selinux: 2.7 -> 2.8 #56965
selinux: 2.7 -> 2.8 #56965
Conversation
|
Because this is a mass-rebuild this needs to be rebased to staging. Also I think you can close those extra PR's. |
outergod
force-pushed
the
pkgs/policycoreutils-2.8
branch
from
fe003e1
to
9f8a3c8
Compare
GrahamcOfBorg
added
6.topic: emacs
6.topic: GNOME
GrahamcOfBorg
removed
6.topic: qt/kde
6.topic: ruby
6.topic: rust
6.topic: steam
6.topic: vim
6.topic: xfce
|
If these updates are interdependent and need to be merged together, it would make a lot of sense to review and merge them in a single PR. |
|
@e-user I agree with @veprbl, it makes sense for all of them to be in a single PR |
|
Ping @Phreedom I'm not familiar with SELinux, is there something important we should test before we can merge this? |
|
@GrahamcOfBorg eval |
|
@veprbl Good to go? |
|
@aanderse I don't know. It used to compile back in April. Since NixOS doesn't have a support for SELinux yet this shouldn't break anything at runtime, in theory. @GrahamcOfBorg build checkpolicy libsemanage libselinux libsepol policycoreutils semodule-utils |
|
@veprbl In that case I think a merge is in order. Please do so if you agree. |
| }; | ||
|
|
||
| nativeBuildInputs = [ bison flex pkgconfig ]; | ||
| buildInputs = [ libsepol libselinux bzip2 audit ] | ||
| ++ optionals enablePython [ swig python ]; | ||
|
|
||
| preBuild = '' | ||
| makeFlagsArray+=("PREFIX=$out") | ||
| makeFlagsArray+=("PREFIX=/") |
There was a problem hiding this comment.
Why do this? Can this backfire on systems without sandboxing?
There was a problem hiding this comment.
The build files where changed in 2.8 so that makeFlagsArray+=("DESTDIR=$out") below is (correctly) prepended to PREFIX, thus with PREFIX=$out you get the same path, twice.
There was a problem hiding this comment.
Then we should actually set PREFIX=$out and DESTDIR=/. This is because PREFIX is the hardcoded path, DESTDIR is just an offset:
https://github.com/SELinuxProject/selinux/blob/ee8f7a870c625de139aa271eae0c40578488c2f6/libsemanage/src/Makefile#L95
There was a problem hiding this comment.
Might as well migrate to use an attribute:
{
makeFlagsArray = [
"PREFIX=${placeholder "out"}"
"PYTHONLIBDIR=lib/${python.libPrefix}/site-packages"
];
}
There was a problem hiding this comment.
Yup, I already did that in libselinux: af9f765#diff-025612052707a295d6f7424b3dba06bc It should be done here as well.
|
This can be closed, #66748 got merged into staging. |
Motivation for this change
Update checkpolicy, policycoreutils, semodule-utils, libsemanage, libselinux and libsepol to 2.8, required to fix NixOS/nix#2374.
Things done
sandboxinnix.confon non-NixOS)nix-shell -p nox --run "nox-review wip"./result/bin/)nix path-info -Sbefore and after)