pool/libselinux
SHA256
2
0
Fork 3
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Accepting request 1095431 from home:mcepl:branches:security:SELinux

Browse Source 
- Remove separate libselinux-bindings SPEC file (bsc#1212618).
- Add explicit BuildRequires for python3-pip and python3-wheel on
  15.5, currently the macros don't do the right thing
- allow building this with different python versions, to make this
  usable for the new sle15 macro (using python3.11)
- Add python-wheel build dependency to build correctly with latest
  python-pip version.
- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.
- Add -ffat-lto-objects to CFLAGS to prevent rpmlint errors because
  of LTO
- Enable LTO as it works fine now.
- Update to version 3.5:
  * check for truncations
  * avoid newline in avc message
  * bail out on path truncations
  * add getpidprevcon to gather the previous context before the last
    exec of a given process
  * Workaround for heap overhead of pcre
  * fix memory leaks on the audit2why module init
  * ignore invalid class name lookup
- Drop restorecon_pin_file.patch, is upstream
- Refreshed python3.8-compat.patch
- Added additional developer key (Jason Zaman)
- Fixed initrd check in selinux-ready (bnc#1186127)
- Added restorecon_pin_file.patch. Fixes issus when running 
  fixfiles/restorecon
- Update to version 3.4:
  * Use PCRE2 by default
  * Make selinux_log() and is_context_customizable() thread-safe
  * Prevent leakeing file descriptors
  * Correctly hash specfiles larger than 4G
- Refreshed skip_cycles.patch
- Add Requires for exact libselinux1 version for selinux-tools
- Simplyfied check for correct boot paramaters in selinux-ready
  (bsc#1195361)
- Update to version 3.3:
  * Lots of smaller issues fixed found by fuzzing
- Add missing libselinux-utils Provides to selinux-tools so that
  %selinux_requires works
- Remove Recommends for selinux-autorelabel. It's better to have this
  in the policy package itself (bsc#1181837)
- Switch to pcre2:
  + Replace pcre-devel BuildRequires with pkgconfig(libpcre2-8)
  + Pass USE_PCRE2=y to make.
  + Replace pkgconfig(libpcre) Requires in -devel static with
    pkgconfig(libpcre2-8).
- Update to version 3.2:
  * Use mmap()'ed kernel status page instead of netlink by default.
    See "KERNEL STATUS PAGE" section in avc_init(3) for more details.
  * New log callback levels for enforcing and policy load notices -
    SELINUX_POLICYLOAD, SELINUX_SETENFORCE
  * Changed userspace AVC setenforce and policy load messages to audit
    format.
- Add Recommends: selinux-autorelabel, which is very important
  for healthy use of the SELinux on the system (/.autorelabel
  mechanism) (bsc#1181837).
- install to /usr (boo#1029961)
- Update to version 3.1:
  * selinux/flask.h, selinux/av_permissions.h and sepol/policydb/flask.h were
    removed. All userspace object managers should have been updated to use the
    dynamic class/perm mapping support.
    Use string_to_security_class(3) and string_to_av_perm(3) to map the class
    and permission names to their policy values, or selinux_set_mapping(3) to
    create a mapping from class and permission index values used by the
    application to the policy values.
  * Removed restrictions in libsepol and checkpolicy that required all declared
    initial SIDs to be assigned a context.
  * Support for new policy capability genfs_seclabel_symlinks
  * selinuxfs is mounted with noexec and nosuid
  * `security_compute_user()` was deprecated
  * Refreshed python3.8-compat.patch
- Added skip_cycles.patch to skip directory cycles and not error
  out
- Update to version 3.0
  * Ignore the stem when looking up all matches in file context
  * Save digest of all partial matches for directory
  * Use Python distutils to install SELinux python bindings
  * ensure that digest_len is not zero
  * fix string conversion of unknown perms
  * mark all exported function "extern"
  Dropped Use-Python-distutils-to-install-SELinux.patch, included
  upstream
- Added swig4_moduleimport.patch to prevent import errors due to
  SWIG 4
- Added Use-Python-distutils-to-install-SELinux.patch to use 
  Python's distutils instead of building and installing python 
  bindings manually
- Add python3.8-compat.patch which makes build possible even with
  Python 3.8, which doesn’t automatically adds -lpython<ver>
- In selinux-ready
  * Removed check for selinux-policy package as we don't ship one
    (bsc#1136845)
  * Add check that restorecond is installed and enabled 
- Disable LTO (boo#1133244).
- Set License: to correct value (bsc#1135710)
- Disable LTO (boo#1133244).
- Update to version 2.9
  * Add security_reject_unknown(3) man page
  * Change matchpathcon usage to match with matchpathcon manpage
  * Do not define gettid() if glibc >= 2.30 is used
  * Fix RESOURCE_LEAK defects reported by coverity scan
  * Fix line wrapping in selabel_file.5
  * Do not dereference symlink with statfs in selinux_restorecon
  * Fix overly strict validation of file_contexts.bin
  * Fix selinux_restorecon() on non-SELinux hosts
  * Fix the whatis line for the selinux_boolean_sub.3 manpage
  * Fix printf format string specifier for uint64_t
  * Fix handling of unknown classes/perms
  * Set an appropriate errno in booleans.c
- Dropped python3.patch, is now upstream
- Remove unneeded build requires for python3 (bsc#1120255) 
- Update to version 2.8 (bsc#1111732)
  For changes please see
  https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20180524/RELEASE-20180524.txt
- ran spec-cleaner on spec files
- Update to version 2.7.
    * %files needed to be heavily modified
    * Based expressly on python3, not just python
  For changes please see
  https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20170804/RELEASE-20170804.txt
- Updated spec file to use python3. Added python3.patch to fix
  build
- Update to version 2.6. Notable changes:
  * selinux_restorecon: fix realpath logic
  * sefcontext_compile: invert semantics of "-r" flag
  * sefcontext_compile: Add "-i" flag
  * Introduce configurable backends
  * Add function to find security.restorecon_last entries
  * Add openrc_contexts functions
  * Add support for pcre2
  * Handle NULL pcre study data
  * Add setfiles support to selinux_restorecon(3)
  * Evaluate inodes in selinux_restorecon(3)
  * Change the location of _selinux.so
  * Explain how to free policy type from selinux_getpolicytype()
  * Compare absolute pathname in matchpathcon -V
  * Add selinux_snapperd_contexts_path()
  * Modify audit2why analyze function to use loaded policy
  * Avoid mounting /proc outside of selinux_init_load_policy()
  * Fix location of selinuxfs mount point
  * Only mount /proc if necessary
  * procattr: return einval for <= 0 pid args
  * procattr: return error on invalid pid_t input
- Dropped
  * libselinux-2.2-ruby.patch 
  * libselinux-proc-mount-only-if-needed.patch 
  * python-selinux-swig-3.10.patch
- readv-proto.patch: include <sys/uio.h> for readv prototype
- -devel static subpackage requires libpcre-devel and libsepol-devel
- Avoid mounting /proc outside of selinux_init_load_policy().
  (Stephen Smalley) reverts upstream 5a8d8c4, 9df4988, fixes
  among other things systemd seccomp sandboxing otherwise all
  filters must allow mount(2)
  (libselinux-proc-mount-only-if-needed.patch)
- Update RPM groups, trim description and combine filelist entries.
- Adjusted source link
- add patch: python-selinux-swig-3.10.patch, fixed boo#985368
  * swig-3.10 in Factory use importlib instead of imp to find
    _selinux.so. imp searched the same directory as __init__.py
    is while importlib searchs only standard paths. so we have
    to move _selinux.so. fixed by upstream
- update version 2.5
  * Add selinux_restorecon function
  * read_spec_entry: fail on non-ascii
  * Add man information about thread specific functions
  * Don't wrap rpm_execcon with DISABLE_RPM with SWIG
  * Correct line count for property and service context files
  * label_file: fix memory leaks and uninitialized jump
  * Replace selabel_digest hash function
  * Fix selabel_open(3) services if no digest requested
  * Add selabel_digest function
  * Flush the class/perm string mapping cache on policy reload
  * Fix restorecon when path has no context
  * Free memory when processing media and x specfiles
  * Fix mmap memory release for file labeling
  * Add policy context validation to sefcontext_compile
  * Do not treat an empty file_contexts(.local) as an error
  * Fail hard on invalid property_contexts entries
  * Fail hard on invalid file_contexts entries
  * Support context validation on file_contexts.bin
  * Add selabel_cmp interface and label_file backend
  * Support specifying file_contexts.bin file path
  * Support file_contexts.bin without file_contexts
  * Simplify procattr cache
  * Use /proc/thread-self when available
  * Add const to selinux_opt for label backends
  * Fix binary file labels for regexes with metachars
  * Fix file labels for regexes with metachars
  * Fix if file_contexts not '\n' terminated
  * Enhance file context support
  * Fix property processing and cleanup formatting
  * Add read_spec_entries function to replace sscanf
  * Support consistent mode size for bin files
  * Fix more bin file processing core dumps
  * add selinux_openssh_contexts_path()
  * setrans_client: minimize overhead when mcstransd is not present
  * Ensure selabel_lookup_best_match links NULL terminated
  * Fix core dumps with corrupt *.bin files
  * Add selabel partial and best match APIs
  * Use os.walk() instead of the deprecated os.path.walk()
  * Remove deprecated mudflap option
  * Mount procfs before checking /proc/filesystems
  * Fix -Wformat errors with gcc-5.0.0
  * label_file:  handle newlines in file names
  * Fix audit2why error handling if SELinux is disabled
  * pcre_study can return NULL without error
  * Only check SELinux enabled status once in selinux_check_access
- changes in 2.4
  * Remove assumption that SHLIBDIR is ../../ relative to LIBDIR
  * Fix bugs found by hardened gcc flags
  * Set the system to permissive if failing to disable SELinux because
    policy has already been loaded
  * Add db_exception and db_datatype support to label_db backend
  * Log an error on unknown classes and permissions
  * Add pcre version string to the compiled file_contexts format
  * Deprecate use of flask.h and av_permissions.h
  * Compiled file_context files and the original should have the same DAC
    permissions
- fixed selinux-ready to work with initrd files created by dracut (bsc#940006)
- Update libselinux-2.2-ruby.patch: use RbConfig instead of
  deprecated Config.
- updated selinux-ready script to handle initrd files compressed with xz
- Update to version 2.3 
* Get rid of security_context_t and fix const declarations.
* Refactor rpm_execcon() into a new setexecfilecon() from Guillem Jover.
- Update to version 2.2
  * Fix avc_has_perm() returns -1 even when SELinux is in permissive mode.
  * Support overriding Makefile RANLIB
  * Update pkgconfig definition
  * Mount sysfs before trying to mount selinuxfs.
  * Fix man pages
  * Support overriding PATH  and LIBBASE in Makefile
  * Fix LDFLAGS usage
  * Avoid shadowing stat in load_mmap
  * Support building on older PCRE libraries
  * Fix handling of temporary file in sefcontext_compile
  * Fix procattr cache
  * Define python constants for getenforce result
  * Fix label substitution handling of /
  * Add selinux_current_policy_path from
  * Change get_context_list to only return good matches
  * Support udev-197 and higher
  * Add support for local substitutions
  * Change setfilecon to not return ENOSUP if context is already correct
  * Python wrapper leak fixes
  * Export SELINUX_TRANS_DIR definition in selinux.h
  * Add selinux_systemd_contexts_path
  * Add selinux_set_policy_root
  * Add man page for sefcontext_compile
- Remove libselinux-rhat.patch; merged on upstream
- Adapt libselinux-ruby.patch to upstream changes
- Use fdupes to symlink duplicate manpages
  
- change the source url to the official 2.1.13 release tarball
- Reuse implicit dependencies injected by pkgconfig
- fixed source url in libselinux-bindings.spec
- removed old tarball
- fix source url
- document changes in libselinux-rhat.patch from previous submission:
  (most code of the removed code was integrated upstream)
  * Add matchpathcon -P /etc/selinux/mls support by allowing users
    to set alternate root
  * Add new constant SETRANS_DIR which points to the directory
    where mstransd can find the socket and libvirt can write its
    translations files
-update to 2.1.13
 * audit2why: make sure path is nul terminated
 * utils: new file context regex compiler
 * label_file: use precompiled filecontext when possible
 * do not leak mmapfd
 * sefcontontext_compile: Add error handling to help debug problems in libsemanage.
 * man: make selinux.8 mention service man pages
 * audit2why: Fix segfault if finish() called twice
 * audit2why: do not leak on multiple init() calls
 * mode_to_security_class: interface to translate a mode_t in to a security class
 * audit2why: Cleanup audit2why analysys function
 * man: Fix program synopsis and function prototypes in man pages
 * man: Fix man pages formatting
 * man: Fix typo in man page
 * man: Add references and man page links to _raw function variants
 * Use ENOTSUP instead of EOPNOTSUPP for getfilecon functions
 * man: context_new(3): fix the return value description
 * selinux_status_open: handle error from sysconf
 * selinux_status_open: do not leak statusfd on exec
 * Fix errors found by coverity
 * Change boooleans.subs to booleans.subs_dist.
 * optimize set*con functions
 * pkg-config do not specifc ruby version
 * unmap file contexts on selabel_close()
 * do not leak file contexts with mmap'd backend
 * sefcontext_compile: do not leak fd on error
 * matchmediacon: do not leak fd
 * src/label_android_property: do not leak fd on error
- update to 2.1.12
- added BuildRequires: pcre-devel
  - added the recent libselinux-rhat.patch
  * Add support for lxc_contexts_path
  * utils: add service to getdefaultcon
  * libsemanage: do not set soname needlessly
  * libsemanage: remove PYTHONLIBDIR and ruby equivalent
  * boolean name equivalency
  * getsebool: support boolean name substitution
  * Add man page for new selinux_boolean_sub function.
  * expose selinux_boolean_sub
  * matchpathcon: add -m option to force file type check
  * utils: avcstat: clear sa_mask set
  * seusers: Check for strchr failure
  * booleans: initialize pointer to silence coveriety
  * stop messages when SELinux disabled
  * Ensure that we only close the selinux netlink socket once.
