Re: [gentoo-hardened] Update on selinux-policy-2 eclass

[Sven Vermeulen]

On Wed, Aug 03, 2011 at 02:59:14PM +0400, Peter Volkov wrote:
> В Втр, 02/08/2011 в 09:19 +0200, Sven Vermeulen пишет:
> > To allow for more manageable patching on our selinux policies (since Matthew
> > will bombard me anyhow with things to fix ;-) and not to clutter the files/
> > directory in the Portage tree, I've been meaning to update the
> > selinux-policy-2 eclass to support reusing the patchbundles offered by the
> > selinux-base-policy releases. The result can currently be seen at
> > http://bit.ly/owGhAs but, unless people object, I'll be pushing this eclass
> > to the hardened-dev overlay tomorrow (in an eclass/ directory) without
> > changing the eclass name ("bumping") since it doesn't change anything for
> > existing ebuilds.
>
> First of all thank you for all this job you are doing. Here are just
> general comments on how to clean code a bit:

Thanks for the feedback. I've incorporated most of the changes you
suggested. The eclass is currently in the hardened-dev overlay (you can view
it at http://bit.ly/oJdMVz) with the changes included.

I'd like to reply to a few of your suggestions (to show you I didn't ignore
them and to solicit some reaction or suggestions too ;-)

> 4. [ -n "${POLICY_PATCH}" ]
> generally it's better to use bash tests [[ ]] and avoid quotation.

For POLICY_PATCH, I'll keep the quotation(s) because it can contain multiple
patches (space-separated).

> 8.
> selinux-policy-2_src_compile() {
> 	for i in ${POLICY_TYPES}; do
> 		make NAME=$i -C "${S}"/${i} || die "${i} compile failed"
> Is parallel build unsupported here? May be emake?

It isn't supported out-of-the-box. I would have to create a Makefile here
(from within the eclass) to allow parallel builds, but I think that would
make it less obvious of what is going on here.

Also, the make operation takes about 2 seconds on a moderate CPU and I
assume that most users set their POLICY_TYPES to the type they use (and not
more), so the gain here is minimal.

Also, emake fails here, it complains about a missing file:

	/bin/sh: tmp/ldap.mod.fc: No such file or directory

whereas with just "make" it works well. The Makefile used is probably the
fault here, but I'm no wizard in these things and since "just" make works,
I'll stick with that ;)

Wkr,
	Sven Vermeulen