fedora: Refresh SELinux labels in scriptlets, require -selinux package
Instead of: https://fedoraproject.org/wiki/SELinux_Policy_Modules_Packaging_Draft follow this: https://fedoraproject.org/wiki/PackagingDrafts/SELinux_Independent_Policy which seems to make more sense and fixes the issue that, on a fresh install, without a reboot, the file contexts for the binaries are not actually updated. In detail: - labels are refreshed using the selinux_relabel_pre and selinux_relabel_post on install, upgrade, and uninstall - use the selinux_modules_install and selinux_modules_uninstall macros, instead of calling 'semodule' directly (no functional changes in our case) - require the -selinux package on SELinux-enabled environments and if the current system policy is "targeted" Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
This commit is contained in:
parent
87a655045b
commit
dd23496619
1 changed files with 16 additions and 6 deletions
|
@ -8,6 +8,7 @@
|
|||
# Author: Stefano Brivio <sbrivio@redhat.com>
|
||||
|
||||
%global git_hash {{{ git_head }}}
|
||||
%global selinuxtype targeted
|
||||
|
||||
Name: passt
|
||||
Version: {{{ git_version }}}
|
||||
|
@ -19,6 +20,7 @@ URL: https://passt.top/
|
|||
Source: https://passt.top/passt/snapshot/passt-%{git_hash}.tar.xz
|
||||
|
||||
BuildRequires: gcc, make, checkpolicy, selinux-policy-devel
|
||||
Requires: (%{name}-selinux = %{version}-%{release} if selinux-policy-%{selinuxtype})
|
||||
|
||||
%description
|
||||
passt implements a translation layer between a Layer-2 network interface and
|
||||
|
@ -66,13 +68,21 @@ install -p -m 644 -D pasta.pp %{buildroot}%{_datadir}/selinux/packages/%{name}/p
|
|||
install -p -m 644 -D pasta.if %{buildroot}%{_datadir}/selinux/devel/include/contrib/pasta.if
|
||||
popd
|
||||
|
||||
%post selinux
|
||||
semodule -i %{_datadir}/selinux/packages/%{name}/passt.pp 2>/dev/null || :
|
||||
semodule -i %{_datadir}/selinux/packages/%{name}/pasta.pp 2>/dev/null || :
|
||||
%pre selinux
|
||||
%selinux_relabel_pre -s %{selinuxtype}
|
||||
|
||||
%preun selinux
|
||||
semodule -r passt 2>/dev/null || :
|
||||
semodule -r pasta 2>/dev/null || :
|
||||
%post selinux
|
||||
%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{name}/passt.pp
|
||||
%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{name}/pasta.pp
|
||||
|
||||
%postun selinux
|
||||
if [ $1 -eq 0 ]; then
|
||||
%selinux_modules_uninstall -s %{selinuxtype} passt
|
||||
%selinux_modules_uninstall -s %{selinuxtype} pasta
|
||||
fi
|
||||
|
||||
%posttrans selinux
|
||||
%selinux_relabel_post -s %{selinuxtype}
|
||||
|
||||
%files
|
||||
%license LICENSES/{AGPL-3.0-or-later.txt,BSD-3-Clause.txt}
|
||||
|
|
Loading…
Reference in a new issue