[Buildroot] [PATCH 1/1] package/openssh: select linux-pam if refpolicy upstream is selected

[Buildroot] [PATCH 1/1] package/openssh: select linux-pam if refpolicy upstream is selected

[Adam Duskett]

linux-pam is required to login via OpenSSH if the upstream refpolicy for
SELinux is enaabled, as linux-pam handles changing user contexts. If a
user wants to make their own policy and use a refpolicy via git, we of course
should let them do so. As such, only select linux-pam if the upstream version
of refpolicy is selected.

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
---
 package/openssh/Config.in | 1 +
 1 file changed, 1 insertion(+)

diff --git a/package/openssh/Config.in b/package/openssh/Config.in
index 08d3c7d391..e7d8f46c07 100644
--- a/package/openssh/Config.in
+++ b/package/openssh/Config.in
@@ -3,6 +3,7 @@ config BR2_PACKAGE_OPENSSH
 	depends on BR2_USE_MMU # fork()
 	select BR2_PACKAGE_OPENSSL
 	select BR2_PACKAGE_ZLIB
+	select BR2_PACKAGE_LINUX_PAM if BR2_PACKAGE_REFPOLICY_UPSTREAM_VERSION
 	help
 	  A free version of the SSH protocol suite of network
 	  connectivity tools. The standard 'ssh', 'sshd', 'scp', and
-- 
2.41.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/openssh: select linux-pam if refpolicy upstream is selected

[Thomas Petazzoni via buildroot]

On Mon,  9 Oct 2023 16:34:40 +0200
Adam Duskett <adam.duskett@amarulasolutions.com> wrote:

> linux-pam is required to login via OpenSSH if the upstream refpolicy for
> SELinux is enaabled, as linux-pam handles changing user contexts. If a
> user wants to make their own policy and use a refpolicy via git, we of course
> should let them do so. As such, only select linux-pam if the upstream version
> of refpolicy is selected.
> 
> Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
> ---
>  package/openssh/Config.in | 1 +
>  1 file changed, 1 insertion(+)

Applied to master, thanks.

Thomas
-- 
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/openssh: select linux-pam if refpolicy upstream is selected

[Peter Korsgaard]

>>>>> "Adam" == Adam Duskett <adam.duskett@amarulasolutions.com> writes:

 > linux-pam is required to login via OpenSSH if the upstream refpolicy for
 > SELinux is enaabled, as linux-pam handles changing user contexts. If a
 > user wants to make their own policy and use a refpolicy via git, we of course
 > should let them do so. As such, only select linux-pam if the upstream version
 > of refpolicy is selected.

 > Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
 > ---
 >  package/openssh/Config.in | 1 +
 >  1 file changed, 1 insertion(+)

 > diff --git a/package/openssh/Config.in b/package/openssh/Config.in
 > index 08d3c7d391..e7d8f46c07 100644
 > --- a/package/openssh/Config.in
 > +++ b/package/openssh/Config.in
 > @@ -3,6 +3,7 @@ config BR2_PACKAGE_OPENSSH
 >  	depends on BR2_USE_MMU # fork()
 >  	select BR2_PACKAGE_OPENSSL
 >  	select BR2_PACKAGE_ZLIB
 > +	select BR2_PACKAGE_LINUX_PAM if BR2_PACKAGE_REFPOLICY_UPSTREAM_VERSION

Hmm, we cannot do that without taking the dependencies on linux-pam into
consideration:

config BR2_PACKAGE_OPENSSH
        bool "openssh"
        depends on BR2_USE_MMU # fork()

..

config BR2_PACKAGE_REFPOLICY
        bool "refpolicy"
        depends on BR2_TOOLCHAIN_HAS_THREADS # libsepol
        depends on BR2_TOOLCHAIN_GCC_AT_LEAST_5 # libsepol
        depends on BR2_HOST_GCC_AT_LEAST_5 # host-setools -> host-libsepol

..

config BR2_PACKAGE_LINUX_PAM
        bool "linux-pam"
        depends on BR2_ENABLE_LOCALE
        depends on BR2_USE_WCHAR
        depends on !BR2_STATIC_LIBS
        depends on BR2_USE_MMU # fork()
        depends on BR2_TOOLCHAIN_GCC_AT_LEAST_4_9 # C11/stdatomic.h

So there is no guarantee that locale, wchar and !static are
available. You either need to propagate these dependencies to openssh if
the standard refpolicy is used or only select if they are / display a
warning otherwise.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/openssh: select linux-pam if refpolicy upstream is selected

[Thomas Petazzoni via buildroot]

On Thu, 09 Nov 2023 12:10:19 +0100
Peter Korsgaard <peter@korsgaard.com> wrote:

>  > +	select BR2_PACKAGE_LINUX_PAM if BR2_PACKAGE_REFPOLICY_UPSTREAM_VERSION  
> 
> Hmm, we cannot do that without taking the dependencies on linux-pam into
> consideration:

Dang, I totally missed that indeed :-/

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot