Re: [ptxdist] [PATCH v2 07/17] libselinux: version bump 2.1.12 -> 3.11

[Michael Olbrich <m.olbrich@pengutronix.de>]

On Sat, Oct 31, 2026 at 09:38:08PM +0100, Ladislav Michl wrote:
> From: Ladislav Michl <ladis@triops.cz>
> 
> Signed-off-by: Ladislav Michl <ladis@triops.cz>
> ---
>  CHANGES:
>  - v2: build with setrans and rpm support, libselinux exports their
>        symbols even when disabled, leading to undefined references
>        (e.g. selinux_raw_context_to_color in secon). Select LIBC_DL.
>        Make python wrapper depend on PYTHON3 instead of selecting it to
>        avoid Kconfig recursive dependency (PYTHON3 -> LIBUUID ->
>        UTIL_LINUX -> LIBSELINUX -> PYTHON3).

This does not work. It fails at build-time because $(CROSS_PYTHON3) is not
available. And where is the "UTIL_LINUX -> LIBSELINUX" dependency with
these patches.

> 
>  ...PyString_FromString-with-PyUnicode_F.patch | 48 ++++++++++++
>  patches/libselinux-3.11/series                |  4 +
>  rules/libselinux.in                           | 57 +++++++++++---
>  rules/libselinux.make                         | 76 +++++++++++++------
>  4 files changed, 154 insertions(+), 31 deletions(-)
>  create mode 100644 patches/libselinux-3.11/0001-libselinux-Replace-PyString_FromString-with-PyUnicode_F.patch
>  create mode 100644 patches/libselinux-3.11/series
> 
> diff --git a/patches/libselinux-3.11/0001-libselinux-Replace-PyString_FromString-with-PyUnicode_F.patch b/patches/libselinux-3.11/0001-libselinux-Replace-PyString_FromString-with-PyUnicode_F.patch
> new file mode 100644
> index 000000000..015ede608
> --- /dev/null
> +++ b/patches/libselinux-3.11/0001-libselinux-Replace-PyString_FromString-with-PyUnicode_F.patch
> @@ -0,0 +1,48 @@
> +From: Petr Lautrbach <lautrbach@redhat.com>
> +Date: Thu, 6 Aug 2026 16:30:44 +0200
> +Subject: [PATCH] libselinux: Replace PyString_FromString with
> + PyUnicode_FromString for SWIG 4.5.0 compatibility
> +
> +SWIG 4.5.0 removed Python 2 C API compatibility macros (PyInt_*,
> +PyString_*, SWIG_Python_str_*) from its runtime header pyhead.swg.
> +These macros previously mapped deprecated Python 2 C API names to their
> +Python 3 equivalents.
> +
> +Fixes: https://github.com/SELinuxProject/selinux/issues/538
> +Authored-by: Jitka Plesníková <jplesnik@redhat.com>
> +Signed-off-by: Petr Lautrbach <lautrbach@redhat.com>
> +Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
> +---
> + src/selinuxswig_python.i | 6 +++---
> + 1 file changed, 3 insertions(+), 3 deletions(-)
> +
> +diff --git a/src/selinuxswig_python.i b/src/selinuxswig_python.i
> +--- a/src/selinuxswig_python.i
> ++++ b/src/selinuxswig_python.i
> +@@ -69,7 +69,7 @@
> + 	PyObject* list = PyList_New(*$2);
> + 	int i;
> + 	for (i = 0; i < *$2; i++) {
> +-		PyList_SetItem(list, i, PyString_FromString((*$1)[i]));
> ++		PyList_SetItem(list, i, PyUnicode_FromString((*$1)[i]));
> + 	}
> + 	$result = SWIG_AppendOutput($result, list);
> + }
> +@@ -102,7 +102,7 @@
> + 			len++;
> + 		plist = PyList_New(len);
> + 		for (i = 0; i < len; i++) {
> +-			PyList_SetItem(plist, i, PyString_FromString((*$1)[i]));
> ++			PyList_SetItem(plist, i, PyUnicode_FromString((*$1)[i]));
> + 		}
> + 	} else {
> + 		plist = PyList_New(0);
> +@@ -119,7 +119,7 @@
> + 	if (*$1) {
> + 		plist = PyList_New(result);
> + 		for (i = 0; i < result; i++) {
> +-			PyList_SetItem(plist, i, PyString_FromString((*$1)[i]));
> ++			PyList_SetItem(plist, i, PyUnicode_FromString((*$1)[i]));
> + 		}
> + 	} else {
> + 		plist = PyList_New(0);
> diff --git a/patches/libselinux-3.11/series b/patches/libselinux-3.11/series
> new file mode 100644
> index 000000000..9d79f21d8
> --- /dev/null
> +++ b/patches/libselinux-3.11/series
> @@ -0,0 +1,4 @@
> +# generated by git-ptx-patches
> +#tag:base --start-number 1
> +0001-libselinux-Replace-PyString_FromString-with-PyUnicode_F.patch
> +# 9229b75b9f37589afb32a0e0c582e3b8  - git-ptx-patches magic
> diff --git a/rules/libselinux.in b/rules/libselinux.in
> index 6d6b1e655..0ff1358af 100644
> --- a/rules/libselinux.in
> +++ b/rules/libselinux.in
> @@ -1,27 +1,66 @@
> -## SECTION=staging
> -## old section:
> -### SECTION=selinux
> +## SECTION=selinux
>  
>  menuconfig LIBSELINUX
>  	tristate
>  	prompt "libselinux                    "
> -	select LIBPCRE
> +	select LIBC_DL
> +	select PCRE2
> +	select PCRE2_8
>  	select LIBSEPOL
> -	select PYTHON		if LIBSELINUX_PYTHON
>  	select HOST_SWIG	if LIBSELINUX_PYTHON
> +	select HOST_PYTHON3_PIP	if LIBSELINUX_PYTHON
>  	help
>  	  libselinux provides an API for SELinux applications to get and set
>  	  process and file security contexts and to obtain security policy
>  	  decisions. Required for any applications that use the SELinux
>  	  API.
>  
> -	  STAGING: remove in ptxdist-2020.12.0
> -	  Old version that need to be updated. Fails to build with gcc >= 9.x.
> -
>  if LIBSELINUX
>  
> +config LIBSELINUX_UTILS
> +	bool "install utilities"
> +
> +if LIBSELINUX_UTILS
> +
> +config LIBSELINUX_GETENFORCE
> +	bool "getenforce"
> +	depends on !BUSYBOX_GETENFORCE || ALLYES
> +
> +comment "busybox' getenforce is selected!"
> +	depends on BUSYBOX_GETENFORCE
> +
> +config LIBSELINUX_GETSEBOOL
> +	bool "getsebool"
> +	depends on !BUSYBOX_GETSEBOOL || ALLYES
> +
> +comment "busybox' getsebool is selected!"
> +	depends on BUSYBOX_GETSEBOOL
> +
> +config LIBSELINUX_MATCHPATHCON
> +	bool "matchpathcon"
> +	depends on !BUSYBOX_MATCHPATHCON || ALLYES
> +
> +comment "busybox' matchpathcon is selected!"
> +	depends on BUSYBOX_MATCHPATHCON
> +
> +config LIBSELINUX_SELINUXENABLED
> +	bool "selinuxenabled"
> +	depends on !BUSYBOX_SELINUXENABLED || ALLYES
> +
> +comment "busybox' selinuxenabled is selected!"
> +	depends on BUSYBOX_SELINUXENABLED
> +
> +config LIBSELINUX_SETENFORCE
> +	bool "setenforce"
> +	depends on !BUSYBOX_SETENFORCE || ALLYES
> +
> +comment "busybox' setenforce is selected!"
> +	depends on BUSYBOX_SETENFORCE
> +
> +endif
> +
>  config LIBSELINUX_PYTHON
>  	bool "python wrapper"
> -	depends on STAGING
> +	depends on PYTHON3
>  
>  endif
> diff --git a/rules/libselinux.make b/rules/libselinux.make
> index 9f6b6a62f..b7bf42854 100644
> --- a/rules/libselinux.make
> +++ b/rules/libselinux.make
> @@ -14,62 +14,94 @@ PACKAGES-$(PTXCONF_LIBSELINUX) += libselinux
>  #
>  # Paths and names
>  #
> -LIBSELINUX_VERSION	:= 2.1.12
> -LIBSELINUX_MD5		:= 73270f384a032fad34b5fe075fa05ce2
> +LIBSELINUX_VERSION	:= $(SELINUX_VERSION)
> +LIBSELINUX_SHA256	:= 73d419c6e20e874adaa4019372cbd097eecf4d276e13f27ec5e67d35c0bd203c
>  LIBSELINUX		:= libselinux-$(LIBSELINUX_VERSION)
>  LIBSELINUX_SUFFIX	:= tar.gz
> -LIBSELINUX_URL		:= https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20120924/$(LIBSELINUX).$(LIBSELINUX_SUFFIX)
> +LIBSELINUX_URL		:= $(SELINUX_URL)/$(LIBSELINUX).$(LIBSELINUX_SUFFIX)
>  LIBSELINUX_SOURCE	:= $(SRCDIR)/$(LIBSELINUX).$(LIBSELINUX_SUFFIX)
>  LIBSELINUX_DIR		:= $(BUILDDIR)/$(LIBSELINUX)
>  LIBSELINUX_LICENSE	:= public_domain
> +LIBSELINUX_LICENSE_FILES	:= file://LICENSE;md5=84b4d2c6ef954a2d4081e775a270d0d0
> +LIBSELINUX_CVE_PRODUCT	:= selinuxproject:libselinux
>  
>  # ----------------------------------------------------------------------------
>  # Prepare
>  # ----------------------------------------------------------------------------
>  
> -LIBSELINUX_CONF_TOOL := NO
> -# no := due to CROSS_PYTHON
> -LIBSELINUX_MAKE_ENV = \
> -	$(CROSS_ENV) \
> -	CFLAGS="-O2 -Wall -g" \
> -	PYTHON=$(CROSS_PYTHON)
> -LIBSELINUX_MAKE_OPT := \
> -	LIBDIR=$(PTXDIST_SYSROOT_TARGET)/usr/lib
> -LIBSELINUX_INSTALL_OPT := \
> +LIBSELINUX_CONF_TOOL	:= NO
> +LIBSELINUX_MAKE_ENV	:= $(CROSS_ENV)
> +LIBSELINUX_MAKE_OPT	= \
> +	PREFIX=/usr \
> +	LIBDIR=/usr/lib \
> +	SHLIBDIR=/usr/lib \
> +	INCLUDEDIR=/usr/include \
> +	SBINDIR=/usr/sbin \
> +	USE_PCRE2=y \
> +	USE_LFS=y \
> +	DISABLE_SHARED=n \
> +	DISABLE_BOOL=n \
> +	DISABLE_SETRANS=n \
> +	DISABLE_RPM=n \
> +	DISABLE_X11=y \
> +	ANDROID_HOST=n \
> +	LABEL_BACKEND_ANDROID=n \
> +	CFLAGS="-O2 -Wall -g"
> +
> +ifdef PTXCONF_LIBSELINUX_PYTHON
> +LIBSELINUX_MAKE_OPT	+= \
> +	PYTHON=$(CROSS_PYTHON3) \
> +	PYTHONLIBDIR=$(PYTHON3_SITEPACKAGES)
> +endif
> +
> +LIBSELINUX_INSTALL_OPT	= \
> +	$(LIBSELINUX_MAKE_OPT) \
>  	install
>  
>  ifdef PTXCONF_LIBSELINUX_PYTHON
> -LIBSELINUX_MAKE_OPT	+= pywrap
>  LIBSELINUX_INSTALL_OPT	+= install-pywrap
>  endif
>  
> +# ----------------------------------------------------------------------------
> +# Compile
> +# ----------------------------------------------------------------------------
> +
> +$(STATEDIR)/libselinux.compile:
> +	@$(call targetinfo)
> +	@$(call world/compile, LIBSELINUX)
> +ifdef PTXCONF_LIBSELINUX_PYTHON
> +	@$(call compile, LIBSELINUX, $(LIBSELINUX_MAKE_OPT) pywrap)

Why is it necessary to build pywrap separately? Please add a comment, wo we
know in the future what is needed to remove the special case.

> +endif
> +	@$(call touch)
> +
>  # ----------------------------------------------------------------------------
>  # Target-Install
>  # ----------------------------------------------------------------------------
>  
> -LIBSELINUX_PROGS := \
> +LIBSELINUX_PROGS-$(PTXCONF_LIBSELINUX_UTILS) := \
>  	avcstat \
>  	compute_av \
>  	compute_create \
>  	compute_member \
>  	compute_relabel \
> -	compute_user \
>  	getconlist \
>  	getdefaultcon \
> -	getenforce \
>  	getfilecon \
>  	getpidcon \
> -	getsebool \
>  	getseuser \
> -	matchpathcon \
>  	policyvers \
> +	sefcontext_compile \
>  	selinux_check_securetty_context \
> -	selinuxenabled \
>  	selinuxexeccon \
> -	setenforce \
>  	setfilecon \
>  	togglesebool
>  
> +LIBSELINUX_PROGS-$(PTXCONF_LIBSELINUX_GETENFORCE)	+= getenforce
> +LIBSELINUX_PROGS-$(PTXCONF_LIBSELINUX_GETSEBOOL)	+= getsebool
> +LIBSELINUX_PROGS-$(PTXCONF_LIBSELINUX_MATCHPATHCON)	+= matchpathcon
> +LIBSELINUX_PROGS-$(PTXCONF_LIBSELINUX_SELINUXENABLED)	+= selinuxenabled
> +LIBSELINUX_PROGS-$(PTXCONF_LIBSELINUX_SETENFORCE)	+= setenforce
> +
>  $(STATEDIR)/libselinux.targetinstall:
>  	@$(call targetinfo)
>  
> @@ -81,11 +113,11 @@ $(STATEDIR)/libselinux.targetinstall:
>  
>  	@$(call install_lib, libselinux, 0, 0, 0644, libselinux)
>  
> -	@$(foreach prog, $(LIBSELINUX_PROGS), \
> +	@$(foreach prog, $(LIBSELINUX_PROGS-y), \
>  		$(call install_copy, libselinux, 0, 0, 0755, -, /usr/sbin/$(prog));)


+	@$(foreach prog, $(LIBSELINUX_PROGS-y), \
 		$(call install_copy, libselinux, 0, 0, 0755, -, /usr/sbin/$(prog))$(ptx/nl))

That way, all errors are propagated.

>  
>  ifdef PTXCONF_LIBSELINUX_PYTHON
> -	@$(call install_tree, libselinux, 0, 0, -, $(PYTHON_SITEPACKAGES))
> +	@$(call install_tree, libselinux, 0, 0, -, $(PYTHON3_SITEPACKAGES))

Use install_glob (to just install the .pyc files) like we do with all other
Python stuff, or add a comment why that is not possible.

Michael

>  endif
>  	@$(call install_finish, libselinux)
>  
> -- 
> 2.47.3
> 
> 
> 

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |