mirror of
https://github.com/fairyglade/ly.git
synced 2025-12-21 11:44:55 +00:00
Add basic spec file and selinux module source
This commit is contained in:
Leon Grünewald
1
selinux/ly.fc
Executable file
1
selinux/ly.fc
Executable file
@@ -0,0 +1 @@
|
||||
/usr/bin/ly -- gen_context(system_u:object_r:ly_exec_t,s0)
|
||||
40
selinux/ly.if
Executable file
40
selinux/ly.if
Executable file
@@ -0,0 +1,40 @@
|
||||
|
||||
## <summary>policy for ly</summary>
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute ly_exec_t in the ly domain.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed to transition.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`ly_domtrans',`
|
||||
gen_require(`
|
||||
type ly_t, ly_exec_t;
|
||||
')
|
||||
|
||||
corecmd_search_bin($1)
|
||||
domtrans_pattern($1, ly_exec_t, ly_t)
|
||||
')
|
||||
|
||||
######################################
|
||||
## <summary>
|
||||
## Execute ly in the caller domain.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`ly_exec',`
|
||||
gen_require(`
|
||||
type ly_exec_t;
|
||||
')
|
||||
|
||||
corecmd_search_bin($1)
|
||||
can_exec($1, ly_exec_t)
|
||||
')
|
||||
52
selinux/ly.sh
Executable file
52
selinux/ly.sh
Executable file
@@ -0,0 +1,52 @@
|
||||
#!/bin/sh -e
|
||||
|
||||
DIRNAME=`dirname $0`
|
||||
cd $DIRNAME
|
||||
USAGE="$0 [ --update ]"
|
||||
if [ `id -u` != 0 ]; then
|
||||
echo 'You must be root to run this script'
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ $# -eq 1 ]; then
|
||||
if [ "$1" = "--update" ] ; then
|
||||
time=`ls -l --time-style="+%x %X" ly.te | awk '{ printf "%s %s", $6, $7 }'`
|
||||
rules=`ausearch --start $time -m avc --raw -se ly`
|
||||
if [ x"$rules" != "x" ] ; then
|
||||
echo "Found avc's to update policy with"
|
||||
echo -e "$rules" | audit2allow -R
|
||||
echo "Do you want these changes added to policy [y/n]?"
|
||||
read ANS
|
||||
if [ "$ANS" = "y" -o "$ANS" = "Y" ] ; then
|
||||
echo "Updating policy"
|
||||
echo -e "$rules" | audit2allow -R >> ly.te
|
||||
# Fall though and rebuild policy
|
||||
else
|
||||
exit 0
|
||||
fi
|
||||
else
|
||||
echo "No new avcs found"
|
||||
exit 0
|
||||
fi
|
||||
else
|
||||
echo -e $USAGE
|
||||
exit 1
|
||||
fi
|
||||
elif [ $# -ge 2 ] ; then
|
||||
echo -e $USAGE
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Building and Loading Policy"
|
||||
set -x
|
||||
make -f /usr/share/selinux/devel/Makefile ly.pp || exit
|
||||
/usr/sbin/semodule -i ly.pp
|
||||
|
||||
# Generate a man page off the installed module
|
||||
sepolicy manpage -p . -d ly_t
|
||||
# Fixing the file context on /usr/bin/ly
|
||||
/sbin/restorecon -F -R -v /usr/bin/ly
|
||||
# Generate a rpm package for the newly generated policy
|
||||
|
||||
pwd=$(pwd)
|
||||
rpmbuild --define "_sourcedir ${pwd}" --define "_specdir ${pwd}" --define "_builddir ${pwd}" --define "_srcrpmdir ${pwd}" --define "_rpmdir ${pwd}" --define "_buildrootdir ${pwd}/.build" -ba ly_selinux.spec
|
||||
32
selinux/ly.te
Executable file
32
selinux/ly.te
Executable file
@@ -0,0 +1,32 @@
|
||||
policy_module(ly, 1.0.0)
|
||||
|
||||
########################################
|
||||
#
|
||||
# Declarations
|
||||
#
|
||||
|
||||
type ly_t;
|
||||
type ly_exec_t;
|
||||
init_daemon_domain(ly_t, ly_exec_t)
|
||||
|
||||
permissive ly_t;
|
||||
|
||||
########################################
|
||||
#
|
||||
# ly local policy
|
||||
#
|
||||
allow ly_t self:capability { setgid setuid };
|
||||
allow ly_t self:process { fork signal_perms };
|
||||
allow ly_t self:process transition;
|
||||
allow ly_t self:fifo_file rw_fifo_file_perms;
|
||||
allow ly_t self:unix_stream_socket create_stream_socket_perms;
|
||||
|
||||
domain_use_interactive_fds(ly_t)
|
||||
|
||||
files_read_etc_files(ly_t)
|
||||
|
||||
auth_use_nsswitch(ly_t)
|
||||
|
||||
logging_send_audit_msgs(ly_t)
|
||||
|
||||
miscfiles_read_localization(ly_t)
|
||||
70
selinux/ly_selinux.spec
Executable file
70
selinux/ly_selinux.spec
Executable file
@@ -0,0 +1,70 @@
|
||||
# vim: sw=4:ts=4:et
|
||||
|
||||
|
||||
%define relabel_files() \
|
||||
restorecon -R /usr/bin/ly; \
|
||||
|
||||
%define selinux_policyver 3.14.6-34
|
||||
|
||||
Name: ly_selinux
|
||||
Version: 1.0
|
||||
Release: 1%{?dist}
|
||||
Summary: SELinux policy module for ly
|
||||
|
||||
Group: System Environment/Base
|
||||
License: WTFPL
|
||||
# This is an example. You will need to change it.
|
||||
URL: https://github.com/nullgemm/ly
|
||||
Source0: ly.pp
|
||||
Source1: ly.if
|
||||
Source2: ly_selinux.8
|
||||
|
||||
|
||||
Requires: policycoreutils, libselinux-utils
|
||||
Requires(post): selinux-policy-base >= %{selinux_policyver}, policycoreutils
|
||||
Requires(postun): policycoreutils
|
||||
BuildArch: noarch
|
||||
|
||||
%description
|
||||
This package installs and sets up the SELinux policy security module for ly.
|
||||
|
||||
%install
|
||||
install -d %{buildroot}%{_datadir}/selinux/packages
|
||||
install -m 644 %{SOURCE0} %{buildroot}%{_datadir}/selinux/packages
|
||||
install -d %{buildroot}%{_datadir}/selinux/devel/include/contrib
|
||||
install -m 644 %{SOURCE1} %{buildroot}%{_datadir}/selinux/devel/include/contrib/
|
||||
install -d %{buildroot}%{_mandir}/man8/
|
||||
install -m 644 %{SOURCE2} %{buildroot}%{_mandir}/man8/ly_selinux.8
|
||||
install -d %{buildroot}/etc/selinux/targeted/contexts/users/
|
||||
|
||||
|
||||
%post
|
||||
semodule -n -i %{_datadir}/selinux/packages/ly.pp
|
||||
if /usr/sbin/selinuxenabled ; then
|
||||
/usr/sbin/load_policy
|
||||
%relabel_files
|
||||
|
||||
fi;
|
||||
exit 0
|
||||
|
||||
%postun
|
||||
if [ $1 -eq 0 ]; then
|
||||
semodule -n -r ly
|
||||
if /usr/sbin/selinuxenabled ; then
|
||||
/usr/sbin/load_policy
|
||||
%relabel_files
|
||||
|
||||
fi;
|
||||
fi;
|
||||
exit 0
|
||||
|
||||
%files
|
||||
%attr(0600,root,root) %{_datadir}/selinux/packages/ly.pp
|
||||
%{_datadir}/selinux/devel/include/contrib/ly.if
|
||||
%{_mandir}/man8/ly_selinux.8.*
|
||||
|
||||
|
||||
%changelog
|
||||
* Wed Feb 3 2021 YOUR NAME <YOUR@EMAILADDRESS> 1.0-1
|
||||
- Initial version
|
||||
|
||||
Reference in New Issue
Block a user