Fix include semanage/handle.h for semanage_set_root() as used by semodule

PATCH In review Guido Trentalancia 5 participants 78 messages Sep 9, 2011 – Sep 17, 2011 Page 1 of 2

Subsystems (2)

Kbuild SELinux security module

lore

Share & tools

lore

Guido Trentalancia

author

2011-09-09 17:02 UTC #0 lore raw

PATCH 1/1 Fix include semanage/handle.h for semanage_set_root() as used by semodule

Hello,

I am not able to build semodule from the current git unless the following patch is applied.

Also, it would still be problematic if an outdated version of handle.h is getting picked up directly from the root include directory (as it happens now) and not from the local build directory... In other words, the Makefile and build system should be modified so that the local header files are picked up during each new build rather than the system-wide ones from previous installations.

But at least this is a start:

Include <semanage/handle.h> for semodule_set_root() currently used by semodule

policycoreutils/semodule/semodule.c +1 -0

@@ -21,6 +21,7 @@
 #include <sys/types.h>
 
 #include <semanage/modules.h>
+#include <semanage/handle.h>
 
 enum client_modes { NO_MODE, INSTALL_M, UPGRADE_M, BASE_M, ENABLE_M, DISABLE_M, REMOVE_M,
 	LIST_M, RELOAD

--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

Guido Trentalancia

author

2011-09-09 17:11 UTC #1 lore raw

Heads-up. No patch is needed for the semanage files (as the new semanage/modules.h file already includes semanage/handle.h).

It's probably just the build system that needs to be modified to include the local header files during the build process instead of the already installed system-wide ones.

Otherwise the libraries need to be installed beforehand ?

Regards,

Guido

Quoted 29 lines · Guido Trentalancia

Hello,
I am not able to build semodule from the current git unless the following patch is applied.
Also, it would still be problematic if an outdated version of handle.h is getting picked up directly from the root include directory (as it happens now) and not from the local build directory... In other words, the Makefile and build system should be modified so that the local header files are picked up during each new build rather than the system-wide ones from previous installations.
But at least this is a start:
Include <semanage/handle.h> for semodule_set_root() currently used by semodule
policycoreutils/semodule/semodule.c +1 -1
@@ -21,6 +21,7 @@
 #include <sys/types.h>
 
 #include <semanage/modules.h>
+#include <semanage/handle.h>
 
 enum client_modes { NO_MODE, INSTALL_M, UPGRADE_M, BASE_M, ENABLE_M, DISABLE_M, REMOVE_M,
 	LIST_M, RELOAD
 
 
--

Quoted 4 lines

This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

Guido Trentalancia

author

2011-09-09 17:17 UTC #2 lore raw

In reply to Guido Trentalancia

It only happens when building from git (because it uses the top-level Makefile which is not being distributed with the released components).

Quoted 29 lines · Guido Trentalancia

Hello,
I am not able to build semodule from the current git unless the following patch is applied.
Also, it would still be problematic if an outdated version of handle.h is getting picked up directly from the root include directory (as it happens now) and not from the local build directory... In other words, the Makefile and build system should be modified so that the local header files are picked up during each new build rather than the system-wide ones from previous installations.
But at least this is a start:
Include <semanage/handle.h> for semodule_set_root() currently used by semodule
policycoreutils/semodule/semodule.c +1 -1
@@ -21,6 +21,7 @@
 #include <sys/types.h>
 
 #include <semanage/modules.h>
+#include <semanage/handle.h>
 
 enum client_modes { NO_MODE, INSTALL_M, UPGRADE_M, BASE_M, ENABLE_M, DISABLE_M, REMOVE_M,
 	LIST_M, RELOAD
 
 
--

Quoted 4 lines

This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

Eric Paris

2011-09-09 17:31 UTC #3 lore raw

I'm also really annoyed by this at times, but I don't know what the right answer is.

We really treat it like we have 5+ separate projects which just all happen to live in the same git tree. Thus to build libselinux you must have already built and installed libsepol. And then to build libsemanage you need to have done that with both libsepol and libselinux. Then of course to get the builds and install right (on Fedora/RHEL) you have to know to use LIBDIR=/usr/lib64 SHLIBDIR=/lib64 for libsepol and libsepol, but SHLIBDIR=/usr/lib64 for libsemanage. Its a mess, but I don't know what to do that's better....

-Eric

Quoted 32 lines · Guido Trentalancia

It only happens when building from git (because it uses the top-level Makefile which is not being distributed with the released components).
Quoted 28 lines · Guido Trentalancia
Hello,
I am not able to build semodule from the current git unless the following patch is applied.
Also, it would still be problematic if an outdated version of handle.h is getting picked up directly from the root include directory (as it happens now) and not from the local build directory... In other words, the Makefile and build system should be modified so that the local header files are picked up during each new build rather than the system-wide ones from previous installations.
But at least this is a start:
Include <semanage/handle.h> for semodule_set_root() currently used by semodule
policycoreutils/semodule/semodule.c 2011-09-09 18:41:24.078319022 +0200 renamed from policycoreutils/semodule/semodule.c 2011-09-02 04:19:47.357716917 +0200 +1 -0
@@ -21,6 +21,7 @@
  #include <sys/types.h>
 
  #include <semanage/modules.h>
+#include <semanage/handle.h>
 
  enum client_modes { NO_MODE, INSTALL_M, UPGRADE_M, BASE_M, ENABLE_M, DISABLE_M, REMOVE_M,
LIST_M, RELOAD

Quoted 13 lines

Quoted 5 lines
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

Guido Trentalancia

author

2011-09-09 17:46 UTC #4 lore raw

Quoted 2 lines · Eric Paris

I'm also really annoyed by this at times, but I don't know what the right answer is.

Well, as long as it is a git-only thing, perhaps a README file would do.

It could be improved too...

For example, load_policy does not honour LIBDIR or SHLIBDIR:

--- selinux-05092011/policycoreutils/load_policy/Makefile 2011-09-02
04:19:47.317716618 +0200
+++ selinux-05092011-fix-LIBDIR/policycoreutils/load_policy/Makefile

2011-09-09 19:44:23.710064117 +0200

@@ -3,11 +3,12 @@ PREFIX ?= ${DESTDIR}/usr
SBINDIR ?= $(DESTDIR)/sbin
USRSBINDIR ?= $(PREFIX)/sbin
MANDIR ?= $(PREFIX)/share/man
+LIBDIR ?= $(PREFIX)/usr/lib
LOCALEDIR ?= /usr/share/locale

CFLAGS ?= -Werror -Wall -W
override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DUSE_NLS
-DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\"" -LDLIBS += -lsepol -lselinux -L$(PREFIX)/lib
+LDLIBS += -lsepol -lselinux -L$(LIBDIR)

TARGETS=$(patsubst %.c,%,$(wildcard *.c))

Quoted 9 lines

We really treat it like we have 5+ separate projects which just all happen to live in the same git tree. Thus to build libselinux you must have already built and installed libsepol. And then to build libsemanage you need to have done that with both libsepol and libselinux. Then of course to get the builds and install right (on Fedora/RHEL) you have to know to use LIBDIR=/usr/lib64 SHLIBDIR=/lib64 for libsepol and libsepol, but SHLIBDIR=/usr/lib64 for libsemanage. Its a mess, but I don't know what to do that's better....

Quoted 50 lines

-Eric
Quoted 45 lines · Guido Trentalancia
It only happens when building from git (because it uses the top-level Makefile which is not being distributed with the released components).
Quoted 29 lines · Guido Trentalancia
Hello,
I am not able to build semodule from the current git unless the following patch is applied.
Also, it would still be problematic if an outdated version of handle.h is getting picked up directly from the root include directory (as it happens now) and not from the local build directory... In other words, the Makefile and build system should be modified so that the local header files are picked up during each new build rather than the system-wide ones from previous installations.
But at least this is a start:
Include <semanage/handle.h> for semodule_set_root() currently used by semodule
policycoreutils/semodule/semodule.c 2011-09-09 18:41:24.078319022 +0200 renamed from policycoreutils/semodule/semodule.c 2011-09-02 04:19:47.357716917 +0200 +1 -1
@@ -21,6 +21,7 @@
 #include <sys/types.h>
 
 #include <semanage/modules.h>
+#include <semanage/handle.h>
 
 enum client_modes { NO_MODE, INSTALL_M, UPGRADE_M, BASE_M, ENABLE_M, DISABLE_M, REMOVE_M,
      LIST_M, RELOAD
 
 
--
Quoted 4 lines
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

Guido Trentalancia

author

2011-09-09 17:59 UTC #5 lore raw

PATCH 1/1 Fix LIBDIR usage for load_policy (was Re: [PATCH] Fix include semanage/handle.h for semanage_set_root() as used by semodule)

Quoted 9 lines · Guido Trentalancia

Quoted 2 lines · Eric Paris
I'm also really annoyed by this at times, but I don't know what the right answer is.
Well, as long as it is a git-only thing, perhaps a README file would do.
It could be improved too...
For example, load_policy does not honour LIBDIR or SHLIBDIR:

It was in a broken format and now I've also changed the subject. The following one should be better:

policycoreutils/load_policy/Makefile +2 -1

@@ -3,11 +3,12 @@ PREFIX ?= ${DESTDIR}/usr
 SBINDIR ?= $(DESTDIR)/sbin
 USRSBINDIR ?= $(PREFIX)/sbin
 MANDIR ?= $(PREFIX)/share/man
+LIBDIR ?= $(PREFIX)/usr/lib
 LOCALEDIR ?= /usr/share/locale
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lsepol -lselinux -L$(PREFIX)/lib
+LDLIBS += -lsepol -lselinux -L$(LIBDIR)
 
 TARGETS=$(patsubst %.c,%,$(wildcard *.c))

The top-level Makefile could be improved too perhaps...

Quoted 83 lines

--- selinux-05092011/policycoreutils/load_policy/Makefile 2011-09-02
04:19:47.317716618 +0200
+++ selinux-05092011-fix-LIBDIR/policycoreutils/load_policy/Makefile
2011-09-09 19:44:23.710064117 +0200
(quoted diff) +2 -2
@@ -3,11 +3,12 @@ PREFIX ?= ${DESTDIR}/usr
 SBINDIR ?= $(DESTDIR)/sbin
 USRSBINDIR ?= $(PREFIX)/sbin
 MANDIR ?= $(PREFIX)/share/man
+LIBDIR ?= $(PREFIX)/usr/lib
 LOCALEDIR ?= /usr/share/locale
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DUSE_NLS
-DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lsepol -lselinux -L$(PREFIX)/lib
+LDLIBS += -lsepol -lselinux -L$(LIBDIR)
 
 TARGETS=$(patsubst %.c,%,$(wildcard *.c))
Quoted 12 lines
We really treat it like we have 5+ separate projects which just all happen to live in the same git tree. Thus to build libselinux you must have already built and installed libsepol. And then to build libsemanage you need to have done that with both libsepol and libselinux. Then of course to get the builds and install right (on Fedora/RHEL) you have to know to use LIBDIR=/usr/lib64 SHLIBDIR=/lib64 for libsepol and libsepol, but SHLIBDIR=/usr/lib64 for libsemanage. Its a mess, but I don't know what to do that's better....
Quoted 50 lines
-Eric
Quoted 45 lines · Guido Trentalancia
It only happens when building from git (because it uses the top-level Makefile which is not being distributed with the released components).
Quoted 29 lines · Guido Trentalancia
Hello,
I am not able to build semodule from the current git unless the following patch is applied.
Also, it would still be problematic if an outdated version of handle.h is getting picked up directly from the root include directory (as it happens now) and not from the local build directory... In other words, the Makefile and build system should be modified so that the local header files are picked up during each new build rather than the system-wide ones from previous installations.
But at least this is a start:
Include <semanage/handle.h> for semodule_set_root() currently used by semodule
policycoreutils/semodule/semodule.c 2011-09-09 18:41:24.078319022 +0200 renamed from policycoreutils/semodule/semodule.c 2011-09-02 04:19:47.357716917 +0200 +1 -1
@@ -21,6 +21,7 @@
 #include <sys/types.h>
 
 #include <semanage/modules.h>
+#include <semanage/handle.h>
 
 enum client_modes { NO_MODE, INSTALL_M, UPGRADE_M, BASE_M, ENABLE_M, DISABLE_M, REMOVE_M,
      LIST_M, RELOAD
 
 
--
Quoted 4 lines
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

Quoted 5 lines

--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

Guido Trentalancia

author

2011-09-09 21:19 UTC #6 lore raw

RFC 1/1 Userspace top-level Makefile (was Re: [PATCH] Fix LIBDIR usage for load_policy)

So either a top-level README file is introduced (to explictly recommend to build the libraries first):

README +21 -0

@@ -0,0 +1,21 @@
+INSTALLATION:
+
+First build and install the libraries (libsepol, libselinux and libsemanage) by typing
+"make" and then "make install" in each directory.
+
+Finally build and install the userspace tools (sepolgen, checkpolicy and policycoreutils) by
+typing "make" and then "make install" in each directory.
+
+---
+
+The environment variables CFLAGS and LDFLAGS can be passed to "make" to use custom compiler
+and/or linker flags (for example: CFLAGS="-fPIC -DSHARED" LDFLAGS="-ldl").
+
+The environment variables LIBDIR and SHLIBDIR can be passed to "make" in order to configure
+different directories for the libraries (e.g. LIBDIR=/usr/lib64 and SHLIBDIR=/usr/lib64
+on 64-bit systems).
+
+The environment variable PREFIX can be passed to "make" in order to configure an install
+prefix other than "/usr".
+
+Please see the Makefile(s) for other environment variables that can be used.

And/or a warning could be printed out by the top-level Makefile:

Makefile +7 -1

@@ -1,4 +1,6 @@
-SUBDIRS=libsepol libselinux libsemanage sepolgen checkpolicy policycoreutils # policy
+SUBDIRS_BIN=sepolgen checkpolicy policycoreutils
+SUBDIRS_LIB=libsepol libselinux libsemanage
+SUBDIRS=$(SUBDIRS_LIB) $(SUBDIRS_BIN)
 PYSUBDIRS=libselinux libsemanage
 DISTCLEANSUBIDRS=libselinux libsemanage

@@ -11,6 +13,10 @@ all install relabel clean test indent:
 	@for subdir in $(SUBDIRS); do \
 		(cd $$subdir && $(MAKE) $@) || exit 1; \
 	done
+	@echo
+	@echo -n "Do not forget to install the libraries ($(SUBDIRS_LIB))"
+	@echo " before trying to build the userspace tools ($(SUBDIRS_BIN))."
+	@echo
 
 install-pywrap swigify:
 	@for subdir in $(PYSUBDIRS); do \

Or the top-level Makefile could install the libraries automatically (really awful as it is and NOT recommended, however on my system it works fine with CFLAGS="-fPIC -DSHARED" and LDFLAGS="-ldl"):

Makefile +23 -3

@@ -1,4 +1,5 @@
-SUBDIRS=libsepol libselinux libsemanage sepolgen checkpolicy policycoreutils # policy
+SUBDIRS=libsepol libselinux libsemanage
+SUBDIRS_BIN=sepolgen checkpolicy policycoreutils # policy
 PYSUBDIRS=libselinux libsemanage
 DISTCLEANSUBIDRS=libselinux libsemanage

@@ -7,9 +8,20 @@ ifeq ($(DEBUG),1)
 	export LDFLAGS = -g
 endif
 
-all install relabel clean test indent:
+all relabel test indent:
 	@for subdir in $(SUBDIRS); do \
-		(cd $$subdir && $(MAKE) $@) || exit 1; \
+		(cd $$subdir && $(MAKE) $@ && $(MAKE) install) || exit 1; \
+	done
+	@for subdir_bin in $(SUBDIRS_BIN); do \
+		(cd $$subdir_bin && $(MAKE) $@) || exit 1; \
+	done
+
+install:
+	@for subdir in $(SUBDIRS); do \
+		(cd $$subdir && $(MAKE) install) || exit 1; \
+	done
+	@for subdir_bin in $(SUBDIRS_BIN); do \
+		(cd $$subdir_bin && $(MAKE) install) || exit 1; \
 	done
 
 install-pywrap swigify:

@@ -17,6 +29,14 @@ install-pywrap swigify:
 		(cd $$subdir && $(MAKE) $@) || exit 1; \
 	done
 
+clean:
+	@for subdir in $(SUBDIRS); do \
+		(cd $$subdir && $(MAKE) $@) || exit 1; \
+	done
+	@for subdir_bin in $(SUBDIRS_BIN); do \
+		(cd $$subdir_bin && $(MAKE) $@) || exit 1; \
+	done
+
 distclean:
 	@for subdir in $(DISTCLEANSUBDIRS); do \
 		(cd $$subdir && $(MAKE) $@) || exit 1; \

The above methods are intended to make the build process (for the userspace git version only) a little bit more user-friendly since the tools might not build if the libraries are not already installed on the system (because, for example, some header files from the libraries are getting included from the system-wide include directory rather than from the local build tree).

A previosly posted patch to honour the environment variable LIBDIR in load_policy is also suggested (both for git and released versions).

Regards,

Guido

Quoted 124 lines · Guido Trentalancia

Quoted 9 lines · Guido Trentalancia
Quoted 2 lines · Eric Paris
I'm also really annoyed by this at times, but I don't know what the right answer is.
Well, as long as it is a git-only thing, perhaps a README file would do.
It could be improved too...
For example, load_policy does not honour LIBDIR or SHLIBDIR:
It was in a broken format and now I've also changed the subject. The following one should be better:
policycoreutils/load_policy/Makefile +2 -1
@@ -3,11 +3,12 @@ PREFIX ?= ${DESTDIR}/usr
 SBINDIR ?= $(DESTDIR)/sbin
 USRSBINDIR ?= $(PREFIX)/sbin
 MANDIR ?= $(PREFIX)/share/man
+LIBDIR ?= $(PREFIX)/usr/lib
 LOCALEDIR ?= /usr/share/locale
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lsepol -lselinux -L$(PREFIX)/lib
+LDLIBS += -lsepol -lselinux -L$(LIBDIR)
 
 TARGETS=$(patsubst %.c,%,$(wildcard *.c))
 
The top-level Makefile could be improved too perhaps...
Quoted 83 lines
--- selinux-05092011/policycoreutils/load_policy/Makefile 2011-09-02
04:19:47.317716618 +0200
+++ selinux-05092011-fix-LIBDIR/policycoreutils/load_policy/Makefile
2011-09-09 19:44:23.710064117 +0200
(quoted diff) +2 -2
@@ -3,11 +3,12 @@ PREFIX ?= ${DESTDIR}/usr
 SBINDIR ?= $(DESTDIR)/sbin
 USRSBINDIR ?= $(PREFIX)/sbin
 MANDIR ?= $(PREFIX)/share/man
+LIBDIR ?= $(PREFIX)/usr/lib
 LOCALEDIR ?= /usr/share/locale
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DUSE_NLS
-DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lsepol -lselinux -L$(PREFIX)/lib
+LDLIBS += -lsepol -lselinux -L$(LIBDIR)
 
 TARGETS=$(patsubst %.c,%,$(wildcard *.c))
Quoted 12 lines
We really treat it like we have 5+ separate projects which just all happen to live in the same git tree. Thus to build libselinux you must have already built and installed libsepol. And then to build libsemanage you need to have done that with both libsepol and libselinux. Then of course to get the builds and install right (on Fedora/RHEL) you have to know to use LIBDIR=/usr/lib64 SHLIBDIR=/lib64 for libsepol and libsepol, but SHLIBDIR=/usr/lib64 for libsemanage. Its a mess, but I don't know what to do that's better....
Quoted 50 lines
-Eric
Quoted 45 lines · Guido Trentalancia
It only happens when building from git (because it uses the top-level Makefile which is not being distributed with the released components).
Quoted 29 lines · Guido Trentalancia
Hello,
I am not able to build semodule from the current git unless the following patch is applied.
Also, it would still be problematic if an outdated version of handle.h is getting picked up directly from the root include directory (as it happens now) and not from the local build directory... In other words, the Makefile and build system should be modified so that the local header files are picked up during each new build rather than the system-wide ones from previous installations.
But at least this is a start:
Include <semanage/handle.h> for semodule_set_root() currently used by semodule
policycoreutils/semodule/semodule.c 2011-09-09 18:41:24.078319022 +0200 renamed from policycoreutils/semodule/semodule.c 2011-09-02 04:19:47.357716917 +0200 +1 -1
@@ -21,6 +21,7 @@
 #include <sys/types.h>
 
 #include <semanage/modules.h>
+#include <semanage/handle.h>
 
 enum client_modes { NO_MODE, INSTALL_M, UPGRADE_M, BASE_M, ENABLE_M, DISABLE_M, REMOVE_M,
      LIST_M, RELOAD
 
 
--
Quoted 4 lines
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 5 lines
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

Quoted 5 lines

--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

Joshua Brindle

2011-09-09 21:39 UTC #7 lore raw

Re: [RFC] Userspace top-level Makefile (was Re: [PATCH] Fix LIBDIR usage for load_policy)

Quoted 20 lines · Guido Trentalancia

Makefile +13 -2

-all install relabel clean test indent:
+all relabel test indent:
  	@for subdir in $(SUBDIRS); do \
-		(cd $$subdir&&  $(MAKE) $@) || exit 1; \
+		(cd $$subdir&&  $(MAKE) $@&&  $(MAKE) install) || exit 1; \
+	done
+	@for subdir_bin in $(SUBDIRS_BIN); do \
+		(cd $$subdir_bin&&  $(MAKE) $@) || exit 1; \
+	done
+
+install:
+	@for subdir in $(SUBDIRS); do \
+		(cd $$subdir&&  $(MAKE) install) || exit 1; \
+	done
+	@for subdir_bin in $(SUBDIRS_BIN); do \
+		(cd $$subdir_bin&&  $(MAKE) install) || exit 1; \
  	done
 
  install-pywrap swigify:

Makefile install-pywrap swigify: · line 31

Quoted 3 lines

Makefile +0 -0

@@ -17,6 +29,14 @@ install-pywrap swigify:
  		(cd $$subdir&&  $(MAKE) $@) || exit 1; \
  	done

Nack. We can't require install in the build target and bail if it fails, this is completely unfriendly to developers who don't want to install all the libraries on their system during development, and those are the people using git.

If you are doing work on libselinux and you install it to your system before testing it locally you can easily break your machine and have to boot from a rescue disk.

Guido Trentalancia

author

2011-09-09 21:46 UTC #8 lore raw

Re: [RFC] Userspace top-level Makefile (was Re: [PATCH] Fix LIBDIR usage for load_policy)

Quoted 29 lines · Joshua Brindle

Quoted 20 lines · Guido Trentalancia
Makefile +13 -2
-all install relabel clean test indent:
+all relabel test indent:
  	@for subdir in $(SUBDIRS); do \
-		(cd $$subdir&&  $(MAKE) $@) || exit 1; \
+		(cd $$subdir&&  $(MAKE) $@&&  $(MAKE) install) || exit 1; \
+	done
+	@for subdir_bin in $(SUBDIRS_BIN); do \
+		(cd $$subdir_bin&&  $(MAKE) $@) || exit 1; \
+	done
+
+install:
+	@for subdir in $(SUBDIRS); do \
+		(cd $$subdir&&  $(MAKE) install) || exit 1; \
+	done
+	@for subdir_bin in $(SUBDIRS_BIN); do \
+		(cd $$subdir_bin&&  $(MAKE) install) || exit 1; \
  	done
 
  install-pywrap swigify:
Makefile install-pywrap swigify: · line 31
Quoted 3 lines
Makefile +0 -0
@@ -17,6 +29,14 @@ install-pywrap swigify:
  		(cd $$subdir&&  $(MAKE) $@) || exit 1; \
  	done
 
Nack. We can't require install in the build target and bail if it fails, this is completely unfriendly to developers who don't want to install all the libraries on their system during development, and those are the people using git.

Quoted 3 lines

If you are doing work on libselinux and you install it to your system before testing it locally you can easily break your machine and have to boot from a rescue disk.

Yes, sure, 100% agreed. It was clearly stated how dirty that was... It's just good for a laugh ;-)

At the end, you can't really install anything without the user knowing (and explicitly requiring) that.

But something like the other two solutions would probably be nice...

Regards,

Guido

Guido Trentalancia

author

2011-09-09 22:35 UTC #9 lore raw

Re: [RFC] Userspace top-level Makefile (was Re: [PATCH] Fix LIBDIR usage for load_policy)

In reply to Joshua Brindle

The following patch is probably even better as it actually sorts out the problem rather than just printing out a warning (it can still be combined with the creation of a top-level README file):

checkpolicy/Makefile +1 -1

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/checkpolicy/Makefile selinux-09092011-local-headers/checkpolicy/Makefile
@@ -12,7 +12,7 @@ YACC = bison -y
 
 CFLAGS ?= -g -Wall -Werror -Wshadow -O2 -pipe -fno-strict-aliasing
 
-override CFLAGS += -I. -I${INCLUDEDIR}
+override CFLAGS += -I. -I../libsepol/include -I${INCLUDEDIR}
 
 CHECKOBJS = y.tab.o lex.yy.o queue.o module_compiler.o parse_util.o \
 	    policy_define.o

checkpolicy/test/Makefile +1 -1

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/checkpolicy/test/Makefile selinux-09092011-local-headers/checkpolicy/test/Makefile
@@ -7,7 +7,7 @@ LIBDIR=$(PREFIX)/lib
 INCLUDEDIR ?= $(PREFIX)/include
 
 CFLAGS ?= -g -Wall -O2 -pipe
-override CFLAGS += -I$(INCLUDEDIR)
+override CFLAGS += -I../../libsepol/include -I$(INCLUDEDIR)
 
 LDLIBS=-lfl -lsepol -lselinux $(LIBDIR)/libsepol.a -L$(LIBDIR)

libselinux/src/Makefile +1 -1

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/libselinux/src/Makefile selinux-09092011-local-headers/libselinux/src/Makefile
@@ -54,7 +54,7 @@ SRCS= $(filter-out $(UNUSED_SRCS) $(GENE
 OBJS= $(patsubst %.c,%.o,$(SRCS))
 LOBJS= $(patsubst %.c,%.lo,$(SRCS))
 CFLAGS ?= -Werror -Wall -W -Wundef -Wshadow -Wmissing-noreturn -Wmissing-format-attribute
-override CFLAGS += -I../include -I$(INCLUDEDIR) -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 $(EMFLAGS)
+override CFLAGS += -I../include -I../../libsepol/include -I$(INCLUDEDIR) -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 $(EMFLAGS)
 RANLIB=ranlib
 
 ARCH := $(patsubst i%86,i386,$(shell uname -m))

libsemanage/src/Makefile +1 -1

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/libsemanage/src/Makefile selinux-09092011-local-headers/libsemanage/src/Makefile
@@ -55,7 +55,7 @@ OBJS= $(patsubst %.c,%.o,$(SRCS)) conf-s
 LOBJS= $(patsubst %.c,%.lo,$(SRCS)) conf-scan.lo conf-parse.lo
 CFLAGS ?= -Werror -Wall -W -Wundef -Wshadow -Wmissing-noreturn -Wmissing-format-attribute
 
-override CFLAGS += -I../include -I$(INCLUDEDIR) -D_GNU_SOURCE 
+override CFLAGS += -I../include -I../../libselinux/include -I../../libsepol/include -I$(INCLUDEDIR) -D_GNU_SOURCE 
 RANLIB=ranlib
 
 SWIG = swig -Wall -python -o $(SWIGCOUT) -outdir ./

policycoreutils/load_policy/Makefile +1 -1

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/load_policy/Makefile selinux-09092011-local-headers/policycoreutils/load_policy/Makefile
@@ -6,7 +6,7 @@ MANDIR ?= $(PREFIX)/share/man
 LOCALEDIR ?= /usr/share/locale
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+override CFLAGS += $(LDFLAGS) -I../../libselinux/include -I../../libsepol/include -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
 LDLIBS += -lsepol -lselinux -L$(PREFIX)/lib
 
 TARGETS=$(patsubst %.c,%,$(wildcard *.c))

policycoreutils/newrole/Makefile +1 -1

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/newrole/Makefile selinux-09092011-local-headers/policycoreutils/newrole/Makefile
@@ -22,7 +22,7 @@ VERSION = $(shell cat ../VERSION)
 
 CFLAGS ?= -Werror -Wall -W
 EXTRA_OBJS =
-override CFLAGS += -DVERSION=\"$(VERSION)\" $(LDFLAGS) -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+override CFLAGS += -DVERSION=\"$(VERSION)\" $(LDFLAGS) -I../../libselinux/include -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
 LDLIBS += -lselinux -L$(PREFIX)/lib
 ifeq (${PAMH}, /usr/include/security/pam_appl.h)
 	override CFLAGS += -DUSE_PAM

policycoreutils/restorecond/Makefile +1 -1

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/restorecond/Makefile selinux-09092011-local-headers/policycoreutils/restorecond/Makefile
@@ -6,7 +6,7 @@ INITDIR = $(DESTDIR)/etc/rc.d/init.d
 SELINUXDIR = $(DESTDIR)/etc/selinux
 
 CFLAGS ?= -g -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64
+override CFLAGS += -I../../libselinux/include -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64
 LDLIBS += -lselinux -L$(PREFIX)/lib
 
 all: restorecond

policycoreutils/run_init/Makefile +1 -1

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/run_init/Makefile selinux-09092011-local-headers/policycoreutils/run_init/Makefile
@@ -9,7 +9,7 @@ PAMH = $(shell ls /usr/include/security/
 AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null)
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+override CFLAGS += -I../../libselinux/include -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
 LDLIBS += -lselinux -L$(PREFIX)/lib
 ifeq (${PAMH}, /usr/include/security/pam_appl.h)
 	override CFLAGS += -DUSE_PAM

policycoreutils/sandbox/Makefile +1 -1

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/sandbox/Makefile selinux-09092011-local-headers/policycoreutils/sandbox/Makefile
@@ -7,7 +7,7 @@ SBINDIR ?= $(PREFIX)/sbin
 MANDIR ?= $(PREFIX)/share/man
 LOCALEDIR ?= /usr/share/locale
 SHAREDIR ?= $(PREFIX)/share/sandbox
-override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DPACKAGE="\"policycoreutils\""
+override CFLAGS += $(LDFLAGS) -I../../libselinux/include -I$(PREFIX)/include -DPACKAGE="\"policycoreutils\""
 LDLIBS += -lselinux -lcap-ng 
 
 all: sandbox seunshare sandboxX.sh start

policycoreutils/secon/Makefile +1 -1

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/secon/Makefile selinux-09092011-local-headers/policycoreutils/secon/Makefile
@@ -8,7 +8,7 @@ LIBDIR ?= ${PREFIX}/lib
 WARNS=-Werror -W -Wall -Wundef -Wshadow -Wpointer-arith -Wbad-function-cast -Wcast-align -Wwrite-strings -Waggregate-return -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -Wno-format-zero-length -Wformat-nonliteral -Wformat-security -Wfloat-equal
 VERSION = $(shell cat ../VERSION)
 CFLAGS ?= $(WARNS) -O1
-override CFLAGS += -DVERSION=\"$(VERSION)\" -I$(INCLUDEDIR) 
+override CFLAGS += -DVERSION=\"$(VERSION)\" -I../../libselinux/include -I$(INCLUDEDIR) 
 LDLIBS = -lselinux -L$(LIBDIR)
 
 all: secon

policycoreutils/semodule/Makefile +1 -1

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/semodule/Makefile selinux-09092011-local-headers/policycoreutils/semodule/Makefile
@@ -6,7 +6,7 @@ MANDIR = $(PREFIX)/share/man
 LIBDIR ?= ${PREFIX}/lib
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(INCLUDEDIR)
+override CFLAGS += -I../../libsemanage/include -I$(INCLUDEDIR)
 LDLIBS = -lsepol -lselinux -lsemanage -L$(LIBDIR)
 SEMODULE_OBJS = semodule.o

policycoreutils/semodule_deps/Makefile +1 -1

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/semodule_deps/Makefile selinux-09092011-local-headers/policycoreutils/semodule_deps/Makefile
@@ -6,7 +6,7 @@ LIBDIR ?= ${PREFIX}/lib
 MANDIR ?= $(PREFIX)/share/man
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(INCLUDEDIR)
+override CFLAGS += -I../../libsepol/include -I$(INCLUDEDIR)
 LDLIBS = $(LIBDIR)/libsepol.a
 
 all: semodule_deps

policycoreutils/semodule_expand/Makefile +1 -1

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/semodule_expand/Makefile selinux-09092011-local-headers/policycoreutils/semodule_expand/Makefile
@@ -6,7 +6,7 @@ LIBDIR ?= ${PREFIX}/lib
 MANDIR ?= $(PREFIX)/share/man
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(INCLUDEDIR)
+override CFLAGS += -I../../libsepol/include -I$(INCLUDEDIR)
 LDLIBS = -lsepol -lselinux -L$(LIBDIR)
 
 all: semodule_expand

policycoreutils/semodule_link/Makefile +1 -1

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/semodule_link/Makefile selinux-09092011-local-headers/policycoreutils/semodule_link/Makefile
@@ -6,7 +6,7 @@ MANDIR ?= $(PREFIX)/share/man
 LIBDIR ?= ${PREFIX}/lib
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(INCLUDEDIR)
+override CFLAGS += -I../../libsepol/include -I$(INCLUDEDIR)
 LDLIBS = -lsepol -lselinux -L$(LIBDIR)
 
 all: semodule_link

policycoreutils/semodule_package/Makefile +1 -1

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/semodule_package/Makefile selinux-09092011-local-headers/policycoreutils/semodule_package/Makefile
@@ -6,7 +6,7 @@ LIBDIR ?= ${PREFIX}/lib
 MANDIR ?= $(PREFIX)/share/man
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(INCLUDEDIR)
+override CFLAGS += -I../../libsepol/include -I$(INCLUDEDIR)
 LDLIBS = -lsepol -lselinux -L$(LIBDIR)
 
 all: semodule_package semodule_unpackage

policycoreutils/sestatus/Makefile +1 -1

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/sestatus/Makefile selinux-09092011-local-headers/policycoreutils/sestatus/Makefile
@@ -6,7 +6,7 @@ ETCDIR ?= $(DESTDIR)/etc
 LIBDIR ?= ${PREFIX}/lib
 
 CFLAGS = -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64
+override CFLAGS += -I../../libselinux/include -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64
 LDLIBS = -lselinux -L$(LIBDIR)
 
 all: sestatus

policycoreutils/setfiles/Makefile +1 -1

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/setfiles/Makefile selinux-09092011-local-headers/policycoreutils/setfiles/Makefile
@@ -6,7 +6,7 @@ LIBDIR ?= $(PREFIX)/lib
 AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null)
 
 CFLAGS = -g -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include
+override CFLAGS += -I../../libsepol/include -I../../libselinux/include -I$(PREFIX)/include
 LDLIBS = -lselinux -lsepol -L$(LIBDIR)
 
 ifeq (${AUDITH}, /usr/include/libaudit.h)

policycoreutils/setsebool/Makefile +1 -1

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/setsebool/Makefile selinux-09092011-local-headers/policycoreutils/setsebool/Makefile
@@ -6,7 +6,7 @@ MANDIR = $(PREFIX)/share/man
 LIBDIR ?= ${PREFIX}/lib
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(INCLUDEDIR)
+override CFLAGS += -I../../libselinux/include -I../../libsemanage/include -I$(INCLUDEDIR)
 LDLIBS = -lsepol -lselinux -lsemanage -L$(LIBDIR)
 SETSEBOOL_OBJS = setsebool.o

Quoted 29 lines · Joshua Brindle

Quoted 20 lines · Guido Trentalancia
(quoted diff) +13 -2
-all install relabel clean test indent:
+all relabel test indent:
  	@for subdir in $(SUBDIRS); do \
-		(cd $$subdir&&  $(MAKE) $@) || exit 1; \
+		(cd $$subdir&&  $(MAKE) $@&&  $(MAKE) install) || exit 1; \
+	done
+	@for subdir_bin in $(SUBDIRS_BIN); do \
+		(cd $$subdir_bin&&  $(MAKE) $@) || exit 1; \
+	done
+
+install:
+	@for subdir in $(SUBDIRS); do \
+		(cd $$subdir&&  $(MAKE) install) || exit 1; \
+	done
+	@for subdir_bin in $(SUBDIRS_BIN); do \
+		(cd $$subdir_bin&&  $(MAKE) install) || exit 1; \
  	done
 
  install-pywrap swigify:
Review install-pywrap swigify: · line 31
Quoted 3 lines
(quoted diff) +0 -0
@@ -17,6 +29,14 @@ install-pywrap swigify:
  		(cd $$subdir&&  $(MAKE) $@) || exit 1; \
  	done
 
Nack. We can't require install in the build target and bail if it fails, this is completely unfriendly to developers who don't want to install all the libraries on their system during development, and those are the people using git.

Quoted 9 lines

If you are doing work on libselinux and you install it to your system before testing it locally you can easily break your machine and have to boot from a rescue disk.
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

Eric Paris

2011-09-09 23:08 UTC #10 lore raw

Re: [RFC] Userspace top-level Makefile (was Re: [PATCH] Fix LIBDIR usage for load_policy)

checkpolicy/Makefile YACC = bison -y · line 15

Quoted 13 lines · Guido Trentalancia

The following patch is probably even better as it actually sorts out the problem rather than just printing out a warning (it can still be combined with the creation of a top-level README file):
diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/checkpolicy/Makefile selinux-09092011-local-headers/checkpolicy/Makefile
checkpolicy/Makefile +1 -1
@@ -12,7 +12,7 @@ YACC = bison -y
 
 CFLAGS ?= -g -Wall -Werror -Wshadow -O2 -pipe -fno-strict-aliasing
 
-override CFLAGS += -I. -I${INCLUDEDIR}
+override CFLAGS += -I. -I../libsepol/include -I${INCLUDEDIR}

I haven't checked, but can the makefiles then work when there is no ../libsepol/include?

Guido Trentalancia

author

2011-09-09 23:12 UTC #11 lore raw

Re: [RFC] Userspace top-level Makefile (was Re: [PATCH] Fix LIBDIR usage for load_policy)

Quoted 10 lines · Eric Paris

Quoted 9 lines · Guido Trentalancia
The following patch is probably even better as it actually sorts out the problem rather than just printing out a warning (it can still be combined with the creation of a top-level README file):
diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/checkpolicy/Makefile selinux-09092011-local-headers/checkpolicy/Makefile
checkpolicy/Makefile +0 -0
@@ -12,7 +12,7 @@ YACC = bison -y
 

Quoted 7 lines

checkpolicy/Makefile YACC = bison -y · line 15
Quoted 4 lines
checkpolicy/Makefile +1 -1
 CFLAGS ?= -g -Wall -Werror -Wshadow -O2 -pipe -fno-strict-aliasing
 
-override CFLAGS += -I. -I${INCLUDEDIR}
+override CFLAGS += -I. -I../libsepol/include -I${INCLUDEDIR}
I haven't checked, but can the makefiles then work when there is no ../libsepol/include?

If ../libsepol/include does not exist and libsepol headers are not installed under the standard location (${INCLUDEDIR}), then the above is going to fail.

But why should libsepol/include be missing from git in the first place ??

Regards,

Guido

Eric Paris

2011-09-09 23:15 UTC #12 lore raw

Re: [RFC] Userspace top-level Makefile (was Re: [PATCH] Fix LIBDIR usage for load_policy)

Quoted 19 lines · Guido Trentalancia

Quoted 10 lines · Eric Paris
Quoted 9 lines · Guido Trentalancia
The following patch is probably even better as it actually sorts out the problem rather than just printing out a warning (it can still be combined with the creation of a top-level README file):
diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/checkpolicy/Makefile selinux-09092011-local-headers/checkpolicy/Makefile
checkpolicy/Makefile +0 -0
@@ -12,7 +12,7 @@ YACC = bison -y
 
Quoted 7 lines
checkpolicy/Makefile YACC = bison -y · line 15
Quoted 4 lines
checkpolicy/Makefile +1 -1
 CFLAGS ?= -g -Wall -Werror -Wshadow -O2 -pipe -fno-strict-aliasing
 
-override CFLAGS += -I. -I${INCLUDEDIR}
+override CFLAGS += -I. -I../libsepol/include -I${INCLUDEDIR}
I haven't checked, but can the makefiles then work when there is no ../libsepol/include?

Quoted 6 lines

If ../libsepol/include does not exist and libsepol headers are not installed under the standard location (${INCLUDEDIR}), then the above is going to fail.
But why should libsepol/include be missing from git in the first place ??

I agree that they must be in one or the other for it to build. A number of distros build these packages separately, rather than all at once. Thus there would be no ../libsepol/include directory at all, but the headers should be picked up by -I$(INCLUDEDIR). As long as gcc doesn't care that the directory doesn't exist, I actually like it.

-Eric

Guido Trentalancia

author

2011-09-09 23:25 UTC #13 lore raw

Re: [RFC] Userspace top-level Makefile (was Re: [PATCH] Fix LIBDIR usage for load_policy)

Quoted 27 lines · Eric Paris

Quoted 19 lines · Guido Trentalancia
Quoted 10 lines · Eric Paris
Quoted 9 lines · Guido Trentalancia
The following patch is probably even better as it actually sorts out the problem rather than just printing out a warning (it can still be combined with the creation of a top-level README file):
diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/checkpolicy/Makefile selinux-09092011-local-headers/checkpolicy/Makefile
checkpolicy/Makefile +0 -0
@@ -12,7 +12,7 @@ YACC = bison -y
 
Quoted 7 lines
checkpolicy/Makefile YACC = bison -y · line 15
Quoted 4 lines
checkpolicy/Makefile +1 -1
 CFLAGS ?= -g -Wall -Werror -Wshadow -O2 -pipe -fno-strict-aliasing
 
-override CFLAGS += -I. -I${INCLUDEDIR}
+override CFLAGS += -I. -I../libsepol/include -I${INCLUDEDIR}
I haven't checked, but can the makefiles then work when there is no ../libsepol/include?
Quoted 6 lines
If ../libsepol/include does not exist and libsepol headers are not installed under the standard location (${INCLUDEDIR}), then the above is going to fail.
But why should libsepol/include be missing from git in the first place ??

Quoted 7 lines

I agree that they must be in one or the other for it to build. A number of distros build these packages separately, rather than all at once. Thus there would be no ../libsepol/include directory at all, but the headers should be picked up by -I$(INCLUDEDIR). As long as gcc doesn't care that the directory doesn't exist, I actually like it.
-Eric

gcc should only care that at least one version of the file can be found if #include'd.

It still needs to be tested though. Can you try building the whole userspace git using that patch ?

Regards,

Guido

Guido Trentalancia

author

2011-09-09 23:45 UTC #14 lore raw

Re: [RFC] Userspace top-level Makefile (was Re: [PATCH] Fix LIBDIR usage for load_policy)

Quoted 10 lines · Guido Trentalancia

Quoted 9 lines · Eric Paris
Quoted 2 lines
But why should libsepol/include be missing from git in the first place ??
I agree that they must be in one or the other for it to build. A number of distros build these packages separately, rather than all at once. Thus there would be no ../libsepol/include directory at all, but the headers should be picked up by -I$(INCLUDEDIR). As long as gcc doesn't care that the directory doesn't exist, I actually like it.

Quoted 7 lines

Quoted 1 line
-Eric
gcc should only care that at least one version of the file can be found if #include'd.
It still needs to be tested though. Can you try building the whole userspace git using that patch ?

I have just tested it again and I am still missing the following bit:

policycoreutils/semodule/Makefile +1 -1

@@ -7,7 +7,7 @@ LIBDIR ?= ${PREFIX}/lib
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += -I../../libsemanage/include -I$(INCLUDEDIR)
-LDLIBS = -lsepol -lselinux -lsemanage -L$(LIBDIR)
+LDLIBS = -L../../libselinux/src -L../../libsepol/src -L../../libsemanage/src -lsepol -lselinux -lsemanage
 SEMODULE_OBJS = semodule.o
 
 all: semodule

policycoreutils/setsebool/Makefile +1 -1

@@ -7,7 +7,7 @@ LIBDIR ?= ${PREFIX}/lib
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += -I../../libselinux/include -I../../libsemanage/include -I$(INCLUDEDIR)
-LDLIBS = -lsepol -lselinux -lsemanage -L$(LIBDIR)
+LDLIBS = -L../../libselinux/src -L../../libsepol/src -L../../libsemanage/src -lsepol -lselinux -lsemanage
 SETSEBOOL_OBJS = setsebool.o
 
 all: setsebool

Quoted 3 lines

Regards,
Guido

Guido Trentalancia

author

2011-09-09 23:57 UTC #15 lore raw

Re: [RFC] Userspace top-level Makefile (was Re: [PATCH] Fix LIBDIR usage for load_policy)

And I think I've just spotted another nasty issue:

libselinux/src/Makefile +1 -1

@@ -126,7 +126,7 @@ install: all
 	install -m 755 $(LIBSO) $(SHLIBDIR)
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
-	cd $(LIBDIR) && ln -sf ../../`basename $(SHLIBDIR)`/$(LIBSO) $(TARGET)
+	cd $(LIBDIR) && ln -sf $(LIBSO) $(TARGET)
 
 install-pywrap: pywrap
 	test -d $(PYLIBDIR)/site-packages/selinux || install -m 755 -d $(PYLIBDIR)/site-packages/selinux

libsepol/src/Makefile +1 -1

@@ -43,7 +43,7 @@ install: all
 	install -m 755 $(LIBSO) $(SHLIBDIR)
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
-	cd $(LIBDIR) && ln -sf ../../`basename $(SHLIBDIR)`/$(LIBSO) $(TARGET)
+	cd $(LIBDIR) && ln -sf $(LIBSO) $(TARGET)
 
 relabel:
 	/sbin/restorecon $(SHLIBDIR)/$(LIBSO)

Regards,

Guido

Quoted 46 lines · Guido Trentalancia

Quoted 10 lines · Guido Trentalancia
Quoted 9 lines · Eric Paris
Quoted 2 lines
But why should libsepol/include be missing from git in the first place ??
I agree that they must be in one or the other for it to build. A number of distros build these packages separately, rather than all at once. Thus there would be no ../libsepol/include directory at all, but the headers should be picked up by -I$(INCLUDEDIR). As long as gcc doesn't care that the directory doesn't exist, I actually like it.
Quoted 7 lines
Quoted 1 line
-Eric
gcc should only care that at least one version of the file can be found if #include'd.
It still needs to be tested though. Can you try building the whole userspace git using that patch ?
I have just tested it again and I am still missing the following bit:
policycoreutils/semodule/Makefile +1 -1
@@ -7,7 +7,7 @@ LIBDIR ?= ${PREFIX}/lib
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += -I../../libsemanage/include -I$(INCLUDEDIR)
-LDLIBS = -lsepol -lselinux -lsemanage -L$(LIBDIR)
+LDLIBS = -L../../libselinux/src -L../../libsepol/src -L../../libsemanage/src -lsepol -lselinux -lsemanage
 SEMODULE_OBJS = semodule.o
 
 all: semodule
policycoreutils/setsebool/Makefile +1 -1
@@ -7,7 +7,7 @@ LIBDIR ?= ${PREFIX}/lib
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += -I../../libselinux/include -I../../libsemanage/include -I$(INCLUDEDIR)
-LDLIBS = -lsepol -lselinux -lsemanage -L$(LIBDIR)
+LDLIBS = -L../../libselinux/src -L../../libsepol/src -L../../libsemanage/src -lsepol -lselinux -lsemanage
 SETSEBOOL_OBJS = setsebool.o
 
 all: setsebool
Quoted 3 lines
Regards,

Quoted 9 lines

Quoted 1 line
Guido
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

Guido Trentalancia

author

2011-09-10 01:04 UTC #16 lore raw

RFC 1/1 Userspace git local build (was Re: [RFC] Userspace top-level Makefile)

The final version of the patch which works on my system is attached below for further testing.

This patch is intended to make sure that the SELinux userspace libraries and tools bundle from the git repository can be built from scratch without requiring existing SELinux installations (in particular header files). It should also fix a possible installation issue (creation of symbolic links to shared libraries for libselinux and libsepol).

checkpolicy/Makefile +2 -2

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/checkpolicy/Makefile selinux-09092011-final-local-build/checkpolicy/Makefile
@@ -12,14 +12,14 @@ YACC = bison -y
 
 CFLAGS ?= -g -Wall -Werror -Wshadow -O2 -pipe -fno-strict-aliasing
 
-override CFLAGS += -I. -I${INCLUDEDIR}
+override CFLAGS += -I. -I../libsepol/include -I${INCLUDEDIR}
 
 CHECKOBJS = y.tab.o lex.yy.o queue.o module_compiler.o parse_util.o \
 	    policy_define.o
 CHECKPOLOBJS = $(CHECKOBJS) checkpolicy.o
 CHECKMODOBJS = $(CHECKOBJS) checkmodule.o
 
-LDLIBS=$(LIBDIR)/libsepol.a -lfl
+LDLIBS=../libsepol/src/libsepol.a -L$(LIBDIR) -lfl
 
 GENERATED=lex.yy.c y.tab.c y.tab.h

checkpolicy/test/Makefile +2 -2

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/checkpolicy/test/Makefile selinux-09092011-final-local-build/checkpolicy/test/Makefile
@@ -7,9 +7,9 @@ LIBDIR=$(PREFIX)/lib
 INCLUDEDIR ?= $(PREFIX)/include
 
 CFLAGS ?= -g -Wall -O2 -pipe
-override CFLAGS += -I$(INCLUDEDIR)
+override CFLAGS += -I../../libsepol/include -I$(INCLUDEDIR)
 
-LDLIBS=-lfl -lsepol -lselinux $(LIBDIR)/libsepol.a -L$(LIBDIR)
+LDLIBS=-L../../libselinux/src -lselinux -L../../libsepol/src -lsepol ../../libsepol/src/libsepol.a -L$(LIBDIR) -lfl
 
 all: dispol dismod

libselinux/src/Makefile +3 -3

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/libselinux/src/Makefile selinux-09092011-final-local-build/libselinux/src/Makefile
@@ -54,7 +54,7 @@ SRCS= $(filter-out $(UNUSED_SRCS) $(GENE
 OBJS= $(patsubst %.c,%.o,$(SRCS))
 LOBJS= $(patsubst %.c,%.lo,$(SRCS))
 CFLAGS ?= -Werror -Wall -W -Wundef -Wshadow -Wmissing-noreturn -Wmissing-format-attribute
-override CFLAGS += -I../include -I$(INCLUDEDIR) -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 $(EMFLAGS)
+override CFLAGS += -I../include -I../../libsepol/include -I$(INCLUDEDIR) -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 $(EMFLAGS)
 RANLIB=ranlib
 
 ARCH := $(patsubst i%86,i386,$(shell uname -m))

@@ -102,7 +102,7 @@ $(AUDIT2WHYLOBJ): audit2why.c
 	$(CC) $(filter-out -Werror, $(CFLAGS)) $(PYINC) -fPIC -DSHARED -c -o $@ $<
 
 $(AUDIT2WHYSO): $(AUDIT2WHYLOBJ)
-	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux ${LIBDIR}/libsepol.a -L$(LIBDIR) -Wl,-soname,$@
+	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux ../../libsepol/libsepol.a -L$(LIBDIR) -Wl,-soname,$@
 
 %.o:  %.c policy.h
 	$(CC) $(CFLAGS) $(TLSFLAGS) -c -o $@ $<

@@ -126,7 +126,7 @@ install: all
 	install -m 755 $(LIBSO) $(SHLIBDIR)
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
-	cd $(LIBDIR) && ln -sf ../../`basename $(SHLIBDIR)`/$(LIBSO) $(TARGET)
+	cd $(LIBDIR) && ln -sf $(LIBSO) $(TARGET)
 
 install-pywrap: pywrap
 	test -d $(PYLIBDIR)/site-packages/selinux || install -m 755 -d $(PYLIBDIR)/site-packages/selinux

libsemanage/src/Makefile +2 -2

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/libsemanage/src/Makefile selinux-09092011-final-local-build/libsemanage/src/Makefile
@@ -55,7 +55,7 @@ OBJS= $(patsubst %.c,%.o,$(SRCS)) conf-s
 LOBJS= $(patsubst %.c,%.lo,$(SRCS)) conf-scan.lo conf-parse.lo
 CFLAGS ?= -Werror -Wall -W -Wundef -Wshadow -Wmissing-noreturn -Wmissing-format-attribute
 
-override CFLAGS += -I../include -I$(INCLUDEDIR) -D_GNU_SOURCE 
+override CFLAGS += -I../include -I../../libselinux/include -I../../libsepol/include -I$(INCLUDEDIR) -D_GNU_SOURCE 
 RANLIB=ranlib
 
 SWIG = swig -Wall -python -o $(SWIGCOUT) -outdir ./

@@ -87,7 +87,7 @@ $(LIBA): $(OBJS)
 	$(RANLIB) $@
 
 $(LIBSO): $(LOBJS)
-	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -lsepol -lselinux -lbz2 -lustr -L$(LIBDIR) -Wl,-soname,$(LIBSO),--version-script=libsemanage.map,-z,defs
+	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L../../libsepol/src -lsepol -L../../libselinux/src -lselinux -L$(LIBDIR) -lbz2 -lustr -Wl,-soname,$(LIBSO),--version-script=libsemanage.map,-z,defs
 	ln -sf $@ $(TARGET)
 
 $(LIBPC): $(LIBPC).in

libsepol/src/Makefile +1 -1

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/libsepol/src/Makefile selinux-09092011-final-local-build/libsepol/src/Makefile
@@ -43,7 +43,7 @@ install: all
 	install -m 755 $(LIBSO) $(SHLIBDIR)
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
-	cd $(LIBDIR) && ln -sf ../../`basename $(SHLIBDIR)`/$(LIBSO) $(TARGET)
+	cd $(LIBDIR) && ln -sf $(LIBSO) $(TARGET)
 
 relabel:
 	/sbin/restorecon $(SHLIBDIR)/$(LIBSO)

policycoreutils/load_policy/Makefile +2 -2

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/load_policy/Makefile selinux-09092011-final-local-build/policycoreutils/load_policy/Makefile
@@ -6,8 +6,8 @@ MANDIR ?= $(PREFIX)/share/man
 LOCALEDIR ?= /usr/share/locale
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lsepol -lselinux -L$(PREFIX)/lib
+override CFLAGS += $(LDFLAGS) -I../../libselinux/include -I../../libsepol/include -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+LDLIBS += -L../../libsepol/src -lsepol -L../../libselinux/src -lselinux
 
 TARGETS=$(patsubst %.c,%,$(wildcard *.c))

policycoreutils/mcstrans/src/Makefile +1 -1

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/mcstrans/src/Makefile selinux-09092011-final-local-build/policycoreutils/mcstrans/src/Makefile
@@ -28,7 +28,7 @@ override CFLAGS += -I../include -D_GNU_S
 all: $(PROG)
 
 $(PROG): $(PROG_OBJS)
-	$(CC) $(LDFLAGS) -pie -o $@ $^ -lselinux -lcap -lpcre $(LIBDIR)/libsepol.a
+	$(CC) $(LDFLAGS) -pie -o $@ $^ -L../../../libselinux/src -lselinux ../../../libsepol/src/libsepol.a -L$(LIBDIR) -lcap -lpcre
 
 %.o:  %.c 
 	$(CC) $(CFLAGS) -fPIE -c -o $@ $<

policycoreutils/mcstrans/utils/Makefile +1 -1

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/mcstrans/utils/Makefile selinux-09092011-final-local-build/policycoreutils/mcstrans/utils/Makefile
@@ -21,7 +21,7 @@ endif
 
 CFLAGS ?= -Wall
 override CFLAGS += -I../src -D_GNU_SOURCE
-LDLIBS += -L../src ../src/mcstrans.o ../src/mls_level.o -lselinux -lpcre $(LIBDIR)/libsepol.a
+LDLIBS += -L../src ../src/mcstrans.o ../src/mls_level.o -L../../../libselinux/src -lselinux ../../../libsepol/src/libsepol.a -L$(LIBDIR) -lpcre
 
 TARGETS=$(patsubst %.c,%,$(wildcard *.c))

policycoreutils/newrole/Makefile +1 -1

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/newrole/Makefile selinux-09092011-final-local-build/policycoreutils/newrole/Makefile
@@ -22,7 +22,7 @@ VERSION = $(shell cat ../VERSION)
 
 CFLAGS ?= -Werror -Wall -W
 EXTRA_OBJS =
-override CFLAGS += -DVERSION=\"$(VERSION)\" $(LDFLAGS) -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+override CFLAGS += -DVERSION=\"$(VERSION)\" $(LDFLAGS) -I../../libselinux/include -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
 LDLIBS += -lselinux -L$(PREFIX)/lib
 ifeq (${PAMH}, /usr/include/security/pam_appl.h)
 	override CFLAGS += -DUSE_PAM

policycoreutils/restorecond/Makefile +1 -1

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/restorecond/Makefile selinux-09092011-final-local-build/policycoreutils/restorecond/Makefile
@@ -6,7 +6,7 @@ INITDIR = $(DESTDIR)/etc/rc.d/init.d
 SELINUXDIR = $(DESTDIR)/etc/selinux
 
 CFLAGS ?= -g -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64
+override CFLAGS += -I../../libselinux/include -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64
 LDLIBS += -lselinux -L$(PREFIX)/lib
 
 all: restorecond

policycoreutils/run_init/Makefile +1 -1

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/run_init/Makefile selinux-09092011-final-local-build/policycoreutils/run_init/Makefile
@@ -9,7 +9,7 @@ PAMH = $(shell ls /usr/include/security/
 AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null)
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+override CFLAGS += -I../../libselinux/include -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
 LDLIBS += -lselinux -L$(PREFIX)/lib
 ifeq (${PAMH}, /usr/include/security/pam_appl.h)
 	override CFLAGS += -DUSE_PAM

policycoreutils/sandbox/Makefile +1 -1

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/sandbox/Makefile selinux-09092011-final-local-build/policycoreutils/sandbox/Makefile
@@ -7,7 +7,7 @@ SBINDIR ?= $(PREFIX)/sbin
 MANDIR ?= $(PREFIX)/share/man
 LOCALEDIR ?= /usr/share/locale
 SHAREDIR ?= $(PREFIX)/share/sandbox
-override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DPACKAGE="\"policycoreutils\""
+override CFLAGS += $(LDFLAGS) -I../../libselinux/include -I$(PREFIX)/include -DPACKAGE="\"policycoreutils\""
 LDLIBS += -lselinux -lcap-ng 
 
 all: sandbox seunshare sandboxX.sh start

policycoreutils/secon/Makefile +2 -2

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/secon/Makefile selinux-09092011-final-local-build/policycoreutils/secon/Makefile
@@ -8,8 +8,8 @@ LIBDIR ?= ${PREFIX}/lib
 WARNS=-Werror -W -Wall -Wundef -Wshadow -Wpointer-arith -Wbad-function-cast -Wcast-align -Wwrite-strings -Waggregate-return -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -Wno-format-zero-length -Wformat-nonliteral -Wformat-security -Wfloat-equal
 VERSION = $(shell cat ../VERSION)
 CFLAGS ?= $(WARNS) -O1
-override CFLAGS += -DVERSION=\"$(VERSION)\" -I$(INCLUDEDIR) 
-LDLIBS = -lselinux -L$(LIBDIR)
+override CFLAGS += -DVERSION=\"$(VERSION)\" -I../../libselinux/include -I$(INCLUDEDIR) 
+LDLIBS = -L../../libselinux/src -lselinux
 
 all: secon

policycoreutils/semodule/Makefile +2 -2

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/semodule/Makefile selinux-09092011-final-local-build/policycoreutils/semodule/Makefile
@@ -6,8 +6,8 @@ MANDIR = $(PREFIX)/share/man
 LIBDIR ?= ${PREFIX}/lib
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(INCLUDEDIR)
-LDLIBS = -lsepol -lselinux -lsemanage -L$(LIBDIR)
+override CFLAGS += -I../../libsemanage/include -I$(INCLUDEDIR)
+LDLIBS = -L../../libselinux/src -lselinux -L../../libsepol/src -lsepol -L../../libsemanage/src -lsemanage
 SEMODULE_OBJS = semodule.o
 
 all: semodule

policycoreutils/semodule_deps/Makefile +2 -2

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/semodule_deps/Makefile selinux-09092011-final-local-build/policycoreutils/semodule_deps/Makefile
@@ -6,8 +6,8 @@ LIBDIR ?= ${PREFIX}/lib
 MANDIR ?= $(PREFIX)/share/man
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(INCLUDEDIR)
-LDLIBS = $(LIBDIR)/libsepol.a
+override CFLAGS += -I../../libsepol/include -I$(INCLUDEDIR)
+LDLIBS = ../../libsepol/src/libsepol.a
 
 all: semodule_deps

policycoreutils/semodule_expand/Makefile +2 -2

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/semodule_expand/Makefile selinux-09092011-final-local-build/policycoreutils/semodule_expand/Makefile
@@ -6,8 +6,8 @@ LIBDIR ?= ${PREFIX}/lib
 MANDIR ?= $(PREFIX)/share/man
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(INCLUDEDIR)
-LDLIBS = -lsepol -lselinux -L$(LIBDIR)
+override CFLAGS += -I../../libsepol/include -I$(INCLUDEDIR)
+LDLIBS = -L../../libsepol/src -lsepol -L../../libselinux/src -lselinux
 
 all: semodule_expand

policycoreutils/semodule_link/Makefile +2 -2

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/semodule_link/Makefile selinux-09092011-final-local-build/policycoreutils/semodule_link/Makefile
@@ -6,8 +6,8 @@ MANDIR ?= $(PREFIX)/share/man
 LIBDIR ?= ${PREFIX}/lib
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(INCLUDEDIR)
-LDLIBS = -lsepol -lselinux -L$(LIBDIR)
+override CFLAGS += -I../../libsepol/include -I$(INCLUDEDIR)
+LDLIBS = -L../../libsepol/src -lsepol -L../../libselinux/src -lselinux
 
 all: semodule_link

policycoreutils/semodule_package/Makefile +2 -2

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/semodule_package/Makefile selinux-09092011-final-local-build/policycoreutils/semodule_package/Makefile
@@ -6,8 +6,8 @@ LIBDIR ?= ${PREFIX}/lib
 MANDIR ?= $(PREFIX)/share/man
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(INCLUDEDIR)
-LDLIBS = -lsepol -lselinux -L$(LIBDIR)
+override CFLAGS += -I../../libsepol/include -I$(INCLUDEDIR)
+LDLIBS = -L../../libsepol/src -lsepol -L../../libselinux/src -lselinux
 
 all: semodule_package semodule_unpackage

policycoreutils/sestatus/Makefile +2 -2

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/sestatus/Makefile selinux-09092011-final-local-build/policycoreutils/sestatus/Makefile
@@ -6,8 +6,8 @@ ETCDIR ?= $(DESTDIR)/etc
 LIBDIR ?= ${PREFIX}/lib
 
 CFLAGS = -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64
-LDLIBS = -lselinux -L$(LIBDIR)
+override CFLAGS += -I../../libselinux/include -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64
+LDLIBS = -L../../libselinux/src -lselinux
 
 all: sestatus

policycoreutils/setfiles/Makefile +2 -2

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/setfiles/Makefile selinux-09092011-final-local-build/policycoreutils/setfiles/Makefile
@@ -6,8 +6,8 @@ LIBDIR ?= $(PREFIX)/lib
 AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null)
 
 CFLAGS = -g -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include
-LDLIBS = -lselinux -lsepol -L$(LIBDIR)
+override CFLAGS += -I../../libsepol/include -I../../libselinux/include -I$(PREFIX)/include
+LDLIBS = -L../../libselinux/src -lselinux -L../../libsepol/src -lsepol
 
 ifeq (${AUDITH}, /usr/include/libaudit.h)
 	override CFLAGS += -DUSE_AUDIT

policycoreutils/setsebool/Makefile +2 -2

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/setsebool/Makefile selinux-09092011-final-local-build/policycoreutils/setsebool/Makefile
@@ -6,8 +6,8 @@ MANDIR = $(PREFIX)/share/man
 LIBDIR ?= ${PREFIX}/lib
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(INCLUDEDIR)
-LDLIBS = -lsepol -lselinux -lsemanage -L$(LIBDIR)
+override CFLAGS += -I../../libselinux/include -I../../libsemanage/include -I$(INCLUDEDIR)
+LDLIBS = -L../../libselinux/src -lselinux -L../../libsepol/src -lsepol -L../../libsemanage/src -lsemanage
 SETSEBOOL_OBJS = setsebool.o
 
 all: setsebool

Guido Trentalancia

author

2011-09-10 02:39 UTC #17 lore raw

Re: [RFC v2] Userspace git local build (was Re: [RFC] Userspace git local build)

New version of the patch (v2) with a few fixes for policycoreutils tools (new_role, restorecond, run_init). For further testing.

checkpolicy/Makefile +2 -2

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/checkpolicy/Makefile selinux-09092011-make-arguments/checkpolicy/Makefile
@@ -12,14 +12,14 @@ YACC = bison -y
 
 CFLAGS ?= -g -Wall -Werror -Wshadow -O2 -pipe -fno-strict-aliasing
 
-override CFLAGS += -I. -I${INCLUDEDIR}
+override CFLAGS += -I. -I../libsepol/include -I${INCLUDEDIR}
 
 CHECKOBJS = y.tab.o lex.yy.o queue.o module_compiler.o parse_util.o \
 	    policy_define.o
 CHECKPOLOBJS = $(CHECKOBJS) checkpolicy.o
 CHECKMODOBJS = $(CHECKOBJS) checkmodule.o
 
-LDLIBS=$(LIBDIR)/libsepol.a -lfl
+LDLIBS=../libsepol/src/libsepol.a -L$(LIBDIR) -lfl
 
 GENERATED=lex.yy.c y.tab.c y.tab.h

checkpolicy/test/Makefile +2 -2

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/checkpolicy/test/Makefile selinux-09092011-make-arguments/checkpolicy/test/Makefile
@@ -7,9 +7,9 @@ LIBDIR=$(PREFIX)/lib
 INCLUDEDIR ?= $(PREFIX)/include
 
 CFLAGS ?= -g -Wall -O2 -pipe
-override CFLAGS += -I$(INCLUDEDIR)
+override CFLAGS += -I../../libsepol/include -I$(INCLUDEDIR)
 
-LDLIBS=-lfl -lsepol -lselinux $(LIBDIR)/libsepol.a -L$(LIBDIR)
+LDLIBS=-L../../libsepol/src -lsepol -L../../libselinux/src -lselinux ../../libsepol/src/libsepol.a -L$(LIBDIR) -lfl
 
 all: dispol dismod

libselinux/src/Makefile +3 -3

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/libselinux/src/Makefile selinux-09092011-make-arguments/libselinux/src/Makefile
@@ -54,7 +54,7 @@ SRCS= $(filter-out $(UNUSED_SRCS) $(GENE
 OBJS= $(patsubst %.c,%.o,$(SRCS))
 LOBJS= $(patsubst %.c,%.lo,$(SRCS))
 CFLAGS ?= -Werror -Wall -W -Wundef -Wshadow -Wmissing-noreturn -Wmissing-format-attribute
-override CFLAGS += -I../include -I$(INCLUDEDIR) -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 $(EMFLAGS)
+override CFLAGS += -I../include -I../../libsepol/include -I$(INCLUDEDIR) -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 $(EMFLAGS)
 RANLIB=ranlib
 
 ARCH := $(patsubst i%86,i386,$(shell uname -m))

@@ -102,7 +102,7 @@ $(AUDIT2WHYLOBJ): audit2why.c
 	$(CC) $(filter-out -Werror, $(CFLAGS)) $(PYINC) -fPIC -DSHARED -c -o $@ $<
 
 $(AUDIT2WHYSO): $(AUDIT2WHYLOBJ)
-	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux ${LIBDIR}/libsepol.a -L$(LIBDIR) -Wl,-soname,$@
+	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux ../../libsepol/src/libsepol.a -L$(LIBDIR) -Wl,-soname,$@
 
 %.o:  %.c policy.h
 	$(CC) $(CFLAGS) $(TLSFLAGS) -c -o $@ $<

@@ -126,7 +126,7 @@ install: all
 	install -m 755 $(LIBSO) $(SHLIBDIR)
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
-	cd $(LIBDIR) && ln -sf ../../`basename $(SHLIBDIR)`/$(LIBSO) $(TARGET)
+	cd $(LIBDIR) && ln -sf $(LIBSO) $(TARGET)
 
 install-pywrap: pywrap
 	test -d $(PYLIBDIR)/site-packages/selinux || install -m 755 -d $(PYLIBDIR)/site-packages/selinux

libsemanage/src/Makefile +2 -2

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/libsemanage/src/Makefile selinux-09092011-make-arguments/libsemanage/src/Makefile
@@ -55,7 +55,7 @@ OBJS= $(patsubst %.c,%.o,$(SRCS)) conf-s
 LOBJS= $(patsubst %.c,%.lo,$(SRCS)) conf-scan.lo conf-parse.lo
 CFLAGS ?= -Werror -Wall -W -Wundef -Wshadow -Wmissing-noreturn -Wmissing-format-attribute
 
-override CFLAGS += -I../include -I$(INCLUDEDIR) -D_GNU_SOURCE 
+override CFLAGS += -I../include -I../../libselinux/include -I../../libsepol/include -I$(INCLUDEDIR) -D_GNU_SOURCE 
 RANLIB=ranlib
 
 SWIG = swig -Wall -python -o $(SWIGCOUT) -outdir ./

@@ -87,7 +87,7 @@ $(LIBA): $(OBJS)
 	$(RANLIB) $@
 
 $(LIBSO): $(LOBJS)
-	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -lsepol -lselinux -lbz2 -lustr -L$(LIBDIR) -Wl,-soname,$(LIBSO),--version-script=libsemanage.map,-z,defs
+	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L../../libsepol/src -lsepol -L../../libselinux/src -lselinux -L$(LIBDIR) -lbz2 -lustr -Wl,-soname,$(LIBSO),--version-script=libsemanage.map,-z,defs
 	ln -sf $@ $(TARGET)
 
 $(LIBPC): $(LIBPC).in

libsepol/src/Makefile +1 -1

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/libsepol/src/Makefile selinux-09092011-make-arguments/libsepol/src/Makefile
@@ -43,7 +43,7 @@ install: all
 	install -m 755 $(LIBSO) $(SHLIBDIR)
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
-	cd $(LIBDIR) && ln -sf ../../`basename $(SHLIBDIR)`/$(LIBSO) $(TARGET)
+	cd $(LIBDIR) && ln -sf $(LIBSO) $(TARGET)
 
 relabel:
 	/sbin/restorecon $(SHLIBDIR)/$(LIBSO)

policycoreutils/load_policy/Makefile +2 -2

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/load_policy/Makefile selinux-09092011-make-arguments/policycoreutils/load_policy/Makefile
@@ -6,8 +6,8 @@ MANDIR ?= $(PREFIX)/share/man
 LOCALEDIR ?= /usr/share/locale
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lsepol -lselinux -L$(PREFIX)/lib
+override CFLAGS += $(LDFLAGS) -I../../libselinux/include -I../../libsepol/include -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+LDLIBS += -L../../libsepol/src -lsepol -L../../libselinux/src -lselinux -L$(PREFIX)/lib
 
 TARGETS=$(patsubst %.c,%,$(wildcard *.c))

policycoreutils/mcstrans/src/Makefile +1 -1

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/mcstrans/src/Makefile selinux-09092011-make-arguments/policycoreutils/mcstrans/src/Makefile
@@ -28,7 +28,7 @@ override CFLAGS += -I../include -D_GNU_S
 all: $(PROG)
 
 $(PROG): $(PROG_OBJS)
-	$(CC) $(LDFLAGS) -pie -o $@ $^ -lselinux -lcap -lpcre $(LIBDIR)/libsepol.a
+	$(CC) $(LDFLAGS) -pie -o $@ $^ -L../../../libselinux/src -lselinux -L$(LIBDIR) -lcap -lpcre ../../../libsepol/src/libsepol.a
 
 %.o:  %.c 
 	$(CC) $(CFLAGS) -fPIE -c -o $@ $<

policycoreutils/mcstrans/utils/Makefile +1 -1

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/mcstrans/utils/Makefile selinux-09092011-make-arguments/policycoreutils/mcstrans/utils/Makefile
@@ -21,7 +21,7 @@ endif
 
 CFLAGS ?= -Wall
 override CFLAGS += -I../src -D_GNU_SOURCE
-LDLIBS += -L../src ../src/mcstrans.o ../src/mls_level.o -lselinux -lpcre $(LIBDIR)/libsepol.a
+LDLIBS += -L../src ../src/mcstrans.o ../src/mls_level.o -L../../../libselinux/src -lselinux -L$(LIBDIR) -lpcre ../../../libsepol/src/libsepol.a
 
 TARGETS=$(patsubst %.c,%,$(wildcard *.c))

policycoreutils/newrole/Makefile +2 -2

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/newrole/Makefile selinux-09092011-make-arguments/policycoreutils/newrole/Makefile
@@ -22,8 +22,8 @@ VERSION = $(shell cat ../VERSION)
 
 CFLAGS ?= -Werror -Wall -W
 EXTRA_OBJS =
-override CFLAGS += -DVERSION=\"$(VERSION)\" $(LDFLAGS) -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lselinux -L$(PREFIX)/lib
+override CFLAGS += -DVERSION=\"$(VERSION)\" $(LDFLAGS) -I../../libselinux/include -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+LDLIBS += -L../../libselinux/src -lselinux -L$(PREFIX)/lib
 ifeq (${PAMH}, /usr/include/security/pam_appl.h)
 	override CFLAGS += -DUSE_PAM
 	EXTRA_OBJS += hashtab.o

policycoreutils/restorecond/Makefile +2 -2

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/restorecond/Makefile selinux-09092011-make-arguments/policycoreutils/restorecond/Makefile
@@ -6,8 +6,8 @@ INITDIR = $(DESTDIR)/etc/rc.d/init.d
 SELINUXDIR = $(DESTDIR)/etc/selinux
 
 CFLAGS ?= -g -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64
-LDLIBS += -lselinux -L$(PREFIX)/lib
+override CFLAGS += -I../../libselinux/include -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64
+LDLIBS += -L../../libselinux/src -lselinux -L$(PREFIX)/lib
 
 all: restorecond

policycoreutils/run_init/Makefile +2 -2

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/run_init/Makefile selinux-09092011-make-arguments/policycoreutils/run_init/Makefile
@@ -9,8 +9,8 @@ PAMH = $(shell ls /usr/include/security/
 AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null)
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lselinux -L$(PREFIX)/lib
+override CFLAGS += -I../../libselinux/include -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+LDLIBS += -L../../libselinux/src -lselinux -L$(PREFIX)/lib
 ifeq (${PAMH}, /usr/include/security/pam_appl.h)
 	override CFLAGS += -DUSE_PAM
 	LDLIBS += -lpam -lpam_misc

policycoreutils/sandbox/Makefile +1 -1

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/sandbox/Makefile selinux-09092011-make-arguments/policycoreutils/sandbox/Makefile
@@ -7,7 +7,7 @@ SBINDIR ?= $(PREFIX)/sbin
 MANDIR ?= $(PREFIX)/share/man
 LOCALEDIR ?= /usr/share/locale
 SHAREDIR ?= $(PREFIX)/share/sandbox
-override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DPACKAGE="\"policycoreutils\""
+override CFLAGS += $(LDFLAGS) -I../../libselinux/include -I$(PREFIX)/include -DPACKAGE="\"policycoreutils\""
 LDLIBS += -lselinux -lcap-ng 
 
 all: sandbox seunshare sandboxX.sh start

policycoreutils/secon/Makefile +2 -2

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/secon/Makefile selinux-09092011-make-arguments/policycoreutils/secon/Makefile
@@ -8,8 +8,8 @@ LIBDIR ?= ${PREFIX}/lib
 WARNS=-Werror -W -Wall -Wundef -Wshadow -Wpointer-arith -Wbad-function-cast -Wcast-align -Wwrite-strings -Waggregate-return -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -Wno-format-zero-length -Wformat-nonliteral -Wformat-security -Wfloat-equal
 VERSION = $(shell cat ../VERSION)
 CFLAGS ?= $(WARNS) -O1
-override CFLAGS += -DVERSION=\"$(VERSION)\" -I$(INCLUDEDIR) 
-LDLIBS = -lselinux -L$(LIBDIR)
+override CFLAGS += -DVERSION=\"$(VERSION)\" -I../../libselinux/include -I$(INCLUDEDIR) 
+LDLIBS = -L../../libselinux/src -lselinux -L$(LIBDIR)
 
 all: secon

policycoreutils/semodule/Makefile +2 -2

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/semodule/Makefile selinux-09092011-make-arguments/policycoreutils/semodule/Makefile
@@ -6,8 +6,8 @@ MANDIR = $(PREFIX)/share/man
 LIBDIR ?= ${PREFIX}/lib
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(INCLUDEDIR)
-LDLIBS = -lsepol -lselinux -lsemanage -L$(LIBDIR)
+override CFLAGS += -I../../libsemanage/include -I$(INCLUDEDIR)
+LDLIBS = -L../../libsepol/src -lsepol -L../../libselinux/src -lselinux -L../../libsemanage/src -lsemanage -L$(LIBDIR)
 SEMODULE_OBJS = semodule.o
 
 all: semodule

policycoreutils/semodule_deps/Makefile +2 -2

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/semodule_deps/Makefile selinux-09092011-make-arguments/policycoreutils/semodule_deps/Makefile
@@ -6,8 +6,8 @@ LIBDIR ?= ${PREFIX}/lib
 MANDIR ?= $(PREFIX)/share/man
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(INCLUDEDIR)
-LDLIBS = $(LIBDIR)/libsepol.a
+override CFLAGS += -I../../libsepol/include -I$(INCLUDEDIR)
+LDLIBS = ../../libsepol/src/libsepol.a
 
 all: semodule_deps

policycoreutils/semodule_expand/Makefile +2 -2

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/semodule_expand/Makefile selinux-09092011-make-arguments/policycoreutils/semodule_expand/Makefile
@@ -6,8 +6,8 @@ LIBDIR ?= ${PREFIX}/lib
 MANDIR ?= $(PREFIX)/share/man
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(INCLUDEDIR)
-LDLIBS = -lsepol -lselinux -L$(LIBDIR)
+override CFLAGS += -I../../libsepol/include -I$(INCLUDEDIR)
+LDLIBS = -L../../libsepol/src -lsepol -L../../libselinux/src -lselinux -L$(LIBDIR)
 
 all: semodule_expand

policycoreutils/semodule_link/Makefile +2 -2

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/semodule_link/Makefile selinux-09092011-make-arguments/policycoreutils/semodule_link/Makefile
@@ -6,8 +6,8 @@ MANDIR ?= $(PREFIX)/share/man
 LIBDIR ?= ${PREFIX}/lib
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(INCLUDEDIR)
-LDLIBS = -lsepol -lselinux -L$(LIBDIR)
+override CFLAGS += -I../../libsepol/include -I$(INCLUDEDIR)
+LDLIBS = -L../../libsepol/src -lsepol -L../../libselinux/src -lselinux -L$(LIBDIR)
 
 all: semodule_link

policycoreutils/semodule_package/Makefile +2 -2

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/semodule_package/Makefile selinux-09092011-make-arguments/policycoreutils/semodule_package/Makefile
@@ -6,8 +6,8 @@ LIBDIR ?= ${PREFIX}/lib
 MANDIR ?= $(PREFIX)/share/man
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(INCLUDEDIR)
-LDLIBS = -lsepol -lselinux -L$(LIBDIR)
+override CFLAGS += -I../../libsepol/include -I$(INCLUDEDIR)
+LDLIBS = -L../../libsepol/src -lsepol -L../../libselinux/src -lselinux -L$(LIBDIR)
 
 all: semodule_package semodule_unpackage

policycoreutils/sestatus/Makefile +2 -2

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/sestatus/Makefile selinux-09092011-make-arguments/policycoreutils/sestatus/Makefile
@@ -6,8 +6,8 @@ ETCDIR ?= $(DESTDIR)/etc
 LIBDIR ?= ${PREFIX}/lib
 
 CFLAGS = -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64
-LDLIBS = -lselinux -L$(LIBDIR)
+override CFLAGS += -I../../libselinux/include -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64
+LDLIBS = -L../../libselinux/src -lselinux -L$(LIBDIR)
 
 all: sestatus

policycoreutils/setfiles/Makefile +2 -2

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/setfiles/Makefile selinux-09092011-make-arguments/policycoreutils/setfiles/Makefile
@@ -6,8 +6,8 @@ LIBDIR ?= $(PREFIX)/lib
 AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null)
 
 CFLAGS = -g -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include
-LDLIBS = -lselinux -lsepol -L$(LIBDIR)
+override CFLAGS += -I../../libselinux/include -I../../libsepol/include -I$(PREFIX)/include
+LDLIBS = -L../../libselinux/src -lselinux -L../../libsepol/src -lsepol -L$(LIBDIR)
 
 ifeq (${AUDITH}, /usr/include/libaudit.h)
 	override CFLAGS += -DUSE_AUDIT

policycoreutils/setsebool/Makefile +2 -2

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/setsebool/Makefile selinux-09092011-make-arguments/policycoreutils/setsebool/Makefile
@@ -6,8 +6,8 @@ MANDIR = $(PREFIX)/share/man
 LIBDIR ?= ${PREFIX}/lib
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(INCLUDEDIR)
-LDLIBS = -lsepol -lselinux -lsemanage -L$(LIBDIR)
+override CFLAGS += -I../../libselinux/include -I../../libsemanage/include -I$(INCLUDEDIR)
+LDLIBS = -L../../libsepol/src -lsepol -L../../libselinux/src -lselinux -L../../libsemanage/src -lsemanage -L$(LIBDIR)
 SETSEBOOL_OBJS = setsebool.o
 
 all: setsebool

Quoted 322 lines · Guido Trentalancia

The final version of the patch which works on my system is attached below for further testing.

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/checkpolicy/Makefile selinux-09092011-final-local-build/checkpolicy/Makefile

checkpolicy/Makefile +2 -2

@@ -12,14 +12,14 @@ YACC = bison -y
 
 CFLAGS ?= -g -Wall -Werror -Wshadow -O2 -pipe -fno-strict-aliasing
 
-override CFLAGS += -I. -I${INCLUDEDIR}
+override CFLAGS += -I. -I../libsepol/include -I${INCLUDEDIR}
 
 CHECKOBJS = y.tab.o lex.yy.o queue.o module_compiler.o parse_util.o \
 	    policy_define.o
 CHECKPOLOBJS = $(CHECKOBJS) checkpolicy.o
 CHECKMODOBJS = $(CHECKOBJS) checkmodule.o
 
-LDLIBS=$(LIBDIR)/libsepol.a -lfl
+LDLIBS=../libsepol/src/libsepol.a -L$(LIBDIR) -lfl
 
 GENERATED=lex.yy.c y.tab.c y.tab.h

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/checkpolicy/test/Makefile selinux-09092011-final-local-build/checkpolicy/test/Makefile

checkpolicy/test/Makefile +2 -2

@@ -7,9 +7,9 @@ LIBDIR=$(PREFIX)/lib
 INCLUDEDIR ?= $(PREFIX)/include
 
 CFLAGS ?= -g -Wall -O2 -pipe
-override CFLAGS += -I$(INCLUDEDIR)
+override CFLAGS += -I../../libsepol/include -I$(INCLUDEDIR)
 
-LDLIBS=-lfl -lsepol -lselinux $(LIBDIR)/libsepol.a -L$(LIBDIR)
+LDLIBS=-L../../libselinux/src -lselinux -L../../libsepol/src -lsepol ../../libsepol/src/libsepol.a -L$(LIBDIR) -lfl
 
 all: dispol dismod

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/libselinux/src/Makefile selinux-09092011-final-local-build/libselinux/src/Makefile

libselinux/src/Makefile +3 -3

@@ -54,7 +54,7 @@ SRCS= $(filter-out $(UNUSED_SRCS) $(GENE
 OBJS= $(patsubst %.c,%.o,$(SRCS))
 LOBJS= $(patsubst %.c,%.lo,$(SRCS))
 CFLAGS ?= -Werror -Wall -W -Wundef -Wshadow -Wmissing-noreturn -Wmissing-format-attribute
-override CFLAGS += -I../include -I$(INCLUDEDIR) -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 $(EMFLAGS)
+override CFLAGS += -I../include -I../../libsepol/include -I$(INCLUDEDIR) -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 $(EMFLAGS)
 RANLIB=ranlib
 
 ARCH := $(patsubst i%86,i386,$(shell uname -m))

@@ -102,7 +102,7 @@ $(AUDIT2WHYLOBJ): audit2why.c
 	$(CC) $(filter-out -Werror, $(CFLAGS)) $(PYINC) -fPIC -DSHARED -c -o $@ $<
 
 $(AUDIT2WHYSO): $(AUDIT2WHYLOBJ)
-	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux ${LIBDIR}/libsepol.a -L$(LIBDIR) -Wl,-soname,$@
+	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux ../../libsepol/libsepol.a -L$(LIBDIR) -Wl,-soname,$@
 
 %.o:  %.c policy.h
 	$(CC) $(CFLAGS) $(TLSFLAGS) -c -o $@ $<

@@ -126,7 +126,7 @@ install: all
 	install -m 755 $(LIBSO) $(SHLIBDIR)
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
-	cd $(LIBDIR) && ln -sf ../../`basename $(SHLIBDIR)`/$(LIBSO) $(TARGET)
+	cd $(LIBDIR) && ln -sf $(LIBSO) $(TARGET)
 
 install-pywrap: pywrap
 	test -d $(PYLIBDIR)/site-packages/selinux || install -m 755 -d $(PYLIBDIR)/site-packages/selinux

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/libsemanage/src/Makefile selinux-09092011-final-local-build/libsemanage/src/Makefile

libsemanage/src/Makefile +2 -2

@@ -55,7 +55,7 @@ OBJS= $(patsubst %.c,%.o,$(SRCS)) conf-s
 LOBJS= $(patsubst %.c,%.lo,$(SRCS)) conf-scan.lo conf-parse.lo
 CFLAGS ?= -Werror -Wall -W -Wundef -Wshadow -Wmissing-noreturn -Wmissing-format-attribute
 
-override CFLAGS += -I../include -I$(INCLUDEDIR) -D_GNU_SOURCE 
+override CFLAGS += -I../include -I../../libselinux/include -I../../libsepol/include -I$(INCLUDEDIR) -D_GNU_SOURCE 
 RANLIB=ranlib
 
 SWIG = swig -Wall -python -o $(SWIGCOUT) -outdir ./

@@ -87,7 +87,7 @@ $(LIBA): $(OBJS)
 	$(RANLIB) $@
 
 $(LIBSO): $(LOBJS)
-	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -lsepol -lselinux -lbz2 -lustr -L$(LIBDIR) -Wl,-soname,$(LIBSO),--version-script=libsemanage.map,-z,defs
+	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L../../libsepol/src -lsepol -L../../libselinux/src -lselinux -L$(LIBDIR) -lbz2 -lustr -Wl,-soname,$(LIBSO),--version-script=libsemanage.map,-z,defs
 	ln -sf $@ $(TARGET)
 
 $(LIBPC): $(LIBPC).in

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/libsepol/src/Makefile selinux-09092011-final-local-build/libsepol/src/Makefile

libsepol/src/Makefile +1 -1

@@ -43,7 +43,7 @@ install: all
 	install -m 755 $(LIBSO) $(SHLIBDIR)
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
-	cd $(LIBDIR) && ln -sf ../../`basename $(SHLIBDIR)`/$(LIBSO) $(TARGET)
+	cd $(LIBDIR) && ln -sf $(LIBSO) $(TARGET)
 
 relabel:
 	/sbin/restorecon $(SHLIBDIR)/$(LIBSO)

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/load_policy/Makefile selinux-09092011-final-local-build/policycoreutils/load_policy/Makefile

policycoreutils/load_policy/Makefile +2 -2

@@ -6,8 +6,8 @@ MANDIR ?= $(PREFIX)/share/man
 LOCALEDIR ?= /usr/share/locale
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lsepol -lselinux -L$(PREFIX)/lib
+override CFLAGS += $(LDFLAGS) -I../../libselinux/include -I../../libsepol/include -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+LDLIBS += -L../../libsepol/src -lsepol -L../../libselinux/src -lselinux
 
 TARGETS=$(patsubst %.c,%,$(wildcard *.c))

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/mcstrans/src/Makefile selinux-09092011-final-local-build/policycoreutils/mcstrans/src/Makefile

policycoreutils/mcstrans/src/Makefile +1 -1

@@ -28,7 +28,7 @@ override CFLAGS += -I../include -D_GNU_S
 all: $(PROG)
 
 $(PROG): $(PROG_OBJS)
-	$(CC) $(LDFLAGS) -pie -o $@ $^ -lselinux -lcap -lpcre $(LIBDIR)/libsepol.a
+	$(CC) $(LDFLAGS) -pie -o $@ $^ -L../../../libselinux/src -lselinux ../../../libsepol/src/libsepol.a -L$(LIBDIR) -lcap -lpcre
 
 %.o:  %.c 
 	$(CC) $(CFLAGS) -fPIE -c -o $@ $<

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/mcstrans/utils/Makefile selinux-09092011-final-local-build/policycoreutils/mcstrans/utils/Makefile

policycoreutils/mcstrans/utils/Makefile +1 -1

@@ -21,7 +21,7 @@ endif
 
 CFLAGS ?= -Wall
 override CFLAGS += -I../src -D_GNU_SOURCE
-LDLIBS += -L../src ../src/mcstrans.o ../src/mls_level.o -lselinux -lpcre $(LIBDIR)/libsepol.a
+LDLIBS += -L../src ../src/mcstrans.o ../src/mls_level.o -L../../../libselinux/src -lselinux ../../../libsepol/src/libsepol.a -L$(LIBDIR) -lpcre
 
 TARGETS=$(patsubst %.c,%,$(wildcard *.c))

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/newrole/Makefile selinux-09092011-final-local-build/policycoreutils/newrole/Makefile

policycoreutils/newrole/Makefile +1 -1

@@ -22,7 +22,7 @@ VERSION = $(shell cat ../VERSION)
 
 CFLAGS ?= -Werror -Wall -W
 EXTRA_OBJS =
-override CFLAGS += -DVERSION=\"$(VERSION)\" $(LDFLAGS) -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+override CFLAGS += -DVERSION=\"$(VERSION)\" $(LDFLAGS) -I../../libselinux/include -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
 LDLIBS += -lselinux -L$(PREFIX)/lib
 ifeq (${PAMH}, /usr/include/security/pam_appl.h)
 	override CFLAGS += -DUSE_PAM

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/restorecond/Makefile selinux-09092011-final-local-build/policycoreutils/restorecond/Makefile

policycoreutils/restorecond/Makefile +1 -1

@@ -6,7 +6,7 @@ INITDIR = $(DESTDIR)/etc/rc.d/init.d
 SELINUXDIR = $(DESTDIR)/etc/selinux
 
 CFLAGS ?= -g -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64
+override CFLAGS += -I../../libselinux/include -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64
 LDLIBS += -lselinux -L$(PREFIX)/lib
 
 all: restorecond

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/run_init/Makefile selinux-09092011-final-local-build/policycoreutils/run_init/Makefile

policycoreutils/run_init/Makefile +1 -1

@@ -9,7 +9,7 @@ PAMH = $(shell ls /usr/include/security/
 AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null)
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+override CFLAGS += -I../../libselinux/include -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
 LDLIBS += -lselinux -L$(PREFIX)/lib
 ifeq (${PAMH}, /usr/include/security/pam_appl.h)
 	override CFLAGS += -DUSE_PAM

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/sandbox/Makefile selinux-09092011-final-local-build/policycoreutils/sandbox/Makefile

policycoreutils/sandbox/Makefile +1 -1

@@ -7,7 +7,7 @@ SBINDIR ?= $(PREFIX)/sbin
 MANDIR ?= $(PREFIX)/share/man
 LOCALEDIR ?= /usr/share/locale
 SHAREDIR ?= $(PREFIX)/share/sandbox
-override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DPACKAGE="\"policycoreutils\""
+override CFLAGS += $(LDFLAGS) -I../../libselinux/include -I$(PREFIX)/include -DPACKAGE="\"policycoreutils\""
 LDLIBS += -lselinux -lcap-ng 
 
 all: sandbox seunshare sandboxX.sh start

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/secon/Makefile selinux-09092011-final-local-build/policycoreutils/secon/Makefile

policycoreutils/secon/Makefile +2 -2

@@ -8,8 +8,8 @@ LIBDIR ?= ${PREFIX}/lib
 WARNS=-Werror -W -Wall -Wundef -Wshadow -Wpointer-arith -Wbad-function-cast -Wcast-align -Wwrite-strings -Waggregate-return -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -Wno-format-zero-length -Wformat-nonliteral -Wformat-security -Wfloat-equal
 VERSION = $(shell cat ../VERSION)
 CFLAGS ?= $(WARNS) -O1
-override CFLAGS += -DVERSION=\"$(VERSION)\" -I$(INCLUDEDIR) 
-LDLIBS = -lselinux -L$(LIBDIR)
+override CFLAGS += -DVERSION=\"$(VERSION)\" -I../../libselinux/include -I$(INCLUDEDIR) 
+LDLIBS = -L../../libselinux/src -lselinux
 
 all: secon

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/semodule/Makefile selinux-09092011-final-local-build/policycoreutils/semodule/Makefile

policycoreutils/semodule/Makefile +2 -2

@@ -6,8 +6,8 @@ MANDIR = $(PREFIX)/share/man
 LIBDIR ?= ${PREFIX}/lib
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(INCLUDEDIR)
-LDLIBS = -lsepol -lselinux -lsemanage -L$(LIBDIR)
+override CFLAGS += -I../../libsemanage/include -I$(INCLUDEDIR)
+LDLIBS = -L../../libselinux/src -lselinux -L../../libsepol/src -lsepol -L../../libsemanage/src -lsemanage
 SEMODULE_OBJS = semodule.o
 
 all: semodule

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/semodule_deps/Makefile selinux-09092011-final-local-build/policycoreutils/semodule_deps/Makefile

policycoreutils/semodule_deps/Makefile +2 -2

@@ -6,8 +6,8 @@ LIBDIR ?= ${PREFIX}/lib
 MANDIR ?= $(PREFIX)/share/man
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(INCLUDEDIR)
-LDLIBS = $(LIBDIR)/libsepol.a
+override CFLAGS += -I../../libsepol/include -I$(INCLUDEDIR)
+LDLIBS = ../../libsepol/src/libsepol.a
 
 all: semodule_deps

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/semodule_expand/Makefile selinux-09092011-final-local-build/policycoreutils/semodule_expand/Makefile

policycoreutils/semodule_expand/Makefile +2 -2

@@ -6,8 +6,8 @@ LIBDIR ?= ${PREFIX}/lib
 MANDIR ?= $(PREFIX)/share/man
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(INCLUDEDIR)
-LDLIBS = -lsepol -lselinux -L$(LIBDIR)
+override CFLAGS += -I../../libsepol/include -I$(INCLUDEDIR)
+LDLIBS = -L../../libsepol/src -lsepol -L../../libselinux/src -lselinux
 
 all: semodule_expand

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/semodule_link/Makefile selinux-09092011-final-local-build/policycoreutils/semodule_link/Makefile

policycoreutils/semodule_link/Makefile +2 -2

@@ -6,8 +6,8 @@ MANDIR ?= $(PREFIX)/share/man
 LIBDIR ?= ${PREFIX}/lib
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(INCLUDEDIR)
-LDLIBS = -lsepol -lselinux -L$(LIBDIR)
+override CFLAGS += -I../../libsepol/include -I$(INCLUDEDIR)
+LDLIBS = -L../../libsepol/src -lsepol -L../../libselinux/src -lselinux
 
 all: semodule_link

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/semodule_package/Makefile selinux-09092011-final-local-build/policycoreutils/semodule_package/Makefile

policycoreutils/semodule_package/Makefile +2 -2

@@ -6,8 +6,8 @@ LIBDIR ?= ${PREFIX}/lib
 MANDIR ?= $(PREFIX)/share/man
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(INCLUDEDIR)
-LDLIBS = -lsepol -lselinux -L$(LIBDIR)
+override CFLAGS += -I../../libsepol/include -I$(INCLUDEDIR)
+LDLIBS = -L../../libsepol/src -lsepol -L../../libselinux/src -lselinux
 
 all: semodule_package semodule_unpackage

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/sestatus/Makefile selinux-09092011-final-local-build/policycoreutils/sestatus/Makefile

policycoreutils/sestatus/Makefile +2 -2

@@ -6,8 +6,8 @@ ETCDIR ?= $(DESTDIR)/etc
 LIBDIR ?= ${PREFIX}/lib
 
 CFLAGS = -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64
-LDLIBS = -lselinux -L$(LIBDIR)
+override CFLAGS += -I../../libselinux/include -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64
+LDLIBS = -L../../libselinux/src -lselinux
 
 all: sestatus

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/setfiles/Makefile selinux-09092011-final-local-build/policycoreutils/setfiles/Makefile

policycoreutils/setfiles/Makefile +2 -2

@@ -6,8 +6,8 @@ LIBDIR ?= $(PREFIX)/lib
 AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null)
 
 CFLAGS = -g -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include
-LDLIBS = -lselinux -lsepol -L$(LIBDIR)
+override CFLAGS += -I../../libsepol/include -I../../libselinux/include -I$(PREFIX)/include
+LDLIBS = -L../../libselinux/src -lselinux -L../../libsepol/src -lsepol
 
 ifeq (${AUDITH}, /usr/include/libaudit.h)
 	override CFLAGS += -DUSE_AUDIT

diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/policycoreutils/setsebool/Makefile selinux-09092011-final-local-build/policycoreutils/setsebool/Makefile

policycoreutils/setsebool/Makefile +2 -3

@@ -6,8 +6,8 @@ MANDIR = $(PREFIX)/share/man
 LIBDIR ?= ${PREFIX}/lib
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(INCLUDEDIR)
-LDLIBS = -lsepol -lselinux -lsemanage -L$(LIBDIR)
+override CFLAGS += -I../../libselinux/include -I../../libsemanage/include -I$(INCLUDEDIR)
+LDLIBS = -L../../libselinux/src -lselinux -L../../libsepol/src -lsepol -L../../libsemanage/src -lsemanage
 SETSEBOOL_OBJS = setsebool.o
 
 all: setsebool
 
 
--

Quoted 4 lines

This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

Joshua Brindle

2011-09-11 23:22 UTC #18 lore raw

Re: [RFC] Userspace top-level Makefile (was Re: [PATCH] Fix LIBDIR usage for load_policy)

In reply to Eric Paris

Quoted 22 lines · Eric Paris

Quoted 21 lines · Guido Trentalancia
Quoted 10 lines · Eric Paris
Quoted 9 lines · Guido Trentalancia
The following patch is probably even better as it actually sorts out the problem rather than just printing out a warning (it can still be combined with the creation of a top-level README file):
diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/checkpolicy/Makefile selinux-09092011-local-headers/checkpolicy/Makefile
checkpolicy/Makefile +0 -0
@@ -12,7 +12,7 @@ YACC = bison -y
 
Quoted 6 lines
checkpolicy/Makefile YACC = bison -y · line 15
Quoted 4 lines
checkpolicy/Makefile +1 -1
  CFLAGS ?= -g -Wall -Werror -Wshadow -O2 -pipe -fno-strict-aliasing
 
-override CFLAGS += -I. -I${INCLUDEDIR}
+override CFLAGS += -I. -I../libsepol/include -I${INCLUDEDIR}
I haven't checked, but can the makefiles then work when there is no ../libsepol/include?
If ../libsepol/include does not exist and libsepol headers are not installed under the standard location (${INCLUDEDIR}), then the above is going to fail.

Quoted 9 lines

Quoted 2 lines
But why should libsepol/include be missing from git in the first place ??
I agree that they must be in one or the other for it to build. A number of distros build these packages separately, rather than all at once. Thus there would be no ../libsepol/include directory at all, but the headers should be picked up by -I$(INCLUDEDIR). As long as gcc doesn't care that the directory doesn't exist, I actually like it.

gcc doesn't care and I swear we use to have ../ directories in the include path, not sure what happened to those :X

Guido Trentalancia

author

2011-09-12 02:13 UTC #19 lore raw

Re: [RFC] Userspace top-level Makefile (was Re: [PATCH] Fix LIBDIR usage for load_policy)

Quoted 33 lines · Joshua Brindle

Quoted 22 lines · Eric Paris
Quoted 21 lines · Guido Trentalancia
Quoted 10 lines · Eric Paris
Quoted 9 lines · Guido Trentalancia
The following patch is probably even better as it actually sorts out the problem rather than just printing out a warning (it can still be combined with the creation of a top-level README file):
diff -x '*.po' -x '*.pot' -pru selinux-09092011-orig/checkpolicy/Makefile selinux-09092011-local-headers/checkpolicy/Makefile
checkpolicy/Makefile +0 -0
@@ -12,7 +12,7 @@ YACC = bison -y
 
Quoted 6 lines
checkpolicy/Makefile YACC = bison -y · line 15
Quoted 4 lines
checkpolicy/Makefile +1 -1
  CFLAGS ?= -g -Wall -Werror -Wshadow -O2 -pipe -fno-strict-aliasing
 
-override CFLAGS += -I. -I${INCLUDEDIR}
+override CFLAGS += -I. -I../libsepol/include -I${INCLUDEDIR}
I haven't checked, but can the makefiles then work when there is no ../libsepol/include?
If ../libsepol/include does not exist and libsepol headers are not installed under the standard location (${INCLUDEDIR}), then the above is going to fail.
Quoted 9 lines
Quoted 2 lines
But why should libsepol/include be missing from git in the first place ??
I agree that they must be in one or the other for it to build. A number of distros build these packages separately, rather than all at once. Thus there would be no ../libsepol/include directory at all, but the headers should be picked up by -I$(INCLUDEDIR). As long as gcc doesn't care that the directory doesn't exist, I actually like it.

Quoted 2 lines

gcc doesn't care and I swear we use to have ../ directories in the include path, not sure what happened to those :X

Honestly, I don't know, I can't remember. From reading a bit of git log, perhaps I can speculate it wasn't there, but what I am hitting is also cross-dependencies between the objects in the library directories (so for example libsepol symbols being required by objects in the libselinux directory).

But if you decide to apply that latest patch, you then need a different patch afterwards to fix the LIBDIR issue with load_policy:

policycoreutils/load_policy/Makefile +2 -1

@@ -3,11 +3,12 @@ PREFIX ?= ${DESTDIR}/usr
 SBINDIR ?= $(DESTDIR)/sbin
 USRSBINDIR ?= $(PREFIX)/sbin
 MANDIR ?= $(PREFIX)/share/man
+LIBDIR ?= $(PREFIX)/usr/lib
 LOCALEDIR ?= /usr/share/locale
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += $(LDFLAGS) -I../../libselinux/include -I../../libsepol/include -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
-LDLIBS += -L../../libsepol/src -lsepol -L../../libselinux/src -lselinux -L$(PREFIX)/lib
+LDLIBS += -L../../libsepol/src -lsepol -L../../libselinux/src -lselinux -L$(LIBDIR)
 
 TARGETS=$(patsubst %.c,%,$(wildcard *.c))

It is maintenance tasks and it strongly depends which way you prefer amongst many different ways of doing it more or less equivalently. There might be other things that could be fixed too.

Or a new complete patch (with further minor fixes) could be as follows:

This is a maintenance patch for further testing. It potentially replaces any other patch previously posted in this same thread.

Make sure that the SELinux userspace libraries and tools bundle from the git repository can be built from scratch without requiring existing SELinux installations (in particular header files).

Fix a possible installation issue (creation of symbolic links with wrong target to shared libraries for libselinux and libsepol).

Replace curly brackets with parentheses for some variables such as DESTDIR and PREFIX in the Makefiles. Add and make use of LIBDIR and INCLUDEDIR where appropriate within the Makefiles. Make use of PREFIX for creating LOCALEDIR within the Makefiles. Do not override passed environment variables (replace = with ?=) within the Makefiles.

checkpolicy/Makefile +2 -2

diff -pru selinux/checkpolicy/Makefile selinux-12092011-git-fix-local-build-fix-load_policy-LIBDIR-v2/checkpolicy/Makefile
@@ -12,14 +12,14 @@ YACC = bison -y
 
 CFLAGS ?= -g -Wall -Werror -Wshadow -O2 -pipe -fno-strict-aliasing
 
-override CFLAGS += -I. -I${INCLUDEDIR}
+override CFLAGS += -I. -I../libsepol/include -I${INCLUDEDIR}
 
 CHECKOBJS = y.tab.o lex.yy.o queue.o module_compiler.o parse_util.o \
 	    policy_define.o
 CHECKPOLOBJS = $(CHECKOBJS) checkpolicy.o
 CHECKMODOBJS = $(CHECKOBJS) checkmodule.o
 
-LDLIBS=$(LIBDIR)/libsepol.a -lfl
+LDLIBS=../libsepol/src/libsepol.a -L$(LIBDIR) -lfl
 
 GENERATED=lex.yy.c y.tab.c y.tab.h

checkpolicy/test/Makefile +2 -2

diff -pru selinux/checkpolicy/test/Makefile selinux-12092011-git-fix-local-build-fix-load_policy-LIBDIR-v2/checkpolicy/test/Makefile
@@ -7,9 +7,9 @@ LIBDIR=$(PREFIX)/lib
 INCLUDEDIR ?= $(PREFIX)/include
 
 CFLAGS ?= -g -Wall -O2 -pipe
-override CFLAGS += -I$(INCLUDEDIR)
+override CFLAGS += -I../../libsepol/include -I$(INCLUDEDIR)
 
-LDLIBS=-lfl -lsepol -lselinux $(LIBDIR)/libsepol.a -L$(LIBDIR)
+LDLIBS=-L../../libsepol/src -lsepol -L../../libselinux/src -lselinux ../../libsepol/src/libsepol.a -L$(LIBDIR) -lfl
 
 all: dispol dismod

libselinux/src/Makefile +3 -3

diff -pru selinux/libselinux/src/Makefile selinux-12092011-git-fix-local-build-fix-load_policy-LIBDIR-v2/libselinux/src/Makefile
@@ -54,7 +54,7 @@ SRCS= $(filter-out $(UNUSED_SRCS) $(GENE
 OBJS= $(patsubst %.c,%.o,$(SRCS))
 LOBJS= $(patsubst %.c,%.lo,$(SRCS))
 CFLAGS ?= -Werror -Wall -W -Wundef -Wshadow -Wmissing-noreturn -Wmissing-format-attribute
-override CFLAGS += -I../include -I$(INCLUDEDIR) -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 $(EMFLAGS)
+override CFLAGS += -I../include -I../../libsepol/include -I$(INCLUDEDIR) -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 $(EMFLAGS)
 RANLIB=ranlib
 
 ARCH := $(patsubst i%86,i386,$(shell uname -m))

@@ -102,7 +102,7 @@ $(AUDIT2WHYLOBJ): audit2why.c
 	$(CC) $(filter-out -Werror, $(CFLAGS)) $(PYINC) -fPIC -DSHARED -c -o $@ $<
 
 $(AUDIT2WHYSO): $(AUDIT2WHYLOBJ)
-	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux ${LIBDIR}/libsepol.a -L$(LIBDIR) -Wl,-soname,$@
+	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux ../../libsepol/src/libsepol.a -L$(LIBDIR) -Wl,-soname,$@
 
 %.o:  %.c policy.h
 	$(CC) $(CFLAGS) $(TLSFLAGS) -c -o $@ $<

@@ -126,7 +126,7 @@ install: all
 	install -m 755 $(LIBSO) $(SHLIBDIR)
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
-	cd $(LIBDIR) && ln -sf ../../`basename $(SHLIBDIR)`/$(LIBSO) $(TARGET)
+	cd $(LIBDIR) && ln -sf $(LIBSO) $(TARGET)
 
 install-pywrap: pywrap
 	test -d $(PYLIBDIR)/site-packages/selinux || install -m 755 -d $(PYLIBDIR)/site-packages/selinux

libsemanage/src/Makefile +2 -2

diff -pru selinux/libsemanage/src/Makefile selinux-12092011-git-fix-local-build-fix-load_policy-LIBDIR-v2/libsemanage/src/Makefile
@@ -55,7 +55,7 @@ OBJS= $(patsubst %.c,%.o,$(SRCS)) conf-s
 LOBJS= $(patsubst %.c,%.lo,$(SRCS)) conf-scan.lo conf-parse.lo
 CFLAGS ?= -Werror -Wall -W -Wundef -Wshadow -Wmissing-noreturn -Wmissing-format-attribute
 
-override CFLAGS += -I../include -I$(INCLUDEDIR) -D_GNU_SOURCE 
+override CFLAGS += -I../include -I../../libselinux/include -I../../libsepol/include -I$(INCLUDEDIR) -D_GNU_SOURCE 
 RANLIB=ranlib
 
 SWIG = swig -Wall -python -o $(SWIGCOUT) -outdir ./

@@ -87,7 +87,7 @@ $(LIBA): $(OBJS)
 	$(RANLIB) $@
 
 $(LIBSO): $(LOBJS)
-	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -lsepol -lselinux -lbz2 -lustr -L$(LIBDIR) -Wl,-soname,$(LIBSO),--version-script=libsemanage.map,-z,defs
+	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L../../libsepol/src -lsepol -L../../libselinux/src -lselinux -L$(LIBDIR) -lbz2 -lustr -Wl,-soname,$(LIBSO),--version-script=libsemanage.map,-z,defs
 	ln -sf $@ $(TARGET)
 
 $(LIBPC): $(LIBPC).in

libsepol/src/Makefile +1 -1

diff -pru selinux/libsepol/src/Makefile selinux-12092011-git-fix-local-build-fix-load_policy-LIBDIR-v2/libsepol/src/Makefile
@@ -43,7 +43,7 @@ install: all
 	install -m 755 $(LIBSO) $(SHLIBDIR)
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
-	cd $(LIBDIR) && ln -sf ../../`basename $(SHLIBDIR)`/$(LIBSO) $(TARGET)
+	cd $(LIBDIR) && ln -sf $(LIBSO) $(TARGET)
 
 relabel:
 	/sbin/restorecon $(SHLIBDIR)/$(LIBSO)

policycoreutils/audit2allow/Makefile +2 -2

diff -pru selinux/policycoreutils/audit2allow/Makefile selinux-12092011-git-fix-local-build-fix-load_policy-LIBDIR-v2/policycoreutils/audit2allow/Makefile
@@ -1,9 +1,9 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 BINDIR ?= $(PREFIX)/bin
 LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 
 all: ;

policycoreutils/audit2why/Makefile +1 -1

diff -pru selinux/policycoreutils/audit2why/Makefile selinux-12092011-git-fix-local-build-fix-load_policy-LIBDIR-v2/policycoreutils/audit2why/Makefile
@@ -1,5 +1,5 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 BINDIR ?= $(PREFIX)/bin
 MANDIR ?= $(PREFIX)/share/man

policycoreutils/load_policy/Makefile +6 -4

diff -pru selinux/policycoreutils/load_policy/Makefile selinux-12092011-git-fix-local-build-fix-load_policy-LIBDIR-v2/policycoreutils/load_policy/Makefile
@@ -1,13 +1,15 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(DESTDIR)/sbin
 USRSBINDIR ?= $(PREFIX)/sbin
 MANDIR ?= $(PREFIX)/share/man
-LOCALEDIR ?= /usr/share/locale
+LIBDIR ?= $(PREFIX)/lib
+INCLUDEDIR ?= $(PREFIX)/include
+LOCALEDIR ?= $(PREFIX)/share/locale
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lsepol -lselinux -L$(PREFIX)/lib
+override CFLAGS += $(LDFLAGS) -I../../libselinux/include -I../../libsepol/include -I$(INCLUDEDIR) -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+LDLIBS += -L../../libsepol/src -lsepol -L../../libselinux/src -lselinux -L$(LIBDIR)
 
 TARGETS=$(patsubst %.c,%,$(wildcard *.c))

policycoreutils/mcstrans/src/Makefile +1 -1

diff -pru selinux/policycoreutils/mcstrans/src/Makefile selinux-12092011-git-fix-local-build-fix-load_policy-LIBDIR-v2/policycoreutils/mcstrans/src/Makefile
@@ -28,7 +28,7 @@ override CFLAGS += -I../include -D_GNU_S
 all: $(PROG)
 
 $(PROG): $(PROG_OBJS)
-	$(CC) $(LDFLAGS) -pie -o $@ $^ -lselinux -lcap -lpcre $(LIBDIR)/libsepol.a
+	$(CC) $(LDFLAGS) -pie -o $@ $^ -L../../../libselinux/src -lselinux -L$(LIBDIR) -lcap -lpcre ../../../libsepol/src/libsepol.a
 
 %.o:  %.c 
 	$(CC) $(CFLAGS) -fPIE -c -o $@ $<

policycoreutils/mcstrans/utils/Makefile +1 -1

diff -pru selinux/policycoreutils/mcstrans/utils/Makefile selinux-12092011-git-fix-local-build-fix-load_policy-LIBDIR-v2/policycoreutils/mcstrans/utils/Makefile
@@ -21,7 +21,7 @@ endif
 
 CFLAGS ?= -Wall
 override CFLAGS += -I../src -D_GNU_SOURCE
-LDLIBS += -L../src ../src/mcstrans.o ../src/mls_level.o -lselinux -lpcre $(LIBDIR)/libsepol.a
+LDLIBS += -L../src ../src/mcstrans.o ../src/mls_level.o -L../../../libselinux/src -lselinux -L$(LIBDIR) -lpcre ../../../libsepol/src/libsepol.a
 
 TARGETS=$(patsubst %.c,%,$(wildcard *.c))

policycoreutils/newrole/Makefile +6 -4

diff -pru selinux/policycoreutils/newrole/Makefile selinux-12092011-git-fix-local-build-fix-load_policy-LIBDIR-v2/policycoreutils/newrole/Makefile
@@ -1,9 +1,11 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 BINDIR ?= $(PREFIX)/bin
+LIBDIR ?= $(PREFIX)/lib
+INCLUDEDIR ?= $(PREFIX)/include
 MANDIR ?= $(PREFIX)/share/man
 ETCDIR ?= $(DESTDIR)/etc
-LOCALEDIR = /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 PAMH = $(shell ls /usr/include/security/pam_appl.h 2>/dev/null)
 AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null)
 # Enable capabilities to permit newrole to generate audit records.

@@ -22,8 +24,8 @@ VERSION = $(shell cat ../VERSION)
 
 CFLAGS ?= -Werror -Wall -W
 EXTRA_OBJS =
-override CFLAGS += -DVERSION=\"$(VERSION)\" $(LDFLAGS) -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lselinux -L$(PREFIX)/lib
+override CFLAGS += -DVERSION=\"$(VERSION)\" $(LDFLAGS) -I../../libselinux/include -I$(INCLUDEDIR) -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+LDLIBS += -L../../libselinux/src -lselinux -L$(LIBDIR)
 ifeq (${PAMH}, /usr/include/security/pam_appl.h)
 	override CFLAGS += -DUSE_PAM
 	EXTRA_OBJS += hashtab.o

policycoreutils/restorecond/Makefile +8 -6

diff -pru selinux/policycoreutils/restorecond/Makefile selinux-12092011-git-fix-local-build-fix-load_policy-LIBDIR-v2/policycoreutils/restorecond/Makefile
@@ -1,13 +1,15 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
-INITDIR = $(DESTDIR)/etc/rc.d/init.d
-SELINUXDIR = $(DESTDIR)/etc/selinux
+MANDIR ?= $(PREFIX)/share/man
+LIBDIR ?= $(PREFIX)/lib
+INCLUDEDIR ?= $(PREFIX)/include
+INITDIR ?= $(DESTDIR)/etc/rc.d/init.d
+SELINUXDIR ?= $(DESTDIR)/etc/selinux
 
 CFLAGS ?= -g -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64
-LDLIBS += -lselinux -L$(PREFIX)/lib
+override CFLAGS += -I../../libselinux/include -I$(INCLUDEDIR) -D_FILE_OFFSET_BITS=64
+LDLIBS += -L../../libselinux/src -lselinux -L$(LIBDIR)
 
 all: restorecond

policycoreutils/run_init/Makefile +6 -5

diff -pru selinux/policycoreutils/run_init/Makefile selinux-12092011-git-fix-local-build-fix-load_policy-LIBDIR-v2/policycoreutils/run_init/Makefile
@@ -1,16 +1,17 @@
-
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(PREFIX)/sbin
 MANDIR ?= $(PREFIX)/share/man
+LIBDIR ?= $(PREFIX)/lib
+INCLUDEDIR ?= $(PREFIX)/include
 ETCDIR ?= $(DESTDIR)/etc
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 PAMH = $(shell ls /usr/include/security/pam_appl.h 2>/dev/null)
 AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null)
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lselinux -L$(PREFIX)/lib
+override CFLAGS += -I../../libselinux/include -I$(INCLUDEDIR) -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+LDLIBS += -L../../libselinux/src -lselinux -L$(LIBDIR)
 ifeq (${PAMH}, /usr/include/security/pam_appl.h)
 	override CFLAGS += -DUSE_PAM
 	LDLIBS += -lpam -lpam_misc

policycoreutils/sandbox/Makefile +8 -6

diff -pru selinux/policycoreutils/sandbox/Makefile selinux-12092011-git-fix-local-build-fix-load_policy-LIBDIR-v2/policycoreutils/sandbox/Makefile
@@ -1,14 +1,16 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
-INITDIR ?= ${DESTDIR}/etc/rc.d/init.d/
-SYSCONFDIR ?= ${DESTDIR}/etc/sysconfig
+PREFIX ?= $(DESTDIR)/usr
+INITDIR ?= $(DESTDIR)/etc/rc.d/init.d/
+SYSCONFDIR ?= $(DESTDIR)/etc/sysconfig
 BINDIR ?= $(PREFIX)/bin
 SBINDIR ?= $(PREFIX)/sbin
+LIBDIR ?= $(PREFIX)/lib
+INCLUDEDIR ?= $(PREFIX)/include
 MANDIR ?= $(PREFIX)/share/man
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 SHAREDIR ?= $(PREFIX)/share/sandbox
-override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lselinux -lcap-ng 
+override CFLAGS += $(LDFLAGS) -I../../libselinux/include -I$(INCLUDEDIR) -DPACKAGE="\"policycoreutils\""
+LDLIBS += -L../../libselinux/src -lselinux -L$(LIBDIR) -lcap-ng
 
 all: sandbox seunshare sandboxX.sh start

policycoreutils/scripts/Makefile +2 -2

diff -pru selinux/policycoreutils/scripts/Makefile selinux-12092011-git-fix-local-build-fix-load_policy-LIBDIR-v2/policycoreutils/scripts/Makefile
@@ -1,9 +1,9 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 BINDIR ?= $(PREFIX)/bin
 SBINDIR ?= $(PREFIX)/sbin
 MANDIR ?= $(PREFIX)/share/man
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 
 all: fixfiles genhomedircon chcat

policycoreutils/secon/Makefile +4 -4

diff -pru selinux/policycoreutils/secon/Makefile selinux-12092011-git-fix-local-build-fix-load_policy-LIBDIR-v2/policycoreutils/secon/Makefile
@@ -1,15 +1,15 @@
 # secon tool - command-line context
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
 MANDIR ?= $(PREFIX)/share/man
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 
 WARNS=-Werror -W -Wall -Wundef -Wshadow -Wpointer-arith -Wbad-function-cast -Wcast-align -Wwrite-strings -Waggregate-return -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -Wno-format-zero-length -Wformat-nonliteral -Wformat-security -Wfloat-equal
 VERSION = $(shell cat ../VERSION)
 CFLAGS ?= $(WARNS) -O1
-override CFLAGS += -DVERSION=\"$(VERSION)\" -I$(INCLUDEDIR) 
-LDLIBS = -lselinux -L$(LIBDIR)
+override CFLAGS += -DVERSION=\"$(VERSION)\" -I../../libselinux/include -I$(INCLUDEDIR) 
+LDLIBS = -L../../libselinux/src -lselinux -L$(LIBDIR)
 
 all: secon

policycoreutils/semanage/Makefile +2 -2

diff -pru selinux/policycoreutils/semanage/Makefile selinux-12092011-git-fix-local-build-fix-load_policy-LIBDIR-v2/policycoreutils/semanage/Makefile
@@ -1,8 +1,8 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 LIBDIR ?= $(PREFIX)/lib
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
+MANDIR ?= $(PREFIX)/share/man
 PYLIBVER ?= $(shell python -c 'import sys;print "python%d.%d" % sys.version_info[0:2]')
 PYTHONLIBDIR ?= $(LIBDIR)/$(PYLIBVER)

policycoreutils/semodule/Makefile +4 -4

diff -pru selinux/policycoreutils/semodule/Makefile selinux-12092011-git-fix-local-build-fix-load_policy-LIBDIR-v2/policycoreutils/semodule/Makefile
@@ -2,12 +2,12 @@
 PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
-LIBDIR ?= ${PREFIX}/lib
+MANDIR ?= $(PREFIX)/share/man
+LIBDIR ?= $(PREFIX)/lib
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(INCLUDEDIR)
-LDLIBS = -lsepol -lselinux -lsemanage -L$(LIBDIR)
+override CFLAGS += -I../../libsemanage/include -I$(INCLUDEDIR)
+LDLIBS = -L../../libsepol/src -lsepol -L../../libselinux/src -lselinux -L../../libsemanage/src -lsemanage -L$(LIBDIR)
 SEMODULE_OBJS = semodule.o
 
 all: semodule

policycoreutils/semodule_deps/Makefile +4 -4

diff -pru selinux/policycoreutils/semodule_deps/Makefile selinux-12092011-git-fix-local-build-fix-load_policy-LIBDIR-v2/policycoreutils/semodule_deps/Makefile
@@ -1,13 +1,13 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(INCLUDEDIR)
-LDLIBS = $(LIBDIR)/libsepol.a
+override CFLAGS += -I../../libsepol/include -I$(INCLUDEDIR)
+LDLIBS = ../../libsepol/src/libsepol.a
 
 all: semodule_deps

policycoreutils/semodule_expand/Makefile +4 -4

diff -pru selinux/policycoreutils/semodule_expand/Makefile selinux-12092011-git-fix-local-build-fix-load_policy-LIBDIR-v2/policycoreutils/semodule_expand/Makefile
@@ -1,13 +1,13 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(INCLUDEDIR)
-LDLIBS = -lsepol -lselinux -L$(LIBDIR)
+override CFLAGS += -I../../libsepol/include -I$(INCLUDEDIR)
+LDLIBS = -L../../libsepol/src -lsepol -L../../libselinux/src -lselinux -L$(LIBDIR)
 
 all: semodule_expand

policycoreutils/semodule_link/Makefile +4 -4

diff -pru selinux/policycoreutils/semodule_link/Makefile selinux-12092011-git-fix-local-build-fix-load_policy-LIBDIR-v2/policycoreutils/semodule_link/Makefile
@@ -1,13 +1,13 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
 MANDIR ?= $(PREFIX)/share/man
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(INCLUDEDIR)
-LDLIBS = -lsepol -lselinux -L$(LIBDIR)
+override CFLAGS += -I../../libsepol/include -I$(INCLUDEDIR)
+LDLIBS = -L../../libsepol/src -lsepol -L../../libselinux/src -lselinux -L$(LIBDIR)
 
 all: semodule_link

policycoreutils/semodule_package/Makefile +4 -4

diff -pru selinux/policycoreutils/semodule_package/Makefile selinux-12092011-git-fix-local-build-fix-load_policy-LIBDIR-v2/policycoreutils/semodule_package/Makefile
@@ -1,13 +1,13 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(INCLUDEDIR)
-LDLIBS = -lsepol -lselinux -L$(LIBDIR)
+override CFLAGS += -I../../libsepol/include -I$(INCLUDEDIR)
+LDLIBS = -L../../libsepol/src -lsepol -L../../libselinux/src -lselinux -L$(LIBDIR)
 
 all: semodule_package semodule_unpackage

policycoreutils/sestatus/Makefile +6 -5

diff -pru selinux/policycoreutils/sestatus/Makefile selinux-12092011-git-fix-local-build-fix-load_policy-LIBDIR-v2/policycoreutils/sestatus/Makefile
@@ -1,13 +1,14 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
+MANDIR ?= $(PREFIX)/share/man
 ETCDIR ?= $(DESTDIR)/etc
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
+INCLUDEDIR ?= $(PREFIX)/include
 
 CFLAGS = -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64
-LDLIBS = -lselinux -L$(LIBDIR)
+override CFLAGS += -I../../libselinux/include -I$(INCLUDEDIR) -D_FILE_OFFSET_BITS=64
+LDLIBS = -L../../libselinux/src -lselinux -L$(LIBDIR)
 
 all: sestatus

policycoreutils/setfiles/Makefile +5 -4

diff -pru selinux/policycoreutils/setfiles/Makefile selinux-12092011-git-fix-local-build-fix-load_policy-LIBDIR-v2/policycoreutils/setfiles/Makefile
@@ -1,13 +1,14 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(DESTDIR)/sbin
-MANDIR = $(PREFIX)/share/man
+MANDIR ?= $(PREFIX)/share/man
 LIBDIR ?= $(PREFIX)/lib
+INCLUDEDIR ?= $(PREFIX)/include
 AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null)
 
 CFLAGS = -g -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include
-LDLIBS = -lselinux -lsepol -L$(LIBDIR)
+override CFLAGS += -I../../libselinux/include -I../../libsepol/include -I$(INCLUDEDIR)
+LDLIBS = -L../../libselinux/src -lselinux -L../../libsepol/src -lsepol -L$(LIBDIR)
 
 ifeq (${AUDITH}, /usr/include/libaudit.h)
 	override CFLAGS += -DUSE_AUDIT

policycoreutils/setsebool/Makefile +4 -4

diff -pru selinux/policycoreutils/setsebool/Makefile selinux-12092011-git-fix-local-build-fix-load_policy-LIBDIR-v2/policycoreutils/setsebool/Makefile
@@ -2,12 +2,12 @@
 PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
-LIBDIR ?= ${PREFIX}/lib
+MANDIR ?= $(PREFIX)/share/man
+LIBDIR ?= $(PREFIX)/lib
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(INCLUDEDIR)
-LDLIBS = -lsepol -lselinux -lsemanage -L$(LIBDIR)
+override CFLAGS += -I../../libselinux/include -I../../libsemanage/include -I$(INCLUDEDIR)
+LDLIBS = -L../../libsepol/src -lsepol -L../../libselinux/src -lselinux -L../../libsemanage/src -lsemanage -L$(LIBDIR)
 SETSEBOOL_OBJS = setsebool.o
 
 all: setsebool

Regards,

Guido

Joshua Brindle

2011-09-12 12:41 UTC #20 lore raw

Re: [RFC] Userspace top-level Makefile (was Re: [PATCH] Fix LIBDIR usage for load_policy)

Quoted 3 lines · Guido Trentalancia

Quoted 2 lines · Joshua Brindle
Quoted 1 line · Eric Paris
On 09/09/2011 07:12 PM, Guido Trentalancia wrote:

Quoted 9 lines

Quoted 2 lines
gcc doesn't care and I swear we use to have ../ directories in the include path, not sure what happened to those :X
Honestly, I don't know, I can't remember. From reading a bit of git log, perhaps I can speculate it wasn't there, but what I am hitting is also cross-dependencies between the objects in the library directories (so for example libsepol symbols being required by objects in the libselinux directory).

Probably pre-git

libselinux/src/Makefile install: all · line 132

Quoted 9 lines

libselinux/src/Makefile +1 -1

@@ -126,7 +126,7 @@ install: all
  	install -m 755 $(LIBSO) $(SHLIBDIR)
  	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
  	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
-	cd $(LIBDIR)&&  ln -sf ../../`basename $(SHLIBDIR)`/$(LIBSO) $(TARGET)
+	cd $(LIBDIR)&&  ln -sf $(LIBSO) $(TARGET)
 
  install-pywrap: pywrap
  	test -d $(PYLIBDIR)/site-packages/selinux || install -m 755 -d $(PYLIBDIR)/site-packages/selinux

What is the purpose of this? It definitely doesn't seem right to me :\

Guido Trentalancia

author

2011-09-12 20:17 UTC #21 lore raw

Re: [RFC] Improve installation of userspace shared libraries (was Re: [RFC] Userspace top-level Makefile)

Hi Joshua,

thanks very much for your comments !

Quoted 24 lines · Joshua Brindle

Quoted 3 lines · Guido Trentalancia
Quoted 2 lines · Joshua Brindle
Quoted 1 line · Eric Paris
On 09/09/2011 07:12 PM, Guido Trentalancia wrote:
<snip>>>
Quoted 9 lines
Quoted 2 lines
gcc doesn't care and I swear we use to have ../ directories in the include path, not sure what happened to those :X
Honestly, I don't know, I can't remember. From reading a bit of git log, perhaps I can speculate it wasn't there, but what I am hitting is also cross-dependencies between the objects in the library directories (so for example libsepol symbols being required by objects in the libselinux directory).
Probably pre-git
Quoted 7 lines
(quoted diff) +1 -1
@@ -126,7 +126,7 @@ install: all
  	install -m 755 $(LIBSO) $(SHLIBDIR)
  	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
  	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
-	cd $(LIBDIR)&&  ln -sf ../../`basename $(SHLIBDIR)`/$(LIBSO) $(TARGET)
+	cd $(LIBDIR)&&  ln -sf $(LIBSO) $(TARGET)
 

Quoted 4 lines

Review install: all · line 132
Quoted 2 lines
(quoted diff) +0 -0
  install-pywrap: pywrap
  	test -d $(PYLIBDIR)/site-packages/selinux || install -m 755 -d $(PYLIBDIR)/site-packages/selinux
What is the purpose of this? It definitely doesn't seem right to me :\

In the first place it was to be coherent with what is being done by libsemanage. However, it is not entirely correct, as LIBDIR should be replaced by SHLIBDIR.

Note that apparently libsepol needs to be installed in /lib instead of $PREFIX/lib (and there is an evident mismatch between the default values for LIBDIR and SHLIBDIR compared to the other two cases).

libselinux/src/Makefile +1 -1

diff -pru selinux-12092011-git-fix-local-build-fix-load_policy-LIBDIR-v2/libselinux/src/Makefile selinux-12092011-test/libselinux/src/Makefile
@@ -126,7 +126,7 @@ install: all
 	install -m 755 $(LIBSO) $(SHLIBDIR)
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
-	cd $(LIBDIR) && ln -sf $(LIBSO) $(TARGET)
+	cd $(SHLIBDIR) && ln -sf $(LIBSO) $(TARGET)
 
 install-pywrap: pywrap
 	test -d $(PYLIBDIR)/site-packages/selinux || install -m 755 -d $(PYLIBDIR)/site-packages/selinux

libsemanage/src/Makefile +1 -1

diff -pru selinux-12092011-git-fix-local-build-fix-load_policy-LIBDIR-v2/libsemanage/src/Makefile selinux-12092011-test/libsemanage/src/Makefile
@@ -139,7 +139,7 @@ install: all
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
 	test -f $(DEFAULT_SEMANAGE_CONF_LOCATION) || install -m 644 -D semanage.conf $(DEFAULT_SEMANAGE_CONF_LOCATION)
-	cd $(LIBDIR) && ln -sf $(LIBSO) $(TARGET)
+	cd $(SHLIBDIR) && ln -sf $(LIBSO) $(TARGET)
 
 install-pywrap: pywrap 
 	test -d $(PYLIBDIR)/site-packages || install -m 755 -d $(PYLIBDIR)/site-packages

libsepol/src/Makefile +1 -1

diff -pru selinux-12092011-git-fix-local-build-fix-load_policy-LIBDIR-v2/libsepol/src/Makefile selinux-12092011-test/libsepol/src/Makefile
@@ -43,7 +43,7 @@ install: all
 	install -m 755 $(LIBSO) $(SHLIBDIR)
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
-	cd $(LIBDIR) && ln -sf $(LIBSO) $(TARGET)
+	cd $(SHLIBDIR) && ln -sf $(LIBSO) $(TARGET)
 
 relabel:
 	/sbin/restorecon $(SHLIBDIR)/$(LIBSO)

Or otherwise, with respect to actual git, it should look like (also modifies include and link directories):

libselinux/src/Makefile +3 -3

@@ -54,7 +54,7 @@ SRCS= $(filter-out $(UNUSED_SRCS) $(GENE
 OBJS= $(patsubst %.c,%.o,$(SRCS))
 LOBJS= $(patsubst %.c,%.lo,$(SRCS))
 CFLAGS ?= -Werror -Wall -W -Wundef -Wshadow -Wmissing-noreturn -Wmissing-format-attribute
-override CFLAGS += -I../include -I$(INCLUDEDIR) -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 $(EMFLAGS)
+override CFLAGS += -I../include -I../../libsepol/include -I$(INCLUDEDIR) -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 $(EMFLAGS)
 RANLIB=ranlib
 
 ARCH := $(patsubst i%86,i386,$(shell uname -m))

@@ -102,7 +102,7 @@ $(AUDIT2WHYLOBJ): audit2why.c
 	$(CC) $(filter-out -Werror, $(CFLAGS)) $(PYINC) -fPIC -DSHARED -c -o $@ $<
 
 $(AUDIT2WHYSO): $(AUDIT2WHYLOBJ)
-	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux ${LIBDIR}/libsepol.a -L$(LIBDIR) -Wl,-soname,$@
+	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux ../../libsepol/src/libsepol.a -L$(LIBDIR) -Wl,-soname,$@
 
 %.o:  %.c policy.h
 	$(CC) $(CFLAGS) $(TLSFLAGS) -c -o $@ $<

@@ -126,7 +126,7 @@ install: all
 	install -m 755 $(LIBSO) $(SHLIBDIR)
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
-	cd $(LIBDIR) && ln -sf ../../`basename $(SHLIBDIR)`/$(LIBSO) $(TARGET)
+	cd $(SHLIBDIR) && ln -sf $(LIBSO) $(TARGET)
 
 install-pywrap: pywrap
 	test -d $(PYLIBDIR)/site-packages/selinux || install -m 755 -d $(PYLIBDIR)/site-packages/selinux

libsemanage/src/Makefile +3 -3

@@ -55,7 +55,7 @@ OBJS= $(patsubst %.c,%.o,$(SRCS)) conf-s
 LOBJS= $(patsubst %.c,%.lo,$(SRCS)) conf-scan.lo conf-parse.lo
 CFLAGS ?= -Werror -Wall -W -Wundef -Wshadow -Wmissing-noreturn -Wmissing-format-attribute
 
-override CFLAGS += -I../include -I$(INCLUDEDIR) -D_GNU_SOURCE 
+override CFLAGS += -I../include -I../../libselinux/include -I../../libsepol/include -I$(INCLUDEDIR) -D_GNU_SOURCE 
 RANLIB=ranlib
 
 SWIG = swig -Wall -python -o $(SWIGCOUT) -outdir ./

@@ -87,7 +87,7 @@ $(LIBA): $(OBJS)
 	$(RANLIB) $@
 
 $(LIBSO): $(LOBJS)
-	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -lsepol -lselinux -lbz2 -lustr -L$(LIBDIR) -Wl,-soname,$(LIBSO),--version-script=libsemanage.map,-z,defs
+	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L../../libsepol/src -lsepol -L../../libselinux/src -lselinux -L$(LIBDIR) -lbz2 -lustr -Wl,-soname,$(LIBSO),--version-script=libsemanage.map,-z,defs
 	ln -sf $@ $(TARGET)
 
 $(LIBPC): $(LIBPC).in

@@ -139,7 +139,7 @@ install: all
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
 	test -f $(DEFAULT_SEMANAGE_CONF_LOCATION) || install -m 644 -D semanage.conf $(DEFAULT_SEMANAGE_CONF_LOCATION)
-	cd $(LIBDIR) && ln -sf $(LIBSO) $(TARGET)
+	cd $(SHLIBDIR) && ln -sf $(LIBSO) $(TARGET)
 
 install-pywrap: pywrap 
 	test -d $(PYLIBDIR)/site-packages || install -m 755 -d $(PYLIBDIR)/site-packages

libsepol/src/Makefile +1 -1

@@ -43,7 +43,7 @@ install: all
 	install -m 755 $(LIBSO) $(SHLIBDIR)
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
-	cd $(LIBDIR) && ln -sf ../../`basename $(SHLIBDIR)`/$(LIBSO) $(TARGET)
+	cd $(SHLIBDIR) && ln -sf $(LIBSO) $(TARGET)
 
 relabel:
 	/sbin/restorecon $(SHLIBDIR)/$(LIBSO)

Is there anything else that looks odd in it ? Partial description could be something like this:

Simply use the filename as the target instead of the full path to the shared libraries when creating the links in SHLIBDIR during installation.

Regards,

Guido

Stephen Smalley

2011-09-13 21:00 UTC #22 lore raw

Re: [RFC] Improve installation of userspace shared libraries (was Re: [RFC] Userspace top-level Makefile)

Quoted 11 lines · Guido Trentalancia

+++ selinux-12092011-test/libsepol/src/Makefile 2011-09-12 21:53:56.414127000 +0200

libsepol/src/Makefile +1 -1

@@ -43,7 +43,7 @@ install: all
 	install -m 755 $(LIBSO) $(SHLIBDIR)
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
-	cd $(LIBDIR) && ln -sf ../../`basename $(SHLIBDIR)`/$(LIBSO) $(TARGET)
+	cd $(SHLIBDIR) && ln -sf $(LIBSO) $(TARGET)
 
 relabel:
 	/sbin/restorecon $(SHLIBDIR)/$(LIBSO)

Quoted 6 lines

Is there anything else that looks odd in it ? Partial description could be something like this:
Simply use the filename as the target instead of the full path to the shared libraries when creating the links in SHLIBDIR during installation.

The symlink and the shared object aren't always in the same directory, e.g. in Fedora the shared object may live in /lib or /lib64 while the symlink may live in /usr/lib or /usr/lib64.

Signature · 8 lines

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Guido Trentalancia

author

2011-09-13 21:12 UTC #23 lore raw

Re: [RFC] Improve installation of userspace shared libraries (was Re: [RFC] Userspace top-level Makefile)

Quoted 15 lines · Stephen Smalley

Quoted 14 lines · Guido Trentalancia
+++ selinux-12092011-test/libsepol/src/Makefile 2011-09-12 21:53:56.414127000 +0200
libsepol/src/Makefile +1 -1
@@ -43,7 +43,7 @@ install: all
 	install -m 755 $(LIBSO) $(SHLIBDIR)
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
-	cd $(LIBDIR) && ln -sf ../../`basename $(SHLIBDIR)`/$(LIBSO) $(TARGET)
+	cd $(SHLIBDIR) && ln -sf $(LIBSO) $(TARGET)
 
 relabel:
 	/sbin/restorecon $(SHLIBDIR)/$(LIBSO)
Is there anything else that looks odd in it ? Partial description could be something like this:

Quoted 7 lines

Quoted 3 lines
Simply use the filename as the target instead of the full path to the shared libraries when creating the links in SHLIBDIR during installation.
The symlink and the shared object aren't always in the same directory, e.g. in Fedora the shared object may live in /lib or /lib64 while the symlink may live in /usr/lib or /usr/lib64.

The spec file would create the second one I suppose.

Regards,

Guido

Guido Trentalancia

author

2011-09-13 21:35 UTC #24 lore raw

Re: [RFC] Improve installation of userspace shared libraries (was Re: [RFC] Userspace top-level Makefile)

Quoted 24 lines · Guido Trentalancia

Quoted 15 lines · Stephen Smalley
Quoted 14 lines · Guido Trentalancia
+++ selinux-12092011-test/libsepol/src/Makefile 2011-09-12 21:53:56.414127000 +0200
libsepol/src/Makefile +1 -1
@@ -43,7 +43,7 @@ install: all
 	install -m 755 $(LIBSO) $(SHLIBDIR)
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
-	cd $(LIBDIR) && ln -sf ../../`basename $(SHLIBDIR)`/$(LIBSO) $(TARGET)
+	cd $(SHLIBDIR) && ln -sf $(LIBSO) $(TARGET)
 
 relabel:
 	/sbin/restorecon $(SHLIBDIR)/$(LIBSO)
Is there anything else that looks odd in it ? Partial description could be something like this:
Quoted 7 lines
Quoted 3 lines
Simply use the filename as the target instead of the full path to the shared libraries when creating the links in SHLIBDIR during installation.
The symlink and the shared object aren't always in the same directory, e.g. in Fedora the shared object may live in /lib or /lib64 while the symlink may live in /usr/lib or /usr/lib64.

Quoted 1 line

The spec file would create the second one I suppose.

You might actually be right.

Apparently in Fedora, it is still being created by the upstream Makefile and it only gets sorted between packages by the spec file. Apart from that, libsemanage from F15 (re)creates that independently in the spec file.

However, apart from the specific case above (any distribution in general depends on its own build scheme), I do not consider a good idea installing the library executable file and the generic symbolic link to it in two different places. This is mainly because the unique directory is assumed to be in the LD search path and thus the link is only intended to select the specific version amongst several different versions available. That is why I am still a little reluctant about changing that.

Regards,

Guido

Stephen Smalley

2011-09-12 12:57 UTC #25 lore raw

In reply to Eric Paris

Quoted 11 lines · Eric Paris

I'm also really annoyed by this at times, but I don't know what the right answer is.
We really treat it like we have 5+ separate projects which just all happen to live in the same git tree. Thus to build libselinux you must have already built and installed libsepol. And then to build libsemanage you need to have done that with both libsepol and libselinux. Then of course to get the builds and install right (on Fedora/RHEL) you have to know to use LIBDIR=/usr/lib64 SHLIBDIR=/lib64 for libsepol and libsepol, but SHLIBDIR=/usr/lib64 for libsemanage. Its a mess, but I don't know what to do that's better....

make DESTDIR=~/out at top-level should work fine - it will build and install each library into a private tree (as specified by DESTDIR) and then build and install the programs against those libraries. Without needing to clobber the system ones.

Signature · 8 lines

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Guido Trentalancia

author

2011-09-12 20:29 UTC #26 lore raw

PATCH 1/1 Fix includes for userspace tools and libraries (was Re: [PATCH] Fix include semanage/handle.h for semanage_set_root() as used by semodule)

Hi Stephen.

Quoted 13 lines · Stephen Smalley

Quoted 11 lines · Eric Paris
I'm also really annoyed by this at times, but I don't know what the right answer is.
We really treat it like we have 5+ separate projects which just all happen to live in the same git tree. Thus to build libselinux you must have already built and installed libsepol. And then to build libsemanage you need to have done that with both libsepol and libselinux. Then of course to get the builds and install right (on Fedora/RHEL) you have to know to use LIBDIR=/usr/lib64 SHLIBDIR=/lib64 for libsepol and libsepol, but SHLIBDIR=/usr/lib64 for libsemanage. Its a mess, but I don't know what to do that's better....

Quoted 4 lines

make DESTDIR=~/out at top-level should work fine - it will build and install each library into a private tree (as specified by DESTDIR) and then build and install the programs against those libraries. Without needing to clobber the system ones.

At the moment, it does not, until the Makefile(s) are modified or at least until the libraries are manually installed first.

Try by yourself, but do not forget to remove $(PREFIX)/usr/include/{selinux,semanage,sepol} and $(PREFIX){/usr,}/lib/libse{linux,manage,pol}* first !

Regards,

Guido

Eric Paris

2011-09-12 22:01 UTC #27 lore raw

Re: [PATCH] Fix includes for userspace tools and libraries (was Re: [PATCH] Fix include semanage/handle.h for semanage_set_root() as used by semodule)

Quoted 21 lines · Guido Trentalancia

Hi Stephen.
Quoted 13 lines · Stephen Smalley
Quoted 11 lines · Eric Paris
I'm also really annoyed by this at times, but I don't know what the right answer is.
We really treat it like we have 5+ separate projects which just all happen to live in the same git tree. Thus to build libselinux you must have already built and installed libsepol. And then to build libsemanage you need to have done that with both libsepol and libselinux. Then of course to get the builds and install right (on Fedora/RHEL) you have to know to use LIBDIR=/usr/lib64 SHLIBDIR=/lib64 for libsepol and libsepol, but SHLIBDIR=/usr/lib64 for libsemanage. Its a mess, but I don't know what to do that's better....
Quoted 4 lines
make DESTDIR=~/out at top-level should work fine - it will build and install each library into a private tree (as specified by DESTDIR) and then build and install the programs against those libraries. Without needing to clobber the system ones.

Quoted 6 lines

At the moment, it does not, until the Makefile(s) are modified or at least until the libraries are manually installed first.
Try by yourself, but do not forget to remove $(PREFIX)/usr/include/{selinux,semanage,sepol} and $(PREFIX){/usr,}/lib/libse{linux,manage,pol}* first !

I recently added the patch which changed the global to be 'build' instead of 'install', so sds might not realize that 'install' is no longer the default, however I think Guido is right about the install having a number of paces that it hard coded things...

-Eric

Guido Trentalancia

author

2011-09-12 23:05 UTC #28 lore raw

Re: [PATCH] Fix includes for userspace tools and libraries (was Re: [PATCH] Fix include semanage/handle.h for semanage_set_root() as used by semodule)

Hi Eric.

Quoted 25 lines · Eric Paris

Quoted 24 lines · Guido Trentalancia
Hi Stephen.
Quoted 13 lines · Stephen Smalley
Quoted 11 lines · Eric Paris
I'm also really annoyed by this at times, but I don't know what the right answer is.
We really treat it like we have 5+ separate projects which just all happen to live in the same git tree. Thus to build libselinux you must have already built and installed libsepol. And then to build libsemanage you need to have done that with both libsepol and libselinux. Then of course to get the builds and install right (on Fedora/RHEL) you have to know to use LIBDIR=/usr/lib64 SHLIBDIR=/lib64 for libsepol and libsepol, but SHLIBDIR=/usr/lib64 for libsemanage. Its a mess, but I don't know what to do that's better....
Quoted 4 lines
make DESTDIR=~/out at top-level should work fine - it will build and install each library into a private tree (as specified by DESTDIR) and then build and install the programs against those libraries. Without needing to clobber the system ones.
At the moment, it does not, until the Makefile(s) are modified or at least until the libraries are manually installed first.

Quoted 8 lines

Quoted 3 lines
Try by yourself, but do not forget to remove $(PREFIX)/usr/include/{selinux,semanage,sepol} and $(PREFIX){/usr,}/lib/libse{linux,manage,pol}* first !
I recently added the patch which changed the global to be 'build' instead of 'install', so sds might not realize that 'install' is no longer the default, however I think Guido is right about the install having a number of paces that it hard coded things...

The new target seems to be "all" (introduced on Aug the 11th by Eric).

However, at the moment, without an existing installation in place the build fails on my system because it cannot source header files from $(PREFIX)/include/{selinux,sepol,semanage} during compilation and then because it cannot source shared libraries from LIBDIR ?= $(PREFIX)/lib during linking.

It also fails if an existing installation provides obsolete header files.

Another (even better) way of achieving the same would probably be to set a TOPLEVEL variable to "pwd" (shell builtin for current directory) in the top-level Makefile and then add -I $(TOPLEVEL)/{selinux,sepol,semanage}/include and -L $(TOPLEVEL)/lib{selinux,sepol,semanage}/src to CFLAGS and LDFLAGS respectively...

What do you think ?

Regards,

Guido

Guido Trentalancia

author

2011-09-13 00:53 UTC #29 lore raw

Re: [PATCH] Fix includes for userspace tools and libraries (was Re: [PATCH] Fix include semanage/handle.h for semanage_set_root() as used by semodule)

Quoted 48 lines · Guido Trentalancia

Hi Eric.
Quoted 25 lines · Eric Paris
Quoted 24 lines · Guido Trentalancia
Hi Stephen.
Quoted 13 lines · Stephen Smalley
Quoted 11 lines · Eric Paris
I'm also really annoyed by this at times, but I don't know what the right answer is.
We really treat it like we have 5+ separate projects which just all happen to live in the same git tree. Thus to build libselinux you must have already built and installed libsepol. And then to build libsemanage you need to have done that with both libsepol and libselinux. Then of course to get the builds and install right (on Fedora/RHEL) you have to know to use LIBDIR=/usr/lib64 SHLIBDIR=/lib64 for libsepol and libsepol, but SHLIBDIR=/usr/lib64 for libsemanage. Its a mess, but I don't know what to do that's better....
Quoted 4 lines
make DESTDIR=~/out at top-level should work fine - it will build and install each library into a private tree (as specified by DESTDIR) and then build and install the programs against those libraries. Without needing to clobber the system ones.
At the moment, it does not, until the Makefile(s) are modified or at least until the libraries are manually installed first.
Quoted 8 lines
Quoted 3 lines
Try by yourself, but do not forget to remove $(PREFIX)/usr/include/{selinux,semanage,sepol} and $(PREFIX){/usr,}/lib/libse{linux,manage,pol}* first !
I recently added the patch which changed the global to be 'build' instead of 'install', so sds might not realize that 'install' is no longer the default, however I think Guido is right about the install having a number of paces that it hard coded things...
The new target seems to be "all" (introduced on Aug the 11th by Eric).
However, at the moment, without an existing installation in place the build fails on my system because it cannot source header files from $(PREFIX)/include/{selinux,sepol,semanage} during compilation and then because it cannot source shared libraries from LIBDIR ?= $(PREFIX)/lib during linking.
It also fails if an existing installation provides obsolete header files.

Quoted 6 lines

Another (even better) way of achieving the same would probably be to set a TOPLEVEL variable to "pwd" (shell builtin for current directory) in the top-level Makefile and then add -I $(TOPLEVEL)/{selinux,sepol,semanage}/include and -L $(TOPLEVEL)/lib{selinux,sepol,semanage}/src to CFLAGS and LDFLAGS respectively...

And here is what I meant:

checkpolicy/Makefile +1 -1

diff -pruN selinux/checkpolicy/Makefile selinux-12092011-test-toplevel-arguments/checkpolicy/Makefile
@@ -19,7 +19,7 @@ CHECKOBJS = y.tab.o lex.yy.o queue.o mod
 CHECKPOLOBJS = $(CHECKOBJS) checkpolicy.o
 CHECKMODOBJS = $(CHECKOBJS) checkmodule.o
 
-LDLIBS=$(LIBDIR)/libsepol.a -lfl
+LDLIBS=../libsepol/src/libsepol.a -L$(LIBDIR) -lfl
 
 GENERATED=lex.yy.c y.tab.c y.tab.h

checkpolicy/test/Makefile +1 -1

diff -pruN selinux/checkpolicy/test/Makefile selinux-12092011-test-toplevel-arguments/checkpolicy/test/Makefile
@@ -9,7 +9,7 @@ INCLUDEDIR ?= $(PREFIX)/include
 CFLAGS ?= -g -Wall -O2 -pipe
 override CFLAGS += -I$(INCLUDEDIR)
 
-LDLIBS=-lfl -lsepol -lselinux $(LIBDIR)/libsepol.a -L$(LIBDIR)
+LDLIBS=-lsepol -lselinux ../../libsepol/src/libsepol.a -L$(LIBDIR) -lfl
 
 all: dispol dismod

Makefile +7 -2

diff -pruN selinux/Makefile selinux-12092011-test-toplevel-arguments/Makefile
@@ -3,10 +3,15 @@ PYSUBDIRS=libselinux libsemanage
 DISTCLEANSUBIDRS=libselinux libsemanage
 
 ifeq ($(DEBUG),1)
-	export CFLAGS = -g3 -O0 -gdwarf-2 -fno-strict-aliasing -Wall -Wshadow -Werror
-	export LDFLAGS = -g
+	CFLAGS += -g3 -O0 -gdwarf-2 -fno-strict-aliasing -Wall -Wshadow -Werror
+	LDFLAGS += -g
 endif
 
+CFLAGS += -I$(CURDIR)/libselinux/include -I$(CURDIR)/libsepol/include -I$(CURDIR)/libsemanage/include
+LDFLAGS += -L$(CURDIR)/libselinux/src -L$(CURDIR)/libsepol/src -L$(CURDIR)/libsemanage/src
+export CFLAGS
+export LDFLAGS
+
 all install relabel clean test indent:
 	@for subdir in $(SUBDIRS); do \
 		(cd $$subdir && $(MAKE) $@) || exit 1; \

policycoreutils/semodule_deps/Makefile +1 -1

diff -pruN selinux/policycoreutils/semodule_deps/Makefile selinux-12092011-test-toplevel-arguments/policycoreutils/semodule_deps/Makefile
@@ -7,7 +7,7 @@ MANDIR ?= $(PREFIX)/share/man
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += -I$(INCLUDEDIR)
-LDLIBS = $(LIBDIR)/libsepol.a
+LDLIBS = ../../libsepol/src/libsepol.a
 
 all: semodule_deps

policycoreutils/sestatus/Makefile +1 -1

diff -pruN selinux/policycoreutils/sestatus/Makefile selinux-12092011-test-toplevel-arguments/policycoreutils/sestatus/Makefile
@@ -5,7 +5,7 @@ MANDIR = $(PREFIX)/share/man
 ETCDIR ?= $(DESTDIR)/etc
 LIBDIR ?= ${PREFIX}/lib
 
-CFLAGS = -Werror -Wall -W
+CFLAGS ?= -Werror -Wall -W
 override CFLAGS += -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64
 LDLIBS = -lselinux -L$(LIBDIR)

policycoreutils/setfiles/Makefile +1 -1

diff -pruN selinux/policycoreutils/setfiles/Makefile selinux-12092011-test-toplevel-arguments/policycoreutils/setfiles/Makefile
@@ -5,7 +5,7 @@ MANDIR = $(PREFIX)/share/man
 LIBDIR ?= $(PREFIX)/lib
 AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null)
 
-CFLAGS = -g -Werror -Wall -W
+CFLAGS ?= -g -Werror -Wall -W
 override CFLAGS += -I$(PREFIX)/include
 LDLIBS = -lselinux -lsepol -L$(LIBDIR)

README +17 -0

diff -pruN selinux/README selinux-12092011-test-toplevel-arguments/README
@@ -0,0 +1,17 @@
+INSTALLATION:
+
+Type "make" to build and then "make install" to install.
+
+---
+
+The environment variables CFLAGS and LDFLAGS can be passed to "make" to use custom compiler
+and/or linker flags (for example: CFLAGS="-O3" LDFLAGS="" make).
+
+The environment variables LIBDIR and SHLIBDIR can be passed to "make" in order to configure
+different directories for the libraries (e.g. LIBDIR=/usr/lib64 and SHLIBDIR=/usr/lib64
+on 64-bit systems).
+
+The environment variable PREFIX can be passed to "make" in order to configure an install
+prefix other than "/usr".
+
+Please see the Makefile(s) for other environment variables that can be used.

There are many different ways of achieving it.

Using the CURDIR variable provided by make is quite nice. Not only it is much simpler and much cleaner, but it also avoids the need to revert the patch before creating the separate components to be released.

However there are many other bits left out from previously posted patches (honor LIBDIR for load_policy, LIBSO link creation in SHLIBDIR for the three shared libraries, genhomedircon manual page, do not hard-code path in genhomedircon script, replacement of curly brackets with parentheses for some variables in some makefiles, make use of PREFIX for determining LOCALEDIR in some makefiles, do not override passed environment variables in some makefiles, et cetera).

Regards,

Guido

Guido Trentalancia

author

2011-09-13 02:03 UTC #30 lore raw

Re: [PATCH v2] Fix includes for userspace tools and libraries (was Re: [PATCH] Fix includes for userspace tools and libraries)

Hello again.

I have prepared a new revised and possibly (in)complete version of the patch.

Quoted 18 lines · Guido Trentalancia

Quoted 9 lines
However, at the moment, without an existing installation in place the build fails on my system because it cannot source header files from $(PREFIX)/include/{selinux,sepol,semanage} during compilation and then because it cannot source shared libraries from LIBDIR ?= $(PREFIX)/lib during linking.
It also fails if an existing installation provides obsolete header files.
Quoted 6 lines
Another (even better) way of achieving the same would probably be to set a TOPLEVEL variable to "pwd" (shell builtin for current directory) in the top-level Makefile and then add -I $(TOPLEVEL)/{selinux,sepol,semanage}/include and -L $(TOPLEVEL)/lib{selinux,sepol,semanage}/src to CFLAGS and LDFLAGS respectively...
And here is what I meant:

[cut]

Quoted 6 lines

There are many different ways of achieving it.
Using the CURDIR variable provided by make is quite nice. Not only it is much simpler and much cleaner, but it also avoids the need to revert the patch before creating the separate components to be released.

Quoted 7 lines

However there are many other bits left out from previously posted patches (honor LIBDIR for load_policy, LIBSO link creation in SHLIBDIR for the three shared libraries, genhomedircon manual page, do not hard-code path in genhomedircon script, replacement of curly brackets with parentheses for some variables in some makefiles, make use of PREFIX for determining LOCALEDIR in some makefiles, do not override passed environment variables in some makefiles, et cetera).

This is a maintenance patch for further testing. It potentially replaces any other patch previously posted in this same and/or other recent threads.

Make sure that the SELinux userspace libraries and tools bundle from the git repository can be built from scratch without requiring existing SELinux installations (in particular header files) by exploiting the CURDIR variable (provided by the make tool itself) in the top-level Makefile only.

Create a top-level README file which is intended to provide a few details about some of the possible environment variables that can be configured and passed to the make tool.

Fix a possible installation issue (creation of symbolic links to shared libraries using a wrong target file and in a possibly wrong directory for libselinux, libsepol and libsemanage).

Do not hard-code the path to semodule in the genhomedircon script but rather generate it each time by using PREFIX. Improve the manual page for genhomedircon.

Replace curly brackets with parentheses for some variables such as DESTDIR and PREFIX in the Makefiles. Add and make use of LIBDIR and INCLUDEDIR where appropriate within the Makefiles. Make use of PREFIX for determining the value of LOCALEDIR within some of the Makefiles. Do not override the environment variables passed from the command-line for some of the Makefiles.

checkpolicy/Makefile +1 -1

diff -pruN selinux/checkpolicy/Makefile selinux-13092011/checkpolicy/Makefile
@@ -19,7 +19,7 @@ CHECKOBJS = y.tab.o lex.yy.o queue.o mod
 CHECKPOLOBJS = $(CHECKOBJS) checkpolicy.o
 CHECKMODOBJS = $(CHECKOBJS) checkmodule.o
 
-LDLIBS=$(LIBDIR)/libsepol.a -lfl
+LDLIBS=../libsepol/src/libsepol.a -L$(LIBDIR) -lfl
 
 GENERATED=lex.yy.c y.tab.c y.tab.h

checkpolicy/test/Makefile +1 -1

diff -pruN selinux/checkpolicy/test/Makefile selinux-13092011/checkpolicy/test/Makefile
@@ -9,7 +9,7 @@ INCLUDEDIR ?= $(PREFIX)/include
 CFLAGS ?= -g -Wall -O2 -pipe
 override CFLAGS += -I$(INCLUDEDIR)
 
-LDLIBS=-lfl -lsepol -lselinux $(LIBDIR)/libsepol.a -L$(LIBDIR)
+LDLIBS=-lsepol -lselinux ../../libsepol/src/libsepol.a -L$(LIBDIR) -lfl
 
 all: dispol dismod

libselinux/src/Makefile +2 -2

diff -pruN selinux/libselinux/src/Makefile selinux-13092011/libselinux/src/Makefile
@@ -102,7 +102,7 @@ $(AUDIT2WHYLOBJ): audit2why.c
 	$(CC) $(filter-out -Werror, $(CFLAGS)) $(PYINC) -fPIC -DSHARED -c -o $@ $<
 
 $(AUDIT2WHYSO): $(AUDIT2WHYLOBJ)
-	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux ${LIBDIR}/libsepol.a -L$(LIBDIR) -Wl,-soname,$@
+	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux ../../libsepol/src/libsepol.a -L$(LIBDIR) -Wl,-soname,$@
 
 %.o:  %.c policy.h
 	$(CC) $(CFLAGS) $(TLSFLAGS) -c -o $@ $<

@@ -126,7 +126,7 @@ install: all
 	install -m 755 $(LIBSO) $(SHLIBDIR)
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
-	cd $(LIBDIR) && ln -sf ../../`basename $(SHLIBDIR)`/$(LIBSO) $(TARGET)
+	cd $(SHLIBDIR) && ln -sf $(LIBSO) $(TARGET)
 
 install-pywrap: pywrap
 	test -d $(PYLIBDIR)/site-packages/selinux || install -m 755 -d $(PYLIBDIR)/site-packages/selinux

libsemanage/src/Makefile +2 -2

diff -pruN selinux/libsemanage/src/Makefile selinux-13092011/libsemanage/src/Makefile
@@ -87,7 +87,7 @@ $(LIBA): $(OBJS)
 	$(RANLIB) $@
 
 $(LIBSO): $(LOBJS)
-	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -lsepol -lselinux -lbz2 -lustr -L$(LIBDIR) -Wl,-soname,$(LIBSO),--version-script=libsemanage.map,-z,defs
+	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -lsepol -lselinux -L$(LIBDIR) -lbz2 -lustr -Wl,-soname,$(LIBSO),--version-script=libsemanage.map,-z,defs
 	ln -sf $@ $(TARGET)
 
 $(LIBPC): $(LIBPC).in

@@ -139,7 +139,7 @@ install: all
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
 	test -f $(DEFAULT_SEMANAGE_CONF_LOCATION) || install -m 644 -D semanage.conf $(DEFAULT_SEMANAGE_CONF_LOCATION)
-	cd $(LIBDIR) && ln -sf $(LIBSO) $(TARGET)
+	cd $(SHLIBDIR) && ln -sf $(LIBSO) $(TARGET)
 
 install-pywrap: pywrap 
 	test -d $(PYLIBDIR)/site-packages || install -m 755 -d $(PYLIBDIR)/site-packages

libsepol/src/Makefile +1 -1

diff -pruN selinux/libsepol/src/Makefile selinux-13092011/libsepol/src/Makefile
@@ -43,7 +43,7 @@ install: all
 	install -m 755 $(LIBSO) $(SHLIBDIR)
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
-	cd $(LIBDIR) && ln -sf ../../`basename $(SHLIBDIR)`/$(LIBSO) $(TARGET)
+	cd $(SHLIBDIR) && ln -sf $(LIBSO) $(TARGET)
 
 relabel:
 	/sbin/restorecon $(SHLIBDIR)/$(LIBSO)

Makefile +7 -2

diff -pruN selinux/Makefile selinux-13092011/Makefile
@@ -3,10 +3,15 @@ PYSUBDIRS=libselinux libsemanage
 DISTCLEANSUBIDRS=libselinux libsemanage
 
 ifeq ($(DEBUG),1)
-	export CFLAGS = -g3 -O0 -gdwarf-2 -fno-strict-aliasing -Wall -Wshadow -Werror
-	export LDFLAGS = -g
+	CFLAGS += -g3 -O0 -gdwarf-2 -fno-strict-aliasing -Wall -Wshadow -Werror
+	LDFLAGS += -g
 endif
 
+CFLAGS += -I$(CURDIR)/libselinux/include -I$(CURDIR)/libsepol/include -I$(CURDIR)/libsemanage/include
+LDFLAGS += -L$(CURDIR)/libselinux/src -L$(CURDIR)/libsepol/src -L$(CURDIR)/libsemanage/src
+export CFLAGS
+export LDFLAGS
+
 all install relabel clean test indent:
 	@for subdir in $(SUBDIRS); do \
 		(cd $$subdir && $(MAKE) $@) || exit 1; \

policycoreutils/audit2allow/Makefile +2 -2

diff -pruN selinux/policycoreutils/audit2allow/Makefile selinux-13092011/policycoreutils/audit2allow/Makefile
@@ -1,9 +1,9 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 BINDIR ?= $(PREFIX)/bin
 LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 
 all: ;

policycoreutils/audit2why/Makefile +1 -1

diff -pruN selinux/policycoreutils/audit2why/Makefile selinux-13092011/policycoreutils/audit2why/Makefile
@@ -1,5 +1,5 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 BINDIR ?= $(PREFIX)/bin
 MANDIR ?= $(PREFIX)/share/man

policycoreutils/load_policy/Makefile +6 -4

diff -pruN selinux/policycoreutils/load_policy/Makefile selinux-13092011/policycoreutils/load_policy/Makefile
@@ -1,13 +1,15 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(DESTDIR)/sbin
 USRSBINDIR ?= $(PREFIX)/sbin
+INCLUDEDIR ?= $(PREFIX)/include
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lsepol -lselinux -L$(PREFIX)/lib
+override CFLAGS += $(LDFLAGS) -I$(INCLUDEDIR) -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+LDLIBS += -lsepol -lselinux -L$(LIBDIR)
 
 TARGETS=$(patsubst %.c,%,$(wildcard *.c))

policycoreutils/mcstrans/src/Makefile +1 -1

diff -pruN selinux/policycoreutils/mcstrans/src/Makefile selinux-13092011/policycoreutils/mcstrans/src/Makefile
@@ -28,7 +28,7 @@ override CFLAGS += -I../include -D_GNU_S
 all: $(PROG)
 
 $(PROG): $(PROG_OBJS)
-	$(CC) $(LDFLAGS) -pie -o $@ $^ -lselinux -lcap -lpcre $(LIBDIR)/libsepol.a
+	$(CC) $(LDFLAGS) -pie -o $@ $^ -lselinux ../../../libsepol/src/libsepol.a -L$(LIBDIR) -lcap -lpcre
 
 %.o:  %.c 
 	$(CC) $(CFLAGS) -fPIE -c -o $@ $<

policycoreutils/mcstrans/utils/Makefile +1 -1

diff -pruN selinux/policycoreutils/mcstrans/utils/Makefile selinux-13092011/policycoreutils/mcstrans/utils/Makefile
@@ -21,7 +21,7 @@ endif
 
 CFLAGS ?= -Wall
 override CFLAGS += -I../src -D_GNU_SOURCE
-LDLIBS += -L../src ../src/mcstrans.o ../src/mls_level.o -lselinux -lpcre $(LIBDIR)/libsepol.a
+LDLIBS += -L../src ../src/mcstrans.o ../src/mls_level.o -lselinux -lpcre ../../../libsepol/src/libsepol.a
 
 TARGETS=$(patsubst %.c,%,$(wildcard *.c))

policycoreutils/newrole/Makefile +6 -4

diff -pruN selinux/policycoreutils/newrole/Makefile selinux-13092011/policycoreutils/newrole/Makefile
@@ -1,9 +1,11 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 BINDIR ?= $(PREFIX)/bin
 MANDIR ?= $(PREFIX)/share/man
+INCLUDEDIR ?= $(PREFIX)/include
+LIBDIR ?= $(PREFIX)/lib
 ETCDIR ?= $(DESTDIR)/etc
-LOCALEDIR = /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 PAMH = $(shell ls /usr/include/security/pam_appl.h 2>/dev/null)
 AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null)
 # Enable capabilities to permit newrole to generate audit records.

@@ -22,8 +24,8 @@ VERSION = $(shell cat ../VERSION)
 
 CFLAGS ?= -Werror -Wall -W
 EXTRA_OBJS =
-override CFLAGS += -DVERSION=\"$(VERSION)\" $(LDFLAGS) -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lselinux -L$(PREFIX)/lib
+override CFLAGS += -DVERSION=\"$(VERSION)\" $(LDFLAGS) -I$(INCLUDEDIR) -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+LDLIBS += -lselinux -L$(LIBDIR)
 ifeq (${PAMH}, /usr/include/security/pam_appl.h)
 	override CFLAGS += -DUSE_PAM
 	EXTRA_OBJS += hashtab.o

policycoreutils/restorecond/Makefile +7 -6

diff -pruN selinux/policycoreutils/restorecond/Makefile selinux-13092011/policycoreutils/restorecond/Makefile
@@ -1,13 +1,14 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
-INITDIR = $(DESTDIR)/etc/rc.d/init.d
-SELINUXDIR = $(DESTDIR)/etc/selinux
+INCLUDEDIR ?= $(PREFIX)/include
+MANDIR ?= $(PREFIX)/share/man
+INITDIR ?= $(DESTDIR)/etc/rc.d/init.d
+SELINUXDIR ?= $(DESTDIR)/etc/selinux
 
 CFLAGS ?= -g -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64
-LDLIBS += -lselinux -L$(PREFIX)/lib
+override CFLAGS += -I$(INCLUDEDIR) -D_FILE_OFFSET_BITS=64
+LDLIBS += -lselinux -L$(LIBDIR)
 
 all: restorecond

policycoreutils/run_init/Makefile +6 -5

diff -pruN selinux/policycoreutils/run_init/Makefile selinux-13092011/policycoreutils/run_init/Makefile
@@ -1,16 +1,17 @@
-
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(PREFIX)/sbin
+INCLUDEDIR ?= $(PREFIX)/include
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
 ETCDIR ?= $(DESTDIR)/etc
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 PAMH = $(shell ls /usr/include/security/pam_appl.h 2>/dev/null)
 AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null)
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lselinux -L$(PREFIX)/lib
+override CFLAGS += -I$(INCLUDEDIR) -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+LDLIBS += -lselinux -L$(LIBDIR)
 ifeq (${PAMH}, /usr/include/security/pam_appl.h)
 	override CFLAGS += -DUSE_PAM
 	LDLIBS += -lpam -lpam_misc

policycoreutils/sandbox/Makefile +8 -6

diff -pruN selinux/policycoreutils/sandbox/Makefile selinux-13092011/policycoreutils/sandbox/Makefile
@@ -1,14 +1,16 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
-INITDIR ?= ${DESTDIR}/etc/rc.d/init.d/
-SYSCONFDIR ?= ${DESTDIR}/etc/sysconfig
+PREFIX ?= $(DESTDIR)/usr
+INITDIR ?= $(DESTDIR)/etc/rc.d/init.d/
+SYSCONFDIR ?= $(DESTDIR)/etc/sysconfig
 BINDIR ?= $(PREFIX)/bin
 SBINDIR ?= $(PREFIX)/sbin
+INCLUDEDIR ?= $(PREFIX)/include
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 SHAREDIR ?= $(PREFIX)/share/sandbox
-override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lselinux -lcap-ng 
+override CFLAGS += $(LDFLAGS) -I$(INCLUDEDIR) -DPACKAGE="\"policycoreutils\""
+LDLIBS += -lselinux -L$(LIBDIR) -lcap-ng
 
 all: sandbox seunshare sandboxX.sh start

policycoreutils/scripts/genhomedircon.8 +12 ~~-28~~

diff -pruN selinux/policycoreutils/scripts/genhomedircon.8 selinux-13092011/policycoreutils/scripts/genhomedircon.8
@@ -1,37 +1,21 @@
-.\" Hey, Emacs! This is an -*- nroff -*- source file.
-.\" Copyright (c) 2010 Dan Walsh <[email protected]>
-.\"
-.\" This is free documentation; you can redistribute it and/or
-.\" modify it under the terms of the GNU General Public License as
-.\" published by the Free Software Foundation; either version 2 of
-.\" the License, or (at your option) any later version.
-.\"
-.\" The GNU General Public License's references to "object code"
-.\" and "executables" are to be interpreted as the output of any
-.\" document formatting or typesetting system, including
-.\" intermediate and printed output.
-.\"
-.\" This manual is distributed in the hope that it will be useful,
-.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
-.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-.\" GNU General Public License for more details.
-.\"
-.\" You should have received a copy of the GNU General Public
-.\" License along with this manual; if not, write to the Free
-.\" Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139,
-.\" USA.
-.\"
-.\"
-.TH GENHOMEDIRCON "8" "May 2010" "Security Enhanced Linux" "SELinux"
+.TH GENHOMEDIRCON "12" "Sep 2011" "Security Enhanced Linux" "SELinux"
 .SH NAME
 genhomedircon \- generate SELinux file context configuration entries for user home directories
 .SH SYNOPSIS
 .B genhomedircon
-is a script that executes semodule to rebuild policy and create the
-labels for HOMEDIRS based on home directories returned by the getpw calls.
+is a script that executes
+.B semodule
+to rebuild the SELinux policy and to create the
+labels for each user home directory based on directory paths returned by calls to getpwent().
 
-This functionality is enabled via the usepasswd flag in /etc/selinux/semanage.conf.
+This functionality can be disabled by using the "usepasswd" flag in /etc/selinux/semanage.conf
+(such flag can either take the value "true" or "false" and by default it is set to "true").
 
 .SH AUTHOR
 This manual page was written by
 .I Dan Walsh <[email protected]>
+
+The supporting functionality in the semanage library was written by Tresys Technology.
+
+.SH "SEE ALSO"
+semodule(8), getpwent(3), getpwent_r(3)

policycoreutils/scripts/Makefile +6 -3

diff -pruN selinux/policycoreutils/scripts/Makefile selinux-13092011/policycoreutils/scripts/Makefile
@@ -1,9 +1,9 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 BINDIR ?= $(PREFIX)/bin
 SBINDIR ?= $(PREFIX)/sbin
 MANDIR ?= $(PREFIX)/share/man
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 
 all: fixfiles genhomedircon chcat

@@ -11,7 +11,10 @@ install: all
 	-mkdir -p $(BINDIR)
 	install -m 755 chcat $(BINDIR)
 	install -m 755 fixfiles $(DESTDIR)/sbin
-	install -m 755 genhomedircon  $(SBINDIR)
+	@echo "#!/bin/sh" > genhomedircon
+	@echo >> genhomedircon
+	@echo "$(SBINDIR)/semodule -Bn" >> genhomedircon
+	install -m 755 genhomedircon $(SBINDIR)
 	-mkdir -p $(MANDIR)/man8
 	install -m 644 fixfiles.8 $(MANDIR)/man8/
 	install -m 644 genhomedircon.8 $(MANDIR)/man8/

policycoreutils/secon/Makefile +2 -2

diff -pruN selinux/policycoreutils/secon/Makefile selinux-13092011/policycoreutils/secon/Makefile
@@ -1,9 +1,9 @@
 # secon tool - command-line context
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
 MANDIR ?= $(PREFIX)/share/man
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 
 WARNS=-Werror -W -Wall -Wundef -Wshadow -Wpointer-arith -Wbad-function-cast -Wcast-align -Wwrite-strings -Waggregate-return -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -Wno-format-zero-length -Wformat-nonliteral -Wformat-security -Wfloat-equal
 VERSION = $(shell cat ../VERSION)

policycoreutils/semanage/Makefile +2 -2

diff -pruN selinux/policycoreutils/semanage/Makefile selinux-13092011/policycoreutils/semanage/Makefile
@@ -1,8 +1,8 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 LIBDIR ?= $(PREFIX)/lib
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
+MANDIR ?= $(PREFIX)/share/man
 PYLIBVER ?= $(shell python -c 'import sys;print "python%d.%d" % sys.version_info[0:2]')
 PYTHONLIBDIR ?= $(LIBDIR)/$(PYLIBVER)

policycoreutils/semodule/Makefile +2 -2

diff -pruN selinux/policycoreutils/semodule/Makefile selinux-13092011/policycoreutils/semodule/Makefile
@@ -2,8 +2,8 @@
 PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
-LIBDIR ?= ${PREFIX}/lib
+MANDIR ?= $(PREFIX)/share/man
+LIBDIR ?= $(PREFIX)/lib
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += -I$(INCLUDEDIR)

policycoreutils/semodule_deps/Makefile +3 -3

diff -pruN selinux/policycoreutils/semodule_deps/Makefile selinux-13092011/policycoreutils/semodule_deps/Makefile
@@ -1,13 +1,13 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += -I$(INCLUDEDIR)
-LDLIBS = $(LIBDIR)/libsepol.a
+LDLIBS = ../../libsepol/src/libsepol.a
 
 all: semodule_deps

policycoreutils/semodule_expand/Makefile +2 -2

diff -pruN selinux/policycoreutils/semodule_expand/Makefile selinux-13092011/policycoreutils/semodule_expand/Makefile
@@ -1,8 +1,8 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
 
 CFLAGS ?= -Werror -Wall -W

policycoreutils/semodule_link/Makefile +2 -2

diff -pruN selinux/policycoreutils/semodule_link/Makefile selinux-13092011/policycoreutils/semodule_link/Makefile
@@ -1,9 +1,9 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
 MANDIR ?= $(PREFIX)/share/man
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += -I$(INCLUDEDIR)

policycoreutils/semodule_package/Makefile +2 -2

diff -pruN selinux/policycoreutils/semodule_package/Makefile selinux-13092011/policycoreutils/semodule_package/Makefile
@@ -1,8 +1,8 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
 
 CFLAGS ?= -Werror -Wall -W

policycoreutils/sestatus/Makefile +6 -5

diff -pruN selinux/policycoreutils/sestatus/Makefile selinux-13092011/policycoreutils/sestatus/Makefile
@@ -1,12 +1,13 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
+INCLUDEDIR ?= $(PREFIX)/include
+MANDIR ?= $(PREFIX)/share/man
 ETCDIR ?= $(DESTDIR)/etc
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 
-CFLAGS = -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64
+CFLAGS ?= -Werror -Wall -W
+override CFLAGS += -I$(INCLUDEDIR) -D_FILE_OFFSET_BITS=64
 LDLIBS = -lselinux -L$(LIBDIR)
 
 all: sestatus

policycoreutils/setfiles/Makefile +5 -4

diff -pruN selinux/policycoreutils/setfiles/Makefile selinux-13092011/policycoreutils/setfiles/Makefile
@@ -1,12 +1,13 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(DESTDIR)/sbin
-MANDIR = $(PREFIX)/share/man
+INCLUDEDIR ?= $(PREFIX)/include
+MANDIR ?= $(PREFIX)/share/man
 LIBDIR ?= $(PREFIX)/lib
 AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null)
 
-CFLAGS = -g -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include
+CFLAGS ?= -g -Werror -Wall -W
+override CFLAGS += -I$(INCLUDEDIR)
 LDLIBS = -lselinux -lsepol -L$(LIBDIR)
 
 ifeq (${AUDITH}, /usr/include/libaudit.h)

policycoreutils/setsebool/Makefile +2 -2

diff -pruN selinux/policycoreutils/setsebool/Makefile selinux-13092011/policycoreutils/setsebool/Makefile
@@ -2,8 +2,8 @@
 PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
-LIBDIR ?= ${PREFIX}/lib
+MANDIR ?= $(PREFIX)/share/man
+LIBDIR ?= $(PREFIX)/lib
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += -I$(INCLUDEDIR)

README +17 -0

diff -pruN selinux/README selinux-13092011/README
@@ -0,0 +1,17 @@
+INSTALLATION:
+
+Type "make" to build and then "make install" to install.
+
+---
+
+The environment variables CFLAGS and LDFLAGS can be passed to "make" to use custom compiler
+and/or linker flags (for example: CFLAGS="-O3" LDFLAGS="" make).
+
+The environment variables LIBDIR and SHLIBDIR can be passed to "make" in order to configure
+different directories for the libraries (e.g. LIBDIR=/usr/lib64 and SHLIBDIR=/usr/lib64
+on 64-bit systems).
+
+The environment variable PREFIX can be passed to "make" in order to configure an install
+prefix other than "/usr".
+
+Please see the Makefile(s) for other environment variables that can be used.

You can always fine-tune the details, but please let me know if I can move on as I would like to create a few manual pages.

Regards,

Guido

Guido Trentalancia

author

2011-09-13 02:41 UTC #31 lore raw

Re: [PATCH v3] Fix includes for userspace tools and libraries (was Re: [PATCH v2] Fix includes for userspace tools and libraries)

And I've just discovered the second version (v2) contains a typo in the section field of the genhomedircon manual page, so here is a new version (v3, same description):

checkpolicy/Makefile +1 -1

diff -pruN selinux/checkpolicy/Makefile selinux-13092011/checkpolicy/Makefile
@@ -19,7 +19,7 @@ CHECKOBJS = y.tab.o lex.yy.o queue.o mod
 CHECKPOLOBJS = $(CHECKOBJS) checkpolicy.o
 CHECKMODOBJS = $(CHECKOBJS) checkmodule.o
 
-LDLIBS=$(LIBDIR)/libsepol.a -lfl
+LDLIBS=../libsepol/src/libsepol.a -L$(LIBDIR) -lfl
 
 GENERATED=lex.yy.c y.tab.c y.tab.h

checkpolicy/test/Makefile +1 -1

diff -pruN selinux/checkpolicy/test/Makefile selinux-13092011/checkpolicy/test/Makefile
@@ -9,7 +9,7 @@ INCLUDEDIR ?= $(PREFIX)/include
 CFLAGS ?= -g -Wall -O2 -pipe
 override CFLAGS += -I$(INCLUDEDIR)
 
-LDLIBS=-lfl -lsepol -lselinux $(LIBDIR)/libsepol.a -L$(LIBDIR)
+LDLIBS=-lsepol -lselinux ../../libsepol/src/libsepol.a -L$(LIBDIR) -lfl
 
 all: dispol dismod

libselinux/src/Makefile +2 -2

diff -pruN selinux/libselinux/src/Makefile selinux-13092011/libselinux/src/Makefile
@@ -102,7 +102,7 @@ $(AUDIT2WHYLOBJ): audit2why.c
 	$(CC) $(filter-out -Werror, $(CFLAGS)) $(PYINC) -fPIC -DSHARED -c -o $@ $<
 
 $(AUDIT2WHYSO): $(AUDIT2WHYLOBJ)
-	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux ${LIBDIR}/libsepol.a -L$(LIBDIR) -Wl,-soname,$@
+	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux ../../libsepol/src/libsepol.a -L$(LIBDIR) -Wl,-soname,$@
 
 %.o:  %.c policy.h
 	$(CC) $(CFLAGS) $(TLSFLAGS) -c -o $@ $<

@@ -126,7 +126,7 @@ install: all
 	install -m 755 $(LIBSO) $(SHLIBDIR)
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
-	cd $(LIBDIR) && ln -sf ../../`basename $(SHLIBDIR)`/$(LIBSO) $(TARGET)
+	cd $(SHLIBDIR) && ln -sf $(LIBSO) $(TARGET)
 
 install-pywrap: pywrap
 	test -d $(PYLIBDIR)/site-packages/selinux || install -m 755 -d $(PYLIBDIR)/site-packages/selinux

libsemanage/src/Makefile +2 -2

diff -pruN selinux/libsemanage/src/Makefile selinux-13092011/libsemanage/src/Makefile
@@ -87,7 +87,7 @@ $(LIBA): $(OBJS)
 	$(RANLIB) $@
 
 $(LIBSO): $(LOBJS)
-	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -lsepol -lselinux -lbz2 -lustr -L$(LIBDIR) -Wl,-soname,$(LIBSO),--version-script=libsemanage.map,-z,defs
+	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -lsepol -lselinux -L$(LIBDIR) -lbz2 -lustr -Wl,-soname,$(LIBSO),--version-script=libsemanage.map,-z,defs
 	ln -sf $@ $(TARGET)
 
 $(LIBPC): $(LIBPC).in

@@ -139,7 +139,7 @@ install: all
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
 	test -f $(DEFAULT_SEMANAGE_CONF_LOCATION) || install -m 644 -D semanage.conf $(DEFAULT_SEMANAGE_CONF_LOCATION)
-	cd $(LIBDIR) && ln -sf $(LIBSO) $(TARGET)
+	cd $(SHLIBDIR) && ln -sf $(LIBSO) $(TARGET)
 
 install-pywrap: pywrap 
 	test -d $(PYLIBDIR)/site-packages || install -m 755 -d $(PYLIBDIR)/site-packages

libsepol/src/Makefile +1 -1

diff -pruN selinux/libsepol/src/Makefile selinux-13092011/libsepol/src/Makefile
@@ -43,7 +43,7 @@ install: all
 	install -m 755 $(LIBSO) $(SHLIBDIR)
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
-	cd $(LIBDIR) && ln -sf ../../`basename $(SHLIBDIR)`/$(LIBSO) $(TARGET)
+	cd $(SHLIBDIR) && ln -sf $(LIBSO) $(TARGET)
 
 relabel:
 	/sbin/restorecon $(SHLIBDIR)/$(LIBSO)

Makefile +7 -2

diff -pruN selinux/Makefile selinux-13092011/Makefile
@@ -3,10 +3,15 @@ PYSUBDIRS=libselinux libsemanage
 DISTCLEANSUBIDRS=libselinux libsemanage
 
 ifeq ($(DEBUG),1)
-	export CFLAGS = -g3 -O0 -gdwarf-2 -fno-strict-aliasing -Wall -Wshadow -Werror
-	export LDFLAGS = -g
+	CFLAGS += -g3 -O0 -gdwarf-2 -fno-strict-aliasing -Wall -Wshadow -Werror
+	LDFLAGS += -g
 endif
 
+CFLAGS += -I$(CURDIR)/libselinux/include -I$(CURDIR)/libsepol/include -I$(CURDIR)/libsemanage/include
+LDFLAGS += -L$(CURDIR)/libselinux/src -L$(CURDIR)/libsepol/src -L$(CURDIR)/libsemanage/src
+export CFLAGS
+export LDFLAGS
+
 all install relabel clean test indent:
 	@for subdir in $(SUBDIRS); do \
 		(cd $$subdir && $(MAKE) $@) || exit 1; \

policycoreutils/audit2allow/Makefile +2 -2

diff -pruN selinux/policycoreutils/audit2allow/Makefile selinux-13092011/policycoreutils/audit2allow/Makefile
@@ -1,9 +1,9 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 BINDIR ?= $(PREFIX)/bin
 LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 
 all: ;

policycoreutils/audit2why/Makefile +1 -1

diff -pruN selinux/policycoreutils/audit2why/Makefile selinux-13092011/policycoreutils/audit2why/Makefile
@@ -1,5 +1,5 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 BINDIR ?= $(PREFIX)/bin
 MANDIR ?= $(PREFIX)/share/man

policycoreutils/load_policy/Makefile +6 -4

diff -pruN selinux/policycoreutils/load_policy/Makefile selinux-13092011/policycoreutils/load_policy/Makefile
@@ -1,13 +1,15 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(DESTDIR)/sbin
 USRSBINDIR ?= $(PREFIX)/sbin
+INCLUDEDIR ?= $(PREFIX)/include
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lsepol -lselinux -L$(PREFIX)/lib
+override CFLAGS += $(LDFLAGS) -I$(INCLUDEDIR) -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+LDLIBS += -lsepol -lselinux -L$(LIBDIR)
 
 TARGETS=$(patsubst %.c,%,$(wildcard *.c))

policycoreutils/mcstrans/src/Makefile +1 -1

diff -pruN selinux/policycoreutils/mcstrans/src/Makefile selinux-13092011/policycoreutils/mcstrans/src/Makefile
@@ -28,7 +28,7 @@ override CFLAGS += -I../include -D_GNU_S
 all: $(PROG)
 
 $(PROG): $(PROG_OBJS)
-	$(CC) $(LDFLAGS) -pie -o $@ $^ -lselinux -lcap -lpcre $(LIBDIR)/libsepol.a
+	$(CC) $(LDFLAGS) -pie -o $@ $^ -lselinux ../../../libsepol/src/libsepol.a -L$(LIBDIR) -lcap -lpcre
 
 %.o:  %.c 
 	$(CC) $(CFLAGS) -fPIE -c -o $@ $<

policycoreutils/mcstrans/utils/Makefile +1 -1

diff -pruN selinux/policycoreutils/mcstrans/utils/Makefile selinux-13092011/policycoreutils/mcstrans/utils/Makefile
@@ -21,7 +21,7 @@ endif
 
 CFLAGS ?= -Wall
 override CFLAGS += -I../src -D_GNU_SOURCE
-LDLIBS += -L../src ../src/mcstrans.o ../src/mls_level.o -lselinux -lpcre $(LIBDIR)/libsepol.a
+LDLIBS += -L../src ../src/mcstrans.o ../src/mls_level.o -lselinux -lpcre ../../../libsepol/src/libsepol.a
 
 TARGETS=$(patsubst %.c,%,$(wildcard *.c))

policycoreutils/newrole/Makefile +6 -4

diff -pruN selinux/policycoreutils/newrole/Makefile selinux-13092011/policycoreutils/newrole/Makefile
@@ -1,9 +1,11 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 BINDIR ?= $(PREFIX)/bin
 MANDIR ?= $(PREFIX)/share/man
+INCLUDEDIR ?= $(PREFIX)/include
+LIBDIR ?= $(PREFIX)/lib
 ETCDIR ?= $(DESTDIR)/etc
-LOCALEDIR = /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 PAMH = $(shell ls /usr/include/security/pam_appl.h 2>/dev/null)
 AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null)
 # Enable capabilities to permit newrole to generate audit records.

@@ -22,8 +24,8 @@ VERSION = $(shell cat ../VERSION)
 
 CFLAGS ?= -Werror -Wall -W
 EXTRA_OBJS =
-override CFLAGS += -DVERSION=\"$(VERSION)\" $(LDFLAGS) -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lselinux -L$(PREFIX)/lib
+override CFLAGS += -DVERSION=\"$(VERSION)\" $(LDFLAGS) -I$(INCLUDEDIR) -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+LDLIBS += -lselinux -L$(LIBDIR)
 ifeq (${PAMH}, /usr/include/security/pam_appl.h)
 	override CFLAGS += -DUSE_PAM
 	EXTRA_OBJS += hashtab.o

policycoreutils/restorecond/Makefile +7 -6

diff -pruN selinux/policycoreutils/restorecond/Makefile selinux-13092011/policycoreutils/restorecond/Makefile
@@ -1,13 +1,14 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
-INITDIR = $(DESTDIR)/etc/rc.d/init.d
-SELINUXDIR = $(DESTDIR)/etc/selinux
+INCLUDEDIR ?= $(PREFIX)/include
+MANDIR ?= $(PREFIX)/share/man
+INITDIR ?= $(DESTDIR)/etc/rc.d/init.d
+SELINUXDIR ?= $(DESTDIR)/etc/selinux
 
 CFLAGS ?= -g -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64
-LDLIBS += -lselinux -L$(PREFIX)/lib
+override CFLAGS += -I$(INCLUDEDIR) -D_FILE_OFFSET_BITS=64
+LDLIBS += -lselinux -L$(LIBDIR)
 
 all: restorecond

policycoreutils/run_init/Makefile +6 -5

diff -pruN selinux/policycoreutils/run_init/Makefile selinux-13092011/policycoreutils/run_init/Makefile
@@ -1,16 +1,17 @@
-
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(PREFIX)/sbin
+INCLUDEDIR ?= $(PREFIX)/include
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
 ETCDIR ?= $(DESTDIR)/etc
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 PAMH = $(shell ls /usr/include/security/pam_appl.h 2>/dev/null)
 AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null)
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lselinux -L$(PREFIX)/lib
+override CFLAGS += -I$(INCLUDEDIR) -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+LDLIBS += -lselinux -L$(LIBDIR)
 ifeq (${PAMH}, /usr/include/security/pam_appl.h)
 	override CFLAGS += -DUSE_PAM
 	LDLIBS += -lpam -lpam_misc

policycoreutils/sandbox/Makefile +8 -6

diff -pruN selinux/policycoreutils/sandbox/Makefile selinux-13092011/policycoreutils/sandbox/Makefile
@@ -1,14 +1,16 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
-INITDIR ?= ${DESTDIR}/etc/rc.d/init.d/
-SYSCONFDIR ?= ${DESTDIR}/etc/sysconfig
+PREFIX ?= $(DESTDIR)/usr
+INITDIR ?= $(DESTDIR)/etc/rc.d/init.d/
+SYSCONFDIR ?= $(DESTDIR)/etc/sysconfig
 BINDIR ?= $(PREFIX)/bin
 SBINDIR ?= $(PREFIX)/sbin
+INCLUDEDIR ?= $(PREFIX)/include
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 SHAREDIR ?= $(PREFIX)/share/sandbox
-override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lselinux -lcap-ng 
+override CFLAGS += $(LDFLAGS) -I$(INCLUDEDIR) -DPACKAGE="\"policycoreutils\""
+LDLIBS += -lselinux -L$(LIBDIR) -lcap-ng
 
 all: sandbox seunshare sandboxX.sh start

policycoreutils/scripts/genhomedircon.8 +12 ~~-28~~

diff -pruN selinux/policycoreutils/scripts/genhomedircon.8 selinux-13092011/policycoreutils/scripts/genhomedircon.8
@@ -1,37 +1,21 @@
-.\" Hey, Emacs! This is an -*- nroff -*- source file.
-.\" Copyright (c) 2010 Dan Walsh <[email protected]>
-.\"
-.\" This is free documentation; you can redistribute it and/or
-.\" modify it under the terms of the GNU General Public License as
-.\" published by the Free Software Foundation; either version 2 of
-.\" the License, or (at your option) any later version.
-.\"
-.\" The GNU General Public License's references to "object code"
-.\" and "executables" are to be interpreted as the output of any
-.\" document formatting or typesetting system, including
-.\" intermediate and printed output.
-.\"
-.\" This manual is distributed in the hope that it will be useful,
-.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
-.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-.\" GNU General Public License for more details.
-.\"
-.\" You should have received a copy of the GNU General Public
-.\" License along with this manual; if not, write to the Free
-.\" Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139,
-.\" USA.
-.\"
-.\"
-.TH GENHOMEDIRCON "8" "May 2010" "Security Enhanced Linux" "SELinux"
+.TH GENHOMEDIRCON "8" "Sep 2011" "Security Enhanced Linux" "SELinux"
 .SH NAME
 genhomedircon \- generate SELinux file context configuration entries for user home directories
 .SH SYNOPSIS
 .B genhomedircon
-is a script that executes semodule to rebuild policy and create the
-labels for HOMEDIRS based on home directories returned by the getpw calls.
+is a script that executes
+.B semodule
+to rebuild the SELinux policy and to create the
+labels for each user home directory based on directory paths returned by calls to getpwent().
 
-This functionality is enabled via the usepasswd flag in /etc/selinux/semanage.conf.
+This functionality can be disabled by using the "usepasswd" flag in /etc/selinux/semanage.conf
+(such flag can either take the value "true" or "false" and by default it is set to "true").
 
 .SH AUTHOR
 This manual page was written by
 .I Dan Walsh <[email protected]>
+
+The supporting functionality in the semanage library was written by Tresys Technology.
+
+.SH "SEE ALSO"
+semodule(8), getpwent(3), getpwent_r(3)

policycoreutils/scripts/Makefile +6 -3

diff -pruN selinux/policycoreutils/scripts/Makefile selinux-13092011/policycoreutils/scripts/Makefile
@@ -1,9 +1,9 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 BINDIR ?= $(PREFIX)/bin
 SBINDIR ?= $(PREFIX)/sbin
 MANDIR ?= $(PREFIX)/share/man
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 
 all: fixfiles genhomedircon chcat

@@ -11,7 +11,10 @@ install: all
 	-mkdir -p $(BINDIR)
 	install -m 755 chcat $(BINDIR)
 	install -m 755 fixfiles $(DESTDIR)/sbin
-	install -m 755 genhomedircon  $(SBINDIR)
+	@echo "#!/bin/sh" > genhomedircon
+	@echo >> genhomedircon
+	@echo "$(SBINDIR)/semodule -Bn" >> genhomedircon
+	install -m 755 genhomedircon $(SBINDIR)
 	-mkdir -p $(MANDIR)/man8
 	install -m 644 fixfiles.8 $(MANDIR)/man8/
 	install -m 644 genhomedircon.8 $(MANDIR)/man8/

policycoreutils/secon/Makefile +2 -2

diff -pruN selinux/policycoreutils/secon/Makefile selinux-13092011/policycoreutils/secon/Makefile
@@ -1,9 +1,9 @@
 # secon tool - command-line context
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
 MANDIR ?= $(PREFIX)/share/man
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 
 WARNS=-Werror -W -Wall -Wundef -Wshadow -Wpointer-arith -Wbad-function-cast -Wcast-align -Wwrite-strings -Waggregate-return -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -Wno-format-zero-length -Wformat-nonliteral -Wformat-security -Wfloat-equal
 VERSION = $(shell cat ../VERSION)

policycoreutils/semanage/Makefile +2 -2

diff -pruN selinux/policycoreutils/semanage/Makefile selinux-13092011/policycoreutils/semanage/Makefile
@@ -1,8 +1,8 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 LIBDIR ?= $(PREFIX)/lib
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
+MANDIR ?= $(PREFIX)/share/man
 PYLIBVER ?= $(shell python -c 'import sys;print "python%d.%d" % sys.version_info[0:2]')
 PYTHONLIBDIR ?= $(LIBDIR)/$(PYLIBVER)

policycoreutils/semodule/Makefile +2 -2

diff -pruN selinux/policycoreutils/semodule/Makefile selinux-13092011/policycoreutils/semodule/Makefile
@@ -2,8 +2,8 @@
 PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
-LIBDIR ?= ${PREFIX}/lib
+MANDIR ?= $(PREFIX)/share/man
+LIBDIR ?= $(PREFIX)/lib
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += -I$(INCLUDEDIR)

policycoreutils/semodule_deps/Makefile +3 -3

diff -pruN selinux/policycoreutils/semodule_deps/Makefile selinux-13092011/policycoreutils/semodule_deps/Makefile
@@ -1,13 +1,13 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += -I$(INCLUDEDIR)
-LDLIBS = $(LIBDIR)/libsepol.a
+LDLIBS = ../../libsepol/src/libsepol.a
 
 all: semodule_deps

policycoreutils/semodule_expand/Makefile +2 -2

diff -pruN selinux/policycoreutils/semodule_expand/Makefile selinux-13092011/policycoreutils/semodule_expand/Makefile
@@ -1,8 +1,8 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
 
 CFLAGS ?= -Werror -Wall -W

policycoreutils/semodule_link/Makefile +2 -2

diff -pruN selinux/policycoreutils/semodule_link/Makefile selinux-13092011/policycoreutils/semodule_link/Makefile
@@ -1,9 +1,9 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
 MANDIR ?= $(PREFIX)/share/man
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += -I$(INCLUDEDIR)

policycoreutils/semodule_package/Makefile +2 -2

diff -pruN selinux/policycoreutils/semodule_package/Makefile selinux-13092011/policycoreutils/semodule_package/Makefile
@@ -1,8 +1,8 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
 
 CFLAGS ?= -Werror -Wall -W

policycoreutils/sestatus/Makefile +6 -5

diff -pruN selinux/policycoreutils/sestatus/Makefile selinux-13092011/policycoreutils/sestatus/Makefile
@@ -1,12 +1,13 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
+INCLUDEDIR ?= $(PREFIX)/include
+MANDIR ?= $(PREFIX)/share/man
 ETCDIR ?= $(DESTDIR)/etc
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 
-CFLAGS = -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64
+CFLAGS ?= -Werror -Wall -W
+override CFLAGS += -I$(INCLUDEDIR) -D_FILE_OFFSET_BITS=64
 LDLIBS = -lselinux -L$(LIBDIR)
 
 all: sestatus

policycoreutils/setfiles/Makefile +5 -4

diff -pruN selinux/policycoreutils/setfiles/Makefile selinux-13092011/policycoreutils/setfiles/Makefile
@@ -1,12 +1,13 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(DESTDIR)/sbin
-MANDIR = $(PREFIX)/share/man
+INCLUDEDIR ?= $(PREFIX)/include
+MANDIR ?= $(PREFIX)/share/man
 LIBDIR ?= $(PREFIX)/lib
 AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null)
 
-CFLAGS = -g -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include
+CFLAGS ?= -g -Werror -Wall -W
+override CFLAGS += -I$(INCLUDEDIR)
 LDLIBS = -lselinux -lsepol -L$(LIBDIR)
 
 ifeq (${AUDITH}, /usr/include/libaudit.h)

policycoreutils/setsebool/Makefile +2 -2

diff -pruN selinux/policycoreutils/setsebool/Makefile selinux-13092011/policycoreutils/setsebool/Makefile
@@ -2,8 +2,8 @@
 PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
-LIBDIR ?= ${PREFIX}/lib
+MANDIR ?= $(PREFIX)/share/man
+LIBDIR ?= $(PREFIX)/lib
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += -I$(INCLUDEDIR)

README +17 -0

diff -pruN selinux/README selinux-13092011/README
@@ -0,0 +1,17 @@
+INSTALLATION:
+
+Type "make" to build and then "make install" to install.
+
+---
+
+The environment variables CFLAGS and LDFLAGS can be passed to "make" to use custom compiler
+and/or linker flags (for example: CFLAGS="-O3" LDFLAGS="" make).
+
+The environment variables LIBDIR and SHLIBDIR can be passed to "make" in order to configure
+different directories for the libraries (e.g. LIBDIR=/usr/lib64 and SHLIBDIR=/usr/lib64
+on 64-bit systems).
+
+The environment variable PREFIX can be passed to "make" in order to configure an install
+prefix other than "/usr".
+
+Please see the Makefile(s) for other environment variables that can be used.

Regards,

Guido

Quoted 613 lines · Guido Trentalancia

Hello again.

I have prepared a new revised and possibly (in)complete version of the patch.

Quoted 18 lines · Guido Trentalancia

Quoted 9 lines
However, at the moment, without an existing installation in place the build fails on my system because it cannot source header files from $(PREFIX)/include/{selinux,sepol,semanage} during compilation and then because it cannot source shared libraries from LIBDIR ?= $(PREFIX)/lib during linking.
It also fails if an existing installation provides obsolete header files.
Quoted 6 lines
Another (even better) way of achieving the same would probably be to set a TOPLEVEL variable to "pwd" (shell builtin for current directory) in the top-level Makefile and then add -I $(TOPLEVEL)/{selinux,sepol,semanage}/include and -L $(TOPLEVEL)/lib{selinux,sepol,semanage}/src to CFLAGS and LDFLAGS respectively...
And here is what I meant:

[cut]

Quoted 6 lines

There are many different ways of achieving it.
Using the CURDIR variable provided by make is quite nice. Not only it is much simpler and much cleaner, but it also avoids the need to revert the patch before creating the separate components to be released.

Quoted 7 lines

However there are many other bits left out from previously posted patches (honor LIBDIR for load_policy, LIBSO link creation in SHLIBDIR for the three shared libraries, genhomedircon manual page, do not hard-code path in genhomedircon script, replacement of curly brackets with parentheses for some variables in some makefiles, make use of PREFIX for determining LOCALEDIR in some makefiles, do not override passed environment variables in some makefiles, et cetera).

This is a maintenance patch for further testing. It potentially replaces any other patch previously posted in this same and/or other recent threads.

Create a top-level README file which is intended to provide a few details about some of the possible environment variables that can be configured and passed to the make tool.

Fix a possible installation issue (creation of symbolic links to shared libraries using a wrong target file and in a possibly wrong directory for libselinux, libsepol and libsemanage).

Do not hard-code the path to semodule in the genhomedircon script but rather generate it each time by using PREFIX. Improve the manual page for genhomedircon.

Replace curly brackets with parentheses for some variables such as DESTDIR and PREFIX in the Makefiles. Add and make use of LIBDIR and INCLUDEDIR where appropriate within the Makefiles. Make use of PREFIX for determining the value of LOCALEDIR within some of the Makefiles. Do not override the environment variables passed from the command-line for some of the Makefiles.

diff -pruN selinux/checkpolicy/Makefile selinux-13092011/checkpolicy/Makefile

checkpolicy/Makefile +1 -1

@@ -19,7 +19,7 @@ CHECKOBJS = y.tab.o lex.yy.o queue.o mod
 CHECKPOLOBJS = $(CHECKOBJS) checkpolicy.o
 CHECKMODOBJS = $(CHECKOBJS) checkmodule.o
 
-LDLIBS=$(LIBDIR)/libsepol.a -lfl
+LDLIBS=../libsepol/src/libsepol.a -L$(LIBDIR) -lfl
 
 GENERATED=lex.yy.c y.tab.c y.tab.h

diff -pruN selinux/checkpolicy/test/Makefile selinux-13092011/checkpolicy/test/Makefile

checkpolicy/test/Makefile +1 -1

@@ -9,7 +9,7 @@ INCLUDEDIR ?= $(PREFIX)/include
 CFLAGS ?= -g -Wall -O2 -pipe
 override CFLAGS += -I$(INCLUDEDIR)
 
-LDLIBS=-lfl -lsepol -lselinux $(LIBDIR)/libsepol.a -L$(LIBDIR)
+LDLIBS=-lsepol -lselinux ../../libsepol/src/libsepol.a -L$(LIBDIR) -lfl
 
 all: dispol dismod

diff -pruN selinux/libselinux/src/Makefile selinux-13092011/libselinux/src/Makefile

libselinux/src/Makefile +2 -2

@@ -102,7 +102,7 @@ $(AUDIT2WHYLOBJ): audit2why.c
 	$(CC) $(filter-out -Werror, $(CFLAGS)) $(PYINC) -fPIC -DSHARED -c -o $@ $<
 
 $(AUDIT2WHYSO): $(AUDIT2WHYLOBJ)
-	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux ${LIBDIR}/libsepol.a -L$(LIBDIR) -Wl,-soname,$@
+	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux ../../libsepol/src/libsepol.a -L$(LIBDIR) -Wl,-soname,$@
 
 %.o:  %.c policy.h
 	$(CC) $(CFLAGS) $(TLSFLAGS) -c -o $@ $<

@@ -126,7 +126,7 @@ install: all
 	install -m 755 $(LIBSO) $(SHLIBDIR)
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
-	cd $(LIBDIR) && ln -sf ../../`basename $(SHLIBDIR)`/$(LIBSO) $(TARGET)
+	cd $(SHLIBDIR) && ln -sf $(LIBSO) $(TARGET)
 
 install-pywrap: pywrap
 	test -d $(PYLIBDIR)/site-packages/selinux || install -m 755 -d $(PYLIBDIR)/site-packages/selinux

diff -pruN selinux/libsemanage/src/Makefile selinux-13092011/libsemanage/src/Makefile

libsemanage/src/Makefile +2 -2

@@ -87,7 +87,7 @@ $(LIBA): $(OBJS)
 	$(RANLIB) $@
 
 $(LIBSO): $(LOBJS)
-	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -lsepol -lselinux -lbz2 -lustr -L$(LIBDIR) -Wl,-soname,$(LIBSO),--version-script=libsemanage.map,-z,defs
+	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -lsepol -lselinux -L$(LIBDIR) -lbz2 -lustr -Wl,-soname,$(LIBSO),--version-script=libsemanage.map,-z,defs
 	ln -sf $@ $(TARGET)
 
 $(LIBPC): $(LIBPC).in

@@ -139,7 +139,7 @@ install: all
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
 	test -f $(DEFAULT_SEMANAGE_CONF_LOCATION) || install -m 644 -D semanage.conf $(DEFAULT_SEMANAGE_CONF_LOCATION)
-	cd $(LIBDIR) && ln -sf $(LIBSO) $(TARGET)
+	cd $(SHLIBDIR) && ln -sf $(LIBSO) $(TARGET)
 
 install-pywrap: pywrap 
 	test -d $(PYLIBDIR)/site-packages || install -m 755 -d $(PYLIBDIR)/site-packages

diff -pruN selinux/libsepol/src/Makefile selinux-13092011/libsepol/src/Makefile

libsepol/src/Makefile +1 -1

@@ -43,7 +43,7 @@ install: all
 	install -m 755 $(LIBSO) $(SHLIBDIR)
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
-	cd $(LIBDIR) && ln -sf ../../`basename $(SHLIBDIR)`/$(LIBSO) $(TARGET)
+	cd $(SHLIBDIR) && ln -sf $(LIBSO) $(TARGET)
 
 relabel:
 	/sbin/restorecon $(SHLIBDIR)/$(LIBSO)

diff -pruN selinux/Makefile selinux-13092011/Makefile

Makefile +7 -2

@@ -3,10 +3,15 @@ PYSUBDIRS=libselinux libsemanage
 DISTCLEANSUBIDRS=libselinux libsemanage
 
 ifeq ($(DEBUG),1)
-	export CFLAGS = -g3 -O0 -gdwarf-2 -fno-strict-aliasing -Wall -Wshadow -Werror
-	export LDFLAGS = -g
+	CFLAGS += -g3 -O0 -gdwarf-2 -fno-strict-aliasing -Wall -Wshadow -Werror
+	LDFLAGS += -g
 endif
 
+CFLAGS += -I$(CURDIR)/libselinux/include -I$(CURDIR)/libsepol/include -I$(CURDIR)/libsemanage/include
+LDFLAGS += -L$(CURDIR)/libselinux/src -L$(CURDIR)/libsepol/src -L$(CURDIR)/libsemanage/src
+export CFLAGS
+export LDFLAGS
+
 all install relabel clean test indent:
 	@for subdir in $(SUBDIRS); do \
 		(cd $$subdir && $(MAKE) $@) || exit 1; \

diff -pruN selinux/policycoreutils/audit2allow/Makefile selinux-13092011/policycoreutils/audit2allow/Makefile

policycoreutils/audit2allow/Makefile +2 -2

@@ -1,9 +1,9 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 BINDIR ?= $(PREFIX)/bin
 LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 
 all: ;

diff -pruN selinux/policycoreutils/audit2why/Makefile selinux-13092011/policycoreutils/audit2why/Makefile

policycoreutils/audit2why/Makefile +1 -1

@@ -1,5 +1,5 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 BINDIR ?= $(PREFIX)/bin
 MANDIR ?= $(PREFIX)/share/man

diff -pruN selinux/policycoreutils/load_policy/Makefile selinux-13092011/policycoreutils/load_policy/Makefile

policycoreutils/load_policy/Makefile +6 -4

@@ -1,13 +1,15 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(DESTDIR)/sbin
 USRSBINDIR ?= $(PREFIX)/sbin
+INCLUDEDIR ?= $(PREFIX)/include
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lsepol -lselinux -L$(PREFIX)/lib
+override CFLAGS += $(LDFLAGS) -I$(INCLUDEDIR) -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+LDLIBS += -lsepol -lselinux -L$(LIBDIR)
 
 TARGETS=$(patsubst %.c,%,$(wildcard *.c))

diff -pruN selinux/policycoreutils/mcstrans/src/Makefile selinux-13092011/policycoreutils/mcstrans/src/Makefile

policycoreutils/mcstrans/src/Makefile +1 -1

@@ -28,7 +28,7 @@ override CFLAGS += -I../include -D_GNU_S
 all: $(PROG)
 
 $(PROG): $(PROG_OBJS)
-	$(CC) $(LDFLAGS) -pie -o $@ $^ -lselinux -lcap -lpcre $(LIBDIR)/libsepol.a
+	$(CC) $(LDFLAGS) -pie -o $@ $^ -lselinux ../../../libsepol/src/libsepol.a -L$(LIBDIR) -lcap -lpcre
 
 %.o:  %.c 
 	$(CC) $(CFLAGS) -fPIE -c -o $@ $<

diff -pruN selinux/policycoreutils/mcstrans/utils/Makefile selinux-13092011/policycoreutils/mcstrans/utils/Makefile

policycoreutils/mcstrans/utils/Makefile +1 -1

@@ -21,7 +21,7 @@ endif
 
 CFLAGS ?= -Wall
 override CFLAGS += -I../src -D_GNU_SOURCE
-LDLIBS += -L../src ../src/mcstrans.o ../src/mls_level.o -lselinux -lpcre $(LIBDIR)/libsepol.a
+LDLIBS += -L../src ../src/mcstrans.o ../src/mls_level.o -lselinux -lpcre ../../../libsepol/src/libsepol.a
 
 TARGETS=$(patsubst %.c,%,$(wildcard *.c))

diff -pruN selinux/policycoreutils/newrole/Makefile selinux-13092011/policycoreutils/newrole/Makefile

policycoreutils/newrole/Makefile +6 -4

@@ -1,9 +1,11 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 BINDIR ?= $(PREFIX)/bin
 MANDIR ?= $(PREFIX)/share/man
+INCLUDEDIR ?= $(PREFIX)/include
+LIBDIR ?= $(PREFIX)/lib
 ETCDIR ?= $(DESTDIR)/etc
-LOCALEDIR = /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 PAMH = $(shell ls /usr/include/security/pam_appl.h 2>/dev/null)
 AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null)
 # Enable capabilities to permit newrole to generate audit records.

@@ -22,8 +24,8 @@ VERSION = $(shell cat ../VERSION)
 
 CFLAGS ?= -Werror -Wall -W
 EXTRA_OBJS =
-override CFLAGS += -DVERSION=\"$(VERSION)\" $(LDFLAGS) -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lselinux -L$(PREFIX)/lib
+override CFLAGS += -DVERSION=\"$(VERSION)\" $(LDFLAGS) -I$(INCLUDEDIR) -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+LDLIBS += -lselinux -L$(LIBDIR)
 ifeq (${PAMH}, /usr/include/security/pam_appl.h)
 	override CFLAGS += -DUSE_PAM
 	EXTRA_OBJS += hashtab.o

diff -pruN selinux/policycoreutils/restorecond/Makefile selinux-13092011/policycoreutils/restorecond/Makefile

policycoreutils/restorecond/Makefile +7 -6

@@ -1,13 +1,14 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
-INITDIR = $(DESTDIR)/etc/rc.d/init.d
-SELINUXDIR = $(DESTDIR)/etc/selinux
+INCLUDEDIR ?= $(PREFIX)/include
+MANDIR ?= $(PREFIX)/share/man
+INITDIR ?= $(DESTDIR)/etc/rc.d/init.d
+SELINUXDIR ?= $(DESTDIR)/etc/selinux
 
 CFLAGS ?= -g -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64
-LDLIBS += -lselinux -L$(PREFIX)/lib
+override CFLAGS += -I$(INCLUDEDIR) -D_FILE_OFFSET_BITS=64
+LDLIBS += -lselinux -L$(LIBDIR)
 
 all: restorecond

diff -pruN selinux/policycoreutils/run_init/Makefile selinux-13092011/policycoreutils/run_init/Makefile

policycoreutils/run_init/Makefile +6 -5

@@ -1,16 +1,17 @@
-
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(PREFIX)/sbin
+INCLUDEDIR ?= $(PREFIX)/include
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
 ETCDIR ?= $(DESTDIR)/etc
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 PAMH = $(shell ls /usr/include/security/pam_appl.h 2>/dev/null)
 AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null)
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lselinux -L$(PREFIX)/lib
+override CFLAGS += -I$(INCLUDEDIR) -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+LDLIBS += -lselinux -L$(LIBDIR)
 ifeq (${PAMH}, /usr/include/security/pam_appl.h)
 	override CFLAGS += -DUSE_PAM
 	LDLIBS += -lpam -lpam_misc

diff -pruN selinux/policycoreutils/sandbox/Makefile selinux-13092011/policycoreutils/sandbox/Makefile

policycoreutils/sandbox/Makefile +8 -6

@@ -1,14 +1,16 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
-INITDIR ?= ${DESTDIR}/etc/rc.d/init.d/
-SYSCONFDIR ?= ${DESTDIR}/etc/sysconfig
+PREFIX ?= $(DESTDIR)/usr
+INITDIR ?= $(DESTDIR)/etc/rc.d/init.d/
+SYSCONFDIR ?= $(DESTDIR)/etc/sysconfig
 BINDIR ?= $(PREFIX)/bin
 SBINDIR ?= $(PREFIX)/sbin
+INCLUDEDIR ?= $(PREFIX)/include
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 SHAREDIR ?= $(PREFIX)/share/sandbox
-override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lselinux -lcap-ng 
+override CFLAGS += $(LDFLAGS) -I$(INCLUDEDIR) -DPACKAGE="\"policycoreutils\""
+LDLIBS += -lselinux -L$(LIBDIR) -lcap-ng
 
 all: sandbox seunshare sandboxX.sh start

diff -pruN selinux/policycoreutils/scripts/genhomedircon.8 selinux-13092011/policycoreutils/scripts/genhomedircon.8

policycoreutils/scripts/genhomedircon.8 +12 ~~-28~~

@@ -1,37 +1,21 @@
-.\" Hey, Emacs! This is an -*- nroff -*- source file.
-.\" Copyright (c) 2010 Dan Walsh <[email protected]>
-.\"
-.\" This is free documentation; you can redistribute it and/or
-.\" modify it under the terms of the GNU General Public License as
-.\" published by the Free Software Foundation; either version 2 of
-.\" the License, or (at your option) any later version.
-.\"
-.\" The GNU General Public License's references to "object code"
-.\" and "executables" are to be interpreted as the output of any
-.\" document formatting or typesetting system, including
-.\" intermediate and printed output.
-.\"
-.\" This manual is distributed in the hope that it will be useful,
-.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
-.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-.\" GNU General Public License for more details.
-.\"
-.\" You should have received a copy of the GNU General Public
-.\" License along with this manual; if not, write to the Free
-.\" Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139,
-.\" USA.
-.\"
-.\"
-.TH GENHOMEDIRCON "8" "May 2010" "Security Enhanced Linux" "SELinux"
+.TH GENHOMEDIRCON "12" "Sep 2011" "Security Enhanced Linux" "SELinux"
 .SH NAME
 genhomedircon \- generate SELinux file context configuration entries for user home directories
 .SH SYNOPSIS
 .B genhomedircon
-is a script that executes semodule to rebuild policy and create the
-labels for HOMEDIRS based on home directories returned by the getpw calls.
+is a script that executes
+.B semodule
+to rebuild the SELinux policy and to create the
+labels for each user home directory based on directory paths returned by calls to getpwent().
 
-This functionality is enabled via the usepasswd flag in /etc/selinux/semanage.conf.
+This functionality can be disabled by using the "usepasswd" flag in /etc/selinux/semanage.conf
+(such flag can either take the value "true" or "false" and by default it is set to "true").
 
 .SH AUTHOR
 This manual page was written by
 .I Dan Walsh <[email protected]>
+
+The supporting functionality in the semanage library was written by Tresys Technology.
+
+.SH "SEE ALSO"
+semodule(8), getpwent(3), getpwent_r(3)

diff -pruN selinux/policycoreutils/scripts/Makefile selinux-13092011/policycoreutils/scripts/Makefile

policycoreutils/scripts/Makefile +6 -3

@@ -1,9 +1,9 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 BINDIR ?= $(PREFIX)/bin
 SBINDIR ?= $(PREFIX)/sbin
 MANDIR ?= $(PREFIX)/share/man
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 
 all: fixfiles genhomedircon chcat

@@ -11,7 +11,10 @@ install: all
 	-mkdir -p $(BINDIR)
 	install -m 755 chcat $(BINDIR)
 	install -m 755 fixfiles $(DESTDIR)/sbin
-	install -m 755 genhomedircon  $(SBINDIR)
+	@echo "#!/bin/sh" > genhomedircon
+	@echo >> genhomedircon
+	@echo "$(SBINDIR)/semodule -Bn" >> genhomedircon
+	install -m 755 genhomedircon $(SBINDIR)
 	-mkdir -p $(MANDIR)/man8
 	install -m 644 fixfiles.8 $(MANDIR)/man8/
 	install -m 644 genhomedircon.8 $(MANDIR)/man8/

diff -pruN selinux/policycoreutils/secon/Makefile selinux-13092011/policycoreutils/secon/Makefile

policycoreutils/secon/Makefile +2 -2

@@ -1,9 +1,9 @@
 # secon tool - command-line context
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
 MANDIR ?= $(PREFIX)/share/man
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 
 WARNS=-Werror -W -Wall -Wundef -Wshadow -Wpointer-arith -Wbad-function-cast -Wcast-align -Wwrite-strings -Waggregate-return -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -Wno-format-zero-length -Wformat-nonliteral -Wformat-security -Wfloat-equal
 VERSION = $(shell cat ../VERSION)

diff -pruN selinux/policycoreutils/semanage/Makefile selinux-13092011/policycoreutils/semanage/Makefile

policycoreutils/semanage/Makefile +2 -2

@@ -1,8 +1,8 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 LIBDIR ?= $(PREFIX)/lib
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
+MANDIR ?= $(PREFIX)/share/man
 PYLIBVER ?= $(shell python -c 'import sys;print "python%d.%d" % sys.version_info[0:2]')
 PYTHONLIBDIR ?= $(LIBDIR)/$(PYLIBVER)

diff -pruN selinux/policycoreutils/semodule/Makefile selinux-13092011/policycoreutils/semodule/Makefile

policycoreutils/semodule/Makefile +2 -2

@@ -2,8 +2,8 @@
 PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
-LIBDIR ?= ${PREFIX}/lib
+MANDIR ?= $(PREFIX)/share/man
+LIBDIR ?= $(PREFIX)/lib
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += -I$(INCLUDEDIR)

diff -pruN selinux/policycoreutils/semodule_deps/Makefile selinux-13092011/policycoreutils/semodule_deps/Makefile

policycoreutils/semodule_deps/Makefile +3 -3

@@ -1,13 +1,13 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += -I$(INCLUDEDIR)
-LDLIBS = $(LIBDIR)/libsepol.a
+LDLIBS = ../../libsepol/src/libsepol.a
 
 all: semodule_deps

diff -pruN selinux/policycoreutils/semodule_expand/Makefile selinux-13092011/policycoreutils/semodule_expand/Makefile

policycoreutils/semodule_expand/Makefile +2 -2

@@ -1,8 +1,8 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
 
 CFLAGS ?= -Werror -Wall -W

diff -pruN selinux/policycoreutils/semodule_link/Makefile selinux-13092011/policycoreutils/semodule_link/Makefile

policycoreutils/semodule_link/Makefile +2 -2

@@ -1,9 +1,9 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
 MANDIR ?= $(PREFIX)/share/man
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += -I$(INCLUDEDIR)

diff -pruN selinux/policycoreutils/semodule_package/Makefile selinux-13092011/policycoreutils/semodule_package/Makefile

policycoreutils/semodule_package/Makefile +2 -2

@@ -1,8 +1,8 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
 
 CFLAGS ?= -Werror -Wall -W

diff -pruN selinux/policycoreutils/sestatus/Makefile selinux-13092011/policycoreutils/sestatus/Makefile

policycoreutils/sestatus/Makefile +6 -5

@@ -1,12 +1,13 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
+INCLUDEDIR ?= $(PREFIX)/include
+MANDIR ?= $(PREFIX)/share/man
 ETCDIR ?= $(DESTDIR)/etc
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 
-CFLAGS = -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64
+CFLAGS ?= -Werror -Wall -W
+override CFLAGS += -I$(INCLUDEDIR) -D_FILE_OFFSET_BITS=64
 LDLIBS = -lselinux -L$(LIBDIR)
 
 all: sestatus

diff -pruN selinux/policycoreutils/setfiles/Makefile selinux-13092011/policycoreutils/setfiles/Makefile

policycoreutils/setfiles/Makefile +5 -4

@@ -1,12 +1,13 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(DESTDIR)/sbin
-MANDIR = $(PREFIX)/share/man
+INCLUDEDIR ?= $(PREFIX)/include
+MANDIR ?= $(PREFIX)/share/man
 LIBDIR ?= $(PREFIX)/lib
 AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null)
 
-CFLAGS = -g -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include
+CFLAGS ?= -g -Werror -Wall -W
+override CFLAGS += -I$(INCLUDEDIR)
 LDLIBS = -lselinux -lsepol -L$(LIBDIR)
 
 ifeq (${AUDITH}, /usr/include/libaudit.h)

diff -pruN selinux/policycoreutils/setsebool/Makefile selinux-13092011/policycoreutils/setsebool/Makefile

policycoreutils/setsebool/Makefile +2 -2

@@ -2,8 +2,8 @@
 PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
-LIBDIR ?= ${PREFIX}/lib
+MANDIR ?= $(PREFIX)/share/man
+LIBDIR ?= $(PREFIX)/lib
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += -I$(INCLUDEDIR)

diff -pruN selinux/README selinux-13092011/README

README +17 -0

@@ -0,0 +1,17 @@
+INSTALLATION:
+
+Type "make" to build and then "make install" to install.
+
+---
+
+The environment variables CFLAGS and LDFLAGS can be passed to "make" to use custom compiler
+and/or linker flags (for example: CFLAGS="-O3" LDFLAGS="" make).
+
+The environment variables LIBDIR and SHLIBDIR can be passed to "make" in order to configure
+different directories for the libraries (e.g. LIBDIR=/usr/lib64 and SHLIBDIR=/usr/lib64
+on 64-bit systems).
+
+The environment variable PREFIX can be passed to "make" in order to configure an install
+prefix other than "/usr".
+
+Please see the Makefile(s) for other environment variables that can be used.

You can always fine-tune the details, but please let me know if I can move on as I would like to create a few manual pages.

Regards,

Quoted 8 lines

Guido
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

Stephen Smalley

2011-09-13 12:41 UTC #32 lore raw

Re: [PATCH] Fix includes for userspace tools and libraries (was Re: [PATCH] Fix include semanage/handle.h for semanage_set_root() as used by semodule)

In reply to Eric Paris

Quoted 25 lines · Eric Paris

Quoted 24 lines · Guido Trentalancia
Hi Stephen.
Quoted 13 lines · Stephen Smalley
Quoted 11 lines · Eric Paris
I'm also really annoyed by this at times, but I don't know what the right answer is.
We really treat it like we have 5+ separate projects which just all happen to live in the same git tree. Thus to build libselinux you must have already built and installed libsepol. And then to build libsemanage you need to have done that with both libsepol and libselinux. Then of course to get the builds and install right (on Fedora/RHEL) you have to know to use LIBDIR=/usr/lib64 SHLIBDIR=/lib64 for libsepol and libsepol, but SHLIBDIR=/usr/lib64 for libsemanage. Its a mess, but I don't know what to do that's better....
Quoted 4 lines
make DESTDIR=~/out at top-level should work fine - it will build and install each library into a private tree (as specified by DESTDIR) and then build and install the programs against those libraries. Without needing to clobber the system ones.
At the moment, it does not, until the Makefile(s) are modified or at least until the libraries are manually installed first.

Quoted 8 lines

Quoted 3 lines
Try by yourself, but do not forget to remove $(PREFIX)/usr/include/{selinux,semanage,sepol} and $(PREFIX){/usr,}/lib/libse{linux,manage,pol}* first !
I recently added the patch which changed the global to be 'build' instead of 'install', so sds might not realize that 'install' is no longer the default, however I think Guido is right about the install having a number of paces that it hard coded things...

Well, that's a regression then - it used to work with make DESTDIR=~/out just fine.

Signature · 8 lines

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Guido Trentalancia

author

2011-09-13 16:31 UTC #33 lore raw

Re: [PATCH] Fix includes for userspace tools and libraries (was Re: [PATCH] Fix include semanage/handle.h for semanage_set_root() as used by semodule)

Hello Stephen,

thanks for getting back...

Quoted 30 lines · Stephen Smalley

Quoted 29 lines · Eric Paris
Quoted 27 lines · Guido Trentalancia
Hi Stephen.
Quoted 13 lines · Stephen Smalley
Quoted 11 lines · Eric Paris
I'm also really annoyed by this at times, but I don't know what the right answer is.
We really treat it like we have 5+ separate projects which just all happen to live in the same git tree. Thus to build libselinux you must have already built and installed libsepol. And then to build libsemanage you need to have done that with both libsepol and libselinux. Then of course to get the builds and install right (on Fedora/RHEL) you have to know to use LIBDIR=/usr/lib64 SHLIBDIR=/lib64 for libsepol and libsepol, but SHLIBDIR=/usr/lib64 for libsemanage. Its a mess, but I don't know what to do that's better....
Quoted 4 lines
make DESTDIR=~/out at top-level should work fine - it will build and install each library into a private tree (as specified by DESTDIR) and then build and install the programs against those libraries. Without needing to clobber the system ones.
At the moment, it does not, until the Makefile(s) are modified or at least until the libraries are manually installed first.
Try by yourself, but do not forget to remove $(PREFIX)/usr/include/{selinux,semanage,sepol} and $(PREFIX){/usr,}/lib/libse{linux,manage,pol}* first !

Quoted 7 lines

Quoted 4 lines
I recently added the patch which changed the global to be 'build' instead of 'install', so sds might not realize that 'install' is no longer the default, however I think Guido is right about the install having a number of paces that it hard coded things...
Well, that's a regression then - it used to work with make DESTDIR=~/out just fine.

For sure, it needs further checking and fixing...

But let me just try again pointing out a few further details so that everybody would better understand the issue.

It is a maintenance issue with the Makefiles.

The DESTDIR variable does not matter much because the problem is that it breaks not only the installation but also the compilation itself (prior to the installation) !

So, DESTDIR is generally only used during the installation process (what DESTINATION directory shall I write to ?).

The compilation problem being discussed here is twofold: compilation itself (from *.c source code to *.o object code) and linking (from *.o object code to the tool or shared library executable).

So the first side of the problem (compilation stage) is due to the fact that gcc is only allowed to include header files from the system-wide header repository (e.g. -I/usr/include) while unfortunately it is not allowed/configured to try picking up local header files first (as in having -I$(CURDIR)/libselinux/include -I$(CURDIR)/libsepol/include -I $(CURDIR)/libsemanage/include before any eventual system-wide -I/usr/include).

The second side of the problem (linking stage) is due to a somewhat similar fact that gcc is only allowed to search dynamic (shared) libraries in system-wide repositories (such as -L/usr/lib) while it is not allowed/configured to search the local build directories first (as in having -L$(CURDIR)/libselinux/src -L$(CURDIR)/libsepol/src -L $(CURDIR)/libsemanage/src before any system-wide -L/usr/lib).

For reference: the CURDIR variable is expanded by the GNU make tools to the current directory (it is a GNU make functionality). I propose exploiting such variable in the top-level Makefile in order to determine the top-level SELinux-userspace directory and subsequently pass it recursively to lower-level Makefiles (so that it is used in turn as the base for the *local* -I include and -L link compiler/linker flags).

That said, I must admit I do not know much about the history, although it seems to me from the git logs that the problem has been there since the very first git commit.

Hope it helps.

Regards,

Guido

Stephen Smalley

2011-09-13 17:20 UTC #34 lore raw

Re: [PATCH] Fix includes for userspace tools and libraries (was Re: [PATCH] Fix include semanage/handle.h for semanage_set_root() as used by semodule)

Quoted 11 lines · Guido Trentalancia

But let me just try again pointing out a few further details so that everybody would better understand the issue.
It is a maintenance issue with the Makefiles.
The DESTDIR variable does not matter much because the problem is that it breaks not only the installation but also the compilation itself (prior to the installation) !
So, DESTDIR is generally only used during the installation process (what DESTINATION directory shall I write to ?).

That may be true, but we have been using it to perform local builds of the entire source repository for a very long time. In the case of package builds, it doesn't matter because there each component is separately compiled and the package dependencies ensure that the required components are built and installed first. At some distant point in the past, this approach of using make DESTDIR was introduced as a way to allow us to build the entire tree without requiring us to introduce -I and -L options relative to the current directory, as that was viewed as being more painful to maintain and wrong when built separately (as for packages).

Quoted 11 lines

The compilation problem being discussed here is twofold: compilation itself (from *.c source code to *.o object code) and linking (from *.o object code to the tool or shared library executable).
So the first side of the problem (compilation stage) is due to the fact that gcc is only allowed to include header files from the system-wide header repository (e.g. -I/usr/include) while unfortunately it is not allowed/configured to try picking up local header files first (as in having -I$(CURDIR)/libselinux/include -I$(CURDIR)/libsepol/include -I $(CURDIR)/libsemanage/include before any eventual system-wide -I/usr/include).

Build with make DESTDIR=/some/path install, and it should already add -I/some/path/usr/include to your CFLAGS, which will then get picked up before the system headers (as per man gcc and confirmed by experiment).

Quoted 6 lines

The second side of the problem (linking stage) is due to a somewhat similar fact that gcc is only allowed to search dynamic (shared) libraries in system-wide repositories (such as -L/usr/lib) while it is not allowed/configured to search the local build directories first (as in having -L$(CURDIR)/libselinux/src -L$(CURDIR)/libsepol/src -L $(CURDIR)/libsemanage/src before any system-wide -L/usr/lib).

Likewise, make DESTDIR=/some/path install will adjust your LDFLAGS correctly.

Quoted 6 lines

For reference: the CURDIR variable is expanded by the GNU make tools to the current directory (it is a GNU make functionality). I propose exploiting such variable in the top-level Makefile in order to determine the top-level SELinux-userspace directory and subsequently pass it recursively to lower-level Makefiles (so that it is used in turn as the base for the *local* -I include and -L link compiler/linker flags).

Ok, maybe we didn't know about CURDIR back then or thought it would break separate package builds. I don't recall. I'm not fundamentally opposed to the changes so long as they don't introduce any regressions, but I wanted to be sure that people understand the history.

Quoted 3 lines

That said, I must admit I do not know much about the history, although it seems to me from the git logs that the problem has been there since the very first git commit.

Yet it has worked for us for quite a long time, via make DESTDIR. If it is broken, it is a recent change that broke it.

Signature · 8 lines

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Guido Trentalancia

author

2011-09-13 18:33 UTC #35 lore raw

Re: [PATCH] Fix includes for userspace tools and libraries (and possible security issue)

Hello Stephen.

Quoted 10 lines · Stephen Smalley

Quoted 9 lines · Guido Trentalancia
But let me just try again pointing out a few further details so that everybody would better understand the issue.
It is a maintenance issue with the Makefiles.
The DESTDIR variable does not matter much because the problem is that it breaks not only the installation but also the compilation itself (prior to the installation) !

Quoted 8 lines

Quoted 2 lines
So, DESTDIR is generally only used during the installation process (what DESTINATION directory shall I write to ?).
That may be true, but we have been using it to perform local builds of the entire source repository for a very long time. In the case of package builds, it doesn't matter because there each component is separately compiled and the package dependencies ensure that the required components are built and installed first.

The above depends on the distribution's build process. We do not know for certain how each present and future distribution is going to build the packages...

Quoted 6 lines

At some distant
point in the past, this approach of using make DESTDIR was introduced as a way to allow us to build the entire tree without requiring us to introduce -I and -L options relative to the current directory, as that was viewed as being more painful to maintain and wrong when built separately (as for packages).

DESTDIR should not be mandatory to use but it is very much desirable. But I do not get the connection with the two compiler flags...

Quoted 12 lines

Quoted 11 lines
The compilation problem being discussed here is twofold: compilation itself (from *.c source code to *.o object code) and linking (from *.o object code to the tool or shared library executable).
So the first side of the problem (compilation stage) is due to the fact that gcc is only allowed to include header files from the system-wide header repository (e.g. -I/usr/include) while unfortunately it is not allowed/configured to try picking up local header files first (as in having -I$(CURDIR)/libselinux/include -I$(CURDIR)/libsepol/include -I $(CURDIR)/libsemanage/include before any eventual system-wide -I/usr/include).

Quoted 3 lines

Build with make DESTDIR=/some/path install, and it should already add -I/some/path/usr/include to your CFLAGS, which will then get picked up before the system headers (as per man gcc and confirmed by experiment).

No, it doesn't currently ! If you want to try reproducing it, then you should do so on a system which hasn't got it already installed (or make sure you get temporarily rid of $(PREFIX)/include/{selinux,sepol,semanage} and $(LIBDIR)/lib{selinux,sepol,semanage}.* first).

Quoted 9 lines

Quoted 6 lines
The second side of the problem (linking stage) is due to a somewhat similar fact that gcc is only allowed to search dynamic (shared) libraries in system-wide repositories (such as -L/usr/lib) while it is not allowed/configured to search the local build directories first (as in having -L$(CURDIR)/libselinux/src -L$(CURDIR)/libsepol/src -L $(CURDIR)/libsemanage/src before any system-wide -L/usr/lib).
Likewise, make DESTDIR=/some/path install will adjust your LDFLAGS correctly.

See above.

And to that add that the actual LDFLAGS possibly introduces an unwanted and potentially dangerous libsepol.a cache !

In fact, somewhere the LDFLAGS currently adds $(LIBDIR)/libsepol.a instead of the local copy of static library libsepol.a. This should be further investigated as it might need to be treated as a security flaw (binaries available from different vendors might be affected if linked against the existing old libsepol.a static library).

Quoted 12 lines

Quoted 6 lines
For reference: the CURDIR variable is expanded by the GNU make tools to the current directory (it is a GNU make functionality). I propose exploiting such variable in the top-level Makefile in order to determine the top-level SELinux-userspace directory and subsequently pass it recursively to lower-level Makefiles (so that it is used in turn as the base for the *local* -I include and -L link compiler/linker flags).
Ok, maybe we didn't know about CURDIR back then or thought it would break separate package builds. I don't recall. I'm not fundamentally opposed to the changes so long as they don't introduce any regressions, but I wanted to be sure that people understand the history.

Quoted 6 lines

Quoted 3 lines
That said, I must admit I do not know much about the history, although it seems to me from the git logs that the problem has been there since the very first git commit.
Yet it has worked for us for quite a long time, via make DESTDIR. If it is broken, it is a recent change that broke it.

I am missing the point again especially because I wasn't able to track it down in git logs.

Regards,

Guido

Guido Trentalancia

author

2011-09-13 18:46 UTC #36 lore raw

Re: [PATCH] Fix includes for userspace tools and libraries (and possible security issue)

To be more precise...

Quoted 65 lines · Guido Trentalancia

Hello Stephen.
Quoted 10 lines · Stephen Smalley
Quoted 9 lines · Guido Trentalancia
But let me just try again pointing out a few further details so that everybody would better understand the issue.
It is a maintenance issue with the Makefiles.
The DESTDIR variable does not matter much because the problem is that it breaks not only the installation but also the compilation itself (prior to the installation) !
Quoted 8 lines
Quoted 2 lines
So, DESTDIR is generally only used during the installation process (what DESTINATION directory shall I write to ?).
That may be true, but we have been using it to perform local builds of the entire source repository for a very long time. In the case of package builds, it doesn't matter because there each component is separately compiled and the package dependencies ensure that the required components are built and installed first.
The above depends on the distribution's build process. We do not know for certain how each present and future distribution is going to build the packages...
Quoted 6 lines
At some distant
point in the past, this approach of using make DESTDIR was introduced as a way to allow us to build the entire tree without requiring us to introduce -I and -L options relative to the current directory, as that was viewed as being more painful to maintain and wrong when built separately (as for packages).
DESTDIR should not be mandatory to use but it is very much desirable. But I do not get the connection with the two compiler flags...
Quoted 12 lines
Quoted 11 lines
The compilation problem being discussed here is twofold: compilation itself (from *.c source code to *.o object code) and linking (from *.o object code to the tool or shared library executable).
So the first side of the problem (compilation stage) is due to the fact that gcc is only allowed to include header files from the system-wide header repository (e.g. -I/usr/include) while unfortunately it is not allowed/configured to try picking up local header files first (as in having -I$(CURDIR)/libselinux/include -I$(CURDIR)/libsepol/include -I $(CURDIR)/libsemanage/include before any eventual system-wide -I/usr/include).
Quoted 3 lines
Build with make DESTDIR=/some/path install, and it should already add -I/some/path/usr/include to your CFLAGS, which will then get picked up before the system headers (as per man gcc and confirmed by experiment).
No, it doesn't currently ! If you want to try reproducing it, then you should do so on a system which hasn't got it already installed (or make sure you get temporarily rid of $(PREFIX)/include/{selinux,sepol,semanage} and $(LIBDIR)/lib{selinux,sepol,semanage}.* first).
Quoted 7 lines
Quoted 6 lines
The second side of the problem (linking stage) is due to a somewhat similar fact that gcc is only allowed to search dynamic (shared) libraries in system-wide repositories (such as -L/usr/lib) while it is not allowed/configured to search the local build directories first (as in having -L$(CURDIR)/libselinux/src -L$(CURDIR)/libsepol/src -L $(CURDIR)/libsemanage/src before any system-wide -L/usr/lib).

Quoted 7 lines

Quoted 2 lines
Likewise, make DESTDIR=/some/path install will adjust your LDFLAGS correctly.
See above.
And to that add that the actual LDFLAGS possibly introduces an unwanted and potentially dangerous libsepol.a cache !

Please read LDLIBS instead of LDFLAGS.

At the least the following objects could be affected: checkpolicy, semodule_deps, mcstransd and the audit2why.so python module. A security notice might be need to be issued if confirmed.

Quoted 22 lines

In fact, somewhere the LDFLAGS currently adds $(LIBDIR)/libsepol.a instead of the local copy of static library libsepol.a. This should be further investigated as it might need to be treated as a security flaw (binaries available from different vendors might be affected if linked against the existing old libsepol.a static library).
Quoted 16 lines
Quoted 6 lines
For reference: the CURDIR variable is expanded by the GNU make tools to the current directory (it is a GNU make functionality). I propose exploiting such variable in the top-level Makefile in order to determine the top-level SELinux-userspace directory and subsequently pass it recursively to lower-level Makefiles (so that it is used in turn as the base for the *local* -I include and -L link compiler/linker flags).
Ok, maybe we didn't know about CURDIR back then or thought it would break separate package builds. I don't recall. I'm not fundamentally opposed to the changes so long as they don't introduce any regressions, but I wanted to be sure that people understand the history.
Quoted 3 lines
That said, I must admit I do not know much about the history, although it seems to me from the git logs that the problem has been there since the very first git commit.

Quoted 5 lines

Quoted 2 lines
Yet it has worked for us for quite a long time, via make DESTDIR. If it is broken, it is a recent change that broke it.
I am missing the point again especially because I wasn't able to track it down in git logs.

Regards,

Guido

Stephen Smalley

2011-09-13 19:17 UTC #37 lore raw

Re: [PATCH] Fix includes for userspace tools and libraries (and possible security issue)

Quoted 16 lines · Guido Trentalancia

To be more precise...
Quoted 2 lines
And to that add that the actual LDFLAGS possibly introduces an unwanted and potentially dangerous libsepol.a cache !
Please read LDLIBS instead of LDFLAGS.
At the least the following objects could be affected: checkpolicy, semodule_deps, mcstransd and the audit2why.so python module. A security notice might be need to be issued if confirmed.
Quoted 5 lines
In fact, somewhere the LDFLAGS currently adds $(LIBDIR)/libsepol.a instead of the local copy of static library libsepol.a. This should be further investigated as it might need to be treated as a security flaw (binaries available from different vendors might be affected if linked against the existing old libsepol.a static library).

If you build with make DESTDIR=~/out > out and then grep libsepol.a out, you'll see that it picks up the locally built one:

$ grep libsepol.a out 
ar rcs libsepol.a hierarchy.o genusers.o roles.o context_record.o port_record.o boolean_record.o interfaces.o assertion.o avtab.o polcaps.o link.o ports.o genbools.o handle.o module.o write.o users.o policydb.o symtab.o policydb_public.o mls.o ebitmap.o user_record.o hashtab.o debug.o util.o conditional.o policydb_convert.o services.o nodes.o sidtab.o iface_record.o context.o expand.o booleans.o constraint.o avrule_block.o node_record.o
ranlib libsepol.a
install -m 644 libsepol.a  /home/sds/out/usr/lib
cc   checkpolicy.o y.tab.o lex.yy.o queue.o module_compiler.o parse_util.o policy_define.o  /home/sds/out/usr/lib/libsepol.a -lfl -o checkpolicy
cc   checkmodule.o y.tab.o lex.yy.o queue.o module_compiler.o parse_util.o policy_define.o  /home/sds/out/usr/lib/libsepol.a -lfl -o checkmodule
cc   dispol.o  -lfl -lsepol -lselinux /home/sds/out/usr/lib/libsepol.a -L/home/sds/out/usr/lib -o dispol
cc   dismod.o  -lfl -lsepol -lselinux /home/sds/out/usr/lib/libsepol.a -L/home/sds/out/usr/lib -o dismod
cc   semodule_deps.o  /home/sds/out/usr/lib/libsepol.a -o semodule_deps

At least with that 16 month old checkout where make DESTDIR=~/out still works.

In any event, the distributions don't build this way; they build libsepol as a separate package and install it first before building the packages that depend on it.

No CVEs filed for libsepol, and it isn't supposed to be a trust boundary.

Nonetheless, I agree that reducing the number of users of the static libsepol would be a good thing. Only checkpolicy (and setools) has a legitimate claim to needing it. The rest ought to be reworked to use new interfaces provided by the shared lib with proper encapsulation of the data structures and implementation details.

Signature · 8 lines

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Stephen Smalley

2011-09-13 18:48 UTC #38 lore raw

Re: [PATCH] Fix includes for userspace tools and libraries (and possible security issue)

In reply to Guido Trentalancia

Quoted 5 lines · Guido Trentalancia

No, it doesn't currently ! If you want to try reproducing it, then you should do so on a system which hasn't got it already installed (or make sure you get temporarily rid of $(PREFIX)/include/{selinux,sepol,semanage} and $(LIBDIR)/lib{selinux,sepol,semanage}.* first).

I know it is presently broken, but not sure exactly when/who broke it. However, as a working example:

$ git clean -fdx
$ rm -rf ~/out
$ git checkout master@{"16 months ago"}
$ make DESTDIR=~/out

works just fine for me.

Signature · 8 lines

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Guido Trentalancia

author

2011-09-13 19:18 UTC #39 lore raw

Re: [PATCH] Fix includes for userspace tools and libraries (and possible security issue)

Hello again.

The security risk associated with the linkage of an old libsepol.a static library is low due to the fact that the tools are usually built from each component separately after all the libraries have been previously built and installed.

Quoted 7 lines · Stephen Smalley

Quoted 5 lines · Guido Trentalancia
No, it doesn't currently ! If you want to try reproducing it, then you should do so on a system which hasn't got it already installed (or make sure you get temporarily rid of $(PREFIX)/include/{selinux,sepol,semanage} and $(LIBDIR)/lib{selinux,sepol,semanage}.* first).

Quoted 8 lines

I know it is presently broken, but not sure exactly when/who broke it. However, as a working example:
$ git clean -fdx
$ rm -rf ~/out
$ git checkout master@{"16 months ago"}
$ make DESTDIR=~/out
works just fine for me.

...
make -C src
make[2]: Entering directory `/usr/src/selinux-userspace/git/selinux-13092011-16monthsago/libselinux/src' cc -Werror -Wall -W -Wundef -Wshadow -Wmissing-noreturn -Wmissing-format-attribute -I../include -I/opt/out/usr/include
-D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -c -o load_policy.o load_policy.c
load_policy.c:14:25: fatal error: sepol/sepol.h: No such file or directory
compilation terminated.
make[2]: *** [load_policy.o] Error 1
make[2]: Leaving directory `/usr/src/selinux-userspace/git/selinux-13092011-16monthsago/libselinux/src' make[1]: *** [all] Error 2
make[1]: Leaving directory `/usr/src/selinux-userspace/git/selinux-13092011-16monthsago/libselinux'
make: *** [all] Error 1

The above is what I get. And there is probably more behind that...

The problem is due to the fact that before "make install" is issued, nothing usually exists under DESTDIR whatever DESTDIR is.

So includes from DESTDIR are getting included but unfortunately they are not there (yet). Until you have temporarily removed DESTDIR, you won't be able to reproduce it.

Regards,

Guido

Stephen Smalley

2011-09-13 19:25 UTC #40 lore raw

Re: [PATCH] Fix includes for userspace tools and libraries (and possible security issue)

Quoted 42 lines · Guido Trentalancia

Hello again.
The security risk associated with the linkage of an old libsepol.a static library is low due to the fact that the tools are usually built from each component separately after all the libraries have been previously built and installed.
Quoted 7 lines · Stephen Smalley
Quoted 5 lines · Guido Trentalancia
No, it doesn't currently ! If you want to try reproducing it, then you should do so on a system which hasn't got it already installed (or make sure you get temporarily rid of $(PREFIX)/include/{selinux,sepol,semanage} and $(LIBDIR)/lib{selinux,sepol,semanage}.* first).
Quoted 8 lines
I know it is presently broken, but not sure exactly when/who broke it. However, as a working example:
$ git clean -fdx
$ rm -rf ~/out
$ git checkout master@{"16 months ago"}
$ make DESTDIR=~/out
works just fine for me.
...
make -C src
make[2]: Entering directory `/usr/src/selinux-userspace/git/selinux-13092011-16monthsago/libselinux/src' cc -Werror -Wall -W -Wundef -Wshadow -Wmissing-noreturn
(quoted diff) +0 -2
-Wmissing-format-attribute -I../include -I/opt/out/usr/include
-D_GNU_SOURCE -D_FILE_OFFSET_BITS=64   -c -o load_policy.o load_policy.c
load_policy.c:14:25: fatal error: sepol/sepol.h: No such file or directory
compilation terminated.
make[2]: *** [load_policy.o] Error 1
make[2]: Leaving directory `/usr/src/selinux-userspace/git/selinux-13092011-16monthsago/libselinux/src' make[1]: *** [all] Error 2
make[1]: Leaving directory `/usr/src/selinux-userspace/git/selinux-13092011-16monthsago/libselinux'
make: *** [all] Error 1

Quoted 8 lines

The above is what I get. And there is probably more behind that...
The problem is due to the fact that before "make install" is issued, nothing usually exists under DESTDIR whatever DESTDIR is.
So includes from DESTDIR are getting included but unfortunately they are not there (yet). Until you have temporarily removed DESTDIR, you won't be able to reproduce it.

I did remove it - look again at my message and see the rm -rf ~/out. I also removed the system headers and libraries via yum. Here we go again:

$ ls ~/out
ls: cannot access /home/sds/out: No such file or directory
$ ls /usr/include/selinux
ls: cannot access /usr/include/selinux: No such file or directory
$ ls /usr/include/sepol
ls: cannot access /usr/include/sepol: No such file or directory
$ make DESTDIR=~/out > out
<completes successfully>
$ ls ~/out/lib/
libselinux.so.1  libsepol.so.1
$ ls ~/out/usr/include/
selinux  semanage  sepol
$ ls ~/out/usr/lib
libselinux.a   libsemanage.a   libsemanage.so.1  libsepol.so  python2.7
libselinux.so  libsemanage.so  libsepol.a        pkgconfig

See, from nothing to a complete build. I can't explain it any more clearly, so I'm stopping this thread here.

Signature · 8 lines

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Stephen Smalley

2011-09-13 19:34 UTC #41 lore raw

Re: [PATCH] Fix includes for userspace tools and libraries (and possible security issue)

Quoted 71 lines · Stephen Smalley

Quoted 42 lines · Guido Trentalancia
Hello again.
The security risk associated with the linkage of an old libsepol.a static library is low due to the fact that the tools are usually built from each component separately after all the libraries have been previously built and installed.
Quoted 7 lines · Stephen Smalley
Quoted 5 lines · Guido Trentalancia
No, it doesn't currently ! If you want to try reproducing it, then you should do so on a system which hasn't got it already installed (or make sure you get temporarily rid of $(PREFIX)/include/{selinux,sepol,semanage} and $(LIBDIR)/lib{selinux,sepol,semanage}.* first).
Quoted 8 lines
I know it is presently broken, but not sure exactly when/who broke it. However, as a working example:
$ git clean -fdx
$ rm -rf ~/out
$ git checkout master@{"16 months ago"}
$ make DESTDIR=~/out
works just fine for me.
...
make -C src
make[2]: Entering directory `/usr/src/selinux-userspace/git/selinux-13092011-16monthsago/libselinux/src' cc -Werror -Wall -W -Wundef -Wshadow -Wmissing-noreturn
(quoted diff) +0 -2
-Wmissing-format-attribute -I../include -I/opt/out/usr/include
-D_GNU_SOURCE -D_FILE_OFFSET_BITS=64   -c -o load_policy.o load_policy.c
load_policy.c:14:25: fatal error: sepol/sepol.h: No such file or directory
compilation terminated.
make[2]: *** [load_policy.o] Error 1
make[2]: Leaving directory `/usr/src/selinux-userspace/git/selinux-13092011-16monthsago/libselinux/src' make[1]: *** [all] Error 2
make[1]: Leaving directory `/usr/src/selinux-userspace/git/selinux-13092011-16monthsago/libselinux'
make: *** [all] Error 1
Quoted 8 lines
The above is what I get. And there is probably more behind that...
The problem is due to the fact that before "make install" is issued, nothing usually exists under DESTDIR whatever DESTDIR is.
So includes from DESTDIR are getting included but unfortunately they are not there (yet). Until you have temporarily removed DESTDIR, you won't be able to reproduce it.
I did remove it - look again at my message and see the rm -rf ~/out. I also removed the system headers and libraries via yum. Here we go again:
$ ls ~/out
ls: cannot access /home/sds/out: No such file or directory
$ ls /usr/include/selinux
ls: cannot access /usr/include/selinux: No such file or directory
$ ls /usr/include/sepol
ls: cannot access /usr/include/sepol: No such file or directory
$ make DESTDIR=~/out > out
<completes successfully>
$ ls ~/out/lib/
libselinux.so.1  libsepol.so.1
$ ls ~/out/usr/include/
selinux  semanage  sepol
$ ls ~/out/usr/lib
libselinux.a   libsemanage.a   libsemanage.so.1  libsepol.so  python2.7
libselinux.so  libsemanage.so  libsepol.a        pkgconfig

Quoted 2 lines

See, from nothing to a complete build. I can't explain it any more clearly, so I'm stopping this thread here.

I suppose the one thing that might not be clear is that the Makefile orders the SUBDIRS in order of dependency, so that we build and install libsepol first, then libselinux, and so on such that the headers and libraries required to build each component are already installed before we build that component. In your case, the sepol headers should have already been installed before trying to build libselinux, and I don't know why that didn't happen for you unless your make reorders SUBDIRS internally or the make install in libsepol failed to complete (but I wouldn't expect it to proceed in that case).

Signature · 8 lines

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Guido Trentalancia

author

2011-09-13 20:04 UTC #42 lore raw

Re: [PATCH] Fix includes for userspace tools and libraries (and possible security issue)

Quoted 16 lines · Stephen Smalley

Quoted 15 lines · Stephen Smalley
Quoted 14 lines · Guido Trentalancia
Hello again.
The security risk associated with the linkage of an old libsepol.a static library is low due to the fact that the tools are usually built from each component separately after all the libraries have been previously built and installed.
Quoted 6 lines · Stephen Smalley
Quoted 5 lines · Guido Trentalancia
No, it doesn't currently ! If you want to try reproducing it, then you should do so on a system which hasn't got it already installed (or make sure you get temporarily rid of $(PREFIX)/include/{selinux,sepol,semanage} and $(LIBDIR)/lib{selinux,sepol,semanage}.* first).

[cut]

Quoted 5 lines

I suppose the one thing that might not be clear is that the Makefile orders the SUBDIRS in order of dependency, so that we build and install libsepol first, then libselinux, and so on such that the headers and libraries required to build each component are already installed before we build that component.

It is up to the maintainer to keep the SUBDIRS variable ordered (according to the dependency relations).

See for example:

http://www.gnu.org/s/hello/manual/make/Phony-Targets.html#Phony-Targets
http://www.gnu.org/s/hello/manual/automake/Subdirectories.html

Quoted 5 lines

In your case, the sepol headers should have
already been installed before trying to build libselinux, and I don't know why that didn't happen for you unless your make reorders SUBDIRS internally or the make install in libsepol failed to complete (but I wouldn't expect it to proceed in that case).

The make tool should not reorder variables in any case.

I did not issue a "make install" (yet). I did just issue "make" from the top-level directory.

I am not building the components separately, I am building the whole bundle (tools + libraries) from the top-level directory of the git version. That's the point.

Regards,

Guido

Stephen Smalley

2011-09-13 20:20 UTC #43 lore raw

Re: [PATCH] Fix includes for userspace tools and libraries (and possible security issue)

Quoted 7 lines · Guido Trentalancia

It is up to the maintainer to keep the SUBDIRS variable ordered (according to the dependency relations).
See for example:
http://www.gnu.org/s/hello/manual/make/Phony-Targets.html#Phony-Targets
http://www.gnu.org/s/hello/manual/automake/Subdirectories.html

Ok, we have ordered SUBDIRS in the Makefile in such a manner that each component is built before anything that depends on it.

Quoted 7 lines

Quoted 5 lines
In your case, the sepol headers should have
already been installed before trying to build libselinux, and I don't know why that didn't happen for you unless your make reorders SUBDIRS internally or the make install in libsepol failed to complete (but I wouldn't expect it to proceed in that case).
The make tool should not reorder variables in any case.

Good.

Quoted 2 lines

I did not issue a "make install" (yet). I did just issue "make" from the top-level directory.

Right, that can't work and never has, which is why 'make' used to invoke 'make install' until Eric (incorrectly) changed that behavior.

Quoted 3 lines

I am not building the components separately, I am building the whole bundle (tools + libraries) from the top-level directory of the git version. That's the point.

Understood, and the only way to do that has always been make DESTDIR=~/out. Reverting/fixing the changes that have broken that behavior is the right solution.

Looking at your last patch, I don't see how it can possibly work in the case where one isn't building the entire source tree (e.g. for package building), because it encodes a relative path to the static libs in LDLIBS.

Signature · 8 lines

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Guido Trentalancia

author

2011-09-13 20:49 UTC #44 lore raw

Re: [PATCH] Fix includes for userspace tools and libraries (and possible security issue)

Quoted 11 lines · Stephen Smalley

Quoted 7 lines · Guido Trentalancia
It is up to the maintainer to keep the SUBDIRS variable ordered (according to the dependency relations).
See for example:
http://www.gnu.org/s/hello/manual/make/Phony-Targets.html#Phony-Targets
http://www.gnu.org/s/hello/manual/automake/Subdirectories.html
Ok, we have ordered SUBDIRS in the Makefile in such a manner that each component is built before anything that depends on it.

Yes, the order looks fine to me.

Could upgrade to phony targets as well (see first document). It would allow parallel builds and also it would prevent it from continuing on failure of a target.

Quoted 8 lines

Quoted 7 lines
Quoted 5 lines
In your case, the sepol headers should have
already been installed before trying to build libselinux, and I don't know why that didn't happen for you unless your make reorders SUBDIRS internally or the make install in libsepol failed to complete (but I wouldn't expect it to proceed in that case).
The make tool should not reorder variables in any case.

Quoted 7 lines

Good.
Quoted 2 lines
I did not issue a "make install" (yet). I did just issue "make" from the top-level directory.
Right, that can't work and never has, which is why 'make' used to invoke 'make install' until Eric (incorrectly) changed that behavior.

"make" should never invoke "make install". It is not desirable that an installation takes place without the user *explictly* requiring it.

However that behavior should be changed for many other reasons, including in particular the possible security risk associated with static linkage of an old libsepol.a.

Quoted 7 lines

Quoted 3 lines
I am not building the components separately, I am building the whole bundle (tools + libraries) from the top-level directory of the git version. That's the point.
Understood, and the only way to do that has always been make DESTDIR=~/out. Reverting/fixing the changes that have broken that behavior is the right solution.

See above and also see latest reply from Eric.

Quoted 4 lines

Looking at your last patch, I don't see how it can possibly work in the case where one isn't building the entire source tree (e.g. for package building), because it encodes a relative path to the static libs in LDLIBS.

If it accidently ends up in the separate packages, it still won't affect their build, because the compiler include/link flag would fall back to the system-wide files.

However, ideally, part of the patch should be reverted prior to creating the release archives for the separate components. As it is, the patch is intended for the whole git bundle (top-level pull).

Regards,

Guido

Eric Paris

2011-09-13 20:26 UTC #45 lore raw

Re: [PATCH] Fix includes for userspace tools and libraries (and possible security issue)

In reply to Guido Trentalancia

Quoted 40 lines · Guido Trentalancia

Quoted 16 lines · Stephen Smalley
Quoted 15 lines · Stephen Smalley
Quoted 14 lines · Guido Trentalancia
Hello again.
The security risk associated with the linkage of an old libsepol.a static library is low due to the fact that the tools are usually built from each component separately after all the libraries have been previously built and installed.
Quoted 6 lines · Stephen Smalley
Quoted 5 lines · Guido Trentalancia
No, it doesn't currently ! If you want to try reproducing it, then you should do so on a system which hasn't got it already installed (or make sure you get temporarily rid of $(PREFIX)/include/{selinux,sepol,semanage} and $(LIBDIR)/lib{selinux,sepol,semanage}.* first).
[cut]
Quoted 5 lines
I suppose the one thing that might not be clear is that the Makefile orders the SUBDIRS in order of dependency, so that we build and install libsepol first, then libselinux, and so on such that the headers and libraries required to build each component are already installed before we build that component.
It is up to the maintainer to keep the SUBDIRS variable ordered (according to the dependency relations).
See for example:
http://www.gnu.org/s/hello/manual/make/Phony-Targets.html#Phony-Targets
http://www.gnu.org/s/hello/manual/automake/Subdirectories.html
Quoted 5 lines
In your case, the sepol headers should have
already been installed before trying to build libselinux, and I don't know why that didn't happen for you unless your make reorders SUBDIRS internally or the make install in libsepol failed to complete (but I wouldn't expect it to proceed in that case).

Quoted 8 lines

The make tool should not reorder variables in any case.
I did not issue a "make install" (yet). I did just issue "make" from the top-level directory.
I am not building the components separately, I am building the whole bundle (tools + libraries) from the top-level directory of the git version. That's the point.

I, recently, applied a patch which changed the top level default from install to all. sds says the 'right' way to build the git tree WAS to call "make DESTDIR=~/out" (Remember the default was to install). Since I changed the default target the new way to build out of the tree is to call "make DESTDIR=~/out install"

I have no plans at this time to revert my commit which changed the default from 'install' to 'all'. It is just flat out totally wrong that cloning the git tree and typing make can break your running system. Period. I agree that we must be certain not to break anyone who decides to still use 'make DESTDIR=~/out install' method. Note: I'm fine that this means I'm forcing sds to use the install target instead of the default target from here out. The old default target was a very bad idea. If you know you need to type DESTDIR= you can also know to type 'install.' If this doesn't work, I need to fix it. (It doesn't work for me, but I'm not certain why just yet)

Personally, I'd like to see just 'make' at the top level dir build properly and I think your patches get us most of the way there without (further) breaking the building method that sds prefers.

If you get your best patch which does nothing but allow us to just type 'make' at the top level dir and it builds everything properly in place, I'll review and probably commit such a patch.

-Eric

Stephen Smalley

2011-09-13 20:42 UTC #46 lore raw

Re: [PATCH] Fix includes for userspace tools and libraries (and possible security issue)

Quoted 67 lines · Eric Paris

Quoted 40 lines · Guido Trentalancia
Quoted 16 lines · Stephen Smalley
Quoted 15 lines · Stephen Smalley
Quoted 14 lines · Guido Trentalancia
Hello again.
The security risk associated with the linkage of an old libsepol.a static library is low due to the fact that the tools are usually built from each component separately after all the libraries have been previously built and installed.
Quoted 6 lines · Stephen Smalley
Quoted 5 lines · Guido Trentalancia
No, it doesn't currently ! If you want to try reproducing it, then you should do so on a system which hasn't got it already installed (or make sure you get temporarily rid of $(PREFIX)/include/{selinux,sepol,semanage} and $(LIBDIR)/lib{selinux,sepol,semanage}.* first).
[cut]
Quoted 5 lines
I suppose the one thing that might not be clear is that the Makefile orders the SUBDIRS in order of dependency, so that we build and install libsepol first, then libselinux, and so on such that the headers and libraries required to build each component are already installed before we build that component.
It is up to the maintainer to keep the SUBDIRS variable ordered (according to the dependency relations).
See for example:
http://www.gnu.org/s/hello/manual/make/Phony-Targets.html#Phony-Targets
http://www.gnu.org/s/hello/manual/automake/Subdirectories.html
Quoted 5 lines
In your case, the sepol headers should have
already been installed before trying to build libselinux, and I don't know why that didn't happen for you unless your make reorders SUBDIRS internally or the make install in libsepol failed to complete (but I wouldn't expect it to proceed in that case).
Quoted 8 lines
The make tool should not reorder variables in any case.
I did not issue a "make install" (yet). I did just issue "make" from the top-level directory.
I am not building the components separately, I am building the whole bundle (tools + libraries) from the top-level directory of the git version. That's the point.
I, recently, applied a patch which changed the top level default from install to all. sds says the 'right' way to build the git tree WAS to call "make DESTDIR=~/out" (Remember the default was to install). Since I changed the default target the new way to build out of the tree is to call "make DESTDIR=~/out install"
I have no plans at this time to revert my commit which changed the default from 'install' to 'all'. It is just flat out totally wrong that cloning the git tree and typing make can break your running system. Period. I agree that we must be certain not to break anyone who decides to still use 'make DESTDIR=~/out install' method. Note: I'm fine that this means I'm forcing sds to use the install target instead of the default target from here out. The old default target was a very bad idea. If you know you need to type DESTDIR= you can also know to type 'install.' If this doesn't work, I need to fix it. (It doesn't work for me, but I'm not certain why just yet)

Quoted 7 lines

Personally, I'd like to see just 'make' at the top level dir build properly and I think your patches get us most of the way there without (further) breaking the building method that sds prefers.
If you get your best patch which does nothing but allow us to just type 'make' at the top level dir and it builds everything properly in place, I'll review and probably commit such a patch.

Be sure to test at least the following scenarios:
1) No sepol/selinux/semanage system headers installed on build host,
2) Old/incompatible sepol/selinux/semanage system headers installed on build host (e.g. f14 build host, latest selinux git tree),
3) Ability to build each component separately without the rest of the source tree, e.g. package rebuilds.

The make DESTDIR=~/out install approach enabled the first two to work without breaking the third, which is why it was attractive. If he can make all three work via another mechanism, then I'm fine with it.

Signature · 8 lines

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Guido Trentalancia

author

2011-09-13 21:09 UTC #47 lore raw

Re: [PATCH] Fix includes for userspace tools and libraries (and possible security issue)

Quoted 10 lines · Stephen Smalley

Quoted 7 lines
Personally, I'd like to see just 'make' at the top level dir build properly and I think your patches get us most of the way there without (further) breaking the building method that sds prefers.
If you get your best patch which does nothing but allow us to just type 'make' at the top level dir and it builds everything properly in place, I'll review and probably commit such a patch.
Be sure to test at least the following scenarios:
1) No sepol/selinux/semanage system headers installed on build host,

I've tested this when creating any of the previous patches. It is important if Eric and/or somebody else could test it again independently.

Quoted 2 lines

2) Old/incompatible sepol/selinux/semanage system headers installed on build host (e.g. f14 build host, latest selinux git tree),

This was the original motivation for creating the patch and as such it has obviously been tested, at least on my system. It is important if Eric and/or somebody else could test it again independently.

Quoted 2 lines

3) Ability to build each component separately without the rest of the source tree, e.g. package rebuilds.

I have never specifically tested this. But it is supposed to work at least until the SUBDIR order is respected.

Quoted 3 lines

The make DESTDIR=~/out install approach enabled the first two to work without breaking the third, which is why it was attractive. If he can make all three work via another mechanism, then I'm fine with it.

After applying the patch, it should be possible to use "make DESTDIR=~/out" to build and "make DESTDIR=~/out install" to install it as a special case of passing special environment variables to the Makefiles.

If previously it was ever possible to build and install at the same time by just using "make DESTDIR=~/out" (i.e. without explicitly requiring the "install" target), it was wrong. It's probably written nowhere specifically, but install at least about a hundred random Linux packages and you will tell me it is wrong !

Note: it is generally preferable to prepend the environment variables to be passed to the make process. If the variables are appended, their value cannot be changed or manipulated by the Makefile(s). Very often the Makefiles need to manipulate (for example, conditional append) the value of some environment variable (for example, CFLAGS).

Regards,

Guido

Guido Trentalancia

author

2011-09-13 22:05 UTC #48 lore raw

Re: [PATCH v4] Fix includes for userspace tools and libraries (and possible security issue)

In reply to Eric Paris

Hello Eric !

Quoted 7 lines · Eric Paris

Personally, I'd like to see just 'make' at the top level dir build properly and I think your patches get us most of the way there without (further) breaking the building method that sds prefers.
If you get your best patch which does nothing but allow us to just type 'make' at the top level dir and it builds everything properly in place, I'll review and probably commit such a patch.

Yes, let's get to the point. The latest version of the patch that you should test is attached below. Please note that it also changes the creation of symbolic links to shared libraries (needs to be double-checked for correctness).

checkpolicy/Makefile +1 -1

diff -pruN selinux/checkpolicy/Makefile selinux-13092011/checkpolicy/Makefile
@@ -19,7 +19,7 @@ CHECKOBJS = y.tab.o lex.yy.o queue.o mod
 CHECKPOLOBJS = $(CHECKOBJS) checkpolicy.o
 CHECKMODOBJS = $(CHECKOBJS) checkmodule.o
 
-LDLIBS=$(LIBDIR)/libsepol.a -lfl
+LDLIBS=../libsepol/src/libsepol.a -L$(LIBDIR) -lfl
 
 GENERATED=lex.yy.c y.tab.c y.tab.h

checkpolicy/test/Makefile +1 -1

diff -pruN selinux/checkpolicy/test/Makefile selinux-13092011/checkpolicy/test/Makefile
@@ -9,7 +9,7 @@ INCLUDEDIR ?= $(PREFIX)/include
 CFLAGS ?= -g -Wall -O2 -pipe
 override CFLAGS += -I$(INCLUDEDIR)
 
-LDLIBS=-lfl -lsepol -lselinux $(LIBDIR)/libsepol.a -L$(LIBDIR)
+LDLIBS=-lsepol -lselinux ../../libsepol/src/libsepol.a -L$(LIBDIR) -lfl
 
 all: dispol dismod

libselinux/src/Makefile +2 -2

diff -pruN selinux/libselinux/src/Makefile selinux-13092011/libselinux/src/Makefile
@@ -102,7 +102,7 @@ $(AUDIT2WHYLOBJ): audit2why.c
 	$(CC) $(filter-out -Werror, $(CFLAGS)) $(PYINC) -fPIC -DSHARED -c -o $@ $<
 
 $(AUDIT2WHYSO): $(AUDIT2WHYLOBJ)
-	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux ${LIBDIR}/libsepol.a -L$(LIBDIR) -Wl,-soname,$@
+	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux ../../libsepol/src/libsepol.a -L$(LIBDIR) -Wl,-soname,$@
 
 %.o:  %.c policy.h
 	$(CC) $(CFLAGS) $(TLSFLAGS) -c -o $@ $<

@@ -126,7 +126,7 @@ install: all
 	install -m 755 $(LIBSO) $(SHLIBDIR)
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
-	cd $(LIBDIR) && ln -sf ../../`basename $(SHLIBDIR)`/$(LIBSO) $(TARGET)
+	cd $(SHLIBDIR) && ln -sf $(LIBSO) $(TARGET)
 
 install-pywrap: pywrap
 	test -d $(PYLIBDIR)/site-packages/selinux || install -m 755 -d $(PYLIBDIR)/site-packages/selinux

libsemanage/src/Makefile +2 -2

diff -pruN selinux/libsemanage/src/Makefile selinux-13092011/libsemanage/src/Makefile
@@ -87,7 +87,7 @@ $(LIBA): $(OBJS)
 	$(RANLIB) $@
 
 $(LIBSO): $(LOBJS)
-	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -lsepol -lselinux -lbz2 -lustr -L$(LIBDIR) -Wl,-soname,$(LIBSO),--version-script=libsemanage.map,-z,defs
+	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -lsepol -lselinux -L$(LIBDIR) -lbz2 -lustr -Wl,-soname,$(LIBSO),--version-script=libsemanage.map,-z,defs
 	ln -sf $@ $(TARGET)
 
 $(LIBPC): $(LIBPC).in

@@ -139,7 +139,7 @@ install: all
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
 	test -f $(DEFAULT_SEMANAGE_CONF_LOCATION) || install -m 644 -D semanage.conf $(DEFAULT_SEMANAGE_CONF_LOCATION)
-	cd $(LIBDIR) && ln -sf $(LIBSO) $(TARGET)
+	cd $(SHLIBDIR) && ln -sf $(LIBSO) $(TARGET)
 
 install-pywrap: pywrap 
 	test -d $(PYLIBDIR)/site-packages || install -m 755 -d $(PYLIBDIR)/site-packages

libsepol/src/Makefile +1 -1

diff -pruN selinux/libsepol/src/Makefile selinux-13092011/libsepol/src/Makefile
@@ -43,7 +43,7 @@ install: all
 	install -m 755 $(LIBSO) $(SHLIBDIR)
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
-	cd $(LIBDIR) && ln -sf ../../`basename $(SHLIBDIR)`/$(LIBSO) $(TARGET)
+	cd $(SHLIBDIR) && ln -sf $(LIBSO) $(TARGET)
 
 relabel:
 	/sbin/restorecon $(SHLIBDIR)/$(LIBSO)

Makefile +7 -2

diff -pruN selinux/Makefile selinux-13092011/Makefile
@@ -3,10 +3,15 @@ PYSUBDIRS=libselinux libsemanage
 DISTCLEANSUBIDRS=libselinux libsemanage
 
 ifeq ($(DEBUG),1)
-	export CFLAGS = -g3 -O0 -gdwarf-2 -fno-strict-aliasing -Wall -Wshadow -Werror
-	export LDFLAGS = -g
+	CFLAGS += -g3 -O0 -gdwarf-2 -fno-strict-aliasing -Wall -Wshadow -Werror
+	LDFLAGS += -g
 endif
 
+CFLAGS += -I$(CURDIR)/libselinux/include -I$(CURDIR)/libsepol/include -I$(CURDIR)/libsemanage/include
+LDFLAGS += -L$(CURDIR)/libselinux/src -L$(CURDIR)/libsepol/src -L$(CURDIR)/libsemanage/src
+export CFLAGS
+export LDFLAGS
+
 all install relabel clean test indent:
 	@for subdir in $(SUBDIRS); do \
 		(cd $$subdir && $(MAKE) $@) || exit 1; \

policycoreutils/audit2allow/Makefile +2 -2

diff -pruN selinux/policycoreutils/audit2allow/Makefile selinux-13092011/policycoreutils/audit2allow/Makefile
@@ -1,9 +1,9 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 BINDIR ?= $(PREFIX)/bin
 LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 
 all: ;

policycoreutils/audit2why/Makefile +1 -1

diff -pruN selinux/policycoreutils/audit2why/Makefile selinux-13092011/policycoreutils/audit2why/Makefile
@@ -1,5 +1,5 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 BINDIR ?= $(PREFIX)/bin
 MANDIR ?= $(PREFIX)/share/man

policycoreutils/load_policy/Makefile +6 -4

diff -pruN selinux/policycoreutils/load_policy/Makefile selinux-13092011/policycoreutils/load_policy/Makefile
@@ -1,13 +1,15 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(DESTDIR)/sbin
 USRSBINDIR ?= $(PREFIX)/sbin
+INCLUDEDIR ?= $(PREFIX)/include
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lsepol -lselinux -L$(PREFIX)/lib
+override CFLAGS += $(LDFLAGS) -I$(INCLUDEDIR) -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+LDLIBS += -lsepol -lselinux -L$(LIBDIR)
 
 TARGETS=$(patsubst %.c,%,$(wildcard *.c))

policycoreutils/mcstrans/src/Makefile +1 -1

diff -pruN selinux/policycoreutils/mcstrans/src/Makefile selinux-13092011/policycoreutils/mcstrans/src/Makefile
@@ -28,7 +28,7 @@ override CFLAGS += -I../include -D_GNU_S
 all: $(PROG)
 
 $(PROG): $(PROG_OBJS)
-	$(CC) $(LDFLAGS) -pie -o $@ $^ -lselinux -lcap -lpcre $(LIBDIR)/libsepol.a
+	$(CC) $(LDFLAGS) -pie -o $@ $^ -lselinux ../../../libsepol/src/libsepol.a -L$(LIBDIR) -lcap -lpcre
 
 %.o:  %.c 
 	$(CC) $(CFLAGS) -fPIE -c -o $@ $<

policycoreutils/mcstrans/utils/Makefile +1 -1

diff -pruN selinux/policycoreutils/mcstrans/utils/Makefile selinux-13092011/policycoreutils/mcstrans/utils/Makefile
@@ -21,7 +21,7 @@ endif
 
 CFLAGS ?= -Wall
 override CFLAGS += -I../src -D_GNU_SOURCE
-LDLIBS += -L../src ../src/mcstrans.o ../src/mls_level.o -lselinux -lpcre $(LIBDIR)/libsepol.a
+LDLIBS += -L../src ../src/mcstrans.o ../src/mls_level.o -lselinux -lpcre ../../../libsepol/src/libsepol.a
 
 TARGETS=$(patsubst %.c,%,$(wildcard *.c))

policycoreutils/newrole/Makefile +6 -4

diff -pruN selinux/policycoreutils/newrole/Makefile selinux-13092011/policycoreutils/newrole/Makefile
@@ -1,9 +1,11 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 BINDIR ?= $(PREFIX)/bin
 MANDIR ?= $(PREFIX)/share/man
+INCLUDEDIR ?= $(PREFIX)/include
+LIBDIR ?= $(PREFIX)/lib
 ETCDIR ?= $(DESTDIR)/etc
-LOCALEDIR = /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 PAMH = $(shell ls /usr/include/security/pam_appl.h 2>/dev/null)
 AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null)
 # Enable capabilities to permit newrole to generate audit records.

@@ -22,8 +24,8 @@ VERSION = $(shell cat ../VERSION)
 
 CFLAGS ?= -Werror -Wall -W
 EXTRA_OBJS =
-override CFLAGS += -DVERSION=\"$(VERSION)\" $(LDFLAGS) -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lselinux -L$(PREFIX)/lib
+override CFLAGS += -DVERSION=\"$(VERSION)\" $(LDFLAGS) -I$(INCLUDEDIR) -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+LDLIBS += -lselinux -L$(LIBDIR)
 ifeq (${PAMH}, /usr/include/security/pam_appl.h)
 	override CFLAGS += -DUSE_PAM
 	EXTRA_OBJS += hashtab.o

policycoreutils/restorecond/Makefile +7 -6

diff -pruN selinux/policycoreutils/restorecond/Makefile selinux-13092011/policycoreutils/restorecond/Makefile
@@ -1,13 +1,14 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
-INITDIR = $(DESTDIR)/etc/rc.d/init.d
-SELINUXDIR = $(DESTDIR)/etc/selinux
+INCLUDEDIR ?= $(PREFIX)/include
+MANDIR ?= $(PREFIX)/share/man
+INITDIR ?= $(DESTDIR)/etc/rc.d/init.d
+SELINUXDIR ?= $(DESTDIR)/etc/selinux
 
 CFLAGS ?= -g -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64
-LDLIBS += -lselinux -L$(PREFIX)/lib
+override CFLAGS += -I$(INCLUDEDIR) -D_FILE_OFFSET_BITS=64
+LDLIBS += -lselinux -L$(LIBDIR)
 
 all: restorecond

policycoreutils/run_init/Makefile +6 -5

diff -pruN selinux/policycoreutils/run_init/Makefile selinux-13092011/policycoreutils/run_init/Makefile
@@ -1,16 +1,17 @@
-
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(PREFIX)/sbin
+INCLUDEDIR ?= $(PREFIX)/include
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
 ETCDIR ?= $(DESTDIR)/etc
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 PAMH = $(shell ls /usr/include/security/pam_appl.h 2>/dev/null)
 AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null)
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lselinux -L$(PREFIX)/lib
+override CFLAGS += -I$(INCLUDEDIR) -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+LDLIBS += -lselinux -L$(LIBDIR)
 ifeq (${PAMH}, /usr/include/security/pam_appl.h)
 	override CFLAGS += -DUSE_PAM
 	LDLIBS += -lpam -lpam_misc

policycoreutils/sandbox/Makefile +8 -6

diff -pruN selinux/policycoreutils/sandbox/Makefile selinux-13092011/policycoreutils/sandbox/Makefile
@@ -1,14 +1,16 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
-INITDIR ?= ${DESTDIR}/etc/rc.d/init.d/
-SYSCONFDIR ?= ${DESTDIR}/etc/sysconfig
+PREFIX ?= $(DESTDIR)/usr
+INITDIR ?= $(DESTDIR)/etc/rc.d/init.d/
+SYSCONFDIR ?= $(DESTDIR)/etc/sysconfig
 BINDIR ?= $(PREFIX)/bin
 SBINDIR ?= $(PREFIX)/sbin
+INCLUDEDIR ?= $(PREFIX)/include
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 SHAREDIR ?= $(PREFIX)/share/sandbox
-override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lselinux -lcap-ng 
+override CFLAGS += $(LDFLAGS) -I$(INCLUDEDIR) -DPACKAGE="\"policycoreutils\""
+LDLIBS += -lselinux -L$(LIBDIR) -lcap-ng
 
 all: sandbox seunshare sandboxX.sh start

policycoreutils/scripts/Makefile +6 -3

diff -pruN selinux/policycoreutils/scripts/Makefile selinux-13092011/policycoreutils/scripts/Makefile
@@ -1,9 +1,9 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 BINDIR ?= $(PREFIX)/bin
 SBINDIR ?= $(PREFIX)/sbin
 MANDIR ?= $(PREFIX)/share/man
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 
 all: fixfiles genhomedircon chcat

@@ -11,7 +11,10 @@ install: all
 	-mkdir -p $(BINDIR)
 	install -m 755 chcat $(BINDIR)
 	install -m 755 fixfiles $(DESTDIR)/sbin
-	install -m 755 genhomedircon  $(SBINDIR)
+	@echo "#!/bin/sh" > genhomedircon
+	@echo >> genhomedircon
+	@echo "$(SBINDIR)/semodule -Bn" >> genhomedircon
+	install -m 755 genhomedircon $(SBINDIR)
 	-mkdir -p $(MANDIR)/man8
 	install -m 644 fixfiles.8 $(MANDIR)/man8/
 	install -m 644 genhomedircon.8 $(MANDIR)/man8/

policycoreutils/secon/Makefile +2 -2

diff -pruN selinux/policycoreutils/secon/Makefile selinux-13092011/policycoreutils/secon/Makefile
@@ -1,9 +1,9 @@
 # secon tool - command-line context
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
 MANDIR ?= $(PREFIX)/share/man
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 
 WARNS=-Werror -W -Wall -Wundef -Wshadow -Wpointer-arith -Wbad-function-cast -Wcast-align -Wwrite-strings -Waggregate-return -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -Wno-format-zero-length -Wformat-nonliteral -Wformat-security -Wfloat-equal
 VERSION = $(shell cat ../VERSION)

policycoreutils/semanage/Makefile +2 -2

diff -pruN selinux/policycoreutils/semanage/Makefile selinux-13092011/policycoreutils/semanage/Makefile
@@ -1,8 +1,8 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 LIBDIR ?= $(PREFIX)/lib
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
+MANDIR ?= $(PREFIX)/share/man
 PYLIBVER ?= $(shell python -c 'import sys;print "python%d.%d" % sys.version_info[0:2]')
 PYTHONLIBDIR ?= $(LIBDIR)/$(PYLIBVER)

policycoreutils/semodule/Makefile +2 -2

diff -pruN selinux/policycoreutils/semodule/Makefile selinux-13092011/policycoreutils/semodule/Makefile
@@ -2,8 +2,8 @@
 PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
-LIBDIR ?= ${PREFIX}/lib
+MANDIR ?= $(PREFIX)/share/man
+LIBDIR ?= $(PREFIX)/lib
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += -I$(INCLUDEDIR)

policycoreutils/semodule_deps/Makefile +3 -3

diff -pruN selinux/policycoreutils/semodule_deps/Makefile selinux-13092011/policycoreutils/semodule_deps/Makefile
@@ -1,13 +1,13 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += -I$(INCLUDEDIR)
-LDLIBS = $(LIBDIR)/libsepol.a
+LDLIBS = ../../libsepol/src/libsepol.a
 
 all: semodule_deps

policycoreutils/semodule_expand/Makefile +2 -2

diff -pruN selinux/policycoreutils/semodule_expand/Makefile selinux-13092011/policycoreutils/semodule_expand/Makefile
@@ -1,8 +1,8 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
 
 CFLAGS ?= -Werror -Wall -W

policycoreutils/semodule_link/Makefile +2 -2

diff -pruN selinux/policycoreutils/semodule_link/Makefile selinux-13092011/policycoreutils/semodule_link/Makefile
@@ -1,9 +1,9 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
 MANDIR ?= $(PREFIX)/share/man
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += -I$(INCLUDEDIR)

policycoreutils/semodule_package/Makefile +2 -2

diff -pruN selinux/policycoreutils/semodule_package/Makefile selinux-13092011/policycoreutils/semodule_package/Makefile
@@ -1,8 +1,8 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
 
 CFLAGS ?= -Werror -Wall -W

policycoreutils/sestatus/Makefile +6 -5

diff -pruN selinux/policycoreutils/sestatus/Makefile selinux-13092011/policycoreutils/sestatus/Makefile
@@ -1,12 +1,13 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
+INCLUDEDIR ?= $(PREFIX)/include
+MANDIR ?= $(PREFIX)/share/man
 ETCDIR ?= $(DESTDIR)/etc
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 
-CFLAGS = -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64
+CFLAGS ?= -Werror -Wall -W
+override CFLAGS += -I$(INCLUDEDIR) -D_FILE_OFFSET_BITS=64
 LDLIBS = -lselinux -L$(LIBDIR)
 
 all: sestatus

policycoreutils/setfiles/Makefile +5 -4

diff -pruN selinux/policycoreutils/setfiles/Makefile selinux-13092011/policycoreutils/setfiles/Makefile
@@ -1,12 +1,13 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(DESTDIR)/sbin
-MANDIR = $(PREFIX)/share/man
+INCLUDEDIR ?= $(PREFIX)/include
+MANDIR ?= $(PREFIX)/share/man
 LIBDIR ?= $(PREFIX)/lib
 AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null)
 
-CFLAGS = -g -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include
+CFLAGS ?= -g -Werror -Wall -W
+override CFLAGS += -I$(INCLUDEDIR)
 LDLIBS = -lselinux -lsepol -L$(LIBDIR)
 
 ifeq (${AUDITH}, /usr/include/libaudit.h)

policycoreutils/setsebool/Makefile +2 -2

diff -pruN selinux/policycoreutils/setsebool/Makefile selinux-13092011/policycoreutils/setsebool/Makefile
@@ -2,8 +2,8 @@
 PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
-LIBDIR ?= ${PREFIX}/lib
+MANDIR ?= $(PREFIX)/share/man
+LIBDIR ?= $(PREFIX)/lib
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += -I$(INCLUDEDIR)

README +20 -0

diff -pruN selinux/README selinux-13092011/README
@@ -0,0 +1,20 @@
+INSTALLATION:
+
+Type "make" to build and then "make install" to install.
+
+---
+
+The environment variables CFLAGS and LDFLAGS can be passed to "make" to use custom compiler
+and/or linker flags (for example: CFLAGS="-O3" LDFLAGS="" make).
+
+The environment variables LIBDIR and SHLIBDIR can be passed to "make" in order to configure
+different directories for the libraries (e.g. LIBDIR=/usr/lib64 and SHLIBDIR=/usr/lib64
+on 64-bit systems).
+
+The environment variable PREFIX can be passed to "make" in order to configure an install
+prefix other than "/usr".
+
+The environment variable DESTDIR can be passed to "make" in order to configure a
+specific directory to be used as the root installation directory.
+
+Please see the Makefile(s) for other environment variables that can be used.

To the above you could also add the following bits in order to improve the manual page of genhomedircon:

policycoreutils/scripts/genhomedircon.8 +12 ~~-28~~

diff -pruN selinux/policycoreutils/scripts/genhomedircon.8 selinux-13092011/policycoreutils/scripts/genhomedircon.8
@@ -1,37 +1,21 @@
-.\" Hey, Emacs! This is an -*- nroff -*- source file.
-.\" Copyright (c) 2010 Dan Walsh <[email protected]>
-.\"
-.\" This is free documentation; you can redistribute it and/or
-.\" modify it under the terms of the GNU General Public License as
-.\" published by the Free Software Foundation; either version 2 of
-.\" the License, or (at your option) any later version.
-.\"
-.\" The GNU General Public License's references to "object code"
-.\" and "executables" are to be interpreted as the output of any
-.\" document formatting or typesetting system, including
-.\" intermediate and printed output.
-.\"
-.\" This manual is distributed in the hope that it will be useful,
-.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
-.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-.\" GNU General Public License for more details.
-.\"
-.\" You should have received a copy of the GNU General Public
-.\" License along with this manual; if not, write to the Free
-.\" Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139,
-.\" USA.
-.\"
-.\"
-.TH GENHOMEDIRCON "8" "May 2010" "Security Enhanced Linux" "SELinux"
+.TH GENHOMEDIRCON "8" "Sep 2011" "Security Enhanced Linux" "SELinux"
 .SH NAME
 genhomedircon \- generate SELinux file context configuration entries for user home directories
 .SH SYNOPSIS
 .B genhomedircon
-is a script that executes semodule to rebuild policy and create the
-labels for HOMEDIRS based on home directories returned by the getpw calls.
+is a script that executes
+.B semodule
+to rebuild the SELinux policy and to create the
+labels for each user home directory based on directory paths returned by calls to getpwent().
 
-This functionality is enabled via the usepasswd flag in /etc/selinux/semanage.conf.
+This functionality can be disabled by using the "usepasswd" flag in /etc/selinux/semanage.conf
+(such flag can either take the value "true" or "false" and by default it is set to "true").
 
 .SH AUTHOR
 This manual page was written by
 .I Dan Walsh <[email protected]>
+
+The supporting functionality in the semanage library was written by Tresys Technology.
+
+.SH "SEE ALSO"
+semodule(8), getpwent(3), getpwent_r(3)

And after that you could then review and eventually commit the patch for the new semanage.conf(5) manual page (separate thread). The good thing about this last one is that it does not need testing !

Regards,

Guido

Guido Trentalancia

author

2011-09-13 23:33 UTC #49 lore raw

PATCH 1/1 Fix function arguments in libsemanage tests (was Re: [PATCH v4] Fix includes for userspace tools and libraries)

Another possible improvement could be as follows (libsemanag):

Fix a few calls to semanage_store_access_check() in the libsemanage tests so that a void function is called.

libsemanage/tests/test_semanage_store.c +9 -9

@@ -163,7 +163,7 @@ void test_semanage_store_access_check(vo
 	err = chmod(polpath, 0);
 	CU_ASSERT(err == 0);
 
-	err = semanage_store_access_check(sh);
+	err = semanage_store_access_check();
 	CU_ASSERT(err == -1);
 
 	/* check with permissions 500 */

@@ -174,7 +174,7 @@ void test_semanage_store_access_check(vo
 	err = chmod(modpath, S_IRUSR | S_IXUSR);
 	CU_ASSERT(err == 0);
 
-	err = semanage_store_access_check(sh);
+	err = semanage_store_access_check();
 	CU_ASSERT(err == SEMANAGE_CAN_READ);
 
 	/* check with permissions 700 */

@@ -185,7 +185,7 @@ void test_semanage_store_access_check(vo
 	err = chmod(modpath, S_IRUSR | S_IWUSR | S_IXUSR);
 	CU_ASSERT(err == 0);
 
-	err = semanage_store_access_check(sh);
+	err = semanage_store_access_check();
 	CU_ASSERT(err == SEMANAGE_CAN_WRITE);
 
 	/* check with lock file 000 and others 500 */

@@ -196,7 +196,7 @@ void test_semanage_store_access_check(vo
 	err = chmod(modpath, S_IRUSR | S_IXUSR);
 	CU_ASSERT(err == 0);
 
-	err = semanage_store_access_check(sh);
+	err = semanage_store_access_check();
 	CU_ASSERT(err == 0);
 
 	/* check with lock file 000 and others 700 */

@@ -207,7 +207,7 @@ void test_semanage_store_access_check(vo
 	err = chmod(modpath, S_IRUSR | S_IWUSR | S_IXUSR);
 	CU_ASSERT(err == 0);
 
-	err = semanage_store_access_check(sh);
+	err = semanage_store_access_check();
 	CU_ASSERT(err == 0);
 
 	/* remove lock file */

@@ -222,7 +222,7 @@ void test_semanage_store_access_check(vo
 	err = chmod(polpath, 0);
 	CU_ASSERT(err == 0);
 
-	err = semanage_store_access_check(sh);
+	err = semanage_store_access_check();
 	CU_ASSERT(err == -1);
 
 	/* check with no lock file and 500 */

@@ -233,14 +233,14 @@ void test_semanage_store_access_check(vo
 	err = chmod(modpath, S_IRUSR | S_IXUSR);
 	CU_ASSERT(err == 0);
 
-	err = semanage_store_access_check(sh);
+	err = semanage_store_access_check();
 	CU_ASSERT(err == 0);
 
 	/* check with no lock file but write in lockpath */
 	err = chmod(lockpath, S_IRUSR | S_IWUSR | S_IXUSR);
 	CU_ASSERT(err == 0);
 
-	err = semanage_store_access_check(sh);
+	err = semanage_store_access_check();
 	CU_ASSERT(err == SEMANAGE_CAN_READ);
 
 	/* check with no lock file and 700 */

@@ -249,7 +249,7 @@ void test_semanage_store_access_check(vo
 	err = chmod(modpath, S_IRUSR | S_IWUSR | S_IXUSR);
 	CU_ASSERT(err == 0);
 
-	err = semanage_store_access_check(sh);
+	err = semanage_store_access_check();
 	CU_ASSERT(err == SEMANAGE_CAN_WRITE);
 }

Guido Trentalancia

author

2011-09-14 00:44 UTC #50 lore raw

PATCH 1/1 Change default make target for sepolgen (was Re: [PATCH v4] Fix includes for userspace tools and libraries)

And for the reason mentioned earlier (do not install unless explicitly required to do so):

Change the default "make" target for sepolgen from "install" to "all".

sepolgen/src/sepolgen/Makefile +3 -1

@@ -1,7 +1,9 @@
 PYTHONLIBDIR ?= $(shell  python -c "from distutils.sysconfig import *; print get_python_lib(1)")
 PACKAGEDIR ?= $(DESTDIR)/$(PYTHONLIBDIR)/sepolgen
 
-install:
+all:
+
+install: all
 	-mkdir -p $(PACKAGEDIR)
 	install -m 644 *.py $(PACKAGEDIR)

sepolgen/src/share/Makefile +3 -1

@@ -1,8 +1,10 @@
 SHAREDIR ?= $(DESTDIR)/var/lib/sepolgen
 
-install:
+all:
+
+install: all
 	-mkdir -p $(SHAREDIR)
 	install -m 644 perm_map $(SHAREDIR)
 
 clean:

Regards,

Guido

Guido Trentalancia

author

2011-09-14 01:10 UTC #51 lore raw

PATCH 1/1 Change default make target for some directories in the libraries (was Re: [PATCH] Change default make target for sepolgen)

And similarly for the "include" and "man" directories available for the libraries:

Change the default "make" target for the libraries from "install" to "all" in *all* makefiles.

libselinux/include/Makefile +2 -0

@@ -2,6 +2,8 @@
 PREFIX ?= $(DESTDIR)/usr
 INCDIR ?= $(PREFIX)/include/selinux
 
+all:
+
 install:
 	test -d $(INCDIR) || install -m 755 -d $(INCDIR)
 	install -m 644 $(wildcard selinux/*.h) $(INCDIR)

libsepol/include/Makefile +2 -0

@@ -2,6 +2,8 @@
 PREFIX ?= $(DESTDIR)/usr
 INCDIR ?= $(PREFIX)/include/sepol
 
+all:
+
 install:
 	test -d $(INCDIR) || install -m 755 -d $(INCDIR)
 	test -d $(INCDIR)/policydb || install -m 755 -d $(INCDIR)/policydb

libsemanage/include/Makefile +2 -0

@@ -2,6 +2,8 @@
 PREFIX ?= $(DESTDIR)/usr
 INCDIR ?= $(PREFIX)/include/semanage
 
+all:
+
 install:
 	test -d $(INCDIR) || install -m 755 -d $(INCDIR)
 	install -m 644 $(wildcard semanage/*.h) $(INCDIR)

libselinux/man/Makefile +2 -0

@@ -4,6 +4,8 @@ MAN3DIR ?= $(PREFIX)/share/man/man3
 MAN5DIR ?= $(PREFIX)/share/man/man5
 MAN8DIR ?= $(PREFIX)/share/man/man8
 
+all:
+
 install:
 	mkdir -p $(MAN3DIR)
 	mkdir -p $(MAN5DIR)

libsepol/man/Makefile +2 -0

@@ -3,6 +3,8 @@ PREFIX ?= $(DESTDIR)/usr
 MAN3DIR ?= $(PREFIX)/share/man/man3
 MAN8DIR ?= $(PREFIX)/share/man/man8
 
+all:
+
 install:
 	mkdir -p $(MAN3DIR)
 	mkdir -p $(MAN8DIR)

libsemanage/man/Makefile +2 -0

@@ -3,6 +3,8 @@ PREFIX ?= $(DESTDIR)/usr
 MAN3DIR ?= $(PREFIX)/share/man/man3
 MAN5DIR ?= $(PREFIX)/share/man/man5
 
+all:
+
 install:
 	mkdir -p $(MAN3DIR)
 	mkdir -p $(MAN5DIR)

Quoted 34 lines · Guido Trentalancia

And for the reason mentioned earlier (do not install unless explicitly required to do so):
Change the default "make" target for sepolgen from "install" to "all".
sepolgen/src/sepolgen/Makefile +3 -1
@@ -1,7 +1,9 @@
 PYTHONLIBDIR ?= $(shell  python -c "from distutils.sysconfig import *; print get_python_lib(1)")
 PACKAGEDIR ?= $(DESTDIR)/$(PYTHONLIBDIR)/sepolgen
 
-install:
+all:
+
+install: all
 	-mkdir -p $(PACKAGEDIR)
 	install -m 644 *.py $(PACKAGEDIR)
 
sepolgen/src/share/Makefile +3 -1
@@ -1,8 +1,10 @@
 SHAREDIR ?= $(DESTDIR)/var/lib/sepolgen
 
-install:
+all:
+
+install: all
 	-mkdir -p $(SHAREDIR)
 	install -m 644 perm_map $(SHAREDIR)
 
 clean:
 
Regards,

Quoted 8 lines

Guido
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

Guido Trentalancia

author

2011-09-14 01:20 UTC #52 lore raw

PATCH 1/1 Change default make target for the man directory of policycoreutils/mcstrans (was Re: [PATCH] Change default make target for sepolgen)

For the sake of completeness, also fix the same issue in policycoreutils (for the currently-disabled target mcstrans):

policycoreutils/mcstrans/man/Makefile +2 -0

@@ -1,6 +1,8 @@
 # Installation directories.
 MAN8DIR ?= $(DESTDIR)/usr/share/man/man8
 
+all:
+
 install:
 	mkdir -p $(MAN8DIR)
 	install -m 644 man8/*.8 $(MAN8DIR)

Quoted 111 lines · Guido Trentalancia

And similarly for the "include" and "man" directories available for the libraries:

Change the default "make" target for the libraries from "install" to "all" in *all* makefiles.

libselinux/include/Makefile +2 -0

@@ -2,6 +2,8 @@
 PREFIX ?= $(DESTDIR)/usr
 INCDIR ?= $(PREFIX)/include/selinux
 
+all:
+
 install:
 	test -d $(INCDIR) || install -m 755 -d $(INCDIR)
 	install -m 644 $(wildcard selinux/*.h) $(INCDIR)

libsepol/include/Makefile +2 -0

@@ -2,6 +2,8 @@
 PREFIX ?= $(DESTDIR)/usr
 INCDIR ?= $(PREFIX)/include/sepol
 
+all:
+
 install:
 	test -d $(INCDIR) || install -m 755 -d $(INCDIR)
 	test -d $(INCDIR)/policydb || install -m 755 -d $(INCDIR)/policydb

libsemanage/include/Makefile +2 -0

@@ -2,6 +2,8 @@
 PREFIX ?= $(DESTDIR)/usr
 INCDIR ?= $(PREFIX)/include/semanage
 
+all:
+
 install:
 	test -d $(INCDIR) || install -m 755 -d $(INCDIR)
 	install -m 644 $(wildcard semanage/*.h) $(INCDIR)

libselinux/man/Makefile +2 -0

@@ -4,6 +4,8 @@ MAN3DIR ?= $(PREFIX)/share/man/man3
 MAN5DIR ?= $(PREFIX)/share/man/man5
 MAN8DIR ?= $(PREFIX)/share/man/man8
 
+all:
+
 install:
 	mkdir -p $(MAN3DIR)
 	mkdir -p $(MAN5DIR)

libsepol/man/Makefile +2 -0

@@ -3,6 +3,8 @@ PREFIX ?= $(DESTDIR)/usr
 MAN3DIR ?= $(PREFIX)/share/man/man3
 MAN8DIR ?= $(PREFIX)/share/man/man8
 
+all:
+
 install:
 	mkdir -p $(MAN3DIR)
 	mkdir -p $(MAN8DIR)

libsemanage/man/Makefile +2 -0

@@ -3,6 +3,8 @@ PREFIX ?= $(DESTDIR)/usr
 MAN3DIR ?= $(PREFIX)/share/man/man3
 MAN5DIR ?= $(PREFIX)/share/man/man5
 
+all:
+
 install:
 	mkdir -p $(MAN3DIR)
 	mkdir -p $(MAN5DIR)

Quoted 37 lines · Guido Trentalancia

And for the reason mentioned earlier (do not install unless explicitly required to do so):
Change the default "make" target for sepolgen from "install" to "all".
sepolgen/src/sepolgen/Makefile +3 -1
@@ -1,7 +1,9 @@
 PYTHONLIBDIR ?= $(shell  python -c "from distutils.sysconfig import *; print get_python_lib(1)")
 PACKAGEDIR ?= $(DESTDIR)/$(PYTHONLIBDIR)/sepolgen
 
-install:
+all:
+
+install: all
 	-mkdir -p $(PACKAGEDIR)
 	install -m 644 *.py $(PACKAGEDIR)
 
sepolgen/src/share/Makefile +3 -1
@@ -1,8 +1,10 @@
 SHAREDIR ?= $(DESTDIR)/var/lib/sepolgen
 
-install:
+all:
+
+install: all
 	-mkdir -p $(SHAREDIR)
 	install -m 644 perm_map $(SHAREDIR)
 
 clean:
 
Regards,
Guido

Quoted 13 lines

Quoted 5 lines
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

Eric Paris

2011-09-14 19:17 UTC #53 lore raw

Re: [PATCH] Change default make target for sepolgen (was Re: [PATCH v4] Fix includes for userspace tools and libraries)

In reply to Guido Trentalancia

Quoted 4 lines · Guido Trentalancia

And for the reason mentioned earlier (do not install unless explicitly required to do so):
Change the default "make" target for sepolgen from "install" to "all".

I've squashed them together and then added a version of these 3 patches to my devel tree. Thank you!

-Eric

Eric Paris

2011-09-14 19:31 UTC #54 lore raw

Re: [PATCH] Fix function arguments in libsemanage tests (was Re: [PATCH v4] Fix includes for userspace tools and libraries)

In reply to Guido Trentalancia

Quoted 4 lines · Guido Trentalancia

Another possible improvement could be as follows (libsemanag):
Fix a few calls to semanage_store_access_check() in the libsemanage tests so that a void function is called.

Please in the future include a line which looks something like the following at the end of the comments with all patches you wish to have committed:

Signed-off-by Guido Trentalancia <[email protected]>

The purpose of this line is to indicate that you have the rights to contribute this code to the project and that you agree to license the code according to the license(s) of the file(s) that the patch will be applied to.

I prefer patches in the format like the linux kernel:
https://github.com/torvalds/linux/blob/master/Documentation/SubmittingPatches

Basically that entails the subject line of the e-mail is the short description of the patch (nothing extra except inside the [])

The body should be a complete description of what change you made and in particular why. You should mention testing and things like that as well.

The signed-off-by line.
The last line of the changelog should be just --- (at the beginning of the line)

After the --- line include the patch.

thanks so much!

-Eric

Guido Trentalancia

author

2011-09-15 04:41 UTC #55 lore raw

PATCH v5 1/1 Fix makefiles for the userspace tools and libraries

Hello Eric,

you are right about the signature and about conforming to the official patch style and guidelines. I just wanted to discuss things first.

There are still at least two issues that need to be further discussed:

- link creation to versioned shared libraries executables (directory SHLIBDIR versus LIBDIR and relative versus absolute linking so that it does not break distribution build scripts and resulting packages);
- creation of individual released components getting broken because a few SELinux static libraries are now linked in from local sources instead of from existing system-wide versions.

I can sign and repost the whole thing, but I have now removed the diff relative to the symbolic link creation:

***

This is a maintenance patch for further testing. It potentially replaces any other patch previously posted in this same and/or other recent threads.

Create a top-level README file which is intended to provide a few details about some of the possible environment variables that can be configured and passed to the make tool.

Do not hard-code the path to semodule in the genhomedircon script but rather generate it each time by using PREFIX. Improve the manual page for genhomedircon.

Replace curly brackets with parentheses for some variables such as DESTDIR and PREFIX in the Makefiles. Add and make use of LIBDIR and INCLUDEDIR where appropriate within the Makefiles. Make use of PREFIX for determining the value of LOCALEDIR within some of the Makefiles. Do not override the environment variables passed from the command-line for some of the Makefiles.

Change the default target for *all* Makefiles (even the "hidden" ones) to "all" from "install", as we cannot install anything without the user *explicitly* requiring it.

This patch no longer tackles a possible installation issue (creation of symbolic links to shared libraries using a wrong target file and in a possibly wrong directory for libselinux, libsepol and libsemanage) because it needs further discussion/testing/acknowledgement.

Please note that this patch might break the creation of separate components distributables (i.e. released components) unless parts of this patch (i.e. linkage of the local version of some static libraries in certain executables) are reverted (for example by reverting a patch created for the purpose or by running sed). Use the make_release.sh script on a cloned tree before creating the released archives. The original behavior has been modified because otherwise it might create a really unwanted and even potentially dangerous sort of "cache" when building the whole userspace SELinux from top-level (a previously-built static library is used instead of the very latest one) .

Signed-off-by Guido Trentalancia <[email protected]>

---

checkpolicy/Makefile +1 -1

diff -pruN selinux/checkpolicy/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/checkpolicy/Makefile
@@ -19,7 +19,7 @@ CHECKOBJS = y.tab.o lex.yy.o queue.o mod
 CHECKPOLOBJS = $(CHECKOBJS) checkpolicy.o
 CHECKMODOBJS = $(CHECKOBJS) checkmodule.o
 
-LDLIBS=$(LIBDIR)/libsepol.a -lfl
+LDLIBS=../libsepol/src/libsepol.a -L$(LIBDIR) -lfl
 
 GENERATED=lex.yy.c y.tab.c y.tab.h

checkpolicy/test/Makefile +1 -1

diff -pruN selinux/checkpolicy/test/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/checkpolicy/test/Makefile
@@ -9,7 +9,7 @@ INCLUDEDIR ?= $(PREFIX)/include
 CFLAGS ?= -g -Wall -O2 -pipe
 override CFLAGS += -I$(INCLUDEDIR)
 
-LDLIBS=-lfl -lsepol -lselinux $(LIBDIR)/libsepol.a -L$(LIBDIR)
+LDLIBS=-lsepol -lselinux ../../libsepol/src/libsepol.a -L$(LIBDIR) -lfl
 
 all: dispol dismod

libselinux/include/Makefile +2 -0

diff -pruN selinux/libselinux/include/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/libselinux/include/Makefile
@@ -2,6 +2,8 @@
 PREFIX ?= $(DESTDIR)/usr
 INCDIR ?= $(PREFIX)/include/selinux
 
+all:
+
 install:
 	test -d $(INCDIR) || install -m 755 -d $(INCDIR)
 	install -m 644 $(wildcard selinux/*.h) $(INCDIR)

libselinux/man/Makefile +2 -0

diff -pruN selinux/libselinux/man/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/libselinux/man/Makefile
@@ -3,6 +3,8 @@ MAN8DIR ?= $(DESTDIR)/usr/share/man/man8
 MAN5DIR ?= $(DESTDIR)/usr/share/man/man5
 MAN3DIR ?= $(DESTDIR)/usr/share/man/man3
 
+all:
+
 install:
 	mkdir -p $(MAN3DIR)
 	mkdir -p $(MAN5DIR)

libselinux/src/Makefile +1 -1

diff -pruN selinux/libselinux/src/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/libselinux/src/Makefile
@@ -102,7 +102,7 @@ $(AUDIT2WHYLOBJ): audit2why.c
 	$(CC) $(filter-out -Werror, $(CFLAGS)) $(PYINC) -fPIC -DSHARED -c -o $@ $<
 
 $(AUDIT2WHYSO): $(AUDIT2WHYLOBJ)
-	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux ${LIBDIR}/libsepol.a -L$(LIBDIR) -Wl,-soname,$@
+	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux ../../libsepol/src/libsepol.a -L$(LIBDIR) -Wl,-soname,$@
 
 %.o:  %.c policy.h
 	$(CC) $(CFLAGS) $(TLSFLAGS) -c -o $@ $<

libsemanage/include/Makefile +2 -0

diff -pruN selinux/libsemanage/include/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/libsemanage/include/Makefile
@@ -2,6 +2,8 @@
 PREFIX ?= $(DESTDIR)/usr
 INCDIR ?= $(PREFIX)/include/semanage
 
+all:
+
 install:
 	test -d $(INCDIR) || install -m 755 -d $(INCDIR)
 	install -m 644 $(wildcard semanage/*.h) $(INCDIR)

libsemanage/man/Makefile +2 -0

diff -pruN selinux/libsemanage/man/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/libsemanage/man/Makefile
@@ -1,6 +1,8 @@
 # Installation directories.
 MAN3DIR ?= $(DESTDIR)/usr/share/man/man3
 
+all:
+
 install:
 	mkdir -p $(MAN3DIR)
 	install -m 644 man3/*.3 $(MAN3DIR)

libsemanage/src/Makefile +1 -1

diff -pruN selinux/libsemanage/src/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/libsemanage/src/Makefile
@@ -87,7 +87,7 @@ $(LIBA): $(OBJS)
 	$(RANLIB) $@
 
 $(LIBSO): $(LOBJS)
-	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -lsepol -lselinux -lbz2 -lustr -L$(LIBDIR) -Wl,-soname,$(LIBSO),--version-script=libsemanage.map,-z,defs
+	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -lsepol -lselinux -L$(LIBDIR) -lbz2 -lustr -Wl,-soname,$(LIBSO),--version-script=libsemanage.map,-z,defs
 	ln -sf $@ $(TARGET)
 
 $(LIBPC): $(LIBPC).in

libsepol/include/Makefile +2 -0

diff -pruN selinux/libsepol/include/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/libsepol/include/Makefile
@@ -2,6 +2,8 @@
 PREFIX ?= $(DESTDIR)/usr
 INCDIR ?= $(PREFIX)/include/sepol
 
+all:
+
 install:
 	test -d $(INCDIR) || install -m 755 -d $(INCDIR)
 	test -d $(INCDIR)/policydb || install -m 755 -d $(INCDIR)/policydb

libsepol/man/Makefile +2 -0

diff -pruN selinux/libsepol/man/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/libsepol/man/Makefile
@@ -2,6 +2,8 @@
 MAN8DIR ?= $(DESTDIR)/usr/share/man/man8
 MAN3DIR ?= $(DESTDIR)/usr/share/man/man3
 
+all:
+
 install:
 	mkdir -p $(MAN3DIR)
 	mkdir -p $(MAN8DIR)

Makefile +7 -2

diff -pruN selinux/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/Makefile
@@ -3,10 +3,15 @@ PYSUBDIRS=libselinux libsemanage
 DISTCLEANSUBIDRS=libselinux libsemanage
 
 ifeq ($(DEBUG),1)
-	export CFLAGS = -g3 -O0 -gdwarf-2 -fno-strict-aliasing -Wall -Wshadow -Werror
-	export LDFLAGS = -g
+	CFLAGS += -g3 -O0 -gdwarf-2 -fno-strict-aliasing -Wall -Wshadow -Werror
+	LDFLAGS += -g
 endif
 
+CFLAGS += -I$(CURDIR)/libselinux/include -I$(CURDIR)/libsepol/include -I$(CURDIR)/libsemanage/include
+LDFLAGS += -L$(CURDIR)/libselinux/src -L$(CURDIR)/libsepol/src -L$(CURDIR)/libsemanage/src
+export CFLAGS
+export LDFLAGS
+
 all install relabel clean test indent:
 	@for subdir in $(SUBDIRS); do \
 		(cd $$subdir && $(MAKE) $@) || exit 1; \

make_release.sh +11 -0

diff -pruN selinux/make_release.sh selinux-14092011-patch-v5-do-not-modify-library-link-creation/make_release.sh
@@ -0,0 +1,11 @@
+#!/bin/sh
+
+sed -i 's/\.\.\/\.\.\/libsepol\/src\/libsepol\.a/\-L\$(LIBDIR)\/libsepol\.a/g' libselinux/src/Makefile
+sed -i 's/\.\.\/src\/libsemanage\.a/\-L\$(LIBDIR)\/libsemanage.a/g' libsemanage/tests/Makefile
+sed -i 's/\.\.\/\.\.\/libsepol\/src\/libsepol\.a/\-L\$(LIBDIR)\/libsepol\.a/g' libsemanage/tests/Makefile
+sed -i 's/\.\.\/\.\.\/libselinux\/src\/libselinux\.a/\-L\$(LIBDIR)\/libselinux\.a/g' libsemanage/tests/Makefile
+sed -i 's/\.\.\/libsepol\/src\/libsepol\.a/\-L\$(LIBDIR)\/libsepol\.a/g' checkpolicy/Makefile
+sed -i 's/\.\.\/\.\.\/libsepol\/src\/libsepol\.a/\-L\$(LIBDIR)\/libsepol\.a/g' checkpolicy/test/Makefile
+sed -i 's/\.\.\/\.\.\/\.\.\/libsepol\/src\/libsepol\.a/\-L\$(LIBDIR)\/libsepol\.a/g' policycoreutils/mcstrans/utils/Makefile
+sed -i 's/\.\.\/\.\.\/\.\.\/libsepol\/src\/libsepol\.a/\-L\$(LIBDIR)\/libsepol\.a/g' policycoreutils/mcstrans/src/Makefile
+sed -i 's/\.\.\/\.\.\/libsepol\/src\/libsepol\.a/\-L\$(LIBDIR)\/libsepol\.a/g' policycoreutils/semodule_deps/Makefile

policycoreutils/audit2allow/Makefile +2 -2

diff -pruN selinux/policycoreutils/audit2allow/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/audit2allow/Makefile
@@ -1,9 +1,9 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 BINDIR ?= $(PREFIX)/bin
 LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 
 all: ;

policycoreutils/audit2why/Makefile +1 -1

diff -pruN selinux/policycoreutils/audit2why/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/audit2why/Makefile
@@ -1,5 +1,5 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 BINDIR ?= $(PREFIX)/bin
 MANDIR ?= $(PREFIX)/share/man

policycoreutils/load_policy/Makefile +6 -4

diff -pruN selinux/policycoreutils/load_policy/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/load_policy/Makefile
@@ -1,13 +1,15 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(DESTDIR)/sbin
 USRSBINDIR ?= $(PREFIX)/sbin
+INCLUDEDIR ?= $(PREFIX)/include
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lsepol -lselinux -L$(PREFIX)/lib
+override CFLAGS += $(LDFLAGS) -I$(INCLUDEDIR) -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+LDLIBS += -lsepol -lselinux -L$(LIBDIR)
 
 TARGETS=$(patsubst %.c,%,$(wildcard *.c))

policycoreutils/mcstrans/man/Makefile +2 -0

diff -pruN selinux/policycoreutils/mcstrans/man/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/mcstrans/man/Makefile
@@ -1,6 +1,8 @@
 # Installation directories.
 MAN8DIR ?= $(DESTDIR)/usr/share/man/man8
 
+all:
+
 install:
 	mkdir -p $(MAN8DIR)
 	install -m 644 man8/*.8 $(MAN8DIR)

policycoreutils/mcstrans/src/Makefile +1 -1

diff -pruN selinux/policycoreutils/mcstrans/src/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/mcstrans/src/Makefile
@@ -28,7 +28,7 @@ override CFLAGS += -I../include -D_GNU_S
 all: $(PROG)
 
 $(PROG): $(PROG_OBJS)
-	$(CC) $(LDFLAGS) -pie -o $@ $^ -lselinux -lcap -lpcre $(LIBDIR)/libsepol.a
+	$(CC) $(LDFLAGS) -pie -o $@ $^ -lselinux ../../../libsepol/src/libsepol.a -L$(LIBDIR) -lcap -lpcre
 
 %.o:  %.c 
 	$(CC) $(CFLAGS) -fPIE -c -o $@ $<

policycoreutils/mcstrans/utils/Makefile +1 -1

diff -pruN selinux/policycoreutils/mcstrans/utils/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/mcstrans/utils/Makefile
@@ -21,7 +21,7 @@ endif
 
 CFLAGS ?= -Wall
 override CFLAGS += -I../src -D_GNU_SOURCE
-LDLIBS += -L../src ../src/mcstrans.o ../src/mls_level.o -lselinux -lpcre $(LIBDIR)/libsepol.a
+LDLIBS += -L../src ../src/mcstrans.o ../src/mls_level.o -lselinux -lpcre ../../../libsepol/src/libsepol.a
 
 TARGETS=$(patsubst %.c,%,$(wildcard *.c))

policycoreutils/newrole/Makefile +6 -4

diff -pruN selinux/policycoreutils/newrole/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/newrole/Makefile
@@ -1,9 +1,11 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 BINDIR ?= $(PREFIX)/bin
 MANDIR ?= $(PREFIX)/share/man
+INCLUDEDIR ?= $(PREFIX)/include
+LIBDIR ?= $(PREFIX)/lib
 ETCDIR ?= $(DESTDIR)/etc
-LOCALEDIR = /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 PAMH = $(shell ls /usr/include/security/pam_appl.h 2>/dev/null)
 AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null)
 # Enable capabilities to permit newrole to generate audit records.

@@ -22,8 +24,8 @@ VERSION = $(shell cat ../VERSION)
 
 CFLAGS ?= -Werror -Wall -W
 EXTRA_OBJS =
-override CFLAGS += -DVERSION=\"$(VERSION)\" $(LDFLAGS) -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lselinux -L$(PREFIX)/lib
+override CFLAGS += -DVERSION=\"$(VERSION)\" $(LDFLAGS) -I$(INCLUDEDIR) -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+LDLIBS += -lselinux -L$(LIBDIR)
 ifeq (${PAMH}, /usr/include/security/pam_appl.h)
 	override CFLAGS += -DUSE_PAM
 	EXTRA_OBJS += hashtab.o

policycoreutils/restorecond/Makefile +8 -6

diff -pruN selinux/policycoreutils/restorecond/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/restorecond/Makefile
@@ -1,13 +1,15 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
-INITDIR = $(DESTDIR)/etc/rc.d/init.d
-SELINUXDIR = $(DESTDIR)/etc/selinux
+INCLUDEDIR ?= $(PREFIX)/include
+LIBDIR ?= $(PREFIX)/lib
+MANDIR ?= $(PREFIX)/share/man
+INITDIR ?= $(DESTDIR)/etc/rc.d/init.d
+SELINUXDIR ?= $(DESTDIR)/etc/selinux
 
 CFLAGS ?= -g -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64
-LDLIBS += -lselinux -L$(PREFIX)/lib
+override CFLAGS += -I$(INCLUDEDIR) -D_FILE_OFFSET_BITS=64
+LDLIBS += -lselinux -L$(LIBDIR)
 
 all: restorecond

policycoreutils/run_init/Makefile +6 -5

diff -pruN selinux/policycoreutils/run_init/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/run_init/Makefile
@@ -1,16 +1,17 @@
-
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(PREFIX)/sbin
+INCLUDEDIR ?= $(PREFIX)/include
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
 ETCDIR ?= $(DESTDIR)/etc
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 PAMH = $(shell ls /usr/include/security/pam_appl.h 2>/dev/null)
 AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null)
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lselinux -L$(PREFIX)/lib
+override CFLAGS += -I$(INCLUDEDIR) -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+LDLIBS += -lselinux -L$(LIBDIR)
 ifeq (${PAMH}, /usr/include/security/pam_appl.h)
 	override CFLAGS += -DUSE_PAM
 	LDLIBS += -lpam -lpam_misc

policycoreutils/sandbox/Makefile +8 -6

diff -pruN selinux/policycoreutils/sandbox/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/sandbox/Makefile
@@ -1,14 +1,16 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
-INITDIR ?= ${DESTDIR}/etc/rc.d/init.d/
-SYSCONFDIR ?= ${DESTDIR}/etc/sysconfig
+PREFIX ?= $(DESTDIR)/usr
+INITDIR ?= $(DESTDIR)/etc/rc.d/init.d/
+SYSCONFDIR ?= $(DESTDIR)/etc/sysconfig
 BINDIR ?= $(PREFIX)/bin
 SBINDIR ?= $(PREFIX)/sbin
+INCLUDEDIR ?= $(PREFIX)/include
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 SHAREDIR ?= $(PREFIX)/share/sandbox
-override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lselinux -lcap-ng 
+override CFLAGS += $(LDFLAGS) -I$(INCLUDEDIR) -DPACKAGE="\"policycoreutils\""
+LDLIBS += -lselinux -L$(LIBDIR) -lcap-ng
 
 all: sandbox seunshare sandboxX.sh start

policycoreutils/scripts/genhomedircon.8 +12 ~~-28~~

diff -pruN selinux/policycoreutils/scripts/genhomedircon.8 selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/scripts/genhomedircon.8
@@ -1,37 +1,21 @@
-.\" Hey, Emacs! This is an -*- nroff -*- source file.
-.\" Copyright (c) 2010 Dan Walsh <[email protected]>
-.\"
-.\" This is free documentation; you can redistribute it and/or
-.\" modify it under the terms of the GNU General Public License as
-.\" published by the Free Software Foundation; either version 2 of
-.\" the License, or (at your option) any later version.
-.\"
-.\" The GNU General Public License's references to "object code"
-.\" and "executables" are to be interpreted as the output of any
-.\" document formatting or typesetting system, including
-.\" intermediate and printed output.
-.\"
-.\" This manual is distributed in the hope that it will be useful,
-.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
-.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-.\" GNU General Public License for more details.
-.\"
-.\" You should have received a copy of the GNU General Public
-.\" License along with this manual; if not, write to the Free
-.\" Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139,
-.\" USA.
-.\"
-.\"
-.TH GENHOMEDIRCON "8" "May 2010" "Security Enhanced Linux" "SELinux"
+.TH GENHOMEDIRCON "8" "Sep 2011" "Security Enhanced Linux" "SELinux"
 .SH NAME
 genhomedircon \- generate SELinux file context configuration entries for user home directories
 .SH SYNOPSIS
 .B genhomedircon
-is a script that executes semodule to rebuild policy and create the
-labels for HOMEDIRS based on home directories returned by the getpw calls.
+is a script that executes
+.B semodule
+to rebuild the SELinux policy and to create the
+labels for each user home directory based on directory paths returned by calls to getpwent().
 
-This functionality is enabled via the usepasswd flag in /etc/selinux/semanage.conf.
+This functionality can be disabled by using the "usepasswd" flag in /etc/selinux/semanage.conf
+(such flag can either take the value "true" or "false" and by default it is set to "true").
 
