# ChangeLog for sys-apps/sysvinit
-# Copyright 2002-2004 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-apps/sysvinit/ChangeLog,v 1.15 2004/12/22 03:25:20 vapier Exp $
+# Copyright 2002-2005 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/sys-apps/sysvinit/ChangeLog,v 1.16 2005/01/04 02:03:14 pebenito Exp $
+
+ 03 Jan 2005; Chris PeBenito <pebenito@gentoo.org>
+ files/2.86-selinux.patch, -files/sysvinit-2.86-selinux.patch,
+ sysvinit-2.86.ebuild:
+ Fix up SELinux patch for 2.86.
*sysvinit-2.86 (21 Dec 2004)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
-MD5 0301c1434f0e57f5c56b1f9fdd6fb794 ChangeLog 2176
+MD5 2a298d8670fe3106367331b56dfcf2dc ChangeLog 2352
MD5 9a09f8d531c582e78977dbfd96edc1f2 metadata.xml 164
-MD5 df0ebe69cb98af99a40955a9a480e6a9 sysvinit-2.86.ebuild 1948
MD5 4bb35af95759582d45324cdf3bc237b7 sysvinit-2.85-r1.ebuild 2545
-MD5 64af9a15df244a29ebd5d09307f21a9b files/digest-sysvinit-2.86 64
-MD5 5f94105e0b503a39fda5fb65d885e16c files/2.86-gentoo.patch 641
-MD5 ee95909bb06edb0cb0ffcb6800ce3226 files/2.86-selinux.patch 5706
+MD5 f960b4dabb15c83bc898c55b535a0154 sysvinit-2.86.ebuild 1968
+MD5 38c0059ecfaa1b09e59a75cc2780aa94 files/digest-sysvinit-2.85-r1 64
MD5 eb3296226618c9805517b4fca35c242e files/inittab 1672
-MD5 3c171d9c843284ce606663e4e6da26e9 files/sysvinit-2.86-selinux.patch 6448
MD5 3c171d9c843284ce606663e4e6da26e9 files/sysvinit-2.85-selinux.patch 6448
-MD5 38c0059ecfaa1b09e59a75cc2780aa94 files/digest-sysvinit-2.85-r1 64
+MD5 5f94105e0b503a39fda5fb65d885e16c files/2.86-gentoo.patch 641
+MD5 3ba9251f1f4f0ae0dd30d682b28183dd files/2.86-selinux.patch 6525
+MD5 64af9a15df244a29ebd5d09307f21a9b files/digest-sysvinit-2.86 64
-----BEGIN PGP SIGNATURE-----
-Version: GnuPG v1.9.10 (GNU/Linux)
+Version: GnuPG v1.2.6 (GNU/Linux)
-iD8DBQFB1x91roRuSHgZdywRAkGTAJ0bZSGgG234okuA+NwrN68jg9YLIwCaAwqW
-3I8ZIPZZVjWVn+NmjvmN/s8=
-=tKRf
+iD8DBQFB2fkiMTuwkQ6eEKsRAnFqAJ90PqllAmSf7z2SLq6F7Z/VKESFCQCggU6Y
+NLYU838/Te+G863vig/R5lg=
+=9zFj
-----END PGP SIGNATURE-----
---- sysvinit-2.85/src/Makefile.selinux 2004-06-09 15:28:47.439412648 -0400
-+++ sysvinit-2.85/src/Makefile 2004-06-09 15:28:47.517400792 -0400
-@@ -12,2 +12,4 @@
+diff -urN sysvinit-2.86.orig/src/Makefile sysvinit-2.86/src/Makefile
+--- sysvinit-2.86.orig/src/Makefile 2004-06-09 08:47:45.000000000 -0400
++++ sysvinit-2.86/src/Makefile 2005-01-03 20:25:59.922659928 -0500
+@@ -12,6 +12,8 @@
+ CFLAGS = -Wall -O2 -fomit-frame-pointer -D_GNU_SOURCE
+ LDFLAGS = -s
STATIC =
+CFLAGS += -DWITH_SELINUX
-+LDFLAGS += -lselinux
++LDFLAGS += -lselinux -lsepol
---- sysvinit-2.85/src/init.c.selinux 2004-06-09 15:28:47.478406720 -0400
-+++ sysvinit-2.85/src/init.c 2004-06-09 15:29:03.208015456 -0400
-@@ -48,6 +48,10 @@
+ # For some known distributions we do not build all programs, otherwise we do.
+ BIN =
+diff -urN sysvinit-2.86.orig/src/init.c sysvinit-2.86/src/init.c
+--- sysvinit-2.86.orig/src/init.c 2004-07-30 08:16:20.000000000 -0400
++++ sysvinit-2.86/src/init.c 2005-01-03 20:46:39.485217776 -0500
+@@ -42,6 +42,11 @@
#include <stdarg.h>
#include <sys/syslog.h>
#include <sys/time.h>
+#include <sys/mman.h>
+#include <selinux/selinux.h>
++#include <sepol/sepol.h>
+#include <sys/mount.h>
+
#ifdef __i386__
# if (__GLIBC__ >= 2)
-@@ -103,6 +107,7 @@
+@@ -104,6 +109,7 @@
int dfl_level = 0; /* Default runlevel */
sig_atomic_t got_cont = 0; /* Set if we received the SIGCONT signal */
sig_atomic_t got_signals; /* Set if we received a signal. */
int emerg_shell = 0; /* Start emergency shell? */
int wrote_wtmp_reboot = 1; /* Set when we wrote the reboot record */
int wrote_utmp_reboot = 1; /* Set when we wrote the reboot record */
-@@ -187,6 +192,130 @@
- {NULL,0}
- };
+@@ -192,6 +198,142 @@
+ char *extra_env[NR_EXTRA_ENV];
+
+/* Mount point for selinuxfs. */
+#define SELINUXMNT "/selinux/"
+static int load_policy(int *enforce)
+{
+ int fd=-1,ret=-1;
-+ int rc=0;
++ int rc=0, orig_enforce;
+ struct stat sb;
+ void *map;
+ char policy_file[PATH_MAX];
+ int policy_version=0;
-+ extern char *selinux_mnt;
+ FILE *cfg;
+ char buf[4096];
+ int seconfig = -2;
+
+ if (mount("none", SELINUXMNT, "selinuxfs", 0, 0) < 0) {
+ if (errno == ENODEV) {
-+ log(L_VB, "SELinux not supported by kernel: %s\n",SELINUXMNT,strerror(errno));
++ initlog(L_VB, "SELinux not supported by kernel: %s\n",SELINUXMNT,strerror(errno));
+ *enforce = 0;
+ } else {
-+ log(L_VB, "Failed to mount %s: %s\n",SELINUXMNT,strerror(errno));
++ initlog(L_VB, "Failed to mount %s: %s\n",SELINUXMNT,strerror(errno));
+ }
+ return ret;
+ }
+
-+ selinux_mnt = SELINUXMNT; /* set manually since we mounted it */
++ set_selinuxmnt(SELINUXMNT); /* set manually since we mounted it */
+
+ policy_version=security_policyvers();
+ if (policy_version < 0) {
-+ log(L_VB, "Can't get policy version: %s\n", strerror(errno));
++ initlog(L_VB, "Can't get policy version: %s\n", strerror(errno));
+ goto UMOUNT;
+ }
+
-+ rc = security_getenforce();
++ orig_enforce = rc = security_getenforce();
+ if (rc < 0) {
-+ log(L_VB, "Can't get SELinux enforcement flag: %s\n", strerror(errno));
++ initlog(L_VB, "Can't get SELinux enforcement flag: %s\n", strerror(errno));
+ goto UMOUNT;
+ }
+ if (enforcing >= 0) {
+ if (rc < 0) {
+ rc = security_setenforce(0);
+ if (rc < 0) {
-+ log(L_VB, "Can't disable SELinux: %s\n", strerror(errno));
++ initlog(L_VB, "Can't disable SELinux: %s\n", strerror(errno));
+ goto UMOUNT;
+ }
+ }
+ goto UMOUNT;
+ } else if (seconfig >= 0) {
+ *enforce = seconfig;
-+ rc = security_setenforce(seconfig);
-+ if (rc < 0) {
-+ log(L_VB, "Can't set SELinux enforcement flag: %s\n", strerror(errno));
-+ goto UMOUNT;
++ if (orig_enforce != *enforce) {
++ rc = security_setenforce(seconfig);
++ if (rc < 0) {
++ initlog(L_VB, "Can't set SELinux enforcement flag: %s\n", strerror(errno));
++ goto UMOUNT;
++ }
+ }
+ }
+
+ snprintf(policy_file,sizeof(policy_file),"%s.%d",selinux_binary_policy_path(),policy_version-1);
+ fd = open(policy_file, O_RDONLY);
+ if (fd < 0) {
