Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Allow to enable or disable SELinux policy checking #7367

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Allow to enable or disable SELinux policy checking #7367

wants to merge 3 commits into from

Conversation

gportay
Copy link

@gportay gportay commented May 23, 2024 •
edited
Loading

Dear Maintainers,

I am trying to cross-compile (the client) and the ./configure fails because the host machine does not have the file /usr/share/selinux/devel/Makefile installed.

Note: It fails because the macro AC_CHECK_FILE dies if the file is not found and if cross-compiling. The ./configure does not fail if doing native-compiling.

The first patch replaces the use of AC_CHECK_FILE by AS_IF, as in that change in that PR.

The second patch outputs for if the SELinux policy is used or not.

Regards,
Gaël

Fixes:

checking for /usr/share/selinux/devel/Makefile... configure: error: cannot check for file existence when cross compiling

@gportay
Use AS_IF to check for SELinux policy devel
b8d5d3c 
According to the online manual of autoconf[1]:

	Be aware that, like most Autoconf macros, they test a feature of
	the host machine, and therefore, they die when cross-compiling.

This uses the macro AS_IF[2] instead of AC_CHECK_FILE[1] to avoid to die
if the file is not found and if cross-compiling.

[1]: https://www.gnu.org/savannah-checkouts/gnu/autoconf/manual/autoconf-2.72/html_node/Files.html
[2]: https://www.gnu.org/savannah-checkouts/gnu/autoconf/manual/autoconf-2.72/html_node/Common-Shell-Constructs.html#index-AS_005fIF-1

Fixes:

	checking for /usr/share/selinux/devel/Makefile... configure: error: cannot check for file existence when cross compiling

Signed-off-by: Gaël PORTAY <gael.portay@rtone.fr>
@gportay
Output if SELinux policy is used
dc7e307 
This produces the output below if SELinux policy is built:

	build SELinux policy:     yes

Or the output below if it is not built:

	build SELinux policy:     no

Signed-off-by: Gaël PORTAY <gael.portay@rtone.fr>
@gportay
Copy link
Author

gportay commented May 23, 2024

This is a workaround as the configure script checks for an host-file to detect if the SELinux policy is to be built or not, whatever if doing native-or-cross-compiling.

IMO, a --with-option such as --with-selinux-policiy=/usr/share/selinux/devel/Makefile is more appropriate. Either, it could be a simple --enable-option (--enable-selinux-policy?).

What is your opinion?

@gportay gportay changed the title Workaround selinux policy checking if cross compiling Workaround SELinuix policy checking if cross compiling May 23, 2024
@abbra
Copy link
Contributor

abbra commented May 23, 2024

Thanks. Yes, making an enable option is preferred. We can default to enable but you can disable in your cross-compilation build.

@gportay
Add --enable-selinux to enable or disable SELinux explicitly
434368d 
The file /usr/share/selinux/devel/Makefile is used to guess if the
SELinux is to be built or not.

This adds the option --enable-selinux to enable or disable explicitly
the build of the SELlinux policy without the need to check for the file.

Note: If SELinux is not explicitly enabled or disabled, the configure
script still autoguesses if the SELinux policy is to be built by testing
the file existence.

Tested:

	gportay@archlinux ~/src/freeipa $ ./configure --disable-server --with-ipaplatform=base --disable-selinux
	(...)
        build SELinux policy:     no

	gportay@archlinux ~/src/freeipa $ ./configure --disable-server --with-ipaplatform=base --enable-selinux
	(...)
        build SELinux policy:     yes

	gportay@archlinux ~/src/freeipa $ ls -1 /usr/share/selinux/devel/Makefile
	ls: cannot access '/usr/share/selinux/devel/Makefile': No such file or directory
	gportay@archlinux ~/src/freeipa $ ./configure --disable-server --with-ipaplatform=base
	(...)
        build SELinux policy:     no

	gportay@archlinux ~/src/freeipa $ ls -1 /usr/share/selinux/devel/Makefile
	/usr/share/selinux/devel/Makefile
	gportay@archlinux ~/src/freeipa $ ./configure --disable-server --with-ipaplatform=base
        build SELinux policy:     yes

Signed-off-by: Gaël PORTAY <gael.portay@rtone.fr>
@gportay
Copy link
Author

gportay commented May 28, 2024 •
edited
Loading

Hello @abbra, is that the change you requested? ^

@abbra abbra added the re-run Trigger a new run of PR-CI label May 28, 2024
@abbra
Copy link
Contributor

abbra commented May 28, 2024

Yes, this looks good. I launched full CI run.

@gportay gportay changed the title Workaround SELinuix policy checking if cross compiling Allow to enable or disable SELinux policy checking May 28, 2024
@gportay
Copy link
Author

gportay commented May 28, 2024 •
edited
Loading

@abbra Thanks!

I have a question. make install is creating the directory /usr/share/selinux/packages/targeted because it is not conditioned by BUILD_SELINUX_POLICY.

Do you mind if I make a change to not create it if SELinux is disabled? (The directory is empty, I guess).

It could be conditioned in the top Makefile maybe?

if BUILD_SELINUX_POLICY
SUBDIRS += selinux
endif

@freeipa-pr-ci freeipa-pr-ci removed the re-run Trigger a new run of PR-CI label May 28, 2024
@abbra
Copy link
Contributor

abbra commented May 28, 2024

I think it is a side-effect of how automake works with nodist_var_DATA.

If you want to avoid installing even a directory, then the whole

selinuxpolicydir = $(datarootdir)/selinux/packages/$(SELINUXTYPE)
nodist_selinuxpolicy_DATA =     \
        $(MODULE)                               \
        $(NULL)

should be put inside the if BUILD_SELINUX_POLICY statement. The problem with a top level Makefile.am change is that it would cause a release build to fail if someone chooses to create a tarball with --disable-selinux and then run in an environment where SELinux would be detected. What distribution tarball is created, we would not package selinux/ subdirectory then and a top level generated Makefile after wards will be broken.

@gportay
Copy link
Author

gportay commented May 28, 2024

should be put inside the if BUILD_SELINUX_POLICY statement. The problem with a top level Makefile.am change is that it would cause a release build to fail if someone chooses to create a tarball with --disable-selinux and then run in an environment where SELinux would be detected. What distribution tarball is created, we would not package selinux/ subdirectory then and a top level generated Makefile after wards will be broken.

That is why I asked, to not break the world.

I can tackle that later if you want.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@gportay @abbra @freeipa-pr-ci