Re: [RFC PATCH v2] projects/selinux: enroll the SELinux userspace project

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential
issues to consider:
- [Medium] projects/selinux: Dockerfile omits newrole build dependencies
  and flags
- [Low] projects/selinux: patch_guidelines.md retains template
  boilerplate and typo
--

commit e4b3796eb9b6ee214884a7fed6793943a0dfc672
Author: Stephen Smalley <stephen.smalley.work@gmail.com>

projects/selinux: enroll the SELinux userspace project

This commit enrolls the SELinux userspace project in oss-scanner by adding
its project configuration, build Dockerfile, threat model, and patch and
report guidelines.

> diff --git a/projects/selinux/Dockerfile b/projects/selinux/Dockerfile
> new file mode 100644
> index 0000000000000..ce909fdf5c285
> --- /dev/null
> +++ b/projects/selinux/Dockerfile
> @@ -0,0 +1,35 @@
> +FROM ubuntu:latest
> +ENV DEBIAN_FRONTEND=noninteractive
> +RUN apt-get update && apt-get install -y --no-install-recommends \
> +      ca-certificates build-essential pkg-config git python3 \
> +	bison \
> +	flex \
> +	gawk \
> +	gcc \
> +	gettext \
> +	libaudit-dev \
> +	libbz2-dev \
> +	libcap-dev \
> +	libcap-ng-dev \
> +	libcunit1-dev \
> +	libdbus-glib-1-dev \
> +	libpcre2-dev \
> +	ruby-dev \
> +	swig \
> +	xmlto \
> +	python3-build \
> +	python3-dev \
> +	python3-pip \
> +	python3-setuptools \
> +	python3-wheel \
> +	swig \
> +	&& rm -rf /var/lib/apt/lists/*
> +
> +# scanner contract: the checkout lives inside the image, at /src
> +COPY . /src
> +WORKDIR /src
> +
> +RUN make -k DEBUG=1 DESTDIR=/src/build install install-pywrap

[Severity: Medium]
Should this Dockerfile install libpam0g-dev and pass AUDIT_LOG_PRIV=y,
NAMESPACE_PRIV=y, and LSPP_PRIV=y to make?

projects/selinux/threat_model.md prioritizes policycoreutils/newrole first
and notes that its privileged behavior depends on those build flags.
However, policycoreutils/Makefile skips building newrole unless PAM headers
(/usr/include/security/pam_appl.h from libpam0g-dev) are present, and
policycoreutils/newrole/Makefile only compiles the privileged audit,
namespace, and LSPP code paths when those flags are enabled, leaving
newrole unbuilt in /src/build.

Also, swig is listed twice in the apt-get install package list.

> diff --git a/projects/selinux/patch_guidelines.md b/projects/selinux/patch_guidelines.md
> new file mode 100644
> index 0000000000000..7688835f95eff
> --- /dev/null
> +++ b/projects/selinux/patch_guidelines.md
> @@ -0,0 +1,13 @@
> +# How we would like patches made
> +
> +## Size and scope of a fix
> +as narrow as possible: change only the faulty function, no refactoring
> +
> +## Code style
> +format with the .clang-format at the root
> +
> +## Tests
> +add a regression test in a new file under the per-component tests/
> +
> +## Branch and commit message
> +against the main branch; subject line in the form 'component: what changed'"

[Severity: Low]
Does patch_guidelines.md retain placeholder text from the oss-scanner
example template?  The selinuxproject/selinux repository has no
.clang-format at the root or uniform per-component tests/ directories, and
the last line has a stray trailing double quote while omitting the
project's Signed-off-by requirement.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261113140145.91850-2-stephen.smalley.work@gmail.com?part=1