[PATCH setools] __init__.py: Make NetworkX dep optional

[PATCH setools] __init__.py: Make NetworkX dep optional

[Jason Zaman]

selinux commit ba23ba068364ab11ff51f52bd1e20e3c63798a62
"python: Import specific modules from setools for less deps"
Makes userspace tools only need specific parts of setools so that the
NetworkX dep can be dropped for minimal installations.
Unfortunately the __init__ still imports the parts which require
NetworkX. Wrap them in try except to guard for missing NetworkX.

$ semanage export
Traceback (most recent call last):
  File "/usr/lib/python-exec/python3.9/semanage", line 29, in <module>
    import seobject
  File "/usr/lib/python3.9/site-packages/seobject.py", line 33, in <module>
    import sepolicy
  File "/usr/lib/python3.9/site-packages/sepolicy/__init__.py", line 15, in <module>
    from setools.boolquery import BoolQuery
  File "/usr/lib/python3.9/site-packages/setools/__init__.py", line 94, in <module>
    from .infoflow import InfoFlowAnalysis
  File "/usr/lib/python3.9/site-packages/setools/infoflow.py", line 24, in <module>
    import networkx as nx
ModuleNotFoundError: No module named 'networkx'

Bug: https://bugs.gentoo.org/809038
Signed-off-by: Jason Zaman <jason@perfinion.com>
---
 setools/__init__.py | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/setools/__init__.py b/setools/__init__.py
index d72d343..e583737 100644
--- a/setools/__init__.py
+++ b/setools/__init__.py
@@ -91,11 +91,20 @@ from .pcideviceconquery import PcideviceconQuery
 from .devicetreeconquery import DevicetreeconQuery
 
 # Information Flow Analysis
-from .infoflow import InfoFlowAnalysis
+try:
+    from .infoflow import InfoFlowAnalysis
+except ImportError:
+    # NetworkX is optional
+    pass
+
 from .permmap import PermissionMap, RuleWeight, Mapping
 
 # Domain Transition Analysis
-from .dta import DomainTransitionAnalysis, DomainEntrypoint, DomainTransition
+try:
+    from .dta import DomainTransitionAnalysis, DomainEntrypoint, DomainTransition
+except ImportError:
+    # NetworkX is optional
+    pass
 
 # Policy difference
 from .diff import PolicyDifference
-- 
2.32.0

Re: [PATCH setools] __init__.py: Make NetworkX dep optional

[Chris PeBenito]

On 9/19/21 9:09 AM, Jason Zaman wrote:
> selinux commit ba23ba068364ab11ff51f52bd1e20e3c63798a62
> "python: Import specific modules from setools for less deps"
> Makes userspace tools only need specific parts of setools so that the
> NetworkX dep can be dropped for minimal installations.
> Unfortunately the __init__ still imports the parts which require
> NetworkX. Wrap them in try except to guard for missing NetworkX.
> 
> $ semanage export
> Traceback (most recent call last):
>    File "/usr/lib/python-exec/python3.9/semanage", line 29, in <module>
>      import seobject
>    File "/usr/lib/python3.9/site-packages/seobject.py", line 33, in <module>
>      import sepolicy
>    File "/usr/lib/python3.9/site-packages/sepolicy/__init__.py", line 15, in <module>
>      from setools.boolquery import BoolQuery
>    File "/usr/lib/python3.9/site-packages/setools/__init__.py", line 94, in <module>
>      from .infoflow import InfoFlowAnalysis
>    File "/usr/lib/python3.9/site-packages/setools/infoflow.py", line 24, in <module>
>      import networkx as nx
> ModuleNotFoundError: No module named 'networkx'
> 
> Bug: https://bugs.gentoo.org/809038
> Signed-off-by: Jason Zaman <jason@perfinion.com>
> ---
>   setools/__init__.py | 13 +++++++++++--
>   1 file changed, 11 insertions(+), 2 deletions(-)
> 
> diff --git a/setools/__init__.py b/setools/__init__.py
> index d72d343..e583737 100644
> --- a/setools/__init__.py
> +++ b/setools/__init__.py
> @@ -91,11 +91,20 @@ from .pcideviceconquery import PcideviceconQuery
>   from .devicetreeconquery import DevicetreeconQuery
>   
>   # Information Flow Analysis
> -from .infoflow import InfoFlowAnalysis
> +try:
> +    from .infoflow import InfoFlowAnalysis
> +except ImportError:
> +    # NetworkX is optional
> +    pass
> +
>   from .permmap import PermissionMap, RuleWeight, Mapping
>   
>   # Domain Transition Analysis
> -from .dta import DomainTransitionAnalysis, DomainEntrypoint, DomainTransition
> +try:
> +    from .dta import DomainTransitionAnalysis, DomainEntrypoint, DomainTransition
> +except ImportError:
> +    # NetworkX is optional
> +    pass
>   
>   # Policy difference
>   from .diff import PolicyDifference

I'd prefer that it emit an INFO message saying something like "NetworkX isn't 
available; Information Flow Analysis is unavailable", rather than being silent 
about it.

-- 
Chris PeBenito