[meta-selinux][PATCH 1/6] python-ipy: remove recipe

[meta-selinux][PATCH 1/6] python-ipy: remove recipe

[Yi Zhao]

The python-ipy had been moved to meta-python.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
---
 recipes-devtools/python/python-ipy.inc      | 18 ------------------
 recipes-devtools/python/python-ipy_1.00.bb  |  2 --
 recipes-devtools/python/python3-ipy_1.00.bb |  2 --
 3 files changed, 22 deletions(-)
 delete mode 100644 recipes-devtools/python/python-ipy.inc
 delete mode 100644 recipes-devtools/python/python-ipy_1.00.bb
 delete mode 100644 recipes-devtools/python/python3-ipy_1.00.bb

diff --git a/recipes-devtools/python/python-ipy.inc b/recipes-devtools/python/python-ipy.inc
deleted file mode 100644
index ba4c2bd..0000000
--- a/recipes-devtools/python/python-ipy.inc
+++ /dev/null
@@ -1,18 +0,0 @@
-SUMMARY = "Python module for handling IPv4 and IPv6 Addresses and Networks"
-DESCRIPTION = "IPy is a Python module for handling IPv4 and IPv6 Addresses and Networks \
-in a fashion similar to perl's Net::IP and friends. The IP class allows \
-a comfortable parsing and handling for most notations in use for IPv4 \
-and IPv6 Addresses and Networks."
-SECTION = "devel/python"
-HOMEPAGE = "https://github.com/haypo/python-ipy"
-LICENSE = "BSD-3-Clause"
-LIC_FILES_CHKSUM = "file://COPYING;md5=848d24919845901b4f48bae5f13252e6"
-
-SRC_URI[md5sum] = "1a90c68174234672241a7e60c7ea0fb9"
-SRC_URI[sha256sum] = "2f2bf658a858d43868d8a4352b3889cf78c66e2ce678b300dcf518c9149ba621"
-
-inherit pypi
-
-PYPI_PACKAGE = "IPy"
-
-BBCLASSEXTEND = "native"
diff --git a/recipes-devtools/python/python-ipy_1.00.bb b/recipes-devtools/python/python-ipy_1.00.bb
deleted file mode 100644
index 587a517..0000000
--- a/recipes-devtools/python/python-ipy_1.00.bb
+++ /dev/null
@@ -1,2 +0,0 @@
-inherit setuptools
-require python-ipy.inc
diff --git a/recipes-devtools/python/python3-ipy_1.00.bb b/recipes-devtools/python/python3-ipy_1.00.bb
deleted file mode 100644
index ea6a105..0000000
--- a/recipes-devtools/python/python3-ipy_1.00.bb
+++ /dev/null
@@ -1,2 +0,0 @@
-inherit setuptools3
-require python-ipy.inc
-- 
2.17.1

[meta-selinux][PATCH 2/6] libselinux-python: fix race issue in parallel build

[Yi Zhao]

The install-pywarp target doesn't depend on swigify target because the
selinux.py is not generated by swigify target but pywrap target.
Here is the dependency chain:
  install-pywrap -> pywrap -> $(SWIGFILES) -> $(SWIGPYOUT) -> $(SWIGCOUT)
  -> selinux.py

But in the recipe, the swigify target is added explicitly in do_install:
  do_install_append() {
    oe_runmake install-pywrap swigify \
    [snip]
  }

This target will regenerate the selinux.py when do_install. So there
will be a potential race issue in parallel build. The install-pywrap
target is trying to install selinux.py when swigify target is generating
the file. Then an empty selinux.py will be installed. Remove the target
swigify to fix this issue.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
---
 recipes-security/selinux/libselinux-python.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/recipes-security/selinux/libselinux-python.inc b/recipes-security/selinux/libselinux-python.inc
index 62354b2..24407e8 100644
--- a/recipes-security/selinux/libselinux-python.inc
+++ b/recipes-security/selinux/libselinux-python.inc
@@ -33,7 +33,7 @@ do_compile() {
 }
 
 do_install() {
-    oe_runmake install-pywrap swigify \
+    oe_runmake install-pywrap \
             PYCEXT='.so' \
             PYLIBVER='python${PYTHON_BASEVERSION}${PYTHON_ABI}' \
             PYTHONLIBDIR='${D}${libdir}/python${PYTHON_BASEVERSION}/site-packages'
-- 
2.17.1

[meta-selinux][PATCH 3/6] libsemanage: fix race issue in parallel build

[Yi Zhao]

The install-pywarp target doesn't depend on swigify target because the
semanage.py is not generated by swigify target but pywrap target.
Here is the dependency chain:
  install-pywrap -> pywrap -> $(SWIGSO) -> $(SWIGLOBJ) -> $(SWIGCOUT)
  -> semanage.py

But in the recipe, the swigify target is added explicitly in do_install:
  do_install_append() {
    oe_runmake install-pywrap swigify \
    [snip]
  }

This target will regenerate the semanage.py when do_install. So there
will be a potential race issue in parallel build. The install-pywrap
target is trying to install semanage.py when swigify target is
generating the file. Then an empty semanage.py will be installed. Remove
the target swigify to fix this issue.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
---
 recipes-security/selinux/libsemanage.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/recipes-security/selinux/libsemanage.inc b/recipes-security/selinux/libsemanage.inc
index 9dc1095..81a3eda 100644
--- a/recipes-security/selinux/libsemanage.inc
+++ b/recipes-security/selinux/libsemanage.inc
@@ -32,7 +32,7 @@ do_compile_append() {
 }
 
 do_install_append() {
-    oe_runmake install-pywrap swigify \
+    oe_runmake install-pywrap \
             PYCEXT='.so' \
             PYLIBVER='python${PYTHON_BASEVERSION}${PYTHON_ABI}' \
             PYTHONLIBDIR='${D}${libdir}/python${PYTHON_BASEVERSION}/site-packages'
-- 
2.17.1

[meta-selinux][PATCH 4/6] selinux-initsh.inc: install selinux-init.sh and selinux-labeldev.sh when using systemd

[Yi Zhao]

The commit 5fd3c5b71edb99659aeb5cb5903088d84517382e introduced an issue
that selinux-init.sh and selinux-labeldev.sh are not installed when
using systemd which will cause the selinux-ini.service and
selinux-labeldev.service fail to startup. Move the do_install codes from
selinux-autorelabel to selinux-initsh.inc to make sure install these
scripts when using systemd.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
---
 recipes-security/selinux/selinux-autorelabel_0.1.bb | 3 ---
 recipes-security/selinux/selinux-initsh.inc         | 9 +++++++--
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/recipes-security/selinux/selinux-autorelabel_0.1.bb b/recipes-security/selinux/selinux-autorelabel_0.1.bb
index 7e7d08c..b898c3b 100644
--- a/recipes-security/selinux/selinux-autorelabel_0.1.bb
+++ b/recipes-security/selinux/selinux-autorelabel_0.1.bb
@@ -21,9 +21,6 @@ require selinux-initsh.inc
 
 do_install_append() {
 	if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then
-		install -d ${D}${bindir}
-		install -m 0755 ${WORKDIR}/${SELINUX_SCRIPT_SRC}.sh ${D}${bindir}
-		sed -i -e '/.*HERE$/d' ${D}${bindir}/${SELINUX_SCRIPT_SRC}.sh
 		echo "# first boot relabelling" > ${D}/.autorelabel
 	fi
 }
diff --git a/recipes-security/selinux/selinux-initsh.inc b/recipes-security/selinux/selinux-initsh.inc
index 6084762..0a6cf4b 100644
--- a/recipes-security/selinux/selinux-initsh.inc
+++ b/recipes-security/selinux/selinux-initsh.inc
@@ -27,8 +27,13 @@ do_install () {
 	       -e '/.*HERE$/d' -e '/.*Contents.*sysvinit/d' \
 	       ${D}${sysconfdir}/init.d/${SELINUX_SCRIPT_DST}
 
-	install -d ${D}${systemd_unitdir}/system
-	install -m 0644 ${WORKDIR}/${SELINUX_SCRIPT_SRC}.service ${D}${systemd_unitdir}/system
+    if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then
+        install -d ${D}${systemd_unitdir}/system
+        install -m 0644 ${WORKDIR}/${SELINUX_SCRIPT_SRC}.service ${D}${systemd_unitdir}/system
+        install -d ${D}${bindir}
+        install -m 0755 ${WORKDIR}/${SELINUX_SCRIPT_SRC}.sh ${D}${bindir}
+        sed -i -e '/.*HERE$/d' ${D}${bindir}/${SELINUX_SCRIPT_SRC}.sh
+    fi
 }
 
 sysroot_stage_all_append () {
-- 
2.17.1

[meta-selinux][PATCH 5/6] refpolicy: add UPSTREAM_CHECK_GITTAGREGEX

[Yi Zhao]

Add UPSTREAM_CHECK_GITTAGREGEX to make devtool check-upgrade-status
works.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
---
 recipes-security/refpolicy/refpolicy_2.20190201.inc | 2 ++
 recipes-security/refpolicy/refpolicy_git.inc        | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/recipes-security/refpolicy/refpolicy_2.20190201.inc b/recipes-security/refpolicy/refpolicy_2.20190201.inc
index 78c6e74..4030b36 100644
--- a/recipes-security/refpolicy/refpolicy_2.20190201.inc
+++ b/recipes-security/refpolicy/refpolicy_2.20190201.inc
@@ -2,6 +2,8 @@ SRC_URI = "https://github.com/SELinuxProject/refpolicy/releases/download/RELEASE
 SRC_URI[md5sum] = "babb0d5ca2ae333631d25392b2b3ce8d"
 SRC_URI[sha256sum] = "ed620dc91c4e09eee6271b373f7c61a364a82ea57bd2dc86ca1f7075304e2843"
 
+UPSTREAM_CHECK_GITTAGREGEX = "RELEASE_(?P<pver>\d+_\d+)"
+
 FILESEXTRAPATHS_prepend := "${THISDIR}/refpolicy-2.20190201:"
 
 include refpolicy_common.inc
diff --git a/recipes-security/refpolicy/refpolicy_git.inc b/recipes-security/refpolicy/refpolicy_git.inc
index 8aeaf27..8de07c0 100644
--- a/recipes-security/refpolicy/refpolicy_git.inc
+++ b/recipes-security/refpolicy/refpolicy_git.inc
@@ -4,6 +4,8 @@ SRC_URI = "git://github.com/SELinuxProject/refpolicy.git;protocol=git;branch=mas
 
 SRCREV_refpolicy ?= "df696a325404b84c2c931c85356510005e5e6916"
 
+UPSTREAM_CHECK_GITTAGREGEX = "RELEASE_(?P<pver>\d+_\d+)"
+
 FILESEXTRAPATHS_prepend := "${THISDIR}/refpolicy-git:"
 
 include refpolicy_common.inc
-- 
2.17.1

[meta-selinux][PATCH 6/6] refpolicy: switch to python3

[Yi Zhao]

* Switch to python3
* Update policy-version to 31 to match selinux 2.9

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
---
 recipes-security/refpolicy/refpolicy_common.inc | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/recipes-security/refpolicy/refpolicy_common.inc b/recipes-security/refpolicy/refpolicy_common.inc
index 2d9ace5..2083a37 100644
--- a/recipes-security/refpolicy/refpolicy_common.inc
+++ b/recipes-security/refpolicy/refpolicy_common.inc
@@ -72,12 +72,12 @@ EXTRANATIVEPATH += "bzip2-native"
 DEPENDS += "bzip2-replacement-native checkpolicy-native policycoreutils-native semodule-utils-native m4-native"
 
 RDEPENDS_${PN}-dev =+ " \
-        python \
+        python3-core \
 "
 
 PACKAGE_ARCH = "${MACHINE_ARCH}"
 
-inherit pythonnative
+inherit python3native
 
 PARALLEL_MAKE = ""
 
@@ -181,7 +181,7 @@ path = ${STAGING_DIR_NATIVE}${sbindir_native}/sefcontext_compile
 args = \$@
 [end]
 
-policy-version = 30
+policy-version = 31
 EOF
 
 	# Create policy store and build the policy
-- 
2.17.1

Re: [meta-selinux][PATCH 4/6] selinux-initsh.inc: install selinux-init.sh and selinux-labeldev.sh when using systemd

[Joe MacDonald]

[-- Attachment #1: Type: text/plain, Size: 2751 bytes --]

Hi Yi,

I've merged the others in this series, can you elaborate a bit on how
this ensures we don't have a problem coming back that 5fd3c5b71 was
intended to address?

Thanks,
-J.

[[meta-selinux][PATCH 4/6] selinux-initsh.inc: install selinux-init.sh and selinux-labeldev.sh when using systemd] On 19.12.23 (Mon 16:21) Yi Zhao wrote:

> The commit 5fd3c5b71edb99659aeb5cb5903088d84517382e introduced an issue
> that selinux-init.sh and selinux-labeldev.sh are not installed when
> using systemd which will cause the selinux-ini.service and
> selinux-labeldev.service fail to startup. Move the do_install codes from
> selinux-autorelabel to selinux-initsh.inc to make sure install these
> scripts when using systemd.
> 
> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
> ---
>  recipes-security/selinux/selinux-autorelabel_0.1.bb | 3 ---
>  recipes-security/selinux/selinux-initsh.inc         | 9 +++++++--
>  2 files changed, 7 insertions(+), 5 deletions(-)
> 
> diff --git a/recipes-security/selinux/selinux-autorelabel_0.1.bb b/recipes-security/selinux/selinux-autorelabel_0.1.bb
> index 7e7d08c..b898c3b 100644
> --- a/recipes-security/selinux/selinux-autorelabel_0.1.bb
> +++ b/recipes-security/selinux/selinux-autorelabel_0.1.bb
> @@ -21,9 +21,6 @@ require selinux-initsh.inc
>  
>  do_install_append() {
>  	if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then
> -		install -d ${D}${bindir}
> -		install -m 0755 ${WORKDIR}/${SELINUX_SCRIPT_SRC}.sh ${D}${bindir}
> -		sed -i -e '/.*HERE$/d' ${D}${bindir}/${SELINUX_SCRIPT_SRC}.sh
>  		echo "# first boot relabelling" > ${D}/.autorelabel
>  	fi
>  }
> diff --git a/recipes-security/selinux/selinux-initsh.inc b/recipes-security/selinux/selinux-initsh.inc
> index 6084762..0a6cf4b 100644
> --- a/recipes-security/selinux/selinux-initsh.inc
> +++ b/recipes-security/selinux/selinux-initsh.inc
> @@ -27,8 +27,13 @@ do_install () {
>  	       -e '/.*HERE$/d' -e '/.*Contents.*sysvinit/d' \
>  	       ${D}${sysconfdir}/init.d/${SELINUX_SCRIPT_DST}
>  
> -	install -d ${D}${systemd_unitdir}/system
> -	install -m 0644 ${WORKDIR}/${SELINUX_SCRIPT_SRC}.service ${D}${systemd_unitdir}/system
> +    if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then
> +        install -d ${D}${systemd_unitdir}/system
> +        install -m 0644 ${WORKDIR}/${SELINUX_SCRIPT_SRC}.service ${D}${systemd_unitdir}/system
> +        install -d ${D}${bindir}
> +        install -m 0755 ${WORKDIR}/${SELINUX_SCRIPT_SRC}.sh ${D}${bindir}
> +        sed -i -e '/.*HERE$/d' ${D}${bindir}/${SELINUX_SCRIPT_SRC}.sh
> +    fi
>  }
>  
>  sysroot_stage_all_append () {
> -- 
> 2.17.1
> 

-- 
-Joe MacDonald.
:wq

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 201 bytes --]

Re: [meta-selinux][PATCH 4/6] selinux-initsh.inc: install selinux-init.sh and selinux-labeldev.sh when using systemd

[Yi Zhao]

On 12/24/19 10:22 PM, Joe MacDonald wrote:
> Hi Yi,
>
> I've merged the others in this series, can you elaborate a bit on how
> this ensures we don't have a problem coming back that 5fd3c5b71 was
> intended to address?


