Add selinux policy to allow cvmfs reading fuse fs

It fixes: cvmfs/collectd-cvmfs#5

python-collectd_cvmfs.spec

@@ -14,6 +14,8 @@ BuildArch:      noarch
 BuildRequires:  python3-devel
 BuildRequires:  python3dist(setuptools)
 
+BuildRequires:  selinux-policy-devel
+
 %description
 Collectd module for CvmFS clients
 
@@ -24,9 +26,19 @@ Summary:        %{summary}
 Requires:       python3dist(psutil)
 Requires:       python3dist(pyxattr)
 Requires:       collectd-python
+Requires:       %{name}-selinux = %{version}-%{release}
+
 %description -n python3-%{pypi_name}
 Collectd module for CvmFS clients
 
+%package selinux
+Summary:        selinux policy for collectd cvmfs plugin
+Requires:       selinux-policy
+Requires:       policycoreutils
+
+%description selinux
+This package contains selinux rules to allow the collectd
+cvmfs plugin to read fuse file systems.
 
 %prep
 %autosetup -n collectd-cvmfs-%{version}
@@ -39,13 +51,29 @@ rm -rf %{pypi_name}.egg-info
 %install
 %py3_install
 
+mkdir -p %{buildroot}%{_datadir}/selinux/packages/%{name}
+install -m 644 -p collectd_cvmfs.pp \
+    %{buildroot}%{_datadir}/selinux/packages/%{name}/collectd_cvmfs.pp
+
+%post selinux
+/usr/sbin/semodule -i %{_datadir}/selinux/packages/%{name}/collectd_cvmfs.pp >/dev/null 2>&1 || :
+
+%postun selinux
+if [ $1 -eq 0 ] ; then
+    /usr/sbin/semodule -r collectd_cvmfs >/dev/null 2>&1 || :
+fi
+
+
 %files -n python3-%{pypi_name}
 %doc README.rst NEWS.txt
 %license LICENSE
 %{python3_sitelib}/%{pypi_name}
 %{python3_sitelib}/%{pypi_name}-%{version}-py?.?.egg-info
 %{_prefix}/share/collectd/%{pypi_name}.db
 
+%files selinux
+%{_datadir}/selinux/packages/%{name}/collectd_cvmfs.pp
+
 %changelog
 * Fri Jul 13 2018 Fedora Release Engineering <[email protected]> - 1.0.2-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild