Repository : http://git.fedorahosted.org/cgit/copr.git
On branch : master
commit 5f15f35ebb420188c7b9454f864681a54dc46675 Author: Miroslav Suchý msuchy@redhat.com Date: Tue Sep 17 20:36:57 2013 +0200
initial selinux subpackage
for now, with empty content
copr.spec | 78 +++++++++++++++++++++++++++++++++++ man/copr-selinux-enable.8.asciidoc | 28 ++++++++++++ man/copr-selinux-relabel.8.asciidoc | 27 ++++++++++++ selinux/copr-selinux-enable | 13 ++++++ selinux/copr-selinux-relabel | 9 ++++ selinux/copr.fc | 3 + selinux/copr.if | 3 + selinux/copr.te | 10 ++++ 8 files changed, 171 insertions(+), 0 deletions(-)
diff --git a/copr.spec b/copr.spec index 6a6d7bd..cd12346 100644 --- a/copr.spec +++ b/copr.spec @@ -1,6 +1,8 @@ %if 0%{?rhel} < 7 && 0%{?rhel} > 0 %global _pkgdocdir %{_docdir}/%{name}-%{version} %endif +%global moduletype apps +%global modulename copr
Name: copr Version: 1.5 @@ -31,6 +33,9 @@ BuildRequires: python-argparse BuildRequires: epydoc BuildRequires: graphviz BuildRequires: make +#for selinux +BuildRequires: checkpolicy, selinux-policy-devel +BuildRequires: policycoreutils >= %{POLICYCOREUTILSVER}
%description COPR is lightweight build system. It allows you to create new project in WebUI, @@ -107,6 +112,20 @@ and submit new builds and COPR will create yum repository from latests builds. This package include documentation for COPR code. Mostly useful for developers only.
+%package selinux +Summary: SELinux module for COPR +Requires(post): policycoreutils, libselinux-utils +Requires(post): policycoreutils-python +Requires(post): selinux-policy-targeted +Requires(postun): policycoreutils + +%description selinux +COPR is lightweight build system. It allows you to create new project in WebUI, +and submit new builds and COPR will create yum repository from latests builds. + +This package include SELinux targeted module for COPR + + %prep %setup -q
@@ -116,12 +135,25 @@ mv copr_cli/README.rst ./
# convert manages a2x -d manpage -f manpage man/copr-cli.1.asciidoc +a2x -d manpage -f manpage man/copr-selinux-enable.8.asciidoc +a2x -d manpage -f manpage man/copr-selinux-relabel.8.asciidoc
# build documentation pushd documentation make python popd
+#selinux +pushd selinux +perl -i -pe 'BEGIN { $VER = join ".", grep /^\d+$/, split /./, "%{version}.%{release}"; } s!@@VERSION@@!$VER!g;' %{modulename}.te +for selinuxvariant in targeted; do + make NAME=${selinuxvariant} -f /usr/share/selinux/devel/Makefile + bzip2 -9 %{modulename}.pp + mv %{modulename}.pp.bz2 %{modulename}.pp.bz2.${selinuxvariant} + make NAME=${selinuxvariant} -f /usr/share/selinux/devel/Makefile clean +done +popd + %install
#backend @@ -172,6 +204,24 @@ install -p -m 644 man/copr-cli.1 %{buildroot}/%{_mandir}/man1/ cp -a documentation/python-doc %{buildroot}%{_pkgdocdir}/ cp -a playbooks %{buildroot}%{_pkgdocdir}/
+#selinux +for selinuxvariant in targeted; do + install -d %{buildroot}%{_datadir}/selinux/${selinuxvariant} + install -p -m 644 selinux/%{modulename}.pp.bz2.${selinuxvariant} \ + %{buildroot}%{_datadir}/selinux/${selinuxvariant}/%{modulename}.pp.bz2 +done +# Install SELinux interfaces +install -d %{buildroot}%{_datadir}/selinux/devel/include/%{moduletype} +install -p -m 644 selinux/%{modulename}.if \ + %{buildroot}%{_datadir}/selinux/devel/include/%{moduletype}/%{modulename}.if +# Install copr-selinux-enable which will be called in %posttrans +install -d %{buildroot}%{_sbindir} +install -p -m 755 selinux/%{name}-selinux-enable %{buildroot}%{_sbindir}/%{name}-selinux-enable +install -p -m 755 selinux/%{name}-selinux-relabel %{buildroot}%{_sbindir}/%{name}-selinux-relabel + +install -d %{buildroot}%{_mandir}/man8 +install -p -m 644 man/%{name}-selinux-enable.8 %{buildroot}/%{_mandir}/man8/ +install -p -m 644 man/%{name}-selinux-relabel.8 %{buildroot}/%{_mandir}/man8/ %pre backend getent group copr >/dev/null || groupadd -r copr getent passwd copr >/dev/null || \ @@ -187,6 +237,26 @@ useradd -r -g copr-fe -G copr-fe -d %{_datadir}/copr/coprs_frontend -s /bin/bash %post frontend service httpd condrestart
