Red Hat Bugzilla – Bug 174062
selinux code compiled even when disabled
Last modified: 2007-11-30 17:11:17 EST
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (compatible; MSIE 6.0; Windows; U; AIIEEEE!; Win98; Windows 98; en-US; Gecko masquerading as IE; should it matter?; rv:1.8b) Gecko/20050217
Description of problem:
Even if you compile pam with SELINUX disabled you get selinux library compiled in with the code, and pam_selinux.so also gets created
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1.rpm -v -ba --define "WITH_SELINUX 0" pam-0.79-9.6.src.rpm
Actual Results: Still end up with SeLinux stuff in code and with a /lib/security/pam_selinux.so module
Expected Results: There should be no SeLinux code compiled with pam.
The problem seems to be that the patch pam-0.78-selinux.patch peppers code with
various "#ifdef WITH_SELINUX" fragments. And subsequent non-selinux-related
patches are dependent on code containing these fragments.
But the clincher is the addition of "-DWITH_SELINUX" to an few Makefiles.
So, if you omit the patch (and avoid the -DWITH_SELINUX) all the subsequent
patches fail because the source files no longer match the files which had diffs
On the other hand, if you include the patch you get a very very lame Makefile
patch which compiles in all of the SELINUX stuff.
Oh dear me! How did this get out the door?
The solution is to do it properly via configure/autoconf.
Building PAM without SELinux is not supported.
(In reply to comment #2)
> Building PAM without SELinux is not supported.
Really? Well it is with the patch that I have created.
I'm surprised to hear you say that, given that SeLinux hasn't been widely
accepted and therefore is not in other source distributions (and probably wont be).
The performance hit that SeLinux and audit stuff creates is considerable and
noticeable. No wonder there has to be readahead and prelink rubbish!
IMO it also create more security holes (once kernel penetrated) than it solves.
No wonder NSA mandated this!