Gitiles
Code Review Sign In
gerrit-public.fairphone.software / platform / external / selinux / 95288432678e0420224bcf36657c81db85a0c646
commit95288432678e0420224bcf36657c81db85a0c646[log] [tgz]
authorSamiul Islam <samiul@google.com>Mon Feb 07 17:36:32 2022 +0000
committerSamiul Islam <samiul@google.com>Tue Feb 15 13:45:21 2022 +0000
treef9d33671dc950af6acb1b994ee3f887983d013c6
parent193dd516b45e1d0d70bc38748d253ad99baaa788 [diff]
Teach pkgdir_selabel_lookup about supplemental process and data

This cl does two things:

  1. Supplemental process will be running in a new UID range, between
  20k to 30k. As such, we need a new username which is different than app
  and isolated process.
  2. Supplmental data, which is an extension of app data, is located in
  /data/misc_{ce,de}/<user-id>/supplemental directory. Their labeling
  need to come from seapp_context file just like other app data
  labeling.

See the selinux changes made in ag/16803377 for context on how this is
being used.

Bug: 217543371
Bug: 217559719
Test: atest SupplementalProcessStorageHostTest
      - #testSelinuxLabel
      - #testSupplementalDataAppDirectory_SharedStorageIsUsable
Change-Id: Ib22c9963761603633d66a232b421dbd5ee752bed
1 file changed
tree: f9d33671dc950af6acb1b994ee3f887983d013c6
  1. .circleci/
  2. .github/
  3. checkpolicy/
  4. dbus/
  5. gui/
  6. libselinux/
  7. libsemanage/
  8. libsepol/
  9. mcstrans/
  10. policycoreutils/
  11. python/
  12. restorecond/
  13. sandbox/
  14. scripts/
  15. secilc/
  16. semodule-utils/
  17. .gitignore
  18. .travis.yml
  19. Android.bp
  20. CleanSpec.mk
  21. CONTRIBUTING.md
  22. lgtm.yml
  23. Makefile
  24. METADATA
  25. MODULE_LICENSE_GPL
  26. NOTICE
  27. OWNERS
  28. README.android
  29. README.md
  30. VERSION
README.md

SELinux Userspace

SELinux logo Run Tests Run SELinux testsuite in a virtual machine OSS-Fuzz Status CIFuzz Status

Please submit all bug reports and patches to selinux@vger.kernel.org.

Subscribe by sending "subscribe selinux" in the body of an email to majordomo@vger.kernel.org.

Archive of this mailing list is available on https://lore.kernel.org/selinux/.

Installation

SELinux libraries and tools are packaged in several Linux distributions:

Building and testing

Build dependencies on Fedora:

# For C libraries and programs
dnf install \
    audit-libs-devel \
    bison \
    bzip2-devel \
    CUnit-devel \
    diffutils \
    flex \
    gcc \
    gettext \
    glib2-devel \
    make \
    libcap-devel \
    libcap-ng-devel \
    pam-devel \
    pcre-devel \
    xmlto

# For Python and Ruby bindings
dnf install \
    python3-devel \
    ruby-devel \
    swig

Build dependencies on Debian:

# For C libraries and programs
apt-get install --no-install-recommends --no-install-suggests \
    bison \
    flex \
    gawk \
    gcc \
    gettext \
    make \
    libaudit-dev \
    libbz2-dev \
    libcap-dev \
    libcap-ng-dev \
    libcunit1-dev \
    libglib2.0-dev \
    libpcre3-dev \
    pkgconf \
    python3 \
    python3-distutils \
    systemd \
    xmlto

# For Python and Ruby bindings
apt-get install --no-install-recommends --no-install-suggests \
    python3-dev \
    ruby-dev \
    swig

To build and install everything under a private directory, run:

make clean distclean

make DESTDIR=~/obj install install-rubywrap install-pywrap

On Debian PYTHON_SETUP_ARGS=--install-layout=deb needs to be set when installing the python wrappers in order to create the correct python directory structure.

To run tests with the built libraries and programs, several paths (relative to $DESTDIR) need to be added to variables $LD_LIBRARY_PATH, $PATH and $PYTHONPATH. This can be done using ./scripts/env_use_destdir:

DESTDIR=~/obj ./scripts/env_use_destdir make test

Some tests require the reference policy to be installed (for example in python/sepolgen). In order to run these ones, instructions similar to the ones in section install of ./.travis.yml can be executed.

To install as the default system libraries and binaries (overwriting any previously installed ones - dangerous!), on x86_64, run:

make LIBDIR=/usr/lib64 SHLIBDIR=/lib64 install install-pywrap relabel

or on x86 (32-bit), run:

make install install-pywrap relabel

This may render your system unusable if the upstream SELinux userspace lacks library functions or other dependencies relied upon by your distribution. If it breaks, you get to keep both pieces.

Setting CFLAGS

Setting CFLAGS during the make process will cause the omission of many defaults. While the project strives to provide a reasonable set of default flags, custom CFLAGS could break the build, or have other undesired changes on the build output. Thus, be very careful when setting CFLAGS. CFLAGS that are encouraged to be set when overriding are:

  • -fno-semantic-interposition for gcc or compilers that do not do this. clang does this by default. clang-10 and up will support passing this flag, but ignore it. Previous clang versions fail.

macOS

To install libsepol on macOS (mainly for policy analysis):

cd libsepol; make PREFIX=/usr/local install

This requires GNU coreutils:

brew install coreutils