Attachment 1440558 Details for Bug 1573998 – selinux snippets changing setsebool variable

[patch] selinux snippets changing setsebool variable

0001-Use-selinux-snippets-to-set-writeable-bind-home.patch (text/plain), 2.46 KB, created by Petr Menšík on 2018-05-23 12:08:23 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Petr Menšík

Created: 2018-05-23 12:08:23 UTC

Size: 2.46 KB

patch

obsolete

>From 3010a5aa1a15593e4a105d56a32b470d610e39f0 Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
>Date: Wed, 23 May 2018 13:58:58 +0200
>Subject: [PATCH] Use selinux snippets to set writeable bind home
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>Signed-off-by: Petr MenÅ¡Ãk <pemensik@redhat.com>
>---
> bind-dyndb-ldap.spec | 19 +++++++++++--------
> 1 file changed, 11 insertions(+), 8 deletions(-)
>
>diff --git a/bind-dyndb-ldap.spec b/bind-dyndb-ldap.spec
>index 729156a..b4140bb 100644
>--- a/bind-dyndb-ldap.spec
>+++ b/bind-dyndb-ldap.spec
>@@ -2,9 +2,11 @@
> 
> %define bind_version 32:9.11.1-1.P1
> 
>+%global selinuxbooleans named_write_master_zones=1
>+
> Name:           bind-dyndb-ldap
> Version:        11.1
>-Release:        10%{?dist}
>+Release:        11%{?dist}
> Summary:        LDAP back-end plug-in for BIND
> 
> Group:          System Environment/Libraries
>@@ -21,8 +23,10 @@ BuildRequires:  krb5-devel
> BuildRequires:  openldap-devel
> BuildRequires:  libuuid-devel
> BuildRequires:  automake, autoconf, libtool
>+BuildRequires:  selinux-policy
> 
> Requires:       bind-pkcs11 >= %{bind_version}, bind-pkcs11-utils >= %{bind_version}
>+%{?selinux_requires}
> 
> 
> %description
>@@ -58,10 +62,7 @@ rm -r %{buildroot}%{_datadir}/doc/%{name}
> # otherwise the plugin will not be able to write to /var/named.
> # This scriptlet enables the boolean after installation or upgrade.
> # SELinux is sensitive area so I want to inform user about the change.
>-if [ -x "/usr/sbin/setsebool" ] ; then
>-        echo "Enabling SELinux boolean named_write_master_zones"
>-        /usr/sbin/setsebool -P named_write_master_zones=1 || :
>-fi
>+%selinux_set_booleans %{selinuxbooleans}
> 
> # Transform named.conf if it still has old-style API.
> PLATFORM=$(uname -m)
>@@ -105,9 +106,8 @@ sed -i.bak -e "$SEDSCRIPT" /etc/named.conf
> 
> # This scriptlet disables the boolean after uninstallation.
> %postun
>-if [ "0$1" -eq "0" ] && [ -x "/usr/sbin/setsebool" ] ; then
>-        echo "Disabling SELinux boolean named_write_master_zones"
>-        /usr/sbin/setsebool -P named_write_master_zones=0 || :
>+if [ "0$1" -eq "0" ]; then
>+	%selinux_unset_booleans %{selinuxbooleans}
> fi
> 
> 
>@@ -120,6 +120,9 @@ fi
> 
> 
> %changelog
>+* Tue May 22 2018 Petr MenÅ¡Ãk <pemensik@redhat.com> - 11.1-11
>+- Use selinux snippets to set writeable bind home
>+
> * Thu Mar 01 2018 Petr MenÅ¡Ãk <pemensik@redhat.com> - 11.1-10
> - Rebuild for bind 9.11.3. Minor tweaks to compile.
> 
>-- 
>2.14.3
>

Actions: View | Diff

Attachments on bug 1573998: 1440558