diff options
Diffstat (limited to 'sec-policy/selinux-base')
| -rw-r--r-- | sec-policy/selinux-base/Manifest | 1 | ||||
| -rw-r--r-- | sec-policy/selinux-base/selinux-base-2.20161023-r3.ebuild | 161 |
2 files changed, 162 insertions, 0 deletions
diff --git a/sec-policy/selinux-base/Manifest b/sec-policy/selinux-base/Manifest index f5ffe3ae414e..17f1705b8a6a 100644 --- a/sec-policy/selinux-base/Manifest +++ b/sec-policy/selinux-base/Manifest @@ -7,6 +7,7 @@ DIST patchbundle-selinux-base-policy-2.20151208-r5.tar.bz2 304623 SHA256 90bbbeb DIST patchbundle-selinux-base-policy-2.20151208-r6.tar.bz2 307239 SHA256 dd8cbe50f5fff68af543062157c778cb026f1bbacfb5825dbdb1121be757c5ec SHA512 22758f5fa1d4058cc34613d61271ddf0947a4d21f4ee9b298b290ef17f0bdbbb6f389577c0c3c4f5625d8ef599bb8f1a91c8c5a9cf372a7c07ae5784385130b4 WHIRLPOOL a8500aae051924d1cc646f080f2e511ee6cbea493efea699afc4b7a0d7bfb6365bd862cea5134fe81c11c26923ffef2d7424eb4a262263e8eb7590970f4c3283 DIST patchbundle-selinux-base-policy-2.20161023-r1.tar.bz2 298107 SHA256 fa5be024a7f3b59b155f3cb3852d8b4124f4e75112cd42014090146221169660 SHA512 f8720e4998023aa5186dd5fdebeb41eb998992fd629dd3ae369c855c00308a0aa47761b7a0fb4638893d7b3d8ef42e11b1ca7c5010cfc055258a3077d83f396d WHIRLPOOL 2cfcb976a2beb5e55049e562d75bb3887ca0cbeac9bc630df23a4456f4026f31673b0be012c8ffda89af9b7417b7202089607cd79e6804f69fa826dd017779f4 DIST patchbundle-selinux-base-policy-2.20161023-r2.tar.bz2 333180 SHA256 d258a0cdc8a6fed19d1d43bcb5946feb2ab422132bb4fa67012dbfc227aa2b4d SHA512 5bca02bd1ddeffc77ce7c59094f4900d54a9f00ec5399ce99fd707a26f705dd973ef8cb81e03d81e7f80dfba84889ec2d690d17803451e34e12c8cd038a293f4 WHIRLPOOL cc6df67f8850d6c464937fdf815dabab7d768ff9c657d4d976fe4899358cad1125851035128775b3c5d1b9e53bb1b5c86b7cad8e8aba55b8d7c90983abc651e6 +DIST patchbundle-selinux-base-policy-2.20161023-r3.tar.bz2 321394 SHA256 76521408b62a17120072cd0db5e037f4b7b967be4340985ce354786e5d2948f7 SHA512 2e9ca3be900c549ddbcd306f1bf5483934d7baf23ffd66a2172d26bcb81b4aa768596555dd8d362398013778e7a127024ec2468d6bf1b487f0c4a14e479e53f4 WHIRLPOOL 246399de9a96f3605fd490cd118f4301b19935990705ab87133911ad3e4befb5aa6d412e5e43b2e2c60936bc485969f55406316c3d37c2a2e8676642153231dd DIST refpolicy-2.20141203.tar.bz2 680243 SHA256 f438209c430d8a2d4ddcbe4bdd3edb46f6af7dc4913637af0b73c635e40c1522 SHA512 682e4280c5799e4c12ec7594afc1389f67be35055748d2e0dbdc3419159a16c96d4946ca6178daee8370515951f8653b2e452efe8c962b8d7f9bc192f0b15a0c WHIRLPOOL 74bca232534e7af9051bb1ab9f77c1ff6c425781cf4561f781d6e9a40cc5ca0d9add540249ea5493e8782a9372aea296ead6c165c6c440ae1509eb319d151ee5 DIST refpolicy-2.20151208.tar.bz2 698182 SHA256 2dd2f45a7132137afe8302805c3b7839739759b9ab73dd1815c01afe34ac99de SHA512 cbefe117f143adea834065949e24e9fe86336c049e9e0518026597d5b0a18c482a9717422bd39b7fb0012d19df00365c969d87e1f13a7bb9dcb9996313ed6cf8 WHIRLPOOL cb843a602dde4234a62e6f92001bff689a457796215b015bcccce79e7aa73bfe875a82bdbdbf59236f218eb41aaf665fcc5753c42d86eb3ed1caa1b69ddc2efa DIST refpolicy-2.20161023.tar.bz2 1768667 SHA256 14c9576e2cdf0ecf656134bc59cba99589dbba2895344d2fc226bdb5d8e541c7 SHA512 3201ca3c6cada1053343d3763d36072cf40afa46bf5343087a8254320879cb61fef539dc7742e04e5645d0c886b8f4bf552bf502e9716f7a3282efc0b0ed970d WHIRLPOOL 3f44955c3b13f5a6152d8ca8b75b3c8d52becc1c47b3b0126f5c86fbdad8bf6a1ae72c42e0b130352e139f987340b3c0d3d37aac5b80c5e3d731fcd666b88504 diff --git a/sec-policy/selinux-base/selinux-base-2.20161023-r3.ebuild b/sec-policy/selinux-base/selinux-base-2.20161023-r3.ebuild new file mode 100644 index 000000000000..ef52278cab83 --- /dev/null +++ b/sec-policy/selinux-base/selinux-base-2.20161023-r3.ebuild @@ -0,0 +1,161 @@ +# Copyright 1999-2016 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Id$ +EAPI="6" + +if [[ ${PV} == 9999* ]]; then + EGIT_REPO_URI="${SELINUX_GIT_REPO:-git://anongit.gentoo.org/proj/hardened-refpolicy.git https://anongit.gentoo.org/git/proj/hardened-refpolicy.git}" + EGIT_BRANCH="${SELINUX_GIT_BRANCH:-master}" + EGIT_CHECKOUT_DIR="${WORKDIR}/refpolicy" + + inherit git-r3 +else + SRC_URI="https://raw.githubusercontent.com/wiki/TresysTechnology/refpolicy/files/refpolicy-${PV}.tar.bz2 + https://dev.gentoo.org/~swift/patches/selinux-base-policy/patchbundle-selinux-base-policy-${PVR}.tar.bz2" + + KEYWORDS="~amd64 ~arm ~arm64 ~mips ~x86" +fi + +IUSE="doc +open_perms +peer_perms systemd +ubac +unconfined" + +DESCRIPTION="Gentoo base policy for SELinux" +HOMEPAGE="https://www.gentoo.org/proj/en/hardened/selinux/" +LICENSE="GPL-2" +SLOT="0" + +RDEPEND=">=sys-apps/policycoreutils-2.3 + virtual/udev" +DEPEND="${RDEPEND} + sys-devel/m4 + >=sys-apps/checkpolicy-2.3" + +S=${WORKDIR}/ + +src_prepare() { + if [[ ${PV} != 9999* ]]; then + einfo "Applying SELinux policy updates ... " + eapply -p0 "${WORKDIR}/0001-full-patch-against-stable-release.patch" + fi + + eapply_user + + cd "${S}/refpolicy" || die + emake bare +} + +src_configure() { + [ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="targeted strict mls mcs" + + # Update the SELinux refpolicy capabilities based on the users' USE flags. + + if ! use peer_perms; then + sed -i -e '/network_peer_controls/d' \ + "${S}/refpolicy/policy/policy_capabilities" || die + fi + + if ! use open_perms; then + sed -i -e '/open_perms/d' \ + "${S}/refpolicy/policy/policy_capabilities" || die + fi + + if ! use ubac; then + sed -i -e '/^UBAC/s/y/n/' "${S}/refpolicy/build.conf" \ + || die "Failed to disable User Based Access Control" + fi + + if use systemd; then + sed -i -e '/^SYSTEMD/s/n/y/' "${S}/refpolicy/build.conf" \ + || die "Failed to enable SystemD" + fi + + echo "DISTRO = gentoo" >> "${S}/refpolicy/build.conf" || die + + # Prepare initial configuration + cd "${S}/refpolicy" || die + emake conf || die "Make conf failed" + + # Setup the policies based on the types delivered by the end user. + # These types can be "targeted", "strict", "mcs" and "mls". + for i in ${POLICY_TYPES}; do + cp -a "${S}/refpolicy" "${S}/${i}" || die + cd "${S}/${i}" || die + + #cp "${FILESDIR}/modules-2.20120215.conf" "${S}/${i}/policy/modules.conf" + sed -i -e "/= module/d" "${S}/${i}/policy/modules.conf" || die + + sed -i -e '/^QUIET/s/n/y/' -e "/^NAME/s/refpolicy/$i/" \ + "${S}/${i}/build.conf" || die "build.conf setup failed." + + if [[ "${i}" == "mls" ]] || [[ "${i}" == "mcs" ]]; + then + # MCS/MLS require additional settings + sed -i -e "/^TYPE/s/standard/${i}/" "${S}/${i}/build.conf" \ + || die "failed to set type to mls" + fi + + if [ "${i}" == "targeted" ]; then + sed -i -e '/root/d' -e 's/user_u/unconfined_u/' \ + "${S}/${i}/config/appconfig-standard/seusers" \ + || die "targeted seusers setup failed." + fi + + if [ "${i}" != "targeted" ] && [ "${i}" != "strict" ] && use unconfined; then + sed -i -e '/root/d' -e 's/user_u/unconfined_u/' \ + "${S}/${i}/config/appconfig-${i}/seusers" \ + || die "policy seusers setup failed." + fi + done +} + +src_compile() { + [ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="targeted strict mls mcs" + + for i in ${POLICY_TYPES}; do + cd "${S}/${i}" || die + emake base + if use doc; then + emake html + fi + done +} + +src_install() { + [ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="targeted strict mls mcs" + + for i in ${POLICY_TYPES}; do + cd "${S}/${i}" || die + + emake DESTDIR="${D}" install \ + || die "${i} install failed." + + emake DESTDIR="${D}" install-headers \ + || die "${i} headers install failed." + + echo "run_init_t" > "${D}/etc/selinux/${i}/contexts/run_init_type" || die + + echo "textrel_shlib_t" >> "${D}/etc/selinux/${i}/contexts/customizable_types" || die + + # libsemanage won't make this on its own + keepdir "/etc/selinux/${i}/policy" + + if use doc; then + docinto ${i}/html + dodoc -r doc/html/*; + fi + + insinto /usr/share/selinux/devel; + doins doc/policy.xml; + + done + + docinto / + dodoc doc/Makefile.example doc/example.{te,fc,if} + + doman man/man8/*.8; + + insinto /etc/selinux + doins "${FILESDIR}/config" + + insinto /usr/share/portage/config/sets + doins "${FILESDIR}/selinux.conf" +} |