From: Ladislav Michl <[email protected]> Upstream moved the python tools to selinux-python and the semodule_* tools to semodule-utils. While there also add PAM support.
Signed-off-by: Ladislav Michl <[email protected]> --- CHANGES: - v2: use full PTXCONF_ variable names in ptx/ifdef and ifdef, so PAM, audit and PAM config files actually work. Select needed libc parts (crypt, dl, util, pthread). Drop BusyBox find selects and document fixfiles requirements in help text instead. rules/policycoreutils.in | 113 +++++++++++--------------- rules/policycoreutils.make | 159 ++++++++++++++++--------------------- 2 files changed, 115 insertions(+), 157 deletions(-) diff --git a/rules/policycoreutils.in b/rules/policycoreutils.in index fce42b002..52208c2e4 100644 --- a/rules/policycoreutils.in +++ b/rules/policycoreutils.in @@ -1,20 +1,18 @@ -## SECTION=staging -## old section: -### SECTION=selinux +## SECTION=selinux menuconfig POLICYCOREUTILS tristate prompt "policycoreutils " - select LIBCAP_NG - select LIBCGROUP select LIBSELINUX - select LIBSEMANAGE select LIBSEPOL - select DBUS_GLIB if POLICYCOREUTILS_RESTORECOND - select BUSYBOX_FEATURE_FIND_DEPTH if BUSYBOX_FIND - select BUSYBOX_FEATURE_FIND_DELETE if BUSYBOX_FIND - select BUSYBOX_SELINUX if BUSYBOX_FIND - select BUSYBOX_FEATURE_FIND_CONTEXT if BUSYBOX_FIND + select LIBSEMANAGE if POLICYCOREUTILS_SEMODULE + select LIBSEMANAGE if POLICYCOREUTILS_SETSEBOOL + select AUDIT if POLICYCOREUTILS_AUDIT + select PAM if GLOBAL_PAM + select LIBC_CRYPT if !GLOBAL_PAM && (POLICYCOREUTILS_NEWROLE || POLICYCOREUTILS_RUN_INIT) + select LIBC_DL if POLICYCOREUTILS_RUN_INIT + select LIBC_UTIL if POLICYCOREUTILS_RUN_INIT + select LIBC_PTHREAD if POLICYCOREUTILS_SETFILES help This package contains the core policy utilities that are required for basic operation of an SELinux system. These utilities include @@ -22,90 +20,71 @@ menuconfig POLICYCOREUTILS to switch roles, and run_init to run /etc/init.d scripts in the proper context. - STAGING: remove in ptxdist-2020.12.0 - Old version that need to be updated. Moved to staging with libselinux. - if POLICYCOREUTILS -menuconfig POLICYCOREUTILS_PYTHON - # needs sepolgen - depends on BROKEN - bool "python based tools" - -if POLICYCOREUTILS_PYTHON - -config POLICYCOREUTILS_AUDIT2ALLOW - bool "audit2allow" - -config POLICYCOREUTILS_SEPOLGEN_IFGEN - select POLICYCOREUTILS_AUDIT2ALLOW - bool "sepolgen-ifgen" - -config POLICYCOREUTILS_AUDIT2WHY - select POLICYCOREUTILS_AUDIT2ALLOW - bool "audit2why" - -config POLICYCOREUTILS_SANDBOX - bool "sandbox" - depends on BROKEN - -config POLICYCOREUTILS_CHCAT - select LIBSEMANAGE_PYTHON - depends on BROKEN - bool "chcat" - -config POLICYCOREUTILS_SEMANAGE - select LIBSEMANAGE_PYTHON - depends on BROKEN - bool "semanage" - -endif +config POLICYCOREUTILS_AUDIT + bool "audit support" + help + Let newrole, run_init and setfiles log to the audit subsystem. config POLICYCOREUTILS_LOAD_POLICY bool "load_policy" + depends on !BUSYBOX_LOAD_POLICY || ALLYES + +comment "busybox' load_policy is selected!" + depends on BUSYBOX_LOAD_POLICY config POLICYCOREUTILS_NEWROLE bool "newrole" -config POLICYCOREUTILS_RESTORECOND - bool "restorecond" - depends on BROKEN +config POLICYCOREUTILS_NEWROLE_PAM_CFG + bool "install /etc/pam.d/newrole" + depends on POLICYCOREUTILS_NEWROLE && GLOBAL_PAM config POLICYCOREUTILS_RUN_INIT bool "run_init/open_init_pty" +config POLICYCOREUTILS_RUN_INIT_PAM_CFG + bool "install /etc/pam.d/run_init" + depends on POLICYCOREUTILS_RUN_INIT && GLOBAL_PAM + config POLICYCOREUTILS_FIXFILES bool "fixfiles" - -config POLICYCOREUTILS_GENHOMEDIRCON - select POLICYCOREUTILS_SEMODULE - bool "genhomedircon" + help + fixfiles script needs a 'find' supporting -context, -delete, + -mindepth, -exec, -type, -print0 and parentheses, plus + 'chcon --reference'. BusyBox can provide these with SELinux + support enabled, but 'fixfiles -N' additionally requires + -mount and -newermt only provided by GNU findutils. config POLICYCOREUTILS_SECON bool "secon" config POLICYCOREUTILS_SEMODULE - bool "semodule" - -config POLICYCOREUTILS_SEMODULE_DEPS - bool "semodule_deps" - -config POLICYCOREUTILS_SEMODULE_EXPAND - bool "semodule_expand" - -config POLICYCOREUTILS_SEMODULE_LINK - bool "semodule_link" - -config POLICYCOREUTILS_SEMODULE_PACKAGE - bool "semodule_package" + bool "semodule/genhomedircon" config POLICYCOREUTILS_SESTATUS bool "sestatus" + depends on !BUSYBOX_SESTATUS || ALLYES + +comment "busybox' sestatus is selected!" + depends on BUSYBOX_SESTATUS config POLICYCOREUTILS_SETFILES bool "setfiles/restorecon" + depends on !BUSYBOX_SETFILES && !BUSYBOX_RESTORECON || ALLYES + +comment "busybox' setfiles/restorecon is selected!" + depends on BUSYBOX_SETFILES || BUSYBOX_RESTORECON config POLICYCOREUTILS_SETSEBOOL bool "setsebool" + depends on !BUSYBOX_SETSEBOOL || ALLYES + +comment "busybox' setsebool is selected!" + depends on BUSYBOX_SETSEBOOL + +config POLICYCOREUTILS_UNSETFILES + bool "unsetfiles" endif diff --git a/rules/policycoreutils.make b/rules/policycoreutils.make index 07baaebe8..a5ca327bf 100644 --- a/rules/policycoreutils.make +++ b/rules/policycoreutils.make @@ -14,116 +14,88 @@ PACKAGES-$(PTXCONF_POLICYCOREUTILS) += policycoreutils # # Paths and names # -POLICYCOREUTILS_VERSION := 2.1.13 -POLICYCOREUTILS_MD5 := 97c0b828599fe608f37894989820d71d +POLICYCOREUTILS_VERSION := $(SELINUX_VERSION) +POLICYCOREUTILS_SHA256 := 054e41ec039731a5ee6b797a8e0b8d6e346ee1d0a9bac2f252db48c23f9a8b1b POLICYCOREUTILS := policycoreutils-$(POLICYCOREUTILS_VERSION) POLICYCOREUTILS_SUFFIX := tar.gz -POLICYCOREUTILS_URL := https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20120924/$(POLICYCOREUTILS).$(POLICYCOREUTILS_SUFFIX) +POLICYCOREUTILS_URL := $(SELINUX_URL)/$(POLICYCOREUTILS).$(POLICYCOREUTILS_SUFFIX) POLICYCOREUTILS_SOURCE := $(SRCDIR)/$(POLICYCOREUTILS).$(POLICYCOREUTILS_SUFFIX) POLICYCOREUTILS_DIR := $(BUILDDIR)/$(POLICYCOREUTILS) -POLICYCOREUTILS_LICENSE := GPL-2.0-or-later +POLICYCOREUTILS_LICENSE := GPL-2.0-only +POLICYCOREUTILS_LICENSE_FILES := file://LICENSE;md5=393a5ca445f6965873eca0259a17f833 +POLICYCOREUTILS_CVE_PRODUCT := selinuxproject:policycoreutils # ---------------------------------------------------------------------------- # Prepare # ---------------------------------------------------------------------------- -POLICYCOREUTILS_SUBDIRS_y := \ - man \ - po \ - scripts - +POLICYCOREUTILS_SUBDIRS_y := POLICYCOREUTILS_PROGS_y := -POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_AUDIT2ALLOW) += audit2allow -POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_AUDIT2ALLOW) += /usr/bin/audit2allow - -POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEPOLGEN_IFGEN) += sepolgen-ifgen -POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEPOLGEN_IFGEN) += /usr/bin/sepolgen-ifgen -POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEPOLGEN_IFGEN) += /usr/bin/sepolgen-ifgen-attr-helper - -POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_AUDIT2WHY) += audit2why -POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_AUDIT2WHY) += /usr/bin/audit2why - -POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_LOAD_POLICY) += load_policy -POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_LOAD_POLICY) += /usr/sbin/load_policy - -POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_NEWROLE) += newrole -POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_NEWROLE) += /usr/bin/newrole - -POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_RESTORECOND) += restorecond -#POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_RESTORECOND) += - -POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_RUN_INIT) += run_init -POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_RUN_INIT) += /usr/sbin/run_init -POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_RUN_INIT) += /usr/sbin/open_init_pty - -POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SANDBOX) += sandbox -#POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SANDBOX) += +POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_LOAD_POLICY) += load_policy +POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_LOAD_POLICY) += /usr/sbin/load_policy -# no SUBDIRS needed for scripts -POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_CHCAT) += /usr/bin/chcat -POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_FIXFILES) += /usr/sbin/fixfiles -POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_GENHOMEDIRCON) += /usr/sbin/genhomedircon +POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_NEWROLE) += newrole +POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_NEWROLE) += /usr/bin/newrole -POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SECON) += secon -POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SECON) += /usr/bin/secon +POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_RUN_INIT) += run_init +POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_RUN_INIT) += /usr/sbin/run_init +POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_RUN_INIT) += /usr/sbin/open_init_pty -POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEMANAGE) += semanage -POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMANAGE) += /usr/sbin/semanage +POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_FIXFILES) += scripts +POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_FIXFILES) += /usr/sbin/fixfiles -POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEMODULE) += semodule -POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE) += /usr/sbin/semodule +POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SECON) += secon +POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SECON) += /usr/bin/secon -POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_DEPS) += semodule_deps -POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_DEPS) += /usr/bin/semodule_deps +POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEMODULE) += semodule hll/pp +POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE) += /usr/sbin/semodule +POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE) += /usr/libexec/selinux/hll/pp -POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_EXPAND) += semodule_expand -POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_EXPAND) += /usr/bin/semodule_expand +POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SESTATUS) += sestatus +POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SESTATUS) += /usr/bin/sestatus -POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_LINK) += semodule_link -POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_LINK) += /usr/bin/semodule_link +POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SETFILES) += setfiles +POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SETFILES) += /usr/sbin/setfiles +POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SETFILES) += /usr/sbin/restorecon_xattr -POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_PACKAGE) += semodule_package -POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_PACKAGE) += /usr/bin/semodule_package -POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_PACKAGE) += /usr/bin/semodule_unpackage +POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SETSEBOOL) += setsebool +POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SETSEBOOL) += /usr/sbin/setsebool -POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SESTATUS) += sestatus -POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SESTATUS) += /usr/sbin/sestatus - -POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SETFILES) += setfiles -POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SETFILES) += /usr/sbin/setfiles - -POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SETSEBOOL) += setsebool -POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SETSEBOOL) += /usr/sbin/setsebool - -POLICYCOREUTILS_CONF_TOOL := NO - -# no ':=' because of $(PYTHON_SITEPACKAGES) -POLICYCOREUTILS_MAKE_ENV = \ - $(CROSS_ENV) \ - SBINDIR=$(POLICYCOREUTILS_PKGDIR)/usr/sbin \ - PYTHONLIBDIR=$(POLICYCOREUTILS_PKGDIR)$(PYTHON_SITEPACKAGES)/.. \ - CFLAGS="-O2 -Wall" \ - INOTIFYH="/usr/include/sys/inotify.h" \ - PAMH="" \ - AUDITH="" -# -# We don't have PAM or AUDIT, so turn off. -# -# Use the following to turn on: -# (Use these paths, as of version 2.1.13) -# -# PAMH=/usr/include/security/pam_appl.h -# AUDITH=/usr/include/libaudit.h -# +POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_UNSETFILES) += unsetfiles +POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_UNSETFILES) += /usr/sbin/unsetfiles -POLICYCOREUTILS_MAKE_OPT := \ - SUBDIRS="$(POLICYCOREUTILS_SUBDIRS_y)" \ - LIBDIR=$(PTXDIST_SYSROOT_TARGET)/usr/lib -POLICYCOREUTILS_INSTALL_OPT := \ +POLICYCOREUTILS_CONF_TOOL := NO +POLICYCOREUTILS_MAKE_ENV := $(CROSS_ENV) +POLICYCOREUTILS_MAKE_OPT := \ SUBDIRS="$(POLICYCOREUTILS_SUBDIRS_y)" \ + PREFIX=/usr \ + BINDIR=/usr/bin \ + SBINDIR=/usr/sbin \ + ETCDIR=/etc \ + LOCALEDIR=/usr/share/locale \ + PAMH=$(call ptx/ifdef, PTXCONF_GLOBAL_PAM, y, n) \ + AUDITH=$(call ptx/ifdef, PTXCONF_POLICYCOREUTILS_AUDIT, y, n) \ + AUDIT_LOG_PRIV=n \ + NAMESPACE_PRIV=n \ + LSPP_PRIV=n \ + CFLAGS="-O2 -Wall -g" +POLICYCOREUTILS_INSTALL_OPT := \ + $(POLICYCOREUTILS_MAKE_OPT) \ install +# ---------------------------------------------------------------------------- +# Install +# ---------------------------------------------------------------------------- + +$(STATEDIR)/policycoreutils.install: + @$(call targetinfo) +ifdef PTXCONF_GLOBAL_PAM + @mkdir -p $(POLICYCOREUTILS_PKGDIR)/etc/pam.d +endif + @$(call world/install, POLICYCOREUTILS) + @$(call touch) + # ---------------------------------------------------------------------------- # Target-Install # ---------------------------------------------------------------------------- @@ -137,15 +109,22 @@ $(STATEDIR)/policycoreutils.targetinstall: @$(call install_fixup, policycoreutils,AUTHOR,"Wolfram Sang <[email protected]>") @$(call install_fixup, policycoreutils,DESCRIPTION,missing) +ifdef PTXCONF_POLICYCOREUTILS_NEWROLE_PAM_CFG + @$(call install_alternative, policycoreutils, 0, 0, 0644, /etc/pam.d/newrole) +endif +ifdef PTXCONF_POLICYCOREUTILS_RUN_INIT_PAM_CFG + @$(call install_alternative, policycoreutils, 0, 0, 0644, /etc/pam.d/run_init) +endif + @$(foreach prog, $(POLICYCOREUTILS_PROGS_y), \ $(call install_copy, policycoreutils, 0, 0, 0755, -, $(prog));) -ifdef PTXCONF_POLICYCOREUTILS_SETFILES - @$(call install_link, policycoreutils, setfiles, /usr/sbin/restorecon) +ifdef PTXCONF_POLICYCOREUTILS_SEMODULE + @$(call install_link, policycoreutils, semodule, /usr/sbin/genhomedircon) endif -ifdef PTXCONF_POLICYCOREUTILS_SEMANAGE - @$(call install_copy, policycoreutils, 0, 0, 0644, -, $(PYTHON_SITEPACKAGES)/seobject.py) +ifdef PTXCONF_POLICYCOREUTILS_SETFILES + @$(call install_link, policycoreutils, setfiles, /usr/sbin/restorecon) endif ifdef PTXCONF_POLICYCOREUTILS_SESTATUS -- 2.47.3
