reorg repo

3 files changed, 266 insertions, 0 deletions

diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..1e65467
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,4 @@
+SRCDIR := $(shell pwd)
+NAME := $(shell basename $(SRCDIR))
+include ../common/Makefile
+
diff --git a/mod_selinux.conf b/mod_selinux.conf
new file mode 100644
index 0000000..a1402a5
--- /dev/null
+++ b/mod_selinux.conf
@@ -0,0 +1,92 @@
+#
+# mod_selinux.conf
+# ----------------
+# Apache/SELinux plus configuration
+
+LoadModule selinux_module modules/mod_selinux.so
+
+selinuxServerDomain	*:s0
+
+#
+# Example for the mapfile based configuration
+# -------------------------------------------
+#
+# <Directory "/var/www/html">
+# #
+# # HTTP Basic Authentication
+# #
+# AuthType	Basic
+# AuthName	"Secret Zone"
+# AuthUserFile	/var/www/htpasswd
+# Require	valid-user
+#
+# #
+# # SELinux domain/range mapping
+# #
+# SetEnvIf Remote_Addr "192.168.1.[0-9]+$" SELINUX_DOMAIN=*:s0:c1
+# SetEnvIf Remote_Addr "192.168.2.[0-9]+$" SELINUX_DOMAIN=*:s0:c2
+# selinuxDomainMap	/var/www/mod_selinux.map
+# selinuxDomainEnv	SELINUX_DOMAIN
+# selinuxDomainVal	anon_webapp_t:SystemLow
+#
+# </Directory>
+
+#
+# Use Case: Virtual Host based separation
+# ---------------------------------------
+#
+# NameVirtualHost *:80
+#
+# <VirtualHost *:80>
+# DocumentRoot          /var/www/html
+# ServerName            dog.example.com
+# selinuxDomainVal      *:s0:c1
+# </VirtualHost>
+#
+# <VirtualHost *:80>
+# DocumentRoot          /var/www/html
+# ServerName            cat.example.com
+# selinuxDomainVal      *:s0:c2
+# </VirtualHost>
+
+#
+# Use Case: Authentication integration with RDBMS
+# -----------------------------------------------
+#
+# LoadModule dbd_module        modules/mod_dbd.so
+# LoadModule authn_dbd_module  modules/mod_authn_dbd.so
+#
+# DBDriver    pgsql
+# DBDParams  "dbname=web user=apache"
+# # NOTE: Don't forget to install apr-util-pgsql package
+# #       to connect PostgreSQL via mod_dbd.
+#
+# <Directory "/var/www/html">
+# # Digest authentication
+# # ---------------------
+# # AuthType               Digest
+# # AuthName               "Secret Zone"
+# # AuthDigestProvider     dbd                  ... (4)
+# # AuthDBDUserRealmQuery  \                    ... (5)
+# #     "SELECT md5(uname || ':' || $2 || ':' || upass), udomain, \
+# #             %s=%s as dummy FROM uaccount WHERE uname = $1"
+#
+# # SELinux context mapping
+# # -----------------------
+# selinuxDomainEnv         AUTHENTICATE_UDOMAIN ... (6)
+# selinuxDomainVal         anon_webapp_t:SystemLow
+# </Directory>
+#
+# We assume the PostgreSQL works on local machine, and it allows
+# the apache user to connect the web database without passwords.
+# In addition, uaccount table should be defined as follows:
+#
+#  CREATE TABLE uaccount (
+#      uname     TEXT PRIMARY KEY,
+#      upass     TEXT NOT NULL,
+#      udomain   TEXT
+#  );
+#  INSERT INTO uaccount VALUES ('foo', 'xxx', 'user_webapp_t:s0:c0');
+#  INSERT INTO uaccount VALUES ('var', 'yyy', 'staff_webapp_t:s0:c1');
+#  INSERT INTO uaccount VALUES ('baz', 'zzz', 'anon_webapp_t:s0:c2');
+#
diff --git a/mod_selinux.spec b/mod_selinux.spec
new file mode 100644
index 0000000..4505e37
--- /dev/null
+++ b/mod_selinux.spec
@@ -0,0 +1,170 @@
+%{!?_httpd_apxs: %{expand: %%global _httpd_apxs %%{_sbindir}/apxs}}
+%{!?_httpd_mmn: %{expand: %%global _httpd_mmn %%(cat %{_includedir}/httpd/.mmn || echo missing-httpd-devel)}}
+# /etc/httpd/conf.d with httpd < 2.4 and defined as /etc/httpd/conf.modules.d with httpd >= 2.4
+%{!?_httpd_modconfdir: %{expand: %%global _httpd_modconfdir %%{_sysconfdir}/httpd/conf.d}}
+%{!?_httpd_confdir:    %{expand: %%global _httpd_confdir    %%{_sysconfdir}/httpd/conf.d}}
+%{!?_httpd_moddir:    %{expand: %%global _httpd_moddir    %%{_libdir}/httpd/modules}}
+
+%define selinux_policy_types targeted mls
+
+Name: mod_selinux
+Version: 2.2.2454
+Release: 5%{?dist}
+Summary: Apache/SELinux plus module
+Group: System Environment/Daemons
+License: ASL 2.0
+URL: http://code.google.com/p/sepgsql/
+Source0: http://sepgsql.googlecode.com/files/%{name}-%{version}.tgz
+Source1: %{name}.conf
+BuildRequires: httpd-devel >= 2.2.0 libselinux-devel checkpolicy >= 2.0.19 policycoreutils selinux-policy-devel
+Requires: kernel >= 2.6.28 httpd >= 2.2.0 policycoreutils selinux-policy
+Requires: httpd-mmn = %{_httpd_mmn}
+BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
+
+%description
+The Apache/SELinux plus is an extra module (mod_selinux.so) which enables
+to launch contents-handler (it means both of references to static contents
+and invocations of web applications) with individual and restrictive
+privileges set, based on http authentication.
+The mod_selinux.so generates a one-time worker thread for each request,
+and it assigns the worker restrictive domain based on the authentication
+prior to launching contents handlers.
+It means we can apply valid access controls on web-applications, and
+makes assurance operating system can prevent violated accesses, even if
+web application contains security bugs or vulnerabilities.
+
+%prep
+%setup -q
+
+%build
+# mod_selinux.so
+%{__make} %{?_smp_mflags} APXS=%{_httpd_apxs}
+
+# mod_selinux.pp
+for policy in %{selinux_policy_types}
+do
+    %{__make} NAME=${policy} -f %{?policy_devel_root}%{_datadir}/selinux/devel/Makefile
+    mv %{name}.pp %{name}.pp.${policy}
+done
+
+%install
+rm -rf %{buildroot}
+%{__install} -d %{buildroot}%{_libdir}/httpd/modules
+%{__install} -d %{buildroot}%{_datadir}/selinux
+
+%{__make} install DESTDIR=%{buildroot}
+
+%if "%{_httpd_modconfdir}" != "%{_httpd_confdir}"
+# httpd 2.4.x config
+sed -n /^LoadModule/p %{SOURCE1} > 10-mod_selinux.conf
+sed    /^LoadModule/d %{SOURCE1} > mod_selinux.conf
+touch -r %{SOURCE1} *.conf
+install -Dp 10-mod_selinux.conf %{buildroot}%{_httpd_modconfdir}/10-mod_selinux.conf
+install -Dp mod_selinux.conf %{buildroot}%{_httpd_confdir}/mod_selinux.conf
+%else
+# httpd 2.2.x
+install -Dp -m 644 %{SOURCE1}       %{buildroot}%{_httpd_confdir}/mod_selinux.conf
+%endif
+
+for policy in %{selinux_policy_types}
+do
+    %{__install} -d %{buildroot}%{_datadir}/selinux/${policy}
+    %{__install} -p -m 644 %{name}.pp.${policy} \
