Merge pull request #83 from fishilico/vagrant-devel
This commit is contained in:
Chris PeBenito
commit
39fd1ed486
|
|
@ -1,46 +1,174 @@
|
||||||
# -*- mode: ruby -*-
|
# -*- mode: ruby -*-
|
||||||
# vi: set ft=ruby :
|
# vi: set ft=ruby :
|
||||||
|
|
||||||
|
# Provisioning script to install the reference policy
|
||||||
|
$install_refpolicy = <<-SHELL
|
||||||
|
# fail as soon as a command failed
|
||||||
|
set -e
|
||||||
|
|
||||||
|
# we set to permissive to allow loading and working with reference policy as opposed to fedora's fork
|
||||||
|
echo "Setting SELinux to Permissive Mode..."
|
||||||
|
setenforce 0
|
||||||
|
|
||||||
|
# build the reference policy
|
||||||
|
sudo -su vagrant make -C /vagrant bare
|
||||||
|
sudo -su vagrant make -C /vagrant conf
|
||||||
|
sudo -su vagrant make -C /vagrant all
|
||||||
|
sudo -su vagrant make -C /vagrant validate
|
||||||
|
sudo -s make -C /vagrant install
|
||||||
|
sudo -s make -C /vagrant install-headers
|
||||||
|
sudo -s semodule -s refpolicy -i /usr/share/selinux/refpolicy/*.pp
|
||||||
|
|
||||||
|
if ! (LANG=C sestatus -v | grep '^Loaded policy name:\s*refpolicy$' > /dev/null)
|
||||||
|
then
|
||||||
|
# Use the reference policy
|
||||||
|
sed -i -e 's/^\\(SELINUXTYPE=\\).*/SELINUXTYPE=refpolicy/' /etc/selinux/config
|
||||||
|
fi
|
||||||
|
sudo -s semodule --reload
|
||||||
|
|
||||||
|
# allow every domain to use /dev/urandom
|
||||||
|
sudo -s semanage boolean --modify --on global_ssp
|
||||||
|
|
||||||
|
# allow systemd-tmpfiles to manage every file
|
||||||
|
sudo -s semanage boolean --modify --on systemd_tmpfiles_manage_all
|
||||||
|
|
||||||
|
# make vagrant user use unconfined_u context
|
||||||
|
if ! (sudo -s semanage login -l | grep '^vagrant' > /dev/null)
|
||||||
|
then
|
||||||
|
echo "Configuring SELinux context for vagrant user"
|
||||||
|
sudo -s semanage login -a -s unconfined_u vagrant
|
||||||
|
fi
|
||||||
|
|
||||||
|
# label /vagrant as vagrant's home files
|
||||||
|
if sudo -s semanage fcontext --list | grep '^/vagrant(/\.\*)?'
|
||||||
|
then
|
||||||
|
sudo -s semanage fcontext -m -s unconfined_u -t user_home_t '/vagrant(/.*)?'
|
||||||
|
else
|
||||||
|
sudo -s semanage fcontext -a -s unconfined_u -t user_home_t '/vagrant(/.*)?'
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Update interface_info
|
||||||
|
sudo -s sepolgen-ifgen -o /var/lib/sepolgen/interface_info -i /usr/share/selinux/refpolicy
|
||||||
|
|
||||||
|
echo "Relabelling the system..."
|
||||||
|
sudo -s restorecon -RF /
|
||||||
|
|
||||||
|
echo "If this is a fresh install, you need to reboot in order to enable enforcing mode"
|
||||||
|
SHELL
|
||||||
|
|
||||||
# All Vagrant configuration is done below. The "2" in Vagrant.configure
|
# All Vagrant configuration is done below. The "2" in Vagrant.configure
|
||||||
# configures the configuration version (we support older styles for
|
# configures the configuration version (we support older styles for
|
||||||
# backwards compatibility). Please don't change it unless you know what
|
# backwards compatibility). Please don't change it unless you know what
|
||||||
# you're doing.
|
# you're doing.
|
||||||
Vagrant.configure("2") do |config|
|
Vagrant.configure("2") do |config|
|
||||||
# build a Fedora 24 VM
|
# build a Fedora 30 VM
|
||||||
config.vm.box = "bento/fedora-24"
|
config.vm.define "fedora" do |fedora|
|
||||||
# assign a nice hostname
|
fedora.vm.box = "fedora/30-cloud-base"
|
||||||
config.vm.hostname = "selinux-devel"
|
# assign a nice hostname
|
||||||
# give it a private internal IP address
|
fedora.vm.hostname = "selinux-fedora-devel"
|
||||||
config.vm.network "private_network", type: "dhcp"
|
# give it a private internal IP address
|
||||||
|
fedora.vm.network "private_network", type: "dhcp"
|
||||||
|
|
||||||
config.vm.provider "virtualbox" do |vb|
|
# Customize the amount of memory on the VM
|
||||||
# Customize the amount of memory on the VM:
|
fedora.vm.provider "virtualbox" do |vb|
|
||||||
vb.memory = "1024"
|
vb.memory = 1024
|
||||||
|
end
|
||||||
|
fedora.vm.provider "libvirt" do |lv|
|
||||||
|
lv.memory = 1024
|
||||||
|
end
|
||||||
|
|
||||||
|
# Enable provisioning with a shell script. Additional provisioners such as
|
||||||
|
# Puppet, Chef, Ansible, Salt, and Docker are also available. Please see the
|
||||||
|
# documentation for more information about their specific syntax and use.
|
||||||
|
fedora.vm.provision "shell", run: "once", inline: <<-SHELL
|
||||||
|
# get the man pages
|
||||||
|
echo "Upgrading DNF and installing man pages..."
|
||||||
|
dnf install -q -y man-pages >/dev/null
|
||||||
|
dnf upgrade -q -y dnf >/dev/null
|
||||||
|
|
||||||
|
# install a few packages to make this machine ready to go out of the box
|
||||||
|
echo "Installing SELinux dev dependencies..."
|
||||||
|
dnf install -q -y \
|
||||||
|
bash-completion \
|
||||||
|
gcc \
|
||||||
|
man-pages \
|
||||||
|
vim \
|
||||||
|
make \
|
||||||
|
kernel-devel \
|
||||||
|
selinux-policy-devel \
|
||||||
|
libselinux-python3 \
|
||||||
|
>/dev/null
|
||||||
|
|
||||||
|
# configure the reference policy for Fedora
|
||||||
|
if ! grep '^DISTRO = fedora$' /vagrant/build.conf > /dev/null
|
||||||
|
then
|
||||||
|
echo 'DISTRO = fedora' >> /vagrant/build.conf
|
||||||
|
echo 'SYSTEMD = y' >> /vagrant/build.conf
|
||||||
|
echo 'UBAC = n' >> /vagrant/build.conf
|
||||||
|
fi
|
||||||
|
|
||||||
|
#{$install_refpolicy}
|
||||||
|
SHELL
|
||||||
end
|
end
|
||||||
|
|
||||||
# Enable provisioning with a shell script. Additional provisioners such as
|
# build a Debian 10 VM
|
||||||
# Puppet, Chef, Ansible, Salt, and Docker are also available. Please see the
|
config.vm.define "debian" do |debian|
|
||||||
# documentation for more information about their specific syntax and use.
|
debian.vm.box = "debian/buster64"
|
||||||
config.vm.provision "shell", run: "once", inline: <<-SHELL
|
# assign a nice hostname
|
||||||
# get the man pages
|
debian.vm.hostname = "selinux-debian-devel"
|
||||||
echo "Upgrading DNF and installing man pages..."
|
# give it a private internal IP address
|
||||||
dnf install -q -y man-pages >/dev/null
|
debian.vm.network "private_network", type: "dhcp"
|
||||||
dnf upgrade -q -y dnf >/dev/null
|
|
||||||
|
|
||||||
# install a few packages to make this machine ready to go out of the box
|
# Customize the amount of memory on the VM
|
||||||
echo "Installing SELinux dev dependencies..."
|
debian.vm.provider "virtualbox" do |vb|
|
||||||
dnf install -q -y \
|
vb.memory = 1024
|
||||||
bash-completion \
|
end
|
||||||
man-pages \
|
debian.vm.provider "libvirt" do |lv|
|
||||||
vim \
|
lv.memory = 1024
|
||||||
make \
|
end
|
||||||
kernel-devel \
|
|
||||||
selinux-policy-devel \
|
|
||||||
libselinux-python3 \
|
|
||||||
>/dev/null
|
|
||||||
|
|
||||||
# we set to permissive to allow loading and working with reference policy as opposed to fedora's fork
|
# redefine the /vagrant as a synced folder (not an NFS share), in order to work cleanly on it
|
||||||
echo "Setting SELinux to Permissive Mode..."
|
config.vm.synced_folder ".", "/vagrant", disabled: true
|
||||||
setenforce 0
|
config.vm.synced_folder ".", "/vagrant", type: "rsync",
|
||||||
SHELL
|
rsync__exclude: ".vagrant/"
|
||||||
|
|
||||||
|
debian.vm.provision "shell", run: "once", inline: <<-SHELL
|
||||||
|
# install a few packages to make this machine ready to go out of the box
|
||||||
|
echo "Installing SELinux dev dependencies..."
|
||||||
|
export DEBIAN_FRONTEND=noninteractive
|
||||||
|
apt-get -qq update
|
||||||
|
apt-get install --no-install-recommends --no-install-suggests -qy \
|
||||||
|
bash-completion \
|
||||||
|
gcc \
|
||||||
|
git \
|
||||||
|
libc6-dev \
|
||||||
|
vim \
|
||||||
|
make \
|
||||||
|
auditd \
|
||||||
|
selinux-basics \
|
||||||
|
selinux-policy-default \
|
||||||
|
selinux-policy-dev \
|
||||||
|
setools
|
||||||
|
|
||||||
|
# If SELinux is not enabled, enable it with Debian's policy and ask for a reboot
|
||||||
|
if ! selinuxenabled
|
||||||
|
then
|
||||||
|
echo "Enabling SELinux for Debian according to https://wiki.debian.org/SELinux/Setup"
|
||||||
|
selinux-activate
|
||||||
|
echo "Please reboot now in order to enable SELinux:"
|
||||||
|
echo "vagrant reload debian && vagrant provision debian"
|
||||||
|
exit
|
||||||
|
fi
|
||||||
|
|
||||||
|
# configure the reference policy for Debian
|
||||||
|
if ! grep '^DISTRO = debian$' /vagrant/build.conf > /dev/null
|
||||||
|
then
|
||||||
|
echo 'DISTRO = debian' >> /vagrant/build.conf
|
||||||
|
echo 'SYSTEMD = y' >> /vagrant/build.conf
|
||||||
|
echo 'UBAC = n' >> /vagrant/build.conf
|
||||||
|
fi
|
||||||
|
|
||||||
|
#{$install_refpolicy}
|
||||||
|
SHELL
|
||||||
|
end
|
||||||
end
|
end
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue