remove obsolete selinux modules #23568

plsph · 2021-12-29T19:57:37Z

Add cleanup actions to post installation step by identifying removed modules from OLD_MODS list, that is copy from previous ebuild and remove it from selinux module store if installed.

One must maintain OLD_MODS list on each new ebuild by copying it from previous MODS list.

gentoo-bot · 2021-12-29T20:00:05Z

Pull Request assignment

Submitter: @plsph
Areas affected: ebuilds
Packages affected: sec-policy/selinux-base-policy

sec-policy/selinux-base-policy: @gentoo/selinux

Linked bugs

No bugs to link found. If your pull request references any of the Gentoo bug reports, please add appropriate GLEP 66 tags to the commit message and request reassignment.

If you do not receive any reply to this pull request, please open or link a bug to attract the attention of maintainers.

Missing GCO sign-off

Please read the terms of Gentoo Certificate of Origin and acknowledge them by adding a sign-off to all your commits.

In order to force reassignment and/or bug reference scan, please append [please reassign] to the pull request title.

Docs: Code of Conduct ● Copyright policy (expl.) ● Devmanual ● GitHub PRs ● Proxy-maint guide

gentoo-repo-qa-bot · 2021-12-29T20:11:05Z

Pull request CI report

Report generated at: 2021-12-29 20:11 UTC
Newest commit scanned: df04fd5
Status: ✅ good

There are existing issues already. Please look into the report to make sure none of them affect the packages in question:
https://qa-reports.gentoo.org/output/gentoo-ci/1cd733992d/output.html

Signed-off-by: Grzegorz Filo <gf578@wp.pl>

gentoo-repo-qa-bot · 2021-12-30T14:25:56Z

Pull request CI report

Report generated at: 2021-12-30 14:25 UTC
Newest commit scanned: e409b5d
Status: ✅ good

There are existing issues already. Please look into the report to make sure none of them affect the packages in question:
https://qa-reports.gentoo.org/output/gentoo-ci/1df98198c6/output.html

perfinion

Good catch on the hotplug removal! this looks pretty good, just would prefer a small change which should be easier to maintain going forward :)

Thanks and happy new year!

perfinion · 2021-12-31T20:28:10Z

sec-policy/selinux-base-policy/selinux-base-policy-2.20210203-r1.ebuild

@@ -27,6 +27,7 @@ BDEPEND="
 	sys-apps/checkpolicy
 	sys-devel/m4"

+OLD_MODS="application authlogin bootloader clock consoletype cron dmesg fstools getty hostname hotplug init iptables libraries locallogin logging lvm miscfiles modutils mount mta netutils nscd portage raid rsync selinuxutil setrans ssh staff storage su sysadm sysnetwork systemd tmpfiles udev userdomain usermanage unprivuser xdg"


ooh good catch on the hotplug removal. This mostly looks good but i think i'd rather change OLD_MODS to just be the list of modules to remove instead of needing to be a copy of all of them. that'd be less of a maintenance burden i think,
The issue is I have bumps scripted so copying MODS to OLD_MODS is complicated. also I'll keep the modules to remove list for at least a years worth of packages just in case someone does not update regularly and skips some versions

can we change this to OLD_MODS="hotplug" (or maybe DEL_MODS is nicer?)

Sure, no problem, that just need to be aligned with upstream to keep DEL_MODS list up to date.

perfinion · 2021-12-31T20:32:04Z

sec-policy/selinux-base-policy/selinux-base-policy-2.20210203-r1.ebuild

@@ -105,12 +107,26 @@ pkg_postinst() {
 		COMMAND="${COMMAND} -i ${i}.pp"
 	done

+	for i in ${OLD_MODS}; do
+		if [ -n "${MODS##*$i*}" ]; then
+			DEL_MODS="${DEL_MODS} ${i}"


Once the line above is changed to just the list of modules to remove then this loop can be changed to die instead.

maybe something like:

for i in ${OLD_MODS}; do [[ ${MODS} != *${i}* ]] || die "Duplicate module in MODS and OLD_MODS: ${i}" done

Signed-off-by: Grzegorz Filo <gf578@wp.pl>

plsph · 2022-01-01T17:16:13Z

Sorry for force push, I keep forgeting about Certificate of Origin.
This should work as described.
Have a nice new year.

jpds · 2022-01-01T17:18:57Z

sec-policy/selinux-base-policy/selinux-base-policy-2.20210203-r1.ebuild

@@ -27,6 +27,7 @@ BDEPEND="
 	sys-apps/checkpolicy
 	sys-devel/m4"

+DEL_MODS="hotplug"


Tiny nit: I think DEL_MODS should go underneath MODS

gentoo-repo-qa-bot · 2022-01-01T17:25:44Z

Pull request CI report

Report generated at: 2022-01-01 17:25 UTC
Newest commit scanned: 922deb3
Status: ✅ good

There are existing issues already. Please look into the report to make sure none of them affect the packages in question:
https://qa-reports.gentoo.org/output/gentoo-ci/2a813a5040/output.html

Signed-off-by: Grzegorz Filo <gf578@wp.pl>

gentoo-repo-qa-bot · 2022-01-01T22:11:04Z

Pull request CI report

Report generated at: 2022-01-01 22:11 UTC
Newest commit scanned: 33e48c2
Status: ✅ good

There are existing issues already. Please look into the report to make sure none of them affect the packages in question:
https://qa-reports.gentoo.org/output/gentoo-ci/c692464138/output.html

perfinion · 2022-01-01T22:43:51Z

About the DCO, it looks like your git is misconfigured, i had to use git commit --amend --author to make the author field match up with your signed-off-by name. Look at git config user.email and user.name I think should do it.

I made some minor changes:

Moved the die up into src_prepare, its not good to die in the postinst stage.
removed the quotes in [[ "${MODS}" != *${i}* ]] otherwise it doesn't glob and wont match.
The if [[ -n ${DEL_MODS} ]] was unnecessary around the for loop.
Added to the -9999 package too cuz future bumps copy from the -9999 package

Happy New Year and Thanks for the PR!

gentoo-bot added assigned PR successfully assigned to the package maintainer(s). no bug found No Bug/Closes found in the commits. no signoff One or more commits do not indicate GCO sign-off. labels Dec 29, 2021

remove obsolete selinux modules

e409b5d

Signed-off-by: Grzegorz Filo <gf578@wp.pl>

plsph force-pushed the remove_obsolete_selinux_modules branch from df04fd5 to e409b5d Compare December 30, 2021 14:13

perfinion self-requested a review December 31, 2021 20:26

perfinion suggested changes Dec 31, 2021

View reviewed changes

del list instead of old list

922deb3

Signed-off-by: Grzegorz Filo <gf578@wp.pl>

plsph force-pushed the remove_obsolete_selinux_modules branch from 7d9c2b8 to 922deb3 Compare January 1, 2022 17:12

plsph requested a review from perfinion January 1, 2022 17:16

jpds reviewed Jan 1, 2022

View reviewed changes

move lines around

33e48c2

Signed-off-by: Grzegorz Filo <gf578@wp.pl>

gentoo-bot closed this in dff6170 Jan 1, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

remove obsolete selinux modules #23568

remove obsolete selinux modules #23568

plsph commented Dec 29, 2021

gentoo-bot commented Dec 29, 2021

gentoo-repo-qa-bot commented Dec 29, 2021

gentoo-repo-qa-bot commented Dec 30, 2021

perfinion left a comment

perfinion Dec 31, 2021

plsph Jan 1, 2022

perfinion Dec 31, 2021

plsph commented Jan 1, 2022

jpds Jan 1, 2022

gentoo-repo-qa-bot commented Jan 1, 2022

gentoo-repo-qa-bot commented Jan 1, 2022

perfinion commented Jan 1, 2022

remove obsolete selinux modules #23568

remove obsolete selinux modules #23568

Conversation

plsph commented Dec 29, 2021

gentoo-bot commented Dec 29, 2021

Pull Request assignment

Linked bugs

Missing GCO sign-off

gentoo-repo-qa-bot commented Dec 29, 2021

Pull request CI report

gentoo-repo-qa-bot commented Dec 30, 2021

Pull request CI report

perfinion left a comment

Choose a reason for hiding this comment

perfinion Dec 31, 2021

Choose a reason for hiding this comment

plsph Jan 1, 2022

Choose a reason for hiding this comment

perfinion Dec 31, 2021

Choose a reason for hiding this comment

plsph commented Jan 1, 2022

jpds Jan 1, 2022

Choose a reason for hiding this comment

gentoo-repo-qa-bot commented Jan 1, 2022

Pull request CI report

gentoo-repo-qa-bot commented Jan 1, 2022

Pull request CI report

perfinion commented Jan 1, 2022