selinux/jabberd-selinux-workaround/jabberd-selinux-workaround-enable | 9
selinux/jabberd-selinux-workaround/jabberd-selinux-workaround.spec | 91 ++++++++++
selinux/jabberd-selinux-workaround/jabberworkaround.if | 1
selinux/jabberd-selinux-workaround/jabberworkaround.te | 17 +
4 files changed, 118 insertions(+)
New commits:
commit 5ecfb5c0becfe85d7029a115cdf978073cafbe2d
Author: Milan Zazrivec <mzazrivec(a)redhat.com>
Date: Mon Jan 31 14:16:43 2011 +0100
initial commit of jabberd-selinux-workaround
This SELinux module is to allow jabberd to work with stock RHEL-6.0
selinux-policy-targeted in enforcing mode.
diff --git a/selinux/jabberd-selinux-workaround/jabberd-selinux-workaround-enable
b/selinux/jabberd-selinux-workaround/jabberd-selinux-workaround-enable
new file mode 100644
index 0000000..6f0e3da
--- /dev/null
+++ b/selinux/jabberd-selinux-workaround/jabberd-selinux-workaround-enable
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+# Install SELinux policy modules
+for selinuxvariant in mls strict targeted
+ do
+ /usr/sbin/semodule -s ${selinuxvariant} -l > /dev/null 2>&1 \
+ && /usr/sbin/semodule -s ${selinuxvariant} -i \
+ /usr/share/selinux/${selinuxvariant}/jabberworkaround.pp || :
+ done
diff --git a/selinux/jabberd-selinux-workaround/jabberd-selinux-workaround.spec
b/selinux/jabberd-selinux-workaround/jabberd-selinux-workaround.spec
new file mode 100644
index 0000000..0e04f4b
--- /dev/null
+++ b/selinux/jabberd-selinux-workaround/jabberd-selinux-workaround.spec
@@ -0,0 +1,91 @@
+%global selinux_variants mls strict targeted
+%global selinux_policyver %(sed -e 's,.*selinux-policy-\\([^/]*\\)/.*,\\1,'
/usr/share/selinux/devel/policyhelp 2> /dev/null)
+%global POLICYCOREUTILSVER 1.33.12-1
+
+%global moduletype apps
+%global modulename jabberworkaround
+
+Name: jabberd-selinux-workaround
+Version: 1.0.1
+Release: 1%{?dist}
+Summary: SELinux policy module supporting jabberd on RHEL-6.0
+
+Group: System Environment/Base
+License: GPLv2+
+URL:
http://fedorahosted.org/spacewalk
+Source0:
https://fedorahosted.org/releases/s/p/spacewalk/%{name}-%{version}.tar.gz
+BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
+
+BuildRequires: checkpolicy, selinux-policy-devel
+BuildRequires: policycoreutils >= %{POLICYCOREUTILSVER}
+BuildArch: noarch
+
+%if "%{selinux_policyver}" != ""
+Requires: selinux-policy >= %{selinux_policyver}
+%endif
+Requires(post): /usr/sbin/semodule, /sbin/restorecon, /usr/sbin/setsebool,
/usr/sbin/selinuxenabled
+Requires(postun): /usr/sbin/semodule, /sbin/restorecon
+Requires: jabberd >= 2.2.8
+
+%description
+Workaround for jabberd to work with default RHEL-6.0 SELinux policy.
+
+%prep
+%setup -q
+
+%build
+# Build SELinux policy modules
+perl -i -pe 'BEGIN { $VER = join ".", grep /^\d+$/, split /\./,
"%{version}.%{release}"; } s!\@\@VERSION\@\@!$VER!g;' %{modulename}.te
+for selinuxvariant in %{selinux_variants}
+do
+ make NAME=${selinuxvariant} -f /usr/share/selinux/devel/Makefile
+ mv %{modulename}.pp %{modulename}.pp.${selinuxvariant}
+ make NAME=${selinuxvariant} -f /usr/share/selinux/devel/Makefile clean
+done
+
+%install
+rm -rf %{buildroot}
+
+# Install SELinux policy modules
+for selinuxvariant in %{selinux_variants}
+ do
+ install -d %{buildroot}%{_datadir}/selinux/${selinuxvariant}
+ install -p -m 644 %{modulename}.pp.${selinuxvariant} \
+ %{buildroot}%{_datadir}/selinux/${selinuxvariant}/%{modulename}.pp
+ done
+
+# Install SELinux interfaces
+install -d %{buildroot}%{_datadir}/selinux/devel/include/%{moduletype}
+install -p -m 644 %{modulename}.if \
+ %{buildroot}%{_datadir}/selinux/devel/include/%{moduletype}/%{modulename}.if
+
+# Install jabberd-selinux-enable which will be called in %posttrans
+install -d %{buildroot}%{_sbindir}
+install -p -m 755 %{name}-enable %{buildroot}%{_sbindir}/%{name}-enable
+
+%clean
+rm -rf %{buildroot}
+
+%post
+if /usr/sbin/selinuxenabled ; then
+ %{_sbindir}/%{name}-enable
+fi
+
+%postun
+# Clean up after package removal
+if [ $1 -eq 0 ]; then
+ for selinuxvariant in %{selinux_variants}
+ do
+ /usr/sbin/semodule -s ${selinuxvariant} -l > /dev/null 2>&1 \
+ && /usr/sbin/semodule -s ${selinuxvariant} -r %{modulename} || :
+ done
+fi
+
+%files
+%defattr(-,root,root,0755)
+%doc %{modulename}.fc %{modulename}.if %{modulename}.te
+%{_datadir}/selinux/*/%{modulename}.pp
+%{_datadir}/selinux/devel/include/%{moduletype}/%{modulename}.if
+%attr(0755,root,root) %{_sbindir}/%{name}-enable
+
+%changelog
diff --git a/selinux/jabberd-selinux-workaround/jabberworkaround.fc
b/selinux/jabberd-selinux-workaround/jabberworkaround.fc
new file mode 100644
index 0000000..e69de29
diff --git a/selinux/jabberd-selinux-workaround/jabberworkaround.if
b/selinux/jabberd-selinux-workaround/jabberworkaround.if
new file mode 100644
index 0000000..3eb6a30
--- /dev/null
+++ b/selinux/jabberd-selinux-workaround/jabberworkaround.if
@@ -0,0 +1 @@
+## <summary></summary>
diff --git a/selinux/jabberd-selinux-workaround/jabberworkaround.te
b/selinux/jabberd-selinux-workaround/jabberworkaround.te
new file mode 100644
index 0000000..9d721e1
--- /dev/null
+++ b/selinux/jabberd-selinux-workaround/jabberworkaround.te
@@ -0,0 +1,17 @@
+
+policy_module(jabberworkaround, @@VERSION@@)
+
+require {
+ type jabberd_t;
+ class process setfscreate;
+ class netlink_route_socket { write getattr read bind create nlmsg_read };
+}
+
+#============= jabberd_t ==============
+allow jabberd_t self:netlink_route_socket { write getattr read bind create nlmsg_read };
+allow jabberd_t self:process setfscreate;
+kerberos_use(jabberd_t)
+miscfiles_manage_cert_dirs(jabberd_t)
+miscfiles_manage_cert_files(jabberd_t)
+seutil_read_file_contexts(jabberd_t)
+seutil_search_default_contexts(jabberd_t)