Re: [Buildroot] [PATCH v3 2/2] package/refpolicy/Config.in: depend on merged usr when selecting upstream

["Yann E. MORIN" <yann.morin.1998@free.fr>]

Adam, All,

Thanks for the quick respin. :-)

On 2023-10-09 10:06 +0200, Adam Duskett spake thusly:
> Refpolicy contexts expect a merged /usr file system. In fact, there
> are no references to /bin, /sbin, /lib, or /lib64 at all. However, if a user
> wants to go through the trouble of creating a policy that works with a
> non-merged system, they should be free to do so. As such, only select
> BR2_ROOTFS_MERGED_USR if using BR2_PACKAGE_REFPOLICY_UPSTREAM_VERSION.

That last sentence is now incorrect. It could have been fixed when
applying, but...

> Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
> ---
> v2 -> v3: Depends on, do not select BR2_ROOTFS_MERGED_USR [Yann]
> 
>  ...ount-dbus-interface-must-be-optional.patch | 33 -------------------

... why is this patch removed? From the description of that patch, it
does not look to be related to merged-usr at all...

If that is due to the version bump, then it should have been part of the
patch bumpng the version...

Regards,
Yann E. MORIN.

>  package/refpolicy/Config.in                   |  4 +++
>  2 files changed, 4 insertions(+), 33 deletions(-)
>  delete mode 100644 package/refpolicy/2.20221101/0001-mount-dbus-interface-must-be-optional.patch
> 
> diff --git a/package/refpolicy/2.20221101/0001-mount-dbus-interface-must-be-optional.patch b/package/refpolicy/2.20221101/0001-mount-dbus-interface-must-be-optional.patch
> deleted file mode 100644
> index adec7d98d0..0000000000
> --- a/package/refpolicy/2.20221101/0001-mount-dbus-interface-must-be-optional.patch
> +++ /dev/null
> @@ -1,33 +0,0 @@
> -From 6c6be65ccf0891391681d4662cc11f508c0f4aeb Mon Sep 17 00:00:00 2001
> -From: Adam Duskett <aduskett@gmail.com>
> -Date: Mon, 24 Apr 2023 14:24:49 -0700
> -Subject: [PATCH] mount: dbus interface must be optional
> -
> -If DBus isn't built, the build process fails due to mount.te always using a
> -dbus interface even if the dbus module. Fix this by setting the dbus interface
> -as optional.
> -
> -Signed-off-by: Adam Duskett <aduskett@gmail.com>
> -Upstream: https://github.com/SELinuxProject/refpolicy/commit/207b09a656c2c3ac5c286d3f7eef085325e35408
> ----
> - policy/modules/system/mount.te | 4 +++-
> - 1 file changed, 3 insertions(+), 1 deletion(-)
> -
> -diff --git a/policy/modules/system/mount.te b/policy/modules/system/mount.te
> -index d028723..af84af0 100644
> ---- a/policy/modules/system/mount.te
> -+++ b/policy/modules/system/mount.te
> -@@ -145,7 +145,9 @@ selinux_getattr_fs(mount_t)
> - 
> - userdom_use_all_users_fds(mount_t)
> - 
> --dbus_dontaudit_write_system_bus_runtime_named_sockets(mount_t)
> -+optional_policy(`
> -+	dbus_dontaudit_write_system_bus_runtime_named_sockets(mount_t)
> -+')
> - 
> - ifdef(`distro_redhat',`
> - 	optional_policy(`
> --- 
> -2.40.0
> -
> diff --git a/package/refpolicy/Config.in b/package/refpolicy/Config.in
> index 0e72b895df..d2fe391d8d 100644
> --- a/package/refpolicy/Config.in
> +++ b/package/refpolicy/Config.in
> @@ -36,9 +36,13 @@ choice
>  
>  config BR2_PACKAGE_REFPOLICY_UPSTREAM_VERSION
>  	bool "Upstream version"
> +	depends on BR2_ROOTFS_MERGED_USR
>  	help
>  	  Use the refpolicy as provided by Buildroot.
>  
> +comment "Upstream refpolicy requires a merged /usr filesystem"
> +	depends on !BR2_ROOTFS_MERGED_USR
> +
>  config BR2_PACKAGE_REFPOLICY_CUSTOM_GIT
>  	bool "Custom git repository"
>  	help
> -- 
> 2.41.0
> 
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot

-- 
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot