Fix include semanage/handle.h for semanage_set_root() as used by semodule
Subsystems (2)
Re: [PATCH v6] Fix includes for userspace tools and libraries
In reply to Stephen SmalleyHello Stephen.
Attached below please find the latest version of the patch with your changes introduced.
For reference, your changes were intended to add variables that define static libraries to be used for linking. By defining the local versions in the top-level Makefile and generic default system-wide versions in the lower-level Makefiles, it is possible to build the whole libraries +tools bundle from git. Otherwise, it is still possible to distribute the separate components individually from the same tree and they will still build properly as the lower-level Makefiles still define the system-wide static libraries for linking.
I have therefore removed the useless make_release.sh script.
I have also documented the USE_PAM build-time option for run_init in the top-level README file. I believe a top-level README file is very courteous and useful for this sort of notes.
Of course, I can (re)produce a better description of the patch if needed.
checkpolicy/Makefile +2 -1
@@ -6,6 +6,7 @@ BINDIR ?= $(PREFIX)/bin MANDIR ?= $(PREFIX)/share/man LIBDIR ?= $(PREFIX)/lib INCLUDEDIR ?= $(PREFIX)/include +LIBSEPOLSTATIC ?= $(LIBDIR)/libsepol.a TARGETS = checkpolicy checkmodule YACC = bison -y
@@ -19,7 +20,7 @@ CHECKOBJS = y.tab.o lex.yy.o queue.o mod CHECKPOLOBJS = $(CHECKOBJS) checkpolicy.o CHECKMODOBJS = $(CHECKOBJS) checkmodule.o -LDLIBS=$(LIBDIR)/libsepol.a -lfl +LDLIBS=$(LIBSEPOLSTATIC) -L$(LIBDIR) -lfl GENERATED=lex.yy.c y.tab.c y.tab.h
checkpolicy/test/Makefile +4 -3
@@ -2,14 +2,15 @@ # Makefile for building the dispol program # PREFIX ?= $(DESTDIR)/usr -BINDIR=$(PREFIX)/bin -LIBDIR=$(PREFIX)/lib +BINDIR ?= $(PREFIX)/bin +LIBDIR ?= $(PREFIX)/lib INCLUDEDIR ?= $(PREFIX)/include +LIBSEPOLSTATIC ?= $(LIBDIR)/libsepol.a CFLAGS ?= -g -Wall -O2 -pipe override CFLAGS += -I$(INCLUDEDIR) -LDLIBS=-lfl -lsepol -lselinux $(LIBDIR)/libsepol.a -L$(LIBDIR) +LDLIBS=-lsepol -lselinux $(LIBSEPOLSTATIC) -L$(LIBDIR) -lfl all: dispol dismod
libselinux/src/Makefile +2 -1
@@ -8,6 +8,7 @@ PYPREFIX ?= $(notdir $(PYTHON)) PREFIX ?= $(DESTDIR)/usr LIBDIR ?= $(PREFIX)/lib SHLIBDIR ?= $(DESTDIR)/lib +LIBSEPOLSTATIC ?= $(LIBDIR)/libsepol.a INCLUDEDIR ?= $(PREFIX)/include PYLIBVER ?= $(shell $(PYTHON) -c 'import sys;print("python%d.%d" % sys.version_info[0:2])') PYINC ?= $(shell pkg-config --cflags $(PYPREFIX))
@@ -102,7 +103,7 @@ $(AUDIT2WHYLOBJ): audit2why.c $(CC) $(filter-out -Werror, $(CFLAGS)) $(PYINC) -fPIC -DSHARED -c -o $@ $< $(AUDIT2WHYSO): $(AUDIT2WHYLOBJ) - $(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux ${LIBDIR}/libsepol.a -L$(LIBDIR) -Wl,-soname,$@ + $(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux $(LIBSEPOLSTATIC) -L$(LIBDIR) -Wl,-soname,$@ %.o: %.c policy.h $(CC) $(CFLAGS) $(TLSFLAGS) -c -o $@ $<
libsemanage/src/Makefile +1 -1
@@ -87,7 +87,7 @@ $(LIBA): $(OBJS) $(RANLIB) $@ $(LIBSO): $(LOBJS) - $(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -lsepol -lselinux -lbz2 -lustr -L$(LIBDIR) -Wl,-soname,$(LIBSO),--version-script=libsemanage.map,-z,defs + $(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -lsepol -lselinux -L$(LIBDIR) -lbz2 -lustr -Wl,-soname,$(LIBSO),--version-script=libsemanage.map,-z,defs ln -sf $@ $(TARGET) $(LIBPC): $(LIBPC).in
libsemanage/tests/Makefile +11 -6
@@ -1,19 +1,24 @@ +PREFIX ?= $(DESTDIR)/usr +LIBDIR ?= $(PREFIX)/lib + +LIBSELINUXSTATIC ?= $(LIBDIR)/libselinux.a +LIBSEPOLSTATIC ?= $(LIBDIR)/libsepol.a + # Add your test source files here: SOURCES = $(wildcard *.c) -# Point this variable to the libsemanage source directory you want to test: -TESTSRC=../src +# Point this variable to the libsemanage source directory: +LIBSEMANAGESRC = ../src # Add the required external object files here: -LIBS = ../src/libsemanage.a ../../libselinux/src/libselinux.a ../../libsepol/src/libsepol.a +LIBS = $(LIBSEMANAGESRC)/libsemanage.a $(LIBSELINUXSTATIC) $(LIBSEPOLSTATIC) ########################################################################### EXECUTABLE = libsemanage-tests -CC = gcc CFLAGS = -c -g -o0 -Wall -W -Wundef -Wmissing-noreturn -Wmissing-format-attribute -Wno-unused-parameter -INCLUDE = -I$(TESTSRC) -I$(TESTSRC)/../include -LDFLAGS = -lcunit -lustr -lbz2 +INCLUDE = -I$(LIBSEMANAGESRC) -I$(LIBSEMANAGESRC)/../include +LDFLAGS = -L$(LIBDIR) -lcunit -lustr -lbz2 OBJECTS = $(SOURCES:.c=.o) all: $(EXECUTABLE)
Makefile +12 -2
@@ -3,10 +3,20 @@ PYSUBDIRS=libselinux libsemanage DISTCLEANSUBIDRS=libselinux libsemanage ifeq ($(DEBUG),1) - export CFLAGS = -g3 -O0 -gdwarf-2 -fno-strict-aliasing -Wall -Wshadow -Werror - export LDFLAGS = -g + CFLAGS += -g3 -O0 -gdwarf-2 -fno-strict-aliasing -Wall -Wshadow -Werror + LDFLAGS += -g endif +# Released components are built separately (from lower-level Makefiles) and generally they use the +# system-wide static libraries and header files that are already installed. +export LIBSELINUXSTATIC = $(CURDIR)/libselinux/src/libselinux.a +export LIBSEPOLSTATIC = $(CURDIR)/libsepol/src/libsepol.a + +CFLAGS += -I$(CURDIR)/libselinux/include -I$(CURDIR)/libsepol/include -I$(CURDIR)/libsemanage/include +LDFLAGS += -L$(CURDIR)/libselinux/src -L$(CURDIR)/libsepol/src -L$(CURDIR)/libsemanage/src +export CFLAGS +export LDFLAGS + all install relabel clean test indent: @for subdir in $(SUBDIRS); do \ (cd $$subdir && $(MAKE) $@) || exit 1; \
policycoreutils/audit2allow/Makefile +2 -2
@@ -1,9 +1,9 @@ # Installation directories. -PREFIX ?= ${DESTDIR}/usr +PREFIX ?= $(DESTDIR)/usr BINDIR ?= $(PREFIX)/bin LIBDIR ?= $(PREFIX)/lib MANDIR ?= $(PREFIX)/share/man -LOCALEDIR ?= /usr/share/locale +LOCALEDIR ?= $(PREFIX)/share/locale all: ;
policycoreutils/audit2why/Makefile +1 -1
@@ -1,5 +1,5 @@ # Installation directories. -PREFIX ?= ${DESTDIR}/usr +PREFIX ?= $(DESTDIR)/usr BINDIR ?= $(PREFIX)/bin MANDIR ?= $(PREFIX)/share/man
policycoreutils/load_policy/Makefile +6 -4
@@ -1,13 +1,15 @@ # Installation directories. -PREFIX ?= ${DESTDIR}/usr +PREFIX ?= $(DESTDIR)/usr SBINDIR ?= $(DESTDIR)/sbin USRSBINDIR ?= $(PREFIX)/sbin +INCLUDEDIR ?= $(PREFIX)/include +LIBDIR ?= $(PREFIX)/lib MANDIR ?= $(PREFIX)/share/man -LOCALEDIR ?= /usr/share/locale +LOCALEDIR ?= $(PREFIX)/share/locale CFLAGS ?= -Werror -Wall -W -override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\"" -LDLIBS += -lsepol -lselinux -L$(PREFIX)/lib +override CFLAGS += $(LDFLAGS) -I$(INCLUDEDIR) -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\"" +LDLIBS += -lsepol -lselinux -L$(LIBDIR) TARGETS=$(patsubst %.c,%,$(wildcard *.c))
policycoreutils/mcstrans/src/Makefile +14 -8
@@ -1,34 +1,40 @@ +# Installation directories +PREFIX ?= $(DESTDIR)/usr +SBINDIR ?= $(DESTDIR)/sbin +INITDIR ?= $(DESTDIR)/etc/rc.d/init.d + ARCH = $(shell uname -i) ifeq "$(ARCH)" "x86_64" # In case of 64 bit system, use these lines - LIBDIR=/usr/lib64 + LIBDIR ?= $(PREFIX)/lib64 else ifeq "$(ARCH)" "i686" # In case of 32 bit system, use these lines - LIBDIR=/usr/lib + LIBDIR ?= $(PREFIX)/lib else ifeq "$(ARCH)" "i386" # In case of 32 bit system, use these lines - LIBDIR=/usr/lib + LIBDIR ?= $(PREFIX)/lib +else + LIBDIR ?= $(PREFIX)/lib endif endif endif -# Installation directories. -PREFIX ?= $(DESTDIR)/usr -SBINDIR ?= $(DESTDIR)/sbin -INITDIR ?= $(DESTDIR)/etc/rc.d/init.d + +LIBSEPOLSTATIC ?= $(LIBDIR)/libsepol.a PROG_SRC=mcstrans.c mcscolor.c mcstransd.c mls_level.c PROG_OBJS= $(patsubst %.c,%.o,$(PROG_SRC)) PROG=mcstransd INITSCRIPT=mcstrans + CFLAGS ?= -Wall -W -Wundef -Wmissing-noreturn -Wmissing-format-attribute override CFLAGS += -I../include -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 all: $(PROG) $(PROG): $(PROG_OBJS) - $(CC) $(LDFLAGS) -pie -o $@ $^ -lselinux -lcap -lpcre $(LIBDIR)/libsepol.a + $(CC) $(LDFLAGS) -pie -o $@ $^ -lselinux $(LIBSEPOLSTATIC) -L$(LIBDIR) -lcap -lpcre %.o: %.c $(CC) $(CFLAGS) -fPIE -c -o $@ $<
policycoreutils/mcstrans/utils/Makefile +7 -4
@@ -5,23 +5,26 @@ BINDIR ?= $(PREFIX)/sbin ARCH = $(shell uname -i) ifeq "$(ARCH)" "x86_64" # In case of 64 bit system, use these lines - LIBDIR=/usr/lib64 + LIBDIR ?= $(PREFIX)/lib64 else ifeq "$(ARCH)" "i686" # In case of 32 bit system, use these lines - LIBDIR=/usr/lib + LIBDIR ?= $(PREFIX)/lib else ifeq "$(ARCH)" "i386" # In case of 32 bit system, use these lines - LIBDIR=/usr/lib + LIBDIR ?= $(PREFIX)/lib +else + LIBDIR ?= $(PREFIX)/lib endif endif endif +LIBSEPOLSTATIC ?= $(LIBDIR)/libsepol.a CFLAGS ?= -Wall override CFLAGS += -I../src -D_GNU_SOURCE -LDLIBS += -L../src ../src/mcstrans.o ../src/mls_level.o -lselinux -lpcre $(LIBDIR)/libsepol.a +LDLIBS += -L../src ../src/mcstrans.o ../src/mls_level.o -lselinux -L$(LIBDIR) -lpcre $(LIBSEPOLSTATIC) TARGETS=$(patsubst %.c,%,$(wildcard *.c))
policycoreutils/newrole/Makefile +6 -4
@@ -1,9 +1,11 @@ # Installation directories. -PREFIX ?= ${DESTDIR}/usr +PREFIX ?= $(DESTDIR)/usr BINDIR ?= $(PREFIX)/bin MANDIR ?= $(PREFIX)/share/man +INCLUDEDIR ?= $(PREFIX)/include +LIBDIR ?= $(PREFIX)/lib ETCDIR ?= $(DESTDIR)/etc -LOCALEDIR = /usr/share/locale +LOCALEDIR ?= $(PREFIX)/share/locale PAMH = $(shell ls /usr/include/security/pam_appl.h 2>/dev/null) AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null) # Enable capabilities to permit newrole to generate audit records.
@@ -22,8 +24,8 @@ VERSION = $(shell cat ../VERSION) CFLAGS ?= -Werror -Wall -W EXTRA_OBJS = -override CFLAGS += -DVERSION=\"$(VERSION)\" $(LDFLAGS) -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\"" -LDLIBS += -lselinux -L$(PREFIX)/lib +override CFLAGS += -DVERSION=\"$(VERSION)\" $(LDFLAGS) -I$(INCLUDEDIR) -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\"" +LDLIBS += -lselinux -L$(LIBDIR) ifeq (${PAMH}, /usr/include/security/pam_appl.h) override CFLAGS += -DUSE_PAM EXTRA_OBJS += hashtab.o
policycoreutils/restorecond/Makefile +8 -6
@@ -1,13 +1,15 @@ # Installation directories. -PREFIX ?= ${DESTDIR}/usr +PREFIX ?= $(DESTDIR)/usr SBINDIR ?= $(PREFIX)/sbin -MANDIR = $(PREFIX)/share/man -INITDIR = $(DESTDIR)/etc/rc.d/init.d -SELINUXDIR = $(DESTDIR)/etc/selinux +INCLUDEDIR ?= $(PREFIX)/include +LIBDIR ?= $(PREFIX)/lib +MANDIR ?= $(PREFIX)/share/man +INITDIR ?= $(DESTDIR)/etc/rc.d/init.d +SELINUXDIR ?= $(DESTDIR)/etc/selinux CFLAGS ?= -g -Werror -Wall -W -override CFLAGS += -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64 -LDLIBS += -lselinux -L$(PREFIX)/lib +override CFLAGS += -I$(INCLUDEDIR) -D_FILE_OFFSET_BITS=64 +LDLIBS += -lselinux -L$(LIBDIR) all: restorecond
policycoreutils/run_init/Makefile +6 -5
@@ -1,16 +1,17 @@ - # Installation directories. -PREFIX ?= ${DESTDIR}/usr +PREFIX ?= $(DESTDIR)/usr SBINDIR ?= $(PREFIX)/sbin +INCLUDEDIR ?= $(PREFIX)/include +LIBDIR ?= $(PREFIX)/lib MANDIR ?= $(PREFIX)/share/man ETCDIR ?= $(DESTDIR)/etc -LOCALEDIR ?= /usr/share/locale +LOCALEDIR ?= $(PREFIX)/share/locale PAMH = $(shell ls /usr/include/security/pam_appl.h 2>/dev/null) AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null) CFLAGS ?= -Werror -Wall -W -override CFLAGS += -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\"" -LDLIBS += -lselinux -L$(PREFIX)/lib +override CFLAGS += -I$(INCLUDEDIR) -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\"" +LDLIBS += -lselinux -L$(LIBDIR) ifeq (${PAMH}, /usr/include/security/pam_appl.h) override CFLAGS += -DUSE_PAM LDLIBS += -lpam -lpam_misc
policycoreutils/sandbox/Makefile +8 -6
@@ -1,14 +1,16 @@ # Installation directories. -PREFIX ?= ${DESTDIR}/usr -INITDIR ?= ${DESTDIR}/etc/rc.d/init.d/ -SYSCONFDIR ?= ${DESTDIR}/etc/sysconfig +PREFIX ?= $(DESTDIR)/usr +INITDIR ?= $(DESTDIR)/etc/rc.d/init.d/ +SYSCONFDIR ?= $(DESTDIR)/etc/sysconfig BINDIR ?= $(PREFIX)/bin SBINDIR ?= $(PREFIX)/sbin +INCLUDEDIR ?= $(PREFIX)/include +LIBDIR ?= $(PREFIX)/lib MANDIR ?= $(PREFIX)/share/man -LOCALEDIR ?= /usr/share/locale +LOCALEDIR ?= $(PREFIX)/share/locale SHAREDIR ?= $(PREFIX)/share/sandbox -override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DPACKAGE="\"policycoreutils\"" -Wall -Werror -Wextra -LDLIBS += -lcgroup -lselinux -lcap-ng +override CFLAGS += $(LDFLAGS) -I$(INCLUDEDIR) -DPACKAGE="\"policycoreutils\"" -Wall -Werror -Wextra +LDLIBS += -lselinux -L$(LIBDIR) -lcgroup -lcap-ng all: sandbox seunshare sandboxX.sh start
policycoreutils/scripts/genhomedircon.8 +12 -28
@@ -1,37 +1,21 @@ -.\" Hey, Emacs! This is an -*- nroff -*- source file. -.\" Copyright (c) 2010 Dan Walsh <[email protected]> -.\" -.\" This is free documentation; you can redistribute it and/or -.\" modify it under the terms of the GNU General Public License as -.\" published by the Free Software Foundation; either version 2 of -.\" the License, or (at your option) any later version. -.\" -.\" The GNU General Public License's references to "object code" -.\" and "executables" are to be interpreted as the output of any -.\" document formatting or typesetting system, including -.\" intermediate and printed output. -.\" -.\" This manual is distributed in the hope that it will be useful, -.\" but WITHOUT ANY WARRANTY; without even the implied warranty of -.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -.\" GNU General Public License for more details. -.\" -.\" You should have received a copy of the GNU General Public -.\" License along with this manual; if not, write to the Free -.\" Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, -.\" USA. -.\" -.\" -.TH GENHOMEDIRCON "8" "May 2010" "Security Enhanced Linux" "SELinux" +.TH GENHOMEDIRCON "8" "Sep 2011" "Security Enhanced Linux" "SELinux" .SH NAME genhomedircon \- generate SELinux file context configuration entries for user home directories .SH SYNOPSIS .B genhomedircon -is a script that executes semodule to rebuild policy and create the -labels for HOMEDIRS based on home directories returned by the getpw calls. +is a script that executes +.B semodule +to rebuild the SELinux policy and to create the +labels for each user home directory based on directory paths returned by calls to getpwent(). -This functionality is enabled via the usepasswd flag in /etc/selinux/semanage.conf. +This functionality can be disabled by using the "usepasswd" flag in /etc/selinux/semanage.conf +(such flag can either take the value "true" or "false" and by default it is set to "true"). .SH AUTHOR This manual page was written by .I Dan Walsh <[email protected]> + +The supporting functionality in the semanage library was written by Tresys Technology. + +.SH "SEE ALSO" +semodule(8), getpwent(3), getpwent_r(3)
policycoreutils/scripts/Makefile +6 -3
@@ -1,9 +1,9 @@ # Installation directories. -PREFIX ?= ${DESTDIR}/usr +PREFIX ?= $(DESTDIR)/usr BINDIR ?= $(PREFIX)/bin SBINDIR ?= $(PREFIX)/sbin MANDIR ?= $(PREFIX)/share/man -LOCALEDIR ?= /usr/share/locale +LOCALEDIR ?= $(PREFIX)/share/locale all: fixfiles genhomedircon chcat
@@ -11,7 +11,10 @@ install: all -mkdir -p $(BINDIR) install -m 755 chcat $(BINDIR) install -m 755 fixfiles $(DESTDIR)/sbin - install -m 755 genhomedircon $(SBINDIR) + @echo "#!/bin/sh" > genhomedircon + @echo >> genhomedircon + @echo "$(SBINDIR)/semodule -Bn" >> genhomedircon + install -m 755 genhomedircon $(SBINDIR) -mkdir -p $(MANDIR)/man8 install -m 644 fixfiles.8 $(MANDIR)/man8/ install -m 644 genhomedircon.8 $(MANDIR)/man8/
policycoreutils/secon/Makefile +2 -2
@@ -1,9 +1,9 @@ # secon tool - command-line context -PREFIX ?= ${DESTDIR}/usr +PREFIX ?= $(DESTDIR)/usr INCLUDEDIR ?= $(PREFIX)/include BINDIR ?= $(PREFIX)/bin MANDIR ?= $(PREFIX)/share/man -LIBDIR ?= ${PREFIX}/lib +LIBDIR ?= $(PREFIX)/lib WARNS=-Werror -W -Wall -Wundef -Wshadow -Wpointer-arith -Wbad-function-cast -Wcast-align -Wwrite-strings -Waggregate-return -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -Wno-format-zero-length -Wformat-nonliteral -Wformat-security -Wfloat-equal VERSION = $(shell cat ../VERSION)
policycoreutils/semanage/Makefile +2 -2
@@ -1,8 +1,8 @@ # Installation directories. -PREFIX ?= ${DESTDIR}/usr +PREFIX ?= $(DESTDIR)/usr LIBDIR ?= $(PREFIX)/lib SBINDIR ?= $(PREFIX)/sbin -MANDIR = $(PREFIX)/share/man +MANDIR ?= $(PREFIX)/share/man PYLIBVER ?= $(shell python -c 'import sys;print "python%d.%d" % sys.version_info[0:2]') PYTHONLIBDIR ?= $(LIBDIR)/$(PYLIBVER)
policycoreutils/semodule/Makefile +2 -2
@@ -2,8 +2,8 @@ PREFIX ?= $(DESTDIR)/usr INCLUDEDIR ?= $(PREFIX)/include SBINDIR ?= $(PREFIX)/sbin -MANDIR = $(PREFIX)/share/man -LIBDIR ?= ${PREFIX}/lib +MANDIR ?= $(PREFIX)/share/man +LIBDIR ?= $(PREFIX)/lib CFLAGS ?= -Werror -Wall -W override CFLAGS += -I$(INCLUDEDIR)
policycoreutils/semodule_deps/Makefile +4 -3
@@ -1,13 +1,14 @@ # Installation directories. -PREFIX ?= ${DESTDIR}/usr +PREFIX ?= $(DESTDIR)/usr INCLUDEDIR ?= $(PREFIX)/include BINDIR ?= $(PREFIX)/bin -LIBDIR ?= ${PREFIX}/lib +LIBDIR ?= $(PREFIX)/lib +LIBSEPOLSTATIC ?= $(LIBDIR)/libsepol.a MANDIR ?= $(PREFIX)/share/man CFLAGS ?= -Werror -Wall -W override CFLAGS += -I$(INCLUDEDIR) -LDLIBS = $(LIBDIR)/libsepol.a +LDLIBS = $(LIBSEPOLSTATIC) all: semodule_deps
policycoreutils/semodule_expand/Makefile +2 -2
@@ -1,8 +1,8 @@ # Installation directories. -PREFIX ?= ${DESTDIR}/usr +PREFIX ?= $(DESTDIR)/usr INCLUDEDIR ?= $(PREFIX)/include BINDIR ?= $(PREFIX)/bin -LIBDIR ?= ${PREFIX}/lib +LIBDIR ?= $(PREFIX)/lib MANDIR ?= $(PREFIX)/share/man CFLAGS ?= -Werror -Wall -W
policycoreutils/semodule_link/Makefile +2 -2
@@ -1,9 +1,9 @@ # Installation directories. -PREFIX ?= ${DESTDIR}/usr +PREFIX ?= $(DESTDIR)/usr INCLUDEDIR ?= $(PREFIX)/include BINDIR ?= $(PREFIX)/bin MANDIR ?= $(PREFIX)/share/man -LIBDIR ?= ${PREFIX}/lib +LIBDIR ?= $(PREFIX)/lib CFLAGS ?= -Werror -Wall -W override CFLAGS += -I$(INCLUDEDIR)
policycoreutils/semodule_package/Makefile +2 -2
@@ -1,8 +1,8 @@ # Installation directories. -PREFIX ?= ${DESTDIR}/usr +PREFIX ?= $(DESTDIR)/usr INCLUDEDIR ?= $(PREFIX)/include BINDIR ?= $(PREFIX)/bin -LIBDIR ?= ${PREFIX}/lib +LIBDIR ?= $(PREFIX)/lib MANDIR ?= $(PREFIX)/share/man CFLAGS ?= -Werror -Wall -W
policycoreutils/sepolgen-ifgen/Makefile +4 -3
@@ -1,12 +1,13 @@ # Installation directories. -PREFIX ?= ${DESTDIR}/usr +PREFIX ?= $(DESTDIR)/usr BINDIR ?= $(PREFIX)/bin -LIBDIR ?= ${PREFIX}/lib +LIBDIR ?= $(PREFIX)/lib +LIBSEPOLSTATIC ?= $(LIBDIR)/libsepol.a INCLUDEDIR ?= $(PREFIX)/include CFLAGS ?= -Werror -Wall -W override CFLAGS += -I$(INCLUDEDIR) -LDLIBS = $(LIBDIR)/libsepol.a +LDLIBS = $(LIBSEPOLSTATIC) all: sepolgen-ifgen-attr-helper
policycoreutils/sestatus/Makefile +6 -5
@@ -1,12 +1,13 @@ # Installation directories. -PREFIX ?= ${DESTDIR}/usr +PREFIX ?= $(DESTDIR)/usr SBINDIR ?= $(PREFIX)/sbin -MANDIR = $(PREFIX)/share/man +INCLUDEDIR ?= $(PREFIX)/include +MANDIR ?= $(PREFIX)/share/man ETCDIR ?= $(DESTDIR)/etc -LIBDIR ?= ${PREFIX}/lib +LIBDIR ?= $(PREFIX)/lib -CFLAGS = -Werror -Wall -W -override CFLAGS += -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64 +CFLAGS ?= -Werror -Wall -W +override CFLAGS += -I$(INCLUDEDIR) -D_FILE_OFFSET_BITS=64 LDLIBS = -lselinux -L$(LIBDIR) all: sestatus
policycoreutils/setfiles/Makefile +5 -4
@@ -1,12 +1,13 @@ # Installation directories. -PREFIX ?= ${DESTDIR}/usr +PREFIX ?= $(DESTDIR)/usr SBINDIR ?= $(DESTDIR)/sbin -MANDIR = $(PREFIX)/share/man +INCLUDEDIR ?= $(PREFIX)/include +MANDIR ?= $(PREFIX)/share/man LIBDIR ?= $(PREFIX)/lib AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null) -CFLAGS = -g -Werror -Wall -W -override CFLAGS += -I$(PREFIX)/include +CFLAGS ?= -g -Werror -Wall -W +override CFLAGS += -I$(INCLUDEDIR) LDLIBS = -lselinux -lsepol -L$(LIBDIR) ifeq (${AUDITH}, /usr/include/libaudit.h)
policycoreutils/setsebool/Makefile +2 -2
@@ -2,8 +2,8 @@ PREFIX ?= $(DESTDIR)/usr INCLUDEDIR ?= $(PREFIX)/include SBINDIR ?= $(PREFIX)/sbin -MANDIR = $(PREFIX)/share/man -LIBDIR ?= ${PREFIX}/lib +MANDIR ?= $(PREFIX)/share/man +LIBDIR ?= $(PREFIX)/lib CFLAGS ?= -Werror -Wall -W override CFLAGS += -I$(INCLUDEDIR)
README +32 -0
@@ -0,0 +1,32 @@ +INSTALLATION: + +Type "make" to build and then "make install" to install. + +--- + +The environment variables CFLAGS and LDFLAGS can be passed to "make" to use custom compiler +and/or linker flags (for example: CFLAGS="-O3" LDFLAGS="" make). + +The environment variables LIBDIR and SHLIBDIR can be passed to "make" in order to configure +different directories for the libraries (e.g. LIBDIR=/usr/lib64 and SHLIBDIR=/usr/lib64 +on 64-bit systems). + +The environment variable PREFIX can be passed to "make" in order to configure an install +prefix other than "/usr". + +The environment variable DESTDIR can be passed to "make" in order to configure a +specific directory to be used as the root installation directory. + +Please see the Makefile(s) for other environment variables that can be used. + +--- + +BUILD OPTIONS: + +policycoreutils/run_init: +The run_init tool can be compiled with either PAM or shadow password authentication. Please +edit the Makefile to suit your needs. The default is to build with PAM authentication (-DUSE_PAM). +Support for Linux Audit (http://people.redhat.com/sgrubb/audit) should be auto-detected by the +Makefile. + +---
Quoted 32 lines · Stephen Smalley
Quoted 16 lines · Guido Trentalancia
I did hit other issues too. Lesson learned was: add -lbz2 -lustr to LDLIBS in policycoreutils/{semodule,setsebool}/Makefile and replace = with ?= in checkpolicy/test/Makefile
Unfortunately none of the above is exactly what I am looking for...
I am looking to install directly under the root live filesystem. So DESTDIR is not going to be used in my specific case. And I need LIBDIR=SHLIBDIR=/usr/lib64. Also, I'd like to first type "make" to build only and then type "make install" to get things installed.
rm -rf
/usr/include/selinux/; rm -rf/usr/include/semanage/; rm(quoted diff) +0
-2-rf /usr/include/sepol/ ; rm -f /usr/lib64/libsepol.* ; rm -f /usr/lib64/libsemanage.* ; CFLAGS="-O3 -march=corei7 -mtune=corei7"LIBDIR=/usr/lib64 SHLIBDIR=/usr/lib64 make install
Quoted 2 lines
Works with "install" target only with latest git. So it is not possible to build only first and then install.
Yes, if you want that, you'll need further changes. But rather than changing the component Makefiles in a manner that won't work for separate builds, how about defining some top-level variables and using them throughout, with conditional definitions (?=) within the individual Makefiles so that the separate builds still work. Like the following (incomplete, but gives the idea):
Makefile +0
-0
Makefile ifeq ($(DEBUG),1) · line 10
Quoted 4 lines
Makefile +1
-0@@ -7,6 +7,10 @@ ifeq ($(DEBUG),1) export LDFLAGS = -g endif +export LIBSEPOLSTATIC=$(CURDIR)/libsepol/src/libsepol.a
I have introduced the above in the revised patch attached to this message, however...
