All the other makefiles just have LIBDIR optionally set so it can be
overridden. These makefiles were autodetecting incorrectly. uname -i
returns "GenuineIntel" so should have been uname -m.
Signed-off-by: Jason Zaman <jason@perfinion.com>
Now that restorecond is separated from policycoreutils, we should not
retain a build dependency on the policycoreutils/setfiles source files.
Fork the restore.[ch] files for restorecond.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Fix the following warnings from clang.
mcstrans.c:1309:6: warning: variable 'groups' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized]
if (violates_constraints(l)) {
^~~~~~~~~~~~~~~~~~~~~~~
mcstrans.c:1491:9: note: uninitialized use occurs here
while (groups)
^~~~~~
mcstrans.c:1309:2: note: remove the 'if' if its condition is always false
if (violates_constraints(l)) {
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
mcstrans.c:1303:6: warning: variable 'groups' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized]
if (!l)
^~
mcstrans.c:1491:9: note: uninitialized use occurs here
while (groups)
^~~~~~
mcstrans.c:1303:2: note: remove the 'if' if its condition is always false
if (!l)
^~~~~~~
mcstrans.c:1299:6: warning: variable 'groups' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized]
if (!level)
^~~~~~
mcstrans.c:1491:9: note: uninitialized use occurs here
while (groups)
^~~~~~
mcstrans.c:1299:2: note: remove the 'if' if its condition is always false
if (!level)
^~~~~~~~~~~
mcstrans.c:1316:2: note: variable 'groups' is declared here
word_group_t *groups = NULL;
^
3 warnings generated.
mcscolor.c:334:24: warning: size argument in 'strncat' call appears to be size of the source [-Wstrncat-size]
strncat(result, buf, sizeof(buf));
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
We should build it by default or else it will bitrot.
But you can still omit it by overriding OPT_SUBDIRS.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Split optional components into their own overridable OPT_SUBDIRS
definition. Then you can build without them via make OPT_SUBDIRS=
or specify a subset of them in that manner.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
When hll/pp loads a policy file which has been modified so that the
nprim field of one of its non-empty symbol table was changed to zero, it
crashes with a segmentation fault. A quick analysis leads to
"p->sym_val_to_name[i] = (char **)alloc(p->symtab[i].nprim, sizeof(char
*));" in policydb_index_others(), which is not executed when
p->symtab[i].nprim is zero even though there are items in
p->symtab[i].table.
Detect such an oddity in the policy file early to exit with a clean
error message.
Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
While fuzzing hll/pp, the fuzzer (AFL) crafted a policy which triggered
the following message without making the policy loading fail (the
program crashed with a segmentation fault later):
security: ebitmap: map size 192 does not match my size 64 (high bit
was 0)
This is because ebitmap_read() returned -EINVAL and this value was
handled as a successful return value by scope_index_read() because it
was not -1.
Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
When fuzzing hll/pp inputs, a policy module where the value of
scope->decl_ids_len has been modified to zero makes the program abort
(when it has been compiled without -DNDEBUG).
Change the behavior to report an error message instead. This eases
fuzzing functions like policydb_read().
Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
The combining logic for dontaudit rules was wrong, causing
a dontaudit A B:C *; rule to be clobbered by a dontaudit A B:C p;
rule.
This is a reimplementation of:
commit 6201bb5e25 ("libsepol:
fix checkpolicy dontaudit compiler bug")
that avoids the cumbersome pointer assignments on alloced.
Reported-by: Nick Kralevich <nnk@google.com>
Signed-off-by: William Roberts <william.c.roberts@intel.com>
The flex skeleton often triggers compiler warnings; make these
non-fatal for building. We already do likewise for checkpolicy.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Using SWIG_fail in the Python SWIG wrappers makes the wrapping function
destroy/free the memory which could have been dynamically allocated
before calling the wrapped function. This thus prevents possible memory
leaks in the wrappers of set*con(), set*con_raw(), security_compute_*(),
etc.
Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
clang does not support -aux-info option. When exception.sh is run with
CC=clang, use gcc to build selinuxswig_python_exception.i and
semanageswig_python_exception.i.
This does not solve the issue of building libselinux and libsemanage
Python wrappers on a system without gcc. However parsing the result of
"gcc -aux-info" is easier than parsing the header files so stay with
this command at least for now.
Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
When running "make all" several times in the root directory of the
project, the following lines always appear (and the command takes some
seconds to complete on my system with a slow hard drive):
xmlto man secilc.8.xml
Note: Writing secilc.8
This is because "make man" always builds secilc.8 even though
secilc.8.xml has not been modified. Introduce an intermediate target to
avoid this behavior.
Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
When linking with -Wl,-no-undefined in LDFLAGS (in order to find
possible link-time errors), the Python wrapper module needs to be
linked with the right libpython.so. This library is found using
pkg-config in a new PYLIBS variable.
Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
Use the python interpreter to find the install directory, like commit
8162f10e67 ("libselinux: query for python site-packages dir directly")
did for libselinux.
While at it, do not install semanage.py (generated by SWIG) with
executable permission bits.
Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
When linking with -Wl,-no-undefined in LDFLAGS (in order to find
possible link-time errors), the Ruby wrapper module needs to be linked
with the libruby.so which is used by $(RUBY). Introduce a new RUBYLIBS
variable to find this library.
Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
This makes building libselinux and libsemanage more robust on systems
with several versions of Ruby installed: when building, only RUBY needs
to be set, without wondering about PKG_CONFIG_PATH or other environment
variables.
Using RbConfig::CONFIG["rubyarchhdrdir"] only works with Ruby >= 2.0 but
since previous Ruby versions are retired since 2015-02-23 this should
not have any impact
(https://www.ruby-lang.org/en/news/2015/02/23/support-for-ruby-1-9-3-has-ended/).
While at it, in libsemanage, use RbConfig::CONFIG["vendorarchdir"] to
install the Ruby extension, like commit 1cd80faa53 ("libselinux:
versioned ruby pkg-config and query vendorarchdir properly") did for
libselinux.
My main motivation with this patch is to make the build configuration
easier to define on Travis-CI or other continuous integration platforms.
Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
