Compare commits
No commits in common. "c9s" and "c8" have entirely different histories.
2
.gitignore
vendored
2
.gitignore
vendored
@ -1 +1 @@
|
|||||||
/tpm2-abrmd-*.tar.gz
|
SOURCES/tpm2-abrmd-2.3.1.tar.gz
|
||||||
|
|||||||
1
.tpm2-abrmd-selinux.metadata
Normal file
1
.tpm2-abrmd-selinux.metadata
Normal file
@ -0,0 +1 @@
|
|||||||
|
02f70f06068fd32d7b9cd2394500e3eb8e7b1667 SOURCES/tpm2-abrmd-2.3.1.tar.gz
|
||||||
@ -1,68 +0,0 @@
|
|||||||
From d319a1a6723ad20766c18964c289d47c06e19182 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Patrik Koncity <pkoncity@redhat.com>
|
|
||||||
Date: Fri, 19 Aug 2022 14:03:49 +0200
|
|
||||||
Subject: [PATCH 1/2] Add new interfaces for communication with keylime
|
|
||||||
|
|
||||||
Policy need rules to communicate with keylime.
|
|
||||||
|
|
||||||
AVC:
|
|
||||||
allow keylime_agent_t tabrmd_t:dbus send_msg;
|
|
||||||
allow keylime_agent_t tabrmd_t:unix_stream_socket { getattr getopt read write };
|
|
||||||
|
|
||||||
Create new interfaces to allow keylime
|
|
||||||
communicate with keylime.
|
|
||||||
|
|
||||||
Signed-off-by: Patrik Koncity <pkoncity@redhat.com>
|
|
||||||
---
|
|
||||||
selinux/tabrmd.if | 40 ++++++++++++++++++++++++++++++++++++++++
|
|
||||||
1 file changed, 40 insertions(+)
|
|
||||||
|
|
||||||
diff --git a/selinux/tabrmd.if b/selinux/tabrmd.if
|
|
||||||
index 3eb6a30..c04eca0 100644
|
|
||||||
--- a/selinux/tabrmd.if
|
|
||||||
+++ b/selinux/tabrmd.if
|
|
||||||
@@ -1 +1,41 @@
|
|
||||||
## <summary></summary>
|
|
||||||
+
|
|
||||||
+########################################
|
|
||||||
+## <summary>
|
|
||||||
+## Create and use a unix stream socket
|
|
||||||
+## </summary>
|
|
||||||
+## <param name="domain">
|
|
||||||
+## <summary>
|
|
||||||
+## Domain allowed access.
|
|
||||||
+## </summary>
|
|
||||||
+## </param>
|
|
||||||
+#
|
|
||||||
+interface(`tabrmd_create_unix_stream_sockets',`
|
|
||||||
+ gen_require(`
|
|
||||||
+ type tabrmd_t;
|
|
||||||
+ ')
|
|
||||||
+
|
|
||||||
+ allow $1 tabrmd_t:unix_stream_socket create_stream_socket_perms;
|
|
||||||
+')
|
|
||||||
+
|
|
||||||
+########################################
|
|
||||||
+## <summary>
|
|
||||||
+## Send messages to and from
|
|
||||||
+## tabrmd over DBUS.
|
|
||||||
+## </summary>
|
|
||||||
+## <param name="domain">
|
|
||||||
+## <summary>
|
|
||||||
+## Domain allowed access.
|
|
||||||
+## </summary>
|
|
||||||
+## </param>
|
|
||||||
+#
|
|
||||||
+interface(`tabr,d_dbus_chat',`
|
|
||||||
+ gen_require(`
|
|
||||||
+ type tabrmd_t;
|
|
||||||
+ class dbus send_msg;
|
|
||||||
+ ')
|
|
||||||
+
|
|
||||||
+ allow $1 tabrmd_t:dbus send_msg;
|
|
||||||
+ allow tabrmd_t $1:dbus send_msg;
|
|
||||||
+')
|
|
||||||
+
|
|
||||||
--
|
|
||||||
2.39.0
|
|
||||||
|
|
||||||
@ -1,29 +0,0 @@
|
|||||||
From 64994388056b9b8c687eef3bc6030f2f40888440 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Patrik Koncity <pkoncity@redhat.com>
|
|
||||||
Date: Mon, 9 Jan 2023 12:30:42 +0100
|
|
||||||
Subject: [PATCH 2/2] Fix in SELinux interface file a typo
|
|
||||||
|
|
||||||
In name of interface in SELinux policy is
|
|
||||||
typo issue.
|
|
||||||
|
|
||||||
Signed-off-by: Patrik Koncity <pkoncity@redhat.com>
|
|
||||||
---
|
|
||||||
selinux/tabrmd.if | 2 +-
|
|
||||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
||||||
|
|
||||||
diff --git a/selinux/tabrmd.if b/selinux/tabrmd.if
|
|
||||||
index c04eca0..81c7853 100644
|
|
||||||
--- a/selinux/tabrmd.if
|
|
||||||
+++ b/selinux/tabrmd.if
|
|
||||||
@@ -29,7 +29,7 @@ interface(`tabrmd_create_unix_stream_sockets',`
|
|
||||||
## </summary>
|
|
||||||
## </param>
|
|
||||||
#
|
|
||||||
-interface(`tabr,d_dbus_chat',`
|
|
||||||
+interface(`tabrmd_dbus_chat',`
|
|
||||||
gen_require(`
|
|
||||||
type tabrmd_t;
|
|
||||||
class dbus send_msg;
|
|
||||||
--
|
|
||||||
2.39.0
|
|
||||||
|
|
||||||
85
SPECS/tpm2-abrmd-selinux.spec
Normal file
85
SPECS/tpm2-abrmd-selinux.spec
Normal file
@ -0,0 +1,85 @@
|
|||||||
|
# defining macros needed by SELinux
|
||||||
|
%global selinuxtype targeted
|
||||||
|
%global selinux_policyver 3.14.1
|
||||||
|
%global moduletype contrib
|
||||||
|
%global modulename tabrmd
|
||||||
|
|
||||||
|
Name: tpm2-abrmd-selinux
|
||||||
|
Version: 2.3.1
|
||||||
|
Release: 1%{?dist}
|
||||||
|
Summary: SELinux policies for tpm2-abrmd
|
||||||
|
|
||||||
|
License: BSD
|
||||||
|
URL: https://github.com/tpm2-software/tpm2-abrmd
|
||||||
|
Source0: https://github.com/tpm2-software/tpm2-abrmd/archive/%{version}/tpm2-abrmd-%{version}.tar.gz
|
||||||
|
Patch0: selinux-allow-fwupd-to-communicate-with-tpm2-abrmd.patch
|
||||||
|
|
||||||
|
BuildArch: noarch
|
||||||
|
Requires: selinux-policy >= %{selinux_policyver}
|
||||||
|
Requires: selinux-policy-%{selinuxtype} >= %{selinux_policyver}
|
||||||
|
BuildRequires: git
|
||||||
|
BuildRequires: pkgconfig(systemd)
|
||||||
|
BuildRequires: selinux-policy
|
||||||
|
BuildRequires: selinux-policy-devel
|
||||||
|
Requires(pre): libselinux-utils
|
||||||
|
Requires(post): policycoreutils
|
||||||
|
Requires(post): policycoreutils-python-utils
|
||||||
|
|
||||||
|
%description
|
||||||
|
SELinux policy modules for tpm2-abrmd.
|
||||||
|
|
||||||
|
%prep
|
||||||
|
%autosetup -p1 -n tpm2-abrmd-%{version}
|
||||||
|
|
||||||
|
%build
|
||||||
|
pushd selinux
|
||||||
|
make %{?_smp_mflags} TARGET="tabrmd" SHARE="%{_datadir}"
|
||||||
|
popd
|
||||||
|
|
||||||
|
%pre
|
||||||
|
%selinux_relabel_pre -s %{selinuxtype}
|
||||||
|
|
||||||
|
%install
|
||||||
|
# install policy modules
|
||||||
|
pushd selinux
|
||||||
|
install -d %{buildroot}%{_datadir}/selinux/packages
|
||||||
|
install -d -p %{buildroot}%{_datadir}/selinux/devel/include/%{moduletype}
|
||||||
|
install -p -m 644 %{modulename}.if %{buildroot}%{_datadir}/selinux/devel/include/%{moduletype}
|
||||||
|
install -m 0644 %{modulename}.pp.bz2 %{buildroot}%{_datadir}/selinux/packages
|
||||||
|
popd
|
||||||
|
|
||||||
|
%check
|
||||||
|
|
||||||
|
%post
|
||||||
|
%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{modulename}.pp.bz2
|
||||||
|
|
||||||
|
%postun
|
||||||
|
if [ $1 -eq 0 ]; then
|
||||||
|
%selinux_modules_uninstall -s %{selinuxtype} %{modulename}
|
||||||
|
fi
|
||||||
|
|
||||||
|
%posttrans
|
||||||
|
%selinux_relabel_post -s %{selinuxtype}
|
||||||
|
|
||||||
|
%files
|
||||||
|
%license LICENSE
|
||||||
|
%{_datadir}/selinux/*
|
||||||
|
%{_datadir}/selinux/packages/%{modulename}.pp.bz2
|
||||||
|
%{_datadir}/selinux/devel/include/%{moduletype}/%{modulename}.if
|
||||||
|
|
||||||
|
%changelog
|
||||||
|
* Mon Nov 16 2020 Jerry Snitselaar <jsnitsel@redhat.com> - 2.3.3-1
|
||||||
|
- Rebase to 2.3.1 release
|
||||||
|
resolves: rhbz#1898384
|
||||||
|
|
||||||
|
* Tue May 14 2019 Jerry Snitselaar <jsnitsel@redhat.com> - 2.0.0-3
|
||||||
|
- Fix Requires issue.
|
||||||
|
- Add initial CI gating support.
|
||||||
|
resolves: rhbz#1642000, rhbz#1682415
|
||||||
|
|
||||||
|
* Tue Sep 11 2018 Jerry Snitselaar <jsnitsel@redhat.com> - 2.0.0-2
|
||||||
|
- Fix dependency
|
||||||
|
resolves: rhbz#1628771
|
||||||
|
|
||||||
|
* Wed Jul 04 2018 Javier Martinez Canillas <javierm@redhat.com> - 2.0.0-1
|
||||||
|
- Initial import (rhbz#1550595)
|
||||||
@ -1,6 +0,0 @@
|
|||||||
--- !Policy
|
|
||||||
product_versions:
|
|
||||||
- rhel-9
|
|
||||||
decision_context: osci_compose_gate
|
|
||||||
rules:
|
|
||||||
- !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}
|
|
||||||
1
sources
1
sources
@ -1 +0,0 @@
|
|||||||
SHA512 (tpm2-abrmd-2.3.1.tar.gz) = 144ab2b147cd18f892f3c05181efdbed2ac422fe8507eb42871ffe571340b6395431743a4f1995a7ce7a914fd5e7afd2b17328062c893a0403708c2c4d92e0cb
|
|
||||||
@ -1,85 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
# get tpm simulator code
|
|
||||||
IBMTPM_VERSION=1661
|
|
||||||
wget --no-check-certificate https://downloads.sourceforge.net/project/ibmswtpm2/ibmtpm$IBMTPM_VERSION.tar.gz
|
|
||||||
|
|
||||||
res="$?"
|
|
||||||
|
|
||||||
if [[ "$res" -ne 0 ]]; then
|
|
||||||
echo "wget failed"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
# unpackage and build the source
|
|
||||||
mkdir ibmtpm
|
|
||||||
pushd ibmtpm
|
|
||||||
tar xf ../ibmtpm$IBMTPM_VERSION.tar.gz
|
|
||||||
pushd src
|
|
||||||
# fixup for openssl 3
|
|
||||||
sed -i -e "s|OPENSSL_VERSION_NUMBER >= 0x10200000L|OPENSSL_VERSION_NUMBER > 0x30000080L|" TpmToOsslMath.h
|
|
||||||
sed -i -e "s|CCFLAGS = -Wall|CCFLAGS = -Wall -Wno-error=deprecated-declarations|" makefile
|
|
||||||
make
|
|
||||||
|
|
||||||
res="$?"
|
|
||||||
|
|
||||||
if [[ "$res" -ne 0 ]]; then
|
|
||||||
echo "make of ibmtpm failed"
|
|
||||||
popd
|
|
||||||
popd
|
|
||||||
rm -rf ibmtpm ibmtpm$IBMTPM_VERSION.tar.gz
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
popd
|
|
||||||
popd
|
|
||||||
|
|
||||||
# get tpm2-tools tests
|
|
||||||
TPM2_TOOLS_VERSION=5.0
|
|
||||||
git clone https://github.com/01org/tpm2-tools.git
|
|
||||||
pushd tpm2-tools
|
|
||||||
git checkout -b test $TPM2_TOOLS_VERSION
|
|
||||||
pushd test/integration
|
|
||||||
sed -i -e 's/python/python3/g' helpers.sh
|
|
||||||
pushd tests
|
|
||||||
sed -i -e 's/python/python3/g' *.sh
|
|
||||||
# some tests aren't executable currently. Needs to be fixed upstream.
|
|
||||||
chmod +x *.sh
|
|
||||||
popd
|
|
||||||
popd
|
|
||||||
popd
|
|
||||||
|
|
||||||
TPM2_ABRMD=tpm2-abrmd
|
|
||||||
TPM2_SIM=tpm_server
|
|
||||||
TPM2_TOOLS_TEST_FIXTURES=`pwd`/tpm2-tools/test/integration/fixtures
|
|
||||||
PATH=`pwd`/ibmtpm/src/:.:$PATH
|
|
||||||
export TPM2_ABRMD TPM2_SIM TPM2_TOOLS_TEST_FIXTURES PATH
|
|
||||||
|
|
||||||
pushd tpm2-tools/test/integration
|
|
||||||
for t in `ls tests/*.sh`
|
|
||||||
do
|
|
||||||
f=`basename $t`
|
|
||||||
test=${f%%.*}
|
|
||||||
/usr/share/automake-1.16/test-driver --test-name $test --log-file $test.log --trs-file $test.trs $t
|
|
||||||
done
|
|
||||||
all=`grep ":test-result:" *.trs | wc -l`;
|
|
||||||
pass=`grep ":test-result: PASS" *.trs | wc -l`;
|
|
||||||
fail=`grep ":test-result: FAIL" *.trs | wc -l`;
|
|
||||||
skip=`grep ":test-result: SKIP" *.trs | wc -l`;
|
|
||||||
xfail=`grep ":test-result: XFAIL" *.trs | wc -l`;
|
|
||||||
xpass=`grep ":test-result: XPASS" *.trs | wc -l`;
|
|
||||||
error=`grep ":test-result: ERROR" *.trs | wc -l`;
|
|
||||||
if [[ $(($fail + $xpass + $error)) -eq 0 ]]; then
|
|
||||||
success=0
|
|
||||||
else
|
|
||||||
success=1
|
|
||||||
fi;
|
|
||||||
popd
|
|
||||||
|
|
||||||
echo PASSED: $pass
|
|
||||||
echo FAILED: $fail
|
|
||||||
echo SKIPPED: $skip
|
|
||||||
echo XFAIL: $xfail
|
|
||||||
echo XPASS: $xpass
|
|
||||||
echo ERROR: $error
|
|
||||||
|
|
||||||
exit $success
|
|
||||||
@ -1,28 +0,0 @@
|
|||||||
- hosts: localhost
|
|
||||||
roles:
|
|
||||||
- role: standard-test-basic
|
|
||||||
tags:
|
|
||||||
- classic
|
|
||||||
required_packages:
|
|
||||||
- gcc
|
|
||||||
- make
|
|
||||||
- automake
|
|
||||||
- wget
|
|
||||||
- openssl
|
|
||||||
- openssl-devel
|
|
||||||
- sed
|
|
||||||
- tpm2-tss
|
|
||||||
- tpm2-tss-devel
|
|
||||||
- tpm2-tools
|
|
||||||
- tpm2-abrmd
|
|
||||||
- tpm2-abrmd-selinux
|
|
||||||
- python3
|
|
||||||
- git
|
|
||||||
- vim-common
|
|
||||||
- perl-Digest-SHA
|
|
||||||
- dbus-daemon
|
|
||||||
tests:
|
|
||||||
- intel-tpm2:
|
|
||||||
dir: .
|
|
||||||
run: dbus-run-session ./runtest.sh
|
|
||||||
timeout: 60m
|
|
||||||
@ -1,121 +0,0 @@
|
|||||||
# defining macros needed by SELinux
|
|
||||||
%global selinuxtype targeted
|
|
||||||
%global selinux_policyver 3.14.3-22
|
|
||||||
%global moduletype contrib
|
|
||||||
%global modulename tabrmd
|
|
||||||
|
|
||||||
Name: tpm2-abrmd-selinux
|
|
||||||
Version: 2.3.1
|
|
||||||
Release: 7%{?dist}
|
|
||||||
Summary: SELinux policies for tpm2-abrmd
|
|
||||||
|
|
||||||
License: BSD
|
|
||||||
URL: https://github.com/tpm2-software/tpm2-abrmd
|
|
||||||
Source0: https://github.com/tpm2-software/tpm2-abrmd/archive/%{version}/tpm2-abrmd-%{version}.tar.gz
|
|
||||||
|
|
||||||
Patch0: selinux-allow-fwupd-to-communicate-with-tpm2-abrmd.patch
|
|
||||||
Patch1: 0001-Add-new-interfaces-for-communication-with-keylime.patch
|
|
||||||
Patch2: 0002-Fix-in-SELinux-interface-file-a-typo.patch
|
|
||||||
|
|
||||||
BuildArch: noarch
|
|
||||||
Requires: selinux-policy >= %{selinux_policyver}
|
|
||||||
BuildRequires: make
|
|
||||||
BuildRequires: git
|
|
||||||
BuildRequires: pkgconfig(systemd)
|
|
||||||
BuildRequires: selinux-policy
|
|
||||||
BuildRequires: selinux-policy-devel
|
|
||||||
BuildRequires: selinux-policy-%{selinuxtype}
|
|
||||||
Requires(post): selinux-policy-base >= %{selinux_policyver}
|
|
||||||
Requires(post): libselinux-utils
|
|
||||||
Requires(post): policycoreutils
|
|
||||||
Requires(post): policycoreutils-python-utils
|
|
||||||
|
|
||||||
%description
|
|
||||||
SELinux policy modules for tpm2-abrmd.
|
|
||||||
|
|
||||||
%prep
|
|
||||||
%autosetup -p1 -n tpm2-abrmd-%{version}
|
|
||||||
|
|
||||||
%build
|
|
||||||
pushd selinux
|
|
||||||
make %{?_smp_mflags} TARGET="tabrmd" SHARE="%{_datadir}"
|
|
||||||
popd
|
|
||||||
|
|
||||||
%pre
|
|
||||||
%selinux_relabel_pre -s %{selinuxtype}
|
|
||||||
|
|
||||||
%install
|
|
||||||
# install policy modules
|
|
||||||
pushd selinux
|
|
||||||
install -d %{buildroot}%{_datadir}/selinux/packages
|
|
||||||
install -d -p %{buildroot}%{_datadir}/selinux/devel/include/%{moduletype}
|
|
||||||
install -p -m 644 %{modulename}.if %{buildroot}%{_datadir}/selinux/devel/include/%{moduletype}
|
|
||||||
install -m 0644 %{modulename}.pp.bz2 %{buildroot}%{_datadir}/selinux/packages
|
|
||||||
popd
|
|
||||||
|
|
||||||
%check
|
|
||||||
|
|
||||||
%post
|
|
||||||
%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{modulename}.pp.bz2
|
|
||||||
|
|
||||||
%postun
|
|
||||||
if [ $1 -eq 0 ]; then
|
|
||||||
%selinux_modules_uninstall -s %{selinuxtype} %{modulename}
|
|
||||||
fi
|
|
||||||
|
|
||||||
%posttrans
|
|
||||||
%selinux_relabel_post -s %{selinuxtype}
|
|
||||||
|
|
||||||
%files
|
|
||||||
%license LICENSE
|
|
||||||
%{_datadir}/selinux/*
|
|
||||||
%{_datadir}/selinux/packages/%{modulename}.pp.bz2
|
|
||||||
%{_datadir}/selinux/devel/include/%{moduletype}/%{modulename}.if
|
|
||||||
|
|
||||||
%changelog
|
|
||||||
* Fri Jan 6 2023 Štěpán Horáček <shoracek@redhat.com> - 2.3.1-7
|
|
||||||
- Include interface for Keylime
|
|
||||||
Resolves: rhbz#2157894
|
|
||||||
|
|
||||||
* Tue Aug 10 2021 Mohan Boddu <mboddu@redhat.com> - 2.3.1-6
|
|
||||||
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
|
|
||||||
Related: rhbz#1991688
|
|
||||||
|
|
||||||
* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 2.3.1-5
|
|
||||||
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
|
|
||||||
|
|
||||||
* Wed Feb 17 2021 Jerry Snitselaar <jsnitsel@redhat.com> - 2.3.1-4
|
|
||||||
- Fix dependency.
|
|
||||||
Resolves: rhbz#1929701
|
|
||||||
|
|
||||||
* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.3.1-3
|
|
||||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
|
|
||||||
|
|
||||||
* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.3.1-2
|
|
||||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
|
|
||||||
|
|
||||||
* Wed Feb 12 2020 Javier Martinez Canillas <javierm@redhat.com> - 2.3.1-1
|
|
||||||
- Update to 2.3.1 release
|
|
||||||
|
|
||||||
* Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.0-4
|
|
||||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
|
|
||||||
|
|
||||||
* Sat Jul 27 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.0-3
|
|
||||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
|
|
||||||
|
|
||||||
* Fri Mar 08 2019 Javier Martinez Canillas <javierm@redhat.com> - 2.1.0-2
|
|
||||||
- selinux: allow tpm2-abrmd to communicate with fwupd
|
|
||||||
Resolves: rhbz#1665701
|
|
||||||
|
|
||||||
* Fri Feb 22 2019 Javier Martinez Canillas <javierm@redhat.com> - 2.1.0-1
|
|
||||||
- Update to 2.1.0 release
|
|
||||||
- Add selinux-policy-%{selinuxtype} BuildRequires
|
|
||||||
|
|
||||||
* Sun Feb 03 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.0.0-3
|
|
||||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
|
|
||||||
|
|
||||||
* Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.0.0-2
|
|
||||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
|
|
||||||
|
|
||||||
* Wed Jul 04 2018 Javier Martinez Canillas <javierm@redhat.com> - 2.0.0-1
|
|
||||||
- Initial import (rhbz#1550595)
|
|
||||||
Loading…
Reference in New Issue
Block a user