selinux-policy/selinux-policy.spec

#
# spec file for package selinux-policy
#
# Copyright (c) 2018 SUSE LINUX GmbH, Nuernberg, Germany.
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
# upon. The license for this file, and modifications and additions to the
# file, is the same license as for the pristine package itself (unless the
# license for the pristine package is not an Open Source License, in which
# case the license is the MIT License). An "Open Source License" is a
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.

# Please submit bugfixes or comments via http://bugs.opensuse.org/
#


#Compat macro for new _fillupdir macro introduced in Nov 2017
%if ! %{defined _fillupdir}
  %define _fillupdir /var/adm/fillup-templates
%endif

# TODO: This turns on distro-specific policies.
# There are almost no SUSE specific modifications available in the policy, so we utilize the
# ones used by redhat and include also the SUSE specific ones (see sed statement below)
%define distro suse
%define ubac n
%define polyinstatiate n
%define monolithic n
%define BUILD_DOC 1
%define BUILD_TARGETED 1
%define BUILD_MINIMUM 1
%define BUILD_MLS 1

%define POLICYCOREUTILSVER %(rpm -q --qf %%{version} policycoreutils)
%define CHECKPOLICYVER %POLICYCOREUTILSVER

%define coreutils_ge() %{lua: if (rpm.vercmp(rpm.expand("%POLICYCOREUTILSVER"), rpm.expand("%1")) >= 0) then print "1" else  print "0" end }

# conditional stuff depending on policycoreutils version
# See https://github.com/SELinuxProject/selinux/wiki/Policy-Store-Migration
%if %{coreutils_ge 2.5}

# Policy version, see https://selinuxproject.org/page/NB_PolicyType#Policy_Versions
# It depends on the kernel, but apparently more so on the libsemanage version.
%define POLICYVER 30

# macros calling module_store have to be defined using global, not define, and
# "lazy" evaluation
%global module_store() %{_localstatedir}/lib/selinux/%%{1}
%global policy_prio 100
%global module_dir active/modules/%{policy_prio}
%global module_disabled() %{module_store %%{1}}/active/modules/disabled/%%{2}

%global install_pp() \
	(cd %{buildroot}/%{_usr}/share/selinux/%1/ \
	 /usr/sbin/semodule -s %%{1} -X %{policy_prio} -n -p %{buildroot} -i *.pp \
         rm -f *pp*); 

# FixMe 170315: None of these exist any more. Are they necessary?
%global files_base_pp() %nil
%global touch_file_contexts() touch %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files/file_contexts.local
%global files_file_contexts() %nil
%global mkdir_other() \
    %{__mkdir} -p %{buildroot}%{module_store %%1}/active/modules/disabled
%global files_other() \
    %dir %{module_store %%1}/active/modules \
    %dir %{module_store %%1}/active/modules/disabled \
    %{module_disabled %%1 sandbox}
%global files_dot_bin() %nil
%global rm_selinux_mod() rm -rf %%1

%else
# Policy version, see https://selinuxproject.org/page/NB_PolicyType#Policy_Versions
# It depends on the kernel, but apparently more so on the libsemanage version.
%define POLICYVER 29

%global module_store() %{_sysconfdir}/selinux/%%{1}/modules
%global module_dir active/modules
%global module_disabled() %{module_store %%{1}}/active/modules/%%{2}.pp.disabled

# FixMe 170315: Why is bzip2 used here rather than semodule -i?
%global install_pp() \
	(cd  %{buildroot}/%{_usr}/share/selinux/%%1/ \
	 bzip2 -c base.pp > %{buildroot}/%{_sysconfdir}/selinux/%%1/modules/active/base.pp \
	 rm -f base.pp \
	 for i in *.pp; do \
	    bzip2 -c $i > %{buildroot}/%{_sysconfdir}/selinux/%%1/modules/active/modules/$i \
	 done \
         rm -f *pp* );

# FixMe 170315:
# Why is base.pp installed in a different path than other modules?
# Requirement of policycoreutils 2.3 ??
%global files_base_pp() %verify(not md5 size mtime) %{module_store %%{1}}/active/base.pp

# FixMe 170315: do we really need these?
%global touch_file_contexts() \
    touch %{buildroot}%{_sysconfdir}/selinux/%%1/modules/active/file_contexts.local \
    touch %{buildroot}%{_sysconfdir}/selinux/%%1/modules/active/file_contexts.homedirs.bin \
    touch %{buildroot}%{_sysconfdir}/selinux/%%1/modules/active/file_contexts.bin;

%global mkdir_other() %nil

# FixMe 170315: do we really need these?
%global files_file_contexts() \
    %verify(not md5 size mtime) %{_sysconfdir}/selinux/%%1/modules/active/file_contexts.homedirs \
    %verify(not md5 size mtime) %{_sysconfdir}/selinux/%%1/modules/active/file_contexts.template

# FixMe 170315: do we really need these?
%global files_other() \
    %config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/selinux/%%1/modules/active/seusers.final \
    %verify(not md5 size mtime) %{_sysconfdir}/selinux/%%1/modules/active/netfilter_contexts

%global files_dot_bin() %ghost %{module_store %%{1}}/active/*.bin
%global rm_selinux_mod() rm -f %%{1}.pp

%endif

Summary:        SELinux policy configuration
License:        GPL-2.0-or-later
Group:          System/Management
Name:           selinux-policy
Version:        20180701
Release:        0
Source:         https://github.com/SELinuxProject/refpolicy/releases/download/RELEASE_2_%{version}/refpolicy-2.%{version}.tar.bz2

Source10:       modules-targeted-base.conf
Source12:       modules-mls-base.conf
Source13:       modules-minimum-disable.lst

Source20:       booleans-targeted.conf
Source21:       booleans-mls.conf
Source22:       booleans-minimum.conf

Source30:       setrans-targeted.conf
Source31:       setrans-mls.conf
Source32:       setrans-minimum.conf

Source40:       securetty_types-targeted
Source41:       securetty_types-mls
Source42:       securetty_types-minimum

Source50:       users-targeted
Source51:       users-mls
Source52:       users-minimum

Source60:       selinux-policy.conf
Source61:       selinux-policy.sysconfig

Source90:       selinux-policy-rpmlintrc
Source91:       Makefile.devel
Source92:       customizable_types
Source93:       config.tgz
Source94:       file_contexts.subs_dist

Patch001:      label_sysconfig.selinux.patch
Patch002:      label_var_run_rsyslog.patch
Patch003:      suse_additions_obs.patch
Patch004:      suse_additions_sslh.patch
Patch005:      suse_modifications_apache.patch
Patch007:      suse_modifications_cron.patch
Patch009:      suse_modifications_getty.patch
Patch012:      suse_modifications_logging.patch
Patch013:      suse_modifications_ntp.patch
Patch021:      suse_modifications_usermanage.patch
Patch022:      suse_modifications_virt.patch
Patch023:      suse_modifications_xserver.patch
Patch024:      sysconfig_network_scripts.patch
Patch025:      segenxml_interpreter.patch

Url:            http://oss.tresys.com/repos/refpolicy/
BuildRoot:      %{_tmppath}/%{name}-%{version}-build
BuildArch:      noarch
BuildRequires:  %fillup_prereq
BuildRequires:  %insserv_prereq
BuildRequires:  bzip2
BuildRequires:  checkpolicy
BuildRequires:  gawk
BuildRequires:  libxml2-tools
BuildRequires:  m4
BuildRequires:  policycoreutils
BuildRequires:  python3-policycoreutils
BuildRequires:  python
BuildRequires:  python-xml
#BuildRequires:  selinux-policy-devel
# we need selinuxenabled
Requires(post): selinux-tools
Requires(pre):  policycoreutils >= %{POLICYCOREUTILSVER}
Requires(post): /bin/awk /usr/bin/sha512sum
Recommends:     audit
Recommends:     selinux-tools
# for audit2allow
Recommends:     python3-policycoreutils
Recommends:     policycoreutils

