From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Sat, 14 Nov 2026 16:56:12 +0100 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1xSG6u-00ApBi-1V for lore@lore.pengutronix.de; Sat, 14 Nov 2026 16:56:12 +0100 Received: from [127.0.0.1] (helo=metis.whiteo.stw.pengutronix.de) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xSG6t-00089Q-Gh; Sat, 14 Nov 2026 16:56:11 +0100 Received: from mx1.white.stw.pengutronix.de ([2a0a:edc0:0:b01:1d::107]) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xSG6e-00089J-FJ for ptxdist@pengutronix.de; Sat, 14 Nov 2026 16:55:56 +0100 Received: from ptx.office.stw.pengutronix.de (ptx.office.stw.4.pengutronix.de [10.9.0.3]) (Authenticated sender: relay-from-ptx.office.stw.pengutronix.de) by mx1.white.stw.pengutronix.de (Postfix) with ESMTPSA id 61E2C201E6E; Sat, 14 Nov 2026 16:55:56 +0100 (CET) ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=pengutronix.de; s=20260414; t=1794671756; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=3jL0Xnzy7G3nP2Ng7Kkyg5OTp45TH/E+omIUEaylVPA=; b=YEacRw/mVOND/zvSI5Fjhbot9sQuO6kkqHIg47N7/L9x9yKLqHJUmoK4nVKJstEc/BmAf2 5Bw6u3RqV683mF0cOVTLGNcMgAf/V/b8qRNSvjGxmqOb/MwTjoc2IKfGNsnACS0bgiakvL o3k/UgpdCmWQi+Fi4vy5eAFE7+XrBistp8tMOKbyI05qNEy5HjLPgT89I4zkUm1VKXwm0T /rqHEIL1X96Hsu222ePUUZu8MyNrjNO6zFDJbvr/4E2L/3jfKTwb6pj0/AHFpSGiOs3qjX 6qfUuH7IMMAKN6KwJIhc5NOmSPYnyQYSuJ9EFw21JIhtSH6fXUsZHoa+UPohXg== ARC-Seal: i=1; s=20260414; d=pengutronix.de; t=1794671756; a=rsa-sha256; cv=none; b=YkJK1y+yFks6bW54X/cmSiEVv0FYgprNVV6JYt4goeB7swvrjEMyKEoiv6nixH6C/LXp43 UPB4Gv2yX8znU4B9kntYVe3UGiT7w7EkN0C26qNDsLDXePiKXOqofIgfVflgS0BK4pc1BF JUAOXrJn5Dle8ex1upFQdyir10VKRlfarDihCF26SlIgBW/S2JPyVsZ+EWmtORnEbu4Dxw pc7ZKsZoQLq9XZVssphd4/6o1kvW8kLygs6o3GNDhU0K2tTDN7qEz6wIt1JkrbjvaOWWPj nKYa5NSCB9YWg5bPPWPb7xT3hQwajNiYvmJQgAxTAfkV0ZSLbXK4+lnGGnq+0A== ARC-Authentication-Results: i=1; ORIGINATING; auth=pass smtp.auth=relay-from-ptx.office.stw.pengutronix.de smtp.mailfrom=mol@pengutronix.de Received: by ptx.office.stw.pengutronix.de (Postfix, from userid 1014) id 435D61BF844; Sat, 14 Nov 2026 16:55:56 +0100 (CET) Date: Sat, 14 Nov 2026 16:55:56 +0100 From: Michael Olbrich To: Ladislav Michl Message-ID: References: <20261031203823.357406-1-oss-lists@triops.cz> <20261031203823.357406-8-oss-lists@triops.cz> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20261031203823.357406-8-oss-lists@triops.cz> X-Sent-From: Pengutronix Hildesheim X-URL: http://www.pengutronix.de/ X-IRC: #ptxdist @freenode X-Accept-Language: de,en X-Accept-Content-Type: text/plain Subject: Re: [ptxdist] [PATCH v2 07/17] libselinux: version bump 2.1.12 -> 3.11 X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Cc: ptxdist@pengutronix.de Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.whiteo.stw.pengutronix.de); SAEximRunCond expanded to false On Sat, Oct 31, 2026 at 09:38:08PM +0100, Ladislav Michl wrote: > From: Ladislav Michl > > Signed-off-by: Ladislav Michl > --- > CHANGES: > - v2: build with setrans and rpm support, libselinux exports their > symbols even when disabled, leading to undefined references > (e.g. selinux_raw_context_to_color in secon). Select LIBC_DL. > Make python wrapper depend on PYTHON3 instead of selecting it to > avoid Kconfig recursive dependency (PYTHON3 -> LIBUUID -> > UTIL_LINUX -> LIBSELINUX -> PYTHON3). This does not work. It fails at build-time because $(CROSS_PYTHON3) is not available. And where is the "UTIL_LINUX -> LIBSELINUX" dependency with these patches. > > ...PyString_FromString-with-PyUnicode_F.patch | 48 ++++++++++++ > patches/libselinux-3.11/series | 4 + > rules/libselinux.in | 57 +++++++++++--- > rules/libselinux.make | 76 +++++++++++++------ > 4 files changed, 154 insertions(+), 31 deletions(-) > create mode 100644 patches/libselinux-3.11/0001-libselinux-Replace-PyString_FromString-with-PyUnicode_F.patch > create mode 100644 patches/libselinux-3.11/series > > diff --git a/patches/libselinux-3.11/0001-libselinux-Replace-PyString_FromString-with-PyUnicode_F.patch b/patches/libselinux-3.11/0001-libselinux-Replace-PyString_FromString-with-PyUnicode_F.patch > new file mode 100644 > index 000000000..015ede608 > --- /dev/null > +++ b/patches/libselinux-3.11/0001-libselinux-Replace-PyString_FromString-with-PyUnicode_F.patch > @@ -0,0 +1,48 @@ > +From: Petr Lautrbach > +Date: Thu, 6 Aug 2026 16:30:44 +0200 > +Subject: [PATCH] libselinux: Replace PyString_FromString with > + PyUnicode_FromString for SWIG 4.5.0 compatibility > + > +SWIG 4.5.0 removed Python 2 C API compatibility macros (PyInt_*, > +PyString_*, SWIG_Python_str_*) from its runtime header pyhead.swg. > +These macros previously mapped deprecated Python 2 C API names to their > +Python 3 equivalents. > + > +Fixes: https://github.com/SELinuxProject/selinux/issues/538 > +Authored-by: Jitka Plesníková > +Signed-off-by: Petr Lautrbach > +Acked-by: Stephen Smalley > +--- > + src/selinuxswig_python.i | 6 +++--- > + 1 file changed, 3 insertions(+), 3 deletions(-) > + > +diff --git a/src/selinuxswig_python.i b/src/selinuxswig_python.i > +--- a/src/selinuxswig_python.i > ++++ b/src/selinuxswig_python.i > +@@ -69,7 +69,7 @@ > + PyObject* list = PyList_New(*$2); > + int i; > + for (i = 0; i < *$2; i++) { > +- PyList_SetItem(list, i, PyString_FromString((*$1)[i])); > ++ PyList_SetItem(list, i, PyUnicode_FromString((*$1)[i])); > + } > + $result = SWIG_AppendOutput($result, list); > + } > +@@ -102,7 +102,7 @@ > + len++; > + plist = PyList_New(len); > + for (i = 0; i < len; i++) { > +- PyList_SetItem(plist, i, PyString_FromString((*$1)[i])); > ++ PyList_SetItem(plist, i, PyUnicode_FromString((*$1)[i])); > + } > + } else { > + plist = PyList_New(0); > +@@ -119,7 +119,7 @@ > + if (*$1) { > + plist = PyList_New(result); > + for (i = 0; i < result; i++) { > +- PyList_SetItem(plist, i, PyString_FromString((*$1)[i])); > ++ PyList_SetItem(plist, i, PyUnicode_FromString((*$1)[i])); > + } > + } else { > + plist = PyList_New(0); > diff --git a/patches/libselinux-3.11/series b/patches/libselinux-3.11/series > new file mode 100644 > index 000000000..9d79f21d8 > --- /dev/null > +++ b/patches/libselinux-3.11/series > @@ -0,0 +1,4 @@ > +# generated by git-ptx-patches > +#tag:base --start-number 1 > +0001-libselinux-Replace-PyString_FromString-with-PyUnicode_F.patch > +# 9229b75b9f37589afb32a0e0c582e3b8 - git-ptx-patches magic > diff --git a/rules/libselinux.in b/rules/libselinux.in > index 6d6b1e655..0ff1358af 100644 > --- a/rules/libselinux.in > +++ b/rules/libselinux.in > @@ -1,27 +1,66 @@ > -## SECTION=staging > -## old section: > -### SECTION=selinux > +## SECTION=selinux > > menuconfig LIBSELINUX > tristate > prompt "libselinux " > - select LIBPCRE > + select LIBC_DL > + select PCRE2 > + select PCRE2_8 > select LIBSEPOL > - select PYTHON if LIBSELINUX_PYTHON > select HOST_SWIG if LIBSELINUX_PYTHON > + select HOST_PYTHON3_PIP if LIBSELINUX_PYTHON > help > libselinux provides an API for SELinux applications to get and set > process and file security contexts and to obtain security policy > decisions. Required for any applications that use the SELinux > API. > > - STAGING: remove in ptxdist-2020.12.0 > - Old version that need to be updated. Fails to build with gcc >= 9.x. > - > if LIBSELINUX > > +config LIBSELINUX_UTILS > + bool "install utilities" > + > +if LIBSELINUX_UTILS > + > +config LIBSELINUX_GETENFORCE > + bool "getenforce" > + depends on !BUSYBOX_GETENFORCE || ALLYES > + > +comment "busybox' getenforce is selected!" > + depends on BUSYBOX_GETENFORCE > + > +config LIBSELINUX_GETSEBOOL > + bool "getsebool" > + depends on !BUSYBOX_GETSEBOOL || ALLYES > + > +comment "busybox' getsebool is selected!" > + depends on BUSYBOX_GETSEBOOL > + > +config LIBSELINUX_MATCHPATHCON > + bool "matchpathcon" > + depends on !BUSYBOX_MATCHPATHCON || ALLYES > + > +comment "busybox' matchpathcon is selected!" > + depends on BUSYBOX_MATCHPATHCON > + > +config LIBSELINUX_SELINUXENABLED > + bool "selinuxenabled" > + depends on !BUSYBOX_SELINUXENABLED || ALLYES > + > +comment "busybox' selinuxenabled is selected!" > + depends on BUSYBOX_SELINUXENABLED > + > +config LIBSELINUX_SETENFORCE > + bool "setenforce" > + depends on !BUSYBOX_SETENFORCE || ALLYES > + > +comment "busybox' setenforce is selected!" > + depends on BUSYBOX_SETENFORCE > + > +endif > + > config LIBSELINUX_PYTHON > bool "python wrapper" > - depends on STAGING > + depends on PYTHON3 > > endif > diff --git a/rules/libselinux.make b/rules/libselinux.make > index 9f6b6a62f..b7bf42854 100644 > --- a/rules/libselinux.make > +++ b/rules/libselinux.make > @@ -14,62 +14,94 @@ PACKAGES-$(PTXCONF_LIBSELINUX) += libselinux > # > # Paths and names > # > -LIBSELINUX_VERSION := 2.1.12 > -LIBSELINUX_MD5 := 73270f384a032fad34b5fe075fa05ce2 > +LIBSELINUX_VERSION := $(SELINUX_VERSION) > +LIBSELINUX_SHA256 := 73d419c6e20e874adaa4019372cbd097eecf4d276e13f27ec5e67d35c0bd203c > LIBSELINUX := libselinux-$(LIBSELINUX_VERSION) > LIBSELINUX_SUFFIX := tar.gz > -LIBSELINUX_URL := https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20120924/$(LIBSELINUX).$(LIBSELINUX_SUFFIX) > +LIBSELINUX_URL := $(SELINUX_URL)/$(LIBSELINUX).$(LIBSELINUX_SUFFIX) > LIBSELINUX_SOURCE := $(SRCDIR)/$(LIBSELINUX).$(LIBSELINUX_SUFFIX) > LIBSELINUX_DIR := $(BUILDDIR)/$(LIBSELINUX) > LIBSELINUX_LICENSE := public_domain > +LIBSELINUX_LICENSE_FILES := file://LICENSE;md5=84b4d2c6ef954a2d4081e775a270d0d0 > +LIBSELINUX_CVE_PRODUCT := selinuxproject:libselinux > > # ---------------------------------------------------------------------------- > # Prepare > # ---------------------------------------------------------------------------- > > -LIBSELINUX_CONF_TOOL := NO > -# no := due to CROSS_PYTHON > -LIBSELINUX_MAKE_ENV = \ > - $(CROSS_ENV) \ > - CFLAGS="-O2 -Wall -g" \ > - PYTHON=$(CROSS_PYTHON) > -LIBSELINUX_MAKE_OPT := \ > - LIBDIR=$(PTXDIST_SYSROOT_TARGET)/usr/lib > -LIBSELINUX_INSTALL_OPT := \ > +LIBSELINUX_CONF_TOOL := NO > +LIBSELINUX_MAKE_ENV := $(CROSS_ENV) > +LIBSELINUX_MAKE_OPT = \ > + PREFIX=/usr \ > + LIBDIR=/usr/lib \ > + SHLIBDIR=/usr/lib \ > + INCLUDEDIR=/usr/include \ > + SBINDIR=/usr/sbin \ > + USE_PCRE2=y \ > + USE_LFS=y \ > + DISABLE_SHARED=n \ > + DISABLE_BOOL=n \ > + DISABLE_SETRANS=n \ > + DISABLE_RPM=n \ > + DISABLE_X11=y \ > + ANDROID_HOST=n \ > + LABEL_BACKEND_ANDROID=n \ > + CFLAGS="-O2 -Wall -g" > + > +ifdef PTXCONF_LIBSELINUX_PYTHON > +LIBSELINUX_MAKE_OPT += \ > + PYTHON=$(CROSS_PYTHON3) \ > + PYTHONLIBDIR=$(PYTHON3_SITEPACKAGES) > +endif > + > +LIBSELINUX_INSTALL_OPT = \ > + $(LIBSELINUX_MAKE_OPT) \ > install > > ifdef PTXCONF_LIBSELINUX_PYTHON > -LIBSELINUX_MAKE_OPT += pywrap > LIBSELINUX_INSTALL_OPT += install-pywrap > endif > > +# ---------------------------------------------------------------------------- > +# Compile > +# ---------------------------------------------------------------------------- > + > +$(STATEDIR)/libselinux.compile: > + @$(call targetinfo) > + @$(call world/compile, LIBSELINUX) > +ifdef PTXCONF_LIBSELINUX_PYTHON > + @$(call compile, LIBSELINUX, $(LIBSELINUX_MAKE_OPT) pywrap) Why is it necessary to build pywrap separately? Please add a comment, wo we know in the future what is needed to remove the special case. > +endif > + @$(call touch) > + > # ---------------------------------------------------------------------------- > # Target-Install > # ---------------------------------------------------------------------------- > > -LIBSELINUX_PROGS := \ > +LIBSELINUX_PROGS-$(PTXCONF_LIBSELINUX_UTILS) := \ > avcstat \ > compute_av \ > compute_create \ > compute_member \ > compute_relabel \ > - compute_user \ > getconlist \ > getdefaultcon \ > - getenforce \ > getfilecon \ > getpidcon \ > - getsebool \ > getseuser \ > - matchpathcon \ > policyvers \ > + sefcontext_compile \ > selinux_check_securetty_context \ > - selinuxenabled \ > selinuxexeccon \ > - setenforce \ > setfilecon \ > togglesebool > > +LIBSELINUX_PROGS-$(PTXCONF_LIBSELINUX_GETENFORCE) += getenforce > +LIBSELINUX_PROGS-$(PTXCONF_LIBSELINUX_GETSEBOOL) += getsebool > +LIBSELINUX_PROGS-$(PTXCONF_LIBSELINUX_MATCHPATHCON) += matchpathcon > +LIBSELINUX_PROGS-$(PTXCONF_LIBSELINUX_SELINUXENABLED) += selinuxenabled > +LIBSELINUX_PROGS-$(PTXCONF_LIBSELINUX_SETENFORCE) += setenforce > + > $(STATEDIR)/libselinux.targetinstall: > @$(call targetinfo) > > @@ -81,11 +113,11 @@ $(STATEDIR)/libselinux.targetinstall: > > @$(call install_lib, libselinux, 0, 0, 0644, libselinux) > > - @$(foreach prog, $(LIBSELINUX_PROGS), \ > + @$(foreach prog, $(LIBSELINUX_PROGS-y), \ > $(call install_copy, libselinux, 0, 0, 0755, -, /usr/sbin/$(prog));) + @$(foreach prog, $(LIBSELINUX_PROGS-y), \ $(call install_copy, libselinux, 0, 0, 0755, -, /usr/sbin/$(prog))$(ptx/nl)) That way, all errors are propagated. > > ifdef PTXCONF_LIBSELINUX_PYTHON > - @$(call install_tree, libselinux, 0, 0, -, $(PYTHON_SITEPACKAGES)) > + @$(call install_tree, libselinux, 0, 0, -, $(PYTHON3_SITEPACKAGES)) Use install_glob (to just install the .pyc files) like we do with all other Python stuff, or add a comment why that is not possible. Michael > endif > @$(call install_finish, libselinux) > > -- > 2.47.3 > > > -- Pengutronix e.K. | | Steuerwalder Str. 21 | http://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |