rpms/libselinux
7
0
Fork 0
Code Issues Pull Requests Releases Activity

SELinux userspace 3.0-rc1 release candidate

Browse Source
This commit is contained in:
Petr Lautrbach 2019-10-15 16:38:59 +02:00
parent 6acb3de757
commit 2bb8ef885f
9 changed files with 70 additions and 280 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
.gitignore vendored
View File

@ -212,3 +212,4 @@ libselinux-2.0.96.tgz
/libselinux-2.9-rc1.tar.gz /libselinux-2.9-rc1.tar.gz
/libselinux-2.9-rc2.tar.gz /libselinux-2.9-rc2.tar.gz
/libselinux-2.9.tar.gz /libselinux-2.9.tar.gz
/libselinux-3.0-rc1.tar.gz

8
0001-Fix-selinux-man-page-to-refer-seinfo-and-sesearch-to.patch
View File

@ -1,14 +1,14 @@
From f71fc47524bef3c4cd8a412e43d13daebd1c418b Mon Sep 17 00:00:00 2001 From c36e12a0ed7641a9baa13afa1730b04eda0be07b Mon Sep 17 00:00:00 2001
From: Miroslav Grepl <mgrepl@redhat.com> From: Miroslav Grepl <mgrepl@redhat.com>
Date: Wed, 16 Jul 2014 08:28:03 +0200 Date: Wed, 16 Jul 2014 08:28:03 +0200
Subject: [PATCH 1/3] Fix selinux man page to refer seinfo and sesearch tools. Subject: [PATCH] Fix selinux man page to refer seinfo and sesearch tools.
--- ---
libselinux/man/man8/selinux.8 | 4 +++- libselinux/man/man8/selinux.8 | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-) 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/libselinux/man/man8/selinux.8 b/libselinux/man/man8/selinux.8 diff --git a/libselinux/man/man8/selinux.8 b/libselinux/man/man8/selinux.8
index e37aee68..bf23b655 100644 index e37aee6833b0..bf23b65579ca 100644
--- a/libselinux/man/man8/selinux.8 --- a/libselinux/man/man8/selinux.8
+++ b/libselinux/man/man8/selinux.8 +++ b/libselinux/man/man8/selinux.8
@@ -91,11 +91,13 @@ This manual page was written by Dan Walsh <dwalsh@redhat.com>. @@ -91,11 +91,13 @@ This manual page was written by Dan Walsh <dwalsh@redhat.com>.
@ -27,5 +27,5 @@ index e37aee68..bf23b655 100644
Every confined service on the system has a man page in the following format: Every confined service on the system has a man page in the following format:
.br .br
-- --
2.21.0 2.23.0

28
0002-Verify-context-input-to-funtions-to-make-sure-the-co.patch
View File

@ -1,7 +1,7 @@
From ad3d3a0bf819f5895a6884357c2d0e18ea1ef314 Mon Sep 17 00:00:00 2001 From b4ebb4534129a5d0f2e8a762015d089a0142b15f Mon Sep 17 00:00:00 2001
From: Dan Walsh <dwalsh@redhat.com> From: Dan Walsh <dwalsh@redhat.com>
Date: Mon, 23 Dec 2013 09:50:54 -0500 Date: Mon, 23 Dec 2013 09:50:54 -0500
Subject: [PATCH 2/3] Verify context input to funtions to make sure the context Subject: [PATCH] Verify context input to funtions to make sure the context
field is not null. field is not null.
Return errno EINVAL, to prevent segfault. Return errno EINVAL, to prevent segfault.
@ -24,7 +24,7 @@ FIXME: use __attribute__(nonnull (arg-index, ...))
11 files changed, 59 insertions(+), 6 deletions(-) 11 files changed, 59 insertions(+), 6 deletions(-)
diff --git a/libselinux/src/avc_sidtab.c b/libselinux/src/avc_sidtab.c diff --git a/libselinux/src/avc_sidtab.c b/libselinux/src/avc_sidtab.c
index 9669264d..c7754305 100644 index 9669264d651a..c77543050b5e 100644
--- a/libselinux/src/avc_sidtab.c --- a/libselinux/src/avc_sidtab.c
+++ b/libselinux/src/avc_sidtab.c +++ b/libselinux/src/avc_sidtab.c
@@ -81,6 +81,11 @@ sidtab_context_to_sid(struct sidtab *s, @@ -81,6 +81,11 @@ sidtab_context_to_sid(struct sidtab *s,
@ -40,7 +40,7 @@ index 9669264d..c7754305 100644
hvalue = sidtab_hash(ctx); hvalue = sidtab_hash(ctx);
diff --git a/libselinux/src/canonicalize_context.c b/libselinux/src/canonicalize_context.c diff --git a/libselinux/src/canonicalize_context.c b/libselinux/src/canonicalize_context.c
index ba4c9a2c..c8158725 100644 index ba4c9a2c7d46..c81587254b80 100644
--- a/libselinux/src/canonicalize_context.c --- a/libselinux/src/canonicalize_context.c
+++ b/libselinux/src/canonicalize_context.c +++ b/libselinux/src/canonicalize_context.c
@@ -17,6 +17,11 @@ int security_canonicalize_context_raw(const char * con, @@ -17,6 +17,11 @@ int security_canonicalize_context_raw(const char * con,
@ -56,7 +56,7 @@ index ba4c9a2c..c8158725 100644
errno = ENOENT; errno = ENOENT;
return -1; return -1;
diff --git a/libselinux/src/check_context.c b/libselinux/src/check_context.c diff --git a/libselinux/src/check_context.c b/libselinux/src/check_context.c
index 8a7997f0..5be84348 100644 index 8a7997f03598..5be8434849af 100644
--- a/libselinux/src/check_context.c --- a/libselinux/src/check_context.c
+++ b/libselinux/src/check_context.c +++ b/libselinux/src/check_context.c
@@ -14,6 +14,11 @@ int security_check_context_raw(const char * con) @@ -14,6 +14,11 @@ int security_check_context_raw(const char * con)
@ -72,7 +72,7 @@ index 8a7997f0..5be84348 100644
errno = ENOENT; errno = ENOENT;
return -1; return -1;
diff --git a/libselinux/src/compute_av.c b/libselinux/src/compute_av.c diff --git a/libselinux/src/compute_av.c b/libselinux/src/compute_av.c
index a47cffe9..6d285a2e 100644 index a47cffe98662..6d285a2e71c3 100644
--- a/libselinux/src/compute_av.c --- a/libselinux/src/compute_av.c
+++ b/libselinux/src/compute_av.c +++ b/libselinux/src/compute_av.c
@@ -27,6 +27,11 @@ int security_compute_av_flags_raw(const char * scon, @@ -27,6 +27,11 @@ int security_compute_av_flags_raw(const char * scon,
@ -88,7 +88,7 @@ index a47cffe9..6d285a2e 100644
fd = open(path, O_RDWR | O_CLOEXEC); fd = open(path, O_RDWR | O_CLOEXEC);
if (fd < 0) if (fd < 0)
diff --git a/libselinux/src/compute_create.c b/libselinux/src/compute_create.c diff --git a/libselinux/src/compute_create.c b/libselinux/src/compute_create.c
index 0975aeac..3e6a48c1 100644 index 0975aeac2224..3e6a48c16968 100644
--- a/libselinux/src/compute_create.c --- a/libselinux/src/compute_create.c
+++ b/libselinux/src/compute_create.c +++ b/libselinux/src/compute_create.c
@@ -64,6 +64,11 @@ int security_compute_create_name_raw(const char * scon, @@ -64,6 +64,11 @@ int security_compute_create_name_raw(const char * scon,
