%define distro redhat %define direct_initrc y %define monolithic n %define POLICYVER 20 %define POLICYCOREUTILSVER 1.29.1-1 %define CHECKPOLICYVER 1.28-1 Summary: SELinux policy configuration Name: selinux-policy Version: 2.1.5 Release: 1 License: GPL Group: System Environment/Base Source: serefpolicy-%{version}.tgz patch: policy-20051208.patch Source1: modules-targeted.conf Source2: booleans-targeted.conf Source3: seusers-targeted Source4: setrans-targeted.conf Source5: modules-mls.conf Source6: booleans-mls.conf Source7: seusers-mls Source8: setrans-mls.conf Url: http://serefpolicy.sourceforge.net BuildRoot: %{_tmppath}/serefpolicy-buildroot BuildArch: noarch BuildRequires: checkpolicy >= %{CHECKPOLICYVER} m4 policycoreutils >= %{POLICYCOREUTILSVER} PreReq: policycoreutils >= %{POLICYCOREUTILSVER} Obsoletes: policy %package targeted Summary: SELinux targeted base policy Group: System Environment/Base Provides: selinux-policy-base Obsoletes: selinux-policy-targeted-sources Prereq: policycoreutils >= %{POLICYCOREUTILSVER} Prereq: coreutils %description targeted SELinux Reference policy targeted base module. %define installCmds() \ cp -f ${RPM_SOURCE_DIR}/modules-%1.conf ./policy/modules.conf \ cp -f ${RPM_SOURCE_DIR}/booleans-%1.conf ./policy/booleans.conf \ make NAME=%1 TYPE=%2 DISTRO=%{distro} DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} base.pp \ make NAME=%1 TYPE=%2 DISTRO=%{distro} DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} modules \ %{__mkdir} -p $RPM_BUILD_ROOT/%{_usr}/share/selinux/%1/ \ %{__cp} *.pp $RPM_BUILD_ROOT/%{_usr}/share/selinux/%1/ \ %{__mkdir} -p $RPM_BUILD_ROOT/%{_sysconfdir}/selinux/%1/policy \ %{__mkdir} -p $RPM_BUILD_ROOT/%{_sysconfdir}/selinux/%1/modules/active \ %{__mkdir} -p $RPM_BUILD_ROOT/%{_sysconfdir}/selinux/%1/contexts/files \ make NAME=%1 TYPE=%2 DISTRO=%{distro} DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} DESTDIR=$RPM_BUILD_ROOT install-appconfig \ rm -rf $RPM_BUILD_ROOT%{_sysconfdir}/selinux/%1/booleans \ touch $RPM_BUILD_ROOT%{_sysconfdir}/selinux/config \ touch $RPM_BUILD_ROOT%{_sysconfdir}/selinux/%1/seusers \ touch $RPM_BUILD_ROOT%{_sysconfdir}/selinux/%1/policy/policy.%{POLICYVER} \ touch $RPM_BUILD_ROOT%{_sysconfdir}/selinux/%1/contexts/files/file_contexts \ touch $RPM_BUILD_ROOT%{_sysconfdir}/selinux/%1/contexts/files/homedir_template \ touch $RPM_BUILD_ROOT%{_sysconfdir}/selinux/%1/contexts/files/file_contexts.homedirs \ install -m0644 ${RPM_SOURCE_DIR}/seusers-%1 ${RPM_BUILD_ROOT}%{_sysconfdir}/selinux/%1/modules/active/seusers \ install -m0644 ${RPM_SOURCE_DIR}/setrans-%1.conf ${RPM_BUILD_ROOT}%{_sysconfdir}/selinux/%1/setrans.conf \ %nil %define fileList() \ %defattr(-,root,root) \ %dir %{_usr}/share/selinux \ %dir %{_usr}/share/selinux/%1 \ %config %{_usr}/share/selinux/%1/base.pp \ %dir %{_sysconfdir}/selinux \ %ghost %config(noreplace) %{_sysconfdir}/selinux/config \ %dir %{_sysconfdir}/selinux/%1 \ %config(noreplace) %{_sysconfdir}/selinux/%1/setrans.conf \ %ghost %{_sysconfdir}/selinux/%1/seusers \ %dir %{_sysconfdir}/selinux/%1/modules \ %attr(700,root,root) %dir %{_sysconfdir}/selinux/%1/modules/active \ %verify(not md5 size mtime) %attr(600,root,root) %config(noreplace) %{_sysconfdir}/selinux/%1/modules/active/seusers \ %dir %{_sysconfdir}/selinux/%1/policy/ \ %ghost %{_sysconfdir}/selinux/%1/policy/policy.* \ %dir %{_sysconfdir}/selinux/%1/contexts \ %config(noreplace) %{_sysconfdir}/selinux/%1/contexts/customizable_types \ %config(noreplace) %{_sysconfdir}/selinux/%1/contexts/dbus_contexts \ %config %{_sysconfdir}/selinux/%1/contexts/default_contexts \ %config(noreplace) %{_sysconfdir}/selinux/%1/contexts/default_type \ %config(noreplace) %{_sysconfdir}/selinux/%1/contexts/failsafe_context \ %config(noreplace) %{_sysconfdir}/selinux/%1/contexts/initrc_context \ %config(noreplace) %{_sysconfdir}/selinux/%1/contexts/removable_context \ %config(noreplace) %{_sysconfdir}/selinux/%1/contexts/userhelper_context \ %dir %{_sysconfdir}/selinux/%1/contexts/files \ %ghost %config %{_sysconfdir}/selinux/%1/contexts/files/file_contexts \ %ghost %config %{_sysconfdir}/selinux/%1/contexts/files/homedir_template \ %ghost %config %{_sysconfdir}/selinux/%1/contexts/files/file_contexts.homedirs \ %config %{_sysconfdir}/selinux/%1/contexts/files/media %define saveFileContext() \ if [ -s /etc/selinux/config ]; then \ . %{_sysconfdir}/selinux/config; \ FILE_CONTEXT=%{_sysconfdir}/selinux/%1/contexts/files/file_contexts; \ if [ "${SELINUXTYPE}" == %1 -a -f ${FILE_CONTEXT} ]; then \ cp -f ${FILE_CONTEXT} ${FILE_CONTEXT}.pre; \ fi \ fi %define rebuildpolicy() \ semodule -b /usr/share/selinux/%1/base.pp -s %1 \ for file in $(ls /usr/share/selinux/%1 | grep -v base.pp) \ do \ semodule -i /usr/share/selinux/%1/$file -s %1;\ done; \ rm -f %{_sysconfdir}/selinux/%1/policy/policy.*.rpmnew %define relabel() \ . %{_sysconfdir}/selinux/config; \ FILE_CONTEXT=%{_sysconfdir}/selinux/%1/contexts/files/file_contexts; \ if [ "${SELINUXTYPE}" == %1 -a -f ${FILE_CONTEXT}.pre ]; then \ fixfiles -C ${FILE_CONTEXT}.pre restore; \ rm -f ${FILE_CONTEXT}.pre; \ fi; %description SELinux Reference Policy - modular. %prep %setup -q -n serefpolicy-%{version} %patch0 -p1 %install # Build targeted policy make conf %{__rm} -fR $RPM_BUILD_ROOT %installCmds targeted targeted-mcs %{direct_initrc} # Build mls policy make clean make conf %installCmds mls strict-mls n # Build strict policy # Commented out because only targeted ref policy currently builds # make clean # make conf #%#installCmds strict strict-mcs %{direct_initrc} %clean %{__rm} -fR $RPM_BUILD_ROOT %files targeted %fileList targeted %pre targeted %saveFileContext targeted %post targeted if [ ! -s /etc/selinux/config ]; then # # New install so we will default to targeted policy # echo " # This file controls the state of SELinux on the system. # SELINUX= can take one of these three values: # enforcing - SELinux security policy is enforced. # permissive - SELinux prints warnings instead of enforcing. # disabled - No SELinux policy is loaded. SELINUX=enforcing # SELINUXTYPE= can take one of these two values: # targeted - Only targeted network daemons are protected. # strict - Full SELinux protection. # mls - Multi Level Security protection. SELINUXTYPE=targeted # SETLOCALDEFS= Check local definition changes SETLOCALDEFS=0 " > /etc/selinux/config ln -sf /etc/selinux/config /etc/sysconfig/selinux restorecon /etc/selinux/config 2> /dev/null else # if first time update booleans.local needs to be copied to sandbox [ -f /etc/selinux/targeted/booleans.local ] && mv /etc/selinux/targeted/booleans.local /etc/selinux/targeted/modules/active/ [ -f /etc/selinux/targeted/seusers ] && cp -f /etc/selinux/targeted/seusers /etc/selinux/targeted/modules/active/seusers grep -q "^SETLOCALDEFS" /etc/selinux/config || echo -n " # SETLOCALDEFS= Check local definition