libsepol, libsemanage: drop duplicate and deprecated symbols

libsepol, libsemanage: drop duplicate and deprecated symbols

[Petr Lautrbach]

This is followup of
https://lore.kernel.org/selinux/20200930145031.910190-1-plautrba@redhat.com/T/#t

Change against 1 version:

- improved commit messages with references to Debian and Fedora guidelines
- drop deprecated functions from libsepol/src/deprecated_functions.c and
- semanage_module_enable/semanage_module_disable from libsemanage

[PATCH v2 1/6] libsepol: Get rid of the old and duplicated symbols

[Petr Lautrbach]

Versioned duplicate symbols cause problems for LTO. These symbols were
introduced during the CIL integration several releases ago and were only
consumed by other SELinux userspace components.

Fixes: https://github.com/SELinuxProject/selinux/issues/245

Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
---
 libsepol/cil/src/cil.c       | 84 ------------------------------------
 libsepol/src/libsepol.map.in |  5 ---
 2 files changed, 89 deletions(-)

diff --git a/libsepol/cil/src/cil.c b/libsepol/cil/src/cil.c
index a3c6a2934c72..95bdb5e5854c 100644
--- a/libsepol/cil/src/cil.c
+++ b/libsepol/cil/src/cil.c
@@ -51,27 +51,6 @@
 #include "cil_policy.h"
 #include "cil_strpool.h"
 
-#if !defined(SHARED) || defined(ANDROID) || defined(__APPLE__)
-    #define DISABLE_SYMVER 1
-#endif
-
-#ifndef DISABLE_SYMVER
-asm(".symver cil_build_policydb_pdb,        cil_build_policydb@LIBSEPOL_1.0");
-asm(".symver cil_build_policydb_create_pdb, cil_build_policydb@@LIBSEPOL_1.1");
-
-asm(".symver cil_compile_pdb,   cil_compile@LIBSEPOL_1.0");
-asm(".symver cil_compile_nopdb, cil_compile@@LIBSEPOL_1.1");
-
-asm(".symver cil_userprefixes_to_string_pdb,   cil_userprefixes_to_string@LIBSEPOL_1.0");
-asm(".symver cil_userprefixes_to_string_nopdb, cil_userprefixes_to_string@@LIBSEPOL_1.1");
-
-asm(".symver cil_selinuxusers_to_string_pdb,   cil_selinuxusers_to_string@LIBSEPOL_1.0");
-asm(".symver cil_selinuxusers_to_string_nopdb, cil_selinuxusers_to_string@@LIBSEPOL_1.1");
-
-asm(".symver cil_filecons_to_string_pdb,   cil_filecons_to_string@LIBSEPOL_1.0");
-asm(".symver cil_filecons_to_string_nopdb, cil_filecons_to_string@@LIBSEPOL_1.1");
-#endif
-
 int cil_sym_sizes[CIL_SYM_ARRAY_NUM][CIL_SYM_NUM] = {
 	{64, 64, 64, 1 << 13, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64},
 	{64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64},
@@ -549,11 +528,7 @@ exit:
 	return rc;
 }
 
-#ifdef DISABLE_SYMVER
 int cil_compile(struct cil_db *db)
-#else
-int cil_compile_nopdb(struct cil_db *db)
-#endif
 {
 	int rc = SEPOL_ERR;
 
@@ -597,33 +572,7 @@ exit:
 	return rc;
 }
 
-#ifndef DISABLE_SYMVER
-int cil_compile_pdb(struct cil_db *db, __attribute__((unused)) sepol_policydb_t *sepol_db)
-{
-	return cil_compile_nopdb(db);
-}
-
-int cil_build_policydb_pdb(cil_db_t *db, sepol_policydb_t *sepol_db)
-{
-	int rc;
-
-	cil_log(CIL_INFO, "Building policy binary\n");
-	rc = cil_binary_create_allocated_pdb(db, sepol_db);
-	if (rc != SEPOL_OK) {
-		cil_log(CIL_ERR, "Failed to generate binary\n");
-		goto exit;
-	}
-
-exit:
-	return rc;
-}
-#endif
-
-#ifdef DISABLE_SYMVER
 int cil_build_policydb(cil_db_t *db, sepol_policydb_t **sepol_db)
-#else
-int cil_build_policydb_create_pdb(cil_db_t *db, sepol_policydb_t **sepol_db)
-#endif
 {
 	int rc;
 
@@ -1371,11 +1320,7 @@ const char * cil_node_to_string(struct cil_tree_node *node)
 	return "<unknown>";
 }
 
-#ifdef DISABLE_SYMVER
 int cil_userprefixes_to_string(struct cil_db *db, char **out, size_t *size)
-#else
-int cil_userprefixes_to_string_nopdb(struct cil_db *db, char **out, size_t *size)
-#endif
 {
 	int rc = SEPOL_ERR;
 	size_t str_len = 0;
@@ -1420,13 +1365,6 @@ exit:
 
 }
 
-#ifndef DISABLE_SYMVER
-int cil_userprefixes_to_string_pdb(struct cil_db *db, __attribute__((unused)) sepol_policydb_t *sepol_db, char **out, size_t *size)
-{
-	return cil_userprefixes_to_string_nopdb(db, out, size);
-}
-#endif
-
 static int cil_cats_to_ebitmap(struct cil_cats *cats, struct ebitmap* cats_ebitmap)
 {
 	int rc = SEPOL_ERR;
@@ -1614,11 +1552,7 @@ static int __cil_level_to_string(struct cil_level *lvl, char *out)
 	return str_tmp - out;
 }
 
-#ifdef DISABLE_SYMVER
 int cil_selinuxusers_to_string(struct cil_db *db, char **out, size_t *size)
-#else
-int cil_selinuxusers_to_string_nopdb(struct cil_db *db, char **out, size_t *size)
-#endif
 {
 	size_t str_len = 0;
 	int buf_pos = 0;
@@ -1675,18 +1609,7 @@ int cil_selinuxusers_to_string_nopdb(struct cil_db *db, char **out, size_t *size
 	return SEPOL_OK;
 }
 
-#ifndef DISABLE_SYMVER
-int cil_selinuxusers_to_string_pdb(struct cil_db *db, __attribute__((unused)) sepol_policydb_t *sepol_db, char **out, size_t *size)
-{
-	return cil_selinuxusers_to_string_nopdb(db, out, size);
-}
-#endif
-
-#ifdef DISABLE_SYMVER
 int cil_filecons_to_string(struct cil_db *db, char **out, size_t *size)
-#else
-int cil_filecons_to_string_nopdb(struct cil_db *db, char **out, size_t *size)
-#endif
 {
 	uint32_t i = 0;
 	int buf_pos = 0;
@@ -1804,13 +1727,6 @@ int cil_filecons_to_string_nopdb(struct cil_db *db, char **out, size_t *size)
 	return SEPOL_OK;
 }
 
-#ifndef DISABLE_SYMVER
-int cil_filecons_to_string_pdb(struct cil_db *db, __attribute__((unused)) sepol_policydb_t *sepol_db, char **out, size_t *size)
-{
-	return cil_filecons_to_string_nopdb(db, out, size);
-}
-#endif
-
 void cil_set_disable_dontaudit(struct cil_db *db, int disable_dontaudit)
 {
 	db->disable_dontaudit = disable_dontaudit;
diff --git a/libsepol/src/libsepol.map.in b/libsepol/src/libsepol.map.in
index f08c2a861693..98da9789b71b 100644
--- a/libsepol/src/libsepol.map.in
+++ b/libsepol/src/libsepol.map.in
@@ -1,19 +1,14 @@
 LIBSEPOL_1.0 {
   global:
 	cil_add_file;
-	cil_build_policydb;
-	cil_compile;
 	cil_db_destroy;
 	cil_db_init;
-	cil_filecons_to_string;
-	cil_selinuxusers_to_string;
 	cil_set_disable_dontaudit;
 	cil_set_disable_neverallow;
 	cil_set_handle_unknown;
 	cil_set_log_handler;
 	cil_set_log_level;
 	cil_set_preserve_tunables;
-	cil_userprefixes_to_string;
 	expand_module_avrules;
 	sepol_bool_clone;
 	sepol_bool_compare;
-- 
2.28.0

[PATCH v2 2/6] libsepol: Drop deprecated functions

[Petr Lautrbach]

These functions were converted to no-op by commit
c3f9492d7ff0 ("selinux: Remove legacy local boolean and user code") and
left in libsepol/src/deprecated_functions.c to preserve API/ABI. As we
change libsepol ABI dropping duplicate symbols it's time to drop these
functions too.

Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
---
 libsepol/include/sepol/booleans.h |  5 ----
 libsepol/include/sepol/users.h    |  6 ----
 libsepol/src/deprecated_funcs.c   | 50 -------------------------------
 libsepol/src/libsepol.map.in      |  4 ---
 4 files changed, 65 deletions(-)
 delete mode 100644 libsepol/src/deprecated_funcs.c

diff --git a/libsepol/include/sepol/booleans.h b/libsepol/include/sepol/booleans.h
index 06d2230c395d..25229057dbd7 100644
--- a/libsepol/include/sepol/booleans.h
+++ b/libsepol/include/sepol/booleans.h
@@ -10,11 +10,6 @@
 extern "C" {
 #endif
 
-/* These two functions are deprecated. See src/deprecated_funcs.c */
-extern int sepol_genbools(void *data, size_t len, const char *boolpath);
-extern int sepol_genbools_array(void *data, size_t len,
-				char **names, int *values, int nel);
-
 /* Set the specified boolean */
 extern int sepol_bool_set(sepol_handle_t * handle,
 			  sepol_policydb_t * policydb,
diff --git a/libsepol/include/sepol/users.h b/libsepol/include/sepol/users.h
index 70158ac41e40..156d1adb2d60 100644
--- a/libsepol/include/sepol/users.h
+++ b/libsepol/include/sepol/users.h
@@ -10,12 +10,6 @@
 extern "C" {
 #endif
 
-/* These two functions are deprecated. See src/deprecated_funcs.c */
-extern int sepol_genusers(void *data, size_t len,
-			  const char *usersdir,
-			  void **newdata, size_t * newlen);
-extern void sepol_set_delusers(int on);
-
 /* Modify the user, or add it, if the key is not found */
 extern int sepol_user_modify(sepol_handle_t * handle,
 			     sepol_policydb_t * policydb,
diff --git a/libsepol/src/deprecated_funcs.c b/libsepol/src/deprecated_funcs.c
deleted file mode 100644
index d0dab7dfcb4a..000000000000
--- a/libsepol/src/deprecated_funcs.c
+++ /dev/null
@@ -1,50 +0,0 @@
-#include <stdio.h>
-#include "debug.h"
-
-/*
- * Need to keep these stubs for the libsepol interfaces exported in
- * libsepol.map.in, as they are part of the shared library ABI.
- */
-
-static const char *msg = "Deprecated interface";
-
-/*
- * These two functions are deprecated and referenced in:
- *	include/libsepol/users.h
- */
-int sepol_genusers(void *data __attribute((unused)),
-		   size_t len __attribute((unused)),
-		   const char *usersdir __attribute((unused)),
-		   void **newdata __attribute((unused)),
-		   size_t *newlen __attribute((unused)))
-{
-	WARN(NULL, "%s", msg);
-	return -1;
-}
-
-void sepol_set_delusers(int on __attribute((unused)))
-{
-	WARN(NULL, "%s", msg);
-}
-
-/*
- * These two functions are deprecated and referenced in:
- *	include/libsepol/booleans.h
- */
-int sepol_genbools(void *data __attribute((unused)),
-		   size_t len __attribute((unused)),
-		   const char *booleans __attribute((unused)))
-{
-	WARN(NULL, "%s", msg);
-	return -1;
-}
-
-int sepol_genbools_array(void *data __attribute((unused)),
-			 size_t len __attribute((unused)),
-			 char **names __attribute((unused)),
-			 int *values __attribute((unused)),
-			 int nel __attribute((unused)))
-{
-	WARN(NULL, "%s", msg);
-	return -1;
-}
diff --git a/libsepol/src/libsepol.map.in b/libsepol/src/libsepol.map.in
index 98da9789b71b..eb5721257638 100644
--- a/libsepol/src/libsepol.map.in
+++ b/libsepol/src/libsepol.map.in
@@ -45,9 +45,6 @@ LIBSEPOL_1.0 {
 	sepol_context_to_string;
 	sepol_debug;
 	sepol_expand_module;
-	sepol_genbools;
-	sepol_genbools_array;
-	sepol_genusers;
 	sepol_get_disable_dontaudit;
 	sepol_get_preserve_tunables;
 	sepol_handle_create;
@@ -213,7 +210,6 @@ LIBSEPOL_1.0 {
 	sepol_port_set_port;
 	sepol_port_set_proto;
 	sepol_port_set_range;
-	sepol_set_delusers;
 	sepol_set_disable_dontaudit;
 	sepol_set_expand_consume_base;
 	sepol_set_policydb_from_file;
-- 
2.28.0

[PATCH v2 3/6] libsepol: Bump libsepol.so version

[Petr Lautrbach]

Previous commits removed some symbols and broke ABI, therefore we need to change
SONAME.

See the following quotes from distribution guidelines:

https://www.debian.org/doc/debian-policy/ch-sharedlibs.html#run-time-shared-libraries

Every time the shared library ABI changes in a way that may break
binaries linked against older versions of the shared library, the SONAME
of the library and the corresponding name for the binary package
containing the runtime shared library should change.

https://docs.fedoraproject.org/en-US/packaging-guidelines/#_downstream_so_name_versioning

When new versions of the library are released, you should use an ABI
comparison tool to check for ABI differences in the built shared
libraries. If it detects any incompatibilities, bump the n number by
one.

Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
---
 libselinux/src/load_policy.c | 2 +-
 libsepol/src/Makefile        | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/libselinux/src/load_policy.c b/libselinux/src/load_policy.c
index 2aea826f863e..0034fa53d6e6 100644
--- a/libselinux/src/load_policy.c
+++ b/libselinux/src/load_policy.c
@@ -76,7 +76,7 @@ int selinux_mkload_policy(int preservebools __attribute__((unused)))
 #ifdef SHARED
 	char *errormsg = NULL;
 	void *libsepolh = NULL;
-	libsepolh = dlopen("libsepol.so.1", RTLD_NOW);
+	libsepolh = dlopen("libsepol.so.2", RTLD_NOW);
 	if (libsepolh) {
 		usesepol = 1;
 		dlerror();
diff --git a/libsepol/src/Makefile b/libsepol/src/Makefile
index 8d466f56ed0e..dc8b1773d974 100644
--- a/libsepol/src/Makefile
+++ b/libsepol/src/Makefile
@@ -7,7 +7,7 @@ RANLIB ?= ranlib
 CILDIR ?= ../cil
 
 VERSION = $(shell cat ../VERSION)
-LIBVERSION = 1
+LIBVERSION = 2
 
 LEX = flex
 CIL_GENERATED = $(CILDIR)/src/cil_lexer.c
-- 
2.28.0

[PATCH v2 4/6] libsemanage: Remove legacy and duplicate symbols

[Petr Lautrbach]

Versioned duplicate symbols cause problems for LTO. These symbols were
introduced during the CIL integration several releases ago and were only
consumed by other SELinux userspace components.