@ -104,7 +104,7 @@ index 0975aeac..3e6a48c1 100644
fd = open(path, O_RDWR | O_CLOEXEC); fd = open(path, O_RDWR | O_CLOEXEC);
if (fd < 0) if (fd < 0)
diff --git a/libselinux/src/compute_member.c b/libselinux/src/compute_member.c diff --git a/libselinux/src/compute_member.c b/libselinux/src/compute_member.c
index 4e2d221e..d1dd9772 100644 index 4e2d221ef9ea..d1dd9772c951 100644
--- a/libselinux/src/compute_member.c --- a/libselinux/src/compute_member.c
+++ b/libselinux/src/compute_member.c +++ b/libselinux/src/compute_member.c
@@ -25,6 +25,11 @@ int security_compute_member_raw(const char * scon, @@ -25,6 +25,11 @@ int security_compute_member_raw(const char * scon,
@ -120,7 +120,7 @@ index 4e2d221e..d1dd9772 100644
fd = open(path, O_RDWR | O_CLOEXEC); fd = open(path, O_RDWR | O_CLOEXEC);
if (fd < 0) if (fd < 0)
diff --git a/libselinux/src/compute_relabel.c b/libselinux/src/compute_relabel.c diff --git a/libselinux/src/compute_relabel.c b/libselinux/src/compute_relabel.c
index 49f77ef3..c3db7c0a 100644 index 49f77ef3344c..c3db7c0ada4c 100644
--- a/libselinux/src/compute_relabel.c --- a/libselinux/src/compute_relabel.c
+++ b/libselinux/src/compute_relabel.c +++ b/libselinux/src/compute_relabel.c
@@ -25,6 +25,11 @@ int security_compute_relabel_raw(const char * scon, @@ -25,6 +25,11 @@ int security_compute_relabel_raw(const char * scon,
@ -136,7 +136,7 @@ index 49f77ef3..c3db7c0a 100644
fd = open(path, O_RDWR | O_CLOEXEC); fd = open(path, O_RDWR | O_CLOEXEC);
if (fd < 0) if (fd < 0)
diff --git a/libselinux/src/compute_user.c b/libselinux/src/compute_user.c diff --git a/libselinux/src/compute_user.c b/libselinux/src/compute_user.c
index 7b881215..401fd107 100644 index 7b8812155750..401fd107e363 100644
--- a/libselinux/src/compute_user.c --- a/libselinux/src/compute_user.c
+++ b/libselinux/src/compute_user.c +++ b/libselinux/src/compute_user.c
@@ -24,6 +24,11 @@ int security_compute_user_raw(const char * scon, @@ -24,6 +24,11 @@ int security_compute_user_raw(const char * scon,
@ -152,7 +152,7 @@ index 7b881215..401fd107 100644
fd = open(path, O_RDWR | O_CLOEXEC); fd = open(path, O_RDWR | O_CLOEXEC);
if (fd < 0) if (fd < 0)
diff --git a/libselinux/src/fsetfilecon.c b/libselinux/src/fsetfilecon.c diff --git a/libselinux/src/fsetfilecon.c b/libselinux/src/fsetfilecon.c
index 52707d05..0cbe12d8 100644 index 52707d05ddd4..0cbe12d844d2 100644
--- a/libselinux/src/fsetfilecon.c --- a/libselinux/src/fsetfilecon.c
+++ b/libselinux/src/fsetfilecon.c +++ b/libselinux/src/fsetfilecon.c
@@ -9,8 +9,12 @@ @@ -9,8 +9,12 @@
@ -171,7 +171,7 @@ index 52707d05..0cbe12d8 100644
char * ccontext = NULL; char * ccontext = NULL;
int err = errno; int err = errno;
diff --git a/libselinux/src/lsetfilecon.c b/libselinux/src/lsetfilecon.c diff --git a/libselinux/src/lsetfilecon.c b/libselinux/src/lsetfilecon.c
index 1d3b28a1..ea6d70b7 100644 index 1d3b28a1c5fc..ea6d70b7584d 100644
--- a/libselinux/src/lsetfilecon.c --- a/libselinux/src/lsetfilecon.c
+++ b/libselinux/src/lsetfilecon.c +++ b/libselinux/src/lsetfilecon.c
@@ -9,8 +9,13 @@ @@ -9,8 +9,13 @@
@ -191,7 +191,7 @@ index 1d3b28a1..ea6d70b7 100644
char * ccontext = NULL; char * ccontext = NULL;
int err = errno; int err = errno;
diff --git a/libselinux/src/setfilecon.c b/libselinux/src/setfilecon.c diff --git a/libselinux/src/setfilecon.c b/libselinux/src/setfilecon.c
index d05969c6..3f0200e8 100644 index d05969c6c2f3..3f0200e8febc 100644
--- a/libselinux/src/setfilecon.c --- a/libselinux/src/setfilecon.c
+++ b/libselinux/src/setfilecon.c +++ b/libselinux/src/setfilecon.c
@@ -9,8 +9,12 @@ @@ -9,8 +9,12 @@
@ -210,5 +210,5 @@ index d05969c6..3f0200e8 100644
char * ccontext = NULL; char * ccontext = NULL;
int err = errno; int err = errno;
-- --
2.21.0 2.23.0

