Add selinux-policy-automotive sub-package
The package is modeled after selinux-policy-minimum in that it contains all the modules that are present in selinux-policy-targeted, but most of them are disabled (content of module-automotive-contrib.conf). The rest of the configuration files is copied from targeted, only booleans-automotive.conf and users-automotive are missing booleans and users defined in disabled modules. Resolves: RHEL-69666
This commit is contained in:
Vit Mojzis
parent
b7b5e03b7e
commit
bbd06ec607
15
booleans-automotive.conf
Normal file
15
booleans-automotive.conf
Normal file
@ -0,0 +1,15 @@
|
||||
gssd_read_tmp = true
|
||||
httpd_builtin_scripting = true
|
||||
httpd_enable_cgi = true
|
||||
kerberos_enabled = true
|
||||
mount_anyfile = true
|
||||
nfs_export_all_ro = true
|
||||
nfs_export_all_rw = true
|
||||
pppd_can_insmod = false
|
||||
selinuxuser_direct_dri_enabled = true
|
||||
selinuxuser_execstack = true
|
||||
selinuxuser_rw_noexattrfile=true
|
||||
selinuxuser_ping = true
|
||||
unconfined_chrome_sandbox_transition=true
|
||||
unconfined_mozilla_plugin_transition=true
|
||||
use_virtualbox = true
|
||||
604
modules-automotive-base.conf
Normal file
604
modules-automotive-base.conf
Normal file
@ -0,0 +1,604 @@
|
||||
# Layer: admin
|
||||
# Module: anaconda
|
||||
#
|
||||
# Policy for the Anaconda installer.
|
||||
#
|
||||
anaconda = module
|
||||
|
||||
# Layer: services
|
||||
# Module: apache
|
||||
#
|
||||
# Apache web server
|
||||
#
|
||||
apache = module
|
||||
|
||||
# Module: application
|
||||
# Required in base
|
||||
#
|
||||
# Defines attributs and interfaces for all user applications
|
||||
#
|
||||
application = module
|
||||
|
||||
# Layer: role
|
||||
# Module: auditadm
|
||||
#
|
||||
# auditadm account on tty logins
|
||||
#
|
||||
auditadm = module
|
||||
|
||||
# Layer: system
|
||||
# Module: authlogin
|
||||
#
|
||||
# Common policy for authentication and user login.
|
||||
#
|
||||
authlogin = module
|
||||
|
||||
# Layer: services
|
||||
# Module: bluetooth
|
||||
#
|
||||
# Bluetooth tools and system services.
|
||||
#
|
||||
bluetooth = module
|
||||
|
||||
# Module: bootloader
|
||||
#
|
||||
# Policy for the kernel modules, kernel image, and bootloader.
|
||||
#
|
||||
bootloader = module
|
||||
|
||||
# Layer: services
|
||||
# Module: chronyd
|
||||
#
|
||||
# Daemon for maintaining clock time
|
||||
#
|
||||
chronyd = module
|
||||
|
||||
# Layer: system
|
||||
# Module: clock
|
||||
#
|
||||
# Policy for reading and setting the hardware clock.
|
||||
#
|
||||
clock = module
|
||||
|
||||
# Layer: kernel
|
||||
# Module: corecommands
|
||||
# Required in base
|
||||
#
|
||||
# Core policy for shells, and generic programs
|
||||
# in /bin, /sbin, /usr/bin, and /usr/sbin.
|
||||
#
|
||||
corecommands = base
|
||||
|
||||
# Layer: kernel
|
||||
# Module: corenetwork
|
||||
# Required in base
|
||||
#
|
||||
# Policy controlling access to network objects
|
||||
#
|
||||
corenetwork = base
|
||||
|
||||
# Layer: services
|
||||
# Module: cpucontrol
|
||||
#
|
||||
# Services for loading CPU microcode and CPU frequency scaling.
|
||||
#
|
||||
cpucontrol = module
|
||||
|
||||
# Layer: system
|
||||
# Module: daemontools
|
||||
#
|
||||
