RFC: introduce new library versions for added symbols

RFC: introduce new library versions for added symbols

[Petr Lautrbach]

I used abi-compliance-checker [1] and compared the latest sources 
with 2.8 release [2].
It looks like there's one symbol added to audit2why.so.

Then I tried the same thing with 2.7 [3] and 2.6 [4] and noticed 
that
there were added new symbols even to LIBSEMANAGE_1.0 while since 
2.3
there's already LIBSEMANAGE_1.1.
It's a bug which breaks automatic dependency checking. So I 
propose
to fix symbol version mappings in order to be in relation with the
release where they was introduced, e.g. for libsemanage:

diff --git a/libsemanage/src/libsemanage.map 
b/libsemanage/src/libsemanage.map
index 02036696..45e90215 100644
--- a/libsemanage/src/libsemanage.map
+++ b/libsemanage/src/libsemanage.map
@@ -18,8 +18,6 @@ LIBSEMANAGE_1.0 {
          semanage_root;
          semanage_user_*; semanage_bool_*; semanage_seuser_*;
          semanage_iface_*; semanage_port_*; semanage_context_*;
-         semanage_ibpkey_*;
-         semanage_ibendport_*;
          semanage_node_*;
          semanage_fcontext_*; semanage_access_check; 
          semanage_set_create_store;
          semanage_is_connected; semanage_get_disable_dontaudit; 
          semanage_set_disable_dontaudit;
@@ -63,3 +61,19 @@ LIBSEMANAGE_1.1 {
          semanage_module_remove_key;
          semanage_set_store_root;
 } LIBSEMANAGE_1.0;
+
+LIBSEMANAGE_2.5 {
+  global:
+    semanage_module_extract;
+} LIBSEMANAGE_1.1;
+
+LIBSEMANAGE_2.7 {
+  global:
+         semanage_ibpkey_*;
+         semanage_ibendport_*;
+} LIBSEMANAGE_2.5;
+
+LIBSEMANAGE_2.8 {
+  global:
+    semanage_fcontext_list_homedirs;
+} LIBSEMANAGE_2.7;


If this is acceptable, I would prepare a patch with symbol 
versions
starting with 2.5 as LIBSEMANAGE_1.1 was introduced in 2.4.

[1] http://lvc.github.io/abi-compliance-checker/
[2] 
https://plautrba.fedorapeople.org/selinux/compat_reports/2.8_to_2.9-rc0/compat_report.html
[3] 
https://plautrba.fedorapeople.org/selinux/compat_reports/2.7_to_2.9-rc0/compat_report.html
[4] 
https://plautrba.fedorapeople.org/selinux/compat_reports/2.6_to_2.9-rc0/compat_report.html

Petr

Re: RFC: introduce new library versions for added symbols

[Stephen Smalley]

On 1/10/19 12:57 PM, Petr Lautrbach wrote:
> I used abi-compliance-checker [1] and compared the latest sources with 
> 2.8 release [2].
> It looks like there's one symbol added to audit2why.so.

audit2why.so needs a .map file or equivalent; it shouldn't be exporting 
all of the libsepol.a symbols.  We don't guarantee ABI or API 
compatibility for anything not in libsepol.map.

> 
> Then I tried the same thing with 2.7 [3] and 2.6 [4] and noticed that
> there were added new symbols even to LIBSEMANAGE_1.0 while since 2.3
> there's already LIBSEMANAGE_1.1.
> It's a bug which breaks automatic dependency checking. So I propose
> to fix symbol version mappings in order to be in relation with the
> release where they was introduced, e.g. for libsemanage:
> 
> diff --git a/libsemanage/src/libsemanage.map 
> b/libsemanage/src/libsemanage.map
> index 02036696..45e90215 100644
> --- a/libsemanage/src/libsemanage.map
> +++ b/libsemanage/src/libsemanage.map
> @@ -18,8 +18,6 @@ LIBSEMANAGE_1.0 {
>           semanage_root;
>           semanage_user_*; semanage_bool_*; semanage_seuser_*;
>           semanage_iface_*; semanage_port_*; semanage_context_*;
> -         semanage_ibpkey_*;
> -         semanage_ibendport_*;
>           semanage_node_*;
>           semanage_fcontext_*; semanage_access_check;          
> semanage_set_create_store;
>           semanage_is_connected; semanage_get_disable_dontaudit; 
>           semanage_set_disable_dontaudit;
> @@ -63,3 +61,19 @@ LIBSEMANAGE_1.1 {
>           semanage_module_remove_key;
>           semanage_set_store_root;
> } LIBSEMANAGE_1.0;
> +
> +LIBSEMANAGE_2.5 {
> +  global:
> +    semanage_module_extract;
> +} LIBSEMANAGE_1.1;
> +
> +LIBSEMANAGE_2.7 {
> +  global:
> +         semanage_ibpkey_*;
> +         semanage_ibendport_*;
> +} LIBSEMANAGE_2.5;
> +
> +LIBSEMANAGE_2.8 {
> +  global:
> +    semanage_fcontext_list_homedirs;
> +} LIBSEMANAGE_2.7;
> 
> 
> If this is acceptable, I would prepare a patch with symbol versions
> starting with 2.5 as LIBSEMANAGE_1.1 was introduced in 2.4.

Will this break compatibility for binaries built against earlier versions?

> 
> [1] http://lvc.github.io/abi-compliance-checker/
> [2] 
> https://plautrba.fedorapeople.org/selinux/compat_reports/2.8_to_2.9-rc0/compat_report.html 
> 
> [3] 
> https://plautrba.fedorapeople.org/selinux/compat_reports/2.7_to_2.9-rc0/compat_report.html 
> 
> [4] 
> https://plautrba.fedorapeople.org/selinux/compat_reports/2.6_to_2.9-rc0/compat_report.html 
> 
> 
> Petr

Re: RFC: introduce new library versions for added symbols

[Petr Lautrbach]

Stephen Smalley <sds@tycho.nsa.gov> writes:

> On 1/10/19 12:57 PM, Petr Lautrbach wrote:
>> I used abi-compliance-checker [1] and compared the latest 
>> sources with 2.8
>> release [2].
>> It looks like there's one symbol added to audit2why.so.
>
> audit2why.so needs a .map file or equivalent; it shouldn't be 
> exporting all of
> the libsepol.a symbols.  We don't guarantee ABI or API 
> compatibility for
> anything not in libsepol.map.
>

I'll prepare a patch for that.

>>
>> Then I tried the same thing with 2.7 [3] and 2.6 [4] and 
>> noticed that
>> there were added new symbols even to LIBSEMANAGE_1.0 while 
>> since 2.3
>> there's already LIBSEMANAGE_1.1.
>> It's a bug which breaks automatic dependency checking. So I 
>> propose
>> to fix symbol version mappings in order to be in relation with 
>> the
>> release where they was introduced, e.g. for libsemanage:
>>
>> diff --git a/libsemanage/src/libsemanage.map 
>> b/libsemanage/src/libsemanage.map
>> index 02036696..45e90215 100644
>> --- a/libsemanage/src/libsemanage.map
>> +++ b/libsemanage/src/libsemanage.map
>> @@ -18,8 +18,6 @@ LIBSEMANAGE_1.0 {
>>   semanage_root;
>>   semanage_user_*; semanage_bool_*; semanage_seuser_*;
>>   semanage_iface_*; semanage_port_*; semanage_context_*;
>> - semanage_ibpkey_*;
>> - semanage_ibendport_*;
>>   semanage_node_*;
>>   semanage_fcontext_*; semanage_access_check;
>> semanage_set_create_store;
>>   semanage_is_connected; semanage_get_disable_dontaudit;  
>> semanage_set_disable_dontaudit;
>> @@ -63,3 +61,19 @@ LIBSEMANAGE_1.1 {
>>   semanage_module_remove_key;
>>   semanage_set_store_root;
>> } LIBSEMANAGE_1.0;
>> +
>> +LIBSEMANAGE_2.5 {
>> + global:
>> + semanage_module_extract;
>> +} LIBSEMANAGE_1.1;
>> +
>> +LIBSEMANAGE_2.7 {
>> + global:
>> + semanage_ibpkey_*;
>> + semanage_ibendport_*;
>> +} LIBSEMANAGE_2.5;
>> +
>> +LIBSEMANAGE_2.8 {
>> + global:
>> + semanage_fcontext_list_homedirs;
>> +} LIBSEMANAGE_2.7;
>>
>>
>> If this is acceptable, I would prepare a patch with symbol 
>> versions
>> starting with 2.5 as LIBSEMANAGE_1.1 was introduced in 2.4.
>
> Will this break compatibility for binaries built against earlier
> versions?

I was under impression that is should be enough to list symbols in
different versions but it looks like a symbol is assigned only to
one/the latest version.

# semodule -B
semodule: relocation error: /lib64/libsemanage.so.1: symbol 
sepol_ibendport_modify version LIBSEPOL_1.0 not defined in file 
libsepol.so.1 with link time reference

I'm still investigating this but given that there's only one 
reported
change between the latest and 2.8 and it  should be covered by 
audit2why
map file, it probably doesn't make sense to do this change 
retroactively now.

Just for the future we need to keep in mind that new symbols needs 
new versions
in .map files.



>
>>
>> [1] http://lvc.github.io/abi-compliance-checker/
>> [2]
>> https://plautrba.fedorapeople.org/selinux/compat_reports/2.8_to_2.9-rc0/compat_report.html 
>>
>> [3]
>> https://plautrba.fedorapeople.org/selinux/compat_reports/2.7_to_2.9-rc0/compat_report.html 
>>
>> [4]
>> https://plautrba.fedorapeople.org/selinux/compat_reports/2.6_to_2.9-rc0/compat_report.html 
>>
>>
>> Petr

Re: RFC: introduce new library versions for added symbols

[Stephen Smalley]

On 1/11/19 7:24 AM, Petr Lautrbach wrote:
> 
> Stephen Smalley <sds@tycho.nsa.gov> writes:
> 
>> On 1/10/19 12:57 PM, Petr Lautrbach wrote:
>>> I used abi-compliance-checker [1] and compared the latest sources 
>>> with 2.8
>>> release [2].
>>> It looks like there's one symbol added to audit2why.so.
>>
>> audit2why.so needs a .map file or equivalent; it shouldn't be 
>> exporting all of
>> the libsepol.a symbols.  We don't guarantee ABI or API compatibility for
>> anything not in libsepol.map.
>>
> 
> I'll prepare a patch for that.

Does audit2why.so actually need to export any symbols other than 
PyInit_audit2why()?  It only gets used for audit2why.

> 
>>>
>>> Then I tried the same thing with 2.7 [3] and 2.6 [4] and noticed that
>>> there were added new symbols even to LIBSEMANAGE_1.0 while since 2.3
>>> there's already LIBSEMANAGE_1.1.
>>> It's a bug which breaks automatic dependency checking. So I propose
>>> to fix symbol version mappings in order to be in relation with the
>>> release where they was introduced, e.g. for libsemanage:
>>>
>>> diff --git a/libsemanage/src/libsemanage.map 
>>> b/libsemanage/src/libsemanage.map
>>> index 02036696..45e90215 100644
>>> --- a/libsemanage/src/libsemanage.map
>>> +++ b/libsemanage/src/libsemanage.map
>>> @@ -18,8 +18,6 @@ LIBSEMANAGE_1.0 {
>>>   semanage_root;
>>>   semanage_user_*; semanage_bool_*; semanage_seuser_*;
>>>   semanage_iface_*; semanage_port_*; semanage_context_*;
>>> - semanage_ibpkey_*;
>>> - semanage_ibendport_*;
>>>   semanage_node_*;
>>>   semanage_fcontext_*; semanage_access_check;
>>> semanage_set_create_store;
>>>   semanage_is_connected; semanage_get_disable_dontaudit; 
>>> semanage_set_disable_dontaudit;
>>> @@ -63,3 +61,19 @@ LIBSEMANAGE_1.1 {
>>>   semanage_module_remove_key;
>>>   semanage_set_store_root;
>>> } LIBSEMANAGE_1.0;
>>> +
>>> +LIBSEMANAGE_2.5 {
>>> + global:
>>> + semanage_module_extract;
>>> +} LIBSEMANAGE_1.1;
>>> +
>>> +LIBSEMANAGE_2.7 {
>>> + global:
>>> + semanage_ibpkey_*;
>>> + semanage_ibendport_*;
>>> +} LIBSEMANAGE_2.5;
>>> +
>>> +LIBSEMANAGE_2.8 {
>>> + global:
>>> + semanage_fcontext_list_homedirs;
>>> +} LIBSEMANAGE_2.7;
>>>
>>>
>>> If this is acceptable, I would prepare a patch with symbol versions
>>> starting with 2.5 as LIBSEMANAGE_1.1 was introduced in 2.4.
>>
>> Will this break compatibility for binaries built against earlier
>> versions?
> 
> I was under impression that is should be enough to list symbols in
> different versions but it looks like a symbol is assigned only to
> one/the latest version.
> 
> # semodule -B
> semodule: relocation error: /lib64/libsemanage.so.1: symbol 
> sepol_ibendport_modify version LIBSEPOL_1.0 not defined in file 
> libsepol.so.1 with link time reference
> 
> I'm still investigating this but given that there's only one reported
> change between the latest and 2.8 and it  should be covered by audit2why
> map file, it probably doesn't make sense to do this change retroactively 
> now.
> 
> Just for the future we need to keep in mind that new symbols needs new 
> versions
> in .map files.
> 
> 
> 
>>
>>>
>>> [1] http://lvc.github.io/abi-compliance-checker/
>>> [2]
>>> https://plautrba.fedorapeople.org/selinux/compat_reports/2.8_to_2.9-rc0/compat_report.html 
>>>
>>> [3]
>>> https://plautrba.fedorapeople.org/selinux/compat_reports/2.7_to_2.9-rc0/compat_report.html 
>>>
>>> [4]
>>> https://plautrba.fedorapeople.org/selinux/compat_reports/2.6_to_2.9-rc0/compat_report.html 
>>>
>>>
>>> Petr
> 

[PATCH] libselinux/audit2why.so: Filter out non-python related symbols

[Petr Lautrbach]

audit2why.so used to export libsepol.a symbols. We only need Python related
symbols:

- initaudit2why for python 2
- PyInit_audit2why for python3

Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
---
 libselinux/src/Makefile      | 2 +-
 libselinux/src/audit2why.map | 6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)
 create mode 100644 libselinux/src/audit2why.map

diff --git a/libselinux/src/Makefile b/libselinux/src/Makefile
index 8891086e..92e30738 100644
--- a/libselinux/src/Makefile
+++ b/libselinux/src/Makefile
@@ -165,7 +165,7 @@ $(AUDIT2WHYLOBJ): audit2why.c
 	$(CC) $(filter-out -Werror, $(CFLAGS)) $(PYINC) -fPIC -DSHARED -c -o $@ $<
 
 $(AUDIT2WHYSO): $(AUDIT2WHYLOBJ) $(LIBSEPOLA)
-	$(CC) $(CFLAGS) $(LDFLAGS) -L. -shared -o $@ $^ -lselinux $(LDLIBS_LIBSEPOLA) $(PYLIBS)
+	$(CC) $(CFLAGS) $(LDFLAGS) -L. -shared -o $@ $^ -lselinux $(LDLIBS_LIBSEPOLA) $(PYLIBS) -Wl,-soname,audit2why.so,--version-script=audit2why.map,-z,defs
 
 %.o:  %.c policy.h
 	$(CC) $(CFLAGS) $(TLSFLAGS) -c -o $@ $<
diff --git a/libselinux/src/audit2why.map b/libselinux/src/audit2why.map
new file mode 100644
index 00000000..65989a8d
--- /dev/null
+++ b/libselinux/src/audit2why.map
@@ -0,0 +1,6 @@
+AUDIT2WHY_2.9 {
+  global:
+    initaudit2why;
+    PyInit_audit2why;
+  local: *;
+};
-- 
2.20.1

Re: [PATCH] libselinux/audit2why.so: Filter out non-python related symbols

[Stephen Smalley]

On 1/15/19 8:36 AM, Petr Lautrbach wrote:
> audit2why.so used to export libsepol.a symbols. We only need Python related
> symbols:
> 
> - initaudit2why for python 2
> - PyInit_audit2why for python3
> 
> Signed-off-by: Petr Lautrbach <plautrba@redhat.com>

Acked-by: Stephen Smalley <sds@tycho.nsa.gov>

> ---
>   libselinux/src/Makefile      | 2 +-
>   libselinux/src/audit2why.map | 6 ++++++
>   2 files changed, 7 insertions(+), 1 deletion(-)
>   create mode 100644 libselinux/src/audit2why.map
> 
> diff --git a/libselinux/src/Makefile b/libselinux/src/Makefile
> index 8891086e..92e30738 100644
> --- a/libselinux/src/Makefile
> +++ b/libselinux/src/Makefile
> @@ -165,7 +165,7 @@ $(AUDIT2WHYLOBJ): audit2why.c
>   	$(CC) $(filter-out -Werror, $(CFLAGS)) $(PYINC) -fPIC -DSHARED -c -o $@ $<
>   
>   $(AUDIT2WHYSO): $(AUDIT2WHYLOBJ) $(LIBSEPOLA)
> -	$(CC) $(CFLAGS) $(LDFLAGS) -L. -shared -o $@ $^ -lselinux $(LDLIBS_LIBSEPOLA) $(PYLIBS)
> +	$(CC) $(CFLAGS) $(LDFLAGS) -L. -shared -o $@ $^ -lselinux $(LDLIBS_LIBSEPOLA) $(PYLIBS) -Wl,-soname,audit2why.so,--version-script=audit2why.map,-z,defs
>   
>   %.o:  %.c policy.h
>   	$(CC) $(CFLAGS) $(TLSFLAGS) -c -o $@ $<
> diff --git a/libselinux/src/audit2why.map b/libselinux/src/audit2why.map
> new file mode 100644
> index 00000000..65989a8d
> --- /dev/null
> +++ b/libselinux/src/audit2why.map
> @@ -0,0 +1,6 @@
> +AUDIT2WHY_2.9 {
> +  global:
> +    initaudit2why;
> +    PyInit_audit2why;
> +  local: *;
> +};
> 

Re: [PATCH] libselinux/audit2why.so: Filter out non-python related symbols

[Stephen Smalley]

On 1/15/19 8:36 AM, Petr Lautrbach wrote:
> audit2why.so used to export libsepol.a symbols. We only need Python related
> symbols:
> 
> - initaudit2why for python 2
> - PyInit_audit2why for python3
> 
> Signed-off-by: Petr Lautrbach <plautrba@redhat.com>

I submitted a pull request to trigger Travis CI of this change here:
https://github.com/SELinuxProject/selinux/pull/130

> ---
>   libselinux/src/Makefile      | 2 +-
>   libselinux/src/audit2why.map | 6 ++++++
>   2 files changed, 7 insertions(+), 1 deletion(-)
>   create mode 100644 libselinux/src/audit2why.map
> 
> diff --git a/libselinux/src/Makefile b/libselinux/src/Makefile
> index 8891086e..92e30738 100644
> --- a/libselinux/src/Makefile
> +++ b/libselinux/src/Makefile
> @@ -165,7 +165,7 @@ $(AUDIT2WHYLOBJ): audit2why.c
>   	$(CC) $(filter-out -Werror, $(CFLAGS)) $(PYINC) -fPIC -DSHARED -c -o $@ $<
>   
>   $(AUDIT2WHYSO): $(AUDIT2WHYLOBJ) $(LIBSEPOLA)
> -	$(CC) $(CFLAGS) $(LDFLAGS) -L. -shared -o $@ $^ -lselinux $(LDLIBS_LIBSEPOLA) $(PYLIBS)
> +	$(CC) $(CFLAGS) $(LDFLAGS) -L. -shared -o $@ $^ -lselinux $(LDLIBS_LIBSEPOLA) $(PYLIBS) -Wl,-soname,audit2why.so,--version-script=audit2why.map,-z,defs
>   
>   %.o:  %.c policy.h
>   	$(CC) $(CFLAGS) $(TLSFLAGS) -c -o $@ $<
> diff --git a/libselinux/src/audit2why.map b/libselinux/src/audit2why.map
> new file mode 100644
> index 00000000..65989a8d
> --- /dev/null
> +++ b/libselinux/src/audit2why.map
> @@ -0,0 +1,6 @@
> +AUDIT2WHY_2.9 {
> +  global:
> +    initaudit2why;
> +    PyInit_audit2why;
> +  local: *;
> +};
> 

Re: [PATCH] libselinux/audit2why.so: Filter out non-python related symbols

[Stephen Smalley]

On 1/17/19 9:18 AM, Stephen Smalley wrote:
> On 1/15/19 8:36 AM, Petr Lautrbach wrote:
>> audit2why.so used to export libsepol.a symbols. We only need Python 
>> related
>> symbols:
>>
>> - initaudit2why for python 2
>> - PyInit_audit2why for python3
>>
>> Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
> 
> I submitted a pull request to trigger Travis CI of this change here:
> https://github.com/SELinuxProject/selinux/pull/130

Hmm...broke the build when using PYVER=pypy3.5.