-+ log(L_VB, "Can't open '%s.%d': %s\n",
++ initlog(L_VB, "Can't open '%s.%d': %s\n",
+ selinux_binary_policy_path(),policy_version,strerror(errno));
+ goto UMOUNT;
+ }
+ }
+
+ if (fstat(fd, &sb) < 0) {
-+ log(L_VB, "Can't stat '%s': %s\n",
++ initlog(L_VB, "Can't stat '%s': %s\n",
+ policy_file, strerror(errno));
+ goto UMOUNT;
+ }
+
-+ map = mmap(NULL, sb.st_size, PROT_READ, MAP_SHARED, fd, 0);
++ map = mmap(NULL, sb.st_size, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
+ if (map == MAP_FAILED) {
-+ log(L_VB, "Can't map '%s': %s\n",
++ initlog(L_VB, "Can't map '%s': %s\n",
+ policy_file, strerror(errno));
+ goto UMOUNT;
+ }
-+ log(L_VB, "Loading security policy\n");
++
++
++ /* Set booleans based on a booleans configuration file. */
++ ret = sepol_genbools(map, sb.st_size, selinux_booleans_path());
++ if (ret < 0) {
++ if (errno != ENOENT && errno != EINVAL) {
++ initlog(L_VB,"Error while setting booleans: %s\n",
++ strerror(errno));
++ goto UMOUNT;
++ }
++ }
++ initlog(L_VB, "Loading security policy\n");
+ ret=security_load_policy(map, sb.st_size);
+ if (ret < 0) {
-+ log(L_VB, "security_load_policy failed\n");
++ initlog(L_VB, "security_load_policy failed\n");
+ }
+
+UMOUNT:
/*
* Sleep a number of seconds.
*
-@@ -2513,6 +2642,7 @@
+@@ -2599,6 +2741,7 @@
char *p;
int f;
int isinit;
/* Get my own name */
if ((p = strrchr(argv[0], '/')) != NULL)
-@@ -2576,6 +2706,20 @@
+@@ -2662,6 +2805,20 @@
maxproclen += strlen(argv[f]) + 1;
}
+ if (enforce > 0) {
+ /* SELinux in enforcing mode but load_policy failed */
+ /* At this point, we probably can't open /dev/console, so log() won't work */
-+ printf("Enforcing mode requested but no policy loaded. Halting now.\n");
++ fprintf(stderr,"Enforcing mode requested but no policy loaded. Halting now.\n");
+ exit(1);
+ }
+ }
/* Start booting. */
argv0 = argv[0];
argv[1] = NULL;
---- sysvinit-2.85/src/sulogin.c.selinux 2004-06-09 15:28:47.321430584 -0400
-+++ sysvinit-2.85/src/sulogin.c 2004-06-09 15:28:47.523399880 -0400
-@@ -28,7 +28,10 @@
+diff -urN sysvinit-2.86.orig/src/sulogin.c sysvinit-2.86/src/sulogin.c
+--- sysvinit-2.86.orig/src/sulogin.c 2004-07-30 07:40:28.000000000 -0400
++++ sysvinit-2.86/src/sulogin.c 2005-01-03 20:30:48.746751992 -0500
+@@ -27,7 +27,10 @@
#if defined(__GLIBC__)
# include <crypt.h>
#endif
#define CHECK_DES 1
#define CHECK_MD5 1
-@@ -332,6 +335,16 @@
+@@ -335,6 +338,16 @@
signal(SIGINT, SIG_DFL);
signal(SIGTSTP, SIG_DFL);
signal(SIGQUIT, SIG_DFL);
+++ /dev/null
---- sysvinit-2.85/src/Makefile.selinux 2004-06-09 15:28:47.439412648 -0400
-+++ sysvinit-2.85/src/Makefile 2004-06-09 15:28:47.517400792 -0400
-@@ -35,7 +35,7 @@
- all: $(PROGS)
-
- init: init.o init_utmp.o
-- $(CC) $(LDFLAGS) $(STATIC) -o $@ init.o init_utmp.o
-+ $(CC) $(LDFLAGS) $(STATIC) -o $@ init.o init_utmp.o -lselinux
-
- halt: halt.o ifdown.o hddown.o utmp.o reboot.h
- $(CC) $(LDFLAGS) -o $@ halt.o ifdown.o hddown.o utmp.o
-@@ -53,7 +53,7 @@
- $(CC) $(LDFLAGS) -o $@ runlevel.o
-
- sulogin: sulogin.o
-- $(CC) $(LDFLAGS) $(STATIC) -o $@ sulogin.o $(LCRYPT)
-+ $(CC) $(LDFLAGS) $(STATIC) -DWITH_SELINUX -o $@ sulogin.o $(LCRYPT) -lselinux
-
- wall: dowall.o wall.o
- $(CC) $(LDFLAGS) -o $@ dowall.o wall.o
