RPM - Revision history

SteveLawrence: /* Getting the Code */

2010-02-02T20:17:22Z

Getting the Code

←Older revision		Revision as of 20:17, 2 February 2010
Line 9:		Line 9:
	First clone the upstream RPM git repo. Instructions are available on the [http://rpm.org/wiki/GetSource RPM get source page].		First clone the upstream RPM git repo. Instructions are available on the [http://rpm.org/wiki/GetSource RPM get source page].

-	The current patch set is at [http://oss.tresys.com/files/rpm/~~add_selinux_support_to_rpm_v2~~.tar.bz2].	+	The current patch set is at [http://oss.tresys.com/files/rpm/add_selinux_support_to_rpm_v3.tar.bz2].

	Apply the patches to the RPM repo.		Apply the patches to the RPM repo.

SteveLawrence at 16:05, 2 February 2010

2010-02-02T16:05:32Z

←Older revision		Revision as of 16:05, 2 February 2010
Line 137:		Line 137:

	This specifies that the module base.pp is a base module.		This specifies that the module base.pp is a base module.
		+
		+	== PolicyRequires ==
		+
		+	The PolicyRequires tag is added to the preamble to specify that the current system must meet certain capabilities before policy can be installed. This tag has the same syntax as Requires, Obsoletes, and similar tags, and will usually contain SElinux libraries that may be necessary to install/load policy:
		+
		+	PolicyRequires: libselinux >= 2.0.90
		+
		+	Unlike Requires, which can be met by both currently installed packages and to-be-installed packages, PolicyRequires must be met by currently installed packages only, ignoring any to-be-installed packages during dependency checks. If PolicyRequires capabilities are not met by the existing packages, but are met by to-be-installed packages, policy can still be installed, but is performed at the end of the transaction, rather than the beginning, and is followed by a full filesystem relabel. Because of the expense of a full relabel, it is recommended that this be used carefully.

SteveLawrence at 16:56, 11 December 2009

2009-12-11T16:56:03Z

←Older revision		Revision as of 16:56, 11 December 2009
Line 21:		Line 21:
	# make && make install		# make && make install

-	=== Building and Installing ===	+	=== Building and Installing RPM ===

	# ./autogen.sh --noconfigure		# ./autogen.sh --noconfigure
Line 67:		Line 67:
	== %policy section ==		== %policy section ==

-	The %policy tag is used to define SELinux policy modules that should be included in the package. A string following the %policy tag indicates ~~the~~ policy should be included in a subpackage.	+	The %policy tag is used to define SELinux policy modules that should be included in the package. A string following the %policy tag indicates that policy should be included in a subpackage.

	%policy targeted		%policy targeted
Line 73:		Line 73:
	This indicates that all policy defined in this section will be included in the targeted subpackage. Similar to %package and %files, the -n option can be given to modify the final name of the subpackage.		This indicates that all policy defined in this section will be included in the targeted subpackage. Similar to %package and %files, the -n option can be given to modify the final name of the subpackage.

-	~~The %policy section can contains the following tags.~~	+	A typical %policy section with multiple modules and options looks like this:
-		+
-	~~=== %basetype ===~~	+
-		+
-	~~The %basetype tag specifies that the package is a base package and why type it is a base package for. The tag can only be specified once per %policy section and cannot have the value of 'default'.~~	+
-		+
-	~~%policy targeted~~	+
-	~~%basetype targeted~~	+
-		+
-	~~This specifies that the targeted subpackage is the base package for the targeted type. Although the subpackage and basetype are the same in this example, this is not required.~~	+
-		+
-	~~=== %module ===~~	+
-		+
-	~~The %module tag specifies a SELinux module to be included in the package. The format for the %module tag is %module path/to/selinux/module, with the root of the path in the rpm build directory.~~ A typical %policy section with multiple modules and options looks like this:	+

	%policy		%policy
Line 97:		Line 84:
	Obsoletes: baz		Obsoletes: baz

-	This specifies two policy modules (foo.pp and bar.pp) to be included in the package. Each module has several options which describe various characteristics of the preceding module. Each option is of the form Option: value, with each option applying to the most recent %module tag. In the following examples, the options are ~~intended~~ for readability only. Leading spaces are ignored when parsing the options.	+	The %policy section can contain the following tags:
		+
		+	=== %module ===
		+
		+	The %module tag specifies an SELinux module to be included in the package. The format for the %module tag is
		+
		+	%module path/to/selinux/module
		+
		+	with the path relative to the rpm build directory. The module can be either a policy package (.pp) or a bzip2 compressed policy package (.pp.bz2).
		+	This specifies two policy modules (foo.pp and bar.pp) to be included in the package. Each module has several options which describe various characteristics of the preceding module. Each option is of the form Option: value, with each option applying to the most recent %module tag. In the following examples, the options are indented for readability only. Leading spaces are ignored when parsing the options.

	==== Name ====		==== Name ====

SteveLawrence at 19:53, 1 December 2009

2009-12-01T19:53:04Z

←Older revision		Revision as of 19:53, 1 December 2009
Line 1:		Line 1:
-	= Introduction =	+	== Introduction ==

	This is the project page for the integration of SELinux policy into RPM 4. Specifically the project is focused on adding infrastructure to RPM to install and manage SELinux policies and reduce the error-prone scriptlets that have been used up to now to install policy from RPM's.		This is the project page for the integration of SELinux policy into RPM 4. Specifically the project is focused on adding infrastructure to RPM to install and manage SELinux policies and reduce the error-prone scriptlets that have been used up to now to install policy from RPM's.

-	= Getting the Code =	+	== Quick Setup ==
		+
		+	=== Getting the Code ===

	First clone the upstream RPM git repo. Instructions are available on the [http://rpm.org/wiki/GetSource RPM get source page].		First clone the upstream RPM git repo. Instructions are available on the [http://rpm.org/wiki/GetSource RPM get source page].

-	The current patch set is at [http://oss.tresys.com/files/rpm/~~add_selinux_support_to_rpm~~.tar.bz2].	+	The current patch set is at [http://oss.tresys.com/files/rpm/add_selinux_support_to_rpm_v2.tar.bz2].

	Apply the patches to the RPM repo.		Apply the patches to the RPM repo.
Line 19:		Line 21:
	# make && make install		# make && make install

-	= Building and ~~installing the code~~ =	+	=== Building and Installing ===

	# ./autogen.sh --noconfigure		# ./autogen.sh --noconfigure
-	# ./configure CPPFLAGS="-I/usr/include/nspr4 -I/usr/include/nss3 -I/usr/include/db4" --with-external-db --prefix=/~~u sr~~ --sysconfdir=/etc --localstatedir=/var --sharedstatedir=/var/lib --with-lua --with-selinux	+	# ./configure CPPFLAGS="-I/usr/include/nspr4 -I/usr/include/nss3 -I/usr/include/db4" \
		+	--with-external-db \
		+	--prefix=/usr \
		+	--sysconfdir=/etc \
		+	--localstatedir=/var \
		+	--sharedstatedir=/var/lib \
		+	--with-lua \
		+	--with-selinux
	# make		# make
	# make install		# make install

-	= Adding ~~a policy~~ to an RPM =	+	=== Adding Policy to an RPM ===

	You'll want a source module with the te, if and fc files. You can get one from the Reference Policy or use the one in the repo at rpm/tests/data/SOURCES/poltest-policy-1.0.tar.bz2		You'll want a source module with the te, if and fc files. You can get one from the Reference Policy or use the one in the repo at rpm/tests/data/SOURCES/poltest-policy-1.0.tar.bz2
Line 36:		Line 45:
	make -f /usr/share/selinux/devel/Makefile -C poltest-policy-%{version}		make -f /usr/share/selinux/devel/Makefile -C poltest-policy-%{version}

-	and specify the policy options using a %policy ~~block~~:	+	and specify the policy options using a %policy section:

	%policy		%policy
	%module poltest-policy-%{version}/foo.pp		%module poltest-policy-%{version}/foo.pp
-	Name: foo	+	Name: foo

		+	For a detailed explanation of the %policy section and the tags/options that can be used, see [[#%policy section]].

-	The name field is optional and if omitted will use the basename minus the extension for the name, however it is recommended that you use the name field and it must match the name of the module specified in the policy.	+	=== Installing an RPM with Policy ===
-		+
-	= Installing an RPM with ~~a policy~~ =	+

	Installing an RPM will also install its policy.		Installing an RPM will also install its policy.
Line 51:		Line 59:
	# rpm -i <rpm>		# rpm -i <rpm>

-	= Verifying the ~~policy~~ is installed =	+	=== Verifying the Policy is installed ===

	# semodule -l \| grep foo		# semodule -l \| grep foo
	foo 1.0.0		foo 1.0.0

-	= Specifying policy type =

-	~~If your~~ policy ~~only works with a specific policy type (eg., targeted, mls, etc) you can specify that with Types:~~	+	== %policy section ==

