gnu/packages/selinux.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2016, 2017, 2018 Ricardo Wurmus <rekado@elephly.net>
   3 ;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
   4 ;;;
   5 ;;; This file is part of GNU Guix.
   6 ;;;
   7 ;;; GNU Guix is free software; you can redistribute it and/or modify it
   8 ;;; under the terms of the GNU General Public License as published by
   9 ;;; the Free Software Foundation; either version 3 of the License, or (at
  10 ;;; your option) any later version.
  11 ;;;
  12 ;;; GNU Guix is distributed in the hope that it will be useful, but
  13 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  14 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 ;;; GNU General Public License for more details.
  16 ;;;
  17 ;;; You should have received a copy of the GNU General Public License
  18 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  19
  20 (define-module (gnu packages selinux)
  21   #:use-module ((guix licenses) #:prefix license:)
  22   #:use-module (guix packages)
  23   #:use-module (guix download)
  24   #:use-module (guix git-download)
  25   #:use-module (guix utils)
  26   #:use-module (guix build-system gnu)
  27   #:use-module (guix build-system python)
  28   #:use-module (gnu packages)
  29   #:use-module (gnu packages admin)
  30   #:use-module (gnu packages bison)
  31   #:use-module (gnu packages docbook)
  32   #:use-module (gnu packages flex)
  33   #:use-module (gnu packages gettext)
  34   #:use-module (gnu packages glib)
  35   #:use-module (gnu packages linux)
  36   #:use-module (gnu packages networking)
  37   #:use-module (gnu packages pcre)
  38   #:use-module (gnu packages pkg-config)
  39   #:use-module (gnu packages python)
  40   #:use-module (gnu packages python-xyz)
  41   #:use-module (gnu packages swig)
  42   #:use-module (gnu packages textutils)
  43   #:use-module (gnu packages xml))
  44
  45 ;; Update the SELinux packages together!
  46
  47 (define-public libsepol
  48   (package
  49     (name "libsepol")
  50     (version "2.7")
  51     (source (let ((release "20170804"))
  52               (origin
  53                 (method git-fetch)
  54                 (uri (git-reference
  55                       (url "https://github.com/SELinuxProject/selinux.git")
  56                       (commit release)))
  57                 (file-name (string-append "selinux-" release "-checkout"))
  58                 (sha256
  59                  (base32
  60                   "1l1nn8bx08v4cxkw5kb0wgr61rfqj5ra9dh1dy5jslillj93vivq")))))
  61     (build-system gnu-build-system)
  62     (arguments
  63      `(#:tests? #f ; tests require checkpolicy, which requires libsepol
  64        #:test-target "test"
  65        #:make-flags
  66        (let ((out (assoc-ref %outputs "out")))
  67          (list (string-append "PREFIX=" out)
  68                (string-append "DESTDIR=" out)
  69                (string-append "MAN3DIR=" out "/share/man/man3")
  70                (string-append "MAN5DIR=" out "/share/man/man5")
  71                (string-append "MAN8DIR=" out "/share/man/man8")
  72                (string-append "LDFLAGS=-Wl,-rpath=" out "/lib")
  73                "CC=gcc"))
  74        #:phases
  75        (modify-phases %standard-phases
  76          (delete 'configure)
  77          (add-after 'unpack 'enter-dir
  78            (lambda _ (chdir ,name) #t))
  79          (add-after 'enter-dir 'portability
  80            (lambda _
  81              (substitute* "src/ibpkeys.c"
  82                (("#include \"ibpkey_internal.h\"" line)
  83                 (string-append line "\n#include <inttypes.h>\n"))
  84                (("%#lx") "%#\" PRIx64 \""))
  85              #t)))))
  86     (native-inputs
  87      `(("flex" ,flex)))
  88     (home-page "https://selinuxproject.org/")
  89     (synopsis "Library for manipulating SELinux policies")
  90     (description
  91      "The libsepol library provides an API for the manipulation of SELinux
  92 binary policies.  It is used by @code{checkpolicy} (the policy compiler) and
  93 similar tools, and programs such as @code{load_policy}, which must perform
  94 specific transformations on binary policies (for example, customizing policy
  95 boolean settings).")
  96     (license license:lgpl2.1+)))
  97
  98 (define-public checkpolicy
  99   (package (inherit libsepol)
 100     (name "checkpolicy")
 101     (arguments
 102      `(#:tests? #f ; there is no check target
 103        #:make-flags
 104        (let ((out (assoc-ref %outputs "out")))
 105          (list (string-append "PREFIX=" out)
 106                (string-append "LIBSEPOLA="
 107                               (assoc-ref %build-inputs "libsepol")
 108                               "/lib/libsepol.a")
 109                "CC=gcc"))
 110        #:phases
 111        (modify-phases %standard-phases
 112          (delete 'configure)
 113          (delete 'portability)
 114          (add-after 'unpack 'enter-dir
 115            (lambda _ (chdir ,name) #t)))))
 116     (inputs
 117      `(("libsepol" ,libsepol)))
 118     (native-inputs
 119      `(("bison" ,bison)
 120        ("flex" ,flex)))
 121     (synopsis "Check SELinux security policy configurations and modules")
 122     (description
 123      "This package provides the tools \"checkpolicy\" and \"checkmodule\".
