12

The RHEL7 supplied tomcat package supports multiple instances through the creation of directories and symlinks. Once such a multiple instance is created and packaged as an RPM, the extra instances fail to start due to selinux failures.

The solution is configure selinux correctly in the RPM packaging, however I am struggling to find a canonical description of how to do this.

Where does the selinux configuration come from when tomcat is installed in RHEL7?

Edit: the question at What is the proper way to set SELinux context in an RPM .spec?, had anyone bothered to actually read it, referred to the obsolete RHEL4 and RHEL5 distributions, and is 7 years old. As clearly stated in this question, this refers to RHEL7 in 2018. The answer to the 7 year old question, and the answer to this one are very different from one another.

Graham Leggett
  • 383
  • 3
  • 11
  • You should first familiarise with building SELinux policy packages (.pp files). I think this link might then give informations on what you want: [5.2. Generating SELinux Policy Modules: sepolicy generate](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/selinux_users_and_administrators_guide/security-enhanced_linux-the-sepolicy-suite-sepolicy_generate) – A.B Sep 15 '18 at 11:15
  • You have already 2 reopen votes. – peterh Sep 28 '18 at 04:29
  • If the answers are obsoleted, updated answers should be posted, instead of reasking the same question for each new version. – muru Sep 28 '18 at 07:15
  • @muru Not when the prior question specifically asks about an obsolete version of the operating system. Unless you're advocating rewriting the question as well? – EdwinW Jan 22 '19 at 22:35
  • More info about SELinux policy packages: https://unix.stackexchange.com/q/245538/11917 – blong Dec 17 '21 at 15:00

1 Answers1

6

SELinux configuration is provided by selinux-policy-targeted package, which contains the default policy configuration for the distribution, including SELinux configuration for tomcat.

I could find two old Fedora packaging drafts describing SELinux configuration in RPM packaging.

PackagingDrafts/SELinux suggests including the file labeling configuration in %post and %postun sections of the spec file by executing semanage fcontext -a and semanage fcontext -d respectively and running restorecon/fixfiles afterwards.

It is useful to note, as pointed out by Graham Legett, that using semanage in %pre or %post sections of spec will add the complete python stack along with policycoreutils-python as install time dependency. Using restorecon will add policycoreutils, which in turn brings in sed, gawk and grep, as install time dependencies.

A better way to provide the required file labeling rules would be by a SELinux policy module. Policy modules provide clearer interface to manage modular policy (labeling rules are not mixed with local modifications done with semanage).

For your policy module with file labeling rules, you need to provide type enforcement file and file context labeling file. Type enforcement file is required even if you do not add any modifications to the policy. An example dummy type enforcement file mymodule.te:

policy_module(mymodule, 1.0)

The file labeling rules are in mymodule.fc and follow same :

/path/to/file   --  gen_context(system_u:object_r:type_t,s0)

With selinux-policy-devel, the module package can be compiled with[note 1]:

make -f /usr/share/selinux/devel/Makefile

Regarding packaging policy modules, SELinux Policy Modules Packaging Draft similarly recommends using the %post and %postun sections of the spec file to install the policy using semodule and restorecon/fixfiles. An example spec file is also provided.

[note 1] The example policy module could be generated without selinux-policy-devel by using checkmodule and semodule_package directly. It would require the policy files to be written without macros.

sebasth
  • 14,332
  • 4
  • 50
  • 68
  • 3
    To enhance this answer - here is an example of small SELinux module shipped as a standalone package: https://pagure.io/copr/copr/blob/master/f/selinux This should give you enough example how to implement your own module. – msuchy Sep 19 '18 at 15:36
  • Any use of semanage in %pre or %post brings in an install time dependency of the complete python stack along with policycoreutils-python, and any use of restorecon brings in policycoreutils, which in turn brings in sed, gawk and grep. The tomcat RPM brings in none of these, and so this isn't the solution on RHEL7. Can you remove these suggestions from the answer if possible? – Graham Leggett Sep 21 '18 at 09:26
  • @GrahamLeggett SELinux policy for tomcat is shipped in [`selinux-policy-targeted`](https://git.centos.org/blob/rpms!selinux-policy.git/c7/SOURCES!policy-rhel-7.5-contrib.patch#L110573), which contains file labeling rules, hence there likely isn't any SELinux configuration shipped with tomcat package. – sebasth Sep 21 '18 at 17:00
  • @GrahamLeggett I've included a note about the dependencies. You are also welcome to suggest an [edit] if you would like to modify the answer details. – sebasth Sep 21 '18 at 17:10
  • Unfortunately, the referenced SELinux Policy Modules Packaging Draft has one fault that is easy to miss, in regards to `fixfiles`. When it's invoked in `-selinux` subpackage's `%post` scriplet, it is not guaranteed that the main package is installed, so it will simply fail upon a new install, and generate message ' not found' during install. While it may be harmless, it may cause some display issues for scriplets of other packages which output text, for whatever reason. – Danila Vershinin Jul 05 '20 at 21:04