-	%policy	+	The %policy tag is used to define SELinux policy modules that should be included in the package. A string following the %policy tag indicates the policy should be included in a subpackage.
-	~~%module poltest-~~policy-%~~{version}/foo~~.pp	+
-	~~Name: foo~~	+
-	~~Type: mls targeted~~	+

-	~~This will only install the module if the current active~~ policy ~~type is "mls" or "~~targeted~~" (you can check by looking at the SELINUXTYPE variable in /etc/selinux/config.~~	+	%policy targeted

-	~~If Type is omitted the~~ policy will ~~install on whatever~~ the ~~current policy type is~~.	+	This indicates that all policy defined in this section will be included in the targeted subpackage. Similar to %package and %files, the -n option can be given to modify the final name of the subpackage.

-	~~= Obsoleting a~~ policy ~~module =~~	+	The %policy section can contains the following tags.

-	~~To obsolete~~ a ~~module you specify which modules~~ are ~~obsoleted~~ with ~~Obsoletes~~:	+	=== %basetype ===
		+
		+	The %basetype tag specifies that the package is a base package and why type it is a base package for. The tag can only be specified once per %policy section and cannot have the value of 'default'.
		+
		+	%policy targeted
		+	%basetype targeted
		+
		+	This specifies that the targeted subpackage is the base package for the targeted type. Although the subpackage and basetype are the same in this example, this is not required.
		+
		+	=== %module ===
		+
		+	The %module tag specifies a SELinux module to be included in the package. The format for the %module tag is %module path/to/selinux/module, with the root of the path in the rpm build directory. A typical %policy section with multiple modules and options looks like this:

	%policy		%policy
-	%module ~~poltest-policy-%{version}~~/foo.pp	+	%module policies/foo.pp
-	Name: foo	+	Name: foo
-	Obsoletes: baz	+	Types: mls targeted
		+	%module policies/bar.pp
		+	Name: bar
		+	Types: targeted
		+	Obsoletes: baz

-	This ~~will remove~~ the ~~baz~~ module at the ~~same time as installing~~ the ~~foo~~ module.	+	This specifies two policy modules (foo.pp and bar.pp) to be included in the package. Each module has several options which describe various characteristics of the preceding module. Each option is of the form Option: value, with each option applying to the most recent %module tag. In the following examples, the options are intended for readability only. Leading spaces are ignored when parsing the options.

-	= ~~Multiple modules~~ =	+	==== Name ====

-	~~You can specify as many modules as necessary in~~ the %policy ~~block~~	+	The Name option specifies the name of the policy module. This must match the name of the module specified inside the policy.

	%policy		%policy
-	%module ~~poltest-policy-%{version}~~/foo.pp	+	%module policies/foo.pp
-	Name: foo	+	Name: foo
-	~~Types: default~~	+
-	~~%module poltest-policy-%{version}/bar.pp~~	+
-	~~Name: bar~~	+
-	~~Types: mls targeted~~	+

-	~~= PolicyRequires =~~	+	If Name is not provided, the basename minus the extension will be used. However, it is recommended that you provide the option.

-	~~You can specify a dependency that is used only when policy is being installed with %PolicyRequires~~	+	==== Types ====

-	~~PolicyRequires: policycoreutils~~	+	The Types option is a space-separated list of policy types the module can be installed into. The special type 'default' can be used to specify that the module can be installed into any type. If the Types option is not specified, 'default' is assumed.

-	~~PolicyRequires is part of the rpm preamble and has the same syntax as the Requires tag~~.	+	%policy
		+	%module policies/foo.pp
		+	Name: foo
		+	Types: mls targeted

-	~~= nopolicy~~ and ~~root~~ =	+	This specifies that the foo.pp module can be installed in both mls and targeted policy types.
		+
		+	==== Obsoletes ====
		+
		+	The Obsoletes option is a space-separated list of policy names that are obsoleted by a module. Any modules listed in Obsoletes will be removed (or ignored if installed, but in the current transaction) upon module installation. If not specified, it is assumed that the module does not obsolete anything.
		+
		+	%policy
		+	%module policies/foo.pp
		+	Name: foo
		+	Obsoletes: bar
		+
		+	This will remove the baz module at the same time as installing the foo module.
		+
		+	==== Base ====
		+
		+	The Base option is a boolean value (Yes/1 or No/0) that specifies whether or not a module is a base module. If not specified, it is assumed that the module is not a base module.
		+
		+	%policy
		+	%module policies/base.pp
		+	Name: base
		+	Base: yes

-	~~If you specify~~ the ~~--nopolicy flag when running RPM the policy will not get installed~~. ~~Additionally if you are installing RPM's into~~ a ~~chroot with --root the policies will be installed in the chroot but the policy '''will not''' be reloaded~~.	+	This specifies that the module base.pp is a base module.

JoshuaBrindle: /* Getting the Code */

2009-10-22T18:09:19Z

Getting the Code

←Older revision		Revision as of 18:09, 22 October 2009
Line 7:		Line 7:
	First clone the upstream RPM git repo. Instructions are available on the [http://rpm.org/wiki/GetSource RPM get source page].		First clone the upstream RPM git repo. Instructions are available on the [http://rpm.org/wiki/GetSource RPM get source page].

-	The current patch set ~~XXX CURRENT PATCH SET LINKS XXX~~	+	The current patch set is at [http://oss.tresys.com/files/rpm/add_selinux_support_to_rpm.tar.bz2].

	Apply the patches to the RPM repo.		Apply the patches to the RPM repo.
		+
		+	You need an up to date copy of libsemanage and libselinux to compile the RPM patchset. To check out these libraries use git:
		+
		+	# git clone http://oss.tresys.com/git/selinux.git
		+
		+	and build and install them with make:
		+
		+	# make && make install

	= Building and installing the code =		= Building and installing the code =

JoshuaBrindle at 16:57, 22 October 2009

2009-10-22T16:57:31Z

←Older revision		Revision as of 16:57, 22 October 2009
Line 94:		Line 94:
	= nopolicy and root =		= nopolicy and root =

-	If you specify the --nopolicy flag when running RPM the policy will not get installed. Additionally if you are installing RPM's into a chroot with --root the policies will be installed in the chroot but the policy ~~_will not_~~ be reloaded.	+	If you specify the --nopolicy flag when running RPM the policy will not get installed. Additionally if you are installing RPM's into a chroot with --root the policies will be installed in the chroot but the policy '''will not''' be reloaded.

JoshuaBrindle: /* Building and installing the code */

2009-10-22T16:56:36Z

Building and installing the code

←Older revision		Revision as of 16:56, 22 October 2009
Line 13:		Line 13:
	= Building and installing the code =		= Building and installing the code =

-	# ./autogen.sh --noconfigure	+	# ./autogen.sh --noconfigure
-	# ./configure CPPFLAGS="-I/usr/include/nspr4 -I/usr/include/nss3 -I/usr/include/db4" --with-external-db --prefix=/u sr --sysconfdir=/etc --localstatedir=/var --sharedstatedir=/var/lib --with-lua --with-selinux	+	# ./configure CPPFLAGS="-I/usr/include/nspr4 -I/usr/include/nss3 -I/usr/include/db4" --with-external-db --prefix=/u sr --sysconfdir=/etc --localstatedir=/var --sharedstatedir=/var/lib --with-lua --with-selinux
-	# make	+	# make
-	# make install	+	# make install

	= Adding a policy to an RPM =		= Adding a policy to an RPM =

JoshuaBrindle at 16:56, 22 October 2009

2009-10-22T16:56:18Z

←Older revision		Revision as of 16:56, 22 October 2009
Line 35:		Line 35:


-	The name field is ~~required~~ and must match the name ~~declared in~~ the module.	+	The name field is optional and if omitted will use the basename minus the extension for the name, however it is recommended that you use the name field and it must match the name of the module specified in the policy.

	= Installing an RPM with a policy =		= Installing an RPM with a policy =
Line 55:		Line 55:
	%module poltest-policy-%{version}/foo.pp		%module poltest-policy-%{version}/foo.pp
	Name: foo		Name: foo
-	Type: mls	+	Type: mls targeted

-	This will only install the module if the current active policy type is "mls" (you can check by looking at the SELINUXTYPE variable in /etc/selinux/config.	+	This will only install the module if the current active policy type is "mls" or "targeted" (you can check by looking at the SELINUXTYPE variable in /etc/selinux/config.

	If Type is omitted the policy will install on whatever the current policy type is.		If Type is omitted the policy will install on whatever the current policy type is.
Line 88:		Line 88:
	You can specify a dependency that is used only when policy is being installed with %PolicyRequires		You can specify a dependency that is used only when policy is being installed with %PolicyRequires

-	%PolicyRequires policycoreutils	+	PolicyRequires: policycoreutils
		+
		+	PolicyRequires is part of the rpm preamble and has the same syntax as the Requires tag.

	= nopolicy and root =		= nopolicy and root =

	If you specify the --nopolicy flag when running RPM the policy will not get installed. Additionally if you are installing RPM's into a chroot with --root the policies will be installed in the chroot but the policy _will not_ be reloaded.		If you specify the --nopolicy flag when running RPM the policy will not get installed. Additionally if you are installing RPM's into a chroot with --root the policies will be installed in the chroot but the policy _will not_ be reloaded.

JoshuaBrindle at 15:56, 22 October 2009

2009-10-22T15:56:42Z

←Older revision		Revision as of 15:56, 22 October 2009
Line 7:		Line 7:
	First clone the upstream RPM git repo. Instructions are available on the [http://rpm.org/wiki/GetSource RPM get source page].		First clone the upstream RPM git repo. Instructions are available on the [http://rpm.org/wiki/GetSource RPM get source page].

-	The current patch set	+	The current patch set XXX CURRENT PATCH SET LINKS XXX

	Apply the patches to the RPM repo.		Apply the patches to the RPM repo.

JoshuaBrindle: New page: = Introduction = This is the project page for the integration of SELinux policy into RPM 4. Specifically the project is focused on adding infrastructure to RPM to install and manage SELi...

2009-10-22T15:56:04Z

New page: = Introduction = This is the project page for the integration of SELinux policy into RPM 4. Specifically the project is focused on adding infrastructure to RPM to install and manage SELi...

New page

= Introduction =

This is the project page for the integration of SELinux policy into RPM 4. Specifically the project is focused on adding infrastructure to RPM to install and manage SELinux policies and reduce the error-prone scriptlets that have been used up to now to install policy from RPM's.

= Getting the Code =

First clone the upstream RPM git repo. Instructions are available on the [http://rpm.org/wiki/GetSource RPM get source page].

The current patch set

Apply the patches to the RPM repo.

= Building and installing the code =

# ./autogen.sh --noconfigure
# ./configure CPPFLAGS="-I/usr/include/nspr4 -I/usr/include/nss3 -I/usr/include/db4" --with-external-db --prefix=/u sr --sysconfdir=/etc --localstatedir=/var --sharedstatedir=/var/lib --with-lua --with-selinux
# make
# make install

= Adding a policy to an RPM =

You'll want a source module with the te, if and fc files. You can get one from the Reference Policy or use the one in the repo at rpm/tests/data/SOURCES/poltest-policy-1.0.tar.bz2

Add a Source line to your RPM:
Source1: poltest-policy-%{version}.tar.bz2

Build the policy during %build:
make -f /usr/share/selinux/devel/Makefile -C poltest-policy-%{version}

and specify the policy options using a %policy block:

%policy
%module poltest-policy-%{version}/foo.pp
Name: foo

The name field is required and must match the name declared in the module.

= Installing an RPM with a policy =

Installing an RPM will also install its policy.

# rpm -i <rpm>

= Verifying the policy is installed =

# semodule -l | grep foo
foo 1.0.0

= Specifying policy type =

If your policy only works with a specific policy type (eg., targeted, mls, etc) you can specify that with Types:

%policy
%module poltest-policy-%{version}/foo.pp
Name: foo
Type: mls

This will only install the module if the current active policy type is "mls" (you can check by looking at the SELINUXTYPE variable in /etc/selinux/config.

If Type is omitted the policy will install on whatever the current policy type is.

= Obsoleting a policy module =

To obsolete a module you specify which modules are obsoleted with Obsoletes:

%policy
%module poltest-policy-%{version}/foo.pp
Name: foo
Obsoletes: baz

This will remove the baz module at the same time as installing the foo module.

= Multiple modules =

You can specify as many modules as necessary in the %policy block

%policy
%module poltest-policy-%{version}/foo.pp
Name: foo
Types: default
%module poltest-policy-%{version}/bar.pp
Name: bar
Types: mls targeted

= PolicyRequires =

You can specify a dependency that is used only when policy is being installed with %PolicyRequires

%PolicyRequires policycoreutils

= nopolicy and root =

If you specify the --nopolicy flag when running RPM the policy will not get installed. Additionally if you are installing RPM's into a chroot with --root the policies will be installed in the chroot but the policy _will not_ be reloaded.