Bug 582006

Created attachment 409243 [details]
Patch to devel's libselinux.spec to add a python3 subpackage

Created attachment 409244 [details]
Patch to src/Makefile

Patch generalizes build to _require_ a PYTHON envvar to be set, pointing at a python runtime, and a PYPREFIX envvar, so that we can build the Python bindings multiple times, once for each Python runtime (in our case, python2.6 and python3.1).  

This is used by the libselinux.spec file.  As it stands, this will break the build for people building outside of RPM, as it requires the two env vars to exist.

I guess we could supply defaults:
PYTHON=python
PYPREFIX=   
(empty)

Created attachment 409245 [details]
Patch to generalize audit2why.c so that it can be built against both python 2.* and 3.*

Mostly just changes to module-initialization logic.  See:
http://wiki.python.org/moin/PortingExtensionModulesToPy3k#module-initialization-and-state

Created attachment 409246 [details]
Fix handling of bad args to audit2why.init

This isn't part of python3 porting, but fixes a compiler warning:
PyArg_ParseTuple can fail, if the input doesn't match what was expected (e.g. if the user passes an argument that isn't a string e.g. a list), and returns NULL when this happens, setting the global exception state for the current thread, and leaving "result" uninitialized.

Created attachment 409247 [details]
Change various parts of the python swig code to use "bytes" not "string"

This will work with Python 2.6 onwards, and Python 3.*

In 2.6 and 2.7, PyBytes_* is a set of #defines for PyString_*

In 3.*, PyBytes_* is the new name for the PyString_ API, but they are a "bytes" type, with no encoding.  Literals have a 'b' prefix.

I've got this to compile against Python 3, but it took a lot more effort than I was hoping.

It wasn't clear to me whether the names of booleans and of constants can contain non-ASCII characters, so I took the conservative approach of representing them as "bytes" instances, rather than (unicode) "str" instances.  I can redo things using "str" if we can rely on them being ASCII.

The result works, under light testing, but I haven't tried "serious" testing:
[david@surprise devel]$ rpm -q libselinux-python3
libselinux-python3-2.0.92-2.fc14.x86_64
[david@surprise devel]$ python3
Python 3.1.2 (r312:79147, Mar 21 2010, 16:44:26) 
[GCC 4.4.3 20100127 (Red Hat 4.4.3-4)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import selinux
>>> selinux.is_selinux_enabled()
1
>>> selinux.is_selinux_mls_enabled()
1
>>> selinux.avc_av_stats()
uavc:  0 AV entries and 0/512 buckets used, longest chain length 0
>>> selinux.get_default_context('foo', 'bar')
[-1, None]
>>> selinux.security_get_boolean_names()
[0, [b'allow_console_login', b'allow_cvs_read_shadow', b'allow_daemons_dump_core', b'allow_daemons_use_tty', b'allow_domain_fd_use', b'allow_execheap', b'allow_execmem', b'allow_execmod', b'allow_execstack', b'allow_ftpd_anon_write', b'allow_ftpd_full_access', 
(etc; note that these are bytes, not strings)

Created attachment 409578 [details]
Patch to src/Makefile, supplying defaults for PYTHON and PYPREFIX

Created attachment 409579 [details]
Patch to devel's libselinux.spec to add a python3 subpackage (renaming one of the patches)

Created attachment 409580 [details]
Patch to generalize audit2why.c so that it can be built against both python 2.* and 3.*  (using PyUnicode for py3k)

Created attachment 409581 [details]
Change various parts of the python swig code to use "PyUnicode"for python3 and "PyString" for python2

I've updated things to use PyUnicode for throughout within Python 3 for contexts and boolean names.  Swig appears to have already been doing this, using UTF8 internally.

I've rebuilt local test packages of "devel" on this F-12 x86_64 system (with a local build of python3) and tested lightly; the python3 bindings appear to work:

[david@surprise devel]$ rpm -q libselinux-python3
libselinux-python3-2.0.92-2.fc14.x86_64
[david@surprise devel]$ python3
Python 3.1.2 (r312:79147, Mar 21 2010, 16:44:26) 
[GCC 4.4.3 20100127 (Red Hat 4.4.3-4)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import selinux
>>> selinux.is_selinux_enabled()
1
>>> selinux.is_selinux_mls_enabled()
1
>>> selinux.avc_av_stats()
uavc:  0 AV entries and 0/512 buckets used, longest chain length 0
>>> selinux.get_default_context('foo', 'bar')
[-1, None]
>>> selinux.security_get_boolean_names()
[0, ['allow_console_login', 'allow_cvs_read_shadow', 'allow_daemons_dump_core', 'allow_daemons_use_tty', 'allow_domain_fd_use', 'allow_execheap', 'allow_execmem', 'allow_execmod', 'allow_execstack', 'allow_ftpd_anon_write', 'allow_ftpd_full_access', 'allow_ftpd_use_cifs', 'allow_ftpd_use_nfs', 'allow_gssd_read_tmp', 
(snip; note the use of strings, not bytes)
>>> selinux.getfilecon('/')
[28, 'system_u:object_r:root_t:s0']


I haven't thoroughly tested it though.

Created attachment 412449 [details]
Revised version of patch for python swig code to use "PyUnicode"for python3 and "PyString" for python2

I've revised this typemap code to use SWIG's internal python API for converting between Python and C string values

Created attachment 412450 [details]
Revised version of specfile patch

I slightly revised the specfile patch, removing a stray ".patch" suffix from the -b parameter to %patch5

Dan:  I've lightly tested a build of this with both Python 2.6 and Python 3.1 on Fedora 13.  I believe it's ready for your review.

Appears to be fixed in rawhide as of libselinux-2.0.96-1