python-3.5audit2why.lo: In function `PyInit_audit2why':
audit2why.c:(.text+0xe): undefined reference to `PyPyModule_Create2'
audit2why.c:(.text+0x30): undefined reference to `PyPyModule_AddIntConstant'
audit2why.c:(.text+0x46): undefined reference to `PyPyModule_AddIntConstant'
audit2why.c:(.text+0x5c): undefined reference to `PyPyModule_AddIntConstant'
audit2why.c:(.text+0x72): undefined reference to `PyPyModule_AddIntConstant'
audit2why.c:(.text+0x88): undefined reference to `PyPyModule_AddIntConstant'
python-3.5audit2why.lo:audit2why.c:(.text+0x9e): more undefined 
references to `PyPyModule_AddIntConstant' follow
python-3.5audit2why.lo: In function `init':
audit2why.c:(.text+0x170): undefined reference to `PyPyExc_RuntimeError'
audit2why.c:(.text+0x17f): undefined reference to `PyPyErr_SetString'
audit2why.c:(.text+0x1a1): undefined reference to `PyPyArg_ParseTuple'
audit2why.c:(.text+0x2c0): undefined reference to `PyPyExc_RuntimeError'
audit2why.c:(.text+0x2cf): undefined reference to `PyPyExc_MemoryError'
audit2why.c:(.text+0x2de): undefined reference to `PyPyErr_SetString'
audit2why.c:(.text+0x329): undefined reference to `PyPyExc_ValueError'
audit2why.c:(.text+0x367): undefined reference to `PyPyExc_ValueError'
audit2why.c:(.text+0x372): undefined reference to `PyPyErr_SetString'
audit2why.c:(.text+0x387): undefined reference to `PyPy_BuildValue'
audit2why.c:(.text+0x3e6): undefined reference to `PyPyExc_ValueError'
audit2why.c:(.text+0x49a): undefined reference to `PyPyExc_RuntimeError'
audit2why.c:(.text+0x4b0): undefined reference to `PyPyExc_MemoryError'
audit2why.c:(.text+0x4c6): undefined reference to `PyPyExc_RuntimeError'
audit2why.c:(.text+0x4d5): undefined reference to `PyPyErr_SetString'
python-3.5audit2why.lo: In function `analyze':
audit2why.c:(.text+0x51d): undefined reference to `PyPyList_Type'
audit2why.c:(.text+0x53d): undefined reference to `PyPyArg_ParseTuple'
audit2why.c:(.text+0x553): undefined reference to `PyPyList_Size'
audit2why.c:(.text+0x5f9): undefined reference to `PyPyList_GetItem'
audit2why.c:(.text+0x601): undefined reference to `PyPyUnicode_AsUTF8'
audit2why.c:(.text+0x63f): undefined reference to `_PyPy_NoneStruct'
audit2why.c:(.text+0x657): undefined reference to `_PyPy_NoneStruct'
audit2why.c:(.text+0x66f): undefined reference to `_PyPy_NoneStruct'
audit2why.c:(.text+0x687): undefined reference to `_PyPy_NoneStruct'
audit2why.c:(.text+0x6f5): undefined reference to `_PyPy_NoneStruct'
python-3.5audit2why.lo:audit2why.c:(.text+0x70a): more undefined 
references to `_PyPy_NoneStruct' follow
python-3.5audit2why.lo: In function `analyze':
audit2why.c:(.text+0x728): undefined reference to `PyPy_BuildValue'
audit2why.c:(.text+0x90b): undefined reference to `PyPyExc_RuntimeError'
audit2why.c:(.text+0x91a): undefined reference to `PyPyErr_SetString'
audit2why.c:(.text+0x93c): undefined reference to `PyPy_BuildValue'
audit2why.c:(.text+0x955): undefined reference to `PyPyExc_MemoryError'
audit2why.c:(.text+0x964): undefined reference to `PyPyErr_SetString'
audit2why.c:(.text+0x981): undefined reference to `_PyPy_NoneStruct'
audit2why.c:(.text+0x9a0): undefined reference to `_PyPy_NoneStruct'
audit2why.c:(.text+0x9b8): undefined reference to `_PyPy_NoneStruct'
audit2why.c:(.text+0x9f3): undefined reference to `PyPyExc_RuntimeError'
audit2why.c:(.text+0x9fe): undefined reference to `PyPyErr_SetString'
audit2why.c:(.text+0xa3f): undefined reference to `PyPyExc_RuntimeError'
audit2why.c:(.text+0xa4f): undefined reference to `PyPyErr_SetString'
audit2why.c:(.text+0xb18): undefined reference to `_PyPy_NoneStruct'
audit2why.c:(.text+0xb2e): undefined reference to `PyPyList_New'
audit2why.c:(.text+0xb56): undefined reference to `PyPy_BuildValue'
audit2why.c:(.text+0xb68): undefined reference to `PyPyList_SetItem'
python-3.5audit2why.lo: In function `finish':
audit2why.c:(.text+0xbb3): undefined reference to `PyPyArg_ParseTuple'
audit2why.c:(.text+0xc7d): undefined reference to `_PyPy_NoneStruct'
clang-7: error: linker command failed with exit code 1 (use -v to see 
invocation)
Makefile:168: recipe for target 'python-3.5audit2why.so' failed

> 
>> ---
>>   libselinux/src/Makefile      | 2 +-
>>   libselinux/src/audit2why.map | 6 ++++++
>>   2 files changed, 7 insertions(+), 1 deletion(-)
>>   create mode 100644 libselinux/src/audit2why.map
>>
>> diff --git a/libselinux/src/Makefile b/libselinux/src/Makefile
>> index 8891086e..92e30738 100644
>> --- a/libselinux/src/Makefile
>> +++ b/libselinux/src/Makefile
>> @@ -165,7 +165,7 @@ $(AUDIT2WHYLOBJ): audit2why.c
>>       $(CC) $(filter-out -Werror, $(CFLAGS)) $(PYINC) -fPIC -DSHARED 
>> -c -o $@ $<
>>   $(AUDIT2WHYSO): $(AUDIT2WHYLOBJ) $(LIBSEPOLA)
>> -    $(CC) $(CFLAGS) $(LDFLAGS) -L. -shared -o $@ $^ -lselinux 
>> $(LDLIBS_LIBSEPOLA) $(PYLIBS)
>> +    $(CC) $(CFLAGS) $(LDFLAGS) -L. -shared -o $@ $^ -lselinux 
>> $(LDLIBS_LIBSEPOLA) $(PYLIBS) 
>> -Wl,-soname,audit2why.so,--version-script=audit2why.map,-z,defs
>>   %.o:  %.c policy.h
>>       $(CC) $(CFLAGS) $(TLSFLAGS) -c -o $@ $<
>> diff --git a/libselinux/src/audit2why.map b/libselinux/src/audit2why.map
>> new file mode 100644
>> index 00000000..65989a8d
>> --- /dev/null
>> +++ b/libselinux/src/audit2why.map
>> @@ -0,0 +1,6 @@
>> +AUDIT2WHY_2.9 {
>> +  global:
>> +    initaudit2why;
>> +    PyInit_audit2why;
>> +  local: *;
>> +};
>>
> 

Re: [PATCH] libselinux/audit2why.so: Filter out non-python related symbols

[Petr Lautrbach]

Stephen Smalley <sds@tycho.nsa.gov> writes:

> On 1/17/19 9:18 AM, Stephen Smalley wrote:
>> On 1/15/19 8:36 AM, Petr Lautrbach wrote:
>>> audit2why.so used to export libsepol.a symbols. We only need Python related
>>> symbols:
>>>
>>> - initaudit2why for python 2
>>> - PyInit_audit2why for python3
>>>
>>> Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
>>
>> I submitted a pull request to trigger Travis CI of this change here:
>> https://github.com/SELinuxProject/selinux/pull/130
>
> Hmm...broke the build when using PYVER=pypy3.5.

This is fixed by the latest patches sent by Nicolas:

https://github.com/bachradsusi/SELinuxProject-selinux/commits/audit2why.so-with-travis-fixes
https://travis-ci.org/bachradsusi/SELinuxProject-selinux/builds/482366289


> python-3.5audit2why.lo: In function `PyInit_audit2why':
> audit2why.c:(.text+0xe): undefined reference to `PyPyModule_Create2'
> audit2why.c:(.text+0x30): undefined reference to `PyPyModule_AddIntConstant'
> audit2why.c:(.text+0x46): undefined reference to `PyPyModule_AddIntConstant'
> audit2why.c:(.text+0x5c): undefined reference to `PyPyModule_AddIntConstant'
> audit2why.c:(.text+0x72): undefined reference to `PyPyModule_AddIntConstant'
> audit2why.c:(.text+0x88): undefined reference to `PyPyModule_AddIntConstant'
> python-3.5audit2why.lo:audit2why.c:(.text+0x9e): more undefined references to
> `PyPyModule_AddIntConstant' follow
> python-3.5audit2why.lo: In function `init':
> audit2why.c:(.text+0x170): undefined reference to `PyPyExc_RuntimeError'
> audit2why.c:(.text+0x17f): undefined reference to `PyPyErr_SetString'
> audit2why.c:(.text+0x1a1): undefined reference to `PyPyArg_ParseTuple'
> audit2why.c:(.text+0x2c0): undefined reference to `PyPyExc_RuntimeError'
> audit2why.c:(.text+0x2cf): undefined reference to `PyPyExc_MemoryError'
> audit2why.c:(.text+0x2de): undefined reference to `PyPyErr_SetString'
> audit2why.c:(.text+0x329): undefined reference to `PyPyExc_ValueError'
> audit2why.c:(.text+0x367): undefined reference to `PyPyExc_ValueError'
> audit2why.c:(.text+0x372): undefined reference to `PyPyErr_SetString'
> audit2why.c:(.text+0x387): undefined reference to `PyPy_BuildValue'
> audit2why.c:(.text+0x3e6): undefined reference to `PyPyExc_ValueError'
> audit2why.c:(.text+0x49a): undefined reference to `PyPyExc_RuntimeError'
> audit2why.c:(.text+0x4b0): undefined reference to `PyPyExc_MemoryError'
> audit2why.c:(.text+0x4c6): undefined reference to `PyPyExc_RuntimeError'
> audit2why.c:(.text+0x4d5): undefined reference to `PyPyErr_SetString'
> python-3.5audit2why.lo: In function `analyze':
> audit2why.c:(.text+0x51d): undefined reference to `PyPyList_Type'
> audit2why.c:(.text+0x53d): undefined reference to `PyPyArg_ParseTuple'
> audit2why.c:(.text+0x553): undefined reference to `PyPyList_Size'
> audit2why.c:(.text+0x5f9): undefined reference to `PyPyList_GetItem'
> audit2why.c:(.text+0x601): undefined reference to `PyPyUnicode_AsUTF8'
> audit2why.c:(.text+0x63f): undefined reference to `_PyPy_NoneStruct'
> audit2why.c:(.text+0x657): undefined reference to `_PyPy_NoneStruct'
> audit2why.c:(.text+0x66f): undefined reference to `_PyPy_NoneStruct'
> audit2why.c:(.text+0x687): undefined reference to `_PyPy_NoneStruct'
> audit2why.c:(.text+0x6f5): undefined reference to `_PyPy_NoneStruct'
> python-3.5audit2why.lo:audit2why.c:(.text+0x70a): more undefined references to
> `_PyPy_NoneStruct' follow
> python-3.5audit2why.lo: In function `analyze':
> audit2why.c:(.text+0x728): undefined reference to `PyPy_BuildValue'
> audit2why.c:(.text+0x90b): undefined reference to `PyPyExc_RuntimeError'
> audit2why.c:(.text+0x91a): undefined reference to `PyPyErr_SetString'
> audit2why.c:(.text+0x93c): undefined reference to `PyPy_BuildValue'
> audit2why.c:(.text+0x955): undefined reference to `PyPyExc_MemoryError'
> audit2why.c:(.text+0x964): undefined reference to `PyPyErr_SetString'
> audit2why.c:(.text+0x981): undefined reference to `_PyPy_NoneStruct'
> audit2why.c:(.text+0x9a0): undefined reference to `_PyPy_NoneStruct'
> audit2why.c:(.text+0x9b8): undefined reference to `_PyPy_NoneStruct'
> audit2why.c:(.text+0x9f3): undefined reference to `PyPyExc_RuntimeError'
> audit2why.c:(.text+0x9fe): undefined reference to `PyPyErr_SetString'
> audit2why.c:(.text+0xa3f): undefined reference to `PyPyExc_RuntimeError'
> audit2why.c:(.text+0xa4f): undefined reference to `PyPyErr_SetString'
> audit2why.c:(.text+0xb18): undefined reference to `_PyPy_NoneStruct'
> audit2why.c:(.text+0xb2e): undefined reference to `PyPyList_New'
> audit2why.c:(.text+0xb56): undefined reference to `PyPy_BuildValue'
> audit2why.c:(.text+0xb68): undefined reference to `PyPyList_SetItem'
> python-3.5audit2why.lo: In function `finish':
> audit2why.c:(.text+0xbb3): undefined reference to `PyPyArg_ParseTuple'
> audit2why.c:(.text+0xc7d): undefined reference to `_PyPy_NoneStruct'
> clang-7: error: linker command failed with exit code 1 (use -v to see
> invocation)
> Makefile:168: recipe for target 'python-3.5audit2why.so' failed
>
>>
>>> ---
>>>   libselinux/src/Makefile      | 2 +-
>>>   libselinux/src/audit2why.map | 6 ++++++
>>>   2 files changed, 7 insertions(+), 1 deletion(-)
>>>   create mode 100644 libselinux/src/audit2why.map
>>>
>>> diff --git a/libselinux/src/Makefile b/libselinux/src/Makefile
>>> index 8891086e..92e30738 100644
>>> --- a/libselinux/src/Makefile
>>> +++ b/libselinux/src/Makefile
>>> @@ -165,7 +165,7 @@ $(AUDIT2WHYLOBJ): audit2why.c
>>>       $(CC) $(filter-out -Werror, $(CFLAGS)) $(PYINC) -fPIC -DSHARED -c -o $@
>>> $<
>>>   $(AUDIT2WHYSO): $(AUDIT2WHYLOBJ) $(LIBSEPOLA)
>>> -    $(CC) $(CFLAGS) $(LDFLAGS) -L. -shared -o $@ $^ -lselinux
>>> $(LDLIBS_LIBSEPOLA) $(PYLIBS)
>>> +    $(CC) $(CFLAGS) $(LDFLAGS) -L. -shared -o $@ $^ -lselinux
>>> $(LDLIBS_LIBSEPOLA) $(PYLIBS)
>>> -Wl,-soname,audit2why.so,--version-script=audit2why.map,-z,defs
>>>   %.o:  %.c policy.h
>>>       $(CC) $(CFLAGS) $(TLSFLAGS) -c -o $@ $<
>>> diff --git a/libselinux/src/audit2why.map b/libselinux/src/audit2why.map
>>> new file mode 100644
>>> index 00000000..65989a8d
>>> --- /dev/null
>>> +++ b/libselinux/src/audit2why.map
>>> @@ -0,0 +1,6 @@
>>> +AUDIT2WHY_2.9 {
>>> +  global:
>>> +    initaudit2why;
>>> +    PyInit_audit2why;
>>> +  local: *;
>>> +};
>>>
>>

