[ptxdist] [PATCH v2 14/17] policycoreutils: version bump 2.1.13 -> 3.11

[Ladislav Michl <oss-lists@triops.cz>]

From: Ladislav Michl <ladis@triops.cz>

Upstream moved the python tools to selinux-python and the semodule_*
tools to semodule-utils. While there also add PAM support.

Signed-off-by: Ladislav Michl <ladis@triops.cz>
---
 CHANGES:
 - v2: use full PTXCONF_ variable names in ptx/ifdef and ifdef, so PAM,
       audit and PAM config files actually work. Select needed libc
       parts (crypt, dl, util, pthread). Drop BusyBox find selects and
       document fixfiles requirements in help text instead.

 rules/policycoreutils.in   | 113 +++++++++++---------------
 rules/policycoreutils.make | 159 ++++++++++++++++---------------------
 2 files changed, 115 insertions(+), 157 deletions(-)

diff --git a/rules/policycoreutils.in b/rules/policycoreutils.in
index fce42b002..52208c2e4 100644
--- a/rules/policycoreutils.in
+++ b/rules/policycoreutils.in
@@ -1,20 +1,18 @@
-## SECTION=staging
-## old section:
-### SECTION=selinux
+## SECTION=selinux
 
 menuconfig POLICYCOREUTILS
 	tristate
 	prompt "policycoreutils               "
-	select LIBCAP_NG
-	select LIBCGROUP
 	select LIBSELINUX
-	select LIBSEMANAGE
 	select LIBSEPOL
-	select DBUS_GLIB	if POLICYCOREUTILS_RESTORECOND
-	select BUSYBOX_FEATURE_FIND_DEPTH	if BUSYBOX_FIND
-	select BUSYBOX_FEATURE_FIND_DELETE	if BUSYBOX_FIND
-	select BUSYBOX_SELINUX			if BUSYBOX_FIND
-	select BUSYBOX_FEATURE_FIND_CONTEXT	if BUSYBOX_FIND
+	select LIBSEMANAGE	if POLICYCOREUTILS_SEMODULE
+	select LIBSEMANAGE	if POLICYCOREUTILS_SETSEBOOL
+	select AUDIT		if POLICYCOREUTILS_AUDIT
+	select PAM		if GLOBAL_PAM
+	select LIBC_CRYPT	if !GLOBAL_PAM && (POLICYCOREUTILS_NEWROLE || POLICYCOREUTILS_RUN_INIT)
+	select LIBC_DL		if POLICYCOREUTILS_RUN_INIT
+	select LIBC_UTIL	if POLICYCOREUTILS_RUN_INIT
+	select LIBC_PTHREAD	if POLICYCOREUTILS_SETFILES
 	help
 	  This package contains the core policy utilities that are required
 	  for basic operation of an SELinux system.  These utilities include
@@ -22,90 +20,71 @@ menuconfig POLICYCOREUTILS
 	  to switch roles, and run_init to run /etc/init.d scripts in the proper
 	  context.
 
-	  STAGING: remove in ptxdist-2020.12.0
-	  Old version that need to be updated. Moved to staging with libselinux.
-
 if POLICYCOREUTILS
 
-menuconfig POLICYCOREUTILS_PYTHON
-	# needs sepolgen
-	depends on BROKEN
-	bool "python based tools"
-
-if POLICYCOREUTILS_PYTHON
-
-config POLICYCOREUTILS_AUDIT2ALLOW
-	bool "audit2allow"
-
-config POLICYCOREUTILS_SEPOLGEN_IFGEN
-	select POLICYCOREUTILS_AUDIT2ALLOW
-	bool "sepolgen-ifgen"
-
-config POLICYCOREUTILS_AUDIT2WHY
-	select POLICYCOREUTILS_AUDIT2ALLOW
-	bool "audit2why"
-
-config POLICYCOREUTILS_SANDBOX
-	bool "sandbox"
-	depends on BROKEN
-
-config POLICYCOREUTILS_CHCAT
-	select LIBSEMANAGE_PYTHON
-	depends on BROKEN
-	bool "chcat"
-
-config POLICYCOREUTILS_SEMANAGE
-	select LIBSEMANAGE_PYTHON
-	depends on BROKEN
-	bool "semanage"
-
-endif
+config POLICYCOREUTILS_AUDIT
+	bool "audit support"
+	help
+	  Let newrole, run_init and setfiles log to the audit subsystem.
 
 config POLICYCOREUTILS_LOAD_POLICY
 	bool "load_policy"
+	depends on !BUSYBOX_LOAD_POLICY || ALLYES
+
+comment "busybox' load_policy is selected!"
+	depends on BUSYBOX_LOAD_POLICY
 
 config POLICYCOREUTILS_NEWROLE
 	bool "newrole"
 
-config POLICYCOREUTILS_RESTORECOND
-	bool "restorecond"
-	depends on BROKEN
+config POLICYCOREUTILS_NEWROLE_PAM_CFG
+	bool "install /etc/pam.d/newrole"
+	depends on POLICYCOREUTILS_NEWROLE && GLOBAL_PAM
 
 config POLICYCOREUTILS_RUN_INIT
 	bool "run_init/open_init_pty"
 
+config POLICYCOREUTILS_RUN_INIT_PAM_CFG
+	bool "install /etc/pam.d/run_init"
+	depends on POLICYCOREUTILS_RUN_INIT && GLOBAL_PAM
+
 config POLICYCOREUTILS_FIXFILES
 	bool "fixfiles"
-
-config POLICYCOREUTILS_GENHOMEDIRCON
-	select POLICYCOREUTILS_SEMODULE
-	bool "genhomedircon"
+	help
+	  fixfiles script needs a 'find' supporting -context, -delete,
+	  -mindepth, -exec, -type, -print0 and parentheses, plus
+	  'chcon --reference'. BusyBox can provide these with SELinux
+	  support enabled, but 'fixfiles -N' additionally requires
+	  -mount and -newermt only provided by GNU findutils.
 
 config POLICYCOREUTILS_SECON
 	bool "secon"
 
 config POLICYCOREUTILS_SEMODULE
-	bool "semodule"
-
-config POLICYCOREUTILS_SEMODULE_DEPS
-	bool "semodule_deps"
-
-config POLICYCOREUTILS_SEMODULE_EXPAND
-	bool "semodule_expand"
-
-config POLICYCOREUTILS_SEMODULE_LINK
-	bool "semodule_link"
-
-config POLICYCOREUTILS_SEMODULE_PACKAGE
-	bool "semodule_package"
+	bool "semodule/genhomedircon"
 
 config POLICYCOREUTILS_SESTATUS
 	bool "sestatus"
+	depends on !BUSYBOX_SESTATUS || ALLYES
+
+comment "busybox' sestatus is selected!"
+	depends on BUSYBOX_SESTATUS
 
 config POLICYCOREUTILS_SETFILES
 	bool "setfiles/restorecon"
+	depends on !BUSYBOX_SETFILES && !BUSYBOX_RESTORECON || ALLYES
+
+comment "busybox' setfiles/restorecon is selected!"
+	depends on BUSYBOX_SETFILES || BUSYBOX_RESTORECON
 
 config POLICYCOREUTILS_SETSEBOOL
 	bool "setsebool"
+	depends on !BUSYBOX_SETSEBOOL || ALLYES
+
+comment "busybox' setsebool is selected!"
+	depends on BUSYBOX_SETSEBOOL
+
+config POLICYCOREUTILS_UNSETFILES
+	bool "unsetfiles"
 
 endif
diff --git a/rules/policycoreutils.make b/rules/policycoreutils.make
index 07baaebe8..a5ca327bf 100644
--- a/rules/policycoreutils.make
+++ b/rules/policycoreutils.make
@@ -14,116 +14,88 @@ PACKAGES-$(PTXCONF_POLICYCOREUTILS) += policycoreutils
 #
 # Paths and names
 #
-POLICYCOREUTILS_VERSION	:= 2.1.13
-POLICYCOREUTILS_MD5	:= 97c0b828599fe608f37894989820d71d
+POLICYCOREUTILS_VERSION	:= $(SELINUX_VERSION)
+POLICYCOREUTILS_SHA256	:= 054e41ec039731a5ee6b797a8e0b8d6e346ee1d0a9bac2f252db48c23f9a8b1b
 POLICYCOREUTILS		:= policycoreutils-$(POLICYCOREUTILS_VERSION)
 POLICYCOREUTILS_SUFFIX	:= tar.gz
-POLICYCOREUTILS_URL	:= https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20120924/$(POLICYCOREUTILS).$(POLICYCOREUTILS_SUFFIX)
+POLICYCOREUTILS_URL	:= $(SELINUX_URL)/$(POLICYCOREUTILS).$(POLICYCOREUTILS_SUFFIX)
 POLICYCOREUTILS_SOURCE	:= $(SRCDIR)/$(POLICYCOREUTILS).$(POLICYCOREUTILS_SUFFIX)
 POLICYCOREUTILS_DIR	:= $(BUILDDIR)/$(POLICYCOREUTILS)
-POLICYCOREUTILS_LICENSE	:= GPL-2.0-or-later
+POLICYCOREUTILS_LICENSE	:= GPL-2.0-only
+POLICYCOREUTILS_LICENSE_FILES	:= file://LICENSE;md5=393a5ca445f6965873eca0259a17f833
+POLICYCOREUTILS_CVE_PRODUCT	:= selinuxproject:policycoreutils
 
