SELinux Buildroot Additions

Changes v4 -> v5:
- Fixed package name to be BR2_PACKAGE_HOST_SEPOLGEN (Suggested by Thomas P.)

- No menu entry needed as host dependency aren't reflected in Config.in files (Suggested by Thomas P.)

package/sepolgen/sepolgen.hash new file +2 -0

new file mode 100644
index 0000000..a377c66
@@ -0,0 +1,2 @@
+# https://github.com/SELinuxProject/selinux/wiki/Releases
+sha256 8a1c6d3a78c9b6ad3555c74def555f65a62950bf21c111c585bfc382fec3a645  sepolgen-1.1.9.tar.gz

package/sepolgen/sepolgen.mk new file +20 -0

new file mode 100644
index 0000000..7c95866
@@ -0,0 +1,30 @@
+################################################################################
+#
+# sepolgen
+#
+################################################################################
+
+SEPOLGEN_VERSION = 1.1.9
+SEPOLGEN_SITE = https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20130423
+SEPOLGEN_LICENSE = GPLv2
+SEPOLGEN_LICENSE_FILES = COPYING
+
+ifeq ($(BR2_PACKAGE_PYTHON3),y)
+HOST_SEPOLGEN_DEPENDENCIES = host-python3
+HOST_SEPOLGEN_MAKE_CMDS = $(HOST_CONFIGURE_OPTS) \
+	PYTHONLIBDIR=/usr/lib/python$(PYTHON3_VERSION_MAJOR)/site-packages
+else
+HOST_SEPOLGEN_DEPENDENCIES = host-python
+HOST_SEPOLGEN_MAKE_CMDS = $(HOST_CONFIGURE_OPTS) \
+	PYTHONLIBDIR=/usr/lib/python$(PYTHON_VERSION_MAJOR)/site-packages
+endif

Dear Clayton Shotwell,

Quoted 3 lines · Clayton Shotwell

Changes v4 -> v5:
- Fixed package name to be BR2_PACKAGE_HOST_SEPOLGEN (Suggested by Thomas P.)

This contradicts...

Quoted 2 lines

- No menu entry needed as host dependency aren't reflected in Config.in files (Suggested by Thomas P.)

.. this, no? :-)

Quoted 38 lines

package/sepolgen/sepolgen.hash new file +2 -0

new file mode 100644
index 0000000..a377c66
@@ -0,0 +1,2 @@
+# https://github.com/SELinuxProject/selinux/wiki/Releases
+sha256 8a1c6d3a78c9b6ad3555c74def555f65a62950bf21c111c585bfc382fec3a645  sepolgen-1.1.9.tar.gz

package/sepolgen/sepolgen.mk new file +24 -0

new file mode 100644
index 0000000..7c95866
@@ -0,0 +1,30 @@
+################################################################################
+#
+# sepolgen
+#
+################################################################################
+
+SEPOLGEN_VERSION = 1.1.9
+SEPOLGEN_SITE = https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20130423
+SEPOLGEN_LICENSE = GPLv2
+SEPOLGEN_LICENSE_FILES = COPYING
+
+ifeq ($(BR2_PACKAGE_PYTHON3),y)
+HOST_SEPOLGEN_DEPENDENCIES = host-python3
+HOST_SEPOLGEN_MAKE_CMDS = $(HOST_CONFIGURE_OPTS) \
+     PYTHONLIBDIR=/usr/lib/python$(PYTHON3_VERSION_MAJOR)/site-packages
+else
+HOST_SEPOLGEN_DEPENDENCIES = host-python
+HOST_SEPOLGEN_MAKE_CMDS = $(HOST_CONFIGURE_OPTS) \
+     PYTHONLIBDIR=/usr/lib/python$(PYTHON_VERSION_MAJOR)/site-packages
+endif
+
+define HOST_SEPOLGEN_BUILD_CMDS
+     $(MAKE) -C $(@D) $(HOST_SEPOLGEN_MAKE_CMDS) DESTDIR=$(HOST_DIR)
+endef

package/sepolgen/sepolgen.mk line 30

Quoted 6 lines

package/sepolgen/sepolgen.mk new file +6 -0

+
+define HOST_SEPOLGEN_INSTALL_CMDS
+     $(MAKE) -C $(@D) $(HOST_SEPOLGEN_MAKE_CMDS) DESTDIR=$(HOST_DIR) install
+endef
+
+$(eval $(host-generic-package))

This looks good to me. Any reason not to use the latest 1.2.2 version?

Quoted 1 line

This looks good to me. Any reason not to use the latest 1.2.2 version?

Have not had time to test the latest versions. Would it be possible to get the initial patch set merged in and then bump versions?

From: Clayton Shotwell <[email protected]>

Signed-off-by Clayton Shotwell <[email protected]>

Signed-off-by Matthew Weber <[email protected]>

---
Changes v4 -> v5:
- Fixed package name to be BR2_PACKAGE_HOST_SEPOLGEN (Suggested by Thomas P.)
- No menu entry needed as host dependency aren't reflected in Config.in files (Suggested by Thomas P.)

From: Matt Weber <[email protected]>

Signed-off-by Clayton Shotwell <[email protected]>

---
Changes v4 -> v5:
- No changes

---
 package/sqlite/sqlite.mk | 1 +
 1 file changed, 1 insertion(+)

package/sqlite/sqlite.mk +0 -0

index fff219a..aaf84fc 100644

Dear Clayton Shotwell,

Quoted 9 lines · Clayton Shotwell

From: Matt Weber <[email protected]>

package/sqlite/sqlite.mk +0 -0

index fff219a..aaf84fc 100644
@@ -50,3 +50,4 @@ SQLITE_CONF_OPTS += --disable-readline
 endif
 

package/sqlite/sqlite.mk SQLITE_CONF_OPTS += --disable-readline · line 53

Quoted 2 lines

package/sqlite/sqlite.mk +1 -0

 $(eval $(autotools-package))
+$(eval $(host-autotools-package))

When adding a host package, it's always good to indicate which other package will be using it so that it doesn't seem to be a useless change.

Quoted 2 lines

When adding a host package, it's always good to indicate which other package will be using it so that it doesn't seem to be a useless change.

I can add a comment to the commit stating why the host support is being added.

From: Matt Weber <[email protected]>

Signed-off-by Clayton Shotwell <[email protected]>

Signed-off-by Matthew Weber <[email protected]>

---
Changes v4 -> v5:
- Added dependency on libsepol (Matt W.)
- Removed limitation of arch it could build for (Matt W.)
- Removed depends on GLIBC (Matt W.)
- Consolidated python configuration (Ryan B.)
- Removed swig (patch and enabling), it's only needed for graphical apol tool (Ryan B.)
- Added comment to cross compile patch about not upstreaming. The package is stable and no updates/reworking since 2013. Currently a 4.0 version is in the works but is a major build infrastructure rework when compared to 3.3.x. (Ryan B.)
- Added comments noting why autoreconf and not libtool patch

(Suggested by Thomas P.)
- Added comments explaining why python on host but not target (Suggested by Thomas P.)
- Add a dependency on not static libs because libselinux requires not static libs. (Clayton S.)
- Added licene info (Clayton S.)
- Added depends on C++ (Matt W.)
- Removed largefile dependency (Clayton S.)

package/setools/0001-cross-compile-fixes.patch new file +0 -0

new file mode 100644
index 0000000..1a4af0c

package/setools/Config.in new file +13 -0

new file mode 100644
index 0000000..43b4b27
@@ -0,0 +1,25 @@
+config BR2_PACKAGE_SETOOLS
+	bool "setools"
+	select BR2_PACKAGE_LIBSELINUX
+	select BR2_PACKAGE_SQLITE
+	select BR2_PACKAGE_LIBXML2
+	select BR2_PACKAGE_BZIP2
+	depends on BR2_TOOLCHAIN_HAS_THREADS
+	depends on !BR2_STATIC_LIBS
+	depends on BR2_INSTALL_LIBSTDCPP
+	help
+	  SETools is an open source project designed to facilitate
+	  SELinux policy analysis. The primary tools are:
+	   * apol - analyze a SELinux policy.

package/setools/setools.mk new file +0 -0

new file mode 100644
index 0000000..bd4de5f

package/setools/setools.mk new file +14 -0

+SETOOLS_LIBTOOL_PATCH = NO
+
+# Notes: Need "disable-selinux-check" so the configure does not check to see
+#        if host has selinux enabled.
+#        No python support as only the libraries and commandline tools are
+#        installed on target
+SETOOLS_CONF_OPTS = \
+	--disable-debug \
+	--disable-gui \
+	--disable-bwidget-check \
+	--disable-selinux-check \
+	--disable-swig-java \
+	--disable-swig-python \
+	--disable-swig-tcl \

package/setools/setools.mk new file +20 -0

+# Notes: Need "disable-selinux-check" so the configure does not check to see
+#        if host has selinux enabled.
+#        Host builds with python support to enable tools for offline target
+#        policy analysis
+HOST_SETOOLS_CONF_OPTS = \
+	--disable-debug \
+	--disable-gui \
+	--disable-bwidget-check \
+	--disable-selinux-check \
+	--disable-swig-java \
+	--disable-swig-python \
+	--disable-swig-tcl \
+	--with-sepol-devel="$(HOST_DIR)/usr" \
+	--with-selinux-devel="$(HOST_DIR)/usr" \
+	PYTHON_LDFLAGS="-L$(HOST_DIR)/usr/lib/"
+
+HOST_SETOOLS_CONF_ENV += \
+	am_cv_pathless_PYTHON=python \
+	ac_cv_path_PYTHON=$(HOST_DIR)/usr/bin/python \
+	am_cv_python_platform=linux2

package/setools/setools.mk new file +13 -0

+HOST_SETOOLS_CONF_OPTS = \
+	--disable-debug \
+	--disable-gui \
+	--disable-bwidget-check \
+	--disable-selinux-check \
+	--disable-swig-java \
+	--disable-swig-python \
+	--disable-swig-tcl \
+	--with-sepol-devel="$(HOST_DIR)/usr" \
+	--with-selinux-devel="$(HOST_DIR)/usr" \
+	PYTHON_LDFLAGS="-L$(HOST_DIR)/usr/lib/" \
+	PYTHON_CPPFLAGS="-I$(HOST_SETOOLS_PYTHON_INCLUDES)" \
+	PYTHON_SITE_PKG="$(HOST_SETOOLS_PYTHON_SITE_PACKAGES") \