39
0003-libselinux-Allow-to-override-OVERRIDE_GETTID-from-co.patch
View File

@ -1,39 +0,0 @@
From 431f72836d6c02450725cf6ffb1c7223b9fa6acc Mon Sep 17 00:00:00 2001
From: Petr Lautrbach <plautrba@redhat.com>
Date: Mon, 11 Mar 2019 15:26:43 +0100
Subject: [PATCH 3/3] libselinux: Allow to override OVERRIDE_GETTID from
command line
$ make CFLAGS="$CFLAGS -DOVERRIDE_GETTID=0" ...
Drop this as soon as glibc-2.30 will become real 2.30 version, see
https://bugzilla.redhat.com/show_bug.cgi?id=1685594
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
---
libselinux/src/procattr.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libselinux/src/procattr.c b/libselinux/src/procattr.c
index c6799ef2..cbb6824e 100644
--- a/libselinux/src/procattr.c
+++ b/libselinux/src/procattr.c
@@ -24,6 +24,7 @@ static __thread char destructor_initialized;
/* Bionic and glibc >= 2.30 declare gettid() system call wrapper in unistd.h and
* has a definition for it */
+#ifndef OVERRIDE_GETTID
#ifdef __BIONIC__
#define OVERRIDE_GETTID 0
#elif !defined(__GLIBC_PREREQ)
@@ -33,6 +34,7 @@ static __thread char destructor_initialized;
#else
#define OVERRIDE_GETTID 0
#endif
+#endif
#if OVERRIDE_GETTID
static pid_t gettid(void)
--
2.21.0

33
0003-libselinux-src-Makefile-don-t-pass-bogus-I-and-L-to-.patch Normal file
View File

@ -0,0 +1,33 @@
From 0271bf4136e3a2bb476919eb9e984418ab95cb75 Mon Sep 17 00:00:00 2001
From: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Date: Fri, 25 Oct 2019 15:41:49 +0200
Subject: [PATCH] libselinux/src/Makefile: don't pass bogus -I and -L to python
setup.py build_ext
Using $(DESTDIR) during the build does not follow the normal/standard
semantic of DESTDIR: it is normally only needed during the
installation. Therefore, a lot of build systems/environments don't
pass any DESTDIR at build time, which causes setup.py to be called
with -I /usr/include -L /usr/lib, which breaks cross-compilation.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
---
libselinux/src/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libselinux/src/Makefile b/libselinux/src/Makefile
index 2b1696a0c17b..3b8bad810de0 100644
--- a/libselinux/src/Makefile
+++ b/libselinux/src/Makefile
@@ -130,7 +130,7 @@ SWIGRUBY = swig -Wall -ruby -o $(SWIGRUBYCOUT) -outdir ./ $(DISABLE_FLAGS)
all: $(LIBA) $(LIBSO) $(LIBPC)
pywrap: all selinuxswig_python_exception.i
- CFLAGS="$(CFLAGS) $(SWIG_CFLAGS)" $(PYTHON) setup.py build_ext -I $(DESTDIR)$(INCLUDEDIR) -L $(DESTDIR)$(LIBDIR)
+ CFLAGS="$(CFLAGS) $(SWIG_CFLAGS)" $(PYTHON) setup.py build_ext
rubywrap: all $(SWIGRUBYSO)
--
2.23.0

166
0004-libselinux-Use-Python-distutils-to-install-SELinux-p.patch
View File

@ -1,166 +0,0 @@
From bb5a63a3e6e19556419a486a00e008ae6af62fc3 Mon Sep 17 00:00:00 2001
From: Petr Lautrbach <plautrba@redhat.com>
Date: Thu, 16 May 2019 15:01:59 +0200
Subject: [PATCH] libselinux: Use Python distutils to install SELinux python
bindings
SWIG-4.0 changed its behavior so that it uses: from . import _selinux which
looks for _selinux module in the same directory as where __init__.py is -
$(PYLIBDIR)/site-packages/selinux. But _selinux module is installed into
$(PYLIBDIR)/site-packages/ since a9604c30a5e2f ("libselinux: Change the location
of _selinux.so").
In order to prevent such breakage in future use Python's distutils instead of
building and installing python bindings manually in Makefile.
Fixes:
>>> import selinux
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "/usr/lib64/python3.7/site-packages/selinux/__init__.py", line 13, in <module>
from . import _selinux
ImportError: cannot import name '_selinux' from 'selinux' (/usr/lib64/python3.7/site-packages/selinux/__init__.py)
>>>
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
---
libselinux/src/Makefile | 37 ++++++++-----------------------------
libselinux/src/setup.py | 24 ++++++++++++++++++++++++
2 files changed, 32 insertions(+), 29 deletions(-)
create mode 100644 libselinux/src/setup.py
diff --git a/libselinux/src/Makefile b/libselinux/src/Makefile
index e9ed0383..826c830c 100644
--- a/libselinux/src/Makefile
+++ b/libselinux/src/Makefile
@@ -36,7 +36,7 @@ TARGET=libselinux.so
LIBPC=libselinux.pc
SWIGIF= selinuxswig_python.i selinuxswig_python_exception.i
SWIGRUBYIF= selinuxswig_ruby.i
-SWIGCOUT= selinuxswig_wrap.c
+SWIGCOUT= selinuxswig_python_wrap.c
SWIGPYOUT= selinux.py
SWIGRUBYCOUT= selinuxswig_ruby_wrap.c
SWIGLOBJ:= $(patsubst %.c,$(PYPREFIX)%.lo,$(SWIGCOUT))
@@ -55,7 +55,7 @@ ifeq ($(LIBSEPOLA),)
LDLIBS_LIBSEPOLA := -l:libsepol.a
endif
-GENERATED=$(SWIGCOUT) $(SWIGRUBYCOUT) selinuxswig_python_exception.i
+GENERATED=$(SWIGCOUT) $(SWIGRUBYCOUT) $(SWIGCOUT) selinuxswig_python_exception.i
SRCS= $(filter-out $(GENERATED) audit2why.c, $(sort $(wildcard *.c)))
MAX_STACK_SIZE=32768
@@ -125,25 +125,18 @@ DISABLE_FLAGS+= -DNO_ANDROID_BACKEND
SRCS:= $(filter-out label_backends_android.c, $(SRCS))
endif
-SWIG = swig -Wall -python -o $(SWIGCOUT) -outdir ./ $(DISABLE_FLAGS)
-
SWIGRUBY = swig -Wall -ruby -o $(SWIGRUBYCOUT) -outdir ./ $(DISABLE_FLAGS)
all: $(LIBA) $(LIBSO) $(LIBPC)
-pywrap: all $(SWIGFILES) $(AUDIT2WHYSO)
+pywrap: all selinuxswig_python_exception.i
+ CFLAGS="$(SWIG_CFLAGS)" $(PYTHON) setup.py build_ext -I $(DESTDIR)$(INCLUDEDIR) -L $(DESTDIR)$(LIBDIR)
rubywrap: all $(SWIGRUBYSO)
-$(SWIGLOBJ): $(SWIGCOUT)
- $(CC) $(CFLAGS) $(SWIG_CFLAGS) $(PYINC) -fPIC -DSHARED -c -o $@ $<
-
$(SWIGRUBYLOBJ): $(SWIGRUBYCOUT)
$(CC) $(CFLAGS) $(SWIG_CFLAGS) $(RUBYINC) -fPIC -DSHARED -c -o $@ $<
-$(SWIGSO): $(SWIGLOBJ)
- $(CC) $(CFLAGS) $(LDFLAGS) -L. -shared -o $@ $< -lselinux $(PYLIBS)
-
$(SWIGRUBYSO): $(SWIGRUBYLOBJ)
$(CC) $(CFLAGS) $(LDFLAGS) -L. -shared -o $@ $^ -lselinux $(RUBYLIBS)
@@ -161,29 +154,15 @@ $(LIBPC): $(LIBPC).in ../VERSION
selinuxswig_python_exception.i: ../include/selinux/selinux.h
bash -e exception.sh > $@ || (rm -f $@ ; false)
-$(AUDIT2WHYLOBJ): audit2why.c
- $(CC) $(filter-out -Werror, $(CFLAGS)) $(PYINC) -fPIC -DSHARED -c -o $@ $<
-
-$(AUDIT2WHYSO): $(AUDIT2WHYLOBJ) $(LIBSEPOLA)
- $(CC) $(CFLAGS) $(LDFLAGS) -L. -shared -o $@ $^ -lselinux $(LDLIBS_LIBSEPOLA) $(PYLIBS) -Wl,-soname,audit2why.so,--version-script=audit2why.map,-z,defs
-
%.o: %.c policy.h
$(CC) $(CFLAGS) $(TLSFLAGS) -c -o $@ $<
%.lo: %.c policy.h
$(CC) $(CFLAGS) -fPIC -DSHARED -c -o $@ $<
-$(SWIGCOUT): $(SWIGIF)
- $(SWIG) $<
-
-$(SWIGPYOUT): $(SWIGCOUT)
-
$(SWIGRUBYCOUT): $(SWIGRUBYIF)
$(SWIGRUBY) $<
-swigify: $(SWIGIF)
- $(SWIG) $<
-
install: all
test -d $(DESTDIR)$(LIBDIR) || install -m 755 -d $(DESTDIR)$(LIBDIR)
install -m 644 $(LIBA) $(DESTDIR)$(LIBDIR)
@@ -194,10 +173,8 @@ install: all
ln -sf --relative $(DESTDIR)$(SHLIBDIR)/$(LIBSO) $(DESTDIR)$(LIBDIR)/$(TARGET)
install-pywrap: pywrap
- test -d $(DESTDIR)$(PYTHONLIBDIR)/selinux || install -m 755 -d $(DESTDIR)$(PYTHONLIBDIR)/selinux
- install -m 755 $(SWIGSO) $(DESTDIR)$(PYTHONLIBDIR)/_selinux$(PYCEXT)
- install -m 755 $(AUDIT2WHYSO) $(DESTDIR)$(PYTHONLIBDIR)/selinux/audit2why$(PYCEXT)
- install -m 644 $(SWIGPYOUT) $(DESTDIR)$(PYTHONLIBDIR)/selinux/__init__.py
+ $(PYTHON) setup.py install --prefix=$(PREFIX) `test -n "$(DESTDIR)" && echo --root $(DESTDIR)`
+ install -m 644 selinux.py $(DESTDIR)$(PYTHONLIBDIR)/selinux/__init__.py
install-rubywrap: rubywrap
test -d $(DESTDIR)$(RUBYINSTALL) || install -m 755 -d $(DESTDIR)$(RUBYINSTALL)
@@ -208,6 +185,8 @@ relabel:
clean-pywrap:
-rm -f $(SWIGLOBJ) $(SWIGSO) $(AUDIT2WHYLOBJ) $(AUDIT2WHYSO)
+ $(PYTHON) setup.py clean
+ -rm -rf build *~ \#* *pyc .#*
clean-rubywrap:
-rm -f $(SWIGRUBYLOBJ) $(SWIGRUBYSO)
diff --git a/libselinux/src/setup.py b/libselinux/src/setup.py
new file mode 100644
index 00000000..b12e7869
--- /dev/null
+++ b/libselinux/src/setup.py
@@ -0,0 +1,24 @@
+#!/usr/bin/python3
+
+from distutils.core import Extension, setup
+
+setup(
+ name="selinux",
+ version="2.9",
+ description="SELinux python 3 bindings",
+ author="SELinux Project",
+ author_email="selinux@vger.kernel.org",
+ ext_modules=[
+ Extension('selinux._selinux',
+ sources=['selinuxswig_python.i'],
+ include_dirs=['../include'],
+ library_dirs=['.'],
+ libraries=['selinux']),
+ Extension('selinux.audit2why',
+ sources=['audit2why.c'],
+ include_dirs=['../include'],
+ library_dirs=['.'],
+ libraries=['selinux'],
+ extra_link_args=['-l:libsepol.a'])
+ ],
+)
--
2.21.0

43
0005-libselinux-Do-not-use-SWIG_CFLAGS-when-Python-bindin.patch
View File

@ -1,43 +0,0 @@
From 10c9985d97d4aa3b98f8c83e9892b20aeea08b1c Mon Sep 17 00:00:00 2001
From: Petr Lautrbach <plautrba@redhat.com>
Date: Thu, 27 Jun 2019 11:17:13 +0200
Subject: [PATCH 5/5] libselinux: Do not use SWIG_CFLAGS when Python bindings
are built
Fixes:
Detecting usr/lib64/python3.6/site-packages/selinux/audit2why.cpython-36m-x86_64-linux-gnu.so with not-hardened warnings '
Hardened: audit2why.cpython-36m-x86_64-linux-gnu.so: FAIL: Gaps were detected in the annobin coverage. Run with -v to list.
' on x86_64
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
---
libselinux/src/Makefile | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/libselinux/src/Makefile b/libselinux/src/Makefile
index 826c830c..f64f23a8 100644
--- a/libselinux/src/Makefile
+++ b/libselinux/src/Makefile
@@ -104,9 +104,6 @@ FTS_LDLIBS ?=
override CFLAGS += -I../include -D_GNU_SOURCE $(DISABLE_FLAGS) $(PCRE_CFLAGS)
-SWIG_CFLAGS += -Wno-error -Wno-unused-variable -Wno-unused-but-set-variable -Wno-unused-parameter \
- -Wno-shadow -Wno-uninitialized -Wno-missing-prototypes -Wno-missing-declarations
-
RANLIB ?= ranlib
ARCH := $(patsubst i%86,i386,$(shell uname -m))
@@ -130,7 +127,7 @@ SWIGRUBY = swig -Wall -ruby -o $(SWIGRUBYCOUT) -outdir ./ $(DISABLE_FLAGS)
all: $(LIBA) $(LIBSO) $(LIBPC)
pywrap: all selinuxswig_python_exception.i
- CFLAGS="$(SWIG_CFLAGS)" $(PYTHON) setup.py build_ext -I $(DESTDIR)$(INCLUDEDIR) -L $(DESTDIR)$(LIBDIR)
+ $(PYTHON) setup.py build_ext -I $(DESTDIR)$(INCLUDEDIR) -L $(DESTDIR)$(LIBDIR)
rubywrap: all $(SWIGRUBYSO)
--
2.22.0

