I am unable to update OpenRC to anything higher than 0.43.5 in my SELinux hardened system. I tried remerging several packages including binutils, libselinux and openrc-selinux. It did not help at all Reproducible: Always Steps to Reproduce: 1. use a SELinux enabled system 2. merge openrc 0.44.7 or 0.44.8 3. observe Actual Results: build error Expected Results: It should build like 0.43.5 does emerge --info: Portage 3.0.28 (python 3.9.7-final-0, default/linux/x86/17.0/hardened/selinux, gcc-9.3.0, glibc-2.33-r7, 5.10.76-gentoo-r1-richGATE i686) ================================================================= System uname: Linux-5.10.76-gentoo-r1-richGATE-i686-AMD_G-T40E_Processor-with-glibc2.33 KiB Mem: 3614296 total, 1137176 free KiB Swap: 1570808 total, 993532 free Timestamp of repository gentoo: Fri, 19 Nov 2021 16:06:44 +0000 Head commit of repository gentoo: 4acecba0fb12b0e23a3cc8fea6050a1bc3db7f3d Head commit of repository chain: b76950b7cff3c6e73a3c91ebceb01815d191bcde sh bash 5.1_p8 ld GNU ld (Gentoo 2.37_p1 p0) 2.37 app-shells/bash: 5.1_p8::gentoo dev-lang/perl: 5.34.0-r3::gentoo dev-lang/python: 3.9.7_p1::gentoo dev-util/cmake: 3.20.5::gentoo sys-apps/baselayout: 2.7-r3::gentoo sys-apps/openrc: 0.43.5-r1::gentoo sys-apps/sandbox: 2.25::gentoo sys-devel/autoconf: 2.71-r1::gentoo sys-devel/automake: 1.16.4::gentoo sys-devel/binutils: 2.37_p1::gentoo sys-devel/gcc: 9.3.0-r2::gentoo sys-devel/gcc-config: 2.4::gentoo sys-devel/libtool: 2.4.6-r6::gentoo sys-devel/make: 4.3::gentoo sys-kernel/linux-headers: 5.10::gentoo (virtual/os-headers) sys-libs/glibc: 2.33-r7::gentoo Repositories: gentoo location: /var/db/repos/gentoo sync-type: git sync-uri: https://github.com/gentoo-mirror/gentoo.git priority: -1000 chain location: /var/db/repos/chain sync-type: git sync-uri: https://chain@git.rpgfiction.net/portage-overlay.git masters: gentoo ACCEPT_KEYWORDS="x86" ACCEPT_LICENSE="@FREE" CBUILD="i586-pc-linux-gnu" CFLAGS="-march=native -O2" CHOST="i586-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/share/gnupg/qualified.txt /var/bind" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/gconf /etc/gentoo-release /etc/php/apache2-php7.4/ext-active/ /etc/php/cgi-php7.4/ext-active/ /etc/php/cli-php7.4/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo" CXXFLAGS="-march=native -O2" DISTDIR="/var/cache/distfiles" EMERGE_DEFAULT_OPTS="--quiet-build=y" ENV_UNSET="CARGO_HOME DBUS_SESSION_BUS_ADDRESS DISPLAY GOBIN GOPATH PERL5LIB PERL5OPT PERLPREFIX PERL_CORE PERL_MB_OPT PERL_MM_OPT XAUTHORITY XDG_CACHE_HOME XDG_CONFIG_HOME XDG_DATA_HOME XDG_RUNTIME_DIR" FCFLAGS="-march=native -O2" FEATURES="assume-digests binpkg-docompress binpkg-dostrip binpkg-logs clean-logs config-protect-if-modified distlocks ebuild-locks fixlafiles ipc-sandbox merge-sync multilib-strict network-sandbox news nodoc noinfo noman parallel-fetch preserve-libs protect-owned qa-unresolved-soname-deps sandbox selinux sesandbox sfperms split-log strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr" FFLAGS="-march=native -O2" GENTOO_MIRRORS="http://distfiles.gentoo.org" LANG="C.UTF-8" LDFLAGS="-Wl,-O1 -Wl,--as-needed" LINGUAS="de" MAKEOPTS="-j2" PKGDIR="/var/cache/binpkgs" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --exclude=/.git" PORTAGE_TMPDIR="/tmp" USE="acl audit bzip2 caps crypt hardened iconv ipv6 libglvnd libtirpc minimal ncurses nptl pcre pic pie readline seccomp selinux split-usr ssl ssp unicode x86 xattr xtpax zlib" ABI_X86="32" ADA_TARGET="gnat_2019" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="karbon sheets words" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="mmx mmxext popcnt sse sse2 sse3 sse4a ssse3" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock greis isync itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf skytraq superstar2 timing tsip tripmate tnt ublox ubx" GRUB_PLATFORMS="pc" INPUT_DEVICES="libinput" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LUA_SINGLE_TARGET="lua5-1" LUA_TARGETS="lua5-1" NGINX_MODULES_HTTP="access addition auth_basic charset dav fancyindex fastcgi gzip limit_conn proxy rewrite upload_progress" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php7-3 php7-4" POSTGRES_TARGETS="postgres12 postgres13" PYTHON_SINGLE_TARGET="python3_9" PYTHON_TARGETS="python3_9" RUBY_TARGETS="ruby26 ruby27" USERLAND="GNU" VIDEO_CARDS="amdgpu fbdev intel nouveau radeon radeonsi vesa dummy v4l" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq proto steal rawnat logmark ipmark dhcpmac delude chaos account" Unset: CC, CPPFLAGS, CTARGET, CXX, INSTALL_MASK, LC_ALL, PORTAGE_BINHOST, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, RUSTFLAGS
Created attachment 753874 [details] build log
Thanks for filing this quickly from the other bug. The issue is that when PAM is disabled and we're building for SELinux, we need to use libcrypt functions, but we don't link against it.
(In reply to Sam James from comment #2) > Thanks for filing this quickly from the other bug. > > The issue is that when PAM is disabled and we're building for SELinux, we > need to use libcrypt functions, but we don't link against it. Thank you for the fast and clear response. Didn't even thing it might have been -pam related again. So I guess, another build system patch then? I will gladly try it out once someone can provide one
(In reply to Richard H. from comment #3) > (In reply to Sam James from comment #2) > > Thanks for filing this quickly from the other bug. > > > > The issue is that when PAM is disabled and we're building for SELinux, we > > need to use libcrypt functions, but we don't link against it. > > Thank you for the fast and clear response. Didn't even thing it might have > been -pam related again. So I guess, another build system patch then? > > I will gladly try it out once someone can provide one Yep! :)
Created attachment 753894 [details, diff] meson-pam-selinux.patch Can you try this patch? (It's actually two, the first one being the one from the other bug: bug 824954 as it's needed to follow the no-PAM path).
(In reply to Sam James from comment #5) > Created attachment 753894 [details, diff] [details, diff] > meson-pam-selinux.patch > > Can you try this patch? (It's actually two, the first one being the one from > the other bug: bug 824954 as it's needed to follow the no-PAM path). Thank you! It works like a charm. I just replaced my own patch from the other ticket with this and everything worked. I am sure it would patch 0.44.7 as well, but I can try that as well if you want.
(In reply to Richard H. from comment #6) > (In reply to Sam James from comment #5) > > Created attachment 753894 [details, diff] [details, diff] [details, diff] > > meson-pam-selinux.patch > > > > Can you try this patch? (It's actually two, the first one being the one from > > the other bug: bug 824954 as it's needed to follow the no-PAM path). > > Thank you! It works like a charm. I just replaced my own patch from the > other ticket with this and everything worked. I am sure it would patch > 0.44.7 as well, but I can try that as well if you want. Thank you for testing! I opened https://github.com/OpenRC/openrc/pull/477 with the two patches. I wouldn't worry about checking 0.44.7 (I think it should apply?) for now, will see what William wants to do in case he has any different ideas or anything first. Hopefully once this is all wrapped up, your experience will be a bit less exciting for a while ;)
The bug has been closed via the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f4fdf74bad1aa4db3522939aa70c2ed2e948cc22 commit f4fdf74bad1aa4db3522939aa70c2ed2e948cc22 Author: Sam James <sam@gentoo.org> AuthorDate: 2021-11-22 11:44:30 +0000 Commit: Sam James <sam@gentoo.org> CommitDate: 2021-11-22 11:44:46 +0000 sys-apps/openrc: backport SELinux + no PAM build fixes Closes: https://bugs.gentoo.org/825286 Closes: https://bugs.gentoo.org/824954 Signed-off-by: Sam James <sam@gentoo.org> .../files/openrc-0.44.8-selinux-no-pam.patch | 89 ++++++++++++++++++++++ sys-apps/openrc/openrc-0.44.8.ebuild | 5 ++ 2 files changed, 94 insertions(+)
