SELinux Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH testsuite] policy: do not rebuild policy package if already built
@ 2019-09-23  9:58 Ondrej Mosnacek
  2019-09-23 10:01 ` Ondrej Mosnacek
  2019-09-23 14:11 ` Stephen Smalley
  0 siblings, 2 replies; 6+ messages in thread
From: Ondrej Mosnacek @ 2019-09-23  9:58 UTC (permalink / raw)
  To: selinux

Right now, test_policy.pp is rebuilt on every make invocation. Tweak the
Makefile so that it is only build when it hasn't been built, it has been
cleaned, or the source files changed.

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
---
 policy/Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/policy/Makefile b/policy/Makefile
index a5942b3..cc0f140 100644
--- a/policy/Makefile
+++ b/policy/Makefile
@@ -86,7 +86,7 @@ ifeq (x$(DISTRO),$(filter x$(DISTRO),xRHEL4 xRHEL5 xRHEL6))
 TARGETS:=$(filter-out test_overlayfs.te test_mqueue.te test_ibpkey.te, $(TARGETS))
 endif
 
-all: build
+all: test_policy/test_policy.pp
 
 expand_check:
 	# Test for "expand-check = 0" in /etc/selinux/semanage.conf
@@ -94,7 +94,7 @@ expand_check:
 		(echo "ERROR: set 'expand-check = 0' in /etc/selinux/semanage.conf"; \
 		 /bin/false)
 
-build: $(TARGETS)
+test_policy/test_policy.pp: $(TARGETS) test_policy.if
 	# General policy build
 	@if [ -d $(POLDEV) ]; then \
 		mkdir -p test_policy; \
-- 
2.21.0


^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH testsuite] policy: do not rebuild policy package if already built
  2019-09-23  9:58 [PATCH testsuite] policy: do not rebuild policy package if already built Ondrej Mosnacek
@ 2019-09-23 10:01 ` Ondrej Mosnacek
  2019-09-23 14:11 ` Stephen Smalley
  1 sibling, 0 replies; 6+ messages in thread
From: Ondrej Mosnacek @ 2019-09-23 10:01 UTC (permalink / raw)
  To: SElinux list

On Mon, Sep 23, 2019 at 11:58 AM Ondrej Mosnacek <omosnace@redhat.com> wrote:
> Right now, test_policy.pp is rebuilt on every make invocation. Tweak the
> Makefile so that it is only build when it hasn't been built, it has been
> cleaned, or the source files changed.
>
> Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
> ---
>  policy/Makefile | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/policy/Makefile b/policy/Makefile
> index a5942b3..cc0f140 100644
> --- a/policy/Makefile
> +++ b/policy/Makefile
> @@ -86,7 +86,7 @@ ifeq (x$(DISTRO),$(filter x$(DISTRO),xRHEL4 xRHEL5 xRHEL6))
>  TARGETS:=$(filter-out test_overlayfs.te test_mqueue.te test_ibpkey.te, $(TARGETS))
>  endif
>
> -all: build
> +all: test_policy/test_policy.pp
>
>  expand_check:
>         # Test for "expand-check = 0" in /etc/selinux/semanage.conf
> @@ -94,7 +94,7 @@ expand_check:
>                 (echo "ERROR: set 'expand-check = 0' in /etc/selinux/semanage.conf"; \
>                  /bin/false)
>
> -build: $(TARGETS)
> +test_policy/test_policy.pp: $(TARGETS) test_policy.if
>         # General policy build
>         @if [ -d $(POLDEV) ]; then \
>                 mkdir -p test_policy; \
> --
> 2.21.0
>

This doesn't make much of a difference performance-wise, but the
behavior is more logical this way.

-- 
Ondrej Mosnacek <omosnace at redhat dot com>
Software Engineer, Security Technologies
Red Hat, Inc.


^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH testsuite] policy: do not rebuild policy package if already built
  2019-09-23  9:58 [PATCH testsuite] policy: do not rebuild policy package if already built Ondrej Mosnacek
  2019-09-23 10:01 ` Ondrej Mosnacek
@ 2019-09-23 14:11 ` Stephen Smalley
  2019-09-24 10:51   ` Ondrej Mosnacek
  1 sibling, 1 reply; 6+ messages in thread
From: Stephen Smalley @ 2019-09-23 14:11 UTC (permalink / raw)
  To: Ondrej Mosnacek, selinux

On 9/23/19 5:58 AM, Ondrej Mosnacek wrote:
> Right now, test_policy.pp is rebuilt on every make invocation. Tweak the
> Makefile so that it is only build when it hasn't been built, it has been
> cleaned, or the source files changed.

It also needs to be rebuilt if anything under 
/usr/share/selinux/devel/include has changed e.g. upon an update of 
selinux-policy-devel.

