* [Buildroot] [PATCH v3 1/2] package/refpolicy: bump version to 2.20231002 @ 2023-10-09 8:06 Adam Duskett 2023-10-09 8:06 ` [Buildroot] [PATCH v3 2/2] package/refpolicy/Config.in: depend on merged usr when selecting upstream Adam Duskett 0 siblings, 1 reply; 4+ messages in thread From: Adam Duskett @ 2023-10-09 8:06 UTC (permalink / raw) To: buildroot; +Cc: Adam Duskett Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com> --- package/refpolicy/refpolicy.hash | 2 +- package/refpolicy/refpolicy.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/refpolicy/refpolicy.hash b/package/refpolicy/refpolicy.hash index a09e59c270..70d1acc9af 100644 --- a/package/refpolicy/refpolicy.hash +++ b/package/refpolicy/refpolicy.hash @@ -1,5 +1,5 @@ # From https://github.com/SELinuxProject/refpolicy/releases -sha256 44f88e62c8efcef54d019b9ca077520d5993de580926bd7575788cfa78515396 refpolicy-2.20221101.tar.bz2 +sha256 c89cd3b2e5d99765cc24536fd8e76de83951ad23e05472350328b5a4f8bee410 refpolicy-2.20231002.tar.bz2 # Locally computed sha256 204d8eff92f95aac4df6c8122bc1505f468f3a901e5a4cc08940e0ede1938994 COPYING diff --git a/package/refpolicy/refpolicy.mk b/package/refpolicy/refpolicy.mk index 8fea7cc254..fb1c213b84 100644 --- a/package/refpolicy/refpolicy.mk +++ b/package/refpolicy/refpolicy.mk @@ -23,7 +23,7 @@ REFPOLICY_SITE = $(call qstrip,$(BR2_PACKAGE_REFPOLICY_CUSTOM_REPO_URL)) REFPOLICY_SITE_METHOD = git BR_NO_CHECK_HASH_FOR += $(REFPOLICY_SOURCE) else -REFPOLICY_VERSION = 2.20221101 +REFPOLICY_VERSION = 2.20231002 REFPOLICY_SOURCE = refpolicy-$(REFPOLICY_VERSION).tar.bz2 REFPOLICY_SITE = https://github.com/SELinuxProject/refpolicy/releases/download/RELEASE_$(subst .,_,$(REFPOLICY_VERSION)) endif -- 2.41.0 _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply related [flat|nested] 4+ messages in thread
* [Buildroot] [PATCH v3 2/2] package/refpolicy/Config.in: depend on merged usr when selecting upstream 2023-10-09 8:06 [Buildroot] [PATCH v3 1/2] package/refpolicy: bump version to 2.20231002 Adam Duskett @ 2023-10-09 8:06 ` Adam Duskett 2023-10-09 15:12 ` Yann E. MORIN 0 siblings, 1 reply; 4+ messages in thread From: Adam Duskett @ 2023-10-09 8:06 UTC (permalink / raw) To: buildroot; +Cc: Adam Duskett Refpolicy contexts expect a merged /usr file system. In fact, there are no references to /bin, /sbin, /lib, or /lib64 at all. However, if a user wants to go through the trouble of creating a policy that works with a non-merged system, they should be free to do so. As such, only select BR2_ROOTFS_MERGED_USR if using BR2_PACKAGE_REFPOLICY_UPSTREAM_VERSION. Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com> --- v2 -> v3: Depends on, do not select BR2_ROOTFS_MERGED_USR [Yann] ...ount-dbus-interface-must-be-optional.patch | 33 ------------------- package/refpolicy/Config.in | 4 +++ 2 files changed, 4 insertions(+), 33 deletions(-) delete mode 100644 package/refpolicy/2.20221101/0001-mount-dbus-interface-must-be-optional.patch diff --git a/package/refpolicy/2.20221101/0001-mount-dbus-interface-must-be-optional.patch b/package/refpolicy/2.20221101/0001-mount-dbus-interface-must-be-optional.patch deleted file mode 100644 index adec7d98d0..0000000000 --- a/package/refpolicy/2.20221101/0001-mount-dbus-interface-must-be-optional.patch +++ /dev/null @@ -1,33 +0,0 @@ -From 6c6be65ccf0891391681d4662cc11f508c0f4aeb Mon Sep 17 00:00:00 2001 -From: Adam Duskett <aduskett@gmail.com> -Date: Mon, 24 Apr 2023 14:24:49 -0700 -Subject: [PATCH] mount: dbus interface must be optional - -If DBus isn't built, the build process fails due to mount.te always using a -dbus interface even if the dbus module. Fix this by setting the dbus interface -as optional. - -Signed-off-by: Adam Duskett <aduskett@gmail.com> -Upstream: https://github.com/SELinuxProject/refpolicy/commit/207b09a656c2c3ac5c286d3f7eef085325e35408 ---- - policy/modules/system/mount.te | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/policy/modules/system/mount.te b/policy/modules/system/mount.te -index d028723..af84af0 100644 ---- a/policy/modules/system/mount.te -+++ b/policy/modules/system/mount.te -@@ -145,7 +145,9 @@ selinux_getattr_fs(mount_t) - - userdom_use_all_users_fds(mount_t) - --dbus_dontaudit_write_system_bus_runtime_named_sockets(mount_t) -+optional_policy(` -+ dbus_dontaudit_write_system_bus_runtime_named_sockets(mount_t) -+') - - ifdef(`distro_redhat',` - optional_policy(` --- -2.40.0 - diff --git a/package/refpolicy/Config.in b/package/refpolicy/Config.in index 0e72b895df..d2fe391d8d 100644 --- a/package/refpolicy/Config.in +++ b/package/refpolicy/Config.in @@ -36,9 +36,13 @@ choice config BR2_PACKAGE_REFPOLICY_UPSTREAM_VERSION bool "Upstream version" + depends on BR2_ROOTFS_MERGED_USR help Use the refpolicy as provided by Buildroot. +comment "Upstream refpolicy requires a merged /usr filesystem" + depends on !BR2_ROOTFS_MERGED_USR + config BR2_PACKAGE_REFPOLICY_CUSTOM_GIT bool "Custom git repository" help -- 2.41.0 _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [Buildroot] [PATCH v3 2/2] package/refpolicy/Config.in: depend on merged usr when selecting upstream 2023-10-09 8:06 ` [Buildroot] [PATCH v3 2/2] package/refpolicy/Config.in: depend on merged usr when selecting upstream Adam Duskett @ 2023-10-09 15:12 ` Yann E. MORIN 2023-10-09 15:14 ` Yann E. MORIN 0 siblings, 1 reply; 4+ messages in thread From: Yann E. MORIN @ 2023-10-09 15:12 UTC (permalink / raw) To: Adam Duskett; +Cc: buildroot Adam, All, Thanks for the quick respin. :-) On 2023-10-09 10:06 +0200, Adam Duskett spake thusly: > Refpolicy contexts expect a merged /usr file system. In fact, there > are no references to /bin, /sbin, /lib, or /lib64 at all. However, if a user > wants to go through the trouble of creating a policy that works with a > non-merged system, they should be free to do so. As such, only select > BR2_ROOTFS_MERGED_USR if using BR2_PACKAGE_REFPOLICY_UPSTREAM_VERSION. That last sentence is now incorrect. It could have been fixed when applying, but... > Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com> > --- > v2 -> v3: Depends on, do not select BR2_ROOTFS_MERGED_USR [Yann] > > ...ount-dbus-interface-must-be-optional.patch | 33 ------------------- ... why is this patch removed? From the description of that patch, it does not look to be related to merged-usr at all... If that is due to the version bump, then it should have been part of the patch bumpng the version... Regards, Yann E. MORIN. > package/refpolicy/Config.in | 4 +++ > 2 files changed, 4 insertions(+), 33 deletions(-) > delete mode 100644 package/refpolicy/2.20221101/0001-mount-dbus-interface-must-be-optional.patch > > diff --git a/package/refpolicy/2.20221101/0001-mount-dbus-interface-must-be-optional.patch b/package/refpolicy/2.20221101/0001-mount-dbus-interface-must-be-optional.patch > deleted file mode 100644 > index adec7d98d0..0000000000 > --- a/package/refpolicy/2.20221101/0001-mount-dbus-interface-must-be-optional.patch > +++ /dev/null > @@ -1,33 +0,0 @@ > -From 6c6be65ccf0891391681d4662cc11f508c0f4aeb Mon Sep 17 00:00:00 2001 > -From: Adam Duskett <aduskett@gmail.com> > -Date: Mon, 24 Apr 2023 14:24:49 -0700 > -Subject: [PATCH] mount: dbus interface must be optional > - > -If DBus isn't built, the build process fails due to mount.te always using a > -dbus interface even if the dbus module. Fix this by setting the dbus interface > -as optional. > - > -Signed-off-by: Adam Duskett <aduskett@gmail.com> > -Upstream: https://github.com/SELinuxProject/refpolicy/commit/207b09a656c2c3ac5c286d3f7eef085325e35408 > ---- > - policy/modules/system/mount.te | 4 +++- > - 1 file changed, 3 insertions(+), 1 deletion(-) > - > -diff --git a/policy/modules/system/mount.te b/policy/modules/system/mount.te > -index d028723..af84af0 100644 > ---- a/policy/modules/system/mount.te > -+++ b/policy/modules/system/mount.te > -@@ -145,7 +145,9 @@ selinux_getattr_fs(mount_t) > - > - userdom_use_all_users_fds(mount_t) > - > --dbus_dontaudit_write_system_bus_runtime_named_sockets(mount_t) > -+optional_policy(` > -+ dbus_dontaudit_write_system_bus_runtime_named_sockets(mount_t) > -+') > - > - ifdef(`distro_redhat',` > - optional_policy(` > --- > -2.40.0 > - > diff --git a/package/refpolicy/Config.in b/package/refpolicy/Config.in > index 0e72b895df..d2fe391d8d 100644 > --- a/package/refpolicy/Config.in > +++ b/package/refpolicy/Config.in > @@ -36,9 +36,13 @@ choice > > config BR2_PACKAGE_REFPOLICY_UPSTREAM_VERSION > bool "Upstream version" > + depends on BR2_ROOTFS_MERGED_USR > help > Use the refpolicy as provided by Buildroot. > > +comment "Upstream refpolicy requires a merged /usr filesystem" > + depends on !BR2_ROOTFS_MERGED_USR > + > config BR2_PACKAGE_REFPOLICY_CUSTOM_GIT > bool "Custom git repository" > help > -- > 2.41.0 > > _______________________________________________ > buildroot mailing list > buildroot@buildroot.org > https://lists.buildroot.org/mailman/listinfo/buildroot -- .-----------------.--------------------.------------------.--------------------. | Yann E. MORIN | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: | | +33 662 376 056 | Software Designer | \ / CAMPAIGN | ___ | | +33 561 099 427 `------------.-------: X AGAINST | \e/ There is no | | http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL | v conspiracy. | '------------------------------^-------^------------------^--------------------' _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [Buildroot] [PATCH v3 2/2] package/refpolicy/Config.in: depend on merged usr when selecting upstream 2023-10-09 15:12 ` Yann E. MORIN @ 2023-10-09 15:14 ` Yann E. MORIN 0 siblings, 0 replies; 4+ messages in thread From: Yann E. MORIN @ 2023-10-09 15:14 UTC (permalink / raw) To: Adam Duskett; +Cc: buildroot Adam, All, Sorry, O was too fast at sending my reply... On 2023-10-09 17:12 +0200, Yann E. MORIN spake thusly: > On 2023-10-09 10:06 +0200, Adam Duskett spake thusly: > > Refpolicy contexts expect a merged /usr file system. In fact, there > > are no references to /bin, /sbin, /lib, or /lib64 at all Is this due to the version bump? If yes, then it should be part of the same patch. If not (i.e. that was already the case before the new version), then it should come before the version bump (so tht it can be more easily backported to maintenance branches) Regards, Yann E. MORIN. -- .-----------------.--------------------.------------------.--------------------. | Yann E. MORIN | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: | | +33 662 376 056 | Software Designer | \ / CAMPAIGN | ___ | | +33 561 099 427 `------------.-------: X AGAINST | \e/ There is no | | http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL | v conspiracy. | '------------------------------^-------^------------------^--------------------' _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2023-10-09 15:14 UTC | newest] Thread overview: 4+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2023-10-09 8:06 [Buildroot] [PATCH v3 1/2] package/refpolicy: bump version to 2.20231002 Adam Duskett 2023-10-09 8:06 ` [Buildroot] [PATCH v3 2/2] package/refpolicy/Config.in: depend on merged usr when selecting upstream Adam Duskett 2023-10-09 15:12 ` Yann E. MORIN 2023-10-09 15:14 ` Yann E. MORIN
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox