Commit Graph

22 Commits

Author SHA1 Message Date
Stephen Smalley
bbc930c756 libselinux: fix subdir build and usage of cmdline CFLAGS
commit 16c123f4b1 ("libselinux:
support ANDROID_HOST=1 on Mac") broke the ability to run make
in the src subdirectory of libselinux (because OS and COMPILER
were not defined) and also caused some warning flags that could
be overridden via command-line CFLAGS to be mandatory.  Fix it.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2016-11-14 13:10:51 -05:00
William Roberts
16c123f4b1 libselinux: support ANDROID_HOST=1 on Mac
To build on mac, first build libsepol with
no DESTDIR set.

Secondly, build libselinux with ANDROID_HOST=y

This configuration can be used to test the Android
host build on Mac.

Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-10-18 13:52:23 -04:00
William Roberts
b5dd7959d8 libselinux: add ANDROID_HOST=y build option
To build the selinux host configuration, specify
ANDROID_HOST=y on the Make command line.

eg)
make ANDROID_HOST=y
2016-09-28 12:22:15 -04:00
William Roberts
9b3e18ed4d libselinux: rename EMFLAGS to DISABLE_FLAGS
Change EMFLAGS variable, used for setting additional CFLAGS
to DISABLE_FLAGS, to indicate its usage better.

Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-09-28 12:07:13 -04:00
William Roberts
fba72330dd libselinux: drop DISABLE_BOOL=y option
Build option DISABLE_BOOL=y is not being used, and is broken, drop it.

Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-09-28 11:45:58 -04:00
William Roberts
42ab513703 libselinux: drop DISABLE_AVC=y
Remove build config DISABLE_AVC, it is unused and broken.

Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-09-28 11:43:36 -04:00
Janis Danisevskis
50f0910cf0 libselinux: add support for pcre2
This patch moves all pcre1/2 dependencies into the new files regex.h
and regex.c implementing the common denominator of features needed
by libselinux. The compiler flag -DUSE_PCRE2 toggles between the
used implementations.

As of this patch libselinux supports either pcre or pcre2 but not
both at the same time. The persistently stored file contexts
information differs. This means libselinux can only load file
context files generated by sefcontext_compile build with the
same pcre variant.

Also, for pcre2 the persistent format is architecture dependent.
Stored precompiled regular expressions can only be used on the
same architecture they were generated on. If pcre2 is used,
sefcontext_compile now respects the "-r". This flag makes
sefcontext_compile include the precompiled regular expressions
in the output file. The default is to omit them, so that the
output remains portable at the cost of having to recompile
the regular expressions at load time, or rather on first use.

Signed-off-by: Janis Danisevskis <jdanis@google.com>
2016-09-15 13:49:14 -04:00
Laurent Bigonville
46c4f3a716 libselinux/utils/Makefile: Fix in tree compilation
Some tools need the sepol/sepol.h header
2016-08-04 08:54:15 -04:00
Richard Haines
bdd4e6d2b1 libselinux: Add selinux_restorecon function
The selinux_restorecon(3) man page details this function.

It has been built using the work from Android where an SHA1 hash
of the specfiles is held in an extended attribute to enhance
performance. Also contains components from policycoreutils/setfiles.

The utils/selinux_restorecon.c utility demonstrates the functionality.

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2016-02-17 09:12:50 -05:00
Richard Haines
c1db824828 libselinux: Replace selabel_digest hash function
This replaces the openssl library with SHA1 hash functions
extracted from [1] as this is a public domain implementation.

util/selabel_digest -v option still compares the result with
the openssl command "openssl dgst -sha1 -hex .." for validation.

[1] https://github.com/WaterJuice/CryptLib

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-10-22 11:55:02 -04:00
Richard Haines
e40bbea95f libselinux: Add selabel_digest function
selabel_digest(3) if enabled by the SELABEL_OPT_DIGEST option during
selabel_open(3) will return an SHA1 digest of the spec files, plus
a list of the specfiles used to calculate the digest. There is a
test utility supplied that will demonstrate the functionality.

The use case for selabel_digest(3) is to implement an selinux_restorecon
function based on the Android version that writes a hash of the
file_contexts files to an extended attribute to enhance performance
(see external/libselinux/src/android.c selinux_android_restorecon()).

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-10-13 17:13:24 -04:00
Richard Haines
50640d313d libselinux: Add policy context validation to sefcontext_compile
Add -p option that will take a binary policy file to validate
context entries in the text file_contexts file.

Should validation fail the binary file will not be written.

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-08-25 14:49:13 -04:00
Stephen Smalley
e889148494 libselinux: build sefcontext_compile with static libselinux
sefcontext_compile depends on libselinux internals, so it might
as well use static libselinux.  Hide read_spec_entries as this is not
intended as a public interface for shared library users.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-06-15 15:25:42 -04:00
Stephen Smalley
082f1d1274 libselinux: Remove deprecated mudflap option.
The mudflap run time checker was removed in GCC 4.9.  The
option no longer does anything and triggers a warning from gcc 4.9
and later.  Remove it.  We might want to add -fsanitize=address
to enable AddressSanitizer in its place, but that should be a separate
change.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-04-16 08:23:55 -04:00
Eric Paris
dac8b32c17 libselinux: utils: new file context regex compiler
This is a new 'compiler' which tranforms the file context database into
a binary format.  This binary format may be mmap'd in later removing the
need to compile the regular expression at run time.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2013-02-01 12:08:56 -05:00
Dan Walsh
ac6ab3afc0 libselinux: Fortify source now requires all code to be compiled with -O flag
Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-06-28 11:21:16 -04:00
Dan Walsh
9b796ead1a libselinux: utils: Stop separating out matchpathcon as something special
It's not special and doesn't need its own Makefile lines.  Just make it
a normal target.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-03-28 14:52:13 -04:00
Dan Walsh
46d294f645 libselinux: Update Makefiles to handle /usrmove
Move everything into /usr/* and just put links from /*.  The whole /usr
thing hasn't really worked in all situations for a long long time.  Just
accept that fact and move along.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-03-28 14:52:13 -04:00
Daniel P. Berrange
a1044d4c84 libselinux: utils: Enable many more gcc warnings for libselinux/utils builds
Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-03-28 14:52:13 -04:00
Eric Paris
85cfd2fe2e libselinux: use -W and -Werror in utils
Add the flags and fix the one build break.

Signed-off-by: Eric Paris <eparis@redhat.com>
2011-12-05 16:14:17 -05:00
Chad Sellers
72d535fdb8 Author: Daniel J Walsh
Email: dwalsh@redhat.com
Subject: We have moved matchpathcon to /sbin from /usr/sbin
Date: Wed, 01 Apr 2009 10:21:53 -0400

Some init scripts wanted to use matchpathcon before /usr is mounted.

Author: Chad Sellers
Email: csellers@tresys.com

Added matchpathcon to clean target

Signed-off-by: Chad Sellers <csellers@tresys.com>
2009-05-07 16:05:05 -04:00
Joshua Brindle
13cd4c8960 initial import from svn trunk revision 2950 2008-08-19 15:30:36 -04:00