rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

spec: Use RPM path macros more consistently

Browse Source 
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
This commit is contained in:
Ondrej Mosnacek 2020-01-14 14:36:14 +01:00
parent 4ee1dfc5d7
commit 2a989ab68e
1 changed files with 113 additions and 113 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

226
selinux-policy.spec
View File

@ -84,8 +84,8 @@ Based off of reference policy: Checked out revision 2.20091117
%files %files
%{!?_licensedir:%global license %%doc} %{!?_licensedir:%global license %%doc}
%license COPYING %license COPYING
%dir %{_usr}/share/selinux %dir %{_datadir}/selinux
%dir %{_usr}/share/selinux/packages %dir %{_datadir}/selinux/packages
%dir %{_sysconfdir}/selinux %dir %{_sysconfdir}/selinux
%ghost %config(noreplace) %{_sysconfdir}/selinux/config %ghost %config(noreplace) %{_sysconfdir}/selinux/config
%ghost %{_sysconfdir}/sysconfig/selinux %ghost %{_sysconfdir}/sysconfig/selinux
@ -101,22 +101,22 @@ Requires(pre): selinux-policy-targeted = %{version}-%{release}
SELinux sandbox policy used for the policycoreutils-sandbox package SELinux sandbox policy used for the policycoreutils-sandbox package
%files sandbox %files sandbox
%verify(not md5 size mtime) /usr/share/selinux/packages/sandbox.pp %verify(not md5 size mtime) %{_datadir}/selinux/packages/sandbox.pp
%post sandbox %post sandbox
rm -f /etc/selinux/*/modules/active/modules/sandbox.pp.disabled 2>/dev/null rm -f %{_sysconfdir}/selinux/*/modules/active/modules/sandbox.pp.disabled 2>/dev/null
rm -f %{_sharedstatedir}/selinux/*/active/modules/disabled/sandbox 2>/dev/null rm -f %{_sharedstatedir}/selinux/*/active/modules/disabled/sandbox 2>/dev/null
semodule -n -X 100 -i /usr/share/selinux/packages/sandbox.pp %{_sbindir}/semodule -n -X 100 -i %{_datadir}/selinux/packages/sandbox.pp
if /usr/sbin/selinuxenabled ; then if %{_sbindir}/selinuxenabled ; then
/usr/sbin/load_policy %{_sbindir}/load_policy
fi; fi;
exit 0 exit 0
%preun sandbox %preun sandbox
if [ $1 -eq 0 ] ; then if [ $1 -eq 0 ] ; then
semodule -n -d sandbox 2>/dev/null %{_sbindir}/semodule -n -d sandbox 2>/dev/null
if /usr/sbin/selinuxenabled ; then if %{_sbindir}/selinuxenabled ; then
/usr/sbin/load_policy %{_sbindir}/load_policy
fi; fi;
fi; fi;
exit 0 exit 0
@ -134,19 +134,19 @@ SELinux policy development and man page package
%files devel %files devel
%{_bindir}/macro-expander %{_bindir}/macro-expander
%dir %{_usr}/share/selinux/devel %dir %{_datadir}/selinux/devel
%dir %{_usr}/share/selinux/devel/include %dir %{_datadir}/selinux/devel/include
%{_usr}/share/selinux/devel/include/* %{_datadir}/selinux/devel/include/*
%dir %{_usr}/share/selinux/devel/html %dir %{_datadir}/selinux/devel/html
%{_usr}/share/selinux/devel/html/*html %{_datadir}/selinux/devel/html/*html
%{_usr}/share/selinux/devel/html/*css %{_datadir}/selinux/devel/html/*css
%{_usr}/share/selinux/devel/Makefile %{_datadir}/selinux/devel/Makefile
%{_usr}/share/selinux/devel/example.* %{_datadir}/selinux/devel/example.*
%{_usr}/share/selinux/devel/policy.* %{_datadir}/selinux/devel/policy.*
%ghost %{_sharedstatedir}/sepolgen/interface_info %ghost %{_sharedstatedir}/sepolgen/interface_info
%post devel %post devel
selinuxenabled && /usr/bin/sepolgen-ifgen 2>/dev/null %{_sbindir}/selinuxenabled && %{_bindir}/sepolgen-ifgen 2>/dev/null
exit 0 exit 0
%package doc %package doc
@ -160,7 +160,7 @@ SELinux policy documentation package
%files doc %files doc
%{_mandir}/man*/* %{_mandir}/man*/*
%{_mandir}/ru/*/* %{_mandir}/ru/*/*