 .SH AUTHOR
 This manual page was written by
 .I Dan Walsh <[email protected]>
+
+The supporting functionality in the semanage library was written by Tresys Technology.
+
+.SH "SEE ALSO"
+semodule(8), getpwent(3), getpwent_r(3)

policycoreutils/scripts/Makefile +6 -3

diff -pruN selinux/policycoreutils/scripts/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/scripts/Makefile
@@ -1,9 +1,9 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 BINDIR ?= $(PREFIX)/bin
 SBINDIR ?= $(PREFIX)/sbin
 MANDIR ?= $(PREFIX)/share/man
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 
 all: fixfiles genhomedircon chcat

@@ -11,7 +11,10 @@ install: all
 	-mkdir -p $(BINDIR)
 	install -m 755 chcat $(BINDIR)
 	install -m 755 fixfiles $(DESTDIR)/sbin
-	install -m 755 genhomedircon  $(SBINDIR)
+	@echo "#!/bin/sh" > genhomedircon
+	@echo >> genhomedircon
+	@echo "$(SBINDIR)/semodule -Bn" >> genhomedircon
+	install -m 755 genhomedircon $(SBINDIR)
 	-mkdir -p $(MANDIR)/man8
 	install -m 644 fixfiles.8 $(MANDIR)/man8/
 	install -m 644 genhomedircon.8 $(MANDIR)/man8/

policycoreutils/secon/Makefile +2 -2

diff -pruN selinux/policycoreutils/secon/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/secon/Makefile
@@ -1,9 +1,9 @@
 # secon tool - command-line context
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
 MANDIR ?= $(PREFIX)/share/man
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 
 WARNS=-Werror -W -Wall -Wundef -Wshadow -Wpointer-arith -Wbad-function-cast -Wcast-align -Wwrite-strings -Waggregate-return -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -Wno-format-zero-length -Wformat-nonliteral -Wformat-security -Wfloat-equal
 VERSION = $(shell cat ../VERSION)

policycoreutils/semanage/Makefile +2 -2

diff -pruN selinux/policycoreutils/semanage/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/semanage/Makefile
@@ -1,8 +1,8 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 LIBDIR ?= $(PREFIX)/lib
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
+MANDIR ?= $(PREFIX)/share/man
 PYLIBVER ?= $(shell python -c 'import sys;print "python%d.%d" % sys.version_info[0:2]')
 PYTHONLIBDIR ?= $(LIBDIR)/$(PYLIBVER)

policycoreutils/semodule/Makefile +2 -2

diff -pruN selinux/policycoreutils/semodule/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/semodule/Makefile
@@ -2,8 +2,8 @@
 PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
-LIBDIR ?= ${PREFIX}/lib
+MANDIR ?= $(PREFIX)/share/man
+LIBDIR ?= $(PREFIX)/lib
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += -I$(INCLUDEDIR)

policycoreutils/semodule_deps/Makefile +3 -3

diff -pruN selinux/policycoreutils/semodule_deps/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/semodule_deps/Makefile
@@ -1,13 +1,13 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += -I$(INCLUDEDIR)
-LDLIBS = $(LIBDIR)/libsepol.a
+LDLIBS = ../../libsepol/src/libsepol.a
 
 all: semodule_deps

policycoreutils/semodule_expand/Makefile +2 -2

diff -pruN selinux/policycoreutils/semodule_expand/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/semodule_expand/Makefile
@@ -1,8 +1,8 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
 
 CFLAGS ?= -Werror -Wall -W

policycoreutils/semodule_link/Makefile +2 -2

diff -pruN selinux/policycoreutils/semodule_link/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/semodule_link/Makefile
@@ -1,9 +1,9 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
 MANDIR ?= $(PREFIX)/share/man
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += -I$(INCLUDEDIR)

policycoreutils/semodule_package/Makefile +2 -2

diff -pruN selinux/policycoreutils/semodule_package/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/semodule_package/Makefile
@@ -1,8 +1,8 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
 
 CFLAGS ?= -Werror -Wall -W

policycoreutils/sestatus/Makefile +6 -5

diff -pruN selinux/policycoreutils/sestatus/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/sestatus/Makefile
@@ -1,12 +1,13 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
+INCLUDEDIR ?= $(PREFIX)/include
+MANDIR ?= $(PREFIX)/share/man
 ETCDIR ?= $(DESTDIR)/etc
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 
-CFLAGS = -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64
+CFLAGS ?= -Werror -Wall -W
+override CFLAGS += -I$(INCLUDEDIR) -D_FILE_OFFSET_BITS=64
 LDLIBS = -lselinux -L$(LIBDIR)
 
 all: sestatus

policycoreutils/setfiles/Makefile +5 -4

diff -pruN selinux/policycoreutils/setfiles/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/setfiles/Makefile
@@ -1,12 +1,13 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(DESTDIR)/sbin
-MANDIR = $(PREFIX)/share/man
+INCLUDEDIR ?= $(PREFIX)/include
+MANDIR ?= $(PREFIX)/share/man
 LIBDIR ?= $(PREFIX)/lib
 AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null)
 
-CFLAGS = -g -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include
+CFLAGS ?= -g -Werror -Wall -W
+override CFLAGS += -I$(INCLUDEDIR)
 LDLIBS = -lselinux -lsepol -L$(LIBDIR)
 
 ifeq (${AUDITH}, /usr/include/libaudit.h)

policycoreutils/setsebool/Makefile +2 -2

diff -pruN selinux/policycoreutils/setsebool/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/setsebool/Makefile
@@ -2,8 +2,8 @@
 PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
-LIBDIR ?= ${PREFIX}/lib
+MANDIR ?= $(PREFIX)/share/man
+LIBDIR ?= $(PREFIX)/lib
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += -I$(INCLUDEDIR)

README +20 -0

diff -pruN selinux/README selinux-14092011-patch-v5-do-not-modify-library-link-creation/README
@@ -0,0 +1,20 @@
+INSTALLATION:
+
+Type "make" to build and then "make install" to install.
+
+---
+
+The environment variables CFLAGS and LDFLAGS can be passed to "make" to use custom compiler
+and/or linker flags (for example: CFLAGS="-O3" LDFLAGS="" make).
+
+The environment variables LIBDIR and SHLIBDIR can be passed to "make" in order to configure
+different directories for the libraries (e.g. LIBDIR=/usr/lib64 and SHLIBDIR=/usr/lib64
+on 64-bit systems).
+
+The environment variable PREFIX can be passed to "make" in order to configure an install
+prefix other than "/usr".
+
+The environment variable DESTDIR can be passed to "make" in order to configure a
+specific directory to be used as the root installation directory.
+
+Please see the Makefile(s) for other environment variables that can be used.

sepolgen/src/sepolgen/Makefile +3 -1

diff -pruN selinux/sepolgen/src/sepolgen/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/sepolgen/src/sepolgen/Makefile
@@ -1,7 +1,9 @@
 PYTHONLIBDIR ?= $(shell  python -c "from distutils.sysconfig import *; print get_python_lib(1)")
 PACKAGEDIR ?= $(DESTDIR)/$(PYTHONLIBDIR)/sepolgen
 
-install:
+all:
+
+install: all
 	-mkdir -p $(PACKAGEDIR)
 	install -m 644 *.py $(PACKAGEDIR)

sepolgen/src/share/Makefile +3 -1

diff -pruN selinux/sepolgen/src/share/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/sepolgen/src/share/Makefile
@@ -1,6 +1,8 @@
 SHAREDIR ?= $(DESTDIR)/var/lib/sepolgen
 
-install:
+all:
+
+install: all
 	-mkdir -p $(SHAREDIR)
 	install -m 644 perm_map $(SHAREDIR)

After the above patch, other patches are pending: semanage.conf manual page (might no longer apply cleanly), libsemanage test fix function's arguments.

Regards,

Guido

Quoted 31 lines · Eric Paris

Quoted 4 lines · Guido Trentalancia
Another possible improvement could be as follows (libsemanag):
Fix a few calls to semanage_store_access_check() in the libsemanage tests so that a void function is called.
Please in the future include a line which looks something like the following at the end of the comments with all patches you wish to have committed:
Signed-off-by Guido Trentalancia <[email protected]>
The purpose of this line is to indicate that you have the rights to contribute this code to the project and that you agree to license the code according to the license(s) of the file(s) that the patch will be applied to.
I prefer patches in the format like the linux kernel:
https://github.com/torvalds/linux/blob/master/Documentation/SubmittingPatches
Basically that entails the subject line of the e-mail is the short description of the patch (nothing extra except inside the [])
The body should be a complete description of what change you made and in particular why. You should mention testing and things like that as well.
The signed-off-by line.
The last line of the changelog should be just --- (at the beginning of the line)

Quoted 6 lines

After the --- line include the patch.
thanks so much!
-Eric

Guido Trentalancia

author

2011-09-15 09:43 UTC #56 lore raw

PATCH 1/1 Fix symbolic link creation for the userspace libraries

Eric,

if you really want to use the modified shared library link creation, then please use one amongst the two following patches, so that at least it also gets rid of "cd" in favor of "pushd/popd":

- first version of the patch: single link creation in SHLIBDIR rather than in LIBDIR (with the executable in SHLIBDIR);
- second version of the patch: double link creation (in SHLIBDIR and also in LIBDIR with the executable in SHLIBDIR);

The first version of the patch might break the link creation for some distributions (as Stephen predicted and as you confirmed, i.e. leads to build failure on distributions that do not independently recreate the symbolic link but rather rely on the original one being in LIBDIR).

The second version of the patch (creation of two links) should not interfere with the build process from different vendors. At this point this is the only version which is possibly recommended and in fact it is the only one which is signed. It still needs testing before eventually getting committed.

SINGLE (might interfere with the proper creation of a symbolic link in distributed packages)

Not-signed - Not-recommended

libselinux/src/Makefile +1 -1

diff -pruN selinux-orig/libselinux/src/Makefile selinux-fix-library-symlink-creation/libselinux/src/Makefile
@@ -126,7 +126,7 @@ install: all
 	install -m 755 $(LIBSO) $(SHLIBDIR)
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
-	cd $(LIBDIR) && ln -sf ../../`basename $(SHLIBDIR)`/$(LIBSO) $(TARGET)
+	pushd $(SHLIBDIR) && ln -sf $(LIBSO) $(TARGET) && popd
 
 install-pywrap: pywrap
 	test -d $(PYLIBDIR)/site-packages/selinux || install -m 755 -d $(PYLIBDIR)/site-packages/selinux

libsemanage/src/Makefile +1 -1

diff -pruN selinux-orig/libsemanage/src/Makefile selinux-fix-library-symlink-creation/libsemanage/src/Makefile
@@ -139,7 +139,7 @@ install: all
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
 	test -f $(DEFAULT_SEMANAGE_CONF_LOCATION) || install -m 644 -D semanage.conf $(DEFAULT_SEMANAGE_CONF_LOCATION)
-	cd $(LIBDIR) && ln -sf $(LIBSO) $(TARGET)
+	pushd $(SHLIBDIR) && ln -sf $(LIBSO) $(TARGET) && popd
 
 install-pywrap: pywrap 
 	test -d $(PYLIBDIR)/site-packages || install -m 755 -d $(PYLIBDIR)/site-packages

libsepol/src/Makefile +1 -1

diff -pruN selinux-orig/libsepol/src/Makefile selinux-fix-library-symlink-creation/libsepol/src/Makefile
@@ -43,7 +43,7 @@ install: all
 	install -m 755 $(LIBSO) $(SHLIBDIR)
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
-	cd $(LIBDIR) && ln -sf ../../`basename $(SHLIBDIR)`/$(LIBSO) $(TARGET)
+	pushd $(SHLIBDIR) && ln -sf $(LIBSO) $(TARGET) && popd
 
 relabel:
 	/sbin/restorecon $(SHLIBDIR)/$(LIBSO)

DOUBLE (possibly recommended version)

Signed-off-by Guido Trentalancia <[email protected]>

---

libselinux/src/Makefile +2 -1

@@ -126,7 +126,8 @@ install: all
 	install -m 755 $(LIBSO) $(SHLIBDIR)
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
-	cd $(LIBDIR) && ln -sf ../../`basename $(SHLIBDIR)`/$(LIBSO) $(TARGET)
+	pushd $(LIBDIR) && ln -sf $(SHLIBDIR)/$(LIBSO) $(TARGET) && popd
+	pushd $(SHLIBDIR) && ln -sf $(LIBSO) $(TARGET) && popd
 
 install-pywrap: pywrap
 	test -d $(PYLIBDIR)/site-packages/selinux || install -m 755 -d $(PYLIBDIR)/site-packages/selinux

libsepol/src/Makefile +2 -1

@@ -43,7 +43,8 @@ install: all
 	install -m 755 $(LIBSO) $(SHLIBDIR)
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
-	cd $(LIBDIR) && ln -sf ../../`basename $(SHLIBDIR)`/$(LIBSO) $(TARGET)
+	pushd $(LIBDIR) && ln -sf $(SHLIBDIR)/$(LIBSO) $(TARGET) && popd
+	pushd $(SHLIBDIR) && ln -sf $(LIBSO) $(TARGET) && popd
 
 relabel:
 	/sbin/restorecon $(SHLIBDIR)/$(LIBSO)

libsemanage/src/Makefile +2 -1

@@ -139,7 +139,8 @@ install: all
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
 	test -f $(DEFAULT_SEMANAGE_CONF_LOCATION) || install -m 644 -D semanage.conf $(DEFAULT_SEMANAGE_CONF_LOCATION)
-	cd $(LIBDIR) && ln -sf $(LIBSO) $(TARGET)
+	pushd $(LIBDIR) && ln -sf $(SHLIBDIR)/$(LIBSO) $(TARGET) && popd
+	pushd $(SHLIBDIR) && ln -sf $(LIBSO) $(TARGET) && popd
 
 install-pywrap: pywrap 
 	test -d $(PYLIBDIR)/site-packages || install -m 755 -d $(PYLIBDIR)/site-packages

The second version is always recommended over the first (that's also why it is the only one that is actually signed). It still needs further testing.

Regards,

Guido

Quoted 755 lines · Guido Trentalancia

Hello Eric,
you are right about the signature and about conforming to the official patch style and guidelines. I just wanted to discuss things first.
There are still at least two issues that need to be further discussed:
- link creation to versioned shared libraries executables (directory SHLIBDIR versus LIBDIR and relative versus absolute linking so that it does not break distribution build scripts and resulting packages);
- creation of individual released components getting broken because a few SELinux static libraries are now linked in from local sources instead of from existing system-wide versions.
I can sign and repost the whole thing, but I have now removed the diff relative to the symbolic link creation:
***
This is a maintenance patch for further testing. It potentially replaces any other patch previously posted in this same and/or other recent threads.
Make sure that the SELinux userspace libraries and tools bundle from the git repository can be built from scratch without requiring existing SELinux installations (in particular header files) by exploiting the CURDIR variable (provided by the make tool itself) in the top-level Makefile only.
Create a top-level README file which is intended to provide a few details about some of the possible environment variables that can be configured and passed to the make tool.
Do not hard-code the path to semodule in the genhomedircon script but rather generate it each time by using PREFIX. Improve the manual page for genhomedircon.
Replace curly brackets with parentheses for some variables such as DESTDIR and PREFIX in the Makefiles. Add and make use of LIBDIR and INCLUDEDIR where appropriate within the Makefiles. Make use of PREFIX for determining the value of LOCALEDIR within some of the Makefiles. Do not override the environment variables passed from the command-line for some of the Makefiles.
Change the default target for *all* Makefiles (even the "hidden" ones) to "all" from "install", as we cannot install anything without the user *explicitly* requiring it.
This patch no longer tackles a possible installation issue (creation of symbolic links to shared libraries using a wrong target file and in a possibly wrong directory for libselinux, libsepol and libsemanage) because it needs further discussion/testing/acknowledgement.
Please note that this patch might break the creation of separate components distributables (i.e. released components) unless parts of this patch (i.e. linkage of the local version of some static libraries in certain executables) are reverted (for example by reverting a patch created for the purpose or by running sed). Use the make_release.sh script on a cloned tree before creating the released archives. The original behavior has been modified because otherwise it might create a really unwanted and even potentially dangerous sort of "cache" when building the whole userspace SELinux from top-level (a previously-built static library is used instead of the very latest one) .
Signed-off-by Guido Trentalancia <[email protected]>
---
diff -pruN selinux/checkpolicy/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/checkpolicy/Makefile
checkpolicy/Makefile +1 -1
@@ -19,7 +19,7 @@ CHECKOBJS = y.tab.o lex.yy.o queue.o mod
 CHECKPOLOBJS = $(CHECKOBJS) checkpolicy.o
 CHECKMODOBJS = $(CHECKOBJS) checkmodule.o
 
-LDLIBS=$(LIBDIR)/libsepol.a -lfl
+LDLIBS=../libsepol/src/libsepol.a -L$(LIBDIR) -lfl
 
 GENERATED=lex.yy.c y.tab.c y.tab.h
 
diff -pruN selinux/checkpolicy/test/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/checkpolicy/test/Makefile
checkpolicy/test/Makefile +1 -1
@@ -9,7 +9,7 @@ INCLUDEDIR ?= $(PREFIX)/include
 CFLAGS ?= -g -Wall -O2 -pipe
 override CFLAGS += -I$(INCLUDEDIR)
 
-LDLIBS=-lfl -lsepol -lselinux $(LIBDIR)/libsepol.a -L$(LIBDIR)
+LDLIBS=-lsepol -lselinux ../../libsepol/src/libsepol.a -L$(LIBDIR) -lfl
 
 all: dispol dismod
 
diff -pruN selinux/libselinux/include/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/libselinux/include/Makefile
libselinux/include/Makefile +2 -0
@@ -2,6 +2,8 @@
 PREFIX ?= $(DESTDIR)/usr
 INCDIR ?= $(PREFIX)/include/selinux
 
+all:
+
 install:
 	test -d $(INCDIR) || install -m 755 -d $(INCDIR)
 	install -m 644 $(wildcard selinux/*.h) $(INCDIR)
diff -pruN selinux/libselinux/man/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/libselinux/man/Makefile
libselinux/man/Makefile +2 -0
@@ -3,6 +3,8 @@ MAN8DIR ?= $(DESTDIR)/usr/share/man/man8
 MAN5DIR ?= $(DESTDIR)/usr/share/man/man5
 MAN3DIR ?= $(DESTDIR)/usr/share/man/man3
 
+all:
+
 install:
 	mkdir -p $(MAN3DIR)
 	mkdir -p $(MAN5DIR)
diff -pruN selinux/libselinux/src/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/libselinux/src/Makefile
libselinux/src/Makefile +1 -1
@@ -102,7 +102,7 @@ $(AUDIT2WHYLOBJ): audit2why.c
 	$(CC) $(filter-out -Werror, $(CFLAGS)) $(PYINC) -fPIC -DSHARED -c -o $@ $<
 
 $(AUDIT2WHYSO): $(AUDIT2WHYLOBJ)
-	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux ${LIBDIR}/libsepol.a -L$(LIBDIR) -Wl,-soname,$@
+	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux ../../libsepol/src/libsepol.a -L$(LIBDIR) -Wl,-soname,$@
 
 %.o:  %.c policy.h
 	$(CC) $(CFLAGS) $(TLSFLAGS) -c -o $@ $<
diff -pruN selinux/libsemanage/include/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/libsemanage/include/Makefile
libsemanage/include/Makefile +2 -0
@@ -2,6 +2,8 @@
 PREFIX ?= $(DESTDIR)/usr
 INCDIR ?= $(PREFIX)/include/semanage
 
+all:
+
 install:
 	test -d $(INCDIR) || install -m 755 -d $(INCDIR)
 	install -m 644 $(wildcard semanage/*.h) $(INCDIR)
diff -pruN selinux/libsemanage/man/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/libsemanage/man/Makefile
libsemanage/man/Makefile +2 -0
@@ -1,6 +1,8 @@
 # Installation directories.
 MAN3DIR ?= $(DESTDIR)/usr/share/man/man3
 
+all:
+
 install:
 	mkdir -p $(MAN3DIR)
 	install -m 644 man3/*.3 $(MAN3DIR)
diff -pruN selinux/libsemanage/src/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/libsemanage/src/Makefile
libsemanage/src/Makefile +1 -1
@@ -87,7 +87,7 @@ $(LIBA): $(OBJS)
 	$(RANLIB) $@
 
 $(LIBSO): $(LOBJS)
-	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -lsepol -lselinux -lbz2 -lustr -L$(LIBDIR) -Wl,-soname,$(LIBSO),--version-script=libsemanage.map,-z,defs
+	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -lsepol -lselinux -L$(LIBDIR) -lbz2 -lustr -Wl,-soname,$(LIBSO),--version-script=libsemanage.map,-z,defs
 	ln -sf $@ $(TARGET)
 
 $(LIBPC): $(LIBPC).in
diff -pruN selinux/libsepol/include/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/libsepol/include/Makefile
libsepol/include/Makefile +2 -0
@@ -2,6 +2,8 @@
 PREFIX ?= $(DESTDIR)/usr
 INCDIR ?= $(PREFIX)/include/sepol
 
+all:
+
 install:
 	test -d $(INCDIR) || install -m 755 -d $(INCDIR)
 	test -d $(INCDIR)/policydb || install -m 755 -d $(INCDIR)/policydb
diff -pruN selinux/libsepol/man/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/libsepol/man/Makefile
libsepol/man/Makefile +2 -0
@@ -2,6 +2,8 @@
 MAN8DIR ?= $(DESTDIR)/usr/share/man/man8
 MAN3DIR ?= $(DESTDIR)/usr/share/man/man3
 
+all:
+
 install:
 	mkdir -p $(MAN3DIR)
 	mkdir -p $(MAN8DIR)
diff -pruN selinux/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/Makefile
Makefile +7 -2
@@ -3,10 +3,15 @@ PYSUBDIRS=libselinux libsemanage
 DISTCLEANSUBIDRS=libselinux libsemanage
 
 ifeq ($(DEBUG),1)
-	export CFLAGS = -g3 -O0 -gdwarf-2 -fno-strict-aliasing -Wall -Wshadow -Werror
-	export LDFLAGS = -g
+	CFLAGS += -g3 -O0 -gdwarf-2 -fno-strict-aliasing -Wall -Wshadow -Werror
+	LDFLAGS += -g
 endif
 
+CFLAGS += -I$(CURDIR)/libselinux/include -I$(CURDIR)/libsepol/include -I$(CURDIR)/libsemanage/include
+LDFLAGS += -L$(CURDIR)/libselinux/src -L$(CURDIR)/libsepol/src -L$(CURDIR)/libsemanage/src
+export CFLAGS
+export LDFLAGS
+
 all install relabel clean test indent:
 	@for subdir in $(SUBDIRS); do \
 		(cd $$subdir && $(MAKE) $@) || exit 1; \
diff -pruN selinux/make_release.sh selinux-14092011-patch-v5-do-not-modify-library-link-creation/make_release.sh
make_release.sh +11 -0
@@ -0,0 +1,11 @@
+#!/bin/sh
+
+sed -i 's/\.\.\/\.\.\/libsepol\/src\/libsepol\.a/\-L\$(LIBDIR)\/libsepol\.a/g' libselinux/src/Makefile
+sed -i 's/\.\.\/src\/libsemanage\.a/\-L\$(LIBDIR)\/libsemanage.a/g' libsemanage/tests/Makefile
+sed -i 's/\.\.\/\.\.\/libsepol\/src\/libsepol\.a/\-L\$(LIBDIR)\/libsepol\.a/g' libsemanage/tests/Makefile
+sed -i 's/\.\.\/\.\.\/libselinux\/src\/libselinux\.a/\-L\$(LIBDIR)\/libselinux\.a/g' libsemanage/tests/Makefile
+sed -i 's/\.\.\/libsepol\/src\/libsepol\.a/\-L\$(LIBDIR)\/libsepol\.a/g' checkpolicy/Makefile
+sed -i 's/\.\.\/\.\.\/libsepol\/src\/libsepol\.a/\-L\$(LIBDIR)\/libsepol\.a/g' checkpolicy/test/Makefile
+sed -i 's/\.\.\/\.\.\/\.\.\/libsepol\/src\/libsepol\.a/\-L\$(LIBDIR)\/libsepol\.a/g' policycoreutils/mcstrans/utils/Makefile
+sed -i 's/\.\.\/\.\.\/\.\.\/libsepol\/src\/libsepol\.a/\-L\$(LIBDIR)\/libsepol\.a/g' policycoreutils/mcstrans/src/Makefile
+sed -i 's/\.\.\/\.\.\/libsepol\/src\/libsepol\.a/\-L\$(LIBDIR)\/libsepol\.a/g' policycoreutils/semodule_deps/Makefile
diff -pruN selinux/policycoreutils/audit2allow/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/audit2allow/Makefile
policycoreutils/audit2allow/Makefile +2 -2
@@ -1,9 +1,9 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 BINDIR ?= $(PREFIX)/bin
 LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 
 all: ;
 
diff -pruN selinux/policycoreutils/audit2why/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/audit2why/Makefile
policycoreutils/audit2why/Makefile +1 -1
@@ -1,5 +1,5 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 BINDIR ?= $(PREFIX)/bin
 MANDIR ?= $(PREFIX)/share/man
 
diff -pruN selinux/policycoreutils/load_policy/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/load_policy/Makefile
policycoreutils/load_policy/Makefile +6 -4
@@ -1,13 +1,15 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(DESTDIR)/sbin
 USRSBINDIR ?= $(PREFIX)/sbin
+INCLUDEDIR ?= $(PREFIX)/include
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lsepol -lselinux -L$(PREFIX)/lib
+override CFLAGS += $(LDFLAGS) -I$(INCLUDEDIR) -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+LDLIBS += -lsepol -lselinux -L$(LIBDIR)
 
 TARGETS=$(patsubst %.c,%,$(wildcard *.c))
 
diff -pruN selinux/policycoreutils/mcstrans/man/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/mcstrans/man/Makefile
policycoreutils/mcstrans/man/Makefile +2 -0
@@ -1,6 +1,8 @@
 # Installation directories.
 MAN8DIR ?= $(DESTDIR)/usr/share/man/man8
 
+all:
+
 install:
 	mkdir -p $(MAN8DIR)
 	install -m 644 man8/*.8 $(MAN8DIR)
diff -pruN selinux/policycoreutils/mcstrans/src/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/mcstrans/src/Makefile
policycoreutils/mcstrans/src/Makefile +1 -1
@@ -28,7 +28,7 @@ override CFLAGS += -I../include -D_GNU_S
 all: $(PROG)
 
 $(PROG): $(PROG_OBJS)
-	$(CC) $(LDFLAGS) -pie -o $@ $^ -lselinux -lcap -lpcre $(LIBDIR)/libsepol.a
+	$(CC) $(LDFLAGS) -pie -o $@ $^ -lselinux ../../../libsepol/src/libsepol.a -L$(LIBDIR) -lcap -lpcre
 
 %.o:  %.c 
 	$(CC) $(CFLAGS) -fPIE -c -o $@ $<
diff -pruN selinux/policycoreutils/mcstrans/utils/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/mcstrans/utils/Makefile
policycoreutils/mcstrans/utils/Makefile +1 -1
@@ -21,7 +21,7 @@ endif
 
 CFLAGS ?= -Wall
 override CFLAGS += -I../src -D_GNU_SOURCE
-LDLIBS += -L../src ../src/mcstrans.o ../src/mls_level.o -lselinux -lpcre $(LIBDIR)/libsepol.a
+LDLIBS += -L../src ../src/mcstrans.o ../src/mls_level.o -lselinux -lpcre ../../../libsepol/src/libsepol.a
 
 TARGETS=$(patsubst %.c,%,$(wildcard *.c))
 
diff -pruN selinux/policycoreutils/newrole/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/newrole/Makefile
policycoreutils/newrole/Makefile +6 -4
@@ -1,9 +1,11 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 BINDIR ?= $(PREFIX)/bin
 MANDIR ?= $(PREFIX)/share/man
+INCLUDEDIR ?= $(PREFIX)/include
+LIBDIR ?= $(PREFIX)/lib
 ETCDIR ?= $(DESTDIR)/etc
-LOCALEDIR = /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 PAMH = $(shell ls /usr/include/security/pam_appl.h 2>/dev/null)
 AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null)
 # Enable capabilities to permit newrole to generate audit records.
@@ -22,8 +24,8 @@ VERSION = $(shell cat ../VERSION)
 
 CFLAGS ?= -Werror -Wall -W
 EXTRA_OBJS =
-override CFLAGS += -DVERSION=\"$(VERSION)\" $(LDFLAGS) -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lselinux -L$(PREFIX)/lib
+override CFLAGS += -DVERSION=\"$(VERSION)\" $(LDFLAGS) -I$(INCLUDEDIR) -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+LDLIBS += -lselinux -L$(LIBDIR)
 ifeq (${PAMH}, /usr/include/security/pam_appl.h)
 	override CFLAGS += -DUSE_PAM
 	EXTRA_OBJS += hashtab.o
diff -pruN selinux/policycoreutils/restorecond/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/restorecond/Makefile
policycoreutils/restorecond/Makefile +8 -6
@@ -1,13 +1,15 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
-INITDIR = $(DESTDIR)/etc/rc.d/init.d
-SELINUXDIR = $(DESTDIR)/etc/selinux
+INCLUDEDIR ?= $(PREFIX)/include
+LIBDIR ?= $(PREFIX)/lib
+MANDIR ?= $(PREFIX)/share/man
+INITDIR ?= $(DESTDIR)/etc/rc.d/init.d
+SELINUXDIR ?= $(DESTDIR)/etc/selinux
 
 CFLAGS ?= -g -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64
-LDLIBS += -lselinux -L$(PREFIX)/lib
+override CFLAGS += -I$(INCLUDEDIR) -D_FILE_OFFSET_BITS=64
+LDLIBS += -lselinux -L$(LIBDIR)
 
 all: restorecond
 
diff -pruN selinux/policycoreutils/run_init/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/run_init/Makefile
policycoreutils/run_init/Makefile +6 -5
@@ -1,16 +1,17 @@
-
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(PREFIX)/sbin
+INCLUDEDIR ?= $(PREFIX)/include
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
 ETCDIR ?= $(DESTDIR)/etc
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 PAMH = $(shell ls /usr/include/security/pam_appl.h 2>/dev/null)
 AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null)
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lselinux -L$(PREFIX)/lib
+override CFLAGS += -I$(INCLUDEDIR) -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+LDLIBS += -lselinux -L$(LIBDIR)
 ifeq (${PAMH}, /usr/include/security/pam_appl.h)
 	override CFLAGS += -DUSE_PAM
 	LDLIBS += -lpam -lpam_misc
diff -pruN selinux/policycoreutils/sandbox/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/sandbox/Makefile
policycoreutils/sandbox/Makefile +8 -6
@@ -1,14 +1,16 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
-INITDIR ?= ${DESTDIR}/etc/rc.d/init.d/
-SYSCONFDIR ?= ${DESTDIR}/etc/sysconfig
+PREFIX ?= $(DESTDIR)/usr
+INITDIR ?= $(DESTDIR)/etc/rc.d/init.d/
+SYSCONFDIR ?= $(DESTDIR)/etc/sysconfig
 BINDIR ?= $(PREFIX)/bin
 SBINDIR ?= $(PREFIX)/sbin
+INCLUDEDIR ?= $(PREFIX)/include
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 SHAREDIR ?= $(PREFIX)/share/sandbox
-override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lselinux -lcap-ng 
+override CFLAGS += $(LDFLAGS) -I$(INCLUDEDIR) -DPACKAGE="\"policycoreutils\""
+LDLIBS += -lselinux -L$(LIBDIR) -lcap-ng
 
 all: sandbox seunshare sandboxX.sh start
 
diff -pruN selinux/policycoreutils/scripts/genhomedircon.8 selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/scripts/genhomedircon.8
policycoreutils/scripts/genhomedircon.8 +12 ~~-28~~
@@ -1,37 +1,21 @@
-.\" Hey, Emacs! This is an -*- nroff -*- source file.
-.\" Copyright (c) 2010 Dan Walsh <[email protected]>
-.\"
-.\" This is free documentation; you can redistribute it and/or
-.\" modify it under the terms of the GNU General Public License as
-.\" published by the Free Software Foundation; either version 2 of
-.\" the License, or (at your option) any later version.
-.\"
-.\" The GNU General Public License's references to "object code"
-.\" and "executables" are to be interpreted as the output of any
-.\" document formatting or typesetting system, including
-.\" intermediate and printed output.
-.\"
-.\" This manual is distributed in the hope that it will be useful,
-.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
-.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-.\" GNU General Public License for more details.
-.\"
-.\" You should have received a copy of the GNU General Public
-.\" License along with this manual; if not, write to the Free
-.\" Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139,
-.\" USA.
-.\"
-.\"
-.TH GENHOMEDIRCON "8" "May 2010" "Security Enhanced Linux" "SELinux"
+.TH GENHOMEDIRCON "8" "Sep 2011" "Security Enhanced Linux" "SELinux"
 .SH NAME
 genhomedircon \- generate SELinux file context configuration entries for user home directories
 .SH SYNOPSIS
 .B genhomedircon
-is a script that executes semodule to rebuild policy and create the
-labels for HOMEDIRS based on home directories returned by the getpw calls.
+is a script that executes
+.B semodule
+to rebuild the SELinux policy and to create the
+labels for each user home directory based on directory paths returned by calls to getpwent().
 
-This functionality is enabled via the usepasswd flag in /etc/selinux/semanage.conf.
+This functionality can be disabled by using the "usepasswd" flag in /etc/selinux/semanage.conf
+(such flag can either take the value "true" or "false" and by default it is set to "true").
 
 .SH AUTHOR
 This manual page was written by
 .I Dan Walsh <[email protected]>
+
+The supporting functionality in the semanage library was written by Tresys Technology.
+
+.SH "SEE ALSO"
+semodule(8), getpwent(3), getpwent_r(3)
diff -pruN selinux/policycoreutils/scripts/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/scripts/Makefile
policycoreutils/scripts/Makefile +6 -3
@@ -1,9 +1,9 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 BINDIR ?= $(PREFIX)/bin
 SBINDIR ?= $(PREFIX)/sbin
 MANDIR ?= $(PREFIX)/share/man
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 
 all: fixfiles genhomedircon chcat
 
@@ -11,7 +11,10 @@ install: all
 	-mkdir -p $(BINDIR)
 	install -m 755 chcat $(BINDIR)
 	install -m 755 fixfiles $(DESTDIR)/sbin
-	install -m 755 genhomedircon  $(SBINDIR)
+	@echo "#!/bin/sh" > genhomedircon
+	@echo >> genhomedircon
+	@echo "$(SBINDIR)/semodule -Bn" >> genhomedircon
+	install -m 755 genhomedircon $(SBINDIR)
 	-mkdir -p $(MANDIR)/man8
 	install -m 644 fixfiles.8 $(MANDIR)/man8/
 	install -m 644 genhomedircon.8 $(MANDIR)/man8/
diff -pruN selinux/policycoreutils/secon/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/secon/Makefile
policycoreutils/secon/Makefile +2 -2
@@ -1,9 +1,9 @@
 # secon tool - command-line context
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
 MANDIR ?= $(PREFIX)/share/man
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 
 WARNS=-Werror -W -Wall -Wundef -Wshadow -Wpointer-arith -Wbad-function-cast -Wcast-align -Wwrite-strings -Waggregate-return -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -Wno-format-zero-length -Wformat-nonliteral -Wformat-security -Wfloat-equal
 VERSION = $(shell cat ../VERSION)
diff -pruN selinux/policycoreutils/semanage/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/semanage/Makefile
policycoreutils/semanage/Makefile +2 -2
@@ -1,8 +1,8 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 LIBDIR ?= $(PREFIX)/lib
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
+MANDIR ?= $(PREFIX)/share/man
 PYLIBVER ?= $(shell python -c 'import sys;print "python%d.%d" % sys.version_info[0:2]')
 PYTHONLIBDIR ?= $(LIBDIR)/$(PYLIBVER)
 
diff -pruN selinux/policycoreutils/semodule/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/semodule/Makefile
policycoreutils/semodule/Makefile +2 -2
@@ -2,8 +2,8 @@
 PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
-LIBDIR ?= ${PREFIX}/lib
+MANDIR ?= $(PREFIX)/share/man
+LIBDIR ?= $(PREFIX)/lib
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += -I$(INCLUDEDIR)
diff -pruN selinux/policycoreutils/semodule_deps/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/semodule_deps/Makefile
policycoreutils/semodule_deps/Makefile +3 -3
@@ -1,13 +1,13 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += -I$(INCLUDEDIR)
-LDLIBS = $(LIBDIR)/libsepol.a
+LDLIBS = ../../libsepol/src/libsepol.a
 
 all: semodule_deps
 
diff -pruN selinux/policycoreutils/semodule_expand/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/semodule_expand/Makefile
policycoreutils/semodule_expand/Makefile +2 -2
@@ -1,8 +1,8 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
 
 CFLAGS ?= -Werror -Wall -W
diff -pruN selinux/policycoreutils/semodule_link/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/semodule_link/Makefile
policycoreutils/semodule_link/Makefile +2 -2
@@ -1,9 +1,9 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
 MANDIR ?= $(PREFIX)/share/man
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += -I$(INCLUDEDIR)
diff -pruN selinux/policycoreutils/semodule_package/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/semodule_package/Makefile
policycoreutils/semodule_package/Makefile +2 -2
@@ -1,8 +1,8 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
 
 CFLAGS ?= -Werror -Wall -W
diff -pruN selinux/policycoreutils/sestatus/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/sestatus/Makefile
policycoreutils/sestatus/Makefile +6 -5
@@ -1,12 +1,13 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
+INCLUDEDIR ?= $(PREFIX)/include
+MANDIR ?= $(PREFIX)/share/man
 ETCDIR ?= $(DESTDIR)/etc
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 
-CFLAGS = -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64
+CFLAGS ?= -Werror -Wall -W
+override CFLAGS += -I$(INCLUDEDIR) -D_FILE_OFFSET_BITS=64
 LDLIBS = -lselinux -L$(LIBDIR)
 
 all: sestatus
diff -pruN selinux/policycoreutils/setfiles/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/setfiles/Makefile
policycoreutils/setfiles/Makefile +5 -4
@@ -1,12 +1,13 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(DESTDIR)/sbin
-MANDIR = $(PREFIX)/share/man
+INCLUDEDIR ?= $(PREFIX)/include
+MANDIR ?= $(PREFIX)/share/man
 LIBDIR ?= $(PREFIX)/lib
 AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null)
 
-CFLAGS = -g -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include
+CFLAGS ?= -g -Werror -Wall -W
+override CFLAGS += -I$(INCLUDEDIR)
 LDLIBS = -lselinux -lsepol -L$(LIBDIR)
 
 ifeq (${AUDITH}, /usr/include/libaudit.h)
diff -pruN selinux/policycoreutils/setsebool/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/policycoreutils/setsebool/Makefile
policycoreutils/setsebool/Makefile +2 -2
@@ -2,8 +2,8 @@
 PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
-LIBDIR ?= ${PREFIX}/lib
+MANDIR ?= $(PREFIX)/share/man
+LIBDIR ?= $(PREFIX)/lib
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += -I$(INCLUDEDIR)
diff -pruN selinux/README selinux-14092011-patch-v5-do-not-modify-library-link-creation/README
README +20 -0
@@ -0,0 +1,20 @@
+INSTALLATION:
+
+Type "make" to build and then "make install" to install.
+
+---
+
+The environment variables CFLAGS and LDFLAGS can be passed to "make" to use custom compiler
+and/or linker flags (for example: CFLAGS="-O3" LDFLAGS="" make).
+
+The environment variables LIBDIR and SHLIBDIR can be passed to "make" in order to configure
+different directories for the libraries (e.g. LIBDIR=/usr/lib64 and SHLIBDIR=/usr/lib64
+on 64-bit systems).
+
+The environment variable PREFIX can be passed to "make" in order to configure an install
+prefix other than "/usr".
+
+The environment variable DESTDIR can be passed to "make" in order to configure a
+specific directory to be used as the root installation directory.
+
+Please see the Makefile(s) for other environment variables that can be used.
diff -pruN selinux/sepolgen/src/sepolgen/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/sepolgen/src/sepolgen/Makefile
sepolgen/src/sepolgen/Makefile +3 -1
@@ -1,7 +1,9 @@
 PYTHONLIBDIR ?= $(shell  python -c "from distutils.sysconfig import *; print get_python_lib(1)")
 PACKAGEDIR ?= $(DESTDIR)/$(PYTHONLIBDIR)/sepolgen
 
-install:
+all:
+
+install: all
 	-mkdir -p $(PACKAGEDIR)
 	install -m 644 *.py $(PACKAGEDIR)
 
diff -pruN selinux/sepolgen/src/share/Makefile selinux-14092011-patch-v5-do-not-modify-library-link-creation/sepolgen/src/share/Makefile
sepolgen/src/share/Makefile +3 -1
@@ -1,6 +1,8 @@
 SHAREDIR ?= $(DESTDIR)/var/lib/sepolgen
 
-install:
+all:
+
+install: all
 	-mkdir -p $(SHAREDIR)
 	install -m 644 perm_map $(SHAREDIR)
 
After the above patch, other patches are pending: semanage.conf manual page (might no longer apply cleanly), libsemanage test fix function's arguments.
Regards,
Guido
Quoted 31 lines · Eric Paris
Quoted 4 lines · Guido Trentalancia
Another possible improvement could be as follows (libsemanag):
Fix a few calls to semanage_store_access_check() in the libsemanage tests so that a void function is called.
Please in the future include a line which looks something like the following at the end of the comments with all patches you wish to have committed:
Signed-off-by Guido Trentalancia <[email protected]>
The purpose of this line is to indicate that you have the rights to contribute this code to the project and that you agree to license the code according to the license(s) of the file(s) that the patch will be applied to.
I prefer patches in the format like the linux kernel:
https://github.com/torvalds/linux/blob/master/Documentation/SubmittingPatches
Basically that entails the subject line of the e-mail is the short description of the patch (nothing extra except inside the [])
The body should be a complete description of what change you made and in particular why. You should mention testing and things like that as well.
The signed-off-by line.
The last line of the changelog should be just --- (at the beginning of the line)
Quoted 6 lines
After the --- line include the patch.
thanks so much!
-Eric

Quoted 5 lines

--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

Guido Trentalancia

author

2011-09-15 11:51 UTC #57 lore raw

PATCH v5 1/1 Fix makefiles for the userspace tools and libraries

In reply to Guido Trentalancia

I just realised that the new make_release.sh script generated by the previously attached patch contains typos (wrong compiler flag being substituted).

I do apologize but it should be integrated with the following (manual removal of "\-L") or otherwise passed through sed 's/\-L//g':

Signed-off-by Guido Trentalancia <[email protected]>

---

make_release.sh +9 -9

@@ -1,11 +1,11 @@
 #!/bin/sh
 
-sed -i 's/\.\.\/\.\.\/libsepol\/src\/libsepol\.a/\-L\$(LIBDIR)\/libsepol\.a/g' libselinux/src/Makefile
-sed -i 's/\.\.\/src\/libsemanage\.a/\-L\$(LIBDIR)\/libsemanage.a/g' libsemanage/tests/Makefile
-sed -i 's/\.\.\/\.\.\/libsepol\/src\/libsepol\.a/\-L\$(LIBDIR)\/libsepol\.a/g' libsemanage/tests/Makefile
-sed -i 's/\.\.\/\.\.\/libselinux\/src\/libselinux\.a/\-L\$(LIBDIR)\/libselinux\.a/g' libsemanage/tests/Makefile
-sed -i 's/\.\.\/libsepol\/src\/libsepol\.a/\-L\$(LIBDIR)\/libsepol\.a/g' checkpolicy/Makefile
-sed -i 's/\.\.\/\.\.\/libsepol\/src\/libsepol\.a/\-L\$(LIBDIR)\/libsepol\.a/g' checkpolicy/test/Makefile
-sed -i 's/\.\.\/\.\.\/\.\.\/libsepol\/src\/libsepol\.a/\-L\$(LIBDIR)\/libsepol\.a/g' policycoreutils/mcstrans/utils/Makefile
-sed -i 's/\.\.\/\.\.\/\.\.\/libsepol\/src\/libsepol\.a/\-L\$(LIBDIR)\/libsepol\.a/g' policycoreutils/mcstrans/src/Makefile
-sed -i 's/\.\.\/\.\.\/libsepol\/src\/libsepol\.a/\-L\$(LIBDIR)\/libsepol\.a/g' policycoreutils/semodule_deps/Makefile
+sed -i 's/\.\.\/\.\.\/libsepol\/src\/libsepol\.a/\$(LIBDIR)\/libsepol\.a/g' libselinux/src/Makefile
+sed -i 's/\.\.\/src\/libsemanage\.a/\$(LIBDIR)\/libsemanage.a/g' libsemanage/tests/Makefile
+sed -i 's/\.\.\/\.\.\/libsepol\/src\/libsepol\.a/\$(LIBDIR)\/libsepol\.a/g' libsemanage/tests/Makefile
+sed -i 's/\.\.\/\.\.\/libselinux\/src\/libselinux\.a/\$(LIBDIR)\/libselinux\.a/g' libsemanage/tests/Makefile
+sed -i 's/\.\.\/libsepol\/src\/libsepol\.a/\$(LIBDIR)\/libsepol\.a/g' checkpolicy/Makefile
+sed -i 's/\.\.\/\.\.\/libsepol\/src\/libsepol\.a/\$(LIBDIR)\/libsepol\.a/g' checkpolicy/test/Makefile
+sed -i 's/\.\.\/\.\.\/\.\.\/libsepol\/src\/libsepol\.a/\$(LIBDIR)\/libsepol\.a/g' policycoreutils/mcstrans/utils/Makefile
+sed -i 's/\.\.\/\.\.\/\.\.\/libsepol\/src\/libsepol\.a/\$(LIBDIR)\/libsepol\.a/g' policycoreutils/mcstrans/src/Makefile
+sed -i 's/\.\.\/\.\.\/libsepol\/src\/libsepol\.a/\$(LIBDIR)\/libsepol\.a/g' policycoreutils/semodule_deps/Makefile

Thanks.

Or creation from scratch would be:

make_release.sh renamed from make_releash.sh/make_release.sh +11 -0

diff -pruN selinux/make_releash.sh/make_release.sh selinux-14092011-fix-library-double-symlink-creation-make_release.sh/make_release.sh
@@ -0,0 +1,11 @@
+#!/bin/sh
+
+sed -i 's/\.\.\/\.\.\/libsepol\/src\/libsepol\.a/\$(LIBDIR)\/libsepol\.a/g' libselinux/src/Makefile
+sed -i 's/\.\.\/src\/libsemanage\.a/\$(LIBDIR)\/libsemanage.a/g' libsemanage/tests/Makefile
+sed -i 's/\.\.\/\.\.\/libsepol\/src\/libsepol\.a/\$(LIBDIR)\/libsepol\.a/g' libsemanage/tests/Makefile
+sed -i 's/\.\.\/\.\.\/libselinux\/src\/libselinux\.a/\$(LIBDIR)\/libselinux\.a/g' libsemanage/tests/Makefile
+sed -i 's/\.\.\/libsepol\/src\/libsepol\.a/\$(LIBDIR)\/libsepol\.a/g' checkpolicy/Makefile
+sed -i 's/\.\.\/\.\.\/libsepol\/src\/libsepol\.a/\$(LIBDIR)\/libsepol\.a/g' checkpolicy/test/Makefile
+sed -i 's/\.\.\/\.\.\/\.\.\/libsepol\/src\/libsepol\.a/\$(LIBDIR)\/libsepol\.a/g' policycoreutils/mcstrans/utils/Makefile
+sed -i 's/\.\.\/\.\.\/\.\.\/libsepol\/src\/libsepol\.a/\$(LIBDIR)\/libsepol\.a/g' policycoreutils/mcstrans/src/Makefile
+sed -i 's/\.\.\/\.\.\/libsepol\/src\/libsepol\.a/\$(LIBDIR)\/libsepol\.a/g' policycoreutils/semodule_deps/Makefile

A script which does the opposite could also be created if needed.

The same thing can be achieved in other ways too (which, for example, do not require manual reconfiguration such as blindly substituting all the possible relative local file paths with the absolute system-wide ones in all makefiles).

It's intended as a starting point for sorting out the issue which arises as a side-effect of applying the patch mentioned in the subject.

Stephen Smalley

2011-09-14 12:56 UTC #58 lore raw

Re: [PATCH v4] Fix includes for userspace tools and libraries (and possible security issue)

In reply to Guido Trentalancia

Quoted 20 lines · Guido Trentalancia

Hello Eric !
Quoted 7 lines · Eric Paris
Personally, I'd like to see just 'make' at the top level dir build properly and I think your patches get us most of the way there without (further) breaking the building method that sds prefers.
If you get your best patch which does nothing but allow us to just type 'make' at the top level dir and it builds everything properly in place, I'll review and probably commit such a patch.
Yes, let's get to the point. The latest version of the patch that you should test is attached below. Please note that it also changes the creation of symbolic links to shared libraries (needs to be double-checked for correctness).
diff -pruN selinux/checkpolicy/Makefile selinux-13092011/checkpolicy/Makefile

checkpolicy/Makefile CHECKOBJS = y.tab.o lex.yy.o queue.o mod · line 24

Quoted 7 lines

checkpolicy/Makefile +1 -1

@@ -19,7 +19,7 @@ CHECKOBJS = y.tab.o lex.yy.o queue.o mod
 CHECKPOLOBJS = $(CHECKOBJS) checkpolicy.o
 CHECKMODOBJS = $(CHECKOBJS) checkmodule.o
 
-LDLIBS=$(LIBDIR)/libsepol.a -lfl
+LDLIBS=../libsepol/src/libsepol.a -L$(LIBDIR) -lfl
 
 GENERATED=lex.yy.c y.tab.c y.tab.h

The above will break when building checkpolicy separately. Ditto for the other components that need to reference a static lib. I think this is why we didn't go down this path previously.

BTW, your patch wouldn't quite compile as is for me even aside from this issue; you don't seem to have defined LIBDIR in policycoreutils/restorecond/Makefile before using it.

Signature · 8 lines

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Guido Trentalancia

author

2011-09-15 02:44 UTC #59 lore raw

Re: [PATCH v5] Fix includes for userspace tools and libraries (and possible security issue)

Hello Stephen.

Quoted 24 lines · Stephen Smalley

Quoted 23 lines · Guido Trentalancia
Hello Eric !
Quoted 7 lines · Eric Paris
Personally, I'd like to see just 'make' at the top level dir build properly and I think your patches get us most of the way there without (further) breaking the building method that sds prefers.
If you get your best patch which does nothing but allow us to just type 'make' at the top level dir and it builds everything properly in place, I'll review and probably commit such a patch.
Yes, let's get to the point. The latest version of the patch that you should test is attached below. Please note that it also changes the creation of symbolic links to shared libraries (needs to be double-checked for correctness).
diff -pruN selinux/checkpolicy/Makefile selinux-13092011/checkpolicy/Makefile
checkpolicy/Makefile +0 -0
@@ -19,7 +19,7 @@ CHECKOBJS = y.tab.o lex.yy.o queue.o mod
 CHECKPOLOBJS = $(CHECKOBJS) checkpolicy.o
 CHECKMODOBJS = $(CHECKOBJS) checkmodule.o
 

Quoted 6 lines

checkpolicy/Makefile CHECKOBJS = y.tab.o lex.yy.o queue.o mod · line 24
Quoted 4 lines
checkpolicy/Makefile +1 -1
-LDLIBS=$(LIBDIR)/libsepol.a -lfl
+LDLIBS=../libsepol/src/libsepol.a -L$(LIBDIR) -lfl
 
 GENERATED=lex.yy.c y.tab.c y.tab.h
The above will break when building checkpolicy separately.

Yes it will. But it also avoids linking an existing old static library when building from the whole git bundle.

Before creating each release of the separate components, that piece of patch could be reverted or otherwise a script could invoke sed on the affected Makefiles.

Quoted 3 lines

Ditto for
the other components that need to reference a static lib. I think this is why we didn't go down this path previously.

See above: reverting a patch or running sed

Quoted 3 lines

BTW, your patch wouldn't quite compile as is for me even aside from this issue; you don't seem to have defined LIBDIR in policycoreutils/restorecond/Makefile before using it.

You're right. It needs a fix. It wasn't showing up here because I was passing LIBDIR from the environment, therefore that was getting passed at each "make" recursion. Thanks very much for pointint that out.

Here is a revised patch:

checkpolicy/Makefile +1 -1

diff -pruN selinux/checkpolicy/Makefile selinux-13092011-patch-v5/checkpolicy/Makefile
@@ -19,7 +19,7 @@ CHECKOBJS = y.tab.o lex.yy.o queue.o mod
 CHECKPOLOBJS = $(CHECKOBJS) checkpolicy.o
 CHECKMODOBJS = $(CHECKOBJS) checkmodule.o
 
-LDLIBS=$(LIBDIR)/libsepol.a -lfl
+LDLIBS=../libsepol/src/libsepol.a -L$(LIBDIR) -lfl
 
 GENERATED=lex.yy.c y.tab.c y.tab.h

checkpolicy/test/Makefile +1 -1

diff -pruN selinux/checkpolicy/test/Makefile selinux-13092011-patch-v5/checkpolicy/test/Makefile
@@ -9,7 +9,7 @@ INCLUDEDIR ?= $(PREFIX)/include
 CFLAGS ?= -g -Wall -O2 -pipe
 override CFLAGS += -I$(INCLUDEDIR)
 
-LDLIBS=-lfl -lsepol -lselinux $(LIBDIR)/libsepol.a -L$(LIBDIR)
+LDLIBS=-lsepol -lselinux ../../libsepol/src/libsepol.a -L$(LIBDIR) -lfl
 
 all: dispol dismod

libselinux/src/Makefile +2 -2

diff -pruN selinux/libselinux/src/Makefile selinux-13092011-patch-v5/libselinux/src/Makefile
@@ -102,7 +102,7 @@ $(AUDIT2WHYLOBJ): audit2why.c
 	$(CC) $(filter-out -Werror, $(CFLAGS)) $(PYINC) -fPIC -DSHARED -c -o $@ $<
 
 $(AUDIT2WHYSO): $(AUDIT2WHYLOBJ)
-	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux ${LIBDIR}/libsepol.a -L$(LIBDIR) -Wl,-soname,$@
+	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux ../../libsepol/src/libsepol.a -L$(LIBDIR) -Wl,-soname,$@
 
 %.o:  %.c policy.h
 	$(CC) $(CFLAGS) $(TLSFLAGS) -c -o $@ $<

@@ -126,7 +126,7 @@ install: all
 	install -m 755 $(LIBSO) $(SHLIBDIR)
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
-	cd $(LIBDIR) && ln -sf ../../`basename $(SHLIBDIR)`/$(LIBSO) $(TARGET)
+	cd $(SHLIBDIR) && ln -sf $(LIBSO) $(TARGET)
 
 install-pywrap: pywrap
 	test -d $(PYLIBDIR)/site-packages/selinux || install -m 755 -d $(PYLIBDIR)/site-packages/selinux

libsemanage/src/Makefile +2 -2

diff -pruN selinux/libsemanage/src/Makefile selinux-13092011-patch-v5/libsemanage/src/Makefile
@@ -87,7 +87,7 @@ $(LIBA): $(OBJS)
 	$(RANLIB) $@
 
 $(LIBSO): $(LOBJS)
-	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -lsepol -lselinux -lbz2 -lustr -L$(LIBDIR) -Wl,-soname,$(LIBSO),--version-script=libsemanage.map,-z,defs
+	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -lsepol -lselinux -L$(LIBDIR) -lbz2 -lustr -Wl,-soname,$(LIBSO),--version-script=libsemanage.map,-z,defs
 	ln -sf $@ $(TARGET)
 
 $(LIBPC): $(LIBPC).in

@@ -139,7 +139,7 @@ install: all
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
 	test -f $(DEFAULT_SEMANAGE_CONF_LOCATION) || install -m 644 -D semanage.conf $(DEFAULT_SEMANAGE_CONF_LOCATION)
-	cd $(LIBDIR) && ln -sf $(LIBSO) $(TARGET)
+	cd $(SHLIBDIR) && ln -sf $(LIBSO) $(TARGET)
 
 install-pywrap: pywrap 
 	test -d $(PYLIBDIR)/site-packages || install -m 755 -d $(PYLIBDIR)/site-packages

libsepol/src/Makefile +1 -1

diff -pruN selinux/libsepol/src/Makefile selinux-13092011-patch-v5/libsepol/src/Makefile
@@ -43,7 +43,7 @@ install: all
 	install -m 755 $(LIBSO) $(SHLIBDIR)
 	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
 	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
-	cd $(LIBDIR) && ln -sf ../../`basename $(SHLIBDIR)`/$(LIBSO) $(TARGET)
+	cd $(SHLIBDIR) && ln -sf $(LIBSO) $(TARGET)
 
 relabel:
 	/sbin/restorecon $(SHLIBDIR)/$(LIBSO)

Makefile +7 -2

diff -pruN selinux/Makefile selinux-13092011-patch-v5/Makefile
@@ -3,10 +3,15 @@ PYSUBDIRS=libselinux libsemanage
 DISTCLEANSUBIDRS=libselinux libsemanage
 
 ifeq ($(DEBUG),1)
-	export CFLAGS = -g3 -O0 -gdwarf-2 -fno-strict-aliasing -Wall -Wshadow -Werror
-	export LDFLAGS = -g
+	CFLAGS += -g3 -O0 -gdwarf-2 -fno-strict-aliasing -Wall -Wshadow -Werror
+	LDFLAGS += -g
 endif
 
+CFLAGS += -I$(CURDIR)/libselinux/include -I$(CURDIR)/libsepol/include -I$(CURDIR)/libsemanage/include
+LDFLAGS += -L$(CURDIR)/libselinux/src -L$(CURDIR)/libsepol/src -L$(CURDIR)/libsemanage/src
+export CFLAGS
+export LDFLAGS
+
 all install relabel clean test indent:
 	@for subdir in $(SUBDIRS); do \
 		(cd $$subdir && $(MAKE) $@) || exit 1; \

policycoreutils/audit2allow/Makefile +2 -2

diff -pruN selinux/policycoreutils/audit2allow/Makefile selinux-13092011-patch-v5/policycoreutils/audit2allow/Makefile
@@ -1,9 +1,9 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 BINDIR ?= $(PREFIX)/bin
 LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 
 all: ;

policycoreutils/audit2why/Makefile +1 -1

diff -pruN selinux/policycoreutils/audit2why/Makefile selinux-13092011-patch-v5/policycoreutils/audit2why/Makefile
@@ -1,5 +1,5 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 BINDIR ?= $(PREFIX)/bin
 MANDIR ?= $(PREFIX)/share/man

policycoreutils/load_policy/Makefile +6 -4

diff -pruN selinux/policycoreutils/load_policy/Makefile selinux-13092011-patch-v5/policycoreutils/load_policy/Makefile
@@ -1,13 +1,15 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(DESTDIR)/sbin
 USRSBINDIR ?= $(PREFIX)/sbin
+INCLUDEDIR ?= $(PREFIX)/include
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lsepol -lselinux -L$(PREFIX)/lib
+override CFLAGS += $(LDFLAGS) -I$(INCLUDEDIR) -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+LDLIBS += -lsepol -lselinux -L$(LIBDIR)
 
 TARGETS=$(patsubst %.c,%,$(wildcard *.c))

policycoreutils/mcstrans/src/Makefile +1 -1

diff -pruN selinux/policycoreutils/mcstrans/src/Makefile selinux-13092011-patch-v5/policycoreutils/mcstrans/src/Makefile
@@ -28,7 +28,7 @@ override CFLAGS += -I../include -D_GNU_S
 all: $(PROG)
 
 $(PROG): $(PROG_OBJS)
-	$(CC) $(LDFLAGS) -pie -o $@ $^ -lselinux -lcap -lpcre $(LIBDIR)/libsepol.a
+	$(CC) $(LDFLAGS) -pie -o $@ $^ -lselinux ../../../libsepol/src/libsepol.a -L$(LIBDIR) -lcap -lpcre
 
 %.o:  %.c 
 	$(CC) $(CFLAGS) -fPIE -c -o $@ $<

policycoreutils/mcstrans/utils/Makefile +1 -1

diff -pruN selinux/policycoreutils/mcstrans/utils/Makefile selinux-13092011-patch-v5/policycoreutils/mcstrans/utils/Makefile
@@ -21,7 +21,7 @@ endif
 
 CFLAGS ?= -Wall
 override CFLAGS += -I../src -D_GNU_SOURCE
-LDLIBS += -L../src ../src/mcstrans.o ../src/mls_level.o -lselinux -lpcre $(LIBDIR)/libsepol.a
+LDLIBS += -L../src ../src/mcstrans.o ../src/mls_level.o -lselinux -lpcre ../../../libsepol/src/libsepol.a
 
 TARGETS=$(patsubst %.c,%,$(wildcard *.c))

policycoreutils/newrole/Makefile +6 -4

diff -pruN selinux/policycoreutils/newrole/Makefile selinux-13092011-patch-v5/policycoreutils/newrole/Makefile
@@ -1,9 +1,11 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 BINDIR ?= $(PREFIX)/bin
 MANDIR ?= $(PREFIX)/share/man
+INCLUDEDIR ?= $(PREFIX)/include
+LIBDIR ?= $(PREFIX)/lib
 ETCDIR ?= $(DESTDIR)/etc
-LOCALEDIR = /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 PAMH = $(shell ls /usr/include/security/pam_appl.h 2>/dev/null)
 AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null)
 # Enable capabilities to permit newrole to generate audit records.

