Don't assume SELinux code is already installed on host
PATCH 1/1 Don't assume SELinux code is already installed on host
Many parts of the SELinux userspace code appear to assume that there's already a pre-existing install of libselinux / selinux head files on the host. That may not be true if you're building SELinux for the first time.
Make the following modifications:
1) SELinux header files should be referenced from the source tree, not from /usr/include.
2) *.a files should be referenced from the source tree, not from /usr/lib
3) #include statements should exactly match the path in the source tree.
This patch only addresses some of the issues found and testing has been extremely limited.
--- checkpolicy/Makefile | 4 ++-- checkpolicy/test/Makefile | 4 ++-- libselinux/src/Makefile | 2 +- libsemanage/src/Makefile | 8 ++++---- libsemanage/src/direct_api.c | 2 +- libsemanage/src/semanage_store.h | 2 +- secilc/Makefile | 4 ++-- secilc/secilc.c | 2 +- 8 files changed, 14 insertions(+), 14 deletions(-)
checkpolicy/Makefile +2 -2
@@ -12,14 +12,14 @@ YACC = bison -y CFLAGS ?= -g -Wall -Werror -Wshadow -O2 -pipe -fno-strict-aliasing -override CFLAGS += -I. -I${INCLUDEDIR} +override CFLAGS += -I. -I../libsepol/include CHECKOBJS = y.tab.o lex.yy.o queue.o module_compiler.o parse_util.o \ policy_define.o CHECKPOLOBJS = $(CHECKOBJS) checkpolicy.o CHECKMODOBJS = $(CHECKOBJS) checkmodule.o -LDLIBS=$(LIBDIR)/libsepol.a -lfl +LDLIBS=../libsepol/src/libsepol.a -lfl GENERATED=lex.yy.c y.tab.c y.tab.h
checkpolicy/test/Makefile +2 -2
@@ -7,9 +7,9 @@ LIBDIR ?= $(PREFIX)/lib INCLUDEDIR ?= $(PREFIX)/include CFLAGS ?= -g -Wall -W -Werror -O2 -pipe -override CFLAGS += -I$(INCLUDEDIR) +override CFLAGS += -I../../libsepol/include -LDLIBS=-lfl $(LIBDIR)/libsepol.a -L$(LIBDIR) +LDLIBS=-lfl ../../libsepol/src/libsepol.a all: dispol dismod
libselinux/src/Makefile +1 -1
@@ -72,7 +72,7 @@ CFLAGS ?= -O -Wall -W -Wundef -Wformat-y2k -Wformat-security -Winit-self -Wmissi -fipa-pure-const -Wno-suggest-attribute=pure -Wno-suggest-attribute=const \ -Werror -Wno-aggregate-return -Wno-redundant-decls -override CFLAGS += -I../include -I$(INCLUDEDIR) -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 $(EMFLAGS) +override CFLAGS += -I../include -I../../libsepol/include -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 $(EMFLAGS) SWIG_CFLAGS += -Wno-error -Wno-unused-variable -Wno-unused-but-set-variable -Wno-unused-parameter \ -Wno-shadow -Wno-uninitialized -Wno-missing-prototypes -Wno-missing-declarations
libsemanage/src/Makefile +4 -4
@@ -60,7 +60,7 @@ CFLAGS ?= -Werror -Wall -W -Wundef -Wshadow -Wmissing-noreturn -Wmissing-format- SWIG_CFLAGS += -Wno-error -Wno-unused-but-set-variable -Wno-unused-variable -Wno-shadow \ -Wno-unused-parameter -override CFLAGS += -I../include -I$(INCLUDEDIR) -D_GNU_SOURCE +override CFLAGS += -I../include -I../../libsepol/include -I../../libsepol/cil/include -I../../libselinux/include -D_GNU_SOURCE RANLIB=ranlib SWIG = swig -Wall -python -o $(SWIGCOUT) -outdir ./
@@ -82,17 +82,17 @@ $(SWIGRUBYLOBJ): $(SWIGRUBYCOUT) $(CC) $(CFLAGS) $(SWIG_CFLAGS) $(RUBYINC) -fPIC -DSHARED -c -o $@ $< $(SWIGSO): $(SWIGLOBJ) - $(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $< -L. -lsemanage -L$(LIBDIR) + $(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $< -L. -L../../libselinux/src -L../../libsepol/src -lsemanage $(SWIGRUBYSO): $(SWIGRUBYLOBJ) - $(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lsemanage -L$(LIBDIR) + $(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -L../../libselinux/src -L../../libsepol/src -lsemanage $(LIBA): $(OBJS) $(AR) rcs $@ $^ $(RANLIB) $@ $(LIBSO): $(LOBJS) - $(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -lsepol -laudit -lselinux -lbz2 -lustr -L$(LIBDIR) -Wl,-soname,$(LIBSO),--version-script=libsemanage.map,-z,defs + $(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -lsepol -laudit -lselinux -lbz2 -lustr -L../../libselinux/src -L../../libsepol/src -Wl,-soname,$(LIBSO),--version-script=libsemanage.map,-z,defs ln -sf $@ $(TARGET) $(LIBPC): $(LIBPC).in ../VERSION
libsemanage/src/direct_api.c +1 -1
@@ -21,7 +21,7 @@#include <sepol/module.h> #include <sepol/handle.h> -#include <sepol/cil/cil.h> +#include <cil/cil.h> #include <selinux/selinux.h> #include <assert.h>
