On Tue, 2009-01-20 at 09:58 -0600, Joe Nall wrote: > On Jan 20, 2009, at 8:26 AM, Stephen Smalley wrote: > > > On Mon, 2009-01-19 at 15:53 -0500, Jacques Thomas wrote: > >> Stephen Smalley wrote: > >>> On Fri, 2009-01-16 at 20:23 +0100, Dominick Grift wrote: > >>> > >>>> On Fri, 2009-01-16 at 14:03 -0500, Stephen Smalley wrote: > >>>> > >>>> > >>>>> You need to first obtain a policy source tree as your starting > >>>>> point. > >>>>> If you want to minimize your divergence from the distro-shipped > >>>>> policy, > >>>>> then download the selinux-policy source RPM (.src.rpm) for your > >>>>> distro, > >>>>> expand it, and then customize as desired and rebuild it (Dan - > >>>>> is there > >>>>> a recipe documented somewhere for doing that?). > >>>>> > >>>> I have created a screen cast that focuses on just that. However, > >>>> the > >>>> file is 200MB and i do not have the ability to host it. > >>>> > >>> > >>> I just meant writing down the sequence of commands to set up a > >>> buildable > >>> policy source tree from the .src.rpm. Screencast seems a bit > >>> overkill > >>> for that - it really ought to just be part of the Fedora SELinux > >>> FAQ or > >>> Guide IMHO. > >>> > >>> > >> > >> Here's what works for me to tweak the policy on a Fedora 8 system. > >> > >> Make sure you have the latest policy package (otherwise, you might > >> not > >> be able to get it in source version): > >> yum update > >> yum install selinux-policy-targeted > >> > >> Figure out the version of the rpm: > >> rpm -qa | grep selinux-policy-targeted > >> > >> Get the corresponding source rpm: > >> yumdownloader --source `rpm -qa | grep policy-targeted` > >> > >> Voila! The source rpm is in your current directory. > >> > >> From there on, regular instructions for rebuilding rpms apply. The > >> following is a short tutorial. > >> http://www.hacktux.com/fedora/source/rpm > > > > I think we need something more specific to the policy, similar to the > > instructions for building a custom kernel at > > http://fedoraproject.org/wiki/Docs/CustomKernel > > > > Getting a buildable policy tree that matches the Fedora shipped policy > > configuration isn't as straightforward as one might like, since the > > spec > > file defers most of the real work to the %install target and specifies > > different build.conf settings (via command-line override to make) and > > different modules.conf configurations based on the particular policy > > type. The question does seem to keep arising on fedora-selinux-list > > and > > selinux list, so it would be helpful to have it documented somewhere. > > I'm sure Dan has better mojo, but I: > - install the src rpm > - add patches to SOURCE directory > - patch spec file to incorporate patches in SOURCE > - build policy rpms using patched spec file Yes, that works if you have your changes in the form of a patch and want to do things the rpm way. But not so much if you'd just like to create a buildable source tree that matches the Fedora configuration that you can then edit at will and build manually (which you might later use as the basis for creating a patch that you would then be able to add to the .src.rpm for distribution purposes). The "add patch file to spec and rebuild with rpm" is fine for packaging but not so much for initially developing one's changes, at least in my view. For many (simpler) packages, you can just do a rpmbuild -bp on the spec file and you'll have a buildable source tree that you can edit and build manually. But not in the case of selinux-policy, where it is building N different variants of policy during %install and pulling in different conf files accordingly. I've done it by hand before in order to make custom changes to a base module (e.g. defining new kernel classes/perms) for testing purposes, but it would be nice if the process were captured and maintained as a recipe somewhere w/o requiring people to reverse engineer it from the .spec file. -- Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
