Skip to content
This repository has been archived by the owner on Jan 9, 2025. It is now read-only.

(PA-5632) Update SELinux on Red Hat 9 to 3.3 #737

Merged
merged 2 commits into from
Nov 1, 2023
Merged

(PA-5632) Update SELinux on Red Hat 9 to 3.3 #737

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0228a1a
(PA-5632) Update SELinux on Red Hat 9 to 3.3
mhashizume Sep 29, 2023
0b128a1
Merge branch 'master' into PA-5632/master/rhel9-selinux
tvpartytonight Nov 1, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 19 additions & 3 deletions configs/components/_base-ruby-selinux.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,24 +10,35 @@
host_ruby ||= settings[:host_ruby]
ruby_bindir ||= settings[:ruby_bindir]

# We download tarballs because system development packages (e.g.
# libselinux-devel) don't necessarily include Swig interface files (*.i files)
if platform.name =~ /el-(6|7)|ubuntu-(16|18.04-amd64)/
pkg.version "2.0.94"
pkg.md5sum "544f75aab11c2af352facc51af12029f"
pkg.url "https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20100525/devel/libselinux-#{pkg.get_version}.tar.gz"
pkg.mirror "#{settings[:buildsources_url]}/libselinux-#{pkg.get_version}.tar.gz"
tvpartytonight marked this conversation as resolved.
Show resolved Hide resolved
elsif platform.name.start_with?('el-9')
# SELinux 3.3 is the minimum version available in RHEL 9 repos
pkg.version '3.3'
pkg.sha256sum 'acfdee27633d2496508c28727c3d41d3748076f66d42fccde2e6b9f3463a7057'
pkg.url "https://github.com/SELinuxProject/selinux/releases/download/#{pkg.get_version}/libselinux-#{pkg.get_version}.tar.gz"
else
pkg.version "2.9"
pkg.md5sum "bb449431b6ed55a0a0496dbc366d6e31"
pkg.apply_patch "resources/patches/ruby-selinux/selinux-29-function.patch"
pkg.url "https://github.com/SELinuxProject/selinux/releases/download/20190315/libselinux-#{pkg.get_version}.tar.gz"
pkg.mirror "#{settings[:buildsources_url]}/libselinux-#{pkg.get_version}.tar.gz"
end
pkg.mirror "#{settings[:buildsources_url]}/libselinux-#{pkg.get_version}.tar.gz"

pkg.build_requires "ruby-#{ruby_version}"
cc = "/opt/pl-build-tools/bin/gcc"
system_include = "-I/usr/include"
system_include = '-I/usr/include'
ruby = "#{ruby_bindir}/ruby -rrbconfig"

# The RHEL 9 libselinux-devel package provides headers, but we don't want to
# use the package becuase of a compatibility issue with the shared library.
# Instead, we use the headers provided in the tarball.
system_include.prepend('-I./include ') if platform.name.start_with?('el-9')

if platform.is_cross_compiled_linux?
cc = "/opt/pl-build-tools/bin/#{settings[:platform_triple]}-gcc"
system_include = "-I/opt/pl-build-tools/#{settings[:platform_triple]}/sysroot/usr/include"
Expand Down Expand Up @@ -57,6 +68,11 @@
steps << "#{platform.patch} --strip=0 --fuzz=0 --ignore-whitespace --no-backup-if-mismatch < ../selinuxswig_ruby_wrap.patch"
end

# libselinux 3.3 is the minimum version we want to build on RHEL 9, but the
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have we tried using versions 3.4 or 3.5? I'm fine merging this as is, but, if we could just use a later version of selinux, maybe we can avoid this hack?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I haven't tried it, my assumption was that there would be compatibility issues if there were a discrepancy between the bindings we built and the version running on the system. Do you think it would be worth a shot?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, I'm not sure if there would be a discrepancy, seems like it might possibly work? As long as the major versions are the same...

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I tried using the SELinux 3.4 tarball and installing the libselinux-devel-3.4 package. It seems like it creates the same compatibility issue as we saw in the original ticket. On an adhoc agent build on x86_64:

Begin tests/selinux.rb

PA-3067: Manage selinux

  * test require 'selinux'

  ergotropic-trap.delivery.puppetlabs.net (ergotropic-trap.delivery.puppetlabs.net) 23:22:11$ env PATH="/opt/puppetlabs/puppet/bin:${PATH}" ruby -e 'require "selinux"'
 /opt/puppetlabs/puppet/lib/ruby/site_ruby/2.7.0/rubygems/core_ext/kernel_require.rb:86:in `require': /lib64/libselinux.so.1: version `LIBSELINUX_3.4' not found (required by /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/2.7.0/x86_64-linux/selinux.so) - /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/2.7.0/x86_64-linux/selinux.so (LoadError)
    	from /opt/puppetlabs/puppet/lib/ruby/site_ruby/2.7.0/rubygems/core_ext/kernel_require.rb:86:in `require'
    	from -e:1:in `<main>'

I assume this happens because there's a mismatch between what we build against and what's present on the system.

I think the only way we can avoid this issue is to target the lowest common denominator, SELinux 3.3.

# libeselinux-devel-3.3 package confusingly installs a shared library that
# uses 3.4. The hacky workaround for this is to symlink an existing library.
steps << 'ln -s /usr/lib64/libselinux.so.1 /usr/lib64/libselinux.so' if platform.name.start_with?('el-9')

steps.concat([
"#{cc} $${INCLUDESTR} #{system_include} #{cflags} -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -fPIC -DSHARED -c -o selinuxswig_ruby_wrap.lo selinuxswig_ruby_wrap.c",
"#{cc} $${INCLUDESTR} #{system_include} -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -shared -o _rubyselinux.so selinuxswig_ruby_wrap.lo -lselinux -Wl,-z,relro,-z,now,-soname,_rubyselinux.so",
Expand Down
1 change: 0 additions & 1 deletion configs/platforms/el-9-aarch64.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,6 @@
java-1.8.0-openjdk-devel
patch
swig
libselinux-devel
readline-devel
zlib-devel
systemtap-sdt-devel
Expand Down
1 change: 0 additions & 1 deletion configs/platforms/el-9-x86_64.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,6 @@
java-1.8.0-openjdk-devel
libsepol
libsepol-devel
libselinux-devel
pkgconfig
readline-devel
rpmdevtools
Expand Down
Loading