Package Review SELinux help

[Robert-André Mauchin]

Hello,


I know next to nothing about SELinux so I'd like some help about the Bitcoin 
Package Review by negativo17: 

https://bugzilla.redhat.com/show_bug.cgi?id=1834731

Notably: are the bitcoin.{te,fc,if} files are sane?
Are they installed properly in the SPEC? Especially these parts:

%post server
%systemd_post %{name}.service
for selinuxvariant in %{selinux_variants}
do
    /usr/sbin/semodule -s ${selinuxvariant} -i \
        %{_datadir}/selinux/${selinuxvariant}/%{name}.pp \
        &> /dev/null || :
done
# FIXME This is less than ideal, but until dwalsh gives me a better way...
/usr/sbin/semanage port -a -t %{name}_port_t -p tcp 8332 2> /dev/null
/usr/sbin/semanage port -a -t %{name}_port_t -p tcp 8333 2> /dev/null
/usr/sbin/semanage port -a -t %{name}_port_t -p tcp 18332 2> /dev/null
/usr/sbin/semanage port -a -t %{name}_port_t -p tcp 18333 2> /dev/null
/sbin/fixfiles -R %{name}-server restore &> /dev/null || :
/sbin/restorecon -R %{_localstatedir}/lib/%{name} || :

%postun server
%systemd_postun_with_restart %{name}.service
if [ $1 -eq 0 ] ; then
    # FIXME This is less than ideal, but until dwalsh gives me a better way...
    /usr/sbin/semanage port -d -p tcp 8332
    /usr/sbin/semanage port -d -p tcp 8333
    /usr/sbin/semanage port -d -p tcp 18332
    /usr/sbin/semanage port -d -p tcp 18333
    for selinuxvariant in %{selinux_variants}
    do
        /usr/sbin/semodule -s ${selinuxvariant} -r %{name} \
        &> /dev/null || :
    done
    /sbin/fixfiles -R %{name}-server restore &> /dev/null || :
    [ -d %{_localstatedir}/lib/%{name} ] && \
        /sbin/restorecon -R %{_localstatedir}/lib/%{name} \
        &> /dev/null || :
fi

Please comment in the RR if you can help.

I find the documentation at https://fedoraproject.org/wiki/SELinux rather old 
and not really focused on the packaging side of it. Is there guidelines 
anywhere else?

Best regards,

Robert-André

[Daniel Walsh]

On 6/26/20 14:39, Robert-André Mauchin wrote:
>  Hello,
>
>
>  I know next to nothing about SELinux so I'd like some help about the Bitcoin 
>  Package Review by negativo17: 
>
>  https://bugzilla.redhat.com/show_bug.cgi?id=1834731
>
>  Notably: are the bitcoin.{te,fc,if} files are sane?
>  Are they installed properly in the SPEC? Especially these parts:
>
>  %post server
>  %systemd_post %{name}.service
>  for selinuxvariant in %{selinux_variants}
>  do
>      /usr/sbin/semodule -s ${selinuxvariant} -i \
>          %{_datadir}/selinux/${selinuxvariant}/%{name}.pp \
>          &> /dev/null || :
>  done
>  # FIXME This is less than ideal, but until dwalsh gives me a better way...
>  /usr/sbin/semanage port -a -t %{name}_port_t -p tcp 8332 2> /dev/null
>  /usr/sbin/semanage port -a -t %{name}_port_t -p tcp 8333 2> /dev/null
>  /usr/sbin/semanage port -a -t %{name}_port_t -p tcp 18332 2> /dev/null
>  /usr/sbin/semanage port -a -t %{name}_port_t -p tcp 18333 2> /dev/null
>  /sbin/fixfiles -R %{name}-server restore &> /dev/null || :
>  /sbin/restorecon -R %{_localstatedir}/lib/%{name} || :
>
>  %postun server
>  %systemd_postun_with_restart %{name}.service
>  if [ $1 -eq 0 ] ; then
>      # FIXME This is less than ideal, but until dwalsh gives me a better way... 
You can do these all in one command using

semanage import

This should speed installation.

>      /usr/sbin/semanage port -d -p tcp 8332
>      /usr/sbin/semanage port -d -p tcp 8333
>      /usr/sbin/semanage port -d -p tcp 18332
>      /usr/sbin/semanage port -d -p tcp 18333
>      for selinuxvariant in %{selinux_variants}
>      do
>          /usr/sbin/semodule -s ${selinuxvariant} -r %{name} \
>          &> /dev/null || :
>      done
>      /sbin/fixfiles -R %{name}-server restore &> /dev/null || :
>      [ -d %{_localstatedir}/lib/%{name} ] && \
>          /sbin/restorecon -R %{_localstatedir}/lib/%{name} \
>          &> /dev/null || :
>  fi
>
>  Please comment in the RR if you can help.
>
>  I find the documentation at https://fedoraproject.org/wiki/SELinux rather old 
>  and not really focused on the packaging side of it. Is there guidelines 
>  anywhere else?
>
>  Best regards,
>
>  Robert-André
>
>
>  _______________________________________________
>  devel mailing list -- devel(a)lists.fedoraproject.org
>  To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedoraproject.org/archives/list/[e-mail]

[Robert-André Mauchin]

On Monday, 29 June 2020 20:55:45 CEST Daniel Walsh wrote:
>  On 6/26/20 14:39, Robert-André Mauchin wrote:
>  
>  > Hello,
>  >
>  >
>  >
>  >
>  > I know next to nothing about SELinux so I'd like some help about the
>  > Bitcoin Package Review by negativo17:
>  >
>  >
>  >
>  > https://bugzilla.redhat.com/show_bug.cgi?id=1834731
>  >
>  >
>  >
>  > Notably: are the bitcoin.{te,fc,if} files are sane?
>  > Are they installed properly in the SPEC? Especially these parts:
>  >
>  >
>  >
>  > %post server
>  > %systemd_post %{name}.service
>  > for selinuxvariant in %{selinux_variants}
>  > do
>  > 
>  >     /usr/sbin/semodule -s ${selinuxvariant} -i \
>  >     
>  >         %{_datadir}/selinux/${selinuxvariant}/%{name}.pp \
>  >         &> /dev/null || :
>  > 
>  > done
>  > # FIXME This is less than ideal, but until dwalsh gives me a better
>  > way...
>  > /usr/sbin/semanage port -a -t %{name}_port_t -p tcp 8332 2> /dev/null
>  > /usr/sbin/semanage port -a -t %{name}_port_t -p tcp 8333 2> /dev/null
>  > /usr/sbin/semanage port -a -t %{name}_port_t -p tcp 18332 2> /dev/null
>  > /usr/sbin/semanage port -a -t %{name}_port_t -p tcp 18333 2> /dev/null
>  > /sbin/fixfiles -R %{name}-server restore &> /dev/null || :
>  > /sbin/restorecon -R %{_localstatedir}/lib/%{name} || :
>  >
>  >
>  >
>  > %postun server
>  > %systemd_postun_with_restart %{name}.service
>  > if [ $1 -eq 0 ] ; then
>  > 
>  >     # FIXME This is less than ideal, but until dwalsh gives me a better
>  >     way...
>  
>  
>  You can do these all in one command using
>  
>  semanage import
>  
>  This should speed installation.
>  
>   
Thanks, do you have any opinions regarding the policy shipped? Could you add a 
comment on the bug report?

Best regards,

Robert-André

[Petr Lautrbach]

On Fri, Jun 26, 2020 at 08:39:19PM +0200, Robert-André Mauchin wrote:
>  Hello,
>  
>  
>  I know next to nothing about SELinux so I'd like some help about the Bitcoin 
>  Package Review by negativo17: 
>  
>  https://bugzilla.redhat.com/show_bug.cgi?id=1834731
>  
>  Notably: are the bitcoin.{te,fc,if} files are sane?
>  Are they installed properly in the SPEC? Especially these parts:
>  
>  %post server
>  %systemd_post %{name}.service
>  for selinuxvariant in %{selinux_variants}
>  do
>      /usr/sbin/semodule -s ${selinuxvariant} -i \
>          %{_datadir}/selinux/${selinuxvariant}/%{name}.pp \
>          &> /dev/null || :
>  done
>  # FIXME This is less than ideal, but until dwalsh gives me a better way...
>  /usr/sbin/semanage port -a -t %{name}_port_t -p tcp 8332 2> /dev/null
>  /usr/sbin/semanage port -a -t %{name}_port_t -p tcp 8333 2> /dev/null
>  /usr/sbin/semanage port -a -t %{name}_port_t -p tcp 18332 2> /dev/null
>  /usr/sbin/semanage port -a -t %{name}_port_t -p tcp 18333 2> /dev/null
>  /sbin/fixfiles -R %{name}-server restore &> /dev/null || :
>  /sbin/restorecon -R %{_localstatedir}/lib/%{name} || :
>  
>  %postun server
>  %systemd_postun_with_restart %{name}.service
>  if [ $1 -eq 0 ] ; then
>      # FIXME This is less than ideal, but until dwalsh gives me a better way...
>      /usr/sbin/semanage port -d -p tcp 8332
>      /usr/sbin/semanage port -d -p tcp 8333
>      /usr/sbin/semanage port -d -p tcp 18332
>      /usr/sbin/semanage port -d -p tcp 18333
>      for selinuxvariant in %{selinux_variants}
>      do
>          /usr/sbin/semodule -s ${selinuxvariant} -r %{name} \
>          &> /dev/null || :
>      done
>      /sbin/fixfiles -R %{name}-server restore &> /dev/null || :
>      [ -d %{_localstatedir}/lib/%{name} ] && \
>          /sbin/restorecon -R %{_localstatedir}/lib/%{name} \
>          &> /dev/null || :
>  fi
>  
>  Please comment in the RR if you can help.
>  
>  I find the documentation at https://fedoraproject.org/wiki/SELinux rather old 
>  and not really focused on the packaging side of it. Is there guidelines 
>  anywhere else?
>  
The following document is focused on packaging custom SELinux policies

https://fedoraproject.org/wiki/SELinux/IndependentPolicy

There's also request to incorporate it into oficial Fedora guidelines but the process
takes some time.

Petr