Directories for policy module packages

[Paul Howarth]

Now that RPM packages are starting to include policy module packages (my 
mod_fcgid package was approved for Extras recently: 
http://bugzilla.redhat.com/195666), it would be nice to have a standard 
place for the .pp files to be dropped, and for that directory to be 
owned by the selinux-policy package (so that all the packages don't need 
to own it themselves).

I propose the following:

/usr/share/selinux/packages
(container directory, separate from modules bundled with Core package)

/usr/share/selinux/packages/mls
(policy modules for use with the mls base policy)

/usr/share/selinux/packages/strict
(policy modules for use with the strict base policy)

/usr/share/selinux/packages/targeted
(policy modules for use with the targeted base policy)

/usr/share/selinux/packages/share
(policy modules that have no base-specific elements, and can be used 
with all base policies)

Paul.

[Christopher J. PeBenito]

On Tue, 2006-07-25 at 10:14 +0100, Paul Howarth wrote:
>  Now that RPM packages are starting to include policy module packages
> (my 
>  mod_fcgid package was approved for Extras recently: 
>  http://bugzilla.redhat.com/195666), it would be nice to have a standard 
>  place for the .pp files to be dropped, and for that directory to be 
>  owned by the selinux-policy package (so that all the packages don't need 
>  to own it themselves).
>  
>  I propose the following:
>  
>  /usr/share/selinux/packages
>  (container directory, separate from modules bundled with Core package)
>  
>  /usr/share/selinux/packages/mls
>  (policy modules for use with the mls base policy)
>  
>  /usr/share/selinux/packages/strict
>  (policy modules for use with the strict base policy)
>  
>  /usr/share/selinux/packages/targeted
>  (policy modules for use with the targeted base policy)
>  
>  /usr/share/selinux/packages/share
>  (policy modules that have no base-specific elements, and can be used 
>  with all base policies) 
There already is a standard location:

/usr/share/selinux/NAME/

where NAME is targeted, strict, mls, etc.

-- 
Chris PeBenito
Tresys Technology, LLC
[phone] x150

[Paul Howarth]

Christopher J. PeBenito wrote:
>  On Tue, 2006-07-25 at 10:14 +0100, Paul Howarth wrote:
> > Now that RPM packages are starting to include policy module packages (my 
> > mod_fcgid package was approved for Extras recently: 
> > http://bugzilla.redhat.com/195666), it would be nice to have a standard 
> > place for the .pp files to be dropped, and for that directory to be 
> > owned by the selinux-policy package (so that all the packages don't need 
> > to own it themselves).
> >
> > I propose the following:
> >
> > /usr/share/selinux/packages
> > (container directory, separate from modules bundled with Core package)
> >
> > /usr/share/selinux/packages/mls
> > (policy modules for use with the mls base policy)
> >
> > /usr/share/selinux/packages/strict
> > (policy modules for use with the strict base policy)
> >
> > /usr/share/selinux/packages/targeted
> > (policy modules for use with the targeted base policy)
> >
> > /usr/share/selinux/packages/share
> > (policy modules that have no base-specific elements, and can be used 
> > with all base policies)
>  
>  There already is a standard location:
>  
>  /usr/share/selinux/NAME/
>  
>  where NAME is targeted, strict, mls, etc. 
I asked about this before and it was suggested that 
/usr/share/selinux/NAME would best be avoided because Core/base packages 
would install modules there and there might be name comflicts. I'm not 
convinced by that argument myself, but:

  * /usr/share/selinux/NAME/ is owned by selinux-policy-NAME; since most 
systems will have only targeted policy installed, this is an issue for 
packages wanting to include modules built for all base policies, which 
will have no directories to install strict/mls modules to. There is also 
no /usr/share/selinux/share directory to install policy module packages 
common to all base policies.

I think wherever the directory is, it needs to be owned by the 
selinux-policy package itself and not the subpackages.

Paul.

[Daniel J Walsh]

Paul Howarth wrote:
>  Christopher J. PeBenito wrote:
> > On Tue, 2006-07-25 at 10:14 +0100, Paul Howarth wrote:
> >> Now that RPM packages are starting to include policy module packages 
> >> (my mod_fcgid package was approved for Extras recently: 
> >> http://bugzilla.redhat.com/195666), it would be nice to have a 
> >> standard place for the .pp files to be dropped, and for that 
> >> directory to be owned by the selinux-policy package (so that all the 
> >> packages don't need to own it themselves).
> >>
> >> I propose the following:
> >>
> >> /usr/share/selinux/packages
> >> (container directory, separate from modules bundled with Core package)
> >>
> >> /usr/share/selinux/packages/mls
> >> (policy modules for use with the mls base policy)
> >>
> >> /usr/share/selinux/packages/strict
> >> (policy modules for use with the strict base policy)
> >>
> >> /usr/share/selinux/packages/targeted
> >> (policy modules for use with the targeted base policy)
> >>
> >> /usr/share/selinux/packages/share
> >> (policy modules that have no base-specific elements, and can be used 
> >> with all base policies)
> > 
I think this is a good idea.
> > There already is a standard location:
> >
> > /usr/share/selinux/NAME/
> > 
Currently the selinux-policy-TYPE package looks in this directory and 
installs all the pp files that are in this directory.
It should probably change to only install  the pp files that it is 
packaging.  This is a management headache because we
don't need to manage this now.  If someone has a good solution to 
figuring out the pp files during the spec build this would be
great.  Trying to update the modules-TYPE.conf file and maintaining the 
spec file in sync would be a royal pain. 
> > where NAME is targeted, strict, mls, etc.
>
>  I asked about this before and it was suggested that 
>  /usr/share/selinux/NAME would best be avoided because Core/base 
>  packages would install modules there and there might be name 
>  comflicts. I'm not convinced by that argument myself, but:
>
>   * /usr/share/selinux/NAME/ is owned by selinux-policy-NAME; since 
>  most systems will have only targeted policy installed, this is an 
>  issue for packages wanting to include modules built for all base 
>  policies, which will have no directories to install strict/mls modules 
>  to. There is also no /usr/share/selinux/share directory to install 
>  policy module packages common to all base policies.
>
>  I think wherever the directory is, it needs to be owned by the 
>  selinux-policy package itself and not the subpackages.
>
>  Paul.
>
>  -- 
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-selinux-list

[Paul Howarth]

Daniel J Walsh wrote:
>  Paul Howarth wrote:
> > Christopher J. PeBenito wrote:
> >> On Tue, 2006-07-25 at 10:14 +0100, Paul Howarth wrote:
> >>> Now that RPM packages are starting to include policy module packages 
> >>> (my mod_fcgid package was approved for Extras recently: 
> >>> http://bugzilla.redhat.com/195666), it would be nice to have a 
> >>> standard place for the .pp files to be dropped, and for that 
> >>> directory to be owned by the selinux-policy package (so that all the 
> >>> packages don't need to own it themselves).
> >>>
> >>> I propose the following:
> >>>
> >>> /usr/share/selinux/packages
> >>> (container directory, separate from modules bundled with Core package)
> >>>
> >>> /usr/share/selinux/packages/mls
> >>> (policy modules for use with the mls base policy)
> >>>
> >>> /usr/share/selinux/packages/strict
> >>> (policy modules for use with the strict base policy)
> >>>
> >>> /usr/share/selinux/packages/targeted
> >>> (policy modules for use with the targeted base policy)
> >>>
> >>> /usr/share/selinux/packages/share
> >>> (policy modules that have no base-specific elements, and can be used 
> >>> with all base policies)
> >>
>  I think this is a good idea. 
Good, but you might change your mind...

