selinux-refpolicy/Vagrantfile

# -*- mode: ruby -*-
# vi: set ft=ruby :

# Provisioning script to install the reference policy
$install_refpolicy = <<-SHELL
  # fail as soon as a command failed
  set -e

  # we set to permissive to allow loading and working with reference policy as opposed to fedora's fork
  echo "Setting SELinux to Permissive Mode..."
  setenforce 0

  # build the reference policy
  sudo -su vagrant make -C /vagrant bare
  sudo -su vagrant make -C /vagrant conf
  sudo -su vagrant make -C /vagrant all
  sudo -su vagrant make -C /vagrant validate
  rm -f /usr/share/selinux/refpolicy/*.pp
  make -C /vagrant install
  make -C /vagrant install-headers
  semodule -s refpolicy -i /usr/share/selinux/refpolicy/*.pp

  # Load the module specific to Vagrant VM
  semodule -s refpolicy -i /vagrant/support/vagrant-vm.cil

  if ! (LANG=C sestatus -v | grep '^Loaded policy name:\s*refpolicy$' > /dev/null)
  then
      # Use the reference policy
      sed -i -e 's/^\\(SELINUXTYPE=\\).*/SELINUXTYPE=refpolicy/' /etc/selinux/config
  fi
  semodule --reload

  # allow every domain to use /dev/urandom
  semanage boolean --modify --on global_ssp

  # allow opening SSH sessions as unconfined_u and sysadm_u
  semanage boolean --modify --on ssh_sysadm_login

  # allow systemd-tmpfiles to manage every file
  semanage boolean --modify --on systemd_tmpfiles_manage_all

  # make vagrant user use unconfined_u context
  if ! (semanage login -l | grep '^vagrant' > /dev/null)
  then
      echo "Configuring SELinux context for vagrant user"
      semanage login -a -s unconfined_u vagrant
  fi

  # label /vagrant as vagrant's home files
  if semanage fcontext --list | grep '^/vagrant(/\.\*)?'
  then
      semanage fcontext -m -s unconfined_u -t user_home_t '/vagrant(/.*)?'
  else
      semanage fcontext -a -s unconfined_u -t user_home_t '/vagrant(/.*)?'
  fi

  # Update interface_info
  sepolgen-ifgen -o /var/lib/sepolgen/interface_info -i /usr/share/selinux/refpolicy

  echo "Relabelling the system..."
  restorecon -RF /

  echo "If this is a fresh install, you need to reboot in order to enable enforcing mode"
SHELL

# All Vagrant configuration is done below. The "2" in Vagrant.configure
# configures the configuration version (we support older styles for
# backwards compatibility). Please don't change it unless you know what
# you're doing.
Vagrant.configure("2") do |config|
  # build a Fedora 30 VM
  config.vm.define "fedora" do |fedora|
    fedora.vm.box = "fedora/30-cloud-base"
    # assign a nice hostname
    fedora.vm.hostname = "selinux-fedora-devel"
    # give it a private internal IP address
    fedora.vm.network "private_network", type: "dhcp"

    # Customize the amount of memory on the VM
    fedora.vm.provider "virtualbox" do |vb|
      vb.memory = 1024
    end
    fedora.vm.provider "libvirt" do |lv|
      lv.memory = 1024
    end

    # Enable provisioning with a shell script. Additional provisioners such as
    # Puppet, Chef, Ansible, Salt, and Docker are also available. Please see the
    # documentation for more information about their specific syntax and use.
    fedora.vm.provision "shell", run: "once", inline: <<-SHELL
      # get the man pages
      echo "Upgrading DNF and installing man pages..."
      dnf install -q -y man-pages >/dev/null
      dnf upgrade -q -y dnf >/dev/null

      # install a few packages to make this machine ready to go out of the box
      echo "Installing SELinux dev dependencies..."
      dnf install -q -y \
        bash-completion \
        gcc \
        man-pages \
        vim \
        make \
        kernel-devel \
        selinux-policy-devel \
        libselinux-python3 \
        >/dev/null

      # configure the reference policy for Fedora
      if ! grep '^DISTRO = fedora$' /vagrant/build.conf > /dev/null
      then
        echo 'DISTRO = fedora' >> /vagrant/build.conf
        echo 'SYSTEMD = y' >> /vagrant/build.conf
        echo 'UBAC = n' >> /vagrant/build.conf
      fi

      #{$install_refpolicy}
    SHELL
  end

  # build a Debian 10 VM
  config.vm.define "debian" do |debian|
    debian.vm.box = "debian/buster64"
    # assign a nice hostname
    debian.vm.hostname = "selinux-debian-devel"
    # give it a private internal IP address
    debian.vm.network "private_network", type: "dhcp"

    # Customize the amount of memory on the VM
    debian.vm.provider "virtualbox" do |vb|
      vb.memory = 1024
    end
    debian.vm.provider "libvirt" do |lv|
      lv.memory = 1024
    end

    # redefine the /vagrant as a synced folder (not an NFS share), in order to work cleanly on it
    debian.vm.synced_folder ".", "/vagrant", disabled: true
    debian.vm.synced_folder ".", "/vagrant", type: "rsync",
      rsync__exclude: ".vagrant/"

    debian.vm.provision "shell", run: "once", inline: <<-SHELL
      # install a few packages to make this machine ready to go out of the box
      echo "Installing SELinux dev dependencies..."
      export DEBIAN_FRONTEND=noninteractive
      apt-get -qq update
      apt-get install --no-install-recommends --no-install-suggests -qy \
        bash-completion \
        gcc \
        git \
        libc6-dev \
        vim \
        make \
        auditd \
        selinux-basics \
        selinux-policy-default \
        selinux-policy-dev \
        setools

      # If SELinux is not enabled, enable it with Debian's policy and ask for a reboot
      if ! selinuxenabled
      then
        echo "Enabling SELinux for Debian according to https://wiki.debian.org/SELinux/Setup"
        selinux-activate
        echo "Please reboot now in order to enable SELinux:"
        echo "vagrant reload debian && vagrant provision debian"
        exit
      fi

      # configure the reference policy for Debian
      if ! grep '^DISTRO = debian$' /vagrant/build.conf > /dev/null
      then
        echo 'DISTRO = debian' >> /vagrant/build.conf
        echo 'SYSTEMD = y' >> /vagrant/build.conf
        echo 'UBAC = n' >> /vagrant/build.conf
      fi

      #{$install_refpolicy}
    SHELL
  end
end