Re: [PATCH] libselinux: add --undefined-version to LD_SONAME_FLAGS

[Petr Lautrbach <plautrba@redhat.com>]

Stephen Smalley <stephen.smalley.work@gmail.com> writes:

> On Mon, Jun 15, 2026 at 4:58 AM Petr Lautrbach <plautrba@redhat.com> wrote:
>>
>> Stephen Smalley <stephen.smalley.work@gmail.com> writes:
>>
>> > On Thu, Jun 11, 2026 at 2:50 PM Christian Göttsche
>> > <cgzones@googlemail.com> wrote:
>> >>
>> >> On Thu, 11 Jun 2026 at 15:10, Stephen Smalley
>> >> <stephen.smalley.work@gmail.com> wrote:
>> >> >
>> >> > commit 9395cc03226a0 ("Always build for LFS mode on 32-bit archs.")
>> >> > introduced a matchpathcon_filespec_add64 symbol for certain 32-bit
>> >> > configurations but added it to libselinux.map. This was benign under
>> >> > GNU ld but breaks lld due to differing defaults for
>> >> > --no-undefined-version. Add --undefined-version to LD_SONAME_FLAGS to
>> >> > avoid breakage when building with lld.
>> >> >
>> >> > Fix: #512
>> >> > Fix: #513
>> >> > Fixes: 9395cc03226a0 ("Always build for LFS mode on 32-bit archs.")
>> >> > Reported-by: Pepper Gray <hello@peppergray.xyz>
>> >> > Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
>> >>
>> >> Personally I liked the fallback wrapper definition of
>> >> matchpathcon_filespec_add64() more...
>> >
>> > I don't strongly care either way. See
>> > https://github.com/SELinuxProject/selinux/pull/513#issuecomment-4674610134
>> > and https://github.com/SELinuxProject/selinux/pull/513#issuecomment-4674659036
>> > for the argument made against
>> > adding the wrapper definition.
>>
>>
>> Could we use libselinux.map.in and generate libselinux.map build time?
>>
>> Add matchpathcon_filespec_add64@LIBSELINUX_3.8 symbol when bits are lower than
>> 64, add  matchpathcon_filespec_add@LIBSELINUX_3.8 when bits are 64
>>
>>
>> Something like the patch bellow. Would it be too complicated?
>
> We would need to match the logic used in selinux.h:
> #if defined(_FILE_OFFSET_BITS) && _FILE_OFFSET_BITS == 64 && \
>         defined(__INO64_T_TYPE) && !defined(__INO_T_MATCHES_INO64_T)
> #define matchpathcon_filespec_add matchpathcon_filespec_add64
> #endif
>
> Yet another option would be to allow overriding of LD_SONAME_FLAGS or
> introduce another Makefile variable that is appended to it that can be
> overridden so that the build system could inject --undefined-version
> when linking with lld.

This would be my preferred solution together with a note in README.md or somewhere.


>>
>> 1. convert .map to map.in
>> $ sed 's/matchpathcon_filespec_add64/@matchpathcon_filespec_add64@/' libselinux/src/libselinux.map > libselinux/src/libselinux.map.in
>>
>> 2.
>>
>> diff --git a/libselinux/Makefile b/libselinux/Makefile
>> index aeede2b56e8e..f397967657bf 100644
>> --- a/libselinux/Makefile
>> +++ b/libselinux/Makefile
>> @@ -39,6 +39,8 @@ ifeq ($(USE_LFS),y)
>>         LFS_CFLAGS := -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64
>>  endif
>>  export LFS_CFLAGS
>> +LONG_BIT := $(shell getconf LONG_BIT)
>> +export LONG_BIT
>>
>>  OS := $(shell uname)
>>  export OS
>> diff --git a/libselinux/src/Makefile b/libselinux/src/Makefile
>> index 9982faada9ef..5cb104fe5576 100644
>> --- a/libselinux/src/Makefile
>> +++ b/libselinux/src/Makefile
>> @@ -158,11 +158,18 @@ $(SWIGRUBYLOBJ): $(SWIGRUBYCOUT)
>>  $(SWIGRUBYSO): $(SWIGRUBYLOBJ)
>>         $(CC) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) -L. -fPIC -shared -o $@ $^ -lselinux $(RUBYLIBS)
>>
>> +libselinux.map: libselinux.map.in
>> +       if [ ${LONG_BIT} -lt 64 ]; then \
>> +               sed 's/@matchpathcon_filespec_add64@/matchpathcon_filespec_add64/' < $< > $@; \
>> +       else \
>> +           sed 's/@matchpathcon_filespec_add64@/matchpathcon_filespec_add/' < $< > $@; \
>> +       fi
>> +
>>  $(LIBA): $(OBJS)
>>         $(AR) rcs $@ $^
>>         $(RANLIB) $@
>>
>> -$(LIBSO): $(LOBJS)
>> +$(LIBSO): $(LOBJS) | libselinux.map
>>         $(CC) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) -fPIC -shared -o $@ $^ $(PCRE_LDLIBS) $(FTS_LDLIBS) -ldl -Wl,$(LD_SONAME_FLAGS)
>>         ln -sf $@ $(TARGET)
>>
>> @@ -212,7 +219,7 @@ clean-rubywrap:
>>         -rm -f $(SWIGRUBYLOBJ) $(SWIGRUBYSO)
>>
>>  clean: clean-pywrap clean-rubywrap
>> -       -rm -f $(LIBPC) $(OBJS) $(LOBJS) $(LIBA) $(LIBSO) $(TARGET) *.o *.lo *~
>> +       -rm -f $(LIBPC) $(OBJS) $(LOBJS) $(LIBA) $(LIBSO) $(TARGET) libselinux.map *.o *.lo *~
>>
>>  distclean: clean
>>         rm -f $(GENERATED) $(SWIGFILES)
>> diff --git a/libselinux/src/libselinux.map b/libselinux/src/libselinux.map.in
>> similarity index 99%
>> rename from libselinux/src/libselinux.map
>> rename to libselinux/src/libselinux.map.in
>> index 95cd53b043c2..9a1b1736aca8 100644
>> --- a/libselinux/src/libselinux.map
>> +++ b/libselinux/src/libselinux.map.in
>> @@ -255,7 +255,7 @@ LIBSELINUX_3.5 {
>>
>>  LIBSELINUX_3.8 {
>>    global:
>> -    matchpathcon_filespec_add64;
>> +    @matchpathcon_filespec_add64@;
>>  } LIBSELINUX_3.5;
>>
>>  LIBSELINUX_3.9 {
>>