Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ci: print version after install & fix apparmor support on build_apparmor #5148

Merged
merged 3 commits into from May 18, 2022

Conversation

kmk3
Copy link
Collaborator

@kmk3 kmk3 commented May 17, 2022

The "build_apparmor" job was added on commit 342e71c ("Add
deb-apparmor build to Gitlab CI", 2019-01-26). It would call
./mkdeb-apparmor.sh, which would run ./configure --enable-apparmor
directly, adding -lapparmor to EXTRA_LDFLAGS and thus passing it to
the linker.

Later, commit 87e7b31 ("Configure Debian package with AA and SELinux
options", 2020-05-13) / PR #3414 merged mkdeb.sh and mkdeb-apparmor.sh
into mkdeb.sh.in, which does not always pass --enable-apparmor to
./configure directly. Instead, it adds --enable-apparmor depending on
whether the $HAVE_APPARMOR environment variable is set, which would be
done by a previous run of ./configure with --enable-apparmor. Since
on "build_apparmor" ./configure is not run the first time with
--enable-apparmor, neither is it on the second time and thus
-lapparmor is never passed to the linker. This commit adds
--enable-apparmor to the first ./configure run on the ci job, so that
it gets passed to the one being executed on mkdeb.sh as well.

kmk3 added 3 commits May 17, 2022 11:22
To ensure that the resulting program actually runs and also to show
which compile-time features it supports.
To ensure that firejail was actually built with support for it.

Note: This commit intentionally fails on GitLab CI to demonstrate that
the above is currently not the case.
The "build_apparmor" job was added on commit 342e71c ("Add
deb-apparmor build to Gitlab CI", 2019-01-26).  It would call
`./mkdeb-apparmor.sh`, which would run `./configure --enable-apparmor`
directly, adding `-lapparmor` to `EXTRA_LDFLAGS` and thus passing it to
the linker.

Later, commit 87e7b31 ("Configure Debian package with AA and SELinux
options", 2020-05-13) / PR netblue30#3414 merged mkdeb.sh and mkdeb-apparmor.sh
into mkdeb.sh.in, which does not always pass `--enable-apparmor` to
./configure directly.  Instead, it adds `--enable-apparmor` depending on
whether the `$HAVE_APPARMOR` environment variable is set, which would be
done by a previous run of ./configure with `--enable-apparmor`.  Since
on "build_apparmor" ./configure is not run the first time with
`--enable-apparmor`, neither is it on the second time and thus
`-lapparmor` is never passed to the linker.  This commit adds
`--enable-apparmor` to the first ./configure run on the ci job, so that
it gets passed to the one being executed on mkdeb.sh as well.
@kmk3
Copy link
Collaborator Author

kmk3 commented May 17, 2022

Depends on #5147.

@kmk3 kmk3 changed the title ci: print --version & fix apparmor support on build_apparmor ci: print version after install & fix apparmor support on build_apparmor May 17, 2022
@kmk3
Copy link
Collaborator Author

kmk3 commented May 17, 2022

By the way, I'm working on make dist improvements that include making
mkdeb.sh not run ./configure anymore. That along with #5142 should make dist a
lot simpler.

@kmk3 kmk3 added this to In progress in Release 0.9.70 via automation May 17, 2022
@kmk3 kmk3 merged commit 12fa2be into netblue30:master May 18, 2022
@kmk3 kmk3 deleted the ci-fix-build-apparmor branch May 18, 2022 16:27
@kmk3
Copy link
Collaborator Author

kmk3 commented May 18, 2022

For completeness, here is the relevant output of running build_apparmor on
each commit on GitLab CI:

  • 6a89ab0 ("ci: run firejail --version after build/install", 2022-05-16)
$ ./configure --prefix=/usr && make deb-apparmor && dpkg -i firejail*.deb
[...]
$ command -V firejail && firejail --version
firejail is /usr/bin/firejail
firejail version 0.9.69
Compile time support:
	- always force nonewprivs support is disabled
	- AppArmor support is disabled
	- AppImage support is enabled
	- chroot support is enabled
	- D-BUS proxy support is enabled
	- file transfer support is enabled
	- firetunnel support is enabled
	- networking support is enabled
	- output logging is enabled
	- overlayfs support is disabled
	- private-home support is enabled
	- private-cache and tmpfs as user enabled
	- SELinux support is disabled
	- user namespace support is enabled
	- X11 sandboxing support is enabled
Cleaning up project directory and file based variables 00:00
Job succeeded
  • 428e068 ("gitlab-ci: check for apparmor support on build_apparmor",
    2022-05-16)
$ ./configure --prefix=/usr && make deb-apparmor && dpkg -i firejail*.deb
[...]
$ command -V firejail && firejail --version
firejail is /usr/bin/firejail
firejail version 0.9.69
Compile time support:
	- always force nonewprivs support is disabled
	- AppArmor support is disabled
	- AppImage support is enabled
	- chroot support is enabled
	- D-BUS proxy support is enabled
	- file transfer support is enabled
	- firetunnel support is enabled
	- networking support is enabled
	- output logging is enabled
	- overlayfs support is disabled
	- private-home support is enabled
	- private-cache and tmpfs as user enabled
	- SELinux support is disabled
	- user namespace support is enabled
	- X11 sandboxing support is enabled
$ firejail --version | grep -F 'AppArmor support is enabled'
Cleaning up project directory and file based variables 00:01
ERROR: Job failed: exit code 1
  • 1f671ab ("gitlab-ci: actually link libapparmor on build_apparmor",
    2022-05-15)
$ ./configure --prefix=/usr --enable-apparmor && make deb-apparmor && dpkg -i firejail*.deb
[...]
$ command -V firejail && firejail --version
firejail is /usr/bin/firejail
firejail version 0.9.69
Compile time support:
	- always force nonewprivs support is disabled
	- AppArmor support is enabled
	- AppImage support is enabled
	- chroot support is enabled
	- D-BUS proxy support is enabled
	- file transfer support is enabled
	- firetunnel support is enabled
	- networking support is enabled
	- output logging is enabled
	- overlayfs support is disabled
	- private-home support is enabled
	- private-cache and tmpfs as user enabled
	- SELinux support is disabled
	- user namespace support is enabled
	- X11 sandboxing support is enabled
$ firejail --version | grep -F 'AppArmor support is enabled'
	- AppArmor support is enabled
Cleaning up project directory and file based variables 00:01
Job succeeded

kmk3 added a commit to kmk3/firejail that referenced this pull request May 27, 2022
Currently, mkdeb.sh (which is used to make a .deb package) runs
./configure with hardcoded options (some of which are automatically
detected based on configure-time variables).  To work around the
hardcoding, contrib/fj-mkdeb.py is used to add additional options by
rewriting the actual call to ./configure on mkdeb.sh.  For example, the
following invocation adds --disable-firetunnel to mkdeb.sh:

    $ ./configure && ./contrib/fj-mkdeb.py --disable-firetunnel

To avoid depending on another script and to avoid re-generating
mkdeb.sh, just let the latter pass the remaining arguments (the first
one is an optional package filename suffix) to ./configure directly.
Example:

    $ make distclean && ./configure && make dist &&
      ./mkdeb.sh "" --disable-firetunnel

Additionally, change contrib/fj-mkdeb.py to do roughly the same as the
above example, by simply forwarding the arguments that it receives to
./mkdeb.sh (which then forwards them to ./configure).  Also, remove the
--only-fix-mkdeb option, since the script does not change mkdeb.sh
anymore.  With these changes, the script's usage (other than when using
--only-fix-mkdeb) should remain the same.

Note: To clean the generated files and then make a .deb package using
the default configuration, the invocation is still the same:

    $ make distclean && ./configure && make deb

Note2: Running ./configure in the above examples is only needed for
generating Makefile/mkdeb.sh from Makefile.in/mkdeb.sh.in after running
distclean, so that running `make` / `./mkdeb.sh` afterwards works.

Should fully fix netblue30#772.

Relates to netblue30#1205 netblue30#5148.
kmk3 added a commit to kmk3/firejail that referenced this pull request May 27, 2022
Currently, mkdeb.sh (which is used to make a .deb package) runs
./configure with hardcoded options (some of which are automatically
detected based on configure-time variables).  To work around the
hardcoding, contrib/fj-mkdeb.py is used to add additional options by
rewriting the actual call to ./configure on mkdeb.sh.  For example, the
following invocation adds --disable-firetunnel to mkdeb.sh:

    $ ./configure && ./contrib/fj-mkdeb.py --disable-firetunnel

To avoid depending on another script and to avoid re-generating
mkdeb.sh, just let the latter pass the remaining arguments (the first
one is an optional package filename suffix) to ./configure directly.
Example:

    $ make distclean && ./configure && make dist &&
      ./mkdeb.sh "" --disable-firetunnel

Additionally, change contrib/fj-mkdeb.py to do roughly the same as the
above example, by simply forwarding the arguments that it receives to
./mkdeb.sh (which then forwards them to ./configure).  Also, remove the
--only-fix-mkdeb option, since the script does not change mkdeb.sh
anymore.  With these changes, the script's usage (other than when using
--only-fix-mkdeb) should remain the same.

Note: To clean the generated files and then make a .deb package using
the default configuration, the invocation is still the same:

    $ make distclean && ./configure && make deb

Note2: Running ./configure in the above examples is only needed for
generating Makefile/mkdeb.sh from Makefile.in/mkdeb.sh.in after running
distclean, so that running `make` / `./mkdeb.sh` afterwards works.

Should fully fix netblue30#772.

Relates to netblue30#1205 netblue30#5148.
kmk3 added a commit to kmk3/firejail that referenced this pull request May 27, 2022
Currently, mkdeb.sh (which is used to make a .deb package) runs
./configure with hardcoded options (some of which are automatically
detected based on configure-time variables).  To work around the
hardcoding, contrib/fj-mkdeb.py is used to add additional options by
rewriting the actual call to ./configure on mkdeb.sh.  For example, the
following invocation adds --disable-firetunnel to mkdeb.sh:

    $ ./configure && ./contrib/fj-mkdeb.py --disable-firetunnel

To avoid depending on another script and to avoid re-generating
mkdeb.sh, just let the latter pass the remaining arguments (the first
one is an optional package filename suffix) to ./configure directly.
Example:

    $ make distclean && ./configure && make dist &&
      ./mkdeb.sh "" --disable-firetunnel

Additionally, change contrib/fj-mkdeb.py to do roughly the same as the
above example, by simply forwarding the arguments that it receives to
./mkdeb.sh (which then forwards them to ./configure).  Also, remove the
--only-fix-mkdeb option, since the script does not change mkdeb.sh
anymore.  With these changes, the script's usage (other than when using
--only-fix-mkdeb) should remain the same.

Note: To clean the generated files and then make a .deb package using
the default configuration, the invocation is still the same:

    $ make distclean && ./configure && make deb

Note2: Running ./configure in the above examples is only needed for
generating Makefile/mkdeb.sh from Makefile.in/mkdeb.sh.in after running
distclean, so that running `make` / `./mkdeb.sh` afterwards works.

Should fully fix netblue30#772.

Relates to netblue30#1205 netblue30#5148.
kmk3 added a commit to kmk3/firejail that referenced this pull request May 29, 2022
Currently, mkdeb.sh (which is used to make a .deb package) runs
./configure with hardcoded options (some of which are automatically
detected based on configure-time variables).  To work around the
hardcoding, contrib/fj-mkdeb.py is used to add additional options by
rewriting the actual call to ./configure on mkdeb.sh.  For example, the
following invocation adds --disable-firetunnel to mkdeb.sh:

    $ ./configure && ./contrib/fj-mkdeb.py --disable-firetunnel

To avoid depending on another script and to avoid re-generating
mkdeb.sh, just let the latter pass the remaining arguments (the first
one is an optional package filename suffix) to ./configure directly.
Example:

    $ make distclean && ./configure && make dist &&
      ./mkdeb.sh "" --disable-firetunnel

Additionally, change contrib/fj-mkdeb.py to do roughly the same as the
above example, by simply forwarding the arguments that it receives to
./mkdeb.sh (which then forwards them to ./configure).  Also, remove the
--only-fix-mkdeb option, since the script does not change mkdeb.sh
anymore.  With these changes, the script's usage (other than when using
--only-fix-mkdeb) should remain the same.

Note: To clean the generated files and then make a .deb package using
the default configuration, the invocation is still the same:

    $ make distclean && ./configure && make deb

Note2: Running ./configure in the above examples is only needed for
generating Makefile/mkdeb.sh from Makefile.in/mkdeb.sh.in after running
distclean, so that running `make` / `./mkdeb.sh` afterwards works.

Should fully fix netblue30#772.

Relates to netblue30#1205 netblue30#3414 netblue30#5148.
kmk3 added a commit that referenced this pull request Jun 8, 2022
@kmk3 kmk3 moved this from In progress to Done (on RELNOTES) in Release 0.9.70 Jun 8, 2022
kmk3 added a commit to kmk3/firejail that referenced this pull request Feb 29, 2024
To reduce TARNAME hard-coding.

Added on commit 6a89ab0 ("ci: run firejail --version after
build/install", 2022-05-16) / PR netblue30#5148.
kmk3 added a commit to kmk3/firejail that referenced this pull request Feb 29, 2024
To reduce TARNAME hardcoding.

Added on commit 6a89ab0 ("ci: run firejail --version after
build/install", 2022-05-16) / PR netblue30#5148.
kmk3 added a commit to kmk3/firejail that referenced this pull request Feb 29, 2024
To reduce TARNAME hardcoding.

Added on commit 6a89ab0 ("ci: run firejail --version after
build/install", 2022-05-16) / PR netblue30#5148.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
No open projects
Release 0.9.70
  
Done (on RELNOTES)
Development

Successfully merging this pull request may close these issues.

None yet

3 participants