> 
> Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
> ---
>   policy/Makefile | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/policy/Makefile b/policy/Makefile
> index a5942b3..cc0f140 100644
> --- a/policy/Makefile
> +++ b/policy/Makefile
> @@ -86,7 +86,7 @@ ifeq (x$(DISTRO),$(filter x$(DISTRO),xRHEL4 xRHEL5 xRHEL6))
>   TARGETS:=$(filter-out test_overlayfs.te test_mqueue.te test_ibpkey.te, $(TARGETS))
>   endif
>   
> -all: build
> +all: test_policy/test_policy.pp
>   
>   expand_check:
>   	# Test for "expand-check = 0" in /etc/selinux/semanage.conf
> @@ -94,7 +94,7 @@ expand_check:
>   		(echo "ERROR: set 'expand-check = 0' in /etc/selinux/semanage.conf"; \
>   		 /bin/false)
>   
> -build: $(TARGETS)
> +test_policy/test_policy.pp: $(TARGETS) test_policy.if
>   	# General policy build
>   	@if [ -d $(POLDEV) ]; then \
>   		mkdir -p test_policy; \
> 


^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH testsuite] policy: do not rebuild policy package if already built
  2019-09-23 14:11 ` Stephen Smalley
@ 2019-09-24 10:51   ` Ondrej Mosnacek
  2019-09-24 13:58     ` Stephen Smalley
  0 siblings, 1 reply; 6+ messages in thread
From: Ondrej Mosnacek @ 2019-09-24 10:51 UTC (permalink / raw)
  To: Stephen Smalley; +Cc: SElinux list

On Mon, Sep 23, 2019 at 4:11 PM Stephen Smalley <sds@tycho.nsa.gov> wrote:
> On 9/23/19 5:58 AM, Ondrej Mosnacek wrote:
> > Right now, test_policy.pp is rebuilt on every make invocation. Tweak the
> > Makefile so that it is only build when it hasn't been built, it has been
> > cleaned, or the source files changed.
>
> It also needs to be rebuilt if anything under
> /usr/share/selinux/devel/include has changed e.g. upon an update of
> selinux-policy-devel.

I am now testing a version that always executes the `$(MAKE) -C
test_policy -f $(POLDEV)/Makefile test_policy.pp` step, relying on the
system Makefile to rebuild the pp as needed (there already are proper
dependencies on the include files). However, the package manager on
Fedora preserves the timestamps of the installed files (from package
build time), which means that make doesn't always detect that the
files are newer than the already built policy package.

So it looks like we don't have any other choice than to always rebuild
if we really need to auto-react to changing system files.

>
> >
> > Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
> > ---
> >   policy/Makefile | 4 ++--
> >   1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/policy/Makefile b/policy/Makefile
> > index a5942b3..cc0f140 100644
> > --- a/policy/Makefile
> > +++ b/policy/Makefile
> > @@ -86,7 +86,7 @@ ifeq (x$(DISTRO),$(filter x$(DISTRO),xRHEL4 xRHEL5 xRHEL6))
> >   TARGETS:=$(filter-out test_overlayfs.te test_mqueue.te test_ibpkey.te, $(TARGETS))
> >   endif
> >
> > -all: build
> > +all: test_policy/test_policy.pp
> >
> >   expand_check:
> >       # Test for "expand-check = 0" in /etc/selinux/semanage.conf
> > @@ -94,7 +94,7 @@ expand_check:
> >               (echo "ERROR: set 'expand-check = 0' in /etc/selinux/semanage.conf"; \
> >                /bin/false)
> >
> > -build: $(TARGETS)
> > +test_policy/test_policy.pp: $(TARGETS) test_policy.if
> >       # General policy build
> >       @if [ -d $(POLDEV) ]; then \
> >               mkdir -p test_policy; \
> >
>


-- 
Ondrej Mosnacek <omosnace at redhat dot com>
Software Engineer, Security Technologies
Red Hat, Inc.


^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH testsuite] policy: do not rebuild policy package if already built
  2019-09-24 10:51   ` Ondrej Mosnacek
@ 2019-09-24 13:58     ` Stephen Smalley
  2019-09-24 17:24       ` Paul Moore
  0 siblings, 1 reply; 6+ messages in thread
From: Stephen Smalley @ 2019-09-24 13:58 UTC (permalink / raw)
  To: Ondrej Mosnacek; +Cc: SElinux list

On 9/24/19 6:51 AM, Ondrej Mosnacek wrote:
> On Mon, Sep 23, 2019 at 4:11 PM Stephen Smalley <sds@tycho.nsa.gov> wrote:
>> On 9/23/19 5:58 AM, Ondrej Mosnacek wrote:
>>> Right now, test_policy.pp is rebuilt on every make invocation. Tweak the
>>> Makefile so that it is only build when it hasn't been built, it has been
>>> cleaned, or the source files changed.
>>
>> It also needs to be rebuilt if anything under
>> /usr/share/selinux/devel/include has changed e.g. upon an update of
>> selinux-policy-devel.
> 
> I am now testing a version that always executes the `$(MAKE) -C
> test_policy -f $(POLDEV)/Makefile test_policy.pp` step, relying on the
> system Makefile to rebuild the pp as needed (there already are proper
> dependencies on the include files). However, the package manager on
> Fedora preserves the timestamps of the installed files (from package
> build time), which means that make doesn't always detect that the
> files are newer than the already built policy package.
> 
> So it looks like we don't have any other choice than to always rebuild
> if we really need to auto-react to changing system files.

I'd rather err on the side of rebuilding too often than using stale policy.

> 
>>
>>>
>>> Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
>>> ---
>>>    policy/Makefile | 4 ++--
>>>    1 file changed, 2 insertions(+), 2 deletions(-)
>>>
>>> diff --git a/policy/Makefile b/policy/Makefile
>>> index a5942b3..cc0f140 100644
>>> --- a/policy/Makefile
>>> +++ b/policy/Makefile
>>> @@ -86,7 +86,7 @@ ifeq (x$(DISTRO),$(filter x$(DISTRO),xRHEL4 xRHEL5 xRHEL6))
>>>    TARGETS:=$(filter-out test_overlayfs.te test_mqueue.te test_ibpkey.te, $(TARGETS))
>>>    endif
>>>
>>> -all: build
>>> +all: test_policy/test_policy.pp
>>>
>>>    expand_check:
>>>        # Test for "expand-check = 0" in /etc/selinux/semanage.conf
>>> @@ -94,7 +94,7 @@ expand_check:
>>>                (echo "ERROR: set 'expand-check = 0' in /etc/selinux/semanage.conf"; \
>>>                 /bin/false)
>>>
>>> -build: $(TARGETS)
>>> +test_policy/test_policy.pp: $(TARGETS) test_policy.if
>>>        # General policy build
>>>        @if [ -d $(POLDEV) ]; then \
>>>                mkdir -p test_policy; \
>>>
>>
> 
> 


^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH testsuite] policy: do not rebuild policy package if already built
  2019-09-24 13:58     ` Stephen Smalley
@ 2019-09-24 17:24       ` Paul Moore
  0 siblings, 0 replies; 6+ messages in thread
From: Paul Moore @ 2019-09-24 17:24 UTC (permalink / raw)
  To: Stephen Smalley; +Cc: Ondrej Mosnacek, SElinux list

On Tue, Sep 24, 2019 at 9:58 AM Stephen Smalley <sds@tycho.nsa.gov> wrote:
> On 9/24/19 6:51 AM, Ondrej Mosnacek wrote:
> > On Mon, Sep 23, 2019 at 4:11 PM Stephen Smalley <sds@tycho.nsa.gov> wrote:
> >> On 9/23/19 5:58 AM, Ondrej Mosnacek wrote:
> >>> Right now, test_policy.pp is rebuilt on every make invocation. Tweak the
> >>> Makefile so that it is only build when it hasn't been built, it has been
> >>> cleaned, or the source files changed.
> >>
> >> It also needs to be rebuilt if anything under
> >> /usr/share/selinux/devel/include has changed e.g. upon an update of
> >> selinux-policy-devel.
> >
> > I am now testing a version that always executes the `$(MAKE) -C
> > test_policy -f $(POLDEV)/Makefile test_policy.pp` step, relying on the
> > system Makefile to rebuild the pp as needed (there already are proper
> > dependencies on the include files). However, the package manager on
> > Fedora preserves the timestamps of the installed files (from package
> > build time), which means that make doesn't always detect that the
> > files are newer than the already built policy package.
> >
> > So it looks like we don't have any other choice than to always rebuild
> > if we really need to auto-react to changing system files.
>
> I'd rather err on the side of rebuilding too often than using stale policy.

That would be my preference as well.  In fact, I actually recommend
doing a 'make clean' before building and running the tests simply to
make sure everything in the dependency list and toolchain is still
working properly with the bits in the test suite.

-- 
paul moore
www.paul-moore.com

^ permalink raw reply	[flat|nested] 6+ messages in thread

end of thread, back to index

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-09-23  9:58 [PATCH testsuite] policy: do not rebuild policy package if already built Ondrej Mosnacek
2019-09-23 10:01 ` Ondrej Mosnacek
2019-09-23 14:11 ` Stephen Smalley
2019-09-24 10:51   ` Ondrej Mosnacek
2019-09-24 13:58     ` Stephen Smalley
2019-09-24 17:24       ` Paul Moore

SELinux Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/selinux/0 selinux/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 selinux selinux/ https://lore.kernel.org/selinux \
		selinux@vger.kernel.org selinux@archiver.kernel.org
	public-inbox-index selinux

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.selinux


AGPL code for this site: git clone https://public-inbox.org/ public-inbox