SELinux policy configuration
Go to file
Zdenek Pytela dfb01e2dd7 * Fri Dec 13 2024 Zdenek Pytela <zpytela@redhat.com> - 40.13.18-1
- Sync dist/targeted/modules.conf with Fedora 42
Resolves: RHEL-70850
- Add support for sap
Resolves: RHEL-70850
- Allow sssd_selinux_manager_t the setcap process permission
Resolves: RHEL-70822
- Allow virtqemud open svirt_devpts_t char files
Resolves: RHEL-43446
- Fix the cups_read_pid_files() interface to use read_files_pattern
Resolves: RHEL-69512
2024-12-13 17:43:37 +01:00
.fmf Add plans/tests.fmf 2023-10-11 13:27:51 +02:00
plans do not run tests which require EPEL repo 2024-07-19 08:46:59 +00:00
tests test-reboot.yml: test.log is mandatory, improve results format 2020-08-27 07:49:02 +02:00
.gitignore * Mon Feb 12 2024 Zdenek Pytela <zpytela@redhat.com> - 40.13-1 2024-02-12 12:26:33 +01:00
changelog * Fri Dec 13 2024 Zdenek Pytela <zpytela@redhat.com> - 40.13.18-1 2024-12-13 17:43:37 +01:00
COPYING remove extra level of directory 2006-07-12 20:32:27 +00:00
gating.yaml Drop baseos-ci gating 2024-05-21 11:09:54 +02:00
ifndefy.py Add a script for enclosing interfaces in ifndef statements 2022-06-29 18:34:21 +00:00
make-rhat-patches.sh Use /usr/bin/bash in scripts as shebang 2024-11-14 17:16:04 +01:00
Makefile.devel Hard code to MLSENABLED 2011-08-22 16:30:20 -04:00
modules-minimum.lst Merge -base and -contrib 2024-11-14 17:16:04 +01:00
permissivedomains.cil Remove all domains from permissive domains, it looks these policies are tested already 2019-01-13 19:28:55 +01:00
README.md Fix typos and grammar in README 2020-12-02 09:41:43 +01:00
rpm.macros Call binaries without full path 2024-11-14 17:14:03 +01:00
selinux-check-proper-disable.service Add a systemd service to check that SELinux is disabled properly 2021-06-22 09:38:56 +00:00
selinux-policy-mls.conf Protect the targeted and mls subpackages 2024-11-14 17:14:03 +01:00
selinux-policy-targeted.conf Protect the targeted and mls subpackages 2024-11-14 17:14:03 +01:00
selinux-policy.conf We need to setcheckreqprot to 0 for security purposes 2015-04-16 14:00:38 -04:00
selinux-policy.spec * Fri Dec 13 2024 Zdenek Pytela <zpytela@redhat.com> - 40.13.18-1 2024-12-13 17:43:37 +01:00
sources * Fri Dec 13 2024 Zdenek Pytela <zpytela@redhat.com> - 40.13.18-1 2024-12-13 17:43:37 +01:00
varrun-convert.sh varrun-convert.sh: Backport changes from Rawhide 2024-11-14 17:14:03 +01:00

Purpose

SELinux Fedora Policy is a fork of the SELinux reference policy. The fedora-selinux/selinux-policy repo makes Fedora packaging simpler and more transparent for packagers, upstream developers, and users. It is used for applying downstream Fedora fixes, for communication about proposed/committed changes, and for communication with upstream and the community. It reflects the upstream repository structure to make submitting patches to upstream easy.

Structure

GitHub

On GitHub, we have one repository containing the policy sources.

$ cd selinux-policy
$ git remote -v
origin	git@github.com:fedora-selinux/selinux-policy.git (fetch)

$ git branch -r
origin/HEAD -> origin/master
origin/f27
origin/f28
origin/master
origin/rawhide

Note: As opposed to dist-git, the Rawhide content resides in the rawhide branch rather than master.

dist-git

Package sources in dist-git are composed from the selinux-policy repository snapshot tarball, container-selinux policy files snapshot, the macro-expander script snapshot, and from other config files.

Build process

  1. Clone the fedora-selinux/selinux-policy repository.

     $ cd ~/devel/github
     $ git clone git@github.com:fedora-selinux/selinux-policy.git
     $ cd selinux-policy
    
  2. Create, backport, or cherry-pick needed changes to a particular branch and push them.

  3. Clone the selinux-policy dist-git repository.

     $ cd ~/devel/dist-git
     $ fedpkg clone selinux-policy
     $ cd selinux-policy
    
  4. Download the latest snapshot from the selinux-policy GitHub repository.

     $ ./make-rhat-patches.sh
    
  5. Add changes to the dist-git repository, bump release, create a changelog entry, commit, and push.

  6. Build the package.

     $ fedpkg build