libselinux: bump to 2.7

PATCH Superseded Adam Duskett 3 participants 9 messages Oct 17, 2017 – Oct 19, 2017

lore

Share & tools

lore

Adam Duskett

author

2017-10-17 18:54 UTC #0 lore raw

PATCH v9 1/5 libselinux: bump to 2.7

remove patch as it's in this release.

Signed-off-by Adam Duskett <[email protected]>

---
Changes v1 -> v2:
- None

Changes v2 -> v3:
- None

Changes v3 -> v4:
- None

Changes v4 -> v5:
- None

Changes v5 -> v6:
- None

Changes v6 -> v7:
- None

Changes v7 -> v8:
- None

Changes v8 -> v9:
- None

 ...src-regex.c-support-old-compilers-for-the.patch | 47 ----------------------
 package/libselinux/libselinux.hash                 |  4 +-
 package/libselinux/libselinux.mk                   |  4 +-
 3 files changed, 4 insertions(+), 51 deletions(-)
 delete mode 100644 package/libselinux/0001-libselinux-src-regex.c-support-old-compilers-for-the.patch

package/libselinux/0001-libselinux-src-regex.c-support-old-compilers-for-the.patch deleted +0 ~~-47~~

deleted file mode 100644
index 3bda607512..0000000000
@@ -1,47 +0,0 @@
-From e0803c0bdbb1abf06b6b5bb1b52fdb733505b8f7 Mon Sep 17 00:00:00 2001
-From: Thomas Petazzoni <[email protected]>
-Date: Wed, 25 Jan 2017 22:41:02 +1300
-Subject: [PATCH] src/regex.c: support old compilers for the endian
- check
-
-libselinux 2.6 has added some code in regex.c that uses __BYTE_ORDER__
-to determine the system endianness. Unfortunately, this definition
-provided directly by the compiler doesn't exist in older gcc versions
-such as gcc 4.4.
-
-In order to address this, this commit extends the logic to use
-<endian.h> definitions if __BYTE_ORDER__ is not provided by the
-compiler. This allows libselinux to build properly with gcc 4.4.
-
-Signed-off-by: Thomas Petazzoni <[email protected]>
----
- src/regex.c | 13 ++++++++++++-
- 1 file changed, 12 insertions(+), 1 deletion(-)
-
-diff --git a/src/regex.c b/src/regex.c
-index a3b427b..0c5ad27 100644
---- a/src/regex.c
-+++ b/src/regex.c
-@@ -13,7 +13,18 @@
- #endif
- 
- #ifndef __BYTE_ORDER__
--#error __BYTE_ORDER__ not defined. Unable to determine endianness.
-+
-+/* If the compiler doesn't define __BYTE_ORDER__, try to use the C
-+ * library <endian.h> header definitions. */
-+#include <endian.h>
-+#ifndef __BYTE_ORDER
-+#error Neither __BYTE_ORDER__ nor __BYTE_ORDER defined. Unable to determine endianness.
-+#endif
-+
-+#define __ORDER_LITTLE_ENDIAN __LITTLE_ENDIAN
-+#define __ORDER_BIG_ENDIAN __BIG_ENDIAN
-+#define __BYTE_ORDER__ __BYTE_ORDER
-+
- #endif
- 
- #ifdef USE_PCRE2
--- 
-2.7.4
-

package/libselinux/libselinux.hash +2 -2

index 76130b2dc0..3c60d5111d 100644
@@ -1,2 +1,2 @@
-# Locally computed
-sha256 4ea2dde50665c202253ba5caac7738370ea0337c47b251ba981c60d24e1a118a libselinux-2.6.tar.gz
+# From: https://github.com/SELinuxProject/selinux/wiki/Releases
+sha256 d0fec0769b3ad60aa7baf9b9a4b7a056827769dc2dadda0dc0eb59b3d1c18c57 libselinux-2.7.tar.gz

package/libselinux/libselinux.mk +2 -2

index f23eea4962..8ac8000de5 100644
@@ -4,8 +4,8 @@
 #
 ################################################################################
 
-LIBSELINUX_VERSION = 2.6
-LIBSELINUX_SITE = https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20161014
+LIBSELINUX_VERSION = 2.7
+LIBSELINUX_SITE = https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20170804
 LIBSELINUX_LICENSE = Public Domain
 LIBSELINUX_LICENSE_FILES = LICENSE

Signature · 1 line

2.13.6

Adam Duskett

author

2017-10-17 18:54 UTC #1 lore raw

PATCH v9 2/5 libsemanage: bump to 2.7

Signed-off-by Adam Duskett <[email protected]>

---
Changes v1 -> v2:
- None

Changes v2 -> v3:
- None

Changes v3 -> v4:
- None

Changes v4 -> v5:
- None

Changes v5 -> v6:
- None

Changes v6 -> v7:
- None

Changes v7 -> v8:
- None

Changes v8 -> v9:
- None

 package/libsemanage/libsemanage.hash | 4 ++--
 package/libsemanage/libsemanage.mk   | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

package/libsemanage/libsemanage.hash +2 -2

index 62f4d833a5..c386571591 100644
@@ -1,2 +1,2 @@
-# Locally computed
-sha256 4f81541047290b751f2ffb926fcd381c186f22db18d9fe671b0b4a6a54e8cfce libsemanage-2.6.tar.gz
+# From: https://github.com/SELinuxProject/selinux/wiki/Releases
+sha256 07e9477714ce6a4557a1fe924ea4cb06501b62d0fa0e3c0dc32a2cf47cb8d476 libsemanage-2.7.tar.gz

package/libsemanage/libsemanage.mk +2 -2

index 2964c56f96..829409f527 100644
@@ -4,8 +4,8 @@
 #
 ################################################################################
 
-LIBSEMANAGE_VERSION = 2.6
-LIBSEMANAGE_SITE = https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20161014
+LIBSEMANAGE_VERSION = 2.7
+LIBSEMANAGE_SITE = https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20170804
 LIBSEMANAGE_LICENSE = LGPL-2.1+
 LIBSEMANAGE_LICENSE_FILES = COPYING
 LIBSEMANAGE_DEPENDENCIES = host-bison host-flex audit libselinux ustr bzip2

Signature · 1 line

2.13.6

Thomas Petazzoni

Applied

2017-10-17 21:18 UTC #2 lore raw

PATCH v9 2/5 libsemanage: bump to 2.7

Hello,

Quoted 4 lines · Adam Duskett

Signed-off-by Adam Duskett <[email protected]>
---
Changes v1 -> v2:
- None

Applied to master, thanks.

Thomas

Signature · 3 lines

Thomas Petazzoni, CTO, Free Electrons
Embedded Linux, Kernel and Android engineering
http://free-electrons.com

PATCH v9 3/5 The reason for combining these patches is because the old version of setools is not compatible iwth libsepol 2.7. If a user where to do a git pull on a patch that only updates libsepol or setools, the build would fail to compile.

In reply to Adam Duskett

setools has been completely rewritten in python instead of C.

The current version of setools includes a few programs that require python-qt5 or python-networkx to run, however the package does not check to see if these exist when compiling, and will install the scripts to the target directory even if they don't exist.

In the case of python-networkx, this package is not available on Buildroot. The scripts that require them are: sedta and seinfoflow.
In the case of python-qt5, qpol is the script that requires it.

Some setools.mk notes to get the package to compile:

- Convert the package .mk to use python-package instead of autotools-package.

- Remove host variant of setools as it is no longer a dependency for policycoreutils.

- setup.py hard codes base_lib_dirs to point to several host directories. To fix this, sed is used before compiling to point the base_lib_dirs to the staging directory.

- setup.py also includes the "Werror" flag, however compilers before gcc6 cause a few autogenerated variables to not be initialized before use, causing the build to fail.
To fix this, sed is used before compiling to remove the Werror flag.

- Remove sedta and seinfoflow from the target system after install. These packages rely on the package python-networkx which is not available in buildroot.

- Remove the installed apol package and the setoolsgui directory from the target directory if python-qt5 is not selected.

Other changes:
- Removed all patches, as they are not compatible with the new version of setools.

- Add COPYING, COPYING.GPL, and COPYING.LGPL to setools.hash

Signed-off-by Adam Duskett <[email protected]>

---
Changes v1 -> v2:
- None

Changes v2 -> v3:
- Added setools update to this patch due to build failures. (Matthew Weber)

Changes v3 -> v4:
- Change commit message to read:
"Convert the package .mk to use python-package instead of autotools-package." (Thomas)
- Added comment explaining that setools is no longer a dependency for policycoreutils. (Thomas)
- Add "depends on BR2_USE_MMU" to setools Config.in (Thomas)
- Add "(requires python-qt5)" to apol line in setools Config.in (Thomas)
- Fix setools comment. (Thomas)
- Add prefix to variables in setools.mk (Thomas)
- Add remove-werror-flag-from-setup.patch patch. (Thomas)
- enclose SETOOLS_REMOVE_QT_SCRIPTS in "ifeq ($(BR2_PACKAGE_PYTHON_PYQT5),)"

Changes v4 -> v5:
- Add host variant of setools because the package "refpolicy" depends on it. (Matthew Weber)

Changes v5 -> v6:
- Add two patches from setools-4.1.1-5.fc28.src.rpm, these are needed to run the console tools.
- Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch:
- This patch removes the need for networkx for the console tools.
- bswap_-macros-are-defined-in-byteswap.h.patch:
- This patch fixes a ImportError on s390x.
- Add prefix on line 44 of setools.mk to REMOVE_BROKEN_SCRIPTS variable.
- Add python-setuptools as a dependency of setools (pkg_resources)
- Add python-enum34 as a dependency of setools if python2 is selected.

Changes v6 -> v7:
- None

Changes v7 -> v8:
- Removed uneeded 0003-bswap_-macros-are-defined-in-byteswap.h.patch (Thomas)
- Added HOST_SETOOLS_REMOVE_BROKEN_SCRIPTS to setools.mk (Matthew Weber)

Changes v8 -> v9:
- Changed HOST_SETOOLS_POST_INSTALL_TARGET_HOOKS to HOST_SETOOLS_POST_INSTALL_HOOKS.
- Fixed up some comments in setools.mk to make it more clear what SETOOLS_FIX_SETUP and HOST_SETOOLS_FIX_SETUP where doing and why.
- Changed rmdir --ignore-fail-on-non-empty to $(RM) -r, as the previous wasn't actually removing the directory.

 package/libsepol/0001-support-static-only.patch    |  32 +++--
 package/libsepol/0003-revert-ln-relative.patch     |  18 ++-
 package/libsepol/libsepol.hash                     |   4 +-
 package/libsepol/libsepol.mk                       |   4 +-
 package/setools/0001-cross-compile-fixes.patch     | 125 ------------------
 .../0001-remove-werror-flag-from-setup.patch       |  29 +++++
 ...rt-use-setools.InfoFlowAnalysis-and-setoo.patch | 142 +++++++++++++++++++++
 package/setools/0002-move-python-check.patch       |  25 ----
 ...s-Update-for-2015-02-02-Userspace-release.patch |  90 -------------
 package/setools/Config.in                          |  37 ++----
 package/setools/setools.hash                       |   7 +-
 package/setools/setools.mk                         | 117 ++++++++---------
 12 files changed, 277 insertions(+), 353 deletions(-)
 delete mode 100644 package/setools/0001-cross-compile-fixes.patch
 create mode 100644 package/setools/0001-remove-werror-flag-from-setup.patch
 create mode 100644 package/setools/0002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch
 delete mode 100644 package/setools/0002-move-python-check.patch
 delete mode 100644 package/setools/0003-setools-Update-for-2015-02-02-Userspace-release.patch

package/libsepol/0001-support-static-only.patch +19 ~~-13~~

index 3e6d555e96..185a5641de 100644
@@ -1,4 +1,7 @@
-Add support for static-only build
+From 2140db697c7f1da2a0a3f7bbcb14c1a0dade84e5 Mon Sep 17 00:00:00 2001
+From: Adam Duskett <[email protected]>
+Date: Mon, 9 Oct 2017 16:28:12 -0400
+Subject: [PATCH] Add support for static-only build
 
 Instead of unconditionally building shared libraries, this patch
 improves the libsepol build system with a "STATIC" variable, which

@@ -7,30 +10,30 @@ libraries. It allows to support cases where the target architecture
 does not have support for shared libraries.
 
 Signed-off-by: Thomas Petazzoni <[email protected]>
-Signed-off-by: Adam Duskett <[email protected]>
-
-Index: b/src/Makefile
-===================================================================
+Signed-off-by: Adam Duskett <[email protected]>
+---
+ src/Makefile | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
 
 diff --git a/src/Makefile b/src/Makefile
-index db6c2ba..0006285 100644
+index 819d261..040921d 100644
 --- a/src/Makefile
 +++ b/src/Makefile
-@@ -30,8 +30,12 @@ LOBJS += $(sort $(patsubst %.c,%.lo,$(wildcard $(CILDIR)/src/*.c) $(CIL_GENERATE
- override CFLAGS += -I$(CILDIR)/include
+@@ -40,7 +40,12 @@ LDFLAGS += -undefined dynamic_lookup
+ LN=gln
  endif
  
+-all: $(LIBA) $(LIBSO) $(LIBPC)
 +ALL_TARGETS = $(LIBA) $(LIBPC)
 +ifeq ($(STATIC),)
 +ALL_TARGETS += $(LIBSO)
 +endif
-
--all: $(LIBA) $(LIBSO) $(LIBPC)
++
 +all: $(ALL_TARGETS)
  
-
+ 
  $(LIBA):  $(OBJS)
-@@ -66,11 +70,13 @@
+@@ -82,11 +87,13 @@ endif
  install: all
  	test -d $(LIBDIR) || install -m 755 -d $(LIBDIR)
  	install -m 644 $(LIBA) $(LIBDIR)

@@ -41,8 +44,11 @@ index db6c2ba..0006285 100644
 +ifeq ($(STATIC),)
 +	test -d $(SHLIBDIR) || install -m 755 -d $(SHLIBDIR)
 +	install -m 755 $(LIBSO) $(SHLIBDIR)
- 	ln -sf --relative $(SHLIBDIR)/$(LIBSO) $(LIBDIR)/$(TARGET)
+ 	$(LN) -sf --relative $(SHLIBDIR)/$(LIBSO) $(LIBDIR)/$(TARGET)
 +endif
  
  relabel:
  	/sbin/restorecon $(SHLIBDIR)/$(LIBSO)
+-- 
+2.13.6
+

package/libsepol/0003-revert-ln-relative.patch +14 -4

index 0902d8d40e..488a9abea0 100644
@@ -1,4 +1,7 @@
-Makefile: revert libsepol: use ln --relative to create .so symlinks
+From 16b2b0e21e10727065042a1baabd1a887757c65c Mon Sep 17 00:00:00 2001
+From: Adam Duskett <[email protected]>
+Date: Mon, 9 Oct 2017 16:29:36 -0400
+Subject: [PATCH] Makefile: revert libsepol: use ln --relative to create .so symlinks
 
 This reverts 71393a181d63c9baae5fe8dcaeb9411d1f253998

@@ -9,16 +12,23 @@ they are maintained (up to 10 years in some cases?).
 For the sake of Buildroot, revert the upstream patch.
 
 Signed-off-by: "Yann E. MORIN" <[email protected]>
+---
+ src/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
 
-diff -durN a/src/Makefile b/src/Makefile
+diff --git a/src/Makefile b/src/Makefile
+index 040921d..e811c9e 100644
 --- a/src/Makefile
 +++ b/src/Makefile
-@@ -77,7 +77,7 @@
+@@ -92,7 +92,7 @@ install: all
  ifeq ($(STATIC),)
  	test -d $(SHLIBDIR) || install -m 755 -d $(SHLIBDIR)
  	install -m 755 $(LIBSO) $(SHLIBDIR)
--	ln -sf --relative $(SHLIBDIR)/$(LIBSO) $(LIBDIR)/$(TARGET)
+-	$(LN) -sf --relative $(SHLIBDIR)/$(LIBSO) $(LIBDIR)/$(TARGET)
 +	cd $(LIBDIR) && ln -sf ../../`basename $(SHLIBDIR)`/$(LIBSO) $(TARGET)
  endif
  
  relabel:
+-- 
+2.13.6
+

package/libsepol/libsepol.hash +2 -2

index 6c705067a2..08e2bf97a4 100644
@@ -1,2 +1,2 @@
-# From https://github.com/SELinuxProject/selinux/wiki/Releases
-sha256 d856d6506054f52abeaa3543ea2f2344595a3dc05d0d873ed7f724f7a16b1874  libsepol-2.6.tar.gz
+# From: https://github.com/SELinuxProject/selinux/wiki/Releases
+sha256 d69d3bd8ec901a3bd5adf2be2fb47fb1a685ed73066ab482e7e505371a48f9e7  libsepol-2.7.tar.gz

package/libsepol/libsepol.mk +2 -2

index 21ca419c74..c54c3bfc42 100644
@@ -4,8 +4,8 @@
 #
 ################################################################################
 
-LIBSEPOL_VERSION = 2.6
-LIBSEPOL_SITE = https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20161014
+LIBSEPOL_VERSION = 2.7
+LIBSEPOL_SITE = https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20170804
 LIBSEPOL_LICENSE = LGPL-2.1+
 LIBSEPOL_LICENSE_FILES = COPYING

package/setools/0001-cross-compile-fixes.patch deleted +0 ~~-125~~

125 lines not on this page · raw message

package/setools/0001-remove-werror-flag-from-setup.patch new file +29 -0

new file mode 100644
index 0000000000..b1446e2ec3
@@ -0,0 +1,29 @@
+From b2fe84bfd00117d4897f1f2e8f83d3410eb188b8 Mon Sep 17 00:00:00 2001
+From: Adam Duskett <[email protected]>
+Date: Thu, 12 Oct 2017 22:04:58 -0400
+Subject: [PATCH] remove werror flag from setup
+
+Compilers older than gcc6 will generate uninitialized variable warnings which
+will cause compiling to fail.
+
+Signed-off-by: Adam Duskett <[email protected]>
+---
+ setup.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/setup.py b/setup.py
+index 2ca44c9..9319bf6 100644
+--- a/setup.py
++++ b/setup.py
+@@ -146,7 +146,7 @@ ext_py_mods = [Extension('setools.policyrep._qpol',
+                           'libqpol/policy_scan.c',
+                           'libqpol/xen_query.c'],
+                          include_dirs=include_dirs,
+-                         extra_compile_args=['-Werror', '-Wextra',
++                         extra_compile_args=['-Wextra',
+                                              '-Waggregate-return',
+                                              '-Wfloat-equal',
+                                              '-Wformat', '-Wformat=2',
+-- 
+2.13.6
+

package/setools/0002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch new file +142 -0

142 lines not on this page · raw message

package/setools/0002-move-python-check.patch deleted +0 ~~-25~~

deleted file mode 100644
index cef2cec996..0000000000
@@ -1,25 +0,0 @@
-Correct a build issue that occurs when python is not found
-in the path. This check should only be done if swig-python
-option is selected.
-
-Signed-off-by Clayton Shotwell <[email protected]>
-
---- a/configure.ac	2015-05-15 12:28:07.566060349 -0500
-+++ b/configure.ac	2015-05-28 15:07:25.357072800 -0500
-@@ -217,8 +217,6 @@
-    do_swigify=yes
- fi
- 
--AM_PATH_PYTHON(2.7)
--
- AC_ARG_ENABLE(swig-python,
-               AC_HELP_STRING([--enable-swig-python],
-                              [build SWIG interfaces for Python]),
-@@ -227,6 +225,7 @@
-    if test ${do_swigify} = no; then
-       AC_PROG_SWIG(2.0.0)
-    fi
-+   AM_PATH_PYTHON(2.7)
-    SWIG_PYTHON
-    do_swigify_python=yes
-    do_swigify=yes

package/setools/0003-setools-Update-for-2015-02-02-Userspace-release.patch deleted +0 ~~-90~~

90 lines not on this page · raw message

package/setools/Config.in +14 ~~-23~~

index d7b119ffc6..ae0c45fe3f 100644
@@ -1,36 +1,27 @@
 config BR2_PACKAGE_SETOOLS
 	bool "setools"
-	depends on BR2_TOOLCHAIN_HAS_THREADS
+	depends on !BR2_arc # arc: libselinux not available
 	depends on !BR2_STATIC_LIBS
-	depends on BR2_INSTALL_LIBSTDCPP
+	depends on BR2_TOOLCHAIN_HAS_THREADS
 	depends on BR2_USE_WCHAR
 	depends on BR2_TOOLCHAIN_USES_GLIBC # libselinux
-	# bfin: infamous _ symbol prefix issue
-	# nios2: triggers some toolchain issue "No symbol version
-	# section for versioned symbol"
-	# arc: libselinux not available
-	depends on !BR2_nios2 && !BR2_bfin && !BR2_arc
+	depends on BR2_USE_MMU
+	select BR2_PACKAGE_PYTHON3 if !BR2_PACKAGE_PYTHON
+	select BR2_PACKAGE_PYTHON_ENUM34 if !BR2_PACKAGE_PYTHON3
+	select BR2_PACKAGE_PYTHON_SETUPTOOLS
 	select BR2_PACKAGE_LIBSELINUX
-	select BR2_PACKAGE_SQLITE
-	select BR2_PACKAGE_LIBXML2
-	select BR2_PACKAGE_BZIP2
 	help
 	  SETools is an open source project designed to facilitate
 	  SELinux policy analysis. The primary tools are:
-	   * apol - analyze a SELinux policy.
-	   * seaudit - analyze audit messages from SELinux.
-	   * seaudit-report - generate highly-customized audit log
-	     reports.
-	   * sechecker - command line tool for performing modular
-	     checks on an SELinux policy.
+	   * apol - analyze a SELinux policy. (requires python-qt5)
 	   * sediff - semantic policy difference tool for SELinux.
-	   * secmds - command-line tools to analyze and search SELinux
-	     policy.
+	   * sedta - Perform domain transition analyses
+	   * sesearch - Search rules (allow, type_transition, etc.)
 
-	  https://github.com/TresysTechnology/setools3/wiki
+	  https://github.com/TresysTechnology/setools
 
 comment "setools needs a glibc toolchain w/ threads, C++, wchar, dynamic library"
-	depends on !BR2_TOOLCHAIN_HAS_THREADS || BR2_STATIC_LIBS \
-		|| !BR2_USE_WCHAR || !BR2_INSTALL_LIBSTDCPP \
-		|| !BR2_TOOLCHAIN_USES_GLIBC
-	depends on !BR2_nios2 && !BR2_bfin && !BR2_arc
+	depends on BR2_USE_MMU && !BR2_arc
+	depends on !BR2_TOOLCHAIN_HAS_THREADS || BR2_STATIC_LIBS || \
+		!BR2_USE_WCHAR || !BR2_TOOLCHAIN_USES_GLIBC || \
+		!BR2_INSTALL_LIBSTDCPP

package/setools/setools.hash +5 -2

index d422e6607b..8729297064 100644
@@ -1,4 +1,7 @@
 # From https://github.com/TresysTechnology/setools3/wiki/Download
-md5	d68d0d4e4da0f01da0f208782ff04b91	setools-3.3.8.tar.bz2
+md5	d68d0d4e4da0f01da0f208782ff04b91	setools-4.1.1.tar.bz2
 # Locally computed
-sha256	44387ecc9a231ec536a937783440cd8960a72c51f14bffc1604b7525e341e999	setools-3.3.8.tar.bz2
+sha256	46a927ea2b163cbe1d35cc35da43e45853e13720c7e02d4cf75a498783c19610 setools-4.1.1.tar.gz
+sha256  2f7547e10f76a382c24c053595f38a5cc6dda9347f508f254ca490e0046a9624 COPYING
+sha256  8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643 COPYING.GPL
+sha256  dc626520dcd53a22f727af3ee42c770e56c97a64fe3adb063799d8ab032fe551 COPYING.LGPL

package/setools/setools.mk +50 ~~-67~~

131 lines not on this page · raw message

Signature · 1 line

2.13.6

Adam Duskett

author

2017-10-17 18:54 UTC #4 lore raw

PATCH v9 4/5 checkpolicy: bump to 2.7

In reply to Adam Duskett

Also remove patch, as it's in this release.

Signed-off-by Adam Duskett <[email protected]>

---
Changes v1 -> v2:
- None

Changes v2 -> v3:
- None

Changes v3 -> v4:
- None

Changes v4 -> v5:
- None

Changes v5 -> v6:
- None

Changes v6 -> v7:
- None

Changes v7 -> v8:
- None

Changes v8 -> v9:
- None

 .../0001-checkpolicy-remove-lfl-from-LDLIBS.patch  | 58 ----------------------
 package/checkpolicy/checkpolicy.hash               |  2 +-
 package/checkpolicy/checkpolicy.mk                 |  4 +-
 3 files changed, 3 insertions(+), 61 deletions(-)
 delete mode 100644 package/checkpolicy/0001-checkpolicy-remove-lfl-from-LDLIBS.patch

package/checkpolicy/0001-checkpolicy-remove-lfl-from-LDLIBS.patch deleted +0 ~~-58~~

deleted file mode 100644
index c0b6de8a5a..0000000000
@@ -1,58 +0,0 @@
-From 4d215a1e8111e14f6074f7abe2559800b6f4838c Mon Sep 17 00:00:00 2001
-From: Adam Duskett <[email protected]>
-Date: Sat, 20 May 2017 11:01:08 -0400
-Subject: [PATCH] checkpolicy: remove -lfl from LDLIBSlogin
-
-When building checkpolicy/test, the linker reports the following error:
-cc   dispol.o  -lfl /usr/src/selinux/DESTDIR/usr/lib/libsepol.a
--L/usr/src/selinux/DESTDIR/usr/lib -o dispol
-/usr/lib/gcc/x86_64-pc-linux-gnu/6.2.1/../../../../lib/libfl.so:
-undefined reference to `yylex'
-collect2: error: ld returned 1 exit status
-
-According to flex documentation
-(https://github.com/westes/flex/blob/master/doc/flex.texi), -lfl is used
-to provide an implementation for yywrap(). However every flex file now
-uses "%option noyywrap", which makes -lfl no longer mandatory. Remove
-this option from checkpolicy Makefiles.
-
-
-Backported from:
-https://patchwork.kernel.org/patch/9450549/
-
-Original author: Nicolas Iooss <[email protected]>
-Signed-off-by: Adam Duskett <[email protected]>
----
- Makefile      | 2 +-
- test/Makefile | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/Makefile b/Makefile
-index 53a3074..875cf00 100644
---- a/Makefile
-+++ b/Makefile
-@@ -20,7 +20,7 @@ CHECKOBJS = y.tab.o lex.yy.o queue.o module_compiler.o parse_util.o \
- CHECKPOLOBJS = $(CHECKOBJS) checkpolicy.o
- CHECKMODOBJS = $(CHECKOBJS) checkmodule.o
- 
--LDLIBS=$(LIBDIR)/libsepol.a -lfl
-+LDLIBS=$(LIBDIR)/libsepol.a
- 
- GENERATED=lex.yy.c y.tab.c y.tab.h
- 
-diff --git a/test/Makefile b/test/Makefile
-index c2367e1..e7bd717 100644
---- a/test/Makefile
-+++ b/test/Makefile
-@@ -9,7 +9,7 @@ INCLUDEDIR ?= $(PREFIX)/include
- CFLAGS ?= -g -Wall -W -Werror -O2 -pipe
- override CFLAGS += -I$(INCLUDEDIR)
- 
--LDLIBS=-lfl $(LIBDIR)/libsepol.a -L$(LIBDIR)
-+LDLIBS=$(LIBDIR)/libsepol.a -L$(LIBDIR)
- 
- all: dispol dismod
- 
--- 
-2.9.3
-

package/checkpolicy/checkpolicy.hash +1 -1

index 6208d7749c..7397393a76 100644
@@ -1,2 +1,2 @@
 # https://github.com/SELinuxProject/selinux/wiki/Releases
-sha256 0bebd18688ca8027b1b3b4ff1532c0626f1fe49883ae6cb74d9d385940e74157  checkpolicy-2.6.tar.gz
+sha256 5413479f1dcde866c19896b4dbfec315d822aa431606e1d03c944408984c3201  checkpolicy-2.7.tar.gz

package/checkpolicy/checkpolicy.mk +2 -2

index f0cca593d3..c1fb43da4d 100644
@@ -4,8 +4,8 @@
 #
 ################################################################################
 
-CHECKPOLICY_VERSION = 2.6
-CHECKPOLICY_SITE = https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20161014
+CHECKPOLICY_VERSION = 2.7
+CHECKPOLICY_SITE = https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20170804
 CHECKPOLICY_LICENSE = GPL-2.0
 CHECKPOLICY_LICENSE_FILES = COPYING

Signature · 1 line

2.13.6

Adam Duskett

author

2017-10-17 18:54 UTC #5 lore raw

PATCH v9 5/5 policycoreutils: split packages and bump to 2.7

In reply to Adam Duskett

Policycoreutils was broken up into several packages, as such several changes needed to happen for this patch to work:

- Remove patches 3, 4, and 5 as they no longer apply.
- Refresh patches 1 and 2 to work with version 2.7
- Remove semodule_${deps,expand,link,package} and sestatus from the makedirs in the mk file.
- Remove restorecond from the make and config file. (Seperate package)
- Remove Audit2allow from the make and config file. (In a different package)
- Remove the package sepolgen
- Add the package selinux-python
- Add the package restorecond
- Add the package semodule-utils
- Add the relevant Config.in.legacy options into the menu.

Because these are utilities that work on top of python, the older versions of these utilites still work, and as such this should be a single patch.

Signed-off-by Adam Duskett <[email protected]>

---
Changes v1 -> v2:
- Combine this patch, sepolgen removal, restorecond, and selinux-python into a single patch. (Adam)
- Add Config.in.legacy entries for: Audit2allow, sepolgen, and audit2allow (Arnout)
- Remove excess SOB lines from policycoreutils patches. (Arnout)
- Fixed line length in restorecond Config.in (Arnout)
- Added comment about _FILE_OFFSET_BITS in restorecond.mk (Arnout)
- Fixed capitalization in restorecond.mk comment. (Arnout)
- Added comment in selinux-python help explaining that if no package is selected, that no package will be built. (Arnout)
- Removed sepolgen from requirements of selinux-python. (Arnout)
- Moved python selection up to BR2_PACKAGE_SELINUX_PYTHON level. (Arnout)
- Added global comment for when selinux-python is not available. (Arnout)
- Added global comment for when audit2allow is not available. (Arnout)
- Cleaned up audit2allow help text (Arnout)
- Removed left over selinux-python host make commands. No packages require host variants of selinux-python packages anymore.

Changes v2 -> v3:
- Remove host-sepolgen from policycoreutils.mk (Matthew Weber)
- Add COPYING license file to policycoreutils.hash.

Changes v3 -> v4:
- Fix Config.in.legacy logic (Thomas)
restorecond:
- Changed depends on BR2_PACKAGE_DBUS to select. (Thomas)
- Added missing upstream URL. (Thomas)
- Added Config.in comment (Thomas)
- Changed installed restorecond init.d script to S20restorecond (Thomas)
- Removed host generic-package call from .mk file. (Thomas) selinux-python:
- changed "selinux python" to "selinux-python" (Thomas)
- Removed "packages" comment. (Thomas)
- Removed "python3" comments. (Thomas)
- Changed "SELinux Python" to "selinux-python" (Thomas)

Changes v4 -> v5:
- Fix building the host variant of policycoreutils by removing make directories that no longer exist in HOST_POLICYCOREUTILS_MAKE_DIRS and from HOST_POLICYCOREUTILS_INSTALL_CMDS. (Matthew Weber)

Changes v5 -> v6:
- None

Changes v6 -> v7:
- Added package semodule-utils, without these utilities, audit2allow will fail to run.
- semodule-utils is selected if audit2allow is selected.

Changes v7 -> v8:
- None.

Changes v8 -> v9:
- None

 Config.in.legacy                                   |  29 +++
 DEVELOPERS                                         |   4 +-
 package/Config.in                                  |   4 +-
 ...IR-to-all-paths-that-use-an-absolute-path.patch | 120 ++-----------
 .../0002-Add-PREFIX-to-host-paths.patch            | 198 +++------------------
 .../0003-Remove-hardcoded-arch-variable.patch      |  43 -----
 ...licy-python-install-arguments-to-be-a-var.patch |  42 -----
 .../0005-Check-to-see-if-DBUS-is-enabled.patch     |  56 ------
 package/policycoreutils/Config.in                  |  43 -----
 package/policycoreutils/policycoreutils.hash       |   3 +-
 package/policycoreutils/policycoreutils.mk         |  42 +----
 package/restorecond/Config.in                      |  19 ++
 package/restorecond/restorecond.hash               |   2 +
 package/restorecond/restorecond.mk                 |  52 ++++++
 package/selinux-python/Config.in                   |  63 +++++++
 package/selinux-python/selinux-python.hash         |   2 +
 package/selinux-python/selinux-python.mk           |  50 ++++++
 package/semodule-utils/Config.in                   |  23 +++
 package/semodule-utils/semodule-utils.hash         |   2 +
 package/semodule-utils/semodule-utils.mk           |  27 +++
 package/sepolgen/Config.in                         |  19 --
 package/sepolgen/sepolgen.hash                     |   2 -
 package/sepolgen/sepolgen.mk                       |  49 -----
 23 files changed, 325 insertions(+), 569 deletions(-)
 delete mode 100644 package/policycoreutils/0003-Remove-hardcoded-arch-variable.patch
 delete mode 100644 package/policycoreutils/0004-Change-sepolicy-python-install-arguments-to-be-a-var.patch
 delete mode 100644 package/policycoreutils/0005-Check-to-see-if-DBUS-is-enabled.patch
 create mode 100644 package/restorecond/Config.in
 create mode 100644 package/restorecond/restorecond.hash
 create mode 100644 package/restorecond/restorecond.mk
 create mode 100644 package/selinux-python/Config.in
 create mode 100644 package/selinux-python/selinux-python.hash
 create mode 100644 package/selinux-python/selinux-python.mk
 create mode 100644 package/semodule-utils/Config.in
 create mode 100644 package/semodule-utils/semodule-utils.hash
 create mode 100644 package/semodule-utils/semodule-utils.mk
 delete mode 100644 package/sepolgen/Config.in
 delete mode 100644 package/sepolgen/sepolgen.hash
 delete mode 100644 package/sepolgen/sepolgen.mk

Config.in.legacy +29 -0

index 748876880c..ea69f5a924 100644
@@ -145,6 +145,35 @@ endif
 ###############################################################################
 comment "Legacy options removed in 2017.11"
 
+config BR2_PACKAGE_POLICYCOREUTILS_AUDIT2ALLOW
+	bool "policycoreutils audit2allow option removed"
+	select BR2_LEGACY
+	select BR2_PACKAGE_SELINUX_PYTHON
+	select BR2_PACKAGE_SELINUX_PYTHON_AUDIT2ALLOW
+	help
+	  The policycoreutils package no longer offers audit2allow
+	  as a option. This package has been moved into the
+	  selinux-python package by the SELinux maintainers.
+
+config BR2_PACKAGE_POLICYCOREUTILS_RESTORECOND
+	bool "policycoreutils restorecond option removed"
+	select BR2_LEGACY
+	select BR2_PACKAGE_RESTORECOND
+	help
+	  The policycoreutils package no longer offers restorecond
+	  as a option.  This package has been moved into a seperate
+	  package maintained by the SELinux maintainers.
+
+config BR2_PACKAGE_SEPOLGEN
+	bool "sepolgen package has been removed"
+	select BR2_LEGACY
+	select BR2_PACKAGE_SELINUX_PYTHON
+	select BR2_PACKAGE_SELINUX_PYTHON_SEPOLGEN
+	help
+	  Sepolgen is no longer a individual package, but instead has
+	  been moved into the selinux-python package by the SELinux
+	  maintainers.
+
 config BR2_PACKAGE_OPENOBEX_BLUEZ
 	bool "openobex bluez option removed"
 	select BR2_LEGACY

DEVELOPERS +3 -1

index f35d6f3688..f52964bd90 100644
@@ -41,8 +41,10 @@ F:	package/libsepol/
 F:	package/nginx-naxsi/
 F:	package/policycoreutils/
 F:	package/python-mutagen/
+F:	package/restorecond/
 F:	package/refpolicy/
-F:	package/sepolgen/
+F:	package/selinux-python/
+F:  package/semodule-utils/
 F:	package/setools/
 F:	package/sngrep/

package/Config.in +3 -1

index aa0f2d7f8e..a3e678939a 100644
@@ -1842,7 +1842,9 @@ menu "Security"
 	source "package/paxtest/Config.in"
 	source "package/policycoreutils/Config.in"
 	source "package/refpolicy/Config.in"
-	source "package/sepolgen/Config.in"
+	source "package/restorecond/Config.in"
+	source "package/selinux-python/Config.in"
+	source "package/semodule-utils/Config.in"
 	source "package/setools/Config.in"
 endmenu

package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch +12 ~~-108~~

139 lines not on this page · raw message

package/policycoreutils/0002-Add-PREFIX-to-host-paths.patch +28 ~~-170~~

235 lines not on this page · raw message

package/policycoreutils/0003-Remove-hardcoded-arch-variable.patch deleted +0 ~~-43~~

43 lines not on this page · raw message

package/policycoreutils/0004-Change-sepolicy-python-install-arguments-to-be-a-var.patch deleted +0 ~~-42~~

42 lines not on this page · raw message

package/policycoreutils/0005-Check-to-see-if-DBUS-is-enabled.patch deleted +0 ~~-56~~

56 lines not on this page · raw message

package/policycoreutils/Config.in +0 ~~-43~~

54 lines not on this page · raw message

package/policycoreutils/policycoreutils.hash +2 -1

index 999a7788d2..241905ca22 100644
@@ -1,2 +1,3 @@
 # https://github.com/SELinuxProject/selinux/wiki/Releases
-sha256 68891b376f5048edc53c6ccb2fca44da3dc7f4563f4b6894e201d70c04a05a29 policycoreutils-2.6.tar.gz
+sha256 0a1b8a4a323b854981c6755ff025fe98a0f1cff307f109abb260f0490f13e4f4 policycoreutils-2.7.tar.gz
+sha256 204d8eff92f95aac4df6c8122bc1505f468f3a901e5a4cc08940e0ede1938994 COPYING

package/policycoreutils/policycoreutils.mk +8 ~~-34~~

72 lines not on this page · raw message

package/restorecond/Config.in new file +19 -0

new file mode 100644
index 0000000000..46fcec1dc2
@@ -0,0 +1,19 @@
+config BR2_PACKAGE_RESTORECOND
+	bool "restorecond"
+	depends on BR2_USE_WCHAR # glib2
+	depends on BR2_TOOLCHAIN_HAS_THREADS # glib2
+	depends on BR2_USE_MMU # glib2
+	depends on BR2_TOOLCHAIN_USES_GLIBC #libselinux
+	select BR2_PACKAGE_DBUS
+	select BR2_PACKAGE_DBUS_GLIB
+	select BR2_PACKAGE_LIBSELINUX
+	select BR2_PACKAGE_LIBGLIB2
+	help
+	  restorecond is a daemon that watches for file creation and
+	  then sets the default SELinux file context for that file.
+	  
+	  https://github.com/SELinuxProject/selinux/wiki/Releases
+	  
+comment "restorecond needs a toolchain w/ glibc, wchar, threads, dynamic library"
+	depends on !BR2_TOOLCHAIN_HAS_THREADS || !BR2_USE_MMU || \
+		!BR2_USE_WCHAR || !BR2_TOOLCHAIN_USES_GLIBC

package/restorecond/restorecond.hash new file +2 -0

new file mode 100644
index 0000000000..f52bbd2161
@@ -0,0 +1,2 @@
+# https://github.com/SELinuxProject/selinux/wiki/Releases
+sha256 cb8e0a8d706cb2c1f105125f3514dffffefcbcfb49199183a7f91ab0bdf1f24d restorecond-2.7.tar.gz

package/restorecond/restorecond.mk new file +52 -0

52 lines not on this page · raw message

package/selinux-python/Config.in new file +63 -0

63 lines not on this page · raw message

package/selinux-python/selinux-python.hash new file +2 -0

new file mode 100644
index 0000000000..42fe575e7b
@@ -0,0 +1,2 @@
+# https://github.com/SELinuxProject/selinux/wiki/Releases
+sha256 4217cb965ecda96c91e15ffcc2e7ddd13ecc2bf5631100f3cd072a7616f140ed selinux-python-2.7.tar.gz

