Skip to content

fix: include role.cil, context file, and semanage in make install #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Amy-Ra-lph wants to merge 2 commits into
base: main
Choose a base branch
from
Open

fix: include role.cil, context file, and semanage in make install #1

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4fd49f7
fix: include role.cil and context file in make install
Amy-Ra-lph Jun 1, 2026
3868a76
fix: use s0 as default MCS range, make it configurable
Amy-Ra-lph Jun 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 11 additions & 1 deletion policy/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,9 +4,13 @@ DENY_POLICIES := blastwall-alg-socket-deny blastwall-bpf-deny blastwall-policy-s
VERSION := 0.5.2
SELINUX_DEVEL ?= /usr/share/selinux/devel

ROLE_CIL := blastwall-role.cil
SUPPORT_CIL := $(addsuffix .cil,$(SUPPORT_POLICIES))
DENY_CIL := $(addsuffix .cil,$(DENY_POLICIES))
ALL_CIL := $(SUPPORT_CIL) $(DENY_CIL)
ALL_CIL := $(ROLE_CIL) $(SUPPORT_CIL) $(DENY_CIL)
CONTEXT_FILE := contexts/blastwall_u
CONTEXT_DIR := /etc/selinux/targeted/contexts/users
SELINUX_MCS ?= s0

.PHONY: all clean install uninstall check

Expand All @@ -22,11 +26,17 @@ check:

install: $(POLICY).pp
semodule -i $(POLICY).pp $(ALL_CIL)
install -m 0644 $(CONTEXT_FILE) $(CONTEXT_DIR)/blastwall_u
semanage user -a -R "blastwall_r" -r "$(SELINUX_MCS)" blastwall_u 2>/dev/null || \
semanage user -m -R "blastwall_r" -r "$(SELINUX_MCS)" blastwall_u

uninstall:
@for p in $(DENY_POLICIES); do semodule -r $$p 2>/dev/null || true; done
@for p in $(SUPPORT_POLICIES); do semodule -r $$p 2>/dev/null || true; done
-semodule -r blastwall-role
-semodule -r $(POLICY)
-semanage user -d blastwall_u 2>/dev/null
-rm -f $(CONTEXT_DIR)/blastwall_u

clean:
rm -f *.pp *.mod *.fc.tmp
Expand Down