# Collection of tools for managing UNIX services
|
||||
#
|
||||
daemontools = module
|
||||
|
||||
# Layer: services
|
||||
# Module: dbus
|
||||
#
|
||||
# Desktop messaging bus
|
||||
#
|
||||
dbus = module
|
||||
|
||||
# Module: devices
|
||||
# Required in base
|
||||
#
|
||||
# Device nodes and interfaces for many basic system devices.
|
||||
#
|
||||
devices = base
|
||||
|
||||
# Layer: services
|
||||
# Module: dhcp
|
||||
#
|
||||
# Dynamic host configuration protocol (DHCP) server
|
||||
#
|
||||
dhcp = module
|
||||
|
||||
# Layer: admin
|
||||
# Module: dmesg
|
||||
#
|
||||
# Policy for dmesg.
|
||||
#
|
||||
dmesg = module
|
||||
|
||||
# Module: domain
|
||||
# Required in base
|
||||
#
|
||||
# Core policy for domains.
|
||||
#
|
||||
domain = base
|
||||
|
||||
# Module: files
|
||||
# Required in base
|
||||
#
|
||||
# Basic filesystem types and interfaces.
|
||||
#
|
||||
files = base
|
||||
|
||||
# Module: filesystem
|
||||
# Required in base
|
||||
#
|
||||
# Policy for filesystems.
|
||||
#
|
||||
filesystem = base
|
||||
|
||||
# Layer: system
|
||||
# Module: fstools
|
||||
#
|
||||
# Tools for filesystem management, such as mkfs and fsck.
|
||||
#
|
||||
fstools = module
|
||||
|
||||
# Layer: contrib
|
||||
# Module: fwupd
|
||||
#
|
||||
# fwupd is a daemon to allow session software to update device firmware.
|
||||
#
|
||||
fwupd = module
|
||||
|
||||
# Layer: apps
|
||||
# Module: games
|
||||
#
|
||||
# The Open Group Pegasus CIM/WBEM Server.
|
||||
#
|
||||
games = module
|
||||
|
||||
# Layer: system
|
||||
# Module: getty
|
||||
#
|
||||
# Policy for getty.
|
||||
#
|
||||
getty = module
|
||||
|
||||
# Layer: apps
|
||||
# Module: gnome
|
||||
#
|
||||
# gnome session and gconf
|
||||
#
|
||||
gnome = module
|
||||
|
||||
# Layer: apps
|
||||
# Module: gpg
|
||||
#
|
||||
# Policy for GNU Privacy Guard and related programs.
|
||||
#
|
||||
gpg = module
|
||||
|
||||
# Layer: system
|
||||
# Module: hostname
|
||||
#
|
||||
# Policy for changing the system host name.
|
||||
#
|
||||
hostname = module
|
||||
|
||||
# Layer: system
|
||||
# Module: init
|
||||
#
|
||||
# System initialization programs (init and init scripts).
|
||||
#
|
||||
init = module
|
||||
|
||||
# Layer: system
|
||||
# Module: ipsec
|
||||
#
|
||||
# TCP/IP encryption
|
||||
#
|
||||
ipsec = module
|
||||
|
||||
# Layer: system
|
||||
# Module: iptables
|
||||
#
|
||||
# Policy for iptables.
|
||||
#
|
||||
iptables = module
|
||||
|
||||
# Layer: contrib
|
||||
# Module: journalctl
|
||||
#
|
||||
# journalctl policy
|
||||
#
|
||||
journalctl = module
|
||||
|
||||
# Layer: services
|
||||
# Module: kerberos
|
||||
#
|
||||
# MIT Kerberos admin and KDC
|
||||
#
|
||||
kerberos = module
|
||||
|
||||
# Module: kernel
|
||||
# Required in base
|
||||
#
|
||||
# Policy for kernel threads, proc filesystem,and unlabeled processes and objects.
|
||||
#
|
||||
kernel = base
|
||||
|
||||
# Layer: services
|
||||
# Module: ldap
|
||||
#
|
||||
# OpenLDAP directory server
|
||||
#
|
||||
ldap = module
|
||||
|
||||
# Layer: system
|
||||
# Module: libraries
|
||||
#
|
||||
# Policy for system libraries.
|
||||
#
|
||||
libraries = module
|
||||
|
||||
# Layer: apps
|
||||
# Module: loadkeys
|
||||
#
|
||||
# Load keyboard mappings.
|
||||
#
|
||||
loadkeys = module
|
||||
|
||||
# Layer: system
|
||||
# Module: locallogin
|
||||
#
|
||||
# Policy for local logins.
|
||||
#
|
||||
locallogin = module
|
||||
|
||||
# Layer: role
|
||||
# Module: logadm
|
||||
#
|
||||
# Minimally prived root role for managing logging system
|
||||
#
|
||||
logadm = module
|
||||
|
||||
# Layer: system
|
||||
# Module: logging
|
||||
#
|
||||
# Policy for the kernel message logger and system logging daemon.
|
||||
#
|
||||
logging = module
|
||||
|
||||
# Layer: services
|
||||
# Module: lpd
|
||||
#
|
||||
# Line printer daemon
|
||||
#
|
||||
lpd = module
|
||||
|
||||
# Layer: system
|
||||
# Module: lvm
|
||||
#
|
||||
# Policy for logical volume management programs.
|
||||
#
|
||||
lvm = module
|
||||
|
||||
# Layer: contrib
|
||||
# Module: mandb
|
||||
#
|
||||
# Policy for mandb
|
||||
#
|
||||
mandb = module
|
||||
|
||||
# Module: mcs
|
||||
# Required in base
|
||||
#
|
||||
# MultiCategory security policy
|
||||
#
|
||||
mcs = base
|
||||
|
||||
# Layer: system
|
||||
# Module: miscfiles
|
||||
#
|
||||
# Miscelaneous files.
|
||||
#
|
||||
miscfiles = module
|
||||
|
||||
# Module: mls
|
||||
# Required in base
|
||||
#
|
||||
# Multilevel security policy
|
||||
#
|
||||
mls = base
|
||||
|
||||
# Layer: system
|
||||
# Module: modutils
|
||||
#
|
||||
# Policy for kernel module utilities
|
||||
#
|
||||
modutils = module
|
||||
|
||||
# Layer: system
|
||||
# Module: mount
|
||||
#
|
||||
# Policy for mount.
|
||||
#
|
||||
mount = module
|
||||
|
||||
# Layer: services
|
||||
# Module: mta
|
||||
#
|
||||
# Policy common to all email tranfer agents.
|
||||
#
|
||||
mta = module
|
||||
|
||||
# Layer: apps
|
||||
# Module: namespace
|
||||
#
|
||||
# policy for namespace.init script
|
||||
#
|
||||
namespace = module
|
||||
|
||||
# Layer: system
|
||||
# Module: netlabel
|
||||
#
|
||||
# Basic netlabel types and interfaces.
|
||||
#
|
||||
netlabel = module
|
||||
|
||||
# Layer: admin
|
||||
# Module: netutils
|
||||
#
|
||||
# Network analysis utilities
|
||||
#
|
||||
netutils = module
|
||||
|
||||
# Layer: services
|
||||
# Module: networkmanager
|
||||
#
|
||||
# Manager for dynamically switching between networks.
|
||||
#
|
||||
networkmanager = module
|
||||
|
||||
# Layer: services
|
||||
# Module: nis
|
||||
#
|
||||
# Policy for NIS (YP) servers and clients
|
||||
#
|
||||
nis = module
|
||||
|
||||
# Layer: services
|
||||
# Module: oddjob
|
||||
#
|
||||
# policy for oddjob
|
||||
#
|
||||
oddjob = module
|
||||
|
||||
# Layer: contrib
|
||||
# Module: pesign
|
||||
#
|
||||
# policy for pesign
|
||||
#
|
||||
pesign = module
|
||||
|
||||
# Layer: services
|
||||
# Module: postgresql
|
||||
#
|
||||
# PostgreSQL relational database
|
||||
#
|
||||
postgresql = module
|
||||
|
||||
# Layer: services
|
||||
# Module: rdisc
|
||||
#
|
||||
# Network router discovery daemon
|
||||
#
|
||||
rdisc = module
|
||||
|
||||
# Layer: services
|
||||
# Module: rpcbind
|
||||
#
|
||||
# universal addresses to RPC program number mapper
|
||||
#
|
||||
rpc = module
|
||||
|
||||
# Layer: admin
|
||||
# Module: rpm
|
||||
#
|
||||
# Policy for the RPM package manager.
|
||||
#
|
||||
rpm = module
|
||||
|
||||
# Layer: role
|
||||
# Module: secadm
|
||||
#
|
||||
# secadm account on tty logins
|
||||
#
|
||||
secadm = module
|
||||
|
||||
# Module: selinux
|
||||
# Required in base
|
||||
#
|
||||
# Policy for kernel security interface, in particular, selinuxfs.
|
||||
#
|
||||
selinux = base
|
||||
|
||||
# Layer: system
|
||||
# Module: selinuxutil
|
||||
#
|
||||
# Policy for SELinux policy and userland applications.
|
||||
#
|
||||
selinuxutil = module
|
||||
|
||||
# Module: setrans
|
||||
# Required in base
|
||||
#
|
||||
# Policy for setrans
|
||||
#
|
||||
setrans = module
|
||||
|
||||
# Layer: apps
|
||||
# Module: seunshare
|
||||
#
|
||||
# seunshare executable
|
||||
#
|
||||
seunshare = module
|
||||
|
||||
# Layer: services
|
||||
# Module: ssh
|
||||
#
|
||||
# Secure shell client and server policy.
|
||||
#
|
||||
ssh = module
|
||||
|
||||
# Layer: services
|
||||
# Module: sssd
|
||||
#
|
||||
# System Security Services Daemon
|
||||
#
|
||||
sssd = module
|
||||
|
||||
# Layer: contrib
|
||||
# Module: stalld
|
||||
#
|
||||
# stalld
|
||||
#
|
||||
stalld = module
|
||||
|
||||
# Layer: kernel
|
||||
# Module: storage
|
||||
#
|
||||
# Policy controlling access to storage devices
|
||||
#
|
||||
storage = base
|
||||
|
||||
# Layer: admin
|
||||
# Module: sudo
|
||||
#
|
||||
# Execute a command with a substitute user
|
||||
#
|
||||
su = module
|
||||
|
||||
# Layer: admin
|
||||
# Module: sudo
|
||||
#
|
||||
# Execute a command with a substitute user
|
||||
#
|
||||
sudo = module
|
||||
|
||||
# Layer:role
|
||||
# Module: sysadm_secadm
|
||||
#
|
||||
# System Administrator with Security Admin rules
|
||||
#
|
||||
sysadm = module
|
||||
|
||||
# Layer:role
|
||||
# Module: sysadm_secadm
|
||||
#
|
||||
# System Administrator with Security Admin rules
|
||||
#
|
||||
sysadm_secadm = module
|
||||
|
||||
# Layer: system
|
||||
# Module: sysnetwork
|
||||
#
|
||||
# Policy for network configuration: ifconfig and dhcp client.
|
||||
#
|
||||
sysnetwork = module
|
||||
|
||||
# Layer: system
|
||||
# Module: systemd
|
||||
#
|
||||
# Policy for systemd components
|
||||
#
|
||||
systemd = module
|
||||
|
||||
# Module: terminal
|
||||
# Required in base
|
||||
#
|
||||
# Policy for terminals.
|
||||
#
|
||||
terminal = base
|
||||
|
||||
# Layer: kernel
|
||||
# Module: ubac
|
||||
#
|
||||
#
|
||||
#
|
||||
ubac = base
|
||||
|
||||
# Layer: system
|
||||
# Module: udev
|
||||
#
|
||||
# Policy for udev.
|
||||
#
|
||||
udev = module
|
||||
|
||||
# Layer: role
|
||||
# Module: unconfineduser
|
||||
#
|
||||
# The unconfined user domain.
|
||||
#
|
||||
unconfined = module
|
||||
|
||||
# Layer: role
|
||||
# Module: unconfineduser
|
||||
#
|
||||
# The unconfined user domain.
|
||||
#
|
||||
unconfineduser = module
|
||||
|
||||
# Layer: kernel
|
||||
# Module: unconfined
|
||||
#
|
||||
# The unlabelednet module.
|
||||
#
|
||||
unlabelednet = module
|
||||
|
||||
# Layer: system
|
||||
# Module: userdomain
|
||||
#
|
||||
# Policy for user domains
|
||||
#
|
||||
userdomain = module
|
||||
|
||||
# Layer: apps
|
||||
# Module: userhelper
|
||||
#
|
||||
# A helper interface to pam.
|
||||
#
|
||||
userhelper = module
|
||||
|
||||
# Layer: admin
|
||||
# Module: usermanage
|
||||
#
|
||||
# Policy for managing user accounts.
|
||||
#
|
||||
usermanage = module
|
||||
|
||||
# Layer: services
|
||||
# Module: virt
|
||||
#
|
||||
# Virtualization libraries
|
||||
#
|
||||
virt = module
|
||||
|
||||
# Layer: apps
|
||||
# Module: vhostmd
|
||||
#
|
||||
# vlock - Virtual Console lock program
|
||||
#
|
||||
vlock = module
|
||||
|
||||
# Layer: services
|
||||
# Module: xserver
|
||||
#
|
||||
# X windows login display manager
|
||||
#
|
||||
xserver = module
|
||||
|
||||
2563
modules-automotive-contrib.conf
Normal file
2563
modules-automotive-contrib.conf
Normal file
File diff suppressed because it is too large
Load Diff
52
readme-automotive
Normal file
52
readme-automotive
Normal file
@ -0,0 +1,52 @@
|
||||
The automotive package is modeled after selinux-policy-minimum in that it
|
||||
contains all the modules that are present in selinux-policy-targeted, but most
|
||||
of them are disabled (content of module-automotive-contrib.conf).
|
||||
The rest of the configuration files is copied from targeted, only
|
||||
booleans-automotive.conf and users-automotive are missing booleans and users
|
||||
defined in disabled modules.
|
||||
|
||||
|
||||
The content of module-automotive-base.conf was determined as follows.
|
||||
Modules providing file context definitions related to packages in qm-minimal
|
||||
image package set [1]:
|
||||
["anaconda", "authlogin", "bluetooth", "bootloader", "clock", "cpucontrol",
|
||||
"cups", "daemontools", "dbus", "dmesg", "fstools", "fwupd", "games", "gpg",
|
||||
"hostname", "init", "iptables", "journalctl", "kerberos", "ldap", "libraries",
|
||||
"loadkeys", "locallogin", "logging", "lpd", "lvm", "miscfiles", "modutils",
|
||||
"mount", "mta", "namespace", "networkmanager", "nis", "oddjob", "rpc", "rpm",
|
||||
"selinuxutil", "stalld", "su", "sysnetwork", "systemd", "udev", "userdomain",
|
||||
"userhelper", "usermanage", "vlock"]
|
||||
|
||||
Modules chosen based on name comparison with the qm-minimal image package set:
|
||||
["cyrus","dbus","gpg","ldap","rpm","sasl","fwupd","stalld","ssh","hostname",
|
||||
"iptables","mount","systemd","udev"]
|
||||
|
||||
The following are additions based on qm-developer image package set:
|
||||
["netutils", "ssh", "sudo ", "chronyd", "mandb", "pesign", "rdisc", "rsync",
|
||||
"sosreport", "virt"]
|
||||
|
||||
Dependencies of container-selinux:
|
||||
["anaconda","gnome","sssd"]
|
||||
|
||||
Dependency of gpg:
|
||||
["apache"]
|
||||
|
||||
systemd_logind does not work properly without:
|
||||
["dhcp"]
|
||||
|
||||
|
||||
All remaining modules are listed in module-automotive-contrib.conf and
|
||||
therefore disabled (modules set to "off" in modules-targeted-* where kept
|
||||
"off" in automotive as well).
|
||||
|
||||
sandbox module was set to "off" instead of it being removed in spec file (as
|
||||
done in "minimum") to simplify the spec file.
|
||||
|
||||
Note that DSP modules will not be installed if they follow [2], which is
|
||||
probably for the best, since they do not consistently use optional_policy
|
||||
blocks and would likely fail to install. However, container module is needed
|
||||
even for the qm-minimal image and has to be installed manually (probably in
|
||||
automotive-image-builder).
|
||||
|
||||
[1] - https://autosd.sig.centos.org/AutoSD-9/nightly/core-rpms/autosd-core-rpms-x86_64.txt
|
||||
[2] - https://fedoraproject.org/wiki/SELinux/IndependentPolicy
|
||||
4
securetty_types-automotive
Normal file
4
securetty_types-automotive
Normal file
@ -0,0 +1,4 @@
|
||||
console_device_t
|
||||
sysadm_tty_device_t
|
||||
user_tty_device_t
|
||||
staff_tty_device_t
|
||||
@ -18,13 +18,16 @@
|
||||
%if %{?BUILD_MLS:0}%{!?BUILD_MLS:1}
|
||||
%define BUILD_MLS 1
|
||||
%endif
|
||||
%if %{?BUILD_AUTOMOTIVE:0}%{!?BUILD_AUTOMOTIVE:1}
|
||||
%define BUILD_AUTOMOTIVE 1
|
||||
%endif
|
||||
%define POLICYVER 33
|
||||
%define POLICYCOREUTILSVER 3.4-1
|
||||
%define CHECKPOLICYVER 3.2
|
||||
Summary: SELinux policy configuration
|
||||
Name: selinux-policy
|
||||
Version: 38.1.53
|
||||
Release: 1%{?dist}
|
||||
Release: 2%{?dist}
|
||||
License: GPLv2+
|
||||
Source: %{giturl}/archive/%{commit}/%{name}-%{shortcommit}.tar.gz
|
||||
Source1: modules-targeted-base.conf
|
||||
@ -61,6 +64,13 @@ Source35: container-selinux.tgz
|
||||
|
||||
Source36: selinux-check-proper-disable.service
|
||||
|
||||
Source37: modules-automotive-base.conf
|
||||
Source38: modules-automotive-contrib.conf
|
||||
Source39: booleans-automotive.conf
|
||||
Source40: users-automotive
|
||||
Source41: setrans-automotive.conf
|
||||
Source42: securetty_types-automotive
|
||||
|
||||
# Provide rpm macros for packages installing SELinux modules
|
||||
Source102: rpm.macros
|
||||
|
||||
@ -408,7 +418,7 @@ end
|
||||
tar -C policy/modules/contrib -xf %{SOURCE35}
|
||||
|
||||
mkdir selinux_config
|
||||
for i in %{SOURCE1} %{SOURCE2} %{SOURCE3} %{SOURCE4} %{SOURCE5} %{SOURCE6} %{SOURCE8} %{SOURCE14} %{SOURCE15} %{SOURCE17} %{SOURCE18} %{SOURCE19} %{SOURCE20} %{SOURCE22} %{SOURCE23} %{SOURCE25} %{SOURCE26} %{SOURCE31} %{SOURCE32};do
|
||||
for i in %{SOURCE1} %{SOURCE2} %{SOURCE3} %{SOURCE4} %{SOURCE5} %{SOURCE6} %{SOURCE8} %{SOURCE14} %{SOURCE15} %{SOURCE17} %{SOURCE18} %{SOURCE19} %{SOURCE20} %{SOURCE22} %{SOURCE23} %{SOURCE25} %{SOURCE26} %{SOURCE31} %{SOURCE32} %{SOURCE37} %{SOURCE38} %{SOURCE39} %{SOURCE40} %{SOURCE41} %{SOURCE42};do
|
||||
cp $i selinux_config
|
||||
done
|
||||
|
||||
@ -425,8 +435,8 @@ mkdir -p %{buildroot}%{_bindir}
|
||||
install -m 755 %{SOURCE33} %{buildroot}%{_bindir}/
|
||||
|
||||
# Always create policy module package directories
|
||||
mkdir -p %{buildroot}%{_datadir}/selinux/{targeted,mls,minimum,modules}/
|
||||
mkdir -p %{buildroot}%{_sharedstatedir}/selinux/{targeted,mls,minimum,modules}/
|
||||
mkdir -p %{buildroot}%{_datadir}/selinux/{targeted,mls,minimum,automotive,modules}/
|
||||
mkdir -p %{buildroot}%{_sharedstatedir}/selinux/{targeted,mls,minimum,automotive,modules}/
|
||||
|
||||
mkdir -p %{buildroot}%{_datadir}/selinux/packages
|
||||
|
||||
@ -466,8 +476,17 @@ rm -rf %{buildroot}%{_sharedstatedir}/selinux/minimum/active/modules/100/sandbox
|
||||
%nonBaseModulesList mls
|
||||
%endif
|
||||
|
||||
%if %{BUILD_AUTOMOTIVE}
|
||||
# Build automotive policy
|
||||
%makeCmds automotive mcs allow
|
||||
%makeModulesConf automotive base contrib
|
||||
%installCmds automotive mcs allow
|
||||
%modulesList automotive
|
||||
%nonBaseModulesList automotive
|
||||
%endif
|
||||
|
||||
# remove leftovers when save-previous=true (semanage.conf) is used
|
||||
rm -rf %{buildroot}%{_sharedstatedir}/selinux/{minimum,targeted,mls}/previous
|
||||
rm -rf %{buildroot}%{_sharedstatedir}/selinux/{minimum,targeted,mls,automotive}/previous
|
||||
|
||||
mkdir -p %{buildroot}%{_mandir}
|
||||
cp -R man/* %{buildroot}%{_mandir}
|
||||
@ -739,6 +758,83 @@ exit 0
|
||||
%fileList minimum
|
||||
%endif
|
||||
|
||||
%if %{BUILD_AUTOMOTIVE}
|
||||
%package automotive
|
||||
Summary: SELinux automotive policy
|
||||
Provides: selinux-policy-any = %{version}-%{release}
|
||||
Requires(post): policycoreutils-python-utils >= %{POLICYCOREUTILSVER}
|
||||
Requires(pre): coreutils
|
||||
Requires(pre): selinux-policy = %{version}-%{release}
|
||||
Requires: selinux-policy = %{version}-%{release}
|
||||
Conflicts: seedit
|
||||
Conflicts: container-selinux <= 1.9.0-9
|
||||
|
||||
%description automotive
|
||||
SELinux automotive policy package.
|
||||
|
||||
%pretrans automotive -p <lua>
|
||||
%backupConfigLua
|
||||
|
||||
%pre automotive
|
||||
%preInstall automotive
|
||||
if [ $1 -ne 1 ]; then
|
||||
%{_sbindir}/semodule -s automotive --list-modules=full | awk '{ if ($4 != "disabled") print $2; }' > %{_datadir}/selinux/automotive/instmodules.lst
|
||||
fi
|
||||
|
||||
%post automotive
|
||||
%checkConfigConsistency automotive
|
||||
contribpackages=`cat %{_datadir}/selinux/automotive/modules-contrib.lst`
|
||||
basepackages=`cat %{_datadir}/selinux/automotive/modules-base.lst`
|
||||
if [ ! -d %{_sharedstatedir}/selinux/automotive/active/modules/disabled ]; then
|
||||
mkdir %{_sharedstatedir}/selinux/automotive/active/modules/disabled
|
||||
fi
|
||||
if [ $1 -eq 1 ]; then
|
||||
for p in $contribpackages; do
|
||||
touch %{_sharedstatedir}/selinux/automotive/active/modules/disabled/$p
|
||||
done
|
||||
for p in $basepackages apache dbus inetd kerberos mta nis; do
|
||||
rm -f %{_sharedstatedir}/selinux/automotive/active/modules/disabled/$p
|
||||
done
|
||||
%{_sbindir}/restorecon -R /root /var/log /var/run 2> /dev/null
|
||||
%{_sbindir}/semodule -B -s automotive
|
||||
else
|
||||
instpackages=`cat %{_datadir}/selinux/automotive/instmodules.lst`
|
||||
for p in $contribpackages; do
|
||||
touch %{_sharedstatedir}/selinux/automotive/active/modules/disabled/$p
|
||||
done
|
||||
for p in $instpackages apache dbus inetd kerberos mta nis; do
|
||||
rm -f %{_sharedstatedir}/selinux/automotive/active/modules/disabled/$p
|
||||
done
|
||||
%{_sbindir}/semodule -B -s automotive
|
||||
%relabel automotive
|
||||
fi
|
||||
exit 0
|
||||
|
||||
%posttrans automotive
|
||||
%checkConfigConsistency automotive
|
||||
|
||||
%postun automotive
|
||||
if [ $1 = 0 ]; then
|
||||
if [ -s %{_sysconfdir}/selinux/config ]; then
|
||||
source %{_sysconfdir}/selinux/config &> /dev/null || true
|
||||
fi
|
||||
if [ "$SELINUXTYPE" = "automotive" ]; then
|
||||
%{_sbindir}/setenforce 0 2> /dev/null
|
||||
if [ ! -s %{_sysconfdir}/selinux/config ]; then
|
||||
echo "SELINUX=disabled" > %{_sysconfdir}/selinux/config
|
||||
else
|
||||
sed -i 's/^SELINUX=.*/SELINUX=disabled/g' %{_sysconfdir}/selinux/config
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
exit 0
|
||||
|
||||
%files automotive -f %{buildroot}%{_datadir}/selinux/automotive/nonbasemodules.lst
|
||||
%config(noreplace) %{_sysconfdir}/selinux/automotive/contexts/users/unconfined_u
|
||||
%config(noreplace) %{_sysconfdir}/selinux/automotive/contexts/users/sysadm_u
|
||||
%fileList automotive
|
||||
%endif
|
||||
|
||||
%if %{BUILD_MLS}
|
||||
%package mls
|
||||
Summary: SELinux MLS policy
|
||||
|
||||
19
setrans-automotive.conf
Normal file
19
setrans-automotive.conf
Normal file
@ -0,0 +1,19 @@
|
||||
#
|
||||
# Multi-Category Security translation table for SELinux
|
||||
#
|
||||
# Uncomment the following to disable translation libary
|
||||
# disable=1
|
||||
#
|
||||
# Objects can be categorized with 0-1023 categories defined by the admin.
|
||||
# Objects can be in more than one category at a time.
|
||||
# Categories are stored in the system as c0-c1023. Users can use this
|
||||
# table to translate the categories into a more meaningful output.
|
||||
# Examples:
|
||||
# s0:c0=CompanyConfidential
|
||||
# s0:c1=PatientRecord
|
||||
# s0:c2=Unclassified
|
||||
# s0:c3=TopSecret
|
||||
# s0:c1,c3=CompanyConfidentialRedHat
|
||||
s0=SystemLow
|
||||
s0-s0:c0.c1023=SystemLow-SystemHigh
|
||||
s0:c0.c1023=SystemHigh
|
||||
39
users-automotive
Normal file
39
users-automotive
Normal file
@ -0,0 +1,39 @@
|
||||
##################################
|
||||
#
|
||||
# Core User configuration.
|
||||
#
|
||||
|
||||
#
|
||||
# gen_user(username, prefix, role_set, mls_defaultlevel, mls_range, [mcs_catetories])
|
||||
#
|
||||
# Note: Identities without a prefix will not be listed
|
||||
# in the users_extra file used by genhomedircon.
|
||||
|
||||
#
|
||||
# system_u is the user identity for system processes and objects.
|
||||
# There should be no corresponding Unix user identity for system,
|
||||
# and a user process should never be assigned the system user
|
||||
# identity.
|
||||
#
|
||||
gen_user(system_u,, system_r unconfined_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||
|
||||
#
|
||||
# user_u is a generic user identity for Linux users who have no
|
||||
# SELinux user identity defined. The modified daemons will use
|
||||
# this user identity in the security context if there is no matching
|
||||
# SELinux user identity for a Linux user. If you do not want to
|
||||
# permit any access to such users, then remove this entry.
|
||||
#
|
||||
gen_user(user_u, user, user_r, s0, s0)
|
||||
gen_user(staff_u, user, staff_r system_r sysadm_r unconfined_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||
gen_user(sysadm_u, user, sysadm_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||
|
||||
#
|
||||
# The following users correspond to Unix identities.
|
||||
# These identities are typically assigned as the user attribute
|
||||
# when login starts the user shell. Users with access to the sysadm_r
|
||||
# role should use the staff_r role instead of the user_r role when
|
||||
# not in the sysadm_r.
|
||||
#
|
||||
gen_user(root, user, unconfined_r sysadm_r staff_r system_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||
gen_user(unconfined_u, user, unconfined_r system_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||
Loading…
Reference in New Issue
Block a user