Makefile ifeq ($(DEBUG),1) · line 12
Quoted 2 lines
Makefile +2
-0+export EXTRA_INCLUDES=-I$(CURDIR)/libsepol/include -I$(CURDIR)/libselinux/include -I$(CURDIR)/libsemanage/include +export EXTRA_LIBS=-L$(CURDIR)/libsepol/src -L$(CURDIR)/libselinux/src -L$(CURDIR)/libsemanage/src
I've dropped the above because it is not just being used for the libraries, it is also used for the tools, therefore since it is widely used, better widely defined.
libselinux/src/Makefile PYPREFIX ?= $(notdir $(PYTHON)) · line 10
Quoted 13 lines
Makefile +0
-0all install relabel clean test indent: @for subdir in $(SUBDIRS); do \ (cd $$subdir && $(MAKE) $@) || exit 1; \libselinux/src/Makefile +1
-1@@ -7,7 +7,8 @@ PYPREFIX ?= $(notdir $(PYTHON)) # Installation directories. PREFIX ?= $(DESTDIR)/usr LIBDIR ?= $(PREFIX)/lib -SHLIBDIR ?= $(PREFIX)/lib +LIBSEPOLSTATIC ?= $(LIBDIR)/libsepol.a
Introduced here and elsewhere. For libsepol and also for static libselinux as needed throughout the whole project.
libselinux/src/Makefile SRCS= $(filter-out $(UNUSED_SRCS) $(GENERATED) audit2why.c, $(wildcard *.c)) · line 58
Quoted 10 lines
libselinux/src/Makefile +2
-1+SHLIBDIR ?= $(DESTDIR)/lib INCLUDEDIR ?= $(PREFIX)/include PYLIBVER ?= $(shell $(PYTHON) -c 'import sys;print("python%d.%d" % sys.version_info[0:2])') PYINC ?= $(shell pkg-config --cflags $(PYPREFIX))@@ -54,7 +55,7 @@ SRCS= $(filter-out $(UNUSED_SRCS) $(GENERATED) audit2why.c, $(wildcard *.c)) OBJS= $(patsubst %.c,%.o,$(SRCS)) LOBJS= $(patsubst %.c,%.lo,$(SRCS)) CFLAGS ?= -Werror -Wall -W -Wundef -Wshadow -Wmissing-noreturn -Wmissing-format-attribute -override CFLAGS += -I../include -I$(INCLUDEDIR) -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 $(EMFLAGS) +override CFLAGS += -I../include -I$(INCLUDEDIR) $(EXTRA_INCLUDES) -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 $(EMFLAGS)
Dropped (see above).
Quoted 27 lines
libselinux/src/Makefile +1
-1RANLIB=ranlib ARCH := $(patsubst i%86,i386,$(shell uname -m))@@ -102,7 +103,7 @@ $(AUDIT2WHYLOBJ): audit2why.c $(CC) $(filter-out -Werror, $(CFLAGS)) $(PYINC) -fPIC -DSHARED -c -o $@ $< $(AUDIT2WHYSO): $(AUDIT2WHYLOBJ) - $(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux ${LIBDIR}/libsepol.a -L$(LIBDIR) -Wl,-soname,$@ + $(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux $(LIBSEPOLSTATIC) -L$(LIBDIR) -Wl,-soname,$@ %.o: %.c policy.h $(CC) $(CFLAGS) $(TLSFLAGS) -c -o $@ $<libsemanage/src/Makefile +1
-1@@ -55,7 +55,7 @@ OBJS= $(patsubst %.c,%.o,$(SRCS)) conf-scan.o conf-parse.o LOBJS= $(patsubst %.c,%.lo,$(SRCS)) conf-scan.lo conf-parse.lo CFLAGS ?= -Werror -Wall -W -Wundef -Wshadow -Wmissing-noreturn -Wmissing-format-attribute -override CFLAGS += -I../include -I$(INCLUDEDIR) -D_GNU_SOURCE +override CFLAGS += -I../include -I$(INCLUDEDIR) $(EXTRA_INCLUDES) -D_GNU_SOURCE RANLIB=ranlib SWIG = swig -Wall -python -o $(SWIGCOUT) -outdir ./
libsemanage/src/Makefile $(LIBA): $(OBJS) · line 93
Quoted 8 lines
libsemanage/src/Makefile +1
-1@@ -87,7 +87,7 @@ $(LIBA): $(OBJS) $(RANLIB) $@ $(LIBSO): $(LOBJS) - $(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -lsepol -lselinux -lbz2 -lustr -L$(LIBDIR) -Wl,-soname,$(LIBSO),--version-script=libsemanage.map,-z,defs + $(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -lsepol -lselinux -lbz2 -lustr $(EXTRA_LIBS) -L$(LIBDIR) -Wl,-soname,$(LIBSO),--version-script=libsemanage.map,-z,defs ln -sf $@ $(TARGET) $(LIBPC): $(LIBPC).in
Thanks for the great suggestion.
By the way, I think the patch to tackle the shared library link creation still needs to be applied. Christopher said he had an idea to improve it, but then I've not heard anything back from him.
For reference, this was the latest version I think:
libselinux/src/Makefile +2 -1
@@ -126,7 +126,8 @@ install: all install -m 755 $(LIBSO) $(SHLIBDIR) test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig - cd $(LIBDIR) && ln -sf ../../`basename $(SHLIBDIR)`/$(LIBSO) $(TARGET) + pushd $(LIBDIR) && ln -sf $(SHLIBDIR)/$(LIBSO) $(TARGET) && popd + pushd $(SHLIBDIR) && ln -sf $(LIBSO) $(TARGET) && popd install-pywrap: pywrap test -d $(PYLIBDIR)/site-packages/selinux || install -m 755 -d $(PYLIBDIR)/site-packages/selinux
libsepol/src/Makefile +2 -1
@@ -43,7 +43,8 @@ install: all install -m 755 $(LIBSO) $(SHLIBDIR) test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig - cd $(LIBDIR) && ln -sf ../../`basename $(SHLIBDIR)`/$(LIBSO) $(TARGET) + pushd $(LIBDIR) && ln -sf $(SHLIBDIR)/$(LIBSO) $(TARGET) && popd + pushd $(SHLIBDIR) && ln -sf $(LIBSO) $(TARGET) && popd relabel: /sbin/restorecon $(SHLIBDIR)/$(LIBSO)
libsemanage/src/Makefile +2 -1
@@ -139,7 +139,8 @@ install: all test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig test -f $(DEFAULT_SEMANAGE_CONF_LOCATION) || install -m 644 -D semanage.conf $(DEFAULT_SEMANAGE_CONF_LOCATION) - cd $(LIBDIR) && ln -sf $(LIBSO) $(TARGET) + pushd $(LIBDIR) && ln -sf $(SHLIBDIR)/$(LIBSO) $(TARGET) && popd + pushd $(SHLIBDIR) && ln -sf $(LIBSO) $(TARGET) && popd install-pywrap: pywrap test -d $(PYLIBDIR)/site-packages || install -m 755 -d $(PYLIBDIR)/site-packages
If Christopher is still willing to contribute his version which supposedly reads better, then I'd be quite happy to have that applied instead, otherwise it doesn't matter I suppose. Similarly it's entirely up to you to decide the details, as long as it doesn't create broken links (as unfortunately is currently doing) I am fine with most ideas (at the moment it creates two links, although personally speaking I would only need the one in SHLIBDIR).
Regards,
Guido
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Re: [PATCH v5] Fix includes for userspace tools and libraries
In reply to Stephen SmalleyQuoted 12 lines · Stephen Smalley
Quoted 5 lines · Guido Trentalancia
My requirements are that I am on a 64-bit system and therefore I need/want to distiguish between "lib" and "lib64". I do not need/care about distinguishing between SHLIBDIR and LIBDIR. I am fine either without a DESTDIR or with a DESTDIR as you suggested (both are problematic).
rm -rf ~/out
make DESTDIR=~/out install
rm -rf ~/out
make DESTDIR=~/out LIBDIR=~/out/usr/lib64 SHLIBDIR=~/out/lib64 install
Quoted 6 lines
Both work fine for me with current selinux git master branch + Eric's patch 1/2 libselinux + my policycoreutils sandbox patch.
Quoted 1 line
And it breaks again after that...
You'd have to show where it fails. It seems to work for me and Eric.
With the original git the breakage is as follows (simple "make" with default target which is not "install"):
(missing libsepol header when compiling libselinux):
cc -O3 -march=corei7 -mtune=corei7 -I../include -I/usr/include
-D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -c -o load_policy.o load_policy.c
load_policy.c:14:25: fatal error: sepol/sepol.h: No such file or directory
and from then on, it is a long series of failures:
(missing libsepol header when compiling libsemanage) (missing libselinux header when compiling libsemanage) (missing libsepol header when compiling checkpolicy) (missing libsepol static lib when linking checkpolicy) (missing libsepol header when compiling under checkpolicy/test) (missing libsepol header when compiling policycoreutils/setfiles) (missing libselinux header when compiling policycoreutils/setfiles) (same as previous two for policycoreutils/load_policy) (missing libselinux header for newrole)
(missing libselinux header for run_init)
(same as above for sandbox)
(same as above for secon)
(same as above for sestatus)
(missing libsepol header for semodule_package)
(missing libsemanage header for semodule)
(missing libsepol header for semodule_link)
(missing libsepol header for semodule_expand)
(missing libsepol static lib for semodule_deps)
...
Only if "install" target is forced, then it works. That's why I still believe the patch is worth.
It is not normal that an installation is mandatory for building a package...
Regards,
Guido
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Re: [PATCH v5] Fix includes for userspace tools and libraries (and possible security issue)
In reply to Guido TrentalanciaQuoted 25 lines · Guido Trentalancia
...
make -C src install
make[2]: Entering directory `/usr/src/selinux-userspace/git/selinux-test/libsemanage/src' cc -O3 -march=corei7 -mtune=corei7 -fPIC -I../include
-I/opt/out/usr/include -D_GNU_SOURCE -shared -o libsemanage.so.1
utilities.lo user_extra_record.lo modules.lo boolean_record.lo ports_file.lo interfaces_file.lo interfaces_local.lo seuser_record.lo user_base_record.lo booleans_file.lo genhomedircon.lo fcontexts_file.lo booleans_local.lo database_llist.lo parse_utils.lo nodes_policydb.lo policy_components.lo users_extra_file.lo debug.lo fcontext_record.lo database_file.lo seusers_file.lo fcontexts_local.lo ports_local.lo direct_api.lo seusers_local.lo context_record.lo nodes_file.lo port_record.lo users_base_policydb.lo semanage_store.lo users_base_file.lo fcontexts_policy.lo booleans_activedb.lo users_policy.lo handle.lo booleans_policydb.lo nodes_local.lo interfaces_policy.lo database.lo users_local.lo ports_policy.lo booleans_active.lo nodes_policy.lo booleans_policy.lo users_join.lo user_record.lo seusers_policy.lo database_join.lo database_activedb.lo ports_policydb.lo interfaces_policydb.lo database_policydb.lo iface_record.lo node_record.lo conf-scan.lo conf-parse.lo -lsepol(quoted diff) +0
-2-lselinux -lbz2 -lustr -L/usr/lib64/ -Wl,-soname,libsemanage.so.1,--version-script=libsemanage.map,-z,defs
/usr/lib/gcc/x86_64-unknown-linux-gnu/4.6.1/../../../../x86_64-unknown-linux-gnu/bin/ld: /usr/lib64//libselinux.a(selinux_config.o): relocationR_X86_64_32against `.rodata.str1.1' can not be used when making a shared object; recompile with -fPIC/usr/lib64//libselinux.a: could not read symbols: Bad value
Quoted 8 lines
collect2: ld returned 1 exit status
make[2]: *** [libsemanage.so.1] Error 1
make[2]: Leaving directory `/usr/src/selinux-userspace/git/selinux-test/libsemanage/src' make[1]: *** [install] Error 2
make[1]: Leaving directory `/usr/src/selinux-userspace/git/selinux-test/libsemanage'
make: *** [install] Error 1
My patch 1/2 from yesterday fixes this problem with the current upstream master branch.
-Eric
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Re: [PATCH] Fix includes for userspace tools and libraries (and possible security issue)
In reply to Stephen SmalleyQuoted 71 lines · Stephen Smalley
Quoted 42 lines · Guido Trentalancia
Hello again.
The security risk associated with the linkage of an old libsepol.a static library is low due to the fact that the tools are usually built from each component separately after all the libraries have been previously built and installed.