 124 Checkpolicy is a program that checks and compiles a SELinux security policy
 125 configuration into a binary representation that can be loaded into the kernel.
 126 Checkmodule is a program that checks and compiles a SELinux security policy
 127 module into a binary representation.")
 128     ;; GPLv2 only
 129     (license license:gpl2)))
 130
 131 (define-public libselinux
 132   (package (inherit libsepol)
 133     (name "libselinux")
 134     (outputs '("out" "python"))
 135     (arguments
 136      (substitute-keyword-arguments (package-arguments libsepol)
 137        ((#:make-flags flags)
 138         `(cons* "PYTHON=python3"
 139                 (string-append "LIBSEPOLA="
 140                               (assoc-ref %build-inputs "libsepol")
 141                               "/lib/libsepol.a")
 142                 (string-append "PYSITEDIR="
 143                                (assoc-ref %outputs "python")
 144                                "/lib/python"
 145                                ,(version-major+minor (package-version python))
 146                                "/site-packages/")
 147                 ,flags))
 148        ((#:phases phases)
 149         `(modify-phases ,phases
 150            (delete 'portability)
 151            (replace 'enter-dir
 152              (lambda _ (chdir ,name) #t))
 153            (add-after 'enter-dir 'remove-Werror
 154              (lambda _
 155                ;; GCC complains about the fact that the output does not (yet)
 156                ;; have an "include" directory, even though it is referenced.
 157                (substitute* '("src/Makefile"
 158                               "utils/Makefile")
 159                  (("-Werror ") ""))
 160                #t))
 161            (add-after 'build 'pywrap
 162              (lambda* (#:key make-flags #:allow-other-keys)
 163                (apply invoke "make" "pywrap" make-flags)))
 164            (add-after 'install 'install-pywrap
 165              (lambda* (#:key make-flags #:allow-other-keys)
 166                (apply invoke "make" "install-pywrap" make-flags)))))))
 167     ;; These libraries are in "Requires.private" in libselinux.pc.
 168     (propagated-inputs
 169      `(("libsepol" ,libsepol)
 170        ("pcre" ,pcre)))
 171     ;; For pywrap phase
 172     (inputs
 173      `(("python" ,python-wrapper)))
 174     ;; These inputs are only needed for the pywrap phase.
 175     (native-inputs
 176      `(("swig" ,swig)
 177        ("pkg-config" ,pkg-config)))
 178     (synopsis "SELinux core libraries and utilities")
 179     (description
 180      "The libselinux library provides an API for SELinux applications to get
 181 and set process and file security contexts, and to obtain security policy
 182 decisions.  It is required for any applications that use the SELinux API, and
 183 used by all applications that are SELinux-aware.  This package also includes
 184 the core SELinux management utilities.")
 185     (license license:public-domain)))
 186
 187 (define-public libsemanage
 188   (package (inherit libsepol)
 189     (name "libsemanage")
 190     (arguments
 191      (substitute-keyword-arguments (package-arguments libsepol)
 192        ((#:make-flags flags)
 193         `(cons* "PYTHON=python3"
 194                 (string-append "PYSITEDIR="
 195                                (assoc-ref %outputs "out")
 196                                "/lib/python"
 197                                ,(version-major+minor (package-version python))
 198                                "/site-packages/")
 199                 ,flags))
 200        ((#:phases phases)
 201         `(modify-phases ,phases
 202            (delete 'portability)
 203            (replace 'enter-dir
 204              (lambda _ (chdir ,name) #t))
 205            (add-after 'build 'pywrap
 206              (lambda* (#:key make-flags #:allow-other-keys)
 207                (apply invoke "make" "pywrap" make-flags)))
 208            (add-after 'install 'install-pywrap
 209              (lambda* (#:key make-flags #:allow-other-keys)
 210                (apply invoke "make" "install-pywrap" make-flags)))))))
 211     (inputs
 212      `(("libsepol" ,libsepol)
 213        ("libselinux" ,libselinux)
 214        ("audit" ,audit)
 215        ("ustr" ,ustr)
 216        ;; For pywrap phase
 217        ("python" ,python-wrapper)))
 218     (native-inputs
 219      `(("bison" ,bison)
 220        ("flex" ,flex)
 221        ;; For pywrap phase
 222        ("swig" ,swig)
 223        ("pkg-config" ,pkg-config)))
 224     (synopsis "SELinux policy management libraries")
 225     (description
 226      "The libsemanage library provides an API for the manipulation of SELinux
 227 binary policies.")
 228     (license license:lgpl2.1+)))
 229
 230 (define-public secilc
 231   (package (inherit libsepol)
 232     (name "secilc")
 233     (arguments
 234      (substitute-keyword-arguments (package-arguments libsepol)
 235        ((#:make-flags flags)
 236         `(let ((docbook (assoc-ref %build-inputs "docbook-xsl")))
 237            (cons (string-append "XMLTO=xmlto --skip-validation -x "
 238                                 docbook "/xml/xsl/docbook-xsl-"
 239                                 ,(package-version docbook-xsl)
 240                                 "/manpages/docbook.xsl")
 241                  ,flags)))
 242        ((#:phases phases)
 243         `(modify-phases ,phases
 244            (delete 'portability)
 245            (replace 'enter-dir
 246              (lambda _ (chdir ,name) #t))))))
 247     (inputs
 248      `(("libsepol" ,libsepol)))
 249     (native-inputs
 250      `(("xmlto" ,xmlto)
 251        ("docbook-xsl" ,docbook-xsl)))
 252     (synopsis "SELinux common intermediate language (CIL) compiler")
 253     (description "The SELinux CIL compiler is a compiler that converts the
 254 @dfn{common intermediate language} (CIL) into a kernel binary policy file.")
 255     (license license:bsd-2)))
 256
 257 (define-public python-sepolgen
 258   (package (inherit libsepol)
 259     (name "python-sepolgen")
 260     (arguments
 261      `(#:modules ((srfi srfi-1)
 262                   (guix build gnu-build-system)
 263                   (guix build utils))
 264        ,@(substitute-keyword-arguments (package-arguments libsepol)
 265            ((#:phases phases)
 266             `(modify-phases ,phases
 267                (delete 'portability)
 268                (replace 'enter-dir
 269                  (lambda _ (chdir "python/sepolgen") #t))
 270                ;; By default all Python files would be installed to
 271                ;; $out/gnu/store/...-python-.../, so we override the
 272                ;; PACKAGEDIR to fix this.
 273                (add-after 'enter-dir 'fix-target-path
 274                  (lambda* (#:key inputs outputs #:allow-other-keys)
 275                    (let ((get-python-version
 276                           ;; FIXME: copied from python-build-system
 277                           (lambda (python)
 278                             (let* ((version     (last (string-split python #\-)))
 279                                    (components  (string-split version #\.))
 280                                    (major+minor (take components 2)))
 281                               (string-join major+minor ".")))))
 282                      (substitute* "src/sepolgen/Makefile"
 283                        (("^PACKAGEDIR.*")
 284                         (string-append "PACKAGEDIR="
 285                                        (assoc-ref outputs "out")
 286                                        "/lib/python"
 287                                        (get-python-version
 288                                         (assoc-ref inputs "python"))
 289                                        "/site-packages/sepolgen")))
 290                      (substitute* "src/share/Makefile"
 291                        (("\\$\\(DESTDIR\\)") (assoc-ref outputs "out"))))
 292                    #t)))))))
 293     (inputs
 294      `(("python" ,python-wrapper)))
 295     (native-inputs '())
 296     (synopsis "Python module for generating SELinux policies")
 297     (description
 298      "This package contains a Python module that forms the core of
 299 @code{audit2allow}, a part of the package @code{policycoreutils}.  The
 300 sepolgen library contains: Reference Policy Representation, which are Objects
 301 for representing policies and the reference policy interfaces.  It has objects
 302 and algorithms for representing access and sets of access in an abstract way
 303 and searching that access.  It also has a parser for reference policy
 304 \"headers\".  It contains infrastructure for parsing SELinux related messages
 305 as produced by the audit system.  It has facilities for generating policy
 306 based on required access.")
 307     ;; GPLv2 only
 308     (license license:gpl2)))
 309
 310 (define-public python-setools
 311   (package
 312     (name "python-setools")
 313     (version "4.1.1")
 314     (source (origin
 315               (method git-fetch)
 316               (uri (git-reference
 317                     (url "https://github.com/TresysTechnology/setools.git")
 318                     (commit version)))
 319               (file-name (string-append name "-" version "-checkout"))
 320               (sha256
 321                (base32
 322                 "0459xxly6zzqc5azcwk3rbbcxvj60dq08f8z6xr05y7dsbb16cg6"))))
 323     (build-system python-build-system)
 324     (arguments
 325      `(#:tests? #f ; the test target causes a rebuild
 326        #:phases
 327        (modify-phases %standard-phases
 328          (delete 'portability)
 329          (add-after 'unpack 'set-SEPOL-variable
 330            (lambda* (#:key inputs #:allow-other-keys)
 331              (setenv "SEPOL"
 332                      (string-append (assoc-ref inputs "libsepol")
 333                                     "/lib/libsepol.a"))))
 334          (add-after 'unpack 'remove-Werror
 335            (lambda _
 336              (substitute* "setup.py"
 337                (("'-Werror',") ""))
 338              #t))
 339          (add-after 'unpack 'fix-target-paths
 340            (lambda* (#:key outputs #:allow-other-keys)
 341              (substitute* "setup.py"
 342                (("join\\(sys.prefix")
 343                 (string-append "join(\"" (assoc-ref outputs "out") "/\"")))
 344              #t)))))
 345     (propagated-inputs
 346      `(("python-networkx" ,python-networkx)))
 347     (inputs
 348      `(("libsepol" ,libsepol)
 349        ("libselinux" ,libselinux)))
 350     (native-inputs
 351      `(("bison" ,bison)
 352        ("flex" ,flex)
 353        ("swig" ,swig)))
 354     (home-page "https://github.com/TresysTechnology/setools")
 355     (synopsis "Tools for SELinux policy analysis")
 356     (description "SETools is a collection of graphical tools, command-line
 357 tools, and libraries designed to facilitate SELinux policy analysis.")
 358     ;; Some programs are under GPL, all libraries under LGPL.
 359     (license (list license:lgpl2.1+
 360                    license:gpl2+))))
 361
 362 (define-public policycoreutils
 363   (package (inherit libsepol)
 364     (name "policycoreutils")
 365     (arguments
 366      `(#:test-target "test"
 367        #:make-flags
 368        (let ((out (assoc-ref %outputs "out")))
 369          (list "CC=gcc"
 370                (string-append "PREFIX=" out)
 371                (string-append "LOCALEDIR=" out "/share/locale")
 372                (string-append "BASHCOMPLETIONDIR=" out
 373                               "/share/bash-completion/completions")
 374                "INSTALL=install -c -p"
 375                "INSTALL_DIR=install -d"
 376                ;; These ones are needed because some Makefiles define the
 377                ;; directories relative to DESTDIR, not relative to PREFIX.
 378                (string-append "SBINDIR=" out "/sbin")
 379                (string-append "ETCDIR=" out "/etc")
 380                (string-append "SYSCONFDIR=" out "/etc/sysconfig")
 381                (string-append "MAN5DIR=" out "/share/man/man5")
 382                (string-append "INSTALL_NLS_DIR=" out "/share/locale")
 383                (string-append "AUTOSTARTDIR=" out "/etc/xdg/autostart")
 384                (string-append "DBUSSERVICEDIR=" out "/share/dbus-1/services")
 385                (string-append "SYSTEMDDIR=" out "/lib/systemd")
 386                (string-append "INITDIR=" out "/etc/rc.d/init.d")
 387                (string-append "SELINUXDIR=" out "/etc/selinux")))
 388        #:phases
 389        (modify-phases %standard-phases
 390          (delete 'configure)
 391          (delete 'portability)
 392          (add-after 'unpack 'enter-dir
 393            (lambda _ (chdir ,name) #t))
 394          (add-after 'enter-dir 'ignore-/usr-tests
 395            (lambda* (#:key inputs #:allow-other-keys)
 396              ;; The Makefile decides to build restorecond only if it finds the
 397              ;; inotify header somewhere under /usr.
 398              (substitute* "Makefile"
 399                (("ifeq.*") "")
 400                (("endif.*") ""))
 401              ;; Rewrite lookup paths for header files.
 402              (substitute* '("newrole/Makefile"
 403                             "setfiles/Makefile"
 404                             "run_init/Makefile")
 405                (("/usr(/include/security/pam_appl.h)" _ file)
 406                 (string-append (assoc-ref inputs "pam") file))
 407                (("/usr(/include/libaudit.h)" _ file)
 408                 (string-append (assoc-ref inputs "audit") file)))
 409              #t)))))
 410     (inputs
 411      `(("audit" ,audit)
 412        ("pam" ,linux-pam)
 413        ("libsepol" ,libsepol)
 414        ("libselinux" ,libselinux)
 415        ("libsemanage" ,libsemanage)))
 416     (native-inputs
 417      `(("gettext" ,gettext-minimal)))
 418     (synopsis "SELinux core utilities")
 419     (description "The policycoreutils package contains the core utilities that
 420 are required for the basic operation of an SELinux-enabled GNU system and its
 421 policies.  These utilities include @code{load_policy} to load policies,
 422 @code{setfiles} to label file systems, @code{newrole} to switch roles, and
 423 @code{run_init} to run service scripts in their proper context.")
 424     (license license:gpl2+)))