Re: Base module, modules.conf

[Jacques Thomas <jthomas@cs.purdue.edu>]

Stephen Smalley wrote:
> On Tue, 2009-01-20 at 09:58 -0600, Joe Nall wrote:
>   
>> On Jan 20, 2009, at 8:26 AM, Stephen Smalley wrote:
>>
>>     
>>> On Mon, 2009-01-19 at 15:53 -0500, Jacques Thomas wrote:
>>>       
>>>> Stephen Smalley wrote:
>>>>         
>>>>> On Fri, 2009-01-16 at 20:23 +0100, Dominick Grift wrote:
>>>>>
>>>>>           
>>>>>> On Fri, 2009-01-16 at 14:03 -0500, Stephen Smalley wrote:
>>>>>>
>>>>>>
>>>>>>             
>>>>>>> You need to first obtain a policy source tree as your starting  
>>>>>>> point.
>>>>>>> If you want to minimize your divergence from the distro-shipped  
>>>>>>> policy,
>>>>>>> then download the selinux-policy source RPM (.src.rpm) for your  
>>>>>>> distro,
>>>>>>> expand it, and then customize as desired and rebuild it (Dan -  
>>>>>>> is there
>>>>>>> a recipe documented somewhere for doing that?).
>>>>>>>
>>>>>>>               
>>>>>> I have created a screen cast that focuses on just that. However,  
>>>>>> the
>>>>>> file is 200MB and i do not have the ability to host it.
>>>>>>
>>>>>>             
>>>>> I just meant writing down the sequence of commands to set up a  
>>>>> buildable
>>>>> policy source tree from the .src.rpm.  Screencast seems a bit  
>>>>> overkill
>>>>> for that - it really ought to just be part of the Fedora SELinux  
>>>>> FAQ or
>>>>> Guide IMHO.
>>>>>
>>>>>
>>>>>           
>>>> Here's what works for me to tweak the policy on a Fedora 8 system.
>>>>
>>>> Make sure you have the latest policy package (otherwise, you might  
>>>> not
>>>> be able to get it in source version):
>>>>   yum update
>>>>   yum install selinux-policy-targeted
>>>>
>>>> Figure out the version of the rpm:
>>>>   rpm -qa | grep selinux-policy-targeted
>>>>
>>>> Get the corresponding source rpm:
>>>>   yumdownloader --source `rpm -qa | grep policy-targeted`
>>>>
>>>> Voila! The source rpm is in your current directory.
>>>>
>>>> From there on, regular instructions for rebuilding rpms apply. The
>>>> following is a short tutorial.
>>>>   http://www.hacktux.com/fedora/source/rpm
>>>>         
>>> I think we need something more specific to the policy, similar to the
>>> instructions for building a custom kernel at
>>> http://fedoraproject.org/wiki/Docs/CustomKernel
>>>
>>> Getting a buildable policy tree that matches the Fedora shipped policy
>>> configuration isn't as straightforward as one might like, since the  
>>> spec
>>> file defers most of the real work to the %install target and specifies
>>> different build.conf settings (via command-line override to make) and
>>> different modules.conf configurations based on the particular policy
>>> type.  The question does seem to keep arising on fedora-selinux-list  
>>> and
>>> selinux list, so it would be helpful to have it documented somewhere.
>>>       
>> I'm sure Dan has better mojo, but I:
>>   - install the src rpm
>>   - add patches to SOURCE directory
>>   - patch spec file to incorporate patches in SOURCE
>>   - build policy rpms using patched spec file
>>     
>
> Yes, that works if you have your changes in the form of a patch and want
> to do things the rpm way.  But not so much if you'd just like to create
> a buildable source tree that matches the Fedora configuration that you
> can then edit at will and build manually (which you might later use as
> the basis for creating a patch that you would then be able to add to
> the .src.rpm for distribution purposes).  The "add patch file to spec
> and rebuild with rpm" is fine for packaging but not so much for
> initially developing one's changes, at least in my view.
>
> For many (simpler) packages, you can just do a rpmbuild -bp on the spec
> file and you'll have a buildable source tree that you can edit and build
> manually.  But not in the case of selinux-policy, where it is building N
> different variants of policy during %install and pulling in different
> conf files accordingly.
>
> I've done it by hand before in order to make custom changes to a base
> module (e.g. defining new kernel classes/perms) for testing purposes,
> but it would be nice if the process were captured and maintained as a
> recipe somewhere w/o requiring people to reverse engineer it from
> the .spec file.
>   

This would help me too. :-)
(I am not done reverse-engineering the package build process)

Best,
Jacques

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.