Dear Clayton Shotwell,

Quoted 18 lines · Clayton Shotwell

From: Matt Weber <[email protected]>

Signed-off-by Clayton Shotwell <[email protected]>

Signed-off-by Matthew Weber <[email protected]>

---
Changes v4 -> v5:
- Added dependency on libsepol (Matt W.)
- Removed limitation of arch it could build for (Matt W.)
- Removed depends on GLIBC (Matt W.)
- Consolidated python configuration (Ryan B.)
- Removed swig (patch and enabling), it's only needed for graphical apol tool (Ryan B.)
- Added comment to cross compile patch about not upstreaming. The package is stable and no updates/reworking since 2013. Currently a 4.0 version is in the works but is a major build infrastructure rework when compared to 3.3.x. (Ryan B.)
- Added comments noting why autoreconf and not libtool patch

Quoted 8 lines

(Suggested by Thomas P.)
- Added comments explaining why python on host but not target (Suggested by Thomas P.)
- Add a dependency on not static libs because libselinux requires not static libs. (Clayton S.)
- Added licene info (Clayton S.)
- Added depends on C++ (Matt W.)
- Removed largefile dependency (Clayton S.)

Thanks a lot for this detailed changelog, very useful.

Quoted 1 line

+comment "setools needs a toolchain w/ threads, c++, dynamic library"

nit of the day: C++ in uppercase.

Quoted 13 lines

package/setools/setools.mk new file +7 -0

new file mode 100644
index 0000000..bd4de5f
@@ -0,0 +1,85 @@
+################################################################################
+#
+# setools
+#
+################################################################################
+
+SETOOLS_VERSION = 3.3.8

package/setools/setools.mk line 10

Quoted 3 lines

package/setools/setools.mk new file +3 -0

+SETOOLS_SOURCE = setools-$(SETOOLS_VERSION).tar.bz2
+SETOOLS_SITE = https://raw.githubusercontent.com/wiki/TresysTechnology/setools3/files/dists/setools-$(SETOOLS_VERSION)/
+SETOOLS_DEPENDENCIES = libselinux sqlite libxml2 bzip2

Here you don't list libsepol explicitly (which is OK since libselinux depends on it), but in the host variant of setools, you do depend explicitly on host-libsepol. Pick one of the two possibilities, but don't mix them :)

package/setools/setools.mk line 15

Quoted 5 lines

package/setools/setools.mk new file +5 -0

+SETOOLS_INSTALL_STAGING = YES
+SETOOLS_LICENSE = GPLv2+ LGPLv2.1+
+SETOOLS_LICENSE_FILES = COPYING COPYING.GPL COPYING.LGPL
+
+# Generate the configuration script

That's not explaining anything, we know what autoreconf is doing. The question is *why*.

package/setools/setools.mk line 19

Quoted 4 lines

package/setools/setools.mk new file +4 -0

+SETOOLS_AUTORECONF = YES
+SETOOLS_AUTORECONF_OPTS = -i -s
+# Prevent patching since autoreconf sets ltmain.sh as a symlink to
+# to host/usr/share/libtool/build-aux/ltmain.sh

Weird autoreconf is used all over the place by many packages, and it's not causing this problem.

Quoted 14 lines

package/setools/setools.mk new file +14 -0

+SETOOLS_LIBTOOL_PATCH = NO
+
+# Notes: Need "disable-selinux-check" so the configure does not check to see
+#        if host has selinux enabled.
+#        No python support as only the libraries and commandline tools are
+#        installed on target
+SETOOLS_CONF_OPTS = \
+     --disable-debug \
+     --disable-gui \
+     --disable-bwidget-check \
+     --disable-selinux-check \
+     --disable-swig-java \
+     --disable-swig-python \
+     --disable-swig-tcl \

package/setools/setools.mk line 43

Quoted 10 lines

package/setools/setools.mk new file +10 -0

+     --with-sepol-devel="$(STAGING_DIR)/usr" \
+     --with-selinux-devel="$(STAGING_DIR)/usr"
+
+HOST_SETOOLS_DEPENDENCIES = host-libselinux host-libsepol host-sqlite \
+     host-libxml2 host-bzip2
+
+# Generate the configuration script
+HOST_SETOOLS_AUTORECONF = YES
+HOST_SETOOLS_AUTORECONF_OPTS = -i -s
+

i.e here (see below).

Quoted 20 lines

package/setools/setools.mk new file +20 -0

+# Notes: Need "disable-selinux-check" so the configure does not check to see
+#        if host has selinux enabled.
+#        Host builds with python support to enable tools for offline target
+#        policy analysis
+HOST_SETOOLS_CONF_OPTS = \
+     --disable-debug \
+     --disable-gui \
+     --disable-bwidget-check \
+     --disable-selinux-check \
+     --disable-swig-java \
+     --disable-swig-python \
+     --disable-swig-tcl \
+     --with-sepol-devel="$(HOST_DIR)/usr" \
+     --with-selinux-devel="$(HOST_DIR)/usr" \
+     PYTHON_LDFLAGS="-L$(HOST_DIR)/usr/lib/"
+
+HOST_SETOOLS_CONF_ENV += \
+     am_cv_pathless_PYTHON=python \
+     ac_cv_path_PYTHON=$(HOST_DIR)/usr/bin/python \
+     am_cv_python_platform=linux2

package/setools/setools.mk line 73

Quoted 10 lines

package/setools/setools.mk new file +10 -0

+
+ifeq ($(BR2_PACKAGE_PYTHON3),y)
+HOST_SETOOLS_PYTHON_VERSION=$(PYTHON3_VERSION_MAJOR)
+HOST_SETOOLS_DEPENDENCIES += host-python3
+HOST_SETOOLS_CONF_ENV += am_cv_python_version=$(PYTHON3_VERSION)
+else
+HOST_SETOOLS_PYTHON_VERSION=$(PYTHON_VERSION_MAJOR)
+HOST_SETOOLS_DEPENDENCIES += host-python
+HOST_SETOOLS_CONF_ENV += am_cv_python_version=$(PYTHON_VERSION)
+endif

This should be put a bit earlier.

package/setools/setools.mk line 82

Quoted 9 lines

package/setools/setools.mk new file +9 -0

+
+HOST_SETOOLS_CONF_ENV += \
+     am_cv_python_pythondir=$(HOST_DIR)/usr/lib/python$(HOST_SETOOLS_PYTHON_VERSION)/site-packages \
+     am_cv_python_pyexecdir=$(HOST_DIR)/usr/lib/python$(HOST_SETOOLS_PYTHON_VERSION)/site-packages \
+     am_cv_python_includes=-I$(HOST_DIR)/usr/include/python$(HOST_SETOOLS_PYTHON_VERSION)
+HOST_SETOOLS_CONF_OPTS += \
+     PYTHON_CPPFLAGS="-I$(HOST_DIR)/usr/include/python$(HOST_SETOOLS_PYTHON_VERSION)" \
+     PYTHON_SITE_PKG="$(HOST_DIR)/usr/lib/python$(HOST_SETOOLS_PYTHON_VERSION)/site-packages" \
+     PYTHON_EXTRA_LIBS="-lpthread -ldl -lutil -lpython$(HOST_SETOOLS_PYTHON_VERSION)"

So that these can be squashed with the HOST_SETOOLS_CONF_ENV and HOST_SETOOLS_CONF_OPTS definitions. Also, I'm pretty sure we can do something a bit better than that.

ifeq ($(BR2_PACKAGE_PYTHON3),y) HOST_SETOOLS_DEPENDENCIES += host-python3 HOST_SETOOLS_PYTHON_VERSION = $(PYTHON3_VERSION_MAJOR) else
HOST_SETOOLS_DEPENDENCIES += host-python HOST_SETOOLS_PYTHON_VERSION = $(PYTHON_VERSION_MAJOR) endif

HOST_SETOOLS_PYTHON_SITE_PACKAGES = $(HOST_DIR)/usr/lib/python$(HOST_SETOOLS_PYTHON_VERSION)/site-packages HOST_SETOOLS_PYTHON_INCLUDES = $(HOST_DIR)/usr/include/python$(HOST_SETOOLS_PYTHON_VERSION) HOST_SETOOLS_PYTHON_LIB = -lpython$(HOST_SETOOLS_PYTHON_VERSION)

And then:

Quoted 13 lines

package/setools/setools.mk new file +13 -0

+HOST_SETOOLS_CONF_OPTS = \
+     --disable-debug \
+     --disable-gui \
+     --disable-bwidget-check \
+     --disable-selinux-check \
+     --disable-swig-java \
+     --disable-swig-python \
+     --disable-swig-tcl \
+     --with-sepol-devel="$(HOST_DIR)/usr" \
+     --with-selinux-devel="$(HOST_DIR)/usr" \
+     PYTHON_LDFLAGS="-L$(HOST_DIR)/usr/lib/" \
+     PYTHON_CPPFLAGS="-I$(HOST_SETOOLS_PYTHON_INCLUDES)" \
+     PYTHON_SITE_PKG="$(HOST_SETOOLS_PYTHON_SITE_PACKAGES") \

package/setools/setools.mk

Quoted 10 lines

package/setools/setools.mk new file +9 -0

+     PYTHON_EXTRA_LIBS="-lpthread -ldl -lutil $(HOST_SETOOLS_PYTHON_LIB)"
 
+HOST_SETOOLS_CONF_ENV += \
+     am_cv_pathless_PYTHON=python \
+     ac_cv_path_PYTHON=$(HOST_DIR)/usr/bin/python \
+     am_cv_python_platform=linux2
+     am_cv_python_version=$(HOST_SETOOLS_PYTHON_VERSION)
+     am_cv_python_pythondir=$(HOST_SETOOLS_PYTHON_SITE_PACKAGES)
+     am_cv_python_pyexecdir=$(HOST_SETOOLS_PYTHON_SITE_PACKAGES)
+     am_cv_python_includes=-I$(HOST_SETOOLS_PYTHON_INCLUDES)

and there you are.

From: Matt Weber <[email protected]>

Signed-off-by Clayton Shotwell <[email protected]>

Signed-off-by Matthew Weber <[email protected]>

package/audit/audit.mk new file +19 -0

@@ -0,0 +1,47 @@
+################################################################################
+#
+# audit
+#
+################################################################################
+
+AUDIT_VERSION = 2.4.1
+AUDIT_SITE = http://people.redhat.com/sgrubb/audit/
+AUDIT_LICENSE = GPLv2
+AUDIT_LICENSE_FILES = COPYING
+
+AUDIT_INSTALL_STAGING = YES
+AUDIT_AUTORECONF = YES
+
+AUDIT_CONF_OPTS = --without-python
+
+ifeq ($(BR2_PACKAGE_LIBCAP_NG),y)
+       AUDIT_DEPENDENCIES += libcap-ng
+       AUDIT_CONF_OPTS += --with-libcap-ng=yes

package/audit/audit.mk new file +18 -1

+ifeq ($(BR2_aarch64),y)
+       AUDIT_CONF_OPTS += --with-aarch64
+endif
+
+ifeq ($(BR2_STATIC_LIBS),y)
+       AUDIT_CONF_OPTS += --enable-shared=no
+endif
+
+define AUDIT_INSTALL_INIT_SYSV
+       $(INSTALL) -m 755 package/audit/S01auditd $(TARGET_DIR)/etc/init.d/
+endef
+
+define AUDIT_REMOVE_STARTUP_SCRIPT_DIR
+       $(RM) -rf $(TARGET_DIR)/etc/rc.d
+endef
+AUDIT_POST_INSTALL_TARGET_HOOKS += AUDIT_REMOVE_STARTUP_SCRIPT_DIR
+
+$(eval $(autotools-package))
--

1.9.1

_______________________________________________
buildroot mailing list
buildroot at busybox.net
http://lists.busybox.net/mailman/listinfo/buildroot

package/audit/audit.mk line 29

Quoted 6 lines

package/audit/audit.mk new file +6 -0

+ifeq ($(BR2_armeb),y)
+       AUDIT_CONF_OPTS += --with-arm
+endif
+ifeq ($(BR2_arm),y)
+       AUDIT_CONF_OPTS += --with-arm
+endif

This could be condensed in:
ifeq ($(BR2_armeb)$(BR2_arm),y)

       AUDIT_CONF_OPTS += --with-arm

endif

Changes v4 -> v5:
- Removed limitation on glibc only build (Matt W.)
- Updated static lib build option variable name (Matt W.)
- Upgrading audit to the latest version. Switched to a simpler cross compile support patch that should be upstreamable (Clayton
S.)
- Cleaned up build flags and patch names (Clayton S.)
- The xtensa architecture uclibc is missing the ADDR_NO_RANDOMIZE flag that is required by the audit application. Exclute the audit package from the xtensa architecture. (Clayton S.)

(quoted diff) +0 -0

b/package/audit/0001-Enable-cross-compiling.patch new file mode 100644 index 0000000..b2c9b4c

package/audit/0001-Enable-cross-compiling.patch new file +1 -0

@@ -0,0 +1,773 @@
+From c30e91c2833fb5c33a238258e5902cc2dd8586d3 Mon Sep 17 00:00:00

2001 +From: Clayton Shotwell <[email protected]>

package/audit/0001-Enable-cross-compiling.patch new file +5 -0

+Date: Thu, 26 Mar 2015 12:26:36 -0500
+Subject: [PATCH] Enable cross compiling
+
+During the audit build, several lookup tables are generated as header
+files that are then linked in with the executables. This process is

done +by a C application that needs to be able to be run on the host. The +current Makfile structure tries to build these executables for the +target instead of the host where they cannot be executed. This patch +reworks the Makefile structure to build for the correct platform. +

package/audit/0001-Enable-cross-compiling.patch new file +9 -0

+This patch is a rework of a patch posted to the audit mailing list at
+the link below.
+https://www.redhat.com/archives/linux-audit/2012-November/msg00000.html
+
+The ax_prog_cc_for_build.m4 file was obtained from GNU at the link
+below.
+http://www.gnu.org/software/autoconf-archive/ax_prog_cc_for_build.html
+
+Signed-off-by: Clayton Shotwell

<[email protected]> +---
+ auparse/Makefile.am | 276
++++++++++++++++++++++++++++++---------------

+ configure.ac               |   1 +
+ lib/Makefile.am            | 133 ++++++++++++++--------
+ m4/ax_prog_cc_for_build.m4 | 125 ++++++++++++++++++++

+ 4 files changed, 397 insertions(+), 138 deletions(-)
+ create mode 100644 m4/ax_prog_cc_for_build.m4

(quoted diff) +0 -0

b/package/audit/0002-Remove-zos-remote-plugin.patch new file mode 100644 index 0000000..1c8180d

package/audit/0002-Remove-zos-remote-plugin.patch new file +1 -0

@@ -0,0 +1,54 @@
+From 145a6ddfc8cfcd20bbb505637e50191655128fbb Mon Sep 17 00:00:00

2001 +From: Clayton Shotwell <[email protected]>

package/audit/0002-Remove-zos-remote-plugin.patch new file +5 -0

+Date: Thu, 26 Mar 2015 12:33:10 -0500
+Subject: [PATCH] Remove zos-remote plugin
+
+The zos-remote plugin is meant to use LDAP authentication to verify a
+remote audit user. This is not a package that is available or

desired in +an embedded target. Removing the plugin from the build until it is +able to be turned off from configure.

package/audit/0002-Remove-zos-remote-plugin.patch new file +2 -0

+
+Signed-off-by: Clayton Shotwell

<[email protected]> +---
+ audisp/plugins/Makefile.am | 2 +-
+ audisp/plugins/Makefile.in | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)

a/package/audit/0004-Do-not-call-posix_fallocate-on-uClibc.patch b/package/audit/0004-Do-not-call-posix_fallocate-on-uClibc.patch new file mode 100644 index 0000000..87ea6a8 --- /dev/null
+++ b/package/audit/0004-Do-not-call-posix_fallocate-on-uClibc.patch

package/audit/0002-Remove-zos-remote-plugin.patch new file +1 -0

@@ -0,0 +1,45 @@
+From 8b65b6788140ba169edb620a2abcf438521919ed Mon Sep 17 00:00:00

2001 +From: Clayton Shotwell <[email protected]>

package/audit/0002-Remove-zos-remote-plugin.patch new file +6 -0

+Date: Wed, 1 Apr 2015 07:49:54 -0500
+Subject: [PATCH] Do not call posix_fallocate() on uClibc
+
+uClibc does not implement posix_fallocate(), and posix_fallocate() is
+mostly only a hint to the kernel that we will need such or such
+amount of space inside a file. So we just don't call

posix_fallocate() +when building against uClibc.

package/audit/0002-Remove-zos-remote-plugin.patch new file +5 -0

+
+Patch copies functionality implemented by Thomas for the
+lttng-babeltrace package.
+
+Signed-off-by: Clayton Shotwell

<[email protected]> +---

package/audit/Config.in new file +6 -0

new file mode 100644
index 0000000..5cf1c26
@@ -0,0 +1,17 @@
+config BR2_PACKAGE_AUDIT
+	bool "audit"
+	# needs memory fences for internal libev
+	depends on !BR2_bfin
+	depends on BR2_TOOLCHAIN_HAS_THREADS
+	help

package/audit/S01auditd new file +6 -0

@@ -0,0 +1,169 @@
+#!/bin/sh
+#
+# auditd        This starts and stops auditd
+#
+# description: This starts the Linux Auditing System Daemon, \
+#              which collects security related events in a dedicated

\ +# audit log. If this daemon is turned off, audit
events \ +# will be sent to syslog.

package/audit/S01auditd new file +4 -0

+#
+# processname: /usr/sbin/auditd
+# config: /etc/sysconfig/auditd
+# config: /etc/audit/auditd.conf

package/audit/S01auditd new file +13 -0

+
+RETVAL=0
+LOCK=/var/lock/subsys/auditd
+
+start(){
+   echo -n "Initializing $prog: "
+
+   if [ ! -e $LOCK ]; then
+      test -x /usr/sbin/auditd  || exit 5
+      test -f /etc/audit/auditd.conf  || exit 6
+
+      # Create dir to store log files in if one doesn't exist
+      test -d /var/log/audit || mkdir /var/log/audit -Z

matchpathcon /var/log/audit | cut -f 2 +

package/audit/S01auditd new file +6 -0

+      RETVAL=$?
+      if test $RETVAL = 0 ; then
+         test -d /var/lock/subsys || mkdir -p /var/lock/subsys
+         touch $LOCK
+         # Load the default rules
+         test -f /etc/audit/rules.d/audit.rules

&& /usr/sbin/auditctl -R /etc/audit/rules.d/audit.rules >/dev/null

package/audit/S01auditd new file +5 -0

+         echo "OK"
+      else
+         echo "FAILED: auditd failed to start"
+      fi
+   else

package/audit/S01auditd new file +6 -0

+      RETVAL=$?
+      if [ $RETVAL ]; then
+         rm -f $LOCK
+         # Remove watches so shutdown works cleanly
+         if test x"$AUDITD_CLEAN_STOP" != "x" ; then
+            if test "`echo $AUDITD_CLEAN_STOP | tr 'NO' 'no'`" !=

"no"

package/audit/S01auditd new file +6 -0

+            then
+               /usr/sbin/auditctl -D >/dev/null
+            fi
+         fi
+         if test x"$AUDITD_STOP_DISABLE" != "x" ; then
+            if test "`echo $AUDITD_STOP_DISABLE | tr 'NO' 'no'`" !=

"no"

package/audit/S01auditd new file +8 -0

+         fi
+         echo "OK"
+      else
+         echo "FAILED: auditd not stopped"
+      fi
+   else
+      echo "FAILED: auditd not started"
+      RETVAL=1

b/package/audit/audit.mk new file mode 100644 index 0000000..b1ebd0e

package/audit/audit.mk new file +3 -0

@@ -0,0 +1,47 @@
+################################################################################
+#
+# audit

package/audit/audit.mk new file +4 -0

+
+ifeq ($(BR2_armeb),y)
+	AUDIT_CONF_OPTS += --with-arm
+endif

Dear Clayton Shotwell,

Quoted 10 lines · Clayton Shotwell

Changes v4 -> v5:
- Removed limitation on glibc only build (Matt W.)
- Updated static lib build option variable name (Matt W.)
- Upgrading audit to the latest version. Switched to a simpler cross compile support patch that should be upstreamable (Clayton
S.)
- Cleaned up build flags and patch names (Clayton S.)
- The xtensa architecture uclibc is missing the ADDR_NO_RANDOMIZE flag that is required by the audit application. Exclute the audit package from the xtensa architecture. (Clayton S.)

This has probably been changed since then, because you haven't ecluded Xtensa, but instead did a workaround to cope with ADDR_NO_RANDOMIZE being not available.

Quoted 30 lines

(quoted diff) +0 -0

b/package/audit/0001-Enable-cross-compiling.patch new file mode 100644 index 0000000..b2c9b4c

package/audit/0001-Enable-cross-compiling.patch new file +1 -0

@@ -0,0 +1,773 @@
+From c30e91c2833fb5c33a238258e5902cc2dd8586d3 Mon Sep 17 00:00:00

2001 +From: Clayton Shotwell <[email protected]>

package/audit/0001-Enable-cross-compiling.patch new file +5 -0

+Date: Thu, 26 Mar 2015 12:26:36 -0500
+Subject: [PATCH] Enable cross compiling
+
+During the audit build, several lookup tables are generated as header
+files that are then linked in with the executables. This process is

done +by a C application that needs to be able to be run on the host. The +current Makfile structure tries to build these executables for the +target instead of the host where they cannot be executed. This patch +reworks the Makefile structure to build for the correct platform. +

package/audit/0001-Enable-cross-compiling.patch new file +9 -0

+This patch is a rework of a patch posted to the audit mailing list at
+the link below.
+https://www.redhat.com/archives/linux-audit/2012-November/msg00000.html
+
+The ax_prog_cc_for_build.m4 file was obtained from GNU at the link
+below.
+http://www.gnu.org/software/autoconf-archive/ax_prog_cc_for_build.html
+
+Signed-off-by: Clayton Shotwell

<[email protected]> +---
+ auparse/Makefile.am | 276
++++++++++++++++++++++++++++++---------------

Quoted 5 lines

+ configure.ac               |   1 +
+ lib/Makefile.am            | 133 ++++++++++++++--------
+ m4/ax_prog_cc_for_build.m4 | 125 ++++++++++++++++++++

+ 4 files changed, 397 insertions(+), 138 deletions(-)
+ create mode 100644 m4/ax_prog_cc_for_build.m4

This patch looks OK to me. We could potentially avoid the need for having m4/ax_prog_cc_for_build.m4 by adding host-autoconf-archive to the dependencies, and passing:

AUDIT_AUTORECONF_OPTS = -I $(HOST_DIR)/usr/share/autoconf-archive

however I am not sure if it's really worth the effort.

Other than that, this patch looks OK to me.

Quoted 16 lines

(quoted diff) +0 -0

b/package/audit/0002-Remove-zos-remote-plugin.patch new file mode 100644 index 0000000..1c8180d

package/audit/0002-Remove-zos-remote-plugin.patch new file +1 -0

@@ -0,0 +1,54 @@
+From 145a6ddfc8cfcd20bbb505637e50191655128fbb Mon Sep 17 00:00:00

2001 +From: Clayton Shotwell <[email protected]>

package/audit/0002-Remove-zos-remote-plugin.patch new file +5 -0

+Date: Thu, 26 Mar 2015 12:33:10 -0500
+Subject: [PATCH] Remove zos-remote plugin
+
+The zos-remote plugin is meant to use LDAP authentication to verify a
+remote audit user. This is not a package that is available or

desired in +an embedded target. Removing the plugin from the build until it is +able to be turned off from configure.
+

Quoted 5 lines

+Signed-off-by: Clayton Shotwell <[email protected]> +---
+ audisp/plugins/Makefile.am | 2 +-
+ audisp/plugins/Makefile.in | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)

Changes to the Makefile.in are not needed, since you autoreconf the package anyway, Makefile.in is regenerated.

Also, what about adding a --enable-zos-remote / --disable-zos-remote option, so that this patch can be submitted upstream?

Something like:

AC_ARG_ENABLE([zos-remote],
AS_HELP_STRING([--disable-zos-remote], [Disable the ZOS remote plugin (default: enabled)]), [with_zos_remote_plugin=$enableval],
[with_zos_remote_plugin=yes])
AM_CONDITIONAL([WITH_ZOS_REMOTE], [test "$with_zos_remote_plugin" = "yes"])

package/audit/0002-Remove-zos-remote-plugin.patch line 26

Quoted 10 lines

package/audit/0002-Remove-zos-remote-plugin.patch new file +10 -0

+diff --git a/audisp/plugins/Makefile.am b/audisp/plugins/Makefile.am
+index b0fa60a..3d6f4e6 100644
+--- a/audisp/plugins/Makefile.am
++++ b/audisp/plugins/Makefile.am
+@@ -22,7 +22,7 @@
+
+ CONFIG_CLEAN_FILES = *.loT *.rej *.orig
+
+-SUBDIRS = builtins zos-remote remote
++SUBDIRS = builtins remote

if WITH_ZOS_REMOTE
SUBDIRS += zos-remote
endif

Quoted 19 lines

a/package/audit/0004-Do-not-call-posix_fallocate-on-uClibc.patch b/package/audit/0004-Do-not-call-posix_fallocate-on-uClibc.patch new file mode 100644 index 0000000..87ea6a8 --- /dev/null
+++ b/package/audit/0004-Do-not-call-posix_fallocate-on-uClibc.patch

package/audit/0002-Remove-zos-remote-plugin.patch new file +1 -0

@@ -0,0 +1,45 @@
+From 8b65b6788140ba169edb620a2abcf438521919ed Mon Sep 17 00:00:00

2001 +From: Clayton Shotwell <[email protected]>

package/audit/0002-Remove-zos-remote-plugin.patch new file +6 -0

+Date: Wed, 1 Apr 2015 07:49:54 -0500
+Subject: [PATCH] Do not call posix_fallocate() on uClibc
+
+uClibc does not implement posix_fallocate(), and posix_fallocate() is
+mostly only a hint to the kernel that we will need such or such
+amount of space inside a file. So we just don't call

posix_fallocate() +when building against uClibc.

package/audit/0002-Remove-zos-remote-plugin.patch new file +5 -0

+
+Patch copies functionality implemented by Thomas for the
+lttng-babeltrace package.
+
+Signed-off-by: Clayton Shotwell

Quoted 1 line

<[email protected]> +---

Using a configure.ac check would actually be a lot better.

AC_CHECK_FUNCS([posix_fallocate])

and then #ifdef HAVE_POSIX_FALLOCATE in the C source file.

Quoted 12 lines

package/audit/Config.in new file +6 -0

new file mode 100644
index 0000000..5cf1c26
@@ -0,0 +1,17 @@
+config BR2_PACKAGE_AUDIT
+     bool "audit"
+     # needs memory fences for internal libev
+     depends on !BR2_bfin
+     depends on BR2_TOOLCHAIN_HAS_THREADS
+     help

package/audit/Config.in line 16

Quoted 10 lines

package/audit/Config.in new file +10 -0

+       The audit package contains the user space utilities for
+       storing and searching the audit records generated by
+       the audit subsystem in the Linux 2.6 kernel
+
+       Note: The z/OS remote plugin is disabled in this package
+
+       http://people.redhat.com/sgrubb/audit/
+
+comment "audit needs a toolchain w/ threads"
+     depends on !BR2_TOOLCHAIN_HAS_THREADS || BR2_bfin

This should be:

depends on !BR2_bfin
depends on !BR2_TOOLCHAIN_HAS_THREADS

so that the comment never appears on Blackfin, and appears on other architectures than Blackfin when thread support is not available.

With your solution, the comment always appears on Blackfin.

package/audit/S01auditd

Quoted 5 lines

package/audit/S01auditd new file +0 -0

new file mode 100644
index 0000000..9083bfe

I am not sure about this script, it seems quite complicated compared to other init scripts in Buildroot.

Quoted 13 lines

package/audit/S01auditd new file +6 -0

@@ -0,0 +1,169 @@
+#!/bin/sh
+#
+# auditd        This starts and stops auditd
+#
+# description: This starts the Linux Auditing System Daemon, \
+#              which collects security related events in a dedicated

\ +# audit log. If this daemon is turned off, audit
events \ +# will be sent to syslog.

package/audit/S01auditd new file +4 -0

+#
+# processname: /usr/sbin/auditd
+# config: /etc/sysconfig/auditd
+# config: /etc/audit/auditd.conf

package/audit/S01auditd line 22

Quoted 10 lines

package/audit/S01auditd new file +10 -0

+# pidfile: /var/run/auditd.pid
+#
+# Return values according to LSB for all commands but status:
+# 0 - success
+# 1 - generic or unspecified error
+# 3 - unimplemented feature (e.g. "reload")
+# 4 - insufficient privilege
+# 5 - program is not installed
+# 6 - program is not configured
+# 7 - program is not running

Do we care about LSB conformance of our init scripts?

package/audit/S01auditd line 27

Quoted 5 lines

package/audit/S01auditd new file +5 -0

+#
+prog="auditd"
+
+# Check that we are root ... so non-root users stop here
+test $EUID=0  ||  exit 4

We typically don't do such checks in other init scripts.

package/audit/S01auditd line 30

Quoted 3 lines

package/audit/S01auditd new file +3 -0

+
+# Check config
+test -f /etc/sysconfig/auditd && . /etc/sysconfig/auditd

/etc/sysconfig is clearly not something standard in Buildroot.

Quoted 14 lines

package/audit/S01auditd new file +13 -0

+
+RETVAL=0
+LOCK=/var/lock/subsys/auditd
+
+start(){
+   echo -n "Initializing $prog: "
+
+   if [ ! -e $LOCK ]; then
+      test -x /usr/sbin/auditd  || exit 5
+      test -f /etc/audit/auditd.conf  || exit 6
+
+      # Create dir to store log files in if one doesn't exist
+      test -d /var/log/audit || mkdir /var/log/audit -Z

matchpathcon /var/log/audit | cut -f 2 +

package/audit/S01auditd line 46

Quoted 2 lines

package/audit/S01auditd new file +2 -0

+      # Run audit daemon executable
+      $prog

start-stop-daemon?

Quoted 12 lines

package/audit/S01auditd new file +6 -0

+      RETVAL=$?
+      if test $RETVAL = 0 ; then
+         test -d /var/lock/subsys || mkdir -p /var/lock/subsys
+         touch $LOCK
+         # Load the default rules
+         test -f /etc/audit/rules.d/audit.rules

&& /usr/sbin/auditctl -R /etc/audit/rules.d/audit.rules >/dev/null

package/audit/S01auditd new file +5 -0

+         echo "OK"
+      else
+         echo "FAILED: auditd failed to start"
+      fi
+   else

package/audit/S01auditd line 67

Quoted 10 lines

package/audit/S01auditd new file +10 -0

+      echo "FAILED: auditd already started, stop first"
+      RETVAL=1
+   fi
+   return $RETVAL
+}
+
+stop(){
+   echo -n "Uninitializing $prog: "
+   if [ -e $LOCK ]; then
+      killall -TERM $prog

so that we can avoid this horrible killall.

Quoted 14 lines

package/audit/S01auditd new file +6 -0

+      RETVAL=$?
+      if [ $RETVAL ]; then
+         rm -f $LOCK
+         # Remove watches so shutdown works cleanly
+         if test x"$AUDITD_CLEAN_STOP" != "x" ; then
+            if test "`echo $AUDITD_CLEAN_STOP | tr 'NO' 'no'`" !=

"no"

package/audit/S01auditd new file +6 -0

+            then
+               /usr/sbin/auditctl -D >/dev/null
+            fi
+         fi
+         if test x"$AUDITD_STOP_DISABLE" != "x" ; then
+            if test "`echo $AUDITD_STOP_DISABLE | tr 'NO' 'no'`" !=

"no"

package/audit/S01auditd line 82

Quoted 3 lines

package/audit/S01auditd new file +3 -0

+            then
+               /usr/sbin/auditctl -e 0 >/dev/null
+            fi

what is AUDITD_CLEAN_STOP and AUDITD_STOP_DISABLE ? These tests look weird.

Quoted 8 lines

package/audit/S01auditd new file +8 -0

+         fi
+         echo "OK"
+      else
+         echo "FAILED: auditd not stopped"
+      fi
+   else
+      echo "FAILED: auditd not started"
+      RETVAL=1

package/audit/S01auditd line 100

Quoted 10 lines

package/audit/S01auditd new file +10 -0

+   fi
+   return $RETVAL
+}
+
+reload(){
+   echo -n "Reloading auditd configuration: "
+   if [ -e $LOCK ]; then
+      test -f /etc/audit/auditd.conf  || exit 6
+      echo -n "Reloading configuration: "
+      killall -HUP $prog

start-stop-daemon also allows to send a SIGHUP.

package/audit/S01auditd line 117

Quoted 4 lines

package/audit/S01auditd new file +4 -0

+rotate(){
+   echo -n "Rotating auditd logs: "
+   if [ -e $LOCK ]; then
+      killall -USR1 $prog

Ditto, with start-stop-daemon you can send all signals you want.

So overall, a simplified, more Buildroot style init script would be appreciated.

Quoted 12 lines

b/package/audit/audit.mk new file mode 100644 index 0000000..b1ebd0e

package/audit/audit.mk new file +8 -0

@@ -0,0 +1,47 @@
+################################################################################
+#
+# audit
+#
+################################################################################
+
+AUDIT_VERSION = 2.4.1
+AUDIT_SITE = http://people.redhat.com/sgrubb/audit/

package/audit/audit.mk line 13

Quoted 5 lines

package/audit/audit.mk new file +5 -0

+AUDIT_LICENSE = GPLv2
+AUDIT_LICENSE_FILES = COPYING
+
+AUDIT_INSTALL_STAGING = YES
+AUDIT_AUTORECONF = YES

Add comment about the fact that we have AUTORECONF = YES because we're patching configure.ac/Makefile.am.

package/audit/audit.mk line 22

Quoted 9 lines

package/audit/audit.mk new file +9 -0

+
+AUDIT_CONF_OPTS = --without-python
+
+ifeq ($(BR2_PACKAGE_LIBCAP_NG),y)
+     AUDIT_DEPENDENCIES += libcap-ng
+     AUDIT_CONF_OPTS += --with-libcap-ng=yes
+else
+     AUDIT_CONF_OPTS += --with-libcap-ng=no
+endif

Don't indent inside conditions.

Quoted 10 lines

package/audit/audit.mk new file +10 -0

+
+ifeq ($(BR2_armeb),y)
+     AUDIT_CONF_OPTS += --with-arm
+endif
+ifeq ($(BR2_arm),y)
+     AUDIT_CONF_OPTS += --with-arm
+endif
+ifeq ($(BR2_aarch64),y)
+     AUDIT_CONF_OPTS += --with-aarch64
+endif

package/audit/audit.mk line 36

Quoted 4 lines

package/audit/audit.mk new file +4 -0

+
+ifeq ($(BR2_STATIC_LIBS),y)
+     AUDIT_CONF_OPTS += --enable-shared=no
+endif

Why is this needed? We already pass --disable-shared when BR2_STATIC_LIBS=y, and --disable-shared should be identical to --enable-shared=no.

From: Matt Weber <[email protected]>

Signed-off-by Clayton Shotwell <[email protected]>

Signed-off-by Matt Weber <[email protected]>

package/policycoreutils/0001-cross-compile-fixes.patch new file +3 -0

+       SUBDIRS += restorecond
+ endif
+

+diff -urN a/newrole/Makefile b/newrole/Makefile +--- a/newrole/Makefile 2013-02-05 19:43:22.000000000 -0600 ++++ b/newrole/Makefile 2013-08-23 09:16:21.292985286 -0500 +@@ -3,9 +3,9 @@
+ BINDIR ?= $(PREFIX)/bin
+ MANDIR ?= $(PREFIX)/share/man
+ ETCDIR ?= $(DESTDIR)/etc

+-LOCALEDIR = /usr/share/locale
+-PAMH = $(shell ls /usr/include/security/pam_appl.h 2>/dev/null)
+-AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null)

++LOCALEDIR = $(DESTDIR)/usr/share/locale
++PAMH = $(shell ls $(DESTDIR)/usr/include/security/pam_appl.h 2>/dev/null)
++AUDITH = $(shell ls $(DESTDIR)/usr/include/libaudit.h 2>/dev/null)
+ # Enable capabilities to permit newrole to generate audit records.
+ # This will make newrole a setuid root program.
+ # The capabilities used are: CAP_AUDIT_WRITE.
+@@ -24,7 +24,7 @@
+ EXTRA_OBJS =
+ override CFLAGS += -DVERSION=\"$(VERSION)\" $(LDFLAGS) -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+ LDLIBS += -lselinux -L$(PREFIX)/lib
+-ifeq ($(PAMH), /usr/include/security/pam_appl.h)
++ifeq ($(PAMH), $(DESTDIR)/usr/include/security/pam_appl.h)

package/policycoreutils/0001-cross-compile-fixes.patch new file +3 -0

+       test -d $(ETCDIR)/pam.d || install -m 755 -d $(ETCDIR)/pam.d
+ ifeq ($(LSPP_PRIV),y)
+       install -m 644 newrole-lspp.pamd $(ETCDIR)/pam.d/newrole