 # ----------------------------------------------------------------------------
 # Prepare
 # ----------------------------------------------------------------------------
 
-POLICYCOREUTILS_SUBDIRS_y := \
-	man \
-	po \
-	scripts
-
+POLICYCOREUTILS_SUBDIRS_y :=
 POLICYCOREUTILS_PROGS_y :=
 
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_AUDIT2ALLOW)		+= audit2allow
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_AUDIT2ALLOW)		+= /usr/bin/audit2allow
-
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEPOLGEN_IFGEN)	+= sepolgen-ifgen
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEPOLGEN_IFGEN)		+= /usr/bin/sepolgen-ifgen
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEPOLGEN_IFGEN)		+= /usr/bin/sepolgen-ifgen-attr-helper
-
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_AUDIT2WHY)		+= audit2why
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_AUDIT2WHY)		+= /usr/bin/audit2why
-
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_LOAD_POLICY)		+= load_policy
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_LOAD_POLICY)		+= /usr/sbin/load_policy
-
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_NEWROLE)		+= newrole
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_NEWROLE)		+= /usr/bin/newrole
-
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_RESTORECOND)		+= restorecond
-#POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_RESTORECOND)		+=
-
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_RUN_INIT)		+= run_init
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_RUN_INIT)		+= /usr/sbin/run_init
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_RUN_INIT)		+= /usr/sbin/open_init_pty
-
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SANDBOX)		+= sandbox
-#POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SANDBOX)		+=
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_LOAD_POLICY)	+= load_policy
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_LOAD_POLICY)	+= /usr/sbin/load_policy
 
-# no SUBDIRS needed for scripts
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_CHCAT)			+= /usr/bin/chcat
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_FIXFILES)		+= /usr/sbin/fixfiles
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_GENHOMEDIRCON)		+= /usr/sbin/genhomedircon
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_NEWROLE)	+= newrole
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_NEWROLE)	+= /usr/bin/newrole
 
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SECON)		+= secon
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SECON)			+= /usr/bin/secon
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_RUN_INIT)	+= run_init
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_RUN_INIT)	+= /usr/sbin/run_init
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_RUN_INIT)	+= /usr/sbin/open_init_pty
 
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEMANAGE)		+= semanage
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMANAGE)		+= /usr/sbin/semanage
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_FIXFILES)	+= scripts
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_FIXFILES)	+= /usr/sbin/fixfiles
 
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEMODULE)		+= semodule
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE)		+= /usr/sbin/semodule
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SECON)	+= secon
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SECON)		+= /usr/bin/secon
 
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_DEPS)	+= semodule_deps
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_DEPS)		+= /usr/bin/semodule_deps
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEMODULE)	+= semodule hll/pp
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE)	+= /usr/sbin/semodule
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE)	+= /usr/libexec/selinux/hll/pp
 
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_EXPAND)	+= semodule_expand
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_EXPAND)	+= /usr/bin/semodule_expand
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SESTATUS)	+= sestatus
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SESTATUS)	+= /usr/bin/sestatus
 
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_LINK)	+= semodule_link
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_LINK)		+= /usr/bin/semodule_link
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SETFILES)	+= setfiles
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SETFILES)	+= /usr/sbin/setfiles
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SETFILES)	+= /usr/sbin/restorecon_xattr
 
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_PACKAGE)	+= semodule_package
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_PACKAGE)	+= /usr/bin/semodule_package
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_PACKAGE)	+= /usr/bin/semodule_unpackage
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SETSEBOOL)	+= setsebool
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SETSEBOOL)	+= /usr/sbin/setsebool
 
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SESTATUS)		+= sestatus
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SESTATUS)		+= /usr/sbin/sestatus
-
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SETFILES)		+= setfiles
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SETFILES)		+= /usr/sbin/setfiles
-
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SETSEBOOL)		+= setsebool
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SETSEBOOL)		+= /usr/sbin/setsebool
-
-POLICYCOREUTILS_CONF_TOOL := NO
-
-# no ':=' because of $(PYTHON_SITEPACKAGES)
-POLICYCOREUTILS_MAKE_ENV = \
-	$(CROSS_ENV) \
-	SBINDIR=$(POLICYCOREUTILS_PKGDIR)/usr/sbin \
-	PYTHONLIBDIR=$(POLICYCOREUTILS_PKGDIR)$(PYTHON_SITEPACKAGES)/.. \
-	CFLAGS="-O2 -Wall" \
-	INOTIFYH="/usr/include/sys/inotify.h" \
-	PAMH="" \
-	AUDITH=""
-#
-# We don't have PAM or AUDIT, so turn off.
-#
-# Use the following to turn on:
-# (Use these paths, as of version 2.1.13)
-#
-# PAMH=/usr/include/security/pam_appl.h
-# AUDITH=/usr/include/libaudit.h
-#
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_UNSETFILES)	+= unsetfiles
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_UNSETFILES)	+= /usr/sbin/unsetfiles
 
-POLICYCOREUTILS_MAKE_OPT := \
-	SUBDIRS="$(POLICYCOREUTILS_SUBDIRS_y)" \
-	LIBDIR=$(PTXDIST_SYSROOT_TARGET)/usr/lib
-POLICYCOREUTILS_INSTALL_OPT := \
+POLICYCOREUTILS_CONF_TOOL	:= NO
+POLICYCOREUTILS_MAKE_ENV	:= $(CROSS_ENV)
+POLICYCOREUTILS_MAKE_OPT	:= \
 	SUBDIRS="$(POLICYCOREUTILS_SUBDIRS_y)" \
+	PREFIX=/usr \
+	BINDIR=/usr/bin \
+	SBINDIR=/usr/sbin \
+	ETCDIR=/etc \
+	LOCALEDIR=/usr/share/locale \
+	PAMH=$(call ptx/ifdef, PTXCONF_GLOBAL_PAM, y, n) \
+	AUDITH=$(call ptx/ifdef, PTXCONF_POLICYCOREUTILS_AUDIT, y, n) \
+	AUDIT_LOG_PRIV=n \
+	NAMESPACE_PRIV=n \
+	LSPP_PRIV=n \
+	CFLAGS="-O2 -Wall -g"
+POLICYCOREUTILS_INSTALL_OPT	:= \
+	$(POLICYCOREUTILS_MAKE_OPT) \
 	install
 
+# ----------------------------------------------------------------------------
+# Install
+# ----------------------------------------------------------------------------
+
+$(STATEDIR)/policycoreutils.install:
+	@$(call targetinfo)
+ifdef PTXCONF_GLOBAL_PAM
+	@mkdir -p $(POLICYCOREUTILS_PKGDIR)/etc/pam.d
+endif
+	@$(call world/install, POLICYCOREUTILS)
+	@$(call touch)
+
 # ----------------------------------------------------------------------------
 # Target-Install
 # ----------------------------------------------------------------------------
@@ -137,15 +109,22 @@ $(STATEDIR)/policycoreutils.targetinstall:
 	@$(call install_fixup, policycoreutils,AUTHOR,"Wolfram Sang <w.sang@pengutronix.de>")
 	@$(call install_fixup, policycoreutils,DESCRIPTION,missing)
 
+ifdef PTXCONF_POLICYCOREUTILS_NEWROLE_PAM_CFG
+	@$(call install_alternative, policycoreutils, 0, 0, 0644, /etc/pam.d/newrole)
+endif
+ifdef PTXCONF_POLICYCOREUTILS_RUN_INIT_PAM_CFG
+	@$(call install_alternative, policycoreutils, 0, 0, 0644, /etc/pam.d/run_init)
+endif
+
 	@$(foreach prog, $(POLICYCOREUTILS_PROGS_y), \
 		$(call install_copy, policycoreutils, 0, 0, 0755, -, $(prog));)
 
-ifdef PTXCONF_POLICYCOREUTILS_SETFILES
-	@$(call install_link, policycoreutils, setfiles, /usr/sbin/restorecon)
+ifdef PTXCONF_POLICYCOREUTILS_SEMODULE
+	@$(call install_link, policycoreutils, semodule, /usr/sbin/genhomedircon)
 endif
 
-ifdef PTXCONF_POLICYCOREUTILS_SEMANAGE
-	@$(call install_copy, policycoreutils, 0, 0, 0644, -, $(PYTHON_SITEPACKAGES)/seobject.py)
+ifdef PTXCONF_POLICYCOREUTILS_SETFILES
+	@$(call install_link, policycoreutils, setfiles, /usr/sbin/restorecon)
 endif
 
 ifdef PTXCONF_POLICYCOREUTILS_SESTATUS
-- 
2.47.3