From 4d33d0310ee10fa10cca01e18f5d7f9967d4bc2c Mon Sep 17 00:00:00 2001
From: Petr Lautrbach <plautrba@redhat.com>
Date: Wed, 17 Aug 2016 10:41:53 +0200
Subject: [PATCH 1/2] Provide rpm macros for packages installing SELinux
 modules

There's no unified practice how to install SELinux modules from packages
and how to relabel a filesystem after the change. This update provides
several new macros which should help maintainers with the process.

%selinux_relabel_pre [-s <policytype>]
- backups the current file_contexts for later use with fixfiles

%selinux_relabel_post [-s <policytype>]
- relabels a filesystem based on changes in file_contexts using fixfiles

%selinux_modules_install [-s <policytype>] module [module]...
%selinux_modules_uninstall [-s <policytype>] module [module]...
- install and uninstall modules to the priority 200
---
 rpm.macros          | 77 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 selinux-policy.spec |  3 ++-
 2 files changed, 79 insertions(+), 1 deletion(-)
 create mode 100644 rpm.macros

diff --git a/rpm.macros b/rpm.macros
new file mode 100644
index 0000000..ee4bf97
--- /dev/null
+++ b/rpm.macros
@@ -0,0 +1,77 @@
+# Copyright (C) 2016  Petr Lautrbach
+# 
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+# 
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# RPM macros for packages installing SELinux modules
+
+%_selinux_policy_version SELINUXPOLICYVERSION
+
+%_file_context_file %{_sysconfdir}/selinux/${SELINUXTYPE}/contexts/files/file_contexts
+%_file_context_file_pre %{_localstatedir}/lib/rpm-state/file_contexts.pre
+
+# %selinux_modules_install [-s <policytype>] module [module]...
+%selinux_modules_install("s:") \
+. /etc/selinux/config \
+_policytype=%{-s*} \
+if [ -z "${_policytype}" ]; then \
+  _policytype="targeted" \
+fi \
+%{_sbindir}/semodule -n -s ${_policytype} -X 200 -i %* \
+if %{_sbindir}/selinuxenabled && [ "${SELINUXTYPE}" = "${_policytype}" ]; then \
+  %{_sbindir}/load_policy \
+fi \
+%{nil}
+
+# %selinux_modules_uninstall [-s <policytype>] module [module]...
+%selinux_modules_uninstall("s:") \
+. /etc/selinux/config \
+_policytype=%{-s*} \
+if [ -z "${_policytype}" ]; then \
+  _policytype="targeted" \
+fi \
+if [ $1 -eq 0 ]; then \
+  %{_sbindir}/semodule -n -X 200 -r %* &> /dev/null || : \
+  if %{_sbindir}/selinuxenabled && [ "${SELINUXTYPE}" = "${_policytype}" ]; then \
+    %{_sbindir}/load_policy \
+  fi \
+fi \
+%{nil}
+
+# %selinux_relabel_pre [-s <policytype>]
+%selinux_relabel_pre("s:") \
+. /etc/selinux/config \
+_policytype=%{-s*} \
+if [ -z "${_policytype}" ]; then \
+  _policytype="targeted" \
+fi \
+if %{_sbindir}/selinuxenabled && [ "${SELINUXTYPE}" = "${_policytype}" ]; then \
+  [ -f %{_file_context_file_pre} ] || cp -f %{_file_context_file} %{_file_context_file_pre} \
+fi \
+%{nil}
+
+
+# %selinux_relabel_post [-s <policytype>]
+%selinux_relabel_post("s:") \
+. /etc/selinux/config \
+_policytype=%{-s*} \
+if [ -z "${_policytype}" ]; then \
+  _policytype="targeted" \
+fi \
+if /usr/sbin/selinuxenabled && [ "${SELINUXTYPE}" = "${_policytype}" ]; then \
+   if [ -f %{_file_context_file_pre} ]; then \
+     %{_sbindir}/fixfiles -C %{_file_context_file_pre} restore \
+     rm -f %{_file_context_file_pre} \
+   fi \
+fi \
+%{nil}
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 95fbdfc..2d7cce1 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -408,7 +408,8 @@ mv %{buildroot}%{_usr}/share/man/man8/*.html %{buildroot}%{_usr}/share/selinux/d
 mv %{buildroot}%{_usr}/share/man/man8/style.css %{buildroot}%{_usr}/share/selinux/devel/html
 
 mkdir -p %{buildroot}%{_rpmconfigdir}/macros.d
-echo '%%_selinux_policy_version %{version}-%{release}' > %{buildroot}%{_rpmconfigdir}/macros.d/macros.selinux-policy
+install -m 644 %{_sourcedir}/rpm.macros %{buildroot}%{_rpmconfigdir}/macros.d/macros.selinux-policy
+sed -i 's/SELINUXPOLICYVERSION/%{version}-%{release}/' %{buildroot}%{_rpmconfigdir}/macros.d/macros.selinux-policy
 
 
 rm -rf selinux_config
-- 
2.9.3

