Ruby bindings patch for libselinux

Ruby bindings patch for libselinux

[Daniel J Walsh]

[-- Attachment #1: Type: text/plain, Size: 858 bytes --]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I noticed that puppet is not SELinux aware.  We are using this in the
Fedora Infrastructure.  Puppet is written in Ruby.  In order to get the
packages to make Puppet SELinux aware we need at least matchpathcon,
is_selinux_enabled, setfscreatecon and setfilecon to have Ruby bindings.


So I try to learn as much Ruby in an afternoon as possible and converted
as much libselinux python bindings to Ruby as I could.   Enough to get
puppet going on working with selinux.

If some Ruby expert wants to fix the rest of the bindings that would be
great. :^)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkh2KEoACgkQrlYvE4MpobND1ACffm5i1ie3FumEXBc+qcm8Fyio
K+4An0Cur4swzMMFoj9blybxBYhzxUMR
=ylTu
-----END PGP SIGNATURE-----

[-- Attachment #2: diff --]
[-- Type: text/plain, Size: 6624 bytes --]

diff --exclude-from=exclude -N -u -r nsalibselinux/src/Makefile libselinux-2.0.67/src/Makefile
--- nsalibselinux/src/Makefile	2008-06-22 09:40:25.000000000 -0400
+++ libselinux-2.0.67/src/Makefile	2008-07-09 16:56:37.000000000 -0400
@@ -7,16 +7,24 @@
 PYINC ?= /usr/include/$(PYLIBVER)
 PYLIB ?= /usr/lib/$(PYLIBVER)
 PYTHONLIBDIR ?= $(LIBDIR)/$(PYLIBVER)
+RUBYLIBVER ?= $(shell ruby -e 'print RUBY_VERSION.split(".")[0..1].join(".")')
+RUBYPLATFORM ?= $(shell ruby -e 'print RUBY_PLATFORM')
+RUBYINC ?= $(LIBDIR)/ruby/$(RUBYLIBVER)/$(RUBYPLATFORM)
+RUBYINSTALL ?= $(LIBDIR)/ruby/site_ruby/$(RUBYLIBVER)/$(RUBYPLATFORM)
 
 LIBVERSION = 1
 
 LIBA=libselinux.a 
 TARGET=libselinux.so
 SWIGIF= selinuxswig_python.i
+SWIGRUBYIF= selinuxswig_ruby.i
 SWIGCOUT= selinuxswig_wrap.c
+SWIGRUBYCOUT= selinuxswig_ruby_wrap.c
 SWIGLOBJ:= $(patsubst %.c,%.lo,$(SWIGCOUT)) 
+SWIGRUBYLOBJ:= $(patsubst %.c,%.lo,$(SWIGRUBYCOUT)) 
 SWIGSO=_selinux.so
 SWIGFILES=$(SWIGSO) selinux.py 
+SWIGRUBYSO=_rubyselinux.so
 LIBSO=$(TARGET).$(LIBVERSION)
 AUDIT2WHYSO=audit2why.so
 
@@ -29,7 +37,9 @@
 ifeq ($(DISABLE_RPM),y)
 	UNUSED_SRCS+=rpm.c
 endif
-SRCS= $(filter-out $(UNUSED_SRCS), $(filter-out audit2why.c $(SWIGCOUT),$(wildcard *.c)))
+
+GENERATED=$(SWIGCOUT) $(SWIGRUBYCOUT)
+SRCS= $(filter-out $(UNUSED_SRCS), $(filter-out audit2why.c $(GENERATED),$(wildcard *.c)))
 
 OBJS= $(patsubst %.c,%.o,$(SRCS))
 LOBJS= $(patsubst %.c,%.lo,$(SRCS))
@@ -44,11 +54,11 @@
 
 SWIG = swig -Wall -python -o $(SWIGCOUT) -outdir ./
 
-GENERATED=$(SWIGCOUT)
+SWIGRUBY = swig -Wall -ruby -o $(SWIGRUBYCOUT) -outdir ./
 
 all: $(LIBA) $(LIBSO) 
 
-pywrap: all $(SWIGSO) $(AUDIT2WHYSO)
+pywrap: all $(SWIGSO) $(AUDIT2WHYSO) $(SWIGRUBYSO) 
 
 $(LIBA):  $(OBJS)
 	$(AR) rcs $@ $^
@@ -57,8 +67,14 @@
 $(SWIGLOBJ): $(SWIGCOUT)
 	$(CC) $(filter-out -Werror,$(CFLAGS)) -I$(PYINC) -fPIC -DSHARED -c -o $@ $<
 
+$(SWIGRUBYLOBJ): $(SWIGRUBYCOUT)
+	$(CC) $(filter-out -Werror,$(CFLAGS)) -I$(RUBYINC) -fPIC -DSHARED -c -o $@ $<
+
 $(SWIGSO): $(SWIGLOBJ)
-	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $< -L. -lselinux -L$(LIBDIR) -Wl,-soname,$@
+	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux -L$(LIBDIR) -Wl,-soname,$@
+
+$(SWIGRUBYSO): $(SWIGRUBYLOBJ)
+	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux -L$(LIBDIR) -Wl,-soname,$@
 
 $(LIBSO): $(LOBJS)
 	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -ldl -L$(LIBDIR) -Wl,-soname,$(LIBSO),-z,defs,-z,relro
@@ -79,6 +95,9 @@
 $(SWIGCOUT): $(SWIGIF)
 	$(SWIG) $^
 
+$(SWIGRUBYCOUT): $(SWIGRUBYIF)
+	$(SWIGRUBY) $^
+
 swigify: $(SWIGIF)
 	$(SWIG) $^
 
@@ -95,6 +114,9 @@
 	install -m 755 $(AUDIT2WHYSO) $(PYTHONLIBDIR)/site-packages/selinux
 	install -m 644  selinux.py $(PYTHONLIBDIR)/site-packages/selinux/__init__.py
 
+	test -d $(RUBYINSTALL) || install -m 755 -d $(RUBYINSTALL) 
+	install -m 755 $(SWIGRUBYSO) $(RUBYINSTALL)/selinux.so
+
 relabel:
 	/sbin/restorecon $(SHLIBDIR)/$(LIBSO)
 
@@ -102,7 +124,7 @@
 	-rm -f $(OBJS) $(LOBJS) $(LIBA) $(LIBSO) $(SWIGLOBJ) $(SWIGSO) $(TARGET) $(AUDIT2WHYSO) *.o *.lo *~
 
 distclean: clean
-	rm -f $(SWIGCOUT) $(SWIGFILES)
+	rm -f $(GENERATED) $(SWIGFILES)
 
 indent:
 	../../scripts/Lindent $(filter-out $(GENERATED),$(wildcard *.[ch]))
diff --exclude-from=exclude -N -u -r nsalibselinux/src/selinuxswig_ruby.i libselinux-2.0.67/src/selinuxswig_ruby.i
--- nsalibselinux/src/selinuxswig_ruby.i	1969-12-31 19:00:00.000000000 -0500
+++ libselinux-2.0.67/src/selinuxswig_ruby.i	2008-07-09 16:52:33.000000000 -0400
@@ -0,0 +1,147 @@
+/* Author: Dan Walsh, Converted from James Athey python code
+ */
+
+%module selinux
+%{
+	#include "selinux/selinux.h"
+%}
+
+/* security_get_boolean_names() typemap */
+/*
+%typemap(argout) (char ***names, int *len) {
+	PyObject* list = PyList_New(*$2);
+	int i;
+	for (i = 0; i < *$2; i++) {
+		PyList_SetItem(list, i, PyString_FromString((*$1)[i]));
+	}
+	$result = SWIG_Python_AppendOutput($result, list);
+}
+*/
+/* return a sid along with the result */
+%typemap(argout) (security_id_t * sid) {
+	if (*$1) {
+                %append_output(SWIG_NewPointerObj(*$1, $descriptor(security_id_t), 0));
+	} 
+/*	else {
+		Py_INCREF(Py_None);
+		%append_output(Py_None);
+	}
+*/
+}
+
+%typemap(in,numinputs=0) security_id_t *(security_id_t temp) {
+  $1 = &temp;
+}
+
+/* Makes security_compute_user() return a Python list of contexts */
+/*
+%typemap(argout) (security_context_t **con) {
+	PyObject* plist;
+	int i, len = 0;
+	
+	if (*$1) {
+		while((*$1)[len])
+			len++;
+		plist = PyList_New(len);
+		for (i = 0; i < len; i++) {
+			PyList_SetItem(plist, i, PyString_FromString((*$1)[i]));
+		}
+	} else {
+		plist = PyList_New(0);
+	}
+
+	$result = SWIG_Python_AppendOutput($result, plist);
+}
+*/
+/* Makes functions in get_context_list.h return a Python list of contexts */
+
+#ifdef fixme
+%typemap(argout) (security_context_t **list) {
+	PyObject* plist;
+	int i;
+	
+	if (*$1) {
+		plist = PyList_New(result);
+		for (i = 0; i < result; i++) {
+			PyList_SetItem(plist, i, PyString_FromString((*$1)[i]));
+		}
+	} else {
+		plist = PyList_New(0);
+	}
+	/* Only return the Python list, don't need to return the length anymore */
+	$result = plist;
+}
+#endif
+
+%typemap(in,noblock=1,numinputs=0) security_context_t * (security_context_t temp = 0) {
+	$1 = &temp;
+}
+%typemap(freearg,match="in") security_context_t * "";
+%typemap(argout,noblock=1) security_context_t * {
+	if (*$1) {
+		%append_output(SWIG_FromCharPtr(*$1));
+		freecon(*$1);
+	}
+/*
+	else {
+		Py_INCREF(Py_None);
+		%append_output(Py_None);
+	}
+*/
+}
+
+%typemap(in,noblock=1,numinputs=0) char ** (char * temp = 0) {
+	$1 = &temp;
+}
+%typemap(freearg,match="in") char ** "";
+%typemap(argout,noblock=1) char ** {
+	if (*$1) {
+		%append_output(SWIG_FromCharPtr(*$1));
+		free(*$1);
+	}
+/*
+	else {
+		Py_INCREF(Py_None);
+		%append_output(Py_None);
+	}
+*/
+}
+/*
+%typemap(in) char * const [] {
+	int i, size;
+	PyObject * s;
+
+	if (!PySequence_Check($input)) {
+		PyErr_SetString(PyExc_ValueError, "Expected a sequence");
+		return NULL;
+	}
+
+	size = PySequence_Size($input);
+	
+	$1 = (char**) malloc(size + 1);
+	for(i = 0; i < size; i++) {
+		if (!PyString_Check(PySequence_GetItem($input, i))) {
+			PyErr_SetString(PyExc_ValueError, "Sequence must contain only strings");
+			return NULL;
+		}
+	}
+		
+	for(i = 0; i < size; i++) {
+		s = PySequence_GetItem($input, i);
+		$1[i] = (char*) malloc(PyString_Size(s) + 1);
+		strcpy($1[i], PyString_AsString(s));
+	}
+	$1[size] = NULL;
+}
+*/
+
+%typemap(freearg,match="in") char * const [] {
+	int i = 0;
+	while($1[i]) {
+		free($1[i]);
+		i++;
+	}
+	free($1);
+}
+
+%include "selinuxswig.i"

[-- Attachment #3: diff.sig --]
[-- Type: application/octet-stream, Size: 72 bytes --]

Re: Ruby bindings patch for libselinux

[Stephen Smalley]

On Thu, 2008-07-10 at 11:18 -0400, Daniel J Walsh wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> I noticed that puppet is not SELinux aware.  We are using this in the
> Fedora Infrastructure.  Puppet is written in Ruby.  In order to get the
> packages to make Puppet SELinux aware we need at least matchpathcon,
> is_selinux_enabled, setfscreatecon and setfilecon to have Ruby bindings.
> 
> 
> So I try to learn as much Ruby in an afternoon as possible and converted
> as much libselinux python bindings to Ruby as I could.   Enough to get
> puppet going on working with selinux.
> 
> If some Ruby expert wants to fix the rest of the bindings that would be
> great. :^)
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.9 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
> 
> iEYEARECAAYFAkh2KEoACgkQrlYvE4MpobND1ACffm5i1ie3FumEXBc+qcm8Fyio
> K+4An0Cur4swzMMFoj9blybxBYhzxUMR
> =ylTu
> -----END PGP SIGNATURE-----
> plain text document attachment (diff)
> diff --exclude-from=exclude -N -u -r nsalibselinux/src/Makefile libselinux-2.0.67/src/Makefile
> --- nsalibselinux/src/Makefile	2008-06-22 09:40:25.000000000 -0400
> +++ libselinux-2.0.67/src/Makefile	2008-07-09 16:56:37.000000000 -0400
> @@ -44,11 +54,11 @@
>  
>  SWIG = swig -Wall -python -o $(SWIGCOUT) -outdir ./
>  
> -GENERATED=$(SWIGCOUT)
> +SWIGRUBY = swig -Wall -ruby -o $(SWIGRUBYCOUT) -outdir ./
>  
>  all: $(LIBA) $(LIBSO) 
>  
> -pywrap: all $(SWIGSO) $(AUDIT2WHYSO)
> +pywrap: all $(SWIGSO) $(AUDIT2WHYSO) $(SWIGRUBYSO) 

Should there be a separate makefile target for the ruby bindings?

> diff --exclude-from=exclude -N -u -r nsalibselinux/src/selinuxswig_ruby.i libselinux-2.0.67/src/selinuxswig_ruby.i
> --- nsalibselinux/src/selinuxswig_ruby.i	1969-12-31 19:00:00.000000000 -0500
> +++ libselinux-2.0.67/src/selinuxswig_ruby.i	2008-07-09 16:52:33.000000000 -0400
> @@ -0,0 +1,147 @@
> +/* Author: Dan Walsh, Converted from James Athey python code
> + */
> +
> +%module selinux
> +%{
> +	#include "selinux/selinux.h"
> +%}
> +
> +/* security_get_boolean_names() typemap */
> +/*
> +%typemap(argout) (char ***names, int *len) {
> +	PyObject* list = PyList_New(*$2);
> +	int i;
> +	for (i = 0; i < *$2; i++) {
> +		PyList_SetItem(list, i, PyString_FromString((*$1)[i]));
> +	}
> +	$result = SWIG_Python_AppendOutput($result, list);
> +}

Rather than commenting out or #ifdef'ing python binding code, just
remove it from this file.

> +%typemap(in,noblock=1,numinputs=0) security_context_t * (security_context_t temp = 0) {
> +	$1 = &temp;
> +}
> +%typemap(freearg,match="in") security_context_t * "";
> +%typemap(argout,noblock=1) security_context_t * {
> +	if (*$1) {
> +		%append_output(SWIG_FromCharPtr(*$1));
> +		freecon(*$1);
> +	}
> +/*
> +	else {
> +		Py_INCREF(Py_None);
> +		%append_output(Py_None);
> +	}
> +*/
> +}

Don't you need to handle the else clause in some manner?

What are the build dependencies?  Doesn't build for me on F8 or F9 with
ruby, ruby-libs and ruby-devel installed.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Ruby bindings patch for libselinux

[Daniel J Walsh]

Stephen Smalley wrote:
> On Thu, 2008-07-10 at 11:18 -0400, Daniel J Walsh wrote:
> I noticed that puppet is not SELinux aware.  We are using this in the
> Fedora Infrastructure.  Puppet is written in Ruby.  In order to get the
> packages to make Puppet SELinux aware we need at least matchpathcon,
> is_selinux_enabled, setfscreatecon and setfilecon to have Ruby bindings.
> 
> 
> So I try to learn as much Ruby in an afternoon as possible and converted
> as much libselinux python bindings to Ruby as I could.   Enough to get
> puppet going on working with selinux.
> 
> If some Ruby expert wants to fix the rest of the bindings that would be
> great. :^)
plain text document attachment (diff)
diff --exclude-from=exclude -N -u -r nsalibselinux/src/Makefile
libselinux-2.0.67/src/Makefile
--- nsalibselinux/src/Makefile	2008-06-22 09:40:25.000000000 -0400
+++ libselinux-2.0.67/src/Makefile	2008-07-09 16:56:37.000000000 -0400
@@ -44,11 +54,11 @@

 SWIG = swig -Wall -python -o $(SWIGCOUT) -outdir ./

-GENERATED=$(SWIGCOUT)
+SWIGRUBY = swig -Wall -ruby -o $(SWIGRUBYCOUT) -outdir ./

 all: $(LIBA) $(LIBSO)

-pywrap: all $(SWIGSO) $(AUDIT2WHYSO)
+pywrap: all $(SWIGSO) $(AUDIT2WHYSO) $(SWIGRUBYSO)

> Should there be a separate makefile target for the ruby bindings?

Yes


diff --exclude-from=exclude -N -u -r
nsalibselinux/src/selinuxswig_ruby.i
libselinux-2.0.67/src/selinuxswig_ruby.i
--- nsalibselinux/src/selinuxswig_ruby.i	1969-12-31 19:00:00.000000000 -0500
+++ libselinux-2.0.67/src/selinuxswig_ruby.i	2008-07-09
16:52:33.000000000 -0400
@@ -0,0 +1,147 @@
+/* Author: Dan Walsh, Converted from James Athey python code
+ */
+
+%module selinux
+%{
+	#include "selinux/selinux.h"
+%}
+
+/* security_get_boolean_names() typemap */
+/*
+%typemap(argout) (char ***names, int *len) {
+	PyObject* list = PyList_New(*$2);
+	int i;
+	for (i = 0; i < *$2; i++) {
+		PyList_SetItem(list, i, PyString_FromString((*$1)[i]));
+	}
+	$result = SWIG_Python_AppendOutput($result, list);
+}

> Rather than commenting out or #ifdef'ing python binding code, just
> remove it from this file.

I left it in t he hopes that someone who knew ruby would come in and fix it.

+%typemap(in,noblock=1,numinputs=0) security_context_t *
(security_context_t temp = 0) {
+	$1 = &temp;
+}
+%typemap(freearg,match="in") security_context_t * "";
+%typemap(argout,noblock=1) security_context_t * {
+	if (*$1) {
+		%append_output(SWIG_FromCharPtr(*$1));
+		freecon(*$1);
+	}
+/*
+	else {
+		Py_INCREF(Py_None);
+		%append_output(Py_None);
+	}
+*/
+}

> Don't you need to handle the else clause in some manner?

I don't know.  This handling is just to make sure memory does not leak,
I believe.  I do not know what the default for ruby would do.

> What are the build dependencies?  Doesn't build for me on F8 or F9 with
> ruby, ruby-libs and ruby-devel installed.

Build fine for me on F9 and Rawhide.

Spec file has:

BuildRequires: python-devel ruby-devel ruby libsepol-static >=
%{libsepolver} swig


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Ruby bindings patch for libselinux

[Stephen Smalley]

On Tue, 2008-07-29 at 10:45 -0400, Daniel J Walsh wrote:
> > Rather than commenting out or #ifdef'ing python binding code, just
> > remove it from this file.
> 
> I left it in t he hopes that someone who knew ruby would come in and fix it.

Better to just strip it and they can always look at the python bindings
later if they want.

> > What are the build dependencies?  Doesn't build for me on F8 or F9 with
> > ruby, ruby-libs and ruby-devel installed.
> 
> Build fine for me on F9 and Rawhide.
> 
> Spec file has:
> 
> BuildRequires: python-devel ruby-devel ruby libsepol-static >=
> %{libsepolver} swig

Ah, ok - now it builds for me.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Ruby bindings patch for libselinux

[Daniel J Walsh]

[-- Attachment #1: Type: text/plain, Size: 697 bytes --]

Stephen Smalley wrote:
> On Tue, 2008-07-29 at 10:45 -0400, Daniel J Walsh wrote:
>>> Rather than commenting out or #ifdef'ing python binding code, just
>>> remove it from this file.
>> I left it in t he hopes that someone who knew ruby would come in and fix it.
> 
> Better to just strip it and they can always look at the python bindings
> later if they want.
> 
>>> What are the build dependencies?  Doesn't build for me on F8 or F9 with
>>> ruby, ruby-libs and ruby-devel installed.
>> Build fine for me on F9 and Rawhide.
>>
>> Spec file has:
>>
>> BuildRequires: python-devel ruby-devel ruby libsepol-static >=
>> %{libsepolver} swig
> 
> Ah, ok - now it builds for me.
>
Added your fixes.


