0cdca1b
# Copyright (C) 2016  Petr Lautrbach
0cdca1b
#
0cdca1b
# This program is free software; you can redistribute it and/or
0cdca1b
# modify it under the terms of the GNU General Public License
0cdca1b
# as published by the Free Software Foundation; either version 2
0cdca1b
# of the License, or (at your option) any later version.
0cdca1b
#
0cdca1b
# This program is distributed in the hope that it will be useful,
0cdca1b
# but WITHOUT ANY WARRANTY; without even the implied warranty of
0cdca1b
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
0cdca1b
# GNU General Public License for more details.
0cdca1b
#
0cdca1b
# You should have received a copy of the GNU General Public License
0cdca1b
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
0cdca1b
0cdca1b
# RPM macros for packages installing SELinux modules
0cdca1b
0cdca1b
%_selinux_policy_version SELINUXPOLICYVERSION
0cdca1b
0cdca1b
%_file_context_file %{_sysconfdir}/selinux/${SELINUXTYPE}/contexts/files/file_contexts
0cdca1b
%_file_context_file_pre %{_localstatedir}/lib/rpm-state/file_contexts.pre
0cdca1b
0cdca1b
# %selinux_modules_install [-s <policytype>] module [module]...
0cdca1b
%selinux_modules_install("s:") \
0cdca1b
. /etc/selinux/config \
0cdca1b
_policytype=%{-s*} \
0cdca1b
if [ -z "${_policytype}" ]; then \
0cdca1b
  _policytype="targeted" \
0cdca1b
fi \
0cdca1b
%{_sbindir}/semodule -n -s ${_policytype} -X 200 -i %* \
0cdca1b
if %{_sbindir}/selinuxenabled && [ "${SELINUXTYPE}" = "${_policytype}" ]; then \
0cdca1b
  %{_sbindir}/load_policy \
0cdca1b
fi \
0cdca1b
%{nil}
0cdca1b
0cdca1b
# %selinux_modules_uninstall [-s <policytype>] module [module]...
0cdca1b
%selinux_modules_uninstall("s:") \
0cdca1b
. /etc/selinux/config \
0cdca1b
_policytype=%{-s*} \
0cdca1b
if [ -z "${_policytype}" ]; then \
0cdca1b
  _policytype="targeted" \
0cdca1b
fi \
0cdca1b
if [ $1 -eq 0 ]; then \
0cdca1b
  %{_sbindir}/semodule -n -X 200 -r %* &> /dev/null || : \
0cdca1b
  if %{_sbindir}/selinuxenabled && [ "${SELINUXTYPE}" = "${_policytype}" ]; then \
0cdca1b
    %{_sbindir}/load_policy \
0cdca1b
  fi \
0cdca1b
fi \
0cdca1b
%{nil}
0cdca1b
0cdca1b
# %selinux_relabel_pre [-s <policytype>]
0cdca1b
%selinux_relabel_pre("s:") \
0cdca1b
. /etc/selinux/config \
0cdca1b
_policytype=%{-s*} \
0cdca1b
if [ -z "${_policytype}" ]; then \
0cdca1b
  _policytype="targeted" \
0cdca1b
fi \
0cdca1b
if %{_sbindir}/selinuxenabled && [ "${SELINUXTYPE}" = "${_policytype}" ]; then \
0cdca1b
  [ -f %{_file_context_file_pre} ] || cp -f %{_file_context_file} %{_file_context_file_pre} \
0cdca1b
fi \
0cdca1b
%{nil}
0cdca1b
0cdca1b
0cdca1b
# %selinux_relabel_post [-s <policytype>]
0cdca1b
%selinux_relabel_post("s:") \
0cdca1b
. /etc/selinux/config \
0cdca1b
_policytype=%{-s*} \
0cdca1b
if [ -z "${_policytype}" ]; then \
0cdca1b
  _policytype="targeted" \
0cdca1b
fi \
0cdca1b
if /usr/sbin/selinuxenabled && [ "${SELINUXTYPE}" = "${_policytype}" ]; then \
0cdca1b
   if [ -f %{_file_context_file_pre} ]; then \
0cdca1b
     %{_sbindir}/fixfiles -C %{_file_context_file_pre} restore \
0cdca1b
     rm -f %{_file_context_file_pre} \
0cdca1b
   fi \
0cdca1b
fi \
0cdca1b
%{nil}
712a7f6
712a7f6
# %selinux_set_booleans [-s <policytype>] boolean [boolean]...
712a7f6
%selinux_set_booleans("s:") \
712a7f6
. /etc/selinux/config \
712a7f6
_policytype=%{-s*} \
712a7f6
if [ -z "${_policytype}" ]; then \
712a7f6
  _policytype="targeted" \
712a7f6
fi \
712a7f6
LOCAL_MODIFICATIONS=$(semanage boolean -E) \
712a7f6
if [ ! -f %_file_custom_defined_booleans ]; then \
712a7f6
    echo "# This file is managed by selinux.macros. Do not edit it manually" > %_file_custom_defined_booleans \
712a7f6
fi \
712a7f6
semanage_import='' \
712a7f6
for boolean in %*; do \
712a7f6
    boolean_name=${boolean%=*} \
712a7f6
    boolean_value=${boolean#*=} \
712a7f6
    boolean_local_string=$(grep "$boolean_name\$" <<<$LOCAL_MODIFICATIONS) \
712a7f6
    if [ -n "$boolean_local_string" ]; then \
712a7f6
        semanage_import="${semanage_import}\\nboolean -m -$boolean_value $boolean_name" \
712a7f6
        boolean_customized_string=$(grep "$boolean_name\$" %_file_custom_defined_booleans | tail -n 1) \
712a7f6
        if [ -n "$boolean_customized_string" ]; then \
712a7f6
            /bin/echo $boolean_customized_string >> %_file_custom_defined_booleans \
712a7f6
        else \
712a7f6
            /bin/echo $boolean_local_string >> %_file_custom_defined_booleans \
712a7f6
        fi \
712a7f6
    else \
712a7f6
        semanage_import="${semanage_import}\\nboolean -m -$boolean_value $boolean_name" \
712a7f6
        boolean_default_value=$(semanage boolean -l | grep "^$boolean_name " | sed 's/[^(]*([^,]*, *\\(on\\|off\\).*/\\1/') \
712a7f6
        /bin/echo "boolean -m --$boolean_default_value $boolean_name" >> %_file_custom_defined_booleans \
712a7f6
    fi \
712a7f6
done; \
712a7f6
if /usr/sbin/selinuxenabled && [ "${SELINUXTYPE}" = "${_policytype}" ]; then \
712a7f6
    /bin/echo -e "$semanage_import" | %{_sbindir}/semanage import -S "${_policytype}" \
712a7f6
else \
712a7f6
    echo -e "$semanage_import" | %{_sbindir}/semanage import -S "${_policytype} -N" \
712a7f6
fi \
712a7f6
%{nil}
712a7f6
712a7f6
# %selinux_unset_booleans [-s <policytype>] boolean [boolean]...
712a7f6
%selinux_unset_booleans("s:") \
712a7f6
. /etc/selinux/config \
712a7f6
_policytype=%{-s*} \
712a7f6
if [ -z "${_policytype}" ]; then \
712a7f6
  _policytype="targeted" \
712a7f6
fi \
712a7f6
semanage_import='' \
712a7f6
for boolean in %*; do \
712a7f6
    boolean_name=${boolean%=*} \
712a7f6
    boolean_customized_string=$(grep "$boolean_name\$" %_file_custom_defined_booleans | tail -n 1) \
712a7f6
    if [ -n "$boolean_customized_string" ]; then \
712a7f6
        awk "/$boolean_customized_string/ && !f{f=1; next} 1" %_file_custom_defined_booleans > %_file_custom_defined_booleans_tmp && mv %_file_custom_defined_booleans_tmp %_file_custom_defined_booleans \
712a7f6
        if ! grep -q "$boolean_name\$" %_file_custom_defined_booleans; then \
712a7f6
            semanage_import="${semanage_import}\\n${boolean_customized_string}" \
712a7f6
        fi \
712a7f6
    fi \
712a7f6
done; \
712a7f6
if /usr/sbin/selinuxenabled && [ "${SELINUXTYPE}" = "${_policytype}" ]; then \
712a7f6
    /bin/echo -e "$semanage_import" | %{_sbindir}/semanage import -S "${_policytype}" \
712a7f6
else \
712a7f6
    echo -e "$semanage_import" | %{_sbindir}/semanage import -S "${_policytype} -N" \
712a7f6
fi \
712a7f6
%{nil}