package/policycoreutils/0001-cross-compile-fixes.patch new file +9 -0

+diff -urN a/run_init/Makefile b/run_init/Makefile
+--- a/run_init/Makefile        2013-02-05 19:43:22.000000000 -0600
++++ b/run_init/Makefile        2013-08-23 09:16:21.292985286 -0500
+@@ -4,21 +4,21 @@
+ SBINDIR ?= $(PREFIX)/sbin
+ MANDIR ?= $(PREFIX)/share/man
+ ETCDIR ?= $(DESTDIR)/etc
+-LOCALEDIR ?= /usr/share/locale
+-PAMH = $(shell ls /usr/include/security/pam_appl.h 2>/dev/null)

package/policycoreutils/0001-cross-compile-fixes.patch new file +87 -0

+       install -m 644 run_init.pamd $(ETCDIR)/pam.d/run_init
+ endif
+
+diff -urN a/semodule/Makefile b/semodule/Makefile
+--- a/semodule/Makefile        2013-02-05 19:43:22.000000000 -0600
++++ b/semodule/Makefile        2013-08-23 09:16:21.302924109 -0500
+@@ -2,7 +2,7 @@
+ PREFIX ?= $(DESTDIR)/usr
+ INCLUDEDIR ?= $(PREFIX)/include
+ SBINDIR ?= $(PREFIX)/sbin
+-MANDIR = $(PREFIX)/share/man
++MANDIR ?= $(PREFIX)/share/man
+ LIBDIR ?= $(PREFIX)/lib
+
+ CFLAGS ?= -Werror -Wall -W
+diff -urN a/sepolicy/Makefile b/sepolicy/Makefile
+--- a/sepolicy/Makefile        2013-02-05 19:43:22.000000000 -0600
++++ b/sepolicy/Makefile        2013-08-23 09:16:21.302924109 -0500
+@@ -5,25 +5,32 @@
+ BINDIR ?= $(PREFIX)/bin
+ SBINDIR ?= $(PREFIX)/sbin
+ MANDIR ?= $(PREFIX)/share/man
+-LOCALEDIR ?= /usr/share/locale
++LOCALEDIR ?= $(DESTDIR)/usr/share/locale
+ PYTHON ?= /usr/bin/python
+ BASHCOMPLETIONDIR ?= $(DESTDIR)/etc/bash_completion.d/
+ SHAREDIR ?= $(PREFIX)/share/sandbox
+-override CFLAGS = $(LDFLAGS) -I$(PREFIX)/include -DPACKAGE="policycoreutils" -Wall -Werror -Wextra -W  -DSHARED -shared
++override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DPACKAGE="policycoreutils" -Wall -Werror -Wextra -W  -DSHARED -shared
+
+ BASHCOMPLETIONS=sepolicy-bash-completion.sh
+
++PYTHON_ARGS = LDSHARED="$(CC) -shared" \
++              CROSS_COMPILING=yes              \
++              _python_sysroot=$(DESTDIR)       \
++              _python_srcdir=$(PYTHON_SRC)     \
++              _python_prefix=/usr              \
++              _python_exec_prefix=/usr
++
+ all: python-build
+
+ python-build: info.c search.c common.h policy.h policy.c
+-      $(PYTHON) setup.py build
++      $(PYTHON_ARGS) $(PYTHON) setup.py build
+
+ clean:
+       $(PYTHON) setup.py clean
+       -rm -rf build *~ \#* *pyc .#*
+
+ install:
+-      $(PYTHON) setup.py install `test -n "$(DESTDIR)" && echo --root $(DESTDIR)`
++      $(PYTHON_ARGS) $(PYTHON) setup.py install --prefix=$(PREFIX)
+       [ -d $(BINDIR) ] || mkdir -p $(BINDIR)
+       install -m 755 sepolicy.py $(BINDIR)/sepolicy
+       -mkdir -p $(MANDIR)/man8
+diff -urN a/sestatus/Makefile b/sestatus/Makefile
+--- a/sestatus/Makefile        2013-02-05 19:43:22.000000000 -0600
++++ b/sestatus/Makefile        2013-08-23 09:16:21.302924109 -0500
+@@ -1,11 +1,11 @@
+ # Installation directories.
+ PREFIX ?= $(DESTDIR)/usr
+ SBINDIR ?= $(PREFIX)/sbin
+-MANDIR = $(PREFIX)/share/man
++MANDIR ?= $(PREFIX)/share/man
+ ETCDIR ?= $(DESTDIR)/etc
+ LIBDIR ?= $(PREFIX)/lib
+
+-CFLAGS = -Werror -Wall -W
++CFLAGS ?= -Werror -Wall -W
+ override CFLAGS += -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64
+ LDLIBS = -lselinux -L$(LIBDIR)
+
+diff -urN a/setfiles/Makefile b/setfiles/Makefile
+--- a/setfiles/Makefile        2013-02-05 19:43:22.000000000 -0600
++++ b/setfiles/Makefile        2013-08-23 09:16:21.302924109 -0500
+@@ -1,24 +1,27 @@
+ # Installation directories.
+ PREFIX ?= $(DESTDIR)/usr
+ SBINDIR ?= $(DESTDIR)/sbin
+-MANDIR = $(PREFIX)/share/man
++MANDIR ?= $(PREFIX)/share/man
+ LIBDIR ?= $(PREFIX)/lib
+-AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null)
++AUDITH = $(shell ls $(DESTDIR)/usr/include/libaudit.h 2>/dev/null)
+
+-PROGRESS_STEP=$(shell grep "^\#define STAR_COUNT" restore.h | awk -S '{ print $$3 }')
+-ABORT_ON_ERRORS=$(shell grep "^\#define ABORT_ON_ERRORS" setfiles.c | awk -S '{ print $$3 }')

package/policycoreutils/0001-cross-compile-fixes.patch new file +12 -0

+       override CFLAGS += -DUSE_AUDIT
+       LDLIBS += -laudit
+ endif
+
+ all: setfiles restorecon man
+
++%.o: %.c
++      $(CC) $(CFLAGS) -c -o $@ $<
++
+ setfiles:  setfiles.o restore.o
+
+ restorecon: setfiles

package/policycoreutils/Config.in new file +36 -0

new file mode 100644
index 0000000..733b896
@@ -0,0 +1,53 @@
+config BR2_PACKAGE_POLICYCOREUTILS
+       bool "policycoreutils"
+       select BR2_PACKAGE_LIBSEMANAGE
+       select BR2_PACKAGE_LIBCAP_NG
+       select BR2_PACKAGE_GETTEXT if BR2_NEEDS_GETTEXT
+       depends on BR2_TOOLCHAIN_HAS_THREADS # libsemanage
+       depends on BR2_TOOLCHAIN_USES_GLIBC || BR2_TOOLCHAIN_USES_MUSL # uses fts.h
+       help
+         Policycoreutils is a collection of policy utilities (originally
+         the "core" set of utilities needed to use SELinux, although it
+         has grown a bit over time), which have different dependencies.
+         sestatus, secon, run_init, and newrole only use libselinux.
+         load_policy and setfiles only use libselinux and libsepol.
+         semodule and semanage use libsemanage (and thus bring in
+         dependencies on libsepol and libselinux as well). setsebool
+         uses libselinux to make non-persistent boolean changes (via
+         the kernel interface) and uses libsemanage to make persistent
+         boolean changes.
+
+         The base package will install the following utilities:
+             load_policy
+             newrole
+             restorecond
+             run_init
+             secon
+             semodule
+             semodule_deps
+             semodule_expand
+             semodule_link
+             semodule_package
+             sepolgen-ifgen
+             sestatus
+             setfiles
+             setsebool
+
+         http://selinuxproject.org/page/Main_Page

package/policycoreutils/Config.in new file +7 -0

+       help
+         Enable restorecond to be built
+
+comment "restorecond needs dbus-glib"
+       depends on !BR2_PACKAGE_DBUS_GLIB
+
+endif

package/policycoreutils/policycoreutils.hash new file +2 -0

new file mode 100644
index 0000000..575dd25
@@ -0,0 +1,2 @@
+# https://github.com/SELinuxProject/selinux/wiki/Releases
+sha256 b6881741f9f9988346a73bfeccb0299941dc117349753f0ef3f23ee86f06c1b5  policycoreutils-2.1.14.tar.gz

package/policycoreutils/policycoreutils.mk new file +7 -0

new file mode 100644
index 0000000..b03ea5c
@@ -0,0 +1,107 @@
+################################################################################
+#
+# policycoreutils
+#
+################################################################################
+
+POLICYCOREUTILS_VERSION = 2.1.14

package/policycoreutils/policycoreutils.mk new file +46 -0

+endif
+
+# Undefining _FILE_OFFSET_BITS here because of a "bug" with glibc fts.h
+# large file support.
+# See https://bugzilla.redhat.com/show_bug.cgi?id=574992 for more information
+POLICYCOREUTILS_MAKE_OPTS = \
+       $(TARGET_CONFIGURE_OPTS) \
+       CFLAGS="$(TARGET_CFLAGS) -U_FILE_OFFSET_BITS" \
+       LDFLAGS="$(TARGET_LDFLAGS) $(if $(BR2_NEEDS_GETTEXT),-lintl)"
+
+POLICYCOREUTILS_MAKE_DIRS = load_policy newrole run_init \
+       secon semodule semodule_deps semodule_expand semodule_link \
+       semodule_package sepolgen-ifgen sestatus setfiles setsebool
+
+ifeq ($(BR2_PACKAGE_POLICYCOREUTILS_RESTORECOND),y)
+POLICYCOREUTILS_DEPENDENCIES += dbus-glib
+POLICYCOREUTILS_MAKE_DIRS += restorecond
+endif
+
+define POLICYCOREUTILS_BUILD_CMDS
+       for dir in $(POLICYCOREUTILS_MAKE_DIRS) ; do \
+               $(MAKE) -C $(@D)/$${dir} $(POLICYCOREUTILS_MAKE_OPTS) DESTDIR=$(STAGING_DIR) all || exit 1 ; \
+       done
+endef
+
+define POLICYCOREUTILS_INSTALL_TARGET_CMDS
+       for dir in $(POLICYCOREUTILS_MAKE_DIRS) ; do \
+               $(MAKE) -C $(@D)/$${dir} $(POLICYCOREUTILS_MAKE_OPTS) DESTDIR=$(TARGET_DIR) install || exit 1 ; \
+       done
+endef
+
+HOST_POLICYCOREUTILS_DEPENDENCIES = host-libsemanage host-dbus-glib host-sepolgen host-setools
+
+# Undefining _FILE_OFFSET_BITS here because of a "bug" with glibc fts.h
+# large file support.
+# See https://bugzilla.redhat.com/show_bug.cgi?id=574992 for more information
+HOST_POLICYCOREUTILS_MAKE_OPTS = \
+       $(HOST_CONFIGURE_OPTS) \
+       CFLAGS+="-U_FILE_OFFSET_BITS" \
+       PYTHON="$(HOST_DIR)/usr/bin/python"
+
+ifeq ($(BR2_PACKAGE_PYTHON3),y)
+HOST_POLICYCOREUTILS_DEPENDENCIES += host-python3
+HOST_POLICYCOREUTILS_MAKE_OPTS += \
+       PYLIBVER="python$(PYTHON3_VERSION_MAJOR)" \
+       PYTHON_SRC="$(BUILD_DIR)/host-python$(PYTHON3_VERSION)"

package/policycoreutils/policycoreutils.mk new file +10 -0

+
+define HOST_POLICYCOREUTILS_BUILD_CMDS
+       for dir in $(HOST_POLICYCOREUTILS_MAKE_DIRS) ; do \
+               $(MAKE) -C $(@D)/$${dir} $(HOST_POLICYCOREUTILS_MAKE_OPTS) DESTDIR=$(HOST_DIR) all || exit 1 ; \
+       done
+endef
+
+define HOST_POLICYCOREUTILS_INSTALL_CMDS
+       for dir in $(HOST_POLICYCOREUTILS_MAKE_DIRS) ; do \
+               $(MAKE) -C $(@D)/$${dir} $(HOST_POLICYCOREUTILS_MAKE_OPTS) DESTDIR=$(HOST_DIR) install || exit 1 ; \

--
1.9.1

_______________________________________________
buildroot mailing list
buildroot at busybox.net
http://lists.busybox.net/mailman/listinfo/buildroot

Quoted 2 lines

+$(eval $(generic-package))
+$(eval $(host-generic-package))

What is the purpose of host-policycoreutils? I don't see it as dependency of policycoreutils...

From: Clayton Shotwell <[email protected]>

Signed-off-by Clayton Shotwell <[email protected]>

Signed-off-by Matt Weber <[email protected]>

---
Changes v4 -> v5:
- Removed TODO and dependency on glibc (Matt W.)
- Added lib depends to meet policycoreutils limitation on std lib

    (Matt W.)

- Added comment for when an option is not defined (Matt W.)
- Removed largefile, locale, and wchar dependencies (Clayton S.)
- Remove dependancy on host-python-pyxml (Ryan B.)
- Forced package to use $(HOST_DIR)/usr/bin/python2 for python executable (Ryan B.)
- Added host-python dependency (Clayton S.)
- Removed config menu (suggested by Thomas P.)
- Added patch to fix awk issue (Clayton S.)

Changes v3 -> v4:
- Added a dependency on host-gawk and correct the awk calls

    in the makefile to use $(AWK)

- Changed the default policy name to br_policy to differentiate the policy generated from refpolicy
- Added a install step to create a /.autorelabel file to cause the file system to be relabeled by S12SELinux init script
- Adding a default modules.conf file with an option to specify a different one. This will decrease the build time for refpolicy by removing unused policies. (implemented by Thomas P.)
- Cleaned up the configure comments (implemented by Thomas).
- Added a check to only install the documentation if the Buildroot option is enabled
- Removed the build because the install step completes the same process. Also removed the clean step because it is being removed globally from buildroot (implemented by Thomas P.)
- Added more error handling to the startup script to print a warning if SELinux fails to install the policy if it exists. This can be caused by the kernel not being configured with SELinux enabled

Changes v2 -> v3:
- Changes patch naming convention (suggested by Thomas P.)
- Added dependencies on BR2_TOOLCHAIN_HAS_THREADS and BR2_LARGEFILE (suggested by Thomas P.)
- Removed configure option for a specific patch folder (suggested by Thomas P.)
- Removed distribution configuration option (suggested by Thomas)
- Changed the monolithic configuration option to a modular configuration option (suggested by Thomas P.)
- Removed the refpolicy name option (suggested by Thomas P.)
- Corrected gramatical and comment errors (suggested by Thomas P.)
- Multiple style corrections to the mk file (suggested by Thomas P.)
- Added a comment to clairfy the usage of the the host build options for a target build

Changes v1 -> v2:
- General cleanup to the mk file to conform to the standard format
- Fixed the patch naming to match the standard 4 digit numbering
- Changed package dependencies into selects in the config

---
 package/Config.in                                  |   2 +
 package/refpolicy-contrib/Config.in                |  20 +
 package/refpolicy-contrib/refpolicy-contrib.mk     |  18 +
 .../0001-Fix-awk-references-to-use-variable.patch  |  42 +++
 package/refpolicy/Config.in                        |  91 +++++
 package/refpolicy/S00selinux                       | 136 +++++++
 package/refpolicy/config                           |   8 +
 package/refpolicy/modules.conf                     | 406 +++++++++++++++++++++
 package/refpolicy/refpolicy.hash                   |   2 +
 package/refpolicy/refpolicy.mk                     | 118 ++++++
 10 files changed, 843 insertions(+)
 create mode 100644 package/refpolicy-contrib/Config.in
 create mode 100644 package/refpolicy-contrib/refpolicy-contrib.mk
 create mode 100644 package/refpolicy/0001-Fix-awk-references-to-use-variable.patch
 create mode 100755 package/refpolicy/Config.in

 create mode 100644 package/refpolicy/S00selinux
 create mode 100644 package/refpolicy/config
 create mode 100644 package/refpolicy/modules.conf
 create mode 100644 package/refpolicy/refpolicy.hash
 create mode 100755 package/refpolicy/refpolicy.mk

package/Config.in +2 -0

index b99a7e0..dcb03d5 100644
@@ -1339,6 +1339,8 @@ endmenu
 
 menu "Security"
        source "package/policycoreutils/Config.in"
+       source "package/refpolicy/Config.in"
+       source "package/refpolicy-contrib/Config.in"
        source "package/setools/Config.in"
 endmenu
 

package/refpolicy-contrib/Config.in new file +0 -0

new file mode 100644
index 0000000..af493fd

From: Clayton Shotwell <[email protected]>

Signed-off-by Clayton Shotwell <[email protected]>

Signed-off-by Matt Weber <[email protected]>

package/refpolicy/refpolicy.mk new file +31 -0

@@ -0,0 +1,118 @@
+################################################################################
+#
+# refpolicy
+#
+################################################################################
+
+ifeq ($(BR2_PACKAGE_REFPOLICY_CUSTOM_GIT),y)
+REFPOLICY_SITE = $(call qstrip,$(BR2_PACKAGE_REFPOLICY_CUSTOM_REPO_URL))
+REFPOLICY_VERSION = $(call qstrip,$(BR2_PACKAGE_REFPOLICY_CUSTOM_REPO_VERSION))
+REFPOLICY_SITE_METHOD = git
+REFPOLICY_DEPENDENCIES += refpolicy-contrib
+else
+REFPOLICY_VERSION = 2.20130424
+REFPOLICY_SOURCE = refpolicy-$(REFPOLICY_VERSION).tar.bz2
+REFPOLICY_SITE = http://oss.tresys.com/files/refpolicy/
+endif
+REFPOLICY_LICENSE = GPLv2
+REFPOLICY_LICENSE_FILES = COPYING
+
+# Cannot use multiple threads to build the reference policy
+REFPOLICY_MAKE = $(TARGET_MAKE_ENV) $(MAKE1)
+
+REFPOLICY_DEPENDENCIES += host-m4 host-checkpolicy host-policycoreutils \
+       host-setools host-gawk host-python policycoreutils
+
+REFPOLICY_INSTALL_STAGING = YES
+
+REFPOLICY_POLICY_NAME = br_policy
+
+# To apply board specific customizations, create a refpolicy folder in
+# BR2_GLOBAL_PATCH_DIR.  These patches will be applied after the patches

package/refpolicy/refpolicy.mk new file +37 -0

+REFPOLICY_MAKE_ENV = \
+       PYTHON="$(HOST_DIR)/usr/bin/python2" \
+       AWK="$(HOST_DIR)/usr/bin/gawk" \
+       M4="$(HOST_DIR)/usr/bin/m4"
+
+
+ifeq ($(BR2_PACKAGE_REFPOLICY_MODULAR),y)
+       REFPOLICY_MONOLITHIC = n
+else
+       REFPOLICY_MONOLITHIC = y
+endif
+
+ifeq ($(BR2_PACKAGE_REFPOLICY_CUSTOM_GIT),y)
+define REFPOLICY_GIT_SUBMODULE_SETUP
+       rsync -ar $(REFPOLICY_CONTRIB_DIR)/* $(@D)/policy/modules/contrib/
+endef
+else
+REFPOLICY_MODULES_FILE = $(call qstrip,$(BR2_PACKAGE_REFPOLICY_MODULES_FILE))
+define REFPOLICY_CUSTOM_MODULES_CONF
+       cp $(REFPOLICY_MODULES_FILE) $(@D)/policy/modules.conf
+endef
+endif
+
+define REFPOLICY_CONFIGURE_CMDS
+       $(REFPOLICY_GIT_SUBMODULE_SETUP)
+       # If an external repo is used to build refpolicy, this preserves the
+       # custom modules.conf which defines the enabled components.
+       if [ -f $(@D)/policy/modules.conf ]; then \
+               mv $(@D)/policy/modules.conf $(@D)/modules.conf.bk ; \
+       fi
+       $(REFPOLICY_MAKE_ENV) $(REFPOLICY_MAKE) -C $(@D) bare \
+               $(REFPOLICY_MAKE_CMDS) DESTDIR=$(STAGING_DIR)
+       $(SED) "/TYPE/c\TYPE = $(BR2_PACKAGE_REFPOLICY_TYPE)" $(@D)/build.conf
+       $(SED) "/MONOLITHIC/c\MONOLITHIC = $(REFPOLICY_MONOLITHIC)" $(@D)/build.conf
+       $(SED) "/NAME/c\NAME = $(REFPOLICY_POLICY_NAME)" $(@D)/build.conf
+       $(REFPOLICY_MAKE_ENV) $(REFPOLICY_MAKE) -C $(@D) conf \
+               $(REFPOLICY_MAKE_CMDS) DESTDIR=$(STAGING_DIR)

package/refpolicy/refpolicy.mk new file +30 -1

+               $(REFPOLICY_MAKE_CMDS) DESTDIR=$(STAGING_DIR)
+endef
+
+define REFPOLICY_INSTALL_TARGET_CMDS
+       $(REFPOLICY_MAKE_ENV) $(REFPOLICY_MAKE) -C $(@D) install \
+               $(REFPOLICY_MAKE_CMDS) DESTDIR=$(TARGET_DIR)
+       $(INSTALL) -m 0755 -D package/refpolicy/config $(TARGET_DIR)/etc/selinux/config
+       $(SED) "/^SELINUXTYPE/c\SELINUXTYPE=$(REFPOLICY_POLICY_NAME)" \
+               $(TARGET_DIR)/etc/selinux/config
+       touch $(TARGET_DIR)/.autorelabel
+       $(RM) $(TARGET_DIR)/etc/selinux/$(REFPOLICY_POLICY_NAME)/booleans
+endef
+
+define REFPOLICY_INSTALL_INIT_SYSV
+       $(INSTALL) -m 0755 -D package/refpolicy/S00selinux \
+               $(TARGET_DIR)/etc/init.d/S00selinux
+endef
+
+define REFPOLICY_POLICY_COMPILE
+       $(INSTALL) -d -m 0755 $(TARGET_DIR)/etc/selinux/$(REFPOLICY_POLICY_NAME)/policy
+       $(INSTALL) -d -m 0755 $(TARGET_DIR)/etc/selinux/$(REFPOLICY_POLICY_NAME)/modules/active/modules
+       $(INSTALL) -d -m 0755 $(TARGET_DIR)/etc/selinux/$(REFPOLICY_POLICY_NAME)/contexts/files
+       touch $(TARGET_DIR)/etc/selinux/$(REFPOLICY_POLICY_NAME)/contexts/files/file_contexts.local
+endef
+
+ifeq ($(BR2_PACKAGE_REFPOLICY_MODULAR),y)
+       REFPOLICY_POST_INSTALL_TARGET_HOOKS += REFPOLICY_POLICY_COMPILE
+endif
+
+$(eval $(generic-package))
--

1.9.1

_______________________________________________
buildroot mailing list
buildroot at busybox.net
http://lists.busybox.net/mailman/listinfo/buildroot

package/refpolicy/refpolicy.mk line 41

Quoted 8 lines

package/refpolicy/refpolicy.mk new file +8 -0

+# Pointing to the host compiler to build a sort application during the build.
+# The host compiler tools are not used for any part of the refpolicy build.
+# Note, the TEST_TOOLCHAIN option will also set the
+# LD_LIBRARY_PATH at run time.
+REFPOLICY_MAKE_CMDS = $(HOST_CONFIGURE_OPTS) \
+       TEST_TOOLCHAIN="$(HOST_DIR)"
+
+# Build requies python2 to run

s/requies/requires/

package/refpolicy/refpolicy.mk line 88

Quoted 3 lines

package/refpolicy/refpolicy.mk new file +3 -0

+define REFPOLICY_INSTALL_STAGING_CMDS
+       $(REFPOLICY_MAKE_ENV) $(REFPOLICY_MAKE) -C $(@D) install-src install-headers \
+               $(if $(BR2_HAVE_DOCUMENTATION),install-docs) \

No need for conditional target. BR2_HAVE_DOCUMENTATION is already deprecated and will be removed sooner or later.
So for staging install, choose either to always or never install the doc.

From: Matt Weber <[email protected]>

Add a configure option to enable the SELinux support in the busybox configuration from the Buildroot menuconfig.

Signed-off-by Thomas Petazzoni <[email protected]>

Signed-off-by Clayton Shotwell <[email protected]>

Signed-off-by Matt Weber <[email protected]>

package/busybox/Config.in +1 -0

+
 config BR2_PACKAGE_BUSYBOX_WATCHDOG
        bool "Install the watchdog daemon startup script"
        help

package/busybox/busybox.mk +9 -1

index dbee100..f60e3f2 100644
@@ -171,6 +171,14 @@ define BUSYBOX_INSTALL_INDIVIDUAL_BINARIES
 endef
 endif
 
+ifeq ($(BR2_PACKAGE_BUSYBOX_SELINUX),y)
+BUSYBOX_DEPENDENCIES += host-pkgconf libselinux libsepol
+define BUSYBOX_SET_SELINUX
+       $(call KCONFIG_ENABLE_OPT,CONFIG_SELINUX,$(BUSYBOX_BUILD_CONFIG))
+       $(call KCONFIG_ENABLE_OPT,CONFIG_SELINUXENABLED,$(BUSYBOX_BUILD_CONFIG))
+endef
+endif
+
 define BUSYBOX_INSTALL_LOGGING_SCRIPT
        if grep -q CONFIG_SYSLOGD=y $(@D)/.config; then \
                $(INSTALL) -m 0755 -D package/busybox/S01logging \

@@ -207,6 +215,7 @@ define BUSYBOX_KCONFIG_FIXUP_CMDS
        $(BUSYBOX_SET_INIT)
        $(BUSYBOX_SET_WATCHDOG)
        $(BUSYBOX_CONFIGURE_INDIVIDUAL_BINARIES)
+       $(BUSYBOX_SET_SELINUX)
 endef
 
 define BUSYBOX_CONFIGURE_CMDS
--

1.9.1

_______________________________________________
buildroot mailing list
buildroot at busybox.net
http://lists.busybox.net/mailman/listinfo/buildroot

Hi Clayton,

Quoted 9 lines · Clayton Shotwell

From: Matt Weber <[email protected]>

Add a configure option to enable the SELinux support in the busybox configuration from the Buildroot menuconfig.

Signed-off-by Thomas Petazzoni <[email protected]>

Signed-off-by Clayton Shotwell <[email protected]>

Signed-off-by Matt Weber <[email protected]>

[...]

Quoted 8 lines

package/busybox/Config.in +0 -0

index 275e317..a60c54b 100644
@@ -35,6 +35,12 @@ comment "Busybox individual binaries depends on dynamic libraries"
        depends on BR2_STATIC_LIBS
        depends on BR2_bfin
 

package/busybox/Config.in comment "Busybox individual binaries depends on dynamic libraries" · line 42

Quoted 5 lines

package/busybox/Config.in +5 -0

+config BR2_PACKAGE_BUSYBOX_SELINUX
+       select BR2_PACKAGE_LIBSELINUX
+       depends on BR2_TOOLCHAIN_HAS_THREADS
+       depends on !BR2_STATIC_LIBS
+       bool "Enable SELinux support"

Does not this option also need to select
BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES?

Quoted 7 lines

package/busybox/Config.in comment "Busybox individual binaries depends on dynamic libraries" · line 42

Quoted 5 lines

package/busybox/Config.in +5 -0

+config BR2_PACKAGE_BUSYBOX_SELINUX
+       select BR2_PACKAGE_LIBSELINUX
+       depends on BR2_TOOLCHAIN_HAS_THREADS
+       depends on !BR2_STATIC_LIBS
+       bool "Enable SELinux support"

Does not this option also need to select
BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES?

Those features are not necessarily dependent, it mostly depends on what parts of busybox are being used. For instance, if a configuration only used a couple of minor busybox features, such as simple command line utilities, the symlinked version of busybox could be used to save space. If busybox was providing more features, such as crond, then individual binaries would have to be enabled for the SELinux type transitions to occur properly. I would like to leave that up to the individual user to enable the individual binaries as needed.

Dear Clayton Shotwell,

Quoted 8 lines · Clayton Shotwell

Quoted 7 lines

package/busybox/Config.in comment "Busybox individual binaries depends on dynamic libraries" · line 42

Quoted 5 lines

package/busybox/Config.in +5 -0

+config BR2_PACKAGE_BUSYBOX_SELINUX
+       select BR2_PACKAGE_LIBSELINUX
+       depends on BR2_TOOLCHAIN_HAS_THREADS
+       depends on !BR2_STATIC_LIBS
+       bool "Enable SELinux support"

Does not this option also need to select
BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES?

Quoted 8 lines

Those features are not necessarily dependent, it mostly depends on what parts of busybox are being used. For instance, if a configuration only used a couple of minor busybox features, such as simple command line utilities, the symlinked version of busybox could be used to save space. If busybox was providing more features, such as crond, then individual binaries would have to be enabled for the SELinux type transitions to occur properly. I would like to leave that up to the individual user to enable the individual binaries as needed.

Then exactly this needs to be copy/pasted in the help text of this option :-)