date:20180117

Re: [PATCH v2 08/14] python: build: follow standard semantics for DESTDIR and PREFIX

2018-01-17 Thread Petr Lautrbach

On Tue, Jan 16, 2018 at 09:23:21PM +0100, Marcus Folkesson wrote:
> Signed-off-by: Marcus Folkesson 
> ---
>  python/audit2allow/Makefile   | 10 --
>  python/chcat/Makefile |  8 
>  python/semanage/Makefile  | 13 ++---
>  python/sepolgen/src/sepolgen/Makefile |  3 ++-
>  python/sepolicy/Makefile  | 18 +-
>  5 files changed, 25 insertions(+), 27 deletions(-)
> 
> diff --git a/python/audit2allow/Makefile b/python/audit2allow/Makefile
> index 8db8075f..a73c8c68 100644
> --- a/python/audit2allow/Makefile
> +++ b/python/audit2allow/Makefile
> @@ -1,12 +1,10 @@
>  PYTHON ?= python
>  
>  # Installation directories.
> -PREFIX ?= $(DESTDIR)/usr
> -BINDIR ?= $(PREFIX)/bin
> -LIBDIR ?= $(PREFIX)/lib
> -MANDIR ?= $(PREFIX)/share/man
> -LOCALEDIR ?= /usr/share/locale
> -INCLUDEDIR ?= $(PREFIX)/include
> +PREFIX ?= /usr
> +BINDIR ?= $(DESTDIR)$(PREFIX)/bin
> +LIBDIR ?= $(DESTDIR)$(PREFIX)/lib
> +MANDIR ?= $(DESTDIR)$(PREFIX)/share/man
>  LIBSEPOLA ?= $(LIBDIR)/libsepol.a
>  
>  CFLAGS ?= -Werror -Wall -W
> diff --git a/python/chcat/Makefile b/python/chcat/Makefile
> index 0fd12d6d..947734a0 100644
> --- a/python/chcat/Makefile
> +++ b/python/chcat/Makefile
> @@ -1,8 +1,8 @@
>  # Installation directories.
> -PREFIX ?= $(DESTDIR)/usr
> -BINDIR ?= $(PREFIX)/bin
> -MANDIR ?= $(PREFIX)/share/man
> -LOCALEDIR ?= $(PREFIX)/share/locale
> +PREFIX ?= /usr
> +BINDIR ?= $(DESTDIR)$(PREFIX)/bin
> +MANDIR ?= $(DESTDIR)$(PREFIX)/share/man
> +LOCALEDIR ?= $(DESTDIR)$(PREFIX)/share/locale
>  
>  .PHONY: all
>  all: chcat
> diff --git a/python/semanage/Makefile b/python/semanage/Makefile
> index 132162bc..70759087 100644
> --- a/python/semanage/Makefile
> +++ b/python/semanage/Makefile
> @@ -1,13 +1,12 @@
>  PYTHON ?= python
>  
>  # Installation directories.
> -PREFIX ?= $(DESTDIR)/usr
> -LIBDIR ?= $(PREFIX)/lib
> -SBINDIR ?= $(PREFIX)/sbin
> -MANDIR = $(PREFIX)/share/man
> -PYTHONLIBDIR ?= $(shell $(PYTHON) -c "from distutils.sysconfig import *; 
> print(get_python_lib(1))")
> -PACKAGEDIR ?= $(DESTDIR)/$(PYTHONLIBDIR)
> -BASHCOMPLETIONDIR ?= $(DESTDIR)/usr/share/bash-completion/completions
> +PREFIX ?= /usr
> +SBINDIR ?= $(DESTDIR)$(PREFIX)/sbin
> +MANDIR = $(DESTDIR)$(PREFIX)/share/man
> +PYTHONLIBDIR ?= $(shell $(PYTHON) -c "from distutils.sysconfig import *; 
> print(get_python_lib(prefix='$(PREFIX)'))")
> +PACKAGEDIR ?= $(DESTDIR)$(PYTHONLIBDIR)
> +BASHCOMPLETIONDIR ?= $(DESTDIR)$(PREFIX)/share/bash-completion/completions
>  
>  TARGETS=semanage
>  
> diff --git a/python/sepolgen/src/sepolgen/Makefile 
> b/python/sepolgen/src/sepolgen/Makefile
> index d3aa7715..2121a955 100644
> --- a/python/sepolgen/src/sepolgen/Makefile
> +++ b/python/sepolgen/src/sepolgen/Makefile
> @@ -1,5 +1,6 @@
> +PREFIX ?= /usr
>  PYTHON ?= python
> -PYTHONLIBDIR ?= $(shell $(PYTHON) -c "from distutils.sysconfig import *; 
> print(get_python_lib(1))")
> +PYTHONLIBDIR ?= $(shell $(PYTHON) -c "from distutils.sysconfig import *; 
> print(get_python_lib(prefix='$(PREFIX)'))")
>  PACKAGEDIR ?= $(DESTDIR)/$(PYTHONLIBDIR)/sepolgen
>  
>  all:
> diff --git a/python/sepolicy/Makefile b/python/sepolicy/Makefile
> index 5a56e6c8..c528ae43 100644
> --- a/python/sepolicy/Makefile
> +++ b/python/sepolicy/Makefile
> @@ -1,14 +1,14 @@
>  PYTHON ?= python
>  
>  # Installation directories.
> -PREFIX ?= $(DESTDIR)/usr
> -LIBDIR ?= $(PREFIX)/lib
> -BINDIR ?= $(PREFIX)/bin
> -DATADIR ?= $(PREFIX)/share
> -MANDIR ?= $(PREFIX)/share/man
> -LOCALEDIR ?= /usr/share/locale
> -BASHCOMPLETIONDIR ?= $(DESTDIR)/usr/share/bash-completion/completions
> -SHAREDIR ?= $(PREFIX)/share/sandbox
> +PREFIX ?= /usr
> +LIBDIR ?= $(DESTDIR)$(PREFIX)/lib
> +BINDIR ?= $(DESTDIR)$(PREFIX)/bin
> +DATADIR ?= $(DESTDIR)$(PREFIX)/share
> +MANDIR ?= $(DESTDIR)$(PREFIX)/share/man
> +LOCALEDIR ?= $(DESTDIR)$(PREFIX)/share/locale
> +BASHCOMPLETIONDIR ?= $(DESTDIR)$(PREFIX)/share/bash-completion/completions
> +SHAREDIR ?= $(DESTDIR)$(PREFIX)/share/sandbox
>  CFLAGS ?= -Wall -Werror -Wextra -W
>  override CFLAGS += -DPACKAGE="policycoreutils" -DSHARED -shared
>  
> @@ -30,7 +30,7 @@ test:
>   @$(PYTHON) test_sepolicy.py -v
>  
>  install:
> - $(PYTHON) setup.py install `test -n "$(DESTDIR)" && echo --root 
> $(DESTDIR)`
> + $(PYTHON) setup.py install --prefix=$(PREFIX) `test -n 
> "$(DESTDIR)$(PREFIX)" && echo --root $(DESTDIR)$(PREFIX)`

--root $(DESTDIR)$(PREFIX) seems to duplicate prefix from  --prefix=$(PREFIX)

$ cd python
$ make \
  
DESTDIR=/home/build/rpmbuild/BUILDROOT/policycoreutils-2.7-99.fc28.20180117103354.x86_64
 \
  LIBSEPOLA=/usr/lib64/libsepol.a install

$ find 
/home/build/rpmbuild/BUILDROOT/policycoreutils-2.7-99.fc28.20180117103354.x86_64/usr/
 -type d -name sepolicy
/home/build/rpmbuild/BUILDROOT/policycoreutils-2.7-99.fc28.20180117103354.x86_64//usr/usr/lib/python2.7/site-packages/sepolicy


>   [ -d $(BINDIR) ] || mkdir -p $(BINDIR)
>   install -m 755 sepolicy.py $(BINDIR)/sepoli

Re: [PATCH v2 08/14] python: build: follow standard semantics for DESTDIR and PREFIX

2018-01-17 Thread Marcus Folkesson

Hi,

On Wed, Jan 17, 2018 at 11:11:35AM +0100, Petr Lautrbach wrote:
> On Tue, Jan 16, 2018 at 09:23:21PM +0100, Marcus Folkesson wrote:
> > Signed-off-by: Marcus Folkesson 
> > ---
> >  python/audit2allow/Makefile   | 10 --
> >  python/chcat/Makefile |  8 
> >  python/semanage/Makefile  | 13 ++---
> >  python/sepolgen/src/sepolgen/Makefile |  3 ++-
> >  python/sepolicy/Makefile  | 18 +-
> >  5 files changed, 25 insertions(+), 27 deletions(-)
> > 
> > diff --git a/python/audit2allow/Makefile b/python/audit2allow/Makefile
> > index 8db8075f..a73c8c68 100644
> > --- a/python/audit2allow/Makefile
> > +++ b/python/audit2allow/Makefile
> > @@ -1,12 +1,10 @@
> >  PYTHON ?= python
> >  
> >  # Installation directories.
> > -PREFIX ?= $(DESTDIR)/usr
> > -BINDIR ?= $(PREFIX)/bin
> > -LIBDIR ?= $(PREFIX)/lib
> > -MANDIR ?= $(PREFIX)/share/man
> > -LOCALEDIR ?= /usr/share/locale
> > -INCLUDEDIR ?= $(PREFIX)/include
> > +PREFIX ?= /usr
> > +BINDIR ?= $(DESTDIR)$(PREFIX)/bin
> > +LIBDIR ?= $(DESTDIR)$(PREFIX)/lib
> > +MANDIR ?= $(DESTDIR)$(PREFIX)/share/man
> >  LIBSEPOLA ?= $(LIBDIR)/libsepol.a
> >  
> >  CFLAGS ?= -Werror -Wall -W
> > diff --git a/python/chcat/Makefile b/python/chcat/Makefile
> > index 0fd12d6d..947734a0 100644
> > --- a/python/chcat/Makefile
> > +++ b/python/chcat/Makefile
> > @@ -1,8 +1,8 @@
> >  # Installation directories.
> > -PREFIX ?= $(DESTDIR)/usr
> > -BINDIR ?= $(PREFIX)/bin
> > -MANDIR ?= $(PREFIX)/share/man
> > -LOCALEDIR ?= $(PREFIX)/share/locale
> > +PREFIX ?= /usr
> > +BINDIR ?= $(DESTDIR)$(PREFIX)/bin
> > +MANDIR ?= $(DESTDIR)$(PREFIX)/share/man
> > +LOCALEDIR ?= $(DESTDIR)$(PREFIX)/share/locale
> >  
> >  .PHONY: all
> >  all: chcat
> > diff --git a/python/semanage/Makefile b/python/semanage/Makefile
> > index 132162bc..70759087 100644
> > --- a/python/semanage/Makefile
> > +++ b/python/semanage/Makefile
> > @@ -1,13 +1,12 @@
> >  PYTHON ?= python
> >  
> >  # Installation directories.
> > -PREFIX ?= $(DESTDIR)/usr
> > -LIBDIR ?= $(PREFIX)/lib
> > -SBINDIR ?= $(PREFIX)/sbin
> > -MANDIR = $(PREFIX)/share/man
> > -PYTHONLIBDIR ?= $(shell $(PYTHON) -c "from distutils.sysconfig import *; 
> > print(get_python_lib(1))")
> > -PACKAGEDIR ?= $(DESTDIR)/$(PYTHONLIBDIR)
> > -BASHCOMPLETIONDIR ?= $(DESTDIR)/usr/share/bash-completion/completions
> > +PREFIX ?= /usr
> > +SBINDIR ?= $(DESTDIR)$(PREFIX)/sbin
> > +MANDIR = $(DESTDIR)$(PREFIX)/share/man
> > +PYTHONLIBDIR ?= $(shell $(PYTHON) -c "from distutils.sysconfig import *; 
> > print(get_python_lib(prefix='$(PREFIX)'))")
> > +PACKAGEDIR ?= $(DESTDIR)$(PYTHONLIBDIR)
> > +BASHCOMPLETIONDIR ?= $(DESTDIR)$(PREFIX)/share/bash-completion/completions
> >  
> >  TARGETS=semanage
> >  
> > diff --git a/python/sepolgen/src/sepolgen/Makefile 
> > b/python/sepolgen/src/sepolgen/Makefile
> > index d3aa7715..2121a955 100644
> > --- a/python/sepolgen/src/sepolgen/Makefile
> > +++ b/python/sepolgen/src/sepolgen/Makefile
> > @@ -1,5 +1,6 @@
> > +PREFIX ?= /usr
> >  PYTHON ?= python
> > -PYTHONLIBDIR ?= $(shell $(PYTHON) -c "from distutils.sysconfig import *; 
> > print(get_python_lib(1))")
> > +PYTHONLIBDIR ?= $(shell $(PYTHON) -c "from distutils.sysconfig import *; 
> > print(get_python_lib(prefix='$(PREFIX)'))")
> >  PACKAGEDIR ?= $(DESTDIR)/$(PYTHONLIBDIR)/sepolgen
> >  
> >  all:
> > diff --git a/python/sepolicy/Makefile b/python/sepolicy/Makefile
> > index 5a56e6c8..c528ae43 100644
> > --- a/python/sepolicy/Makefile
> > +++ b/python/sepolicy/Makefile
> > @@ -1,14 +1,14 @@
> >  PYTHON ?= python
> >  
> >  # Installation directories.
> > -PREFIX ?= $(DESTDIR)/usr
> > -LIBDIR ?= $(PREFIX)/lib
> > -BINDIR ?= $(PREFIX)/bin
> > -DATADIR ?= $(PREFIX)/share
> > -MANDIR ?= $(PREFIX)/share/man
> > -LOCALEDIR ?= /usr/share/locale
> > -BASHCOMPLETIONDIR ?= $(DESTDIR)/usr/share/bash-completion/completions
> > -SHAREDIR ?= $(PREFIX)/share/sandbox
> > +PREFIX ?= /usr
> > +LIBDIR ?= $(DESTDIR)$(PREFIX)/lib
> > +BINDIR ?= $(DESTDIR)$(PREFIX)/bin
> > +DATADIR ?= $(DESTDIR)$(PREFIX)/share
> > +MANDIR ?= $(DESTDIR)$(PREFIX)/share/man
> > +LOCALEDIR ?= $(DESTDIR)$(PREFIX)/share/locale
> > +BASHCOMPLETIONDIR ?= $(DESTDIR)$(PREFIX)/share/bash-completion/completions
> > +SHAREDIR ?= $(DESTDIR)$(PREFIX)/share/sandbox
> >  CFLAGS ?= -Wall -Werror -Wextra -W
> >  override CFLAGS += -DPACKAGE="policycoreutils" -DSHARED -shared
> >  
> > @@ -30,7 +30,7 @@ test:
> > @$(PYTHON) test_sepolicy.py -v
> >  
> >  install:
> > -   $(PYTHON) setup.py install `test -n "$(DESTDIR)" && echo --root 
> > $(DESTDIR)`
> > +   $(PYTHON) setup.py install --prefix=$(PREFIX) `test -n 
> > "$(DESTDIR)$(PREFIX)" && echo --root $(DESTDIR)$(PREFIX)`
> 
> --root $(DESTDIR)$(PREFIX) seems to duplicate prefix from  --prefix=$(PREFIX)
> 
> $ cd python
> $ make \
>   
> DESTDIR=/home/build/rpmbuild/BUILDROOT/policycoreutils-2.7-99.fc28.20180117103354.x86_64
>  \
>   LIBSEPOLA=/usr/lib64/libsepol.a install
> 
> $ find 
> /h

[PATCH] selinux:Significant reduce of preempt_disable holds

2018-01-17 Thread peter.enderborg

From: Peter Enderborg 

Holding the preempt_disable is very bad for low latency tasks
as audio and therefore we need to break out the rule-set dependent
part from this disable. By using a rwsem instead of rwlock we
have an efficient locking and less preemption interference.

Selinux uses a lot of read_locks. This patch replaces the rwlock
with rwsem/percpu_down_read() that does not hold preempt_disable.

Intel Xeon W3520 2.67 Ghz running FC27 with 4.15.0-rc8git (+measurement)
I get preempt_disable in worst case for 1.2ms in security_compute_av().
With the patch I get 960us as the longest security_compute_av()
without preempt disabeld. It very much noise in the measurement
but it is not likely a degrade.

And the preempt_disable times is also very dependent on the selinux
rule-set.

In security_get_user_sids() we have two nested for-loops and the
inner part calls sittab_context_to_sid() that calls
sidtab_search_context() that has a for loop() over a while() where
the loops is dependent on the rules.

On the test system the average lookup time is 60us and does
not change with the rwsem usage.

Reported-by: Björn Davidsson 
Signed-off-by: Peter Enderborg 
---
 security/selinux/ss/services.c | 134 -
 1 file changed, 67 insertions(+), 67 deletions(-)

diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 33cfe5d..a3daaf2 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -87,7 +87,7 @@ int selinux_policycap_alwaysnetwork;
 int selinux_policycap_cgroupseclabel;
 int selinux_policycap_nnp_nosuid_transition;
 
-static DEFINE_RWLOCK(policy_rwlock);
+DEFINE_STATIC_PERCPU_RWSEM(policy_rwsem);
 
 static struct sidtab sidtab;
 struct policydb policydb;
@@ -779,7 +779,7 @@ static int security_compute_validatetrans(u32 oldsid, u32 
newsid, u32 tasksid,
if (!ss_initialized)
return 0;
 
-   read_lock(&policy_rwlock);
+   percpu_down_read(&policy_rwsem);
 
if (!user)
tclass = unmap_class(orig_tclass);
@@ -833,7 +833,7 @@ static int security_compute_validatetrans(u32 oldsid, u32 
newsid, u32 tasksid,
}
 
 out:
-   read_unlock(&policy_rwlock);
+   percpu_up_read(&policy_rwsem);
return rc;
 }
 
@@ -867,7 +867,7 @@ int security_bounded_transition(u32 old_sid, u32 new_sid)
int index;
int rc;
 
-   read_lock(&policy_rwlock);
+   percpu_down_read(&policy_rwsem);
 
rc = -EINVAL;
old_context = sidtab_search(&sidtab, old_sid);
@@ -929,7 +929,7 @@ int security_bounded_transition(u32 old_sid, u32 new_sid)
kfree(old_name);
}
 out:
-   read_unlock(&policy_rwlock);
+   percpu_up_read(&policy_rwsem);
 
return rc;
 }
@@ -1017,7 +1017,7 @@ void security_compute_xperms_decision(u32 ssid,
memset(xpermd->auditallow->p, 0, sizeof(xpermd->auditallow->p));
memset(xpermd->dontaudit->p, 0, sizeof(xpermd->dontaudit->p));
 
-   read_lock(&policy_rwlock);
+   percpu_down_read(&policy_rwsem);
if (!ss_initialized)
goto allow;
 
@@ -1070,7 +1070,7 @@ void security_compute_xperms_decision(u32 ssid,
}
}
 out:
-   read_unlock(&policy_rwlock);
+   percpu_up_read(&policy_rwsem);
return;
 allow:
memset(xpermd->allowed->p, 0xff, sizeof(xpermd->allowed->p));
@@ -1097,7 +1097,7 @@ void security_compute_av(u32 ssid,
u16 tclass;
struct context *scontext = NULL, *tcontext = NULL;
 
-   read_lock(&policy_rwlock);
+   percpu_down_read(&policy_rwsem);
avd_init(avd);
xperms->len = 0;
if (!ss_initialized)
@@ -1130,7 +1130,7 @@ void security_compute_av(u32 ssid,
context_struct_compute_av(scontext, tcontext, tclass, avd, xperms);
map_decision(orig_tclass, avd, policydb.allow_unknown);
 out:
-   read_unlock(&policy_rwlock);
+   percpu_up_read(&policy_rwsem);
return;
 allow:
avd->allowed = 0x;
@@ -1144,7 +1144,7 @@ void security_compute_av_user(u32 ssid,
 {
struct context *scontext = NULL, *tcontext = NULL;
 
-   read_lock(&policy_rwlock);
+   percpu_down_read(&policy_rwsem);
avd_init(avd);
if (!ss_initialized)
goto allow;
@@ -1175,7 +1175,7 @@ void security_compute_av_user(u32 ssid,
 
context_struct_compute_av(scontext, tcontext, tclass, avd, NULL);
  out:
-   read_unlock(&policy_rwlock);
+   percpu_up_read(&policy_rwsem);
return;
 allow:
avd->allowed = 0x;
@@ -1277,7 +1277,7 @@ static int security_sid_to_context_core(u32 sid, char 
**scontext,
rc = -EINVAL;
goto out;
}
-   read_lock(&policy_rwlock);
+   percpu_down_read(&policy_rwsem);
if (force)
context = sidtab_search_force(&sidtab, sid);
else
@@ -1290,7 +1290,7 @@ static int security_sid_to_context_core(u32 sid

Re: [PATCH] selinux:Significant reduce of preempt_disable holds

2018-01-17 Thread Stephen Smalley

On Wed, 2018-01-17 at 15:55 +0100, peter.enderb...@sony.com wrote:
> From: Peter Enderborg 
> 
> Holding the preempt_disable is very bad for low latency tasks
> as audio and therefore we need to break out the rule-set dependent
> part from this disable. By using a rwsem instead of rwlock we
> have an efficient locking and less preemption interference.
> 
> Selinux uses a lot of read_locks. This patch replaces the rwlock
> with rwsem/percpu_down_read() that does not hold preempt_disable.

Many of these functions are called while holding spinlocks, and some of
them are called from interrupt.  Unless I misunderstand, you can't just
replace read_lock() with percpu_down_read(), which might sleep.

What you might be able to do is to convert the whole thing to RCU, but
this would require reworking how policy booleans are changed and how
policy is reloaded.

You might also try increasing your AVC size via
/sys/fs/selinux/avc/cache_threshold to reduce cache misses and thus
calls to security_compute_av().

> 
> Intel Xeon W3520 2.67 Ghz running FC27 with 4.15.0-rc8git
> (+measurement)
> I get preempt_disable in worst case for 1.2ms in
> security_compute_av().
> With the patch I get 960us as the longest security_compute_av()
> without preempt disabeld. It very much noise in the measurement
> but it is not likely a degrade.
> 
> And the preempt_disable times is also very dependent on the selinux
> rule-set.
> 
> In security_get_user_sids() we have two nested for-loops and the
> inner part calls sittab_context_to_sid() that calls
> sidtab_search_context() that has a for loop() over a while() where
> the loops is dependent on the rules.
> 
> On the test system the average lookup time is 60us and does
> not change with the rwsem usage.
> 
> Reported-by: Björn Davidsson 
> Signed-off-by: Peter Enderborg 
> ---
>  security/selinux/ss/services.c | 134 ---
> --
>  1 file changed, 67 insertions(+), 67 deletions(-)
> 
> diff --git a/security/selinux/ss/services.c
> b/security/selinux/ss/services.c
> index 33cfe5d..a3daaf2 100644
> --- a/security/selinux/ss/services.c
> +++ b/security/selinux/ss/services.c
> @@ -87,7 +87,7 @@ int selinux_policycap_alwaysnetwork;
>  int selinux_policycap_cgroupseclabel;
>  int selinux_policycap_nnp_nosuid_transition;
>  
> -static DEFINE_RWLOCK(policy_rwlock);
> +DEFINE_STATIC_PERCPU_RWSEM(policy_rwsem);
>  
>  static struct sidtab sidtab;
>  struct policydb policydb;
> @@ -779,7 +779,7 @@ static int security_compute_validatetrans(u32
> oldsid, u32 newsid, u32 tasksid,
>   if (!ss_initialized)
>   return 0;
>  
> - read_lock(&policy_rwlock);
> + percpu_down_read(&policy_rwsem);
>  
>   if (!user)
>   tclass = unmap_class(orig_tclass);
> @@ -833,7 +833,7 @@ static int security_compute_validatetrans(u32
> oldsid, u32 newsid, u32 tasksid,
>   }
>  
>  out:
> - read_unlock(&policy_rwlock);
> + percpu_up_read(&policy_rwsem);
>   return rc;
>  }
>  
> @@ -867,7 +867,7 @@ int security_bounded_transition(u32 old_sid, u32
> new_sid)
>   int index;
>   int rc;
>  
> - read_lock(&policy_rwlock);
> + percpu_down_read(&policy_rwsem);
>  
>   rc = -EINVAL;
>   old_context = sidtab_search(&sidtab, old_sid);
> @@ -929,7 +929,7 @@ int security_bounded_transition(u32 old_sid, u32
> new_sid)
>   kfree(old_name);
>   }
>  out:
> - read_unlock(&policy_rwlock);
> + percpu_up_read(&policy_rwsem);
>  
>   return rc;
>  }
> @@ -1017,7 +1017,7 @@ void security_compute_xperms_decision(u32 ssid,
>   memset(xpermd->auditallow->p, 0, sizeof(xpermd->auditallow-
> >p));
>   memset(xpermd->dontaudit->p, 0, sizeof(xpermd->dontaudit-
> >p));
>  
> - read_lock(&policy_rwlock);
> + percpu_down_read(&policy_rwsem);
>   if (!ss_initialized)
>   goto allow;
>  
> @@ -1070,7 +1070,7 @@ void security_compute_xperms_decision(u32 ssid,
>   }
>   }
>  out:
> - read_unlock(&policy_rwlock);
> + percpu_up_read(&policy_rwsem);
>   return;
>  allow:
>   memset(xpermd->allowed->p, 0xff, sizeof(xpermd->allowed-
> >p));
> @@ -1097,7 +1097,7 @@ void security_compute_av(u32 ssid,
>   u16 tclass;
>   struct context *scontext = NULL, *tcontext = NULL;
>  
> - read_lock(&policy_rwlock);
> + percpu_down_read(&policy_rwsem);
>   avd_init(avd);
>   xperms->len = 0;
>   if (!ss_initialized)
> @@ -1130,7 +1130,7 @@ void security_compute_av(u32 ssid,
>   context_struct_compute_av(scontext, tcontext, tclass, avd,
> xperms);
>   map_decision(orig_tclass, avd, policydb.allow_unknown);
>  out:
> - read_unlock(&policy_rwlock);
> + percpu_up_read(&policy_rwsem);
>   return;
>  allow:
>   avd->allowed = 0x;
> @@ -1144,7 +1144,7 @@ void security_compute_av_user(u32 ssid,
>  {
>   struct context *scontext = NULL, *tcontext = NULL;
>  
> - read_lock(&policy_rwlock);
> + percpu_down_read(&polic

Re: [PATCH v2 08/14] python: build: follow standard semantics for DESTDIR and PREFIX

2018-01-17 Thread Petr Lautrbach

On Wed, Jan 17, 2018 at 11:43:58AM +0100, Marcus Folkesson wrote:
> Hi,
> 
> On Wed, Jan 17, 2018 at 11:11:35AM +0100, Petr Lautrbach wrote:
> > On Tue, Jan 16, 2018 at 09:23:21PM +0100, Marcus Folkesson wrote:
> > > Signed-off-by: Marcus Folkesson 
> > > ---
> > >  python/audit2allow/Makefile   | 10 --
> > >  python/chcat/Makefile |  8 
> > >  python/semanage/Makefile  | 13 ++---
> > >  python/sepolgen/src/sepolgen/Makefile |  3 ++-
> > >  python/sepolicy/Makefile  | 18 +-
> > >  5 files changed, 25 insertions(+), 27 deletions(-)
> > > 
> > > diff --git a/python/audit2allow/Makefile b/python/audit2allow/Makefile
> > > index 8db8075f..a73c8c68 100644
> > > --- a/python/audit2allow/Makefile
> > > +++ b/python/audit2allow/Makefile
> > > @@ -1,12 +1,10 @@
> > >  PYTHON ?= python
> > >  
> > >  # Installation directories.
> > > -PREFIX ?= $(DESTDIR)/usr
> > > -BINDIR ?= $(PREFIX)/bin
> > > -LIBDIR ?= $(PREFIX)/lib
> > > -MANDIR ?= $(PREFIX)/share/man
> > > -LOCALEDIR ?= /usr/share/locale
> > > -INCLUDEDIR ?= $(PREFIX)/include
> > > +PREFIX ?= /usr
> > > +BINDIR ?= $(DESTDIR)$(PREFIX)/bin
> > > +LIBDIR ?= $(DESTDIR)$(PREFIX)/lib
> > > +MANDIR ?= $(DESTDIR)$(PREFIX)/share/man
> > >  LIBSEPOLA ?= $(LIBDIR)/libsepol.a
> > >  
> > >  CFLAGS ?= -Werror -Wall -W
> > > diff --git a/python/chcat/Makefile b/python/chcat/Makefile
> > > index 0fd12d6d..947734a0 100644
> > > --- a/python/chcat/Makefile
> > > +++ b/python/chcat/Makefile
> > > @@ -1,8 +1,8 @@
> > >  # Installation directories.
> > > -PREFIX ?= $(DESTDIR)/usr
> > > -BINDIR ?= $(PREFIX)/bin
> > > -MANDIR ?= $(PREFIX)/share/man
> > > -LOCALEDIR ?= $(PREFIX)/share/locale
> > > +PREFIX ?= /usr
> > > +BINDIR ?= $(DESTDIR)$(PREFIX)/bin
> > > +MANDIR ?= $(DESTDIR)$(PREFIX)/share/man
> > > +LOCALEDIR ?= $(DESTDIR)$(PREFIX)/share/locale
> > >  
> > >  .PHONY: all
> > >  all: chcat
> > > diff --git a/python/semanage/Makefile b/python/semanage/Makefile
> > > index 132162bc..70759087 100644
> > > --- a/python/semanage/Makefile
> > > +++ b/python/semanage/Makefile
> > > @@ -1,13 +1,12 @@
> > >  PYTHON ?= python
> > >  
> > >  # Installation directories.
> > > -PREFIX ?= $(DESTDIR)/usr
> > > -LIBDIR ?= $(PREFIX)/lib
> > > -SBINDIR ?= $(PREFIX)/sbin
> > > -MANDIR = $(PREFIX)/share/man
> > > -PYTHONLIBDIR ?= $(shell $(PYTHON) -c "from distutils.sysconfig import *; 
> > > print(get_python_lib(1))")
> > > -PACKAGEDIR ?= $(DESTDIR)/$(PYTHONLIBDIR)
> > > -BASHCOMPLETIONDIR ?= $(DESTDIR)/usr/share/bash-completion/completions
> > > +PREFIX ?= /usr
> > > +SBINDIR ?= $(DESTDIR)$(PREFIX)/sbin
> > > +MANDIR = $(DESTDIR)$(PREFIX)/share/man
> > > +PYTHONLIBDIR ?= $(shell $(PYTHON) -c "from distutils.sysconfig import *; 
> > > print(get_python_lib(prefix='$(PREFIX)'))")
> > > +PACKAGEDIR ?= $(DESTDIR)$(PYTHONLIBDIR)
> > > +BASHCOMPLETIONDIR ?= 
> > > $(DESTDIR)$(PREFIX)/share/bash-completion/completions
> > >  
> > >  TARGETS=semanage
> > >  
> > > diff --git a/python/sepolgen/src/sepolgen/Makefile 
> > > b/python/sepolgen/src/sepolgen/Makefile
> > > index d3aa7715..2121a955 100644
> > > --- a/python/sepolgen/src/sepolgen/Makefile
> > > +++ b/python/sepolgen/src/sepolgen/Makefile
> > > @@ -1,5 +1,6 @@
> > > +PREFIX ?= /usr
> > >  PYTHON ?= python
> > > -PYTHONLIBDIR ?= $(shell $(PYTHON) -c "from distutils.sysconfig import *; 
> > > print(get_python_lib(1))")
> > > +PYTHONLIBDIR ?= $(shell $(PYTHON) -c "from distutils.sysconfig import *; 
> > > print(get_python_lib(prefix='$(PREFIX)'))")
> > >  PACKAGEDIR ?= $(DESTDIR)/$(PYTHONLIBDIR)/sepolgen
> > >  
> > >  all:
> > > diff --git a/python/sepolicy/Makefile b/python/sepolicy/Makefile
> > > index 5a56e6c8..c528ae43 100644
> > > --- a/python/sepolicy/Makefile
> > > +++ b/python/sepolicy/Makefile
> > > @@ -1,14 +1,14 @@
> > >  PYTHON ?= python
> > >  
> > >  # Installation directories.
> > > -PREFIX ?= $(DESTDIR)/usr
> > > -LIBDIR ?= $(PREFIX)/lib
> > > -BINDIR ?= $(PREFIX)/bin
> > > -DATADIR ?= $(PREFIX)/share
> > > -MANDIR ?= $(PREFIX)/share/man
> > > -LOCALEDIR ?= /usr/share/locale
> > > -BASHCOMPLETIONDIR ?= $(DESTDIR)/usr/share/bash-completion/completions
> > > -SHAREDIR ?= $(PREFIX)/share/sandbox
> > > +PREFIX ?= /usr
> > > +LIBDIR ?= $(DESTDIR)$(PREFIX)/lib
> > > +BINDIR ?= $(DESTDIR)$(PREFIX)/bin
> > > +DATADIR ?= $(DESTDIR)$(PREFIX)/share
> > > +MANDIR ?= $(DESTDIR)$(PREFIX)/share/man
> > > +LOCALEDIR ?= $(DESTDIR)$(PREFIX)/share/locale
> > > +BASHCOMPLETIONDIR ?= 
> > > $(DESTDIR)$(PREFIX)/share/bash-completion/completions
> > > +SHAREDIR ?= $(DESTDIR)$(PREFIX)/share/sandbox
> > >  CFLAGS ?= -Wall -Werror -Wextra -W
> > >  override CFLAGS += -DPACKAGE="policycoreutils" -DSHARED -shared
> > >  
> > > @@ -30,7 +30,7 @@ test:
> > >   @$(PYTHON) test_sepolicy.py -v
> > >  
> > >  install:
> > > - $(PYTHON) setup.py install `test -n "$(DESTDIR)" && echo --root 
> > > $(DESTDIR)`
> > > + $(PYTHON) setup.py install --prefix=$(PREFIX) `test -n 
> > > "$(

Re: [PATCH v2 08/14] python: build: follow standard semantics for DESTDIR and PREFIX

2018-01-17 Thread Marcus Folkesson

On Wed, Jan 17, 2018 at 05:38:06PM +0100, Petr Lautrbach wrote:
> On Wed, Jan 17, 2018 at 11:43:58AM +0100, Marcus Folkesson wrote:
> > Hi,
> > 
> > On Wed, Jan 17, 2018 at 11:11:35AM +0100, Petr Lautrbach wrote:
> > > On Tue, Jan 16, 2018 at 09:23:21PM +0100, Marcus Folkesson wrote:
> > > > Signed-off-by: Marcus Folkesson 
> > > > ---
> > > >  python/audit2allow/Makefile   | 10 --
> > > >  python/chcat/Makefile |  8 
> > > >  python/semanage/Makefile  | 13 ++---
> > > >  python/sepolgen/src/sepolgen/Makefile |  3 ++-
> > > >  python/sepolicy/Makefile  | 18 +-
> > > >  5 files changed, 25 insertions(+), 27 deletions(-)
> > > > 
> > > > diff --git a/python/audit2allow/Makefile b/python/audit2allow/Makefile
> > > > index 8db8075f..a73c8c68 100644
> > > > --- a/python/audit2allow/Makefile
> > > > +++ b/python/audit2allow/Makefile
> > > > @@ -1,12 +1,10 @@
> > > >  PYTHON ?= python
> > > >  
> > > >  # Installation directories.
> > > > -PREFIX ?= $(DESTDIR)/usr
> > > > -BINDIR ?= $(PREFIX)/bin
> > > > -LIBDIR ?= $(PREFIX)/lib
> > > > -MANDIR ?= $(PREFIX)/share/man
> > > > -LOCALEDIR ?= /usr/share/locale
> > > > -INCLUDEDIR ?= $(PREFIX)/include
> > > > +PREFIX ?= /usr
> > > > +BINDIR ?= $(DESTDIR)$(PREFIX)/bin
> > > > +LIBDIR ?= $(DESTDIR)$(PREFIX)/lib
> > > > +MANDIR ?= $(DESTDIR)$(PREFIX)/share/man
> > > >  LIBSEPOLA ?= $(LIBDIR)/libsepol.a
> > > >  
> > > >  CFLAGS ?= -Werror -Wall -W
> > > > diff --git a/python/chcat/Makefile b/python/chcat/Makefile
> > > > index 0fd12d6d..947734a0 100644
> > > > --- a/python/chcat/Makefile
> > > > +++ b/python/chcat/Makefile
> > > > @@ -1,8 +1,8 @@
> > > >  # Installation directories.
> > > > -PREFIX ?= $(DESTDIR)/usr
> > > > -BINDIR ?= $(PREFIX)/bin
> > > > -MANDIR ?= $(PREFIX)/share/man
> > > > -LOCALEDIR ?= $(PREFIX)/share/locale
> > > > +PREFIX ?= /usr
> > > > +BINDIR ?= $(DESTDIR)$(PREFIX)/bin
> > > > +MANDIR ?= $(DESTDIR)$(PREFIX)/share/man
> > > > +LOCALEDIR ?= $(DESTDIR)$(PREFIX)/share/locale
> > > >  
> > > >  .PHONY: all
> > > >  all: chcat
> > > > diff --git a/python/semanage/Makefile b/python/semanage/Makefile
> > > > index 132162bc..70759087 100644
> > > > --- a/python/semanage/Makefile
> > > > +++ b/python/semanage/Makefile
> > > > @@ -1,13 +1,12 @@
> > > >  PYTHON ?= python
> > > >  
> > > >  # Installation directories.
> > > > -PREFIX ?= $(DESTDIR)/usr
> > > > -LIBDIR ?= $(PREFIX)/lib
> > > > -SBINDIR ?= $(PREFIX)/sbin
> > > > -MANDIR = $(PREFIX)/share/man
> > > > -PYTHONLIBDIR ?= $(shell $(PYTHON) -c "from distutils.sysconfig import 
> > > > *; print(get_python_lib(1))")
> > > > -PACKAGEDIR ?= $(DESTDIR)/$(PYTHONLIBDIR)
> > > > -BASHCOMPLETIONDIR ?= $(DESTDIR)/usr/share/bash-completion/completions
> > > > +PREFIX ?= /usr
> > > > +SBINDIR ?= $(DESTDIR)$(PREFIX)/sbin
> > > > +MANDIR = $(DESTDIR)$(PREFIX)/share/man
> > > > +PYTHONLIBDIR ?= $(shell $(PYTHON) -c "from distutils.sysconfig import 
> > > > *; print(get_python_lib(prefix='$(PREFIX)'))")
> > > > +PACKAGEDIR ?= $(DESTDIR)$(PYTHONLIBDIR)
> > > > +BASHCOMPLETIONDIR ?= 
> > > > $(DESTDIR)$(PREFIX)/share/bash-completion/completions
> > > >  
> > > >  TARGETS=semanage
> > > >  
> > > > diff --git a/python/sepolgen/src/sepolgen/Makefile 
> > > > b/python/sepolgen/src/sepolgen/Makefile
> > > > index d3aa7715..2121a955 100644
> > > > --- a/python/sepolgen/src/sepolgen/Makefile
> > > > +++ b/python/sepolgen/src/sepolgen/Makefile
> > > > @@ -1,5 +1,6 @@
> > > > +PREFIX ?= /usr
> > > >  PYTHON ?= python
> > > > -PYTHONLIBDIR ?= $(shell $(PYTHON) -c "from distutils.sysconfig import 
> > > > *; print(get_python_lib(1))")
> > > > +PYTHONLIBDIR ?= $(shell $(PYTHON) -c "from distutils.sysconfig import 
> > > > *; print(get_python_lib(prefix='$(PREFIX)'))")
> > > >  PACKAGEDIR ?= $(DESTDIR)/$(PYTHONLIBDIR)/sepolgen
> > > >  
> > > >  all:
> > > > diff --git a/python/sepolicy/Makefile b/python/sepolicy/Makefile
> > > > index 5a56e6c8..c528ae43 100644
> > > > --- a/python/sepolicy/Makefile
> > > > +++ b/python/sepolicy/Makefile
> > > > @@ -1,14 +1,14 @@
> > > >  PYTHON ?= python
> > > >  
> > > >  # Installation directories.
> > > > -PREFIX ?= $(DESTDIR)/usr
> > > > -LIBDIR ?= $(PREFIX)/lib
> > > > -BINDIR ?= $(PREFIX)/bin
> > > > -DATADIR ?= $(PREFIX)/share
> > > > -MANDIR ?= $(PREFIX)/share/man
> > > > -LOCALEDIR ?= /usr/share/locale
> > > > -BASHCOMPLETIONDIR ?= $(DESTDIR)/usr/share/bash-completion/completions
> > > > -SHAREDIR ?= $(PREFIX)/share/sandbox
> > > > +PREFIX ?= /usr
> > > > +LIBDIR ?= $(DESTDIR)$(PREFIX)/lib
> > > > +BINDIR ?= $(DESTDIR)$(PREFIX)/bin
> > > > +DATADIR ?= $(DESTDIR)$(PREFIX)/share
> > > > +MANDIR ?= $(DESTDIR)$(PREFIX)/share/man
> > > > +LOCALEDIR ?= $(DESTDIR)$(PREFIX)/share/locale
> > > > +BASHCOMPLETIONDIR ?= 
> > > > $(DESTDIR)$(PREFIX)/share/bash-completion/completions
> > > > +SHAREDIR ?= $(DESTDIR)$(PREFIX)/share/sandbox
> > > >  CFLAGS ?= -Wall -Werror -Wextra -W
> > > >  override CFLAGS += -DPA

Re: [PATCH v2 02/14] libselinux: build: follow standard semantics for DESTDIR and PREFIX

2018-01-17 Thread Nicolas Iooss

On Tue, Jan 16, 2018 at 9:23 PM, Marcus Folkesson
 wrote:
> This patch solves the following issues:
> - The pkg-config files generates odd paths when using DESTDIR without PREFIX
> - DESTDIR is needed during compile time to compute library and header paths 
> which it should not.
> - Installing with both DESTDIR and PREFIX set gives us odd paths
> - Make usage of DESTDIR and PREFIX more standard
>
> Signed-off-by: Marcus Folkesson 
> ---
>  libselinux/include/Makefile |  4 ++--
>  libselinux/man/Makefile |  7 ---
>  libselinux/src/Makefile | 12 +---
>  libselinux/src/libselinux.pc.in |  2 +-
>  libselinux/utils/Makefile   |  6 ++
>  5 files changed, 14 insertions(+), 17 deletions(-)
>
> diff --git a/libselinux/include/Makefile b/libselinux/include/Makefile
> index 757a6c9c..3b51f5ce 100644
> --- a/libselinux/include/Makefile
> +++ b/libselinux/include/Makefile
> @@ -1,6 +1,6 @@
>  # Installation directories.
> -PREFIX ?= $(DESTDIR)/usr
> -INCDIR ?= $(PREFIX)/include/selinux
> +PREFIX ?= /usr
> +INCDIR = $(DESTDIR)$(PREFIX)/include/selinux
>
>  all:
>
> diff --git a/libselinux/man/Makefile b/libselinux/man/Makefile
> index 0643e6af..233bfaa9 100644
> --- a/libselinux/man/Makefile
> +++ b/libselinux/man/Makefile
> @@ -1,7 +1,8 @@
>  # Installation directories.
> -MAN8DIR ?= $(DESTDIR)/usr/share/man/man8
> -MAN5DIR ?= $(DESTDIR)/usr/share/man/man5
> -MAN3DIR ?= $(DESTDIR)/usr/share/man/man3
> +PREFIX ?= /usr
> +MAN8DIR ?= $(DESTDIR)$(PREFIX)/share/man/man8
> +MAN5DIR ?= $(DESTDIR)$(PREFIX)/share/man/man5
> +MAN3DIR ?= $(DESTDIR)$(PREFIX)/share/man/man3
>
>  all:
>
> diff --git a/libselinux/src/Makefile b/libselinux/src/Makefile
> index 18df75c8..18a58164 100644
> --- a/libselinux/src/Makefile
> +++ b/libselinux/src/Makefile
> @@ -8,8 +8,8 @@ RUBYPREFIX ?= $(notdir $(RUBY))
>  PKG_CONFIG ?= pkg-config
>
>  # Installation directories.
> -PREFIX ?= $(DESTDIR)/usr
> -LIBDIR ?= $(PREFIX)/lib
> +PREFIX ?= /usr
> +LIBDIR ?= $(DESTDIR)$(PREFIX)/lib
>  SHLIBDIR ?= $(DESTDIR)/lib
>  INCLUDEDIR ?= $(PREFIX)/include
>  PYINC ?= $(shell $(PKG_CONFIG) --cflags $(PYPREFIX))
> @@ -19,8 +19,6 @@ PYCEXT ?= $(shell $(PYTHON) -c 'import imp;print([s for 
> s,m,t in imp.get_suffixe
>  RUBYINC ?= $(shell $(RUBY) -e 'puts "-I" + 
> RbConfig::CONFIG["rubyarchhdrdir"] + " -I" + RbConfig::CONFIG["rubyhdrdir"]')
>  RUBYLIBS ?= $(shell $(RUBY) -e 'puts "-L" + RbConfig::CONFIG["libdir"] + " 
> -L" + RbConfig::CONFIG["archlibdir"] + " " + 
> RbConfig::CONFIG["LIBRUBYARG_SHARED"]')
>  RUBYINSTALL ?= $(DESTDIR)$(shell $(RUBY) -e 'puts 
> RbConfig::CONFIG["vendorarchdir"]')
> -LIBBASE ?= $(shell basename $(LIBDIR))
> -LIBSEPOLA ?= $(LIBDIR)/libsepol.a
>
>  VERSION = $(shell cat ../VERSION)
>  LIBVERSION = 1
> @@ -148,7 +146,7 @@ $(LIBSO): $(LOBJS)
> ln -sf $@ $(TARGET)
>
>  $(LIBPC): $(LIBPC).in ../VERSION
> -   sed -e 's/@VERSION@/$(VERSION)/; s:@prefix@:$(PREFIX):; 
> s:@libdir@:$(LIBBASE):; s:@includedir@:$(INCLUDEDIR):; 
> s:@PCRE_MODULE@:$(PCRE_MODULE):' < $< > $@
> +   sed -e 's/@VERSION@/$(VERSION)/; s:@prefix@:$(PREFIX):; 
> s:@libdir@:$(LIBDIR):; s:@includedir@:$(INCLUDEDIR):; 
> s:@PCRE_MODULE@:$(PCRE_MODULE):' < $< > $@
>
>  selinuxswig_python_exception.i: ../include/selinux/selinux.h
> bash -e exception.sh > $@ || (rm -f $@ ; false)
> @@ -156,8 +154,8 @@ selinuxswig_python_exception.i: 
> ../include/selinux/selinux.h
>  $(AUDIT2WHYLOBJ): audit2why.c
> $(CC) $(filter-out -Werror, $(CFLAGS)) $(PYINC) -fPIC -DSHARED -c -o 
> $@ $<
>
> -$(AUDIT2WHYSO): $(AUDIT2WHYLOBJ) $(LIBSEPOLA)
> -   $(CC) $(CFLAGS) $(LDFLAGS) -L. -shared -o $@ $^ -lselinux $(PYLIBS)
> +$(AUDIT2WHYSO): $(AUDIT2WHYLOBJ)
> +   $(CC) $(CFLAGS) $(LDFLAGS) -L. -shared -o $@ $^ -lselinux $(PYLIBS) 
> -l:libsepol.a

Hello,
This change makes audit2why.so no longer being rebuilt when libsepol's
code change. This is an issue when debugging issues in libsepol, which
is why I added $(LIBSEPOLA) to the dependencies of $(AUDIT2WHYSO) in
commit dcd135cc06ab ("Re-link programs after libsepol.a is updated"
[1]).
By the way, I like the change from using a "hardcoded" path to
libsepol.a to telling the compiler to look into directories specified
with option -L in LDFLAGS. This would ease the packaging a little bit,
as it makes defining LIBSEPOLA no longer necessary (if I understood
the changes correctly, I have not tested this point). Is there a way
to ask the compiler for the resolved location of a static library, in
a way which can be used to compute the value of LIBSEPOLA? ("gcc
-Wl,--trace ..." displays it but it is not easily usable).

Best regards,
Nicolas

[1] 
https://github.com/SELinuxProject/selinux/commit/dcd135cc06abd8cd662d2d7a896e368f09380dd2

Re: [PATCH v2 08/14] python: build: follow standard semantics for DESTDIR and PREFIX

Re: [PATCH v2 08/14] python: build: follow standard semantics for DESTDIR and PREFIX

[PATCH] selinux:Significant reduce of preempt_disable holds

Re: [PATCH] selinux:Significant reduce of preempt_disable holds

Re: [PATCH v2 08/14] python: build: follow standard semantics for DESTDIR and PREFIX

Re: [PATCH v2 08/14] python: build: follow standard semantics for DESTDIR and PREFIX

Re: [PATCH v2 02/14] libselinux: build: follow standard semantics for DESTDIR and PREFIX

7 matches

Site Navigation

Mail list logo

Footer information