gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

selinuxPackages: init; selinux (all): 3.8.1 -> 3.10; selinux-refpolicy: 2.20250213 -> 2.20250923; selinux-sandbox: 3.3 -> 3.10 (#485821)

Browse Source
This commit is contained in:
Philip Taron
2026-02-13 20:02:53 +00:00
committed by GitHub
parent df7bf59230 f9a2e01611
commit 22a3bb7c93
13 changed files with 130 additions and 142 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkgs/by-name/ch/checkpolicy/package.nix
+5 -5
View File
@@ -7,14 +7,14 @@
libsepol,
}:
stdenv.mkDerivation rec {
stdenv.mkDerivation (finalAttrs: {
pname = "checkpolicy";
version = "3.8.1";
version = "3.10";
inherit (libsepol) se_url;
src = fetchurl {
url = "${se_url}/${version}/checkpolicy-${version}.tar.gz";
sha256 = "sha256-e0d8UW4mk9i2xRE4YyMXfx19tRwuBOttDejKKzYSDl0=";
url = "${finalAttrs.se_url}/${finalAttrs.version}/checkpolicy-${finalAttrs.version}.tar.gz";
hash = "sha256-LZKVHfywkNYXnnojhWYi4Py8Mr4Dvx5grOncnL2hHlk=";
};
nativeBuildInputs = [
@@ -37,4 +37,4 @@ stdenv.mkDerivation rec {
description = "SELinux policy compiler";
mainProgram = "checkpolicy";
};
}
})
pkgs/by-name/li/libselinux/fix-build-32bit-lfs.patch
-41
View File
@@ -1,41 +0,0 @@
diff --git libselinux/include/selinux/selinux.h libselinux/include/selinux/selinux.h
index f3cf5a209..f64896b7a 100644
--- libselinux/include/selinux/selinux.h
+++ libselinux/include/selinux/selinux.h
@@ -537,7 +537,7 @@ extern int matchpathcon_index(const char *path,
with the same inode (e.g. due to multiple hard links). If so, then
use the latter of the two specifications based on their order in the
file contexts configuration. Return the used specification index. */
-#if defined(_FILE_OFFSET_BITS) && _FILE_OFFSET_BITS == 64 && __BITS_PER_LONG < 64
+#if defined(_FILE_OFFSET_BITS) && _FILE_OFFSET_BITS == 64 && defined(__INO64_T_TYPE) && !defined(__INO_T_MATCHES_INO64_T)
#define matchpathcon_filespec_add matchpathcon_filespec_add64
#endif
extern int matchpathcon_filespec_add(ino_t ino, int specind, const char *file);
diff --git libselinux/src/matchpathcon.c libselinux/src/matchpathcon.c
index 51f0e4ff9..ab7c3090a 100644
--- libselinux/src/matchpathcon.c
+++ libselinux/src/matchpathcon.c
@@ -261,7 +261,7 @@ int matchpathcon_filespec_add(ino_t ino, int specind, const char *file)
return -1;
}
-#if defined(_FILE_OFFSET_BITS) && _FILE_OFFSET_BITS == 64 && __BITS_PER_LONG < 64
+#if (defined(_FILE_OFFSET_BITS) && _FILE_OFFSET_BITS == 64) && defined(__INO64_T_TYPE) && !defined(__INO_T_MATCHES_INO64_T)
/* alias defined in the public header but we undefine it here */
#undef matchpathcon_filespec_add
@@ -280,9 +280,13 @@ int matchpathcon_filespec_add(unsigned long ino, int specind,
{
return matchpathcon_filespec_add64(ino, specind, file);
}
+#elif (defined(_FILE_OFFSET_BITS) && _FILE_OFFSET_BITS == 64) || defined(__INO_T_MATCHES_INO64_T)
+
+static_assert(sizeof(uint64_t) == sizeof(ino_t), "inode size mismatch");
+
#else
-static_assert(sizeof(unsigned long) == sizeof(ino_t), "inode size mismatch");
+static_assert(sizeof(uint32_t) == sizeof(ino_t), "inode size mismatch");
#endif
pkgs/by-name/li/libselinux/package.nix
+16 -29
View File
@@ -2,7 +2,6 @@
lib,
stdenv,
fetchurl,
buildPackages,
pcre2,
pkg-config,
libsepol,
@@ -13,11 +12,11 @@
fts,
}:
assert enablePython -> swig != null && python3 != null;
assert enablePython -> swig != null && python3 != null && !stdenv.hostPlatform.isStatic;
stdenv.mkDerivation (finalAttrs: {
pname = "libselinux";
version = "3.8.1";
version = "3.10";
inherit (libsepol) se_url;
outputs = [
@@ -30,39 +29,14 @@ stdenv.mkDerivation (finalAttrs: {
src = fetchurl {
url = "${finalAttrs.se_url}/${finalAttrs.version}/libselinux-${finalAttrs.version}.tar.gz";
hash = "sha256-7C0nifkxFS0hwdsetLwgLOTszt402b6eNg47RSQ87iw=";
hash = "sha256-HvIWxbVvt+ClHNKQl4ehdaF+45HgRniUgHhzU56+dms=";
};
patches = [
# Make it possible to disable shared builds (for pkgsStatic).
#
# We can't use fetchpatch because it processes includes/excludes
# /after/ stripping the prefix, which wouldn't work here because
# there would be no way to distinguish between
# e.g. libselinux/src/Makefile and libsepol/src/Makefile.
#
# This is a static email, so we shouldn't have to worry about
# normalizing the patch.
(fetchurl {
url = "https://lore.kernel.org/selinux/20250211211651.1297357-3-hi@alyssa.is/raw";
hash = "sha256-a0wTSItj5vs8GhIkfD1OPSjGmAJlK1orptSE7T3Hx20=";
postFetch = ''
mv "$out" $TMPDIR/patch
${buildPackages.patchutils_0_3_3}/bin/filterdiff \
-i 'a/libselinux/*' --strip 1 <$TMPDIR/patch >"$out"
'';
})
(fetchurl {
url = "https://git.yoctoproject.org/meta-selinux/plain/recipes-security/selinux/libselinux/0003-libselinux-restore-drop-the-obsolete-LSF-transitiona.patch?id=62b9c816a5000dc01b28e78213bde26b58cbca9d";
hash = "sha256-RiEUibLVzfiRU6N/J187Cs1iPAih87gCZrlyRVI2abU=";
})
# commit 5c3fcbd931b7f9752b5ce29cec3b6813991d61c0 plus an additional
# fix for a musl build regression caused by that commit:
# https://lore.kernel.org/selinux/20250426151356.7116-2-hi@alyssa.is/
# Fix build on 32-bit LFS platforms
./fix-build-32bit-lfs.patch
];
nativeBuildInputs = [
@@ -129,6 +103,19 @@ stdenv.mkDerivation (finalAttrs: {
preFixup = lib.optionalString enablePython ''
mv $out/${python3.sitePackages}/selinux/* $py/${python3.sitePackages}/selinux/
rm -rf $out/lib/python*
# We need to fix this symlink so it's named correctly for cross compiles.
# e.g. the Makefile would put _selinux.cpython-313-x86_64-linux-gnu.so -> selinux/_selinux.cpython-313-x86_64-linux-gnu.so
# here on a cross compile for aarch64, but put the aarch64 file in the selinux directory
pushd .
cd $py/${python3.sitePackages}
[ -f "$(ls selinux/_selinux.*${stdenv.hostPlatform.extensions.sharedLibrary})" ] || {
echo "selinux shared library not found!" >&2
exit 1
}
rm -vf _selinux.*${stdenv.hostPlatform.extensions.sharedLibrary}
ln -vsf selinux/_selinux.*${stdenv.hostPlatform.extensions.sharedLibrary}
popd
'';
meta = removeAttrs libsepol.meta [ "outputsToInstall" ] // {
pkgs/by-name/li/libsemanage/package.nix
+9 -6
View File
@@ -9,19 +9,19 @@
libselinux,
bzip2,
audit,
enablePython ? true,
enablePython ? !stdenv.hostPlatform.isStatic,
swig ? null,
python3 ? null,
}:
stdenv.mkDerivation rec {
stdenv.mkDerivation (finalAttrs: {
pname = "libsemanage";
version = "3.8.1";
version = "3.10";
inherit (libsepol) se_url;
src = fetchurl {
url = "${se_url}/${version}/libsemanage-${version}.tar.gz";
sha256 = "sha256-ezkSeyGcxwv9k1pK9rDyuoPUs1yRbyU8fpQsI6tJDwc=";
url = "${finalAttrs.se_url}/${finalAttrs.version}/libsemanage-${finalAttrs.version}.tar.gz";
hash = "sha256-GXiJTEFHaa13Q40miG6q4/t7t0V47ypa0xMMictcsf4=";
};
outputs = [
@@ -60,6 +60,9 @@ stdenv.mkDerivation rec {
"PYPREFIX=python"
"PYTHONLIBDIR=$(py)/${python3.sitePackages}"
"DEFAULT_SEMANAGE_CONF_LOCATION=$(out)/etc/selinux/semanage.conf"
]
++ lib.optionals stdenv.hostPlatform.isStatic [
"DISABLE_SHARED=y"
];
# The following turns the 'clobbered' error into a warning
@@ -80,4 +83,4 @@ stdenv.mkDerivation rec {
description = "Policy management tools for SELinux";
license = lib.licenses.lgpl21;
};
}
})
pkgs/by-name/li/libsepol/package.nix
+10 -11
View File
@@ -5,9 +5,9 @@
flex,
}:
stdenv.mkDerivation rec {
stdenv.mkDerivation (finalAttrs: {
pname = "libsepol";
version = "3.8.1";
version = "3.10";
se_url = "https://github.com/SELinuxProject/selinux/releases/download";
outputs = [
@@ -18,15 +18,10 @@ stdenv.mkDerivation rec {
];
src = fetchurl {
url = "${se_url}/${version}/libsepol-${version}.tar.gz";
sha256 = "sha256-DnhwUwX5VavUwGVNN6VHfuJjSat0254rA6eGiJeuHd8=";
url = "${finalAttrs.se_url}/${finalAttrs.version}/libsepol-${finalAttrs.version}.tar.gz";
hash = "sha256-1VVYZ5f6nzg0RJbSp+wRR7bKrz/MRMQtjVFz7denmnE=";
};
postPatch = lib.optionalString stdenv.hostPlatform.isStatic ''
substituteInPlace src/Makefile --replace 'all: $(LIBA) $(LIBSO)' 'all: $(LIBA)'
sed -i $'/^\t.*LIBSO/d' src/Makefile
'';
nativeBuildInputs = [ flex ];
makeFlags = [
@@ -37,18 +32,22 @@ stdenv.mkDerivation rec {
"MAN3DIR=$(man)/share/man/man3"
"MAN8DIR=$(man)/share/man/man8"
"SHLIBDIR=$(out)/lib"
]
++ lib.optionals stdenv.hostPlatform.isStatic [
"DISABLE_SHARED=y"
];
env.NIX_CFLAGS_COMPILE = "-Wno-error";
enableParallelBuilding = true;
passthru = { inherit se_url; };
passthru = { inherit (finalAttrs) se_url; };
meta = {
description = "SELinux binary policy manipulation library";
homepage = "http://userspace.selinuxproject.org";
platforms = lib.platforms.linux;
# Note: changing maintainers here changes maintainers for all SELinux-related libraries
maintainers = with lib.maintainers; [
RossComputerGuy
numinit
@@ -56,4 +55,4 @@ stdenv.mkDerivation rec {
license = lib.licenses.gpl2Plus;
pkgConfigModules = [ "libselinux" ];
};
}
})
pkgs/by-name/po/policycoreutils/package.nix
+10 -6
View File
@@ -7,16 +7,17 @@
libselinux,
libsemanage,
libxcrypt,
pkg-config,
}:
stdenv.mkDerivation rec {
stdenv.mkDerivation (finalAttrs: {
pname = "policycoreutils";
version = "3.8.1";
version = "3.10";
inherit (libsepol) se_url;
src = fetchurl {
url = "${se_url}/${version}/policycoreutils-${version}.tar.gz";
hash = "sha256-7vIxlrUB0UHLlfX8Uu8acon0WbZeRBXqD+mu7cXYDvI=";
url = "${finalAttrs.se_url}/${finalAttrs.version}/policycoreutils-${finalAttrs.version}.tar.gz";
hash = "sha256-jb1Q2Gisv66dGpcva7slh/BsnsczCNEa9qyzpAHemDI=";
};
postPatch = ''
@@ -26,7 +27,10 @@ stdenv.mkDerivation rec {
substituteInPlace newrole/Makefile --replace /usr/share /share
'';
nativeBuildInputs = [ gettext ];
nativeBuildInputs = [
gettext
pkg-config
];
buildInputs = [
libsepol
libselinux
@@ -48,4 +52,4 @@ stdenv.mkDerivation rec {
license = lib.licenses.gpl2Only;
inherit (libsepol.meta) homepage platforms maintainers;
};
}
})
pkgs/by-name/se/selinux-python/package.nix
+7 -6
View File
@@ -20,13 +20,13 @@ let
in
stdenv.mkDerivation (finalAttrs: {
pname = "selinux-python";
version = "3.8.1";
version = "3.10";
inherit (libsepol) se_url;
src = fetchurl {
url = "${finalAttrs.se_url}/${finalAttrs.version}/selinux-python-${finalAttrs.version}.tar.gz";
hash = "sha256-dJAlv6SqDgCb8//EVdVloY1Ntxz+eWvkQFghcXIGwlo=";
hash = "sha256-nQpbafL7zOjlzNjg8X1W9x5gBadWOG+Ps2wx+UJBkaI=";
};
strictDeps = true;
@@ -82,6 +82,8 @@ stdenv.mkDerivation (finalAttrs: {
doInstallCheck = true;
installCheckPhase = ''
runHook preInstallCheck
# Version hasn't changed in 17 years, if it suddenly does these tests deserve to break
$out/bin/audit2allow --version | grep -Fm1 'audit2allow .1'
$out/bin/audit2why --version | grep -Fm1 'audit2allow .1'
@@ -96,16 +98,15 @@ stdenv.mkDerivation (finalAttrs: {
# Should at least run, even if we can't provide it a policy file and need to provide /dev/zero
{ $out/bin/sepolgen-ifgen-attr-helper test /dev/null 2>&1 || true; } | grep -Fm1 'error(s) encountered' >/dev/null
runHook postInstallCheck
'';
meta = {
description = "SELinux policy core utilities written in Python";
license = lib.licenses.gpl2Plus;
homepage = "https://selinuxproject.org";
maintainers = with lib.maintainers; [
RossComputerGuy
numinit
];
inherit (libsepol.meta) maintainers;
platforms = lib.platforms.linux;
};
})
pkgs/by-name/se/selinux-refpolicy/package.nix
+3 -3
View File
@@ -13,13 +13,13 @@
}:
stdenv.mkDerivation (finalAttrs: {
pname = "selinux-refpolicy";
version = "2.20250213";
version = "2.20250923";
src = fetchFromGitHub {
owner = "SELinuxProject";
repo = "refpolicy";
tag = "RELEASE_${lib.versions.major finalAttrs.version}_${lib.versions.minor finalAttrs.version}";
hash = "sha256-VsQRqigGwSVJ52uqFj1L2xzQqbWwQ/YaFI5Rsn/HbP8=";
hash = "sha256-A7bC/44Swt1pe9qAubrOIVEJpsXeCkJUaftLHqq3EmM=";
};
nativeBuildInputs = [
@@ -56,7 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
description = "SELinux Reference Policy v2";
homepage = "http://userspace.selinuxproject.org";
platforms = lib.platforms.linux;
maintainers = with lib.maintainers; [ RossComputerGuy ];
inherit (semodule-utils.meta) maintainers;
license = lib.licenses.gpl2Only;
};
})
pkgs/by-name/se/selinux-sandbox/package.nix
+47 -27
View File
@@ -2,34 +2,37 @@
lib,
stdenv,
fetchurl,
gettext,
bash,
coreutils,
python3,
python3Packages,
libcap_ng,
policycoreutils,
selinux-python,
dbus,
xorg-server,
xwayland,
openbox,
xmodmap,
libselinux,
setools,
}:
# this is python3 only as it depends on selinux-python
with python3.pkgs;
stdenv.mkDerivation rec {
stdenv.mkDerivation (finalAttrs: {
pname = "selinux-sandbox";
version = "3.3";
version = "3.10";
inherit (policycoreutils) se_url;
src = fetchurl {
url = "${se_url}/${version}/selinux-sandbox-${version}.tar.gz";
sha256 = "0rw8pxfqhl6ww4w31fbf4hi3zilh1n3b1rfjm7ra76mm78wfyylj";
url = "${finalAttrs.se_url}/${finalAttrs.version}/selinux-sandbox-${finalAttrs.version}.tar.gz";
hash = "sha256-4r0T4YT3IYFVoz6pQygdAvRBwpcQQBW+69/G2Npv9cM=";
};
nativeBuildInputs = [ wrapPython ];
nativeBuildInputs = [
gettext
python3Packages.wrapPython
];
buildInputs = [
bash
coreutils
@@ -43,29 +46,36 @@ stdenv.mkDerivation rec {
libselinux
];
propagatedBuildInputs = [
pygobject3
python3Packages.pygobject3
selinux-python
];
pythonPath = [
python3Packages.libselinux
setools
];
postPatch = ''
# Fix setuid install
substituteInPlace Makefile --replace "-m 4755" "-m 755"
substituteInPlace Makefile --replace-fail "-m 4755" "-m 755"
substituteInPlace po/Makefile --replace-fail /usr/bin/install install
substituteInPlace sandboxX.sh \
--replace "#!/bin/sh" "#!${bash}/bin/sh" \
--replace "/usr/share/sandbox/start" "${placeholder "out"}/share/sandbox/start" \
--replace "/usr/bin/cut" "${coreutils}/bin/cut" \
--replace "/usr/bin/Xephyr" "${xorg-server}/bin/Xepyhr" \
--replace "secon" "${policycoreutils}/bin/secon"
--replace-fail "#!/bin/bash" "#!${bash}/bin/bash" \
--replace-fail "/usr/share/sandbox/start" "${placeholder "out"}/share/sandbox/start" \
--replace-fail "/usr/bin/cut" "${coreutils}/bin/cut" \
--replace-fail "/usr/bin/Xephyr" "${xorg-server}/bin/Xepyhr" \
--replace-fail "/usr/bin/Xwayland" "${xwayland}/bin/Xwayland" \
--replace-fail "secon" "${policycoreutils}/bin/secon"
substituteInPlace sandbox \
--replace "/usr/sbin/seunshare" "$out/bin/seunshare" \
--replace "/usr/share/sandbox" "$out/share/sandbox" \
--replace "/usr/share/locale" "${policycoreutils}/share/locale" \
--replace "/usr/bin/openbox" "${openbox}/bin/openbox" \
--replace "#!/bin/sh" "#!${bash}/bin/sh" \
--replace "dbus-" "${dbus}/bin/dbus-" \
--replace "/usr/bin/xmodmap" "${xmodmap}/bin/xmodmap" \
--replace "/usr/bin/shred" "${coreutils}/bin/shred" \
--replace "/usr/bin/test" "${coreutils}/bin/test" \
--replace-fail "/usr/sbin/seunshare" "$out/bin/seunshare" \
--replace-fail "/usr/share/sandbox" "$out/share/sandbox" \
--replace-fail "/usr/share/locale" "${policycoreutils}/share/locale" \
--replace-fail "/usr/bin/openbox" "${openbox}/bin/openbox" \
--replace-fail "#!/bin/sh" "#!${bash}/bin/sh" \
--replace-fail "dbus-" "${dbus}/bin/dbus-" \
--replace-fail "/usr/bin/xmodmap" "${xmodmap}/bin/xmodmap" \
--replace-fail "/usr/bin/shred" "${coreutils}/bin/shred" \
--replace-fail "/usr/bin/test" "${coreutils}/bin/test"
patchShebangs --host sandboxX.sh sandbox start sandbox.init
'';
makeFlags = [
@@ -77,11 +87,21 @@ stdenv.mkDerivation rec {
wrapPythonPrograms
'';
doInstallCheck = true;
installCheckPhase = ''
runHook preInstallCheck
# "sandbox: Requires a SELinux enabled system" or help, which includes sandbox
{ $out/bin/sandbox --help || true; } 2>&1 | grep -Fm1 'sandbox'
runHook postInstallCheck
'';
meta = {
mainProgram = "sandbox";
description = "SELinux sandbox utility";
license = lib.licenses.gpl2Only;
homepage = "https://selinuxproject.org";
platforms = lib.platforms.linux;
maintainers = with lib.maintainers; [ RossComputerGuy ];
inherit (selinux-python.meta) maintainers;
};
}
})
pkgs/by-name/se/semodule-utils/package.nix
+6 -7
View File
@@ -5,15 +5,15 @@
libsepol,
}:
stdenv.mkDerivation rec {
stdenv.mkDerivation (finalAttrs: {
pname = "semodule-utils";
version = "3.8.1";
version = "3.10";
inherit (libsepol) se_url;
src = fetchurl {
url = "${se_url}/${version}/semodule-utils-${version}.tar.gz";
sha256 = "sha256-dwWw2wWcU6IdanfAtQ9sRn2RoOqS/4dfHJNSfNJ2I5U=";
url = "${finalAttrs.se_url}/${finalAttrs.version}/semodule-utils-${finalAttrs.version}.tar.gz";
hash = "sha256-HC8UzAmMu011kS0THF90fnAkbhBC5y8qtA4o9Tz0XBA=";
};
buildInputs = [ libsepol ];
@@ -26,7 +26,6 @@ stdenv.mkDerivation rec {
meta = {
description = "SELinux policy core utilities (packaging additions)";
license = lib.licenses.gpl2Only;
inherit (libsepol.meta) homepage platforms;
maintainers = with lib.maintainers; [ RossComputerGuy ];
inherit (libsepol.meta) homepage platforms maintainers;
};
}
})
pkgs/by-name/se/setools/package.nix
+1 -1
View File
@@ -65,7 +65,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
gpl2Only
lgpl21Plus
];
maintainers = [ ];
inherit (libsepol.meta) maintainers;
platforms = lib.platforms.linux;
};
})
pkgs/os-specific/linux/selinux/default.nix
+14
View File
@@ -0,0 +1,14 @@
{
checkpolicy,
libselinux,
libsemanage,
libsepol,
policycoreutils,
selinux-python,
selinux-refpolicy,
selinux-sandbox,
semodule-utils,
setools,
}@packages:
packages
pkgs/top-level/all-packages.nix
+2
View File
@@ -12665,6 +12665,8 @@ with pkgs;
sane-frontends = callPackage ../applications/graphics/sane/frontends.nix { };
selinuxPackages = recurseIntoAttrs (callPackage ../os-specific/linux/selinux { });
snscrape = with python3Packages; toPythonApplication snscrape;
sourceAndTags = callPackage ../misc/source-and-tags {