clearlinux/docker
2
0
Fork 0
mirror of https://github.com/clearlinux/docker.git synced 2026-09-06 05:31:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

add selinux-policy and docker-engine-selinux rpm

Browse Source 
Signed-off-by: Jessica Frazelle <acidburn@docker.com>
This commit is contained in:
Jessica Frazelle
2015-08-28 17:54:04 -07:00
parent 42d8fe6105
commit 8fe675d799
9 changed files with 1551 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hack/make/.build-rpm/docker-engine-selinux.spec
+102
View File
@@ -0,0 +1,102 @@
# Some bits borrowed from the openstack-selinux package
Name: docker-engine-selinux
Version: %{_version}
Release: %{_release}%{?dist}
Summary: SELinux Policies for the open-source application container engine
BuildArch: noarch
Group: Tools/Docker
License: GPLv2
Source: %{name}.tar.gz
URL: https://dockerproject.org
Vendor: Docker
Packager: Docker <support@docker.com>
# Version of SELinux we were using
%if 0%{?fedora} == 20
%global selinux_policyver 3.12.1-197
%endif # fedora 20
%if 0%{?fedora} == 21
%global selinux_policyver 3.13.1-105
%endif # fedora 21
%if 0%{?fedora} >= 22
%global selinux_policyver 3.13.1-128
%endif # fedora 22
%if 0%{?centos} >= 7 || 0%{?rhel} >= 7 || 0%{?oraclelinux} >= 7
%global selinux_policyver 3.13.1-23
%endif # centos,rhel,oraclelinux 7
%global selinuxtype targeted
%global moduletype services
%global modulenames docker
Requires(post): selinux-policy-base >= %{selinux_policyver}, selinux-policy-targeted >= %{selinux_policyver}, policycoreutils, policycoreutils-python libselinux-utils
BuildRequires: selinux-policy selinux-policy-devel
# conflicting packages
Conflicts: docker-selinux
# Usage: _format var format
# Expand 'modulenames' into various formats as needed
# Format must contain '$x' somewhere to do anything useful
%global _format() export %1=""; for x in %{modulenames}; do %1+=%2; %1+=" "; done;
# Relabel files
%global relabel_files() \
/sbin/restorecon -R %{_bindir}/docker %{_localstatedir}/run/docker.sock %{_localstatedir}/run/docker.pid %{_sharedstatedir}/docker %{_sysconfdir}/docker %{_localstatedir}/log/docker %{_localstatedir}/log/lxc %{_localstatedir}/lock/lxc %{_usr}/lib/systemd/system/docker.service /root/.docker &> /dev/null || : \
%description
SELinux policy modules for use with Docker
%prep
%if 0%{?centos} <= 6
%setup -n %{name}
%else
%autosetup -n %{name}
%endif
%build
make SHARE="%{_datadir}" TARGETS="%{modulenames}"
%install
# Install SELinux interfaces
%_format INTERFACES $x.if
install -d %{buildroot}%{_datadir}/selinux/devel/include/%{moduletype}
install -p -m 644 $INTERFACES %{buildroot}%{_datadir}/selinux/devel/include/%{moduletype}
# Install policy modules
%_format MODULES $x.pp.bz2
install -d %{buildroot}%{_datadir}/selinux/packages
install -m 0644 $MODULES %{buildroot}%{_datadir}/selinux/packages
%post
#
# Install all modules in a single transaction
#
if [ $1 -eq 1 ]; then
%{_sbindir}/setsebool -P -N virt_use_nfs=1 virt_sandbox_use_all_caps=1
fi
%_format MODULES %{_datadir}/selinux/packages/$x.pp.bz2
%{_sbindir}/semodule -n -s %{selinuxtype} -i $MODULES
if %{_sbindir}/selinuxenabled ; then
%{_sbindir}/load_policy
%relabel_files
fi
%postun
if [ $1 -eq 0 ]; then
%{_sbindir}/semodule -n -r %{modulenames} &> /dev/null || :
if %{_sbindir}/selinuxenabled ; then
%{_sbindir}/load_policy
%relabel_files
fi
fi
%files
%defattr(-,root,root,0755)
%attr(0644,root,root) %{_datadir}/selinux/packages/*.pp.bz2
%attr(0644,root,root) %{_datadir}/selinux/devel/include/%{moduletype}/*.if
%changelog
hack/make/.build-rpm/docker-engine.spec
+12 -5
View File
@@ -51,18 +51,25 @@ Requires: device-mapper >= 1.02.90-2
%endif
# docker-selinux conditional
%if 0%{?fedora} >= 22 || 0%{?centos} >= 7 || 0%{?rhel} >= 7 || 0%{?oracle} >= 7
%if 0%{?fedora} >= 20 || 0%{?centos} >= 7 || 0%{?rhel} >= 7 || 0%{?oraclelinux} >= 7
%global with_selinux 1
%endif
# start if with_selinux
%if 0%{?with_selinux}
# Version of SELinux we were using
%if 0%{?fedora} == 20
%global selinux_policyver 3.12.1-197
%endif # fedora 20
%if 0%{?fedora} == 21
%global selinux_policyver 3.13.1-105
%endif # fedora 21
%if 0%{?fedora} >= 22
%global selinux_policyver 3.13.1-119
%else
%global selinux_policyver 3.13.1-39
%endif
%global selinux_policyver 3.13.1-128
%endif # fedora 22
%if 0%{?centos} >= 7 || 0%{?rhel} >= 7 || 0%{?oraclelinux} >= 7
%global selinux_policyver 3.13.1-23
%endif # centos,oraclelinux 7
%endif # with_selinux
# RE: rhbz#1195804 - ensure min NVR for selinux-policy
hack/make/build-rpm
+10 -1
View File
@@ -63,11 +63,20 @@ set -e
RUN mkdir -p /root/rpmbuild/SOURCES
WORKDIR /root/rpmbuild
RUN ln -sfv /usr/src/${rpmName}/hack/make/.build-rpm SPECS
RUN tar -cz -C /usr/src -f /root/rpmbuild/SOURCES/${rpmName}.tar.gz ${rpmName}
WORKDIR /root/rpmbuild/SPECS
RUN tar -cz -C /usr/src -f /root/rpmbuild/SOURCES/${rpmName}.tar.gz ${rpmName}
RUN { echo '* $rpmDate $rpmPackager $rpmVersion-$rpmRelease'; echo '* Version: $VERSION'; } >> ${rpmName}.spec && tail >&2 ${rpmName}.spec
RUN rpmbuild -ba --define '_release $rpmRelease' --define '_version $rpmVersion' --define '_origversion $VERSION' ${rpmName}.spec
EOF
# selinux policy referencing systemd things won't work on non-systemd versions
# of centos or rhel, which we don't support anyways
if [ "$suite" -gt 6 ]; then
cat >> "$DEST/$version/Dockerfile.build" <<-EOF
RUN tar -cz -C /usr/src/${rpmName}/contrib -f /root/rpmbuild/SOURCES/${rpmName}-selinux.tar.gz ${rpmName}-selinux
RUN { echo '* $rpmDate $rpmPackager $rpmVersion-$rpmRelease'; echo '* Version: $VERSION'; } >> ${rpmName}-selinux.spec && tail >&2 ${rpmName}-selinux.spec
RUN rpmbuild -ba --define '_release $rpmRelease' --define '_version $rpmVersion' --define '_origversion $VERSION' ${rpmName}-selinux.spec
EOF
fi
tempImage="docker-temp/build-rpm:$version"
( set -x && docker build -t "$tempImage" -f $DEST/$version/Dockerfile.build . )
docker run --rm "$tempImage" bash -c 'cd /root/rpmbuild && tar -c *RPMS' | tar -xvC "$DEST/$version"