From: Ladislav Michl <[email protected]> Signed-off-by: Ladislav Michl <[email protected]> --- CHANGES: - v2: build with setrans and rpm support, libselinux exports their symbols even when disabled, leading to undefined references (e.g. selinux_raw_context_to_color in secon). Select LIBC_DL. Make python wrapper depend on PYTHON3 instead of selecting it to avoid Kconfig recursive dependency (PYTHON3 -> LIBUUID -> UTIL_LINUX -> LIBSELINUX -> PYTHON3).
...PyString_FromString-with-PyUnicode_F.patch | 48 ++++++++++++ patches/libselinux-3.11/series | 4 + rules/libselinux.in | 57 +++++++++++--- rules/libselinux.make | 76 +++++++++++++------ 4 files changed, 154 insertions(+), 31 deletions(-) create mode 100644 patches/libselinux-3.11/0001-libselinux-Replace-PyString_FromString-with-PyUnicode_F.patch create mode 100644 patches/libselinux-3.11/series diff --git a/patches/libselinux-3.11/0001-libselinux-Replace-PyString_FromString-with-PyUnicode_F.patch b/patches/libselinux-3.11/0001-libselinux-Replace-PyString_FromString-with-PyUnicode_F.patch new file mode 100644 index 000000000..015ede608 --- /dev/null +++ b/patches/libselinux-3.11/0001-libselinux-Replace-PyString_FromString-with-PyUnicode_F.patch @@ -0,0 +1,48 @@ +From: Petr Lautrbach <[email protected]> +Date: Thu, 6 Aug 2026 16:30:44 +0200 +Subject: [PATCH] libselinux: Replace PyString_FromString with + PyUnicode_FromString for SWIG 4.5.0 compatibility + +SWIG 4.5.0 removed Python 2 C API compatibility macros (PyInt_*, +PyString_*, SWIG_Python_str_*) from its runtime header pyhead.swg. +These macros previously mapped deprecated Python 2 C API names to their +Python 3 equivalents. + +Fixes: https://github.com/SELinuxProject/selinux/issues/538 +Authored-by: Jitka Plesníková <[email protected]> +Signed-off-by: Petr Lautrbach <[email protected]> +Acked-by: Stephen Smalley <[email protected]> +--- + src/selinuxswig_python.i | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/src/selinuxswig_python.i b/src/selinuxswig_python.i +--- a/src/selinuxswig_python.i ++++ b/src/selinuxswig_python.i +@@ -69,7 +69,7 @@ + PyObject* list = PyList_New(*$2); + int i; + for (i = 0; i < *$2; i++) { +- PyList_SetItem(list, i, PyString_FromString((*$1)[i])); ++ PyList_SetItem(list, i, PyUnicode_FromString((*$1)[i])); + } + $result = SWIG_AppendOutput($result, list); + } +@@ -102,7 +102,7 @@ + len++; + plist = PyList_New(len); + for (i = 0; i < len; i++) { +- PyList_SetItem(plist, i, PyString_FromString((*$1)[i])); ++ PyList_SetItem(plist, i, PyUnicode_FromString((*$1)[i])); + } + } else { + plist = PyList_New(0); +@@ -119,7 +119,7 @@ + if (*$1) { + plist = PyList_New(result); + for (i = 0; i < result; i++) { +- PyList_SetItem(plist, i, PyString_FromString((*$1)[i])); ++ PyList_SetItem(plist, i, PyUnicode_FromString((*$1)[i])); + } + } else { + plist = PyList_New(0); diff --git a/patches/libselinux-3.11/series b/patches/libselinux-3.11/series new file mode 100644 index 000000000..9d79f21d8 --- /dev/null +++ b/patches/libselinux-3.11/series @@ -0,0 +1,4 @@ +# generated by git-ptx-patches +#tag:base --start-number 1 +0001-libselinux-Replace-PyString_FromString-with-PyUnicode_F.patch +# 9229b75b9f37589afb32a0e0c582e3b8 - git-ptx-patches magic diff --git a/rules/libselinux.in b/rules/libselinux.in index 6d6b1e655..0ff1358af 100644 --- a/rules/libselinux.in +++ b/rules/libselinux.in @@ -1,27 +1,66 @@ -## SECTION=staging -## old section: -### SECTION=selinux +## SECTION=selinux menuconfig LIBSELINUX tristate prompt "libselinux " - select LIBPCRE + select LIBC_DL + select PCRE2 + select PCRE2_8 select LIBSEPOL - select PYTHON if LIBSELINUX_PYTHON select HOST_SWIG if LIBSELINUX_PYTHON + select HOST_PYTHON3_PIP if LIBSELINUX_PYTHON help libselinux provides an API for SELinux applications to get and set process and file security contexts and to obtain security policy decisions. Required for any applications that use the SELinux API. - STAGING: remove in ptxdist-2020.12.0 - Old version that need to be updated. Fails to build with gcc >= 9.x. - if LIBSELINUX +config LIBSELINUX_UTILS + bool "install utilities" + +if LIBSELINUX_UTILS + +config LIBSELINUX_GETENFORCE + bool "getenforce" + depends on !BUSYBOX_GETENFORCE || ALLYES + +comment "busybox' getenforce is selected!" + depends on BUSYBOX_GETENFORCE + +config LIBSELINUX_GETSEBOOL + bool "getsebool" + depends on !BUSYBOX_GETSEBOOL || ALLYES + +comment "busybox' getsebool is selected!" + depends on BUSYBOX_GETSEBOOL + +config LIBSELINUX_MATCHPATHCON + bool "matchpathcon" + depends on !BUSYBOX_MATCHPATHCON || ALLYES + +comment "busybox' matchpathcon is selected!" + depends on BUSYBOX_MATCHPATHCON + +config LIBSELINUX_SELINUXENABLED + bool "selinuxenabled" + depends on !BUSYBOX_SELINUXENABLED || ALLYES + +comment "busybox' selinuxenabled is selected!" + depends on BUSYBOX_SELINUXENABLED + +config LIBSELINUX_SETENFORCE + bool "setenforce" + depends on !BUSYBOX_SETENFORCE || ALLYES + +comment "busybox' setenforce is selected!" + depends on BUSYBOX_SETENFORCE + +endif + config LIBSELINUX_PYTHON bool "python wrapper" - depends on STAGING + depends on PYTHON3 endif diff --git a/rules/libselinux.make b/rules/libselinux.make index 9f6b6a62f..b7bf42854 100644 --- a/rules/libselinux.make +++ b/rules/libselinux.make @@ -14,62 +14,94 @@ PACKAGES-$(PTXCONF_LIBSELINUX) += libselinux # # Paths and names # -LIBSELINUX_VERSION := 2.1.12 -LIBSELINUX_MD5 := 73270f384a032fad34b5fe075fa05ce2 +LIBSELINUX_VERSION := $(SELINUX_VERSION) +LIBSELINUX_SHA256 := 73d419c6e20e874adaa4019372cbd097eecf4d276e13f27ec5e67d35c0bd203c LIBSELINUX := libselinux-$(LIBSELINUX_VERSION) LIBSELINUX_SUFFIX := tar.gz -LIBSELINUX_URL := https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20120924/$(LIBSELINUX).$(LIBSELINUX_SUFFIX) +LIBSELINUX_URL := $(SELINUX_URL)/$(LIBSELINUX).$(LIBSELINUX_SUFFIX) LIBSELINUX_SOURCE := $(SRCDIR)/$(LIBSELINUX).$(LIBSELINUX_SUFFIX) LIBSELINUX_DIR := $(BUILDDIR)/$(LIBSELINUX) LIBSELINUX_LICENSE := public_domain +LIBSELINUX_LICENSE_FILES := file://LICENSE;md5=84b4d2c6ef954a2d4081e775a270d0d0 +LIBSELINUX_CVE_PRODUCT := selinuxproject:libselinux # ---------------------------------------------------------------------------- # Prepare # ---------------------------------------------------------------------------- -LIBSELINUX_CONF_TOOL := NO -# no := due to CROSS_PYTHON -LIBSELINUX_MAKE_ENV = \ - $(CROSS_ENV) \ - CFLAGS="-O2 -Wall -g" \ - PYTHON=$(CROSS_PYTHON) -LIBSELINUX_MAKE_OPT := \ - LIBDIR=$(PTXDIST_SYSROOT_TARGET)/usr/lib -LIBSELINUX_INSTALL_OPT := \ +LIBSELINUX_CONF_TOOL := NO +LIBSELINUX_MAKE_ENV := $(CROSS_ENV) +LIBSELINUX_MAKE_OPT = \ + PREFIX=/usr \ + LIBDIR=/usr/lib \ + SHLIBDIR=/usr/lib \ + INCLUDEDIR=/usr/include \ + SBINDIR=/usr/sbin \ + USE_PCRE2=y \ + USE_LFS=y \ + DISABLE_SHARED=n \ + DISABLE_BOOL=n \ + DISABLE_SETRANS=n \ + DISABLE_RPM=n \ + DISABLE_X11=y \ + ANDROID_HOST=n \ + LABEL_BACKEND_ANDROID=n \ + CFLAGS="-O2 -Wall -g" + +ifdef PTXCONF_LIBSELINUX_PYTHON +LIBSELINUX_MAKE_OPT += \ + PYTHON=$(CROSS_PYTHON3) \ + PYTHONLIBDIR=$(PYTHON3_SITEPACKAGES) +endif + +LIBSELINUX_INSTALL_OPT = \ + $(LIBSELINUX_MAKE_OPT) \ install ifdef PTXCONF_LIBSELINUX_PYTHON -LIBSELINUX_MAKE_OPT += pywrap LIBSELINUX_INSTALL_OPT += install-pywrap endif +# ---------------------------------------------------------------------------- +# Compile +# ---------------------------------------------------------------------------- + +$(STATEDIR)/libselinux.compile: + @$(call targetinfo) + @$(call world/compile, LIBSELINUX) +ifdef PTXCONF_LIBSELINUX_PYTHON + @$(call compile, LIBSELINUX, $(LIBSELINUX_MAKE_OPT) pywrap) +endif + @$(call touch) + # ---------------------------------------------------------------------------- # Target-Install # ---------------------------------------------------------------------------- -LIBSELINUX_PROGS := \ +LIBSELINUX_PROGS-$(PTXCONF_LIBSELINUX_UTILS) := \ avcstat \ compute_av \ compute_create \ compute_member \ compute_relabel \ - compute_user \ getconlist \ getdefaultcon \ - getenforce \ getfilecon \ getpidcon \ - getsebool \ getseuser \ - matchpathcon \ policyvers \ + sefcontext_compile \ selinux_check_securetty_context \ - selinuxenabled \ selinuxexeccon \ - setenforce \ setfilecon \ togglesebool +LIBSELINUX_PROGS-$(PTXCONF_LIBSELINUX_GETENFORCE) += getenforce +LIBSELINUX_PROGS-$(PTXCONF_LIBSELINUX_GETSEBOOL) += getsebool +LIBSELINUX_PROGS-$(PTXCONF_LIBSELINUX_MATCHPATHCON) += matchpathcon +LIBSELINUX_PROGS-$(PTXCONF_LIBSELINUX_SELINUXENABLED) += selinuxenabled +LIBSELINUX_PROGS-$(PTXCONF_LIBSELINUX_SETENFORCE) += setenforce + $(STATEDIR)/libselinux.targetinstall: @$(call targetinfo) @@ -81,11 +113,11 @@ $(STATEDIR)/libselinux.targetinstall: @$(call install_lib, libselinux, 0, 0, 0644, libselinux) - @$(foreach prog, $(LIBSELINUX_PROGS), \ + @$(foreach prog, $(LIBSELINUX_PROGS-y), \ $(call install_copy, libselinux, 0, 0, 0755, -, /usr/sbin/$(prog));) ifdef PTXCONF_LIBSELINUX_PYTHON - @$(call install_tree, libselinux, 0, 0, -, $(PYTHON_SITEPACKAGES)) + @$(call install_tree, libselinux, 0, 0, -, $(PYTHON3_SITEPACKAGES)) endif @$(call install_finish, libselinux) -- 2.47.3
