7171eb2bf3
A usual step in creating OS file system trees is to apply the correct SELinux labels for all files and directories. This is done by the org.osbuild.selinux stage, which internally uses the setfiles command in order to do so. The SELiunx policy to be used for this operation is the one of the newly created system, not the host one. It therefore can contain labels that are not known on the host. The kernel will prevent setting invalid, i.e. unknown, labels unless the caller has the CAP_MAC_ADMIN capability. By default, setfiles is executed in the setfiles_t domain, where it lacks that capability. Therefore a custom osbuild SELinux policy was created, with a special transition rule that will execute setfiles in the setfiles_mac_t domain. All stages, sources and assemblers as well as the main binary are label with the new osbuild_exec_t label. Additionally, allow a transition from osbuild_t to install_t by using `anaconda_domtrans_install`, so that ostree and rpm-ostree, which are labeled as install_exec_t, can transition to the install_t domain when called form osbuild. Update the spec file to build the policy and include it in a new osbuild-selinux sub-package.
182 lines
5 KiB
RPMSpec
182 lines
5 KiB
RPMSpec
%global forgeurl https://github.com/osbuild/osbuild
|
|
%global selinuxtype targeted
|
|
|
|
Version: 16
|
|
|
|
%forgemeta
|
|
|
|
%global pypi_name osbuild
|
|
%global pkgdir %{_prefix}/lib/%{pypi_name}
|
|
|
|
Name: %{pypi_name}
|
|
Release: 1%{?dist}
|
|
License: ASL 2.0
|
|
|
|
URL: %{forgeurl}
|
|
|
|
Source0: %{forgesource}
|
|
BuildArch: noarch
|
|
Summary: A build system for OS images
|
|
|
|
BuildRequires: make
|
|
BuildRequires: python3-devel
|
|
BuildRequires: python3-docutils
|
|
|
|
Requires: bash
|
|
Requires: coreutils
|
|
Requires: curl
|
|
Requires: dnf
|
|
Requires: e2fsprogs
|
|
Requires: glibc
|
|
Requires: policycoreutils
|
|
Requires: qemu-img
|
|
Requires: systemd
|
|
Requires: systemd-container
|
|
Requires: tar
|
|
Requires: util-linux
|
|
Requires: python3-%{pypi_name} = %{version}-%{release}
|
|
Requires: (%{name}-selinux if selinux-policy-%{selinuxtype})
|
|
|
|
# Turn off dependency generators for assemblers, runners and stages.
|
|
# They run in a container, so there's no reason to generate dependencies
|
|
# from them. As of 2020-03-25 this filters out python3.6 dependency generated
|
|
# by rhel runner.
|
|
%global __requires_exclude_from ^%{pkgdir}/(assemblers|runners|stages)/.*$
|
|
|
|
%{?python_enable_dependency_generator}
|
|
|
|
%description
|
|
A build system for OS images
|
|
|
|
%package -n python3-%{pypi_name}
|
|
Summary: %{summary}
|
|
%{?python_provide:%python_provide python3-%{pypi_name}}
|
|
|
|
%description -n python3-%{pypi_name}
|
|
A build system for OS images
|
|
|
|
%package ostree
|
|
Summary: OSTree support
|
|
Requires: %{name} = %{version}-%{release}
|
|
Requires: ostree
|
|
Requires: rpm-ostree
|
|
|
|
%description ostree
|
|
Contains the necessary stages, assembler and source
|
|
to build OSTree based images.
|
|
|
|
%package selinux
|
|
Summary: SELinux policies
|
|
Requires: %{name} = %{version}-%{release}
|
|
BuildRequires: selinux-policy
|
|
BuildRequires: selinux-policy-devel
|
|
%{?selinux_requires}
|
|
|
|
%description selinux
|
|
Contains the necessary SELinux policies that allows
|
|
osbuild to use labels unknown to the host inside the
|
|
containers it uses to build OS artifacts.