There are 3 recipes require selinux-initsh.inc: selinux-init_0.1.bb, 
selinux-labeldev_0.1.bb and selinux-autorelabel_0.1.bb. The 
${SELINUX_SCRIPT_SRC}.sh will expand to different script name  in each 
of recipes: selinux-init.sh, selinux-labeldev.sh and 
selinux-autorelabel.sh. These scripts will be invoked by systemd 
services. The commit 5fd3c5b71edb99659aeb5cb5903088d84517382e move all 
installation codes to selinux-autorelabel_0.1.bb which make the 
selinux-init.sh and selinux-labeldev.sh will be not installed. This 
patch keeps the touching .autorelabel code in the selinux-autorelabel 
recipe and move the rest codes back to selinux-initsh.inc.


//Yi


>
> Thanks,
> -J.
>
> [[meta-selinux][PATCH 4/6] selinux-initsh.inc: install selinux-init.sh and selinux-labeldev.sh when using systemd] On 19.12.23 (Mon 16:21) Yi Zhao wrote:
>
>> The commit 5fd3c5b71edb99659aeb5cb5903088d84517382e introduced an issue
>> that selinux-init.sh and selinux-labeldev.sh are not installed when
>> using systemd which will cause the selinux-ini.service and
>> selinux-labeldev.service fail to startup. Move the do_install codes from
>> selinux-autorelabel to selinux-initsh.inc to make sure install these
>> scripts when using systemd.
>>
>> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>> ---
>>   recipes-security/selinux/selinux-autorelabel_0.1.bb | 3 ---
>>   recipes-security/selinux/selinux-initsh.inc         | 9 +++++++--
>>   2 files changed, 7 insertions(+), 5 deletions(-)
>>
>> diff --git a/recipes-security/selinux/selinux-autorelabel_0.1.bb b/recipes-security/selinux/selinux-autorelabel_0.1.bb
>> index 7e7d08c..b898c3b 100644
>> --- a/recipes-security/selinux/selinux-autorelabel_0.1.bb
>> +++ b/recipes-security/selinux/selinux-autorelabel_0.1.bb
>> @@ -21,9 +21,6 @@ require selinux-initsh.inc
>>   
>>   do_install_append() {
>>   	if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then
>> -		install -d ${D}${bindir}
>> -		install -m 0755 ${WORKDIR}/${SELINUX_SCRIPT_SRC}.sh ${D}${bindir}
>> -		sed -i -e '/.*HERE$/d' ${D}${bindir}/${SELINUX_SCRIPT_SRC}.sh
>>   		echo "# first boot relabelling" > ${D}/.autorelabel
>>   	fi
>>   }
>> diff --git a/recipes-security/selinux/selinux-initsh.inc b/recipes-security/selinux/selinux-initsh.inc
>> index 6084762..0a6cf4b 100644
>> --- a/recipes-security/selinux/selinux-initsh.inc
>> +++ b/recipes-security/selinux/selinux-initsh.inc
>> @@ -27,8 +27,13 @@ do_install () {
>>   	       -e '/.*HERE$/d' -e '/.*Contents.*sysvinit/d' \
>>   	       ${D}${sysconfdir}/init.d/${SELINUX_SCRIPT_DST}
>>   
>> -	install -d ${D}${systemd_unitdir}/system
>> -	install -m 0644 ${WORKDIR}/${SELINUX_SCRIPT_SRC}.service ${D}${systemd_unitdir}/system
>> +    if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then
>> +        install -d ${D}${systemd_unitdir}/system
>> +        install -m 0644 ${WORKDIR}/${SELINUX_SCRIPT_SRC}.service ${D}${systemd_unitdir}/system
>> +        install -d ${D}${bindir}
>> +        install -m 0755 ${WORKDIR}/${SELINUX_SCRIPT_SRC}.sh ${D}${bindir}
>> +        sed -i -e '/.*HERE$/d' ${D}${bindir}/${SELINUX_SCRIPT_SRC}.sh
>> +    fi
>>   }
>>   
>>   sysroot_stage_all_append () {
>> -- 
>> 2.17.1
>>