-@@ -64,7 +64,7 @@
- bootlogd: bootlogd.o
- $(CC) $(LDFLAGS) -o $@ bootlogd.o
-
- init.o: init.c init.h set.h reboot.h
-- $(CC) -c $(CFLAGS) init.c
-+ $(CC) -c $(CFLAGS) -DWITH_SELINUX init.c
-
- utmp.o: utmp.c init.h
- $(CC) -c $(CFLAGS) utmp.c
---- sysvinit-2.85/src/init.c.selinux 2004-06-09 15:28:47.478406720 -0400
-+++ sysvinit-2.85/src/init.c 2004-06-09 15:29:03.208015456 -0400
-@@ -48,6 +48,10 @@
- #include <stdarg.h>
- #include <sys/syslog.h>
- #include <sys/time.h>
-+#include <sys/mman.h>
-+#include <selinux/selinux.h>
-+#include <sys/mount.h>
-+
-
- #ifdef __i386__
- # if (__GLIBC__ >= 2)
-@@ -103,6 +107,7 @@
- int dfl_level = 0; /* Default runlevel */
- sig_atomic_t got_cont = 0; /* Set if we received the SIGCONT signal */
- sig_atomic_t got_signals; /* Set if we received a signal. */
-+int enforcing = -1; /* SELinux enforcing mode */
- int emerg_shell = 0; /* Start emergency shell? */
- int wrote_wtmp_reboot = 1; /* Set when we wrote the reboot record */
- int wrote_utmp_reboot = 1; /* Set when we wrote the reboot record */
-@@ -187,6 +192,130 @@
- {NULL,0}
- };
-
-+/* Mount point for selinuxfs. */
-+#define SELINUXMNT "/selinux/"
-+
-+static int load_policy(int *enforce)
-+{
-+ int fd=-1,ret=-1;
-+ int rc=0;
-+ struct stat sb;
-+ void *map;
-+ char policy_file[PATH_MAX];
-+ int policy_version=0;
-+ extern char *selinux_mnt;
-+ FILE *cfg;
-+ char buf[4096];
-+ int seconfig = -2;
-+
-+ selinux_getenforcemode(&seconfig);
-+
-+ mount("none", "/proc", "proc", 0, 0);
-+ cfg = fopen("/proc/cmdline","r");
-+ if (cfg) {
-+ char *tmp;
-+ if (fgets(buf,4096,cfg) && (tmp = strstr(buf,"enforcing="))) {
-+ if (tmp == buf || isspace(*(tmp-1))) {
-+ enforcing=atoi(tmp+10);
-+ }
-+ }
-+ fclose(cfg);
-+ }
-+#define MNT_DETACH 2
-+ umount2("/proc",MNT_DETACH);
-+
-+ if (enforcing >=0)
-+ *enforce = enforcing;
-+ else if (seconfig == 1)
-+ *enforce = 1;
-+
-+ if (mount("none", SELINUXMNT, "selinuxfs", 0, 0) < 0) {
-+ if (errno == ENODEV) {
-+ log(L_VB, "SELinux not supported by kernel: %s\n",SELINUXMNT,strerror(errno));
-+ *enforce = 0;
-+ } else {
-+ log(L_VB, "Failed to mount %s: %s\n",SELINUXMNT,strerror(errno));
-+ }
-+ return ret;
-+ }
-+
-+ selinux_mnt = SELINUXMNT; /* set manually since we mounted it */
-+
-+ policy_version=security_policyvers();
-+ if (policy_version < 0) {
-+ log(L_VB, "Can't get policy version: %s\n", strerror(errno));
-+ goto UMOUNT;
-+ }
-+
-+ rc = security_getenforce();
-+ if (rc < 0) {
-+ log(L_VB, "Can't get SELinux enforcement flag: %s\n", strerror(errno));
-+ goto UMOUNT;
-+ }
-+ if (enforcing >= 0) {
-+ *enforce = enforcing;
-+ } else if (seconfig == -1) {
-+ *enforce = 0;
-+ rc = security_disable();
-+ if (rc == 0) umount(SELINUXMNT);
-+ if (rc < 0) {
-+ rc = security_setenforce(0);
-+ if (rc < 0) {
-+ log(L_VB, "Can't disable SELinux: %s\n", strerror(errno));
-+ goto UMOUNT;
-+ }
-+ }
-+ ret = 0;
-+ goto UMOUNT;
-+ } else if (seconfig >= 0) {
-+ *enforce = seconfig;
-+ rc = security_setenforce(seconfig);
-+ if (rc < 0) {
-+ log(L_VB, "Can't set SELinux enforcement flag: %s\n", strerror(errno));
-+ goto UMOUNT;
-+ }
-+ }
-+
-+ snprintf(policy_file,sizeof(policy_file),"%s.%d",selinux_binary_policy_path(),policy_version);
-+ fd = open(policy_file, O_RDONLY);
-+ if (fd < 0) {
-+ /* Check previous version to see if old policy is available
-+ */
-+ snprintf(policy_file,sizeof(policy_file),"%s.%d",selinux_binary_policy_path(),policy_version-1);
-+ fd = open(policy_file, O_RDONLY);
-+ if (fd < 0) {
-+ log(L_VB, "Can't open '%s.%d': %s\n",
-+ selinux_binary_policy_path(),policy_version,strerror(errno));
-+ goto UMOUNT;
-+ }
-+ }
-+
-+ if (fstat(fd, &sb) < 0) {
-+ log(L_VB, "Can't stat '%s': %s\n",
-+ policy_file, strerror(errno));
-+ goto UMOUNT;
-+ }
-+
-+ map = mmap(NULL, sb.st_size, PROT_READ, MAP_SHARED, fd, 0);
-+ if (map == MAP_FAILED) {
-+ log(L_VB, "Can't map '%s': %s\n",
-+ policy_file, strerror(errno));
-+ goto UMOUNT;
-+ }
-+ log(L_VB, "Loading security policy\n");
-+ ret=security_load_policy(map, sb.st_size);
-+ if (ret < 0) {
-+ log(L_VB, "security_load_policy failed\n");
-+ }
-+
-+UMOUNT:
-+ /*umount(SELINUXMNT); */
-+ if ( fd >= 0) {
-+ close(fd);
-+ }
-+ return(ret);
-+}
-+
- /*
- * Sleep a number of seconds.
- *
-@@ -2513,6 +2642,7 @@
- char *p;
- int f;
- int isinit;
-+ int enforce = 0;
-
- /* Get my own name */
- if ((p = strrchr(argv[0], '/')) != NULL)
-@@ -2576,6 +2706,20 @@
- maxproclen += strlen(argv[f]) + 1;
- }
-
-+ if (getenv("SELINUX_INIT") == NULL) {
-+ putenv("SELINUX_INIT=YES");
-+ if (load_policy(&enforce) == 0 ) {
-+ execv(myname, argv);
-+ } else {
-+ if (enforce > 0) {
-+ /* SELinux in enforcing mode but load_policy failed */
-+ /* At this point, we probably can't open /dev/console, so log() won't work */
-+ printf("Enforcing mode requested but no policy loaded. Halting now.\n");
-+ exit(1);
-+ }
-+ }
-+ }
-+
- /* Start booting. */
- argv0 = argv[0];
- argv[1] = NULL;
---- sysvinit-2.85/src/sulogin.c.selinux 2004-06-09 15:28:47.321430584 -0400
-+++ sysvinit-2.85/src/sulogin.c 2004-06-09 15:28:47.523399880 -0400
-@@ -28,7 +28,10 @@
- #if defined(__GLIBC__)
- # include <crypt.h>
- #endif
--
-+#ifdef WITH_SELINUX
-+#include <selinux/selinux.h>
-+#include <selinux/get_context_list.h>
-+#endif
- #define CHECK_DES 1
- #define CHECK_MD5 1
-
-@@ -332,6 +335,16 @@
- signal(SIGINT, SIG_DFL);
- signal(SIGTSTP, SIG_DFL);
- signal(SIGQUIT, SIG_DFL);
-+#ifdef WITH_SELINUX
-+ if (is_selinux_enabled > 0) {
-+ security_context_t* contextlist=NULL;
-+ if (get_ordered_context_list("root", 0, &contextlist) > 0) {
-+ if (setexeccon(contextlist[0]) != 0)
-+ fprintf(stderr, "setexeccon faile\n");
-+ freeconary(contextlist);
-+ }
-+ }
-+#endif
- execl(sushell, shell, NULL);
- perror(sushell);
-
# Copyright 1999-2005 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-apps/sysvinit/sysvinit-2.86.ebuild,v 1.2 2005/01/01 22:08:41 vapier Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-apps/sysvinit/sysvinit-2.86.ebuild,v 1.3 2005/01/04 02:03:14 pebenito Exp $
inherit eutils toolchain-funcs
KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86"
IUSE="selinux bootstrap build"
-RDEPEND="selinux? ( >=sys-libs/libselinux-1.14 )"
+RDEPEND="selinux? ( >=sys-libs/libselinux-1.14 sys-libs/libsepol )"
DEPEND="${RDEPEND}
virtual/os-headers"
projects / gentoo.git / commitdiff