@@ -22,8 +24,8 @@ VERSION = $(shell cat ../VERSION)
 
 CFLAGS ?= -Werror -Wall -W
 EXTRA_OBJS =
-override CFLAGS += -DVERSION=\"$(VERSION)\" $(LDFLAGS) -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lselinux -L$(PREFIX)/lib
+override CFLAGS += -DVERSION=\"$(VERSION)\" $(LDFLAGS) -I$(INCLUDEDIR) -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+LDLIBS += -lselinux -L$(LIBDIR)
 ifeq (${PAMH}, /usr/include/security/pam_appl.h)
 	override CFLAGS += -DUSE_PAM
 	EXTRA_OBJS += hashtab.o

policycoreutils/restorecond/Makefile +8 -6

diff -pruN selinux/policycoreutils/restorecond/Makefile selinux-13092011-patch-v5/policycoreutils/restorecond/Makefile
@@ -1,13 +1,15 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
-INITDIR = $(DESTDIR)/etc/rc.d/init.d
-SELINUXDIR = $(DESTDIR)/etc/selinux
+INCLUDEDIR ?= $(PREFIX)/include
+LIBDIR ?= $(PREFIX)/lib
+MANDIR ?= $(PREFIX)/share/man
+INITDIR ?= $(DESTDIR)/etc/rc.d/init.d
+SELINUXDIR ?= $(DESTDIR)/etc/selinux
 
 CFLAGS ?= -g -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64
-LDLIBS += -lselinux -L$(PREFIX)/lib
+override CFLAGS += -I$(INCLUDEDIR) -D_FILE_OFFSET_BITS=64
+LDLIBS += -lselinux -L$(LIBDIR)
 
 all: restorecond

policycoreutils/run_init/Makefile +6 -5

diff -pruN selinux/policycoreutils/run_init/Makefile selinux-13092011-patch-v5/policycoreutils/run_init/Makefile
@@ -1,16 +1,17 @@
-
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(PREFIX)/sbin
+INCLUDEDIR ?= $(PREFIX)/include
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
 ETCDIR ?= $(DESTDIR)/etc
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 PAMH = $(shell ls /usr/include/security/pam_appl.h 2>/dev/null)
 AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null)
 
 CFLAGS ?= -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lselinux -L$(PREFIX)/lib
+override CFLAGS += -I$(INCLUDEDIR) -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+LDLIBS += -lselinux -L$(LIBDIR)
 ifeq (${PAMH}, /usr/include/security/pam_appl.h)
 	override CFLAGS += -DUSE_PAM
 	LDLIBS += -lpam -lpam_misc

policycoreutils/sandbox/Makefile +8 -6

diff -pruN selinux/policycoreutils/sandbox/Makefile selinux-13092011-patch-v5/policycoreutils/sandbox/Makefile
@@ -1,14 +1,16 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
-INITDIR ?= ${DESTDIR}/etc/rc.d/init.d/
-SYSCONFDIR ?= ${DESTDIR}/etc/sysconfig
+PREFIX ?= $(DESTDIR)/usr
+INITDIR ?= $(DESTDIR)/etc/rc.d/init.d/
+SYSCONFDIR ?= $(DESTDIR)/etc/sysconfig
 BINDIR ?= $(PREFIX)/bin
 SBINDIR ?= $(PREFIX)/sbin
+INCLUDEDIR ?= $(PREFIX)/include
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 SHAREDIR ?= $(PREFIX)/share/sandbox
-override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DPACKAGE="\"policycoreutils\""
-LDLIBS += -lselinux -lcap-ng 
+override CFLAGS += $(LDFLAGS) -I$(INCLUDEDIR) -DPACKAGE="\"policycoreutils\""
+LDLIBS += -lselinux -L$(LIBDIR) -lcap-ng
 
 all: sandbox seunshare sandboxX.sh start

policycoreutils/scripts/genhomedircon.8 +12 ~~-28~~

diff -pruN selinux/policycoreutils/scripts/genhomedircon.8 selinux-13092011-patch-v5/policycoreutils/scripts/genhomedircon.8
@@ -1,37 +1,21 @@
-.\" Hey, Emacs! This is an -*- nroff -*- source file.
-.\" Copyright (c) 2010 Dan Walsh <[email protected]>
-.\"
-.\" This is free documentation; you can redistribute it and/or
-.\" modify it under the terms of the GNU General Public License as
-.\" published by the Free Software Foundation; either version 2 of
-.\" the License, or (at your option) any later version.
-.\"
-.\" The GNU General Public License's references to "object code"
-.\" and "executables" are to be interpreted as the output of any
-.\" document formatting or typesetting system, including
-.\" intermediate and printed output.
-.\"
-.\" This manual is distributed in the hope that it will be useful,
-.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
-.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-.\" GNU General Public License for more details.
-.\"
-.\" You should have received a copy of the GNU General Public
-.\" License along with this manual; if not, write to the Free
-.\" Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139,
-.\" USA.
-.\"
-.\"
-.TH GENHOMEDIRCON "8" "May 2010" "Security Enhanced Linux" "SELinux"
+.TH GENHOMEDIRCON "8" "Sep 2011" "Security Enhanced Linux" "SELinux"
 .SH NAME
 genhomedircon \- generate SELinux file context configuration entries for user home directories
 .SH SYNOPSIS
 .B genhomedircon
-is a script that executes semodule to rebuild policy and create the
-labels for HOMEDIRS based on home directories returned by the getpw calls.
+is a script that executes
+.B semodule
+to rebuild the SELinux policy and to create the
+labels for each user home directory based on directory paths returned by calls to getpwent().
 
-This functionality is enabled via the usepasswd flag in /etc/selinux/semanage.conf.
+This functionality can be disabled by using the "usepasswd" flag in /etc/selinux/semanage.conf
+(such flag can either take the value "true" or "false" and by default it is set to "true").
 
 .SH AUTHOR
 This manual page was written by
 .I Dan Walsh <[email protected]>
+
+The supporting functionality in the semanage library was written by Tresys Technology.
+
+.SH "SEE ALSO"
+semodule(8), getpwent(3), getpwent_r(3)

policycoreutils/scripts/Makefile +6 -3

diff -pruN selinux/policycoreutils/scripts/Makefile selinux-13092011-patch-v5/policycoreutils/scripts/Makefile
@@ -1,9 +1,9 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 BINDIR ?= $(PREFIX)/bin
 SBINDIR ?= $(PREFIX)/sbin
 MANDIR ?= $(PREFIX)/share/man
-LOCALEDIR ?= /usr/share/locale
+LOCALEDIR ?= $(PREFIX)/share/locale
 
 all: fixfiles genhomedircon chcat

@@ -11,7 +11,10 @@ install: all
 	-mkdir -p $(BINDIR)
 	install -m 755 chcat $(BINDIR)
 	install -m 755 fixfiles $(DESTDIR)/sbin
-	install -m 755 genhomedircon  $(SBINDIR)
+	@echo "#!/bin/sh" > genhomedircon
+	@echo >> genhomedircon
+	@echo "$(SBINDIR)/semodule -Bn" >> genhomedircon
+	install -m 755 genhomedircon $(SBINDIR)
 	-mkdir -p $(MANDIR)/man8
 	install -m 644 fixfiles.8 $(MANDIR)/man8/
 	install -m 644 genhomedircon.8 $(MANDIR)/man8/

policycoreutils/secon/Makefile +2 -2

diff -pruN selinux/policycoreutils/secon/Makefile selinux-13092011-patch-v5/policycoreutils/secon/Makefile
@@ -1,9 +1,9 @@
 # secon tool - command-line context
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
 MANDIR ?= $(PREFIX)/share/man
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 
 WARNS=-Werror -W -Wall -Wundef -Wshadow -Wpointer-arith -Wbad-function-cast -Wcast-align -Wwrite-strings -Waggregate-return -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -Wno-format-zero-length -Wformat-nonliteral -Wformat-security -Wfloat-equal
 VERSION = $(shell cat ../VERSION)

policycoreutils/semanage/Makefile +2 -2

diff -pruN selinux/policycoreutils/semanage/Makefile selinux-13092011-patch-v5/policycoreutils/semanage/Makefile
@@ -1,8 +1,8 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 LIBDIR ?= $(PREFIX)/lib
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
+MANDIR ?= $(PREFIX)/share/man
 PYLIBVER ?= $(shell python -c 'import sys;print "python%d.%d" % sys.version_info[0:2]')
 PYTHONLIBDIR ?= $(LIBDIR)/$(PYLIBVER)

policycoreutils/semodule/Makefile +2 -2

diff -pruN selinux/policycoreutils/semodule/Makefile selinux-13092011-patch-v5/policycoreutils/semodule/Makefile
@@ -2,8 +2,8 @@
 PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
-LIBDIR ?= ${PREFIX}/lib
+MANDIR ?= $(PREFIX)/share/man
+LIBDIR ?= $(PREFIX)/lib
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += -I$(INCLUDEDIR)

policycoreutils/semodule_deps/Makefile +3 -3

diff -pruN selinux/policycoreutils/semodule_deps/Makefile selinux-13092011-patch-v5/policycoreutils/semodule_deps/Makefile
@@ -1,13 +1,13 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += -I$(INCLUDEDIR)
-LDLIBS = $(LIBDIR)/libsepol.a
+LDLIBS = ../../libsepol/src/libsepol.a
 
 all: semodule_deps

policycoreutils/semodule_expand/Makefile +2 -2

diff -pruN selinux/policycoreutils/semodule_expand/Makefile selinux-13092011-patch-v5/policycoreutils/semodule_expand/Makefile
@@ -1,8 +1,8 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
 
 CFLAGS ?= -Werror -Wall -W

policycoreutils/semodule_link/Makefile +2 -2

diff -pruN selinux/policycoreutils/semodule_link/Makefile selinux-13092011-patch-v5/policycoreutils/semodule_link/Makefile
@@ -1,9 +1,9 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
 MANDIR ?= $(PREFIX)/share/man
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += -I$(INCLUDEDIR)

policycoreutils/semodule_package/Makefile +2 -2

diff -pruN selinux/policycoreutils/semodule_package/Makefile selinux-13092011-patch-v5/policycoreutils/semodule_package/Makefile
@@ -1,8 +1,8 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 BINDIR ?= $(PREFIX)/bin
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
 
 CFLAGS ?= -Werror -Wall -W

policycoreutils/sestatus/Makefile +6 -5

diff -pruN selinux/policycoreutils/sestatus/Makefile selinux-13092011-patch-v5/policycoreutils/sestatus/Makefile
@@ -1,12 +1,13 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
+INCLUDEDIR ?= $(PREFIX)/include
+MANDIR ?= $(PREFIX)/share/man
 ETCDIR ?= $(DESTDIR)/etc
-LIBDIR ?= ${PREFIX}/lib
+LIBDIR ?= $(PREFIX)/lib
 
-CFLAGS = -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64
+CFLAGS ?= -Werror -Wall -W
+override CFLAGS += -I$(INCLUDEDIR) -D_FILE_OFFSET_BITS=64
 LDLIBS = -lselinux -L$(LIBDIR)
 
 all: sestatus

policycoreutils/setfiles/Makefile +5 -4

diff -pruN selinux/policycoreutils/setfiles/Makefile selinux-13092011-patch-v5/policycoreutils/setfiles/Makefile
@@ -1,12 +1,13 @@
 # Installation directories.
-PREFIX ?= ${DESTDIR}/usr
+PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(DESTDIR)/sbin
-MANDIR = $(PREFIX)/share/man
+INCLUDEDIR ?= $(PREFIX)/include
+MANDIR ?= $(PREFIX)/share/man
 LIBDIR ?= $(PREFIX)/lib
 AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null)
 
-CFLAGS = -g -Werror -Wall -W
-override CFLAGS += -I$(PREFIX)/include
+CFLAGS ?= -g -Werror -Wall -W
+override CFLAGS += -I$(INCLUDEDIR)
 LDLIBS = -lselinux -lsepol -L$(LIBDIR)
 
 ifeq (${AUDITH}, /usr/include/libaudit.h)

policycoreutils/setsebool/Makefile +2 -2

diff -pruN selinux/policycoreutils/setsebool/Makefile selinux-13092011-patch-v5/policycoreutils/setsebool/Makefile
@@ -2,8 +2,8 @@
 PREFIX ?= $(DESTDIR)/usr
 INCLUDEDIR ?= $(PREFIX)/include
 SBINDIR ?= $(PREFIX)/sbin
-MANDIR = $(PREFIX)/share/man
-LIBDIR ?= ${PREFIX}/lib
+MANDIR ?= $(PREFIX)/share/man
+LIBDIR ?= $(PREFIX)/lib
 
 CFLAGS ?= -Werror -Wall -W
 override CFLAGS += -I$(INCLUDEDIR)

README +20 -0

diff -pruN selinux/README selinux-13092011-patch-v5/README
@@ -0,0 +1,20 @@
+INSTALLATION:
+
+Type "make" to build and then "make install" to install.
+
+---
+
+The environment variables CFLAGS and LDFLAGS can be passed to "make" to use custom compiler
+and/or linker flags (for example: CFLAGS="-O3" LDFLAGS="" make).
+
+The environment variables LIBDIR and SHLIBDIR can be passed to "make" in order to configure
+different directories for the libraries (e.g. LIBDIR=/usr/lib64 and SHLIBDIR=/usr/lib64
+on 64-bit systems).
+
+The environment variable PREFIX can be passed to "make" in order to configure an install
+prefix other than "/usr".
+
+The environment variable DESTDIR can be passed to "make" in order to configure a
+specific directory to be used as the root installation directory.
+
+Please see the Makefile(s) for other environment variables that can be used.

Or for Eric, if he only needs the relative diff, here it is:

policycoreutils/restorecond/Makefile +1 -0

diff -pruN selinux-13092011-patch-v4/policycoreutils/restorecond/Makefile selinux-13092011-patch-v5/policycoreutils/restorecond/Makefile
@@ -2,6 +2,7 @@
 PREFIX ?= $(DESTDIR)/usr
 SBINDIR ?= $(PREFIX)/sbin
 INCLUDEDIR ?= $(PREFIX)/include
+LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
 INITDIR ?= $(DESTDIR)/etc/rc.d/init.d
 SELINUXDIR ?= $(DESTDIR)/etc/selinux

I wish to remind you once again that the proposed solution for creating the links to the versioned shared libraries has not been fully tested/agreed yet.

In fact, as Stephen pointed out there is a risk that using absolute symbolic linking instead of relative symbolic linking could actually result in broken links being distributed in binary packages (i.e. pointing to the full path on the build system).

Regards,

Guido

Stephen Smalley

2011-09-15 12:56 UTC #60 lore raw

Re: [PATCH v5] Fix includes for userspace tools and libraries (and possible security issue)

Quoted 4 lines · Guido Trentalancia

Quoted 1 line
The above will break when building checkpolicy separately.
Yes it will. But it also avoids linking an existing old static library when building from the whole git bundle.

You can already avoid that problem by building with make DESTDIR=~/out install (which will then install libsepol.a under ~/out/usr/lib and use it rather than the system one when linking subsequent libraries and programs), so our current build procedure isn't broken, just the newly proposed one.

Quoted 3 lines

Before creating each release of the separate components, that piece of patch could be reverted or otherwise a script could invoke sed on the affected Makefiles.

I don't see that as a maintainable solution. What other upstream projects patch their Makefiles before release and thus ship a different set of Makefiles than the ones they are using themselves for testing?

Signature · 8 lines

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Guido Trentalancia

author

2011-09-15 16:04 UTC #61 lore raw

Re: [PATCH v5] Fix includes for userspace tools and libraries (and possible security issue)

Hi Stephen.

Quoted 11 lines · Stephen Smalley

Quoted 4 lines · Guido Trentalancia
Quoted 1 line
The above will break when building checkpolicy separately.
Yes it will. But it also avoids linking an existing old static library when building from the whole git bundle.
You can already avoid that problem by building with make DESTDIR=~/out install (which will then install libsepol.a under ~/out/usr/lib and use it rather than the system one when linking subsequent libraries and programs), so our current build procedure isn't broken, just the newly proposed one.

What you suggest is:

make DESTDIR=~/out install

which is equivalent to:

make DESTDIR=/opt/out (for those whom do not have the tilde ~ handy on their keyboads)

which results in an error caused by wrong compiler link flags being used by the current SELinux userspace build system (wrong shared library path to be more precise, i.e. wrong path after -L flag):

...
make -C src install
make[2]: Entering directory
`/usr/src/selinux-userspace/git/selinux-test/libsemanage/src'
cc -O3 -march=corei7 -mtune=corei7 -fPIC -I../include
-I/opt/out/usr/include -D_GNU_SOURCE -shared -o libsemanage.so.1
utilities.lo user_extra_record.lo modules.lo boolean_record.lo
ports_file.lo interfaces_file.lo interfaces_local.lo seuser_record.lo
user_base_record.lo booleans_file.lo genhomedircon.lo fcontexts_file.lo
booleans_local.lo database_llist.lo parse_utils.lo nodes_policydb.lo
policy_components.lo users_extra_file.lo debug.lo fcontext_record.lo
database_file.lo seusers_file.lo fcontexts_local.lo ports_local.lo
direct_api.lo seusers_local.lo context_record.lo nodes_file.lo
port_record.lo users_base_policydb.lo semanage_store.lo
users_base_file.lo fcontexts_policy.lo booleans_activedb.lo
users_policy.lo handle.lo booleans_policydb.lo nodes_local.lo
interfaces_policy.lo database.lo users_local.lo ports_policy.lo
booleans_active.lo nodes_policy.lo booleans_policy.lo users_join.lo
user_record.lo seusers_policy.lo database_join.lo database_activedb.lo
ports_policydb.lo interfaces_policydb.lo database_policydb.lo
iface_record.lo node_record.lo conf-scan.lo conf-parse.lo -lsepol
-lselinux -lbz2 -lustr -L/usr/lib64/
-Wl,-soname,libsemanage.so.1,--version-script=libsemanage.map,-z,defs
/usr/lib/gcc/x86_64-unknown-linux-gnu/4.6.1/../../../../x86_64-unknown-linux-gnu/bin/ld: /usr/lib64//libselinux.a(selinux_config.o): relocation R_X86_64_32 against `.rodata.str1.1' can not be used when making a shared object; recompile with -fPIC /usr/lib64//libselinux.a: could not read symbols: Bad value
collect2: ld returned 1 exit status
make[2]: *** [libsemanage.so.1] Error 1
make[2]: Leaving directory
`/usr/src/selinux-userspace/git/selinux-test/libsemanage/src'
make[1]: *** [install] Error 2
make[1]: Leaving directory
`/usr/src/selinux-userspace/git/selinux-test/libsemanage'
make: *** [install] Error 1

It is sourcing dynamic libraries from /usr/lib64 or in other words from LIBDIR, while you would expect it to source dynamic libraries from /opt/out/usr/lib64 (or ~/out/usr/lib64 for the lucky ones that have the tilde on their keyboard).

Quoted 7 lines

Quoted 3 lines
Before creating each release of the separate components, that piece of patch could be reverted or otherwise a script could invoke sed on the affected Makefiles.
I don't see that as a maintainable solution. What other upstream projects patch their Makefiles before release and thus ship a different set of Makefiles than the ones they are using themselves for testing?

No other project that I am aware of is going to patch the Makefile before releasing versions out. But also no other project that I am aware of is releasing individual components from a unique repository base.

Guido

Stephen Smalley

2011-09-15 16:35 UTC #62 lore raw

Re: [PATCH v5] Fix includes for userspace tools and libraries (and possible security issue)

Quoted 38 lines · Guido Trentalancia

which results in an error caused by wrong compiler link flags being used by the current SELinux userspace build system (wrong shared library path to be more precise, i.e. wrong path after -L flag):
...
make -C src install
make[2]: Entering directory `/usr/src/selinux-userspace/git/selinux-test/libsemanage/src' cc -O3 -march=corei7 -mtune=corei7 -fPIC -I../include
-I/opt/out/usr/include -D_GNU_SOURCE -shared -o libsemanage.so.1
utilities.lo user_extra_record.lo modules.lo boolean_record.lo ports_file.lo interfaces_file.lo interfaces_local.lo seuser_record.lo user_base_record.lo booleans_file.lo genhomedircon.lo fcontexts_file.lo booleans_local.lo database_llist.lo parse_utils.lo nodes_policydb.lo policy_components.lo users_extra_file.lo debug.lo fcontext_record.lo database_file.lo seusers_file.lo fcontexts_local.lo ports_local.lo direct_api.lo seusers_local.lo context_record.lo nodes_file.lo port_record.lo users_base_policydb.lo semanage_store.lo users_base_file.lo fcontexts_policy.lo booleans_activedb.lo users_policy.lo handle.lo booleans_policydb.lo nodes_local.lo interfaces_policy.lo database.lo users_local.lo ports_policy.lo booleans_active.lo nodes_policy.lo booleans_policy.lo users_join.lo user_record.lo seusers_policy.lo database_join.lo database_activedb.lo ports_policydb.lo interfaces_policydb.lo database_policydb.lo iface_record.lo node_record.lo conf-scan.lo conf-parse.lo -lsepol
(quoted diff) +0 -2
-lselinux -lbz2 -lustr -L/usr/lib64/
-Wl,-soname,libsemanage.so.1,--version-script=libsemanage.map,-z,defs
/usr/lib/gcc/x86_64-unknown-linux-gnu/4.6.1/../../../../x86_64-unknown-linux-gnu/bin/ld: /usr/lib64//libselinux.a(selinux_config.o): relocation R_X86_64_32 against `.rodata.str1.1' can not be used when making a shared object; recompile with -fPIC /usr/lib64//libselinux.a: could not read symbols: Bad value
collect2: ld returned 1 exit status
make[2]: *** [libsemanage.so.1] Error 1
make[2]: Leaving directory
`/usr/src/selinux-userspace/git/selinux-test/libsemanage/src'
make[1]: *** [install] Error 2
make[1]: Leaving directory
`/usr/src/selinux-userspace/git/selinux-test/libsemanage'
make: *** [install] Error 1

Quoted 4 lines

It is sourcing dynamic libraries from /usr/lib64 or in other words from LIBDIR, while you would expect it to source dynamic libraries from /opt/out/usr/lib64 (or ~/out/usr/lib64 for the lucky ones that have the tilde on their keyboard).

Is that with your patched tree? Because I don't get that error, and it doesn't make sense based on my reading of the current libsemanage/src/Makefile and how it sets LIBDIR based on DESTDIR.

Signature · 8 lines

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Guido Trentalancia

author

2011-09-15 17:03 UTC #63 lore raw

Re: [PATCH v5] Fix includes for userspace tools and libraries (and possible security issue)

Hello Stephen.

Quoted 39 lines · Stephen Smalley

Quoted 38 lines · Guido Trentalancia
which results in an error caused by wrong compiler link flags being used by the current SELinux userspace build system (wrong shared library path to be more precise, i.e. wrong path after -L flag):
...
make -C src install
make[2]: Entering directory `/usr/src/selinux-userspace/git/selinux-test/libsemanage/src' cc -O3 -march=corei7 -mtune=corei7 -fPIC -I../include
-I/opt/out/usr/include -D_GNU_SOURCE -shared -o libsemanage.so.1
utilities.lo user_extra_record.lo modules.lo boolean_record.lo ports_file.lo interfaces_file.lo interfaces_local.lo seuser_record.lo user_base_record.lo booleans_file.lo genhomedircon.lo fcontexts_file.lo booleans_local.lo database_llist.lo parse_utils.lo nodes_policydb.lo policy_components.lo users_extra_file.lo debug.lo fcontext_record.lo database_file.lo seusers_file.lo fcontexts_local.lo ports_local.lo direct_api.lo seusers_local.lo context_record.lo nodes_file.lo port_record.lo users_base_policydb.lo semanage_store.lo users_base_file.lo fcontexts_policy.lo booleans_activedb.lo users_policy.lo handle.lo booleans_policydb.lo nodes_local.lo interfaces_policy.lo database.lo users_local.lo ports_policy.lo booleans_active.lo nodes_policy.lo booleans_policy.lo users_join.lo user_record.lo seusers_policy.lo database_join.lo database_activedb.lo ports_policydb.lo interfaces_policydb.lo database_policydb.lo iface_record.lo node_record.lo conf-scan.lo conf-parse.lo -lsepol
(quoted diff) +0 -2
-lselinux -lbz2 -lustr -L/usr/lib64/
-Wl,-soname,libsemanage.so.1,--version-script=libsemanage.map,-z,defs
/usr/lib/gcc/x86_64-unknown-linux-gnu/4.6.1/../../../../x86_64-unknown-linux-gnu/bin/ld: /usr/lib64//libselinux.a(selinux_config.o): relocation R_X86_64_32 against `.rodata.str1.1' can not be used when making a shared object; recompile with -fPIC /usr/lib64//libselinux.a: could not read symbols: Bad value
collect2: ld returned 1 exit status
make[2]: *** [libsemanage.so.1] Error 1
make[2]: Leaving directory
`/usr/src/selinux-userspace/git/selinux-test/libsemanage/src'
make[1]: *** [install] Error 2
make[1]: Leaving directory
`/usr/src/selinux-userspace/git/selinux-test/libsemanage'
make: *** [install] Error 1

Quoted 6 lines

Quoted 4 lines
It is sourcing dynamic libraries from /usr/lib64 or in other words from LIBDIR, while you would expect it to source dynamic libraries from /opt/out/usr/lib64 (or ~/out/usr/lib64 for the lucky ones that have the tilde on their keyboard).
Is that with your patched tree?

Nope, with original from git.

With my patch everything works all right. Otherwise why did I create the patch in the first place ??

Quoted 3 lines

Because I don't get that error, and it
doesn't make sense based on my reading of the current libsemanage/src/Makefile and how it sets LIBDIR based on DESTDIR.

I only forgot to mention the flags that I used:

CFLAGS="-O3 -march=corei7 -mtune=corei7" LIBDIR=/usr/lib64 SHLIBDIR=/usr/lib64 DESTDIR=/opt/out make install

Regards,

Guido

Stephen Smalley

2011-09-15 17:16 UTC #64 lore raw

Re: [PATCH v5] Fix includes for userspace tools and libraries (and possible security issue)

Quoted 4 lines · Guido Trentalancia

Nope, with original from git.
With my patch everything works all right. Otherwise why did I create the patch in the first place ??

I don't know. As I've said, make DESTDIR=~/out install worked fine until recently, and with Eric's patch 1/2 to fix up the recent breakage of the libselinux Makefile and my just-posted patch for the sandbox Makefile, I can once again do a make DESTDIR=~/out install on a system without the system -devel packages.

Quoted 4 lines

I only forgot to mention the flags that I used:
CFLAGS="-O3 -march=corei7 -mtune=corei7" LIBDIR=/usr/lib64 SHLIBDIR=/usr/lib64 DESTDIR=/opt/out make install

So it is picking up the wrong libs because you told it to do so by separately specifying incompatible DESTDIR and LIBDIR/SHLIBDIR definitions. Either only specify DESTDIR and let it automatically derive LIBDIR/SHLIBDIR underneath, or specify them all with the same prefix.

Signature · 8 lines

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Guido Trentalancia

author

2011-09-15 17:26 UTC #65 lore raw

Re: [PATCH v5] Fix includes for userspace tools and libraries (and possible security issue)

Quoted 14 lines · Stephen Smalley

Quoted 4 lines · Guido Trentalancia
Nope, with original from git.
With my patch everything works all right. Otherwise why did I create the patch in the first place ??
I don't know. As I've said, make DESTDIR=~/out install worked fine until recently, and with Eric's patch 1/2 to fix up the recent breakage of the libselinux Makefile and my just-posted patch for the sandbox Makefile, I can once again do a make DESTDIR=~/out install on a system without the system -devel packages.
Quoted 2 lines
I only forgot to mention the flags that I used:

Quoted 8 lines

Quoted 2 lines
CFLAGS="-O3 -march=corei7 -mtune=corei7" LIBDIR=/usr/lib64 SHLIBDIR=/usr/lib64 DESTDIR=/opt/out make install
So it is picking up the wrong libs because you told it to do so by separately specifying incompatible DESTDIR and LIBDIR/SHLIBDIR definitions. Either only specify DESTDIR and let it automatically derive LIBDIR/SHLIBDIR underneath, or specify them all with the same prefix.

My requirements are that I am on a 64-bit system and therefore I need/want to distiguish between "lib" and "lib64". I do not need/care about distinguishing between SHLIBDIR and LIBDIR. I am fine either without a DESTDIR or with a DESTDIR as you suggested (both are problematic).

And it breaks again after that...

Guido

Stephen Smalley

2011-09-15 18:14 UTC #66 lore raw

Re: [PATCH v5] Fix includes for userspace tools and libraries (and possible security issue)

Quoted 5 lines · Guido Trentalancia

My requirements are that I am on a 64-bit system and therefore I need/want to distiguish between "lib" and "lib64". I do not need/care about distinguishing between SHLIBDIR and LIBDIR. I am fine either without a DESTDIR or with a DESTDIR as you suggested (both are problematic).

rm -rf ~/out
make DESTDIR=~/out install
rm -rf ~/out
make DESTDIR=~/out LIBDIR=~/out/usr/lib64 SHLIBDIR=~/out/lib64 install

Both work fine for me with current selinux git master branch + Eric's patch 1/2 libselinux + my policycoreutils sandbox patch.

Quoted 1 line

And it breaks again after that...

You'd have to show where it fails. It seems to work for me and Eric.

Signature · 8 lines

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Guido Trentalancia

author

2011-09-15 19:12 UTC #67 lore raw

Re: [PATCH v5] Fix includes for userspace tools and libraries

Quoted 7 lines · Stephen Smalley

Quoted 5 lines · Guido Trentalancia
My requirements are that I am on a 64-bit system and therefore I need/want to distiguish between "lib" and "lib64". I do not need/care about distinguishing between SHLIBDIR and LIBDIR. I am fine either without a DESTDIR or with a DESTDIR as you suggested (both are problematic).

Quoted 5 lines

rm -rf ~/out
make DESTDIR=~/out install
rm -rf ~/out
make DESTDIR=~/out LIBDIR=~/out/usr/lib64 SHLIBDIR=~/out/lib64 install

I did hit other issues too. Lesson learned was: add -lbz2 -lustr to LDLIBS in policycoreutils/{semodule,setsebool}/Makefile and replace = with ?= in checkpolicy/test/Makefile

Unfortunately none of the above is exactly what I am looking for...

I am looking to install directly under the root live filesystem. So DESTDIR is not going to be used in my specific case. And I need LIBDIR=SHLIBDIR=/usr/lib64. Also, I'd like to first type "make" to build only and then type "make install" to get things installed.

rm -rf /usr/include/selinux/ ; rm -rf /usr/include/semanage/ ; rm -rf /usr/include/sepol/ ; rm -f /usr/lib64/libsepol.* ; rm -f /usr/lib64/libsemanage.* ; CFLAGS="-O3 -march=corei7 -mtune=corei7" LIBDIR=/usr/lib64 SHLIBDIR=/usr/lib64 make install

Works with "install" target only with latest git. So it is not possible to build only first and then install.

Quoted 6 lines

Both work fine for me with current selinux git master branch + Eric's patch 1/2 libselinux + my policycoreutils sandbox patch.
Quoted 1 line
And it breaks again after that...
You'd have to show where it fails. It seems to work for me and Eric.

Regards,

Guido

Stephen Smalley

2011-09-15 20:00 UTC #68 lore raw

Re: [PATCH v5] Fix includes for userspace tools and libraries

Quoted 16 lines · Guido Trentalancia

I did hit other issues too. Lesson learned was: add -lbz2 -lustr to LDLIBS in policycoreutils/{semodule,setsebool}/Makefile and replace = with ?= in checkpolicy/test/Makefile
Unfortunately none of the above is exactly what I am looking for...
I am looking to install directly under the root live filesystem. So DESTDIR is not going to be used in my specific case. And I need LIBDIR=SHLIBDIR=/usr/lib64. Also, I'd like to first type "make" to build only and then type "make install" to get things installed.
rm -rf /usr/include/selinux/ ; rm -rf /usr/include/semanage/ ; rm
(quoted diff) +0 -2
-rf /usr/include/sepol/ ; rm -f /usr/lib64/libsepol.* ; rm
-f /usr/lib64/libsemanage.* ; CFLAGS="-O3 -march=corei7 -mtune=corei7"
LIBDIR=/usr/lib64 SHLIBDIR=/usr/lib64 make install

Quoted 2 lines

Works with "install" target only with latest git. So it is not possible to build only first and then install.

Yes, if you want that, you'll need further changes. But rather than changing the component Makefiles in a manner that won't work for separate builds, how about defining some top-level variables and using them throughout, with conditional definitions (?=) within the individual Makefiles so that the separate builds still work. Like the following (incomplete, but gives the idea):

Makefile +4 -0

index 09c2c1e..f68a2b2 100644
@@ -7,6 +7,10 @@ ifeq ($(DEBUG),1)
 	export LDFLAGS = -g
 endif
 
+export LIBSEPOLSTATIC=$(CURDIR)/libsepol/src/libsepol.a
+export EXTRA_INCLUDES=-I$(CURDIR)/libsepol/include -I$(CURDIR)/libselinux/include -I$(CURDIR)/libsemanage/include
+export EXTRA_LIBS=-L$(CURDIR)/libsepol/src -L$(CURDIR)/libselinux/src -L$(CURDIR)/libsemanage/src
+
 all install relabel clean test indent:
 	@for subdir in $(SUBDIRS); do \
 		(cd $$subdir && $(MAKE) $@) || exit 1; \

libselinux/src/Makefile +4 -3

index 7680008..4651616 100644
@@ -7,7 +7,8 @@ PYPREFIX ?= $(notdir $(PYTHON))
 # Installation directories.
 PREFIX ?= $(DESTDIR)/usr
 LIBDIR ?= $(PREFIX)/lib
-SHLIBDIR ?= $(PREFIX)/lib
+LIBSEPOLSTATIC ?= $(LIBDIR)/libsepol.a
+SHLIBDIR ?= $(DESTDIR)/lib
 INCLUDEDIR ?= $(PREFIX)/include
 PYLIBVER ?= $(shell $(PYTHON) -c 'import sys;print("python%d.%d" % sys.version_info[0:2])')
 PYINC ?= $(shell pkg-config --cflags $(PYPREFIX))

@@ -54,7 +55,7 @@ SRCS= $(filter-out $(UNUSED_SRCS) $(GENERATED) audit2why.c, $(wildcard *.c))
 OBJS= $(patsubst %.c,%.o,$(SRCS))
 LOBJS= $(patsubst %.c,%.lo,$(SRCS))
 CFLAGS ?= -Werror -Wall -W -Wundef -Wshadow -Wmissing-noreturn -Wmissing-format-attribute
-override CFLAGS += -I../include -I$(INCLUDEDIR) -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 $(EMFLAGS)
+override CFLAGS += -I../include -I$(INCLUDEDIR) $(EXTRA_INCLUDES) -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 $(EMFLAGS)
 RANLIB=ranlib
 
 ARCH := $(patsubst i%86,i386,$(shell uname -m))

@@ -102,7 +103,7 @@ $(AUDIT2WHYLOBJ): audit2why.c
 	$(CC) $(filter-out -Werror, $(CFLAGS)) $(PYINC) -fPIC -DSHARED -c -o $@ $<
 
 $(AUDIT2WHYSO): $(AUDIT2WHYLOBJ)
-	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux ${LIBDIR}/libsepol.a -L$(LIBDIR) -Wl,-soname,$@
+	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux $(LIBSEPOLSTATIC) -L$(LIBDIR) -Wl,-soname,$@
 
 %.o:  %.c policy.h
 	$(CC) $(CFLAGS) $(TLSFLAGS) -c -o $@ $<

libsemanage/src/Makefile +2 -2

index d9120c0..44962e6 100644
@@ -55,7 +55,7 @@ OBJS= $(patsubst %.c,%.o,$(SRCS)) conf-scan.o conf-parse.o
 LOBJS= $(patsubst %.c,%.lo,$(SRCS)) conf-scan.lo conf-parse.lo
 CFLAGS ?= -Werror -Wall -W -Wundef -Wshadow -Wmissing-noreturn -Wmissing-format-attribute
 
-override CFLAGS += -I../include -I$(INCLUDEDIR) -D_GNU_SOURCE 
+override CFLAGS += -I../include -I$(INCLUDEDIR) $(EXTRA_INCLUDES) -D_GNU_SOURCE 
 RANLIB=ranlib
 
 SWIG = swig -Wall -python -o $(SWIGCOUT) -outdir ./

@@ -87,7 +87,7 @@ $(LIBA): $(OBJS)
 	$(RANLIB) $@
 
 $(LIBSO): $(LOBJS)
-	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -lsepol -lselinux -lbz2 -lustr -L$(LIBDIR) -Wl,-soname,$(LIBSO),--version-script=libsemanage.map,-z,defs
+	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -lsepol -lselinux -lbz2 -lustr $(EXTRA_LIBS) -L$(LIBDIR) -Wl,-soname,$(LIBSO),--version-script=libsemanage.map,-z,defs
 	ln -sf $@ $(TARGET)
 
 $(LIBPC): $(LIBPC).in

Signature · 8 lines

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Guido Trentalancia

author

2011-09-15 20:32 UTC #69 lore raw

Re: [PATCH v5] Fix includes for userspace tools and libraries

Hello Stephen.

Quoted 17 lines · Stephen Smalley

Quoted 16 lines · Guido Trentalancia
I did hit other issues too. Lesson learned was: add -lbz2 -lustr to LDLIBS in policycoreutils/{semodule,setsebool}/Makefile and replace = with ?= in checkpolicy/test/Makefile
Unfortunately none of the above is exactly what I am looking for...
I am looking to install directly under the root live filesystem. So DESTDIR is not going to be used in my specific case. And I need LIBDIR=SHLIBDIR=/usr/lib64. Also, I'd like to first type "make" to build only and then type "make install" to get things installed.
rm -rf /usr/include/selinux/ ; rm -rf /usr/include/semanage/ ; rm
(quoted diff) +0 -2
-rf /usr/include/sepol/ ; rm -f /usr/lib64/libsepol.* ; rm
-f /usr/lib64/libsemanage.* ; CFLAGS="-O3 -march=corei7 -mtune=corei7"
LIBDIR=/usr/lib64 SHLIBDIR=/usr/lib64 make install

Quoted 4 lines

Quoted 2 lines
Works with "install" target only with latest git. So it is not possible to build only first and then install.
Yes, if you want that, you'll need further changes.

It's not me specifically wanting that, I think...

Quoted 12 lines

But rather than
changing the component Makefiles in a manner that won't work for separate builds, how about defining some top-level variables and using them throughout, with conditional definitions (?=) within the individual Makefiles so that the separate builds still work. Like the following (incomplete, but gives the idea):
Makefile +0 -0
index 09c2c1e..f68a2b2 100644

Makefile ifeq ($(DEBUG),1) · line 12

Quoted 6 lines

Makefile +3 -0

@@ -7,6 +7,10 @@ ifeq ($(DEBUG),1)
 	export LDFLAGS = -g
 endif
 
+export LIBSEPOLSTATIC=$(CURDIR)/libsepol/src/libsepol.a
+export EXTRA_INCLUDES=-I$(CURDIR)/libsepol/include -I$(CURDIR)/libselinux/include -I$(CURDIR)/libsemanage/include
+export EXTRA_LIBS=-L$(CURDIR)/libsepol/src -L$(CURDIR)/libselinux/src -L$(CURDIR)/libsemanage/src

Yes, I like the idea. I would only really change EXTRA to LOCAL for better readability.

libselinux/src/Makefile PYPREFIX ?= $(notdir $(PYTHON)) · line 10

Quoted 13 lines

Makefile +0 -0

 all install relabel clean test indent:
 	@for subdir in $(SUBDIRS); do \
 		(cd $$subdir && $(MAKE) $@) || exit 1; \

libselinux/src/Makefile +1 -1

index 7680008..4651616 100644
@@ -7,7 +7,8 @@ PYPREFIX ?= $(notdir $(PYTHON))
 # Installation directories.
 PREFIX ?= $(DESTDIR)/usr
 LIBDIR ?= $(PREFIX)/lib
-SHLIBDIR ?= $(PREFIX)/lib
+LIBSEPOLSTATIC ?= $(LIBDIR)/libsepol.a

Hopefully the above won't override the exported one from top-level...

libselinux/src/Makefile SRCS= $(filter-out $(UNUSED_SRCS) $(GENERATED) audit2why.c, $(wildcard *.c)) · line 58

Quoted 10 lines

libselinux/src/Makefile +2 -1

+SHLIBDIR ?= $(DESTDIR)/lib
 INCLUDEDIR ?= $(PREFIX)/include
 PYLIBVER ?= $(shell $(PYTHON) -c 'import sys;print("python%d.%d" % sys.version_info[0:2])')
 PYINC ?= $(shell pkg-config --cflags $(PYPREFIX))

@@ -54,7 +55,7 @@ SRCS= $(filter-out $(UNUSED_SRCS) $(GENERATED) audit2why.c, $(wildcard *.c))
 OBJS= $(patsubst %.c,%.o,$(SRCS))
 LOBJS= $(patsubst %.c,%.lo,$(SRCS))
 CFLAGS ?= -Werror -Wall -W -Wundef -Wshadow -Wmissing-noreturn -Wmissing-format-attribute
-override CFLAGS += -I../include -I$(INCLUDEDIR) -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 $(EMFLAGS)
+override CFLAGS += -I../include -I$(INCLUDEDIR) $(EXTRA_INCLUDES) -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 $(EMFLAGS)

It seems to me that you are giving the precedence to the system-wide includes. We want the EXTRA/LOCAL ones to have precedence over the system-wide ones, with the fall-back only for released components (which won't have EXTRA/LOCAL passed to them from a top-level Makefile).

libselinux/src/Makefile $(AUDIT2WHYLOBJ): audit2why.c · line 106

Quoted 9 lines

libselinux/src/Makefile +1 -1

 RANLIB=ranlib
 
 ARCH := $(patsubst i%86,i386,$(shell uname -m))

@@ -102,7 +103,7 @@ $(AUDIT2WHYLOBJ): audit2why.c
 	$(CC) $(filter-out -Werror, $(CFLAGS)) $(PYINC) -fPIC -DSHARED -c -o $@ $<
 
 $(AUDIT2WHYSO): $(AUDIT2WHYLOBJ)
-	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux ${LIBDIR}/libsepol.a -L$(LIBDIR) -Wl,-soname,$@
+	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux $(LIBSEPOLSTATIC) -L$(LIBDIR) -Wl,-soname,$@

As long as the locally-defined LIBSEPOLSTATIC did not override the top-level exported one for builds from the whole git bundle (see above)...

libsemanage/src/Makefile OBJS= $(patsubst %.c,%.o,$(SRCS)) conf-scan.o conf-parse.o · line 58

Quoted 12 lines

libselinux/src/Makefile +0 -0

 %.o:  %.c policy.h
 	$(CC) $(CFLAGS) $(TLSFLAGS) -c -o $@ $<

libsemanage/src/Makefile +1 -1

index d9120c0..44962e6 100644
@@ -55,7 +55,7 @@ OBJS= $(patsubst %.c,%.o,$(SRCS)) conf-scan.o conf-parse.o
 LOBJS= $(patsubst %.c,%.lo,$(SRCS)) conf-scan.lo conf-parse.lo
 CFLAGS ?= -Werror -Wall -W -Wundef -Wshadow -Wmissing-noreturn -Wmissing-format-attribute
 
-override CFLAGS += -I../include -I$(INCLUDEDIR) -D_GNU_SOURCE 
+override CFLAGS += -I../include -I$(INCLUDEDIR) $(EXTRA_INCLUDES) -D_GNU_SOURCE

See above for precedence of flags (search order).

libsemanage/src/Makefile $(LIBA): $(OBJS) · line 90

Quoted 9 lines

libsemanage/src/Makefile +1 -1

 RANLIB=ranlib
 
 SWIG = swig -Wall -python -o $(SWIGCOUT) -outdir ./

@@ -87,7 +87,7 @@ $(LIBA): $(OBJS)
 	$(RANLIB) $@
 
 $(LIBSO): $(LOBJS)
-	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -lsepol -lselinux -lbz2 -lustr -L$(LIBDIR) -Wl,-soname,$(LIBSO),--version-script=libsemanage.map,-z,defs
+	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -lsepol -lselinux -lbz2 -lustr $(EXTRA_LIBS) -L$(LIBDIR) -Wl,-soname,$(LIBSO),--version-script=libsemanage.map,-z,defs

You already reminded me that the order does not matter to ld, I hope the same is true for cpp and -I (see above).

libsemanage/src/Makefile $(LIBA): $(OBJS) · line 93

Quoted 3 lines

libsemanage/src/Makefile +0 -0
 	ln -sf $@ $(TARGET)
 
 $(LIBPC): $(LIBPC).in

If you decide to go for this solution there might be other minor things from my original patch that might be worth importing.

Regards,

Guido

Stephen Smalley

2011-09-16 12:39 UTC #70 lore raw

Re: [PATCH v5] Fix includes for userspace tools and libraries

Quoted 4 lines · Guido Trentalancia

Quoted 4 lines
libselinux/src/Makefile +0 -0
index 7680008..4651616 100644

Quoted 8 lines

libselinux/src/Makefile PYPREFIX ?= $(notdir $(PYTHON)) · line 10
Quoted 6 lines
libselinux/src/Makefile +1 -1
@@ -7,7 +7,8 @@ PYPREFIX ?= $(notdir $(PYTHON))
 # Installation directories.
 PREFIX ?= $(DESTDIR)/usr
 LIBDIR ?= $(PREFIX)/lib
-SHLIBDIR ?= $(PREFIX)/lib
+LIBSEPOLSTATIC ?= $(LIBDIR)/libsepol.a
Hopefully the above won't override the exported one from top-level...

It won't, because we use the ?= operator above. So it will take effect if building in the libselinux directory, as for a per-package build, not if building from top-level.

Quoted 11 lines

libselinux/src/Makefile SRCS= $(filter-out $(UNUSED_SRCS) $(GENERATED) audit2why.c, $(wildcard *.c)) · line 58
Quoted 6 lines
libselinux/src/Makefile +1 -1
@@ -54,7 +55,7 @@ SRCS= $(filter-out $(UNUSED_SRCS) $(GENERATED) audit2why.c, $(wildcard *.c))
 OBJS= $(patsubst %.c,%.o,$(SRCS))
 LOBJS= $(patsubst %.c,%.lo,$(SRCS))
 CFLAGS ?= -Werror -Wall -W -Wundef -Wshadow -Wmissing-noreturn -Wmissing-format-attribute
-override CFLAGS += -I../include -I$(INCLUDEDIR) -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 $(EMFLAGS)
+override CFLAGS += -I../include -I$(INCLUDEDIR) $(EXTRA_INCLUDES) -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 $(EMFLAGS)
It seems to me that you are giving the precedence to the system-wide includes. We want the EXTRA/LOCAL ones to have precedence over the system-wide ones, with the fall-back only for released components (which won't have EXTRA/LOCAL passed to them from a top-level Makefile).

See the description of -I in the man page for gcc. The above will have the desired effect.

Quoted 10 lines

libselinux/src/Makefile $(AUDIT2WHYLOBJ): audit2why.c · line 106
Quoted 6 lines
libselinux/src/Makefile +1 -1
@@ -102,7 +103,7 @@ $(AUDIT2WHYLOBJ): audit2why.c
 	$(CC) $(filter-out -Werror, $(CFLAGS)) $(PYINC) -fPIC -DSHARED -c -o $@ $<
 
 $(AUDIT2WHYSO): $(AUDIT2WHYLOBJ)
-	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux ${LIBDIR}/libsepol.a -L$(LIBDIR) -Wl,-soname,$@
+	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux $(LIBSEPOLSTATIC) -L$(LIBDIR) -Wl,-soname,$@
As long as the locally-defined LIBSEPOLSTATIC did not override the top-level exported one for builds from the whole git bundle (see above)...

It won't.

Signature · 8 lines

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Guido Trentalancia

author

2011-09-16 12:50 UTC #71 lore raw

Re: [PATCH v5] Fix includes for userspace tools and libraries

Quoted 44 lines · Stephen Smalley

Quoted 4 lines · Guido Trentalancia
Quoted 4 lines
libselinux/src/Makefile +0 -0
index 7680008..4651616 100644
Quoted 8 lines
libselinux/src/Makefile PYPREFIX ?= $(notdir $(PYTHON)) · line 10
Quoted 6 lines
libselinux/src/Makefile +1 -1
@@ -7,7 +7,8 @@ PYPREFIX ?= $(notdir $(PYTHON))
 # Installation directories.
 PREFIX ?= $(DESTDIR)/usr
 LIBDIR ?= $(PREFIX)/lib
-SHLIBDIR ?= $(PREFIX)/lib
+LIBSEPOLSTATIC ?= $(LIBDIR)/libsepol.a
Hopefully the above won't override the exported one from top-level...
It won't, because we use the ?= operator above. So it will take effect if building in the libselinux directory, as for a per-package build, not if building from top-level.
Quoted 11 lines
libselinux/src/Makefile SRCS= $(filter-out $(UNUSED_SRCS) $(GENERATED) audit2why.c, $(wildcard *.c)) · line 58
Quoted 6 lines
libselinux/src/Makefile +1 -1
@@ -54,7 +55,7 @@ SRCS= $(filter-out $(UNUSED_SRCS) $(GENERATED) audit2why.c, $(wildcard *.c))
 OBJS= $(patsubst %.c,%.o,$(SRCS))
 LOBJS= $(patsubst %.c,%.lo,$(SRCS))
 CFLAGS ?= -Werror -Wall -W -Wundef -Wshadow -Wmissing-noreturn -Wmissing-format-attribute
-override CFLAGS += -I../include -I$(INCLUDEDIR) -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 $(EMFLAGS)
+override CFLAGS += -I../include -I$(INCLUDEDIR) $(EXTRA_INCLUDES) -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 $(EMFLAGS)
It seems to me that you are giving the precedence to the system-wide includes. We want the EXTRA/LOCAL ones to have precedence over the system-wide ones, with the fall-back only for released components (which won't have EXTRA/LOCAL passed to them from a top-level Makefile).
See the description of -I in the man page for gcc. The above will have the desired effect.
Quoted 10 lines
libselinux/src/Makefile $(AUDIT2WHYLOBJ): audit2why.c · line 106
Quoted 6 lines
libselinux/src/Makefile +1 -1
@@ -102,7 +103,7 @@ $(AUDIT2WHYLOBJ): audit2why.c
 	$(CC) $(filter-out -Werror, $(CFLAGS)) $(PYINC) -fPIC -DSHARED -c -o $@ $<
 
 $(AUDIT2WHYSO): $(AUDIT2WHYLOBJ)
-	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux ${LIBDIR}/libsepol.a -L$(LIBDIR) -Wl,-soname,$@
+	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux $(LIBSEPOLSTATIC) -L$(LIBDIR) -Wl,-soname,$@
As long as the locally-defined LIBSEPOLSTATIC did not override the top-level exported one for builds from the whole git bundle (see above)...

Quoted 1 line

It won't.

Yes, excellent, let's go for that then.

Guido