selinux/oracle-selinux/oracle-nofcontext-selinux-enable | 10 +++--
selinux/oracle-selinux/oracle-port.te | 4 ++
selinux/oracle-selinux/oracle-selinux.spec | 30 +++++++++++-----
selinux/oracle-selinux/oracle.te | 15 +++-----
4 files changed, 40 insertions(+), 19 deletions(-)
New commits:
commit 7707c88d53ed895613877db9c664f8c0555aa3a8
Author: Jan Pazdziora <jpazdziora(a)redhat.com>
Date: Thu Jan 27 11:41:38 2011 +0100
Move the oracle_port_t to separate SELinux policy module.
This should make it possible to install on Fedora 14 where
the new selinux-policy-targeted already defines oracle_port_t,
plus it will make it possible for selinux-policy-targeted to
remove the oracle-port module upon upgrades.
diff --git a/selinux/oracle-selinux/oracle-nofcontext-selinux-enable
b/selinux/oracle-selinux/oracle-nofcontext-selinux-enable
index 7d755b2..bd88631 100644
--- a/selinux/oracle-selinux/oracle-nofcontext-selinux-enable
+++ b/selinux/oracle-selinux/oracle-nofcontext-selinux-enable
@@ -3,9 +3,13 @@
# Install SELinux policy modules
for selinuxvariant in mls strict targeted
do
- /usr/sbin/semodule -s ${selinuxvariant} -l > /dev/null 2>&1 \
- && /usr/sbin/semodule -s ${selinuxvariant} -i \
- /usr/share/selinux/${selinuxvariant}/oracle-nofcontext.pp || :
+ if /usr/sbin/semodule -s ${selinuxvariant} -l > /dev/null 2>&1 ; then
+ /usr/sbin/semodule -s ${selinuxvariant} \
+ -i /usr/share/selinux/${selinuxvariant}/oracle-port.pp \
+ -i /usr/share/selinux/${selinuxvariant}/oracle-nofcontext.pp > /dev/null
2>&1 \
+ || /usr/sbin/semodule -s ${selinuxvariant} \
+ -i /usr/share/selinux/${selinuxvariant}/oracle-nofcontext.pp || :
+ fi
done
# add an oracle port if it does not already exist
diff --git a/selinux/oracle-selinux/oracle-port.te
b/selinux/oracle-selinux/oracle-port.te
new file mode 100644
index 0000000..4c80d8a
--- /dev/null
+++ b/selinux/oracle-selinux/oracle-port.te
@@ -0,0 +1,4 @@
+policy_module(oracle-port,1.1.2)
+
+type oracle_port_t;
+corenet_port(oracle_port_t)
diff --git a/selinux/oracle-selinux/oracle-selinux.spec
b/selinux/oracle-selinux/oracle-selinux.spec
index 12198f3..c46fac7 100644
--- a/selinux/oracle-selinux/oracle-selinux.spec
+++ b/selinux/oracle-selinux/oracle-selinux.spec
@@ -29,6 +29,7 @@ Source1: %{modulename}.if
Source2: %{modulename}.te
Source3: %{modulename}.fc
Source4: oracle-nofcontext-selinux-enable
+Source5: %{modulename}-port.te
BuildRoot: %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX)
BuildRequires: checkpolicy, selinux-policy-devel, hardlink
BuildArch: noarch
@@ -66,7 +67,7 @@ Oracle RDBMS, without specifying any file contexts.
%prep
rm -rf SELinux
mkdir -p SELinux
-cp -p %{SOURCE1} %{SOURCE2} %{SOURCE3} %{SOURCE4} SELinux
+cp -p %{SOURCE1} %{SOURCE2} %{SOURCE3} %{SOURCE4} %{SOURCE5} SELinux
# Make file contexts relative to oracle_base
perl -pi -e 's#%{default_oracle_base}#%{oracle_base}#g' SELinux/%{modulename}.fc
@@ -84,6 +85,7 @@ do
make NAME=${selinuxvariant} -f /usr/share/selinux/devel/Makefile
mv %{modulename}.pp %{modulename}.pp.${selinuxvariant}
mv %{modulename}-nofcontext.pp %{modulename}-nofcontext.pp.${selinuxvariant}
+ mv %{modulename}-port.pp %{modulename}-port.pp.${selinuxvariant}
make NAME=${selinuxvariant} -f /usr/share/selinux/devel/Makefile clean
done
cd -
@@ -100,6 +102,8 @@ for selinuxvariant in %{selinux_variants}
%{buildroot}%{_datadir}/selinux/${selinuxvariant}/%{modulename}.pp
install -p -m 644 %{modulename}-nofcontext.pp.${selinuxvariant} \
%{buildroot}%{_datadir}/selinux/${selinuxvariant}/%{modulename}-nofcontext.pp
+ install -p -m 644 %{modulename}-port.pp.${selinuxvariant} \
+ %{buildroot}%{_datadir}/selinux/${selinuxvariant}/%{modulename}-port.pp
done
cd -
@@ -124,9 +128,13 @@ rm -rf %{buildroot}
# Install SELinux policy modules
for selinuxvariant in %{selinux_variants}
do
- /usr/sbin/semodule -s ${selinuxvariant} -l > /dev/null 2>&1 \
- && /usr/sbin/semodule -s ${selinuxvariant} -i \
- %{_datadir}/selinux/${selinuxvariant}/%{modulename}.pp || :
+ if /usr/sbin/semodule -s ${selinuxvariant} -l > /dev/null 2>&1 ; then
+ /usr/sbin/semodule -s ${selinuxvariant} \
+ -i %{_datadir}/selinux/${selinuxvariant}/%{modulename}-port.pp \
+ -i %{_datadir}/selinux/${selinuxvariant}/%{modulename}.pp > /dev/null
2>&1 \
+ || /usr/sbin/semodule -s ${selinuxvariant} \
+ -i %{_datadir}/selinux/${selinuxvariant}/%{modulename}.pp || :
+ fi
done
# add an oracle port if it does not already exist
@@ -171,8 +179,10 @@ if [ $1 -eq 0 ]; then
# Remove SELinux policy modules
for selinuxvariant in %{selinux_variants}
do
- /usr/sbin/semodule -s ${selinuxvariant} -l > /dev/null 2>&1 \
- && /usr/sbin/semodule -s ${selinuxvariant} -r %{modulename} || :
+ if /usr/sbin/semodule -s ${selinuxvariant} -l > /dev/null 2>&1 ; then
+ /usr/sbin/semodule -s ${selinuxvariant} -r %{modulename} || :
+ /usr/sbin/semodule -s ${selinuxvariant} -r %{modulename}-port || :
+ fi
done
# Clean up any remaining file contexts (shouldn't be any really)
[ -d %{oracle_base} ] && \
@@ -192,8 +202,10 @@ if [ $1 -eq 0 ]; then
# Remove SELinux policy modules
for selinuxvariant in %{selinux_variants}
do
- /usr/sbin/semodule -s ${selinuxvariant} -l > /dev/null 2>&1 \
- && /usr/sbin/semodule -s ${selinuxvariant} -r %{modulename}-nofcontext ||
:
+ if /usr/sbin/semodule -s ${selinuxvariant} -l > /dev/null 2>&1 ; then
+ /usr/sbin/semodule -s ${selinuxvariant} -r %{modulename}-nofcontext || :
+ /usr/sbin/semodule -s ${selinuxvariant} -r %{modulename}-port || :
+ fi
done
fi
@@ -201,12 +213,14 @@ fi
%defattr(-,root,root,0755)
%doc SELinux/%{modulename}.fc SELinux/%{modulename}.if SELinux/%{modulename}.te
%{_datadir}/selinux/*/%{modulename}.pp
+%{_datadir}/selinux/*/%{modulename}-port.pp
%{_datadir}/selinux/devel/include/%{moduletype}/%{modulename}.if
%files -n oracle-nofcontext-selinux
%defattr(-,root,root,0755)
%doc SELinux/%{modulename}-nofcontext.fc SELinux/%{modulename}-nofcontext.if
SELinux/%{modulename}-nofcontext.te
%{_datadir}/selinux/*/%{modulename}-nofcontext.pp
+%{_datadir}/selinux/*/%{modulename}-port.pp
%{_datadir}/selinux/devel/include/%{moduletype}/%{modulename}-nofcontext.if
%attr(0755,root,root) %{_sbindir}/oracle-nofcontext-selinux-enable
diff --git a/selinux/oracle-selinux/oracle.te b/selinux/oracle-selinux/oracle.te
index 8c01722..fe2973a 100644
--- a/selinux/oracle-selinux/oracle.te
+++ b/selinux/oracle-selinux/oracle.te
@@ -1,9 +1,4 @@
-policy_module(oracle,1.1.1)
-
-########################################
-#
-# $Id: oracle.te 1558 2008-04-16 21:25:05Z rm153 $
-#
+policy_module(oracle,1.1.2)
########################################
#
@@ -78,8 +73,12 @@ oracle_management_role(sysadm_r)
#
# define oracle ports
-type oracle_port_t;
-corenet_port(oracle_port_t)
+# The following two lines are not in oracle-port.te.
+# type oracle_port_t;
+# corenet_port(oracle_port_t)
+gen_require(`
+ type oracle_port_t;
+')
# for RHEL5.0 policy
#corenet_port_type(oracle_port_t)
Show replies by date