|
 |
d51d46 |
Summary: Application Whitelisting Daemon
|
|
|
d51d46 |
Name: fapolicyd
|
|
|
d51d46 |
Version: 0.8.10
|
|
|
d51d46 |
Release: 3%{?dist}
|
|
|
d51d46 |
License: GPLv3+
|
|
|
d51d46 |
URL: http://people.redhat.com/sgrubb/fapolicyd
|
|
|
d51d46 |
Source0: https://people.redhat.com/sgrubb/fapolicyd/%{name}-%{version}.tar.gz
|
|
|
d51d46 |
BuildRequires: kernel-headers
|
|
|
d51d46 |
BuildRequires: autoconf automake make gcc libtool
|
|
|
d51d46 |
BuildRequires: systemd-devel libgcrypt-devel rpm-devel file-devel
|
|
|
d51d46 |
BuildRequires: libcap-ng-devel libseccomp-devel lmdb-devel
|
|
|
d51d46 |
BuildRequires: python3-devel
|
|
|
d51d46 |
Requires(pre): shadow-utils
|
|
|
d51d46 |
Requires(post): systemd-units
|
|
|
d51d46 |
Requires(preun): systemd-units
|
|
|
d51d46 |
Requires(postun): systemd-units
|
|
|
d51d46 |
|
|
|
d51d46 |
# Convert hashes to lowercase like sha256sum outputs
|
|
|
d51d46 |
Patch1: fapolicyd-hash.patch
|
|
|
d51d46 |
|
|
|
d51d46 |
# Removed stdout output for dnf plugin
|
|
|
d51d46 |
# 1721496 - Stop littering STDOUT output for dnf plugin in fapolicyd
|
|
|
d51d46 |
Patch2: fapolicyd-dnf-output.patch
|
|
|
d51d46 |
|
|
|
d51d46 |
# Added missing manpage for fapolicyd-cli
|
|
|
d51d46 |
Patch3: fapolicyd-manpage.patch
|
|
|
d51d46 |
|
|
|
d51d46 |
%description
|
|
|
d51d46 |
Fapolicyd (File Access Policy Daemon) implements application whitelisting
|
|
|
d51d46 |
to decide file access rights. Applications that are known via a reputation
|
|
|
d51d46 |
source are allowed access while unknown applications are not. The daemon
|
|
|
d51d46 |
makes use of the kernel's fanotify interface to determine file access rights.
|
|
|
d51d46 |
|
|
|
d51d46 |
%prep
|
|
|
d51d46 |
%setup -q
|
|
|
d51d46 |
|
|
|
d51d46 |
%patch1 -p1 -b .hash
|
|
|
d51d46 |
%patch2 -p1 -b .dnf-output
|
|
|
d51d46 |
%patch3 -p1 -b .manpage
|
|
|
d51d46 |
|
|
|
d51d46 |
%build
|
|
|
d51d46 |
./autogen.sh
|
|
|
d51d46 |
%configure --with-audit
|
|
|
d51d46 |
make CFLAGS="%{optflags}" %{?_smp_mflags}
|
|
|
d51d46 |
|
|
|
d51d46 |
%install
|
|
|
d51d46 |
make DESTDIR="%{buildroot}" INSTALL='install -p' install
|
|
|
d51d46 |
mkdir -p %{buildroot}/%{python3_sitelib}/dnf-plugins/
|
|
|
d51d46 |
install -p -m 644 dnf/%{name}-dnf-plugin.py %{buildroot}/%{python3_sitelib}/dnf-plugins/
|
|
|
d51d46 |
install -p -m 644 -D init/%{name}-tmpfiles.conf %{buildroot}/%{_tmpfilesdir}/%{name}.conf
|
|
|
d51d46 |
mkdir -p %{buildroot}/%{_localstatedir}/lib/%{name}
|
|
|
d51d46 |
mkdir -p %{buildroot}/run/%{name}
|
|
|
d51d46 |
|
|
|
d51d46 |
%pre
|
|
|
d51d46 |
getent passwd %{name} >/dev/null || useradd -r -M -d %{_localstatedir}/lib/%{name} -s /sbin/nologin -c "Application Whitelisting Daemon" %{name}
|
|
|
d51d46 |
|
|
|
d51d46 |
%post
|
|
|
d51d46 |
%systemd_post %{name}.service
|
|
|
d51d46 |
|
|
|
d51d46 |
%preun
|
|
|
d51d46 |
%systemd_preun %{name}.service
|
|
|
d51d46 |
|
|
|
d51d46 |
%postun
|
|
|
d51d46 |
%systemd_postun_with_restart %{name}.service
|
|
|
d51d46 |
|
|
|
d51d46 |
%files
|
|
|
d51d46 |
%doc README.md
|
|
|
d51d46 |
%{!?_licensedir:%global license %%doc}
|
|
|
d51d46 |
%license COPYING
|
|
|
d51d46 |
%attr(750,root,%{name}) %dir %{_sysconfdir}/%{name}
|
|
|
d51d46 |
%config(noreplace) %attr(644,root,%{name}) %{_sysconfdir}/%{name}/%{name}.rules
|
|
|
d51d46 |
%config(noreplace) %attr(644,root,%{name}) %{_sysconfdir}/%{name}/%{name}.mounts
|
|
|
d51d46 |
%config(noreplace) %attr(644,root,%{name}) %{_sysconfdir}/%{name}/%{name}.conf
|
|
|
d51d46 |
%attr(644,root,root) %{_unitdir}/%{name}.service
|
|
|
d51d46 |
%attr(644,root,root) %{_tmpfilesdir}/%{name}.conf
|
|
|
d51d46 |
%attr(755,root,root) %{_sbindir}/%{name}
|
|
|
d51d46 |
%attr(755,root,root) %{_sbindir}/%{name}-cli
|
|
|
d51d46 |
%attr(644,root,root) %{_mandir}/man8/*
|
|
|
d51d46 |
%attr(644,root,root) %{_mandir}/man5/*
|
|
|
d51d46 |
%attr(644,root,root) %{_mandir}/man1/*
|
|
|
d51d46 |
%ghost %{_localstatedir}/log/%{name}-access.log
|
|
|
d51d46 |
%attr(770,root,%{name}) %dir %{_localstatedir}/lib/%{name}
|
|
|
d51d46 |
%attr(770,root,%{name}) %dir /run/%{name}
|
|
|
d51d46 |
%ghost %{_localstatedir}/run/%{name}/%{name}.fifo
|
|
|
d51d46 |
%ghost %{_localstatedir}/lib/%{name}/data.mdb
|
|
|
d51d46 |
%ghost %{_localstatedir}/lib/%{name}/lock.mdb
|
|
|
d51d46 |
%{python3_sitelib}/dnf-plugins/%{name}-dnf-plugin.py
|
|
|
d51d46 |
%{python3_sitelib}/dnf-plugins/__pycache__/%{name}-dnf-plugin.*.pyc
|
|
|
d51d46 |
|
|
|
d51d46 |
%changelog
|
|
|
d51d46 |
* Wed Jul 24 2019 Radovan Sroka <rsroka@redhat.com> - 0.8.10-3
|
|
|
d51d46 |
- added missing manpage for fapolicyd-cli
|
|
|
d51d46 |
Resolves: rhbz#1708015
|
|
|
d51d46 |
|
|
|
d51d46 |
* Mon Jul 22 2019 Radovan Sroka <rsroka@redhat.com> - 0.8.10-2
|
|
|
d51d46 |
- Convert hashes to lowercase like sha256sum outputs
|
|
|
d51d46 |
- Stop littering STDOUT output for dnf plugin in fapolicyd
|
|
|
d51d46 |
Resolves: rhbz#1721496
|
|
|
d51d46 |
|
|
|
d51d46 |
* Tue Jun 18 2019 Radovan Sroka <rsroka@redhat.com> - 0.8.10-1
|
|
|
d51d46 |
- new upstream release
|
|
|
d51d46 |
Resolves: rhbz#1673323
|
|
|
d51d46 |
|
|
|
d51d46 |
* Mon May 06 2019 Radovan Sroka <rsroka@redhat.com> - 0.8.9-1
|
|
|
d51d46 |
- New upstream release
|
|
|
d51d46 |
- imported from fedora30
|
|
|
d51d46 |
resolves: rhbz#1673323
|
|
|
d51d46 |
|
|
|
d51d46 |
* Wed Mar 13 2019 Radovan Sroka <rsroka@redhat.com> - 0.8.8-2
|
|
|
d51d46 |
- backport some patches to resolve dac_override for fapolicyd
|
|
|
d51d46 |
|
|
|
d51d46 |
* Mon Mar 11 2019 Radovan Sroka <rsroka@redhat.com> - 0.8.8-1
|
|
|
d51d46 |
- New upstream release
|
|
|
d51d46 |
- Added new DNF plugin that can update the trust database when rpms are installed
|
|
|
d51d46 |
- Added support for FAN_OPEN_EXEC_PERM
|
|
|
d51d46 |
|
|
|
d51d46 |
* Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.8.7-3
|
|
|
d51d46 |
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
|
|
|
d51d46 |
|
|
|
d51d46 |
|
|
|
d51d46 |
* Wed Oct 03 2018 Steve Grubb <sgrubb@redhat.com> 0.8.7-1
|
|
|
d51d46 |
- New upstream bugfix release
|
|
|
d51d46 |
|
|
|
d51d46 |
* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 0.8.6-2
|
|
|
d51d46 |
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
|
|
|
d51d46 |
|
|
|
d51d46 |
* Thu Jun 07 2018 Steve Grubb <sgrubb@redhat.com> 0.8.6-1
|
|
|
d51d46 |
- New upstream feature release
|
|
|
d51d46 |
|
|
|
d51d46 |
* Fri May 18 2018 Steve Grubb <sgrubb@redhat.com> 0.8.5-2
|
|
|
d51d46 |
- Add dist tag (#1579362)
|
|
|
d51d46 |
|
|
|
d51d46 |
* Fri Feb 16 2018 Steve Grubb <sgrubb@redhat.com> 0.8.5-1
|
|
|
d51d46 |
- New release
|