* Thu Mar 12 2009 Adam Jackson <ajax@redhat.com> 1.6.0-13
- xselinux-1.6.0-selinux-nlfd.patch: Acquire the netlink socket from selinux, check it ourselves rather than having libselinux bang on it all the time.
This commit is contained in:
parent
242c526cf3
commit
3fbffab8f3
@ -19,7 +19,7 @@
|
||||
Summary: X.Org X11 X server
|
||||
Name: xorg-x11-server
|
||||
Version: 1.6.0
|
||||
Release: 12%{?dist}
|
||||
Release: 13%{?dist}
|
||||
URL: http://www.x.org
|
||||
License: MIT
|
||||
Group: User Interface/X
|
||||
@ -79,10 +79,13 @@ Patch6010: xserver-1.5.99.902-selinux-debugging.patch
|
||||
Patch6011: xserver-1.6.0-less-acpi-brokenness.patch
|
||||
|
||||
# don't try intel on poulsbo
|
||||
Patch6013: xserver-1.5.99.902-sod-off-poulsbo.patch
|
||||
Patch6012: xserver-1.5.99.902-sod-off-poulsbo.patch
|
||||
|
||||
# don't do selinux if we're not told to
|
||||
Patch6014: xserver-1.6.0-selinux-less.patch
|
||||
Patch6013: xserver-1.6.0-selinux-less.patch
|
||||
|
||||
# selinux performance hack
|
||||
Patch6014: xserver-1.6.0-selinux-nlfd.patch
|
||||
|
||||
# https://bugs.freedesktop.org/show_bug.cgi?id=20087
|
||||
Patch6015: xserver-1.5.99.902-vnc.patch
|
||||
@ -144,7 +147,7 @@ BuildRequires: mesa-libGL-devel >= 7.1-0.37
|
||||
# XXX silly...
|
||||
BuildRequires: libdrm-devel >= 2.4.0 kernel-headers
|
||||
|
||||
BuildRequires: audit-libs-devel libselinux-devel >= 2.0.59-1
|
||||
BuildRequires: audit-libs-devel libselinux-devel >= 2.0.79-1
|
||||
BuildRequires: hal-devel dbus-devel
|
||||
|
||||
# All server subpackages have a virtual provide for the name of the server
|
||||
@ -158,6 +161,7 @@ X.Org X11 X server
|
||||
Summary: Xorg server common files
|
||||
Group: User Interface/X
|
||||
Requires: pixman >= 0.14.0
|
||||
Requires: libselinux >= 2.0.79-1
|
||||
|
||||
%description common
|
||||
Common files shared among all X servers.
|
||||
@ -507,6 +511,10 @@ rm -rf $RPM_BUILD_ROOT
|
||||
|
||||
|
||||
%changelog
|
||||
* Thu Mar 12 2009 Adam Jackson <ajax@redhat.com> 1.6.0-13
|
||||
- xselinux-1.6.0-selinux-nlfd.patch: Acquire the netlink socket from selinux,
|
||||
check it ourselves rather than having libselinux bang on it all the time.
|
||||
|
||||
* Wed Mar 11 2009 Adam Jackson <ajax@redhat.com> 1.6.0-12
|
||||
- Requires: pixman >= 0.14.0
|
||||
|
||||
@ -965,7 +973,7 @@ rm -rf $RPM_BUILD_ROOT
|
||||
|
||||
* Tue Mar 11 2008 Adam Jackson <ajax@redhat.com> 1.4.99.901-3.20080310
|
||||
- New 1.5 snapshot.
|
||||
- xserver-1.5-x86emy.patch: Fix an x86emu quirk.
|
||||
- xserver-1.5-x86emu.patch: Fix an x86emu quirk.
|
||||
|
||||
* Fri Mar 07 2008 Adam Jackson <ajax@redhat.com> 1.4.99.901-1.20080307
|
||||
- Today's 1.5 snapshot.
|
||||
|
94
xserver-1.6.0-selinux-nlfd.patch
Normal file
94
xserver-1.6.0-selinux-nlfd.patch
Normal file
@ -0,0 +1,94 @@
|
||||
From 0731394b205f003143ceec1bde04b6c6726f9c10 Mon Sep 17 00:00:00 2001
|
||||
From: Adam Jackson <ajax@redhat.com>
|
||||
Date: Mon, 2 Mar 2009 18:45:27 -0500
|
||||
Subject: [PATCH] selinux netlink socket hack
|
||||
|
||||
---
|
||||
Xext/xselinux.c | 29 +++++++++++++++++++++++++++++
|
||||
configure.ac | 4 ++++
|
||||
include/dix-config.h.in | 2 ++
|
||||
3 files changed, 35 insertions(+), 0 deletions(-)
|
||||
|
||||
diff --git a/Xext/xselinux.c b/Xext/xselinux.c
|
||||
index 6085983..419c0ae 100644
|
||||
--- a/Xext/xselinux.c
|
||||
+++ b/Xext/xselinux.c
|
||||
@@ -1887,6 +1887,22 @@ SProcSELinuxDispatch(ClientPtr client)
|
||||
}
|
||||
}
|
||||
|
||||
+#ifdef HAVE_AVC_NETLINK_ACQUIRE_FD
|
||||
+static int netlink_fd;
|
||||
+
|
||||
+static void
|
||||
+SELinuxBlockHandler(void *data, struct timeval **tv, void *read_mask)
|
||||
+{
|
||||
+}
|
||||
+
|
||||
+static void
|
||||
+SELinuxWakeupHandler(void *data, int err, void *read_mask)
|
||||
+{
|
||||
+ if (FD_ISSET(netlink_fd, (fd_set *)read_mask))
|
||||
+ avc_netlink_check_nb();
|
||||
+}
|
||||
+#endif
|
||||
+
|
||||
|
||||
/*
|
||||
* Extension Setup / Teardown
|
||||
@@ -1917,6 +1933,12 @@ SELinuxResetProc(ExtensionEntry *extEntry)
|
||||
label_hnd = NULL;
|
||||
|
||||
audit_close(audit_fd);
|
||||
+#ifdef HAVE_AVC_NETLINK_ACQUIRE_FD
|
||||
+ avc_netlink_release_fd();
|
||||
+ RemoveBlockAndWakeupHandlers(SELinuxBlockHandler, SELinuxWakeupHandler,
|
||||
+ NULL);
|
||||
+ RemoveGeneralSocket(netlink_fd);
|
||||
+#endif
|
||||
|
||||
avc_destroy();
|
||||
avc_active = 0;
|
||||
@@ -2013,6 +2035,13 @@ SELinuxExtensionInit(INITARGS)
|
||||
if (atom_client_ctx == BAD_RESOURCE)
|
||||
FatalError("SELinux: Failed to create atom\n");
|
||||
|
||||
+#ifdef HAVE_AVC_NETLINK_ACQUIRE_FD
|
||||
+ netlink_fd = avc_netlink_acquire_fd();
|
||||
+ AddGeneralSocket(netlink_fd);
|
||||
+ RegisterBlockAndWakeupHandlers(SELinuxBlockHandler, SELinuxWakeupHandler,
|
||||
+ NULL);
|
||||
+#endif
|
||||
+
|
||||
/* Register callbacks */
|
||||
ret &= dixRegisterPrivateInitFunc(subjectKey, SELinuxSubjectInit, NULL);
|
||||
ret &= dixRegisterPrivateDeleteFunc(subjectKey, SELinuxSubjectFree, NULL);
|
||||
diff --git a/configure.ac b/configure.ac
|
||||
index 72ae67e..55a880e 100644
|
||||
--- a/configure.ac
|
||||
+++ b/configure.ac
|
||||
@@ -920,6 +920,10 @@ if test "x$XSELINUX" = xyes; then
|
||||
AC_CHECK_LIB(selinux, avc_init, [], AC_MSG_ERROR([SELinux library not found]))
|
||||
AC_CHECK_HEADERS([libaudit.h], [], AC_MSG_ERROR([SELinux extension requires audit system headers]))
|
||||
AC_CHECK_LIB(audit, audit_open, [], AC_MSG_ERROR([SELinux extension requires audit system library]))
|
||||
+ AC_CHECK_DECL(avc_netlink_acquire_fd,
|
||||
+ [AC_DEFINE(HAVE_AVC_NETLINK_ACQUIRE_FD, 1, "Have avc_netlink_acquire_fd")],
|
||||
+ [],
|
||||
+ [#include <selinux/avc.h>])
|
||||
AC_DEFINE(XSELINUX, 1, [Build SELinux extension])
|
||||
SELINUX_LIB="-lselinux -laudit"
|
||||
fi
|
||||
diff --git a/include/dix-config.h.in b/include/dix-config.h.in
|
||||
index 3da193f..66c3008 100644
|
||||
--- a/include/dix-config.h.in
|
||||
+++ b/include/dix-config.h.in
|
||||
@@ -442,4 +442,6 @@
|
||||
#include "dix-config-apple-verbatim.h"
|
||||
#endif
|
||||
|
||||
+#undef HAVE_AVC_NETLINK_ACQUIRE_FD
|
||||
+
|
||||
#endif /* _DIX_CONFIG_H_ */
|
||||
--
|
||||
1.6.1.3
|
||||
|
Loading…
Reference in New Issue
Block a user