From 87b1b6669fe080fb517c5d7c9620d46da5047ab0 Mon Sep 17 00:00:00 2001 From: "Anthony G. Basile" Date: Fri, 15 Jul 2011 23:29:30 +0000 Subject: Add fix for bug #374897 and initial support for python3 (Portage version: 2.1.10.3/cvs/Linux x86_64) --- sys-apps/policycoreutils/ChangeLog | 10 +- ...icycoreutils-2.0.85-fix-seunshare-vuln.patch.gz | Bin 0 -> 8962 bytes .../policycoreutils-2.0.85-sesandbox.patch.gz | Bin 0 -> 4551 bytes .../policycoreutils/policycoreutils-2.0.85.ebuild | 116 +++++++++++++++++++++ 4 files changed, 125 insertions(+), 1 deletion(-) create mode 100644 sys-apps/policycoreutils/files/policycoreutils-2.0.85-fix-seunshare-vuln.patch.gz create mode 100644 sys-apps/policycoreutils/files/policycoreutils-2.0.85-sesandbox.patch.gz create mode 100644 sys-apps/policycoreutils/policycoreutils-2.0.85.ebuild diff --git a/sys-apps/policycoreutils/ChangeLog b/sys-apps/policycoreutils/ChangeLog index 0bc63fc026f2..d02a01c4b9ff 100644 --- a/sys-apps/policycoreutils/ChangeLog +++ b/sys-apps/policycoreutils/ChangeLog @@ -1,6 +1,14 @@ # ChangeLog for sys-apps/policycoreutils # Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/sys-apps/policycoreutils/ChangeLog,v 1.86 2011/07/08 10:54:27 ssuominen Exp $ +# $Header: /var/cvsroot/gentoo-x86/sys-apps/policycoreutils/ChangeLog,v 1.87 2011/07/15 23:29:30 blueness Exp $ + +*policycoreutils-2.0.85 (15 Jul 2011) + + 15 Jul 2011; Anthony G. Basile + +policycoreutils-2.0.85.ebuild, + +files/policycoreutils-2.0.85-fix-seunshare-vuln.patch.gz, + +files/policycoreutils-2.0.85-sesandbox.patch.gz: + Add fix for bug #374897 and initial support for python3 08 Jul 2011; Samuli Suominen policycoreutils-2.0.55.ebuild, policycoreutils-2.0.69.ebuild, diff --git a/sys-apps/policycoreutils/files/policycoreutils-2.0.85-fix-seunshare-vuln.patch.gz b/sys-apps/policycoreutils/files/policycoreutils-2.0.85-fix-seunshare-vuln.patch.gz new file mode 100644 index 000000000000..d58b5b384139 Binary files /dev/null and b/sys-apps/policycoreutils/files/policycoreutils-2.0.85-fix-seunshare-vuln.patch.gz differ diff --git a/sys-apps/policycoreutils/files/policycoreutils-2.0.85-sesandbox.patch.gz b/sys-apps/policycoreutils/files/policycoreutils-2.0.85-sesandbox.patch.gz new file mode 100644 index 000000000000..336dcb21bb7f Binary files /dev/null and b/sys-apps/policycoreutils/files/policycoreutils-2.0.85-sesandbox.patch.gz differ diff --git a/sys-apps/policycoreutils/policycoreutils-2.0.85.ebuild b/sys-apps/policycoreutils/policycoreutils-2.0.85.ebuild new file mode 100644 index 000000000000..9d2917cd588d --- /dev/null +++ b/sys-apps/policycoreutils/policycoreutils-2.0.85.ebuild @@ -0,0 +1,116 @@ +# Copyright 1999-2011 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/sys-apps/policycoreutils/policycoreutils-2.0.85.ebuild,v 1.1 2011/07/15 23:29:30 blueness Exp $ + +EAPI="3" +PYTHON_DEPEND="*" +PYTHON_USE_WITH="xml" +SUPPORT_PYTHON_ABIS="1" +RESTRICT_PYTHON_ABIS="*-jython" + +inherit multilib python toolchain-funcs eutils + +EXTRAS_VER="1.20" +SEMNG_VER="2.0.46" +SELNX_VER="2.0.98" +SEPOL_VER="2.0.42" + +IUSE="" + +DESCRIPTION="SELinux core utilities" +HOMEPAGE="http://userspace.selinuxproject.org" +SRC_URI="http://userspace.selinuxproject.org/releases/20101221/devel/${P}.tar.gz + mirror://gentoo/policycoreutils-extra-${EXTRAS_VER}.tar.bz2 + mirror://gentoo/policycoreutils-2.0.85-python3.tar.gz" + +LICENSE="GPL-2" +SLOT="0" +KEYWORDS="~amd64 ~x86" + +COMMON_DEPS=">=sys-libs/libselinux-${SELNX_VER}[python] + >=sys-libs/glibc-2.4 + >=sys-process/audit-1.5.1 + >=sys-libs/libcap-1.10-r10 + sys-libs/pam + >=sys-libs/libsemanage-${SEMNG_VER}[python] + sys-libs/libcap-ng + >=sys-libs/libsepol-${SEPOL_VER} + sys-devel/gettext" + +# pax-utils for scanelf used by rlpkg +RDEPEND="${COMMON_DEPS} + dev-python/sepolgen + app-misc/pax-utils" + +DEPEND="${COMMON_DEPS}" + +S2=${WORKDIR}/policycoreutils-extra + +src_prepare() { + # rlpkg is more useful than fixfiles + sed -i -e '/^all/s/fixfiles//' "${S}/scripts/Makefile" \ + || die "fixfiles sed 1 failed" + sed -i -e '/fixfiles/d' "${S}/scripts/Makefile" \ + || die "fixfiles sed 2 failed" + # We currently do not support MCS, so the sandbox code in policycoreutils + # is not usable yet. However, work for MCS is on the way and a reported + # vulnerability (bug #374897) might go by unnoticed if we ignore it now. + # As such, we will + # - prepare support for switching name from "sandbox" to "sesandbox" + epatch "${FILESDIR}/policycoreutils-2.0.85-sesandbox.patch.gz" + # - patch the sandbox and seunshare code to fix the vulnerability + # (uses, with permission, extract from + # http://pkgs.fedoraproject.org/gitweb/?p=policycoreutils.git;a=blob_plain;f=policycoreutils-rhat.patch;hb=HEAD) + epatch "${FILESDIR}/policycoreutils-2.0.85-fix-seunshare-vuln.patch.gz" + # But for now, disable building sandbox code + sed -i -e 's/sandbox //' "${S}/Makefile" || die "failed removing sandbox" + # Overwrite gl.po, id.po and et.po with valid PO file + cp "${S}/po/sq.po" "${S}/po/gl.po" || die "failed to copy ${S}/po/sq.po to gl.po" + cp "${S}/po/sq.po" "${S}/po/id.po" || die "failed to copy ${S}/po/sq.po to id.po" + cp "${S}/po/sq.po" "${S}/po/et.po" || die "failed to copy ${S}/po/sq.po to et.po" + # Fixed scripts for Python 3 support + cp "${WORKDIR}/seobject.py" "${S}/semanage/seobject.py" || die "failed to copy seobject.py" + cp "${WORKDIR}/semanage" "${S}/semanage/semanage" || die "failed to copy semanage" + cp "${WORKDIR}/chcat" "${S}/scripts/chcat" || die "failed to copy chcat" + cp "${WORKDIR}/audit2allow" "${S}/audit2allow/audit2allow" || die "failed to copy audit2allow" + cp "${WORKDIR}/rlpkg" "${S2}/scripts/rlpkg" || die "failed to copy rlpkg" +} + +src_compile() { + python_copy_sources semanage sandbox + building() { + einfo "Compiling policycoreutils" + emake -C "${S}" AUDIT_LOG_PRIVS="y" CC="$(tc-getCC)" PYLIBVER="python$(python_get_version)" || die + einfo "Compiling policycoreutils-extra" + emake -C "${S2}" AUDIT_LOG_PRIVS="y" CC="$(tc-getCC)" PYLIBVER="python$(python_get_version)" || die + } + python_execute_function -s --source-dir semanage building +} + +src_install() { + # Python scripts are present in many places. There are no extension modules. + installation() { + einfo "Installing policycoreutils" + emake -C "${S}" DESTDIR="${T}/images/${PYTHON_ABI}" AUDIT_LOG_PRIV="y" PYLIBVER="python$(python_get_version)" install || return 1 + + einfo "Installing policycoreutils-extra" + emake -C "${S2}" DESTDIR="${T}/images/${PYTHON_ABI}" SHLIBDIR="${D}$(get_libdir)/rc" install || return 1 + } + python_execute_function installation + python_merge_intermediate_installation_images "${T}/images" + + # remove redhat-style init script + rm -fR "${D}/etc/rc.d" + + # compatibility symlinks + dosym /sbin/setfiles /usr/sbin/setfiles + dosym /$(get_libdir)/rc/runscript_selinux.so /$(get_libdir)/rcscripts/runscript_selinux.so +} + +pkg_postinst() { + python_mod_optimize seobject.py +} + +pkg_postrm() { + python_mod_cleanup seobject.py +} -- cgit v1.2.3-65-gdbad