%global makeCmds() \
make %{?_smp_mflags} SYSTEMD=y UNK_PERMS=%4 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=%{ubac} DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} MLS_CATS=1024 MCS_CATS=1024 bare \
make %{?_smp_mflags} SYSTEMD=y UNK_PERMS=%4 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=%{ubac} DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} MLS_CATS=1024 MCS_CATS=1024 conf \
cp -f selinux_config/booleans-%1.conf ./policy/booleans.conf \
#cp -f selinux_config/users-%1 ./policy/users \
#cp -f selinux_config/modules-%1-base.conf  ./policy/modules.conf \

%global makeModulesConf() \
cp -f selinux_config/modules-%1-%2.conf ./policy/modules-base.conf \
cp -f selinux_config/modules-%1-%2.conf ./policy/modules.conf \
#if [ "%3" = "contrib" ];then \
#  cp selinux_config/modules-%1-%3.conf ./policy/modules-contrib.conf; \
#  cat selinux_config/modules-%1-%3.conf >> ./policy/modules.conf; \
#fi; \

%global installCmds() \
make %{?_smp_mflags} SYSTEMD=y UNK_PERMS=%4 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=%{ubac} DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} MLS_CATS=1024 MCS_CATS=1024 SEMOD_EXP="/usr/bin/semodule_expand -a" base.pp \
make %{?_smp_mflags} validate SYSTEMD=y UNK_PERMS=%4 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=%{ubac} DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} MLS_CATS=1024 MCS_CATS=1024 SEMOD_EXP="/usr/bin/semodule_expand -a" modules \
make %{?_smp_mflags} SYSTEMD=y UNK_PERMS=%4 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=%{ubac} DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} MLS_CATS=1024 MCS_CATS=1024 install \
make %{?_smp_mflags} SYSTEMD=y UNK_PERMS=%4 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=%{ubac} DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} MLS_CATS=1024 MCS_CATS=1024 install-appconfig \
%{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/logins \
%{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/policy \
%{__mkdir} -p %{buildroot}/%{module_store %%{1}}/%{module_dir} \
%{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/contexts/files \
%{mkdir_other %%1} \
touch %{buildroot}/%{module_store %%{1}}/semanage.read.LOCK \
touch %{buildroot}/%{module_store %%{1}}/semanage.trans.LOCK \
rm -rf %{buildroot}%{_sysconfdir}/selinux/%1/booleans \
touch %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files/file_contexts.subs \
%{touch_file_contexts %%1} \
install -m0644 selinux_config/securetty_types-%1 %{buildroot}%{_sysconfdir}/selinux/%1/contexts/securetty_types \
install -m0644 selinux_config/file_contexts.subs_dist %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files \
install -m0644 selinux_config/setrans-%1.conf %{buildroot}%{_sysconfdir}/selinux/%1/setrans.conf \
install -m0644 selinux_config/customizable_types %{buildroot}%{_sysconfdir}/selinux/%1/contexts/customizable_types \
touch %{buildroot}%{module_store %%{1}}/active/seusers \
touch %{buildroot}%{module_store %%{1}}/active/nodes.local \
touch %{buildroot}%{module_store %%{1}}/active/users_extra.local \
touch %{buildroot}%{module_store %%{1}}/active/users.local \
%install_pp %%1 \
touch %{buildroot}%{module_disabled %%1 sandbox} \
/usr/sbin/semodule -s %%1 -n -B -p %{buildroot}; \
/usr/bin/sha512sum %{buildroot}%{_sysconfdir}/selinux/%1/policy/policy.* | cut -d' ' -f 1 > %{buildroot}%{_sysconfdir}/selinux/%1/.policy.sha512; \
rm -rf %{buildroot}%{_sysconfdir}/selinux/%1/contexts/netfilter_contexts  \
%nil

%global fileList() \
%defattr(-,root,root) \
%dir %{_usr}/share/selinux/%1 \
%dir %{_sysconfdir}/selinux/%1 \
%config(noreplace) %{_sysconfdir}/selinux/%1/setrans.conf \
%config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/selinux/%1/seusers \
%dir %{_sysconfdir}/selinux/%1/logins \
%dir %{module_store %%{1}} \
%verify(not md5 size mtime) %{module_store %%{1}}/semanage.read.LOCK \
%verify(not md5 size mtime) %{module_store %%{1}}/semanage.trans.LOCK \
%dir %attr(700,root,root) %dir %{module_store %%{1}}/active \
%dir %{module_store %%{1}}/%{module_dir} \
%verify(not md5 size mtime) %{module_store %%{1}}/active/policy.kern \
%verify(not md5 size mtime) %{module_store %%{1}}/active/commit_num \
%{files_base_pp %%1} \
%verify(not md5 size mtime) %{module_store %%{1}}/active/file_contexts \
%{files_file_contexts %%1} \
%{files_other %%1} \
%config(noreplace) %verify(not md5 size mtime) %{module_store %%{1}}/active/users_extra \
%verify(not md5 size mtime) %{module_store %%{1}}/active/homedir_template \
%{module_store %%{1}}/%{module_dir}/* \
%ghost %{module_store %%{1}}/active/*.local \
%{module_store %%{1}}/active/*.linked \
%{module_store %%{1}}/active/*.homedirs \
%{files_dot_bin %%1} \
%ghost %{module_store %%{1}}/active/seusers \
%dir %{_sysconfdir}/selinux/%1/policy/ \
%verify(not md5 size mtime) %{_sysconfdir}/selinux/%1/policy/policy.* \
%{_sysconfdir}/selinux/%1/.policy.sha512 \
%dir %{_sysconfdir}/selinux/%1/contexts \
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/securetty_types \
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/dbus_contexts \
%config %{_sysconfdir}/selinux/%1/contexts/x_contexts \
%config %{_sysconfdir}/selinux/%1/contexts/default_contexts \
%config %{_sysconfdir}/selinux/%1/contexts/virtual_domain_context \
%config %{_sysconfdir}/selinux/%1/contexts/virtual_image_context \
%config %{_sysconfdir}/selinux/%1/contexts/lxc_contexts \
%config %{_sysconfdir}/selinux/%1/contexts/sepgsql_contexts \
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/default_type \
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/failsafe_context \
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/initrc_context \
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/removable_context \
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/userhelper_context \
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/customizable_types \
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/openrc_contexts \
%dir %{_sysconfdir}/selinux/%1/contexts/files \
%verify(not md5 size mtime) %{_sysconfdir}/selinux/%1/contexts/files/file_contexts \
%verify(not md5 size mtime) %{_sysconfdir}/selinux/%1/contexts/files/file_contexts.homedirs \
%ghost %{_sysconfdir}/selinux/%1/contexts/files/*.bin \
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/files/file_contexts.local \
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/files/file_contexts.subs \
%{_sysconfdir}/selinux/%1/contexts/files/file_contexts.subs_dist \
%config %{_sysconfdir}/selinux/%1/contexts/files/media \
%dir %{_sysconfdir}/selinux/%1/contexts/users \
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/*

%define relabel() \
. %{_sysconfdir}/sysconfig/selinux-policy; \
FILE_CONTEXT=%{_sysconfdir}/selinux/%1/contexts/files/file_contexts; \
if selinuxenabled; then \
  if [ $? = 0  -a "${SELINUXTYPE}" = %1 -a -f ${FILE_CONTEXT}.pre ]; then \
    /sbin/fixfiles -C ${FILE_CONTEXT}.pre restore 2> /dev/null; \
    rm -f ${FILE_CONTEXT}.pre; \
  fi; \
  /sbin/restorecon -e /run/media -R /root /var/log /var/run %{_sysconfdir}/passwd* %{_sysconfdir}/group* %{_sysconfdir}/*shadow* 2> /dev/null; \
  /sbin/restorecon -R /home/*/.cache /home/*/.config 2> /dev/null || true; \
fi;

%global preInstall() \
if [ $1 -ne 1 ] && [ -s %{_sysconfdir}/selinux/config ]; then \
  . %{_sysconfdir}/selinux/config; \
  FILE_CONTEXT=%{_sysconfdir}/selinux/%%1/contexts/files/file_contexts; \
  if [ "${SELINUXTYPE}" = %%1 -a -f ${FILE_CONTEXT} ]; then \
    [ -f ${FILE_CONTEXT}.pre ] || cp -f ${FILE_CONTEXT} ${FILE_CONTEXT}.pre; \
  fi; \
  touch %{_sysconfdir}/selinux/%%1/.rebuild; \
  if [ -e %{_sysconfdir}/selinux/%%1/.policy.sha512 ]; then \
    sha512=`sha512sum %{module_store %%{1}}/active/policy.kern | cut -d ' ' -f 1`; \
    checksha512=`cat %{_sysconfdir}/selinux/%%1/.policy.sha512`; \
    if [ "$sha512" = "$checksha512" ] ; then \
      rm %{_sysconfdir}/selinux/%%1/.rebuild; \
    fi; \
  fi; \
fi;

%global postInstall() \
. %{_sysconfdir}/selinux/config; \
if [ -e %{_sysconfdir}/selinux/%%2/.rebuild ]; then \
  rm %{_sysconfdir}/selinux/%%2/.rebuild; \
  (cd %{module_store %%2}/%{module_dir}; for _mod in shutdown amavis clamav gnomeclock matahari xfs kudzu kerneloops execmem openoffice ada tzdata hal hotplug howl java mono moilscanner gamin audio_entropy audioentropy iscsid polkit_auth polkit rtkit_daemon ModemManager telepathysofiasip ethereal passanger qpidd pyzor razor pki-selinux phpfpm consoletype ctdbd fcoemon isnsd l2tp rgmanager corosync aisexec pacemaker; do %{rm_selinux_mod ${_mod}}; done ) \
  /usr/sbin/semodule -B -n -s %%2; \
else \
  touch %{module_disabled %%2 sandbox} \
fi; \
if [ "${SELINUXTYPE}" = "%2" ]; then \
  if selinuxenabled; then \
    load_policy; \
  else \
    # probably a first install of the policy \
    true; \
  fi; \
fi; \
if selinuxenabled; then \
  if [ %1 -eq 1 ]; then \
    /sbin/restorecon -R /root /var/log /var/run 2> /dev/null; \
  else \
    %relabel %2 \
  fi; \
else \
  # run fixfiles on next boot \
  touch /.autorelabel \
fi;

%define modulesList() \
awk '$1 !~ "/^#/" && $2 == "=" && $3 == "module" { printf "%%s ", $1 }' ./policy/modules-base.conf > %{buildroot}/%{_usr}/share/selinux/%1/modules-base.lst \
if [ -e ./policy/modules-contrib.conf ];then \
  awk '$1 !~ "/^#/" && $2 == "=" && $3 == "module" { printf "%%s ", $1 }' ./policy/modules-contrib.conf > %{buildroot}/%{_usr}/share/selinux/%1/modules-contrib.lst; \
fi;

%files
%defattr(-,root,root,-)
%doc COPYING
%dir %{_usr}/share/selinux
%dir %{_sysconfdir}/selinux
%ghost %config(noreplace) %{_sysconfdir}/selinux/config
%{_fillupdir}/sysconfig.%{name}
%{_usr}/lib/tmpfiles.d/selinux-policy.conf

%description
SELinux Reference Policy. A complete SELinux policy that can be used as the system policy for a variety of
systems and used as the basis for creating other policies. 

%prep
%setup -n refpolicy
%patch001 -p1
%patch002 -p1
%patch003 -p1
%patch004 -p1
%patch005 -p1
%patch007 -p1
%patch009 -p1
%patch012 -p1
%patch013 -p1
%patch021 -p1
%patch022 -p1
%patch023 -p1
%patch024 -p1
%patch025 -p1

%build

%install
mkdir selinux_config
for i in %{SOURCE10} %{SOURCE12} %{SOURCE20} %{SOURCE21} %{SOURCE22} %{SOURCE30} %{SOURCE31} %{SOURCE32} %{SOURCE40} %{SOURCE41} %{SOURCE42} %{SOURCE91} %{SOURCE92} %{SOURCE93} %{SOURCE94};do
 cp $i selinux_config
done
tar zxvf selinux_config/config.tgz
# Build targeted policy
%{__rm} -fR %{buildroot}
mkdir -p %{buildroot}%{_sysconfdir}/selinux
mkdir -p %{buildroot}%{_usr}/lib/tmpfiles.d/
cp %{SOURCE60} %{buildroot}%{_usr}/lib/tmpfiles.d/