|
|
|
|
%prep
|
|
%forgesetup
|
|
|
|
%build
|
|
%py3_build
|
|
make man
|
|
|
|
# SELinux
|
|
make -f /usr/share/selinux/devel/Makefile osbuild.pp
|
|
bzip2 -9 osbuild.pp
|
|
|
|
%pre
|
|
%selinux_relabel_pre -s %{selinuxtype}
|
|
|
|
%install
|
|
%py3_install
|
|
|
|
mkdir -p %{buildroot}%{pkgdir}/stages
|
|
install -p -m 0755 $(find stages -type f) %{buildroot}%{pkgdir}/stages/
|
|
|
|
mkdir -p %{buildroot}%{pkgdir}/assemblers
|
|
install -p -m 0755 $(find assemblers -type f) %{buildroot}%{pkgdir}/assemblers/
|
|
|
|
mkdir -p %{buildroot}%{pkgdir}/runners
|
|
install -p -m 0755 $(find runners -type f -or -type l) %{buildroot}%{pkgdir}/runners
|
|
|
|
mkdir -p %{buildroot}%{pkgdir}/sources
|
|
install -p -m 0755 $(find sources -type f) %{buildroot}%{pkgdir}/sources
|
|
|
|
# mount point for bind mounting the osbuild library
|
|
mkdir -p %{buildroot}%{pkgdir}/osbuild
|
|
|
|
# schemata
|
|
mkdir -p %{buildroot}%{_datadir}/osbuild/schemas
|
|
install -p -m 0755 $(find schemas/*.json) %{buildroot}%{_datadir}/osbuild/schemas
|
|
ln -s %{_datadir}/osbuild/schemas %{buildroot}%{pkgdir}/schemas
|
|
|
|
# documentation
|
|
mkdir -p %{buildroot}%{_mandir}/man1
|
|
mkdir -p %{buildroot}%{_mandir}/man5
|
|
install -p -m 0644 -t %{buildroot}%{_mandir}/man1/ docs/*.1
|
|
install -p -m 0644 -t %{buildroot}%{_mandir}/man5/ docs/*.5
|
|
|
|
# SELinux
|
|
install -D -m 644 -t %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype} %{name}.pp.bz2
|
|
install -D -m 644 -t %{buildroot}%{_mandir}/man8 selinux/%{name}_selinux.8
|
|
|
|
%check
|
|
exit 0
|
|
# We have some integration tests, but those require running a VM, so that would
|
|
# be an overkill for RPM check script.
|
|
|
|
%files
|
|
%license LICENSE
|
|
%{_bindir}/osbuild
|
|
%{_mandir}/man1/%{name}.1*
|
|
%{_mandir}/man5/%{name}-manifest.5*
|
|
%{_datadir}/osbuild/schemas
|
|
%{pkgdir}
|
|
# the following files are in the ostree sub-package
|
|
%exclude %{pkgdir}/assemblers/org.osbuild.ostree.commit
|
|
%exclude %{pkgdir}/sources/org.osbuild.ostree
|
|
%exclude %{pkgdir}/stages/org.osbuild.ostree
|
|
%exclude %{pkgdir}/stages/org.osbuild.rpm-ostree
|
|
|
|
%files -n python3-%{pypi_name}
|
|
%license LICENSE
|
|
%doc README.md NEWS.md
|
|
%{python3_sitelib}/%{pypi_name}-*.egg-info/
|
|
%{python3_sitelib}/%{pypi_name}/
|
|
|
|
%files ostree
|
|
%{pkgdir}/assemblers/org.osbuild.ostree.commit
|
|
%{pkgdir}/sources/org.osbuild.ostree
|
|
%{pkgdir}/stages/org.osbuild.ostree
|
|
%{pkgdir}/stages/org.osbuild.rpm-ostree
|
|
|
|
%files selinux
|
|
%{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2
|
|
%{_mandir}/man8/%{name}_selinux.8.*
|
|
%ghost %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name}
|
|
|
|
%post selinux
|
|
%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2
|
|
|
|
%postun selinux
|
|
if [ $1 -eq 0 ]; then
|
|
%selinux_modules_uninstall -s %{selinuxtype} %{name}
|
|
fi
|
|
|
|
%posttrans selinux
|
|
%selinux_relabel_post -s %{selinuxtype}
|
|
|
|
|
|
%changelog
|
|
* Mon Aug 19 2019 Miro Hrončok <mhroncok@redhat.com> - 1-3
|
|
- Rebuilt for Python 3.8
|
|
|
|
* Mon Jul 29 2019 Martin Sehnoutka <msehnout@redhat.com> - 1-2
|
|
- update upstream URL to the new Github organization
|
|
|
|
* Wed Jul 17 2019 Martin Sehnoutka <msehnout@redhat.com> - 1-1
|
|
- Initial package
|