Package: busybox Followup-For: Bug #767760 Hi,
Please find here a patch to add SELinux support. The patch is not disabling SELinux on !linux architectures, that should be fixed before being pushed, but I'm not too sure how to do that with the build system here. Cheers, Laurent Bigonville -- System Information: Debian Release: stretch/sid APT prefers unstable APT policy: (500, 'unstable'), (1, 'experimental') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 4.1.0-1-amd64 (SMP w/8 CPU cores) Locale: LANG=fr_BE.utf8, LC_CTYPE=fr_BE.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) Versions of packages busybox depends on: ii libc6 2.19-19 ii libselinux1 2.3-2+b1 ii libsepol1 2.4-1 busybox recommends no packages. busybox suggests no packages. -- no debconf information
diff -Nru busybox-1.22.0/debian/config/pkg/deb busybox-1.22.0/debian/config/pkg/deb --- busybox-1.22.0/debian/config/pkg/deb 2014-03-01 11:41:03.000000000 +0100 +++ busybox-1.22.0/debian/config/pkg/deb 2015-08-06 01:46:50.000000000 +0200 @@ -46,7 +46,7 @@ CONFIG_FEATURE_SUID=y CONFIG_FEATURE_SUID_CONFIG=y CONFIG_FEATURE_SUID_CONFIG_QUIET=y -# CONFIG_SELINUX is not set +CONFIG_SELINUX=y CONFIG_FEATURE_PREFER_APPLETS=y CONFIG_BUSYBOX_EXEC_PATH="/proc/self/exe" CONFIG_FEATURE_SYSLOG=y @@ -168,7 +168,7 @@ CONFIG_FEATURE_TAR_TO_COMMAND=y CONFIG_FEATURE_TAR_UNAME_GNAME=y CONFIG_FEATURE_TAR_NOPRESERVE_TIME=y -# CONFIG_FEATURE_TAR_SELINUX is not set +CONFIG_FEATURE_TAR_SELINUX=y CONFIG_UNZIP=y # @@ -951,21 +951,25 @@ # CONFIG_ENVUIDGID is not set # CONFIG_ENVDIR is not set # CONFIG_SOFTLIMIT is not set -# CONFIG_CHCON is not set -# CONFIG_FEATURE_CHCON_LONG_OPTIONS is not set -# CONFIG_GETENFORCE is not set -# CONFIG_GETSEBOOL is not set -# CONFIG_LOAD_POLICY is not set -# CONFIG_MATCHPATHCON is not set -# CONFIG_RESTORECON is not set -# CONFIG_RUNCON is not set -# CONFIG_FEATURE_RUNCON_LONG_OPTIONS is not set -# CONFIG_SELINUXENABLED is not set -# CONFIG_SETENFORCE is not set -# CONFIG_SETFILES is not set -# CONFIG_FEATURE_SETFILES_CHECK_OPTION is not set -# CONFIG_SETSEBOOL is not set -# CONFIG_SESTATUS is not set + +# +# SELinux Utilities +# +CONFIG_CHCON=y +CONFIG_FEATURE_CHCON_LONG_OPTIONS=y +CONFIG_GETENFORCE=y +CONFIG_GETSEBOOL=y +CONFIG_LOAD_POLICY=y +CONFIG_MATCHPATHCON=y +CONFIG_RESTORECON=y +CONFIG_RUNCON=y +CONFIG_FEATURE_RUNCON_LONG_OPTIONS=y +CONFIG_SELINUXENABLED=y +CONFIG_SETENFORCE=y +CONFIG_SETFILES=y +CONFIG_FEATURE_SETFILES_CHECK_OPTION=y +CONFIG_SETSEBOOL=y +CONFIG_SESTATUS=y # # Shells diff -Nru busybox-1.22.0/debian/config/pkg/static busybox-1.22.0/debian/config/pkg/static --- busybox-1.22.0/debian/config/pkg/static 2014-03-01 11:41:03.000000000 +0100 +++ busybox-1.22.0/debian/config/pkg/static 2015-08-06 01:46:59.000000000 +0200 @@ -46,7 +46,7 @@ CONFIG_FEATURE_SUID=y CONFIG_FEATURE_SUID_CONFIG=y CONFIG_FEATURE_SUID_CONFIG_QUIET=y -# CONFIG_SELINUX is not set +CONFIG_SELINUX=y CONFIG_FEATURE_PREFER_APPLETS=y CONFIG_BUSYBOX_EXEC_PATH="/proc/self/exe" CONFIG_FEATURE_SYSLOG=y @@ -168,7 +168,7 @@ CONFIG_FEATURE_TAR_TO_COMMAND=y CONFIG_FEATURE_TAR_UNAME_GNAME=y CONFIG_FEATURE_TAR_NOPRESERVE_TIME=y -# CONFIG_FEATURE_TAR_SELINUX is not set +CONFIG_FEATURE_TAR_SELINUX=y CONFIG_UNZIP=y # @@ -951,21 +951,25 @@ # CONFIG_ENVUIDGID is not set # CONFIG_ENVDIR is not set # CONFIG_SOFTLIMIT is not set -# CONFIG_CHCON is not set -# CONFIG_FEATURE_CHCON_LONG_OPTIONS is not set -# CONFIG_GETENFORCE is not set -# CONFIG_GETSEBOOL is not set -# CONFIG_LOAD_POLICY is not set -# CONFIG_MATCHPATHCON is not set -# CONFIG_RESTORECON is not set -# CONFIG_RUNCON is not set -# CONFIG_FEATURE_RUNCON_LONG_OPTIONS is not set -# CONFIG_SELINUXENABLED is not set -# CONFIG_SETENFORCE is not set -# CONFIG_SETFILES is not set -# CONFIG_FEATURE_SETFILES_CHECK_OPTION is not set -# CONFIG_SETSEBOOL is not set -# CONFIG_SESTATUS is not set + +# +# SELinux Utilities +# +CONFIG_CHCON=y +CONFIG_FEATURE_CHCON_LONG_OPTIONS=y +CONFIG_GETENFORCE=y +CONFIG_GETSEBOOL=y +CONFIG_LOAD_POLICY=y +CONFIG_MATCHPATHCON=y +CONFIG_RESTORECON=y +CONFIG_RUNCON=y +CONFIG_FEATURE_RUNCON_LONG_OPTIONS=y +CONFIG_SELINUXENABLED=y +CONFIG_SETENFORCE=y +CONFIG_SETFILES=y +CONFIG_FEATURE_SETFILES_CHECK_OPTION=y +CONFIG_SETSEBOOL=y +CONFIG_SESTATUS=y # # Shells diff -Nru busybox-1.22.0/debian/control busybox-1.22.0/debian/control --- busybox-1.22.0/debian/control 2015-03-04 16:12:02.000000000 +0100 +++ busybox-1.22.0/debian/control 2015-08-13 20:07:47.000000000 +0200 @@ -9,6 +9,7 @@ # glibc static-nss #754813, 2.19..2.19-11, -12 is ok. Depend on libc-dev-bin # as it is the package which is named the same on all architectures libc-dev-bin (>> 2.19-12~) | libc-dev-bin (<< 2.19), + libselinux1-dev [linux-any] Standards-Version: 3.9.5 Vcs-Git: git://anonscm.debian.org/d-i/busybox.git Vcs-Browser: http://anonscm.debian.org/gitweb/?p=d-i/busybox.git diff -Nru busybox-1.22.0/debian/patches/series busybox-1.22.0/debian/patches/series --- busybox-1.22.0/debian/patches/series 2015-03-04 17:02:27.000000000 +0100 +++ busybox-1.22.0/debian/patches/series 2015-08-13 20:10:10.000000000 +0200 @@ -29,3 +29,4 @@ update-deb-format-support.patch CVE-2014-9645.patch +static-linking-selinux.patch diff -Nru busybox-1.22.0/debian/patches/static-linking-selinux.patch busybox-1.22.0/debian/patches/static-linking-selinux.patch --- busybox-1.22.0/debian/patches/static-linking-selinux.patch 1970-01-01 01:00:00.000000000 +0100 +++ busybox-1.22.0/debian/patches/static-linking-selinux.patch 2015-08-13 20:28:22.000000000 +0200 @@ -0,0 +1,15 @@ +Description: Newer versions of libselinux requires libpcre and pthread for static linking +Author: Laurent Bigonville <bi...@debian.org> +Forwarded: no + +--- a/Makefile.flags ++++ b/Makefile.flags +@@ -143,7 +143,7 @@ LDLIBS += pam pam_misc pthread + endif + + ifeq ($(CONFIG_SELINUX),y) +-SELINUX_PC_MODULES = libselinux libsepol ++SELINUX_PC_MODULES = libselinux libsepol libpcre pthread + $(eval $(call pkg_check_modules,SELINUX,$(SELINUX_PC_MODULES))) + CPPFLAGS += $(SELINUX_CFLAGS) + LDLIBS += $(if $(SELINUX_LIBS),$(SELINUX_LIBS:-l%=%),$(SELINUX_PC_MODULES:lib%=%))