Bug 2496812

This package built on koji:  https://koji.fedoraproject.org/koji/taskinfo?taskID=147336813

Copr build:
https://copr.fedorainfracloud.org/coprs/build/10678156
(succeeded)

Review template:
https://download.copr.fedorainfracloud.org/results/@fedora-review/fedora-review-2496812-webhook/fedora-rawhide-x86_64/10678156-webhook/fedora-review/review.txt

Please take a look if any issues were found.


---
This comment was created by the fedora-review-service
https://github.com/FrostyX/fedora-review-service

If you want to trigger a new Copr build, add a comment containing new
Spec and SRPM URLs or [fedora-review-service-build] string.

- A systemd service file can be useful. Having a socket file to start the service when an incoming connection starts can be better.
- Project has some security concerns, like the one reported in issue 756. I sent a PR trying to fix this, could you include the patch in the spec? https://github.com/adnanh/webhook/pull/759

Spec URL: https://kanru.fedorapeople.org/webhook.spec
SRPM URL: https://kanru.fedorapeople.org/webhook-2.8.3-3.fc45.src.rpm

Thanks for the review! The patch is added to the spec.

I've added systemd units with socket activation, using the default upstream port 9000.

I've also added a selinux policy subpackage to only allow scripts or executables with the webhook_unconfined_exec_t type to run unconfined. There is a default on boolean `webhook_unconfined_exec_any` to allow running any executables with bin_t type unconfined, to match the default behavior without selinux.

Spec diff:

diff --git a/webhook.spec b/webhook.spec
index 22cf14d76f..49df23c074 100644
--- a/webhook.spec
+++ b/webhook.spec
@@ -1,6 +1,10 @@
 # Generated by go2rpm 1.19.0
 %bcond check 1
 
+# SELinux support
+%global selinuxtype targeted
+%bcond selinux 1
+
 # https://github.com/adnanh/webhook
 %global goipath         github.com/adnanh/webhook
 Version:                2.8.3
@@ -20,15 +24,48 @@
 # Generated by go-vendor-tools
 Source1:        %{archivename}-vendor.tar.bz2
 Source2:        go-vendor-tools.toml
+# Decentralized SELinux policy
+Source3:        webhook.fc
+Source4:        webhook.te
+Source5:        webhook.if
+# Systemd
+Source6:        webhook.socket
+Source7:        webhook.service
+Source8:        webhook.conf
 
 BuildRequires:  go-vendor-tools
+BuildRequires:  systemd-rpm-macros
+
+%if 0%{?with_selinux}
+Requires: (%{name}-selinux = %{version}-%{release} if selinux-policy-%{selinuxtype})
+%endif
+
+# https://github.com/adnanh/webhook/pull/759
+Patch0:         0000-Prevent-unbounded-request-body-reads.patch
 
 %description
 Webhook is a lightweight incoming webhook server to run shell commands.
 
+%if 0%{?with_selinux}
+%package selinux
+Summary:    SElinux policy for webhook
+BuildArch:  noarch
+Requires:   selinux-policy-%{selinuxtype}
+Requires(post):  selinux-policy-%{selinuxtype}
+BuildRequires:   selinux-policy-devel
+%{?selinux_requires}
+
+%description selinux
+SELinux policy modules for FRR package
+
+%endif
+
 %prep
 %goprep -p1
 tar -xf %{S:1}
+# SELinux
+mkdir selinux
+cp -p %{SOURCE3} %{SOURCE4} %{SOURCE5} selinux
 
 %generate_buildrequires
 %go_vendor_license_buildrequires -c %{S:2}
@@ -37,10 +74,43 @@
 %global gomodulesmode GO111MODULE=on
 %gobuild -o %{gobuilddir}/bin/webhook %{goipath}
 
+#SELinux policy
+%if 0%{?with_selinux}
+make -C selinux -f %{_datadir}/selinux/devel/Makefile %{name}.pp
+bzip2 -9 selinux/%{name}.pp
+%endif
+
 %install
 %go_vendor_license_install -c %{S:2}
 install -m 0755 -vd                     %{buildroot}%{_bindir}
 install -m 0755 -vp %{gobuilddir}/bin/* %{buildroot}%{_bindir}/
+install -m 0755 -vd                     %{buildroot}%{_unitdir}
+install -m 0644 -vp %{SOURCE6}          %{buildroot}%{_unitdir}/
+install -m 0644 -vp %{SOURCE7}          %{buildroot}%{_unitdir}/
+install -m 0755 -vd                     %{buildroot}%{_sysconfdir}
+install -m 0644 -vp %{SOURCE8}          %{buildroot}%{_sysconfdir}/
+
+%if 0%{?with_selinux}
+install -D -m 644 selinux/%{name}.pp.bz2 \
+  %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2
+install -D -m 644 selinux/%{name}.if %{buildroot}%{_datadir}/selinux/devel/include/distributed/%{name}.if
+%endif
+
+#SELinux
+%if 0%{?with_selinux}
+%pre selinux
+%selinux_relabel_pre -s %{selinuxtype}
+
+%post selinux
+%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2
+%selinux_relabel_post -s %{selinuxtype}
+
+%postun selinux
+if [ $1 -eq 0 ]; then
+    %selinux_modules_uninstall -s %{selinuxtype} %{name}
+    %selinux_relabel_post -s %{selinuxtype}
+fi
+%endif
 
 %check
 %go_vendor_license_check -c %{S:2}
@@ -50,8 +120,17 @@
 
 %files -f %{go_vendor_license_filelist}
 %doc docs CONTRIBUTING.md README.md
+%config(noreplace) %{_sysconfdir}/webhook.conf
 %{_bindir}/webhook
+%{_unitdir}/webhook.socket
+%{_unitdir}/webhook.service
 
+%if 0%{?with_selinux}
+%files selinux
+%{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.*
+%{_datadir}/selinux/devel/include/distributed/%{name}.if
+%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name}
+%endif
 
 %changelog
 %autochangelog

> +%description selinux
> +SELinux policy modules for FRR package

Fixed the description

Hi Mikel, would you like to continue the review?