[Buildroot] [PATCH v3 1/2] package/refpolicy: bump version to 2.20231002

[Buildroot] [PATCH v3 1/2] package/refpolicy: bump version to 2.20231002

[Adam Duskett]

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
---
 package/refpolicy/refpolicy.hash | 2 +-
 package/refpolicy/refpolicy.mk   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/package/refpolicy/refpolicy.hash b/package/refpolicy/refpolicy.hash
index a09e59c270..70d1acc9af 100644
--- a/package/refpolicy/refpolicy.hash
+++ b/package/refpolicy/refpolicy.hash
@@ -1,5 +1,5 @@
 # From https://github.com/SELinuxProject/refpolicy/releases
-sha256  44f88e62c8efcef54d019b9ca077520d5993de580926bd7575788cfa78515396  refpolicy-2.20221101.tar.bz2
+sha256  c89cd3b2e5d99765cc24536fd8e76de83951ad23e05472350328b5a4f8bee410  refpolicy-2.20231002.tar.bz2
 
 # Locally computed
 sha256  204d8eff92f95aac4df6c8122bc1505f468f3a901e5a4cc08940e0ede1938994  COPYING
diff --git a/package/refpolicy/refpolicy.mk b/package/refpolicy/refpolicy.mk
index 8fea7cc254..fb1c213b84 100644
--- a/package/refpolicy/refpolicy.mk
+++ b/package/refpolicy/refpolicy.mk
@@ -23,7 +23,7 @@ REFPOLICY_SITE = $(call qstrip,$(BR2_PACKAGE_REFPOLICY_CUSTOM_REPO_URL))
 REFPOLICY_SITE_METHOD = git
 BR_NO_CHECK_HASH_FOR += $(REFPOLICY_SOURCE)
 else
-REFPOLICY_VERSION = 2.20221101
+REFPOLICY_VERSION = 2.20231002
 REFPOLICY_SOURCE = refpolicy-$(REFPOLICY_VERSION).tar.bz2
 REFPOLICY_SITE = https://github.com/SELinuxProject/refpolicy/releases/download/RELEASE_$(subst .,_,$(REFPOLICY_VERSION))
 endif
-- 
2.41.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [PATCH v3 2/2] package/refpolicy/Config.in: depend on merged usr when selecting upstream

[Adam Duskett]

Refpolicy contexts expect a merged /usr file system. In fact, there
are no references to /bin, /sbin, /lib, or /lib64 at all. However, if a user
wants to go through the trouble of creating a policy that works with a
non-merged system, they should be free to do so. As such, only select
BR2_ROOTFS_MERGED_USR if using BR2_PACKAGE_REFPOLICY_UPSTREAM_VERSION.

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
---
v2 -> v3: Depends on, do not select BR2_ROOTFS_MERGED_USR [Yann]

 ...ount-dbus-interface-must-be-optional.patch | 33 -------------------
 package/refpolicy/Config.in                   |  4 +++
 2 files changed, 4 insertions(+), 33 deletions(-)
 delete mode 100644 package/refpolicy/2.20221101/0001-mount-dbus-interface-must-be-optional.patch

diff --git a/package/refpolicy/2.20221101/0001-mount-dbus-interface-must-be-optional.patch b/package/refpolicy/2.20221101/0001-mount-dbus-interface-must-be-optional.patch
deleted file mode 100644
index adec7d98d0..0000000000
--- a/package/refpolicy/2.20221101/0001-mount-dbus-interface-must-be-optional.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 6c6be65ccf0891391681d4662cc11f508c0f4aeb Mon Sep 17 00:00:00 2001
-From: Adam Duskett <aduskett@gmail.com>
-Date: Mon, 24 Apr 2023 14:24:49 -0700
-Subject: [PATCH] mount: dbus interface must be optional
-
-If DBus isn't built, the build process fails due to mount.te always using a
-dbus interface even if the dbus module. Fix this by setting the dbus interface
-as optional.
-
-Signed-off-by: Adam Duskett <aduskett@gmail.com>
-Upstream: https://github.com/SELinuxProject/refpolicy/commit/207b09a656c2c3ac5c286d3f7eef085325e35408
----
- policy/modules/system/mount.te | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/policy/modules/system/mount.te b/policy/modules/system/mount.te
-index d028723..af84af0 100644
---- a/policy/modules/system/mount.te
-+++ b/policy/modules/system/mount.te
-@@ -145,7 +145,9 @@ selinux_getattr_fs(mount_t)
- 
- userdom_use_all_users_fds(mount_t)
- 
--dbus_dontaudit_write_system_bus_runtime_named_sockets(mount_t)
-+optional_policy(`
-+	dbus_dontaudit_write_system_bus_runtime_named_sockets(mount_t)
-+')
- 
- ifdef(`distro_redhat',`
- 	optional_policy(`
--- 
-2.40.0
-
diff --git a/package/refpolicy/Config.in b/package/refpolicy/Config.in
index 0e72b895df..d2fe391d8d 100644
--- a/package/refpolicy/Config.in
+++ b/package/refpolicy/Config.in
@@ -36,9 +36,13 @@ choice
 
 config BR2_PACKAGE_REFPOLICY_UPSTREAM_VERSION
 	bool "Upstream version"
+	depends on BR2_ROOTFS_MERGED_USR
 	help
 	  Use the refpolicy as provided by Buildroot.
 
