Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
Bug 174062 - selinux code compiled even when disabled
selinux code compiled even when disabled
Product: Fedora
Classification: Fedora
Component: pam (Show other bugs)
i386 Linux
medium Severity medium
: ---
: ---
Assigned To: Tomas Mraz
Depends On:
  Show dependency treegraph
Reported: 2005-11-24 02:43 EST by JW
Modified: 2007-11-30 17:11 EST (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2005-11-24 05:33:04 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description JW 2005-11-24 02:43:27 EST
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (compatible; MSIE 6.0; Windows; U; AIIEEEE!; Win98; Windows 98; en-US; Gecko masquerading as IE; should it matter?; rv:1.8b) Gecko/20050217

Description of problem:
Even if you compile pam with SELINUX disabled you get selinux library compiled in with the code, and pam_selinux.so also gets created

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1.rpm -v -ba --define "WITH_SELINUX 0" pam-0.79-9.6.src.rpm

Actual Results:  Still end up with SeLinux stuff in code and with a /lib/security/pam_selinux.so module

Expected Results:  There should be no SeLinux code compiled with pam.

Additional info:
Comment 1 JW 2005-11-24 02:54:25 EST
The problem seems to be that the patch pam-0.78-selinux.patch peppers code with
various "#ifdef WITH_SELINUX" fragments.  And subsequent non-selinux-related
patches are dependent on code containing these fragments.

But the clincher is the addition of "-DWITH_SELINUX" to an few Makefiles.

So, if you omit the patch (and avoid the -DWITH_SELINUX) all the subsequent
patches fail because the source files no longer match the files which had diffs

On the other hand, if you include the patch you get a very very lame Makefile
patch which compiles in all of the SELINUX stuff.

Oh dear me! How did this get out the door?

The solution is to do it properly via configure/autoconf.

Comment 2 Tomas Mraz 2005-11-24 05:33:04 EST
Building PAM without SELinux is not supported.
Comment 3 JW 2005-11-24 05:56:43 EST
(In reply to comment #2)
> Building PAM without SELinux is not supported.

Really? Well it is with the patch that I have created.
I'm surprised to hear you say that, given that SeLinux hasn't been widely
accepted and therefore is not in other source distributions (and probably wont be).

The performance hit that SeLinux and audit stuff creates is considerable and
noticeable. No wonder there has to be readahead and prelink rubbish!

IMO it also create more security holes (once kernel penetrated) than it solves.
No wonder NSA mandated this!

Note You need to log in before you can comment on or make changes to this bug.