[Buildroot] [PATCH 1/1] package/openssh: select linux-pam if refpolicy upstream is selected
Peter Korsgaard
peter at korsgaard.com
Thu Nov 9 11:10:19 UTC 2023
>>>>> "Adam" == Adam Duskett <adam.duskett at amarulasolutions.com> writes:
> linux-pam is required to login via OpenSSH if the upstream refpolicy for
> SELinux is enaabled, as linux-pam handles changing user contexts. If a
> user wants to make their own policy and use a refpolicy via git, we of course
> should let them do so. As such, only select linux-pam if the upstream version
> of refpolicy is selected.
> Signed-off-by: Adam Duskett <adam.duskett at amarulasolutions.com>
> ---
> package/openssh/Config.in | 1 +
> 1 file changed, 1 insertion(+)
> diff --git a/package/openssh/Config.in b/package/openssh/Config.in
> index 08d3c7d391..e7d8f46c07 100644
> --- a/package/openssh/Config.in
> +++ b/package/openssh/Config.in
> @@ -3,6 +3,7 @@ config BR2_PACKAGE_OPENSSH
> depends on BR2_USE_MMU # fork()
> select BR2_PACKAGE_OPENSSL
> select BR2_PACKAGE_ZLIB
> + select BR2_PACKAGE_LINUX_PAM if BR2_PACKAGE_REFPOLICY_UPSTREAM_VERSION
Hmm, we cannot do that without taking the dependencies on linux-pam into
consideration:
config BR2_PACKAGE_OPENSSH
bool "openssh"
depends on BR2_USE_MMU # fork()
..
config BR2_PACKAGE_REFPOLICY
bool "refpolicy"
depends on BR2_TOOLCHAIN_HAS_THREADS # libsepol
depends on BR2_TOOLCHAIN_GCC_AT_LEAST_5 # libsepol
depends on BR2_HOST_GCC_AT_LEAST_5 # host-setools -> host-libsepol
..
config BR2_PACKAGE_LINUX_PAM
bool "linux-pam"
depends on BR2_ENABLE_LOCALE
depends on BR2_USE_WCHAR
depends on !BR2_STATIC_LIBS
depends on BR2_USE_MMU # fork()
depends on BR2_TOOLCHAIN_GCC_AT_LEAST_4_9 # C11/stdatomic.h
So there is no guarantee that locale, wchar and !static are
available. You either need to propagate these dependencies to openssh if
the standard refpolicy is used or only select if they are / display a
warning otherwise.
--
Bye, Peter Korsgaard
More information about the buildroot
mailing list