[gentoo-commits] gentoo-x86 commit in sec-policy/selinux-base-policy: metadata.xml ChangeLog selinux-base-policy-2.20101213-r16.ebuild

[gentoo-commits] gentoo-x86 commit in sec-policy/selinux-base-policy: metadata.xml ChangeLog selinux-base-policy-2.20101213-r16.ebuild

[Anthony G. Basile (blueness)]

blueness    11/05/20 19:02:57

  Modified:             metadata.xml ChangeLog
  Added:                selinux-base-policy-2.20101213-r16.ebuild
  Log:
  Updated patchbundle for base policy 2.20101213
  
  (Portage version: 2.1.9.42/cvs/Linux x86_64)

Revision  Changes    Path
1.4                  sec-policy/selinux-base-policy/metadata.xml

file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/sec-policy/selinux-base-policy/metadata.xml?rev=1.4&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/sec-policy/selinux-base-policy/metadata.xml?rev=1.4&content-type=text/plain
diff : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/sec-policy/selinux-base-policy/metadata.xml?r1=1.3&r2=1.4

Index: metadata.xml
===================================================================
RCS file: /var/cvsroot/gentoo-x86/sec-policy/selinux-base-policy/metadata.xml,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- metadata.xml	13 Feb 2011 18:52:43 -0000	1.3
+++ metadata.xml	20 May 2011 19:02:56 -0000	1.4
@@ -9,5 +9,6 @@
 	<use>
 		<flag name='peer_perms'>Enable the labeled networking peer permissions (SELinux policy capability).</flag>
 		<flag name='open_perms'>Enable the open permissions for file object classes (SELinux policy capability).</flag>
+		<flag name='ubac'>Enable User Based Access Control (UBAC) in the SELinux policy</flag>
 	</use>
 </pkgmetadata>



1.73                 sec-policy/selinux-base-policy/ChangeLog

file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/sec-policy/selinux-base-policy/ChangeLog?rev=1.73&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/sec-policy/selinux-base-policy/ChangeLog?rev=1.73&content-type=text/plain
diff : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/sec-policy/selinux-base-policy/ChangeLog?r1=1.72&r2=1.73

Index: ChangeLog
===================================================================
RCS file: /var/cvsroot/gentoo-x86/sec-policy/selinux-base-policy/ChangeLog,v
retrieving revision 1.72
retrieving revision 1.73
diff -u -r1.72 -r1.73
--- ChangeLog	16 Apr 2011 13:02:44 -0000	1.72
+++ ChangeLog	20 May 2011 19:02:56 -0000	1.73
@@ -1,6 +1,15 @@
 # ChangeLog for sec-policy/selinux-base-policy
 # Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-base-policy/ChangeLog,v 1.72 2011/04/16 13:02:44 blueness Exp $
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-base-policy/ChangeLog,v 1.73 2011/05/20 19:02:56 blueness Exp $
+
+*selinux-base-policy-2.20101213-r16 (20 May 2011)
+
+  20 May 2011; Anthony G. Basile <blueness@gentoo.org>
+  +selinux-base-policy-2.20101213-r16.ebuild,
+  +files/patchbundle-selinux-base-policy-2.20101213-r16.tar.bz2, metadata.xml:
+  Drop obsoleted policy builds, add openrc support (rc-update, rc-status),
+  correct file contexts for /lib64, make UBAC optional (#257111 and #306393),
+  use portage_srcrepo_t for live ebuilds and match mdadm policy with upstream
 
 *selinux-base-policy-2.20101213-r12 (16 Apr 2011)
 *selinux-base-policy-2.20101213-r11 (16 Apr 2011)



1.1                  sec-policy/selinux-base-policy/selinux-base-policy-2.20101213-r16.ebuild

file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/sec-policy/selinux-base-policy/selinux-base-policy-2.20101213-r16.ebuild?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/sec-policy/selinux-base-policy/selinux-base-policy-2.20101213-r16.ebuild?rev=1.1&content-type=text/plain

Index: selinux-base-policy-2.20101213-r16.ebuild
===================================================================
# Copyright 1999-2011 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-base-policy/selinux-base-policy-2.20101213-r16.ebuild,v 1.1 2011/05/20 19:02:56 blueness Exp $

EAPI="1"
IUSE="+peer_perms +open_perms +ubac"

inherit eutils

PATCHBUNDLE="${FILESDIR}/patchbundle-${PF}.tar.bz2"
DESCRIPTION="Gentoo base policy for SELinux"
HOMEPAGE="http://www.gentoo.org/proj/en/hardened/selinux/"
SRC_URI="http://oss.tresys.com/files/refpolicy/refpolicy-${PV}.tar.bz2"
LICENSE="GPL-2"
SLOT="0"

KEYWORDS="~amd64 ~x86"

RDEPEND=">=sys-apps/policycoreutils-1.30.30
	>=sys-fs/udev-151"
DEPEND="${RDEPEND}
	sys-devel/m4
	>=sys-apps/checkpolicy-1.30.12"

S=${WORKDIR}/

src_unpack() {
	[ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="strict targeted"
	MOD_CONF_VER="20090730"

	unpack ${A}

	cd "${S}"
	epatch "${PATCHBUNDLE}"
	cd "${S}/refpolicy"
	# Fix bug 257111
	sed -i -e 's:system_crond_t:system_cronjob_t:g' \
		"${S}/refpolicy/config/appconfig-standard/default_contexts"

	if ! use peer_perms; then
		sed -i -e '/network_peer_controls/d' \
			"${S}/refpolicy/policy/policy_capabilities"
	fi

	if ! use open_perms; then
		sed -i -e '/open_perms/d' \
			"${S}/refpolicy/policy/policy_capabilities"
	fi

	for i in ${POLICY_TYPES}; do
		cp -a "${S}/refpolicy" "${S}/${i}"

		cd "${S}/${i}";
		make conf || die "${i} reconfiguration failed"

		cp "${FILESDIR}/modules.conf.${i}.${MOD_CONF_VER}" \
			"${S}/${i}/policy/modules.conf" \
			|| die "failed to set up modules.conf"
		sed -i -e '/^QUIET/s/n/y/' -e '/^MONOLITHIC/s/y/n/' \
			-e "/^NAME/s/refpolicy/$i/" "${S}/${i}/build.conf" \
			|| die "build.conf setup failed."

		if ! use ubac; then
			sed -i -e 's:^UBAC = y:UBAC = n:g' "${S}/${i}/build.conf"
		fi

		echo "DISTRO = gentoo" >> "${S}/${i}/build.conf"

		if [ "${i}" == "targeted" ]; then
			sed -i -e '/root/d' -e 's/user_u/unconfined_u/' \
			"${S}/${i}/config/appconfig-standard/seusers" \
			|| die "targeted seusers setup failed."
		fi
	done
}

src_compile() {
	[ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="strict targeted"

	for i in ${POLICY_TYPES}; do
		cd "${S}/${i}"
		make base || die "${i} compile failed"
	done
}

src_install() {
	[ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="strict targeted"

	for i in ${POLICY_TYPES}; do
		cd "${S}/${i}"

		make DESTDIR="${D}" install \
			|| die "${i} install failed."

		make DESTDIR="${D}" install-headers \
			|| die "${i} headers install failed."

		echo "run_init_t" > "${D}/etc/selinux/${i}/contexts/run_init_type"

		echo "textrel_shlib_t" >> "${D}/etc/selinux/${i}/contexts/customizable_types"

		# libsemanage won't make this on its own
		keepdir "/etc/selinux/${i}/policy"
	done

	dodoc doc/Makefile.example doc/example.{te,fc,if}

	insinto /etc/selinux
	doins "${FILESDIR}/config"
}

pkg_preinst() {
	has_version "<${CATEGORY}/${PN}-2.20101213-r13"
	previous_less_than_r13=$?
}

pkg_postinst() {
	[ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="strict targeted"

	for i in ${POLICY_TYPES}; do
		einfo "Inserting base module into ${i} module store."

		cd "/usr/share/selinux/${i}"
		semodule -s "${i}" -b base.pp || die "Could not load in new base policy"
	done
	elog "Updates on policies might require you to relabel files. If you, after"
	elog "installing new SELinux policies, get 'permission denied' errors,"
	elog "relabelling your system using 'rlpkg -a -r' might resolve the issues."
}