Related: https://github.com/SELinuxProject/selinux/issues/245

Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
---
 libsemanage/include/semanage/modules.h |   2 +-
 libsemanage/src/libsemanage.map        |   5 --
 libsemanage/src/modules.c              | 100 +------------------------
 libsemanage/src/modules.h              |   9 +--
 libsemanage/src/semanageswig_python.i  |   2 -
 5 files changed, 4 insertions(+), 114 deletions(-)

diff --git a/libsemanage/include/semanage/modules.h b/libsemanage/include/semanage/modules.h
index ac4039314857..b51f61f033d5 100644
--- a/libsemanage/include/semanage/modules.h
+++ b/libsemanage/include/semanage/modules.h
@@ -33,7 +33,7 @@ typedef struct semanage_module_key semanage_module_key_t;
  */
 
 extern int semanage_module_install(semanage_handle_t *,
-				   char *module_data, size_t data_len, char *name, char *ext_lang);
+				   char *module_data, size_t data_len, const char *name, const char *ext_lang);
 extern int semanage_module_install_file(semanage_handle_t *,
 					const char *module_name);
 extern int semanage_module_remove(semanage_handle_t *, char *module_name);
diff --git a/libsemanage/src/libsemanage.map b/libsemanage/src/libsemanage.map
index 1375a8ca0ea7..4bec06aaae27 100644
--- a/libsemanage/src/libsemanage.map
+++ b/libsemanage/src/libsemanage.map
@@ -167,18 +167,13 @@ LIBSEMANAGE_1.0 {
     semanage_mls_enabled;
     semanage_module_disable;
     semanage_module_enable;
-    semanage_module_get_enabled;
     semanage_module_get_name;
     semanage_module_get_version;
     semanage_module_info_datum_destroy;
-    semanage_module_install;
-    semanage_module_install_base;
-    semanage_module_install_base_file;
     semanage_module_install_file;
     semanage_module_list;
     semanage_module_list_nth;
     semanage_module_remove;
-    semanage_module_upgrade;
     semanage_module_upgrade_file;
     semanage_msg_get_channel;
     semanage_msg_get_fname;
diff --git a/libsemanage/src/modules.c b/libsemanage/src/modules.c
index 6d3eb60ae462..8b36801038df 100644
--- a/libsemanage/src/modules.c
+++ b/libsemanage/src/modules.c
@@ -42,70 +42,7 @@
 #include "modules.h"
 #include "debug.h"
 
-asm(".symver semanage_module_get_enabled_1_1,semanage_module_get_enabled@@LIBSEMANAGE_1.1");
-asm(".symver semanage_module_get_enabled_1_0,semanage_module_get_enabled@LIBSEMANAGE_1.0");
-asm(".symver semanage_module_install_pp,semanage_module_install@LIBSEMANAGE_1.0");
-asm(".symver semanage_module_install_hll,semanage_module_install@@LIBSEMANAGE_1.1");
-
-/* Takes a module stored in 'module_data' and parses its headers.
- * Sets reference variables 'module_name' to module's name and
- * 'version' to module's version. The caller is responsible for
- * free()ing 'module_name' and 'version'; they will be
- * set to NULL upon entering this function.  Returns 0 on success, -1
- * if out of memory, or -2 if data did not represent a module.
- */
-static int parse_module_headers(semanage_handle_t * sh, char *module_data,
-				size_t data_len, char **module_name, char **version)
-{
-	struct sepol_policy_file *pf;
-	int file_type;
-	*version = NULL;
-
-	if (sepol_policy_file_create(&pf)) {
-		ERR(sh, "Out of memory!");
-		return -1;
-	}
-	sepol_policy_file_set_mem(pf, module_data, data_len);
-	sepol_policy_file_set_handle(pf, sh->sepolh);
-	if (module_data == NULL ||
-	    data_len == 0 ||
-	    sepol_module_package_info(pf, &file_type, module_name, version) == -1) {
-		sepol_policy_file_free(pf);
-		ERR(sh, "Could not parse module data.");
-		return -2;
-	}
-	sepol_policy_file_free(pf);
-	if (file_type != SEPOL_POLICY_MOD) {
-		ERR(sh, "Data did not represent a pp module. Please upgrade to the latest version of libsemanage to support hll modules.");
-		return -2;
-	}
-
-	return 0;
-}
-
-/* This function is used to preserve ABI compatibility with
- * versions of semodule using LIBSEMANAGE_1.0
- */
-int semanage_module_install_pp(semanage_handle_t * sh,
-			    char *module_data, size_t data_len)
-{
-	char *name = NULL;
-	char *version = NULL;
-	int status;
-
-	if ((status = parse_module_headers(sh, module_data, data_len, &name, &version)) != 0) {
-		goto cleanup;
-	}
-
-	status = semanage_module_install_hll(sh, module_data, data_len, name, "pp");
-
-cleanup:
-	free(name);
-	free(version);
-	return status;
-}
-
-int semanage_module_install_hll(semanage_handle_t * sh,
+int semanage_module_install(semanage_handle_t * sh,
 			    char *module_data, size_t data_len, const char *name, const char *ext_lang)
 {
 	if (sh->funcs->install == NULL) {
@@ -160,16 +97,6 @@ int semanage_module_extract(semanage_handle_t * sh,
 	return sh->funcs->extract(sh, modkey, extract_cil, mapped_data, data_len, modinfo);
 }
 
-/* Legacy function that remains to preserve ABI
- * compatibility. Please use semanage_module_install instead.
- */
-int semanage_module_upgrade(semanage_handle_t * sh,
-			    char *module_data, size_t data_len)
-{
-	return semanage_module_install_pp(sh, module_data, data_len);
-	
-}
-
 /* Legacy function that remains to preserve ABI
  * compatibility. Please use semanage_module_install_file instead.
  */
@@ -179,24 +106,6 @@ int semanage_module_upgrade_file(semanage_handle_t * sh,
 	return semanage_module_install_file(sh, module_name);
 }
 
-/* Legacy function that remains to preserve ABI
- * compatibility. Please use semanage_module_install instead.
- */
-int semanage_module_install_base(semanage_handle_t * sh,
-				 char *module_data, size_t data_len)
-{
-	return semanage_module_install_pp(sh, module_data, data_len);
-}
-
-/* Legacy function that remains to preserve ABI
- * compatibility. Please use semanage_module_install_file instead.
- */
-int semanage_module_install_base_file(semanage_handle_t * sh,
-				 const char *module_name)
-{
-	return semanage_module_install_file(sh, module_name);
-}
-
 int semanage_module_remove(semanage_handle_t * sh, char *module_name)
 {
 	if (sh->funcs->remove == NULL) {
@@ -780,7 +689,7 @@ int semanage_module_key_set_priority(semanage_handle_t *sh,
 }
 
 
-int semanage_module_get_enabled_1_1(semanage_handle_t *sh,
+int semanage_module_get_enabled(semanage_handle_t *sh,
 				const semanage_module_key_t *modkey,
 				int *enabled)
 {
@@ -800,11 +709,6 @@ int semanage_module_get_enabled_1_1(semanage_handle_t *sh,
 	return sh->funcs->get_enabled(sh, modkey, enabled);
 }
 
-int semanage_module_get_enabled_1_0(semanage_module_info_t *modinfo)
-{
-	return modinfo->enabled;
-}
-
 int semanage_module_set_enabled(semanage_handle_t *sh,
 				const semanage_module_key_t *modkey,
 				int enabled)
diff --git a/libsemanage/src/modules.h b/libsemanage/src/modules.h
index 2d3576fb15df..64d4a157f5ca 100644
--- a/libsemanage/src/modules.h
+++ b/libsemanage/src/modules.h
@@ -26,16 +26,9 @@
 
 #include "semanage/modules.h"
 
-int semanage_module_install_pp(semanage_handle_t * sh,
-			    char *module_data, size_t data_len);
-int semanage_module_install_hll(semanage_handle_t * sh,
-			    char *module_data, size_t data_len, const char *name, const char *ext_lang);
-int semanage_module_upgrade(semanage_handle_t * sh,
-			    char *module_data, size_t data_len);
+
 int semanage_module_upgrade_file(semanage_handle_t * sh,
 				 const char *module_name);
-int semanage_module_install_base(semanage_handle_t * sh,
-				 char *module_data, size_t data_len);
 int semanage_module_install_base_file(semanage_handle_t * sh,
 				 const char *module_name);
 
diff --git a/libsemanage/src/semanageswig_python.i b/libsemanage/src/semanageswig_python.i
index 8dd79fc24213..5f0113966962 100644
--- a/libsemanage/src/semanageswig_python.i
+++ b/libsemanage/src/semanageswig_python.i
@@ -30,8 +30,6 @@
 %}
 
 %include "stdint.i"
-%ignore semanage_module_install_pp;
-%ignore semanage_module_install_hll;
 
 %wrapper %{
 
-- 
2.28.0

[PATCH v2 5/6] libsemanage: Drop deprecated functions

[Petr Lautrbach]

semanage_module_enable() and semanage_module_disable() were deprecated
by commit 9fbc6d14418f ("libsemanage: add back original module
enable/disable functions for ABI compatability") in 2014 in order to
preserve ABI compatibility. As we the libsemanage ABI is changed by the
previous commit, it makes sense to drop them completely.

Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
---
 libsemanage/src/libsemanage.map |  2 --
 libsemanage/src/modules.c       | 56 ---------------------------------
 2 files changed, 58 deletions(-)

diff --git a/libsemanage/src/libsemanage.map b/libsemanage/src/libsemanage.map
index 4bec06aaae27..3ea7b60f97bb 100644
--- a/libsemanage/src/libsemanage.map
+++ b/libsemanage/src/libsemanage.map
@@ -165,8 +165,6 @@ LIBSEMANAGE_1.0 {
     semanage_is_connected;
     semanage_is_managed;
     semanage_mls_enabled;
-    semanage_module_disable;
-    semanage_module_enable;
     semanage_module_get_name;
     semanage_module_get_version;
     semanage_module_info_datum_destroy;
diff --git a/libsemanage/src/modules.c b/libsemanage/src/modules.c
index 8b36801038df..b6dd456cac32 100644
--- a/libsemanage/src/modules.c
+++ b/libsemanage/src/modules.c
@@ -734,62 +734,6 @@ int semanage_module_set_enabled(semanage_handle_t *sh,
 }
 
 
-/* This function exists only for ABI compatibility. It has been deprecated and
- * should not be used. Instead, use semanage_module_set_enabled() */
-int semanage_module_enable(semanage_handle_t *sh, char *module_name)
-{
-	int rc = -1;
-	semanage_module_key_t *modkey = NULL;
-
-	rc = semanage_module_key_create(sh, &modkey);
-	if (rc != 0)
-		goto exit;
-
-	rc = semanage_module_key_set_name(sh, modkey, module_name);
-	if (rc != 0)
-		goto exit;
-
-	rc = semanage_module_set_enabled(sh, modkey, 1);
-	if (rc != 0)
-		goto exit;
-
-	rc = 0;
-
-exit:
-	semanage_module_key_destroy(sh, modkey);
-	free(modkey);
-
-	return rc;
-}
-
-/* This function exists only for ABI compatibility. It has been deprecated and
- * should not be used. Instead, use semanage_module_set_enabled() */
-int semanage_module_disable(semanage_handle_t *sh, char *module_name)
-{
-	int rc = -1;
-	semanage_module_key_t *modkey = NULL;
-
-	rc = semanage_module_key_create(sh, &modkey);
-	if (rc != 0)
-		goto exit;
-
-	rc = semanage_module_key_set_name(sh, modkey, module_name);
-	if (rc != 0)
-		goto exit;
-
-	rc = semanage_module_set_enabled(sh, modkey, 0);
-	if (rc != 0)
-		goto exit;
-
-	rc = 0;
-
-exit:
-	semanage_module_key_destroy(sh, modkey);
-	free(modkey);
-
-	return rc;
-}
-
 /* Converts a string to a priority
  *
  * returns -1 if str is not a valid priority.
-- 
2.28.0

[PATCH v2 6/6] libsemanage: Bump libsemanage.so version

[Petr Lautrbach]

Previous commits removed some symbols and broke ABI, therefore we need to change
SONAME.

See the following quotes from distribution guidelines:

https://www.debian.org/doc/debian-policy/ch-sharedlibs.html#run-time-shared-libraries

Every time the shared library ABI changes in a way that may break
binaries linked against older versions of the shared library, the SONAME
of the library and the corresponding name for the binary package
containing the runtime shared library should change.

https://docs.fedoraproject.org/en-US/packaging-guidelines/#_downstream_so_name_versioning

When new versions of the library are released, you should use an ABI
comparison tool to check for ABI differences in the built shared
libraries. If it detects any incompatibilities, bump the n number by
one.

Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
---
 libsemanage/src/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libsemanage/src/Makefile b/libsemanage/src/Makefile
index a0eb3747d74b..ab6cae51f5c3 100644
--- a/libsemanage/src/Makefile
+++ b/libsemanage/src/Makefile
@@ -32,7 +32,7 @@ YACC = bison
 YFLAGS = -d
 
 VERSION = $(shell cat ../VERSION)
-LIBVERSION = 1
+LIBVERSION = 2
 
 LIBA=libsemanage.a
 TARGET=libsemanage.so
-- 
2.28.0

Re: [PATCH v2 1/6] libsepol: Get rid of the old and duplicated symbols

[James Carter]

On Fri, Oct 9, 2020 at 9:47 AM Petr Lautrbach <plautrba@redhat.com> wrote:
>
> Versioned duplicate symbols cause problems for LTO. These symbols were
> introduced during the CIL integration several releases ago and were only
> consumed by other SELinux userspace components.
>
> Fixes: https://github.com/SELinuxProject/selinux/issues/245
>
> Signed-off-by: Petr Lautrbach <plautrba@redhat.com>

