What is the proper way to set SELinux context in an RPM .spec?

Question

I am trying to build an RPM that targets RHEL4 and 5. Right now I call chcon from %post but multiple Google entries say "that's not how you are supposed to do it" with very limited help on the right way. I've also noticed that fixfiles -R mypackage check says the files are wrong when they are right (as expected; the RPM DB doesn't realize what I want)..

• I specifically say RHEL4 because it does not have semanage which seems to be one of the proper ways to do it. (Add a new policy and then run restorecon on your directories in %post.)

  • I also don't need my own context, just httpd_cache_t on a non-standard directory.

• I have also seen "let cpio take care of it" - but then I have a new problem that a non-root RPM building user cannot run chcon on the build directories. I cheated and had sudo in the spec file but that didn't seem to matter anyway.

Answer 1

The Fedora Packaging Guidelines have a draft document explaining how to handle SELinux in packages, and they use semanage. Without semanage, it looks like supporting RHEL 4 is going to be a hack, and there's no way around that.

According to the rpm 4.9.0 release notes, there has been some support directly in rpm for managing SELinux policies, but it has historically been broken:

• Older versions of RPM supported a %policy directive in spec for attaching SELinux policies into the package header, but this was never really usable for anything. Any uses of the %policy directive in specs should be removed as this unused directive prevents building with RPM 4.9.0 and later, while not doing anything for older versions.
• Starting with RPM 4.9.0, SELinux policy packaging is supported via new %sepolicy section in the spec. Such packages cannot be built, but are installable on older RPM versions too (but the included policies will not be used in any way).

I see no mention of file contexts there, and I haven't been able to find any mention of direct file context support (like %attr in the %files section). In any case, it looks like RHEL 6 is only on rpm 4.8.0, so (unless I've missed something) the semanage route is as good as we're going to be able to do at least until RHEL 7.