%doc %{_usr}/share/doc/%{name} %doc %{_datadir}/doc/%{name}
%define common_params DISTRO=%{distro} UBAC=n DIRECT_INITRC=n MONOLITHIC=%{monolithic} MLS_CATS=1024 MCS_CATS=1024 %define common_params DISTRO=%{distro} UBAC=n DIRECT_INITRC=n MONOLITHIC=%{monolithic} MLS_CATS=1024 MCS_CATS=1024
@ -184,8 +184,8 @@ fi; \
%make_build %common_params UNK_PERMS=%3 NAME=%1 TYPE=%2 validate modules \ %make_build %common_params UNK_PERMS=%3 NAME=%1 TYPE=%2 validate modules \
make %common_params UNK_PERMS=%3 NAME=%1 TYPE=%2 DESTDIR=%{buildroot} install \ make %common_params UNK_PERMS=%3 NAME=%1 TYPE=%2 DESTDIR=%{buildroot} install \
make %common_params UNK_PERMS=%3 NAME=%1 TYPE=%2 DESTDIR=%{buildroot} install-appconfig \ make %common_params UNK_PERMS=%3 NAME=%1 TYPE=%2 DESTDIR=%{buildroot} install-appconfig \
make %common_params UNK_PERMS=%3 NAME=%1 TYPE=%2 DESTDIR=%{buildroot} SEMODULE="semodule -p %{buildroot} -X 100 " load \ make %common_params UNK_PERMS=%3 NAME=%1 TYPE=%2 DESTDIR=%{buildroot} SEMODULE="%{_sbindir}/semodule -p %{buildroot} -X 100 " load \
%{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/logins \ %{__mkdir} -p %{buildroot}%{_sysconfdir}/selinux/%1/logins \
touch %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files/file_contexts.subs \ touch %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files/file_contexts.subs \
install -m0644 selinux_config/securetty_types-%1 %{buildroot}%{_sysconfdir}/selinux/%1/contexts/securetty_types \ install -m0644 selinux_config/securetty_types-%1 %{buildroot}%{_sysconfdir}/selinux/%1/contexts/securetty_types \
install -m0644 selinux_config/file_contexts.subs_dist %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files \ install -m0644 selinux_config/file_contexts.subs_dist %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files \
@ -195,8 +195,8 @@ touch %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files/file_contexts.bin \
touch %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files/file_contexts.local \ touch %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files/file_contexts.local \
touch %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files/file_contexts.local.bin \ touch %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files/file_contexts.local.bin \
cp %{SOURCE30} %{buildroot}%{_sysconfdir}/selinux/%1 \ cp %{SOURCE30} %{buildroot}%{_sysconfdir}/selinux/%1 \
rm -f %{buildroot}/%{_usr}/share/selinux/%1/*pp* \ rm -f %{buildroot}%{_datadir}/selinux/%1/*pp* \
/usr/bin/sha512sum %{buildroot}%{_sysconfdir}/selinux/%1/policy/policy.%{POLICYVER} | cut -d' ' -f 1 > %{buildroot}%{_sysconfdir}/selinux/%1/.policy.sha512; \ %{_bindir}/sha512sum %{buildroot}%{_sysconfdir}/selinux/%1/policy/policy.%{POLICYVER} | cut -d' ' -f 1 > %{buildroot}%{_sysconfdir}/selinux/%1/.policy.sha512; \
rm -rf %{buildroot}%{_sysconfdir}/selinux/%1/contexts/netfilter_contexts \ rm -rf %{buildroot}%{_sysconfdir}/selinux/%1/contexts/netfilter_contexts \
rm -rf %{buildroot}%{_sysconfdir}/selinux/%1/modules/active/policy.kern \ rm -rf %{buildroot}%{_sysconfdir}/selinux/%1/modules/active/policy.kern \
rm -f %{buildroot}%{_sharedstatedir}/selinux/%1/active/*.linked \ rm -f %{buildroot}%{_sharedstatedir}/selinux/%1/active/*.linked \
@ -270,16 +270,16 @@ rm -f %{buildroot}%{_sharedstatedir}/selinux/%1/active/*.linked \
%define relabel() \ %define relabel() \
. %{_sysconfdir}/selinux/config &> /dev/null || true; \ . %{_sysconfdir}/selinux/config &> /dev/null || true; \
FILE_CONTEXT=%{_sysconfdir}/selinux/%1/contexts/files/file_contexts; \ FILE_CONTEXT=%{_sysconfdir}/selinux/%1/contexts/files/file_contexts; \
