Accepting request 934691 from home:aplanas:branches:security

- Use a bcond to enable selinux when is available

OBS-URL: https://build.opensuse.org/request/show/934691
OBS-URL: https://build.opensuse.org/package/show/security/tpm2.0-abrmd?expand=0&rev=63

tpm2.0-abrmd.changes

@@ -1,3 +1,8 @@
+-------------------------------------------------------------------
+Mon Nov 29 12:54:02 UTC 2021 - Alberto Planas Dominguez <aplanas@suse.com>
+
+- Warp selinux into a bcond
+
 -------------------------------------------------------------------
 Thu Nov 25 09:16:32 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
 

tpm2.0-abrmd.spec

@@ -18,6 +18,16 @@
 
 %global selinuxtype targeted
 %global modulename tabrmd
+# the auto activation is not whitelisted for <= SLE12-SP3
+%if 0%{?sle_version} > 120300 || 0%{?is_opensuse}
+%define install_dbus_files 1
+%endif
+# selinux only for Tumbleweed for now
+%if 0%{?suse_version} >= 1550 && 0%{?is_opensuse}
+%bcond_without selinux
+%else
+%bcond_with selinux
+%endif
 Name:           tpm2.0-abrmd
 Version:        2.4.0
 Release:        0
@@ -35,23 +45,19 @@ BuildRequires:  gcc-c++
 BuildRequires:  libtool
 BuildRequires:  pkgconfig
 BuildRequires:  policycoreutils
-BuildRequires:  selinux-policy-devel
 BuildRequires:  systemd-rpm-macros
 BuildRequires:  pkgconfig(dbus-1)
 BuildRequires:  pkgconfig(gio-unix-2.0)
 BuildRequires:  pkgconfig(tss2-sys)
-# due to %%selinux_requires
-BuildRequires:  pkgconfig(systemd)
-#
-BuildRequires:  selinux-policy-targeted
-Requires(pre):  user(tss)
 Requires:       libtss2-tcti-device0
 Requires:       libtss2-tcti-tabrmd0
 Requires:       tpm2-0-tss
+Requires(pre):  user(tss)
+%if %{with selinux}
+BuildRequires:  selinux-policy-devel
+BuildRequires:  selinux-policy-targeted
+BuildRequires:  pkgconfig(systemd)
 Requires:       (%{name}-selinux if selinux-policy-base)
-# the auto activation is not whitelisted for <= SLE12-SP3
-%if 0%{?sle_version} > 120300 || 0%{?is_opensuse}
-%define install_dbus_files 1
 %endif
 
 %description
@@ -70,15 +76,17 @@ Requires:       tpm2.0-abrmd = %{version}
 This package provides the development files for the Access Broker & Resource
 Manager for coordinating access to TPM 2.0 chips.
 
+%if %{with selinux}
 %package selinux
 Summary:        SELinux module for the Access Broker & Resource Manager for TPM 2.0 chips
 Group:          System/Management
-BuildArch:      noarch
 Requires:       tpm2.0-abrmd = %{version}
-%selinux_requires
+BuildArch:      noarch
+%{selinux_requires}
 
 %description selinux
 This package provides the SELinux module for the Access Broker & Resource Manager for TPM 2.0 chips.
+%endif
 
 %package -n libtss2-tcti-tabrmd0
 Summary:        Client interface library for tpm2-abrmd
@@ -98,12 +106,11 @@ use with the SAPI library (libtss2-sys) like any other TCTI.
 export CFLAGS="%{optflags} -fPIE"
 export LDFLAGS="$LDFLAGS -pie"
 %configure \
-  --disable-static \
+    --disable-static \
-  --with-sepolicy=yes \
+    %{?with_selinux: --with-sepolicy=yes} \
-  --with-systemdsystemunitdir=%{_unitdir} \
+    --with-systemdsystemunitdir=%{_unitdir} \
-  --with-dbuspolicydir=%{_datadir}/dbus-1/system.d
+    --with-dbuspolicydir=%{_datadir}/dbus-1/system.d
-  %{nil}
+%make_build PTHREAD_LDFLAGS=-pthread
-make %{?_smp_mflags} PTHREAD_LDFLAGS=-pthread
 
 %install
 %make_install
@@ -112,13 +119,15 @@ find %{buildroot} -type f -name "*.la" -delete -print
 ln -sv %{_sbindir}/service %{buildroot}%{_sbindir}/rctpm2-abrmd
 # don't install the systemd preset, our presets are handled by
 # systemd-presets-* packages
-rm %{buildroot}/usr/lib*/systemd/system-preset/tpm2-abrmd.preset
+rm %{buildroot}%{_prefix}/lib*/systemd/system-preset/tpm2-abrmd.preset
 %if ! 0%{?install_dbus_files}
 rm %{buildroot}/%{_sysconfdir}/dbus-1/system.d/tpm2-abrmd.conf
 rm %{buildroot}/%{_datadir}/dbus-1/system-services/com.intel.tss2.Tabrmd.service
 %endif
+%if %{with selinux}
 mkdir %{buildroot}%{_datadir}/selinux/packages/targeted
 mv %{buildroot}%{_datadir}/selinux/packages/tab* %{buildroot}%{_datadir}/selinux/packages/targeted
+%endif
 
 %pre
 %service_add_pre tpm2-abrmd.service
@@ -132,19 +141,21 @@ mv %{buildroot}%{_datadir}/selinux/packages/tab* %{buildroot}%{_datadir}/selinux
 %preun
 %service_del_preun tpm2-abrmd.service
 
+%if %{with selinux}
 %pre selinux
-%selinux_relabel_pre -s %{selinuxtype}
+%{selinux_relabel_pre -s %{selinuxtype}}
 
 %post selinux
-%selinux_modules_install -s %{selinuxtype} -p 200 %{_datadir}/selinux/packages/targeted/%{modulename}.pp.bz2
+%{selinux_modules_install -s %{selinuxtype} -p 200 %{_datadir}/selinux/packages/targeted/%{modulename}.pp.bz2}
 
 %postun selinux
 if [ $1 -eq 0 ]; then
-    %selinux_modules_uninstall -s %{selinuxtype} -p 200 %{modulename}
+    %{selinux_modules_uninstall -s %{selinuxtype} -p 200 %{modulename}}
 fi
 
 %posttrans selinux
-%selinux_relabel_post -s %{selinuxtype}
+%{selinux_relabel_post -s %{selinuxtype}}
+%endif
 
 %files
 %doc *.md
@@ -160,16 +171,20 @@ fi
 %{_datadir}/dbus-1/system-services/com.intel.tss2.Tabrmd.service
 %endif
 
+%if %{with selinux}
 %files selinux
 %{_datadir}/selinux/packages/targeted/tabrmd.pp.bz2
 %ghost %verify(not md5 size mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{modulename}
+%endif
 
 %files devel
 %{_includedir}/tss2
 %{_libdir}/*.so
 %{_libdir}/pkgconfig/*.pc
 %{_mandir}/man3/Tss2*
+%if %{with selinux}
 %{_datadir}/selinux/devel/include/contrib/tabrmd.if
+%endif
 
 %files -n libtss2-tcti-tabrmd0
 %{_libdir}/libtss2-tcti-tabrmd.so.*