| Message ID | 20231009143440.1776155-1-adam.duskett@amarulasolutions.com |
|---|---|
| State | Accepted |
| Headers | show |
| Series | [1/1] package/openssh: select linux-pam if refpolicy upstream is selected | expand |
On Mon, 9 Oct 2023 16:34:40 +0200 Adam Duskett <adam.duskett@amarulasolutions.com> wrote: > linux-pam is required to login via OpenSSH if the upstream refpolicy for > SELinux is enaabled, as linux-pam handles changing user contexts. If a > user wants to make their own policy and use a refpolicy via git, we of course > should let them do so. As such, only select linux-pam if the upstream version > of refpolicy is selected. > > Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com> > --- > package/openssh/Config.in | 1 + > 1 file changed, 1 insertion(+) Applied to master, thanks. Thomas
>>>>> "Adam" == Adam Duskett <adam.duskett@amarulasolutions.com> writes: > linux-pam is required to login via OpenSSH if the upstream refpolicy for > SELinux is enaabled, as linux-pam handles changing user contexts. If a > user wants to make their own policy and use a refpolicy via git, we of course > should let them do so. As such, only select linux-pam if the upstream version > of refpolicy is selected. > Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com> > --- > package/openssh/Config.in | 1 + > 1 file changed, 1 insertion(+) > diff --git a/package/openssh/Config.in b/package/openssh/Config.in > index 08d3c7d391..e7d8f46c07 100644 > --- a/package/openssh/Config.in > +++ b/package/openssh/Config.in > @@ -3,6 +3,7 @@ config BR2_PACKAGE_OPENSSH > depends on BR2_USE_MMU # fork() > select BR2_PACKAGE_OPENSSL > select BR2_PACKAGE_ZLIB > + select BR2_PACKAGE_LINUX_PAM if BR2_PACKAGE_REFPOLICY_UPSTREAM_VERSION Hmm, we cannot do that without taking the dependencies on linux-pam into consideration: config BR2_PACKAGE_OPENSSH bool "openssh" depends on BR2_USE_MMU # fork() .. config BR2_PACKAGE_REFPOLICY bool "refpolicy" depends on BR2_TOOLCHAIN_HAS_THREADS # libsepol depends on BR2_TOOLCHAIN_GCC_AT_LEAST_5 # libsepol depends on BR2_HOST_GCC_AT_LEAST_5 # host-setools -> host-libsepol .. config BR2_PACKAGE_LINUX_PAM bool "linux-pam" depends on BR2_ENABLE_LOCALE depends on BR2_USE_WCHAR depends on !BR2_STATIC_LIBS depends on BR2_USE_MMU # fork() depends on BR2_TOOLCHAIN_GCC_AT_LEAST_4_9 # C11/stdatomic.h So there is no guarantee that locale, wchar and !static are available. You either need to propagate these dependencies to openssh if the standard refpolicy is used or only select if they are / display a warning otherwise.
On Thu, 09 Nov 2023 12:10:19 +0100 Peter Korsgaard <peter@korsgaard.com> wrote: > > + select BR2_PACKAGE_LINUX_PAM if BR2_PACKAGE_REFPOLICY_UPSTREAM_VERSION > > Hmm, we cannot do that without taking the dependencies on linux-pam into > consideration: Dang, I totally missed that indeed :-/ Thomas
diff --git a/package/openssh/Config.in b/package/openssh/Config.in index 08d3c7d391..e7d8f46c07 100644 --- a/package/openssh/Config.in +++ b/package/openssh/Config.in @@ -3,6 +3,7 @@ config BR2_PACKAGE_OPENSSH depends on BR2_USE_MMU # fork() select BR2_PACKAGE_OPENSSL select BR2_PACKAGE_ZLIB + select BR2_PACKAGE_LINUX_PAM if BR2_PACKAGE_REFPOLICY_UPSTREAM_VERSION help A free version of the SSH protocol suite of network connectivity tools. The standard 'ssh', 'sshd', 'scp', and
linux-pam is required to login via OpenSSH if the upstream refpolicy for SELinux is enaabled, as linux-pam handles changing user contexts. If a user wants to make their own policy and use a refpolicy via git, we of course should let them do so. As such, only select linux-pam if the upstream version of refpolicy is selected. Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com> --- package/openssh/Config.in | 1 + 1 file changed, 1 insertion(+)