rpms/openhpi
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add SELinux subpackage

Browse source 
Add openhpi-selinux subpackage containing selinux policy for openhpi.
This policy module will override the distribution policy.
Policy files where extracted from
https://github.com/fedora-selinux/selinux-policy

See Independent policy project guidelines for more details about
shipping custom SELinux policy.
https://fedoraproject.org/wiki/SELinux/IndependentPolicy
This commit is contained in:
Than Ngo 2021-03-31 13:56:03 +02:00
commit ffbd4eefd9
4 changed files with 309 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

79
openhpi.spec
View file

@ -1,11 +1,21 @@
# defining macros needed by SELinux
%global selinuxtype targeted
%global moduletype contrib
%global modulename openhpid
%global with_selinux 1
Summary: Hardware Platform Interface library and tools
Name: openhpi
Version: 3.8.0
Release: 15%{?dist}
Release: 16%{?dist}
License: BSD
URL: http://www.openhpi.org
Source0: http://downloads.sourceforge.net/%{name}/%{name}-%{version}.tar.gz
# convert from initscript to systemd unit
# selinux policy for openhpi, Policy files where extracted from
# https://github.com/fedora-selinux/selinux-policy
Source1: openhpid.fc
Source2: openhpid.if
Source3: openhpid.te
Patch0: %{name}-3.4.0-systemd.patch
Patch1: %{name}-3.6.1-ssl.patch
Patch2: %{name}-3.7.0-multilib.patch
@ -33,6 +43,11 @@ BuildRequires: systemd
BuildRequires: autoconf automake libtool
BuildRequires: libgcrypt-devel
BuildRequires: net-snmp
%if 0%{?with_selinux}
# This ensures that the *-selinux package and all it’s dependencies are not pulled
# into containers and other systems that do not use SELinux
Requires: (%{name}-selinux if selinux-policy-%{selinuxtype})
%endif
Requires(post): systemd
Requires(preun): systemd
Requires(postun): systemd
@ -53,14 +68,12 @@ easily. Many plug-ins exist in the OpenHPI source tree to provide access to
various types of hardware. This includes, but is not limited to, IPMI based
servers, Blade Center, and machines which export data via sysfs.
%package libs
Summary: The system libraries for the OpenHPI project
%description libs
The system libraries for the OpenHPI project.
%package devel
Summary: The development environment for the OpenHPI project
Requires: %{name}-libs%{?_isa} = %{version}-%{release}
@ -69,6 +82,19 @@ Requires: glib2-devel
%description devel
The development libraries and header files for the OpenHPI project.
%if 0%{?with_selinux}
# SELinux subpackage
%package selinux
Summary: openhpi SELinux policy
BuildArch: noarch
Requires: selinux-policy-%{selinuxtype}
Requires(post): selinux-policy-%{selinuxtype}
BuildRequires: selinux-policy-devel
%{?selinux_requires}
%description selinux
Custom SELinux policy module
%endif
%prep
%autosetup -p1
@ -88,7 +114,6 @@ if [ $UID -eq 0 ]; then
find . -name openhpi.conf -execdir chown root:root . \;
fi
%build
export CFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing"
%configure --disable-static --with-systemdsystemunitdir=%{_unitdir} --docdir=%{_docdir}/%{name}-%{version}
@ -99,6 +124,14 @@ sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool
make %{?_smp_mflags}
%if 0%{?with_selinux}
# SELinux policy (originally from selinux-policy-contrib)
# this policy module will override the production module
mkdir selinux
cp -p %{SOURCE1} %{SOURCE2} %{SOURCE3} selinux/
make -f %{_datadir}/selinux/devel/Makefile %{modulename}.pp
bzip2 -9 %{modulename}.pp
%endif
%install
mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/%{name}
@ -110,9 +143,36 @@ rm -rf $RPM_BUILD_ROOT/%{_libdir}/%{name}/*.la
cp plugins/dynamic_simulator/README $RPM_BUILD_ROOT/%{_docdir}/%{name}-%{version}/README-dynamic_simulator
# install selinux module
install -D -m 0644 %{modulename}.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/%{modulename}.pp.bz2
%check
make check
%if 0%{?with_selinux}
# SELinux contexts are saved so that only affected files can be
# relabeled after the policy module installation
%pre selinux
%selinux_relabel_pre -s %{selinuxtype}
%post selinux
%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/%{modulename}.pp.bz2
%selinux_relabel_post -s %{selinuxtype}
if [ "$1" -le "1" ]; then # First install
%systemd_postun_with_restart openhpid.service
fi
%postun selinux
if [ $1 -eq 0 ]; then
%selinux_modules_uninstall -s %{selinuxtype} %{modulename}
%selinux_relabel_post -s %{selinuxtype}
%systemd_postun_with_restart openhpid.service
fi
%posttrans selinux
%selinux_relabel_post -s %{selinuxtype}
%endif
%post
%systemd_post openhpid.service
@ -123,7 +183,6 @@ make check
%postun
%systemd_postun_with_restart openhpid.service
%files
%license %{_docdir}/%{name}-%{version}/COPYING
%doc %{_docdir}/%{name}-%{version}/ChangeLog
@ -150,8 +209,16 @@ make check
%{_includedir}/%{name}
%{_libdir}/pkgconfig/*.pc
%if 0%{?with_selinux}
%files selinux
%{_datadir}/selinux/packages/%{selinuxtype}/%{modulename}.pp.*
%ghost %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{modulename}
%endif
%changelog
* Wed Mar 31 2021 Than Ngo <than@redhat.com> - 3.8.0-16
- Add openhpi-selinux subpackage containing selinux policy for openhpi
* Tue Mar 02 2021 Than Ngo <than@redhat.com> - 3.8.0-15
- drop BR on sysfs in rhel >=9

10
openhpid.fc Normal file
View file

@ -0,0 +1,10 @@
/etc/rc\.d/init\.d/openhpid -- gen_context(system_u:object_r:openhpid_initrc_exec_t,s0)
/usr/sbin/openhpid -- gen_context(system_u:object_r:openhpid_exec_t,s0)
/var/lib/openhpi(/.*)? gen_context(system_u:object_r:openhpid_var_lib_t,s0)
/var/log/dynsim[0-9]*\.log -- gen_context(system_u:object_r:openhpid_log_t,s0)
/var/run/openhpid\.pid -- gen_context(system_u:object_r:openhpid_var_run_t,s0)

159
openhpid.if Normal file
View file

@ -0,0 +1,159 @@
## <summary>policy for openhpid</summary>
########################################
## <summary>
## Transition to openhpid.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
## </param>
#
interface(`openhpid_domtrans',`
gen_require(`
type openhpid_t, openhpid_exec_t;
')
corecmd_search_bin($1)
domtrans_pattern($1, openhpid_exec_t, openhpid_t)
')
########################################
## <summary>
## Execute openhpid server in the openhpid domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`openhpid_initrc_domtrans',`
gen_require(`
type openhpid_initrc_exec_t;
')
init_labeled_script_domtrans($1, openhpid_initrc_exec_t)
')
########################################
## <summary>
## Search openhpid lib directories.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`openhpid_search_lib',`
gen_require(`
type openhpid_var_lib_t;
')
allow $1 openhpid_var_lib_t:dir search_dir_perms;
files_search_var_lib($1)
')
########################################
## <summary>
## Read openhpid lib files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`openhpid_read_lib_files',`
gen_require(`
type openhpid_var_lib_t;
')
files_search_var_lib($1)
read_files_pattern($1, openhpid_var_lib_t, openhpid_var_lib_t)
')
########################################
## <summary>
## Manage openhpid lib files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`openhpid_manage_lib_files',`
gen_require(`
type openhpid_var_lib_t;
')
files_search_var_lib($1)
manage_files_pattern($1, openhpid_var_lib_t, openhpid_var_lib_t)
')
########################################
## <summary>
## Manage openhpid lib directories.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`openhpid_manage_lib_dirs',`
gen_require(`
type openhpid_var_lib_t;
')
files_search_var_lib($1)
manage_dirs_pattern($1, openhpid_var_lib_t, openhpid_var_lib_t)
')
########################################
## <summary>
## All of the rules required to administrate
## an openhpid environment
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
## <param name="role">
## <summary>
## Role allowed access.
## </summary>
## </param>
## <rolecap/>
#
interface(`openhpid_admin',`
gen_require(`
type openhpid_t;
type openhpid_initrc_exec_t;
type openhpid_var_lib_t;
')
allow $1 openhpid_t:process { ptrace signal_perms };
ps_process_pattern($1, openhpid_t)
openhpid_initrc_domtrans($1)
domain_system_change_exemption($1)
role_transition $2 openhpid_initrc_exec_t system_r;
allow $2 system_r;
files_search_var_lib($1)
admin_pattern($1, openhpid_var_lib_t)
')

67
openhpid.te Normal file
View file

@ -0,0 +1,67 @@
policy_module(openhpid, 1.0.0)
########################################
#
# Declarations
#
type openhpid_t;
type openhpid_exec_t;
init_daemon_domain(openhpid_t, openhpid_exec_t)
type openhpid_initrc_exec_t;
init_script_file(openhpid_initrc_exec_t)
type openhpid_log_t;
logging_log_file(openhpid_log_t)
type openhpid_var_lib_t;
files_type(openhpid_var_lib_t)
type openhpid_var_run_t;
files_pid_file(openhpid_var_run_t)
########################################
#
# openhpid local policy
#
allow openhpid_t self:capability { kill };
allow openhpid_t self:process signal_perms;
allow openhpid_t self:fifo_file rw_fifo_file_perms;
allow openhpid_t self:netlink_route_socket r_netlink_socket_perms;
allow openhpid_t self:unix_stream_socket create_stream_socket_perms;
allow openhpid_t self:tcp_socket create_stream_socket_perms;
allow openhpid_t self:udp_socket create_socket_perms;
manage_files_pattern(openhpid_t, openhpid_log_t, openhpid_log_t)
logging_log_filetrans(openhpid_t, openhpid_log_t, file)
manage_dirs_pattern(openhpid_t, openhpid_var_lib_t, openhpid_var_lib_t)
manage_files_pattern(openhpid_t, openhpid_var_lib_t, openhpid_var_lib_t)
files_var_lib_filetrans(openhpid_t, openhpid_var_lib_t, { dir file })
manage_files_pattern(openhpid_t, openhpid_var_run_t, openhpid_var_run_t)
files_pid_filetrans(openhpid_t, openhpid_var_run_t, { file })
kernel_read_system_state(openhpid_t)
corenet_tcp_bind_generic_node(openhpid_t)
corenet_tcp_bind_openhpid_port(openhpid_t)
corenet_tcp_connect_http_port(openhpid_t)
dev_read_urand(openhpid_t)
dev_rw_watchdog(openhpid_t)
logging_send_syslog_msg(openhpid_t)
miscfiles_read_generic_certs(openhpid_t)
sysnet_read_config(openhpid_t)
optional_policy(`
snmp_manage_var_lib_files(openhpid_t)
snmp_manage_var_lib_dirs(openhpid_t)
')