Re: RFC: introduce new library versions for added symbols

[Stephen Smalley <sds@tycho.nsa.gov>]

On 1/10/19 12:57 PM, Petr Lautrbach wrote:
> I used abi-compliance-checker [1] and compared the latest sources with 
> 2.8 release [2].
> It looks like there's one symbol added to audit2why.so.

audit2why.so needs a .map file or equivalent; it shouldn't be exporting 
all of the libsepol.a symbols.  We don't guarantee ABI or API 
compatibility for anything not in libsepol.map.

> 
> Then I tried the same thing with 2.7 [3] and 2.6 [4] and noticed that
> there were added new symbols even to LIBSEMANAGE_1.0 while since 2.3
> there's already LIBSEMANAGE_1.1.
> It's a bug which breaks automatic dependency checking. So I propose
> to fix symbol version mappings in order to be in relation with the
> release where they was introduced, e.g. for libsemanage:
> 
> diff --git a/libsemanage/src/libsemanage.map 
> b/libsemanage/src/libsemanage.map
> index 02036696..45e90215 100644
> --- a/libsemanage/src/libsemanage.map
> +++ b/libsemanage/src/libsemanage.map
> @@ -18,8 +18,6 @@ LIBSEMANAGE_1.0 {
>           semanage_root;
>           semanage_user_*; semanage_bool_*; semanage_seuser_*;
>           semanage_iface_*; semanage_port_*; semanage_context_*;
> -         semanage_ibpkey_*;
> -         semanage_ibendport_*;
>           semanage_node_*;
>           semanage_fcontext_*; semanage_access_check;          
> semanage_set_create_store;
>           semanage_is_connected; semanage_get_disable_dontaudit; 
>           semanage_set_disable_dontaudit;
> @@ -63,3 +61,19 @@ LIBSEMANAGE_1.1 {
>           semanage_module_remove_key;
>           semanage_set_store_root;
> } LIBSEMANAGE_1.0;
> +
> +LIBSEMANAGE_2.5 {
> +  global:
> +    semanage_module_extract;
> +} LIBSEMANAGE_1.1;
> +
> +LIBSEMANAGE_2.7 {
> +  global:
> +         semanage_ibpkey_*;
> +         semanage_ibendport_*;
> +} LIBSEMANAGE_2.5;
> +
> +LIBSEMANAGE_2.8 {
> +  global:
> +    semanage_fcontext_list_homedirs;
> +} LIBSEMANAGE_2.7;
> 
> 
> If this is acceptable, I would prepare a patch with symbol versions
> starting with 2.5 as LIBSEMANAGE_1.1 was introduced in 2.4.

Will this break compatibility for binaries built against earlier versions?

> 
> [1] http://lvc.github.io/abi-compliance-checker/
> [2] 
> https://plautrba.fedorapeople.org/selinux/compat_reports/2.8_to_2.9-rc0/compat_report.html 
> 
> [3] 
> https://plautrba.fedorapeople.org/selinux/compat_reports/2.7_to_2.9-rc0/compat_report.html 
> 
> [4] 
> https://plautrba.fedorapeople.org/selinux/compat_reports/2.6_to_2.9-rc0/compat_report.html 
> 
> 
> Petr