[ptxdist] [PATCH v1 14/17] policycoreutils: version bump 2.1.13 -> 3.11

[Ladislav Michl <oss-lists@triops.cz>]

From: Ladislav Michl <ladis@triops.cz>

Upstream moved the python tools to selinux-python and the semodule_*
tools to semodule-utils. While there also add PAM support.

Signed-off-by: Ladislav Michl <ladis@triops.cz>
---
 rules/policycoreutils.in   |  99 +++++++++--------------
 rules/policycoreutils.make | 159 ++++++++++++++++---------------------
 2 files changed, 105 insertions(+), 153 deletions(-)

diff --git a/rules/policycoreutils.in b/rules/policycoreutils.in
index fce42b002..b9d3a1ff3 100644
--- a/rules/policycoreutils.in
+++ b/rules/policycoreutils.in
@@ -1,16 +1,14 @@
-## SECTION=staging
-## old section:
-### SECTION=selinux
+## SECTION=selinux
 
 menuconfig POLICYCOREUTILS
 	tristate
 	prompt "policycoreutils               "
-	select LIBCAP_NG
-	select LIBCGROUP
 	select LIBSELINUX
-	select LIBSEMANAGE
 	select LIBSEPOL
-	select DBUS_GLIB	if POLICYCOREUTILS_RESTORECOND
+	select LIBSEMANAGE	if POLICYCOREUTILS_SEMODULE
+	select LIBSEMANAGE	if POLICYCOREUTILS_SETSEBOOL
+	select AUDIT		if POLICYCOREUTILS_AUDIT
+	select PAM		if GLOBAL_PAM
 	select BUSYBOX_FEATURE_FIND_DEPTH	if BUSYBOX_FIND
 	select BUSYBOX_FEATURE_FIND_DELETE	if BUSYBOX_FIND
 	select BUSYBOX_SELINUX			if BUSYBOX_FIND
@@ -22,90 +20,65 @@ menuconfig POLICYCOREUTILS
 	  to switch roles, and run_init to run /etc/init.d scripts in the proper
 	  context.
 
-	  STAGING: remove in ptxdist-2020.12.0
-	  Old version that need to be updated. Moved to staging with libselinux.
-
 if POLICYCOREUTILS
 
-menuconfig POLICYCOREUTILS_PYTHON
-	# needs sepolgen
-	depends on BROKEN
-	bool "python based tools"
-
-if POLICYCOREUTILS_PYTHON
-
-config POLICYCOREUTILS_AUDIT2ALLOW
-	bool "audit2allow"
-
-config POLICYCOREUTILS_SEPOLGEN_IFGEN
-	select POLICYCOREUTILS_AUDIT2ALLOW
-	bool "sepolgen-ifgen"
-
-config POLICYCOREUTILS_AUDIT2WHY
-	select POLICYCOREUTILS_AUDIT2ALLOW
-	bool "audit2why"
-
-config POLICYCOREUTILS_SANDBOX
-	bool "sandbox"
-	depends on BROKEN
-
-config POLICYCOREUTILS_CHCAT
-	select LIBSEMANAGE_PYTHON
-	depends on BROKEN
-	bool "chcat"
-
-config POLICYCOREUTILS_SEMANAGE
-	select LIBSEMANAGE_PYTHON
-	depends on BROKEN
-	bool "semanage"
-
-endif
+config POLICYCOREUTILS_AUDIT
+	bool "audit support"
+	help
+	  Let newrole, run_init and setfiles log to the audit subsystem.
 
 config POLICYCOREUTILS_LOAD_POLICY
 	bool "load_policy"
+	depends on !BUSYBOX_LOAD_POLICY || ALLYES
+
+comment "busybox' load_policy is selected!"
+	depends on BUSYBOX_LOAD_POLICY
 
 config POLICYCOREUTILS_NEWROLE
 	bool "newrole"
 
-config POLICYCOREUTILS_RESTORECOND
-	bool "restorecond"
-	depends on BROKEN
+config POLICYCOREUTILS_NEWROLE_PAM_CFG
+	bool "install /etc/pam.d/newrole"
+	depends on POLICYCOREUTILS_NEWROLE && GLOBAL_PAM
 
 config POLICYCOREUTILS_RUN_INIT
 	bool "run_init/open_init_pty"
 
