Skip to content

Commit 177b5ab

Browse files
scientist-stscientist-st
committed
Added selinux policy
1 parent c4fe78b commit 177b5ab

File tree

6 files changed

+213
-1
lines changed

6 files changed

+213
-1
lines changed

‎.gitlab-ci.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -139,7 +139,7 @@ build (s)rpm:
139139
- .skip_manual_for_pr_template
140140
stage: "🚧 Build Stage 2"
141141
script:
142-
- sudo dnf install -y rpmdevtools systemd-rpm-macros
142+
- sudo dnf install -y rpmdevtools systemd-rpm-macros selinux-policy-devel
143143
- sed -i "s/set(CPACK_RPM_PACKAGE_RELEASE \"[0-9]\+\")/set(CPACK_RPM_PACKAGE_RELEASE \"${CI_PIPELINE_IID}\")/" packaging/rpm/cpack_config.cmake
144144
- cmake . -B $BUILD_WORKSPACE -DAPS_CHRONY_DBUS_SERVICE_FETCH_CONTENT_USE_GITLAB_CI_TOKEN=ON -DCMAKE_BUILD_TYPE=Release -DAPS_CHRONY_DBUS_SERVICE_BUILD_TESTS=OFF -DAPS_CHRONY_DBUS_SERVICE_CPACK_RPM_TYPE=RPM
145145
- cmake --build $BUILD_WORKSPACE --parallel $PARALLEL
@@ -151,6 +151,11 @@ build (s)rpm:
151151
- pushd $BUILD_WORKSPACE
152152
- ../scripts/build_rpm.sh
153153
- popd
154+
- cp -r ./packaging/selinux/ $BUILD_WORKSPACE/
155+
- pushd $BUILD_WORKSPACE/selinux/
156+
- ../scripts/build_selinux_policy.sh
157+
- mv *.rpm $BUILD_WORKSPACE
158+
- popd
154159
- mkdir -p $BUILD_WORKSPACE/RPM
155160
- rm -rf $BUILD_WORKSPACE/RPM/*
156161
- mv $BUILD_WORKSPACE/*.rpm $BUILD_WORKSPACE/RPM

‎packaging/selinux/chrony_dbus_service.fc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
/usr/bin/chrony-dbus-service -- gen_context(system_u:object_r:chrony_dbus_service_exec_t,s0)

‎packaging/selinux/chrony_dbus_service.if‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
2+
## <summary>policy for chrony_dbus_service</summary>
3+
4+
########################################
5+
## <summary>
6+
## Execute chrony_dbus_service_exec_t in the chrony_dbus_service domain.
7+
## </summary>
8+
## <param name="domain">
9+
## <summary>
10+
## Domain allowed to transition.
11+
## </summary>
12+
## </param>
13+
#
14+
interface(`chrony_dbus_service_domtrans',`
15+
gen_require(`
16+
type chrony_dbus_service_t, chrony_dbus_service_exec_t;
17+
')
18+
19+
corecmd_search_bin($1)
20+
domtrans_pattern($1, chrony_dbus_service_exec_t, chrony_dbus_service_t)
21+
')
22+
23+
######################################
24+
## <summary>
25+
## Execute chrony_dbus_service in the caller domain.
26+
## </summary>
27+
## <param name="domain">
28+
## <summary>
29+
## Domain allowed access.
30+
## </summary>
31+
## </param>
32+
#
33+
interface(`chrony_dbus_service_exec',`
34+
gen_require(`
35+
type chrony_dbus_service_exec_t;
36+
')
37+
38+
corecmd_search_bin($1)
39+
can_exec($1, chrony_dbus_service_exec_t)
40+
')
41+
42+
########################################
43+
## <summary>
44+
## Send and receive messages from
45+
## chrony_dbus_service over dbus.
46+
## </summary>
47+
## <param name="domain">
48+
## <summary>
49+
## Domain allowed access.
50+
## </summary>
51+
## </param>
52+
#
53+
interface(`chrony_dbus_service_dbus_chat',`
54+
gen_require(`
55+
type chrony_dbus_service_t;
56+
class dbus send_msg;
57+
')
58+
59+
allow $1 chrony_dbus_service_t:dbus send_msg;
60+
allow chrony_dbus_service_t $1:dbus send_msg;
61+
')

