Linux – the proper way to set SELinux context in an RPM .spec? (RHEL7 in 2018)

packagingrpmselinux

The RHEL7 supplied tomcat package supports multiple instances through the creation of directories and symlinks. Once such a multiple instance is created and packaged as an RPM, the extra instances fail to start due to selinux failures.

The solution is configure selinux correctly in the RPM packaging, however I am struggling to find a canonical description of how to do this.

Where does the selinux configuration come from when tomcat is installed in RHEL7?

Edit: the question at What is the proper way to set SELinux context in an RPM .spec?, had anyone bothered to actually read it, referred to the obsolete RHEL4 and RHEL5 distributions, and is 7 years old. As clearly stated in this question, this refers to RHEL7 in 2018. The answer to the 7 year old question, and the answer to this one are very different from one another.

Best Answer

SELinux configuration is provided by selinux-policy-targeted package, which contains the default policy configuration for the distribution, including SELinux configuration for tomcat.

I could find two old Fedora packaging drafts describing SELinux configuration in RPM packaging.

PackagingDrafts/SELinux suggests including the file labeling configuration in %post and %postun sections of the spec file by executing semanage fcontext -a and semanage fcontext -d respectively and running restorecon/fixfiles afterwards.

It is useful to note, as pointed out by Graham Legett, that using semanage in %pre or %post sections of spec will add the complete python stack along with policycoreutils-python as install time dependency. Using restorecon will add policycoreutils, which in turn brings in sed, gawk and grep, as install time dependencies.

A better way to provide the required file labeling rules would be by a SELinux policy module. Policy modules provide clearer interface to manage modular policy (labeling rules are not mixed with local modifications done with semanage).

For your policy module with file labeling rules, you need to provide type enforcement file and file context labeling file. Type enforcement file is required even if you do not add any modifications to the policy. An example dummy type enforcement file mymodule.te:

policy_module(mymodule, 1.0)

The file labeling rules are in mymodule.fc and follow same :

/path/to/file   --  gen_context(system_u:object_r:type_t,s0)

With selinux-policy-devel, the module package can be compiled with[note 1]:

make -f /usr/share/selinux/devel/Makefile

Regarding packaging policy modules, SELinux Policy Modules Packaging Draft similarly recommends using the %post and %postun sections of the spec file to install the policy using semodule and restorecon/fixfiles. An example spec file is also provided.

[note 1] The example policy module could be generated without selinux-policy-devel by using checkmodule and semodule_package directly. It would require the policy files to be written without macros.

Related Question