azurelinux-sysinfo: policies to work with SELinux enforcing mode

SPECS/azurelinux-sysinfo/azurelinux-sysinfo.signatures.json

@@ -2,7 +2,8 @@
     "Signatures": {
      "collect-sysinfo": "b47df8a856c49e4bc02b36d1c3dd2825b75b9d8449b5dae8af401fc6818131c9",
      "sysinfo-schema-v1.json": "67b541239416bd5f9a77a0799881f21c2e5eea686dc7a3ccaffe6bd7219a4798",
-     "azurelinux-sysinfo.service": "c719ab2238d0412b7ac6a793cd83e5be7879023161f86fb29d1c0ca18e70631c"
+     "azurelinux-sysinfo.service": "c719ab2238d0412b7ac6a793cd83e5be7879023161f86fb29d1c0ca18e70631c",
+     "sysinfo-selinuxpolicies.cil": "1f0df94a09f4db09093743339b6162735b6f1c81108cd3b857a6dbc729630400"
     }
 }
 

SPECS/azurelinux-sysinfo/azurelinux-sysinfo.spec

@@ -10,6 +10,7 @@ URL:            https://aka.ms/azurelinux
 Source0:        collect-sysinfo
 Source1:        sysinfo-schema-v1.json
 Source2:        azurelinux-sysinfo.service
+Source3:        sysinfo-selinuxpolicies.cil
 Requires:       systemd
 Requires:       python3-psutil
 
@@ -32,15 +33,33 @@ install -m 755 %{SOURCE1} %{buildroot}%{_datadir}/azurelinux-sysinfo/
 mkdir -p %{buildroot}%{_sysconfdir}/systemd/system/
 install -m 755 %{SOURCE2} %{buildroot}%{_sysconfdir}/systemd/system/
 
+# Copy the sysinfo-selinuxpolicies file to /usr/share/selinux/packages/
+mkdir -p %{buildroot}%{_datadir}/selinux/packages/
+install -m 755 %{SOURCE3} %{buildroot}%{_datadir}/selinux/packages/
+
 %files
 %{_bindir}/collect-sysinfo
+%dir %{_datadir}/azurelinux-sysinfo/
 %{_datadir}/azurelinux-sysinfo/sysinfo-schema-v1.json
 %{_sysconfdir}/systemd/system/azurelinux-sysinfo.service
+%{_datadir}/selinux/packages/sysinfo-selinuxpolicies.cil
 
 %post
 #!/bin/sh
+# Enable the systemd service
 systemctl enable azurelinux-sysinfo.service
 
+# Apply required SElinux policies only if selinux-policy is present
+if rpm -q selinux-policy &> /dev/null; then    
+    semodule -i %{_datadir}/selinux/packages/sysinfo-selinuxpolicies.cil
+fi
+
+%postun
+# If selinux-policy is present, remove the sysinfo-selinuxpolicies module
+if rpm -q selinux-policy &> /dev/null; then
+    semodule -r sysinfo-selinuxpolicies
+fi
+
 %changelog
 * Thu Apr 04 2024 Amrita Kohli <amritakohli@microsoft.com> - 3.0-1
 - License verified.

SPECS/azurelinux-sysinfo/sysinfo-selinuxpolicies.cil

@@ -0,0 +1,14 @@
+(allow systemd_analyze_t sysctl_kernel_t (dir (search)))
+(allow systemd_analyze_t locale_t (dir (search)))
+(allow systemd_analyze_t init_runtime_t (dir (search)))
+(allow systemd_analyze_t sysctl_kernel_t (file (read)))
+(allow systemd_analyze_t locale_t (file (read)))
+(allow systemd_analyze_t systemd_analyze_t (capability (net_admin)))
+(allow systemd_analyze_t init_t (unix_stream_socket (connectto)))
+(allow systemd_analyze_t system_dbusd_runtime_t (dir (search)))
+(allow systemd_analyze_t security_t (filesystem (getattr)))
+(allow systemd_analyze_t selinux_config_t (dir (search)))
+(allow systemd_analyze_t init_t (system (status)))
+(allow systemd_analyze_t init_t (service (status)))
+(allow systemd_analyze_t systemdunit (service (status)))
+(allow systemd_analyze_t etc_t (service (status)))