diff --git a/SPECS/azurelinux-sysinfo/azurelinux-sysinfo.signatures.json b/SPECS/azurelinux-sysinfo/azurelinux-sysinfo.signatures.json index 81544f4aad9..0ca8108b646 100644 --- a/SPECS/azurelinux-sysinfo/azurelinux-sysinfo.signatures.json +++ b/SPECS/azurelinux-sysinfo/azurelinux-sysinfo.signatures.json @@ -2,7 +2,8 @@ "Signatures": { "collect-sysinfo": "b47df8a856c49e4bc02b36d1c3dd2825b75b9d8449b5dae8af401fc6818131c9", "sysinfo-schema-v1.json": "67b541239416bd5f9a77a0799881f21c2e5eea686dc7a3ccaffe6bd7219a4798", - "azurelinux-sysinfo.service": "c719ab2238d0412b7ac6a793cd83e5be7879023161f86fb29d1c0ca18e70631c" + "azurelinux-sysinfo.service": "c719ab2238d0412b7ac6a793cd83e5be7879023161f86fb29d1c0ca18e70631c", + "sysinfo-selinuxpolicies.cil": "1f0df94a09f4db09093743339b6162735b6f1c81108cd3b857a6dbc729630400" } } \ No newline at end of file diff --git a/SPECS/azurelinux-sysinfo/azurelinux-sysinfo.spec b/SPECS/azurelinux-sysinfo/azurelinux-sysinfo.spec index e18a51bbcb9..f9fc7f4d867 100644 --- a/SPECS/azurelinux-sysinfo/azurelinux-sysinfo.spec +++ b/SPECS/azurelinux-sysinfo/azurelinux-sysinfo.spec @@ -10,6 +10,7 @@ URL: https://aka.ms/azurelinux Source0: collect-sysinfo Source1: sysinfo-schema-v1.json Source2: azurelinux-sysinfo.service +Source3: sysinfo-selinuxpolicies.cil Requires: systemd Requires: python3-psutil @@ -32,15 +33,33 @@ install -m 755 %{SOURCE1} %{buildroot}%{_datadir}/azurelinux-sysinfo/ mkdir -p %{buildroot}%{_sysconfdir}/systemd/system/ install -m 755 %{SOURCE2} %{buildroot}%{_sysconfdir}/systemd/system/ +# Copy the sysinfo-selinuxpolicies file to /usr/share/selinux/packages/ +mkdir -p %{buildroot}%{_datadir}/selinux/packages/ +install -m 755 %{SOURCE3} %{buildroot}%{_datadir}/selinux/packages/ + %files %{_bindir}/collect-sysinfo +%dir %{_datadir}/azurelinux-sysinfo/ %{_datadir}/azurelinux-sysinfo/sysinfo-schema-v1.json %{_sysconfdir}/systemd/system/azurelinux-sysinfo.service +%{_datadir}/selinux/packages/sysinfo-selinuxpolicies.cil %post #!/bin/sh +# Enable the systemd service systemctl enable azurelinux-sysinfo.service +# Apply required SElinux policies only if selinux-policy is present +if rpm -q selinux-policy &> /dev/null; then + semodule -i %{_datadir}/selinux/packages/sysinfo-selinuxpolicies.cil +fi + +%postun +# If selinux-policy is present, remove the sysinfo-selinuxpolicies module +if rpm -q selinux-policy &> /dev/null; then + semodule -r sysinfo-selinuxpolicies +fi + %changelog * Thu Apr 04 2024 Amrita Kohli - 3.0-1 - License verified. diff --git a/SPECS/azurelinux-sysinfo/sysinfo-selinuxpolicies.cil b/SPECS/azurelinux-sysinfo/sysinfo-selinuxpolicies.cil new file mode 100644 index 00000000000..d66205f386a --- /dev/null +++ b/SPECS/azurelinux-sysinfo/sysinfo-selinuxpolicies.cil @@ -0,0 +1,14 @@ +(allow systemd_analyze_t sysctl_kernel_t (dir (search))) +(allow systemd_analyze_t locale_t (dir (search))) +(allow systemd_analyze_t init_runtime_t (dir (search))) +(allow systemd_analyze_t sysctl_kernel_t (file (read))) +(allow systemd_analyze_t locale_t (file (read))) +(allow systemd_analyze_t systemd_analyze_t (capability (net_admin))) +(allow systemd_analyze_t init_t (unix_stream_socket (connectto))) +(allow systemd_analyze_t system_dbusd_runtime_t (dir (search))) +(allow systemd_analyze_t security_t (filesystem (getattr))) +(allow systemd_analyze_t selinux_config_t (dir (search))) +(allow systemd_analyze_t init_t (system (status))) +(allow systemd_analyze_t init_t (service (status))) +(allow systemd_analyze_t systemdunit (service (status))) +(allow systemd_analyze_t etc_t (service (status)))