Accepting request 1164510 from home:rrahl0:branches:devel:tools:scm
- increase golang dep to 1.22, to imitate the CI/CD of forgejo - revise how the apparmor package gets build + add selinux OBS-URL: https://build.opensuse.org/request/show/1164510 OBS-URL: https://build.opensuse.org/package/show/devel:tools:scm/forgejo?expand=0&rev=7
This commit is contained in:
Richard Rahl
Git OBS Bridge
parent
35e84d159a
commit
22388ccb98
@ -1,3 +1,9 @@
|
||||
-------------------------------------------------------------------
|
||||
Thu Mar 28 06:58:20 UTC 2024 - Richard Rahl <rrahl0@proton.me>
|
||||
|
||||
- increase golang dep to 1.22, to imitate the CI/CD of forgejo
|
||||
- revise how the apparmor package gets build + add selinux
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Sat Mar 23 21:21:28 UTC 2024 - Richard Rahl <user@localhost>
|
||||
|
||||
|
||||
5
forgejo.fc
Normal file
5
forgejo.fc
Normal file
@ -0,0 +1,5 @@
|
||||
/usr/bin/forgejo -- gen_context(system_u:object_r:forgejo_exec_t,s0)
|
||||
|
||||
/var/lib/forgejo(/.*)? gen_context(system_u:object_r:forgejo_var_lib_t,s0)
|
||||
|
||||
/var/log/forgejo(/.*)? gen_context(system_u:object_r:forgejo_log_t,s0)
|
||||
218
forgejo.if
Normal file
218
forgejo.if
Normal file
@ -0,0 +1,218 @@
|
||||
|
||||
## <summary>policy for forgejo</summary>
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute forgejo_exec_t in the forgejo domain.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed to transition.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`forgejo_domtrans',`
|
||||
gen_require(`
|
||||
type forgejo_t, forgejo_exec_t;
|
||||
')
|
||||
|
||||
corecmd_search_bin($1)
|
||||
domtrans_pattern($1, forgejo_exec_t, forgejo_t)
|
||||
')
|
||||
|
||||
######################################
|
||||
## <summary>
|
||||
## Execute forgejo in the caller domain.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`forgejo_exec',`
|
||||
gen_require(`
|
||||
type forgejo_exec_t;
|
||||
')
|
||||
|
||||
corecmd_search_bin($1)
|
||||
can_exec($1, forgejo_exec_t)
|
||||
')
|
||||
########################################
|
||||
## <summary>
|
||||
## Read forgejo's log files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <rolecap/>
|
||||
#
|
||||
interface(`forgejo_read_log',`
|
||||
gen_require(`
|
||||
type forgejo_log_t;
|
||||
')
|
||||
|
||||
logging_search_logs($1)
|
||||
read_files_pattern($1, forgejo_log_t, forgejo_log_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Append to forgejo log files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`forgejo_append_log',`
|
||||
gen_require(`
|
||||
type forgejo_log_t;
|
||||
')
|
||||
|
||||
logging_search_logs($1)
|
||||
append_files_pattern($1, forgejo_log_t, forgejo_log_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Manage forgejo log files
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`forgejo_manage_log',`
|
||||
gen_require(`
|
||||
type forgejo_log_t;
|
||||
')
|
||||
|
||||
logging_search_logs($1)
|
||||
manage_dirs_pattern($1, forgejo_log_t, forgejo_log_t)
|
||||
manage_files_pattern($1, forgejo_log_t, forgejo_log_t)
|
||||
manage_lnk_files_pattern($1, forgejo_log_t, forgejo_log_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Search forgejo lib directories.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`forgejo_search_lib',`
|
||||
gen_require(`
|
||||
type forgejo_var_lib_t;
|
||||
')
|
||||
|
||||
allow $1 forgejo_var_lib_t:dir search_dir_perms;
|
||||
files_search_var_lib($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Read forgejo lib files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`forgejo_read_lib_files',`
|
||||
gen_require(`
|
||||
type forgejo_var_lib_t;
|
||||
')
|
||||
|
||||
files_search_var_lib($1)
|
||||
read_files_pattern($1, forgejo_var_lib_t, forgejo_var_lib_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Manage forgejo lib files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`forgejo_manage_lib_files',`
|
||||
gen_require(`
|
||||
type forgejo_var_lib_t;
|
||||
')
|
||||
|
||||
files_search_var_lib($1)
|
||||
manage_files_pattern($1, forgejo_var_lib_t, forgejo_var_lib_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Manage forgejo lib directories.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`forgejo_manage_lib_dirs',`
|
||||
gen_require(`
|
||||
type forgejo_var_lib_t;
|
||||
')
|
||||
|
||||
files_search_var_lib($1)
|
||||
manage_dirs_pattern($1, forgejo_var_lib_t, forgejo_var_lib_t)
|
||||
')
|
||||
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## All of the rules required to administrate
|
||||
## an forgejo environment
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <param name="role">
|
||||
## <summary>
|
||||
## Role allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <rolecap/>
|
||||
#
|
||||
interface(`forgejo_admin',`
|
||||
gen_require(`
|
||||
type forgejo_t;
|
||||
type forgejo_log_t;
|
||||
type forgejo_var_lib_t;
|
||||
')
|
||||
|
||||
allow $1 forgejo_t:process { signal_perms };
|
||||
ps_process_pattern($1, forgejo_t)
|
||||
|
||||
tunable_policy(`deny_ptrace',`',`
|
||||
allow $1 forgejo_t:process ptrace;
|
||||
')
|
||||
|
||||
logging_search_logs($1)
|
||||
admin_pattern($1, forgejo_log_t)
|
||||
|
||||
files_search_var_lib($1)
|
||||
admin_pattern($1, forgejo_var_lib_t)
|
||||
optional_policy(`
|
||||
systemd_passwd_agent_exec($1)
|
||||
systemd_read_fifo_file_passwd_run($1)
|
||||
')
|
||||
')
|
||||
56
forgejo.sh
Normal file
56
forgejo.sh
Normal file
@ -0,0 +1,56 @@
|
||||
#!/bin/sh -e
|
||||
|
||||
DIRNAME=`dirname $0`
|
||||
cd $DIRNAME
|
||||
USAGE="$0 [ --update ]"
|
||||
if [ `id -u` != 0 ]; then
|
||||
echo 'You must be root to run this script'
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ $# -eq 1 ]; then
|
||||
if [ "$1" = "--update" ] ; then
|
||||
time=`ls -l --time-style="+%x %X" forgejo.te | awk '{ printf "%s %s", $6, $7 }'`
|
||||
rules=`ausearch --start $time -m avc --raw -se forgejo`
|
||||
if [ x"$rules" != "x" ] ; then
|
||||
echo "Found avc's to update policy with"
|
||||
echo -e "$rules" | audit2allow -R
|
||||
echo "Do you want these changes added to policy [y/n]?"
|
||||
read ANS
|
||||
if [ "$ANS" = "y" -o "$ANS" = "Y" ] ; then
|
||||
echo "Updating policy"
|
||||
echo -e "$rules" | audit2allow -R >> forgejo.te
|
||||
# Fall though and rebuild policy
|
||||
else
|
||||
exit 0
|
||||
fi
|
||||
else
|
||||
echo "No new avcs found"
|
||||
exit 0
|
||||
fi
|
||||
else
|
||||
echo -e $USAGE
|
||||
exit 1
|
||||
fi
|
||||
elif [ $# -ge 2 ] ; then
|
||||
echo -e $USAGE
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Building and Loading Policy"
|
||||
set -x
|
||||
make -f /usr/share/selinux/devel/Makefile forgejo.pp || exit
|
||||
/usr/sbin/semodule -i forgejo.pp
|
||||
|
||||
# Generate a man page of the installed module
|
||||
sepolicy manpage -p . -d forgejo_t
|
||||
# Fixing the file context on /usr/bin/forgejo
|
||||
/sbin/restorecon -F -R -v /usr/bin/forgejo
|
||||
# Fixing the file context on /var/log/forgejo
|
||||
/sbin/restorecon -F -R -v /var/log/forgejo
|
||||
# Fixing the file context on /var/lib/forgejo
|
||||
/sbin/restorecon -F -R -v /var/lib/forgejo
|
||||
# Generate a rpm package for the newly generated policy
|
||||
|
||||
pwd=$(pwd)
|
||||
rpmbuild --define "_sourcedir ${pwd}" --define "_specdir ${pwd}" --define "_builddir ${pwd}" --define "_srcrpmdir ${pwd}" --define "_rpmdir ${pwd}" --define "_buildrootdir ${pwd}/.build" -ba forgejo_selinux.spec
|
||||
131
forgejo.spec
131
forgejo.spec
@ -18,6 +18,21 @@
|
||||
|
||||
%define gitea_version 1.21.8
|
||||
%define forgejo_version 0
|
||||
%if 0%{?suse_version} > 1600
|
||||
# TW
|
||||
%bcond_without selinux
|
||||
%bcond_without apparmor
|
||||
%else
|
||||
%if 0%{?suse_version} == 1600
|
||||
# ALP
|
||||
%bcond_without selinux
|
||||
%bcond_with apparmor
|
||||
%else
|
||||
# Leap & SLE
|
||||
%bcond_with selinux
|
||||
%bcond_without apparmor
|
||||
%endif
|
||||
%endif
|
||||
Name: forgejo
|
||||
Version: %{gitea_version}+%{forgejo_version}
|
||||
Release: 0
|
||||
@ -25,19 +40,23 @@ Summary: Self-hostable forge
|
||||
License: MIT
|
||||
Group: Development/Tools/Version Control
|
||||
URL: https://forgejo.org
|
||||
Source0: https://codeberg.org/forgejo/forgejo/releases/download/v%{gitea_version}-%{forgejo_version}/%{name}-src-%{gitea_version}-%{forgejo_version}.tar.gz
|
||||
Source1: https://codeberg.org/forgejo/forgejo/releases/download/v%{gitea_version}-%{forgejo_version}/%{name}-src-%{gitea_version}-%{forgejo_version}.tar.gz.asc
|
||||
Source2: http://keyserver.ubuntu.com/pks/lookup?op=get&search=0xeb114f5e6c0dc2bcdd183550a4b61a2dc5923710#/forgejo.keyring
|
||||
Source0: https://codeberg.org/%{name}/%{name}/releases/download/v%{gitea_version}-%{forgejo_version}/%{name}-src-%{gitea_version}-%{forgejo_version}.tar.gz
|
||||
Source1: https://codeberg.org/%{name}/%{name}/releases/download/v%{gitea_version}-%{forgejo_version}/%{name}-src-%{gitea_version}-%{forgejo_version}.tar.gz.asc
|
||||
Source2: http://keyserver.ubuntu.com/pks/lookup?op=get&search=0xeb114f5e6c0dc2bcdd183550a4b61a2dc5923710#/%{name}.keyring
|
||||
Source3: package-lock.json
|
||||
Source4: node_modules.spec.inc
|
||||
%include %{_sourcedir}/node_modules.spec.inc
|
||||
Source5: forgejo.service
|
||||
Source6: forgejo.sysusers
|
||||
Source7: apparmor-usr.bin.forgejo
|
||||
Source5: %{name}.service
|
||||
Source6: %{name}.sysusers
|
||||
Source7: apparmor-usr.bin.%{name}
|
||||
Source8: %{name}.fc
|
||||
Source9: %{name}.if
|
||||
Source10: %{name}.sh
|
||||
Source11: %{name}.te
|
||||
Source99: get-sources.sh
|
||||
Patch0: custom-app.ini.patch
|
||||
BuildRequires: golang-packaging
|
||||
BuildRequires: go >= 1.21
|
||||
BuildRequires: golang(API) = 1.22
|
||||
## node >= 20
|
||||
%if 0%{?suse_version} == 1500
|
||||
BuildRequires: nodejs-devel-default
|
||||
@ -49,24 +68,42 @@ BuildRequires: local-npm-registry
|
||||
BuildRequires: make
|
||||
BuildRequires: systemd-rpm-macros
|
||||
BuildRequires: sysuser-tools
|
||||
BuildRequires: apparmor-abstractions
|
||||
BuildRequires: apparmor-parser
|
||||
BuildRequires: apparmor-rpm-macros
|
||||
Requires: git-core
|
||||
Requires: git-lfs
|
||||
Requires: (%{name}-apparmor if apparmor)
|
||||
Requires(pre): shadow
|
||||
Requires: (%{name}-apparmor if apparmor-abstractions)
|
||||
Requires: (%{name}-selinux if selinux-policy-targeted)
|
||||
%if %{with apparmor}
|
||||
BuildRequires: apparmor-abstractions
|
||||
BuildRequires: apparmor-rpm-macros
|
||||
BuildRequires: libapparmor-devel
|
||||
%endif
|
||||
%if %{with selinux}
|
||||
BuildRequires: checkpolicy
|
||||
BuildRequires: selinux-policy-devel
|
||||
%endif
|
||||
%{systemd_requires}
|
||||
%{sysusers_requires}
|
||||
|
||||
%if %{with apparmor}
|
||||
%package apparmor
|
||||
Summary: Apparmor profile for %{name}
|
||||
Supplements: (%{name} and apparmor)
|
||||
Requires: apparmor
|
||||
Recommends: apparmor-abstractions
|
||||
BuildArch: noarch
|
||||
Requires: %{name} = %{version}-%{release}
|
||||
|
||||
%description apparmor
|
||||
This package includes the apparmor profile for %{name}
|
||||
This package adds the Apparmor profile to %{name}
|
||||
%endif
|
||||
|
||||
%if %{with selinux}
|
||||
%package selinux
|
||||
Summary: Selinux support for %{name}
|
||||
BuildArch: noarch
|
||||
Requires: %{name} = %{version}-%{release}
|
||||
Requires: selinux-policy-targeted
|
||||
|
||||
%description selinux
|
||||
This package adds SELinux enforcement to %{name}.
|
||||
%endif
|
||||
|
||||
%description
|
||||
Providing Git hosting for your project, friends, company or community? Forgejo (/for'd͡ʒe.jo/ inspired by forĝejo
|
||||
@ -80,39 +117,61 @@ local-npm-registry %{_sourcedir} install --also=dev
|
||||
%sysusers_generate_pre %{SOURCE6} %{name} %{name}.conf
|
||||
export EXTRA_GOFLAGS="-buildmode=pie -mod=vendor"
|
||||
export TAGS="bindata timetzdata sqlite sqlite_unlock_notify"
|
||||
%{make_build}
|
||||
%make_build
|
||||
|
||||
%install
|
||||
install -d %{buildroot}%{_bindir}
|
||||
install -d %{buildroot}%{_sysconfdir}/apparmor.d
|
||||
install -d %{buildroot}%{_datadir}/forgejo
|
||||
install -d %{buildroot}%{_datadir}/forgejo/{conf,https,mailer}
|
||||
install -d %{buildroot}%{_datadir}/%{name}
|
||||
install -d %{buildroot}%{_datadir}/%{name}/{conf,https,mailer}
|
||||
ln -s %{name} %{buildroot}%{_bindir}/gitea
|
||||
install -d %{buildroot}%{_sharedstatedir}/%{name}/{data,https,indexers,queues,repositories}
|
||||
install -d %{buildroot}%{_sysconfdir}/%{name}
|
||||
install -d %{buildroot}%{_localstatedir}/log/%{name}
|
||||
install -D -m 0644 %{_builddir}/%{name}-src-%{gitea_version}-%{forgejo_version}/custom/conf/app.example.ini %{buildroot}%{_sysconfdir}/%{name}/conf/app.ini
|
||||
install -D -m 0755 %{_builddir}/%{name}-src-%{gitea_version}-%{forgejo_version}/gitea %{buildroot}%{_bindir}/forgejo
|
||||
install -D -m 0644 %{SOURCE5} %{buildroot}%{_unitdir}/forgejo.service
|
||||
install -D -m 0755 %{_builddir}/%{name}-src-%{gitea_version}-%{forgejo_version}/gitea %{buildroot}%{_bindir}/%{name}
|
||||
install -D -m 0644 %{SOURCE5} %{buildroot}%{_unitdir}/%{name}.service
|
||||
install -D -m 0644 %{SOURCE6} %{buildroot}%{_sysusersdir}/%{name}.conf
|
||||
install -m 0644 %{SOURCE7} %{buildroot}%{_sysconfdir}/apparmor.d/usr.bin.forgejo
|
||||
|
||||
%if %{with apparmor}
|
||||
install -d %{buildroot}%{_sysconfdir}/apparmor.d
|
||||
install -Dm0644 %{SOURCE7} %{buildroot}%{_sysconfdir}/apparmor.d/usr.bin.%{name}
|
||||
%endif
|
||||
|
||||
%if %{with selinux}
|
||||
cd %{_sourcedir}
|
||||
make -f %{_datadir}/selinux/devel/Makefile %{name}.pp
|
||||
install -Dm0644 %{name}.pp %{buildroot}%{_datadir}/selinux/packages/%{name}/%{name}.pp
|
||||
install -Dm0644 %{name}.if %{buildroot}%{_datadir}/selinux/devel/include/distributed/%{name}.if
|
||||
%endif
|
||||
|
||||
%pre -f %{name}.pre
|
||||
%service_add_pre forgejo.service
|
||||
%service_add_pre %{name}.service
|
||||
|
||||
%post
|
||||
%service_add_post forgejo.service
|
||||
%apparmor_reload %{_sysconfdir}/apparmor.d/usr.bin.forgejo
|
||||
%service_add_post %{name}.service
|
||||
|
||||
%if %{with apparmor}
|
||||
%post apparmor
|
||||
%apparmor_reload %{_sysconfdir}/apparmor.d/usr.bin.%{name}
|
||||
%endif
|
||||
|
||||
%if %{with selinux}
|
||||
%post selinux
|
||||
semodule -i %{_datadir}/selinux/packages/%{name}/%{name}.pp 2>/dev/null || :
|
||||
|
||||
%preun selinux
|
||||
semodule -r %{name} 2>/dev/null || :
|
||||
%endif
|
||||
|
||||
%preun
|
||||
%service_del_preun forgejo.service
|
||||
%service_del_preun %{name}.service
|
||||
|
||||
%postun
|
||||
%service_del_postun forgejo.service
|
||||
%service_del_postun %{name}.service
|
||||
|
||||
%check
|
||||
#right now broken, see https://github.com/openSUSE/obs-service-node_modules/issues/22
|
||||
#make test
|
||||
#%%make_test
|
||||
|
||||
%files
|
||||
%license LICENSE
|
||||
@ -125,11 +184,21 @@ install -m 0644 %{SOURCE7} %{buildroot}%{_sysconfdir}/apparmor.d/usr.bin.forgejo
|
||||
%{_sysconfdir}/%{name}
|
||||
%{_localstatedir}/log/%{name}
|
||||
%defattr(0660,forgejo,forgejo,750)
|
||||
%{_datadir}/forgejo
|
||||
%{_datadir}/%{name}
|
||||
%{_sharedstatedir}/%{name}
|
||||
%{_sysusersdir}/%{name}.conf
|
||||
|
||||
%if %{with apparmor}
|
||||
%files apparmor
|
||||
%config %{_sysconfdir}/apparmor.d/usr.bin.forgejo
|
||||
%dir %{_sysconfdir}/apparmor.d
|
||||
%config %{_sysconfdir}/apparmor.d/usr.bin.%{name}
|
||||
%endif
|
||||
|
||||
%if %{with selinux}
|
||||
%files selinux
|
||||
%dir %{_datadir}/selinux/devel/include/distributed
|
||||
%{_datadir}/selinux/packages/%{name}
|
||||
%{_datadir}/selinux/devel/include/distributed/%{name}.if
|
||||
%endif
|
||||
|
||||
%changelog
|
||||
|
||||
41
forgejo.te
Normal file
41
forgejo.te
Normal file
@ -0,0 +1,41 @@
|
||||
policy_module(forgejo, 1.0.0)
|
||||
|
||||
########################################
|
||||
#
|
||||
# Declarations
|
||||
#
|
||||
|
||||
type forgejo_t;
|
||||
type forgejo_exec_t;
|
||||
init_daemon_domain(forgejo_t, forgejo_exec_t)
|
||||
|
||||
permissive forgejo_t;
|
||||
|
||||
type forgejo_log_t;
|
||||
logging_log_file(forgejo_log_t)
|
||||
|
||||
type forgejo_var_lib_t;
|
||||
files_type(forgejo_var_lib_t)
|
||||
|
||||
########################################
|
||||
#
|
||||
# forgejo local policy
|
||||
#
|
||||
allow forgejo_t self:fifo_file rw_fifo_file_perms;
|
||||
allow forgejo_t self:unix_stream_socket create_stream_socket_perms;
|
||||
|
||||
manage_dirs_pattern(forgejo_t, forgejo_log_t, forgejo_log_t)
|
||||
manage_files_pattern(forgejo_t, forgejo_log_t, forgejo_log_t)
|
||||
manage_lnk_files_pattern(forgejo_t, forgejo_log_t, forgejo_log_t)
|
||||
logging_log_filetrans(forgejo_t, forgejo_log_t, { dir file lnk_file })
|
||||
|
||||
manage_dirs_pattern(forgejo_t, forgejo_var_lib_t, forgejo_var_lib_t)
|
||||
manage_files_pattern(forgejo_t, forgejo_var_lib_t, forgejo_var_lib_t)
|
||||
manage_lnk_files_pattern(forgejo_t, forgejo_var_lib_t, forgejo_var_lib_t)
|
||||
files_var_lib_filetrans(forgejo_t, forgejo_var_lib_t, { dir file lnk_file })
|
||||
|
||||
domain_use_interactive_fds(forgejo_t)
|
||||
|
||||
files_read_etc_files(forgejo_t)
|
||||
|
||||
miscfiles_read_localization(forgejo_t)
|
||||
Loading…
Reference in New Issue
Block a user