RE: Annotate Deprecated Functions in libselinux

From: "Roberts, William C" <william.c.roberts@intel.com>
To: Nicolas Iooss <nicolas.iooss@m4x.org>,
	William Roberts <bill.c.roberts@gmail.com>
Cc: SElinux list <selinux@vger.kernel.org>
Subject: RE: Annotate Deprecated Functions in libselinux
Date: Mon, 20 Apr 2020 14:34:54 +0000	[thread overview]
Message-ID: <476DC76E7D1DF2438D32BFADF679FC5649ED3BA6@ORSMSX101.amr.corp.intel.com> (raw)
In-Reply-To: <CAJfZ7==Ote6uQWMjDfNMA=qj79u2ByrnrH==++gDOhPeYD-W5g@mail.gmail.com>

> -----Original Message-----
> From: selinux-owner@vger.kernel.org [mailto:selinux-owner@vger.kernel.org]
> On Behalf Of Nicolas Iooss
> Sent: Sunday, April 19, 2020 8:47 AM
> To: William Roberts <bill.c.roberts@gmail.com>
> Cc: SElinux list <selinux@vger.kernel.org>
> Subject: Re: Annotate Deprecated Functions in libselinux
> 
> Hello,
> 
> Does "make install && make install-pywrap" works for you? On both my

No because I didn't build the python bindings, I total forgot.

> development system (Arch Linux with swig 4.0.1) and Travis-CI (https://travis-
> ci.org/github/fishilico/selinux/jobs/675842719), swig fails to build libselinux
> Python bindings (with your patches):
> 
> building 'selinux._selinux' extension
> swigging selinuxswig_python.i to selinuxswig_python_wrap.c swig -python -o
> selinuxswig_python_wrap.c selinuxswig_python.i
> ../include/selinux/avc.h:67: Error: Syntax error - possibly a missing semicolon.
> error: command 'swig' failed with exit status 1
> Makefile:133: recipe for target 'pywrap' failed
> 
> The problematic line is:
> 
> extern int sidget(security_id_t sid) __attribute__ ((deprecated));
> 
> It seems that swig does not understand this attribute.

Yeah, I agree with your triage of the issue. I think I'll have to define a
DEPRECATED() macro and turn it off when SWIG is defined.

We also might even want to consider using:
https://pypi.org/project/Deprecated/

> 
> Nicolas
> 
> On Thu, Apr 16, 2020 at 5:44 PM <bill.c.roberts@gmail.com> wrote:
> >
> > V2:
> > - Simplified now that dso.h stuff has been removed.
> > - selinux_check_passwd_access has been deprecated and now
> >   both selinux_check_passwd_access and checkPasswdAccess
> >   are recomending selinux_check_access.
> > - matchpathcon is linked statically to get access to deprecated
> >   routines and prints a deprecated warning to stderr.
> >
> > V1:
> > I went through and annotated deprecated routines we have in libselinux
> > that are mentioned to be deprecated either in code comments and/or
> > manpages.
> >
> > External users, when compiling will see a warning similair to some
> > sample output:
> >
> > a.c: In function ‘main’:
> > a.c:18:2: warning: ‘foo’ is deprecated: foo bar msg [-Wdeprecated-declarations]
> >   foo();
> >   ^~~
> > a.c:5:5: note: declared here
> >  int foo(void) {
> >      ^~~
> > a.c:19:2: warning: ‘boo’ is deprecated [-Wdeprecated-declarations]
> >   boo();
> >   ^~~
> > a.c:11:5: note: declared here
> >  int boo(void) {
> >
> > [PATCH v2 01/18] security_load_booleans: update return comment [PATCH
> > v2 02/18] security_load_booleans: annotate deprecated [PATCH v2 03/18]
> > selinux_booleans_path: annotate deprecated [PATCH v2 04/18]
> > selinux_users_path: annotate deprecated [PATCH v2 05/18] rpm_execcon:
> > annotate deprecated [PATCH v2 06/18] sidget: annotate deprecated
> > [PATCH v2 07/18] sidput: annotate deprecated [PATCH v2 08/18]
> > checkPasswdAccess: annotate deprecated [PATCH v2 09/18]
> > matchpathcon_init: annotate deprecated [PATCH v2 10/18]
> > matchpathcon_fini: annotate deprecated [PATCH v2 11/18] matchpathcon:
> > annotate deprecated [PATCH v2 12/18] avc_init: annotate deprecated
> > [PATCH v2 13/18] avc: create internal avc_init interface [PATCH v2
> > 14/18] matchpathcon: create internal matchpathcon_fini [PATCH v2
> > 15/18] matchpathcon: create internal matchpathcon interface [PATCH v2
> > 16/18] selinux_check_passwd_access: annotate deprecated [PATCH v2
> > 17/18] utils: matchpathcon to use interal interfaces [PATCH v2 18/18]
> > utils: matchpathcon add deprecated warning
> >