Re: [PATCH] selinux-policy-2.eclass: introduce SELINUX_POLICY_USEDEP

On 4/6/26 10:20 AM, Rahul Sandhu wrote:
> Policy packages need to apply the same, consistent set of constraints
> for the various policy types onto any dependencies. As such, introduce
> SELINUX_POLICY_USEDEP for consumers to easily append such constraints:
> 
>> sec-policy/selinux-foo[${SELINUX_USEDEP}]


Mostly lgtm, uninvasive but necessary.


> Signed-off-by: Rahul Sandhu <[email protected]>
> ---
>  eclass/selinux-policy-2.eclass | 18 +++++++++---------
>  1 file changed, 9 insertions(+), 9 deletions(-)
> 
> diff --git a/eclass/selinux-policy-2.eclass b/eclass/selinux-policy-2.eclass
> index 96bf57746f68..2f75baec5c47 100644
> --- a/eclass/selinux-policy-2.eclass
> +++ b/eclass/selinux-policy-2.eclass
> @@ -84,6 +84,11 @@ fi
>  # The default value is the 'master' branch.
>  : "${SELINUX_GIT_BRANCH:="master"}"
>  
> +# @ECLASS_VARIABLE: SELINUX_POLICY_USEDEP
> +# @DESCRIPTION:
> +# This variable contains the USE dependency constraints for policy packages.
> +: "${SELINUX_POLICY_USEDEP:="selinux_policy_types_targeted(-)?,selinux_policy_types_strict(-)?,selinux_policy_types_mcs(-)?,selinux_policy_types_mls(-)?"}"


Unclear if we need support in ebuilds to override this. We could just
set it as SELINUX_POLICY_USEDEP="..." and tag it as @OUTPUT_VARIABLE, if
it cannot be changed by ebuilds (that is, what your ebuild gets upon
inheriting the eclass is what your ebuild gets).


>  case ${BASEPOL} in
>  	9999)
>  		inherit git-r3
> @@ -127,15 +132,10 @@ if [[ ${EAPI} = 7 ]]; then
>  		>=sec-policy/selinux-base-policy-${_BASE_POLICY_VERSION}
>  	"
>  else
> -	RDEPEND=">=sys-apps/policycoreutils-2.5"
> -	for _poltype in selinux_policy_types_{targeted,strict,mcs,mls}; do
> -		RDEPEND+="
> -			${_poltype}? (
> -				>=sec-policy/selinux-base-policy-${_BASE_POLICY_VERSION}[${_poltype}]
> -			)
> -		"
> -	done
> -	unset _poltype
> +	RDEPEND="
> +		>=sys-apps/policycoreutils-2.5
> +		>=sec-policy/selinux-base-policy-${_BASE_POLICY_VERSION}[${SELINUX_POLICY_USEDEP}]
> +	"
>  fi


This is a simplification that seems obvious in hindsight.


>  unset _BASE_POLICY_VERSION


-- 
Eli Schwartz

-----BEGIN PGP SIGNATURE-----

wnsEABYIACMWIQTnFNnmK0TPZHnXm3qEp9ErcA0vVwUCadPK8gUDAAAAAAAKCRCEp9ErcA0vVyPI
AQDcSzECIXPgl9ICb1NNfzcHnqKe9naWZAH4S7cm++VZdAEA4J5qAioFIqbKemUMYTCtZ1HxU8NG
mtBCsezcE4b93QM=
=pVFb
-----END PGP SIGNATURE-----