changes SETLOCALDEFS=0 ">> /etc/selinux/config fi %rebuildpolicy targeted %relabel targeted %triggerpostun targeted -- selinux-policy-targeted <= 2.0.7 %rebuildpolicy targeted %package mls Summary: SELinux mls base policy Group: System Environment/Base Provides: selinux-policy-base Obsoletes: selinux-policy-mls-sources Prereq: policycoreutils >= %{POLICYCOREUTILSVER} Prereq: coreutils %description mls SELinux Reference policy mls base module. %pre mls %saveFileContext mls %post mls %rebuildpolicy mls %relabel mls %triggerpostun mls -- mls <= 2.0.7 %{rebuildpolicy} mls %files mls %fileList mls %if 0 %package strict Summary: SELinux strict base policy Group: System Environment/Base Provides: selinux-policy-base Obsoletes: selinux-policy-strict-sources Prereq: policycoreutils >= %{POLICYCOREUTILSVER} Prereq: coreutils %description strict SELinux Reference policy strict base module. %pre strict %saveFileContext strict %post strict %rebuildpolicy strict %relabel strict %triggerpostun strict -- strict <= 2.0.7 %{rebuildpolicy} strict %files strict %fileList strict %endif %changelog * Tue Dec 13 2005 Dan Walsh 2.1.5-1 - Update from upstream - Allow unconfined_t to transition to rpm_script_t * Tue Dec 13 2005 Dan Walsh 2.1.4-2 - Clean up spec - range_transition crond to SystemHigh * Mon Dec 12 2005 Dan Walsh 2.1.4-1 - Fixes for hal - Update to upstream * Mon Dec 12 2005 Dan Walsh 2.1.3-1 - Turn back on execmem since we need it for java, firefox, ooffice - Allow gpm to stream socket to itself * Mon Dec 12 2005 Jeremy Katz - 2.1.2-3 - fix requirements to be on the actual packages so that policy can get created properly at install time * Sun Dec 10 2005 Dan Walsh 2.1.2-2 - Allow unconfined_t to execmod texrel_shlib_t * Sat Dec 9 2005 Dan Walsh 2.1.2-1 - Update to upstream - Turn off allow_execmem and allow_execmod booleans - Add tcpd and automount policies * Fri Dec 8 2005 Dan Walsh 2.1.1-3 - Add two new httpd booleans, turned off by default * httpd_can_network_relay * httpd_can_network_connect_db * Fri Dec 8 2005 Dan Walsh 2.1.1-2 - Add ghost for policy.20 * Thu Dec 8 2005 Dan Walsh 2.1.1-1 - Update to upstream - Turn off boolean allow_execstack * Thu Dec 8 2005 Dan Walsh 2.1.0-3 - Change setrans-mls to use new libsetrans - Add default_context rule for xdm * Thu Dec 8 2005 Dan Walsh 2.1.0-2. - Change Requires to PreReg for requiring of policycoreutils on install * Wed Dec 7 2005 Dan Walsh 2.1.0-1. - New upstream release * Wed Dec 7 2005 Dan Walsh 2.0.11-2. Add xdm policy * Tue Dec 6 2005 Dan Walsh 2.0.11-1. Update from upstream * Fri Dec 2 2005 Dan Walsh 2.0.9-1. Update from upstream * Fri Dec 2 2005 Dan Walsh 2.0.8-1. Update from upstream * Fri Dec 2 2005 Dan Walsh 2.0.7-3 - Also trigger to rebuild policy for versions up to 2.0.7. * Tue Nov 29 2005 Dan Walsh 2.0.7-2 - No longer installing policy.20 file, anaconda handles the building of the app. * Tue Nov 29 2005 Dan Walsh 2.0.6-2 - Fixes for dovecot and saslauthd * Wed Nov 23 2005 Dan Walsh 2.0.5-4 - Cleanup pegasus and named - Fix spec file - Fix up passwd changing applications * Tue Nov 21 2005 Dan Walsh 2.0.5-1 -Update to latest from upstream * Tue Nov 21 2005 Dan Walsh 2.0.4-1 - Add rules for pegasus and avahi * Mon Nov 21 2005 Dan Walsh 2.0.2-2 - Start building MLS Policy * Fri Nov 18 2005 Dan Walsh 2.0.2-1 - Update to upstream * Wed Nov 9 2005 Dan Walsh 2.0.1-2 - Turn on bash * Wed Nov 9 2005 Dan Walsh 2.0.1-1 - Initial version