libsemanage/src/semanage_store.h +1 -1
@@ -26,7 +26,7 @@#include <sys/time.h> #include <sepol/module.h> -#include <sepol/cil/cil.h> +#include <cil/cil.h> #include "handle.h" enum semanage_store_defs {
secilc/Makefile +2 -2
@@ -4,7 +4,7 @@ MANDIR ?= $(PREFIX)/share/man LIBDIR ?= $(PREFIX)/lib INCLUDEDIR ?= $(PREFIX)/include -LDLIBS = -lsepol -L$(LIBDIR) +LDLIBS = -lsepol -L../libsepol/src SECILC = secilc SECILC_SRCS := secilc.c SECILC_OBJS := $(patsubst %.c,%.o,$(SECILC_SRCS))
@@ -15,7 +15,7 @@ XMLTO = xmlto CFLAGS ?= -Wall -Wshadow -Wextra -Wundef -Wmissing-format-attribute -Wcast-align -Wstrict-prototypes -Wpointer-arith -Wunused -override CFLAGS += -I$(INCLUDEDIR) -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 +override CFLAGS += -I../libsepol/include -I../libsepol/cil/include -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 $(SECILC): $(SECILC_OBJS) $(CC) $(CFLAGS) -o $@ $^ $(LDFLAGS) $(LDLIBS)
secilc/secilc.c +1 -1
@@ -37,7 +37,7 @@#ifdef ANDROID #include <sepol/cil.h> #else -#include <sepol/cil/cil.h> +#include <cil/cil.h> #endif #include <sepol/policydb.h>
Signature · 1 line
2.2.0.rc0.207.ga3a616c
Quoted 13 lines · Nick Kralevich
Many parts of the SELinux userspace code appear to assume that there's already a pre-existing install of libselinux / selinux head files on the host. That may not be true if you're building SELinux for the first time.
Make the following modifications:
1) SELinux header files should be referenced from the source tree, not from
/usr/include.
2) *.a files should be referenced from the source tree, not from/usr/lib
3) #include statements should exactly match the path in the source tree.
Quoted 4 lines
This patch only addresses some of the issues found and testing has been extremely limited.
Signed-off-by Nick Kralevich <[email protected]>
Hmmm...well, we don't assume it has been installed on the host; we just assume that you are building as per selinux/README, i.e.
cd selinux && make DESTDIR=~/obj install
will correctly install to a private build directory specified via DESTDIR and pick up the headers and libraries from there.
Using relative paths within the selinux source tree is problematic in the other case since historically we have distributed individual tarballs for each components and not the entire tree. Actually, it was the other way around originally but Red Hat wanted us to break it up into separate tarballs for inclusion in separate packages in the Linux distributions.
Quoted 6 lines · Stephen Smalley
Hmmm...well, we don't assume it has been installed on the host; we just assume that you are building as per selinux/README, i.e.
cd selinux && make DESTDIR=~/obj install
will correctly install to a private build directory specified via DESTDIR and pick up the headers and libraries from there.
Quoted 6 lines
Using relative paths within the selinux source tree is problematic in the other case since historically we have distributed individual tarballs for each components and not the entire tree. Actually, it was the other way around originally but Red Hat wanted us to break it up into separate tarballs for inclusion in separate packages in the Linux distributions.
Ok, disregard this patch then. I figured I was doing something fundamentally wrong. Next time I should read the README.
-- Nick
Signature · 1 line
Nick Kralevich | Android Security | [email protected] | 650.214.4037
Quoted 6 lines · Stephen Smalley
Using relative paths within the selinux source tree is problematic in the other case since historically we have distributed individual tarballs for each components and not the entire tree. Actually, it was the other way around originally but Red Hat wanted us to break it up into separate tarballs for inclusion in separate packages in the Linux distributions.
Yes, in Gentoo we too use separate tarballs for all the userspace applications and libraries, so this would definitely break our builds.
We are able to install and build up a SELinux system from a non-SELinux system using the current instruction sets (so we don't assume it is installed either). The most important part is the order in which installations are done afaik.
Wkr,
Sven Vermeulen