The SELinux Modularity prototype is under heavy development and all, or portions, of this page may be incorrect and/or incomplete.
Prerequisites
The SELinux Modularity prototype described here has the following dependencies.
Fedora 26
While it may be possible to duplicate the prototype described here on other versions of Fedora, Fedora 26 is strongly recommended. Help on installing Fedora can be found in the Fedora Installation Guide.
Fedora Module Developer Packages
In order to build Fedora Modules the module-build-service package must be installed. While the package may be available via the normal DNF installation mechanism, due to the rapid development of the Fedora Modularity mechanisms it is recommended that the latest package be obtained from Koji.
# dnf install module-build-service
SELinux Developer Packages
The following is only necessary for local testing of the selinux policy package since the policy build is otherwise done by the module-build-service.
# dnf install selinux-policy-devel rpm-build
DNF (module support)
To install the module, DNF with module support has to be installed. It can be obtained from mhatina's copr repository
# dnf copr enable mhatina/DNF-Modules # dnf update dnf
Building the memcached Module
The Fedora Modularity project has more information on building modules on their website.
The memcached module source is currently maintained in the Fedora Project's module repository. The first step to building the memcached module is cloning the remote repository:
# git clone https://src.fedoraproject.org/git/modules/memcached.git Cloning into 'memcached'... remote: Counting objects: 93, done. remote: Compressing objects: 100% (86/86), done. remote: Total 93 (delta 38), reused 0 (delta 0) Unpacking objects: 100% (93/93), done.
Once the repository has been cloned, you can enter the local repository and build the memcached module with the mbs-build command:
# cd memcached # mbs-build local ... [the build process may take some time to complete] ... Resulting module repository can be found at /root/modulebuild/builds/module-memcached-f26-<build-id>
Including SELinux policy package
To include new package into the module, it's source repository has to be provided and listed in the modulemd file (in this case memcached.yaml). Source repository for memcached-selinux is currently located at pagure. For details on how to create custom SELinux policy rpm package, please visit lvrabec's blog.
Use this pagure repository containing memcached module source with all the adjustments needed to include the SELinux policy package, or follow the following steps to edit memcached module repository mentioned above.
Add memcached selinux under components:
memcached-selinux:
rationale: SELinux policy package for memcached.
repository: https://pagure.io/memcached-selinux.git
ref: master
And edit default profile:
default:
rpms:
- memcached
- memcached-selinux
Module build service needs to be configured to allow building packages form custom repositories. To do so, set RPMS_ALLOW_REPOSITORY and RPMS_ALLOW_CACHE to True in /etc/module-build-service/config.py file.
Installation
If needed, individual packages contained within the module can be installed using dnf shipped with fedora.
Module repository created by mbs-build local can be made visible to dnf by creating repository file in /etc/yum.repos.d/ as follows.
# cat /etc/yum.repos.d/local.repo [local] name = local baseurl = file:///root/modulebuild/builds/module-memcached-f26-<module-id>/results/ enabled=1 gpgcheck=0 modules=1 # dnf module list Name Stream Version Repo Installed Info memcached f26 20170728100714 local High Performance, Distributed Memory Object Cache # dnf module info memcached ...[memcached module info]... # dnf module install/default