30
libselinux.spec
View File

@ -1,25 +1,25 @@
%define ruby_inc %(pkg-config --cflags ruby) %define ruby_inc %(pkg-config --cflags ruby)
%define libsepolver 2.9-1 %define libsepolver 3.0
Summary: SELinux library and simple utilities Summary: SELinux library and simple utilities
Name: libselinux Name: libselinux
Version: 2.9 Version: 3.0
Release: 7%{?dist} Release: 0.r1.1%{?dist}
License: Public Domain License: Public Domain
# https://github.com/SELinuxProject/selinux/wiki/Releases # https://github.com/SELinuxProject/selinux/wiki/Releases
Source0: https://github.com/SELinuxProject/selinux/releases/download/20190315/libselinux-2.9.tar.gz Source0: https://github.com/SELinuxProject/selinux/releases/download/20191031/libselinux-3.0-rc1.tar.gz
Source1: selinuxconlist.8 Source1: selinuxconlist.8
Source2: selinuxdefcon.8 Source2: selinuxdefcon.8
Url: https://github.com/SELinuxProject/selinux/wiki Url: https://github.com/SELinuxProject/selinux/wiki
# $ git clone https://github.com/SELinuxProject/selinux.git # $ git clone https://github.com/fedora-selinux/selinux.git
# $ cd selinux # $ cd selinux
# $ git format-patch libselinux-2.9 -- libselinux # $ git format-patch -N libselinux-3.0-rc1 -- libselinux
# $ i=1; for j in 00*patch; do printf "Patch%04d: %s\n" $i $j; i=$((i+1));done # $ i=1; for j in 00*patch; do printf "Patch%04d: %s\n" $i $j; i=$((i+1));done
# Patch list start
Patch0001: 0001-Fix-selinux-man-page-to-refer-seinfo-and-sesearch-to.patch Patch0001: 0001-Fix-selinux-man-page-to-refer-seinfo-and-sesearch-to.patch
Patch0002: 0002-Verify-context-input-to-funtions-to-make-sure-the-co.patch Patch0002: 0002-Verify-context-input-to-funtions-to-make-sure-the-co.patch
Patch0003: 0003-libselinux-Allow-to-override-OVERRIDE_GETTID-from-co.patch Patch0003: 0003-libselinux-src-Makefile-don-t-pass-bogus-I-and-L-to-.patch
Patch0004: 0004-libselinux-Use-Python-distutils-to-install-SELinux-p.patch # Patch list end
Patch0005: 0005-libselinux-Do-not-use-SWIG_CFLAGS-when-Python-bindin.patch
BuildRequires: gcc BuildRequires: gcc
BuildRequires: ruby-devel ruby libsepol-static >= %{libsepolver} swig pcre2-devel xz-devel BuildRequires: ruby-devel ruby libsepol-static >= %{libsepolver} swig pcre2-devel xz-devel
BuildRequires: python3 python3-devel BuildRequires: python3 python3-devel
@ -89,7 +89,7 @@ The libselinux-static package contains the static libraries
needed for developing SELinux applications. needed for developing SELinux applications.
%prep %prep
%autosetup -p 2 -n libselinux-%{version} %autosetup -p 2 -n libselinux-%{version}-rc1
%build %build
export DISABLE_RPM="y" export DISABLE_RPM="y"
@ -97,8 +97,6 @@ export USE_PCRE2="y"
%set_build_flags %set_build_flags
export CFLAGS="$CFLAGS -DOVERRIDE_GETTID=0"
# To support building the Python wrapper against multiple Python runtimes # To support building the Python wrapper against multiple Python runtimes
# Define a function, for how to perform a "build" of the python wrapper against # Define a function, for how to perform a "build" of the python wrapper against
# a specific runtime: # a specific runtime:
@ -197,6 +195,8 @@ rm -f %{buildroot}%{_mandir}/man8/togglesebool*
%{_sbindir}/selabel_lookup_best_match %{_sbindir}/selabel_lookup_best_match
%{_sbindir}/selabel_partial_match %{_sbindir}/selabel_partial_match
%{_sbindir}/selinux_check_access %{_sbindir}/selinux_check_access
%{_sbindir}/selabel_get_digests_all_partial_matches
%{_sbindir}/validatetrans
%{_mandir}/man5/* %{_mandir}/man5/*
%{_mandir}/man8/* %{_mandir}/man8/*
%{_mandir}/ru/man5/* %{_mandir}/ru/man5/*
@ -213,12 +213,16 @@ rm -f %{buildroot}%{_mandir}/man8/togglesebool*
%files -n python3-libselinux %files -n python3-libselinux
%{python3_sitearch}/selinux/ %{python3_sitearch}/selinux/
%{python3_sitearch}/selinux-%{version}-* %{python3_sitearch}/selinux-%{version}*
%{python3_sitearch}/_selinux*
%files ruby %files ruby
%{ruby_vendorarchdir}/selinux.so %{ruby_vendorarchdir}/selinux.so
%changelog %changelog
* Mon Nov 11 2019 Petr Lautrbach <plautrba@redhat.com> - 3.0-0.r1.1
- SELinux userspace 3.0-rc1 release candidate
* Thu Oct 03 2019 Miro Hrončok <mhroncok@redhat.com> - 2.9-7 * Thu Oct 03 2019 Miro Hrončok <mhroncok@redhat.com> - 2.9-7
- Rebuilt for Python 3.8.0rc1 (#1748018) - Rebuilt for Python 3.8.0rc1 (#1748018)

2
sources
View File

@ -1 +1 @@
SHA512 (libselinux-2.9.tar.gz) = 727b211d09f374d45aa3fa4dec7fd5463dfdcf5aaa47f7fcaccee51fb74896c3aa1a6f0bac9cdd47ebe4929effff13f66f5f70447b27b783dca5f7b1576d30d0 SHA512 (libselinux-3.0-rc1.tar.gz) = c2060523462423846325790eb0d23dc0cdf24d3672cd9ba3df8de3fef4b56f2778303d33cc735d4264fdcac90c11585e588aaa8ead6db458082c3746a93f602e