[Buildroot] [PATCH 1/3] package/xen: explicitly disable checkpolicy logic
peter at korsgaard.com
Tue Jan 21 21:45:41 UTC 2020
>>>>> "Arnout" == Arnout Vandecappelle <arnout at mind.be> writes:
> On 19/01/2020 18:03, Peter Korsgaard wrote:
>> The Xen build system builds and embeds a default XSM FLASK (Flux Advanced
>> Security Kernel) security policy if it detects SELinux checkpolicy on the
>> build machine.
>> If enabled, a gen-policy.py python script is used to convert the binary
>> FLASK policy to a C array initialization list to embed it in the Xen binary.
>> Depending on the python version and locale available on the host, this fails
> The more appropriate thing to do would be to:
> - set this XEN_HAS_CHECKPOLICY=n if selinux is disabled;
> - do not set it when selinux is enabled, and depend on host-checkpolicy
Yes, that can be done in the future by someone interested in xen with
> - depend on host-python
> - set LC_ALL=C
Hmm, where are we setting LC_ALL=C in the package build step?
> However, the latter two are already done. So except for incorrectly detecting
> checkpolicy installed on the system, I wonder what is really triggering this
I was also unable to reproduce the issue locally, but given the > 255
byte values I assume it is related to locale. Looking at the issue I
noticed the invalid checkpolicy logic and that disabling it would get
rid of the entire code path.
But I am fine with people sending patches to improve it. I don't use Xen
myself, I only looked at the build issues while doing security support
and noticed they have been occuring for quite a long time.
Bye, Peter Korsgaard
More information about the buildroot