Re: [Buildroot] [PATCH 1/1] package/openssh: select linux-pam if refpolicy upstream is selected

[Peter Korsgaard <peter@korsgaard.com>]

>>>>> "Adam" == Adam Duskett <adam.duskett@amarulasolutions.com> writes:

 > linux-pam is required to login via OpenSSH if the upstream refpolicy for
 > SELinux is enaabled, as linux-pam handles changing user contexts. If a
 > user wants to make their own policy and use a refpolicy via git, we of course
 > should let them do so. As such, only select linux-pam if the upstream version
 > of refpolicy is selected.

 > Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
 > ---
 >  package/openssh/Config.in | 1 +
 >  1 file changed, 1 insertion(+)

 > diff --git a/package/openssh/Config.in b/package/openssh/Config.in
 > index 08d3c7d391..e7d8f46c07 100644
 > --- a/package/openssh/Config.in
 > +++ b/package/openssh/Config.in
 > @@ -3,6 +3,7 @@ config BR2_PACKAGE_OPENSSH
 >  	depends on BR2_USE_MMU # fork()
 >  	select BR2_PACKAGE_OPENSSL
 >  	select BR2_PACKAGE_ZLIB
 > +	select BR2_PACKAGE_LINUX_PAM if BR2_PACKAGE_REFPOLICY_UPSTREAM_VERSION

Hmm, we cannot do that without taking the dependencies on linux-pam into
consideration:

config BR2_PACKAGE_OPENSSH
        bool "openssh"
        depends on BR2_USE_MMU # fork()

..

config BR2_PACKAGE_REFPOLICY
        bool "refpolicy"
        depends on BR2_TOOLCHAIN_HAS_THREADS # libsepol
        depends on BR2_TOOLCHAIN_GCC_AT_LEAST_5 # libsepol
        depends on BR2_HOST_GCC_AT_LEAST_5 # host-setools -> host-libsepol

..

config BR2_PACKAGE_LINUX_PAM
        bool "linux-pam"
        depends on BR2_ENABLE_LOCALE
        depends on BR2_USE_WCHAR
        depends on !BR2_STATIC_LIBS
        depends on BR2_USE_MMU # fork()
        depends on BR2_TOOLCHAIN_GCC_AT_LEAST_4_9 # C11/stdatomic.h

So there is no guarantee that locale, wchar and !static are
available. You either need to propagate these dependencies to openssh if
the standard refpolicy is used or only select if they are / display a
warning otherwise.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot