d96e8c3c99
- update to AppArmor 2.7.0 rc1
- aa-notify: add --display option and warn if $DISPLAY is not set
(important for usage with sudo on openSUSE)
- fix syntax error on "rcapparmor stop"
- allow read access to /proc/*/mounts in the dovecot profile
OBS-URL: https://build.opensuse.org/request/show/87773
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/apparmor?expand=0&rev=25
802 lines
22 KiB
RPMSpec
802 lines
22 KiB
RPMSpec
#
|
|
# spec file for package apparmor
|
|
#
|
|
# Copyright (c) 2011 SUSE LINUX Products GmbH, Nuernberg, Germany.
|
|
#
|
|
# All modifications and additions to the file contributed by third parties
|
|
# remain the property of their copyright owners, unless otherwise agreed
|
|
# upon. The license for this file, and modifications and additions to the
|
|
# file, is the same license as for the pristine package itself (unless the
|
|
# license for the pristine package is not an Open Source License, in which
|
|
# case the license is the MIT License). An "Open Source License" is a
|
|
# license that conforms to the Open Source Definition (Version 1.9)
|
|
# published by the Open Source Initiative.
|
|
|
|
# Please submit bugfixes or comments via http://bugs.opensuse.org/
|
|
#
|
|
|
|
|
|
%bcond_with tomcat
|
|
%bcond_without pam
|
|
%bcond_without apache
|
|
%bcond_with python
|
|
%bcond_with ruby
|
|
%bcond_with gnome
|
|
%bcond_with dbus
|
|
%bcond_with editor
|
|
|
|
%define CATALINA_HOME /usr/share/tomcat6
|
|
%define APPARMOR_DOC_DIR /usr/share/doc/packages/apparmor-docs/
|
|
%define JNI_SO libJNIChangeHat.so
|
|
%define JAR_FILE changeHatValve.jar
|
|
%define apache_module_path %(/usr/sbin/apxs2 -q LIBEXECDIR)
|
|
|
|
Name: apparmor
|
|
%if ! %{?distro:1}0
|
|
%if %{?suse_version:1}0
|
|
%define distro suse
|
|
%endif
|
|
%if %{?fedora_version:1}0
|
|
%define distro redhat
|
|
%endif
|
|
%endif
|
|
%if ! %{?distro:1}0
|
|
%define distro suse
|
|
%endif
|
|
Version: 2.7.rc1
|
|
Release: 1
|
|
%define versiondir 2.7.0~rc1
|
|
Summary: AppArmor userlevel parser utility
|
|
Group: Productivity/Networking/Security
|
|
Source0: apparmor-%{version}.tar.gz
|
|
Source1: %{name}-profile-editor.png
|
|
Source2: %{name}-profile-editor.desktop
|
|
Source3: update-trans.sh
|
|
|
|
# enable caching of profiles (= massive performance speedup when loading profiles)
|
|
Patch1: apparmor-enable-profile-cache.diff
|
|
|
|
# split a long string in AppArmor.pm. Not accepted upstream because they want a solution without hardcoded width.
|
|
Patch5: apparmor-utils-string-split
|
|
|
|
# use autobuild everywhere. Patch applies to 2.6.1 only and probably won't be accepted upstream.
|
|
Patch10: apparmor-2.5.1-unified-build
|
|
# requires Patch10
|
|
Patch11: apparmor-2.5.1-rpmlint-asprintf
|
|
|
|
# Add support for eDirectory calls in abstractions/nameservice. Not accepted upstream (yet) because of open questions
|
|
Patch12: apparmor-2.5.1-edirectory-profile
|
|
# split ldap related things from abstractions/nameservice to abstractions/ldapclient and add sasl support. TODO: send upstream
|
|
Patch13: apparmor-2.5.1-ldapclient-profile
|
|
|
|
# obsolete, upstream implemented this in another way
|
|
Patch15: apparmor-remove-repo
|
|
|
|
# remove after 12.1 release - bnc#720617 #c7
|
|
Patch21: apparmor-utils-subdomain-compat
|
|
|
|
License: GPLv2+
|
|
Url: https://launchpad.net/apparmor
|
|
PreReq: sed
|
|
BuildRoot: %{_tmppath}/%{name}-%{version}-build
|
|
%if %{distro} == "suse"
|
|
PreReq: %{insserv_prereq}
|
|
PreReq: aaa_base
|
|
%endif
|
|
%define apparmor_bin_prefix /lib/apparmor
|
|
BuildRequires: bison
|
|
BuildRequires: flex
|
|
BuildRequires: gcc-c++
|
|
BuildRequires: latex2html
|
|
BuildRequires: libtool
|
|
BuildRequires: pcre-devel
|
|
BuildRequires: pkg-config
|
|
BuildRequires: texlive-latex
|
|
BuildRequires: w3m
|
|
|
|
BuildRequires: swig
|
|
|
|
%if %{with python}
|
|
BuildRequires: python-devel
|
|
BuildRequires: swig
|
|
%endif
|
|
|
|
%if %{with ruby}
|
|
BuildRequires: ruby-devel
|
|
BuildRequires: swig
|
|
%endif
|
|
|
|
%if %{with apache}
|
|
BuildRequires: apache2-devel
|
|
%endif
|
|
|
|
%if %{with tomcat}
|
|
BuildRequires: ant
|
|
BuildRequires: java-devel >= 1.6.0
|
|
BuildRequires: tomcat6
|
|
%endif
|
|
|
|
%if %{with editor}
|
|
BuildRequires: gcc-c++
|
|
BuildRequires: update-desktop-files
|
|
BuildRequires: wxGTK-devel
|
|
%endif
|
|
|
|
%if %{with gnome}
|
|
BuildRequires: gnome-common
|
|
BuildRequires: pkgconfig(dbus-1)
|
|
BuildRequires: pkgconfig(gtk+-2.0)
|
|
BuildRequires: pkgconfig(libgnome-2.0)
|
|
BuildRequires: pkgconfig(libpanelapplet-2.0)
|
|
%endif
|
|
|
|
%if %{with dbus}
|
|
BuildRequires: audit-devel
|
|
BuildRequires: libapparmor-devel
|
|
BuildRequires: pkg-config
|
|
BuildRequires: pkgconfig(dbus-1)
|
|
%endif
|
|
|
|
%package parser
|
|
License: GPLv2+
|
|
Summary: AppArmor userlevel parser utility
|
|
Group: Productivity/Networking/Security
|
|
Obsoletes: subdomain_parser < %{version}
|
|
Obsoletes: subdomain-parser < %{version}
|
|
Obsoletes: subdomain-parser-demo < %{version}
|
|
Obsoletes: subdomain-parser-common < %{version}
|
|
Obsoletes: subdomain-leaf-cert < %{version}
|
|
Obsoletes: libimnxcert < %{version}
|
|
Provides: subdomain_parser = %{version}
|
|
Provides: subdomain-parser = %{version}
|
|
Provides: subdomain-parser-demo = %{version}
|
|
Provides: subdomain-parser-common = %{version}
|
|
Provides: subdomain-leaf-cert = %{version}
|
|
Provides: libimnxcert = %{version}
|
|
Provides: apparmor-parser(CAP_SYSLOG)
|
|
|
|
%description parser
|
|
The AppArmor Parser is a userlevel program that is used to load in
|
|
program profiles to the AppArmor Security kernel module.
|
|
|
|
This package is part of a suite of tools that used to be named
|
|
SubDomain.
|
|
|
|
%package docs
|
|
License: GPLv2+
|
|
Summary: AppArmor Documentation package
|
|
Group: Documentation/Other
|
|
BuildArch: noarch
|
|
|
|
%description docs
|
|
This package contains documentation for AppArmor.
|
|
|
|
This package is part of a suite of tools that used to be named
|
|
SubDomain.
|
|
|
|
%if %{with apache}
|
|
|
|
%package -n apache2-mod_apparmor
|
|
License: GPLv2+
|
|
Summary: AppArmor module for apache2
|
|
Group: Productivity/Security
|
|
|
|
%description -n apache2-mod_apparmor
|
|
apache2-modapparmor adds support to apache2 to provide AppArmor
|
|
confinement to individual cgi scripts handled by apache modules like
|
|
mod_php and mod_perl.
|
|
|
|
This package is part of a suite of tools that used to be named
|
|
SubDomain.
|
|
|
|
The documentation is in the apparmor-admin_en package.
|
|
|
|
%endif
|
|
|
|
%package -n libapparmor1
|
|
License: LGPLv2.1+
|
|
Summary: Utility library for AppArmor
|
|
Group: Development/Libraries/C and C++
|
|
%ifarch ppc64
|
|
Obsoletes: libapparmor-64bit < %{version}
|
|
Provides: libapparmor-64bit = ${version}
|
|
%endif
|
|
Provides: libapparmor = %{version}
|
|
Provides: libimmunix = %{version}
|
|
Obsoletes: libapparmor < %{version}
|
|
Obsoletes: libimmunix < %{version}
|
|
|
|
%description -n libapparmor1
|
|
This package provides the libapparmor library, which contains the
|
|
change_hat(2) symbol, used for sub-process confinement by AppArmor, as
|
|
well as functions to parse AppArmor log messages.
|
|
|
|
%package -n libapparmor-devel
|
|
License: LGPLv2.1+
|
|
Summary: Development headers and libraries for libapparmor
|
|
Group: Development/Libraries/C and C++
|
|
Requires: libapparmor1 = %{version}
|
|
Provides: libapparmor:/usr/include/sys/apparmor.h
|
|
|
|
%description -n libapparmor-devel
|
|
These libraries are needed for developing software that makes use of the
|
|
AppArmor API.
|
|
|
|
%package -n perl-apparmor
|
|
License: GPLv2 ; LGPLv2.1+
|
|
Summary: Perl interface for libapparmor functions
|
|
Group: Development/Libraries/Perl
|
|
Requires: libapparmor1 = %{version}
|
|
Requires: perl = %{perl_version}
|
|
Requires: perl(DBD::SQLite)
|
|
Requires: perl(Locale::gettext)
|
|
Requires: perl(RPC::XML)
|
|
Requires: perl(RPC::XML)
|
|
Requires: perl(Term::ReadKey)
|
|
Requires: perl(Term::ReadKey)
|
|
Provides: perl-libapparmor
|
|
Obsoletes: perl-libapparmor < 2.5
|
|
|
|
%description -n perl-apparmor
|
|
This package provides the perl interface to AppArmor. It is used for perl
|
|
applications interfacing with AppArmor, including the AppArmor utilities.
|
|
|
|
%if %{with python}
|
|
|
|
%package -n python-apparmor
|
|
License: GPLv2 ; LGPLv2.1+
|
|
Summary: Python interface for libapparmor functions
|
|
Group: Development/Libraries/Python
|
|
BuildRequires: python
|
|
Requires: libapparmor1 = %{version}
|
|
Requires: python = %{python_version}
|
|
Provides: python-libapparmor
|
|
Obsoletes: python-libapparmor < 2.5
|
|
|
|
%description -n python-apparmor
|
|
This package provides the python interface to AppArmor. It is used for python
|
|
applications interfacing with AppArmor.
|
|
|
|
%endif
|
|
|
|
%if %{with ruby}
|
|
|
|
%package -n ruby-apparmor
|
|
License: GPLv2 ; LGPLv2.1+
|
|
Summary: Ruby interface for libapparmor functions
|
|
Group: Development/Libraries/Ruby
|
|
Requires: libapparmor1 = %{version}
|
|
Requires: ruby = %{ruby_version}
|
|
Provides: ruby-libapparmor
|
|
Obsoletes: ruby-libapparmor < 2.5
|
|
|
|
%description -n ruby-apparmor
|
|
This package provides the ruby interface to AppArmor. It is used for ruby
|
|
applications interfacing with AppArmor.
|
|
|
|
%endif
|
|
|
|
%package profiles
|
|
License: GPLv2 ; LGPLv2.1+
|
|
Summary: AppArmor profiles that are loaded into the apparmor kernel module
|
|
Group: Productivity/Security
|
|
Requires: apparmor-parser(CAP_SYSLOG)
|
|
Obsoletes: subdomain-profiles < %{version}
|
|
Provides: subdomain-profiles = %{version}
|
|
BuildArch: noarch
|
|
|
|
%description profiles
|
|
Base profiles. AppArmor is a file and network mandatory access control
|
|
mechanism. AppArmor confines processes to the resources allowed by the
|
|
systems administrator and can constrain the scope of potential security
|
|
vulnerabilities.
|
|
|
|
This package is part of a suite of tools that used to be named
|
|
SubDomain.
|
|
|
|
%package utils
|
|
License: GPLv2 ; LGPLv2.1+
|
|
Summary: AppArmor User-Level Utilities Useful for Creating AppArmor Profiles
|
|
Group: Productivity/Security
|
|
Requires: libapparmor1 = %{version}
|
|
Requires: perl = %{perl_version}
|
|
Requires: perl-apparmor = %{version}
|
|
BuildArch: noarch
|
|
|
|
%description utils
|
|
This package provides the aa-logprof, aa-genprof, aa-autodep,
|
|
aa-enforce, and aa-complain tools to assist with profile authoring.
|
|
Besides it provides the aa-unconfined server information tool.
|
|
It is part of a suite of tools that used to be named SubDomain.
|
|
|
|
%if %{with tomcat}
|
|
|
|
%package -n tomcat_apparmor
|
|
License: GPLv2 ; LGPLv2.1+
|
|
Summary: Tomcat 6 plugin for AppArmor change_hat
|
|
Group: System/Libraries
|
|
Requires: libapparmor1 = %{version}
|
|
Requires: tomcat6
|
|
|
|
%description -n tomcat_apparmor
|
|
tomcat_apparmor - is a plugin for Apache Tomcat version 6 that
|
|
provides support for AppArmor change_hat for creating AppArmor
|
|
containers that are bound to discrete elements of processing within the
|
|
Tomcat servlet container. The AppArmor containers, or "hats", can be
|
|
created for individual URL processing or per servlet.
|
|
|
|
%endif
|
|
|
|
%if %{with pam}
|
|
|
|
%package -n pam_apparmor
|
|
License: GPLv2 ; LGPLv2.1+
|
|
Summary: PAM module for AppArmor change_hat
|
|
Group: Productivity/Security
|
|
BuildRequires: pam-devel
|
|
PreReq: pam
|
|
PreReq: pam-config
|
|
Requires: pam
|
|
Requires: pam-config
|
|
|
|
%description -n pam_apparmor
|
|
The pam_apparmor module provides the means for any PAM applications
|
|
that call pam_open_session() to automatically perform an AppArmor
|
|
change_hat operation in order to switch to a user-specific security
|
|
policy.
|
|
|
|
%endif
|
|
|
|
%if %{with dbus}
|
|
|
|
%package dbus
|
|
License: GPLv2 ; LGPLv2.1+
|
|
Summary: Audit dispatcher for sending AppArmor events over DBUS
|
|
Group: System/Monitoring
|
|
|
|
%description dbus
|
|
An audit dispatcher for sending AppArmor events over the DBUS system
|
|
bus.
|
|
|
|
%endif
|
|
|
|
%if %{with editor}
|
|
|
|
%package profile-editor
|
|
License: GPLv2 ; LGPLv2.1+
|
|
Summary: AppArmor profile editor
|
|
Group: Productivity/Editors/Other
|
|
|
|
%description profile-editor
|
|
A syntax highlighting editor for AppArmor profiles.
|
|
|
|
%endif
|
|
|
|
%if %{with gnome}
|
|
|
|
%package -n apparmorapplet-gnome
|
|
License: GPLv2 ; LGPLv2.1+
|
|
Summary: An AppArmor event notification applet for GNOME
|
|
Group: System/GUI/GNOME
|
|
|
|
%description -n apparmorapplet-gnome
|
|
This taskbar applet receives AppArmor events over DBUS, and notifies
|
|
the user when AppArmor prevents an application from functioning.
|
|
|
|
%endif
|
|
|
|
%description
|
|
The AppArmor Parser is a userlevel program that is used to load in
|
|
program profiles to the AppArmor Security kernel module.
|
|
|
|
This package is part of a suite of tools that used to be named
|
|
SubDomain.
|
|
|
|
%lang_package -n apparmor-utils
|
|
%lang_package -n apparmor-parser
|
|
%if %{with gnome}
|
|
%lang_package -n apparmorapplet-gnome
|
|
%endif
|
|
|
|
%prep
|
|
%setup -q -n %{name}-%{versiondir}
|
|
%patch1 -p1
|
|
%patch5 -p1
|
|
#%patch10 -p1 # disabled, see above
|
|
#%patch11 -p1 # disabled, see above
|
|
%patch12 -p1
|
|
%patch13 -p1
|
|
#%patch15 -p1 # obsolete, see above
|
|
%patch21 -p1
|
|
|
|
%build
|
|
export SUSE_ASNEEDED=0
|
|
# re-define _libdir to /lib or /lib64
|
|
%define _libdir /%{_lib}
|
|
|
|
# libapparmor:
|
|
(
|
|
cd ./libraries/libapparmor
|
|
sh ./autogen.sh
|
|
%configure --with-perl \
|
|
%if %{with python}
|
|
--with-python \
|
|
%else
|
|
--without-python \
|
|
%endif
|
|
%if %{with ruby}
|
|
--with-ruby \
|
|
%else
|
|
--without-ruby \
|
|
%endif
|
|
|
|
make
|
|
#make check
|
|
)
|
|
|
|
# Utilities:
|
|
make -C utils
|
|
# make -C utils check
|
|
|
|
# parser:
|
|
make -C parser
|
|
# techdoc.txt depends on techdoc.pdf and techdoc/index.html, so make techdoc.txt should be enough
|
|
make -C parser techdoc.txt
|
|
# make -C parser check
|
|
|
|
# Apache mod_apparmor:
|
|
%if %{with apache}
|
|
make -C changehat/mod_apparmor
|
|
%endif
|
|
|
|
# PAM AppArmor:
|
|
%if %{with pam}
|
|
make -C changehat/pam_apparmor
|
|
%endif
|
|
|
|
# Profiles:
|
|
make -C profiles
|
|
# make -C profiles check
|
|
|
|
##configure --disable-static --with-pic \
|
|
#--with-perl \
|
|
%if %{with tomcat}
|
|
make -C changehat/tomcat_apparmor/tomcat_5_5 CATALINA_HOME=%{CATALINA_HOME}
|
|
%endif
|
|
%if %{with gnome}
|
|
#--with-gnome \
|
|
%endif
|
|
%if %{with dbus}
|
|
#--with-dbus \
|
|
%endif
|
|
%if %{with editor}
|
|
#--with-profileeditor \
|
|
%endif
|
|
|
|
%if %{with ruby}
|
|
#rm libraries/libapparmor/swig/ruby/Makefile.ruby
|
|
#make -C libraries/libapparmor/swig/ruby
|
|
%endif
|
|
|
|
%install
|
|
# libapparmor
|
|
%makeinstall -C libraries/libapparmor
|
|
# create symlink for old change_hat(2) manpage
|
|
( cd %{buildroot}/%{_mandir}/man2/ && ln -s aa_change_hat.2 change_hat.2 )
|
|
|
|
# utilities
|
|
%makeinstall -C utils
|
|
mkdir -p %{buildroot}%{_localstatedir}/log/apparmor
|
|
|
|
%makeinstall -C profiles
|
|
mkdir %{buildroot}%{_sysconfdir}/apparmor.d/disable
|
|
|
|
%makeinstall -C parser
|
|
# default cache dir is /etc/apparmor.d/cache - not the best location.
|
|
# Use /var/cache/apparmor and make /etc/apparmor.d/cache a symlink to it
|
|
mkdir -p %{buildroot}%{_localstatedir}/cache/apparmor
|
|
( cd %{buildroot}/%{_sysconfdir}/apparmor.d/ && ln -s ../../%{_localstatedir}/cache/apparmor cache )
|
|
|
|
%if %{with apache}
|
|
%makeinstall -C changehat/mod_apparmor
|
|
%endif
|
|
|
|
%if %{with pam}
|
|
%makeinstall -C changehat/pam_apparmor SECDIR=%{buildroot}%{_libdir}/security
|
|
%endif
|
|
|
|
%if %{with tomcat}
|
|
mkdir -p %{buildroot}/%{CATALINA_HOME}
|
|
%makeinstall -C changehat/tomcat_apparmor/tomcat_5_5 CATALINA_HOME=%{buildroot}/%{CATALINA_HOME}
|
|
%endif
|
|
|
|
find %{buildroot} -name .packlist -exec rm -f {} \;
|
|
find %{buildroot} -name perllocal.pod -exec rm -f {} \;
|
|
|
|
# Re-create the links to the old names
|
|
for file in %{buildroot}%{_prefix}/{sbin,share/man/man[0-9]}/aa-*; do
|
|
d=$(dirname $file)
|
|
f=$(basename $file)
|
|
if [ "${f#aa-}" != "$f" ]; then
|
|
ln -s $f $d/${f#aa-}
|
|
fi
|
|
done
|
|
|
|
mv -f %{buildroot}%{_mandir}/man8/{status.8,apparmor_status.8}
|
|
mv -f %{buildroot}%{_mandir}/man8/{notify.8,apparmor_notify.8}
|
|
rm -f %{buildroot}%{_mandir}/man8/decode.8
|
|
|
|
%if %{with editor}
|
|
%suse_update_desktop_file -i %{name}-profile-editor Utility TextEditor
|
|
%endif
|
|
|
|
%if %{with gnome}
|
|
%find_lang apparmorapplet-gnome
|
|
%endif
|
|
|
|
for pkg in apparmor-utils apparmor-parser; do
|
|
%find_lang $pkg
|
|
done
|
|
|
|
# remove *.la files
|
|
rm -fv %{buildroot}%{_libdir}/libapparmor.la %{buildroot}%{_libdir}/libimmunix.la
|
|
|
|
echo -------------------------------------------------------------------
|
|
find -ls
|
|
echo -------------------------------------------------------------------
|
|
find %{buildroot} -ls
|
|
echo -------------------------------------------------------------------
|
|
|
|
%files docs
|
|
%defattr(-,root,root)
|
|
%doc parser/*.[1-9].html
|
|
%doc common/apparmor.css
|
|
%doc parser/techdoc.pdf parser/techdoc/techdoc.html parser/techdoc/techdoc.css parser/techdoc.txt
|
|
|
|
%files parser
|
|
%defattr(-,root,root)
|
|
%doc parser/README parser/COPYING.GPL
|
|
/sbin/apparmor_parser
|
|
%dir %attr(-, root, root) %{_sysconfdir}/apparmor
|
|
%dir %{_sysconfdir}/apparmor.d
|
|
%{_sysconfdir}/apparmor.d/cache
|
|
%dir %{_localstatedir}/cache/apparmor
|
|
%if %{distro} == "suse"
|
|
/sbin/rcsubdomain
|
|
/sbin/rcapparmor
|
|
%{_sysconfdir}/init.d/boot.apparmor
|
|
%else
|
|
%{_sysconfdir}/init.d/apparmor
|
|
%endif
|
|
%config(noreplace) %{_sysconfdir}/apparmor/subdomain.conf
|
|
%config(noreplace) %{_sysconfdir}/apparmor/parser.conf
|
|
%{_localstatedir}/lib/apparmor
|
|
%dir %attr(-, root, root) %{apparmor_bin_prefix}
|
|
%{apparmor_bin_prefix}/rc.apparmor.functions
|
|
%doc %{_mandir}/man5/apparmor.d.5.gz
|
|
%doc %{_mandir}/man5/apparmor.vim.5.gz
|
|
%doc %{_mandir}/man5/subdomain.conf.5.gz
|
|
%doc %{_mandir}/man7/apparmor.7.gz
|
|
%doc %{_mandir}/man8/apparmor_parser.8.gz
|
|
%if %{distro} == "redhat" || %{distro} == "rhel4"
|
|
|
|
%pre parser
|
|
if [ -f %{_sysconfdir}/init.d/subdomain ] ; then
|
|
chkconfig --del subdomain
|
|
fi
|
|
%endif
|
|
|
|
%files parser-lang -f apparmor-parser.lang
|
|
|
|
%files -n libapparmor1
|
|
%defattr(-,root,root)
|
|
%{_libdir}/libapparmor.so*
|
|
%{_libdir}/libimmunix.so*
|
|
# not sure about the correct package for *.a files...
|
|
%{_libdir}/libapparmor.a
|
|
%{_libdir}/libimmunix.a
|
|
|
|
%files -n libapparmor-devel
|
|
%defattr(-,root,root)
|
|
%{_libdir}/libapparmor.so
|
|
%{_libdir}/libimmunix.so
|
|
%doc %{_mandir}/man2/aa_change_hat.2.gz
|
|
%doc %{_mandir}/man2/change_hat.2.gz
|
|
%doc %{_mandir}/man2/aa_find_mountpoint.2.gz
|
|
%doc %{_mandir}/man2/aa_getcon.2.gz
|
|
%dir %{_includedir}/aalogparse
|
|
%{_includedir}/sys/apparmor.h
|
|
%{_includedir}/aalogparse/*
|
|
|
|
# hrm, still need to enumerate each directory in these paths in files :(
|
|
# %define extras_dir %{_sysconfdir}/apparmor/profiles/extras/
|
|
# %define profiles_dir %{_sysconfdir}/apparmor.d/
|
|
|
|
%files profiles
|
|
%defattr(644,root,root,755)
|
|
%config(noreplace) %{_sysconfdir}/apparmor.d/
|
|
%exclude %{_sysconfdir}/apparmor.d/cache
|
|
%dir %{_sysconfdir}/apparmor/
|
|
%dir %{_sysconfdir}/apparmor/profiles
|
|
%config %{_sysconfdir}/apparmor/profiles/extras/
|
|
|
|
%files utils
|
|
%defattr(-,root,root)
|
|
%dir %{_sysconfdir}/apparmor
|
|
%config(noreplace) %{_sysconfdir}/apparmor/logprof.conf
|
|
%config(noreplace) %{_sysconfdir}/apparmor/notify.conf
|
|
%config(noreplace) %{_sysconfdir}/apparmor/severity.db
|
|
%config(noreplace) %{_sysconfdir}/apparmor/subdomain.conf
|
|
%{_sbindir}/*
|
|
%dir %{_localstatedir}/log/apparmor
|
|
%doc %{_mandir}/man2/aa_change_profile.2.gz
|
|
%doc %{_mandir}/man5/logprof.conf.5.gz
|
|
%doc %{_mandir}/man8/apparmor_notify.8.gz
|
|
%doc %{_mandir}/man8/aa-*.gz
|
|
%doc %{_mandir}/man8/apparmor_status.8.gz
|
|
%doc %{_mandir}/man8/audit.8.gz
|
|
%doc %{_mandir}/man8/autodep.8.gz
|
|
%doc %{_mandir}/man8/complain.8.gz
|
|
%doc %{_mandir}/man8/disable.8.gz
|
|
%doc %{_mandir}/man8/enforce.8.gz
|
|
%doc %{_mandir}/man8/genprof.8.gz
|
|
%doc %{_mandir}/man8/logprof.8.gz
|
|
%doc %{_mandir}/man8/unconfined.8.gz
|
|
%doc utils/*.[0-9].html
|
|
%doc common/apparmor.css
|
|
|
|
%files utils-lang -f apparmor-utils.lang
|
|
|
|
%files -n perl-apparmor
|
|
%defattr(-,root,root)
|
|
%{perl_vendorlib}/Immunix
|
|
%{perl_vendorarch}/auto/LibAppArmor/
|
|
%{perl_vendorarch}/LibAppArmor.pm
|
|
|
|
%if %{with python}
|
|
|
|
%files -n python-apparmor
|
|
%defattr(-,root,root)
|
|
%{python_sitearch}/LibAppArmor-2.5.1-py2.7.egg-info
|
|
%{python_sitearch}/libapparmor1/*
|
|
%endif
|
|
|
|
%if %{with ruby}
|
|
|
|
%files -n ruby-apparmor
|
|
%defattr(-,root,root)
|
|
%{_prefix}/%{rb_sitearch}/*
|
|
%endif
|
|
|
|
%if %{with pam}
|
|
|
|
%files -n pam_apparmor
|
|
%defattr(444,root,root,755)
|
|
%attr(555,root,root) %{_libdir}/security/pam_apparmor.so
|
|
%endif
|
|
|
|
%if %{with tomcat}
|
|
|
|
%files -n tomcat_apparmor
|
|
%defattr(-,root,root)
|
|
%{CATALINA_HOME}/lib/%{JAR_FILE}
|
|
%{_libdir}/libJNI*
|
|
%doc %attr(0644,root,root) changehat/tomcat_apparmor/tomcat_5_5/README.tomcat_apparmor
|
|
%endif
|
|
|
|
%if %{with apache}
|
|
|
|
%files -n apache2-mod_apparmor
|
|
%defattr(-,root,root)
|
|
%{apache_module_path}/mod_apparmor.so
|
|
%doc %{_mandir}/man8/mod_apparmor.8.gz
|
|
%endif
|
|
|
|
%if %{with dbus}
|
|
|
|
%files dbus
|
|
%defattr(0750, root, root)
|
|
%{_bindir}/apparmor-dbus
|
|
%endif
|
|
|
|
%if %{with editor}
|
|
|
|
%files profile-editor
|
|
%defattr(-, root, root)
|
|
%{_datadir}/applications/%{name}-profile-editor.desktop
|
|
%{_datadir}/pixmaps/%{name}-profile-editor.png
|
|
%{_bindir}/profileeditor
|
|
%{_docdir}/profileeditor/AppArmorProfileEditor.htb
|
|
%if 0
|
|
%{_datadir}/doc/profileeditor/AppArmorProfileEditor.htb
|
|
%endif
|
|
%dir %{_datadir}/doc/profileeditor
|
|
%endif
|
|
|
|
%if %{with gnome}
|
|
|
|
%files -n apparmorapplet-gnome
|
|
%defattr(-, root, root)
|
|
%{_libdir}/bonobo/servers/*.server
|
|
%{_prefix}/lib/apparmorapplet
|
|
%{_datadir}/pixmaps/*
|
|
|
|
%files -n apparmorapplet-gnome-lang -f apparmorapplet-gnome.lang
|
|
%endif
|
|
|
|
%post parser
|
|
%if %{distro} == "suse"
|
|
# SUSE uses insserv
|
|
# For package renaming from subdomain -> apparmor
|
|
# we check the existence of the AppArmor 1.1 and
|
|
# AppArmor 1.2 based init script to help determine
|
|
# whether we are upgrading
|
|
SUBDOMAIN_PARSER_INSTALLED="no"
|
|
if test -e %{_sysconfdir}/init.d/boot.subdomain -o -e %{_sysconfdir}/init.d/subdomain; then
|
|
SUBDOMAIN_PARSER_INSTALLED="yes"
|
|
fi
|
|
if test "$1" == 1 -a $SUBDOMAIN_PARSER_INSTALLED = "no"; then
|
|
%{insserv_force_if_yast boot.apparmor}
|
|
elif test -e %{_sysconfdir}/rc.d/boot.d/S??boot.subdomain -o \
|
|
-e %{_sysconfdir}/rc.d/boot.d/S??boot.apparmor -o \
|
|
-e %{_sysconfdir}/rc.d/rc3.d/S??subdomain ; then
|
|
%{insserv_force_if_yast boot.apparmor}
|
|
else
|
|
%{fillup_and_insserv -f boot.apparmor}
|
|
fi
|
|
%endif
|
|
%if %{distro} == "redhat" || %{distro} == "rhel4"
|
|
chkconfig --add apparmor
|
|
%endif
|
|
%if %{distro} == "slackware"
|
|
if grep -qs "# BEGIN rc.subdomain INSERTION" %{_sysconfdir}/rc.d/rc.M ; then true ; else
|
|
%{apparmor_bin_prefix}/install/frob_slack_rc --init
|
|
fi
|
|
if grep -qs "# BEGIN rc.subdomain INSERTION" %{_sysconfdir}/rc.d/rc.K ; then true ; else
|
|
%{apparmor_bin_prefix}/install/frob_slack_rc --shutdown
|
|
fi
|
|
%endif
|
|
|
|
%preun parser
|
|
if [ "$1" = 0 ] ; then
|
|
%if %{distro} == "suse"
|
|
# TODO: aaeventd no longer exists - how to handle it?
|
|
%{stop_on_removal aaeventd}
|
|
%{stop_on_removal boot.apparmor}
|
|
%endif
|
|
%if %{distro} == "redhat" || %{distro} == "rhel4"
|
|
# TODO: aaeventd no longer exists - how to handle it?
|
|
chkconfig --del aaeventd
|
|
chkconfig --del apparmor
|
|
%endif
|
|
fi
|
|
|
|
%postun parser
|
|
%if %{distro} == "suse"
|
|
%restart_on_update boot.apparmor
|
|
%{insserv_cleanup} || true
|
|
%endif
|
|
|
|
%post -n libapparmor1 -p /sbin/ldconfig
|
|
|
|
%postun -n libapparmor1 -p /sbin/ldconfig
|
|
%if %{with tomcat}
|
|
|
|
%post -n tomcat_apparmor -p /sbin/ldconfig
|
|
|
|
%postun -n tomcat_apparmor -p /sbin/ldconfig
|
|
%endif
|
|
|
|
%if %{with pam}
|
|
|
|
%post -n pam_apparmor
|
|
pam-config -a --apparmor
|
|
pam-config --update
|
|
|
|
%postun -n pam_apparmor
|
|
pam-config -d --apparmor
|
|
pam-config --update
|
|
%endif
|
|
|
|
%changelog
|