> >> There already is a standard location:
> >>
> >> /usr/share/selinux/NAME/
> >>
>  Currently the selinux-policy-TYPE package looks in this directory and 
>  installs all the pp files that are in this directory.
>  It should probably change to only install  the pp files that it is 
>  packaging.  This is a management headache because we
>  don't need to manage this now.  If someone has a good solution to 
>  figuring out the pp files during the spec build this would be
>  great.  Trying to update the modules-TYPE.conf file and maintaining the 
>  spec file in sync would be a royal pain. 
Try the attached patch which groks the module names from the 
modules-TYPE.conf file.

It also moves the directory ownership of the /usr/share/selinux/NAME/ 
directory from the selinux-policy-NAME package to the selinux-policy 
package, so that RPMs containing policy module packages for all base 
policies will have properly-owned directories to install them into even 
on systems that only have one of the base policies installed.

Regarding .pp files that are identical for each of the base policies, I 
think it's better not to have a "share" directory for them but instead 
to install them into one of the /usr/share/selinux/NAME/ directories and 
then link them to the other /usr/share/selinux/NAME/ directories. This 
could be done automagically with a bit of boilerplate scripting in the 
spec file that looks for identical .pp files and links them together. 
The advantage of doing it this way is that it'll still work properly 
even if some of the policy macros change and what was once a policy 
package that was identical across all base policies suddenly becomes 
different for each base policy, i.e. the module packager doesn't need to 
make any changes, just rebuild against the new policy.

With the attached patch and the module packaging policy described above, 
all .pp files, from both the Core policy packages and others, will go in 
/usr/share/selinux/NAME/ and there is no need for the separate 
/usr/share/selinux/packages/ hierarchy.

Paul.

[Daniel J Walsh]