+config POLICYCOREUTILS_RUN_INIT_PAM_CFG
+	bool "install /etc/pam.d/run_init"
+	depends on POLICYCOREUTILS_RUN_INIT && GLOBAL_PAM
+
 config POLICYCOREUTILS_FIXFILES
 	bool "fixfiles"
 
-config POLICYCOREUTILS_GENHOMEDIRCON
-	select POLICYCOREUTILS_SEMODULE
-	bool "genhomedircon"
-
 config POLICYCOREUTILS_SECON
 	bool "secon"
 
 config POLICYCOREUTILS_SEMODULE
-	bool "semodule"
-
-config POLICYCOREUTILS_SEMODULE_DEPS
-	bool "semodule_deps"
-
-config POLICYCOREUTILS_SEMODULE_EXPAND
-	bool "semodule_expand"
-
-config POLICYCOREUTILS_SEMODULE_LINK
-	bool "semodule_link"
-
-config POLICYCOREUTILS_SEMODULE_PACKAGE
-	bool "semodule_package"
+	bool "semodule/genhomedircon"
 
 config POLICYCOREUTILS_SESTATUS
 	bool "sestatus"
+	depends on !BUSYBOX_SESTATUS || ALLYES
+
+comment "busybox' sestatus is selected!"
+	depends on BUSYBOX_SESTATUS
 
 config POLICYCOREUTILS_SETFILES
 	bool "setfiles/restorecon"
+	depends on !BUSYBOX_SETFILES && !BUSYBOX_RESTORECON || ALLYES
+
+comment "busybox' setfiles/restorecon is selected!"
+	depends on BUSYBOX_SETFILES || BUSYBOX_RESTORECON
 
 config POLICYCOREUTILS_SETSEBOOL
 	bool "setsebool"
+	depends on !BUSYBOX_SETSEBOOL || ALLYES
+
+comment "busybox' setsebool is selected!"
+	depends on BUSYBOX_SETSEBOOL
+
+config POLICYCOREUTILS_UNSETFILES
+	bool "unsetfiles"
 
 endif
diff --git a/rules/policycoreutils.make b/rules/policycoreutils.make
index 07baaebe8..4daf28f2c 100644
--- a/rules/policycoreutils.make
+++ b/rules/policycoreutils.make
@@ -14,116 +14,88 @@ PACKAGES-$(PTXCONF_POLICYCOREUTILS) += policycoreutils
 #
 # Paths and names
 #
-POLICYCOREUTILS_VERSION	:= 2.1.13
-POLICYCOREUTILS_MD5	:= 97c0b828599fe608f37894989820d71d
+POLICYCOREUTILS_VERSION	:= $(SELINUX_VERSION)
+POLICYCOREUTILS_SHA256	:= 054e41ec039731a5ee6b797a8e0b8d6e346ee1d0a9bac2f252db48c23f9a8b1b
 POLICYCOREUTILS		:= policycoreutils-$(POLICYCOREUTILS_VERSION)
 POLICYCOREUTILS_SUFFIX	:= tar.gz
-POLICYCOREUTILS_URL	:= https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20120924/$(POLICYCOREUTILS).$(POLICYCOREUTILS_SUFFIX)
+POLICYCOREUTILS_URL	:= $(SELINUX_URL)/$(POLICYCOREUTILS).$(POLICYCOREUTILS_SUFFIX)
 POLICYCOREUTILS_SOURCE	:= $(SRCDIR)/$(POLICYCOREUTILS).$(POLICYCOREUTILS_SUFFIX)
 POLICYCOREUTILS_DIR	:= $(BUILDDIR)/$(POLICYCOREUTILS)
-POLICYCOREUTILS_LICENSE	:= GPL-2.0-or-later
+POLICYCOREUTILS_LICENSE	:= GPL-2.0-only
+POLICYCOREUTILS_LICENSE_FILES	:= file://LICENSE;md5=393a5ca445f6965873eca0259a17f833
+POLICYCOREUTILS_CVE_PRODUCT	:= selinuxproject:policycoreutils
 
 # ----------------------------------------------------------------------------
 # Prepare
 # ----------------------------------------------------------------------------
 
-POLICYCOREUTILS_SUBDIRS_y := \
-	man \
-	po \
-	scripts
-
+POLICYCOREUTILS_SUBDIRS_y :=
 POLICYCOREUTILS_PROGS_y :=
 
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_AUDIT2ALLOW)		+= audit2allow
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_AUDIT2ALLOW)		+= /usr/bin/audit2allow
-
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEPOLGEN_IFGEN)	+= sepolgen-ifgen
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEPOLGEN_IFGEN)		+= /usr/bin/sepolgen-ifgen
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEPOLGEN_IFGEN)		+= /usr/bin/sepolgen-ifgen-attr-helper
-
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_AUDIT2WHY)		+= audit2why
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_AUDIT2WHY)		+= /usr/bin/audit2why
-
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_LOAD_POLICY)		+= load_policy
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_LOAD_POLICY)		+= /usr/sbin/load_policy
-
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_NEWROLE)		+= newrole
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_NEWROLE)		+= /usr/bin/newrole
-
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_RESTORECOND)		+= restorecond
-#POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_RESTORECOND)		+=
-
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_RUN_INIT)		+= run_init
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_RUN_INIT)		+= /usr/sbin/run_init
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_RUN_INIT)		+= /usr/sbin/open_init_pty
-
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SANDBOX)		+= sandbox
-#POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SANDBOX)		+=
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_LOAD_POLICY)	+= load_policy
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_LOAD_POLICY)	+= /usr/sbin/load_policy
 
-# no SUBDIRS needed for scripts
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_CHCAT)			+= /usr/bin/chcat
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_FIXFILES)		+= /usr/sbin/fixfiles
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_GENHOMEDIRCON)		+= /usr/sbin/genhomedircon
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_NEWROLE)	+= newrole
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_NEWROLE)	+= /usr/bin/newrole
 
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SECON)		+= secon
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SECON)			+= /usr/bin/secon
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_RUN_INIT)	+= run_init
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_RUN_INIT)	+= /usr/sbin/run_init
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_RUN_INIT)	+= /usr/sbin/open_init_pty
 
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEMANAGE)		+= semanage
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMANAGE)		+= /usr/sbin/semanage
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_FIXFILES)	+= scripts
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_FIXFILES)	+= /usr/sbin/fixfiles
 
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEMODULE)		+= semodule
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE)		+= /usr/sbin/semodule
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SECON)	+= secon
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SECON)		+= /usr/bin/secon
 
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_DEPS)	+= semodule_deps
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_DEPS)		+= /usr/bin/semodule_deps
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEMODULE)	+= semodule hll/pp
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE)	+= /usr/sbin/semodule
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE)	+= /usr/libexec/selinux/hll/pp
 
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_EXPAND)	+= semodule_expand
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_EXPAND)	+= /usr/bin/semodule_expand
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SESTATUS)	+= sestatus
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SESTATUS)	+= /usr/bin/sestatus
 
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_LINK)	+= semodule_link
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_LINK)		+= /usr/bin/semodule_link
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SETFILES)	+= setfiles
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SETFILES)	+= /usr/sbin/setfiles
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SETFILES)	+= /usr/sbin/restorecon_xattr
 
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_PACKAGE)	+= semodule_package
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_PACKAGE)	+= /usr/bin/semodule_package
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_PACKAGE)	+= /usr/bin/semodule_unpackage
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SETSEBOOL)	+= setsebool
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SETSEBOOL)	+= /usr/sbin/setsebool
 
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SESTATUS)		+= sestatus
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SESTATUS)		+= /usr/sbin/sestatus
-
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SETFILES)		+= setfiles
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SETFILES)		+= /usr/sbin/setfiles
-
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SETSEBOOL)		+= setsebool
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SETSEBOOL)		+= /usr/sbin/setsebool
-
-POLICYCOREUTILS_CONF_TOOL := NO
-
-# no ':=' because of $(PYTHON_SITEPACKAGES)
-POLICYCOREUTILS_MAKE_ENV = \
-	$(CROSS_ENV) \
-	SBINDIR=$(POLICYCOREUTILS_PKGDIR)/usr/sbin \
-	PYTHONLIBDIR=$(POLICYCOREUTILS_PKGDIR)$(PYTHON_SITEPACKAGES)/.. \
-	CFLAGS="-O2 -Wall" \
-	INOTIFYH="/usr/include/sys/inotify.h" \
-	PAMH="" \
-	AUDITH=""
-#
-# We don't have PAM or AUDIT, so turn off.
-#
-# Use the following to turn on:
-# (Use these paths, as of version 2.1.13)
-#
-# PAMH=/usr/include/security/pam_appl.h
-# AUDITH=/usr/include/libaudit.h
-#
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_UNSETFILES)	+= unsetfiles
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_UNSETFILES)	+= /usr/sbin/unsetfiles
 
-POLICYCOREUTILS_MAKE_OPT := \
-	SUBDIRS="$(POLICYCOREUTILS_SUBDIRS_y)" \
-	LIBDIR=$(PTXDIST_SYSROOT_TARGET)/usr/lib
-POLICYCOREUTILS_INSTALL_OPT := \
+POLICYCOREUTILS_CONF_TOOL	:= NO
+POLICYCOREUTILS_MAKE_ENV	:= $(CROSS_ENV)
+POLICYCOREUTILS_MAKE_OPT	:= \
 	SUBDIRS="$(POLICYCOREUTILS_SUBDIRS_y)" \
+	PREFIX=/usr \
+	BINDIR=/usr/bin \
+	SBINDIR=/usr/sbin \
+	ETCDIR=/etc \
+	LOCALEDIR=/usr/share/locale \
+	PAMH=$(call ptx/ifdef, GLOBAL_PAM, y, n) \
+	AUDITH=$(call ptx/ifdef, POLICYCOREUTILS_AUDIT, y, n) \
+	AUDIT_LOG_PRIV=n \
+	NAMESPACE_PRIV=n \
+	LSPP_PRIV=n \
+	CFLAGS="-O2 -Wall -g"
+POLICYCOREUTILS_INSTALL_OPT	:= \
+	$(POLICYCOREUTILS_MAKE_OPT) \
 	install
 
+# ----------------------------------------------------------------------------
+# Install
+# ----------------------------------------------------------------------------
+
+$(STATEDIR)/policycoreutils.install:
+	@$(call targetinfo)
+ifdef PTXCONF_GLOBAL_PAM
+	@mkdir -p $(POLICYCOREUTILS_PKGDIR)/etc/pam.d
+endif
+	@$(call world/install, POLICYCOREUTILS)
+	@$(call touch)
+
 # ----------------------------------------------------------------------------
 # Target-Install
 # ----------------------------------------------------------------------------
@@ -137,15 +109,22 @@ $(STATEDIR)/policycoreutils.targetinstall:
 	@$(call install_fixup, policycoreutils,AUTHOR,"Wolfram Sang <w.sang@pengutronix.de>")
 	@$(call install_fixup, policycoreutils,DESCRIPTION,missing)
 
+ifdef POLICYCOREUTILS_NEWROLE_PAM_CFG
+	@$(call install_alternative, policycoreutils, 0, 0, 0644, /etc/pam.d/newrole)
+endif
+ifdef POLICYCOREUTILS_RUN_INIT_PAM_CFG
+	@$(call install_alternative, policycoreutils, 0, 0, 0644, /etc/pam.d/run_init)
+endif
+
 	@$(foreach prog, $(POLICYCOREUTILS_PROGS_y), \
 		$(call install_copy, policycoreutils, 0, 0, 0755, -, $(prog));)
 
-ifdef PTXCONF_POLICYCOREUTILS_SETFILES
-	@$(call install_link, policycoreutils, setfiles, /usr/sbin/restorecon)
+ifdef PTXCONF_POLICYCOREUTILS_SEMODULE
+	@$(call install_link, policycoreutils, semodule, /usr/sbin/genhomedircon)
 endif
 
-ifdef PTXCONF_POLICYCOREUTILS_SEMANAGE
-	@$(call install_copy, policycoreutils, 0, 0, 0644, -, $(PYTHON_SITEPACKAGES)/seobject.py)
+ifdef PTXCONF_POLICYCOREUTILS_SETFILES
+	@$(call install_link, policycoreutils, setfiles, /usr/sbin/restorecon)
 endif
 
 ifdef PTXCONF_POLICYCOREUTILS_SESTATUS
-- 
2.47.3