pyrox.dev
lol
1{ lib, stdenv, fetchurl, fetchpatch, buildPackages, pcre2, pkg-config, libsepol
2, enablePython ? !stdenv.hostPlatform.isStatic
3, swig ? null, python3 ? null, python3Packages
4, fts
5}:
6
7assert enablePython -> swig != null && python3 != null;
8
9with lib;
10
11stdenv.mkDerivation rec {
12 pname = "libselinux";
13 version = "3.6";
14 inherit (libsepol) se_url;
15
16 outputs = [ "bin" "out" "dev" "man" ] ++ optional enablePython "py";
17
18 src = fetchurl {
19 url = "${se_url}/${version}/libselinux-${version}.tar.gz";
20 hash = "sha256-uk4O80snDnZypeXxtSP+K+qzpAuzPZOJ9K06hyjyG1I=";
21 };
22
23 patches = [
24 # Make it possible to disable shared builds (for pkgsStatic).
25 #
26 # We can't use fetchpatch because it processes includes/excludes
27 # /after/ stripping the prefix, which wouldn't work here because
28 # there would be no way to distinguish between
29 # e.g. libselinux/src/Makefile and libsepol/src/Makefile.
30 #
31 # This is a static email, so we shouldn't have to worry about
32 # normalizing the patch.
33 (fetchurl {
34 url = "https://lore.kernel.org/selinux/20211113141616.361640-1-hi@alyssa.is/raw";
35 sha256 = "16a2s2ji9049892i15yyqgp4r20hi1hij4c1s4s8law9jsx65b3n";
36 postFetch = ''
37 mv "$out" $TMPDIR/patch
38 ${buildPackages.patchutils_0_3_3}/bin/filterdiff \
39 -i 'a/libselinux/*' --strip 1 <$TMPDIR/patch >"$out"
40 '';
41 })
42
43 (fetchurl {
44 url = "https://git.yoctoproject.org/meta-selinux/plain/recipes-security/selinux/libselinux/0003-libselinux-restore-drop-the-obsolete-LSF-transitiona.patch?id=62b9c816a5000dc01b28e78213bde26b58cbca9d";
45 sha256 = "sha256-RiEUibLVzfiRU6N/J187Cs1iPAih87gCZrlyRVI2abU=";
46 })
47 ];
48
49 nativeBuildInputs = [ pkg-config python3 ] ++ optionals enablePython [
50 python3Packages.pip
51 python3Packages.setuptools
52 python3Packages.wheel
53 swig
54 ];
55 buildInputs = [ libsepol pcre2 fts ] ++ optionals enablePython [ python3 ];
56
57 # drop fortify here since package uses it by default, leading to compile error:
58 # command-line>:0:0: error: "_FORTIFY_SOURCE" redefined [-Werror]
59 hardeningDisable = [ "fortify" ];
60
61 env.NIX_CFLAGS_COMPILE = "-Wno-error -D_FILE_OFFSET_BITS=64";
62
63 makeFlags = [
64 "PREFIX=$(out)"
65 "INCDIR=$(dev)/include/selinux"
66 "INCLUDEDIR=$(dev)/include"
67 "MAN3DIR=$(man)/share/man/man3"
68 "MAN5DIR=$(man)/share/man/man5"
69 "MAN8DIR=$(man)/share/man/man8"
70 "SBINDIR=$(bin)/sbin"
71 "SHLIBDIR=$(out)/lib"
72
73 "LIBSEPOLA=${lib.getLib libsepol}/lib/libsepol.a"
74 "ARCH=${stdenv.hostPlatform.linuxArch}"
75 ] ++ optionals (fts != null) [
76 "FTS_LDLIBS=-lfts"
77 ] ++ optionals stdenv.hostPlatform.isStatic [
78 "DISABLE_SHARED=y"
79 ] ++ optionals enablePython [
80 "PYTHON=${python3.pythonOnBuildForHost.interpreter}"
81 "PYTHONLIBDIR=$(py)/${python3.sitePackages}"
82 "PYTHON_SETUP_ARGS=--no-build-isolation"
83 ];
84
85 postPatch = lib.optionalString stdenv.hostPlatform.isMusl ''
86 substituteInPlace src/procattr.c \
87 --replace "#include <unistd.h>" ""
88 '';
89
90 preInstall = optionalString enablePython ''
91 mkdir -p $py/${python3.sitePackages}/selinux
92 '';
93
94 installTargets = [ "install" ] ++ optional enablePython "install-pywrap";
95
96 meta = removeAttrs libsepol.meta ["outputsToInstall"] // {
97 description = "SELinux core library";
98 };
99}