From 6e3f05e35f9870415670b5e3f0907786dea04f50 Mon Sep 17 00:00:00 2001 From: Sven Vermeulen Date: Sat, 17 Sep 2011 16:20:17 +0000 Subject: Bump policies to basepol rev 4 (Portage version: 2.1.10.11/cvs/Linux x86_64) --- sec-policy/selinux-base-policy/ChangeLog | 8 +- .../selinux-base-policy-2.20110726-r4.ebuild | 166 +++++++++++++++++++++ sec-policy/selinux-gpg/ChangeLog | 7 +- .../selinux-gpg/selinux-gpg-2.20110726-r2.ebuild | 13 ++ sec-policy/selinux-mozilla/ChangeLog | 7 +- .../selinux-mozilla-2.20110726-r2.ebuild | 13 ++ sec-policy/selinux-mutt/ChangeLog | 7 +- .../selinux-mutt/selinux-mutt-2.20110726-r2.ebuild | 13 ++ sec-policy/selinux-puppet/ChangeLog | 8 +- .../selinux-puppet-2.20110726-r2.ebuild | 13 ++ sec-policy/selinux-wireshark/ChangeLog | 9 +- .../selinux-wireshark-2.20110726-r2.ebuild | 13 ++ 12 files changed, 271 insertions(+), 6 deletions(-) create mode 100644 sec-policy/selinux-base-policy/selinux-base-policy-2.20110726-r4.ebuild create mode 100644 sec-policy/selinux-gpg/selinux-gpg-2.20110726-r2.ebuild create mode 100644 sec-policy/selinux-mozilla/selinux-mozilla-2.20110726-r2.ebuild create mode 100644 sec-policy/selinux-mutt/selinux-mutt-2.20110726-r2.ebuild create mode 100644 sec-policy/selinux-puppet/selinux-puppet-2.20110726-r2.ebuild create mode 100644 sec-policy/selinux-wireshark/selinux-wireshark-2.20110726-r2.ebuild (limited to 'sec-policy') diff --git a/sec-policy/selinux-base-policy/ChangeLog b/sec-policy/selinux-base-policy/ChangeLog index a4015e448197..5e5ea0a570f4 100644 --- a/sec-policy/selinux-base-policy/ChangeLog +++ b/sec-policy/selinux-base-policy/ChangeLog @@ -1,6 +1,12 @@ # ChangeLog for sec-policy/selinux-base-policy # Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-base-policy/ChangeLog,v 1.83 2011/08/28 21:12:32 swift Exp $ +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-base-policy/ChangeLog,v 1.84 2011/09/17 16:20:17 swift Exp $ + +*selinux-base-policy-2.20110726-r4 (17 Sep 2011) + + 17 Sep 2011; +selinux-base-policy-2.20110726-r4.ebuild: + Update on portage and portage_fetch domains, fix puppet issues, normalize + patches with refpolicy *selinux-base-policy-2.20110726-r3 (28 Aug 2011) diff --git a/sec-policy/selinux-base-policy/selinux-base-policy-2.20110726-r4.ebuild b/sec-policy/selinux-base-policy/selinux-base-policy-2.20110726-r4.ebuild new file mode 100644 index 000000000000..fcf7a4d0666e --- /dev/null +++ b/sec-policy/selinux-base-policy/selinux-base-policy-2.20110726-r4.ebuild @@ -0,0 +1,166 @@ +# Copyright 1999-2011 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-base-policy/selinux-base-policy-2.20110726-r4.ebuild,v 1.1 2011/09/17 16:20:17 swift Exp $ + +EAPI="4" +IUSE="+peer_perms +open_perms +ubac doc" + +inherit eutils + +DESCRIPTION="Gentoo base policy for SELinux" +HOMEPAGE="http://www.gentoo.org/proj/en/hardened/selinux/" +SRC_URI="http://oss.tresys.com/files/refpolicy/refpolicy-${PV}.tar.bz2 + http://dev.gentoo.org/~swift/patches/${PN}/patchbundle-${PF}.tar.bz2" +LICENSE="GPL-2" +SLOT="0" + +KEYWORDS="~amd64 ~x86" + +RDEPEND=">=sys-apps/policycoreutils-1.30.30 + >=sys-fs/udev-151" +DEPEND="${RDEPEND} + sys-devel/m4 + >=sys-apps/checkpolicy-1.30.12" + +S=${WORKDIR}/ + +src_prepare() { + # Apply the gentoo patches to the policy. These patches are only necessary + # for base policies, or for interface changes on modules. + EPATCH_MULTI_MSG="Applying SELinux policy updates ... " \ + EPATCH_SUFFIX="patch" \ + EPATCH_SOURCE="${WORKDIR}" \ + EPATCH_FORCE="yes" \ + epatch + + cd "${S}/refpolicy" + # Fix bug 257111 - Correct the initial sid for cron-started jobs in the + # system_r role + sed -i -e 's:system_crond_t:system_cronjob_t:g' \ + "${S}/refpolicy/config/appconfig-standard/default_contexts" + sed -i -e 's|system_r:cronjob_t|system_r:system_cronjob_t|g' \ + "${S}/refpolicy/config/appconfig-mls/default_contexts" + sed -i -e 's|system_r:cronjob_t|system_r:system_cronjob_t|g' \ + "${S}/refpolicy/config/appconfig-mcs/default_contexts" +} + +src_configure() { + [ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="targeted strict mls mcs" + + # Update the SELinux refpolicy capabilities based on the users' USE flags. + + if ! use peer_perms; then + sed -i -e '/network_peer_controls/d' \ + "${S}/refpolicy/policy/policy_capabilities" + fi + + if ! use open_perms; then + sed -i -e '/open_perms/d' \ + "${S}/refpolicy/policy/policy_capabilities" + fi + + if ! use ubac; then + sed -i -e '/^UBAC/s/y/n/' "${S}/refpolicy/build.conf" \ + || die "Failed to disable User Based Access Control" + fi + + echo "DISTRO = gentoo" >> "${S}/refpolicy/build.conf" + + # Setup the policies based on the types delivered by the end user. + # These types can be "targeted", "strict", "mcs" and "mls". + for i in ${POLICY_TYPES}; do + cp -a "${S}/refpolicy" "${S}/${i}" + + cd "${S}/${i}"; + make conf || die "Make conf in ${i} failed" + + # Define what we see as "base" and what we want to remain modular. + cp "${FILESDIR}/modules.conf" \ + "${S}/${i}/policy/modules.conf" \ + || die "failed to set up modules.conf" + # In case of "targeted", we add the "unconfined" to the base policy + if [[ "${i}" == "targeted" ]]; + then + echo "unconfined = base" >> "${S}/${i}/policy/modules.conf" + fi + # Add xdg support + echo "xdg = base" >> "${S}/${i}/policy/modules.conf" + + sed -i -e '/^QUIET/s/n/y/' -e "/^NAME/s/refpolicy/$i/" \ + "${S}/${i}/build.conf" || die "build.conf setup failed." + + if [[ "${i}" == "mls" ]] || [[ "${i}" == "mcs" ]]; + then + # MCS/MLS require additional settings + sed -i -e "/^TYPE/s/standard/${i}/" "${S}/${i}/build.conf" \ + || die "failed to set type to mls" + fi + + if [ "${i}" == "targeted" ]; then + sed -i -e '/root/d' -e 's/user_u/unconfined_u/' \ + "${S}/${i}/config/appconfig-standard/seusers" \ + || die "targeted seusers setup failed." + fi + done +} + +src_compile() { + [ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="targeted strict mls mcs" + + for i in ${POLICY_TYPES}; do + cd "${S}/${i}" + make base || die "${i} compile failed" + if use doc; then + make html || die + fi + done +} + +src_install() { + [ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="targeted strict mls mcs" + + for i in ${POLICY_TYPES}; do + cd "${S}/${i}" + + make DESTDIR="${D}" install \ + || die "${i} install failed." + + make DESTDIR="${D}" install-headers \ + || die "${i} headers install failed." + + echo "run_init_t" > "${D}/etc/selinux/${i}/contexts/run_init_type" + + echo "textrel_shlib_t" >> "${D}/etc/selinux/${i}/contexts/customizable_types" + + # libsemanage won't make this on its own + keepdir "/etc/selinux/${i}/policy" + + if use doc; then + dohtml doc/html/*; + fi + done + + dodoc doc/Makefile.example doc/example.{te,fc,if} + + insinto /etc/selinux + doins "${FILESDIR}/config" +} + +pkg_preinst() { + has_version "<${CATEGORY}/${PN}-2.20101213-r13" + previous_less_than_r13=$? +} + +pkg_postinst() { + [ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="targeted strict mls mcs" + + for i in ${POLICY_TYPES}; do + einfo "Inserting base module into ${i} module store." + + cd "${ROOT}/usr/share/selinux/${i}" + semodule -s "${i}" -b base.pp || die "Could not load in new base policy" + done + elog "Updates on policies might require you to relabel files. If you, after" + elog "installing new SELinux policies, get 'permission denied' errors," + elog "relabelling your system using 'rlpkg -a -r' might resolve the issues." +} diff --git a/sec-policy/selinux-gpg/ChangeLog b/sec-policy/selinux-gpg/ChangeLog index c21a79e8e567..557acf62b3df 100644 --- a/sec-policy/selinux-gpg/ChangeLog +++ b/sec-policy/selinux-gpg/ChangeLog @@ -1,6 +1,11 @@ # ChangeLog for sec-policy/selinux-gpg # Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-gpg/ChangeLog,v 1.3 2011/09/09 18:38:24 swift Exp $ +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-gpg/ChangeLog,v 1.4 2011/09/17 16:20:16 swift Exp $ + +*selinux-gpg-2.20110726-r2 (17 Sep 2011) + + 17 Sep 2011; +selinux-gpg-2.20110726-r2.ebuild: + Add gpg_exec interface, used by portage domain (signed tree support) 09 Sep 2011; +files/0021-gpg-fix-mutt-call-r4.patch, selinux-gpg-2.20110726-r1.ebuild: diff --git a/sec-policy/selinux-gpg/selinux-gpg-2.20110726-r2.ebuild b/sec-policy/selinux-gpg/selinux-gpg-2.20110726-r2.ebuild new file mode 100644 index 000000000000..69d38ea8cb16 --- /dev/null +++ b/sec-policy/selinux-gpg/selinux-gpg-2.20110726-r2.ebuild @@ -0,0 +1,13 @@ +# Copyright 1999-2011 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-gpg/selinux-gpg-2.20110726-r2.ebuild,v 1.1 2011/09/17 16:20:16 swift Exp $ +EAPI="4" + +IUSE="" +MODS="gpg" +BASEPOL="2.20110726-r4" + +inherit selinux-policy-2 + +DESCRIPTION="SELinux policy for GnuPG" +KEYWORDS="~amd64 ~x86" diff --git a/sec-policy/selinux-mozilla/ChangeLog b/sec-policy/selinux-mozilla/ChangeLog index 97d77905f502..f642340f4958 100644 --- a/sec-policy/selinux-mozilla/ChangeLog +++ b/sec-policy/selinux-mozilla/ChangeLog @@ -1,6 +1,11 @@ # ChangeLog for sec-policy/selinux-mozilla # Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-mozilla/ChangeLog,v 1.7 2011/08/28 21:12:42 swift Exp $ +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-mozilla/ChangeLog,v 1.8 2011/09/17 16:20:16 swift Exp $ + +*selinux-mozilla-2.20110726-r2 (17 Sep 2011) + + 17 Sep 2011; +selinux-mozilla-2.20110726-r2.ebuild: + Add support for XDG types *selinux-mozilla-2.20110726-r1 (28 Aug 2011) diff --git a/sec-policy/selinux-mozilla/selinux-mozilla-2.20110726-r2.ebuild b/sec-policy/selinux-mozilla/selinux-mozilla-2.20110726-r2.ebuild new file mode 100644 index 000000000000..bb4276e1391d --- /dev/null +++ b/sec-policy/selinux-mozilla/selinux-mozilla-2.20110726-r2.ebuild @@ -0,0 +1,13 @@ +# Copyright 1999-2011 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-mozilla/selinux-mozilla-2.20110726-r2.ebuild,v 1.1 2011/09/17 16:20:16 swift Exp $ +EAPI="4" + +IUSE="" +MODS="mozilla" +BASEPOL="2.20110726-r4" + +inherit selinux-policy-2 + +DESCRIPTION="SELinux policy for mozilla" +KEYWORDS="~amd64 ~x86" diff --git a/sec-policy/selinux-mutt/ChangeLog b/sec-policy/selinux-mutt/ChangeLog index 3df1850602a5..0916fec679e9 100644 --- a/sec-policy/selinux-mutt/ChangeLog +++ b/sec-policy/selinux-mutt/ChangeLog @@ -1,6 +1,11 @@ # ChangeLog for sec-policy/selinux-mutt # Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-mutt/ChangeLog,v 1.5 2011/08/28 21:12:36 swift Exp $ +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-mutt/ChangeLog,v 1.6 2011/09/17 16:20:16 swift Exp $ + +*selinux-mutt-2.20110726-r2 (17 Sep 2011) + + 17 Sep 2011; +selinux-mutt-2.20110726-r2.ebuild: + Fix support for gpg signing *selinux-mutt-2.20110726-r1 (28 Aug 2011) diff --git a/sec-policy/selinux-mutt/selinux-mutt-2.20110726-r2.ebuild b/sec-policy/selinux-mutt/selinux-mutt-2.20110726-r2.ebuild new file mode 100644 index 000000000000..c9578d03ab58 --- /dev/null +++ b/sec-policy/selinux-mutt/selinux-mutt-2.20110726-r2.ebuild @@ -0,0 +1,13 @@ +# Copyright 1999-2011 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-mutt/selinux-mutt-2.20110726-r2.ebuild,v 1.1 2011/09/17 16:20:16 swift Exp $ +EAPI="4" + +IUSE="" +MODS="mutt" +BASEPOL="2.20110726-r4" + +inherit selinux-policy-2 + +DESCRIPTION="SELinux policy for mutt" +KEYWORDS="~amd64 ~x86" diff --git a/sec-policy/selinux-puppet/ChangeLog b/sec-policy/selinux-puppet/ChangeLog index 36b628165932..466bbb1476a2 100644 --- a/sec-policy/selinux-puppet/ChangeLog +++ b/sec-policy/selinux-puppet/ChangeLog @@ -1,6 +1,12 @@ # ChangeLog for sec-policy/selinux-puppet # Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-puppet/ChangeLog,v 1.4 2011/08/28 21:13:11 swift Exp $ +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-puppet/ChangeLog,v 1.5 2011/09/17 16:20:16 swift Exp $ + +*selinux-puppet-2.20110726-r2 (17 Sep 2011) + + 17 Sep 2011; +selinux-puppet-2.20110726-r2.ebuild: + Fix the calls towards the portage domains, include support for the + portage_fetch_t domain *selinux-puppet-2.20110726-r1 (28 Aug 2011) diff --git a/sec-policy/selinux-puppet/selinux-puppet-2.20110726-r2.ebuild b/sec-policy/selinux-puppet/selinux-puppet-2.20110726-r2.ebuild new file mode 100644 index 000000000000..f113f224feb8 --- /dev/null +++ b/sec-policy/selinux-puppet/selinux-puppet-2.20110726-r2.ebuild @@ -0,0 +1,13 @@ +# Copyright 1999-2011 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-puppet/selinux-puppet-2.20110726-r2.ebuild,v 1.1 2011/09/17 16:20:16 swift Exp $ +EAPI="4" + +IUSE="" +MODS="puppet" +BASEPOL="2.20110726-r4" + +inherit selinux-policy-2 + +DESCRIPTION="SELinux policy for puppet" +KEYWORDS="~amd64 ~x86" diff --git a/sec-policy/selinux-wireshark/ChangeLog b/sec-policy/selinux-wireshark/ChangeLog index a3057a5c9544..b6bc97d4e15c 100644 --- a/sec-policy/selinux-wireshark/ChangeLog +++ b/sec-policy/selinux-wireshark/ChangeLog @@ -1,6 +1,13 @@ # ChangeLog for sec-policy/selinux-wireshark # Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-wireshark/ChangeLog,v 1.13 2011/08/28 21:12:38 swift Exp $ +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-wireshark/ChangeLog,v 1.14 2011/09/17 16:20:16 swift Exp $ + +*selinux-wireshark-2.20110726-r2 (17 Sep 2011) + + 17 Sep 2011; +selinux-wireshark-2.20110726-r2.ebuild: + Drop the libffi hack that we introduced (to get it to work now, build with + USE without python) as it introduces a potential security risk. Other patches + have been rewritten and accepted by refpolicy. *selinux-wireshark-2.20110726-r1 (28 Aug 2011) diff --git a/sec-policy/selinux-wireshark/selinux-wireshark-2.20110726-r2.ebuild b/sec-policy/selinux-wireshark/selinux-wireshark-2.20110726-r2.ebuild new file mode 100644 index 000000000000..db6a429f0d29 --- /dev/null +++ b/sec-policy/selinux-wireshark/selinux-wireshark-2.20110726-r2.ebuild @@ -0,0 +1,13 @@ +# Copyright 1999-2011 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-wireshark/selinux-wireshark-2.20110726-r2.ebuild,v 1.1 2011/09/17 16:20:16 swift Exp $ +EAPI="4" + +IUSE="" +MODS="wireshark" +BASEPOL="2.20110726-r4" + +inherit selinux-policy-2 + +DESCRIPTION="SELinux policy for wireshark" +KEYWORDS="~amd64 ~x86" -- cgit v1.2.3-65-gdbad