libsepol: bump to 2.7, setools: bump to 4.1.1
PATCH v9 3/5 libsepol: bump to 2.7, setools: bump to 4.1.1
The reason for combining these patches is because the
old version of setools is not compatible iwth libsepol 2.7. If a user where to do a git pull on a patch that only updates libsepol or setools, the build would fail to compile.
setools has been completely rewritten in python instead of C.
The current version of setools includes a few programs that require python-qt5 or python-networkx to run, however the package does not check to see if these exist when compiling, and will install the scripts to the target directory even if they don't exist.
In the case of python-networkx, this package is not available on Buildroot. The scripts that require them are: sedta and seinfoflow.
In the case of python-qt5, qpol is the script that requires it.
Some setools.mk notes to get the package to compile:
- Convert the package .mk to use python-package instead of autotools-package.
- Remove host variant of setools as it is no longer a dependency for policycoreutils.
- setup.py hard codes base_lib_dirs to point to several host directories. To fix this, sed is used before compiling to point the base_lib_dirs to the staging directory.
- setup.py also includes the "Werror" flag, however compilers before gcc6 cause a few autogenerated variables to not be initialized before use, causing the build to fail.
To fix this, sed is used before compiling to remove the Werror flag.
- Remove sedta and seinfoflow from the target system after install. These packages rely on the package python-networkx which is not available in buildroot.
- Remove the installed apol package and the setoolsgui directory from the target directory if python-qt5 is not selected.
Other changes:
- Removed all patches, as they are not compatible with the new version of setools.
- Add COPYING, COPYING.GPL, and COPYING.LGPL to setools.hash
---
Changes v1 -> v2:
- None
Changes v2 -> v3:
- Added setools update to this patch due to build failures. (Matthew Weber)
Changes v3 -> v4:
- Change commit message to read:
"Convert the package .mk to use python-package instead of autotools-package." (Thomas)
- Added comment explaining that setools is no longer a dependency for policycoreutils. (Thomas)
- Add "depends on BR2_USE_MMU" to setools Config.in (Thomas)
- Add "(requires python-qt5)" to apol line in setools Config.in (Thomas)
- Fix setools comment. (Thomas)
- Add prefix to variables in setools.mk (Thomas)
- Add remove-werror-flag-from-setup.patch patch. (Thomas)
- enclose SETOOLS_REMOVE_QT_SCRIPTS in "ifeq ($(BR2_PACKAGE_PYTHON_PYQT5),)"
Changes v4 -> v5:
- Add host variant of setools because the package "refpolicy" depends on it. (Matthew Weber)
Changes v5 -> v6:
- Add two patches from setools-4.1.1-5.fc28.src.rpm, these are needed to run the console tools.
- Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch:
- This patch removes the need for networkx for the console tools.
- bswap_-macros-are-defined-in-byteswap.h.patch:
- This patch fixes a ImportError on s390x.
- Add prefix on line 44 of setools.mk to REMOVE_BROKEN_SCRIPTS variable.
- Add python-setuptools as a dependency of setools (pkg_resources)
- Add python-enum34 as a dependency of setools if python2 is selected.
Changes v6 -> v7:
- None
Changes v7 -> v8:
- Removed uneeded 0003-bswap_-macros-are-defined-in-byteswap.h.patch (Thomas)
- Added HOST_SETOOLS_REMOVE_BROKEN_SCRIPTS to setools.mk (Matthew Weber)
Changes v8 -> v9:
- Changed HOST_SETOOLS_POST_INSTALL_TARGET_HOOKS to HOST_SETOOLS_POST_INSTALL_HOOKS.
- Fixed up some comments in setools.mk to make it more clear what SETOOLS_FIX_SETUP and HOST_SETOOLS_FIX_SETUP where doing and why.
