On 2013-12-10 13:36:10, Seth Arnold wrote: > On Fri, Dec 06, 2013 at 08:57:57PM -0800, Tyler Hicks wrote: > > By default, statically link against the in-tree libapparmor. If the > > in-tree libapparmor is not yet built, print a helpful error message. To > > build against the system libapparmor, the SYSTEM_LIBAPPARMOR make > > variable can be set on the command line like so: > > > > $ make SYSTEM_LIBAPPARMOR=1 > > > > This patch also fixes issues around the inclusion of the apparmor.h > > header. Previously, the in-tree apparmor.h was always being included > > even if the parser was being linked against the system libapparmor. > > Parser source files should no longer include apparmor.h as the Makefile > > includes the correct header at build time using the pre-processor's > > -include option. > > > > This is fragile and definitely not ideal, but there is a valid reason > > for doing it this way. -I../libraries/libapparmor/src/ was previously > > used, but that is incorrect because there are header file collisions in > > libraries/libapparmor/src/ and parser/. For example, a parser.h exists > > in both directories. > > > > Per-target modification of EXTRA_CXXFLAGS is performed for source files > > needing to include apparmor.h. Those targets were also updated to depend > > on the local apparmor.h when building against the in-tree libapparmor. > > When building against the system libapparmor, the variable used in the > > dependency list is empty. Likewise, a libapparmor.la dependency is added > > to the apparmor_parser target when building against the in-tree > > apparmor. > > > > Signed-off-by: Tyler Hicks <[email protected]> > > --- > > > > This turned out being much uglier than I initially expected. This patch > > should > > be fine to merge, but I'd love for someone to suggest something cleaner. I > > particularly don't like including apparmor.h through a pre-processor option. > > Thanks for tackling this, it had the potential to be a gigantic disaster > for someone. > > I don't particularly love the design but have nothing better to suggest. > > Is building against the in-tree version the "best" default?
Steve obviously thinks it is and JJ signed off on defaulting to the in-tree libapparmor in #apparmor last week, so that's what I went with. However, I haven't convinced myself one way or the other. > > The actual implementation of the idea looked good to me. > > Acked-by: Seth Arnold <[email protected]> Thanks! > (Though probably it'd be best to wait for Steve's feedback before > committing -- he's thought about our build system a lot more than I have.) Yeah, I'm definitely waiting for Steve's (n)ack on this one. Tyler
signature.asc
Description: Digital signature
-- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
