From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Sat, 31 Oct 2026 21:38:53 +0100 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1xNFqm-005gPe-22 for lore@lore.pengutronix.de; Sat, 31 Oct 2026 21:38:53 +0100 Received: from [127.0.0.1] (helo=metis.whiteo.stw.pengutronix.de) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xNFql-0002dB-GQ; Sat, 31 Oct 2026 21:38:51 +0100 Received: from mx1.white.stw.pengutronix.de ([2a0a:edc0:0:b01:1d::107]) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xNFqN-0001wg-JX for ptxdist@pengutronix.de; Sat, 31 Oct 2026 21:38:27 +0100 Received: from h4.cmg2.smtp.forpsi.com (h4.cmg2.smtp.forpsi.com [185.129.138.189]) by mx1.white.stw.pengutronix.de (Postfix) with ESMTPS id 7271A202882 for ; Sat, 31 Oct 2026 21:38:27 +0100 (CET) ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=pengutronix.de; s=20260414; t=1793479107; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=TKFSMO2z8ZfKoKDbcL09xdl857UPwrWmxXEzLwDe6Is=; b=LA00NG+jz+FtE7kNWCKa9nUi6N294Vx+xp5sN3MqyNMeK7oDcEJqy8M5ZGdDHmO4h8GzQK vW2Wo0jH+AjbL3O5v6H23d6Y87K1Zgo+rhiHBkPQ/gJbqToTpDgAJHTKECUWtythOcI7kT tlIfgGsOMYTGOZaLNcDXDh0s7Q9rqxYbdivvpJn/2JRpu48Il7RrOFZutvQ+we8bSfdliU CBjGdpAisxJ/yxa7KNuuMdI7A8VPQucGwmiembTtFqLcH4anvgS/ruU5Fp6ut43HNsahMn /OW0SWlV+rkiosAbTK3hPfKIV8sXmMbQzCLkZWGRQEXB3fYmMZanYxlYy898gg== ARC-Authentication-Results: i=1; mx1.white.stw.pengutronix.de; dkim=pass header.d=triops.cz header.s=f2019 header.b=P1ch5gHL; spf=none (mx1.white.stw.pengutronix.de: domain of oss-lists@triops.cz has no SPF policy when checking 185.129.138.189) smtp.mailfrom=oss-lists@triops.cz; dmarc=none ARC-Seal: i=1; s=20260414; d=pengutronix.de; t=1793479107; a=rsa-sha256; cv=none; b=Wx63KAUyzYNCixY4GHEMjzjcQ1VKzkQwisg6lIej50BtLzmsQigL2DTTboQUpEg9QenNl7 ca0fmkONnKKgSvgeEqUtN2HX7jDjzPFzyBOleGLIpAUW4aaFUrSPjC4pBc7kLRNaBZXGzO 1dkr391qEIR1K1r6B0TfiVMU9+7g2nToQ/VQw84+Kcor7WJHutnVz6153aSb2Zo/3850wF 2gmfiTn/nSi8ARISI6QTKQCgB6jyL+nPw9xvqSWYCeMYfvEG55y7KMqxP7IrcPMiYVDmGY VHjAzxYb114NIGDiKkYzpWE21p854JTFrWtuBofUyQ79JvOGtECv8GQ7tXZtQw== Received: from localhost.localdomain ([91.218.190.200]) by cmgsmtp with ESMTPSA id NFqKxUpN38HlqNFqNxK73Y; Sat, 31 Oct 2026 21:38:27 +0100 From: Ladislav Michl To: ptxdist@pengutronix.de Date: Sat, 31 Oct 2026 21:38:08 +0100 Message-ID: <20261031203823.357406-8-oss-lists@triops.cz> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261031203823.357406-1-oss-lists@triops.cz> References: <20261031203823.357406-1-oss-lists@triops.cz> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-CMAE-Envelope: MS4xfOUL+NQ2rVoubYeLoGE32BRgRKNm0ZyaYYZiOYd7Z1ds3Fx2+kxuLOXnJIH5hCJxnQICL7unBaq45f0sV82UWStZHYPZarUjfV30Q9wXJFJnZBIFEiP4 zH9H1rcJGWTWwKUnBEnLEIiZU06F56zVUdum5zsiN8uxJf5sP6KUoGd4I9u8fLY0kGxDwpkBCZ9HIh2DUAomxzXUdh9RkKu0EwY= X-Spamd-Result: default: False [-2.10 / 15.00]; BAYES_HAM(-3.00)[100.00%]; MID_CONTAINS_FROM(1.00)[]; ONCE_RECEIVED(0.20)[]; R_DKIM_ALLOW(-0.20)[triops.cz:s=f2019]; MIME_GOOD(-0.10)[text/plain]; RCPT_COUNT_ONE(0.00)[1]; RCVD_TLS_ALL(0.00)[]; ASN(0.00)[asn:24806, ipnet:185.129.136.0/22, country:CZ]; MIME_TRACE(0.00)[0:+]; RCVD_COUNT_ONE(0.00)[1]; ARC_SIGNED(0.00)[pengutronix.de:s=20260414:i=1]; ARC_NA(0.00)[]; RCVD_VIA_SMTP_AUTH(0.00)[]; DMARC_NA(0.00)[triops.cz]; TO_MATCH_ENVRCPT_ALL(0.00)[]; FROM_HAS_DN(0.00)[]; NEURAL_SPAM(0.00)[0.464]; FROM_EQ_ENVFROM(0.00)[]; TO_DN_NONE(0.00)[]; R_SPF_NA(0.00)[no SPF record]; DKIM_TRACE(0.00)[triops.cz:+] X-Rspamd-Action: no action X-Rspamd-Server: mx1 X-Stat-Signature: opagk7mg6977nowso94hnc9u7qzi7k9h X-Rspamd-Queue-Id: 7271A202882 Subject: [ptxdist] [PATCH v2 07/17] libselinux: version bump 2.1.12 -> 3.11 X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.whiteo.stw.pengutronix.de); SAEximRunCond expanded to false From: Ladislav Michl Signed-off-by: Ladislav Michl --- CHANGES: - v2: build with setrans and rpm support, libselinux exports their symbols even when disabled, leading to undefined references (e.g. selinux_raw_context_to_color in secon). Select LIBC_DL. Make python wrapper depend on PYTHON3 instead of selecting it to avoid Kconfig recursive dependency (PYTHON3 -> LIBUUID -> UTIL_LINUX -> LIBSELINUX -> PYTHON3). ...PyString_FromString-with-PyUnicode_F.patch | 48 ++++++++++++ patches/libselinux-3.11/series | 4 + rules/libselinux.in | 57 +++++++++++--- rules/libselinux.make | 76 +++++++++++++------ 4 files changed, 154 insertions(+), 31 deletions(-) create mode 100644 patches/libselinux-3.11/0001-libselinux-Replace-PyString_FromString-with-PyUnicode_F.patch create mode 100644 patches/libselinux-3.11/series diff --git a/patches/libselinux-3.11/0001-libselinux-Replace-PyString_FromString-with-PyUnicode_F.patch b/patches/libselinux-3.11/0001-libselinux-Replace-PyString_FromString-with-PyUnicode_F.patch new file mode 100644 index 000000000..015ede608 --- /dev/null +++ b/patches/libselinux-3.11/0001-libselinux-Replace-PyString_FromString-with-PyUnicode_F.patch @@ -0,0 +1,48 @@ +From: Petr Lautrbach +Date: Thu, 6 Aug 2026 16:30:44 +0200 +Subject: [PATCH] libselinux: Replace PyString_FromString with + PyUnicode_FromString for SWIG 4.5.0 compatibility + +SWIG 4.5.0 removed Python 2 C API compatibility macros (PyInt_*, +PyString_*, SWIG_Python_str_*) from its runtime header pyhead.swg. +These macros previously mapped deprecated Python 2 C API names to their +Python 3 equivalents. + +Fixes: https://github.com/SELinuxProject/selinux/issues/538 +Authored-by: Jitka Plesníková +Signed-off-by: Petr Lautrbach +Acked-by: Stephen Smalley +--- + src/selinuxswig_python.i | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/src/selinuxswig_python.i b/src/selinuxswig_python.i +--- a/src/selinuxswig_python.i ++++ b/src/selinuxswig_python.i +@@ -69,7 +69,7 @@ + PyObject* list = PyList_New(*$2); + int i; + for (i = 0; i < *$2; i++) { +- PyList_SetItem(list, i, PyString_FromString((*$1)[i])); ++ PyList_SetItem(list, i, PyUnicode_FromString((*$1)[i])); + } + $result = SWIG_AppendOutput($result, list); + } +@@ -102,7 +102,7 @@ + len++; + plist = PyList_New(len); + for (i = 0; i < len; i++) { +- PyList_SetItem(plist, i, PyString_FromString((*$1)[i])); ++ PyList_SetItem(plist, i, PyUnicode_FromString((*$1)[i])); + } + } else { + plist = PyList_New(0); +@@ -119,7 +119,7 @@ + if (*$1) { + plist = PyList_New(result); + for (i = 0; i < result; i++) { +- PyList_SetItem(plist, i, PyString_FromString((*$1)[i])); ++ PyList_SetItem(plist, i, PyUnicode_FromString((*$1)[i])); + } + } else { + plist = PyList_New(0); diff --git a/patches/libselinux-3.11/series b/patches/libselinux-3.11/series new file mode 100644 index 000000000..9d79f21d8 --- /dev/null +++ b/patches/libselinux-3.11/series @@ -0,0 +1,4 @@ +# generated by git-ptx-patches +#tag:base --start-number 1 +0001-libselinux-Replace-PyString_FromString-with-PyUnicode_F.patch +# 9229b75b9f37589afb32a0e0c582e3b8 - git-ptx-patches magic diff --git a/rules/libselinux.in b/rules/libselinux.in index 6d6b1e655..0ff1358af 100644 --- a/rules/libselinux.in +++ b/rules/libselinux.in @@ -1,27 +1,66 @@ -## SECTION=staging -## old section: -### SECTION=selinux +## SECTION=selinux menuconfig LIBSELINUX tristate prompt "libselinux " - select LIBPCRE + select LIBC_DL + select PCRE2 + select PCRE2_8 select LIBSEPOL - select PYTHON if LIBSELINUX_PYTHON select HOST_SWIG if LIBSELINUX_PYTHON + select HOST_PYTHON3_PIP if LIBSELINUX_PYTHON help libselinux provides an API for SELinux applications to get and set process and file security contexts and to obtain security policy decisions. Required for any applications that use the SELinux API. - STAGING: remove in ptxdist-2020.12.0 - Old version that need to be updated. Fails to build with gcc >= 9.x. - if LIBSELINUX +config LIBSELINUX_UTILS + bool "install utilities" + +if LIBSELINUX_UTILS + +config LIBSELINUX_GETENFORCE + bool "getenforce" + depends on !BUSYBOX_GETENFORCE || ALLYES + +comment "busybox' getenforce is selected!" + depends on BUSYBOX_GETENFORCE + +config LIBSELINUX_GETSEBOOL + bool "getsebool" + depends on !BUSYBOX_GETSEBOOL || ALLYES + +comment "busybox' getsebool is selected!" + depends on BUSYBOX_GETSEBOOL + +config LIBSELINUX_MATCHPATHCON + bool "matchpathcon" + depends on !BUSYBOX_MATCHPATHCON || ALLYES + +comment "busybox' matchpathcon is selected!" + depends on BUSYBOX_MATCHPATHCON + +config LIBSELINUX_SELINUXENABLED + bool "selinuxenabled" + depends on !BUSYBOX_SELINUXENABLED || ALLYES + +comment "busybox' selinuxenabled is selected!" + depends on BUSYBOX_SELINUXENABLED + +config LIBSELINUX_SETENFORCE + bool "setenforce" + depends on !BUSYBOX_SETENFORCE || ALLYES + +comment "busybox' setenforce is selected!" + depends on BUSYBOX_SETENFORCE + +endif + config LIBSELINUX_PYTHON bool "python wrapper" - depends on STAGING + depends on PYTHON3 endif diff --git a/rules/libselinux.make b/rules/libselinux.make index 9f6b6a62f..b7bf42854 100644 --- a/rules/libselinux.make +++ b/rules/libselinux.make @@ -14,62 +14,94 @@ PACKAGES-$(PTXCONF_LIBSELINUX) += libselinux # # Paths and names # -LIBSELINUX_VERSION := 2.1.12 -LIBSELINUX_MD5 := 73270f384a032fad34b5fe075fa05ce2 +LIBSELINUX_VERSION := $(SELINUX_VERSION) +LIBSELINUX_SHA256 := 73d419c6e20e874adaa4019372cbd097eecf4d276e13f27ec5e67d35c0bd203c LIBSELINUX := libselinux-$(LIBSELINUX_VERSION) LIBSELINUX_SUFFIX := tar.gz -LIBSELINUX_URL := https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20120924/$(LIBSELINUX).$(LIBSELINUX_SUFFIX) +LIBSELINUX_URL := $(SELINUX_URL)/$(LIBSELINUX).$(LIBSELINUX_SUFFIX) LIBSELINUX_SOURCE := $(SRCDIR)/$(LIBSELINUX).$(LIBSELINUX_SUFFIX) LIBSELINUX_DIR := $(BUILDDIR)/$(LIBSELINUX) LIBSELINUX_LICENSE := public_domain +LIBSELINUX_LICENSE_FILES := file://LICENSE;md5=84b4d2c6ef954a2d4081e775a270d0d0 +LIBSELINUX_CVE_PRODUCT := selinuxproject:libselinux # ---------------------------------------------------------------------------- # Prepare # ---------------------------------------------------------------------------- -LIBSELINUX_CONF_TOOL := NO -# no := due to CROSS_PYTHON -LIBSELINUX_MAKE_ENV = \ - $(CROSS_ENV) \ - CFLAGS="-O2 -Wall -g" \ - PYTHON=$(CROSS_PYTHON) -LIBSELINUX_MAKE_OPT := \ - LIBDIR=$(PTXDIST_SYSROOT_TARGET)/usr/lib -LIBSELINUX_INSTALL_OPT := \ +LIBSELINUX_CONF_TOOL := NO +LIBSELINUX_MAKE_ENV := $(CROSS_ENV) +LIBSELINUX_MAKE_OPT = \ + PREFIX=/usr \ + LIBDIR=/usr/lib \ + SHLIBDIR=/usr/lib \ + INCLUDEDIR=/usr/include \ + SBINDIR=/usr/sbin \ + USE_PCRE2=y \ + USE_LFS=y \ + DISABLE_SHARED=n \ + DISABLE_BOOL=n \ + DISABLE_SETRANS=n \ + DISABLE_RPM=n \ + DISABLE_X11=y \ + ANDROID_HOST=n \ + LABEL_BACKEND_ANDROID=n \ + CFLAGS="-O2 -Wall -g" + +ifdef PTXCONF_LIBSELINUX_PYTHON +LIBSELINUX_MAKE_OPT += \ + PYTHON=$(CROSS_PYTHON3) \ + PYTHONLIBDIR=$(PYTHON3_SITEPACKAGES) +endif + +LIBSELINUX_INSTALL_OPT = \ + $(LIBSELINUX_MAKE_OPT) \ install ifdef PTXCONF_LIBSELINUX_PYTHON -LIBSELINUX_MAKE_OPT += pywrap LIBSELINUX_INSTALL_OPT += install-pywrap endif +# ---------------------------------------------------------------------------- +# Compile +# ---------------------------------------------------------------------------- + +$(STATEDIR)/libselinux.compile: + @$(call targetinfo) + @$(call world/compile, LIBSELINUX) +ifdef PTXCONF_LIBSELINUX_PYTHON + @$(call compile, LIBSELINUX, $(LIBSELINUX_MAKE_OPT) pywrap) +endif + @$(call touch) + # ---------------------------------------------------------------------------- # Target-Install # ---------------------------------------------------------------------------- -LIBSELINUX_PROGS := \ +LIBSELINUX_PROGS-$(PTXCONF_LIBSELINUX_UTILS) := \ avcstat \ compute_av \ compute_create \ compute_member \ compute_relabel \ - compute_user \ getconlist \ getdefaultcon \ - getenforce \ getfilecon \ getpidcon \ - getsebool \ getseuser \ - matchpathcon \ policyvers \ + sefcontext_compile \ selinux_check_securetty_context \ - selinuxenabled \ selinuxexeccon \ - setenforce \ setfilecon \ togglesebool +LIBSELINUX_PROGS-$(PTXCONF_LIBSELINUX_GETENFORCE) += getenforce +LIBSELINUX_PROGS-$(PTXCONF_LIBSELINUX_GETSEBOOL) += getsebool +LIBSELINUX_PROGS-$(PTXCONF_LIBSELINUX_MATCHPATHCON) += matchpathcon +LIBSELINUX_PROGS-$(PTXCONF_LIBSELINUX_SELINUXENABLED) += selinuxenabled +LIBSELINUX_PROGS-$(PTXCONF_LIBSELINUX_SETENFORCE) += setenforce + $(STATEDIR)/libselinux.targetinstall: @$(call targetinfo) @@ -81,11 +113,11 @@ $(STATEDIR)/libselinux.targetinstall: @$(call install_lib, libselinux, 0, 0, 0644, libselinux) - @$(foreach prog, $(LIBSELINUX_PROGS), \ + @$(foreach prog, $(LIBSELINUX_PROGS-y), \ $(call install_copy, libselinux, 0, 0, 0755, -, /usr/sbin/$(prog));) ifdef PTXCONF_LIBSELINUX_PYTHON - @$(call install_tree, libselinux, 0, 0, -, $(PYTHON_SITEPACKAGES)) + @$(call install_tree, libselinux, 0, 0, -, $(PYTHON3_SITEPACKAGES)) endif @$(call install_finish, libselinux) -- 2.47.3