Red Hat Bugzilla – Bug 174062
selinux code compiled even when disabled
Last modified: 2007-11-30 17:11:17 EST
From Bugzilla Helper: User-Agent: Mozilla/5.0 (compatible; MSIE 6.0; Windows; U; AIIEEEE!; Win98; Windows 98; en-US; Gecko masquerading as IE; should it matter?; rv:1.8b) Gecko/20050217 Description of problem: Even if you compile pam with SELINUX disabled you get selinux library compiled in with the code, and pam_selinux.so also gets created Version-Release number of selected component (if applicable): pam-0.79-9.6 How reproducible: Always Steps to Reproduce: 1.rpm -v -ba --define "WITH_SELINUX 0" pam-0.79-9.6.src.rpm 2. 3. Actual Results: Still end up with SeLinux stuff in code and with a /lib/security/pam_selinux.so module Expected Results: There should be no SeLinux code compiled with pam. Additional info:
The problem seems to be that the patch pam-0.78-selinux.patch peppers code with various "#ifdef WITH_SELINUX" fragments. And subsequent non-selinux-related patches are dependent on code containing these fragments. But the clincher is the addition of "-DWITH_SELINUX" to an few Makefiles. So, if you omit the patch (and avoid the -DWITH_SELINUX) all the subsequent patches fail because the source files no longer match the files which had diffs taken. On the other hand, if you include the patch you get a very very lame Makefile patch which compiles in all of the SELINUX stuff. Oh dear me! How did this get out the door? The solution is to do it properly via configure/autoconf.
Building PAM without SELinux is not supported.
(In reply to comment #2) > Building PAM without SELinux is not supported. > Really? Well it is with the patch that I have created. I'm surprised to hear you say that, given that SeLinux hasn't been widely accepted and therefore is not in other source distributions (and probably wont be). The performance hit that SeLinux and audit stuff creates is considerable and noticeable. No wonder there has to be readahead and prelink rubbish! IMO it also create more security holes (once kernel penetrated) than it solves. No wonder NSA mandated this!