Difference between revisions of "RPM"

Revision as of 16:56, 11 December 2009

Introduction

This is the project page for the integration of SELinux policy into RPM 4. Specifically the project is focused on adding infrastructure to RPM to install and manage SELinux policies and reduce the error-prone scriptlets that have been used up to now to install policy from RPM's.

Quick Setup

Getting the Code

First clone the upstream RPM git repo. Instructions are available on the RPM get source page.

The current patch set is at [1].

Apply the patches to the RPM repo.

You need an up to date copy of libsemanage and libselinux to compile the RPM patchset. To check out these libraries use git:

# git clone http://oss.tresys.com/git/selinux.git

and build and install them with make:

# make && make install

Building and Installing RPM

# ./autogen.sh --noconfigure
# ./configure CPPFLAGS="-I/usr/include/nspr4 -I/usr/include/nss3 -I/usr/include/db4" \
    --with-external-db \
    --prefix=/usr \
    --sysconfdir=/etc \
    --localstatedir=/var \
    --sharedstatedir=/var/lib \
    --with-lua \
    --with-selinux
# make
# make install

Adding Policy to an RPM

You'll want a source module with the te, if and fc files. You can get one from the Reference Policy or use the one in the repo at rpm/tests/data/SOURCES/poltest-policy-1.0.tar.bz2

Add a Source line to your RPM:

Source1: poltest-policy-%{version}.tar.bz2

Build the policy during %build:

make -f /usr/share/selinux/devel/Makefile -C poltest-policy-%{version}

and specify the policy options using a %policy section:

%policy
%module poltest-policy-%{version}/foo.pp
    Name: foo

For a detailed explanation of the %policy section and the tags/options that can be used, see #%policy section.

Installing an RPM with Policy

Installing an RPM will also install its policy.

# rpm -i <rpm>

Verifying the Policy is installed

# semodule -l | grep foo
foo    1.0.0

%policy section

The %policy tag is used to define SELinux policy modules that should be included in the package. A string following the %policy tag indicates that policy should be included in a subpackage.

%policy targeted

This indicates that all policy defined in this section will be included in the targeted subpackage. Similar to %package and %files, the -n option can be given to modify the final name of the subpackage.

A typical %policy section with multiple modules and options looks like this:

%policy
%module policies/foo.pp
   Name: foo
   Types: mls targeted
%module policies/bar.pp
   Name: bar
   Types: targeted
   Obsoletes: baz

The %policy section can contain the following tags:

%module

The %module tag specifies an SELinux module to be included in the package. The format for the %module tag is

%module path/to/selinux/module

with the path relative to the rpm build directory. The module can be either a policy package (.pp) or a bzip2 compressed policy package (.pp.bz2). This specifies two policy modules (foo.pp and bar.pp) to be included in the package. Each module has several options which describe various characteristics of the preceding module. Each option is of the form Option: value, with each option applying to the most recent %module tag. In the following examples, the options are indented for readability only. Leading spaces are ignored when parsing the options.

Name

The Name option specifies the name of the policy module. This must match the name of the module specified inside the policy.

%policy
%module policies/foo.pp
    Name: foo

If Name is not provided, the basename minus the extension will be used. However, it is recommended that you provide the option.

Types

The Types option is a space-separated list of policy types the module can be installed into. The special type 'default' can be used to specify that the module can be installed into any type. If the Types option is not specified, 'default' is assumed.

%policy
%module policies/foo.pp
    Name: foo
    Types: mls targeted

This specifies that the foo.pp module can be installed in both mls and targeted policy types.

Obsoletes

The Obsoletes option is a space-separated list of policy names that are obsoleted by a module. Any modules listed in Obsoletes will be removed (or ignored if installed, but in the current transaction) upon module installation. If not specified, it is assumed that the module does not obsolete anything.

%policy
%module policies/foo.pp
    Name: foo
    Obsoletes: bar

This will remove the baz module at the same time as installing the foo module.

Base

The Base option is a boolean value (Yes/1 or No/0) that specifies whether or not a module is a base module. If not specified, it is assumed that the module is not a base module.

%policy
%module policies/base.pp
    Name: base
    Base: yes

This specifies that the module base.pp is a base module.