selinux-policy.spec wierdness?

Am looking at selinux-policy-2.2.38-1.src.rpm.  Does anybody know
why there isn't a %build section in the .SPEC file?  I was *hoping*
to do a 'rpmbuild -bc' to assist in debugging an outstanding problem
I'm having with strict policy, but apparently all the building gets
done in the %install. Blech.

[Maxim Britov]

On Tue, 09 May 2006 18:07:01 -0400
 Valdis.Kletnieks(a)vt.edu wrote:

>  Am looking at selinux-policy-2.2.38-1.src.rpm.  Does anybody know
>  why there isn't a %build section in the .SPEC file?  I was *hoping*
>  to do a 'rpmbuild -bc' to assist in debugging an outstanding problem
>  I'm having with strict policy, but apparently all the building gets
>  done in the %install. Blech. 
Confirm. selinux-policy-strict-2.2.38-1 in fc5 updates is broken :(

  Updating  : selinux-policy-strict        ####################### [ 4/10]
libsepol.scope_copy_callback: authlogin: Duplicate declaration in module: type/attribute
system_chkpwd_t
libsemanage.semanage_link_sandbox: Link packages failed
semodule:  Failed!



-- 
Maxim Britov

GnuPG KeyID 0x4580A6D66F3DB1FB xmpp:[e-mail] icq 198171258
Fingerprint: 4059 B5C5 8985 5A47 8F5A 8623 4580 A6D6 6F3D B1FB
GnuPG-ru Team (http://lists.gnupg.org/mailman/listinfo/gnupg-ru
               xmpp:[e-mail])

On Wed, 10 May 2006 10:53:16 +0300, Maxim Britov said:
>  On Tue, 09 May 2006 18:07:01 -0400
>   Valdis.Kletnieks(a)vt.edu wrote:
>  
>  > Am looking at selinux-policy-2.2.38-1.src.rpm.  Does anybody know
>  > why there isn't a %build section in the .SPEC file?  I was *hoping*
>  > to do a 'rpmbuild -bc' to assist in debugging an outstanding problem
>  > I'm having with strict policy, but apparently all the building gets
>  > done in the %install. Blech.
>  
>  Confirm. selinux-policy-strict-2.2.38-1 in fc5 updates is broken :(
>  
>    Updating  : selinux-policy-strict        ####################### [ 4/10]
>  libsepol.scope_copy_callback: authlogin: Duplicate declaration in module: typ
e/attribute system_chkpwd_t
>  libsemanage.semanage_link_sandbox: Link packages failed
>  semodule:  Failed! 
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=188060

is already open for the system_chkpwd_t problem.  I came across the specfile
problem while trying to debug that problem.

The interesting part is that Horst opened that bug against 2.2.29, I finally
got fed up with rpm complaining and found the bugzilla - and nobody else has
attached themselves to the cc: list. For a while, I was wondering if Horst and
I were the only two trying to use the Rawhide 'strict' policy...

[Bruno Wolff III]

On Wed, May 10, 2006 at 04:07:11 -0400,
  Valdis.Kletnieks(a)vt.edu wrote:
>  On Wed, 10 May 2006 10:53:16 +0300, Maxim Britov said:
>  > On Tue, 09 May 2006 18:07:01 -0400
>  >  Valdis.Kletnieks(a)vt.edu wrote:
>  > 
>  > > Am looking at selinux-policy-2.2.38-1.src.rpm.  Does anybody know
>  > > why there isn't a %build section in the .SPEC file?  I was *hoping*
>  > > to do a 'rpmbuild -bc' to assist in debugging an outstanding problem
>  > > I'm having with strict policy, but apparently all the building gets
>  > > done in the %install. Blech.
>  > 
>  > Confirm. selinux-policy-strict-2.2.38-1 in fc5 updates is broken :(
>  > 
>  >   Updating  : selinux-policy-strict        ####################### [ 4/10]
>  > libsepol.scope_copy_callback: authlogin: Duplicate declaration in module: typ
>  e/attribute system_chkpwd_t
>  > libsemanage.semanage_link_sandbox: Link packages failed
>  > semodule:  Failed!
>  
>  https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=188060
>  
>  is already open for the system_chkpwd_t problem.  I came across the specfile
>  problem while trying to debug that problem.
>  
>  The interesting part is that Horst opened that bug against 2.2.29, I finally
>  got fed up with rpm complaining and found the bugzilla - and nobody else has
>  attached themselves to the cc: list. For a while, I was wondering if Horst and
>  I were the only two trying to use the Rawhide 'strict' policy... 
I have been seeing this for a while in FC5 and have an open ticket (190012)
that I am about to update saying the problem isn't fixed with 2.2.38-1.fc5.

[Stephen Smalley]

On Tue, 2006-05-09 at 18:07 -0400, Valdis.Kletnieks(a)vt.edu wrote:
>  Am looking at selinux-policy-2.2.38-1.src.rpm.  Does anybody know
>  why there isn't a %build section in the .SPEC file?  I was *hoping*
>  to do a 'rpmbuild -bc' to assist in debugging an outstanding problem
>  I'm having with strict policy, but apparently all the building gets
>  done in the %install. Blech. 
1) strict policy is known to be broken simply due to the current
brokenness of optionals-in-base support in checkpolicy/libsepol.
Patches are coming soon.  It isn't really strict policy per se, but
fully modularized policy where the base has to contain optional sections
that need to be dynamically enabled at link time.

2) At present, you can build a working copy of a given policy build tree
via:
rpmbuild -bb --define "BUILD_xxx 0" --define "BUILD_yyy 0"
selinux-policy.spec
where xxx and yyy are MLS, STRICT, or TARGETED, and you are disabling
the ones you don't want.  e.g. to build a working copy of a build tree
for just strict, you'd use:
rpmbuild -bb --define "BUILD_MLS 0" --define "BUILD_TARGETED 0"
selinux-policy.spec

This tries to build a binary package, of course, but leaves the build
tree intact so that you can then go use it.

We do need a cleaner way of doing this, or at least for it to be
documented in the FAQ.

-- 
Stephen Smalley
National Security Agency