Gentoo Development Guide

SELINUX-POLICY-2.ECLASS

Section: portage (5)
Updated: May 2013
Index Return to Main Contents

NAME

selinux-policy-2.eclass - This eclass supports the deployment of the various SELinux modules in sec-policy

DESCRIPTION

The selinux-policy-2.eclass supports deployment of the various SELinux modules defined in the sec-policy category. It is responsible for extracting the specific bits necessary for single-module deployment (instead of full-blown policy rebuilds) and applying the necessary patches.

Also, it supports for bundling patches to make the whole thing just a bit more manageable.

FUNCTIONS

selinux-policy-2_src_unpack

Unpack the policy sources as offered by upstream (refpolicy). In case of EAPI older than 2, call src_prepare too.

selinux-policy-2_src_prepare

Patch the reference policy sources with our set of enhancements. Start with the base patchbundle referred to by the ebuilds through the BASEPOL variable, then apply the additional patches as offered by the ebuild.

Next, extract only those files needed for this particular module (i.e. the .te and .fc files for the given module in the MODS variable).

Finally, prepare the build environments for each of the supported SELinux types (such as targeted or strict), depending on the POLICY_TYPES variable content.

selinux-policy-2_src_compile

Build the SELinux policy module (.pp file) for just the selected module, and this for each SELinux policy mentioned in POLICY_TYPES

selinux-policy-2_src_install

Install the built .pp files in the correct subdirectory within /usr/share/selinux.

selinux-policy-2_pkg_postinst

Install the built .pp files in the SELinux policy stores, effectively activating the policy on the system.

selinux-policy-2_pkg_postrm

Uninstall the module(s) from the SELinux policy stores, effectively deactivating the policy on the system.

ECLASS VARIABLES

MODS ?= "_illegal": This variable contains the (upstream) module name for the SELinux module. This name is only the module name, not the category!
BASEPOL ?= "": This variable contains the version string of the selinux-base-policy package that this module build depends on. It is used to patch with the appropriate patch bundle(s) that are part of selinux-base-policy.
POLICY_PATCH ?= "": This variable contains the additional patch(es) that need to be applied on top of the patchset already contained within the BASEPOL variable. The variable can be both a simple string (space-separated) or a bash array.
POLICY_FILES ?= "": When defined, this contains the files (located in the ebuilds' files/ directory) which should be copied as policy module files into the store. Generally, users would want to include at least a .te and .fc file, but .if files are supported as well. The variable can be both a simple string (space-separated) or a bash array.
POLICY_TYPES ?= "targeted strict mcs mls": This variable informs the eclass for which SELinux policies the module should be built. Currently, Gentoo supports targeted, strict, mcs and mls. This variable is the same POLICY_TYPES variable that we tell SELinux users to set in make.conf. Therefore, it is not the module that should override it, but the user.

MAINTAINERS

selinux@gentoo.org

REPORTING BUGS

Please report bugs via http://bugs.gentoo.org/

FILES

/usr/portage/eclass/selinux-policy-2.eclass

This document was created by man2html, using the manual pages.
Time: 03:25:01 GMT, May 24, 2013