Blame SPECS/fapolicyd.spec

a749e0
%global selinuxtype targeted
a749e0
%global moduletype contrib
fb8a4e
%define semodule_version 0.4
a749e0
a749e0
12f79b
Summary: Application Whitelisting Daemon
12f79b
Name: fapolicyd
fb8a4e
Version: 1.1
fb8a4e
Release: 1%{?dist}
12f79b
License: GPLv3+
12f79b
URL: http://people.redhat.com/sgrubb/fapolicyd
12f79b
Source0: https://people.redhat.com/sgrubb/fapolicyd/%{name}-%{version}.tar.gz
a749e0
Source1: https://github.com/linux-application-whitelisting/%{name}-selinux/releases/download/v%{semodule_version}/%{name}-selinux-%{semodule_version}.tar.gz
a749e0
BuildRequires: gcc
12f79b
BuildRequires: kernel-headers
12f79b
BuildRequires: autoconf automake make gcc libtool
a9f027
BuildRequires: systemd-devel libgcrypt-devel rpm-devel file-devel file
12f79b
BuildRequires: libcap-ng-devel libseccomp-devel lmdb-devel
12f79b
BuildRequires: python3-devel
a749e0
BuildRequires: python2-devel
a9f027
BuildRequires: uthash-devel
a9f027
Requires: rpm-plugin-fapolicyd >= 4.14.3-12
a749e0
Recommends: %{name}-selinux
12f79b
Requires(pre): shadow-utils
12f79b
Requires(post): systemd-units
12f79b
Requires(preun): systemd-units
12f79b
Requires(postun): systemd-units
12f79b
a9f027
# we are making the dnf-plugin completelly dummy because of
a9f027
# https://bugzilla.redhat.com/show_bug.cgi?id=1929163
25361f
# we require the rpm-plugin from now on and the dnf-plugin still needs to be part of
25361f
# the fapolicyd package because it provides safe upgrade path
fb8a4e
Patch1: fapolicyd-dnf-plugin.patch
fb8a4e
Patch2: fapolicyd-selinux.patch
25361f
12f79b
%description
12f79b
Fapolicyd (File Access Policy Daemon) implements application whitelisting
12f79b
to decide file access rights. Applications that are known via a reputation
12f79b
source are allowed access while unknown applications are not. The daemon
12f79b
makes use of the kernel's fanotify interface to determine file access rights.
12f79b
a749e0
%package        selinux
a749e0
Summary:        Fapolicyd selinux
a749e0
Group:          Applications/System
a749e0
Requires:       %{name} = %{version}-%{release}
a749e0
BuildRequires:  selinux-policy
a749e0
BuildRequires:  selinux-policy-devel
a749e0
BuildArch: noarch
a749e0
%{?selinux_requires}
a749e0
a749e0
%description    selinux
a749e0
The %{name}-selinux package contains selinux policy for the %{name} daemon.
a749e0
12f79b
%prep
a749e0
12f79b
%setup -q
12f79b
a749e0
# selinux
a749e0
%setup -q -D -T -a 1
a749e0
fb8a4e
%patch1 -p1 -b .plugin
a9f027
%patch2 -p1 -b .selinux
25361f
066af4
# generate rules for python
fb8a4e
sed -i "s/%python2_path%/`readlink -f %{__python2} | sed 's/\//\\\\\//g'`/g" rules.d/*.rules
fb8a4e
sed -i "s/%python3_path%/`readlink -f %{__python3} | sed 's/\//\\\\\//g'`/g" rules.d/*.rules
fb8a4e
sed -i "s/%ld_so_path%/`find /usr/lib64/ -type f -name 'ld-linux-*.so.*' | sed 's/\//\\\\\//g'`/g" rules.d/*.rules
a749e0
12f79b
%build
12f79b
./autogen.sh
a749e0
%configure \
a749e0
    --with-audit \
a749e0
    --with-rpm \
a749e0
    --disable-shared
a749e0
fb8a4e
%make_build
12f79b
a749e0
# selinux
a749e0
pushd %{name}-selinux-%{semodule_version}
a749e0
make
a749e0
popd
a749e0
fb8a4e
%check
fb8a4e
make check
fb8a4e
a749e0
# selinux
a749e0
%pre selinux
a749e0
%selinux_relabel_pre -s %{selinuxtype}
a749e0
12f79b
%install
fb8a4e
%make_install
12f79b
mkdir -p %{buildroot}/%{python3_sitelib}/dnf-plugins/
12f79b
install -p -m 644 dnf/%{name}-dnf-plugin.py %{buildroot}/%{python3_sitelib}/dnf-plugins/
12f79b
install -p -m 644 -D init/%{name}-tmpfiles.conf %{buildroot}/%{_tmpfilesdir}/%{name}.conf
12f79b
mkdir -p %{buildroot}/%{_localstatedir}/lib/%{name}
12f79b
mkdir -p %{buildroot}/run/%{name}
fb8a4e
mkdir -p %{buildroot}%{_sysconfdir}/%{name}/trust.d
fb8a4e
mkdir -p %{buildroot}%{_sysconfdir}/%{name}/rules.d
12f79b
a749e0
# selinux
a749e0
install -d %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}
a749e0
install -m 0644 %{name}-selinux-%{semodule_version}/%{name}.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}
a749e0
install -d -p %{buildroot}%{_datadir}/selinux/devel/include/%{moduletype}
a749e0
install -p -m 644 %{name}-selinux-%{semodule_version}/%{name}.if %{buildroot}%{_datadir}/selinux/devel/include/%{moduletype}/ipp-%{name}.if
a749e0
a749e0
#cleanup
fb8a4e
find %{buildroot} \( -name '*.la' -o -name '*.a' \) -delete
a749e0
12f79b
%pre
12f79b
getent passwd %{name} >/dev/null || useradd -r -M -d %{_localstatedir}/lib/%{name} -s /sbin/nologin -c "Application Whitelisting Daemon" %{name}
12f79b
12f79b
%post
fb8a4e
# if no pre-existing rule file
fb8a4e
if [ ! -e %{_sysconfdir}/%{name}/%{name}.rules ] ; then
fb8a4e
 files=`ls %{_sysconfdir}/%{name}/rules.d/ 2>/dev/null | wc -w`
fb8a4e
 # Only if no pre-existing component rules
fb8a4e
 if [ "$files" -eq 0 ] ; then
fb8a4e
  ## Install the known libs policy
fb8a4e
  cp %{_datadir}/%{name}/sample-rules/10-languages.rules  %{_sysconfdir}/%{name}/rules.d/
fb8a4e
  cp %{_datadir}/%{name}/sample-rules/20-patterns.rules %{_sysconfdir}/%{name}/rules.d/
fb8a4e
  cp %{_datadir}/%{name}/sample-rules/30-dracut.rules %{_sysconfdir}/%{name}/rules.d/
fb8a4e
  cp %{_datadir}/%{name}/sample-rules/30-updaters.rules  %{_sysconfdir}/%{name}/rules.d/
fb8a4e
  cp %{_datadir}/%{name}/sample-rules/40-bad-elf.rules  %{_sysconfdir}/%{name}/rules.d/
fb8a4e
  cp %{_datadir}/%{name}/sample-rules/41-shared-obj.rules  %{_sysconfdir}/%{name}/rules.d/
