Accepting request 1164510 from home:rrahl0:branches:devel:tools:scm

- increase golang dep to 1.22, to imitate the CI/CD of forgejo
- revise how the apparmor package gets build + add selinux

OBS-URL: https://build.opensuse.org/request/show/1164510
OBS-URL: https://build.opensuse.org/package/show/devel:tools:scm/forgejo?expand=0&rev=7

forgejo.changes

@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Thu Mar 28 06:58:20 UTC 2024 - Richard Rahl <rrahl0@proton.me>
+
+- increase golang dep to 1.22, to imitate the CI/CD of forgejo
+- revise how the apparmor package gets build + add selinux
+
 -------------------------------------------------------------------
 Sat Mar 23 21:21:28 UTC 2024 - Richard Rahl <user@localhost>
 

forgejo.fc

@@ -0,0 +1,5 @@
+/usr/bin/forgejo		--	gen_context(system_u:object_r:forgejo_exec_t,s0)
+
+/var/lib/forgejo(/.*)?		gen_context(system_u:object_r:forgejo_var_lib_t,s0)
+
+/var/log/forgejo(/.*)?		gen_context(system_u:object_r:forgejo_log_t,s0)

forgejo.if

@@ -0,0 +1,218 @@
+
+## <summary>policy for forgejo</summary>
+
+########################################
+## <summary>
+##	Execute forgejo_exec_t in the forgejo domain.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`forgejo_domtrans',`
+	gen_require(`
+		type forgejo_t, forgejo_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	domtrans_pattern($1, forgejo_exec_t, forgejo_t)
+')
+
+######################################
+## <summary>
+##	Execute forgejo in the caller domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`forgejo_exec',`
+	gen_require(`
+		type forgejo_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	can_exec($1, forgejo_exec_t)
+')
+########################################
+## <summary>
+##	Read forgejo's log files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`forgejo_read_log',`
+	gen_require(`
+		type forgejo_log_t;
+	')
+
+	logging_search_logs($1)
+	read_files_pattern($1, forgejo_log_t, forgejo_log_t)
+')
+
+########################################
+## <summary>
+##	Append to forgejo log files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`forgejo_append_log',`
+	gen_require(`
+		type forgejo_log_t;
+	')
+
+	logging_search_logs($1)
+	append_files_pattern($1, forgejo_log_t, forgejo_log_t)
+')
+
+########################################
+## <summary>
+##	Manage forgejo log files
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`forgejo_manage_log',`
+	gen_require(`
+		type forgejo_log_t;
+	')
+
+	logging_search_logs($1)
+	manage_dirs_pattern($1, forgejo_log_t, forgejo_log_t)
+	manage_files_pattern($1, forgejo_log_t, forgejo_log_t)
+	manage_lnk_files_pattern($1, forgejo_log_t, forgejo_log_t)
+')
+
+########################################
+## <summary>
+##	Search forgejo lib directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`forgejo_search_lib',`
+	gen_require(`
+		type forgejo_var_lib_t;
+	')
+
+	allow $1 forgejo_var_lib_t:dir search_dir_perms;
+	files_search_var_lib($1)
+')
+
+########################################
+## <summary>
+##	Read forgejo lib files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`forgejo_read_lib_files',`
+	gen_require(`
+		type forgejo_var_lib_t;
+	')
+
+	files_search_var_lib($1)
+	read_files_pattern($1, forgejo_var_lib_t, forgejo_var_lib_t)
+')
+
+########################################
+## <summary>
+##	Manage forgejo lib files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`forgejo_manage_lib_files',`
+	gen_require(`
+		type forgejo_var_lib_t;
+	')
+
+	files_search_var_lib($1)
+	manage_files_pattern($1, forgejo_var_lib_t, forgejo_var_lib_t)
+')
+
+########################################
+## <summary>
+##	Manage forgejo lib directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`forgejo_manage_lib_dirs',`
+	gen_require(`
+		type forgejo_var_lib_t;
+	')
+
+	files_search_var_lib($1)
+	manage_dirs_pattern($1, forgejo_var_lib_t, forgejo_var_lib_t)
+')
+
+
+########################################
+## <summary>
+##	All of the rules required to administrate
+##	an forgejo environment
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`forgejo_admin',`
+	gen_require(`
+		type forgejo_t;
+		type forgejo_log_t;
+		type forgejo_var_lib_t;
+	')
+
+	allow $1 forgejo_t:process { signal_perms };
+	ps_process_pattern($1, forgejo_t)
+
+    tunable_policy(`deny_ptrace',`',`
+        allow $1 forgejo_t:process ptrace;
+    ')
+
+	logging_search_logs($1)
+	admin_pattern($1, forgejo_log_t)
+
+	files_search_var_lib($1)
+	admin_pattern($1, forgejo_var_lib_t)
+	optional_policy(`
+		systemd_passwd_agent_exec($1)
+		systemd_read_fifo_file_passwd_run($1)
+	')
+')