Acked-by: James Carter <jwcart2@gmail.com>

> ---
>  libsepol/cil/src/cil.c       | 84 ------------------------------------
>  libsepol/src/libsepol.map.in |  5 ---
>  2 files changed, 89 deletions(-)
>
> diff --git a/libsepol/cil/src/cil.c b/libsepol/cil/src/cil.c
> index a3c6a2934c72..95bdb5e5854c 100644
> --- a/libsepol/cil/src/cil.c
> +++ b/libsepol/cil/src/cil.c
> @@ -51,27 +51,6 @@
>  #include "cil_policy.h"
>  #include "cil_strpool.h"
>
> -#if !defined(SHARED) || defined(ANDROID) || defined(__APPLE__)
> -    #define DISABLE_SYMVER 1
> -#endif
> -
> -#ifndef DISABLE_SYMVER
> -asm(".symver cil_build_policydb_pdb,        cil_build_policydb@LIBSEPOL_1.0");
> -asm(".symver cil_build_policydb_create_pdb, cil_build_policydb@@LIBSEPOL_1.1");
> -
> -asm(".symver cil_compile_pdb,   cil_compile@LIBSEPOL_1.0");
> -asm(".symver cil_compile_nopdb, cil_compile@@LIBSEPOL_1.1");
> -
> -asm(".symver cil_userprefixes_to_string_pdb,   cil_userprefixes_to_string@LIBSEPOL_1.0");
> -asm(".symver cil_userprefixes_to_string_nopdb, cil_userprefixes_to_string@@LIBSEPOL_1.1");
> -
> -asm(".symver cil_selinuxusers_to_string_pdb,   cil_selinuxusers_to_string@LIBSEPOL_1.0");
> -asm(".symver cil_selinuxusers_to_string_nopdb, cil_selinuxusers_to_string@@LIBSEPOL_1.1");
> -
> -asm(".symver cil_filecons_to_string_pdb,   cil_filecons_to_string@LIBSEPOL_1.0");
> -asm(".symver cil_filecons_to_string_nopdb, cil_filecons_to_string@@LIBSEPOL_1.1");
> -#endif
> -
>  int cil_sym_sizes[CIL_SYM_ARRAY_NUM][CIL_SYM_NUM] = {
>         {64, 64, 64, 1 << 13, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64},
>         {64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64},
> @@ -549,11 +528,7 @@ exit:
>         return rc;
>  }
>
> -#ifdef DISABLE_SYMVER
>  int cil_compile(struct cil_db *db)
> -#else
> -int cil_compile_nopdb(struct cil_db *db)
> -#endif
>  {
>         int rc = SEPOL_ERR;
>
> @@ -597,33 +572,7 @@ exit:
>         return rc;
>  }
>
> -#ifndef DISABLE_SYMVER
> -int cil_compile_pdb(struct cil_db *db, __attribute__((unused)) sepol_policydb_t *sepol_db)
> -{
> -       return cil_compile_nopdb(db);
> -}
> -
> -int cil_build_policydb_pdb(cil_db_t *db, sepol_policydb_t *sepol_db)
> -{
> -       int rc;
> -
> -       cil_log(CIL_INFO, "Building policy binary\n");
> -       rc = cil_binary_create_allocated_pdb(db, sepol_db);
> -       if (rc != SEPOL_OK) {
> -               cil_log(CIL_ERR, "Failed to generate binary\n");
> -               goto exit;
> -       }
> -
> -exit:
> -       return rc;
> -}
> -#endif
> -
> -#ifdef DISABLE_SYMVER
>  int cil_build_policydb(cil_db_t *db, sepol_policydb_t **sepol_db)
> -#else
> -int cil_build_policydb_create_pdb(cil_db_t *db, sepol_policydb_t **sepol_db)
> -#endif
>  {
>         int rc;
>
> @@ -1371,11 +1320,7 @@ const char * cil_node_to_string(struct cil_tree_node *node)
>         return "<unknown>";
>  }
>
> -#ifdef DISABLE_SYMVER
>  int cil_userprefixes_to_string(struct cil_db *db, char **out, size_t *size)
> -#else
> -int cil_userprefixes_to_string_nopdb(struct cil_db *db, char **out, size_t *size)
> -#endif
>  {
>         int rc = SEPOL_ERR;
>         size_t str_len = 0;
> @@ -1420,13 +1365,6 @@ exit:
>
>  }
>
> -#ifndef DISABLE_SYMVER
> -int cil_userprefixes_to_string_pdb(struct cil_db *db, __attribute__((unused)) sepol_policydb_t *sepol_db, char **out, size_t *size)
> -{
> -       return cil_userprefixes_to_string_nopdb(db, out, size);
> -}
> -#endif
> -
>  static int cil_cats_to_ebitmap(struct cil_cats *cats, struct ebitmap* cats_ebitmap)
>  {
>         int rc = SEPOL_ERR;
> @@ -1614,11 +1552,7 @@ static int __cil_level_to_string(struct cil_level *lvl, char *out)
>         return str_tmp - out;
>  }
>
> -#ifdef DISABLE_SYMVER
>  int cil_selinuxusers_to_string(struct cil_db *db, char **out, size_t *size)
> -#else
> -int cil_selinuxusers_to_string_nopdb(struct cil_db *db, char **out, size_t *size)
> -#endif
>  {
>         size_t str_len = 0;
>         int buf_pos = 0;
> @@ -1675,18 +1609,7 @@ int cil_selinuxusers_to_string_nopdb(struct cil_db *db, char **out, size_t *size
>         return SEPOL_OK;
>  }
>
> -#ifndef DISABLE_SYMVER
> -int cil_selinuxusers_to_string_pdb(struct cil_db *db, __attribute__((unused)) sepol_policydb_t *sepol_db, char **out, size_t *size)
> -{
> -       return cil_selinuxusers_to_string_nopdb(db, out, size);
> -}
> -#endif
> -
> -#ifdef DISABLE_SYMVER
>  int cil_filecons_to_string(struct cil_db *db, char **out, size_t *size)
> -#else
> -int cil_filecons_to_string_nopdb(struct cil_db *db, char **out, size_t *size)
> -#endif
>  {
>         uint32_t i = 0;
>         int buf_pos = 0;
> @@ -1804,13 +1727,6 @@ int cil_filecons_to_string_nopdb(struct cil_db *db, char **out, size_t *size)
>         return SEPOL_OK;
>  }
>
> -#ifndef DISABLE_SYMVER
> -int cil_filecons_to_string_pdb(struct cil_db *db, __attribute__((unused)) sepol_policydb_t *sepol_db, char **out, size_t *size)
> -{
> -       return cil_filecons_to_string_nopdb(db, out, size);
> -}
> -#endif
> -
>  void cil_set_disable_dontaudit(struct cil_db *db, int disable_dontaudit)
>  {
>         db->disable_dontaudit = disable_dontaudit;
> diff --git a/libsepol/src/libsepol.map.in b/libsepol/src/libsepol.map.in
> index f08c2a861693..98da9789b71b 100644
> --- a/libsepol/src/libsepol.map.in
> +++ b/libsepol/src/libsepol.map.in
> @@ -1,19 +1,14 @@
>  LIBSEPOL_1.0 {
>    global:
>         cil_add_file;
> -       cil_build_policydb;
> -       cil_compile;
>         cil_db_destroy;
>         cil_db_init;
> -       cil_filecons_to_string;
> -       cil_selinuxusers_to_string;
>         cil_set_disable_dontaudit;
>         cil_set_disable_neverallow;
>         cil_set_handle_unknown;
>         cil_set_log_handler;
>         cil_set_log_level;
>         cil_set_preserve_tunables;
> -       cil_userprefixes_to_string;
>         expand_module_avrules;
>         sepol_bool_clone;
>         sepol_bool_compare;
> --
> 2.28.0
>

Re: [PATCH v2 3/6] libsepol: Bump libsepol.so version

[James Carter]

On Fri, Oct 9, 2020 at 9:47 AM Petr Lautrbach <plautrba@redhat.com> wrote:
>
> Previous commits removed some symbols and broke ABI, therefore we need to change
> SONAME.
>
> See the following quotes from distribution guidelines:
>
> https://www.debian.org/doc/debian-policy/ch-sharedlibs.html#run-time-shared-libraries
>
> Every time the shared library ABI changes in a way that may break
> binaries linked against older versions of the shared library, the SONAME
> of the library and the corresponding name for the binary package
> containing the runtime shared library should change.
>
> https://docs.fedoraproject.org/en-US/packaging-guidelines/#_downstream_so_name_versioning
>
> When new versions of the library are released, you should use an ABI
> comparison tool to check for ABI differences in the built shared
> libraries. If it detects any incompatibilities, bump the n number by
> one.
>
> Signed-off-by: Petr Lautrbach <plautrba@redhat.com>

Acked-by: James Carter <jwcart2@gmail.com>

> ---
>  libselinux/src/load_policy.c | 2 +-
>  libsepol/src/Makefile        | 2 +-
>  2 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/libselinux/src/load_policy.c b/libselinux/src/load_policy.c
> index 2aea826f863e..0034fa53d6e6 100644
> --- a/libselinux/src/load_policy.c
> +++ b/libselinux/src/load_policy.c
> @@ -76,7 +76,7 @@ int selinux_mkload_policy(int preservebools __attribute__((unused)))
>  #ifdef SHARED
>         char *errormsg = NULL;
>         void *libsepolh = NULL;
> -       libsepolh = dlopen("libsepol.so.1", RTLD_NOW);
> +       libsepolh = dlopen("libsepol.so.2", RTLD_NOW);
>         if (libsepolh) {
>                 usesepol = 1;
>                 dlerror();
> diff --git a/libsepol/src/Makefile b/libsepol/src/Makefile
> index 8d466f56ed0e..dc8b1773d974 100644
> --- a/libsepol/src/Makefile
> +++ b/libsepol/src/Makefile
> @@ -7,7 +7,7 @@ RANLIB ?= ranlib
>  CILDIR ?= ../cil
>
>  VERSION = $(shell cat ../VERSION)
> -LIBVERSION = 1
> +LIBVERSION = 2
>
>  LEX = flex
>  CIL_GENERATED = $(CILDIR)/src/cil_lexer.c
> --
> 2.28.0
>

Re: [PATCH v2 2/6] libsepol: Drop deprecated functions

[James Carter]

On Fri, Oct 9, 2020 at 9:47 AM Petr Lautrbach <plautrba@redhat.com> wrote:
>
> These functions were converted to no-op by commit
> c3f9492d7ff0 ("selinux: Remove legacy local boolean and user code") and
> left in libsepol/src/deprecated_functions.c to preserve API/ABI. As we
> change libsepol ABI dropping duplicate symbols it's time to drop these
> functions too.
>
> Signed-off-by: Petr Lautrbach <plautrba@redhat.com>

Acked-by: James Carter <jwcart2@gmail.com>

> ---
>  libsepol/include/sepol/booleans.h |  5 ----
>  libsepol/include/sepol/users.h    |  6 ----
>  libsepol/src/deprecated_funcs.c   | 50 -------------------------------
>  libsepol/src/libsepol.map.in      |  4 ---
>  4 files changed, 65 deletions(-)
>  delete mode 100644 libsepol/src/deprecated_funcs.c
>
> diff --git a/libsepol/include/sepol/booleans.h b/libsepol/include/sepol/booleans.h
> index 06d2230c395d..25229057dbd7 100644
> --- a/libsepol/include/sepol/booleans.h
> +++ b/libsepol/include/sepol/booleans.h
> @@ -10,11 +10,6 @@
>  extern "C" {
>  #endif
>
> -/* These two functions are deprecated. See src/deprecated_funcs.c */
> -extern int sepol_genbools(void *data, size_t len, const char *boolpath);
> -extern int sepol_genbools_array(void *data, size_t len,
> -                               char **names, int *values, int nel);
> -
>  /* Set the specified boolean */
>  extern int sepol_bool_set(sepol_handle_t * handle,
>                           sepol_policydb_t * policydb,
> diff --git a/libsepol/include/sepol/users.h b/libsepol/include/sepol/users.h
> index 70158ac41e40..156d1adb2d60 100644
> --- a/libsepol/include/sepol/users.h
> +++ b/libsepol/include/sepol/users.h
> @@ -10,12 +10,6 @@
>  extern "C" {
>  #endif
>
> -/* These two functions are deprecated. See src/deprecated_funcs.c */
> -extern int sepol_genusers(void *data, size_t len,
> -                         const char *usersdir,
> -                         void **newdata, size_t * newlen);
> -extern void sepol_set_delusers(int on);
> -
>  /* Modify the user, or add it, if the key is not found */
>  extern int sepol_user_modify(sepol_handle_t * handle,
>                              sepol_policydb_t * policydb,
> diff --git a/libsepol/src/deprecated_funcs.c b/libsepol/src/deprecated_funcs.c
> deleted file mode 100644
> index d0dab7dfcb4a..000000000000
> --- a/libsepol/src/deprecated_funcs.c
> +++ /dev/null
> @@ -1,50 +0,0 @@
> -#include <stdio.h>
> -#include "debug.h"
> -
> -/*
> - * Need to keep these stubs for the libsepol interfaces exported in
> - * libsepol.map.in, as they are part of the shared library ABI.
> - */
> -
> -static const char *msg = "Deprecated interface";
> -
> -/*
> - * These two functions are deprecated and referenced in:
> - *     include/libsepol/users.h
> - */
> -int sepol_genusers(void *data __attribute((unused)),
> -                  size_t len __attribute((unused)),
> -                  const char *usersdir __attribute((unused)),
> -                  void **newdata __attribute((unused)),
> -                  size_t *newlen __attribute((unused)))
> -{
> -       WARN(NULL, "%s", msg);
> -       return -1;
> -}
> -
> -void sepol_set_delusers(int on __attribute((unused)))
> -{
> -       WARN(NULL, "%s", msg);
> -}
> -
> -/*
> - * These two functions are deprecated and referenced in:
> - *     include/libsepol/booleans.h
> - */
> -int sepol_genbools(void *data __attribute((unused)),
> -                  size_t len __attribute((unused)),
> -                  const char *booleans __attribute((unused)))
> -{
> -       WARN(NULL, "%s", msg);
> -       return -1;
> -}
> -
> -int sepol_genbools_array(void *data __attribute((unused)),
> -                        size_t len __attribute((unused)),
> -                        char **names __attribute((unused)),
> -                        int *values __attribute((unused)),
> -                        int nel __attribute((unused)))
> -{
> -       WARN(NULL, "%s", msg);
> -       return -1;
> -}
> diff --git a/libsepol/src/libsepol.map.in b/libsepol/src/libsepol.map.in
> index 98da9789b71b..eb5721257638 100644
> --- a/libsepol/src/libsepol.map.in
> +++ b/libsepol/src/libsepol.map.in
> @@ -45,9 +45,6 @@ LIBSEPOL_1.0 {
>         sepol_context_to_string;
>         sepol_debug;
>         sepol_expand_module;
> -       sepol_genbools;
> -       sepol_genbools_array;
> -       sepol_genusers;
>         sepol_get_disable_dontaudit;
>         sepol_get_preserve_tunables;
>         sepol_handle_create;
> @@ -213,7 +210,6 @@ LIBSEPOL_1.0 {
>         sepol_port_set_port;
>         sepol_port_set_proto;
>         sepol_port_set_range;
> -       sepol_set_delusers;
>         sepol_set_disable_dontaudit;
>         sepol_set_expand_consume_base;
>         sepol_set_policydb_from_file;
> --
> 2.28.0
>

Re: [PATCH v2 4/6] libsemanage: Remove legacy and duplicate symbols

[James Carter]

On Fri, Oct 9, 2020 at 9:48 AM Petr Lautrbach <plautrba@redhat.com> wrote:
>
> Versioned duplicate symbols cause problems for LTO. These symbols were
> introduced during the CIL integration several releases ago and were only
> consumed by other SELinux userspace components.
>
> Related: https://github.com/SELinuxProject/selinux/issues/245
>
> Signed-off-by: Petr Lautrbach <plautrba@redhat.com>

