Package including selinux
Move from dist-git
This commit is contained in:
Daniel Demus
parent
3e166852ae
commit
f5bd20b9e0
6
README-Fedora
Normal file
6
README-Fedora
Normal file
@ -0,0 +1,6 @@
|
||||
After installation edit the domain in /etc/httpd/conf.d/surrogator.config.php.
|
||||
Add avatar images to the /var/lib/surrogator folder and run /usr/bin/surrogator.
|
||||
Restart your httpd server.
|
||||
|
||||
The surrogator.config.php.dist is the original project version of the
|
||||
config file.
|
||||
26
surrogator.conf
Normal file
26
surrogator.conf
Normal file
@ -0,0 +1,26 @@
|
||||
<VirtualHost 0.0.0.0:80>
|
||||
ServerName avatars.example.com
|
||||
Redirect / https://avatars.example.com
|
||||
</VirtualHost>
|
||||
|
||||
<VirtualHost 0.0.0.0:443>
|
||||
ServerName avatars.example.com
|
||||
|
||||
ErrorLog logs/avatars.example.com-error_log
|
||||
TransferLog logs/avatars.example.com-access_log
|
||||
LogLevel warn
|
||||
CustomLog logs/avatars.example.com-request_log "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
|
||||
|
||||
DocumentRoot /usr/share/surrogator/www
|
||||
|
||||
<Location />
|
||||
Require all granted
|
||||
Options Indexes MultiViews FollowSymlinks
|
||||
</Location>
|
||||
|
||||
<IfModule mod_rewrite.c>
|
||||
RewriteEngine On
|
||||
RewriteRule ^avatar/ avatar.php [L]
|
||||
</IfModule>
|
||||
|
||||
</VirtualHost>
|
||||
62
surrogator.config.php
Normal file
62
surrogator.config.php
Normal file
@ -0,0 +1,62 @@
|
||||
<?php
|
||||
/**
|
||||
* Directory where you source image files live
|
||||
*/
|
||||
$rawDir = '/var/lib/surrogator/';
|
||||
|
||||
/**
|
||||
* Directory in which all the image files get generated into.
|
||||
* You could put that to /var/cached/avatars/ or so
|
||||
*/
|
||||
$varDir = '/var/cache/surrogator/';
|
||||
|
||||
/**
|
||||
* Document root of the web server host.
|
||||
*/
|
||||
$wwwDir = '/usr/share/surrogator/www/';
|
||||
|
||||
/**
|
||||
* Directory of default resource files.
|
||||
* You probably do not want to change that.
|
||||
*/
|
||||
$resDir = '/usr/share/surrogator/res/';
|
||||
|
||||
/**
|
||||
* Array of image sizes to generate.
|
||||
* Needs to be in ascending order.
|
||||
*/
|
||||
$sizes = array(16, 32, 48, 64, 80, 96, 128, 256, 512);
|
||||
|
||||
/**
|
||||
* Maximum image size supported by the server
|
||||
*/
|
||||
$maxSize = 512;
|
||||
|
||||
/**
|
||||
* Default log level. 0 for no logging, 1 for important messages, 3 for all
|
||||
*/
|
||||
$logLevel = 1;
|
||||
|
||||
/**
|
||||
* By default, images are only generated if their source file (in raw/)
|
||||
* is newer than the generated square file. If you set $forceUpdate
|
||||
* to true, the images will always be regenerated.
|
||||
*/
|
||||
$forceUpdate = false;
|
||||
|
||||
/**
|
||||
* URL prefixes that may be used as "default" parameter.
|
||||
*
|
||||
* Taken from https://git.linux-kernel.at/oliver/ivatar/-/blob/master/config.py
|
||||
*/
|
||||
$trustedDefaultUrls = [
|
||||
'http://gravatar.com/avatar/',
|
||||
'http://www.planet-libre.org/themes/planetlibre/images/',
|
||||
'https://avatars.dicebear.com/api/',
|
||||
'https://badges.fedoraproject.org/static/img/',
|
||||
'https://gravatar.com/avatar/',
|
||||
'https://secure.gravatar.com/avatar/',
|
||||
'https://ui-avatars.com/api/',
|
||||
'https://www.azuracast.com/img/',
|
||||
];
|
||||
?>
|
||||
5
surrogator.fc
Normal file
5
surrogator.fc
Normal file
@ -0,0 +1,5 @@
|
||||
/usr/bin/surrogator -- gen_context(system_u:object_r:surrogator_exec_t,s0)
|
||||
|
||||
/var/cache/surrogator(/.*)? gen_context(system_u:object_r:surrogator_cache_t,s0)
|
||||
|
||||
/var/lib/surrogator(/.*)? gen_context(system_u:object_r:surrogator_var_lib_t,s0)
|
||||
237
surrogator.if
Normal file
237
surrogator.if
Normal file
@ -0,0 +1,237 @@
|
||||
|
||||
## <summary>policy for surrogator</summary>
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute surrogator_exec_t in the surrogator domain.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed to transition.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`surrogator_domtrans',`
|
||||
gen_require(`
|
||||
type surrogator_t, surrogator_exec_t;
|
||||
')
|
||||
|
||||
corecmd_search_bin($1)
|
||||
domtrans_pattern($1, surrogator_exec_t, surrogator_t)
|
||||
')
|
||||
|
||||
######################################
|
||||
## <summary>
|
||||
## Execute surrogator in the caller domain.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`surrogator_exec',`
|
||||
gen_require(`
|
||||
type surrogator_exec_t;
|
||||
')
|
||||
|
||||
corecmd_search_bin($1)
|
||||
can_exec($1, surrogator_exec_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Search surrogator cache directories.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`surrogator_search_cache',`
|
||||
gen_require(`
|
||||
type surrogator_cache_t;
|
||||
')
|
||||
|
||||
allow $1 surrogator_cache_t:dir search_dir_perms;
|
||||
files_search_var($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Read surrogator cache files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`surrogator_read_cache_files',`
|
||||
gen_require(`
|
||||
type surrogator_cache_t;
|
||||
')
|
||||
|
||||
files_search_var($1)
|
||||
read_files_pattern($1, surrogator_cache_t, surrogator_cache_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Create, read, write, and delete
|
||||
## surrogator cache files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`surrogator_manage_cache_files',`
|
||||
gen_require(`
|
||||
type surrogator_cache_t;
|
||||
')
|
||||
|
||||
files_search_var($1)
|
||||
manage_files_pattern($1, surrogator_cache_t, surrogator_cache_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Manage surrogator cache dirs.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`surrogator_manage_cache_dirs',`
|
||||
gen_require(`
|
||||
type surrogator_cache_t;
|
||||
')
|
||||
|
||||
files_search_var($1)
|
||||
manage_dirs_pattern($1, surrogator_cache_t, surrogator_cache_t)
|
||||
')
|
||||
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Search surrogator lib directories.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`surrogator_search_lib',`
|
||||
gen_require(`
|
||||
type surrogator_var_lib_t;
|
||||
')
|
||||
|
||||
allow $1 surrogator_var_lib_t:dir search_dir_perms;
|
||||
files_search_var_lib($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Read surrogator lib files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`surrogator_read_lib_files',`
|
||||
gen_require(`
|
||||
type surrogator_var_lib_t;
|
||||
')
|
||||
|
||||
files_search_var_lib($1)
|
||||
read_files_pattern($1, surrogator_var_lib_t, surrogator_var_lib_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Manage surrogator lib files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`surrogator_manage_lib_files',`
|
||||
gen_require(`
|
||||
type surrogator_var_lib_t;
|
||||
')
|
||||
|
||||
files_search_var_lib($1)
|
||||
manage_files_pattern($1, surrogator_var_lib_t, surrogator_var_lib_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Manage surrogator lib directories.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`surrogator_manage_lib_dirs',`
|
||||
gen_require(`
|
||||
type surrogator_var_lib_t;
|
||||
')
|
||||
|
||||
files_search_var_lib($1)
|
||||
manage_dirs_pattern($1, surrogator_var_lib_t, surrogator_var_lib_t)
|
||||
')
|
||||
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## All of the rules required to administrate
|
||||
## an surrogator environment
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <param name="role">
|
||||
## <summary>
|
||||
## Role allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <rolecap/>
|
||||
#
|
||||
interface(`surrogator_admin',`
|
||||
gen_require(`
|
||||
type surrogator_t;
|
||||
type surrogator_cache_t;
|
||||
type surrogator_var_lib_t;
|
||||
')
|
||||
|
||||
allow $1 surrogator_t:process { signal_perms };
|
||||
ps_process_pattern($1, surrogator_t)
|
||||
|
||||
tunable_policy(`deny_ptrace',`',`
|
||||
allow $1 surrogator_t:process ptrace;
|
||||
')
|
||||
|
||||
files_search_var($1)
|
||||
admin_pattern($1, surrogator_cache_t)
|
||||
|
||||
files_search_var_lib($1)
|
||||
admin_pattern($1, surrogator_var_lib_t)
|
||||
optional_policy(`
|
||||
systemd_passwd_agent_exec($1)
|
||||
systemd_read_fifo_file_passwd_run($1)
|
||||
')
|
||||
')
|
||||
BIN
surrogator.pp
Normal file
BIN
surrogator.pp
Normal file
Binary file not shown.
160
surrogator.spec
Normal file
160
surrogator.spec
Normal file
@ -0,0 +1,160 @@
|
||||
%define relabel_files() \
|
||||
restorecon -R /usr/bin/surrogator; \
|
||||
restorecon -R /var/cache/surrogator; \
|
||||
restorecon -R /var/lib/surrogator; \
|
||||
|
||||
%define selinux_policyver 39.6-1
|
||||
|
||||
Name: surrogator
|
||||
Summary: Simple open source Libravatar compatible avatar image server written in PHP
|
||||
Version: 0.3.0
|
||||
Release: 8%{?dist}
|
||||
Group: System Environment/Daemons
|
||||
License: AGPL-3.0-or-later
|
||||
|
||||
Source0: surrogator-0.3.0.tar.bz2
|
||||
Source1: surrogator.config.php
|
||||
Source2: surrogator.conf
|
||||
Source3: README-Fedora
|
||||
Source4: surrogator.te
|
||||
Source5: surrogator.if
|
||||
Source6: surrogator.fc
|
||||
|
||||
|
||||
URL: https://sourceforge.net/p/surrogator/wiki/Home/
|
||||
Requires: php >= 5
|
||||
Requires: webserver
|
||||
Requires: surrogator
|
||||
BuildArch: noarch
|
||||
|
||||
%description
|
||||
Simple open source Libravatar compatible avatar image server written
|
||||
in PHP.
|
||||
|
||||
Features:
|
||||
* Delivers images for email addresses
|
||||
* Very easy to setup.
|
||||
* No graphics processing is done on the server,
|
||||
keeping the CPU load low. All avatar images get
|
||||
pre-generated for a set of sizes
|
||||
* If no image at the user requested size is found,
|
||||
the next larger image gets returned.
|
||||
* Supports the mm fallback image (mystery man)
|
||||
|
||||
%package httpd
|
||||
Summary: A htppd config to enable surrogator on an apache server
|
||||
Requires: surrogator
|
||||
Requires: httpd-core
|
||||
|
||||
%description httpd
|
||||
Simple open source Libravatar compatible avatar image server written
|
||||
in PHP.
|
||||
This package contains an http config file that enables the service on
|
||||
an apache server.
|
||||
|
||||
%package selinux
|
||||
Summary: SELinux policy module for surrogator
|
||||
Group: System Environment/Base
|
||||
|
||||
Requires: policycoreutils-python-utils, libselinux-utils
|
||||
Requires: surrogator, surrogator-http
|
||||
Requires(post): selinux-policy-base >= %{selinux_policyver}, policycoreutils-python-utils
|
||||
Requires(postun): policycoreutils-python-utils
|
||||
Requires(post): surrogator
|
||||
BuildRequires: selinux-policy-devel
|
||||
BuildArch: noarch
|
||||
|
||||
%description selinux
|
||||
This package installs and sets up the SELinux policy security module for surrogator.
|
||||
|
||||
|
||||
%prep
|
||||
%setup -q
|
||||
cp %{SOURCE1} surrogator.config.php
|
||||
cp %{SOURCE2} surrogator.conf
|
||||
cp %{SOURCE3} README-Fedora
|
||||
cp %{SOURCE4} surrogator.te
|
||||
cp %{SOURCE5} surrogator.if
|
||||
cp %{SOURCE6} surrogator.fc
|
||||
|
||||
%build selinux
|
||||
make -f %{_datadir}/selinux/devel/Makefile %{name}.pp
|
||||
bzip2 -9 %{name}.pp
|
||||
|
||||
%install
|
||||
install -dm 755 %{buildroot}
|
||||
install -Dm 644 -t %{buildroot}%{_sysconfdir} %{SOURCE1}
|
||||
install -Dm 644 -t %{buildroot}%{_docdir}/%{name} %{SOURCE3}
|
||||
install -Dm 644 -t %{buildroot}%{_sysconfdir}/httpd/conf.d %{SOURCE2}
|
||||
install -Dm 644 -t %{buildroot}%{_datadir}/%{name}/res res/*.png res/*.svg
|
||||
install -Dm 644 -t %{buildroot}%{_datadir}/%{name}/www www/avatar.php res/www/*
|
||||
install -dm 755 %{buildroot}%{_var}/cache/%{name}
|
||||
install -dm 755 %{buildroot}%{_sharedstatedir}/%{name}
|
||||
install -Dm 755 surrogator.php %{buildroot}%{_bindir}/%{name}
|
||||
install -Dm 644 -t %{buildroot}%{_datadir}/%{name}/www www/avatar.php res/www/*
|
||||
|
||||
install -Dm 644 -t %{buildroot}%{_datadir}/selinux/packages %{name}.pp.bz2
|
||||
install -Dm 644 -t %{buildroot}%{_datadir}/selinux/devel/include/contrib/ %{SOURCE5}
|
||||
|
||||
%post selinux
|
||||
semodule -n -i %{_datadir}/selinux/packages/surrogator.pp
|
||||
sepolicy manpage --domain surrogator_t
|
||||
if /usr/sbin/selinuxenabled ; then
|
||||
/usr/sbin/load_policy
|
||||
%relabel_files
|
||||
|
||||
fi;
|
||||
exit 0
|
||||
|
||||
%postun selinux
|
||||
if [ $1 -eq 0 ]; then
|
||||
semodule -n -r surrogator
|
||||
if /usr/sbin/selinuxenabled ; then
|
||||
/usr/sbin/load_policy
|
||||
%relabel_files
|
||||
|
||||
fi;
|
||||
fi;
|
||||
exit 0
|
||||
|
||||
|
||||
%files
|
||||
%defattr(-,root,root)
|
||||
%{_datadir}/%{name}
|
||||
%{_var}/cache/%{name}
|
||||
%{_sharedstatedir}/%{name}
|
||||
%{_bindir}/%{name}
|
||||
%config(noreplace) %{_sysconfdir}/%{name}.config.php
|
||||
%doc README.rst
|
||||
%doc data/%{name}.config.php.dist
|
||||
%doc %{_docdir}/%{name}/*
|
||||
%license LICENSE
|
||||
|
||||
%files httpd
|
||||
%config(noreplace) %{_sysconfdir}/httpd/conf.d/%{name}.conf
|
||||
%license LICENSE
|
||||
|
||||
%files selinux
|
||||
%attr(0600,root,root) %{_datadir}/selinux/packages/surrogator.pp.bz2
|
||||
%{_datadir}/selinux/devel/include/contrib/surrogator.if
|
||||
%ghost %{_mandir}/man8/surrogator_selinux.8.gz
|
||||
|
||||
%changelog
|
||||
* Mon May 20 2024 Daniel Demus <daniel@demus.dk> - 0.3.0-8
|
||||
- Add selinux targeted policy
|
||||
* Sat May 18 2024 Daniel Demus <daniel@demus.dk> - 0.3.0-7
|
||||
- Add final slash to cache directory path
|
||||
* Sun Nov 19 2023 Daniel Demus <daniel@demus.dk> - 0.3.0-6
|
||||
- Correct DocumentRoot
|
||||
* Sun Nov 19 2023 Daniel Demus <daniel@demus.dk> - 0.3.0-5
|
||||
- Add Location section to allow all in apache config
|
||||
* Wed Nov 15 2023 Daniel Demus <daniel@demus.dk> - 0.3.0-4
|
||||
- Correct license
|
||||
* Wed Nov 15 2023 Daniel Demus <daniel@demus.dk> - 0.3.0-3
|
||||
- Remove invalid RewriteBase directive from apache config
|
||||
* Wed Nov 15 2023 Daniel Demus <daniel@demus.dk> - 0.3.0-2
|
||||
- Require only webserver in the base package
|
||||
* Wed Nov 15 2023 Daniel Demus <daniel@demus.dk> - 0.3.0-1
|
||||
- Require base package in the httpd config package
|
||||
* Mon Oct 30 2023 Daniel Demus <daniel@demus.dk> - 0.3.0-0
|
||||
- First package
|
||||
50
surrogator.te
Normal file
50
surrogator.te
Normal file
@ -0,0 +1,50 @@
|
||||
policy_module(surrogator, 1.0.0)
|
||||
|
||||
########################################
|
||||
#
|
||||
# Declarations
|
||||
#
|
||||
|
||||
type surrogator_t;
|
||||
type surrogator_exec_t;
|
||||
init_daemon_domain(surrogator_t, surrogator_exec_t)
|
||||
|
||||
permissive surrogator_t;
|
||||
|
||||
type surrogator_cache_t;
|
||||
files_type(surrogator_cache_t)
|
||||
|
||||
type surrogator_var_lib_t;
|
||||
files_type(surrogator_var_lib_t)
|
||||
|
||||
########################################
|
||||
#
|
||||
# surrogator local policy
|
||||
#
|
||||
allow surrogator_t self:fifo_file rw_fifo_file_perms;
|
||||
allow surrogator_t self:unix_stream_socket create_stream_socket_perms;
|
||||
|
||||
manage_dirs_pattern(surrogator_t, surrogator_cache_t, surrogator_cache_t)
|
||||
manage_files_pattern(surrogator_t, surrogator_cache_t, surrogator_cache_t)
|
||||
manage_lnk_files_pattern(surrogator_t, surrogator_cache_t, surrogator_cache_t)
|
||||
files_var_filetrans(surrogator_t, surrogator_cache_t, { dir file lnk_file })
|
||||
|
||||
manage_dirs_pattern(surrogator_t, surrogator_var_lib_t, surrogator_var_lib_t)
|
||||
manage_files_pattern(surrogator_t, surrogator_var_lib_t, surrogator_var_lib_t)
|
||||
manage_lnk_files_pattern(surrogator_t, surrogator_var_lib_t, surrogator_var_lib_t)
|
||||
files_var_lib_filetrans(surrogator_t, surrogator_var_lib_t, { dir file lnk_file })
|
||||
|
||||
domain_use_interactive_fds(surrogator_t)
|
||||
|
||||
files_read_etc_files(surrogator_t)
|
||||
|
||||
miscfiles_read_localization(surrogator_t)
|
||||
|
||||
#============= httpd_t ==============
|
||||
require {
|
||||
type httpd_t;
|
||||
class file { getattr read open };
|
||||
}
|
||||
|
||||
allow httpd_t surrogator_cache_t:file { getattr read open map };
|
||||
|
||||
Loading…
Reference in New Issue
Block a user