forgejo.sh

@@ -0,0 +1,56 @@
+#!/bin/sh -e
+
+DIRNAME=`dirname $0`
+cd $DIRNAME
+USAGE="$0 [ --update ]"
+if [ `id -u` != 0 ]; then
+echo 'You must be root to run this script'
+exit 1
+fi
+
+if [ $# -eq 1 ]; then
+	if [ "$1" = "--update" ] ; then
+		time=`ls -l --time-style="+%x %X" forgejo.te | awk '{ printf "%s %s", $6, $7 }'`
+		rules=`ausearch --start $time -m avc --raw -se forgejo`
+		if [ x"$rules" != "x" ] ; then
+			echo "Found avc's to update policy with"
+			echo -e "$rules" | audit2allow -R
+			echo "Do you want these changes added to policy [y/n]?"
+			read ANS
+			if [ "$ANS" = "y" -o "$ANS" = "Y" ] ; then
+				echo "Updating policy"
+				echo -e "$rules" | audit2allow -R >> forgejo.te
+				# Fall though and rebuild policy
+			else
+				exit 0
+			fi
+		else
+			echo "No new avcs found"
+			exit 0
+		fi
+	else
+		echo -e $USAGE
+		exit 1
+	fi
+elif [ $# -ge 2 ] ; then
+	echo -e $USAGE
+	exit 1
+fi
+
+echo "Building and Loading Policy"
+set -x
+make -f /usr/share/selinux/devel/Makefile forgejo.pp || exit
+/usr/sbin/semodule -i forgejo.pp
+
+# Generate a man page of the installed module
+sepolicy manpage -p . -d forgejo_t
+# Fixing the file context on /usr/bin/forgejo
+/sbin/restorecon -F -R -v /usr/bin/forgejo
+# Fixing the file context on /var/log/forgejo
+/sbin/restorecon -F -R -v /var/log/forgejo
+# Fixing the file context on /var/lib/forgejo
+/sbin/restorecon -F -R -v /var/lib/forgejo
+# Generate a rpm package for the newly generated policy
+
+pwd=$(pwd)
+rpmbuild --define "_sourcedir ${pwd}" --define "_specdir ${pwd}" --define "_builddir ${pwd}" --define "_srcrpmdir ${pwd}" --define "_rpmdir ${pwd}" --define "_buildrootdir ${pwd}/.build"  -ba forgejo_selinux.spec

forgejo.spec

@@ -18,6 +18,21 @@
 
 %define gitea_version 1.21.8
 %define forgejo_version 0
+%if 0%{?suse_version} > 1600
+# TW
+%bcond_without selinux
+%bcond_without apparmor
+%else
+%if 0%{?suse_version} == 1600
+# ALP
+%bcond_without selinux
+%bcond_with apparmor
+%else
+# Leap & SLE
+%bcond_with selinux
+%bcond_without apparmor
+%endif
+%endif
 Name:           forgejo
 Version:        %{gitea_version}+%{forgejo_version}
 Release:        0
@@ -25,19 +40,23 @@ Summary:        Self-hostable forge
 License:        MIT
 Group:          Development/Tools/Version Control
 URL:            https://forgejo.org
-Source0:        https://codeberg.org/forgejo/forgejo/releases/download/v%{gitea_version}-%{forgejo_version}/%{name}-src-%{gitea_version}-%{forgejo_version}.tar.gz
+Source0:        https://codeberg.org/%{name}/%{name}/releases/download/v%{gitea_version}-%{forgejo_version}/%{name}-src-%{gitea_version}-%{forgejo_version}.tar.gz
-Source1:        https://codeberg.org/forgejo/forgejo/releases/download/v%{gitea_version}-%{forgejo_version}/%{name}-src-%{gitea_version}-%{forgejo_version}.tar.gz.asc
+Source1:        https://codeberg.org/%{name}/%{name}/releases/download/v%{gitea_version}-%{forgejo_version}/%{name}-src-%{gitea_version}-%{forgejo_version}.tar.gz.asc
-Source2:        http://keyserver.ubuntu.com/pks/lookup?op=get&search=0xeb114f5e6c0dc2bcdd183550a4b61a2dc5923710#/forgejo.keyring
+Source2:        http://keyserver.ubuntu.com/pks/lookup?op=get&search=0xeb114f5e6c0dc2bcdd183550a4b61a2dc5923710#/%{name}.keyring
 Source3:        package-lock.json
 Source4:        node_modules.spec.inc
 %include        %{_sourcedir}/node_modules.spec.inc
-Source5:        forgejo.service
+Source5:        %{name}.service
-Source6:        forgejo.sysusers
+Source6:        %{name}.sysusers
-Source7:        apparmor-usr.bin.forgejo
+Source7:        apparmor-usr.bin.%{name}
+Source8:        %{name}.fc
+Source9:        %{name}.if
+Source10:       %{name}.sh
+Source11:       %{name}.te
 Source99:       get-sources.sh
 Patch0:         custom-app.ini.patch
 BuildRequires:  golang-packaging
-BuildRequires:  go >= 1.21
+BuildRequires:  golang(API) = 1.22
 ## node >= 20
 %if 0%{?suse_version} == 1500
 BuildRequires:  nodejs-devel-default
@@ -49,24 +68,42 @@ BuildRequires:  local-npm-registry
 BuildRequires:  make
 BuildRequires:  systemd-rpm-macros
 BuildRequires:  sysuser-tools
-BuildRequires:  apparmor-abstractions
-BuildRequires:  apparmor-parser
-BuildRequires:  apparmor-rpm-macros
 Requires:       git-core
 Requires:       git-lfs
-Requires:       (%{name}-apparmor if apparmor)
+Requires:       (%{name}-apparmor if apparmor-abstractions)
-Requires(pre):  shadow
+Requires:       (%{name}-selinux if selinux-policy-targeted)
+%if %{with apparmor}
+BuildRequires:  apparmor-abstractions
+BuildRequires:  apparmor-rpm-macros
+BuildRequires:  libapparmor-devel
+%endif
+%if %{with selinux}
+BuildRequires:  checkpolicy
+BuildRequires:  selinux-policy-devel
+%endif
 %{systemd_requires}
 %{sysusers_requires}
 
+%if %{with apparmor}
 %package apparmor
 Summary:        Apparmor profile for %{name}
-Supplements:    (%{name} and apparmor)
+BuildArch:      noarch
-Requires:       apparmor
+Requires:       %{name} = %{version}-%{release}
-Recommends:     apparmor-abstractions
 
 %description apparmor
-This package includes the apparmor profile for %{name}
+This package adds the Apparmor profile to %{name}
+%endif
+
+%if %{with selinux}
+%package selinux
+Summary:        Selinux support for %{name}
+BuildArch:      noarch
+Requires:       %{name} = %{version}-%{release}
+Requires:       selinux-policy-targeted
+
+%description selinux
+This package adds SELinux enforcement to %{name}.
+%endif
 
 %description
 Providing Git hosting for your project, friends, company or community? Forgejo (/for'd͡ʒe.jo/ inspired by forĝejo
@@ -80,39 +117,61 @@ local-npm-registry %{_sourcedir} install --also=dev
 %sysusers_generate_pre %{SOURCE6} %{name} %{name}.conf
 export EXTRA_GOFLAGS="-buildmode=pie -mod=vendor"
 export TAGS="bindata timetzdata sqlite sqlite_unlock_notify"
-%{make_build}
+%make_build
 
 %install
 install -d %{buildroot}%{_bindir}
-install -d %{buildroot}%{_sysconfdir}/apparmor.d
+install -d %{buildroot}%{_datadir}/%{name}
-install -d %{buildroot}%{_datadir}/forgejo
+install -d %{buildroot}%{_datadir}/%{name}/{conf,https,mailer}
-install -d %{buildroot}%{_datadir}/forgejo/{conf,https,mailer}
 ln -s %{name} %{buildroot}%{_bindir}/gitea
 install -d %{buildroot}%{_sharedstatedir}/%{name}/{data,https,indexers,queues,repositories}
 install -d %{buildroot}%{_sysconfdir}/%{name}
 install -d %{buildroot}%{_localstatedir}/log/%{name}
 install -D -m 0644 %{_builddir}/%{name}-src-%{gitea_version}-%{forgejo_version}/custom/conf/app.example.ini %{buildroot}%{_sysconfdir}/%{name}/conf/app.ini
-install -D -m 0755 %{_builddir}/%{name}-src-%{gitea_version}-%{forgejo_version}/gitea %{buildroot}%{_bindir}/forgejo
+install -D -m 0755 %{_builddir}/%{name}-src-%{gitea_version}-%{forgejo_version}/gitea %{buildroot}%{_bindir}/%{name}
-install -D -m 0644 %{SOURCE5} %{buildroot}%{_unitdir}/forgejo.service
+install -D -m 0644 %{SOURCE5} %{buildroot}%{_unitdir}/%{name}.service
 install -D -m 0644 %{SOURCE6} %{buildroot}%{_sysusersdir}/%{name}.conf
-install -m 0644 %{SOURCE7} %{buildroot}%{_sysconfdir}/apparmor.d/usr.bin.forgejo
+
+%if %{with apparmor}
+install -d %{buildroot}%{_sysconfdir}/apparmor.d
+install -Dm0644 %{SOURCE7} %{buildroot}%{_sysconfdir}/apparmor.d/usr.bin.%{name}
+%endif
+
+%if %{with selinux}
+cd %{_sourcedir}
+make -f %{_datadir}/selinux/devel/Makefile %{name}.pp
+install -Dm0644 %{name}.pp %{buildroot}%{_datadir}/selinux/packages/%{name}/%{name}.pp
+install -Dm0644 %{name}.if %{buildroot}%{_datadir}/selinux/devel/include/distributed/%{name}.if
+%endif
 
 %pre -f %{name}.pre
-%service_add_pre forgejo.service
+%service_add_pre %{name}.service
 
 %post
-%service_add_post forgejo.service
+%service_add_post %{name}.service
-%apparmor_reload %{_sysconfdir}/apparmor.d/usr.bin.forgejo
+
+%if %{with apparmor}
+%post apparmor
+%apparmor_reload %{_sysconfdir}/apparmor.d/usr.bin.%{name}
+%endif
+
+%if %{with selinux}
+%post selinux
+semodule -i %{_datadir}/selinux/packages/%{name}/%{name}.pp 2>/dev/null || :
+
+%preun selinux
+semodule -r %{name} 2>/dev/null || :
+%endif
 
 %preun
-%service_del_preun forgejo.service
+%service_del_preun %{name}.service
 
 %postun
-%service_del_postun forgejo.service
+%service_del_postun %{name}.service
 
 %check
 #right now broken, see https://github.com/openSUSE/obs-service-node_modules/issues/22
-#make test
+#%%make_test
 
 %files
 %license LICENSE
@@ -125,11 +184,21 @@ install -m 0644 %{SOURCE7} %{buildroot}%{_sysconfdir}/apparmor.d/usr.bin.forgejo
 %{_sysconfdir}/%{name}
 %{_localstatedir}/log/%{name}
 %defattr(0660,forgejo,forgejo,750)
-%{_datadir}/forgejo
+%{_datadir}/%{name}
 %{_sharedstatedir}/%{name}
 %{_sysusersdir}/%{name}.conf
 
+%if %{with apparmor}
 %files apparmor
-%config %{_sysconfdir}/apparmor.d/usr.bin.forgejo
+%dir %{_sysconfdir}/apparmor.d
+%config %{_sysconfdir}/apparmor.d/usr.bin.%{name}
+%endif
+
+%if %{with selinux}
+%files selinux
+%dir %{_datadir}/selinux/devel/include/distributed
+%{_datadir}/selinux/packages/%{name}
+%{_datadir}/selinux/devel/include/distributed/%{name}.if
+%endif
 
 %changelog

forgejo.te

@@ -0,0 +1,41 @@
+policy_module(forgejo, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type forgejo_t;
+type forgejo_exec_t;
+init_daemon_domain(forgejo_t, forgejo_exec_t)
+
+permissive forgejo_t;
+
+type forgejo_log_t;
+logging_log_file(forgejo_log_t)
+
+type forgejo_var_lib_t;
+files_type(forgejo_var_lib_t)
+
+########################################
+#
+# forgejo local policy
+#
+allow forgejo_t self:fifo_file rw_fifo_file_perms;
+allow forgejo_t self:unix_stream_socket create_stream_socket_perms;
+
+manage_dirs_pattern(forgejo_t, forgejo_log_t, forgejo_log_t)
+manage_files_pattern(forgejo_t, forgejo_log_t, forgejo_log_t)
+manage_lnk_files_pattern(forgejo_t, forgejo_log_t, forgejo_log_t)
+logging_log_filetrans(forgejo_t, forgejo_log_t, { dir file lnk_file })
+
+manage_dirs_pattern(forgejo_t, forgejo_var_lib_t, forgejo_var_lib_t)
+manage_files_pattern(forgejo_t, forgejo_var_lib_t, forgejo_var_lib_t)
+manage_lnk_files_pattern(forgejo_t, forgejo_var_lib_t, forgejo_var_lib_t)
+files_var_lib_filetrans(forgejo_t, forgejo_var_lib_t, { dir file lnk_file })
+
+domain_use_interactive_fds(forgejo_t)
+
+files_read_etc_files(forgejo_t)
+
+miscfiles_read_localization(forgejo_t)