Paul Howarth wrote:
>  Daniel J Walsh wrote:
> > Paul Howarth wrote:
> >> Christopher J. PeBenito wrote:
> >>> On Tue, 2006-07-25 at 10:14 +0100, Paul Howarth wrote:
> >>>> Now that RPM packages are starting to include policy module 
> >>>> packages (my mod_fcgid package was approved for Extras recently: 
> >>>> http://bugzilla.redhat.com/195666), it would be nice to have a 
> >>>> standard place for the .pp files to be dropped, and for that 
> >>>> directory to be owned by the selinux-policy package (so that all 
> >>>> the packages don't need to own it themselves).
> >>>>
> >>>> I propose the following:
> >>>>
> >>>> /usr/share/selinux/packages
> >>>> (container directory, separate from modules bundled with Core 
> >>>> package)
> >>>>
> >>>> /usr/share/selinux/packages/mls
> >>>> (policy modules for use with the mls base policy)
> >>>>
> >>>> /usr/share/selinux/packages/strict
> >>>> (policy modules for use with the strict base policy)
> >>>>
> >>>> /usr/share/selinux/packages/targeted
> >>>> (policy modules for use with the targeted base policy)
> >>>>
> >>>> /usr/share/selinux/packages/share
> >>>> (policy modules that have no base-specific elements, and can be 
> >>>> used with all base policies)
> >>>
> > I think this is a good idea.
>
>  Good, but you might change your mind...
>
> >>> There already is a standard location:
> >>>
> >>> /usr/share/selinux/NAME/
> >>>
> > Currently the selinux-policy-TYPE package looks in this directory and 
> > installs all the pp files that are in this directory.
> > It should probably change to only install  the pp files that it is 
> > packaging.  This is a management headache because we
> > don't need to manage this now.  If someone has a good solution to 
> > figuring out the pp files during the spec build this would be
> > great.  Trying to update the modules-TYPE.conf file and maintaining 
> > the spec file in sync would be a royal pain.
>
>  Try the attached patch which groks the module names from the 
>  modules-TYPE.conf file.
>
>  It also moves the directory ownership of the /usr/share/selinux/NAME/ 
>  directory from the selinux-policy-NAME package to the selinux-policy 
>  package, so that RPMs containing policy module packages for all base 
>  policies will have properly-owned directories to install them into 
>  even on systems that only have one of the base policies installed.
>
>  Regarding .pp files that are identical for each of the base policies, 
>  I think it's better not to have a "share" directory for them but 
>  instead to install them into one of the /usr/share/selinux/NAME/ 
>  directories and then link them to the other /usr/share/selinux/NAME/ 
>  directories. This could be done automagically with a bit of 
>  boilerplate scripting in the spec file that looks for identical .pp 
>  files and links them together. The advantage of doing it this way is 
>  that it'll still work properly even if some of the policy macros 
>  change and what was once a policy package that was identical across 
>  all base policies suddenly becomes different for each base policy, 
>  i.e. the module packager doesn't need to make any changes, just 
>  rebuild against the new policy.
>
>  With the attached patch and the module packaging policy described 
>  above, all .pp files, from both the Core policy packages and others, 
>  will go in /usr/share/selinux/NAME/ and there is no need for the 
>  separate /usr/share/selinux/packages/ hierarchy.
>
>  Paul.
>  ------------------------------------------------------------------------
>
>  --- selinux-policy.spec	2006-07-26 10:22:24.000000000 +0100
>  +++ selinux-policy.spec	2006-07-26 12:40:09.000000000 +0100
>  @@ -58,6 +58,9 @@
>   %{_usr}/share/selinux/devel/policygentool
>   %{_usr}/share/selinux/devel/example.*
>   %attr(755,root,root) %{_usr}/share/selinux/devel/policyhelp
>  +%dir %{_usr}/share/selinux/targeted
>  +%dir %{_usr}/share/selinux/strict
>  +%dir %{_usr}/share/selinux/mls
>   
>   %define setupCmds() \
>   make NAME=%1 TYPE=%2 DISTRO=%{distro} DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%3
> bare \
>  @@ -65,6 +68,9 @@
>   cp -f ${RPM_SOURCE_DIR}/modules-%1.conf  ./policy/modules.conf \
>   cp -f ${RPM_SOURCE_DIR}/booleans-%1.conf ./policy/booleans.conf \
>   
>  +%define moduleList() %([ -f %{_sourcedir}/modules-%{1}.conf ] && \
>  +sort %{_sourcedir}/modules-%{1}.conf | awk '$2 == "=" && $3 ==
> "module" { printf "-i %%s.pp ", $1 }')
>  +
>   %define installCmds() \
>   make NAME=%1 TYPE=%2 DISTRO=%{distro} DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%3
> base.pp \
>   make NAME=%1 TYPE=%2 DISTRO=%{distro} DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%3
> modules \
>  @@ -91,7 +97,6 @@
>   
>   %define fileList() \
>   %defattr(-,root,root) \
>  -%dir %{_usr}/share/selinux/%1 \
>   %{_usr}/share/selinux/%1/*.pp \
>   %dir %{_sysconfdir}/selinux/%1 \
>   %config(noreplace) %{_sysconfdir}/selinux/%1/setrans.conf \
>  @@ -130,8 +135,7 @@
>   
>   %define rebuildpolicy() \
>   ( cd /usr/share/selinux/%1; \
>  -x=`ls *.pp | grep -v -e base.pp -e enableaudit.pp | awk '{ print "-i " $1
> }'`; \
>  -semodule -b base.pp $x -s %1; \
>  +semodule -b base.pp %{expand:%%moduleList %1} -s %1; \
>   );\
>   rm -f %{_sysconfdir}/selinux/%1/policy/policy.*.rpmnew
>   
>  @@ -160,6 +164,9 @@
>   touch %{buildroot}%{_sysconfdir}/selinux/config
>   touch %{buildroot}%{_sysconfdir}/sysconfig/selinux
>   
>  +# Always create policy module package directories
>  +mkdir -p %{buildroot}%{_usr}/share/selinux/{targeted,strict,mls}/
>  +
>   # Install devel
>   make clean
>   make NAME=targeted TYPE=targeted-mcs DISTRO=%{distro} DIRECT_INITRC=y
> MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} PKGNAME=%{name}-%{version} POLY=%3
> install-headers install-docs
>  @@ -281,7 +288,7 @@
>   %relabel mls
>   
>   %triggerpostun mls -- mls <= 2.0.7
>  -%{rebuildpolicy} mls 
>  +%rebuildpolicy mls 
>   
>   %files mls
>   %fileList mls
>  @@ -315,7 +322,7 @@
>   semodule -b base.pp -r bootloader -r clock -r dpkg -r fstools -r hotplug -r init -r
> libraries -r locallogin -r logging -r lvm -r miscfiles -r modutils -r mount -r mta -r
> netutils -r selinuxutil -r storage -r sysnetwork -r udev -r userdomain -r vpnc -r xend $x
> -s strict
>   
>   %triggerpostun strict -- strict <= 2.0.7
>  -%{rebuildpolicy} strict 
>  +%rebuildpolicy strict 
>   
>   %files strict
>   %fileList strict
>     
Changing to use

%define moduleList() %([ -f %{_sourcedir}/modules-%{1}.conf ] && \
awk '$1 !~ "#.*" && $2 == "=" && $3 ==
"module" { printf "-i %%s.pp ", 
$1 }' %{_sourcedir}/modules-%{1}.conf )

Any reason for the sort?
Do not want to grab comment lines.

[Paul Howarth]

Daniel J Walsh wrote:
>  Changing to use
>  
>  %define moduleList() %([ -f %{_sourcedir}/modules-%{1}.conf ] && \
>  awk '$1 !~ "#.*" && $2 == "=" && $3 ==
> "module" { printf "-i %%s.pp ", 
>  $1 }' %{_sourcedir}/modules-%{1}.conf ) 
Could possibly use:

$1 !~ /^#/

instead of

$1 !~ "#.*"

which might be marginally faster

>  Any reason for the sort? 
No particular reason other than it orders the list of modules in the 
same way that the original "ls *.pp" did, and it's easier to check that 
the list of modules matches what's in the package that way.

>  Do not want to grab comment lines. 
I didn't see it doing that but better safe than sorry.

Paul.

[Paul Howarth]

Paul Howarth wrote:
>  Daniel J Walsh wrote:
> > Changing to use
> >
> > %define moduleList() %([ -f %{_sourcedir}/modules-%{1}.conf ] && \
> > awk '$1 !~ "#.*" && $2 == "=" && $3 ==
> "module" { printf "-i %%s.pp ", 
> > $1 }' %{_sourcedir}/modules-%{1}.conf ) 
I see the patch went in in today's rawhide report:

* Wed Jul 26 2006 Dan Walsh <dwalsh(a)redhat.com&gt; 2.3.3-11
- Added Paul Howorth patch to only load policy packages shipped
   with this package

My name's actually "Howarth", not "Howorth" by the way.

Will this go into the next FC5 update too?

Did you include the part moving the /usr/share/selinux/POLICYNAME 
directories to the main selinux-policy package?

Paul.

[Daniel J Walsh]

Paul Howarth wrote:
>  Paul Howarth wrote:
> > Daniel J Walsh wrote:
> >> Changing to use
> >>
> >> %define moduleList() %([ -f %{_sourcedir}/modules-%{1}.conf ] && \
> >> awk '$1 !~ "#.*" && $2 == "=" && $3 ==
> "module" { printf "-i %%s.pp 
> >> ", $1 }' %{_sourcedir}/modules-%{1}.conf )
>
>  I see the patch went in in today's rawhide report:
>
>  * Wed Jul 26 2006 Dan Walsh <dwalsh(a)redhat.com&gt; 2.3.3-11
>  - Added Paul Howorth patch to only load policy packages shipped
>    with this package
>
>  My name's actually "Howarth", not "Howorth" by the way.
>  
Sorry, will be fixed tonight.
>  Will this go into the next FC5 update too?
>  
Probably
>  Did you include the part moving the /usr/share/selinux/POLICYNAME 
>  directories to the main selinux-policy package?
>  
Yes
>  Paul.