Re: [PATCH] selinux-policy-2.eclass: introduce SELINUX_POLICY_USEDEP

On Mon Apr 6, 2026 at 4:02 PM BST, Eli Schwartz wrote:
> On 4/6/26 10:20 AM, Rahul Sandhu wrote:
>> Policy packages need to apply the same, consistent set of constraints
>> for the various policy types onto any dependencies. As such, introduce
>> SELINUX_POLICY_USEDEP for consumers to easily append such constraints:
>> 
>>> sec-policy/selinux-foo[${SELINUX_USEDEP}]
>
>
> Mostly lgtm, uninvasive but necessary.
>
>
>> Signed-off-by: Rahul Sandhu <[email protected]>
>> ---
>>  eclass/selinux-policy-2.eclass | 18 +++++++++---------
>>  1 file changed, 9 insertions(+), 9 deletions(-)
>> 
>> diff --git a/eclass/selinux-policy-2.eclass b/eclass/selinux-policy-2.eclass
>> index 96bf57746f68..2f75baec5c47 100644
>> --- a/eclass/selinux-policy-2.eclass
>> +++ b/eclass/selinux-policy-2.eclass
>> @@ -84,6 +84,11 @@ fi
>>  # The default value is the 'master' branch.
>>  : "${SELINUX_GIT_BRANCH:="master"}"
>>  
>> +# @ECLASS_VARIABLE: SELINUX_POLICY_USEDEP
>> +# @DESCRIPTION:
>> +# This variable contains the USE dependency constraints for policy packages.
>> +: "${SELINUX_POLICY_USEDEP:="selinux_policy_types_targeted(-)?,selinux_policy_types_strict(-)?,selinux_policy_types_mcs(-)?,selinux_policy_types_mls(-)?"}"
>
>
> Unclear if we need support in ebuilds to override this. We could just
> set it as SELINUX_POLICY_USEDEP="..." and tag it as @OUTPUT_VARIABLE, if
> it cannot be changed by ebuilds (that is, what your ebuild gets upon
> inheriting the eclass is what your ebuild gets).

I personally don't think we need support in ebuilds to override this. Policy
packages should always support _all_ policy types; the code that handles the
support for other types is done by the base interfaces and as such requires
quite literally _zero_ effort for a consumer of the base policy writing a new
policy module to support.

>
>
>>  case ${BASEPOL} in
>>  	9999)
>>  		inherit git-r3
>> @@ -127,15 +132,10 @@ if [[ ${EAPI} = 7 ]]; then
>>  		>=sec-policy/selinux-base-policy-${_BASE_POLICY_VERSION}
>>  	"
>>  else
>> -	RDEPEND=">=sys-apps/policycoreutils-2.5"
>> -	for _poltype in selinux_policy_types_{targeted,strict,mcs,mls}; do
>> -		RDEPEND+="
>> -			${_poltype}? (
>> -				>=sec-policy/selinux-base-policy-${_BASE_POLICY_VERSION}[${_poltype}]
>> -			)
>> -		"
>> -	done
>> -	unset _poltype
>> +	RDEPEND="
>> +		>=sys-apps/policycoreutils-2.5
>> +		>=sec-policy/selinux-base-policy-${_BASE_POLICY_VERSION}[${SELINUX_POLICY_USEDEP}]
>> +	"
>>  fi
>
>
> This is a simplification that seems obvious in hindsight.
>
>
>>  unset _BASE_POLICY_VERSION

-----BEGIN PGP SIGNATURE-----

iMMEABMJAEsWIQS/vgbYdOWd+8Xk64hojcaB+U4gTAUCadPPdBsUgAAAAAAEAA5t
YW51MiwyLjUrMS4xMiwyLDIRHG52cmF4bkBwb3N0ZW8udWsACgkQaI3GgflOIEzU
zgF+IHqv89RUs/PgYFMOQEz3P3CpYOHA/SpJNaZ39+QMu7F4Fiv28UZb0lv3Xozi
TE3/AX0SJK3FOyB14mXTLAdhFFsQjlU+I6mrgxQNJQLc8SrD0Wwbcze531q5wwk8
pY8qzSM=
=qtlL
-----END PGP SIGNATURE-----