- Changed rmdir --ignore-fail-on-non-empty to $(RM) -r, as the previous wasn't actually removing the directory.
package/libsepol/0001-support-static-only.patch | 32 +++-- package/libsepol/0003-revert-ln-relative.patch | 18 ++- package/libsepol/libsepol.hash | 4 +- package/libsepol/libsepol.mk | 4 +- package/setools/0001-cross-compile-fixes.patch | 125 ------------------ .../0001-remove-werror-flag-from-setup.patch | 29 +++++ ...rt-use-setools.InfoFlowAnalysis-and-setoo.patch | 142 +++++++++++++++++++++ package/setools/0002-move-python-check.patch | 25 ---- ...s-Update-for-2015-02-02-Userspace-release.patch | 90 ------------- package/setools/Config.in | 37 ++---- package/setools/setools.hash | 7 +- package/setools/setools.mk | 117 ++++++++--------- 12 files changed, 277 insertions(+), 353 deletions(-) delete mode 100644 package/setools/0001-cross-compile-fixes.patch create mode 100644 package/setools/0001-remove-werror-flag-from-setup.patch create mode 100644 package/setools/0002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch delete mode 100644 package/setools/0002-move-python-check.patch delete mode 100644 package/setools/0003-setools-Update-for-2015-02-02-Userspace-release.patch
package/libsepol/0001-support-static-only.patch +19 -13
@@ -1,4 +1,7 @@ -Add support for static-only build +From 2140db697c7f1da2a0a3f7bbcb14c1a0dade84e5 Mon Sep 17 00:00:00 2001 +From: Adam Duskett <[email protected]> +Date: Mon, 9 Oct 2017 16:28:12 -0400 +Subject: [PATCH] Add support for static-only build Instead of unconditionally building shared libraries, this patch improves the libsepol build system with a "STATIC" variable, which
@@ -7,30 +10,30 @@ libraries. It allows to support cases where the target architecture does not have support for shared libraries. Signed-off-by: Thomas Petazzoni <[email protected]> -Signed-off-by: Adam Duskett <[email protected]> - -Index: b/src/Makefile -=================================================================== +Signed-off-by: Adam Duskett <[email protected]> +--- + src/Makefile | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/src/Makefile b/src/Makefile -index db6c2ba..0006285 100644 +index 819d261..040921d 100644 --- a/src/Makefile +++ b/src/Makefile -@@ -30,8 +30,12 @@ LOBJS += $(sort $(patsubst %.c,%.lo,$(wildcard $(CILDIR)/src/*.c) $(CIL_GENERATE - override CFLAGS += -I$(CILDIR)/include +@@ -40,7 +40,12 @@ LDFLAGS += -undefined dynamic_lookup + LN=gln endif +-all: $(LIBA) $(LIBSO) $(LIBPC) +ALL_TARGETS = $(LIBA) $(LIBPC) +ifeq ($(STATIC),) +ALL_TARGETS += $(LIBSO) +endif - --all: $(LIBA) $(LIBSO) $(LIBPC) ++ +all: $(ALL_TARGETS) - + $(LIBA): $(OBJS) -@@ -66,11 +70,13 @@ +@@ -82,11 +87,13 @@ endif install: all test -d $(LIBDIR) || install -m 755 -d $(LIBDIR) install -m 644 $(LIBA) $(LIBDIR)
@@ -41,8 +44,11 @@ index db6c2ba..0006285 100644 +ifeq ($(STATIC),) + test -d $(SHLIBDIR) || install -m 755 -d $(SHLIBDIR) + install -m 755 $(LIBSO) $(SHLIBDIR) - ln -sf --relative $(SHLIBDIR)/$(LIBSO) $(LIBDIR)/$(TARGET) + $(LN) -sf --relative $(SHLIBDIR)/$(LIBSO) $(LIBDIR)/$(TARGET) +endif relabel: /sbin/restorecon $(SHLIBDIR)/$(LIBSO) +-- +2.13.6 +
package/libsepol/0003-revert-ln-relative.patch +14 -4
@@ -1,4 +1,7 @@ -Makefile: revert libsepol: use ln --relative to create .so symlinks +From 16b2b0e21e10727065042a1baabd1a887757c65c Mon Sep 17 00:00:00 2001 +From: Adam Duskett <[email protected]> +Date: Mon, 9 Oct 2017 16:29:36 -0400 +Subject: [PATCH] Makefile: revert libsepol: use ln --relative to create .so symlinks This reverts 71393a181d63c9baae5fe8dcaeb9411d1f253998
@@ -9,16 +12,23 @@ they are maintained (up to 10 years in some cases?). For the sake of Buildroot, revert the upstream patch. Signed-off-by: "Yann E. MORIN" <[email protected]> +--- + src/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) -diff -durN a/src/Makefile b/src/Makefile +diff --git a/src/Makefile b/src/Makefile +index 040921d..e811c9e 100644 --- a/src/Makefile +++ b/src/Makefile -@@ -77,7 +77,7 @@ +@@ -92,7 +92,7 @@ install: all ifeq ($(STATIC),) test -d $(SHLIBDIR) || install -m 755 -d $(SHLIBDIR) install -m 755 $(LIBSO) $(SHLIBDIR) -- ln -sf --relative $(SHLIBDIR)/$(LIBSO) $(LIBDIR)/$(TARGET) +- $(LN) -sf --relative $(SHLIBDIR)/$(LIBSO) $(LIBDIR)/$(TARGET) + cd $(LIBDIR) && ln -sf ../../`basename $(SHLIBDIR)`/$(LIBSO) $(TARGET) endif relabel: +-- +2.13.6 +
package/libsepol/libsepol.hash +2 -2
@@ -1,2 +1,2 @@ -# From https://github.com/SELinuxProject/selinux/wiki/Releases -sha256 d856d6506054f52abeaa3543ea2f2344595a3dc05d0d873ed7f724f7a16b1874 libsepol-2.6.tar.gz +# From: https://github.com/SELinuxProject/selinux/wiki/Releases +sha256 d69d3bd8ec901a3bd5adf2be2fb47fb1a685ed73066ab482e7e505371a48f9e7 libsepol-2.7.tar.gz
package/libsepol/libsepol.mk +2 -2
@@ -4,8 +4,8 @@ # ################################################################################ -LIBSEPOL_VERSION = 2.6 -LIBSEPOL_SITE = https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20161014 +LIBSEPOL_VERSION = 2.7 +LIBSEPOL_SITE = https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20170804 LIBSEPOL_LICENSE = LGPL-2.1+ LIBSEPOL_LICENSE_FILES = COPYING
package/setools/0001-cross-compile-fixes.patch deleted +0 -125
125 lines not on this page · raw message
package/setools/0001-remove-werror-flag-from-setup.patch new file +29 -0
@@ -0,0 +1,29 @@ +From b2fe84bfd00117d4897f1f2e8f83d3410eb188b8 Mon Sep 17 00:00:00 2001 +From: Adam Duskett <[email protected]> +Date: Thu, 12 Oct 2017 22:04:58 -0400 +Subject: [PATCH] remove werror flag from setup + +Compilers older than gcc6 will generate uninitialized variable warnings which +will cause compiling to fail. + +Signed-off-by: Adam Duskett <[email protected]> +--- + setup.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/setup.py b/setup.py +index 2ca44c9..9319bf6 100644 +--- a/setup.py ++++ b/setup.py +@@ -146,7 +146,7 @@ ext_py_mods = [Extension('setools.policyrep._qpol', + 'libqpol/policy_scan.c', + 'libqpol/xen_query.c'], + include_dirs=include_dirs, +- extra_compile_args=['-Werror', '-Wextra', ++ extra_compile_args=['-Wextra', + '-Waggregate-return', + '-Wfloat-equal', + '-Wformat', '-Wformat=2', +-- +2.13.6 +
package/setools/0002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch new file +142 -0
142 lines not on this page · raw message
package/setools/0002-move-python-check.patch deleted +0 -25
@@ -1,25 +0,0 @@ -Correct a build issue that occurs when python is not found -in the path. This check should only be done if swig-python -option is selected. - -Signed-off-by Clayton Shotwell <[email protected]> - ---- a/configure.ac 2015-05-15 12:28:07.566060349 -0500 -+++ b/configure.ac 2015-05-28 15:07:25.357072800 -0500 -@@ -217,8 +217,6 @@ - do_swigify=yes - fi - --AM_PATH_PYTHON(2.7) -- - AC_ARG_ENABLE(swig-python, - AC_HELP_STRING([--enable-swig-python], - [build SWIG interfaces for Python]), -@@ -227,6 +225,7 @@ - if test ${do_swigify} = no; then - AC_PROG_SWIG(2.0.0) - fi -+ AM_PATH_PYTHON(2.7) - SWIG_PYTHON - do_swigify_python=yes - do_swigify=yes
package/setools/0003-setools-Update-for-2015-02-02-Userspace-release.patch deleted +0 -90
90 lines not on this page · raw message
package/setools/Config.in +14 -23
@@ -1,36 +1,27 @@ config BR2_PACKAGE_SETOOLS bool "setools" - depends on BR2_TOOLCHAIN_HAS_THREADS + depends on !BR2_arc # arc: libselinux not available depends on !BR2_STATIC_LIBS - depends on BR2_INSTALL_LIBSTDCPP + depends on BR2_TOOLCHAIN_HAS_THREADS depends on BR2_USE_WCHAR depends on BR2_TOOLCHAIN_USES_GLIBC # libselinux - # bfin: infamous _ symbol prefix issue - # nios2: triggers some toolchain issue "No symbol version - # section for versioned symbol" - # arc: libselinux not available - depends on !BR2_nios2 && !BR2_bfin && !BR2_arc + depends on BR2_USE_MMU + select BR2_PACKAGE_PYTHON3 if !BR2_PACKAGE_PYTHON + select BR2_PACKAGE_PYTHON_ENUM34 if !BR2_PACKAGE_PYTHON3 + select BR2_PACKAGE_PYTHON_SETUPTOOLS select BR2_PACKAGE_LIBSELINUX - select BR2_PACKAGE_SQLITE - select BR2_PACKAGE_LIBXML2 - select BR2_PACKAGE_BZIP2 help SETools is an open source project designed to facilitate SELinux policy analysis. The primary tools are: - * apol - analyze a SELinux policy. - * seaudit - analyze audit messages from SELinux. - * seaudit-report - generate highly-customized audit log - reports. - * sechecker - command line tool for performing modular - checks on an SELinux policy. + * apol - analyze a SELinux policy. (requires python-qt5) * sediff - semantic policy difference tool for SELinux. - * secmds - command-line tools to analyze and search SELinux - policy. + * sedta - Perform domain transition analyses + * sesearch - Search rules (allow, type_transition, etc.) - https://github.com/TresysTechnology/setools3/wiki + https://github.com/TresysTechnology/setools comment "setools needs a glibc toolchain w/ threads, C++, wchar, dynamic library" - depends on !BR2_TOOLCHAIN_HAS_THREADS || BR2_STATIC_LIBS \ - || !BR2_USE_WCHAR || !BR2_INSTALL_LIBSTDCPP \ - || !BR2_TOOLCHAIN_USES_GLIBC - depends on !BR2_nios2 && !BR2_bfin && !BR2_arc + depends on BR2_USE_MMU && !BR2_arc + depends on !BR2_TOOLCHAIN_HAS_THREADS || BR2_STATIC_LIBS || \ + !BR2_USE_WCHAR || !BR2_TOOLCHAIN_USES_GLIBC || \ + !BR2_INSTALL_LIBSTDCPP
package/setools/setools.hash +5 -2
@@ -1,4 +1,7 @@ # From https://github.com/TresysTechnology/setools3/wiki/Download -md5 d68d0d4e4da0f01da0f208782ff04b91 setools-3.3.8.tar.bz2 +md5 d68d0d4e4da0f01da0f208782ff04b91 setools-4.1.1.tar.bz2 # Locally computed -sha256 44387ecc9a231ec536a937783440cd8960a72c51f14bffc1604b7525e341e999 setools-3.3.8.tar.bz2 +sha256 46a927ea2b163cbe1d35cc35da43e45853e13720c7e02d4cf75a498783c19610 setools-4.1.1.tar.gz +sha256 2f7547e10f76a382c24c053595f38a5cc6dda9347f508f254ca490e0046a9624 COPYING +sha256 8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643 COPYING.GPL +sha256 dc626520dcd53a22f727af3ee42c770e56c97a64fe3adb063799d8ab032fe551 COPYING.LGPL
package/setools/setools.mk +50 -67
131 lines not on this page · raw message
Signature · 1 line
2.13.6
PATCH v9 3/5 libsepol: bump to 2.7, setools: bump to 4.1.1
Hello,
Quoted 12 lines · Adam Duskett
The reason for combining these patches is because the
old version of setools is not compatible iwth libsepol 2.7. If a user where to do a git pull on a patch that only updates libsepol or setools, the build would fail to compile.setools has been completely rewritten in python instead of C.
The current version of setools includes a few programs that require python-qt5 or python-networkx to run, however the package does not check to see if these exist when compiling, and will install the scripts to the target directory even if they don't exist.
Quoted 6 lines
In the case of python-networkx, this package is not available on Buildroot. The scripts that require them are: sedta and seinfoflow.
In the case of python-qt5, qpol is the script that requires it.- Remove host variant of setools as it is no longer a dependency for policycoreutils.
This is no longer true: there is a host variant of setools, and it is used.
Quoted 4 lines
-
setup.pyalso includes the "Werror" flag, however compilers before gcc6 cause a few autogenerated variables to not be initialized before use, causing the build to fail.
To fix this, sed is used before compiling to remove the Werror flag.
This is no longer true, you use a patch.
package/setools/setools.mk line 9
Quoted 2 lines
package/setools/setools.mk +2
-0+SETOOLS_SITE = $(call github,TresysTechnology,setools,$(SETOOLS_VERSION)) +SETOOLS_DEPENDENCIES = libselinux libsepol python-setuptools host-bison host-flex host-swig
Are you sure you need python-setuptools on the target ?
package/setools/setools.mk
Quoted 4 lines
package/setools/setools.mk +4
-0+define HOST_SETOOLS_FIX_SETUP + # By default, setup.py will look for libsepol.a in the host machines + # /usr/lib directory. This needs to be changed to the host directory. + $(SED) "s at base_lib_dirs =.*@base_lib_dirs = ['$(HOST_DIR)/usr/lib']@g" \
$(HOST_DIR)/lib, the $(HOST_DIR)/usr folder has been removed.
Quoted 1 line
+# sedta and seinfoflow depends on python-networkx. This package is not
depends -> depend
package/setools/setools.mk line 46
Quoted 8 lines
package/setools/setools.mk +8
-0+# available in buildroot. +define SETOOLS_REMOVE_BROKEN_SCRIPTS + $(RM) $(TARGET_DIR)/usr/bin/sedta + $(RM) $(TARGET_DIR)/usr/bin/seinfoflow +endef +SETOOLS_POST_INSTALL_TARGET_HOOKS += SETOOLS_REMOVE_BROKEN_SCRIPTS + +# apol requires pyqt5, but is installed even if it's not installed.
"is installed even if it's not installed", wow a bit weird :)
Perhaps: "apol requires pyqt5. However, the setools installation process will install apol even if pyqt5 is missing." Or something better than what I propose :)
Quoted 14 lines
package/setools/setools.mk +8
-5+# Remove these scripts from the target it pyqt5 is not selected. +ifeq ($(BR2_PACKAGE_PYTHON_PYQT5),) +define SETOOLS_REMOVE_QT_SCRIPTS + $(RM) $(TARGET_DIR)/usr/bin/apol + $(RM) -r $(TARGET_DIR)/usr/lib/$(SETOOLS_PYLIBVER)/site-packages/setoolsgui/ +endef +SETOOLS_POST_INSTALL_TARGET_HOOKS += SETOOLS_REMOVE_QT_SCRIPTS +endif -HOST_SETOOLS_CONF_ENV += \ - am_cv_pathless_PYTHON=python \ - ac_cv_path_PYTHON=$(HOST_DIR)/bin/python \ - am_cv_python_platform=linux2 \ - am_cv_python_version=$(HOST_SETOOLS_PYTHON_VERSION) \
package/setools/setools.mk line 62
Quoted 10 lines
package/setools/setools.mk +7
-3- am_cv_python_pythondir=$(HOST_SETOOLS_PYTHON_SITE_PACKAGES) \ - am_cv_python_pyexecdir=$(HOST_SETOOLS_PYTHON_SITE_PACKAGES) \ - am_cv_python_includes=-I$(HOST_SETOOLS_PYTHON_INCLUDES) +# sedta and seinfoflow depends on python-networkx. This package is not +# available in buildroot. pyqt5 is not a host-package, remove apol +# from the host directory as well. +define HOST_SETOOLS_REMOVE_BROKEN_SCRIPTS + $(RM) $(HOST_DIR)/usr/bin/sedta + $(RM) $(HOST_DIR)/usr/bin/seinfoflow + $(RM) $(HOST_DIR)/usr/bin/apol
$(HOST_DIR)/bin and not $(HOST_DIR)/usr/bin.
Thanks!
Thomas
Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons Embedded Linux and Kernel engineering http://free-electrons.com