summaryrefslogtreecommitdiff
path: root/configure
diff options
context:
space:
mode:
authorCarlos O'Donell <carlos@redhat.com>2014-04-10 18:31:53 -0400
committerCarlos O'Donell <carlos@redhat.com>2014-04-14 04:10:39 -0400
commit0699f766b10c86912b75f35bef697106b70c1cf6 (patch)
treea5dc479f70809dba741a4cc60dc9d0a660885659 /configure
parent809bd45fa91992dd96aeb4dc4a58d471f9e0996c (diff)
downloadglibc-0699f766b10c86912b75f35bef697106b70c1cf6.tar.gz
nscd: Make SELinux checks dynamic.
The SELinux team has indicated to me that glibc's SELinux checks in nscd are not being carried out as they would expect the API to be used today. They would like to move away from static header defines for class and permissions and instead use dynamic checks at runtime that provide an answer which is dependent on the runtime status of SELinux i.e. more dynamic. The following patch is a minimal change that moves us forward in this direction. It does the following: * Stop checking for SELinux headers that define NSCD__SHMEMHOST. Check only for the presence or absence of the library. * Don't encode the specific SELinux permission constants into a table at build time, and instead use the symbolic name for the permission as expected. * Lookup the "What do we do if we don't know this permission?" policy and use that if we find SELinux's policy is older than the glibc policy e.g. we make a request for a permission that SELinux doesn't know about. * Lastly, translate the class and permission and then make the permission check. This is done every time we lookup a permission, and this is the expected way to use the API. SELinux will optimize this for us, and we expect the network latencies to hide these extra library calls. Tested on x86, x86-64, and via Fedora Rawhide since November 2013. See: https://sourceware.org/ml/libc-alpha/2014-04/msg00179.html
Diffstat (limited to 'configure')
-rwxr-xr-xconfigure31
1 files changed, 1 insertions, 30 deletions
diff --git a/configure b/configure
index abefcdb521..8b0b22241d 100755
--- a/configure
+++ b/configure
@@ -6938,38 +6938,9 @@ else
have_selinux=no
fi
- # See if we have the SELinux header with the NSCD permissions in it.
- if test x$have_selinux = xyes ; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for NSCD Flask permissions in selinux/av_permissions.h" >&5
-$as_echo_n "checking for NSCD Flask permissions in selinux/av_permissions.h... " >&6; }
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h. */
-#include <selinux/av_permissions.h>
-int
-main ()
-{
-#ifdef NSCD__SHMEMHOST
- return 0;
- #else
- #error NSCD__SHMEMHOST not defined
- #endif
- ;
- return 0;
-}
-_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
- have_selinux=yes
-else
- have_selinux=no
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $have_selinux" >&5
-$as_echo "$have_selinux" >&6; }
- fi
-
if test x$with_selinux = xyes ; then
if test x$have_selinux = xno ; then
- as_fn_error $? "SELinux explicitly required, but sufficiently recent SELinux library not found" "$LINENO" 5
+ as_fn_error $? "SELinux explicitly required, but SELinux library not found" "$LINENO" 5
fi
fi
fi