rpms/queuegraph/F-8 queuegraph.fc, NONE, 1.1 queuegraph.if, NONE, 1.1 queuegraph.te, NONE, 1.1 queuegraph-average.patch, 1.1, 1.2 queuegraph-paths.patch, 1.1, 1.2 queuegraph.conf, 1.1, 1.2 queuegraph.spec, 1.1, 1.2 sources, 1.2, 1.3

Wed Oct 31 05:35:18 UTC 2007

Author: bjohnson

Update of /cvs/pkgs/rpms/queuegraph/F-8
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv23199/F-8

Modified Files:
	queuegraph-average.patch queuegraph-paths.patch 
	queuegraph.conf queuegraph.spec sources 
Added Files:
	queuegraph.fc queuegraph.if queuegraph.te 
Log Message:
- new tarball - no version numbers updated
- fixed up patches to match new tarball
- removed repotag
- Queuegraph needs AddHandler cgi-script .cgi (bz #289031)
- queuegraph is denied by selinux (bz #247435)

--- NEW FILE queuegraph.fc ---

/usr/share/queuegraph/queuegraph.cgi		--	gen_context(system_u:object_r:httpd_queuegraph_script_exec_t,s0)

/var/cache/queuegraph(/.*)?			gen_context(system_u:object_r:httpd_queuegraph_script_rw_t,s0)
/var/lib/queuegraph(/.*)?			gen_context(system_u:object_r:httpd_queuegraph_script_var_lib_t,s0)


--- NEW FILE queuegraph.if ---

## <summary>policy for httpd_queuegraph_script</summary>

########################################
## <summary>
##	Execute a domain transition to run httpd_queuegraph_script.
## </summary>
## <param name="domain">
## <summary>
##	Domain allowed to transition.
## </summary>
## </param>
#
interface(`httpd_queuegraph_script_domtrans',`
	gen_require(`
		type httpd_queuegraph_script_t, httpd_queuegraph_script_exec_t;
	')

	domain_auto_trans($1,httpd_queuegraph_script_exec_t,httpd_queuegraph_script_t)

	allow httpd_queuegraph_script_t $1:fd use;
	allow httpd_queuegraph_script_t $1:fifo_file rw_file_perms;
	allow httpd_queuegraph_script_t $1:process sigchld;
')

########################################
## <summary>
##	Search httpd_queuegraph_script rw directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`httpd_queuegraph_script_search_rw_dir',`
	gen_require(`
		type httpd_queuegraph_script_rw_t;
	')

	allow $1 httpd_queuegraph_script_rw_t:dir search_dir_perms;
	files_search_rw($1)
')

########################################
## <summary>
##	Read httpd_queuegraph_script rw files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`httpd_queuegraph_script_read_rw_files',`
	gen_require(`
		type httpd_queuegraph_script_rw_t;
	')

	allow $1 httpd_queuegraph_script_rw_t:file r_file_perms;
	allow $1 httpd_queuegraph_script_rw_t:dir list_dir_perms;
	files_search_rw($1)
')

########################################
## <summary>
##	Create, read, write, and delete
##	httpd_queuegraph_script rw files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`httpd_queuegraph_script_manage_rw_files',`
	gen_require(`
		type httpd_queuegraph_script_rw_t;
	')

	allow $1 httpd_queuegraph_script_rw_t:file manage_file_perms;
	allow $1 httpd_queuegraph_script_rw_t:dir rw_dir_perms;
')

########################################
## <summary>
##	Search httpd_queuegraph_script lib directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`httpd_queuegraph_script_search_lib',`
	gen_require(`
		type httpd_queuegraph_script_var_lib_t;
	')

	allow $1 httpd_queuegraph_script_var_lib_t:dir search_dir_perms;
	files_search_var_lib($1)
')

########################################
## <summary>
##	Read httpd_queuegraph_script lib files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`httpd_queuegraph_script_read_lib_files',`
	gen_require(`
		type httpd_queuegraph_script_var_lib_t;
	')

	allow $1 httpd_queuegraph_script_var_lib_t:file r_file_perms;
	allow $1 httpd_queuegraph_script_var_lib_t:dir list_dir_perms;
	files_search_var_lib($1)
')

########################################
## <summary>
##	Create, read, write, and delete
##	httpd_queuegraph_script lib files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`httpd_queuegraph_script_manage_lib_files',`
	gen_require(`
		type httpd_queuegraph_script_var_lib_t;
	')

	allow $1 httpd_queuegraph_script_var_lib_t:file manage_file_perms;
	allow $1 httpd_queuegraph_script_var_lib_t:dir rw_dir_perms;
	files_search_var_lib($1)
')


