summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAnthony G. Basile <blueness@gentoo.org>2011-05-20 19:02:57 +0000
committerAnthony G. Basile <blueness@gentoo.org>2011-05-20 19:02:57 +0000
commitbae1d5eecd16517ebc8b6a2ba2194ae9079d244c (patch)
tree75e34080ba7aa0d6b31eeedf584c76a4c4cf2f3d /sec-policy/selinux-base-policy
parentppc/ppc64 stable wrt #359853 (diff)
downloadgentoo-2-bae1d5eecd16517ebc8b6a2ba2194ae9079d244c.tar.gz
gentoo-2-bae1d5eecd16517ebc8b6a2ba2194ae9079d244c.tar.bz2
gentoo-2-bae1d5eecd16517ebc8b6a2ba2194ae9079d244c.zip
Updated patchbundle for base policy 2.20101213
(Portage version: 2.1.9.42/cvs/Linux x86_64)
Diffstat (limited to 'sec-policy/selinux-base-policy')
-rw-r--r--sec-policy/selinux-base-policy/ChangeLog11
-rw-r--r--sec-policy/selinux-base-policy/files/patchbundle-selinux-base-policy-2.20101213-r16.tar.bz2bin0 -> 13853 bytes
-rw-r--r--sec-policy/selinux-base-policy/metadata.xml1
-rw-r--r--sec-policy/selinux-base-policy/selinux-base-policy-2.20101213-r16.ebuild129
4 files changed, 140 insertions, 1 deletions
diff --git a/sec-policy/selinux-base-policy/ChangeLog b/sec-policy/selinux-base-policy/ChangeLog
index ce50bf0cbd4a..a58a98cbe0c5 100644
--- a/sec-policy/selinux-base-policy/ChangeLog
+++ b/sec-policy/selinux-base-policy/ChangeLog
@@ -1,6 +1,15 @@
# ChangeLog for sec-policy/selinux-base-policy
# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-base-policy/ChangeLog,v 1.72 2011/04/16 13:02:44 blueness Exp $
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-base-policy/ChangeLog,v 1.73 2011/05/20 19:02:56 blueness Exp $
+
+*selinux-base-policy-2.20101213-r16 (20 May 2011)
+
+ 20 May 2011; Anthony G. Basile <blueness@gentoo.org>
+ +selinux-base-policy-2.20101213-r16.ebuild,
+ +files/patchbundle-selinux-base-policy-2.20101213-r16.tar.bz2, metadata.xml:
+ Drop obsoleted policy builds, add openrc support (rc-update, rc-status),
+ correct file contexts for /lib64, make UBAC optional (#257111 and #306393),
+ use portage_srcrepo_t for live ebuilds and match mdadm policy with upstream
*selinux-base-policy-2.20101213-r12 (16 Apr 2011)
*selinux-base-policy-2.20101213-r11 (16 Apr 2011)
diff --git a/sec-policy/selinux-base-policy/files/patchbundle-selinux-base-policy-2.20101213-r16.tar.bz2 b/sec-policy/selinux-base-policy/files/patchbundle-selinux-base-policy-2.20101213-r16.tar.bz2
new file mode 100644
index 000000000000..d2969cbd1da5
--- /dev/null
+++ b/sec-policy/selinux-base-policy/files/patchbundle-selinux-base-policy-2.20101213-r16.tar.bz2
Binary files differ
diff --git a/sec-policy/selinux-base-policy/metadata.xml b/sec-policy/selinux-base-policy/metadata.xml
index 4e26a8603f4d..393f3bb02965 100644
--- a/sec-policy/selinux-base-policy/metadata.xml
+++ b/sec-policy/selinux-base-policy/metadata.xml
@@ -9,5 +9,6 @@
<use>
<flag name='peer_perms'>Enable the labeled networking peer permissions (SELinux policy capability).</flag>
<flag name='open_perms'>Enable the open permissions for file object classes (SELinux policy capability).</flag>
+ <flag name='ubac'>Enable User Based Access Control (UBAC) in the SELinux policy</flag>
</use>
</pkgmetadata>
diff --git a/sec-policy/selinux-base-policy/selinux-base-policy-2.20101213-r16.ebuild b/sec-policy/selinux-base-policy/selinux-base-policy-2.20101213-r16.ebuild
new file mode 100644
index 000000000000..551fb9610ba1
--- /dev/null
+++ b/sec-policy/selinux-base-policy/selinux-base-policy-2.20101213-r16.ebuild
@@ -0,0 +1,129 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-base-policy/selinux-base-policy-2.20101213-r16.ebuild,v 1.1 2011/05/20 19:02:56 blueness Exp $
+
+EAPI="1"
+IUSE="+peer_perms +open_perms +ubac"
+
+inherit eutils
+
+PATCHBUNDLE="${FILESDIR}/patchbundle-${PF}.tar.bz2"
+DESCRIPTION="Gentoo base policy for SELinux"
+HOMEPAGE="http://www.gentoo.org/proj/en/hardened/selinux/"
+SRC_URI="http://oss.tresys.com/files/refpolicy/refpolicy-${PV}.tar.bz2"
+LICENSE="GPL-2"
+SLOT="0"
+
+KEYWORDS="~amd64 ~x86"
+
+RDEPEND=">=sys-apps/policycoreutils-1.30.30
+ >=sys-fs/udev-151"
+DEPEND="${RDEPEND}
+ sys-devel/m4
+ >=sys-apps/checkpolicy-1.30.12"
+
+S=${WORKDIR}/
+
+src_unpack() {
+ [ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="strict targeted"
+ MOD_CONF_VER="20090730"
+
+ unpack ${A}
+
+ cd "${S}"
+ epatch "${PATCHBUNDLE}"
+ cd "${S}/refpolicy"
+ # Fix bug 257111
+ sed -i -e 's:system_crond_t:system_cronjob_t:g' \
+ "${S}/refpolicy/config/appconfig-standard/default_contexts"
+
+ if ! use peer_perms; then
+ sed -i -e '/network_peer_controls/d' \
+ "${S}/refpolicy/policy/policy_capabilities"
+ fi
+
+ if ! use open_perms; then
+ sed -i -e '/open_perms/d' \
+ "${S}/refpolicy/policy/policy_capabilities"
+ fi
+
+ for i in ${POLICY_TYPES}; do
+ cp -a "${S}/refpolicy" "${S}/${i}"
+
+ cd "${S}/${i}";
+ make conf || die "${i} reconfiguration failed"
+
+ cp "${FILESDIR}/modules.conf.${i}.${MOD_CONF_VER}" \
+ "${S}/${i}/policy/modules.conf" \
+ || die "failed to set up modules.conf"
+ sed -i -e '/^QUIET/s/n/y/' -e '/^MONOLITHIC/s/y/n/' \
+ -e "/^NAME/s/refpolicy/$i/" "${S}/${i}/build.conf" \
+ || die "build.conf setup failed."
+
+ if ! use ubac; then
+ sed -i -e 's:^UBAC = y:UBAC = n:g' "${S}/${i}/build.conf"
+ fi
+
+ echo "DISTRO = gentoo" >> "${S}/${i}/build.conf"
+
+ if [ "${i}" == "targeted" ]; then
+ sed -i -e '/root/d' -e 's/user_u/unconfined_u/' \
+ "${S}/${i}/config/appconfig-standard/seusers" \
+ || die "targeted seusers setup failed."
+ fi
+ done
+}
+
+src_compile() {
+ [ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="strict targeted"
+
+ for i in ${POLICY_TYPES}; do
+ cd "${S}/${i}"
+ make base || die "${i} compile failed"
+ done
+}
+
+src_install() {
+ [ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="strict targeted"
+
+ for i in ${POLICY_TYPES}; do
+ cd "${S}/${i}"
+
+ make DESTDIR="${D}" install \
+ || die "${i} install failed."
+
+ make DESTDIR="${D}" install-headers \
+ || die "${i} headers install failed."
+
+ echo "run_init_t" > "${D}/etc/selinux/${i}/contexts/run_init_type"
+
+ echo "textrel_shlib_t" >> "${D}/etc/selinux/${i}/contexts/customizable_types"
+
+ # libsemanage won't make this on its own
+ keepdir "/etc/selinux/${i}/policy"
+ done
+
+ dodoc doc/Makefile.example doc/example.{te,fc,if}
+
+ insinto /etc/selinux
+ doins "${FILESDIR}/config"
+}
+
+pkg_preinst() {
+ has_version "<${CATEGORY}/${PN}-2.20101213-r13"
+ previous_less_than_r13=$?
+}
+
+pkg_postinst() {
+ [ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="strict targeted"
+
+ for i in ${POLICY_TYPES}; do
+ einfo "Inserting base module into ${i} module store."
+
+ cd "/usr/share/selinux/${i}"
+ semodule -s "${i}" -b base.pp || die "Could not load in new base policy"
+ done
+ elog "Updates on policies might require you to relabel files. If you, after"
+ elog "installing new SELinux policies, get 'permission denied' errors,"
+ elog "relabelling your system using 'rlpkg -a -r' might resolve the issues."
+}