[meta-selinux][PATCH 0/2] libsemanage-native: remove audit-native dependency

[meta-selinux][PATCH 0/2] libsemanage-native: remove audit-native dependency

[wenzong.fan]

From: Wenzong Fan <wenzong.fan@windriver.com>

* native tools don't need audit support;
* audit 2.3.2 or laters require kernel headers >= 2.6.30, this causes
  audit-native can't be built on some older distributions. 

The following changes since commit 3fee4a09cc26816862dacfb2081dc7e0fa7ca47e:

  psmisc: inherit enable-selinux and backport to fix build issue (2014-01-13 17:50:00 +0800)

are available in the git repository at:

  git://git.pokylinux.org/poky-contrib wenzong/disable-audit
  http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=wenzong/disable-audit

Wenzong Fan (2):
  Revert "libsemanage: add audit dependency"
  libsemanage-native: remove audit-native dependency

 recipes-security/audit/audit_2.3.2.bb              |    8 +-
 recipes-security/selinux/libsemanage.inc           |    5 +-
 ...ibsemanage-allow-to-disable-audit-support.patch |  126 ++++++++++++++++++++
 recipes-security/selinux/libsemanage_2.2.bb        |    1 +
 recipes-security/selinux/libsemanage_git.bb        |    1 +
 5 files changed, 133 insertions(+), 8 deletions(-)
 create mode 100644 recipes-security/selinux/libsemanage/libsemanage-allow-to-disable-audit-support.patch

-- 
1.7.9.5

[meta-selinux][PATCH 1/2] Revert "libsemanage: add audit dependency"

[wenzong.fan]

From: Wenzong Fan <wenzong.fan@windriver.com>

This reverts commit 146bd8c6bc3bc0e9e96a8517263f28f7915b871d.

Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
---
 recipes-security/audit/audit_2.3.2.bb    |    8 +-------
 recipes-security/selinux/libsemanage.inc |    2 +-
 2 files changed, 2 insertions(+), 8 deletions(-)

diff --git a/recipes-security/audit/audit_2.3.2.bb b/recipes-security/audit/audit_2.3.2.bb
index 8ab0c7b..edcb881 100644
--- a/recipes-security/audit/audit_2.3.2.bb
+++ b/recipes-security/audit/audit_2.3.2.bb
@@ -26,7 +26,6 @@ SRC_URI[md5sum] = "4e8d065b5cc16b77b9b61e93a9ed160e"
 SRC_URI[sha256sum] = "8872e0b5392888789061db8034164305ef0e1b34543e1e7004d275f039081d29"
 
 DEPENDS += "python tcp-wrappers libcap-ng linux-libc-headers (>= 2.6.30)"
-DEPENDS_class-native = ""
 
 EXTRA_OECONF += "--without-prelude \
 	--with-libwrap \
@@ -38,9 +37,6 @@ EXTRA_OECONF += "--without-prelude \
 	--sbindir=${base_sbindir} \
 	"
 
-# Remove extra configs for native build
-EXTRA_OECONF_class-native = "--with-python=no"
-
 EXTRA_OEMAKE += "PYLIBVER='python${PYTHON_BASEVERSION}' \
 	PYINC='${STAGING_INCDIR}/$(PYLIBVER)' \
 	pyexecdir=${libdir}/python${PYTHON_BASEVERSION}/site-packages \
@@ -66,7 +62,7 @@ FILES_${PN}-dbg += "${libdir}/python${PYTHON_BASEVERSION}/*/.debug"
 FILES_${PN}-python = "${libdir}/python${PYTHON_BASEVERSION}"
 FILES_${PN}-dev += "${base_libdir}/*.so ${base_libdir}/*.la"
 
-do_install_append_class-target() {
+do_install_append() {
 	rm -f ${D}/${libdir}/python${PYTHON_BASEVERSION}/site-packages/*.a
 	rm -f ${D}/${libdir}/python${PYTHON_BASEVERSION}/site-packages/*.la
 
@@ -79,5 +75,3 @@ do_install_append_class-target() {
 	install -D -m 0755 ${S}/../auditd ${D}/etc/init.d/auditd
 	rm -rf ${D}/etc/rc.d
 }
-
-BBCLASSEXTEND = "native"
diff --git a/recipes-security/selinux/libsemanage.inc b/recipes-security/selinux/libsemanage.inc
index a978c75..dfc3006 100644
--- a/recipes-security/selinux/libsemanage.inc
+++ b/recipes-security/selinux/libsemanage.inc
@@ -10,7 +10,7 @@ LICENSE = "LGPLv2.1+"
 
 inherit lib_package
 
-DEPENDS += "libsepol libselinux ustr bzip2 python audit bison-native flex-native"
+DEPENDS += "libsepol libselinux ustr bzip2 python bison-native flex-native"
 
 PACKAGES += "${PN}-python"
 FILES_${PN}-python = "${libdir}/python${PYTHON_BASEVERSION}/site-packages/*"
-- 
1.7.9.5

[meta-selinux][PATCH 2/2] libsemanage-native: remove audit-native dependency

[wenzong.fan]

From: Wenzong Fan <wenzong.fan@windriver.com>

* native tools don't need audit support;
* audit 2.3.2 or laters require kernel headers >= 2.6.30, this causes
  audit-native can't be built on some older distributions.

Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
---
 recipes-security/selinux/libsemanage.inc           |    3 +
 ...ibsemanage-allow-to-disable-audit-support.patch |  126 ++++++++++++++++++++
 recipes-security/selinux/libsemanage_2.2.bb        |    1 +
 recipes-security/selinux/libsemanage_git.bb        |    1 +
 4 files changed, 131 insertions(+)
 create mode 100644 recipes-security/selinux/libsemanage/libsemanage-allow-to-disable-audit-support.patch

diff --git a/recipes-security/selinux/libsemanage.inc b/recipes-security/selinux/libsemanage.inc
index dfc3006..9424358 100644
--- a/recipes-security/selinux/libsemanage.inc
+++ b/recipes-security/selinux/libsemanage.inc
@@ -11,11 +11,14 @@ LICENSE = "LGPLv2.1+"
 inherit lib_package
 
 DEPENDS += "libsepol libselinux ustr bzip2 python bison-native flex-native"
+DEPENDS_class-target += "audit"
 
 PACKAGES += "${PN}-python"
 FILES_${PN}-python = "${libdir}/python${PYTHON_BASEVERSION}/site-packages/*"
 FILES_${PN}-dbg += "${libdir}/python${PYTHON_BASEVERSION}/site-packages/.debug/*"
 
+EXTRA_OEMAKE_class-native += "DISABLE_AUDIT=y"
+
 do_compile_append() {
     oe_runmake pywrap \
             INCLUDEDIR='${STAGING_INCDIR}' \
diff --git a/recipes-security/selinux/libsemanage/libsemanage-allow-to-disable-audit-support.patch b/recipes-security/selinux/libsemanage/libsemanage-allow-to-disable-audit-support.patch
new file mode 100644
index 0000000..d843d2b
--- /dev/null
+++ b/recipes-security/selinux/libsemanage/libsemanage-allow-to-disable-audit-support.patch
@@ -0,0 +1,126 @@
+From 7d23189c4541124469aad24fe1719f2a24b4ca48 Mon Sep 17 00:00:00 2001
+From: Wenzong Fan <wenzong.fan@windriver.com>
+Date: Mon, 20 Jan 2014 03:53:48 -0500
+Subject: [PATCH] libsemanage: allow to disable audit support
+
+* native tools don't need audit support;
+* audit 2.3.2 or laters require kernel headers >= 2.6.30
+
+Upstream-Status: Pending
+
+Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
+---
+ src/Makefile        |   10 +++++++++-
+ src/seusers_local.c |   13 +++++++++++++
+ tests/Makefile      |   10 +++++++++-
+ 3 files changed, 31 insertions(+), 2 deletions(-)
+
+diff --git a/src/Makefile b/src/Makefile
+index 359d738..24dbf29 100644
+--- a/src/Makefile
++++ b/src/Makefile
+@@ -28,6 +28,14 @@ ifeq ($(DEBUG),1)
+ 	export LDFLAGS = -g
+ endif
+ 
++DISABLE_AUDIT ?= n
++ifeq ($(DISABLE_AUDIT),y)
++	LIBAUDIT =
++	CFLAGS += -DDISABLE_AUDIT
++else
++	LIBAUDIT = -laudit
++endif
++
+ LEX = flex
+ LFLAGS = -s
+ YACC = bison
+@@ -92,7 +100,7 @@ $(LIBA): $(OBJS)
+ 	$(RANLIB) $@
+ 
+ $(LIBSO): $(LOBJS)
+-	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -lsepol -laudit -lselinux -lbz2 -lustr -L$(LIBDIR) -Wl,-soname,$(LIBSO),--version-script=libsemanage.map,-z,defs
++	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -lsepol $(LIBAUDIT) -lselinux -lbz2 -lustr -L$(LIBDIR) -Wl,-soname,$(LIBSO),--version-script=libsemanage.map,-z,defs
+ 	ln -sf $@ $(TARGET)
+ 
+ $(LIBPC): $(LIBPC).in ../VERSION
+diff --git a/src/seusers_local.c b/src/seusers_local.c
+index 63ab40c..8bdc7da 100644
+--- a/src/seusers_local.c
++++ b/src/seusers_local.c
+@@ -8,7 +8,11 @@ typedef struct semanage_seuser record_t;
+ 
+ #include <sepol/policydb.h>
+ #include <sepol/context.h>
++
++#ifndef DISABLE_AUDIT
+ #include <libaudit.h>
++#endif
++
+ #include <errno.h>
+ #include "user_internal.h"
+ #include "seuser_internal.h"
+@@ -51,6 +55,7 @@ static char *semanage_user_roles(semanage_handle_t * handle, const char *sename)
+ 	return roles;
+ }
+ 
++#ifndef DISABLE_AUDIT
+ static int semanage_seuser_audit(semanage_handle_t * handle,
+ 			  const semanage_seuser_t * seuser,
+ 			  const semanage_seuser_t * previous,
+@@ -114,6 +119,7 @@ err:
+ 	free(proles);
+ 	return rc;
+ }
++#endif
+ 
+ int semanage_seuser_modify_local(semanage_handle_t * handle,
+ 				 const semanage_seuser_key_t * key,
+@@ -157,8 +163,11 @@ int semanage_seuser_modify_local(semanage_handle_t * handle,
+ 	(void) semanage_seuser_query(handle, key, &previous);
+ 	handle->msg_callback = callback;
+ 	rc = dbase_modify(handle, dconfig, key, new);
++
++#ifndef DISABLE_AUDIT
+ 	if (semanage_seuser_audit(handle, new, previous, AUDIT_ROLE_ASSIGN, rc == 0) < 0)
+ 		rc = -1;
++#endif
+ err:
+ 	if (previous)
+ 		semanage_seuser_free(previous);
+@@ -174,8 +183,12 @@ int semanage_seuser_del_local(semanage_handle_t * handle,
+ 	dbase_config_t *dconfig = semanage_seuser_dbase_local(handle);
+ 	rc = dbase_del(handle, dconfig, key);
+ 	semanage_seuser_query(handle, key, &seuser);
++
++#ifndef DISABLE_AUDIT
+ 	if (semanage_seuser_audit(handle, NULL, seuser, AUDIT_ROLE_REMOVE, rc == 0) < 0)
+ 		rc = -1;
++#endif
++
+ 	if (seuser)
+ 		semanage_seuser_free(seuser);
+ 	return rc;
+diff --git a/tests/Makefile b/tests/Makefile
+index 418d701..7839db6 100644
+--- a/tests/Makefile
++++ b/tests/Makefile
+@@ -13,7 +13,15 @@ EXECUTABLE = libsemanage-tests
+ CC = gcc
+ CFLAGS = -c -g -o0 -Wall -W -Wundef -Wmissing-noreturn -Wmissing-format-attribute -Wno-unused-parameter
+ INCLUDE = -I$(TESTSRC) -I$(TESTSRC)/../include
+-LDFLAGS = -lcunit -lustr -lbz2 -laudit
++DISABLE_AUDIT ?= n
++ifeq ($(DISABLE_AUDIT),y)
++	LIBAUDIT =
++	CFLAGS += -DDISABLE_AUDIT
++else
++	LIBAUDIT = -laudit
++endif
++
++LDFLAGS = -lcunit -lustr -lbz2 $(LIBAUDIT)
+ OBJECTS = $(SOURCES:.c=.o) 
+ 
+ all: $(EXECUTABLE) 
+-- 
+1.7.9.5
+
diff --git a/recipes-security/selinux/libsemanage_2.2.bb b/recipes-security/selinux/libsemanage_2.2.bb
index 4ee93c0..93daf9f 100644
--- a/recipes-security/selinux/libsemanage_2.2.bb
+++ b/recipes-security/selinux/libsemanage_2.2.bb
@@ -14,4 +14,5 @@ SRC_URI += "\
 	file://libsemanage-fix-path-nologin.patch \
 	file://libsemanage-drop-Wno-unused-but-set-variable.patch \
 	file://libsemanage-define-FD_CLOEXEC-as-necessary.patch;striplevel=2 \
+	file://libsemanage-allow-to-disable-audit-support.patch \
 	"
diff --git a/recipes-security/selinux/libsemanage_git.bb b/recipes-security/selinux/libsemanage_git.bb
index c3799fd..a32ebc3 100644
--- a/recipes-security/selinux/libsemanage_git.bb
+++ b/recipes-security/selinux/libsemanage_git.bb
@@ -12,4 +12,5 @@ SRC_URI += "\
 	file://libsemanage-fix-path-nologin.patch \
 	file://libsemanage-drop-Wno-unused-but-set-variable.patch \
 	file://libsemanage-define-FD_CLOEXEC-as-necessary.patch;striplevel=2 \
+	file://libsemanage-allow-to-disable-audit-support.patch \
 	"
-- 
1.7.9.5

