-
Notifications
You must be signed in to change notification settings - Fork 0
/
oracle-selinux.spec
130 lines (98 loc) · 3.96 KB
/
oracle-selinux.spec
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
# vim: sw=4:ts=4:et
%define oracle_base /oraapp/oracle
%define oracle_data /oraapp/oraInventory
%define selinux_policyver 3.13.1-268
%global selinuxtype targeted
%global moduletype contrib
%global modulename oracle
Name: oracle-selinux
Version: 1.0.2
Release: 1%{?dist}.spe
Summary: SELinux policy module for oracle databases at Sony Pictures
Group: System Environment/Base
License: Proprietary
Source: %{name}-%{version}.tar.gz
Requires: policycoreutils, libselinux-utils
Requires(post): selinux-policy-base >= %{selinux_policyver}, policycoreutils
Requires(postun): policycoreutils
BuildRequires: selinux-policy-devel, policycoreutils-devel
BuildArch: noarch
%{?el7:Requires(pre): policycoreutils-python}
%{?el7:Requires(preun): policycoreutils-python}
%{?el8:Requires(pre): policycoreutils-python-utils}
%{?el8:Requires(preun): policycoreutils-python-utils}
%description
This package installs and sets up the SELinux policy security module for oracle.
%prep
%setup -q
%build
%{__make} -f /usr/share/selinux/devel/Makefile oracle.pp
%{__bzip2} -9 oracle.pp
/usr/sbin/semodule -X 999 -i oracle.pp.bz2
/usr/bin/sepolicy manpage -p . -d oracle_t oracle_lsnr_t
/usr/sbin/semodule -X 999 -r oracle
%install
install -d \
%{buildroot}%{_datadir}/selinux/packages \
%{buildroot}%{_datadir}/selinux/devel/include/contrib \
%{buildroot}%{_mandir}/man8 \
%{buildroot}/etc/selinux/targeted/contexts/users \
%{buildroot}/%{_bindir} \
%{buildroot}/etc/sudoers.d
install -m 644 oracle.pp.bz2 %{buildroot}%{_datadir}/selinux/packages
install -m 644 oracle.if %{buildroot}%{_datadir}/selinux/devel/include/contrib
install -m 644 oracle_selinux.8 %{buildroot}%{_mandir}/man8/oracle_selinux.8
install -m 644 oracle_lsnr_selinux.8 %{buildroot}%{_mandir}/man8/oracle_lsnr_selinux.8
install -m 644 oracle_u %{buildroot}/etc/selinux/targeted/contexts/users/oracle_u
install -m 755 spe-oracle-port %{buildroot}/%{_bindir}/spe-oracle-port
install -m 400 oracle-selinux.sudoers %{buildroot}/etc/sudoers.d/oracle-selinux
%clean
%pre
%selinux_relabel_pre -s %{selinuxtype}
%posttrans
%selinux_relabel_post -s %{selinuxtype} || :
%post
%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{modulename}.pp.bz2 || :
/usr/sbin/semanage user -a -r s0-s0:c0.c1023 -R 'staff_r secadm_r oracle_r oracle_lsnr_r' oracle_u || :
while read -r user ; do
if [ -n $user ]; then
/usr/sbin/semanage login -a -s oracle_u $user > /dev/null || :
fi;
done <<<"`getent passwd | grep -E 'cyb-uprv-[pdq]dba' | cut -f1 -d:`"
getent group dba > /dev/null;
if [ $? -eq 0 ]; then
/usr/sbin/semanage login -a -s oracle_u %%dba || :
fi;
%preun
while read -r user ; do
if [ -n $user ]; then
/usr/sbin/semanage login -d $user > /dev/null || :
fi;
done <<<"`getent passwd | grep -E 'cyb-uprv-[pdq]dba' | cut -f1 -d:`"
getent group dba > /dev/null;
if [ $? -eq 0 ]; then
/usr/sbin/semanage login -d %%dba || :
fi;
/usr/sbin/semanage user -d oracle_u || :
%postun
if [ $1 -eq 0 ]; then
%selinux_modules_uninstall -s %{selinuxtype} %{modulename} || :
fi
%files
%attr(0600,root,root) %{_datadir}/selinux/packages/oracle.pp.bz2
%{_datadir}/selinux/devel/include/%{moduletype}/oracle.if
%{_mandir}/man8/oracle_selinux.8.*
%{_mandir}/man8/oracle_lsnr_selinux.8.*
/etc/selinux/targeted/contexts/users/oracle_u
%attr(0755,root,root) %{_bindir}/spe-oracle-port
%attr(0400,root,root) /etc/sudoers.d/oracle-selinux
%changelog
* Fri May 14 2021 Alan Willis <[email protected]> 1.0.2-1.el8.spe
- Incorporated updates from selinux troubleshooting dashboard in Splunk
* Tue Feb 9 2021 Alan Willis <[email protected]> 1.0.1-1.el8.spe
- Incorporated changes from test server
- Added four 'enable_oracle' booleans for optional features
* Thu Feb 4 2021 Alan Willis <[email protected]> 1.0.0-1.el8.spe
- Flesh out usage of oracle_conf_t, add script for DBA port modification
* Mon Jan 25 2021 Alan Willis <[email protected]> 1.0.0-0.el8.spe
- Pre-release version for internal testing