package/selinux-python/selinux-python.mk new file +50 -0

50 lines not on this page · raw message

package/semodule-utils/Config.in new file +23 -0

new file mode 100644
index 0000000000..6dc59ba501
@@ -0,0 +1,23 @@
+config BR2_PACKAGE_SEMODULE_UTILS
+	bool "semodule-utils"
+	depends on BR2_USE_WCHAR # glib2
+	depends on BR2_TOOLCHAIN_HAS_THREADS # glib2
+	depends on BR2_USE_MMU # glib2
+	depends on BR2_TOOLCHAIN_USES_GLIBC #libselinux
+	select BR2_PACKAGE_LIBSEPOL
+	select BR2_PACKAGE_LIBGLIB2
+	help
+	  semodule-utils is a package that contains tools for handling
+	  selinux modules.
+	  
+	  The package will install the following utilities:
+  	  * semodule_deps - Show the dependencies between SELinux policy packages.
+  	  * semodule_expand - Expand a SELinux policy module package.
+  	  * semodule_link - Link SELinux policy module packages together
+	  * semodule_package - Create a SELinux policy module package.
+	  
+	  https://github.com/SELinuxProject/selinux/wiki/Releases
+	  
+comment "semodule-utils needs a toolchain w/ glibc, wchar, threads, dynamic library"
+	depends on !BR2_TOOLCHAIN_HAS_THREADS || !BR2_USE_MMU || \
+		!BR2_USE_WCHAR || !BR2_TOOLCHAIN_USES_GLIBC

package/semodule-utils/semodule-utils.hash new file +2 -0

new file mode 100644
index 0000000000..18c8217ca6
@@ -0,0 +1,2 @@
+# https://github.com/SELinuxProject/selinux/wiki/Releases
+sha256 90c98b3362a43b4da2a51a9176820a56f3e615225e23e3395bc566c4490786ba semodule-utils-2.7.tar.gz

package/semodule-utils/semodule-utils.mk new file +27 -0

new file mode 100644
index 0000000000..2c8923f82e
@@ -0,0 +1,27 @@
+################################################################################
+#
+# semodule-utils
+#
+################################################################################
+
+SEMODULE_UTILS_VERSION = 2.7
+SEMODULE_UTILS_SITE = https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20170804
+SEMODULE_UTILS_LICENSE = GPL-2.0
+SEMODULE_UTILS_LICENSE_FILES = COPYING
+SEMODULE_UTILS_DEPENDENCIES = libselinux
+
+SEMODULE_UTILS_MAKE_OPTS += \
+	$(TARGET_CONFIGURE_OPTS) \
+	LIBSEPOLA=$(STAGING_DIR)/usr/lib/libsepol.a
+
+# We need to pass DESTDIR at build time because it's used by
+# semodule-utils build system to find headers and libraries.
+define SEMODULE_UTILS_BUILD_CMDS
+	$(MAKE) -C $(@D) $(SEMODULE_UTILS_MAKE_OPTS) DESTDIR=$(STAGING_DIR) all
+endef
+
+define SEMODULE_UTILS_INSTALL_TARGET_CMDS
+	$(MAKE) -C $(@D) $(SEMODULE_UTILS_MAKE_OPTS) DESTDIR=$(TARGET_DIR) install
+endef
+
+$(eval $(generic-package))

package/sepolgen/Config.in deleted +0 ~~-19~~

deleted file mode 100644
index 8dd90388c8..0000000000
@@ -1,19 +0,0 @@
-config BR2_PACKAGE_SEPOLGEN
-	bool "sepolgen"
-	depends on BR2_USE_WCHAR # python3
-	depends on BR2_USE_MMU # python3
-	depends on BR2_TOOLCHAIN_HAS_THREADS # python3
-	depends on !BR2_STATIC_LIBS # python3
-	select BR2_PACKAGE_PYTHON3 if !BR2_PACKAGE_PYTHON
-	help
-	  This package contains a Python module that forms the core of
-	  the modern audit2allow (which is a part of the package
-	  policycoreutils).  It contains infrastructure for parsing
-	  SELinux related messages as produced by the audit system.
-	  It has facilities for generating policy based on required
-	  access.
-
-comment "sepolgen needs a toolchain w/ wchar, threads, dynamic library"
-	depends on BR2_USE_MMU
-	depends on !BR2_USE_WCHAR || !BR2_TOOLCHAIN_HAS_THREADS || \
-		BR2_STATIC_LIBS

package/sepolgen/sepolgen.hash deleted +0 -2

deleted file mode 100644
index b338a7019f..0000000000
@@ -1,2 +0,0 @@
-# https://github.com/SELinuxProject/selinux/wiki/Releases
-sha256 6a327b1576d914e57ad796a541a7a9bcceefb14c445355559993de0fdb8e7a60  sepolgen-2.6.tar.gz

package/sepolgen/sepolgen.mk deleted +0 ~~-49~~

49 lines not on this page · raw message

Signature · 1 line

2.13.6

Thomas Petazzoni

2017-10-17 21:34 UTC #6 lore raw

PATCH v9 5/5 policycoreutils: split packages and bump to 2.7

Hello,

DEVELOPERS F: package/libsepol/ · line 47

Quoted 13 lines · Adam Duskett

DEVELOPERS +3 -1

index f35d6f3688..f52964bd90 100644
@@ -41,8 +41,10 @@ F:	package/libsepol/
 F:	package/nginx-naxsi/
 F:	package/policycoreutils/
 F:	package/python-mutagen/
+F:	package/restorecond/
 F:	package/refpolicy/
-F:	package/sepolgen/
+F:	package/selinux-python/
+F:  package/semodule-utils/

Indentation issue.

Quoted 6 lines

package/restorecond/Config.in new file +0 -0
new file mode 100644
index 0000000000..46fcec1dc2

package/restorecond/Config.in line 10

Quoted 10 lines

package/restorecond/Config.in new file +10 -0

@@ -0,0 +1,19 @@
+config BR2_PACKAGE_RESTORECOND
+	bool "restorecond"
+	depends on BR2_USE_WCHAR # glib2
+	depends on BR2_TOOLCHAIN_HAS_THREADS # glib2
+	depends on BR2_USE_MMU # glib2
+	depends on BR2_TOOLCHAIN_USES_GLIBC #libselinux
+	select BR2_PACKAGE_DBUS
+	select BR2_PACKAGE_DBUS_GLIB
+	select BR2_PACKAGE_LIBSELINUX
+	select BR2_PACKAGE_LIBGLIB2

Missing:

depends on !BR2_arc
depends on !BR2_STATIC_LIBS

you select BR2_PACKAGE_LIBSELINUX, so you have to inherit the dependencies.

package/restorecond/Config.in line 19

Quoted 9 lines

package/restorecond/Config.in new file +9 -0

+	help
+	  restorecond is a daemon that watches for file creation and
+	  then sets the default SELinux file context for that file.
+	  
+	  https://github.com/SELinuxProject/selinux/wiki/Releases
+	  
+comment "restorecond needs a toolchain w/ glibc, wchar, threads, dynamic library"
+	depends on !BR2_TOOLCHAIN_HAS_THREADS || !BR2_USE_MMU || \
+		!BR2_USE_WCHAR || !BR2_TOOLCHAIN_USES_GLIBC

BR2_USE_MMU should be on a separate line, as we don't want to see the comment on !BR2_USE_MMU systems. Don't forget the ARC dependency and dynamic library dependency. Well, dynamic library is mentioned in the comment... but not in the dependencies!

package/selinux-python/Config.in line 1

Quoted 7 lines

package/selinux-python/Config.in new file +1 -0

new file mode 100644
index 0000000000..44fdc1e4e6
@@ -0,0 +1,63 @@
+menuconfig BR2_PACKAGE_SELINUX_PYTHON

Please don't make this change immediately, but I'm wondering if we should use selinux-python or python-selinux. All packages that package Python modules are called python-<foo> in Buildroot.

Is selinux-python somewhat suggested by upstream? Or perhaps it's not really a set of Python modules, but rather some SELinux programs that happen to be in Python ?

I'm currently fine with selinux-python, so we can keep it as-is, and change later (before the release preferably) depending on how the discussion goes. I certainly don't want to hold merging this just for this detail.

package/semodule-utils/Config.in line 6

Quoted 12 lines

package/semodule-utils/Config.in new file +6 -0

new file mode 100644
index 0000000000..6dc59ba501
@@ -0,0 +1,23 @@
+config BR2_PACKAGE_SEMODULE_UTILS
+	bool "semodule-utils"
+	depends on BR2_USE_WCHAR # glib2
+	depends on BR2_TOOLCHAIN_HAS_THREADS # glib2
+	depends on BR2_USE_MMU # glib2
+	depends on BR2_TOOLCHAIN_USES_GLIBC #libselinux

You're not selecting libselinux in this package, and libsepol doesn't select it. So, why this glibc dependency?

Quoted 7 lines

package/semodule-utils/Config.in new file +7 -0

+	select BR2_PACKAGE_LIBSEPOL
+	select BR2_PACKAGE_LIBGLIB2
+	help
+	  semodule-utils is a package that contains tools for handling
+	  selinux modules.
+	  
+	  The package will install the following utilities:

package/semodule-utils/Config.in line 23

Quoted 10 lines

package/semodule-utils/Config.in new file +10 -0

+  	  * semodule_deps - Show the dependencies between SELinux policy packages.
+  	  * semodule_expand - Expand a SELinux policy module package.
+  	  * semodule_link - Link SELinux policy module packages together
+	  * semodule_package - Create a SELinux policy module package.
+	  
+	  https://github.com/SELinuxProject/selinux/wiki/Releases
+	  
+comment "semodule-utils needs a toolchain w/ glibc, wchar, threads, dynamic library"
+	depends on !BR2_TOOLCHAIN_HAS_THREADS || !BR2_USE_MMU || \
+		!BR2_USE_WCHAR || !BR2_TOOLCHAIN_USES_GLIBC

BR2_USE_MMU on a separate line. Why "dynamic library" in the comment? Why glibc in the dependencies?

Quoted 15 lines

package/semodule-utils/semodule-utils.hash new file +2 -0

new file mode 100644
index 0000000000..18c8217ca6
@@ -0,0 +1,2 @@
+# https://github.com/SELinuxProject/selinux/wiki/Releases
+sha256 90c98b3362a43b4da2a51a9176820a56f3e615225e23e3395bc566c4490786ba semodule-utils-2.7.tar.gz

package/semodule-utils/semodule-utils.mk new file +1 -0

new file mode 100644
index 0000000000..2c8923f82e
@@ -0,0 +1,27 @@
+################################################################################

package/semodule-utils/semodule-utils.mk line 11

Quoted 10 lines

package/semodule-utils/semodule-utils.mk new file +10 -0

+#
+# semodule-utils
+#
+################################################################################
+
+SEMODULE_UTILS_VERSION = 2.7
+SEMODULE_UTILS_SITE = https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20170804
+SEMODULE_UTILS_LICENSE = GPL-2.0
+SEMODULE_UTILS_LICENSE_FILES = COPYING
+SEMODULE_UTILS_DEPENDENCIES = libselinux

Ah, in the end, you need libselinux, but not libsepol. It seems like we have a consistency issue here, no?

Best regards,

Thomas

Signature · 3 lines

Thomas Petazzoni, CTO, Free Electrons
Embedded Linux and Kernel engineering
http://free-electrons.com

Arnout Vandecappelle

2017-10-19 13:51 UTC #7 lore raw

PATCH v9 5/5 policycoreutils: split packages and bump to 2.7

Quoted 7 lines · Thomas Petazzoni

Please don't make this change immediately, but I'm wondering if we should use selinux-python or python-selinux. All packages that package Python modules are called python-<foo> in Buildroot.
Is selinux-python somewhat suggested by upstream? Or perhaps it's not really a set of Python modules, but rather some SELinux programs that happen to be in Python ?

The upstream tarball if selinux-python-2.7.tar.gz, which is why
SELINUX_PYTHON_SOURCE is not defined. So indeed, it's the upstream choice. For reference, the Debian source package is called selinux-python while the binary packages are called python3-sepolgen, policycoreutils-python-utils, ...

Also, yes, it's just a bunch of programs that happen to be written in python.
Python bindings are part of libselinux itself.

Regards,
Arnout

Signature · 6 lines

Arnout Vandecappelle                          arnout at mind be
Senior Embedded Software Architect            +32-16-286500
Essensium/Mind                                http://www.mind.be
G.Geenslaan 9, 3001 Leuven, Belgium           BE 872 984 063 RPR Leuven
LinkedIn profile: http://www.linkedin.com/in/arnoutvandecappelle
GPG fingerprint:  7493 020B C7E3 8618 8DEC 222C 82EB F404 F9AC 0DDF

Thomas Petazzoni

Applied

2017-10-17 21:18 UTC #8 lore raw

PATCH v9 1/5 libselinux: bump to 2.7

In reply to Adam Duskett

Hello,

Quoted 6 lines · Adam Duskett

remove patch as it's in this release.
Signed-off-by Adam Duskett <[email protected]>
---
Changes v1 -> v2:
- None

Applied to master, thanks. Hopefully it won't break stuff since I've only applied PATCH 1/5 and 2/5, and won't yet apply the remainder of the series due to comments.

Thomas

Signature · 3 lines

Thomas Petazzoni, CTO, Free Electrons
Embedded Linux, Kernel and Android engineering
http://free-electrons.com