Re: [meta-selinux][PATCH 0/2] libsemanage-native: remove audit-native dependency

[Pascal Ouyang]

于 14-1-20 下午6:15, wenzong.fan@windriver.com 写道:
> From: Wenzong Fan <wenzong.fan@windriver.com>
> 
> * native tools don't need audit support;
> * audit 2.3.2 or laters require kernel headers >= 2.6.30, this causes
>    audit-native can't be built on some older distributions.
> 
> The following changes since commit 3fee4a09cc26816862dacfb2081dc7e0fa7ca47e:
> 
>    psmisc: inherit enable-selinux and backport to fix build issue (2014-01-13 17:50:00 +0800)
> 
> are available in the git repository at:
> 
>    git://git.pokylinux.org/poky-contrib wenzong/disable-audit
>    http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=wenzong/disable-audit
> 
> Wenzong Fan (2):
>    Revert "libsemanage: add audit dependency"
>    libsemanage-native: remove audit-native dependency
> 
>   recipes-security/audit/audit_2.3.2.bb              |    8 +-
>   recipes-security/selinux/libsemanage.inc           |    5 +-
>   ...ibsemanage-allow-to-disable-audit-support.patch |  126 ++++++++++++++++++++
>   recipes-security/selinux/libsemanage_2.2.bb        |    1 +
>   recipes-security/selinux/libsemanage_git.bb        |    1 +
>   5 files changed, 133 insertions(+), 8 deletions(-)
>   create mode 100644 recipes-security/selinux/libsemanage/libsemanage-allow-to-disable-audit-support.patch
> 

Merged to meta-selinux:master.

Thanks. :)

-- 
- Pascal