--- NEW FILE queuegraph.te ---
policy_module(queuegraph,1.0.0)

########################################
#
# Declarations
#

apache_content_template(queuegraph)

type httpd_queuegraph_script_var_lib_t;
files_type(httpd_queuegraph_script_var_lib_t)


allow httpd_queuegraph_script_t httpd_queuegraph_script_rw_t:file manage_file_perms;
allow httpd_queuegraph_script_t httpd_queuegraph_script_rw_t:dir create_dir_perms;
files_pid_filetrans(httpd_queuegraph_script_t,httpd_queuegraph_script_rw_t, { file dir })

allow httpd_queuegraph_script_t httpd_queuegraph_script_var_lib_t:file manage_file_perms;
allow httpd_queuegraph_script_t httpd_queuegraph_script_var_lib_t:dir manage_dir_perms;
files_var_lib_filetrans(httpd_queuegraph_script_t,httpd_queuegraph_script_var_lib_t, { file dir })

queuegraph-average.patch:

Index: queuegraph-average.patch
===================================================================
RCS file: /cvs/pkgs/rpms/queuegraph/F-8/queuegraph-average.patch,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- queuegraph-average.patch	27 Mar 2007 17:07:06 -0000	1.1
+++ queuegraph-average.patch	31 Oct 2007 05:34:42 -0000	1.2
@@ -1,5 +1,5 @@
---- queuegraph/queuegraph/queuegraph-rrd.sh.orig	2007-02-12 02:37:40.000000000 -0700
-+++ queuegraph/queuegraph/queuegraph-rrd.sh	2007-03-25 23:07:38.000000000 -0600
+--- queuegraph/queuegraph-rrd.sh.orig	2007-02-12 02:37:40.000000000 -0700
++++ queuegraph/queuegraph-rrd.sh	2007-03-25 23:07:38.000000000 -0600
 @@ -27,7 +27,7 @@
  	$RRDTOOL create $RRDFILE --step 60 \
  		DS:active:GAUGE:900:0:U \

queuegraph-paths.patch:

Index: queuegraph-paths.patch
===================================================================
RCS file: /cvs/pkgs/rpms/queuegraph/F-8/queuegraph-paths.patch,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- queuegraph-paths.patch	27 Mar 2007 17:07:06 -0000	1.1
+++ queuegraph-paths.patch	31 Oct 2007 05:34:42 -0000	1.2
@@ -1,14 +1,14 @@
---- quegraph/queuegraph/queuegraph-rrd.sh.orig	2007-02-12 02:37:40.000000000 -0700
-+++ quegraph/queuegraph/queuegraph-rrd.sh	2007-03-25 21:06:32.000000000 -0600
-@@ -14,7 +14,7 @@
- # change this to the location of rrdtool
- RRDTOOL=/usr/bin/rrdtool
+--- queuegraph/queuegraph-rrd.sh.orig	2007-02-12 02:37:40.000000000 -0700
++++ queuegraph/queuegraph-rrd.sh	2007-03-25 21:06:32.000000000 -0600
+@@ -15,7 +15,7 @@
+ RRDTOOL=`which rrdtool`
+ 
  # change this to the location you want to store the rrd
 -RRDFILE=/etc/postfix/mailqueues.rrd
 +RRDFILE=/var/lib/queuegraph/mailqueues.rrd
  
  if test ! -x $RRDTOOL ; then
- 	echo "ERROR: $RRDTOOL does not exist or is not executable"
+        echo "ERROR: $RRDTOOL does not exist or is not executable"
 --- queuegraph/queuegraph.cgi.orig	2005-10-24 03:27:09.000000000 -0600
 +++ queuegraph/queuegraph.cgi	2007-03-25 21:53:38.000000000 -0600
 @@ -16,8 +16,8 @@
@@ -16,7 +16,7 @@
  my $ypoints = 160;
  my $ypoints_err = 80;
 -my $rrd = '/etc/postfix/mailqueues.rrd'; # path to where the RRD database is
--my $tmp_dir = '/tmp/queuegraph'; # temporary directory where to store the images
+-my $tmp_dir = '/tmp'; # temporary directory where to store the images
 +my $rrd = '/var/lib/queuegraph/mailqueues.rrd'; # path to where the RRD database is
 +my $tmp_dir = '/var/cache/queuegraph'; # temporary directory where to store the images
  my $rrdtool_1_0 = ($RRDs::VERSION < 1.199908);
@@ -30,14 +30,3 @@
  		mkdir "$tmp_dir/$uri", 0777 unless -d "$tmp_dir/$uri";
  		my $file = "$tmp_dir/$uri$ENV{PATH_INFO}";
  		if($ENV{PATH_INFO} =~ /^\/queuegraph_(\d+)\.png$/) {
---- queuegraph/queuegraph/queuegraph-rrd.sh.orig	2007-02-12 02:37:40.000000000 -0700
-+++ queuegraph/queuegraph/queuegraph-rrd.sh	2007-03-26 00:48:14.000000000 -0600
-@@ -36,7 +36,7 @@
- fi
- 
- #set -x
--qdir=`postconf -h queue_directory`
-+qdir=`/usr/sbin/postconf -h queue_directory`
- active=`find $qdir/incoming $qdir/active $qdir/maildrop -type f -print | wc -l | awk '{print $1}'`
- deferred=`find $qdir/deferred -type f -print | wc -l | awk '{print $1}'`
- #printf "active: %d\ndeferred: %d\n" $active $deferred


Index: queuegraph.conf
===================================================================
RCS file: /cvs/pkgs/rpms/queuegraph/F-8/queuegraph.conf,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- queuegraph.conf	27 Mar 2007 17:07:06 -0000	1.1
+++ queuegraph.conf	31 Oct 2007 05:34:42 -0000	1.2
@@ -3,6 +3,8 @@
 #
 Alias /queuegraph    /usr/share/queuegraph
 
+AddHandler cgi-script .cgi
+
 <Directory /usr/share/queuegraph/>
     AllowOverride None
     Options +ExecCGI


Index: queuegraph.spec
===================================================================
RCS file: /cvs/pkgs/rpms/queuegraph/F-8/queuegraph.spec,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- queuegraph.spec	27 Mar 2007 17:07:06 -0000	1.1
+++ queuegraph.spec	31 Oct 2007 05:34:42 -0000	1.2
@@ -1,6 +1,13 @@
+# Only Fedora & RHEL 5+ can use selinux
+%if 0%{?rhel} && "%rhel" < "5"
+%define without_selinux 1
+%endif
+
+%define selinux_variants mls strict targeted
+
 Name:           queuegraph
 Version:        1.1
-Release:        1%{?dist}%{?repotag:.%{repotag}}
+Release:        2%{?dist}
 Summary:        A RRDtool frontend for Mail statistics
 
 Group:          System Environment/Daemons
@@ -10,10 +17,17 @@
 Source0:        http://www.arschkrebs.de/postfix/queuegraph/queuegraph.tar.gz
 Source1:        queuegraph.conf
 Source2:        queuegraph.cron
+Source3:        queuegraph.te
+Source4:        queuegraph.fc
+Source5:        queuegraph.if
 Patch0:         queuegraph-paths.patch
 Patch1:         queuegraph-average.patch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
+%if ! 0%{?without_selinux}
+BuildRequires:  checkpolicy, selinux-policy-devel, hardlink
+%endif
+
 Requires:       rrdtool, httpd, vixie-cron
 Requires:       perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version))
 
@@ -24,13 +38,44 @@
 produces daily, weekly, monthly and yearly graphs of Postfix's active,
 deferred, incoming and bounce queues.
 
+%if ! 0%{?without_selinux}
+%package selinux
+Summary:        A RRDtool frontend for Mail statistics
+
+Group:          System Environment/Daemons
+%define selinux_policyver %(sed -e 's,.*selinux-policy-\\([^/]*\\)/.*,\\1,' /usr/share/selinux/devel/policyhelp) 
+%if "%{selinux_policyver}" != ""
+Requires:       selinux-policy >= %{selinux_policyver}
+%endif
+Requires:       %{name} = %{version}-%{release}
+
+Requires(post):   /usr/sbin/semodule, /sbin/restorecon, /sbin/fixfiles, %{name}
+Requires(postun): /usr/sbin/semodule, /sbin/restorecon, /sbin/fixfiles, %{name}
+
+%description selinux
+This is the selinux policy for queuegraph.
+%endif
 
 %prep
-%setup -q -c queuegraph
+%setup -q -n %{name}
 %patch0 -p1 -b .paths
 %patch1 -p1 -b .average
 
+%if ! 0%{?without_selinux}
+mkdir selinux
+cp -p %{SOURCE3} %{SOURCE4} %{SOURCE5} ./selinux/
+%endif
+
 %build
+%if ! 0%{?without_selinux}
+cd selinux
+for selinuxvariant in %{selinux_variants}; do
+  make NAME=${selinuxvariant} -f %{_datadir}/selinux/devel/Makefile
+  mv %{name}.pp %{name}.pp.${selinuxvariant}
+  make NAME=${selinuxvariant} -f %{_datadir}/selinux/devel/Makefile clean
+done
+cd -
+%endif
 
 %install
 rm -rf $RPM_BUILD_ROOT
@@ -42,16 +87,58 @@
 %{__install} -d -m 0775 $RPM_BUILD_ROOT/%{_localstatedir}/cache/queuegraph
 
 %{__install} -p -m 0755 queuegraph.cgi $RPM_BUILD_ROOT/%{_datadir}/queuegraph/queuegraph.cgi
-%{__install} -p -m 0755 queuegraph/queuegraph-rrd.sh $RPM_BUILD_ROOT/%{_sbindir}/
+%{__install} -p -m 0755 queuegraph-rrd.sh $RPM_BUILD_ROOT/%{_sbindir}/
 %{__install} -p -m 0644 %SOURCE1 $RPM_BUILD_ROOT/%{_sysconfdir}/httpd/conf.d/
 %{__install} -p -m 0644 %SOURCE2 $RPM_BUILD_ROOT/%{_sysconfdir}/cron.d/queuegraph
 
+%if ! 0%{?without_selinux}
+cd selinux
+for selinuxvariant in %{selinux_variants}; do
+  install -d $RPM_BUILD_ROOT/%{_datadir}/selinux/${selinuxvariant}
+  install -p -m 644 %{name}.pp.${selinuxvariant} \
+    $RPM_BUILD_ROOT/%{_datadir}/selinux/${selinuxvariant}/%{name}.pp
+done
+cd -
+
+# Hardlink identical policy module packages together
+/usr/sbin/hardlink -cv $RPM_BUILD_ROOT/%{_datadir}/selinux
+%endif
+
+
 %clean
 rm -rf $RPM_BUILD_ROOT
 
+%if ! 0%{?without_selinux}
+%post selinux
+for selinuxvariant in %{selinux_variants}; do
+  /usr/sbin/semodule -s ${selinuxvariant} -i \
+    %{_datadir}/selinux/${selinuxvariant}/%{name}.pp &> /dev/null || :
+done
+
+# Fix up non-standard file contexts
+/sbin/fixfiles -R %{name} restore || :
+/sbin/restorecon -R %{_localstatedir}/cache/%{name} || :
+
+%postun selinux
+# Clean up after package removal
+if [ $1 -eq 0 ]; then
+  # Remove SELinux policy modules
+  for selinuxvariant in %{selinux_variants}
+  do
+    /usr/sbin/semodule -s ${selinuxvariant} -r %{name} &> /dev/null || :
+  done
+
+  /sbin/fixfiles -R %{name} restore || :
+
+  # Clean up any remaining file contexts (shouldn't be any really)
+  [ -d %{_localstatedir}/cache/%{name} ] && \
+    /sbin/restorecon -R %{_localstatedir}/cache/%{name} &> /dev/null || :
+fi
+%endif
+
 %files
 %defattr(-,root,root,-)
-%doc queuegraph/README
+%doc README
 %dir %{_localstatedir}/lib/queuegraph
 %dir %attr(0775,root,apache) %{_localstatedir}/cache/queuegraph
 %config(noreplace) %{_sysconfdir}/httpd/conf.d/queuegraph.conf
@@ -59,7 +146,20 @@
 %{_sbindir}/*
 %{_datadir}/queuegraph
 
+%if ! 0%{?without_selinux}
+%files selinux
+%defattr(-,root,root,-)
+%{_datadir}/selinux/*/%{name}.pp
+%doc selinux/*
+%endif
 
 %changelog
+* Tue Oct 30 2007 Bernard Johnson <bjohnson at symetrix.com> - 1.1-2
+- new tarball - no version numbers updated
+- fixed up patches to match new tarball
+- removed repotag
+- Queuegraph needs AddHandler cgi-script .cgi (bz #289031)
+- queuegraph is denied by selinux (bz #247435)
+
 * Sun Mar 25 2007 Bernard Johnson <bjohnson at symetrix.com> - 1.1-1
 - initial release


Index: sources
===================================================================
RCS file: /cvs/pkgs/rpms/queuegraph/F-8/sources,v
retrieving revision 1.2
retrieving revision 1.3
diff -u -r1.2 -r1.3
--- sources	27 Mar 2007 17:07:06 -0000	1.2
+++ sources	31 Oct 2007 05:34:42 -0000	1.3
@@ -1 +1 @@
-2e0c78563cef4fb3195b06e9ee102264  queuegraph.tar.gz
+626729aef1c52b360353e511bc9d4af0  queuegraph.tar.gz