if /usr/sbin/selinuxenabled && [ "${SELINUXTYPE}" = %1 -a -f ${FILE_CONTEXT}.pre ]; then \ if %{_sbindir}/selinuxenabled && [ "${SELINUXTYPE}" = %1 -a -f ${FILE_CONTEXT}.pre ]; then \
/sbin/fixfiles -C ${FILE_CONTEXT}.pre restore &> /dev/null > /dev/null; \ %{_sbindir}/fixfiles -C ${FILE_CONTEXT}.pre restore &> /dev/null > /dev/null; \
rm -f ${FILE_CONTEXT}.pre; \ rm -f ${FILE_CONTEXT}.pre; \
fi; \ fi; \
if /sbin/restorecon -e /run/media -R /root /var/log /var/run /etc/passwd* /etc/group* /etc/*shadow* 2> /dev/null;then \ if %{_sbindir}/restorecon -e /run/media -R /root /var/log /var/run /etc/passwd* /etc/group* /etc/*shadow* 2> /dev/null;then \
continue; \ continue; \
fi; fi;
%define preInstall() \ %define preInstall() \
if [ $1 -ne 1 ] && [ -s /etc/selinux/config ]; then \ if [ $1 -ne 1 ] && [ -s %{_sysconfdir}/selinux/config ]; then \
if [ -d %{_sharedstatedir}/selinux/%1/active/modules/100/ganesha ]; then \ if [ -d %{_sharedstatedir}/selinux/%1/active/modules/100/ganesha ]; then \
%{_sbindir}/semodule -n -d ganesha; \ %{_sbindir}/semodule -n -d ganesha; \
fi; \ fi; \
@ -288,43 +288,43 @@ if [ $1 -ne 1 ] && [ -s /etc/selinux/config ]; then \
if [ "${SELINUXTYPE}" = %1 -a -f ${FILE_CONTEXT} ]; then \ if [ "${SELINUXTYPE}" = %1 -a -f ${FILE_CONTEXT} ]; then \
[ -f ${FILE_CONTEXT}.pre ] || cp -f ${FILE_CONTEXT} ${FILE_CONTEXT}.pre; \ [ -f ${FILE_CONTEXT}.pre ] || cp -f ${FILE_CONTEXT} ${FILE_CONTEXT}.pre; \
fi; \ fi; \
touch /etc/selinux/%1/.rebuild; \ touch %{_sysconfdir}/selinux/%1/.rebuild; \
if [ -e /etc/selinux/%1/.policy.sha512 ]; then \ if [ -e %{_sysconfdir}/selinux/%1/.policy.sha512 ]; then \
POLICY_FILE=`ls /etc/selinux/%1/policy/policy.* | sort | head -1` \ POLICY_FILE=`ls %{_sysconfdir}/selinux/%1/policy/policy.* | sort | head -1` \
sha512=`sha512sum $POLICY_FILE | cut -d ' ' -f 1`; \ sha512=`sha512sum $POLICY_FILE | cut -d ' ' -f 1`; \
checksha512=`cat /etc/selinux/%1/.policy.sha512`; \ checksha512=`cat %{_sysconfdir}/selinux/%1/.policy.sha512`; \
if [ "$sha512" == "$checksha512" ] ; then \ if [ "$sha512" == "$checksha512" ] ; then \
rm /etc/selinux/%1/.rebuild; \ rm %{_sysconfdir}/selinux/%1/.rebuild; \
fi; \ fi; \
fi; \ fi; \
fi; fi;
%define postInstall() \ %define postInstall() \
. %{_sysconfdir}/selinux/config &> /dev/null || true; \ . %{_sysconfdir}/selinux/config &> /dev/null || true; \
if [ -e /etc/selinux/%2/.rebuild ]; then \ if [ -e %{_sysconfdir}/selinux/%2/.rebuild ]; then \
rm /etc/selinux/%2/.rebuild; \ rm %{_sysconfdir}/selinux/%2/.rebuild; \
/usr/sbin/semodule -B -n -s %2; \ %{_sbindir}/semodule -B -n -s %2; \
fi; \ fi; \
[ "${SELINUXTYPE}" == "%2" ] && selinuxenabled && load_policy; \ [ "${SELINUXTYPE}" == "%2" ] && %{_sbindir}/selinuxenabled && load_policy; \
if [ %1 -eq 1 ]; then \ if [ %1 -eq 1 ]; then \
/sbin/restorecon -R /root /var/log /run /etc/passwd* /etc/group* /etc/*shadow* 2> /dev/null; \ %{_sbindir}/restorecon -R /root /var/log /run /etc/passwd* /etc/group* /etc/*shadow* 2> /dev/null; \
else \ else \
%relabel %2 \ %relabel %2 \
fi; fi;
%define modulesList() \ %define modulesList() \
awk '$1 !~ "/^#/" && $2 == "=" && $3 == "module" { printf "%%s ", $1 }' ./policy/modules-base.conf > %{buildroot}/%{_usr}/share/selinux/%1/modules-base.lst \ awk '$1 !~ "/^#/" && $2 == "=" && $3 == "module" { printf "%%s ", $1 }' ./policy/modules-base.conf > %{buildroot}%{_datadir}/selinux/%1/modules-base.lst \
awk '$1 !~ "/^#/" && $2 == "=" && $3 == "base" { printf "%%s ", $1 }' ./policy/modules-base.conf > %{buildroot}/%{_usr}/share/selinux/%1/base.lst \ awk '$1 !~ "/^#/" && $2 == "=" && $3 == "base" { printf "%%s ", $1 }' ./policy/modules-base.conf > %{buildroot}%{_datadir}/selinux/%1/base.lst \
if [ -e ./policy/modules-contrib.conf ];then \ if [ -e ./policy/modules-contrib.conf ];then \
awk '$1 !~ "/^#/" && $2 == "=" && $3 == "module" { printf "%%s ", $1 }' ./policy/modules-contrib.conf > %{buildroot}/%{_usr}/share/selinux/%1/modules-contrib.lst; \ awk '$1 !~ "/^#/" && $2 == "=" && $3 == "module" { printf "%%s ", $1 }' ./policy/modules-contrib.conf > %{buildroot}%{_datadir}/selinux/%1/modules-contrib.lst; \
fi; fi;
%define nonBaseModulesList() \ %define nonBaseModulesList() \
contrib_modules=`cat %{buildroot}/%{_usr}/share/selinux/%1/modules-contrib.lst` \ contrib_modules=`cat %{buildroot}%{_datadir}/selinux/%1/modules-contrib.lst` \
base_modules=`cat %{buildroot}/%{_usr}/share/selinux/%1/modules-base.lst` \ base_modules=`cat %{buildroot}%{_datadir}/selinux/%1/modules-base.lst` \
for i in $contrib_modules $base_modules; do \ for i in $contrib_modules $base_modules; do \
if [ $i != "sandbox" ];then \ if [ $i != "sandbox" ];then \
echo "%verify(not md5 size mtime) %{_sharedstatedir}/selinux/%1/active/modules/100/$i" >> %{buildroot}/%{_usr}/share/selinux/%1/nonbasemodules.lst \ echo "%verify(not md5 size mtime) %{_sharedstatedir}/selinux/%1/active/modules/100/$i" >> %{buildroot}%{_datadir}/selinux/%1/nonbasemodules.lst \
fi; \ fi; \
done; done;
@ -410,10 +410,10 @@ mkdir -p %{buildroot}%{_bindir}
install -m 755 %{SOURCE33} %{buildroot}%{_bindir}/ install -m 755 %{SOURCE33} %{buildroot}%{_bindir}/
# Always create policy module package directories # Always create policy module package directories
mkdir -p %{buildroot}%{_usr}/share/selinux/{targeted,mls,minimum,modules}/ mkdir -p %{buildroot}%{_datadir}/selinux/{targeted,mls,minimum,modules}/
mkdir -p %{buildroot}%{_sharedstatedir}/selinux/{targeted,mls,minimum,modules}/ mkdir -p %{buildroot}%{_sharedstatedir}/selinux/{targeted,mls,minimum,modules}/
mkdir -p %{buildroot}%{_usr}/share/selinux/packages mkdir -p %{buildroot}%{_datadir}/selinux/packages
# Install devel # Install devel
make clean make clean
@ -425,12 +425,12 @@ cp %{SOURCE28} %{buildroot}/
%makeModulesConf targeted base contrib %makeModulesConf targeted base contrib
%installCmds targeted mcs allow %installCmds targeted mcs allow
# install permissivedomains.cil # install permissivedomains.cil
semodule -p %{buildroot} -X 100 -s targeted -i %{buildroot}/permissivedomains.cil %{_sbindir}/semodule -p %{buildroot} -X 100 -s targeted -i %{buildroot}/permissivedomains.cil
rm -rf %{buildroot}/permissivedomains.cil rm -rf %{buildroot}/permissivedomains.cil
# recreate sandbox.pp # recreate sandbox.pp
rm -rf %{buildroot}%{_sharedstatedir}/selinux/targeted/active/modules/100/sandbox rm -rf %{buildroot}%{_sharedstatedir}/selinux/targeted/active/modules/100/sandbox
%make_build %common_params UNK_PERMS=allow NAME=targeted TYPE=mcs sandbox.pp %make_build %common_params UNK_PERMS=allow NAME=targeted TYPE=mcs sandbox.pp
mv sandbox.pp %{buildroot}/usr/share/selinux/packages/sandbox.pp mv sandbox.pp %{buildroot}%{_datadir}/selinux/packages/sandbox.pp
%modulesList targeted %modulesList targeted
%nonBaseModulesList targeted %nonBaseModulesList targeted
%endif %endif
@ -438,11 +438,11 @@ mv sandbox.pp %{buildroot}/usr/share/selinux/packages/sandbox.pp
%if %{BUILD_MINIMUM} %if %{BUILD_MINIMUM}
# Build minimum policy # Build minimum policy
# Commented out because only minimum ref policy currently builds # Commented out because only minimum ref policy currently builds
mkdir -p %{buildroot}%{_usr}/share/selinux/minimum mkdir -p %{buildroot}%{_datadir}/selinux/minimum
%makeCmds minimum mcs allow %makeCmds minimum mcs allow
%makeModulesConf targeted base contrib %makeModulesConf targeted base contrib
%installCmds minimum mcs allow %installCmds minimum mcs allow
rm -f %{buildroot}/%{_sysconfdir}/selinux/minimum/modules/active/modules/sandbox.pp rm -f %{buildroot}%{_sysconfdir}/selinux/minimum/modules/active/modules/sandbox.pp
rm -rf %{buildroot}%{_sharedstatedir}/selinux/minimum/active/modules/100/sandbox rm -rf %{buildroot}%{_sharedstatedir}/selinux/minimum/active/modules/100/sandbox
%modulesList minimum %modulesList minimum
%nonBaseModulesList minimum %nonBaseModulesList minimum
@ -464,15 +464,15 @@ mkdir -p %{buildroot}%{_mandir}
cp -R man/* %{buildroot}%{_mandir} cp -R man/* %{buildroot}%{_mandir}
make UNK_PERMS=allow NAME=targeted TYPE=mcs DISTRO=%{distro} UBAC=n DIRECT_INITRC=n MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} PKGNAME=%{name} MLS_CATS=1024 MCS_CATS=1024 install-docs make UNK_PERMS=allow NAME=targeted TYPE=mcs DISTRO=%{distro} UBAC=n DIRECT_INITRC=n MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} PKGNAME=%{name} MLS_CATS=1024 MCS_CATS=1024 install-docs
make UNK_PERMS=allow NAME=targeted TYPE=mcs DISTRO=%{distro} UBAC=n DIRECT_INITRC=n MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} PKGNAME=%{name} MLS_CATS=1024 MCS_CATS=1024 install-headers make UNK_PERMS=allow NAME=targeted TYPE=mcs DISTRO=%{distro} UBAC=n DIRECT_INITRC=n MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} PKGNAME=%{name} MLS_CATS=1024 MCS_CATS=1024 install-headers
mkdir %{buildroot}%{_usr}/share/selinux/devel/ mkdir %{buildroot}%{_datadir}/selinux/devel/
mv %{buildroot}%{_usr}/share/selinux/targeted/include %{buildroot}%{_usr}/share/selinux/devel/include mv %{buildroot}%{_datadir}/selinux/targeted/include %{buildroot}%{_datadir}/selinux/devel/include
install -m 644 selinux_config/Makefile.devel %{buildroot}%{_usr}/share/selinux/devel/Makefile install -m 644 selinux_config/Makefile.devel %{buildroot}%{_datadir}/selinux/devel/Makefile
install -m 644 doc/example.* %{buildroot}%{_usr}/share/selinux/devel/ install -m 644 doc/example.* %{buildroot}%{_datadir}/selinux/devel/
install -m 644 doc/policy.* %{buildroot}%{_usr}/share/selinux/devel/ install -m 644 doc/policy.* %{buildroot}%{_datadir}/selinux/devel/
/usr/bin/sepolicy manpage -a -p %{buildroot}/usr/share/man/man8/ -w -r %{buildroot} %{_bindir}/sepolicy manpage -a -p %{buildroot}%{_datadir}/man/man8/ -w -r %{buildroot}
mkdir %{buildroot}%{_usr}/share/selinux/devel/html mkdir %{buildroot}%{_datadir}/selinux/devel/html
mv %{buildroot}%{_usr}/share/man/man8/*.html %{buildroot}%{_usr}/share/selinux/devel/html mv %{buildroot}%{_datadir}/man/man8/*.html %{buildroot}%{_datadir}/selinux/devel/html
mv %{buildroot}%{_usr}/share/man/man8/style.css %{buildroot}%{_usr}/share/selinux/devel/html mv %{buildroot}%{_datadir}/man/man8/style.css %{buildroot}%{_datadir}/selinux/devel/html
mkdir -p %{buildroot}%{_rpmconfigdir}/macros.d mkdir -p %{buildroot}%{_rpmconfigdir}/macros.d
install -m 644 %{SOURCE102} %{buildroot}%{_rpmconfigdir}/macros.d/macros.selinux-policy install -m 644 %{SOURCE102} %{buildroot}%{_rpmconfigdir}/macros.d/macros.selinux-policy
@ -482,7 +482,7 @@ sed -i 's@SELINUXSTOREPATH@%{_sharedstatedir}/selinux@' %{buildroot}%{_rpmconfig
rm -rf selinux_config rm -rf selinux_config
%post %post
if [ ! -s /etc/selinux/config ]; then if [ ! -s %{_sysconfdir}/selinux/config ]; then
# #
# New install so we will default to targeted policy # New install so we will default to targeted policy
# #
@ -499,22 +499,22 @@ SELINUX=enforcing
# mls - Multi Level Security protection. # mls - Multi Level Security protection.
SELINUXTYPE=targeted SELINUXTYPE=targeted
" > /etc/selinux/config " > %{_sysconfdir}/selinux/config
ln -sf ../selinux/config /etc/sysconfig/selinux ln -sf ../selinux/config %{_sysconfdir}/sysconfig/selinux
restorecon /etc/selinux/config 2> /dev/null || : %{_sbindir}/restorecon %{_sysconfdir}/selinux/config 2> /dev/null || :
else else
. /etc/selinux/config . %{_sysconfdir}/selinux/config
fi fi
exit 0 exit 0
%postun %postun
if [ $1 = 0 ]; then if [ $1 = 0 ]; then
setenforce 0 2> /dev/null %{_sbindir}/setenforce 0 2> /dev/null
if [ ! -s /etc/selinux/config ]; then if [ ! -s %{_sysconfdir}/selinux/config ]; then
echo "SELINUX=disabled" > /etc/selinux/config echo "SELINUX=disabled" > %{_sysconfdir}/selinux/config
else else
sed -i 's/^SELINUX=.*/SELINUX=disabled/g' /etc/selinux/config sed -i 's/^SELINUX=.*/SELINUX=disabled/g' %{_sysconfdir}/selinux/config
fi fi
fi fi
exit 0 exit 0
@ -556,7 +556,7 @@ exit 0
if [ $1 = 0 ]; then if [ $1 = 0 ]; then
source %{_sysconfdir}/selinux/config &> /dev/null || true source %{_sysconfdir}/selinux/config &> /dev/null || true
if [ "$SELINUXTYPE" = "targeted" ]; then if [ "$SELINUXTYPE" = "targeted" ]; then
setenforce 0 2> /dev/null %{_sbindir}/setenforce 0 2> /dev/null
if [ ! -s %{_sysconfdir}/selinux/config ]; then if [ ! -s %{_sysconfdir}/selinux/config ]; then
echo "SELINUX=disabled" > %{_sysconfdir}/selinux/config echo "SELINUX=disabled" > %{_sysconfdir}/selinux/config
else else
@ -568,35 +568,35 @@ exit 0
%triggerin -- pcre %triggerin -- pcre
selinuxenabled && semodule -nB %{_sbindir}/selinuxenabled && %{_sbindir}/semodule -nB
exit 0 exit 0
%triggerpostun -- selinux-policy-targeted < 3.12.1-74 %triggerpostun -- selinux-policy-targeted < 3.12.1-74
rm -f /etc/selinux/*/modules/active/modules/sandbox.pp.disabled 2>/dev/null rm -f %{_sysconfdir}/selinux/*/modules/active/modules/sandbox.pp.disabled 2>/dev/null
exit 0 exit 0
%triggerpostun targeted -- selinux-policy-targeted < 3.13.1-138 %triggerpostun targeted -- selinux-policy-targeted < 3.13.1-138
CR=$'\n' CR=$'\n'
INPUT="" INPUT=""
for i in `find /etc/selinux/targeted/modules/active/modules/ -name \*disabled`; do for i in `find %{_sysconfdir}/selinux/targeted/modules/active/modules/ -name \*disabled`; do
module=`basename $i | sed 's/.pp.disabled//'` module=`basename $i | sed 's/.pp.disabled//'`
if [ -d /var/lib/selinux/targeted/active/modules/100/$module ]; then if [ -d %{_sharedstatedir}/selinux/targeted/active/modules/100/$module ]; then
touch /var/lib/selinux/targeted/active/modules/disabled/$p touch %{_sharedstatedir}/selinux/targeted/active/modules/disabled/$p
fi fi
done done
for i in `find /etc/selinux/targeted/modules/active/modules/ -name \*.pp`; do for i in `find %{_sysconfdir}/selinux/targeted/modules/active/modules/ -name \*.pp`; do
INPUT="${INPUT}${CR}module -N -a $i" INPUT="${INPUT}${CR}module -N -a $i"
done done
for i in $(find /etc/selinux/targeted/modules/active -name \*.local); do for i in $(find %{_sysconfdir}/selinux/targeted/modules/active -name \*.local); do
cp $i /var/lib/selinux/targeted/active cp $i %{_sharedstatedir}/selinux/targeted/active
done done
echo "$INPUT" | %{_sbindir}/semanage import -S targeted -N echo "$INPUT" | %{_sbindir}/semanage import -S targeted -N
if /usr/sbin/selinuxenabled ; then if %{_sbindir}/selinuxenabled ; then
/usr/sbin/load_policy %{_sbindir}/load_policy
fi fi
exit 0 exit 0
%files targeted -f %{buildroot}/%{_usr}/share/selinux/targeted/nonbasemodules.lst %files targeted -f %{buildroot}%{_datadir}/selinux/targeted/nonbasemodules.lst
%config(noreplace) %{_sysconfdir}/selinux/targeted/contexts/users/unconfined_u %config(noreplace) %{_sysconfdir}/selinux/targeted/contexts/users/unconfined_u
%config(noreplace) %{_sysconfdir}/selinux/targeted/contexts/users/sysadm_u %config(noreplace) %{_sysconfdir}/selinux/targeted/contexts/users/sysadm_u
%fileList targeted %fileList targeted
@ -623,38 +623,38 @@ SELinux Reference policy minimum base module.
%pre minimum %pre minimum
%preInstall minimum %preInstall minimum
if [ $1 -ne 1 ]; then if [ $1 -ne 1 ]; then
/usr/sbin/semodule -s minimum --list-modules=full | awk '{ if ($4 != "disabled") print $2; }' > /usr/share/selinux/minimum/instmodules.lst %{_sbindir}/semodule -s minimum --list-modules=full | awk '{ if ($4 != "disabled") print $2; }' > %{_datadir}/selinux/minimum/instmodules.lst
fi fi
%post minimum %post minimum
%checkConfigConsistency minimum %checkConfigConsistency minimum
contribpackages=`cat /usr/share/selinux/minimum/modules-contrib.lst` contribpackages=`cat %{_datadir}/selinux/minimum/modules-contrib.lst`
basepackages=`cat /usr/share/selinux/minimum/modules-base.lst` basepackages=`cat %{_datadir}/selinux/minimum/modules-base.lst`
if [ ! -d /var/lib/selinux/minimum/active/modules/disabled ]; then if [ ! -d %{_sharedstatedir}/selinux/minimum/active/modules/disabled ]; then
mkdir /var/lib/selinux/minimum/active/modules/disabled mkdir %{_sharedstatedir}/selinux/minimum/active/modules/disabled
fi fi
if [ $1 -eq 1 ]; then if [ $1 -eq 1 ]; then
for p in $contribpackages; do for p in $contribpackages; do
touch /var/lib/selinux/minimum/active/modules/disabled/$p touch %{_sharedstatedir}/selinux/minimum/active/modules/disabled/$p
done done
for p in $basepackages apache dbus inetd kerberos mta nis; do for p in $basepackages apache dbus inetd kerberos mta nis; do
rm -f /var/lib/selinux/minimum/active/modules/disabled/$p rm -f %{_sharedstatedir}/selinux/minimum/active/modules/disabled/$p
done done
/usr/sbin/semanage import -S minimum -f - << __eof %{_sbindir}/semanage import -S minimum -f - << __eof
login -m -s unconfined_u -r s0-s0:c0.c1023 __default__ login -m -s unconfined_u -r s0-s0:c0.c1023 __default__
login -m -s unconfined_u -r s0-s0:c0.c1023 root login -m -s unconfined_u -r s0-s0:c0.c1023 root
__eof __eof
/sbin/restorecon -R /root /var/log /var/run 2> /dev/null %{_sbindir}/restorecon -R /root /var/log /var/run 2> /dev/null
/usr/sbin/semodule -B -s minimum %{_sbindir}/semodule -B -s minimum
else else
instpackages=`cat /usr/share/selinux/minimum/instmodules.lst` instpackages=`cat %{_datadir}/selinux/minimum/instmodules.lst`
for p in $contribpackages; do for p in $contribpackages; do
touch /var/lib/selinux/minimum/active/modules/disabled/$p touch %{_sharedstatedir}/selinux/minimum/active/modules/disabled/$p
done done
for p in $instpackages apache dbus inetd kerberos mta nis; do for p in $instpackages apache dbus inetd kerberos mta nis; do
rm -f /var/lib/selinux/minimum/active/modules/disabled/$p rm -f %{_sharedstatedir}/selinux/minimum/active/modules/disabled/$p
done done
/usr/sbin/semodule -B -s minimum %{_sbindir}/semodule -B -s minimum
%relabel minimum %relabel minimum
fi fi
exit 0 exit 0
@ -666,7 +666,7 @@ exit 0
if [ $1 = 0 ]; then if [ $1 = 0 ]; then
source %{_sysconfdir}/selinux/config &> /dev/null || true source %{_sysconfdir}/selinux/config &> /dev/null || true
if [ "$SELINUXTYPE" = "minimum" ]; then if [ "$SELINUXTYPE" = "minimum" ]; then
setenforce 0 2> /dev/null %{_sbindir}/setenforce 0 2> /dev/null
if [ ! -s %{_sysconfdir}/selinux/config ]; then if [ ! -s %{_sysconfdir}/selinux/config ]; then
echo "SELINUX=disabled" > %{_sysconfdir}/selinux/config echo "SELINUX=disabled" > %{_sysconfdir}/selinux/config
else else
@ -677,27 +677,27 @@ fi
exit 0 exit 0
%triggerpostun minimum -- selinux-policy-minimum < 3.13.1-138 %triggerpostun minimum -- selinux-policy-minimum < 3.13.1-138
if [ `ls -A /var/lib/selinux/minimum/active/modules/disabled/` ]; then if [ `ls -A %{_sharedstatedir}/selinux/minimum/active/modules/disabled/` ]; then
rm -f /var/lib/selinux/minimum/active/modules/disabled/* rm -f %{_sharedstatedir}/selinux/minimum/active/modules/disabled/*
