summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorSven Vermeulen <swift@gentoo.org>2012-01-14 19:57:53 +0000
committerSven Vermeulen <swift@gentoo.org>2012-01-14 19:57:53 +0000
commit8eb9c19f9b4ebba3a32aadedc40f830fa4ee923c (patch)
treef6a8cbf901dc14b1dd73f7cf042073096dd9c250 /sys-apps/policycoreutils
parentalpha/ia64/s390/sh/sparc stable wrt #393937 (diff)
downloadhistorical-8eb9c19f9b4ebba3a32aadedc40f830fa4ee923c.tar.gz
historical-8eb9c19f9b4ebba3a32aadedc40f830fa4ee923c.tar.bz2
historical-8eb9c19f9b4ebba3a32aadedc40f830fa4ee923c.zip
Fix bug #393401, #375475
Package-Manager: portage-2.1.10.41/cvs/Linux x86_64
Diffstat (limited to 'sys-apps/policycoreutils')
-rw-r--r--sys-apps/policycoreutils/ChangeLog13
-rw-r--r--sys-apps/policycoreutils/Manifest6
-rw-r--r--sys-apps/policycoreutils/metadata.xml3
-rw-r--r--sys-apps/policycoreutils/policycoreutils-2.1.0-r2.ebuild136
4 files changed, 154 insertions, 4 deletions
diff --git a/sys-apps/policycoreutils/ChangeLog b/sys-apps/policycoreutils/ChangeLog
index aece87eba0eb..ee248190b992 100644
--- a/sys-apps/policycoreutils/ChangeLog
+++ b/sys-apps/policycoreutils/ChangeLog
@@ -1,6 +1,15 @@
# ChangeLog for sys-apps/policycoreutils
-# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-apps/policycoreutils/ChangeLog,v 1.94 2011/11/12 18:13:09 swift Exp $
+# Copyright 1999-2012 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/sys-apps/policycoreutils/ChangeLog,v 1.95 2012/01/14 19:57:53 swift Exp $
+
+ 14 Jan 2012; <swift@gentoo.org> +policycoreutils-2.1.0-r2.ebuild,
+ metadata.xml:
+ Mark audit as a local USE flag
+
+*policycoreutils-2.1.0-r2 (14 Jan 2012)
+
+ 14 Jan 2012; <swift@gentoo.org> +policycoreutils-2.1.0-r2.ebuild:
+ Override auto-detection of pam and audit, use USE flags for this
12 Nov 2011; <swift@gentoo.org> -policycoreutils-2.0.82.ebuild,
-policycoreutils-2.0.82-r1.ebuild, -policycoreutils-2.0.85.ebuild,
diff --git a/sys-apps/policycoreutils/Manifest b/sys-apps/policycoreutils/Manifest
index ecae8ea07b37..53dd3f8460ce 100644
--- a/sys-apps/policycoreutils/Manifest
+++ b/sys-apps/policycoreutils/Manifest
@@ -1,8 +1,10 @@
DIST policycoreutils-2.0.85-fix-seunshare-vuln.patch.gz 8962 RMD160 4175ac56c5c72ba37b3bd94009cbe17345444445 SHA1 f9a3b6d64f7b6632b8740cc4f07d8db029039e7c SHA256 2dc16bc7489d626a91d93356d80651795eb757a25fd807fbbf93c772f392b50f
DIST policycoreutils-2.0.85-python3.tar.gz 19750 RMD160 ae5daef8bf9083964e37b101a6168dc6ce5b8bb2 SHA1 61c058cb39ef9f13dd54af844a033ac724de743c SHA256 4bc78bfd39ce43a010c4e1de3d7f4ff45fcfc7bac4bc70e28c9bdb681053fe4e
DIST policycoreutils-2.0.85-sesandbox.patch.gz 4551 RMD160 28ea43ae81418e0d1da95904276b8cc7423ee1e1 SHA1 dfcbc87fecfbd335b51f1c020ca0f642245b6417 SHA256 9854b390e1283194b76335dcacc0b8f7d45d8fb025592e4e9b701122c925d1e1
+DIST policycoreutils-2.1.0-fix-makefile-pam-audit.patch.gz 1089 RMD160 aba0402ac5b18ab39cb1c5a9e8e36b3355b1ae0c SHA1 6df02773eb4afe6d669415a16eaa3267407a78b1 SHA256 339c988c11bf2a15e34abc617e791dd2e1607368d93a0ec977fdbb5f124ccd62
DIST policycoreutils-2.1.0.tar.gz 885913 RMD160 267829f78bc154dc96bc66678e82c5d07b522de5 SHA1 dae3e6d547a81e4be4ef7ab2a184256c6ad721ac SHA256 6199b07fd4280e455ea05933cee510b5e09ad3f60b0544382231fe05b787d3f3
DIST policycoreutils-extra-1.21.tar.bz2 12864 RMD160 28e5d0f52a69e0cb9c0d2e8088e828cbac951732 SHA1 7866b24ddab5a48c95fd51b88ad1eb4af0d9572e SHA256 c2d3627e2a10f83f5de997e9db75c40830e7f3520b558807346c9bd9c49769bb
EBUILD policycoreutils-2.1.0-r1.ebuild 4516 RMD160 563c527df53a7e87a92576a4dd62f5f877acdc29 SHA1 981eba8971e01484e7414f4f2a937e17f3d0c605 SHA256 d0a40c0135ccf25a2094bf06e6d31f91f123837f2b1857fbe867c621380f24a4
-MISC ChangeLog 15043 RMD160 dda23a4cb6d0b8a503ceb8fabebc6974c168bf95 SHA1 85e9dbdc4a9e9263c20aa7694e1ae8bf8ce884b0 SHA256 00718df9a9b3970de60d15d9a6cc0125464f3bba6d55c4ffc1ea64655c746f45
-MISC metadata.xml 717 RMD160 0fc1c3cf181bfbe5d0e2c31e7c0db5f7a837cd91 SHA1 2ee21a2645c4e8e96e4714ba12ad0037631e83b9 SHA256 0c06ffad8c7c95b22992240c5fe0516a3e29a65ebe8da43e184fc2c8b08a1971
+EBUILD policycoreutils-2.1.0-r2.ebuild 5117 RMD160 aafa131c6d8451fa15abdc097d87cd0081b01ca0 SHA1 1bdd629352d581be2c3ba8bec6f65622f4d0bf2a SHA256 1a7b44ace4b355ea54bc38632a4011c81dbc841f01541937d6710ddf284d40ab
+MISC ChangeLog 15338 RMD160 2080e7e163fda1b388b98e17f69463999882e2cf SHA1 7574dccb7e7fea84b099d048b67d86d26cf4e543 SHA256 7f0e886a8c4c7f9a7df7a3726c1a2aa4d2f5f88a2213a6a5a61f470a4f5deaca
+MISC metadata.xml 879 RMD160 7e5a226b4191c3a163f3f3e41ff74b37898cf681 SHA1 7a3926ea5443df754220516dae22154e544d0477 SHA256 ba531ccb7d95f6a49c4e8c7a5fed72277c79dda8acd76bb7bf3bf76d8054d9c4
diff --git a/sys-apps/policycoreutils/metadata.xml b/sys-apps/policycoreutils/metadata.xml
index 87cddb01c888..04b9b39ac0fe 100644
--- a/sys-apps/policycoreutils/metadata.xml
+++ b/sys-apps/policycoreutils/metadata.xml
@@ -14,4 +14,7 @@
avc_enforcing to query the current mode of the system, enforcing or
permissive.
</longdescription>
+ <use>
+ <flag name='audit'>Enable support for <pkg>sys-process/audit</pkg> and use the audit_* functions (like audit_getuid instead of getuid())</flag>
+ </use>
</pkgmetadata>
diff --git a/sys-apps/policycoreutils/policycoreutils-2.1.0-r2.ebuild b/sys-apps/policycoreutils/policycoreutils-2.1.0-r2.ebuild
new file mode 100644
index 000000000000..b2e07845059d
--- /dev/null
+++ b/sys-apps/policycoreutils/policycoreutils-2.1.0-r2.ebuild
@@ -0,0 +1,136 @@
+# Copyright 1999-2012 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sys-apps/policycoreutils/policycoreutils-2.1.0-r2.ebuild,v 1.1 2012/01/14 19:57:53 swift Exp $
+
+EAPI="3"
+PYTHON_DEPEND="*"
+PYTHON_USE_WITH="xml"
+SUPPORT_PYTHON_ABIS="1"
+RESTRICT_PYTHON_ABIS="*-jython"
+
+inherit multilib python toolchain-funcs eutils
+
+EXTRAS_VER="1.21"
+SEMNG_VER="2.1.0"
+SELNX_VER="2.1.0"
+SEPOL_VER="2.1.0"
+
+IUSE="audit pam"
+
+DESCRIPTION="SELinux core utilities"
+HOMEPAGE="http://userspace.selinuxproject.org"
+SRC_URI="http://userspace.selinuxproject.org/releases/20110727/devel/${P}.tar.gz
+ http://dev.gentoo.org/~swift/patches/policycoreutils/policycoreutils-2.0.85-sesandbox.patch.gz
+ http://dev.gentoo.org/~swift/patches/policycoreutils/policycoreutils-2.0.85-fix-seunshare-vuln.patch.gz
+ http://dev.gentoo.org/~swift/patches/policycoreutils/policycoreutils-2.1.0-fix-makefile-pam-audit.patch.gz
+ mirror://gentoo/policycoreutils-extra-${EXTRAS_VER}.tar.bz2
+ mirror://gentoo/policycoreutils-2.0.85-python3.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+
+COMMON_DEPS=">=sys-libs/libselinux-${SELNX_VER}[python]
+ >=sys-libs/glibc-2.4
+ >=sys-libs/libcap-1.10-r10
+ >=sys-libs/libsemanage-${SEMNG_VER}[python]
+ sys-libs/libcap-ng
+ >=sys-libs/libsepol-${SEPOL_VER}
+ sys-devel/gettext
+ audit? ( >=sys-process/audit-1.5.1 )
+ pam? ( sys-libs/pam )"
+
+# pax-utils for scanelf used by rlpkg
+RDEPEND="${COMMON_DEPS}
+ dev-python/sepolgen
+ app-misc/pax-utils"
+
+DEPEND="${COMMON_DEPS}"
+
+S2=${WORKDIR}/policycoreutils-extra
+
+src_prepare() {
+ # rlpkg is more useful than fixfiles
+ sed -i -e '/^all/s/fixfiles//' "${S}/scripts/Makefile" \
+ || die "fixfiles sed 1 failed"
+ sed -i -e '/fixfiles/d' "${S}/scripts/Makefile" \
+ || die "fixfiles sed 2 failed"
+ # We currently do not support MCS, so the sandbox code in policycoreutils
+ # is not usable yet. However, work for MCS is on the way and a reported
+ # vulnerability (bug #374897) might go by unnoticed if we ignore it now.
+ # As such, we will
+ # - prepare support for switching name from "sandbox" to "sesandbox"
+ epatch "${DISTDIR}/policycoreutils-2.0.85-sesandbox.patch.gz"
+ # - patch the sandbox and seunshare code to fix the vulnerability
+ # (uses, with permission, extract from
+ # http://pkgs.fedoraproject.org/gitweb/?p=policycoreutils.git;a=blob_plain;f=policycoreutils-rhat.patch;hb=HEAD)
+ epatch "${DISTDIR}/policycoreutils-2.0.85-fix-seunshare-vuln.patch.gz"
+ # But for now, disable building sandbox code
+ sed -i -e 's/sandbox //' "${S}/Makefile" || die "failed removing sandbox"
+ # Disable auto-detection of PAM and audit related stuff and override
+ epatch "${DISTDIR}/policycoreutils-2.1.0-fix-makefile-pam-audit.patch.gz"
+ # Overwrite gl.po, id.po and et.po with valid PO file
+ cp "${S}/po/sq.po" "${S}/po/gl.po" || die "failed to copy ${S}/po/sq.po to gl.po"
+ cp "${S}/po/sq.po" "${S}/po/id.po" || die "failed to copy ${S}/po/sq.po to id.po"
+ cp "${S}/po/sq.po" "${S}/po/et.po" || die "failed to copy ${S}/po/sq.po to et.po"
+ # Fixed scripts for Python 3 support
+ cp "${WORKDIR}/seobject.py" "${S}/semanage/seobject.py" || die "failed to copy seobject.py"
+ cp "${WORKDIR}/semanage" "${S}/semanage/semanage" || die "failed to copy semanage"
+ cp "${WORKDIR}/chcat" "${S}/scripts/chcat" || die "failed to copy chcat"
+ cp "${WORKDIR}/audit2allow" "${S}/audit2allow/audit2allow" || die "failed to copy audit2allow"
+}
+
+src_compile() {
+ local use_audit="n";
+ local use_pam="n";
+
+ use audit && use_audit="y";
+ use pam && use_pam="y";
+
+ python_copy_sources semanage sandbox
+ building() {
+ einfo "Compiling policycoreutils"
+ emake -C "${S}" AUDIT_LOG_PRIVS="y" AUDITH="${use_audit}" PAMH="${use_pam}" CC="$(tc-getCC)" PYLIBVER="python$(python_get_version)" || die
+ einfo "Compiling policycoreutils-extra "
+ emake -C "${S2}" AUDIT_LOG_PRIVS="y" AUDITH="${use_audit}" PAMH="${use_pam}" CC="$(tc-getCC)" PYLIBVER="python$(python_get_version)" || die
+ }
+ python_execute_function -s --source-dir semanage building
+}
+
+src_install() {
+ local use_audit="n";
+ local use_pam="n";
+
+ use audit && use_audit="y";
+ use pam && use_pam="y";
+
+ # Python scripts are present in many places. There are no extension modules.
+ installation() {
+ einfo "Installing policycoreutils"
+ emake -C "${S}" DESTDIR="${T}/images/${PYTHON_ABI}" AUDITH="${use_audit}" PAMH="${use_pam}" AUDIT_LOG_PRIV="y" PYLIBVER="python$(python_get_version)" install || return 1
+
+ einfo "Installing policycoreutils-extra"
+ emake -C "${S2}" DESTDIR="${T}/images/${PYTHON_ABI}" SHLIBDIR="${D}$(get_libdir)/rc" install || return 1
+ }
+ python_execute_function installation
+ python_merge_intermediate_installation_images "${T}/images"
+
+ # remove redhat-style init script
+ rm -fR "${D}/etc/rc.d"
+
+ # compatibility symlinks
+ dosym /sbin/setfiles /usr/sbin/setfiles
+ dosym /$(get_libdir)/rc/runscript_selinux.so /$(get_libdir)/rcscripts/runscript_selinux.so
+
+ # location for permissive definitions
+ dodir /var/lib/selinux
+ keepdir /var/lib/selinux
+}
+
+pkg_postinst() {
+ python_mod_optimize seobject.py
+}
+
+pkg_postrm() {
+ python_mod_cleanup seobject.py
+}