From 22388ccb9870a0bf5d932aa5b099bec550bca91df164aca57e1ea167c97c376c Mon Sep 17 00:00:00 2001 From: Richard Rahl Date: Thu, 4 Apr 2024 08:14:51 +0000 Subject: [PATCH] Accepting request 1164510 from home:rrahl0:branches:devel:tools:scm - increase golang dep to 1.22, to imitate the CI/CD of forgejo - revise how the apparmor package gets build + add selinux OBS-URL: https://build.opensuse.org/request/show/1164510 OBS-URL: https://build.opensuse.org/package/show/devel:tools:scm/forgejo?expand=0&rev=7 --- forgejo.changes | 6 ++ forgejo.fc | 5 ++ forgejo.if | 218 ++++++++++++++++++++++++++++++++++++++++++++++++ forgejo.sh | 56 +++++++++++++ forgejo.spec | 131 ++++++++++++++++++++++------- forgejo.te | 41 +++++++++ 6 files changed, 426 insertions(+), 31 deletions(-) create mode 100644 forgejo.fc create mode 100644 forgejo.if create mode 100644 forgejo.sh create mode 100644 forgejo.te diff --git a/forgejo.changes b/forgejo.changes index c212b83..ce0149a 100644 --- a/forgejo.changes +++ b/forgejo.changes @@ -1,3 +1,9 @@ +------------------------------------------------------------------- +Thu Mar 28 06:58:20 UTC 2024 - Richard Rahl + +- increase golang dep to 1.22, to imitate the CI/CD of forgejo +- revise how the apparmor package gets build + add selinux + ------------------------------------------------------------------- Sat Mar 23 21:21:28 UTC 2024 - Richard Rahl diff --git a/forgejo.fc b/forgejo.fc new file mode 100644 index 0000000..2e3f41f --- /dev/null +++ b/forgejo.fc @@ -0,0 +1,5 @@ +/usr/bin/forgejo -- gen_context(system_u:object_r:forgejo_exec_t,s0) + +/var/lib/forgejo(/.*)? gen_context(system_u:object_r:forgejo_var_lib_t,s0) + +/var/log/forgejo(/.*)? gen_context(system_u:object_r:forgejo_log_t,s0) diff --git a/forgejo.if b/forgejo.if new file mode 100644 index 0000000..0860709 --- /dev/null +++ b/forgejo.if @@ -0,0 +1,218 @@ + +## policy for forgejo + +######################################## +## +## Execute forgejo_exec_t in the forgejo domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`forgejo_domtrans',` + gen_require(` + type forgejo_t, forgejo_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, forgejo_exec_t, forgejo_t) +') + +###################################### +## +## Execute forgejo in the caller domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`forgejo_exec',` + gen_require(` + type forgejo_exec_t; + ') + + corecmd_search_bin($1) + can_exec($1, forgejo_exec_t) +') +######################################## +## +## Read forgejo's log files. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`forgejo_read_log',` + gen_require(` + type forgejo_log_t; + ') + + logging_search_logs($1) + read_files_pattern($1, forgejo_log_t, forgejo_log_t) +') + +######################################## +## +## Append to forgejo log files. +## +## +## +## Domain allowed access. +## +## +# +interface(`forgejo_append_log',` + gen_require(` + type forgejo_log_t; + ') + + logging_search_logs($1) + append_files_pattern($1, forgejo_log_t, forgejo_log_t) +') + +######################################## +## +## Manage forgejo log files +## +## +## +## Domain allowed access. +## +## +# +interface(`forgejo_manage_log',` + gen_require(` + type forgejo_log_t; + ') + + logging_search_logs($1) + manage_dirs_pattern($1, forgejo_log_t, forgejo_log_t) + manage_files_pattern($1, forgejo_log_t, forgejo_log_t) + manage_lnk_files_pattern($1, forgejo_log_t, forgejo_log_t) +') + +######################################## +## +## Search forgejo lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`forgejo_search_lib',` + gen_require(` + type forgejo_var_lib_t; + ') + + allow $1 forgejo_var_lib_t:dir search_dir_perms; + files_search_var_lib($1) +') + +######################################## +## +## Read forgejo lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`forgejo_read_lib_files',` + gen_require(` + type forgejo_var_lib_t; + ') + + files_search_var_lib($1) + read_files_pattern($1, forgejo_var_lib_t, forgejo_var_lib_t) +') + +######################################## +## +## Manage forgejo lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`forgejo_manage_lib_files',` + gen_require(` + type forgejo_var_lib_t; + ') + + files_search_var_lib($1) + manage_files_pattern($1, forgejo_var_lib_t, forgejo_var_lib_t) +') + +######################################## +## +## Manage forgejo lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`forgejo_manage_lib_dirs',` + gen_require(` + type forgejo_var_lib_t; + ') + + files_search_var_lib($1) + manage_dirs_pattern($1, forgejo_var_lib_t, forgejo_var_lib_t) +') + + +######################################## +## +## All of the rules required to administrate +## an forgejo environment +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`forgejo_admin',` + gen_require(` + type forgejo_t; + type forgejo_log_t; + type forgejo_var_lib_t; + ') + + allow $1 forgejo_t:process { signal_perms }; + ps_process_pattern($1, forgejo_t) + + tunable_policy(`deny_ptrace',`',` + allow $1 forgejo_t:process ptrace; + ') + + logging_search_logs($1) + admin_pattern($1, forgejo_log_t) + + files_search_var_lib($1) + admin_pattern($1, forgejo_var_lib_t) + optional_policy(` + systemd_passwd_agent_exec($1) + systemd_read_fifo_file_passwd_run($1) + ') +') diff --git a/forgejo.sh b/forgejo.sh new file mode 100644 index 0000000..6edaf13 --- /dev/null +++ b/forgejo.sh @@ -0,0 +1,56 @@ +#!/bin/sh -e + +DIRNAME=`dirname $0` +cd $DIRNAME +USAGE="$0 [ --update ]" +if [ `id -u` != 0 ]; then +echo 'You must be root to run this script' +exit 1 +fi + +if [ $# -eq 1 ]; then + if [ "$1" = "--update" ] ; then + time=`ls -l --time-style="+%x %X" forgejo.te | awk '{ printf "%s %s", $6, $7 }'` + rules=`ausearch --start $time -m avc --raw -se forgejo` + if [ x"$rules" != "x" ] ; then + echo "Found avc's to update policy with" + echo -e "$rules" | audit2allow -R + echo "Do you want these changes added to policy [y/n]?" + read ANS + if [ "$ANS" = "y" -o "$ANS" = "Y" ] ; then + echo "Updating policy" + echo -e "$rules" | audit2allow -R >> forgejo.te + # Fall though and rebuild policy + else + exit 0 + fi + else + echo "No new avcs found" + exit 0 + fi + else + echo -e $USAGE + exit 1 + fi +elif [ $# -ge 2 ] ; then + echo -e $USAGE + exit 1 +fi + +echo "Building and Loading Policy" +set -x +make -f /usr/share/selinux/devel/Makefile forgejo.pp || exit +/usr/sbin/semodule -i forgejo.pp + +# Generate a man page of the installed module +sepolicy manpage -p . -d forgejo_t +# Fixing the file context on /usr/bin/forgejo +/sbin/restorecon -F -R -v /usr/bin/forgejo +# Fixing the file context on /var/log/forgejo +/sbin/restorecon -F -R -v /var/log/forgejo +# Fixing the file context on /var/lib/forgejo +/sbin/restorecon -F -R -v /var/lib/forgejo +# Generate a rpm package for the newly generated policy + +pwd=$(pwd) +rpmbuild --define "_sourcedir ${pwd}" --define "_specdir ${pwd}" --define "_builddir ${pwd}" --define "_srcrpmdir ${pwd}" --define "_rpmdir ${pwd}" --define "_buildrootdir ${pwd}/.build" -ba forgejo_selinux.spec diff --git a/forgejo.spec b/forgejo.spec index abca333..1db59ca 100644 --- a/forgejo.spec +++ b/forgejo.spec @@ -18,6 +18,21 @@ %define gitea_version 1.21.8 %define forgejo_version 0 +%if 0%{?suse_version} > 1600 +# TW +%bcond_without selinux +%bcond_without apparmor +%else +%if 0%{?suse_version} == 1600 +# ALP +%bcond_without selinux +%bcond_with apparmor +%else +# Leap & SLE +%bcond_with selinux +%bcond_without apparmor +%endif +%endif Name: forgejo Version: %{gitea_version}+%{forgejo_version} Release: 0 @@ -25,19 +40,23 @@ Summary: Self-hostable forge License: MIT Group: Development/Tools/Version Control URL: https://forgejo.org -Source0: https://codeberg.org/forgejo/forgejo/releases/download/v%{gitea_version}-%{forgejo_version}/%{name}-src-%{gitea_version}-%{forgejo_version}.tar.gz -Source1: https://codeberg.org/forgejo/forgejo/releases/download/v%{gitea_version}-%{forgejo_version}/%{name}-src-%{gitea_version}-%{forgejo_version}.tar.gz.asc -Source2: http://keyserver.ubuntu.com/pks/lookup?op=get&search=0xeb114f5e6c0dc2bcdd183550a4b61a2dc5923710#/forgejo.keyring +Source0: https://codeberg.org/%{name}/%{name}/releases/download/v%{gitea_version}-%{forgejo_version}/%{name}-src-%{gitea_version}-%{forgejo_version}.tar.gz +Source1: https://codeberg.org/%{name}/%{name}/releases/download/v%{gitea_version}-%{forgejo_version}/%{name}-src-%{gitea_version}-%{forgejo_version}.tar.gz.asc +Source2: http://keyserver.ubuntu.com/pks/lookup?op=get&search=0xeb114f5e6c0dc2bcdd183550a4b61a2dc5923710#/%{name}.keyring Source3: package-lock.json Source4: node_modules.spec.inc %include %{_sourcedir}/node_modules.spec.inc -Source5: forgejo.service -Source6: forgejo.sysusers -Source7: apparmor-usr.bin.forgejo +Source5: %{name}.service +Source6: %{name}.sysusers +Source7: apparmor-usr.bin.%{name} +Source8: %{name}.fc +Source9: %{name}.if +Source10: %{name}.sh +Source11: %{name}.te Source99: get-sources.sh Patch0: custom-app.ini.patch BuildRequires: golang-packaging -BuildRequires: go >= 1.21 +BuildRequires: golang(API) = 1.22 ## node >= 20 %if 0%{?suse_version} == 1500 BuildRequires: nodejs-devel-default @@ -49,24 +68,42 @@ BuildRequires: local-npm-registry BuildRequires: make BuildRequires: systemd-rpm-macros BuildRequires: sysuser-tools -BuildRequires: apparmor-abstractions -BuildRequires: apparmor-parser -BuildRequires: apparmor-rpm-macros Requires: git-core Requires: git-lfs -Requires: (%{name}-apparmor if apparmor) -Requires(pre): shadow +Requires: (%{name}-apparmor if apparmor-abstractions) +Requires: (%{name}-selinux if selinux-policy-targeted) +%if %{with apparmor} +BuildRequires: apparmor-abstractions +BuildRequires: apparmor-rpm-macros +BuildRequires: libapparmor-devel +%endif +%if %{with selinux} +BuildRequires: checkpolicy +BuildRequires: selinux-policy-devel +%endif %{systemd_requires} %{sysusers_requires} +%if %{with apparmor} %package apparmor Summary: Apparmor profile for %{name} -Supplements: (%{name} and apparmor) -Requires: apparmor -Recommends: apparmor-abstractions +BuildArch: noarch +Requires: %{name} = %{version}-%{release} %description apparmor -This package includes the apparmor profile for %{name} +This package adds the Apparmor profile to %{name} +%endif + +%if %{with selinux} +%package selinux +Summary: Selinux support for %{name} +BuildArch: noarch +Requires: %{name} = %{version}-%{release} +Requires: selinux-policy-targeted + +%description selinux +This package adds SELinux enforcement to %{name}. +%endif %description Providing Git hosting for your project, friends, company or community? Forgejo (/for'd͡ʒe.jo/ inspired by forĝejo @@ -80,39 +117,61 @@ local-npm-registry %{_sourcedir} install --also=dev %sysusers_generate_pre %{SOURCE6} %{name} %{name}.conf export EXTRA_GOFLAGS="-buildmode=pie -mod=vendor" export TAGS="bindata timetzdata sqlite sqlite_unlock_notify" -%{make_build} +%make_build %install install -d %{buildroot}%{_bindir} -install -d %{buildroot}%{_sysconfdir}/apparmor.d -install -d %{buildroot}%{_datadir}/forgejo -install -d %{buildroot}%{_datadir}/forgejo/{conf,https,mailer} +install -d %{buildroot}%{_datadir}/%{name} +install -d %{buildroot}%{_datadir}/%{name}/{conf,https,mailer} ln -s %{name} %{buildroot}%{_bindir}/gitea install -d %{buildroot}%{_sharedstatedir}/%{name}/{data,https,indexers,queues,repositories} install -d %{buildroot}%{_sysconfdir}/%{name} install -d %{buildroot}%{_localstatedir}/log/%{name} install -D -m 0644 %{_builddir}/%{name}-src-%{gitea_version}-%{forgejo_version}/custom/conf/app.example.ini %{buildroot}%{_sysconfdir}/%{name}/conf/app.ini -install -D -m 0755 %{_builddir}/%{name}-src-%{gitea_version}-%{forgejo_version}/gitea %{buildroot}%{_bindir}/forgejo -install -D -m 0644 %{SOURCE5} %{buildroot}%{_unitdir}/forgejo.service +install -D -m 0755 %{_builddir}/%{name}-src-%{gitea_version}-%{forgejo_version}/gitea %{buildroot}%{_bindir}/%{name} +install -D -m 0644 %{SOURCE5} %{buildroot}%{_unitdir}/%{name}.service install -D -m 0644 %{SOURCE6} %{buildroot}%{_sysusersdir}/%{name}.conf -install -m 0644 %{SOURCE7} %{buildroot}%{_sysconfdir}/apparmor.d/usr.bin.forgejo + +%if %{with apparmor} +install -d %{buildroot}%{_sysconfdir}/apparmor.d +install -Dm0644 %{SOURCE7} %{buildroot}%{_sysconfdir}/apparmor.d/usr.bin.%{name} +%endif + +%if %{with selinux} +cd %{_sourcedir} +make -f %{_datadir}/selinux/devel/Makefile %{name}.pp +install -Dm0644 %{name}.pp %{buildroot}%{_datadir}/selinux/packages/%{name}/%{name}.pp +install -Dm0644 %{name}.if %{buildroot}%{_datadir}/selinux/devel/include/distributed/%{name}.if +%endif %pre -f %{name}.pre -%service_add_pre forgejo.service +%service_add_pre %{name}.service %post -%service_add_post forgejo.service -%apparmor_reload %{_sysconfdir}/apparmor.d/usr.bin.forgejo +%service_add_post %{name}.service + +%if %{with apparmor} +%post apparmor +%apparmor_reload %{_sysconfdir}/apparmor.d/usr.bin.%{name} +%endif + +%if %{with selinux} +%post selinux +semodule -i %{_datadir}/selinux/packages/%{name}/%{name}.pp 2>/dev/null || : + +%preun selinux +semodule -r %{name} 2>/dev/null || : +%endif %preun -%service_del_preun forgejo.service +%service_del_preun %{name}.service %postun -%service_del_postun forgejo.service +%service_del_postun %{name}.service %check #right now broken, see https://github.com/openSUSE/obs-service-node_modules/issues/22 -#make test +#%%make_test %files %license LICENSE @@ -125,11 +184,21 @@ install -m 0644 %{SOURCE7} %{buildroot}%{_sysconfdir}/apparmor.d/usr.bin.forgejo %{_sysconfdir}/%{name} %{_localstatedir}/log/%{name} %defattr(0660,forgejo,forgejo,750) -%{_datadir}/forgejo +%{_datadir}/%{name} %{_sharedstatedir}/%{name} %{_sysusersdir}/%{name}.conf +%if %{with apparmor} %files apparmor -%config %{_sysconfdir}/apparmor.d/usr.bin.forgejo +%dir %{_sysconfdir}/apparmor.d +%config %{_sysconfdir}/apparmor.d/usr.bin.%{name} +%endif + +%if %{with selinux} +%files selinux +%dir %{_datadir}/selinux/devel/include/distributed +%{_datadir}/selinux/packages/%{name} +%{_datadir}/selinux/devel/include/distributed/%{name}.if +%endif %changelog diff --git a/forgejo.te b/forgejo.te new file mode 100644 index 0000000..034da94 --- /dev/null +++ b/forgejo.te @@ -0,0 +1,41 @@ +policy_module(forgejo, 1.0.0) + +######################################## +# +# Declarations +# + +type forgejo_t; +type forgejo_exec_t; +init_daemon_domain(forgejo_t, forgejo_exec_t) + +permissive forgejo_t; + +type forgejo_log_t; +logging_log_file(forgejo_log_t) + +type forgejo_var_lib_t; +files_type(forgejo_var_lib_t) + +######################################## +# +# forgejo local policy +# +allow forgejo_t self:fifo_file rw_fifo_file_perms; +allow forgejo_t self:unix_stream_socket create_stream_socket_perms; + +manage_dirs_pattern(forgejo_t, forgejo_log_t, forgejo_log_t) +manage_files_pattern(forgejo_t, forgejo_log_t, forgejo_log_t) +manage_lnk_files_pattern(forgejo_t, forgejo_log_t, forgejo_log_t) +logging_log_filetrans(forgejo_t, forgejo_log_t, { dir file lnk_file }) + +manage_dirs_pattern(forgejo_t, forgejo_var_lib_t, forgejo_var_lib_t) +manage_files_pattern(forgejo_t, forgejo_var_lib_t, forgejo_var_lib_t) +manage_lnk_files_pattern(forgejo_t, forgejo_var_lib_t, forgejo_var_lib_t) +files_var_lib_filetrans(forgejo_t, forgejo_var_lib_t, { dir file lnk_file }) + +domain_use_interactive_fds(forgejo_t) + +files_read_etc_files(forgejo_t) + +miscfiles_read_localization(forgejo_t)