Merge lp:~jpds/upstart/selinux-support into lp:upstart

[Jonathan Davies]

Adds SELinux support to Upstart using the patch that exists in Debian.

[lp:~jpds/upstart/selinux-support]

1548. By Jonathan Davies on 2013-11-02

Incorporated SELinux support patch from Russell Coker from bug #595774.

1549. By Jonathan Davies on 2013-11-02

configure.ac: Added --enable-selinux option.

1550. By Jonathan Davies on 2013-11-02

init/Makefile.am: Added SELinux flags and libraries for init binary.

[Dimitri John Ledkov (xnox)]

These patches are also in the Ubuntu Upstart package.

Checking https://launchpad.net/~contributor-agreement-canonical/+members it doesn't look like Russell has completed CLA at http://www.canonical.com/contributors yet. Has this been completed now by him?

[Jonathan Davies (jpds)]

> These patches are also in the Ubuntu Upstart package.

Then, we really should be building the package with --enable-selinux (as we do for ls and everything else)...

> Checking https://launchpad.net/~contributor-agreement-canonical/+members it doesn't
> look like Russell has completed CLA at http://www.canonical.com/contributors yet.
> Has this been completed now by him?

The patch is from 2009 and included in Debian and Ubuntu as is. I say we just commit this into trunk and move on.

[Steve Langasek (vorlon)]

> The patch is from 2009 and included in Debian and Ubuntu as is. I say we just
> commit this into trunk and move on.

Not how it works. The CLA policy doesn't cease to apply just because a patch is old.

review: Disapprove

Unmerged revisions

1550. By Jonathan Davies on 2013-11-02

init/Makefile.am: Added SELinux flags and libraries for init binary.

1549. By Jonathan Davies on 2013-11-02

configure.ac: Added --enable-selinux option.

1548. By Jonathan Davies on 2013-11-02

Incorporated SELinux support patch from Russell Coker from bug #595774.

=== modified file 'configure.ac'
--- configure.ac	2013-09-12 23:44:17 +0000
+++ configure.ac	2013-11-02 16:26:24 +0000
@@ -34,6 +34,15 @@
 PKG_CHECK_MODULES([UDEV], [libudev >= 146], [have_udev=yes], [have_udev=no])
 PKG_CHECK_MODULES([DCONF], [dconf >= 0.14], [have_dconf=yes], [have_dconf=no])
 
+AC_ARG_ENABLE(selinux,
+	AS_HELP_STRING([--enable-selinux], [enable SELinux support]),
+	[], [enable_selinux=no])
+
+if test "x$enable_selinux" = "xyes" ; then
+	PKG_CHECK_MODULES(SELINUX, [libselinux])
+	AC_DEFINE(HAVE_SELINUX, 1, [Define if we have SELinux])
+fi
+
 AC_ARG_ENABLE([udev-bridge],
 	AS_HELP_STRING([--disable-udev-bridge],
 		[Disable building of upstart-udev-bridge even if required dependencies available]),
 
=== modified file 'init/Makefile.am'
--- init/Makefile.am	2013-08-23 09:22:32 +0000
+++ init/Makefile.am	2013-11-02 16:26:24 +0000
@@ -8,7 +8,8 @@
 	$(NIH_CFLAGS) \
 	$(NIH_DBUS_CFLAGS) \
 	$(DBUS_CFLAGS) \
-	$(JSON_CFLAGS)
+	$(JSON_CFLAGS) \
+	$(SELINUX_CFLAGS)
 
 AM_CPPFLAGS = \
 	-DLOCALEDIR="\"$(localedir)\"" \
@@ -71,6 +72,7 @@
 	$(NIH_DBUS_LIBS) \
 	$(DBUS_LIBS) \
 	$(JSON_LIBS) \
+	$(SELINUX_LIBS) \
 	-lrt
 
 
 
=== modified file 'init/main.c'
--- init/main.c	2013-07-31 09:28:48 +0000
+++ init/main.c	2013-11-02 16:26:24 +0000
@@ -46,6 +46,10 @@
 #include <syslog.h>
 #include <unistd.h>
 
+#ifdef HAVE_SELINUX
+#include <selinux/selinux.h>
+#endif
+
 #include <linux/kd.h>
 
 #include <nih/macros.h>
@@ -190,6 +194,25 @@
 {
 	char **args = NULL;
 	int    ret;
+	int    enforce = 0;
+
+#ifdef HAVE_SELINUX
+	if (getenv ("SELINUX_INIT") == NULL) {
+		putenv ("SELINUX_INIT=YES");
+		if (selinux_init_load_policy (&enforce) == 0 ) {
+			execv (argv[0], argv);
+		} else {
+			if (enforce > 0) {
+				/* SELinux in enforcing mode but load_policy
+				 * failed. At this point, we probably can't
+				 * open /dev/console, so log() won't work.
+				 */
+				fprintf (stderr, "Unable to load SELinux Policy. Machine is in enforcing mode. Halting now.\n");
+				exit (1);
+			}
+		}
+	}
+#endif /* HAVE_SELINUX */
 
 	conf_dirs = NIH_MUST (nih_str_array_new (NULL));