gnu/packages/selinux.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2016, 2017, 2018 Ricardo Wurmus <rekado@elephly.net>
   3 ;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
   4 ;;; Copyright © 2019, 2020 Marius Bakke <mbakke@fastmail.com>
   5 ;;; Copyright © 2021 Efraim Flashner <efraim@flashner.co.il>
   6 ;;;
   7 ;;; This file is part of GNU Guix.
   8 ;;;
   9 ;;; GNU Guix is free software; you can redistribute it and/or modify it
  10 ;;; under the terms of the GNU General Public License as published by
  11 ;;; the Free Software Foundation; either version 3 of the License, or (at
  12 ;;; your option) any later version.
  13 ;;;
  14 ;;; GNU Guix is distributed in the hope that it will be useful, but
  15 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  16 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17 ;;; GNU General Public License for more details.
  18 ;;;
  19 ;;; You should have received a copy of the GNU General Public License
  20 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  21
  22 (define-module (gnu packages selinux)
  23   #:use-module ((guix licenses) #:prefix license:)
  24   #:use-module (guix packages)
  25   #:use-module (guix download)
  26   #:use-module (guix git-download)
  27   #:use-module (guix utils)
  28   #:use-module (guix build-system gnu)
  29   #:use-module (guix build-system python)
  30   #:use-module (gnu packages)
  31   #:use-module (gnu packages admin)
  32   #:use-module (gnu packages bison)
  33   #:use-module (gnu packages docbook)
  34   #:use-module (gnu packages flex)
  35   #:use-module (gnu packages gettext)
  36   #:use-module (gnu packages glib)
  37   #:use-module (gnu packages linux)
  38   #:use-module (gnu packages networking)
  39   #:use-module (gnu packages pcre)
  40   #:use-module (gnu packages pkg-config)
  41   #:use-module (gnu packages python)
  42   #:use-module (gnu packages python-xyz)
  43   #:use-module (gnu packages swig)
  44   #:use-module (gnu packages xml))
  45
  46 ;; Update the SELinux packages together!
  47
  48 (define-public libsepol
  49   (package
  50     (name "libsepol")
  51     (version "3.2")
  52     (source (origin
  53               (method git-fetch)
  54               (uri (git-reference
  55                      (url "https://github.com/SELinuxProject/selinux")
  56                      (commit version)))
  57               (file-name (git-file-name "selinux" version))
  58               (sha256
  59                (base32
  60                 "03p3lmvrvkcvsmiczsjzhyfgxlxdkdyq0p8igv3s3hdak5n92jjn"))))
  61     (build-system gnu-build-system)
  62     (arguments
  63      `(#:tests? #f ; tests require checkpolicy, which requires libsepol
  64        #:test-target "test"
  65        #:make-flags
  66        (let ((out (assoc-ref %outputs "out")))
  67          (list (string-append "PREFIX=" out)
  68                (string-append "SHLIBDIR=" out "/lib")
  69                (string-append "MAN3DIR=" out "/share/man/man3")
  70                (string-append "MAN5DIR=" out "/share/man/man5")
  71                (string-append "MAN8DIR=" out "/share/man/man8")
  72                (string-append "LDFLAGS=-Wl,-rpath=" out "/lib")
  73                (string-append "CC=" ,(cc-for-target))))
  74        #:phases
  75        (modify-phases %standard-phases
  76          (delete 'configure)
  77          (add-after 'unpack 'enter-dir
  78            (lambda _ (chdir ,name)))
  79          (add-after 'enter-dir 'portability
  80            (lambda _
  81              (substitute* "src/ibpkeys.c"
  82                (("#include \"ibpkey_internal.h\"" line)
  83                 (string-append line "\n#include <inttypes.h>\n"))
  84                (("%#lx") "%#\" PRIx64 \"")))))))
  85     (native-inputs
  86      `(("flex" ,flex)))
  87     (home-page "https://selinuxproject.org/")
  88     (synopsis "Library for manipulating SELinux policies")
  89     (description
  90      "The libsepol library provides an API for the manipulation of SELinux
  91 binary policies.  It is used by @code{checkpolicy} (the policy compiler) and
  92 similar tools, and programs such as @code{load_policy}, which must perform
  93 specific transformations on binary policies (for example, customizing policy
  94 boolean settings).")