‎packaging/selinux/chrony_dbus_service.te‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
policy_module(chrony_dbus_service, 1.0.0)
2+
3+
########################################
4+
#
5+
# Declarations
6+
#
7+
8+
type chrony_dbus_service_t;
9+
type chrony_dbus_service_exec_t;
10+
init_daemon_domain(chrony_dbus_service_t, chrony_dbus_service_exec_t)
11+
12+
permissive chrony_dbus_service_t;
13+
14+
########################################
15+
#
16+
# chrony_dbus_service local policy
17+
#
18+
allow chrony_dbus_service_t self:fifo_file rw_fifo_file_perms;
19+
allow chrony_dbus_service_t self:unix_stream_socket create_stream_socket_perms;
20+
21+
domain_use_interactive_fds(chrony_dbus_service_t)
22+
23+
files_read_etc_files(chrony_dbus_service_t)
24+
25+
miscfiles_read_localization(chrony_dbus_service_t)
26+
27+
sysnet_dns_name_resolve(chrony_dbus_service_t)
28+
29+
optional_policy(`
30+
dbus_system_bus_client(chrony_dbus_service_t)
31+
dbus_connect_system_bus(chrony_dbus_service_t)
32+
')
33+
34+
require {
35+
type chronyd_t;
36+
type chronyd_var_run_t;
37+
}
38+
39+
#============= chrony_dbus_service_t ==============
40+
allow chrony_dbus_service_t chronyd_t:unix_dgram_socket sendto;
41+
allow chrony_dbus_service_t chronyd_var_run_t:dir { add_name remove_name write };
42+
allow chrony_dbus_service_t chronyd_var_run_t:sock_file { create getattr setattr unlink write };
43+
allow chrony_dbus_service_t self:capability { dac_override dac_read_search };
44+
allow chrony_dbus_service_t self:unix_dgram_socket { bind connect create setopt };
45+
46+
#============= chronyd_t ==============
47+
allow chronyd_t chrony_dbus_service_t:unix_dgram_socket sendto;

‎packaging/selinux/chrony_dbus_service_selinux.spec‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
# vim: sw=4:ts=4:et
2+
3+
4+
%define relabel_files() \
5+
restorecon -R /usr/bin/chrony-dbus-service; \
6+
7+
%define selinux_policyver 40.30-1
8+
9+
Name: chrony-dbus-service-selinux
10+
Version: 1.0
11+
Release: 1%{?dist}
12+
Summary: SELinux policy module for chrony_dbus_service
13+
14+
Group: System Environment/Base
15+
License: GPLv2+
16+
17+
URL: https://github.com/AP-Sensing/chrony-dbus-service
18+
Source0: chrony_dbus_service.pp
19+
Source1: chrony_dbus_service.if
20+
21+
22+
Requires: policycoreutils-python-utils, libselinux-utils
23+
Requires(post): selinux-policy-base >= %{selinux_policyver}, policycoreutils-python-utils
24+
Requires(postun): policycoreutils-python-utils
25+
Requires(post): chrony-dbus-service, chrony-dbus-service, chrony-dbus-service
26+
BuildArch: noarch
27+
28+
%description
29+
This package installs and sets up the SELinux policy security module for chrony_dbus_service.
30+
31+
%install
32+
install -d %{buildroot}%{_datadir}/selinux/packages
33+
install -m 644 %{SOURCE0} %{buildroot}%{_datadir}/selinux/packages
34+
install -d %{buildroot}%{_datadir}/selinux/devel/include/contrib
35+
install -m 644 %{SOURCE1} %{buildroot}%{_datadir}/selinux/devel/include/contrib/
36+
37+
%post
38+
semodule -n -i %{_datadir}/selinux/packages/chrony_dbus_service.pp
39+
40+
if [ $1 -eq 1 ]; then
41+
42+
fi
43+
if /usr/sbin/selinuxenabled ; then
44+
/usr/sbin/load_policy
45+
%relabel_files
46+
fi;
47+
exit 0
48+
49+
%postun
50+
if [ $1 -eq 0 ]; then
51+
52+
semodule -n -r chrony_dbus_service
53+
if /usr/sbin/selinuxenabled ; then
54+
/usr/sbin/load_policy
55+
%relabel_files
56+
fi;
57+
fi;
58+
exit 0
59+
60+
%files
61+
%attr(0600,root,root) %{_datadir}/selinux/packages/chrony_dbus_service.pp
62+
%{_datadir}/selinux/devel/include/contrib/chrony_dbus_service.if
63+
64+
65+
%changelog
66+
* Thu Mar 26 2026 Samuel Stirtzel <s.stirtzel@googlemail.com> 1.0-1
67+
- Initial version
68+

‎scripts/build_selinux_policy.sh‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
#!/bin/sh -e
2+
3+
printf "🗂️ Building Policy...\n"
4+
5+
RED='\033[0;31m'
6+
GREEN='\033[0;32m'
7+
NC='\033[0m'
8+
9+
10+
make -f /usr/share/selinux/devel/Makefile chrony_dbus_service.pp
11+
12+
ret=$?
13+
if [ $ret -ne 0 ]; then
14+
printf "❌ ${RED}Building Policy failed.?${NC}\n"
15+
else
16+
printf "✅ ${GREEN}Policy build successfully. Output: $(pwd)${NC}\n"
17+
fi
18+
19+
printf "🗂️ Building Policy RPM...\n"
20+
21+
pwd=$(pwd)
22+
rpmbuild --define "_sourcedir ${pwd}" --define "_specdir ${pwd}" --define "_builddir ${pwd}" --define "_srcrpmdir ${pwd}" --define "_rpmdir ${pwd}" --define "_buildrootdir ${pwd}/.build" -ba chrony_dbus_service_selinux.spec
23+
24+
if [ $ret -ne 0 ]; then
25+
printf "❌ ${RED}Building Policy RPM failed. Did you build successfully before (pressed F7)?${NC}\n"
26+
else
27+
printf "✅ ${GREEN}Policy RPM build successfully. Output: $(pwd)${NC}\n"
28+
fi
29+
30+
exit $ret

0 commit comments

Comments
 (0)