Quoted 7 lines · Stephen Smalley
Quoted 5 lines · Guido Trentalancia
No, it doesn't currently ! If you want to try reproducing it, then you should do so on a system which hasn't got it already installed (or make sure you get temporarily rid of $(PREFIX)/include/{selinux,sepol,semanage} and $(LIBDIR)/lib{selinux,sepol,semanage}.* first).
Quoted 8 lines
I know it is presently broken, but not sure exactly when/who broke it. However, as a working example:
$ git clean -fdx $ rm -rf ~/out $ git checkout master@{"16 months ago"} $ make DESTDIR=~/outworks just fine for me.
...
make -C src
make[2]: Entering directory `/usr/src/selinux-userspace/git/selinux-13092011-16monthsago/libselinux/src' cc -Werror -Wall -W -Wundef -Wshadow -Wmissing-noreturn(quoted diff) +0
-2-Wmissing-format-attribute -I../include -I/opt/out/usr/include -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -c -o load_policy.o load_policy.cload_policy.c:14:25: fatal error:
sepol/sepol.h: No such file or directory
compilation terminated.
make[2]: *** [load_policy.o] Error 1
make[2]: Leaving directory `/usr/src/selinux-userspace/git/selinux-13092011-16monthsago/libselinux/src' make[1]: *** [all] Error 2
make[1]: Leaving directory `/usr/src/selinux-userspace/git/selinux-13092011-16monthsago/libselinux'
make: *** [all] Error 1Quoted 8 lines
The above is what I get. And there is probably more behind that...
The problem is due to the fact that before "make install" is issued, nothing usually exists under DESTDIR whatever DESTDIR is.
So includes from DESTDIR are getting included but unfortunately they are not there (yet). Until you have temporarily removed DESTDIR, you won't be able to reproduce it.
I did remove it - look again at my message and see the rm -rf ~/out. I also removed the system headers and libraries via yum. Here we go again:
$ ls ~/out ls: cannot access /home/sds/out: No such file or directory $ ls /usr/include/selinux ls: cannot access /usr/include/selinux: No such file or directory $ ls /usr/include/sepol ls: cannot access /usr/include/sepol: No such file or directory $ make DESTDIR=~/out > out <completes successfully> $ ls ~/out/lib/ libselinux.so.1 libsepol.so.1 $ ls ~/out/usr/include/ selinux semanage sepol $ ls ~/out/usr/lib libselinux.a libsemanage.a libsemanage.so.1 libsepol.so python2.7 libselinux.so libsemanage.so libsepol.a pkgconfig
Quoted 2 lines
See, from nothing to a complete build. I can't explain it any more clearly, so I'm stopping this thread here.
Black magic ?
It is particularly strange that "make" automatically implies "make install" (it should never be like that as it would be equivalent to performing an installation without the user explicitly requiring it).
However in my specific case (above quoted logs), I bet git did not properly go back in time so I was actually working on current git.
How about the semanage.conf(5) manual page ?
Regards,
Guido
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Re: [PATCH] Fix includes for userspace tools and libraries (was Re: [PATCH] Fix include semanage/handle.h for semanage_set_root() as used by semodule)
In reply to Eric ParisQuoted 25 lines · Eric Paris
Quoted 24 lines · Guido Trentalancia
Hi Stephen.
Quoted 13 lines · Stephen Smalley
Quoted 11 lines · Eric Paris
I'm also really annoyed by this at times, but I don't know what the right answer is.
We really treat it like we have 5+ separate projects which just all happen to live in the same git tree. Thus to build libselinux you must have already built and installed libsepol. And then to build libsemanage you need to have done that with both libsepol and libselinux. Then of course to get the builds and install right (on Fedora/RHEL) you have to know to use LIBDIR=/usr/lib64 SHLIBDIR=/lib64 for libsepol and libsepol, but SHLIBDIR=/usr/lib64 for libsemanage. Its a mess, but I don't know what to do that's better....
Quoted 4 lines
make DESTDIR=~/out at top-level should work fine - it will build and install each library into a private tree (as specified by DESTDIR) and then build and install the programs against those libraries. Without needing to clobber the system ones.
At the moment, it does not, until the Makefile(s) are modified or at least until the libraries are manually installed first.
Quoted 8 lines
Quoted 3 lines
Try by yourself, but do not forget to remove $(PREFIX)/usr/include/{selinux,semanage,sepol} and $(PREFIX){/usr,}/lib/libse{linux,manage,pol}* first !
I recently added the patch which changed the global to be 'build' instead of 'install', so sds might not realize that 'install' is no longer the default, however I think Guido is right about the install having a number of paces that it hard coded things...
Your patch was wrong and should have been rejected. make DESTDIR=~/out was the way to build the entire source tree. It ensured that the right headers are picked up (by adding -I~/out/usr/include to CFLAGS, which then take precedence over the system ones), and that the right libraries are linked against (likewise with LDFLAGS), and it didn't require you to be root to build.
Signature · 8 lines
Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 2 lines · Guido Trentalancia
It only happens when building from git (because it uses the top-level
Makefilewhich is not being distributed with the released components).
And a similar error happens with checkpolicy if a recent enough libsepol is not already installed:
cc -g -Wall -Wshadow -O2 -pipe -fno-strict-aliasing -I. -I/usr/include -o y.tab.o -c y.tab.c
In file included from policy_parse.y:53:0:
module_compiler.h:85:28: error: unknown type name filename_trans_rule_t
make: *** [y.tab.o] Error 1
Quoted 29 lines · Guido Trentalancia
Quoted 28 lines
Hello,
I am not able to build semodule from the current git unless the following patch is applied.
Also, it would still be problematic if an outdated version of
handle.his getting picked up directly from the root include directory (as it happens now) and not from the local build directory... In other words, theMakefileand build system should be modified so that the local header files are picked up during each new build rather than the system-wide ones from previous installations.But at least this is a start:
Include <
semanage/handle.h> forsemodule_set_root()currently used by semodulepolicycoreutils/semodule/semodule.c +1
-0@@ -21,6 +21,7 @@#include <sys/types.h> #include <semanage/modules.h> +#include <semanage/handle.h> enum client_modes {NO_MODE ,INSTALL_M ,UPGRADE_M ,BASE_M ,ENABLE_M ,DISABLE_M ,REMOVE_M ,LIST_M ,RELOAD
Quoted 13 lines
Quoted 5 lines
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.