policytype}" ]; then \
b68c75
      /bin/echo -e "$semanage_import" | %{_sbindir}/semanage import -S "${_policytype}" \
b68c75
  elif test -d /usr/share/selinux/"${_policytype}"/base.lst; then \
b68c75
      /bin/echo -e "$semanage_import" | %{_sbindir}/semanage import -S "${_policytype}" -N \
b68c75
  fi \
6fa7bc
fi \
6fa7bc
%{nil}