aboutgitcodebugslistschat
diff options
context:
space:
mode:
authorStefano Brivio <sbrivio@redhat.com>2023-03-16 20:51:23 +0100
committerStefano Brivio <sbrivio@redhat.com>2023-03-17 08:26:07 +0100
commitdd2349661933c4e9756e524ae9465f38b53b7557 (patch)
treeca5ff3816890bc6c53f9c1a3e9734c1f459c3901
parent87a655045bf2631a10c44a3d41090bd289f34525 (diff)
downloadpasst-dd2349661933c4e9756e524ae9465f38b53b7557.tar
passt-dd2349661933c4e9756e524ae9465f38b53b7557.tar.gz
passt-dd2349661933c4e9756e524ae9465f38b53b7557.tar.bz2
passt-dd2349661933c4e9756e524ae9465f38b53b7557.tar.lz
passt-dd2349661933c4e9756e524ae9465f38b53b7557.tar.xz
passt-dd2349661933c4e9756e524ae9465f38b53b7557.tar.zst
passt-dd2349661933c4e9756e524ae9465f38b53b7557.zip
fedora: Refresh SELinux labels in scriptlets, require -selinux package2023_03_17.dd23496
Instead of: https://fedoraproject.org/wiki/SELinux_Policy_Modules_Packaging_Draft follow this: https://fedoraproject.org/wiki/PackagingDrafts/SELinux_Independent_Policy which seems to make more sense and fixes the issue that, on a fresh install, without a reboot, the file contexts for the binaries are not actually updated. In detail: - labels are refreshed using the selinux_relabel_pre and selinux_relabel_post on install, upgrade, and uninstall - use the selinux_modules_install and selinux_modules_uninstall macros, instead of calling 'semodule' directly (no functional changes in our case) - require the -selinux package on SELinux-enabled environments and if the current system policy is "targeted" Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
-rw-r--r--contrib/fedora/passt.spec20
1 files changed, 15 insertions, 5 deletions
diff --git a/contrib/fedora/passt.spec b/contrib/fedora/passt.spec
index 51cad90..f6aa117 100644
--- a/contrib/fedora/passt.spec
+++ b/contrib/fedora/passt.spec
@@ -8,6 +8,7 @@
# Author: Stefano Brivio <sbrivio@redhat.com>
%global git_hash {{{ git_head }}}
+%global selinuxtype targeted
Name: passt
Version: {{{ git_version }}}
@@ -19,6 +20,7 @@ URL: https://passt.top/
Source: https://passt.top/passt/snapshot/passt-%{git_hash}.tar.xz
BuildRequires: gcc, make, checkpolicy, selinux-policy-devel
+Requires: (%{name}-selinux = %{version}-%{release} if selinux-policy-%{selinuxtype})
%description
passt implements a translation layer between a Layer-2 network interface and
@@ -66,13 +68,21 @@ install -p -m 644 -D pasta.pp %{buildroot}%{_datadir}/selinux/packages/%{name}/p
install -p -m 644 -D pasta.if %{buildroot}%{_datadir}/selinux/devel/include/contrib/pasta.if
popd
+%pre selinux
+%selinux_relabel_pre -s %{selinuxtype}
+
%post selinux
-semodule -i %{_datadir}/selinux/packages/%{name}/passt.pp 2>/dev/null || :
-semodule -i %{_datadir}/selinux/packages/%{name}/pasta.pp 2>/dev/null || :
+%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{name}/passt.pp
+%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{name}/pasta.pp
+
+%postun selinux
+if [ $1 -eq 0 ]; then
+ %selinux_modules_uninstall -s %{selinuxtype} passt
+ %selinux_modules_uninstall -s %{selinuxtype} pasta
+fi
-%preun selinux
-semodule -r passt 2>/dev/null || :
-semodule -r pasta 2>/dev/null || :
+%posttrans selinux
+%selinux_relabel_post -s %{selinuxtype}
%files
%license LICENSES/{AGPL-3.0-or-later.txt,BSD-3-Clause.txt}