fb8a4e
  cp %{_datadir}/%{name}/sample-rules/42-trusted-elf.rules  %{_sysconfdir}/%{name}/rules.d/
fb8a4e
  cp %{_datadir}/%{name}/sample-rules/70-trusted-lang.rules  %{_sysconfdir}/%{name}/rules.d/
fb8a4e
  cp %{_datadir}/%{name}/sample-rules/72-shell.rules  %{_sysconfdir}/%{name}/rules.d/
fb8a4e
  cp %{_datadir}/%{name}/sample-rules/90-deny-execute.rules %{_sysconfdir}/%{name}/rules.d/
fb8a4e
  cp %{_datadir}/%{name}/sample-rules/95-allow-open.rules  %{_sysconfdir}/%{name}/rules.d/
fb8a4e
  chgrp %{name} %{_sysconfdir}/%{name}/rules.d/*
fb8a4e
  if [ -x /usr/sbin/restorecon ] ; then
fb8a4e
   # restore correct label
fb8a4e
   /usr/sbin/restorecon -F %{_sysconfdir}/%{name}/rules.d/*
fb8a4e
  fi
fb8a4e
  fagenrules --load
fb8a4e
 fi
fb8a4e
fi
12f79b
%systemd_post %{name}.service
12f79b
12f79b
%preun
12f79b
%systemd_preun %{name}.service
12f79b
12f79b
%postun
12f79b
%systemd_postun_with_restart %{name}.service
12f79b
12f79b
%files
12f79b
%doc README.md
12f79b
%{!?_licensedir:%global license %%doc}
12f79b
%license COPYING
a749e0
%attr(755,root,%{name}) %dir %{_datadir}/%{name}
fb8a4e
%attr(755,root,%{name}) %dir %{_datadir}/%{name}/sample-rules
fb8a4e
%attr(644,root,%{name}) %{_datadir}/%{name}/sample-rules/*
fb8a4e
%attr(644,root,%{name}) %{_datadir}/%{name}/fapolicyd-magic.mgc
12f79b
%attr(750,root,%{name}) %dir %{_sysconfdir}/%{name}
fb8a4e
%attr(750,root,%{name}) %dir %{_sysconfdir}/%{name}/trust.d
fb8a4e
%attr(750,root,%{name}) %dir %{_sysconfdir}/%{name}/rules.d
fb8a4e
%ghost %{_sysconfdir}/%{name}/rules.d/*
fb8a4e
%ghost %{_sysconfdir}/%{name}/%{name}.rules
12f79b
%config(noreplace) %attr(644,root,%{name}) %{_sysconfdir}/%{name}/%{name}.conf
a749e0
%config(noreplace) %attr(644,root,%{name}) %{_sysconfdir}/%{name}/%{name}.trust
fb8a4e
%ghost %attr(644,root,%{name}) %{_sysconfdir}/%{name}/compiled.rules
12f79b
%attr(644,root,root) %{_unitdir}/%{name}.service
12f79b
%attr(644,root,root) %{_tmpfilesdir}/%{name}.conf
12f79b
%attr(755,root,root) %{_sbindir}/%{name}
12f79b
%attr(755,root,root) %{_sbindir}/%{name}-cli
fb8a4e
%attr(755,root,root) %{_sbindir}/fagenrules
12f79b
%attr(644,root,root) %{_mandir}/man8/*
12f79b
%attr(644,root,root) %{_mandir}/man5/*
066af4
%attr(644,root,root) %{_mandir}/man1/*
fb8a4e
%ghost %attr(440,%{name},%{name}) %verify(not md5 size mtime) %{_localstatedir}/log/%{name}-access.log
12f79b
%attr(770,root,%{name}) %dir %{_localstatedir}/lib/%{name}
12f79b
%attr(770,root,%{name}) %dir /run/%{name}
fb8a4e
%ghost %attr(660,root,%{name}) /run/%{name}/%{name}.fifo
fb8a4e
%ghost %attr(660,%{name},%{name}) %verify(not md5 size mtime) %{_localstatedir}/lib/%{name}/data.mdb
fb8a4e
%ghost %attr(660,%{name},%{name}) %verify(not md5 size mtime) %{_localstatedir}/lib/%{name}/lock.mdb
12f79b
%{python3_sitelib}/dnf-plugins/%{name}-dnf-plugin.py
12f79b
%{python3_sitelib}/dnf-plugins/__pycache__/%{name}-dnf-plugin.*.pyc
12f79b
a749e0
# selinux
a749e0
%files selinux
a749e0
%{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2
fb8a4e
%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name}
a749e0
%{_datadir}/selinux/devel/include/%{moduletype}/ipp-%{name}.if
a749e0
a749e0
%post selinux
a749e0
%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2
25361f
%selinux_relabel_post -s %{selinuxtype}
a749e0
a749e0
%postun selinux
a749e0
if [ $1 -eq 0 ]; then
a749e0
    %selinux_modules_uninstall -s %{selinuxtype} %{name}
a749e0
fi
a749e0
a749e0
%posttrans selinux
a749e0
%selinux_relabel_post -s %{selinuxtype}
a749e0
12f79b
%changelog
fb8a4e
* Wed Feb 16 2022 Radovan Sroka <rsroka@redhat.com> - 1.1-1
fb8a4e
RHEL 8.6.0 ERRATUM
fb8a4e
- rebase to 1.1
fb8a4e
Resolves: rhbz#1939379
fb8a4e
- introduce rules.d feature
fb8a4e
Resolves: rhbz#2054741
fb8a4e
- remove pretrans scriptlet
fb8a4e
Resolves: rhbz#2051485
fb8a4e
fb8a4e
* Mon Dec 13 2021 Zoltan Fridrich <zfridric@redhat.com> - 1.0.4-2
fb8a4e
RHEL 8.6.0 ERRATUM
fb8a4e
- rebase to 1.0.4
fb8a4e
- added rpm_sha256_only option
fb8a4e
- added trust.d directory
fb8a4e
- allow file names with whitespace in trust files
fb8a4e
- use full paths in trust files
fb8a4e
Resolves: rhbz#1939379
fb8a4e
- fix libc.so getting identified as application/x-executable
fb8a4e
Resolves: rhbz#1989272
fb8a4e
- fix fapolicyd-dnf-plugin reporting as '<invalid>'
fb8a4e
Resolves: rhbz#1997414
fb8a4e
- fix selinux DSP module definition in spec file
fb8a4e
Resolves: rhbz#2014445
fb8a4e
fb8a4e
* Thu Aug 19 2021 Radovan Sroka <rsroka@redhat.com> - 1.0.2-7
25361f
- fapolicyd abnormally exits by executing sosreport
25361f
- fixed multiple problems with unlink()
25361f
- fapolicyd breaks system upgrade, leaving system in dead state - complete fix
fb8a4e
Resolves: rhbz#1943251
25361f
a9f027
* Tue Feb 16 2021 Radovan Sroka <rsroka@redhat.com> - 1.0.2-3
a9f027
RHEL 8.4.0 ERRATUM
a9f027
- rebase to 1.0.2
a9f027
- strong dependency on rpm/rpm-plugin-fapolicyd
a9f027
- installed dnf-plugin is dummy and we are not using it anymore
a9f027
- enabled integrity setting
a9f027
Resolves: rhbz#1887451
a9f027
- added make check
a9f027
- Adding DISA STIG during OS installation causes 'ipa-server-install' to fail
a9f027
- fixed java detection
a9f027
Resolves: rhbz#1895435
a9f027
- dnf update fails when fapolicyd is enabled
a9f027
Resolves: rhbz#1876975
a9f027
- fapolicyd breaks system upgrade, leaving system in dead state - complete fix
a9f027
Resolves: rhbz#1896875
a9f027
a749e0
* Tue Jun 30 2020 Radovan Sroka <rsroka@redhat.com> - 1.0-3
a749e0
RHEL 8.3 ERRATUM
a749e0
- fixed manpage fapolicyd-conf
a749e0
Resolves: rhbz#1817413
a749e0
a749e0
* Mon May 25 2020 Radovan Sroka <rsroka@redhat.com> - 1.0-2
a749e0
RHEL 8.3 ERRATUM
a749e0
- rebase to v1.0
a749e0
- installed multiple policies to /usr/share/fapolicyd
a749e0
  - known-libs (default)
a749e0
  - restrictive
a749e0
- installed fapolicyd.trust file
a749e0
- enhanced fapolicyd-cli
a749e0
Resolves: rhbz#1817413
a749e0
- introduced fapolicyd-selinux that provides SELinux policy module
a749e0
Resolves: rhbz#1714529
a749e0
a749e0
* Tue Mar 03 2020 Radovan Sroka <rsroka@redhat.com> - 0.9.1-4
a749e0
RHEL 8.2 ERRATUM
a749e0
- fixed possible heap buffer overflow in elf parser
a749e0
Resolves: rhbz#1807912
a749e0
a749e0
* Tue Feb 11 2020 Radovan Sroka <rsroka@redhat.com> - 0.9.1-3
a749e0
RHEL 8.2 ERRATUM
a749e0
- fixed build time python interpreter detection (spec)
a749e0
- added python2-devel as a BuildRequires (spec)
a749e0
- allow running bash scripts in home directories
a749e0
Resolves: rhbz#1801872
a749e0
066af4
* Wed Nov 20 2019 Radovan Sroka <rsroka@redhat.com> - 0.9.1-2
066af4
RHEL 8.2 ERRATUM
066af4
- rebase to v0.9.1
066af4
- updated default configuration with new syntax
066af4
- removed daemon mounts configuration
066af4
Resolves: rhbz#1759895
066af4
- default fapolicyd policy prevents Ansible from running
066af4
- added ansible rule to default ruleset
066af4
Resolves: rhbz#1746464
066af4
- suspicious logs on service start
066af4
Resolves: rhbz#1747494
066af4
- fapolicyd blocks dracut from generating initramfs
066af4
- added dracut rule to default configuration
066af4
Resolves: rhbz#1757736
066af4
- fapolicyd fails to identify perl interpreter
066af4
Resolves: rhbz#1765039
066af4
066af4
* Wed Jul 24 2019 Radovan Sroka <rsroka@redhat.com> - 0.8.10-3
066af4
- added missing manpage for fapolicyd-cli
066af4
Resolves: rhbz#1708015
066af4
066af4
* Mon Jul 22 2019 Radovan Sroka <rsroka@redhat.com> - 0.8.10-2
066af4
- Convert hashes to lowercase like sha256sum outputs
066af4
- Stop littering STDOUT output for dnf plugin in fapolicyd
066af4
Resolves: rhbz#1721496
066af4
066af4
* Tue Jun 18 2019 Radovan Sroka <rsroka@redhat.com> - 0.8.10-1
066af4
- new upstream release
066af4
Resolves: rhbz#1673323
066af4
12f79b
* Mon May 06 2019 Radovan Sroka <rsroka@redhat.com> - 0.8.9-1
12f79b
- New upstream release
12f79b
- imported from fedora30
12f79b
  resolves: rhbz#1673323
12f79b
12f79b
* Wed Mar 13 2019 Radovan Sroka <rsroka@redhat.com> - 0.8.8-2
12f79b
- backport some patches to resolve dac_override for fapolicyd
12f79b
12f79b
* Mon Mar 11 2019 Radovan Sroka <rsroka@redhat.com> - 0.8.8-1
12f79b
- New upstream release
12f79b
- Added new DNF plugin that can update the trust database when rpms are installed
12f79b
- Added support for FAN_OPEN_EXEC_PERM
12f79b
12f79b
* Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.8.7-3
12f79b
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
12f79b
12f79b
12f79b
* Wed Oct 03 2018 Steve Grubb <sgrubb@redhat.com> 0.8.7-1
12f79b
- New upstream bugfix release
12f79b
12f79b
* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 0.8.6-2
12f79b
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
12f79b
12f79b
* Thu Jun 07 2018 Steve Grubb <sgrubb@redhat.com> 0.8.6-1
12f79b
- New upstream feature release
12f79b
12f79b
* Fri May 18 2018 Steve Grubb <sgrubb@redhat.com> 0.8.5-2
12f79b
- Add dist tag (#1579362)
12f79b
12f79b
* Fri Feb 16 2018 Steve Grubb <sgrubb@redhat.com> 0.8.5-1
12f79b
- New release