[gentoo-commits] proj/hardened-dev:master commit in: sec-policy/selinux-dhcp/, sec-policy/selinux-base/, sec-policy/selinux-clamav/, ...

[Sven Vermeulen]

commit:     c79cf001c99e55a498a841438929dd5317aef10a
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Thu Mar  1 20:29:07 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Thu Mar  1 20:29:07 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-dev.git;a=commit;h=c79cf001

Release of r4 patchset

---
 sec-policy/selinux-base-policy/ChangeLog           |    5 +
 .../selinux-base-policy-2.20120215-r4.ebuild       |  122 +++++++++++++++
 sec-policy/selinux-base/ChangeLog                  |    5 +
 .../selinux-base/selinux-base-2.20120215-r4.ebuild |  162 ++++++++++++++++++++
 sec-policy/selinux-clamav/ChangeLog                |    7 +-
 .../selinux-clamav-2.20120215-r1.ebuild            |   14 ++
 sec-policy/selinux-dhcp/ChangeLog                  |    5 +
 .../selinux-dhcp/selinux-dhcp-2.20120215-r1.ebuild |   14 ++
 sec-policy/selinux-gorg/ChangeLog                  |    5 +
 .../selinux-gorg/selinux-gorg-2.20120215-r1.ebuild |   13 ++
 sec-policy/selinux-mozilla/ChangeLog               |    5 +
 .../selinux-mozilla-2.20120215-r1.ebuild           |   13 ++
 12 files changed, 369 insertions(+), 1 deletions(-)

diff --git a/sec-policy/selinux-base-policy/ChangeLog b/sec-policy/selinux-base-policy/ChangeLog
index 1b0ab15..1a8074b 100644
--- a/sec-policy/selinux-base-policy/ChangeLog
+++ b/sec-policy/selinux-base-policy/ChangeLog
@@ -2,6 +2,11 @@
 # Copyright 1999-2012 Gentoo Foundation; Distributed under the GPL v2
 # $Header: $
 
+*selinux-base-policy-2.20120215-r4 (01 Mar 2012)
+
+  01 Mar 2012; <swift@g.o> +selinux-base-policy-2.20120215-r4.ebuild:
+  Increase to r4
+
 *selinux-base-policy-2.20120215-r3 (27 Feb 2012)
 
   27 Feb 2012; <swift@g.o> +selinux-base-policy-2.20120215-r3.ebuild:

diff --git a/sec-policy/selinux-base-policy/selinux-base-policy-2.20120215-r4.ebuild b/sec-policy/selinux-base-policy/selinux-base-policy-2.20120215-r4.ebuild
new file mode 100644
index 0000000..723ff58
--- /dev/null
+++ b/sec-policy/selinux-base-policy/selinux-base-policy-2.20120215-r4.ebuild
@@ -0,0 +1,122 @@
+# Copyright 1999-2012 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-dcc/selinux-dcc-2.20110726.ebuild,v 1.2 2011/10/23 12:42:45 swift Exp $
+EAPI="4"
+
+HOMEPAGE="http://www.gentoo.org/proj/en/hardened/selinux/"
+DESCRIPTION="SELinux policy for core modules"
+
+IUSE=""
+BASEPOL="2.20120215-r4"
+
+inherit eutils
+
+RDEPEND=">=sec-policy/selinux-base-2.20120215-r4"
+DEPEND=""
+SRC_URI="http://oss.tresys.com/files/refpolicy/refpolicy-${PV}.tar.bz2
+		http://dev.gentoo.org/~swift/patches/${PN}/patchbundle-${PN}-${BASEPOL}.tar.bz2"
+KEYWORDS="~amd64 ~x86"
+
+MODS="application authlogin bootloader clock consoletype cron dmesg fstools getty hostname hotplug init iptables libraries locallogin logging lvm miscfiles modutils mount mta netutils nscd portage raid rsync selinuxutil ssh staff storage su sysadm sysnetwork udev userdomain usermanage unprivuser xdg unconfined"
+LICENSE="GPL-2"
+SLOT="0"
+S="${WORKDIR}/"
+PATCHBUNDLE="${DISTDIR}/patchbundle-selinux-base-policy-${BASEPOL}.tar.bz2"
+
+# Code entirely copied from selinux-eclass (cannot inherit due to dependency on
+# itself), when reworked reinclude it. Only postinstall (where -b base.pp is
+# added) needs to remain then.
+
+src_prepare() {
+	local modfiles
+
+	# Patch the sources with the base patchbundle
+	if [[ -n ${BASEPOL} ]];
+	then
+		cd "${S}"
+		EPATCH_MULTI_MSG="Applying SELinux policy updates ... " \
+		EPATCH_SUFFIX="patch" \
+		EPATCH_SOURCE="${WORKDIR}" \
+		EPATCH_FORCE="yes" \
+		epatch
+	fi
+
+	# Apply the additional patches refered to by the module ebuild.
+	# But first some magic to differentiate between bash arrays and strings
+	if [[ "$(declare -p POLICY_PATCH 2>/dev/null 2>&1)" == "declare -a"* ]];
+	then
+		cd "${S}/refpolicy/policy/modules"
+		for POLPATCH in "${POLICY_PATCH[@]}";
+		do
+			epatch "${POLPATCH}"
+		done
+	else
+		if [[ -n ${POLICY_PATCH} ]];
+		then
+			cd "${S}/refpolicy/policy/modules"
+			for POLPATCH in ${POLICY_PATCH};
+			do
+				epatch "${POLPATCH}"
+			done
+		fi
+	fi
+
+	# Collect only those files needed for this particular module
+	for i in ${MODS}; do
+		modfiles="$(find ${S}/refpolicy/policy/modules -iname $i.te) $modfiles"
+		modfiles="$(find ${S}/refpolicy/policy/modules -iname $i.fc) $modfiles"
+	done
+
+	for i in ${POLICY_TYPES}; do
+		mkdir "${S}"/${i} || die "Failed to create directory ${S}/${i}"
+		cp "${S}"/refpolicy/doc/Makefile.example "${S}"/${i}/Makefile \
+			|| die "Failed to copy Makefile.example to ${S}/${i}/Makefile"
+
+		cp ${modfiles} "${S}"/${i} \
+			|| die "Failed to copy the module files to ${S}/${i}"
+	done
+}
+
+src_compile() {
+	for i in ${POLICY_TYPES}; do
+		# Parallel builds are broken, so we need to force -j1 here
+		emake -j1 NAME=$i -C "${S}"/${i} || die "${i} compile failed"
+	done
+}
+
+src_install() {
+	local BASEDIR="/usr/share/selinux"
+
+	for i in ${POLICY_TYPES}; do
+		for j in ${MODS}; do
+			einfo "Installing ${i} ${j} policy package"
+			insinto ${BASEDIR}/${i}
+			doins "${S}"/${i}/${j}.pp || die "Failed to add ${j}.pp to ${i}"
+		done
+	done
+}
+
+pkg_postinst() {
+	# Override the command from the eclass, we need to load in base as well here
+	local COMMAND
+	for i in ${MODS}; do
+		COMMAND="-i ${i}.pp ${COMMAND}"
+	done
+
+	for i in ${POLICY_TYPES}; do
+		local LOCCOMMAND
+		local LOCMODS
+		if [[ "${i}" != "targeted" ]]; then
+			LOCCOMMAND=$(echo "${COMMAND}" | sed -e 's:-i unconfined.pp::g');
+			LOCMODS=$(echo "${MODS}" | sed -e 's: unconfined::g');
+		else
+			LOCCOMMAND="${COMMAND}"
+			LOCMODS="${MODS}"
+		fi
+		einfo "Inserting the following modules, with base, into the $i module store: ${LOCMODS}"
+
+		cd /usr/share/selinux/${i} || die "Could not enter /usr/share/selinux/${i}"
+
+		semodule -s ${i} -b base.pp ${LOCCOMMAND} || die "Failed to load in base and modules ${LOCMODS} in the $i policy store"
+	done
+}

diff --git a/sec-policy/selinux-base/ChangeLog b/sec-policy/selinux-base/ChangeLog
index 4b9e30c..bb0bb58 100644
--- a/sec-policy/selinux-base/ChangeLog
+++ b/sec-policy/selinux-base/ChangeLog
@@ -2,6 +2,11 @@
 # Copyright 1999-2012 Gentoo Foundation; Distributed under the GPL v2
 # $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-base-policy/ChangeLog,v 1.95 2012/01/29 13:08:48 swift Exp $
 
+*selinux-base-2.20120215-r4 (01 Mar 2012)
+
+  01 Mar 2012; <swift@g.o> +selinux-base-2.20120215-r4.ebuild:
+  Increase to r4
+
 *selinux-base-2.20120215-r3 (27 Feb 2012)
 
   27 Feb 2012; <swift@g.o> +selinux-base-2.20120215-r3.ebuild:

diff --git a/sec-policy/selinux-base/selinux-base-2.20120215-r4.ebuild b/sec-policy/selinux-base/selinux-base-2.20120215-r4.ebuild
new file mode 100644
index 0000000..866e80f
--- /dev/null
+++ b/sec-policy/selinux-base/selinux-base-2.20120215-r4.ebuild
@@ -0,0 +1,162 @@
+# Copyright 1999-2012 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-base-policy/selinux-base-policy-2.20110726-r13.ebuild,v 1.1 2012/02/23 18:17:40 swift Exp $
+
+EAPI="4"
+IUSE="+peer_perms +open_perms +ubac doc"
+
+inherit eutils
+
+DESCRIPTION="Gentoo base policy for SELinux"
+HOMEPAGE="http://www.gentoo.org/proj/en/hardened/selinux/"
+SRC_URI="http://oss.tresys.com/files/refpolicy/refpolicy-${PV}.tar.bz2
+	http://dev.gentoo.org/~swift/patches/selinux-base-policy/patchbundle-selinux-base-policy-${PVR}.tar.bz2"
+LICENSE="GPL-2"
+SLOT="0"
+
+KEYWORDS="~amd64 ~x86"
+
+RDEPEND=">=sys-apps/policycoreutils-2.1.10
+	>=sys-fs/udev-151
+	!<=sec-policy/selinux-base-policy-2.20120215"
+DEPEND="${RDEPEND}
+	sys-devel/m4
+	>=sys-apps/checkpolicy-2.1.8"
+
+S=${WORKDIR}/
+
+src_prepare() {
+	# Apply the gentoo patches to the policy. These patches are only necessary
+	# for base policies, or for interface changes on modules.
+	EPATCH_MULTI_MSG="Applying SELinux policy updates ... " \
+	EPATCH_SUFFIX="patch" \
+	EPATCH_SOURCE="${WORKDIR}" \
+	EPATCH_FORCE="yes" \
+	epatch
+
+	cd "${S}/refpolicy"
+	# Fix bug 257111 - Correct the initial sid for cron-started jobs in the
+	# system_r role
+	sed -i -e 's:system_crond_t:system_cronjob_t:g' \
+		"${S}/refpolicy/config/appconfig-standard/default_contexts"
+	sed -i -e 's|system_r:cronjob_t|system_r:system_cronjob_t|g' \
+		"${S}/refpolicy/config/appconfig-mls/default_contexts"
+	sed -i -e 's|system_r:cronjob_t|system_r:system_cronjob_t|g' \
+		"${S}/refpolicy/config/appconfig-mcs/default_contexts"
+}
+
+src_configure() {
+	[ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="targeted strict mls mcs"
+
+	# Update the SELinux refpolicy capabilities based on the users' USE flags.
+
+	if ! use peer_perms; then
+		sed -i -e '/network_peer_controls/d' \
+			"${S}/refpolicy/policy/policy_capabilities"
+	fi
+
+	if ! use open_perms; then
+		sed -i -e '/open_perms/d' \
+			"${S}/refpolicy/policy/policy_capabilities"
+	fi
+
+	if ! use ubac; then
+		sed -i -e '/^UBAC/s/y/n/' "${S}/refpolicy/build.conf" \
+			|| die "Failed to disable User Based Access Control"
+	fi
+
+	echo "DISTRO = gentoo" >> "${S}/refpolicy/build.conf"
+
+	# Setup the policies based on the types delivered by the end user.
+	# These types can be "targeted", "strict", "mcs" and "mls".
+	for i in ${POLICY_TYPES}; do
+		cp -a "${S}/refpolicy" "${S}/${i}"
+
+		cd "${S}/${i}";
+		make conf || die "Make conf in ${i} failed"
+
+		#cp "${FILESDIR}/modules-2.20120215.conf" "${S}/${i}/policy/modules.conf"
+		sed -i -e "/= module/d" "${S}/${i}/policy/modules.conf"
+
+		sed -i -e '/^QUIET/s/n/y/' -e "/^NAME/s/refpolicy/$i/" \
+			"${S}/${i}/build.conf" || die "build.conf setup failed."
+
+		if [[ "${i}" == "mls" ]] || [[ "${i}" == "mcs" ]];
+		then
+			# MCS/MLS require additional settings
+			sed -i -e "/^TYPE/s/standard/${i}/" "${S}/${i}/build.conf" \
+				|| die "failed to set type to mls"
+		fi
+
+		if [ "${i}" == "targeted" ]; then
+			sed -i -e '/root/d' -e 's/user_u/unconfined_u/' \
+			"${S}/${i}/config/appconfig-standard/seusers" \
+			|| die "targeted seusers setup failed."
+		fi
+	done
+}
+
+src_compile() {
+	[ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="targeted strict mls mcs"
+
+	for i in ${POLICY_TYPES}; do
+		cd "${S}/${i}"
+		make base || die "${i} compile failed"
+		if use doc; then
+			make html || die
+		fi
+	done
+}
+
+src_install() {
+	[ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="targeted strict mls mcs"
+
+	for i in ${POLICY_TYPES}; do
+		cd "${S}/${i}"
+
+		make DESTDIR="${D}" install \
+			|| die "${i} install failed."
+
+		make DESTDIR="${D}" install-headers \
+			|| die "${i} headers install failed."
+
+		echo "run_init_t" > "${D}/etc/selinux/${i}/contexts/run_init_type"
+
+		echo "textrel_shlib_t" >> "${D}/etc/selinux/${i}/contexts/customizable_types"
+
+		# libsemanage won't make this on its own
+		keepdir "/etc/selinux/${i}/policy"
+
+		if use doc; then
+			dohtml doc/html/*;
+		fi
+	done
+
+	dodoc doc/Makefile.example doc/example.{te,fc,if}
+
+	insinto /etc/selinux
+	doins "${FILESDIR}/config"
+}
+
+pkg_preinst() {
+	has_version "<${CATEGORY}/${PN}-2.20101213-r13"
+	previous_less_than_r13=$?
+}
+
+pkg_postinst() {
+	[ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="targeted strict mls mcs"
+
+	for i in ${POLICY_TYPES}; do
+		einfo "Trying to insert base module into ${i} module store."
+
+		cd "${ROOT}/usr/share/selinux/${i}"
+		semodule -s "${i}" -b base.pp
+		if [[ $? -ne 0 ]]; then
+			ewarn "Base policy failed loading. However, this can be ignored if"
+			ewarn "you still have to install (or update) selinux-core."
+		fi
+	done
+	elog "Updates on policies might require you to relabel files. If you, after"
+	elog "installing new SELinux policies, get 'permission denied' errors,"
+	elog "relabelling your system using 'rlpkg -a -r' might resolve the issues."
+}

diff --git a/sec-policy/selinux-clamav/ChangeLog b/sec-policy/selinux-clamav/ChangeLog
index fddea88..39f7574 100644
--- a/sec-policy/selinux-clamav/ChangeLog
+++ b/sec-policy/selinux-clamav/ChangeLog
@@ -1,7 +1,12 @@
 # ChangeLog for sec-policy/selinux-clamav
-# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
+# Copyright 1999-2012 Gentoo Foundation; Distributed under the GPL v2
 # $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-clamav/ChangeLog,v 1.28 2011/11/12 20:53:29 swift Exp $
 
+*selinux-clamav-2.20120215-r1 (01 Mar 2012)
+
+  01 Mar 2012; <swift@g.o> +selinux-clamav-2.20120215-r1.ebuild:
+  Correct type def
+
   12 Nov 2011; <swift@g.o> -selinux-clamav-2.20101213.ebuild:
   Removing old policies
 

diff --git a/sec-policy/selinux-clamav/selinux-clamav-2.20120215-r1.ebuild b/sec-policy/selinux-clamav/selinux-clamav-2.20120215-r1.ebuild
new file mode 100644
index 0000000..daeadfd
--- /dev/null
+++ b/sec-policy/selinux-clamav/selinux-clamav-2.20120215-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2012 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-clamav/selinux-clamav-2.20110726.ebuild,v 1.2 2011/10/23 12:42:29 swift Exp $
+EAPI="4"
+
+IUSE=""
+MODS="clamav"
+BASEPOL="2.20120215-r4"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for clamav"
+
+KEYWORDS="~amd64 ~x86"

diff --git a/sec-policy/selinux-dhcp/ChangeLog b/sec-policy/selinux-dhcp/ChangeLog
index 45e37fc..d015cb6 100644
--- a/sec-policy/selinux-dhcp/ChangeLog
+++ b/sec-policy/selinux-dhcp/ChangeLog
@@ -2,6 +2,11 @@
 # Copyright 1999-2012 Gentoo Foundation; Distributed under the GPL v2
 # $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-dhcp/ChangeLog,v 1.40 2012/01/29 13:08:48 swift Exp $
 
+*selinux-dhcp-2.20120215-r1 (01 Mar 2012)
+
+  01 Mar 2012; <swift@g.o> +selinux-dhcp-2.20120215-r1.ebuild:
+  Update patch on LDAP backend support
+
   29 Jan 2012;  <swift@g.o> Manifest:
   Updating manifest
 

diff --git a/sec-policy/selinux-dhcp/selinux-dhcp-2.20120215-r1.ebuild b/sec-policy/selinux-dhcp/selinux-dhcp-2.20120215-r1.ebuild
new file mode 100644
index 0000000..bdc2d0a
--- /dev/null
+++ b/sec-policy/selinux-dhcp/selinux-dhcp-2.20120215-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2012 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-dhcp/selinux-dhcp-2.20110726.ebuild,v 1.2 2011/10/23 12:42:44 swift Exp $
+EAPI="4"
+
+IUSE=""
+MODS="dhcp"
+BASEPOL="2.20120215-r4"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for dhcp"
+
+KEYWORDS="~amd64 ~x86"

diff --git a/sec-policy/selinux-gorg/ChangeLog b/sec-policy/selinux-gorg/ChangeLog
index 1f45a25..12b90ec 100644
--- a/sec-policy/selinux-gorg/ChangeLog
+++ b/sec-policy/selinux-gorg/ChangeLog
@@ -2,6 +2,11 @@
 # Copyright 1999-2012 Gentoo Foundation; Distributed under the GPL v2
 # $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-gorg/ChangeLog,v 1.8 2012/01/29 13:08:48 swift Exp $
 
+*selinux-gorg-2.20120215-r1 (01 Mar 2012)
+
+  01 Mar 2012; <swift@g.o> +selinux-gorg-2.20120215-r1.ebuild:
+  Update on gorg, allow to signal itself
+
   29 Jan 2012;  <swift@g.o> Manifest:
   Updating manifest
 

diff --git a/sec-policy/selinux-gorg/selinux-gorg-2.20120215-r1.ebuild b/sec-policy/selinux-gorg/selinux-gorg-2.20120215-r1.ebuild
new file mode 100644
index 0000000..f78397b
--- /dev/null
+++ b/sec-policy/selinux-gorg/selinux-gorg-2.20120215-r1.ebuild
@@ -0,0 +1,13 @@
+# Copyright 1999-2012 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-gorg/selinux-gorg-2.20110726.ebuild,v 1.2 2011/10/23 12:42:55 swift Exp $
+EAPI="4"
+
+IUSE=""
+MODS="gorg"
+BASEPOL="2.20120215-r4"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for gorg"
+KEYWORDS="~amd64 ~x86"

diff --git a/sec-policy/selinux-mozilla/ChangeLog b/sec-policy/selinux-mozilla/ChangeLog
index 29cd815..256b133 100644
--- a/sec-policy/selinux-mozilla/ChangeLog
+++ b/sec-policy/selinux-mozilla/ChangeLog
@@ -2,6 +2,11 @@
 # Copyright 1999-2012 Gentoo Foundation; Distributed under the GPL v2
 # $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-mozilla/ChangeLog,v 1.16 2012/01/29 13:08:49 swift Exp $
 
+*selinux-mozilla-2.20120215-r1 (01 Mar 2012)
+
+  01 Mar 2012; <swift@g.o> +selinux-mozilla-2.20120215-r1.ebuild:
+  Allow mozilla_plugin_t to be used by suers
+
   29 Jan 2012;  <swift@g.o> Manifest:
   Updating manifest
 

diff --git a/sec-policy/selinux-mozilla/selinux-mozilla-2.20120215-r1.ebuild b/sec-policy/selinux-mozilla/selinux-mozilla-2.20120215-r1.ebuild
new file mode 100644
index 0000000..158e37a
--- /dev/null
+++ b/sec-policy/selinux-mozilla/selinux-mozilla-2.20120215-r1.ebuild
@@ -0,0 +1,13 @@
+# Copyright 1999-2012 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-mozilla/selinux-mozilla-2.20110726-r5.ebuild,v 1.1 2012/01/14 19:59:59 swift Exp $
+EAPI="4"
+
+IUSE=""
+MODS="mozilla"
+BASEPOL="2.20120215-r4"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for mozilla"
+KEYWORDS="~amd64 ~x86"