rpms/xpilot-ng/FC-5 xpilotd.fc, NONE, 1.1 xpilotd.if, NONE, 1.1 xpilotd.te, NONE, 1.1 xpilot-ng-server.init, 1.2, 1.3 xpilot-ng.spec, 1.6, 1.7
Michael Thomas (wart)
fedora-extras-commits at redhat.com
Mon Sep 4 04:35:47 UTC 2006
- Previous message: rpms/exim/devel exim.spec,1.28,1.29
- Next message: rpms/exim/FC-5 exim-4.62-dlopen-localscan.patch, NONE, 1.1 exim-4.63-allow-filter.patch, NONE, 1.1 exim-4.63-localhost-is-local.patch, NONE, 1.1 exim-4.63-procmail.patch, NONE, 1.1 exim-4.33-cyrus.patch, 1.1, 1.2 exim-4.43-pamconfig.patch, 1.1, 1.2 exim-4.50-spamdconf.patch, 1.1, 1.2 exim.pam, 1.1, 1.2 exim.spec, 1.20, 1.21
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
Author: wart
Update of /cvs/extras/rpms/xpilot-ng/FC-5
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv19683
Modified Files:
xpilot-ng-server.init xpilot-ng.spec
Added Files:
xpilotd.fc xpilotd.if xpilotd.te
Log Message:
- Add selinux policy to the game server.
- Don't create the daemon user if it already exists.
- Don't ghost compiled python files.
--- NEW FILE xpilotd.fc ---
# xpilot-ng-server executable will have:
# label: system_u:object_r:xpilotd_exec_t
# MLS sensitivity: s0
# MCS categories: <none>
/usr/bin/xpilot-ng-server -- gen_context(system_u:object_r:xpilotd_exec_t,s0)
/etc/xpilot-ng(/.*)? gen_context(system_u:object_r:xpilotd_private_data_t)
--- NEW FILE xpilotd.if ---
## <summary>policy for xpilot-ng</summary>
########################################
## <summary>
## Execute a domain transition to run xpilot-ng-server.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
## </param>
#
interface(`xpilotd_domtrans',`
gen_require(`
type xpilotd_t, xpilotd_exec_t;
')
domain_auto_trans($1,xpilotd_exec_t,xpilotd_t)
allow $1 xpilotd_t:fd use;
allow xpilotd_t $1:fd use;
allow xpilotd_t $1:fifo_file rw_file_perms;
allow xpilotd_t $1:process sigchld;
')
--- NEW FILE xpilotd.te ---
policy_module(xpilotd,1.0.0)
########################################
#
# Declarations
#
gen_require(`
type port_t;
attribute port_type;
type var_log_t;
')
type xpilotd_port_t, port_type;
type xpilotd_t;
type xpilotd_exec_t;
domain_type(xpilotd_t)
init_daemon_domain(xpilotd_t, xpilotd_exec_t)
# pid files
type xpilotd_var_run_t;
files_pid_file(xpilotd_var_run_t)
# Game data files
type xpilotd_private_data_t;
files_type(xpilotd_private_data_t);
########################################
#
# xpilot local policy
#
# Check in /etc/selinux/refpolicy/include for macros to use instead of allow rules.
# Note: /usr/share/selinux/devel/include/support/obj_perm_sets.spt contains
# the definitions of many permissions, such as 'rw_dir_perms'
# Some common macros (you might be able to remove some)
files_read_usr_files(xpilotd_t)
files_read_etc_files(xpilotd_t)
libs_use_ld_so(xpilotd_t)
libs_use_shared_libs(xpilotd_t)
miscfiles_read_localization(xpilotd_t)
## internal communication is often done using fifo and unix sockets.
allow xpilotd_t self:fifo_file { read write };
allow xpilotd_t self:unix_stream_socket create_stream_socket_perms;
# log files
allow xpilotd_t var_log_t:file rw_file_perms ;
## Networking basics (adjust to your needs!)
sysnet_dns_name_resolve(xpilotd_t)
corenet_udp_bind_all_nodes(xpilotd_t)
corenet_non_ipsec_sendrecv(xpilotd_t)
corenet_udp_sendrecv_all_ports(xpilotd_t)
allow xpilotd_t xpilotd_port_t:udp_socket { name_bind };
# Init script handling
init_use_fds(xpilotd_t)
init_use_script_ptys(xpilotd_t)
domain_use_interactive_fds(xpilotd_t)
# Game private data
allow xpilotd_t xpilotd_private_data_t:file { r_file_perms };
allow xpilotd_t xpilotd_private_data_t:dir search;
# Misc rules that are needed. I don't understand the meaning of some
# of these, and for others I don't yet understand why the game needs
# them
kernel_read_system_state(xpilotd_t)
allow xpilotd_t self:process signal;
Index: xpilot-ng-server.init
===================================================================
RCS file: /cvs/extras/rpms/xpilot-ng/FC-5/xpilot-ng-server.init,v
retrieving revision 1.2
retrieving revision 1.3
diff -u -r1.2 -r1.3
--- xpilot-ng-server.init 18 Jul 2006 16:28:42 -0000 1.2
+++ xpilot-ng-server.init 4 Sep 2006 04:35:47 -0000 1.3
@@ -35,13 +35,17 @@
echo
return 1
fi
+ if selinuxenabled ; then
+ /usr/sbin/semanage port -a -t xpilotd_port_t -p udp 1545 &>/dev/null || :
+ /usr/sbin/semanage port -a -t xpilotd_port_t -p udp 32200-32299 &>/dev/null || :
+ fi
+
# This doesn't properly detect startup failures
daemon --user xpilot $exec $XPILOTD_OPTIONS >>/var/log/xpilot.log 2>&1 &
retval=$?
if [ $retval -eq 0 ]; then
success
touch $lockfile
- pidofproc $prog > $pidfile
else
failure
fi
@@ -55,6 +59,10 @@
retval=$?
echo
[ $retval -eq 0 ] && rm -f $lockfile
+ if selinuxenabled ; then
+ /usr/sbin/semanage port -d -t xpilotd_port_t -p udp 1545 &>/dev/null || :
+ /usr/sbin/semanage port -d -t xpilotd_port_t -p udp 32200-32299 &>/dev/null || :
+ fi
return $retval
}
Index: xpilot-ng.spec
===================================================================
RCS file: /cvs/extras/rpms/xpilot-ng/FC-5/xpilot-ng.spec,v
retrieving revision 1.6
retrieving revision 1.7
diff -u -r1.6 -r1.7
--- xpilot-ng.spec 18 Jul 2006 16:29:08 -0000 1.6
+++ xpilot-ng.spec 4 Sep 2006 04:35:47 -0000 1.7
@@ -1,24 +1,30 @@
+%define selinux_variants mls strict targeted
+%define selinux_policyver %(sed -e 's,.*selinux-policy-\\([^/]*\\)/.*,\\1,' /usr/share/selinux/devel/policyhelp)
+
Name: xpilot-ng
Version: 4.7.2
-Release: 9%{?dist}
+Release: 10%{?dist}
Summary: Multiplayer space arcade game
Group: Amusements/Games
License: GPL
URL: http://xpilot.sourceforge.net
Source0: http://dl.sourceforge.net/sourceforge/xpilot/xpilot-ng-%{version}.tar.gz
-Source1: xpilot-ng.png
-Source2: xpilot-ng-x11.desktop
-Source3: xpilot-ng-sdl.desktop
-Source4: xpilot-ng-server.init
+Source1: xpilot-ng.png
+Source2: xpilot-ng-x11.desktop
+Source3: xpilot-ng-sdl.desktop
+Source4: xpilot-ng-server.init
Source5: xpilot-ng.sysconfig
Source6: xpilot-ng.logrotate
+Source7: xpilotd.te
+Source8: xpilotd.fc
+Source9: xpilotd.if
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
BuildRequires: desktop-file-utils
BuildRequires: expat-devel SDL_ttf-devel SDL_image-devel zlib-devel
-# The following BR are not needed for FC-4
BuildRequires: libXt-devel libGLU-devel libXxf86misc-devel
+BuildRequires: selinux-policy-devel hardlink checkpolicy
%description
A highly addictive, infinitely configurable multiplayer space
@@ -42,6 +48,16 @@
are playing alone, but not required if you are joining one of the
public xpilot games hosted on the internet.
+%package selinux
+Summary: SELinux policy files for the xpilot-ng game server
+Group: Amusements/Games
+Requires: %{name}-server = %{version}-%{release}
+Requires(post): /usr/sbin/semodule /usr/sbin/semanage /sbin/fixfiles
+Requires(preun): /sbin/service /usr/sbin/semodule /usr/sbin/semanage /sbin/fixfiles /usr/sbin/setsebool
+Requires(postun): /usr/sbin/semodule
+%description selinux
+SELinux policy files for the xpilot-ng game server
+
%prep
%setup -q
pushd doc/man
@@ -51,10 +67,23 @@
mv xpilot-ng-x11.man.new xpilot-ng-x11.man
popd
+mkdir SELinux
+cp %{SOURCE7} %{SOURCE8} %{SOURCE9} SELinux/
+
%build
CFLAGS="$RPM_OPT_FLAGS" %configure
make %{?_smp_mflags}
+# Build the selinux policy file
+pushd SELinux
+for variant in %{selinux_variants}
+do
+ make NAME=${variant} -f %{_datadir}/selinux/devel/Makefile
+ mv xpilotd.pp xpilotd.pp.${variant}
+ make NAME=${variant} -f %{_datadir}/selinux/devel/Makefile clean
+done
+popd
+
%install
rm -rf $RPM_BUILD_ROOT
make install DESTDIR=$RPM_BUILD_ROOT
@@ -85,6 +114,18 @@
install -p -D -m 644 lib/defaults.txt $RPM_BUILD_ROOT/%{_sysconfdir}/%{name}/defaults.txt
install -p -D -m 600 lib/password.txt $RPM_BUILD_ROOT/%{_sysconfdir}/%{name}/password.txt
+# Install selinux policies
+pushd SELinux
+for variant in %{selinux_variants}
+do
+ install -d %{buildroot}%{_datadir}/selinux/${variant}
+ install -p -m 644 xpilotd.pp.${variant} \
+ %{buildroot}%{_datadir}/selinux/${variant}/xpilotd.pp
+done
+popd
+# Hardlink identical policy module packages together
+/usr/sbin/hardlink -cv %{buildroot}%{_datadir}/selinux
+
%post
touch --no-create %{_datadir}/icons/hicolor || :
if [ -x %{_bindir}/gtk-update-icon-cache ]; then
@@ -98,25 +139,62 @@
fi
%pre server
-/usr/sbin/fedora-groupadd 25 -r xpilot &>/dev/null || :
-/usr/sbin/fedora-useradd 25 -r -s /sbin/nologin -d /usr/share/xpilot-ng -M \
- -c 'XPilot Server' -g xpilot xpilot >/dev/null || :
+user_uid=`id -u xpilot 2>/dev/null`
+if [ x"$user_uid" = x ] ; then
+ /usr/sbin/fedora-groupadd 25 -r xpilot &>/dev/null || :
+ /usr/sbin/fedora-useradd 25 -r -s /sbin/nologin -d /usr/share/xpilot-ng \
+ -M -c 'XPilot Server' -g xpilot xpilot >/dev/null || :
+fi
%post server
/sbin/chkconfig --add xpilot-ng-server
%preun server
-if [ "$1" = "0" ]; then
+if [ "$1" -le "0" ]; then
/sbin/service xpilot-ng-server stop > /dev/null 2>&1
/sbin/chkconfig --del xpilot-ng-server
fi
%postun server
if [ "$1" -ge "1" ]; then
- /sbin/service xpilot-ng-server condrestart >/dev/null 2>&1
+ /sbin/service xpilot-ng-server condrestart > /dev/null 2>&1
+fi
+
+%post selinux
+# Install SELinux policy modules
+for selinuxvariant in %{selinux_variants}
+do
+ /usr/sbin/semodule -s ${selinuxvariant} -i \
+ %{_datadir}/selinux/${selinuxvariant}/xpilotd.pp &> /dev/null || :
+done
+/usr/sbin/semanage port -a -t xpilotd_port_t -p udp 15345 &> /dev/null || :
+/usr/sbin/semanage port -a -t xpilotd_port_t -p udp 32200-32299 &> /dev/null || :
+/sbin/fixfiles -R %{name}-server restore || :
+/sbin/service %{name}-server condrestart > /dev/null 2>&1 || :
+
+%preun selinux
+if [ "$1" -lt "1" ] ; then
+ # Disable the policy and restart the daemon
+ /usr/sbin/setsebool xpilotd_disable_trans 1 &> /dev/null || :
+ /sbin/service %{name}-server condrestart > /dev/null 2>&1 || :
+ # Unload the module
+ /usr/sbin/semanage port -d -t xpilotd_port_t -p udp 15345 &> /dev/null || :
+ /usr/sbin/semanage port -d -t xpilotd_port_t -p udp 32200-32299 &> /dev/null || :
+ for variant in %{selinux_variants} ; do
+ /usr/sbin/semodule -s ${variant} -r xpilotd &> /dev/null || :
+ done
+ # Set the context back
+ /sbin/fixfiles -R %{name}-server restore || :
+fi
+
+%postun selinux
+if [ "$1" -ge "1" ] ; then
+ # Replace the module if it is already loaded. semodule -u also
+ # checks the module version
+ for variant in %{selinux_variants} ; do
+ /usr/sbin/semodule -u %{_datadir}/selinux/${variant}/xpilotd.pp || :
+ done
fi
-test "$1" != 0 || /usr/sbin/fedora-userdel xpilot &>/dev/null || :
-test "$1" != 0 || /usr/sbin/fedora-groupdel xpilot &>/dev/null || :
%clean
rm -rf $RPM_BUILD_ROOT
@@ -144,29 +222,30 @@
%{_initrddir}/xpilot-ng-server
%config(noreplace) %{_sysconfdir}/sysconfig/%{name}-server
%config(noreplace) %{_sysconfdir}/logrotate.d/%{name}-server
-%dir %{_datadir}/%{name}
-%{_datadir}/%{name}/defaults.txt
-%{_datadir}/%{name}/password.txt
-%{_datadir}/%{name}/robots.txt
-%{_datadir}/%{name}/shipshapes.txt
-%{_datadir}/%{name}/mapconvert.py
-%{_datadir}/%{name}/maps
+%{_datadir}/%{name}
%dir %{_sysconfdir}/%{name}
%config(noreplace) %attr(0600,xpilot,xpilot) %{_sysconfdir}/%{name}/password.txt
%config(noreplace) %{_sysconfdir}/%{name}/defaults.txt
%{_mandir}/man6/xpilot-ng-server.6.gz
%{_mandir}/man6/xpilot-ng-xp-mapedit.6.gz
%doc README COPYING
-#The following two entries need to be removed with FC-4
-%ghost %{_datadir}/%{name}/mapconvert.pyc
-%ghost %{_datadir}/%{name}/mapconvert.pyo
+
+%files selinux
+%defattr(-,root,root,-)
+%doc SELinux/*.??
+%{_datadir}/selinux/*/xpilotd.pp
%changelog
+* Sun Sep 3 2006 Wart <wart at kobold.org> 4.7.2-10
+- Added SELinux policies for the game server
+- Don't attempt to create the xpilot user if it already exists
+- Don't ghost the compiled python files anymore
+
* Mon Jul 17 2006 Wart <wart at kobold.org> 4.7.2-9
- Use the new xpilot user in the init.d script
- Add info on firewall configuration in the sysconfig script
- Explicitly disable reporting to the meta server (BZ #199164)
-- Don't restart the server in %postun unless it was already running.
+- Don't restart the server in %%postun unless it was already running.
* Tue Jul 11 2006 Wart <wart at kobold.org> 4.7.2-8
- Fix Requires: for the -server subpackage
- Previous message: rpms/exim/devel exim.spec,1.28,1.29
- Next message: rpms/exim/FC-5 exim-4.62-dlopen-localscan.patch, NONE, 1.1 exim-4.63-allow-filter.patch, NONE, 1.1 exim-4.63-localhost-is-local.patch, NONE, 1.1 exim-4.63-procmail.patch, NONE, 1.1 exim-4.33-cyrus.patch, 1.1, 1.2 exim-4.43-pamconfig.patch, 1.1, 1.2 exim-4.50-spamdconf.patch, 1.1, 1.2 exim.pam, 1.1, 1.2 exim.spec, 1.20, 1.21
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
More information about the scm-commits
mailing list