  * improve the file_contexts.5 manual page
  * Fortify source now requires all code to be compiled with -O flag
  * asprintf return code must be checked
  * avc_netlink_recieve handle EINTR
  * audit2why: silence -Wmissing-prototypes warning
  * libsemanage: remove build warning when build swig c files
  * matchpathcon: bad handling of symlinks in /
  * seusers: remove unused lineno
  * seusers: getseuser: gracefully handle NULL service
  * New Android property labeling backend
  * label_android_property whitespace cleanups
  * additional makefile support for rubywrap
  * Remove jump over variable declaration
  * Fix old style function definitions
  * Fix const-correctness
  * Remove unused flush_class_cache method
  * Add prototype decl for destructor
  * Add more printf format annotations
  * Add printf format attribute annotation to die() method
  * Fix const-ness of parameters & make usage() methods static
  * Enable many more gcc warnings for libselinux/src/ builds
  * utils: Enable many more gcc warnings for libselinux/utils builds
  * Change annotation on include/selinux/avc.h to avoid upsetting SWIG
  * Ensure there is a prototype for 'matchpathcon_lib_destructor'
  * Update Makefiles to handle /usrmove
  * utils: Stop separating out matchpathcon as something special
  * pkg-config to figure out where ruby include files are located
  * build with either ruby 1.9 or ruby 1.8
  * assert if avc_init() not called
  * take security_deny_unknown into account
  * security_compute_create_name(3)
  * Do not link against python library, this is considered
  * bad practice in debian
  * Hide unnecessarily-exported library destructors
- Remove obsolete defines/sections
- update selinux-ready script
  * use -L when stat()ing /etc/selinux/config
  * make sure that SELINUX isn't disabled in /etc/selinux/config
  * look for either of /sys/fs/selinux and /selinux directory
  * use systemctl to check for restorecond
  * don't look for booleans file (deprecated)
- update selinux-ready script
- updated to 2.1.9 again (see below)
- go back even more - everything else requires the full SELinux stack
  (too late for 12.2)
- revert back to 2.0.98 for 12.2
- update to libselinux-2.1.9
  * better man pages
  * selinux_status interfaces
  * simple interface for access checks
  * multiple bug fixes
- fix build for ruby-1.9
- cross-build fix: use %__cc macro
- use %_smp_mflags
- don't package /var/run/setrans in libselinux1 package
  - Feature#303793
  - the directory will be created in initscript of mcstrans package
- buildrequire pkg-config to fix provides
- selinux-ready: added function to check for restorecond in
                 runlevel 3/5 
- selinux-ready: added functions for checking PAM config and
                 policy boolean init_upstart 
- selinux-ready: fixed init ramfs checking 
- added new selinux-ready script 
- updated to 2.0.91
  * changes too numerous to list
- add baselibs.conf as a source
- updated selinux-ready script
- change libsepol-devel to libsepol-devel-static in dependencies
  of python bindings
- put libsepol-devel back to Requires of libselinux-devel
- added selinux-ready tool to selinux-tools package
- remove static libraries
- libselinux-devel does not require libsepol-devel
- updated to 2.0.80
  * deny_unknown wrapper function from KaiGai Kohei
  * security_compute_av_flags API from KaiGai Kohei
  * Netlink socket management and callbacks from KaiGai Kohei
  * Netlink socket handoff patch from Adam Jackson
  * AVC caching of compute_create results by Eric Paris
  * fix incorrect conversion in discover_class code
- fixed memory leak (memleak.patch)
- updated to 2.0.77
  * add new function getseuser which will take username and service
    and return seuser and level; ipa will populate file in future
  * change selinuxdefcon to return just the context by default
  * fix segfault if seusers file does not work
  * strip trailing / for matchpathcon
  * fix restorecon python code
- updated to 2.0.76
  * allow shell-style wildcarding in X names
  * add Restorecon/Install python functions
  * correct message types in AVC log messages
  * make matchpathcon -V pass mode
  * add man page for selinux_file_context_cmp
  * update flask headers from refpolicy trunk
- fix debug_packages_requires define
- require only version, not release [bnc#429053]
- updated to 2.0.71
  * Add group support to seusers using %groupname syntax from Dan Walsh.
  * Mark setrans socket close-on-exec from Stephen Smalley.
  * Only apply nodups checking to base file contexts from Stephen Smalley.
  * Merge ruby bindings from Dan Walsh.
- Fix build of debuginfo.
- added baselibs.conf file
- split bindings into separate subpackage (libselinux-bindings)
- split tools into separate subpackage (selinux-tools)
- fix requires for debuginfo package
- initial version 2.0.67
  * based on Fedora package by Dan Walsh <dwalsh@redhat.com>

OBS-URL: https://build.opensuse.org/request/show/1095431
OBS-URL: https://build.opensuse.org/package/show/security:SELinux/libselinux?expand=0&rev=159
This commit is contained in:
Johannes Segitz 2023-06-27 08:15:55 +00:00 committed by Git OBS Bridge
parent 932b2e33f0
commit 18c38b5f6e
5 changed files with 126 additions and 623 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
_multibuild
View File

@ -1,4 +0,0 @@
<multibuild>
<package>libselinux-bindings</package>
</multibuild>

481
libselinux-bindings.changes
View File

@ -1,481 +0,0 @@
-------------------------------------------------------------------
Tue Jun 20 13:34:39 UTC 2023 - Johannes Segitz <jsegitz@suse.com>
- Add explicit BuildRequires for python3-pip and python3-wheel on
15.5, currently the macros don't do the right thing
-------------------------------------------------------------------
Thu Jun 1 11:50:33 UTC 2023 - Johannes Kastl <kastl@b1-systems.de>
- allow building this with different python versions, to make this
usable for the new sle15 macro (using python3.11)
-------------------------------------------------------------------
Fri May 5 12:35:31 UTC 2023 - Daniel Garcia <daniel.garcia@suse.com>
- Add python-wheel build dependency to build correctly with latest
python-pip version.
-------------------------------------------------------------------
Thu May 4 14:04:04 UTC 2023 - Frederic Crozat <fcrozat@suse.com>
- Add _multibuild to define additional spec files as additional
flavors.
Eliminates the need for source package links in OBS.
-------------------------------------------------------------------
Thu Mar 23 15:39:15 UTC 2023 - Martin Liška <mliska@suse.cz>
- Enable LTO as it works fine now.
-------------------------------------------------------------------
Fri Feb 24 07:42:25 UTC 2023 - Johannes Segitz <jsegitz@suse.com>
- Update to version 3.5:
* check for truncations
* avoid newline in avc message
* bail out on path truncations
* add getpidprevcon to gather the previous context before the last
exec of a given process
* Workaround for heap overhead of pcre
* fix memory leaks on the audit2why module init
* ignore invalid class name lookup
- Drop restorecon_pin_file.patch, is upstream
- Refreshed python3.8-compat.patch
- Added additional developer key (Jason Zaman)
-------------------------------------------------------------------
Mon May 9 10:23:32 UTC 2022 - Johannes Segitz <jsegitz@suse.com>
- Update to version 3.4:
* Use PCRE2 by default
* Make selinux_log() and is_context_customizable() thread-safe
* Prevent leakeing file descriptors
* Correctly hash specfiles larger than 4G
- Refreshed skip_cycles.patch
-------------------------------------------------------------------
Thu Nov 11 13:25:30 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
- Update to version 3.3:
* Lots of smaller issues fixed found by fuzzing
-------------------------------------------------------------------
Wed Mar 17 15:17:27 UTC 2021 - Dominique Leuenberger <dimstar@opensuse.org>
- Switch to pcre2:
+ Replace pcre-devel BuildRequires with pkgconfig(libpcre2-8)
+ Pass USE_PCRE2=y to make.
-------------------------------------------------------------------
Tue Mar 9 09:01:15 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
- Update to version 3.2:
* Use mmap()'ed kernel status page instead of netlink by default.
See "KERNEL STATUS PAGE" section in avc_init(3) for more details.
* New log callback levels for enforcing and policy load notices -
SELINUX_POLICYLOAD, SELINUX_SETENFORCE
* Changed userspace AVC setenforce and policy load messages to audit
format.
-------------------------------------------------------------------
Tue Jul 14 08:24:20 UTC 2020 - Johannes Segitz <jsegitz@suse.com>
- Update to version 3.1:
* selinux/flask.h, selinux/av_permissions.h and sepol/policydb/flask.h were
removed. All userspace object managers should have been updated to use the
dynamic class/perm mapping support.
Use string_to_security_class(3) and string_to_av_perm(3) to map the class
and permission names to their policy values, or selinux_set_mapping(3) to
create a mapping from class and permission index values used by the
application to the policy values.
* Removed restrictions in libsepol and checkpolicy that required all declared
initial SIDs to be assigned a context.
* Support for new policy capability genfs_seclabel_symlinks
* selinuxfs is mounted with noexec and nosuid
* `security_compute_user()` was deprecated
* Refreshed python3.8-compat.patch
-------------------------------------------------------------------
Tue Mar 3 11:13:12 UTC 2020 - Johannes Segitz <jsegitz@suse.de>
- Update to version 3.0
* Ignore the stem when looking up all matches in file context
* Save digest of all partial matches for directory
* Use Python distutils to install SELinux python bindings
* ensure that digest_len is not zero
* fix string conversion of unknown perms
* mark all exported function "extern"
-------------------------------------------------------------------
Mon Dec 16 16:04:41 UTC 2019 - Johannes Segitz <jsegitz@suse.de>
- Added swig4_moduleimport.patch to prevent import errors due to
SWIG 4
-------------------------------------------------------------------
Wed Oct 30 17:21:00 CET 2019 - Matej Cepl <mcepl@suse.com>
- Add python3.8-compat.patch which makes build possible even with
Python 3.8, which doesn’t automatically adds -lpython<ver>
-------------------------------------------------------------------
Tue May 28 08:28:03 UTC 2019 - Martin Liška <mliska@suse.cz>
- Disable LTO (boo#1133244).
-------------------------------------------------------------------
Fri May 24 11:22:19 UTC 2019 - <jsegitz@suse.com>
- Set License: to correct value (bsc#1135710)
-------------------------------------------------------------------
Wed Mar 20 15:05:35 UTC 2019 - jsegitz@suse.com
- Update to version 2.9
* Add security_reject_unknown(3) man page
* Change matchpathcon usage to match with matchpathcon manpage
* Do not define gettid() if glibc >= 2.30 is used
* Fix RESOURCE_LEAK defects reported by coverity scan
* Fix line wrapping in selabel_file.5
* Do not dereference symlink with statfs in selinux_restorecon
* Fix overly strict validation of file_contexts.bin
* Fix selinux_restorecon() on non-SELinux hosts
* Fix the whatis line for the selinux_boolean_sub.3 manpage
* Fix printf format string specifier for uint64_t
* Fix handling of unknown classes/perms
* Set an appropriate errno in booleans.c
- Dropped python3.patch, is now upstream
-------------------------------------------------------------------
Wed Oct 17 11:48:30 UTC 2018 - jsegitz@suse.com
- Update to version 2.8 (bsc#1111732).
For changes please see
https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20180524/RELEASE-20180524.txt
- ran spec-cleaner on spec files
-------------------------------------------------------------------
Mon May 14 22:50:42 UTC 2018 - mcepl@cepl.eu
- Update to version 2.7.
* %files needed to be heavily modified
* Based expressly on python3, not just python
For changes please see
https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20170804/RELEASE-20170804.txt
-------------------------------------------------------------------
Fri Mar 16 15:25:10 UTC 2018 - jsegitz@suse.com
- Updated spec file to use python3. Added python3.patch to fix
build
-------------------------------------------------------------------
Fri Nov 24 09:09:02 UTC 2017 - jsegitz@suse.com
- Update to version 2.6. Notable changes:
* selinux_restorecon: fix realpath logic
* sefcontext_compile: invert semantics of "-r" flag
* sefcontext_compile: Add "-i" flag
* Introduce configurable backends
* Add function to find security.restorecon_last entries
* Add openrc_contexts functions
* Add support for pcre2
* Handle NULL pcre study data
* Add setfiles support to selinux_restorecon(3)
* Evaluate inodes in selinux_restorecon(3)
* Change the location of _selinux.so
* Explain how to free policy type from selinux_getpolicytype()
* Compare absolute pathname in matchpathcon -V
* Add selinux_snapperd_contexts_path()
* Modify audit2why analyze function to use loaded policy
* Avoid mounting /proc outside of selinux_init_load_policy()
* Fix location of selinuxfs mount point
* Only mount /proc if necessary
* procattr: return einval for <= 0 pid args
* procattr: return error on invalid pid_t input
- Dropped
* libselinux-2.2-ruby.patch
* libselinux-proc-mount-only-if-needed.patch
* python-selinux-swig-3.10.patch
-------------------------------------------------------------------
Wed Jul 5 10:30:57 UTC 2017 - schwab@suse.de
- readv-proto.patch: include <sys/uio.h> for readv prototype
-------------------------------------------------------------------
Sun Jul 17 15:30:05 UTC 2016 - jengelh@inai.de
- Update RPM groups, trim description and combine filelist entries.
-------------------------------------------------------------------
Thu Jul 14 07:59:04 UTC 2016 - jsegitz@novell.com
- Adjusted source link
-------------------------------------------------------------------
Tue Jul 5 16:44:44 UTC 2016 - i@marguerite.su
- add patch: python-selinux-swig-3.10.patch, fixed boo#985368
* swig-3.10 in Factory use importlib instead of imp to find
_selinux.so. imp searched the same directory as __init__.py
is while importlib searchs only standard paths. so we have
to move _selinux.so. fixed by upstream
- update version 2.5
* Add selinux_restorecon function
* read_spec_entry: fail on non-ascii
* Add man information about thread specific functions
* Don't wrap rpm_execcon with DISABLE_RPM with SWIG
* Correct line count for property and service context files
* label_file: fix memory leaks and uninitialized jump
* Replace selabel_digest hash function
* Fix selabel_open(3) services if no digest requested
* Add selabel_digest function
* Flush the class/perm string mapping cache on policy reload
* Fix restorecon when path has no context
* Free memory when processing media and x specfiles
* Fix mmap memory release for file labeling
* Add policy context validation to sefcontext_compile
* Do not treat an empty file_contexts(.local) as an error
* Fail hard on invalid property_contexts entries
* Fail hard on invalid file_contexts entries
* Support context validation on file_contexts.bin
* Add selabel_cmp interface and label_file backend
* Support specifying file_contexts.bin file path
* Support file_contexts.bin without file_contexts
* Simplify procattr cache
* Use /proc/thread-self when available
* Add const to selinux_opt for label backends
* Fix binary file labels for regexes with metachars
* Fix file labels for regexes with metachars
* Fix if file_contexts not '\n' terminated
* Enhance file context support
* Fix property processing and cleanup formatting
* Add read_spec_entries function to replace sscanf
* Support consistent mode size for bin files
* Fix more bin file processing core dumps
* add selinux_openssh_contexts_path()
* setrans_client: minimize overhead when mcstransd is not present
* Ensure selabel_lookup_best_match links NULL terminated
* Fix core dumps with corrupt *.bin files
* Add selabel partial and best match APIs
* Use os.walk() instead of the deprecated os.path.walk()
* Remove deprecated mudflap option
* Mount procfs before checking /proc/filesystems
* Fix -Wformat errors with gcc-5.0.0
* label_file: handle newlines in file names
* Fix audit2why error handling if SELinux is disabled
* pcre_study can return NULL without error
* Only check SELinux enabled status once in selinux_check_access
- changes in 2.4
* Remove assumption that SHLIBDIR is ../../ relative to LIBDIR
* Fix bugs found by hardened gcc flags
* Set the system to permissive if failing to disable SELinux because
policy has already been loaded
* Add db_exception and db_datatype support to label_db backend
* Log an error on unknown classes and permissions
* Add pcre version string to the compiled file_contexts format
* Deprecate use of flask.h and av_permissions.h
* Compiled file_context files and the original should have the same DAC
permissions
-------------------------------------------------------------------
Wed May 27 11:53:54 UTC 2015 - dimstar@opensuse.org
- Update libselinux-2.2-ruby.patch: use RbConfig instead of
deprecated Config.
-------------------------------------------------------------------
Sun May 18 00:15:17 UTC 2014 - crrodriguez@opensuse.org
- Update to version 2.3
* Get rid of security_context_t and fix const declarations.
* Refactor rpm_execcon() into a new setexecfilecon() from Guillem Jover.
-------------------------------------------------------------------
Thu Oct 31 13:43:41 UTC 2013 - p.drouand@gmail.com
- Update to version 2.2
* Fix avc_has_perm() returns -1 even when SELinux is in permissive mode.
* Support overriding Makefile RANLIB
* Update pkgconfig definition
* Mount sysfs before trying to mount selinuxfs.
* Fix man pages
* Support overriding PATH and LIBBASE in Makefile
* Fix LDFLAGS usage
* Avoid shadowing stat in load_mmap
* Support building on older PCRE libraries
* Fix handling of temporary file in sefcontext_compile
* Fix procattr cache
* Define python constants for getenforce result
* Fix label substitution handling of /
* Add selinux_current_policy_path from
* Change get_context_list to only return good matches
* Support udev-197 and higher
* Add support for local substitutions
* Change setfilecon to not return ENOSUP if context is already correct
* Python wrapper leak fixes
* Export SELINUX_TRANS_DIR definition in selinux.h
* Add selinux_systemd_contexts_path
* Add selinux_set_policy_root
* Add man page for sefcontext_compile
- Remove libselinux-rhat.patch; merged on upstream
- Adapt libselinux-ruby.patch to upstream changes
- Use fdupes to symlink duplicate manpages
-------------------------------------------------------------------
Thu Jun 27 14:57:53 UTC 2013 - vcizek@suse.com
- change the source url to the official 2.1.13 release tarball
-------------------------------------------------------------------
Wed Jan 30 12:33:45 UTC 2013 - vcizek@suse.com
- update to 2.1.12
- added BuildRequires: pcre-devel
-------------------------------------------------------------------
Mon Jan 7 22:34:03 UTC 2013 - jengelh@inai.de
- Remove obsolete defines/sections
-------------------------------------------------------------------
Wed Jul 25 11:15:02 UTC 2012 - meissner@suse.com
- updated to 2.1.9 again (see below)
-------------------------------------------------------------------
Fri Jun 1 18:34:04 CEST 2012 - mls@suse.de
- update to libselinux-2.1.9
* better man pages
* selinux_status interfaces
* simple interface for access checks
* multiple bug fixes
- fix build for ruby-1.9
-------------------------------------------------------------------
Mon Jun 28 06:38:35 UTC 2010 - jengelh@medozas.de
- use %_smp_mflags
-------------------------------------------------------------------
Thu Feb 25 14:57:16 UTC 2010 - prusnak@suse.cz
- updated to 2.0.91
* changes too numerous to list
-------------------------------------------------------------------
Sat Dec 12 16:43:54 CET 2009 - jengelh@medozas.de
- add baselibs.conf as a source
-------------------------------------------------------------------
Fri Jul 24 17:09:50 CEST 2009 - thomas@novell.com
- updated selinux-ready script
-------------------------------------------------------------------
Wed Jul 22 15:17:25 CEST 2009 - prusnak@suse.cz
- change libsepol-devel to libsepol-devel-static in dependencies
of python bindings
-------------------------------------------------------------------
Wed Jul 1 12:26:48 CEST 2009 - prusnak@suse.cz
- put libsepol-devel back to Requires of libselinux-devel
-------------------------------------------------------------------
Mon Jun 29 21:24:16 CEST 2009 - prusnak@suse.cz
- added selinux-ready tool to selinux-tools package
-------------------------------------------------------------------
Tue Jun 9 20:17:54 CEST 2009 - crrodriguez@suse.de
- remove static libraries
- libselinux-devel does not require libsepol-devel
-------------------------------------------------------------------
Wed May 27 14:06:14 CEST 2009 - prusnak@suse.cz
- updated to 2.0.80
* deny_unknown wrapper function from KaiGai Kohei
* security_compute_av_flags API from KaiGai Kohei
* Netlink socket management and callbacks from KaiGai Kohei
* Netlink socket handoff patch from Adam Jackson
* AVC caching of compute_create results by Eric Paris
* fix incorrect conversion in discover_class code
-------------------------------------------------------------------
Fri Apr 17 17:12:06 CEST 2009 - prusnak@suse.cz
- fixed memory leak (memleak.patch)
-------------------------------------------------------------------
Wed Jan 14 14:04:30 CET 2009 - prusnak@suse.cz
- updated to 2.0.77
* add new function getseuser which will take username and service
and return seuser and level; ipa will populate file in future
* change selinuxdefcon to return just the context by default
* fix segfault if seusers file does not work
* strip trailing / for matchpathcon
* fix restorecon python code
-------------------------------------------------------------------
Mon Dec 1 11:32:50 CET 2008 - prusnak@suse.cz
- updated to 2.0.76
* allow shell-style wildcarding in X names
* add Restorecon/Install python functions
* correct message types in AVC log messages
* make matchpathcon -V pass mode
* add man page for selinux_file_context_cmp
* update flask headers from refpolicy trunk
-------------------------------------------------------------------
Wed Oct 22 16:28:59 CEST 2008 - mrueckert@suse.de
- fix debug_packages_requires define
-------------------------------------------------------------------
Tue Sep 23 12:51:10 CEST 2008 - prusnak@suse.cz
- require only version, not release [bnc#429053]
-------------------------------------------------------------------
Tue Sep 2 12:09:22 CEST 2008 - prusnak@suse.cz
- updated to 2.0.71
* Add group support to seusers using %groupname syntax from Dan Walsh.
* Mark setrans socket close-on-exec from Stephen Smalley.
* Only apply nodups checking to base file contexts from Stephen Smalley.
* Merge ruby bindings from Dan Walsh.
-------------------------------------------------------------------
Mon Sep 1 07:35:00 CEST 2008 - aj@suse.de
- Fix build of debuginfo.
-------------------------------------------------------------------
Fri Aug 22 14:45:29 CEST 2008 - prusnak@suse.cz
- added baselibs.conf file
- split bindings into separate subpackage (libselinux-bindings)
- split tools into separate subpackage (selinux-tools)
-------------------------------------------------------------------
Fri Aug 1 17:32:20 CEST 2008 - ro@suse.de
- fix requires for debuginfo package
-------------------------------------------------------------------
Tue Jul 15 16:26:31 CEST 2008 - prusnak@suse.cz
- initial version 2.0.67
* based on Fedora package by Dan Walsh <dwalsh@redhat.com>

132
libselinux-bindings.spec
View File

@ -1,132 +0,0 @@
#
# spec file for package libselinux-bindings
#
# Copyright (c) 2023 SUSE LLC
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
# upon. The license for this file, and modifications and additions to the
# file, is the same license as for the pristine package itself (unless the
# license for the pristine package is not an Open Source License, in which
# case the license is the MIT License). An "Open Source License" is a
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.
# Please submit bugfixes or comments via https://bugs.opensuse.org/
#
%{?sle15_python_module_pythons}
%if 0%{?suse_version} < 1699
# Leap15, SLES15
# have some safe defaults
%define python_subpackage_name python3-selinux
%define python_base_requirement python3
%if "%pythons" == "python36"
%define python_subpackage_name python36-selinux
%define python_base_requirement python36
%endif
%if "%pythons" == "python310"
%define python_subpackage_name python310-selinux
%define python_base_requirement python310
%endif
%if "%pythons" == "python311"
%define python_subpackage_name python311-selinux
%define python_base_requirement python311
%endif
%else
# Tumbleweed
%define python_subpackage_name python3-selinux
%define python_base_requirement python3
%endif
%define libsepol_ver 3.5
Name: libselinux-bindings
Version: 3.5
Release: 0
Summary: SELinux runtime library and simple utilities
License: SUSE-Public-Domain
Group: Development/Libraries/C and C++
URL: https://github.com/SELinuxProject/selinux/wiki/Releases
Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}/libselinux-%{version}.tar.gz
Source1: https://github.com/SELinuxProject/selinux/releases/download/%{version}/libselinux-%{version}.tar.gz.asc
Source2: libselinux.keyring
Source3: selinux-ready
Source4: baselibs.conf
# PATCH-FIX-UPSTREAM Include <sys/uio.h> for readv prototype
Patch4: readv-proto.patch
# PATCH-FIX-UPSTREAM python3.8-compat.patch mcepl@suse.com
# Make linking working even when default pkg-config doesn’t provide -lpython<ver>
Patch5: python3.8-compat.patch
Patch6: swig4_moduleimport.patch
BuildRequires: %{python_module setuptools}
%if 0%{?sle_version} == 150500
BuildRequires: python3-pip
BuildRequires: python3-wheel
%else
BuildRequires: %{python_module pip}
BuildRequires: %{python_module wheel}
%endif
BuildRequires: libsepol-devel-static >= %{libsepol_ver}
BuildRequires: python-rpm-macros
BuildRequires: python3-devel
BuildRequires: ruby-devel
BuildRequires: swig
BuildRequires: pkgconfig(libpcre2-8)
%description
libselinux provides an interface to get and set process and file
security contexts and to obtain security policy decisions.
%package -n %{python_subpackage_name}
%define oldpython python
Summary: Python bindings for the SELinux runtime library
Group: Development/Libraries/Python
Requires: %{python_base_requirement}
Requires: libselinux1 = %{version}
%ifpython2
Obsoletes: %{oldpython}-selinux < %{version}
Provides: %{oldpython}-selinux = %{version}
%endif
%description -n %{python_subpackage_name}
libselinux provides an interface to get and set process and file
security contexts and to obtain security policy decisions.
This subpackage contains Python extensions to use SELinux from that
language.
%package -n ruby-selinux
Summary: Ruby bindings for the SELinux runtime library
Group: Development/Languages/Ruby
Requires: libselinux1 = %{version}
Requires: ruby
%description -n ruby-selinux
libselinux provides an interface to get and set process and file
security contexts and to obtain security policy decisions.
This subpackage contains Ruby extensions to use SELinux from that
language.
%prep
%setup -q -n libselinux-%{version}
%autopatch -p1
%build
make %{?_smp_mflags} LIBDIR="%{_libdir}" CFLAGS="%{optflags} -fno-semantic-interposition" swigify V=1 USE_PCRE2=y
make %{?_smp_mflags} LIBDIR="%{_libdir}" CFLAGS="%{optflags} -fno-semantic-interposition" pywrap V=1 USE_PCRE2=y
make %{?_smp_mflags} LIBDIR="%{_libdir}" CFLAGS="%{optflags} -fno-semantic-interposition" rubywrap V=1 USE_PCRE2=y
%install
make DESTDIR=%{buildroot} LIBDIR="%{_libdir}" SHLIBDIR="/%{_lib}" LIBSEPOLA=%{_libdir}/libsepol.a install-pywrap V=1
make DESTDIR=%{buildroot} LIBDIR="%{_libdir}" SHLIBDIR="/%{_lib}" LIBSEPOLA=%{_libdir}/libsepol.a install-rubywrap V=1
rm -rf %{buildroot}/%{_lib} %{buildroot}%{_libdir}/libselinux.* %{buildroot}%{_libdir}/pkgconfig
%files -n %{python_subpackage_name}
%{python3_sitearch}/*selinux*
%files -n ruby-selinux
%{_libdir}/ruby/vendor_ruby/%{rb_ver}/%{rb_arch}/selinux.so
%changelog

55
libselinux.changes
View File

@ -1,3 +1,26 @@
-------------------------------------------------------------------
Fri Jun 23 14:50:33 UTC 2023 - Matej Cepl <mcepl@suse.com>
- Remove separate libselinux-bindings SPEC file (bsc#1212618).
