# Copyright (C) 2017 Red Hat, Inc. All rights reserved.

#

#   Author: Petr Lautrbach <plautrba@redhat.com>

#   Author: Lukáš Vrabec <lvrabec@redhat.com>

#

# This program is free software; you can redistribute it and/or

# modify it under the terms of the GNU General Public License

# as published by the Free Software Foundation; either version 2

# of the License, or (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

# RPM macros for packages installing SELinux modules

%_selinux_policy_version SELINUXPOLICYVERSION

%_selinux_store_path SELINUXSTOREPATH

%_file_context_file %{_sysconfdir}/selinux/${SELINUXTYPE}/contexts/files/file_contexts

%_file_context_file_pre %{_localstatedir}/lib/rpm-state/file_contexts.pre

%_file_custom_defined_booleans %{_selinux_store_path}/${_policytype}/rpmbooleans.custom

%_file_custom_defined_booleans_tmp %{_selinux_store_path}/${_policytype}/rpmbooleans.custom.tmp

# %selinux_requires

%selinux_requires \

Requires: selinux-policy >= %{_selinux_policy_version} \

BuildRequires: git \

BuildRequires: pkgconfig(systemd) \

BuildRequires: selinux-policy \

BuildRequires: selinux-policy-devel \

Requires(post): selinux-policy-base >= %{_selinux_policy_version} \

Requires(post): libselinux-utils \

Requires(post): policycoreutils \

%if 0%{?fedora} \

Requires(post): policycoreutils-python-utils \

%else \

Requires(post): policycoreutils-python \

%endif \

%{nil}

# %selinux_modules_install [-s <policytype>] [-p <modulepriority>] module [module]...

%selinux_modules_install("s:p:") \

. /etc/selinux/config \

_policytype=%{-s*} \

if [ -z "${_policytype}" ]; then \

  _policytype="targeted" \

fi \

%{_sbindir}/semodule -n -s ${_policytype} -X %{!-p:200}%{-p*} -i %* \

if %{_sbindir}/selinuxenabled && [ "${SELINUXTYPE}" = "${_policytype}" ]; then \

  %{_sbindir}/load_policy \

fi \

%{nil}

# %selinux_modules_uninstall [-s <policytype>] [-p <modulepriority>] module [module]...

%selinux_modules_uninstall("s:p:") \

. /etc/selinux/config \

_policytype=%{-s*} \

if [ -z "${_policytype}" ]; then \

  _policytype="targeted" \

fi \

if [ $1 -eq 0 ]; then \

  %{_sbindir}/semodule -n -X %{!-p:200}%{-p*} -s ${_policytype} -r %* &> /dev/null || : \

  if %{_sbindir}/selinuxenabled && [ "${SELINUXTYPE}" = "${_policytype}" ]; then \

    %{_sbindir}/load_policy \

  fi \

fi \

%{nil}

# %selinux_relabel_pre [-s <policytype>]

%selinux_relabel_pre("s:") \

. /etc/selinux/config \

_policytype=%{-s*} \

if [ -z "${_policytype}" ]; then \

  _policytype="targeted" \

fi \

if %{_sbindir}/selinuxenabled && [ "${SELINUXTYPE}" = "${_policytype}" ]; then \

  [ -f %{_file_context_file_pre} ] || cp -f %{_file_context_file} %{_file_context_file_pre} \

fi \

%{nil}

# %selinux_relabel_post [-s <policytype>]

%selinux_relabel_post("s:") \

. /etc/selinux/config \

_policytype=%{-s*} \

if [ -z "${_policytype}" ]; then \

  _policytype="targeted" \

fi \

if %{_sbindir}/selinuxenabled && [ "${SELINUXTYPE}" = "${_policytype}" ]; then \

   if [ -f %{_file_context_file_pre} ]; then \

     %{_sbindir}/fixfiles -C %{_file_context_file_pre} restore &> /dev/null \

     rm -f %{_file_context_file_pre} \

   fi \

fi \

%{nil}

# %selinux_set_booleans [-s <policytype>] boolean [boolean]...

%selinux_set_booleans("s:") \

. /etc/selinux/config \

_policytype=%{-s*} \

if [ -z "${_policytype}" ]; then \

  _policytype="targeted" \

fi \

LOCAL_MODIFICATIONS=$(semanage boolean -E) \

if [ ! -f %_file_custom_defined_booleans ]; then \

    /bin/echo "# This file is managed by macros.selinux-policy. Do not edit it manually" > %_file_custom_defined_booleans \

fi \

semanage_import='' \

for boolean in %*; do \

    boolean_name=${boolean%=*} \

    boolean_value=${boolean#*=} \

    boolean_local_string=$(grep "$boolean_name\$" <<<$LOCAL_MODIFICATIONS) \

    if [ -n "$boolean_local_string" ]; then \

        semanage_import="${semanage_import}\\nboolean -m -$boolean_value $boolean_name" \

        boolean_customized_string=$(grep "$boolean_name\$" %_file_custom_defined_booleans | tail -n 1) \

        if [ -n "$boolean_customized_string" ]; then \

            /bin/echo $boolean_customized_string >> %_file_custom_defined_booleans \

        else \

            /bin/echo $boolean_local_string >> %_file_custom_defined_booleans \

        fi \

    else \

        semanage_import="${semanage_import}\\nboolean -m -$boolean_value $boolean_name" \

        boolean_default_value=$(semanage boolean -l | grep "^$boolean_name " | sed 's/[^(]*([^,]*, *\\(on\\|off\\).*/\\1/') \

        /bin/echo "boolean -m --$boolean_default_value $boolean_name" >> %_file_custom_defined_booleans \

    fi \

done; \

if %{_sbindir}/selinuxenabled && [ "${SELINUXTYPE}" = "${_policytype}" ]; then \

    /bin/echo -e "$semanage_import" | %{_sbindir}/semanage import -S "${_policytype}" \

else \

    /bin/echo -e "$semanage_import" | %{_sbindir}/semanage import -S "${_policytype} -N" \

fi \

%{nil}

# %selinux_unset_booleans [-s <policytype>] boolean [boolean]...

%selinux_unset_booleans("s:") \

. /etc/selinux/config \

_policytype=%{-s*} \

if [ -z "${_policytype}" ]; then \

  _policytype="targeted" \

fi \

semanage_import='' \

for boolean in %*; do \

    boolean_name=${boolean%=*} \

    boolean_customized_string=$(grep "$boolean_name\$" %_file_custom_defined_booleans | tail -n 1) \

    if [ -n "$boolean_customized_string" ]; then \

        awk "/$boolean_customized_string/ && !f{f=1; next} 1" %_file_custom_defined_booleans > %_file_custom_defined_booleans_tmp && mv %_file_custom_defined_booleans_tmp %_file_custom_defined_booleans \

        if ! grep -q "$boolean_name\$" %_file_custom_defined_booleans; then \

            semanage_import="${semanage_import}\\n${boolean_customized_string}" \

        fi \

    fi \

done; \

if %{_sbindir}/selinuxenabled && [ "${SELINUXTYPE}" = "${_policytype}" ]; then \

    /bin/echo -e "$semanage_import" | %{_sbindir}/semanage import -S "${_policytype}" \

else \

    /bin/echo -e "$semanage_import" | %{_sbindir}/semanage import -S "${_policytype} -N" \

fi \

%{nil}