Repository :
http://git.fedorahosted.org/cgit/copr.git
On branch : master
---------------------------------------------------------------
commit 5f15f35ebb420188c7b9454f864681a54dc46675
Author: Miroslav Suchý <msuchy(a)redhat.com>
Date: Tue Sep 17 20:36:57 2013 +0200
initial selinux subpackage
for now, with empty content
---------------------------------------------------------------
copr.spec | 78 +++++++++++++++++++++++++++++++++++
man/copr-selinux-enable.8.asciidoc | 28 ++++++++++++
man/copr-selinux-relabel.8.asciidoc | 27 ++++++++++++
selinux/copr-selinux-enable | 13 ++++++
selinux/copr-selinux-relabel | 9 ++++
selinux/copr.fc | 3 +
selinux/copr.if | 3 +
selinux/copr.te | 10 ++++
8 files changed, 171 insertions(+), 0 deletions(-)
diff --git a/copr.spec b/copr.spec
index 6a6d7bd..cd12346 100644
--- a/copr.spec
+++ b/copr.spec
@@ -1,6 +1,8 @@
%if 0%{?rhel} < 7 && 0%{?rhel} > 0
%global _pkgdocdir %{_docdir}/%{name}-%{version}
%endif
+%global moduletype apps
+%global modulename copr
Name: copr
Version: 1.5
@@ -31,6 +33,9 @@ BuildRequires: python-argparse
BuildRequires: epydoc
BuildRequires: graphviz
BuildRequires: make
+#for selinux
+BuildRequires: checkpolicy, selinux-policy-devel
+BuildRequires: policycoreutils >= %{POLICYCOREUTILSVER}
%description
COPR is lightweight build system. It allows you to create new project in WebUI,
@@ -107,6 +112,20 @@ and submit new builds and COPR will create yum repository from
latests builds.
This package include documentation for COPR code. Mostly useful for developers
only.
+%package selinux
+Summary: SELinux module for COPR
+Requires(post): policycoreutils, libselinux-utils
+Requires(post): policycoreutils-python
+Requires(post): selinux-policy-targeted
+Requires(postun): policycoreutils
+
+%description selinux
+COPR is lightweight build system. It allows you to create new project in WebUI,
+and submit new builds and COPR will create yum repository from latests builds.
+
+This package include SELinux targeted module for COPR
+
+
%prep
%setup -q
@@ -116,12 +135,25 @@ mv copr_cli/README.rst ./
# convert manages
a2x -d manpage -f manpage man/copr-cli.1.asciidoc
+a2x -d manpage -f manpage man/copr-selinux-enable.8.asciidoc
+a2x -d manpage -f manpage man/copr-selinux-relabel.8.asciidoc
# build documentation
pushd documentation
make python
popd
+#selinux
+pushd selinux
+perl -i -pe 'BEGIN { $VER = join ".", grep /^\d+$/, split /\./,
"%{version}.%{release}"; } s!\@\@VERSION\@\@!$VER!g;' %{modulename}.te
+for selinuxvariant in targeted; do
+ make NAME=${selinuxvariant} -f /usr/share/selinux/devel/Makefile
+ bzip2 -9 %{modulename}.pp
+ mv %{modulename}.pp.bz2 %{modulename}.pp.bz2.${selinuxvariant}
+ make NAME=${selinuxvariant} -f /usr/share/selinux/devel/Makefile clean
+done
+popd
+
%install
#backend
@@ -172,6 +204,24 @@ install -p -m 644 man/copr-cli.1 %{buildroot}/%{_mandir}/man1/
cp -a documentation/python-doc %{buildroot}%{_pkgdocdir}/
cp -a playbooks %{buildroot}%{_pkgdocdir}/
+#selinux
+for selinuxvariant in targeted; do
+ install -d %{buildroot}%{_datadir}/selinux/${selinuxvariant}
+ install -p -m 644 selinux/%{modulename}.pp.bz2.${selinuxvariant} \
+ %{buildroot}%{_datadir}/selinux/${selinuxvariant}/%{modulename}.pp.bz2
+done
+# Install SELinux interfaces
+install -d %{buildroot}%{_datadir}/selinux/devel/include/%{moduletype}
+install -p -m 644 selinux/%{modulename}.if \
+ %{buildroot}%{_datadir}/selinux/devel/include/%{moduletype}/%{modulename}.if
+# Install copr-selinux-enable which will be called in %posttrans
+install -d %{buildroot}%{_sbindir}
+install -p -m 755 selinux/%{name}-selinux-enable
%{buildroot}%{_sbindir}/%{name}-selinux-enable
+install -p -m 755 selinux/%{name}-selinux-relabel
%{buildroot}%{_sbindir}/%{name}-selinux-relabel
+
+install -d %{buildroot}%{_mandir}/man8
+install -p -m 644 man/%{name}-selinux-enable.8 %{buildroot}/%{_mandir}/man8/
+install -p -m 644 man/%{name}-selinux-relabel.8 %{buildroot}/%{_mandir}/man8/
%pre backend
getent group copr >/dev/null || groupadd -r copr
getent passwd copr >/dev/null || \
@@ -187,6 +237,26 @@ useradd -r -g copr-fe -G copr-fe -d %{_datadir}/copr/coprs_frontend
-s /bin/bash
%post frontend
service httpd condrestart
+%post selinux
+if /usr/sbin/selinuxenabled ; then
+ %{_sbindir}/%{name}-selinux-enable
+fi
+
+%posttrans selinux
+if /usr/sbin/selinuxenabled ; then
+ %{_sbindir}/%{name}-selinux-relabel
+fi
+
+%postun
+# Clean up after package removal
+if [ $1 -eq 0 ]; then
+ for selinuxvariant in targeted; do
+ /usr/sbin/semodule -s ${selinuxvariant} -l > /dev/null 2>&1 \
+ && /usr/sbin/semodule -s ${selinuxvariant} -r %{modulename} || :
+ done
+fi
+%{sbinpath}/restorecon -rvvi %{_sharedstatedir}/copr
+
%files backend
%doc LICENSE README
%dir %{_datadir}/copr
@@ -235,6 +305,14 @@ service httpd condrestart
%files doc
%doc %{_pkgdocdir}/python-doc
+%files selinux
+%{_datadir}/selinux/*/%{modulename}.pp.bz2
+%{_datadir}/selinux/devel/include/%{moduletype}/%{modulename}.if
+%{_sbindir}/%{name}-selinux-enable
+%{_sbindir}/%{name}-selinux-relabel
+%{_mandir}/man8/%{name}-selinux-enable.8*
+%{_mandir}/man8/%{name}-selinux-relabel.8*
+
%changelog
* Mon Sep 16 2013 Miroslav Suchý <msuchy(a)redhat.com> 1.5-1
- 1008532 - use __python2 instead of __python
diff --git a/man/copr-selinux-enable.8.asciidoc b/man/copr-selinux-enable.8.asciidoc
new file mode 100644
index 0000000..4c55023
--- /dev/null
+++ b/man/copr-selinux-enable.8.asciidoc
@@ -0,0 +1,28 @@
+copr-selinux-enable(8)
+=====================
+:man source: copr
+:man manual: COPR
+
+NAME
+----
+
+copr-selinux-enable - enable Copr SELinux policy
+
+SYNOPSIS
+--------
+
+copr-selinux-enable
+
+DESCRIPTION
+-----------
+
+The *copr-selinux-enable* program will install and enable Copr
+SELinux module and sets required SELinux bool flags.
+
+The program is called by rpm post script and it
+is not usually required to run it manually.
+
+SEE ALSO
+--------
+
+copr-selinux-relabel(8)
diff --git a/man/copr-selinux-relabel.8.asciidoc b/man/copr-selinux-relabel.8.asciidoc
new file mode 100644
index 0000000..c2b6339
--- /dev/null
+++ b/man/copr-selinux-relabel.8.asciidoc
@@ -0,0 +1,27 @@
+copr-selinux-relabel(8)
+=====================
+:man source: copr
+:man manual: COPR
+
+NAME
+----
+
+copr-selinux-relabel - call restorecon on Copr files
+
+SYNOPSIS
+--------
+
+copr-selinux-relabel
+
+DESCRIPTION
+-----------
+
+The *copr-selinux-relabel* program will call restorecon(8) on all
+Copr files. Efectively restore SELinux context.
+
+The program is called by rpm post script and it
+is not usually required to run it manually.
+
+=head1 SEE ALSO
+
+copr-selinux-enable(8), restorecon(8)
diff --git a/selinux/copr-selinux-enable b/selinux/copr-selinux-enable
new file mode 100755
index 0000000..1974de2
--- /dev/null
+++ b/selinux/copr-selinux-enable
@@ -0,0 +1,13 @@
+#!/bin/bash
+
+# Install SELinux policy modules
+for selinuxvariant in targeted; do
+ /usr/sbin/semodule -s ${selinuxvariant} -l > /dev/null 2>&1 \
+ && /usr/sbin/semodule -s ${selinuxvariant} -i
/usr/share/selinux/${selinuxvariant}/copr.pp.bz2
+done
+
+/usr/sbin/setsebool -P httpd_enable_cgi 1
+/usr/sbin/setsebool -P httpd_can_network_connect 1
+/usr/sbin/setsebool -P httpd_can_sendmail 1
+
+
diff --git a/selinux/copr-selinux-relabel b/selinux/copr-selinux-relabel
new file mode 100755
index 0000000..d482d60
--- /dev/null
+++ b/selinux/copr-selinux-relabel
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+for package in copr-backend copr-frontend copr-cli copr-selinux; do
+ rpm -q $package &>/dev/null && /usr/sbin/fixfiles -R $package restore
+done
+
+if [ -d /var/lib/copr ]; then
+ restorecon -rvvi /var/lib/copr
+fi
diff --git a/selinux/copr.fc b/selinux/copr.fc
new file mode 100644
index 0000000..fdff57a
--- /dev/null
+++ b/selinux/copr.fc
@@ -0,0 +1,3 @@
+#
+# This file is currently intentionally left blank.
+#
diff --git a/selinux/copr.if b/selinux/copr.if
new file mode 100644
index 0000000..fdff57a
--- /dev/null
+++ b/selinux/copr.if
@@ -0,0 +1,3 @@
+#
+# This file is currently intentionally left blank.
+#
diff --git a/selinux/copr.te b/selinux/copr.te
new file mode 100644
index 0000000..4ffecc3
--- /dev/null
+++ b/selinux/copr.te
@@ -0,0 +1,10 @@
+policy_module(copr,@@VERSION@@)
+
+## <desc>
+## <p>
+## Allow Copr BE to work with data (/var/lib/copr/public_html) stored
+## on NFS-mounted directories.
+## </p>
+## </desc>
+gen_tunable(copr_nfs_mountpoint,false)
+