-------------------------------------------------------------------
Tue Jun 20 13:34:39 UTC 2023 - Johannes Segitz <jsegitz@suse.com>
- Add explicit BuildRequires for python3-pip and python3-wheel on
15.5, currently the macros don't do the right thing
-------------------------------------------------------------------
Thu Jun 1 11:50:33 UTC 2023 - Johannes Kastl <kastl@b1-systems.de>
- allow building this with different python versions, to make this
usable for the new sle15 macro (using python3.11)
-------------------------------------------------------------------
Fri May 5 12:35:31 UTC 2023 - Daniel Garcia <daniel.garcia@suse.com>
- Add python-wheel build dependency to build correctly with latest
python-pip version.
------------------------------------------------------------------- -------------------------------------------------------------------
Thu May 4 14:04:04 UTC 2023 - Frederic Crozat <fcrozat@suse.com> Thu May 4 14:04:04 UTC 2023 - Frederic Crozat <fcrozat@suse.com>
@ -29,6 +52,7 @@ Fri Feb 24 07:42:25 UTC 2023 - Johannes Segitz <jsegitz@suse.com>
* fix memory leaks on the audit2why module init * fix memory leaks on the audit2why module init
* ignore invalid class name lookup * ignore invalid class name lookup
- Drop restorecon_pin_file.patch, is upstream - Drop restorecon_pin_file.patch, is upstream
- Refreshed python3.8-compat.patch
- Added additional developer key (Jason Zaman) - Added additional developer key (Jason Zaman)
------------------------------------------------------------------- -------------------------------------------------------------------
@ -126,6 +150,7 @@ Tue Jul 14 08:24:20 UTC 2020 - Johannes Segitz <jsegitz@suse.com>
* Support for new policy capability genfs_seclabel_symlinks * Support for new policy capability genfs_seclabel_symlinks
* selinuxfs is mounted with noexec and nosuid * selinuxfs is mounted with noexec and nosuid
* `security_compute_user()` was deprecated * `security_compute_user()` was deprecated
* Refreshed python3.8-compat.patch
------------------------------------------------------------------- -------------------------------------------------------------------
Thu Mar 26 15:43:41 UTC 2020 - Johannes Segitz <jsegitz@suse.de> Thu Mar 26 15:43:41 UTC 2020 - Johannes Segitz <jsegitz@suse.de>
@ -146,6 +171,12 @@ Tue Mar 3 11:13:12 UTC 2020 - Johannes Segitz <jsegitz@suse.de>
Dropped Use-Python-distutils-to-install-SELinux.patch, included Dropped Use-Python-distutils-to-install-SELinux.patch, included
upstream upstream
-------------------------------------------------------------------
Mon Dec 16 16:04:41 UTC 2019 - Johannes Segitz <jsegitz@suse.de>
- Added swig4_moduleimport.patch to prevent import errors due to
SWIG 4
------------------------------------------------------------------- -------------------------------------------------------------------
Wed Nov 13 08:03:39 UTC 2019 - Johannes Segitz <jsegitz@suse.de> Wed Nov 13 08:03:39 UTC 2019 - Johannes Segitz <jsegitz@suse.de>
@ -153,6 +184,12 @@ Wed Nov 13 08:03:39 UTC 2019 - Johannes Segitz <jsegitz@suse.de>
Python's distutils instead of building and installing python Python's distutils instead of building and installing python
bindings manually bindings manually
-------------------------------------------------------------------
Wed Oct 30 17:21:00 CET 2019 - Matej Cepl <mcepl@suse.com>
- Add python3.8-compat.patch which makes build possible even with
Python 3.8, which doesn’t automatically adds -lpython<ver>
------------------------------------------------------------------- -------------------------------------------------------------------
Mon Jun 3 09:34:17 UTC 2019 - <jsegitz@suse.com> Mon Jun 3 09:34:17 UTC 2019 - <jsegitz@suse.com>
@ -160,6 +197,10 @@ Mon Jun 3 09:34:17 UTC 2019 - <jsegitz@suse.com>
* Removed check for selinux-policy package as we don't ship one * Removed check for selinux-policy package as we don't ship one
(bsc#1136845) (bsc#1136845)
* Add check that restorecond is installed and enabled * Add check that restorecond is installed and enabled
-------------------------------------------------------------------
Tue May 28 08:28:03 UTC 2019 - Martin Liška <mliska@suse.cz>
- Disable LTO (boo#1133244).
------------------------------------------------------------------- -------------------------------------------------------------------
Fri May 24 11:22:19 UTC 2019 - <jsegitz@suse.com> Fri May 24 11:22:19 UTC 2019 - <jsegitz@suse.com>
@ -211,6 +252,12 @@ Mon May 14 22:45:54 UTC 2018 - mcepl@cepl.eu
For changes please see For changes please see
https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20170804/RELEASE-20170804.txt https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20170804/RELEASE-20170804.txt
-------------------------------------------------------------------
Fri Mar 16 15:25:10 UTC 2018 - jsegitz@suse.com
- Updated spec file to use python3. Added python3.patch to fix
build
------------------------------------------------------------------- -------------------------------------------------------------------
Fri Nov 24 09:09:02 UTC 2017 - jsegitz@suse.com Fri Nov 24 09:09:02 UTC 2017 - jsegitz@suse.com
@ -340,6 +387,12 @@ Thu Jul 30 12:00:27 UTC 2015 - jsegitz@novell.com
- fixed selinux-ready to work with initrd files created by dracut (bsc#940006) - fixed selinux-ready to work with initrd files created by dracut (bsc#940006)
-------------------------------------------------------------------
Wed May 27 11:53:54 UTC 2015 - dimstar@opensuse.org
- Update libselinux-2.2-ruby.patch: use RbConfig instead of
deprecated Config.
------------------------------------------------------------------- -------------------------------------------------------------------
Mon Sep 8 08:25:11 UTC 2014 - jsegitz@suse.com Mon Sep 8 08:25:11 UTC 2014 - jsegitz@suse.com
@ -447,6 +500,7 @@ Fri Mar 29 15:12:50 UTC 2013 - vcizek@suse.com
Wed Jan 30 11:44:45 UTC 2013 - vcizek@suse.com Wed Jan 30 11:44:45 UTC 2013 - vcizek@suse.com
- update to 2.1.12 - update to 2.1.12
- added BuildRequires: pcre-devel
- added the recent libselinux-rhat.patch - added the recent libselinux-rhat.patch
* Add support for lxc_contexts_path * Add support for lxc_contexts_path
* utils: add service to getdefaultcon * utils: add service to getdefaultcon
@ -541,6 +595,7 @@ Fri Jun 1 18:34:04 CEST 2012 - mls@suse.de
* selinux_status interfaces * selinux_status interfaces
* simple interface for access checks * simple interface for access checks
* multiple bug fixes * multiple bug fixes
- fix build for ruby-1.9
------------------------------------------------------------------- -------------------------------------------------------------------
Wed Oct 5 15:09:25 UTC 2011 - uli@suse.com Wed Oct 5 15:09:25 UTC 2011 - uli@suse.com

77
libselinux.spec
View File

@ -16,6 +16,8 @@
# #
%{?sle15_python_module_pythons}
%define python_subpackage_only 1
%define libsepol_ver 3.5 %define libsepol_ver 3.5
Name: libselinux Name: libselinux
Version: 3.5 Version: 3.5
@ -32,10 +34,23 @@ Source4: baselibs.conf
# PATCH-FIX-UPSTREAM Include <sys/uio.h> for readv prototype # PATCH-FIX-UPSTREAM Include <sys/uio.h> for readv prototype
Patch4: readv-proto.patch Patch4: readv-proto.patch
Patch5: skip_cycles.patch Patch5: skip_cycles.patch
# PATCH-FIX-UPSTREAM python3.8-compat.patch mcepl@suse.com
# Make linking working even when default pkg-config doesn’t provide -lpython<ver>
Patch6: python3.8-compat.patch
Patch7: swig4_moduleimport.patch
BuildRequires: %{python_module devel}
BuildRequires: %{python_module pip}
BuildRequires: %{python_module setuptools}
BuildRequires: %{python_module wheel}
BuildRequires: fdupes BuildRequires: fdupes
BuildRequires: libsepol-devel >= %{libsepol_ver} BuildRequires: libsepol-devel >= %{libsepol_ver}
BuildRequires: libsepol-devel-static >= %{libsepol_ver}
BuildRequires: pkgconfig BuildRequires: pkgconfig
BuildRequires: python-rpm-macros
BuildRequires: ruby-devel
BuildRequires: swig
BuildRequires: pkgconfig(libpcre2-8) BuildRequires: pkgconfig(libpcre2-8)
%python_subpackages
%description %description
libselinux provides an interface to get and set process and file libselinux provides an interface to get and set process and file
@ -57,8 +72,8 @@ Security.)
%package -n selinux-tools %package -n selinux-tools
Summary: SELinux command-line utilities Summary: SELinux command-line utilities
Group: System/Base Group: System/Base
Provides: libselinux-utils = %{version}-%{release}
Requires: libselinux1 = %{version} Requires: libselinux1 = %{version}
Provides: libselinux-utils = %{version}-%{release}
%description -n selinux-tools %description -n selinux-tools
Security-enhanced Linux is a feature of the kernel and some Security-enhanced Linux is a feature of the kernel and some
@ -97,20 +112,63 @@ security contexts and to obtain security policy decisions.
This package contains the static development files, which are This package contains the static development files, which are
necessary to develop your own software using libselinux. necessary to develop your own software using libselinux.
%package -n python-%{name}
%define oldpython python
Summary: Python bindings for the SELinux runtime library
Group: Development/Libraries/Python
# Requires: %%{python_base_requirement}
Requires: libselinux1 = %{version}
Obsoletes: python-selinux < %{version}
Provides: python-selinux = %{version}
%ifpython2
Obsoletes: %{oldpython}-selinux < %{version}
Provides: %{oldpython}-selinux = %{version}
%endif
%description -n python-%{name}
libselinux provides an interface to get and set process and file
security contexts and to obtain security policy decisions.
This subpackage contains Python extensions to use SELinux from that
language.
%package -n ruby-selinux
Summary: Ruby bindings for the SELinux runtime library
Group: Development/Languages/Ruby
Requires: libselinux1 = %{version}
Requires: ruby
%description -n ruby-selinux
libselinux provides an interface to get and set process and file
security contexts and to obtain security policy decisions.
This subpackage contains Ruby extensions to use SELinux from that
language.
%prep %prep
%setup -q -n libselinux-%{version} %autosetup -p1 -n libselinux-%{version}
%patch4 -p1
%patch5 -p1
%build %build
make %{?_smp_mflags} LIBDIR="%{_libdir}" CC="gcc" CFLAGS="%{optflags} -fno-semantic-interposition -ffat-lto-objects" USE_PCRE2=y %{python_expand :
%make_build LIBDIR="%{_libdir}" CC="gcc" CFLAGS="%{optflags} -fno-semantic-interposition -ffat-lto-objects" USE_PCRE2=y PYTHON=$python
%make_build LIBDIR="%{_libdir}" CFLAGS="%{optflags} -fno-semantic-interposition" swigify USE_PCRE2=y PYTHON=$python
%make_build LIBDIR="%{_libdir}" CFLAGS="%{optflags} -fno-semantic-interposition" pywrap USE_PCRE2=y PYTHON=$python
%make_build LIBDIR="%{_libdir}" CFLAGS="%{optflags} -fno-semantic-interposition" rubywrap USE_PCRE2=y PYTHON=$python
}
%install %install
mkdir -p %{buildroot}/%{_lib} mkdir -p %{buildroot}/%{_lib}
mkdir -p %{buildroot}%{_libdir} mkdir -p %{buildroot}%{_libdir}
mkdir -p %{buildroot}%{_includedir} mkdir -p %{buildroot}%{_includedir}
mkdir -p %{buildroot}%{_sbindir} mkdir -p %{buildroot}%{_sbindir}
make DESTDIR=%{buildroot} LIBDIR="%{_libdir}" SHLIBDIR="%{_libdir}" BINDIR="%{_sbindir}" install %{python_expand :
make DESTDIR=%{buildroot} LIBDIR="%{_libdir}" SHLIBDIR="%{_libdir}" PYTHON=$python BINDIR="%{_sbindir}" install
make DESTDIR=%{buildroot} LIBDIR="%{_libdir}" SHLIBDIR="/%{_lib}" PYTHON=$python LIBSEPOLA=%{_libdir}/libsepol.a install-pywrap V=1
make DESTDIR=%{buildroot} LIBDIR="%{_libdir}" SHLIBDIR="/%{_lib}" PYTHON=$python LIBSEPOLA=%{_libdir}/libsepol.a install-rubywrap V=1
# Remove unnecessary copy of the Python C extension
rm -v %{buildroot}%{$python_sitearch}/_selinux.*.so
}
mv %{buildroot}%{_sbindir}/getdefaultcon %{buildroot}%{_sbindir}/selinuxdefcon mv %{buildroot}%{_sbindir}/getdefaultcon %{buildroot}%{_sbindir}/selinuxdefcon
mv %{buildroot}%{_sbindir}/getconlist %{buildroot}%{_sbindir}/selinuxconlist mv %{buildroot}%{_sbindir}/getconlist %{buildroot}%{_sbindir}/selinuxconlist
install -m 0755 %{SOURCE3} %{buildroot}%{_sbindir}/selinux-ready install -m 0755 %{SOURCE3} %{buildroot}%{_sbindir}/selinux-ready
@ -165,4 +223,11 @@ install -m 0755 %{SOURCE3} %{buildroot}%{_sbindir}/selinux-ready
%files devel-static %files devel-static
%{_libdir}/libselinux.a %{_libdir}/libselinux.a
%files %{python_files %{name}}
%{python_sitearch}/selinux
%{python_sitearch}/selinux-%{version}*-info
%files -n ruby-selinux
%{_libdir}/ruby/vendor_ruby/%{rb_ver}/%{rb_arch}/selinux.so
%changelog %changelog