Re: [PATCH] libselinux/audit2why.so: Filter out non-python related symbols

[Petr Lautrbach]

Petr Lautrbach <plautrba@redhat.com> writes:

> Stephen Smalley <sds@tycho.nsa.gov> writes:
>
>> On 1/17/19 9:18 AM, Stephen Smalley wrote:
>>> On 1/15/19 8:36 AM, Petr Lautrbach wrote:
>>>> audit2why.so used to export libsepol.a symbols. We only need Python related
>>>> symbols:
>>>>
>>>> - initaudit2why for python 2
>>>> - PyInit_audit2why for python3
>>>>
>>>> Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
>>>
>>> I submitted a pull request to trigger Travis CI of this change here:
>>> https://github.com/SELinuxProject/selinux/pull/130
>>
>> Hmm...broke the build when using PYVER=pypy3.5.
>
> This is fixed by the latest patches sent by Nicolas:
>
> https://github.com/bachradsusi/SELinuxProject-selinux/commits/audit2why.so-with-travis-fixes
> https://travis-ci.org/bachradsusi/SELinuxProject-selinux/builds/482366289

Given that this all Travis CI tests passed and it's acked, I've merged
the patch.

The last CI run based on the merged patch is https://travis-ci.org/SELinuxProject/selinux/builds/483832670

>
>> python-3.5audit2why.lo: In function `PyInit_audit2why':
>> audit2why.c:(.text+0xe): undefined reference to `PyPyModule_Create2'
>> audit2why.c:(.text+0x30): undefined reference to `PyPyModule_AddIntConstant'
>> audit2why.c:(.text+0x46): undefined reference to `PyPyModule_AddIntConstant'
>> audit2why.c:(.text+0x5c): undefined reference to `PyPyModule_AddIntConstant'
>> audit2why.c:(.text+0x72): undefined reference to `PyPyModule_AddIntConstant'
>> audit2why.c:(.text+0x88): undefined reference to `PyPyModule_AddIntConstant'
>> python-3.5audit2why.lo:audit2why.c:(.text+0x9e): more undefined references to
>> `PyPyModule_AddIntConstant' follow
>> python-3.5audit2why.lo: In function `init':
>> audit2why.c:(.text+0x170): undefined reference to `PyPyExc_RuntimeError'
>> audit2why.c:(.text+0x17f): undefined reference to `PyPyErr_SetString'
>> audit2why.c:(.text+0x1a1): undefined reference to `PyPyArg_ParseTuple'
>> audit2why.c:(.text+0x2c0): undefined reference to `PyPyExc_RuntimeError'
>> audit2why.c:(.text+0x2cf): undefined reference to `PyPyExc_MemoryError'
>> audit2why.c:(.text+0x2de): undefined reference to `PyPyErr_SetString'
>> audit2why.c:(.text+0x329): undefined reference to `PyPyExc_ValueError'
>> audit2why.c:(.text+0x367): undefined reference to `PyPyExc_ValueError'
>> audit2why.c:(.text+0x372): undefined reference to `PyPyErr_SetString'
>> audit2why.c:(.text+0x387): undefined reference to `PyPy_BuildValue'
>> audit2why.c:(.text+0x3e6): undefined reference to `PyPyExc_ValueError'
>> audit2why.c:(.text+0x49a): undefined reference to `PyPyExc_RuntimeError'
>> audit2why.c:(.text+0x4b0): undefined reference to `PyPyExc_MemoryError'
>> audit2why.c:(.text+0x4c6): undefined reference to `PyPyExc_RuntimeError'
>> audit2why.c:(.text+0x4d5): undefined reference to `PyPyErr_SetString'
>> python-3.5audit2why.lo: In function `analyze':
>> audit2why.c:(.text+0x51d): undefined reference to `PyPyList_Type'
>> audit2why.c:(.text+0x53d): undefined reference to `PyPyArg_ParseTuple'
>> audit2why.c:(.text+0x553): undefined reference to `PyPyList_Size'
>> audit2why.c:(.text+0x5f9): undefined reference to `PyPyList_GetItem'
>> audit2why.c:(.text+0x601): undefined reference to `PyPyUnicode_AsUTF8'
>> audit2why.c:(.text+0x63f): undefined reference to `_PyPy_NoneStruct'
>> audit2why.c:(.text+0x657): undefined reference to `_PyPy_NoneStruct'
>> audit2why.c:(.text+0x66f): undefined reference to `_PyPy_NoneStruct'
>> audit2why.c:(.text+0x687): undefined reference to `_PyPy_NoneStruct'
>> audit2why.c:(.text+0x6f5): undefined reference to `_PyPy_NoneStruct'
>> python-3.5audit2why.lo:audit2why.c:(.text+0x70a): more undefined references to
>> `_PyPy_NoneStruct' follow
>> python-3.5audit2why.lo: In function `analyze':
>> audit2why.c:(.text+0x728): undefined reference to `PyPy_BuildValue'
>> audit2why.c:(.text+0x90b): undefined reference to `PyPyExc_RuntimeError'
>> audit2why.c:(.text+0x91a): undefined reference to `PyPyErr_SetString'
>> audit2why.c:(.text+0x93c): undefined reference to `PyPy_BuildValue'
>> audit2why.c:(.text+0x955): undefined reference to `PyPyExc_MemoryError'
>> audit2why.c:(.text+0x964): undefined reference to `PyPyErr_SetString'
>> audit2why.c:(.text+0x981): undefined reference to `_PyPy_NoneStruct'
>> audit2why.c:(.text+0x9a0): undefined reference to `_PyPy_NoneStruct'
>> audit2why.c:(.text+0x9b8): undefined reference to `_PyPy_NoneStruct'
>> audit2why.c:(.text+0x9f3): undefined reference to `PyPyExc_RuntimeError'
>> audit2why.c:(.text+0x9fe): undefined reference to `PyPyErr_SetString'
>> audit2why.c:(.text+0xa3f): undefined reference to `PyPyExc_RuntimeError'
>> audit2why.c:(.text+0xa4f): undefined reference to `PyPyErr_SetString'
>> audit2why.c:(.text+0xb18): undefined reference to `_PyPy_NoneStruct'
>> audit2why.c:(.text+0xb2e): undefined reference to `PyPyList_New'
>> audit2why.c:(.text+0xb56): undefined reference to `PyPy_BuildValue'
>> audit2why.c:(.text+0xb68): undefined reference to `PyPyList_SetItem'
>> python-3.5audit2why.lo: In function `finish':
>> audit2why.c:(.text+0xbb3): undefined reference to `PyPyArg_ParseTuple'
>> audit2why.c:(.text+0xc7d): undefined reference to `_PyPy_NoneStruct'
>> clang-7: error: linker command failed with exit code 1 (use -v to see
>> invocation)
>> Makefile:168: recipe for target 'python-3.5audit2why.so' failed
>>
>>>
>>>> ---
>>>>   libselinux/src/Makefile      | 2 +-
>>>>   libselinux/src/audit2why.map | 6 ++++++
>>>>   2 files changed, 7 insertions(+), 1 deletion(-)
>>>>   create mode 100644 libselinux/src/audit2why.map
>>>>
>>>> diff --git a/libselinux/src/Makefile b/libselinux/src/Makefile
>>>> index 8891086e..92e30738 100644
>>>> --- a/libselinux/src/Makefile
>>>> +++ b/libselinux/src/Makefile
>>>> @@ -165,7 +165,7 @@ $(AUDIT2WHYLOBJ): audit2why.c
>>>>       $(CC) $(filter-out -Werror, $(CFLAGS)) $(PYINC) -fPIC -DSHARED -c -o $@
>>>> $<
>>>>   $(AUDIT2WHYSO): $(AUDIT2WHYLOBJ) $(LIBSEPOLA)
>>>> -    $(CC) $(CFLAGS) $(LDFLAGS) -L. -shared -o $@ $^ -lselinux
>>>> $(LDLIBS_LIBSEPOLA) $(PYLIBS)
>>>> +    $(CC) $(CFLAGS) $(LDFLAGS) -L. -shared -o $@ $^ -lselinux
>>>> $(LDLIBS_LIBSEPOLA) $(PYLIBS)
>>>> -Wl,-soname,audit2why.so,--version-script=audit2why.map,-z,defs
>>>>   %.o:  %.c policy.h
>>>>       $(CC) $(CFLAGS) $(TLSFLAGS) -c -o $@ $<
>>>> diff --git a/libselinux/src/audit2why.map b/libselinux/src/audit2why.map
>>>> new file mode 100644
>>>> index 00000000..65989a8d
>>>> --- /dev/null
>>>> +++ b/libselinux/src/audit2why.map
>>>> @@ -0,0 +1,6 @@
>>>> +AUDIT2WHY_2.9 {
>>>> +  global:
>>>> +    initaudit2why;
>>>> +    PyInit_audit2why;
>>>> +  local: *;
>>>> +};
>>>>
>>>