[-- Attachment #2: diff --]
[-- Type: text/plain, Size: 5085 bytes --]

diff --exclude-from=exclude -N -u -r nsalibselinux/Makefile libselinux-2.0.69/Makefile
--- nsalibselinux/Makefile	2008-06-12 23:25:14.000000000 -0400
+++ libselinux-2.0.69/Makefile	2008-07-29 14:21:44.000000000 -0400
@@ -29,6 +29,9 @@
 pywrap: 
 	$(MAKE) -C src pywrap
 
+rubywrap: 
+	$(MAKE) -C src rubywrap
+
 install: 
 	$(MAKE) -C include install
 	$(MAKE) -C src install
@@ -38,6 +41,9 @@
 install-pywrap: 
 	$(MAKE) -C src install-pywrap 
 
+install-rubywrap: 
+	$(MAKE) -C src install-rubywrap 
+
 relabel: 
 	$(MAKE) -C src relabel
 
diff --exclude-from=exclude -N -u -r nsalibselinux/src/Makefile libselinux-2.0.69/src/Makefile
--- nsalibselinux/src/Makefile	2008-06-22 09:40:25.000000000 -0400
+++ libselinux-2.0.69/src/Makefile	2008-07-29 14:15:39.000000000 -0400
@@ -7,16 +7,24 @@
 PYINC ?= /usr/include/$(PYLIBVER)
 PYLIB ?= /usr/lib/$(PYLIBVER)
 PYTHONLIBDIR ?= $(LIBDIR)/$(PYLIBVER)
+RUBYLIBVER ?= $(shell ruby -e 'print RUBY_VERSION.split(".")[0..1].join(".")')
+RUBYPLATFORM ?= $(shell ruby -e 'print RUBY_PLATFORM')
+RUBYINC ?= $(LIBDIR)/ruby/$(RUBYLIBVER)/$(RUBYPLATFORM)
+RUBYINSTALL ?= $(LIBDIR)/ruby/site_ruby/$(RUBYLIBVER)/$(RUBYPLATFORM)
 
 LIBVERSION = 1
 
 LIBA=libselinux.a 
 TARGET=libselinux.so
 SWIGIF= selinuxswig_python.i
+SWIGRUBYIF= selinuxswig_ruby.i
 SWIGCOUT= selinuxswig_wrap.c
+SWIGRUBYCOUT= selinuxswig_ruby_wrap.c
 SWIGLOBJ:= $(patsubst %.c,%.lo,$(SWIGCOUT)) 
+SWIGRUBYLOBJ:= $(patsubst %.c,%.lo,$(SWIGRUBYCOUT)) 
 SWIGSO=_selinux.so
 SWIGFILES=$(SWIGSO) selinux.py 
+SWIGRUBYSO=_rubyselinux.so
 LIBSO=$(TARGET).$(LIBVERSION)
 AUDIT2WHYSO=audit2why.so
 
@@ -29,7 +37,9 @@
 ifeq ($(DISABLE_RPM),y)
 	UNUSED_SRCS+=rpm.c
 endif
-SRCS= $(filter-out $(UNUSED_SRCS), $(filter-out audit2why.c $(SWIGCOUT),$(wildcard *.c)))
+
+GENERATED=$(SWIGCOUT) $(SWIGRUBYCOUT)
+SRCS= $(filter-out $(UNUSED_SRCS), $(filter-out audit2why.c $(GENERATED),$(wildcard *.c)))
 
 OBJS= $(patsubst %.c,%.o,$(SRCS))
 LOBJS= $(patsubst %.c,%.lo,$(SRCS))
@@ -44,12 +54,14 @@
 
 SWIG = swig -Wall -python -o $(SWIGCOUT) -outdir ./
 
-GENERATED=$(SWIGCOUT)
+SWIGRUBY = swig -Wall -ruby -o $(SWIGRUBYCOUT) -outdir ./
 
 all: $(LIBA) $(LIBSO) 
 
 pywrap: all $(SWIGSO) $(AUDIT2WHYSO)
 
+rubywrap: all $(SWIGRUBYSO)
+
 $(LIBA):  $(OBJS)
 	$(AR) rcs $@ $^
 	$(RANLIB) $@
@@ -57,9 +69,15 @@
 $(SWIGLOBJ): $(SWIGCOUT)
 	$(CC) $(filter-out -Werror,$(CFLAGS)) -I$(PYINC) -fPIC -DSHARED -c -o $@ $<
 
+$(SWIGRUBYLOBJ): $(SWIGRUBYCOUT)
+	$(CC) $(filter-out -Werror,$(CFLAGS)) -I$(RUBYINC) -fPIC -DSHARED -c -o $@ $<
+
 $(SWIGSO): $(SWIGLOBJ)
 	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $< -L. -lselinux -L$(LIBDIR) -Wl,-soname,$@
 
+$(SWIGRUBYSO): $(SWIGRUBYLOBJ)
+	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -L. -lselinux -L$(LIBDIR) -Wl,-soname,$@
+
 $(LIBSO): $(LOBJS)
 	$(CC) $(CFLAGS) $(LDFLAGS) -shared -o $@ $^ -ldl -L$(LIBDIR) -Wl,-soname,$(LIBSO),-z,defs,-z,relro
 	ln -sf $@ $(TARGET) 
@@ -79,6 +97,9 @@
 $(SWIGCOUT): $(SWIGIF)
 	$(SWIG) $^
 
+$(SWIGRUBYCOUT): $(SWIGRUBYIF)
+	$(SWIGRUBY) $^
+
 swigify: $(SWIGIF)
 	$(SWIG) $^
 
@@ -95,6 +116,10 @@
 	install -m 755 $(AUDIT2WHYSO) $(PYTHONLIBDIR)/site-packages/selinux
 	install -m 644  selinux.py $(PYTHONLIBDIR)/site-packages/selinux/__init__.py
 
+install-rubywrap: rubywrap
+	test -d $(RUBYINSTALL) || install -m 755 -d $(RUBYINSTALL) 
+	install -m 755 $(SWIGRUBYSO) $(RUBYINSTALL)/selinux.so
+
 relabel:
 	/sbin/restorecon $(SHLIBDIR)/$(LIBSO)
 
@@ -102,7 +127,7 @@
 	-rm -f $(OBJS) $(LOBJS) $(LIBA) $(LIBSO) $(SWIGLOBJ) $(SWIGSO) $(TARGET) $(AUDIT2WHYSO) *.o *.lo *~
 
 distclean: clean
-	rm -f $(SWIGCOUT) $(SWIGFILES)
+	rm -f $(GENERATED) $(SWIGFILES)
 
 indent:
 	../../scripts/Lindent $(filter-out $(GENERATED),$(wildcard *.[ch]))
diff --exclude-from=exclude -N -u -r nsalibselinux/src/selinuxswig_ruby.i libselinux-2.0.69/src/selinuxswig_ruby.i
--- nsalibselinux/src/selinuxswig_ruby.i	1969-12-31 19:00:00.000000000 -0500
+++ libselinux-2.0.69/src/selinuxswig_ruby.i	2008-07-29 14:17:14.000000000 -0400
@@ -0,0 +1,52 @@
+/* Author: Dan Walsh
+   Based on selinuxswig_python.i by James Athey
+ */
+
+%module selinux
+%{
+	#include "selinux/selinux.h"
+%}
+
+/* return a sid along with the result */
+%typemap(argout) (security_id_t * sid) {
+	if (*$1) {
+                %append_output(SWIG_NewPointerObj(*$1, $descriptor(security_id_t), 0));
+	} 
+}
+
+%typemap(in,numinputs=0) security_id_t *(security_id_t temp) {
+  $1 = &temp;
+}
+
+%typemap(in,noblock=1,numinputs=0) security_context_t * (security_context_t temp = 0) {
+	$1 = &temp;
+}
+%typemap(freearg,match="in") security_context_t * "";
+%typemap(argout,noblock=1) security_context_t * {
+	if (*$1) {
+		%append_output(SWIG_FromCharPtr(*$1));
+		freecon(*$1);
+	}
+}
+
+%typemap(in,noblock=1,numinputs=0) char ** (char * temp = 0) {
+	$1 = &temp;
+}
+%typemap(freearg,match="in") char ** "";
+%typemap(argout,noblock=1) char ** {
+	if (*$1) {
+		%append_output(SWIG_FromCharPtr(*$1));
+		free(*$1);
+	}
+}
+
+%typemap(freearg,match="in") char * const [] {
+	int i = 0;
+	while($1[i]) {
+		free($1[i]);
+		i++;
+	}
+	free($1);
+}
+
+%include "selinuxswig.i"