- 1 Configuring the Development Environment
- 2 Packaging SELinux Policy
- 3 Bundling SELinux Policy RPMs in Fedora Modules
Configuring the Development Environment
The goal of this section is to help people setup their system to build SELinux policy and Fedora Modules.
Building Fedora Modules
Module build is facilitated by the fm-oschestrator (module-build-service package), which is controlled by a set of fedpkg commands.
# dnf install fedpkg module-build-service
Building SELinux Policy modules and RPMs
SELinux policy module build is a multi step process covered by a Makefile provided by selinux-policy-devel pacakge together with all the necessary tools. Since the finished module will be packaged in an rpm, we also need rpm-build package.
The following is only necessary for local testing of the SELinux policy package since the build is otherwise done by the module-build-service.
# dnf install selinux-policy-devel rpm-build
By default dnf does not have access to FM repositories even though it is able to work with modules. Install "fedora-repos-modular-<fedora version>" package to gain acces to "Fedora Modular" modules.
# dnf install fedora-repos-modular-28
Packaging SELinux Policy
From modularity point of view the SELinux policy needs to be available in the form of RPM package. It's up to the maintainer to choose weather the policy package is standalone or a sub-package of the corresponding software. The former is covered by the Independent Policy Project (IPP) wiki. The latter only differs in the RPM spec file and can be seen in the memcached package.
SELinux Policy Priorities
Priority 200 should be used for all custom policy modules falling under IPP project regardless of the means of distribution (FM, RPM, ...). This value is set in the %selinux_modules_install macro and should not be overridden by package maintainers.
SELinux Base Policies
Q - have we tried packaging both a MLS and targeted policy module in the memcached prototype? If not, this is something we should do to verify that it works as expected.
No, only targeted so far.
Example SELinux Policy RPM specfile
Bundling SELinux Policy RPMs in Fedora Modules
Including the policy RPM in a Fedora module is as simple as specifying the RPM source repository name and branch in the components section of the modulemd file.
components: rpms: foo: rationale: Primary component of this module. ref: master foo-selinux: rationale: Provides SELinux policy for foo ref: master
In case the SELinux policy RPM is a sub-package, this step is already done (the Module Build Service (MBS) will build the specified component including all sub-packages automatically.)
Adding the SELinux Policy to the Module Install Profiles
Including the SELinux policy module in the Fedora module makes no difference unless the policy module is part of one or more install profiles.
It is recommended to include the policy RPM in the default install profile. Depending on the primary component it may be useful to include an install profile without the policy module to be used for example inside a container. The policy does not take effect inside a container and would only bring unnecessary dependencies.
profiles: default: rpms: - foo - foo-selinux container: rpms: - foo
Complete example modulemd file which includes SELinux policy module RPM (sub-package) can be seen in the memcached module repository.