+%post selinux +if /usr/sbin/selinuxenabled ; then + %{_sbindir}/%{name}-selinux-enable +fi + +%posttrans selinux +if /usr/sbin/selinuxenabled ; then + %{_sbindir}/%{name}-selinux-relabel +fi + +%postun +# Clean up after package removal +if [ $1 -eq 0 ]; then + for selinuxvariant in targeted; do + /usr/sbin/semodule -s ${selinuxvariant} -l > /dev/null 2>&1 \ + && /usr/sbin/semodule -s ${selinuxvariant} -r %{modulename} || : + done +fi +%{sbinpath}/restorecon -rvvi %{_sharedstatedir}/copr + %files backend %doc LICENSE README %dir %{_datadir}/copr @@ -235,6 +305,14 @@ service httpd condrestart %files doc %doc %{_pkgdocdir}/python-doc
+%files selinux +%{_datadir}/selinux/*/%{modulename}.pp.bz2 +%{_datadir}/selinux/devel/include/%{moduletype}/%{modulename}.if +%{_sbindir}/%{name}-selinux-enable +%{_sbindir}/%{name}-selinux-relabel +%{_mandir}/man8/%{name}-selinux-enable.8* +%{_mandir}/man8/%{name}-selinux-relabel.8* + %changelog * Mon Sep 16 2013 Miroslav Suchý msuchy@redhat.com 1.5-1 - 1008532 - use __python2 instead of __python diff --git a/man/copr-selinux-enable.8.asciidoc b/man/copr-selinux-enable.8.asciidoc new file mode 100644 index 0000000..4c55023 --- /dev/null +++ b/man/copr-selinux-enable.8.asciidoc @@ -0,0 +1,28 @@ +copr-selinux-enable(8) +===================== +:man source: copr +:man manual: COPR + +NAME +---- + +copr-selinux-enable - enable Copr SELinux policy + +SYNOPSIS +-------- + +copr-selinux-enable + +DESCRIPTION +----------- + +The *copr-selinux-enable* program will install and enable Copr +SELinux module and sets required SELinux bool flags. + +The program is called by rpm post script and it +is not usually required to run it manually. + +SEE ALSO +-------- + +copr-selinux-relabel(8) diff --git a/man/copr-selinux-relabel.8.asciidoc b/man/copr-selinux-relabel.8.asciidoc new file mode 100644 index 0000000..c2b6339 --- /dev/null +++ b/man/copr-selinux-relabel.8.asciidoc @@ -0,0 +1,27 @@ +copr-selinux-relabel(8) +===================== +:man source: copr +:man manual: COPR + +NAME +---- + +copr-selinux-relabel - call restorecon on Copr files + +SYNOPSIS +-------- + +copr-selinux-relabel + +DESCRIPTION +----------- + +The *copr-selinux-relabel* program will call restorecon(8) on all +Copr files. Efectively restore SELinux context. + +The program is called by rpm post script and it +is not usually required to run it manually. + +=head1 SEE ALSO + +copr-selinux-enable(8), restorecon(8) diff --git a/selinux/copr-selinux-enable b/selinux/copr-selinux-enable new file mode 100755 index 0000000..1974de2 --- /dev/null +++ b/selinux/copr-selinux-enable @@ -0,0 +1,13 @@ +#!/bin/bash + +# Install SELinux policy modules +for selinuxvariant in targeted; do + /usr/sbin/semodule -s ${selinuxvariant} -l > /dev/null 2>&1 \ + && /usr/sbin/semodule -s ${selinuxvariant} -i /usr/share/selinux/${selinuxvariant}/copr.pp.bz2 +done + +/usr/sbin/setsebool -P httpd_enable_cgi 1 +/usr/sbin/setsebool -P httpd_can_network_connect 1 +/usr/sbin/setsebool -P httpd_can_sendmail 1 + + diff --git a/selinux/copr-selinux-relabel b/selinux/copr-selinux-relabel new file mode 100755 index 0000000..d482d60 --- /dev/null +++ b/selinux/copr-selinux-relabel @@ -0,0 +1,9 @@ +#!/bin/bash + +for package in copr-backend copr-frontend copr-cli copr-selinux; do + rpm -q $package &>/dev/null && /usr/sbin/fixfiles -R $package restore +done + +if [ -d /var/lib/copr ]; then + restorecon -rvvi /var/lib/copr +fi diff --git a/selinux/copr.fc b/selinux/copr.fc new file mode 100644 index 0000000..fdff57a --- /dev/null +++ b/selinux/copr.fc @@ -0,0 +1,3 @@ +# +# This file is currently intentionally left blank. +# diff --git a/selinux/copr.if b/selinux/copr.if new file mode 100644 index 0000000..fdff57a --- /dev/null +++ b/selinux/copr.if @@ -0,0 +1,3 @@ +# +# This file is currently intentionally left blank. +# diff --git a/selinux/copr.te b/selinux/copr.te new file mode 100644 index 0000000..4ffecc3 --- /dev/null +++ b/selinux/copr.te @@ -0,0 +1,10 @@ +policy_module(copr,@@VERSION@@) + +## <desc> +## <p> +## Allow Copr BE to work with data (/var/lib/copr/public_html) stored +## on NFS-mounted directories. +## </p> +## </desc> +gen_tunable(copr_nfs_mountpoint,false) +