sec-policy/selinux-base/selinux-base-2.20140311-r5.ebuild

   1 # Copyright 1999-2015 Gentoo Foundation
   2 # Distributed under the terms of the GNU General Public License v2
   3 # $Id$
   4 EAPI="5"
   5
   6 inherit eutils
   7
   8 if [[ ${PV} == 9999* ]]; then
   9         EGIT_REPO_URI="${SELINUX_GIT_REPO:-git://anongit.gentoo.org/proj/hardened-refpolicy.git https://anongit.gentoo.org/git/proj/hardened-refpolicy.git}"
  10         EGIT_BRANCH="${SELINUX_GIT_BRANCH:-master}"
  11         EGIT_SOURCEDIR="${WORKDIR}/refpolicy"
  12
  13         inherit git-2
  14
  15         KEYWORDS=""
  16 else
  17         SRC_URI="http://oss.tresys.com/files/refpolicy/refpolicy-${PV}.tar.bz2
  18                         https://dev.gentoo.org/~swift/patches/selinux-base-policy/patchbundle-selinux-base-policy-${PVR}.tar.bz2"
  19
  20         KEYWORDS="amd64 x86"
  21 fi
  22
  23 IUSE="+peer_perms +open_perms +ubac +unconfined doc"
  24
  25 DESCRIPTION="Gentoo base policy for SELinux"
  26 HOMEPAGE="https://www.gentoo.org/proj/en/hardened/selinux/"
  27 LICENSE="GPL-2"
  28 SLOT="0"
  29
  30 RDEPEND=">=sys-apps/policycoreutils-2.3
  31         virtual/udev
  32         !<=sec-policy/selinux-base-policy-2.20120725"
  33 DEPEND="${RDEPEND}
  34         sys-devel/m4
  35         >=sys-apps/checkpolicy-2.3"
  36
  37 S=${WORKDIR}/
  38
  39 #src_unpack() {
  40 #       git-2_src_unpack
  41 #}
  42
  43 src_prepare() {
  44         if [[ ${PV} != 9999* ]]; then
  45                 # Apply the gentoo patches to the policy. These patches are only necessary
  46                 # for base policies, or for interface changes on modules.
  47                 EPATCH_MULTI_MSG="Applying SELinux policy updates ... " \
  48                 EPATCH_SUFFIX="patch" \
  49                 EPATCH_SOURCE="${WORKDIR}" \
  50                 EPATCH_FORCE="yes" \
  51                 epatch
  52         fi
  53
  54         cd "${S}/refpolicy"
  55         make bare
  56         # Fix bug 257111 - Correct the initial sid for cron-started jobs in the
  57         # system_r role
  58         sed -i -e 's:system_crond_t:system_cronjob_t:g' \
  59                 "${S}/refpolicy/config/appconfig-standard/default_contexts"
  60         sed -i -e 's|system_r:cronjob_t|system_r:system_cronjob_t|g' \
  61                 "${S}/refpolicy/config/appconfig-mls/default_contexts"
  62         sed -i -e 's|system_r:cronjob_t|system_r:system_cronjob_t|g' \
  63                 "${S}/refpolicy/config/appconfig-mcs/default_contexts"
  64
  65         epatch_user
  66 }
  67
  68 src_configure() {
  69         [ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="targeted strict mls mcs"
  70
  71         # Update the SELinux refpolicy capabilities based on the users' USE flags.
  72
  73         if ! use peer_perms; then
  74                 sed -i -e '/network_peer_controls/d' \
  75                         "${S}/refpolicy/policy/policy_capabilities"
  76         fi
  77
  78         if ! use open_perms; then
  79                 sed -i -e '/open_perms/d' \
  80                         "${S}/refpolicy/policy/policy_capabilities"
  81         fi
  82
  83         if ! use ubac; then
  84                 sed -i -e '/^UBAC/s/y/n/' "${S}/refpolicy/build.conf" \
  85                         || die "Failed to disable User Based Access Control"
  86         fi
  87
  88         echo "DISTRO = gentoo" >> "${S}/refpolicy/build.conf"
  89
  90         # Prepare initial configuration
  91         cd "${S}/refpolicy";
  92         make conf || die "Make conf failed"
  93
  94         # Setup the policies based on the types delivered by the end user.
  95         # These types can be "targeted", "strict", "mcs" and "mls".
  96         for i in ${POLICY_TYPES}; do
  97                 cp -a "${S}/refpolicy" "${S}/${i}"
  98                 cd "${S}/${i}";
  99
 100                 #cp "${FILESDIR}/modules-2.20120215.conf" "${S}/${i}/policy/modules.conf"
 101                 sed -i -e "/= module/d" "${S}/${i}/policy/modules.conf"
 102
 103                 sed -i -e '/^QUIET/s/n/y/' -e "/^NAME/s/refpolicy/$i/" \
 104                         "${S}/${i}/build.conf" || die "build.conf setup failed."
 105
 106                 if [[ "${i}" == "mls" ]] || [[ "${i}" == "mcs" ]];
 107                 then
 108                         # MCS/MLS require additional settings
 109                         sed -i -e "/^TYPE/s/standard/${i}/" "${S}/${i}/build.conf" \
 110                                 || die "failed to set type to mls"
 111                 fi
 112
 113                 if [ "${i}" == "targeted" ]; then
 114                         sed -i -e '/root/d' -e 's/user_u/unconfined_u/' \
 115                         "${S}/${i}/config/appconfig-standard/seusers" \
 116                         || die "targeted seusers setup failed."
 117                 fi
 118
 119                 if [ "${i}" != "targeted" ] && [ "${i}" != "strict" ] && use unconfined; then
 120                         sed -i -e '/root/d' -e 's/user_u/unconfined_u/' \
 121                         "${S}/${i}/config/appconfig-${i}/seusers" \
 122                         || die "policy seusers setup failed."
 123                 fi
 124         done
 125 }
 126
 127 src_compile() {
 128         [ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="targeted strict mls mcs"
 129
 130         for i in ${POLICY_TYPES}; do
 131                 cd "${S}/${i}"
 132                 make base || die "${i} compile failed"
 133                 if use doc; then
 134                         make html || die
 135                 fi
 136         done
 137 }
 138
 139 src_install() {
 140         [ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="targeted strict mls mcs"
 141
 142         for i in ${POLICY_TYPES}; do
 143                 cd "${S}/${i}"
 144
 145                 make DESTDIR="${D}" install \
 146                         || die "${i} install failed."
 147
 148                 make DESTDIR="${D}" install-headers \
 149                         || die "${i} headers install failed."
 150
 151                 echo "run_init_t" > "${D}/etc/selinux/${i}/contexts/run_init_type"
 152
 153                 echo "textrel_shlib_t" >> "${D}/etc/selinux/${i}/contexts/customizable_types"
 154
 155                 # libsemanage won't make this on its own
 156                 keepdir "/etc/selinux/${i}/policy"
 157
 158                 if use doc; then
 159                         dohtml doc/html/*;
 160                 fi
 161
 162                 insinto /usr/share/selinux/devel;
 163                 doins doc/policy.xml;
 164
 165         done
 166
 167         dodoc doc/Makefile.example doc/example.{te,fc,if}
 168
 169         doman man/man8/*.8;
 170
 171         insinto /etc/selinux
 172         doins "${FILESDIR}/config"
 173 }
 174
 175 pkg_preinst() {
 176         has_version "<${CATEGORY}/${PN}-2.20101213-r13"
 177         previous_less_than_r13=$?
 178 }