+               %{buildroot}%{_datadir}/selinux/${policy}/%{name}.pp
+done
+
+%clean
+rm -rf %{buildroot}
+
+%post
+/sbin/fixfiles -R %{name} restore || :
+
+for policy in %{selinux_policy_types}
+do
+    %{_sbindir}/semodule -s ${policy} \
+        -i %{_datadir}/selinux/${policy}/%{name}.pp 2>/dev/null || :
+done
+
+%postun
+# unload policy, if rpm -e
+if [ $1 -eq 0 ]; then
+    for policy in %{selinux_policy_types}
+    do
+        %{_sbindir}/semodule -s ${policy} -r %{name} 2>/dev/null || :
+    done
+fi
+
+%files
+%defattr(-,root,root,-)
+%doc LICENSE README
+%if "%{_httpd_modconfdir}" != "%{_httpd_confdir}"
+%config(noreplace) %{_httpd_modconfdir}/*.conf
+%endif
+%config(noreplace) %{_httpd_confdir}/*.conf
+%{_libdir}/httpd/modules/%{name}.so
+%{_datadir}/selinux/*/%{name}.pp
+
+%changelog
+* Tue May  1 2012 Joe Orton <jorton@redhat.com> - 2.2.2454-5
+- packaging fixes (#803075)
+
+* Fri Jan 13 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.2.2454-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
+
+* Tue Feb 08 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.2.2454-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
+
+* Fri Dec  4 2009 KaiGai Kohei <kaigai@ak.jp.nec.com> - 2.2.2454-2
+- rebuild for the base policy of F-13
+
+* Sat Jul 25 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.2.2015-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
+
+* Thu Jun 11 2009 KaiGai Kohei <kaigai@ak.jp.nec.com> - 2.2.2015-1
+- update: add support to use translated format in MLS-range
+
+* Wed May 27 2009 KaiGai Kohei <kaigai@ak.jp.nec.com> - 2.2.1938-1
+- bugfix: it may returns OK, instead of HTTP_INTERNAL_SERVER_ERROR,
+    when the contents handler crashed.
+
+* Fri May 22 2009 KaiGai Kohei <kaigai@ak.jp.nec.com> - 2.2.1930-1
+- rework: libselinux was dropped from explicit dependencies due to
+    http://fedoraproject.org/wiki/Packaging/Guidelines#Explicit_Requires
+
+* Tue May 19 2009 KaiGai Kohei <kaigai@ak.jp.nec.com> - 2.2.1904-1
+- bugfix: update Makefile to allow to build for 64bit architecture
+
+* Mon May 18 2009 KaiGai Kohei <kaigai@ak.jp.nec.com> - 2.2.1903-1
+- rework: add selinux_merge_conf()
+- rework: remove mod_authn_sepgsql, instead of documentation
+          to use mod_authn_dbd with pgsql driver.
+
+* Fri May 15 2009 KaiGai Kohei <kaigai@ak.jp.nec.com> - 2.2.1898-1
+- rework: mod_authn_sepgsql cleanups
+- update: README updates.
+
+* Wed May 13 2009 KaiGai Kohei <kaigai@ak.jp.nec.com> - 2.2.1884-1
+- rework: add mod_authn_sepgsql module
+- rework: directives were reorganized
+- rework: simultaneous usage with keep-alive
+
+* Fri Apr 17 2009 KaiGai Kohei <kaigai@ak.jp.nec.com> - 2.2.1817-1
+- bugfix: add kernel >= 2.6.28 because of typebounds feature
+
+* Thu Apr 16 2009 KaiGai Kohei <kaigai@ak.jp.nec.com> - 2.2.1803-1
+- rework: reverted to multi-threading design
+- bugfix: security policy didn't allow prosess:{setcurrent}
+
+* Wed Apr 15 2009 KaiGai Kohei <kaigai@ak.jp.nec.com> - 2.2.1800-1
+- rework: worker was redesigned to use a process, instead of thread,
+          on process_connection hook.
+- rework: "selinuxAllowCaches" and "selinuxAllowKeepAlive" were added.
+- rework: README was revised
+
+* Tue Apr 14 2009 KaiGai Kohei <kaigai@ak.jp.nec.com> - 2.2.1795-1
+- bugfix: install script didn't work correctly.
+- update: add some of inline source comments.
+- update: specfile improvement.
+
+* Sun Apr 12 2009 KaiGai Kohei <kaigai@ak.jp.nec.com> - 2.2.1792-1
+- Initial build