  95     (license license:lgpl2.1+)))
  96
  97 (define-public checkpolicy
  98   (package/inherit libsepol
  99     (name "checkpolicy")
 100     (arguments
 101      `(#:tests? #f ; there is no check target
 102        #:make-flags
 103        (let ((out (assoc-ref %outputs "out")))
 104          (list (string-append "PREFIX=" out)
 105                (string-append "LIBSEPOLA="
 106                               (assoc-ref %build-inputs "libsepol")
 107                               "/lib/libsepol.a")
 108                (string-append "CC=" ,(cc-for-target))))
 109        #:phases
 110        (modify-phases %standard-phases
 111          (delete 'configure)
 112          (delete 'portability)
 113          (add-after 'unpack 'enter-dir
 114            (lambda _ (chdir ,name))))))
 115     (inputs
 116      `(("libsepol" ,libsepol)))
 117     (native-inputs
 118      `(("bison" ,bison)
 119        ("flex" ,flex)))
 120     (synopsis "Check SELinux security policy configurations and modules")
 121     (description
 122      "This package provides the tools \"checkpolicy\" and \"checkmodule\".
 123 Checkpolicy is a program that checks and compiles a SELinux security policy
 124 configuration into a binary representation that can be loaded into the kernel.
 125 Checkmodule is a program that checks and compiles a SELinux security policy
 126 module into a binary representation.")
 127     ;; GPLv2 only
 128     (license license:gpl2)))
 129
 130 (define-public libselinux
 131   (package/inherit libsepol
 132     (name "libselinux")
 133     (outputs '("out" "python"))
 134     (arguments
 135      (substitute-keyword-arguments (package-arguments libsepol)
 136        ((#:make-flags flags)
 137         `(cons* "PYTHON=python3"
 138                 (string-append "LIBSEPOLA="
 139                               (assoc-ref %build-inputs "libsepol")
 140                               "/lib/libsepol.a")
 141                 (string-append "PYTHONLIBDIR="
 142                                (assoc-ref %outputs "python")
 143                                "/lib/python"
 144                                ,(version-major+minor (package-version python))
 145                                "/site-packages/")
 146                 ,flags))
 147        ((#:phases phases)
 148         `(modify-phases ,phases
 149            (delete 'portability)
 150            (replace 'enter-dir
 151              (lambda _ (chdir ,name)))
 152            (add-after 'build 'pywrap
 153              (lambda* (#:key make-flags #:allow-other-keys)
 154                (apply invoke "make" "pywrap" make-flags)))
 155            (add-after 'install 'install-pywrap
 156              (lambda* (#:key make-flags outputs #:allow-other-keys)
 157                ;; The build system uses "python setup.py install" to install
 158                ;; Python bindings.  Instruct it to use the correct output.
 159                (substitute* "src/Makefile"
 160                  (("--prefix=\\$\\(PREFIX\\)")
 161                   (string-append "--prefix=" (assoc-ref outputs "python"))))
 162
 163                (apply invoke "make" "install-pywrap" make-flags)))))))
 164     ;; These libraries are in "Requires.private" in libselinux.pc.
 165     (propagated-inputs
 166      `(("libsepol" ,libsepol)
 167        ("pcre" ,pcre)))
 168     ;; For pywrap phase
 169     (inputs
 170      `(("python" ,python-wrapper)))
 171     ;; These inputs are only needed for the pywrap phase.
 172     (native-inputs
 173      `(("swig" ,swig)
 174        ("pkg-config" ,pkg-config)))
 175     (synopsis "SELinux core libraries and utilities")
 176     (description
 177      "The libselinux library provides an API for SELinux applications to get
 178 and set process and file security contexts, and to obtain security policy
 179 decisions.  It is required for any applications that use the SELinux API, and
 180 used by all applications that are SELinux-aware.  This package also includes
 181 the core SELinux management utilities.")
 182     (license license:public-domain)))
 183
 184 (define-public libsemanage
 185   (package/inherit libsepol
 186     (name "libsemanage")
 187     (arguments
 188      (substitute-keyword-arguments (package-arguments libsepol)
 189        ((#:make-flags flags)
 190         `(cons* "PYTHON=python3"
 191                 (string-append "PYTHONLIBDIR="
 192                                (assoc-ref %outputs "out")
 193                                "/lib/python"
 194                                ,(version-major+minor (package-version python))
 195                                "/site-packages/")
 196                 ,flags))
 197        ((#:phases phases)
 198         `(modify-phases ,phases
 199            (delete 'portability)
 200            (replace 'enter-dir
 201              (lambda _ (chdir ,name)))
 202            (add-before 'install 'adjust-semanage-conf-location
 203              (lambda _
 204                (substitute* "src/Makefile"
 205                  (("DEFAULT_SEMANAGE_CONF_LOCATION=/etc")
 206                   "DEFAULT_SEMANAGE_CONF_LOCATION=$(PREFIX)/etc"))))
 207            (add-after 'build 'pywrap
 208              (lambda* (#:key make-flags #:allow-other-keys)
 209                (apply invoke "make" "pywrap" make-flags)))
 210            (add-after 'install 'install-pywrap
 211              (lambda* (#:key make-flags #:allow-other-keys)
 212                (apply invoke "make" "install-pywrap" make-flags)))))))
 213     (inputs
 214      `(("libsepol" ,libsepol)
 215        ("libselinux" ,libselinux)
 216        ("audit" ,audit)
 217        ;; For pywrap phase
 218        ("python" ,python-wrapper)))
 219     (native-inputs
 220      `(("bison" ,bison)
 221        ("flex" ,flex)
 222        ;; For pywrap phase
 223        ("swig" ,swig)
 224        ("pkg-config" ,pkg-config)))
 225     (synopsis "SELinux policy management libraries")
 226     (description
 227      "The libsemanage library provides an API for the manipulation of SELinux
 228 binary policies.")
 229     (license license:lgpl2.1+)))
 230
 231 (define-public secilc
 232   (package/inherit libsepol
 233     (name "secilc")
 234     (arguments
 235      (substitute-keyword-arguments (package-arguments libsepol)
 236        ((#:make-flags flags)
 237         `(let ((docbook (assoc-ref %build-inputs "docbook-xsl")))
 238            (cons (string-append "XMLTO=xmlto --skip-validation -x "
 239                                 docbook "/xml/xsl/docbook-xsl-"
 240                                 ,(package-version docbook-xsl)
 241                                 "/manpages/docbook.xsl")
 242                  ,flags)))
 243        ((#:phases phases)
 244         `(modify-phases ,phases
 245            (delete 'portability)
 246            (replace 'enter-dir
 247              (lambda _ (chdir ,name)))))))
 248     (inputs
 249      `(("libsepol" ,libsepol)))
 250     (native-inputs
 251      `(("xmlto" ,xmlto)
 252        ("docbook-xsl" ,docbook-xsl)))
 253     (synopsis "SELinux common intermediate language (CIL) compiler")
 254     (description "The SELinux CIL compiler is a compiler that converts the
 255 @dfn{common intermediate language} (CIL) into a kernel binary policy file.")
 256     (license license:bsd-2)))
 257
 258 (define-public python-sepolgen
 259   (package/inherit libsepol
 260     (name "python-sepolgen")
 261     (arguments
 262      `(#:modules ((srfi srfi-1)
 263                   (guix build gnu-build-system)
 264                   (guix build utils))
 265        ,@(substitute-keyword-arguments (package-arguments libsepol)
 266            ((#:phases phases)
 267             `(modify-phases ,phases
 268                (delete 'portability)
 269                (replace 'enter-dir
 270                  (lambda _ (chdir "python/sepolgen")))
 271                ;; By default all Python files would be installed to
 272                ;; $out/gnu/store/...-python-.../, so we override the
 273                ;; PACKAGEDIR to fix this.
 274                (add-after 'enter-dir 'fix-target-path
 275                  (lambda* (#:key inputs outputs #:allow-other-keys)
 276                    (let ((get-python-version
 277                           ;; FIXME: copied from python-build-system
 278                           (lambda (python)
 279                             (let* ((version     (last (string-split python #\-)))
 280                                    (components  (string-split version #\.))
 281                                    (major+minor (take components 2)))
 282                               (string-join major+minor ".")))))
 283                      (substitute* "src/sepolgen/Makefile"
 284                        (("^PACKAGEDIR.*")
 285                         (string-append "PACKAGEDIR="
 286                                        (assoc-ref outputs "out")
 287                                        "/lib/python"
 288                                        (get-python-version
 289                                         (assoc-ref inputs "python"))
 290                                        "/site-packages/sepolgen")))
 291                      (substitute* "src/share/Makefile"
 292                        (("\\$\\(DESTDIR\\)") (assoc-ref outputs "out")))))))))))
 293     (inputs
 294      `(("python" ,python-wrapper)))
 295     (native-inputs '())
 296     (synopsis "Python module for generating SELinux policies")
 297     (description
 298      "This package contains a Python module that forms the core of
 299 @code{audit2allow}, a part of the package @code{policycoreutils}.  The
 300 sepolgen library contains: Reference Policy Representation, which are Objects
 301 for representing policies and the reference policy interfaces.  It has objects
 302 and algorithms for representing access and sets of access in an abstract way
 303 and searching that access.  It also has a parser for reference policy
 304 \"headers\".  It contains infrastructure for parsing SELinux related messages
 305 as produced by the audit system.  It has facilities for generating policy
 306 based on required access.")
 307     ;; GPLv2 only
 308     (license license:gpl2)))
 309
 310 (define-public python-setools
 311   (package
 312     (name "python-setools")
 313     (version "4.1.1")
 314     (source (origin
 315               (method git-fetch)
 316               (uri (git-reference
 317                     (url "https://github.com/TresysTechnology/setools")
 318                     (commit version)))
 319               (file-name (string-append name "-" version "-checkout"))
 320               (sha256
 321                (base32
 322                 "0459xxly6zzqc5azcwk3rbbcxvj60dq08f8z6xr05y7dsbb16cg6"))))
 323     (build-system python-build-system)
 324     (arguments
 325      `(#:tests? #f ; the test target causes a rebuild
 326        #:phases
 327        (modify-phases %standard-phases
 328          (delete 'portability)
 329          (add-after 'unpack 'set-SEPOL-variable
 330            (lambda* (#:key inputs #:allow-other-keys)
 331              (setenv "SEPOL"
 332                      (search-input-file inputs "/lib/libsepol.a"))))
 333          (add-after 'unpack 'remove-Werror
 334            (lambda _
 335              (substitute* "setup.py"
 336                (("'-Werror',") ""))
 337              #t))
 338          (add-after 'unpack 'fix-target-paths
 339            (lambda* (#:key outputs #:allow-other-keys)
 340              (substitute* "setup.py"
 341                (("join\\(sys.prefix")
 342                 (string-append "join(\"" (assoc-ref outputs "out") "/\"")))
 343              #t)))))
 344     (propagated-inputs
 345      `(("python-networkx" ,python-networkx)))
 346     (inputs
 347      `(("libsepol" ,libsepol)
 348        ("libselinux" ,libselinux)))
 349     (native-inputs
 350      `(("bison" ,bison)
 351        ("flex" ,flex)
 352        ("swig" ,swig)))
 353     (home-page "https://github.com/TresysTechnology/setools")
 354     (synopsis "Tools for SELinux policy analysis")
 355     (description "SETools is a collection of graphical tools, command-line
 356 tools, and libraries designed to facilitate SELinux policy analysis.")
 357     ;; Some programs are under GPL, all libraries under LGPL.
 358     (license (list license:lgpl2.1+
 359                    license:gpl2+))))
 360
 361 (define-public policycoreutils
 362   (package/inherit libsepol
 363     (name "policycoreutils")
 364     (arguments
 365      `(#:test-target "test"
 366        #:make-flags
 367        (let ((out (assoc-ref %outputs "out")))
 368          (list (string-append "CC=" ,(cc-for-target))
 369                (string-append "PREFIX=" out)
 370                (string-append "LOCALEDIR=" out "/share/locale")
 371                (string-append "BASHCOMPLETIONDIR=" out
 372                               "/share/bash-completion/completions")
 373                "INSTALL=install -c -p"
 374                "INSTALL_DIR=install -d"
 375                ;; These ones are needed because some Makefiles define the
 376                ;; directories relative to DESTDIR, not relative to PREFIX.
 377                (string-append "SBINDIR=" out "/sbin")
 378                (string-append "ETCDIR=" out "/etc")
 379                (string-append "SYSCONFDIR=" out "/etc/sysconfig")
 380                (string-append "MAN5DIR=" out "/share/man/man5")
 381                (string-append "INSTALL_NLS_DIR=" out "/share/locale")
 382                (string-append "AUTOSTARTDIR=" out "/etc/xdg/autostart")
 383                (string-append "DBUSSERVICEDIR=" out "/share/dbus-1/services")
 384                (string-append "SYSTEMDDIR=" out "/lib/systemd")
 385                (string-append "INITDIR=" out "/etc/rc.d/init.d")
 386                (string-append "SELINUXDIR=" out "/etc/selinux")))
 387        #:phases
 388        (modify-phases %standard-phases
 389          (delete 'configure)
 390          (add-after 'unpack 'enter-dir
 391            (lambda _ (chdir ,name)))
 392          (add-after 'enter-dir 'ignore-/usr-tests
 393            (lambda* (#:key inputs #:allow-other-keys)
 394              ;; Rewrite lookup paths for header files.
 395              (substitute* '("newrole/Makefile"
 396                             "setfiles/Makefile"
 397                             "run_init/Makefile")
 398                (("/usr(/include/security/pam_appl.h)" _ file)
 399                 (search-input-file inputs file))
 400                (("/usr(/include/libaudit.h)" _ file)
 401                 (search-input-file inputs file))))))))
 402     (inputs
 403      `(("audit" ,audit)
 404        ("pam" ,linux-pam)
 405        ("libsepol" ,libsepol)
 406        ("libselinux" ,libselinux)
 407        ("libsemanage" ,libsemanage)))
 408     (native-inputs
 409      `(("gettext" ,gettext-minimal)))
 410     (synopsis "SELinux core utilities")
 411     (description "The policycoreutils package contains the core utilities that
 412 are required for the basic operation of an SELinux-enabled GNU system and its
 413 policies.  These utilities include @code{load_policy} to load policies,
 414 @code{setfiles} to label file systems, @code{newrole} to switch roles, and
 415 @code{run_init} to run service scripts in their proper context.")
 416     (license license:gpl2+)))