Acked-by: James Carter <jwcart2@gmail.com>

> ---
>  libsemanage/include/semanage/modules.h |   2 +-
>  libsemanage/src/libsemanage.map        |   5 --
>  libsemanage/src/modules.c              | 100 +------------------------
>  libsemanage/src/modules.h              |   9 +--
>  libsemanage/src/semanageswig_python.i  |   2 -
>  5 files changed, 4 insertions(+), 114 deletions(-)
>
> diff --git a/libsemanage/include/semanage/modules.h b/libsemanage/include/semanage/modules.h
> index ac4039314857..b51f61f033d5 100644
> --- a/libsemanage/include/semanage/modules.h
> +++ b/libsemanage/include/semanage/modules.h
> @@ -33,7 +33,7 @@ typedef struct semanage_module_key semanage_module_key_t;
>   */
>
>  extern int semanage_module_install(semanage_handle_t *,
> -                                  char *module_data, size_t data_len, char *name, char *ext_lang);
> +                                  char *module_data, size_t data_len, const char *name, const char *ext_lang);
>  extern int semanage_module_install_file(semanage_handle_t *,
>                                         const char *module_name);
>  extern int semanage_module_remove(semanage_handle_t *, char *module_name);
> diff --git a/libsemanage/src/libsemanage.map b/libsemanage/src/libsemanage.map
> index 1375a8ca0ea7..4bec06aaae27 100644
> --- a/libsemanage/src/libsemanage.map
> +++ b/libsemanage/src/libsemanage.map
> @@ -167,18 +167,13 @@ LIBSEMANAGE_1.0 {
>      semanage_mls_enabled;
>      semanage_module_disable;
>      semanage_module_enable;
> -    semanage_module_get_enabled;
>      semanage_module_get_name;
>      semanage_module_get_version;
>      semanage_module_info_datum_destroy;
> -    semanage_module_install;
> -    semanage_module_install_base;
> -    semanage_module_install_base_file;
>      semanage_module_install_file;
>      semanage_module_list;
>      semanage_module_list_nth;
>      semanage_module_remove;
> -    semanage_module_upgrade;
>      semanage_module_upgrade_file;
>      semanage_msg_get_channel;
>      semanage_msg_get_fname;
> diff --git a/libsemanage/src/modules.c b/libsemanage/src/modules.c
> index 6d3eb60ae462..8b36801038df 100644
> --- a/libsemanage/src/modules.c
> +++ b/libsemanage/src/modules.c
> @@ -42,70 +42,7 @@
>  #include "modules.h"
>  #include "debug.h"
>
> -asm(".symver semanage_module_get_enabled_1_1,semanage_module_get_enabled@@LIBSEMANAGE_1.1");
> -asm(".symver semanage_module_get_enabled_1_0,semanage_module_get_enabled@LIBSEMANAGE_1.0");
> -asm(".symver semanage_module_install_pp,semanage_module_install@LIBSEMANAGE_1.0");
> -asm(".symver semanage_module_install_hll,semanage_module_install@@LIBSEMANAGE_1.1");
> -
> -/* Takes a module stored in 'module_data' and parses its headers.
> - * Sets reference variables 'module_name' to module's name and
> - * 'version' to module's version. The caller is responsible for
> - * free()ing 'module_name' and 'version'; they will be
> - * set to NULL upon entering this function.  Returns 0 on success, -1
> - * if out of memory, or -2 if data did not represent a module.
> - */
> -static int parse_module_headers(semanage_handle_t * sh, char *module_data,
> -                               size_t data_len, char **module_name, char **version)
> -{
> -       struct sepol_policy_file *pf;
> -       int file_type;
> -       *version = NULL;
> -
> -       if (sepol_policy_file_create(&pf)) {
> -               ERR(sh, "Out of memory!");
> -               return -1;
> -       }
> -       sepol_policy_file_set_mem(pf, module_data, data_len);
> -       sepol_policy_file_set_handle(pf, sh->sepolh);
> -       if (module_data == NULL ||
> -           data_len == 0 ||
> -           sepol_module_package_info(pf, &file_type, module_name, version) == -1) {
> -               sepol_policy_file_free(pf);
> -               ERR(sh, "Could not parse module data.");
> -               return -2;
> -       }
> -       sepol_policy_file_free(pf);
> -       if (file_type != SEPOL_POLICY_MOD) {
> -               ERR(sh, "Data did not represent a pp module. Please upgrade to the latest version of libsemanage to support hll modules.");
> -               return -2;
> -       }
> -
> -       return 0;
> -}
> -
> -/* This function is used to preserve ABI compatibility with
> - * versions of semodule using LIBSEMANAGE_1.0
> - */
> -int semanage_module_install_pp(semanage_handle_t * sh,
> -                           char *module_data, size_t data_len)
> -{
> -       char *name = NULL;
> -       char *version = NULL;
> -       int status;
> -
> -       if ((status = parse_module_headers(sh, module_data, data_len, &name, &version)) != 0) {
> -               goto cleanup;
> -       }
> -
> -       status = semanage_module_install_hll(sh, module_data, data_len, name, "pp");
> -
> -cleanup:
> -       free(name);
> -       free(version);
> -       return status;
> -}
> -
> -int semanage_module_install_hll(semanage_handle_t * sh,
> +int semanage_module_install(semanage_handle_t * sh,
>                             char *module_data, size_t data_len, const char *name, const char *ext_lang)
>  {
>         if (sh->funcs->install == NULL) {
> @@ -160,16 +97,6 @@ int semanage_module_extract(semanage_handle_t * sh,
>         return sh->funcs->extract(sh, modkey, extract_cil, mapped_data, data_len, modinfo);
>  }
>
> -/* Legacy function that remains to preserve ABI
> - * compatibility. Please use semanage_module_install instead.
> - */
> -int semanage_module_upgrade(semanage_handle_t * sh,
> -                           char *module_data, size_t data_len)
> -{
> -       return semanage_module_install_pp(sh, module_data, data_len);
> -
> -}
> -
>  /* Legacy function that remains to preserve ABI
>   * compatibility. Please use semanage_module_install_file instead.
>   */
> @@ -179,24 +106,6 @@ int semanage_module_upgrade_file(semanage_handle_t * sh,
>         return semanage_module_install_file(sh, module_name);
>  }
>
> -/* Legacy function that remains to preserve ABI
> - * compatibility. Please use semanage_module_install instead.
> - */
> -int semanage_module_install_base(semanage_handle_t * sh,
> -                                char *module_data, size_t data_len)
> -{
> -       return semanage_module_install_pp(sh, module_data, data_len);
> -}
> -
> -/* Legacy function that remains to preserve ABI
> - * compatibility. Please use semanage_module_install_file instead.
> - */
> -int semanage_module_install_base_file(semanage_handle_t * sh,
> -                                const char *module_name)
> -{
> -       return semanage_module_install_file(sh, module_name);
> -}
> -
>  int semanage_module_remove(semanage_handle_t * sh, char *module_name)
>  {
>         if (sh->funcs->remove == NULL) {
> @@ -780,7 +689,7 @@ int semanage_module_key_set_priority(semanage_handle_t *sh,
>  }
>
>
> -int semanage_module_get_enabled_1_1(semanage_handle_t *sh,
> +int semanage_module_get_enabled(semanage_handle_t *sh,
>                                 const semanage_module_key_t *modkey,
>                                 int *enabled)
>  {
> @@ -800,11 +709,6 @@ int semanage_module_get_enabled_1_1(semanage_handle_t *sh,
>         return sh->funcs->get_enabled(sh, modkey, enabled);
>  }
>
> -int semanage_module_get_enabled_1_0(semanage_module_info_t *modinfo)
> -{
> -       return modinfo->enabled;
> -}
> -
>  int semanage_module_set_enabled(semanage_handle_t *sh,
>                                 const semanage_module_key_t *modkey,
>                                 int enabled)
> diff --git a/libsemanage/src/modules.h b/libsemanage/src/modules.h
> index 2d3576fb15df..64d4a157f5ca 100644
> --- a/libsemanage/src/modules.h
> +++ b/libsemanage/src/modules.h
> @@ -26,16 +26,9 @@
>
>  #include "semanage/modules.h"
>
> -int semanage_module_install_pp(semanage_handle_t * sh,
> -                           char *module_data, size_t data_len);
> -int semanage_module_install_hll(semanage_handle_t * sh,
> -                           char *module_data, size_t data_len, const char *name, const char *ext_lang);
> -int semanage_module_upgrade(semanage_handle_t * sh,
> -                           char *module_data, size_t data_len);
> +
>  int semanage_module_upgrade_file(semanage_handle_t * sh,
>                                  const char *module_name);
> -int semanage_module_install_base(semanage_handle_t * sh,
> -                                char *module_data, size_t data_len);
>  int semanage_module_install_base_file(semanage_handle_t * sh,
>                                  const char *module_name);
>
> diff --git a/libsemanage/src/semanageswig_python.i b/libsemanage/src/semanageswig_python.i
> index 8dd79fc24213..5f0113966962 100644
> --- a/libsemanage/src/semanageswig_python.i
> +++ b/libsemanage/src/semanageswig_python.i
> @@ -30,8 +30,6 @@
>  %}
>
>  %include "stdint.i"
> -%ignore semanage_module_install_pp;
> -%ignore semanage_module_install_hll;
>
>  %wrapper %{
>
> --
> 2.28.0
>

Re: [PATCH v2 5/6] libsemanage: Drop deprecated functions

[James Carter]

On Fri, Oct 9, 2020 at 9:48 AM Petr Lautrbach <plautrba@redhat.com> wrote:
>
> semanage_module_enable() and semanage_module_disable() were deprecated
> by commit 9fbc6d14418f ("libsemanage: add back original module
> enable/disable functions for ABI compatability") in 2014 in order to
> preserve ABI compatibility. As we the libsemanage ABI is changed by the
> previous commit, it makes sense to drop them completely.
>
> Signed-off-by: Petr Lautrbach <plautrba@redhat.com>

Acked-by: James Carter <jwcart2@gmail.com>

> ---
>  libsemanage/src/libsemanage.map |  2 --
>  libsemanage/src/modules.c       | 56 ---------------------------------
>  2 files changed, 58 deletions(-)
>
> diff --git a/libsemanage/src/libsemanage.map b/libsemanage/src/libsemanage.map
> index 4bec06aaae27..3ea7b60f97bb 100644
> --- a/libsemanage/src/libsemanage.map
> +++ b/libsemanage/src/libsemanage.map
> @@ -165,8 +165,6 @@ LIBSEMANAGE_1.0 {
>      semanage_is_connected;
>      semanage_is_managed;
>      semanage_mls_enabled;
> -    semanage_module_disable;
> -    semanage_module_enable;
>      semanage_module_get_name;
>      semanage_module_get_version;
>      semanage_module_info_datum_destroy;
> diff --git a/libsemanage/src/modules.c b/libsemanage/src/modules.c
> index 8b36801038df..b6dd456cac32 100644
> --- a/libsemanage/src/modules.c
> +++ b/libsemanage/src/modules.c
> @@ -734,62 +734,6 @@ int semanage_module_set_enabled(semanage_handle_t *sh,
>  }
>
>
> -/* This function exists only for ABI compatibility. It has been deprecated and
> - * should not be used. Instead, use semanage_module_set_enabled() */
> -int semanage_module_enable(semanage_handle_t *sh, char *module_name)
> -{
> -       int rc = -1;
> -       semanage_module_key_t *modkey = NULL;
> -
> -       rc = semanage_module_key_create(sh, &modkey);
> -       if (rc != 0)
> -               goto exit;
> -
> -       rc = semanage_module_key_set_name(sh, modkey, module_name);
> -       if (rc != 0)
> -               goto exit;
> -
> -       rc = semanage_module_set_enabled(sh, modkey, 1);
> -       if (rc != 0)
> -               goto exit;
> -
> -       rc = 0;
> -
> -exit:
> -       semanage_module_key_destroy(sh, modkey);
> -       free(modkey);
> -
> -       return rc;
> -}
> -
> -/* This function exists only for ABI compatibility. It has been deprecated and
> - * should not be used. Instead, use semanage_module_set_enabled() */
> -int semanage_module_disable(semanage_handle_t *sh, char *module_name)
> -{
> -       int rc = -1;
> -       semanage_module_key_t *modkey = NULL;
> -
> -       rc = semanage_module_key_create(sh, &modkey);
> -       if (rc != 0)
> -               goto exit;
> -
> -       rc = semanage_module_key_set_name(sh, modkey, module_name);
> -       if (rc != 0)
> -               goto exit;
> -
> -       rc = semanage_module_set_enabled(sh, modkey, 0);
> -       if (rc != 0)
> -               goto exit;
> -
> -       rc = 0;
> -
> -exit:
> -       semanage_module_key_destroy(sh, modkey);
> -       free(modkey);
> -
> -       return rc;
> -}
> -
>  /* Converts a string to a priority
>   *
>   * returns -1 if str is not a valid priority.
> --
> 2.28.0
>

Re: [PATCH v2 6/6] libsemanage: Bump libsemanage.so version

[James Carter]

On Fri, Oct 9, 2020 at 9:48 AM Petr Lautrbach <plautrba@redhat.com> wrote:
>
> Previous commits removed some symbols and broke ABI, therefore we need to change
> SONAME.
>
> See the following quotes from distribution guidelines:
>
> https://www.debian.org/doc/debian-policy/ch-sharedlibs.html#run-time-shared-libraries
>
> Every time the shared library ABI changes in a way that may break
> binaries linked against older versions of the shared library, the SONAME
> of the library and the corresponding name for the binary package
> containing the runtime shared library should change.
>
> https://docs.fedoraproject.org/en-US/packaging-guidelines/#_downstream_so_name_versioning
>
> When new versions of the library are released, you should use an ABI
> comparison tool to check for ABI differences in the built shared
> libraries. If it detects any incompatibilities, bump the n number by
> one.
>
> Signed-off-by: Petr Lautrbach <plautrba@redhat.com>

Acked-by: James Carter <jwcart2@gmail.com>

> ---
>  libsemanage/src/Makefile | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/libsemanage/src/Makefile b/libsemanage/src/Makefile
> index a0eb3747d74b..ab6cae51f5c3 100644
> --- a/libsemanage/src/Makefile
> +++ b/libsemanage/src/Makefile
> @@ -32,7 +32,7 @@ YACC = bison
>  YFLAGS = -d
>
>  VERSION = $(shell cat ../VERSION)
> -LIBVERSION = 1
> +LIBVERSION = 2
>
>  LIBA=libsemanage.a
>  TARGET=libsemanage.so
> --
> 2.28.0
>

Re: libsepol, libsemanage: drop duplicate and deprecated symbols

[James Carter]

On Fri, Oct 9, 2020 at 9:49 AM Petr Lautrbach <plautrba@redhat.com> wrote:
>
>
> This is followup of
> https://lore.kernel.org/selinux/20200930145031.910190-1-plautrba@redhat.com/T/#t
>
> Change against 1 version:
>
> - improved commit messages with references to Debian and Fedora guidelines
> - drop deprecated functions from libsepol/src/deprecated_functions.c and
> - semanage_module_enable/semanage_module_disable from libsemanage
>

I am not an expert in library versioning and such, but everything
looks ok to me.
Jim

Re: libsepol, libsemanage: drop duplicate and deprecated symbols

[Nicolas Iooss]

On Thu, Oct 15, 2020 at 7:59 PM James Carter <jwcart2@gmail.com> wrote:
>
> On Fri, Oct 9, 2020 at 9:49 AM Petr Lautrbach <plautrba@redhat.com> wrote:
> >
> >
> > This is followup of
> > https://lore.kernel.org/selinux/20200930145031.910190-1-plautrba@redhat.com/T/#t
> >
> > Change against 1 version:
> >
> > - improved commit messages with references to Debian and Fedora guidelines
> > - drop deprecated functions from libsepol/src/deprecated_functions.c and
> > - semanage_module_enable/semanage_module_disable from libsemanage
> >
>
> I am not an expert in library versioning and such, but everything
> looks ok to me.
> Jim

Same: not an expert, but the patches look good (and Travis-CI does not
report any issue). Thanks for adding references to the guidelines! For
this series:

Acked-by: Nicolas Iooss <nicolas.iooss@m4x.org>

I will be busy tomorrow but will merge this on Wednesday if you do not
merge it before (and if nobody sends comments requiring changes).
Nicolas

Re: libsepol, libsemanage: drop duplicate and deprecated symbols

[Nicolas Iooss]

On Mon, Oct 19, 2020 at 11:35 PM Nicolas Iooss <nicolas.iooss@m4x.org> wrote:
>
> On Thu, Oct 15, 2020 at 7:59 PM James Carter <jwcart2@gmail.com> wrote:
> >
> > On Fri, Oct 9, 2020 at 9:49 AM Petr Lautrbach <plautrba@redhat.com> wrote:
> > >
> > >
> > > This is followup of
> > > https://lore.kernel.org/selinux/20200930145031.910190-1-plautrba@redhat.com/T/#t
> > >
> > > Change against 1 version:
> > >
> > > - improved commit messages with references to Debian and Fedora guidelines
> > > - drop deprecated functions from libsepol/src/deprecated_functions.c and
> > > - semanage_module_enable/semanage_module_disable from libsemanage
> > >
> >
> > I am not an expert in library versioning and such, but everything
> > looks ok to me.
> > Jim
>
> Same: not an expert, but the patches look good (and Travis-CI does not
> report any issue). Thanks for adding references to the guidelines! For
> this series:
>
> Acked-by: Nicolas Iooss <nicolas.iooss@m4x.org>
>
> I will be busy tomorrow but will merge this on Wednesday if you do not
> merge it before (and if nobody sends comments requiring changes).

Merged.

Thanks!
Nicolas