fi fi
CR=$'\n' CR=$'\n'
INPUT="" INPUT=""
for i in `find /etc/selinux/minimum/modules/active/modules/ -name \*disabled`; do for i in `find %{_sysconfdir}/selinux/minimum/modules/active/modules/ -name \*disabled`; do
module=`basename $i | sed 's/.pp.disabled//'` module=`basename $i | sed 's/.pp.disabled//'`
if [ -d /var/lib/selinux/minimum/active/modules/100/$module ]; then if [ -d %{_sharedstatedir}/selinux/minimum/active/modules/100/$module ]; then
touch /var/lib/selinux/minimum/active/modules/disabled/$p touch %{_sharedstatedir}/selinux/minimum/active/modules/disabled/$p
fi fi
done done
for i in `find /etc/selinux/minimum/modules/active/modules/ -name \*.pp`; do for i in `find %{_sysconfdir}/selinux/minimum/modules/active/modules/ -name \*.pp`; do
INPUT="${INPUT}${CR}module -N -a $i" INPUT="${INPUT}${CR}module -N -a $i"
done done
echo "$INPUT" | %{_sbindir}/semanage import -S minimum -N echo "$INPUT" | %{_sbindir}/semanage import -S minimum -N
if /usr/sbin/selinuxenabled ; then if %{_sbindir}/selinuxenabled ; then
/usr/sbin/load_policy %{_sbindir}/load_policy
fi fi
exit 0 exit 0
%files minimum -f %{buildroot}/%{_usr}/share/selinux/minimum/nonbasemodules.lst %files minimum -f %{buildroot}%{_datadir}/selinux/minimum/nonbasemodules.lst
%config(noreplace) %{_sysconfdir}/selinux/minimum/contexts/users/unconfined_u %config(noreplace) %{_sysconfdir}/selinux/minimum/contexts/users/unconfined_u
%config(noreplace) %{_sysconfdir}/selinux/minimum/contexts/users/sysadm_u %config(noreplace) %{_sysconfdir}/selinux/minimum/contexts/users/sysadm_u
%fileList minimum %fileList minimum
@ -737,7 +737,7 @@ exit 0
if [ $1 = 0 ]; then if [ $1 = 0 ]; then
source %{_sysconfdir}/selinux/config &> /dev/null || true; source %{_sysconfdir}/selinux/config &> /dev/null || true;
if [ "$SELINUXTYPE" = "mls" ]; then if [ "$SELINUXTYPE" = "mls" ]; then
setenforce 0 2> /dev/null %{_sbindir}/setenforce 0 2> /dev/null
if [ ! -s %{_sysconfdir}/selinux/config ]; then if [ ! -s %{_sysconfdir}/selinux/config ]; then
echo "SELINUX=disabled" > %{_sysconfdir}/selinux/config echo "SELINUX=disabled" > %{_sysconfdir}/selinux/config
else else
@ -750,23 +750,23 @@ exit 0
%triggerpostun mls -- selinux-policy-mls < 3.13.1-138 %triggerpostun mls -- selinux-policy-mls < 3.13.1-138
CR=$'\n' CR=$'\n'
INPUT="" INPUT=""
for i in `find /etc/selinux/mls/modules/active/modules/ -name \*disabled`; do for i in `find %{_sysconfdir}/selinux/mls/modules/active/modules/ -name \*disabled`; do
module=`basename $i | sed 's/.pp.disabled//'` module=`basename $i | sed 's/.pp.disabled//'`
if [ -d /var/lib/selinux/mls/active/modules/100/$module ]; then if [ -d %{_sharedstatedir}/selinux/mls/active/modules/100/$module ]; then
touch /var/lib/selinux/mls/active/modules/disabled/$p touch %{_sharedstatedir}/selinux/mls/active/modules/disabled/$p
fi fi
done done
for i in `find /etc/selinux/mls/modules/active/modules/ -name \*.pp`; do for i in `find %{_sysconfdir}/selinux/mls/modules/active/modules/ -name \*.pp`; do
INPUT="${INPUT}${CR}module -N -a $i" INPUT="${INPUT}${CR}module -N -a $i"
done done
echo "$INPUT" | %{_sbindir}/semanage import -S mls -N echo "$INPUT" | %{_sbindir}/semanage import -S mls -N
if /usr/sbin/selinuxenabled ; then if %{_sbindir}/selinuxenabled ; then
/usr/sbin/load_policy %{_sbindir}/load_policy
fi fi
exit 0 exit 0
%files mls -f %{buildroot}/%{_usr}/share/selinux/mls/nonbasemodules.lst %files mls -f %{buildroot}%{_datadir}/selinux/mls/nonbasemodules.lst
%config(noreplace) %{_sysconfdir}/selinux/mls/contexts/users/unconfined_u %config(noreplace) %{_sysconfdir}/selinux/mls/contexts/users/unconfined_u
%fileList mls %fileList mls
%endif %endif