# Always create policy module package directories
mkdir -p %{buildroot}%{_usr}/share/selinux/{targeted,mls,minimum,modules}/

make clean
%if %{BUILD_TARGETED}
# Build targeted policy
mkdir -p %{buildroot}%{_usr}/share/selinux/targeted
%makeCmds targeted mcs n allow
%makeModulesConf targeted base contrib
%installCmds targeted mcs n allow
%modulesList targeted
%endif

%if %{BUILD_MINIMUM}
# Build minimum policy
mkdir -p %{buildroot}%{_usr}/share/selinux/minimum
%makeCmds minimum mcs n allow
%makeModulesConf targeted base contrib
%installCmds minimum mcs n allow
install -m0644 %{SOURCE13} %{buildroot}/usr/share/selinux/minimum/modules-minimum-disable.lst \
%modulesList minimum
%endif

%if %{BUILD_MLS}
# Build mls policy
mkdir -p %{buildroot}%{_usr}/share/selinux/mls
%makeCmds mls mls n deny
%makeModulesConf mls base contrib
%installCmds mls mls n deny
%modulesList mls
%endif

# Install devel
mkdir -p %{buildroot}%{_mandir}
cp -R  man/* %{buildroot}%{_mandir}
make SYSTEMD=y UNK_PERMS=allow NAME=targeted TYPE=mcs DISTRO=%{distro} UBAC=%{ubac} DIRECT_INITRC=n MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} PKGNAME=%{name}-%{version} MLS_CATS=1024 MCS_CATS=1024 install-docs
make SYSTEMD=y UNK_PERMS=allow NAME=targeted TYPE=mcs DISTRO=%{distro} UBAC=%{ubac} DIRECT_INITRC=n MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} PKGNAME=%{name}-%{version} MLS_CATS=1024 MCS_CATS=1024 install-headers
mkdir %{buildroot}%{_usr}/share/selinux/devel/
mv %{buildroot}%{_usr}/share/selinux/targeted/include %{buildroot}%{_usr}/share/selinux/devel/include
chmod +x %{buildroot}%{_usr}/share/selinux/devel/include/support/segenxml.py
install -m 644 selinux_config/Makefile.devel %{buildroot}%{_usr}/share/selinux/devel/Makefile
install -m 644 doc/example.* %{buildroot}%{_usr}/share/selinux/devel/
install -m 644 doc/policy.* %{buildroot}%{_usr}/share/selinux/devel/

rm -rf selinux_config
# fillup sysconfig
mkdir -p %{buildroot}%{_fillupdir}
cp %{SOURCE61} %{buildroot}%{_fillupdir}/sysconfig.%{name}

%clean

%post
%{fillup_only}
if [ ! -s %{_sysconfdir}/selinux/config ]; then
  # new install
  ln -sf %{_sysconfdir}/sysconfig/selinux-policy %{_sysconfdir}/selinux/config
  restorecon %{_sysconfdir}/selinux/config 2> /dev/null || :
else
  . %{_sysconfdir}/sysconfig/selinux-policy
  # if first time update booleans.local needs to be copied to sandbox
  [ -f %{_sysconfdir}/selinux/${SELINUXTYPE}/booleans.local ] && mv %{_sysconfdir}/selinux/${SELINUXTYPE}/booleans.local %{module_store targeted}/active/
  [ -f %{_sysconfdir}/selinux/${SELINUXTYPE}/seusers ] && cp -f %{_sysconfdir}/selinux/${SELINUXTYPE}/seusers %{module_store ${SELINUXTYPE}}/active/seusers
fi
exit 0

%postun
if [ $1 = 0 ]; then
  setenforce 0 2> /dev/null
  if [ -s %{_sysconfdir}/selinux/config ]; then
    sed -i --follow-symlinks 's/^SELINUX=.*/SELINUX=disabled/g' %{_sysconfdir}/selinux/config
  fi
fi
exit 0

%package devel
Summary:        SELinux policy devel
Group:          System/Management
Requires(pre):  selinux-policy = %{version}-%{release}
Requires:       /usr/bin/make
Requires:       checkpolicy >= %{CHECKPOLICYVER}
Requires:       m4

%description devel
SELinux policy development and man page package

%files devel
%defattr(-,root,root,-)
%doc /usr/share/man/ru/man8/*
%doc /usr/share/man/man8/*
%dir %{_usr}/share/selinux/devel
%dir %{_usr}/share/selinux/devel/include
%{_usr}/share/selinux/devel/include/*
%{_usr}/share/selinux/devel/Makefile
%{_usr}/share/selinux/devel/example.*

%package doc
Summary:        SELinux policy documentation
Group:          System/Management
Requires(pre):  selinux-policy = %{version}-%{release}
Requires:       /usr/bin/xdg-open

%description doc
SELinux policy documentation package

%files doc
%defattr(-,root,root,-)
%doc %{_usr}/share/doc/%{name}-%{version}
%{_usr}/share/selinux/devel/policy.*

%if %{BUILD_TARGETED}
%package targeted
Summary:        SELinux targeted base policy
Group:          System/Management
Provides:       selinux-policy-base = %{version}-%{release}
Requires(pre):  policycoreutils >= %{POLICYCOREUTILSVER}
Requires(pre):  coreutils
Requires(pre):  selinux-policy = %{version}-%{release}
Requires:       selinux-policy = %{version}-%{release}

%description targeted
SELinux Reference policy targeted base module.

%pre targeted
%preInstall targeted

%post targeted
%postInstall $1 targeted
exit 0

%files targeted
%defattr(-,root,root,-)
%fileList targeted
%{_usr}/share/selinux/targeted/modules-base.lst
%endif

%if %{BUILD_MINIMUM}
%package minimum
Summary:        SELinux minimum base policy
Group:          System/Management
Provides:       selinux-policy-base = %{version}-%{release}
Requires(post): python3-policycoreutils >= %{POLICYCOREUTILSVER}
Requires(pre):  coreutils
Requires(pre):  selinux-policy = %{version}-%{release}
Requires:       selinux-policy = %{version}-%{release}
Conflicts:      seedit

%description minimum
SELinux Reference policy minimum base module.

%pre minimum
%preInstall minimum
if [ $1 -ne 1 ]; then
  /usr/sbin/semodule -s minimum -l 2>/dev/null | awk '{ if ($3 != "Disabled") print $1; }' > /usr/share/selinux/minimum/instmodules.lst
fi

%post minimum
contribpackages=`cat /usr/share/selinux/minimum/modules-minimum-disable.lst`
if [ $1 -eq 1 ]; then
  for p in $contribpackages djbdns dkim getty geoclue lightsquid openca pyzor portage shibboleth yam portslave qemu xserver evolution thunderbird xscreensaver; do
    touch %{module_disabled minimum $p}
  done
  /sbin/restorecon -R /root /var/log /var/run 2> /dev/null
  /usr/sbin/semodule -B -s minimum
else
  instpackages=`cat /usr/share/selinux/minimum/instmodules.lst`
  for p in $contribpackages djbdns dkim getty geoclue lightsquid openca pyzor portage shibboleth yam portslave qemu xserver evolution thunderbird xscreensaver; do
    touch %{module_disabled minimum $p}
  done
  /usr/sbin/semodule -B -s minimum
  %relabel minimum
fi
exit 0

%files minimum
%defattr(-,root,root,-)
%fileList minimum
%{_usr}/share/selinux/minimum/modules-base.lst
/usr/share/selinux/minimum/modules-minimum-disable.lst
%endif

%if %{BUILD_MLS}
%package mls
Summary:        SELinux mls base policy
Group:          System/Management
Provides:       selinux-policy-base = %{version}-%{release}
Obsoletes:      selinux-policy-mls-sources < 2
Requires:       policycoreutils-newrole >= %{POLICYCOREUTILSVER}
Requires:       setransd
Requires(pre):  policycoreutils >= %{POLICYCOREUTILSVER}
Requires(pre):  coreutils
Requires(pre):  selinux-policy = %{version}-%{release}
Requires:       selinux-policy = %{version}-%{release}
Conflicts:      seedit

%description mls
SELinux Reference policy mls base module.

%pre mls
%preInstall mls

%post mls
%postInstall $1 mls

%files mls
%defattr(-,root,root,-)
%fileList mls
%{_usr}/share/selinux/mls/modules-base.lst
%endif

%changelog