+comment "Upstream refpolicy requires a merged /usr filesystem"
+	depends on !BR2_ROOTFS_MERGED_USR
+
 config BR2_PACKAGE_REFPOLICY_CUSTOM_GIT
 	bool "Custom git repository"
 	help
-- 
2.41.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH v3 2/2] package/refpolicy/Config.in: depend on merged usr when selecting upstream

[Yann E. MORIN]

Adam, All,

Thanks for the quick respin. :-)

On 2023-10-09 10:06 +0200, Adam Duskett spake thusly:
> Refpolicy contexts expect a merged /usr file system. In fact, there
> are no references to /bin, /sbin, /lib, or /lib64 at all. However, if a user
> wants to go through the trouble of creating a policy that works with a
> non-merged system, they should be free to do so. As such, only select
> BR2_ROOTFS_MERGED_USR if using BR2_PACKAGE_REFPOLICY_UPSTREAM_VERSION.

That last sentence is now incorrect. It could have been fixed when
applying, but...

> Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
> ---
> v2 -> v3: Depends on, do not select BR2_ROOTFS_MERGED_USR [Yann]
> 
>  ...ount-dbus-interface-must-be-optional.patch | 33 -------------------

... why is this patch removed? From the description of that patch, it
does not look to be related to merged-usr at all...

If that is due to the version bump, then it should have been part of the
patch bumpng the version...

Regards,
Yann E. MORIN.

>  package/refpolicy/Config.in                   |  4 +++
>  2 files changed, 4 insertions(+), 33 deletions(-)
>  delete mode 100644 package/refpolicy/2.20221101/0001-mount-dbus-interface-must-be-optional.patch
> 
> diff --git a/package/refpolicy/2.20221101/0001-mount-dbus-interface-must-be-optional.patch b/package/refpolicy/2.20221101/0001-mount-dbus-interface-must-be-optional.patch
> deleted file mode 100644
> index adec7d98d0..0000000000
> --- a/package/refpolicy/2.20221101/0001-mount-dbus-interface-must-be-optional.patch
> +++ /dev/null
> @@ -1,33 +0,0 @@
> -From 6c6be65ccf0891391681d4662cc11f508c0f4aeb Mon Sep 17 00:00:00 2001
> -From: Adam Duskett <aduskett@gmail.com>
> -Date: Mon, 24 Apr 2023 14:24:49 -0700
> -Subject: [PATCH] mount: dbus interface must be optional
> -
> -If DBus isn't built, the build process fails due to mount.te always using a
> -dbus interface even if the dbus module. Fix this by setting the dbus interface
> -as optional.
> -
> -Signed-off-by: Adam Duskett <aduskett@gmail.com>
> -Upstream: https://github.com/SELinuxProject/refpolicy/commit/207b09a656c2c3ac5c286d3f7eef085325e35408
> ----
> - policy/modules/system/mount.te | 4 +++-
> - 1 file changed, 3 insertions(+), 1 deletion(-)
> -
> -diff --git a/policy/modules/system/mount.te b/policy/modules/system/mount.te
> -index d028723..af84af0 100644
> ---- a/policy/modules/system/mount.te
> -+++ b/policy/modules/system/mount.te
> -@@ -145,7 +145,9 @@ selinux_getattr_fs(mount_t)
> - 
> - userdom_use_all_users_fds(mount_t)
> - 
> --dbus_dontaudit_write_system_bus_runtime_named_sockets(mount_t)
> -+optional_policy(`
> -+	dbus_dontaudit_write_system_bus_runtime_named_sockets(mount_t)
> -+')
> - 
> - ifdef(`distro_redhat',`
> - 	optional_policy(`
> --- 
> -2.40.0
> -
> diff --git a/package/refpolicy/Config.in b/package/refpolicy/Config.in
> index 0e72b895df..d2fe391d8d 100644
> --- a/package/refpolicy/Config.in
> +++ b/package/refpolicy/Config.in
> @@ -36,9 +36,13 @@ choice
>  
>  config BR2_PACKAGE_REFPOLICY_UPSTREAM_VERSION
>  	bool "Upstream version"
> +	depends on BR2_ROOTFS_MERGED_USR
>  	help
>  	  Use the refpolicy as provided by Buildroot.
>  
> +comment "Upstream refpolicy requires a merged /usr filesystem"
> +	depends on !BR2_ROOTFS_MERGED_USR
> +
>  config BR2_PACKAGE_REFPOLICY_CUSTOM_GIT
>  	bool "Custom git repository"
>  	help
> -- 
> 2.41.0
> 
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot

-- 
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH v3 2/2] package/refpolicy/Config.in: depend on merged usr when selecting upstream

[Yann E. MORIN]

Adam, All,

Sorry, O was too fast at sending my reply...

On 2023-10-09 17:12 +0200, Yann E. MORIN spake thusly:
> On 2023-10-09 10:06 +0200, Adam Duskett spake thusly:
> > Refpolicy contexts expect a merged /usr file system. In fact, there
> > are no references to /bin, /sbin, /lib, or /lib64 at all

Is this due to the version bump?

If yes, then it should be part of the same patch. If not (i.e. that was
already the case before the new version), then it should come before the
version bump (so tht it can be more easily backported to maintenance
branches)

Regards,
Yann E. MORIN.

-- 
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot