https://bugzilla.redhat.com/show_bug.cgi?id=2496812
--- Comment #5 from Kan-Ru Chen <[email protected]> --- Spec diff: diff --git a/webhook.spec b/webhook.spec index 22cf14d76f..49df23c074 100644 --- a/webhook.spec +++ b/webhook.spec @@ -1,6 +1,10 @@ # Generated by go2rpm 1.19.0 %bcond check 1 +# SELinux support +%global selinuxtype targeted +%bcond selinux 1 + # https://github.com/adnanh/webhook %global goipath github.com/adnanh/webhook Version: 2.8.3 @@ -20,15 +24,48 @@ # Generated by go-vendor-tools Source1: %{archivename}-vendor.tar.bz2 Source2: go-vendor-tools.toml +# Decentralized SELinux policy +Source3: webhook.fc +Source4: webhook.te +Source5: webhook.if +# Systemd +Source6: webhook.socket +Source7: webhook.service +Source8: webhook.conf BuildRequires: go-vendor-tools +BuildRequires: systemd-rpm-macros + +%if 0%{?with_selinux} +Requires: (%{name}-selinux = %{version}-%{release} if selinux-policy-%{selinuxtype}) +%endif + +# https://github.com/adnanh/webhook/pull/759 +Patch0: 0000-Prevent-unbounded-request-body-reads.patch %description Webhook is a lightweight incoming webhook server to run shell commands. +%if 0%{?with_selinux} +%package selinux +Summary: SElinux policy for webhook +BuildArch: noarch +Requires: selinux-policy-%{selinuxtype} +Requires(post): selinux-policy-%{selinuxtype} +BuildRequires: selinux-policy-devel +%{?selinux_requires} + +%description selinux +SELinux policy modules for FRR package + +%endif + %prep %goprep -p1 tar -xf %{S:1} +# SELinux +mkdir selinux +cp -p %{SOURCE3} %{SOURCE4} %{SOURCE5} selinux %generate_buildrequires %go_vendor_license_buildrequires -c %{S:2} @@ -37,10 +74,43 @@ %global gomodulesmode GO111MODULE=on %gobuild -o %{gobuilddir}/bin/webhook %{goipath} +#SELinux policy +%if 0%{?with_selinux} +make -C selinux -f %{_datadir}/selinux/devel/Makefile %{name}.pp +bzip2 -9 selinux/%{name}.pp +%endif + %install %go_vendor_license_install -c %{S:2} install -m 0755 -vd %{buildroot}%{_bindir} install -m 0755 -vp %{gobuilddir}/bin/* %{buildroot}%{_bindir}/ +install -m 0755 -vd %{buildroot}%{_unitdir} +install -m 0644 -vp %{SOURCE6} %{buildroot}%{_unitdir}/ +install -m 0644 -vp %{SOURCE7} %{buildroot}%{_unitdir}/ +install -m 0755 -vd %{buildroot}%{_sysconfdir} +install -m 0644 -vp %{SOURCE8} %{buildroot}%{_sysconfdir}/ + +%if 0%{?with_selinux} +install -D -m 644 selinux/%{name}.pp.bz2 \ + %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2 +install -D -m 644 selinux/%{name}.if %{buildroot}%{_datadir}/selinux/devel/include/distributed/%{name}.if +%endif + +#SELinux +%if 0%{?with_selinux} +%pre selinux +%selinux_relabel_pre -s %{selinuxtype} + +%post selinux +%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2 +%selinux_relabel_post -s %{selinuxtype} + +%postun selinux +if [ $1 -eq 0 ]; then + %selinux_modules_uninstall -s %{selinuxtype} %{name} + %selinux_relabel_post -s %{selinuxtype} +fi +%endif %check %go_vendor_license_check -c %{S:2} @@ -50,8 +120,17 @@ %files -f %{go_vendor_license_filelist} %doc docs CONTRIBUTING.md README.md +%config(noreplace) %{_sysconfdir}/webhook.conf %{_bindir}/webhook +%{_unitdir}/webhook.socket +%{_unitdir}/webhook.service +%if 0%{?with_selinux} +%files selinux +%{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.* +%{_datadir}/selinux/devel/include/distributed/%{name}.if +%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name} +%endif %changelog %autochangelog -- You are receiving this mail because: You are always notified about changes to this product and component You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2496812 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-spam&short_desc=Report%20of%20Bug%202496812%23c5 -- _______________________________________________ package-review mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
