[PATCH v7 1/4] elf: Cleanup and improve tst-execstack

[Florian Weimer]

* Adhemerval Zanella Netto:

> On 30/12/24 14:08, Florian Weimer wrote:
>> * Adhemerval Zanella:
>> 
>>> +static bool
>>> +check_selinux (void)
>>> +{
>>> +  /* Old Red Hat like systems.  */
>>> +  enum selinux_status r =
>>> +    check_selinux_generic ("/selinux/enforce",
>>> +			   "/selinux/booleans/allow_execstack");
>>> +  if (r == SELINUX_NOT_PRESENT)
>>> +    /* New Red Hard like systems.  */
>>> +    r = check_selinux_generic ("/sys/fs/selinux/enforce",
>>> +			       "/sys/fs/selinux/booleans/selinuxuser_execstack");
>>> +  return r == SELINUX_NOT_PRESENT || r == SELINUX_EXECSTACK_ENABLE;
>>> +}
>> 
>> Typo: Red Ha[t]
>> 
>> I think this isn't quite right.  The path prefix (selinuxfs mount point)
>> is independent of the policy style.  The reference policy
>> <https://github.com/SELinuxProject/refpolicy> still uses allow_execstack
>> in its most recent versions.  Only the Fedora policy
>> <https://github.com/fedora-selinux/selinux-policy> uses
>> selinuxuser_execstack.
>
> Right, do you prefer if I can move this to a different patch? My first
> approach was to use a list of mount points and check for both policy
> styles.

Let's keep it separate I would say.  It seems uncommon to test glibc
with allow_execstack or equivalent disabled.

> I don't have access to a Red Hat release, so I used as a proxy the CentOS 
> and Alma Linux we have on gcc compile farm.  It seems that such system
> might not be a 100% proxy for Red Hat systems.

I don't think downstreams from RHEL deviate here.  The last RHEL release
that used /selinux as the mount was RHEL 6.  It's got a heavily patched
2.6.32 kernel (with lots of *at system call backports).  It's probably
good enough to build and run glibc now that we have removed the kernel
version check, but I don't expect anyone doing that.

I don't know which mountpoints other distributions use (that aren't
downstream from Fedora).  Fedora formally forked from refpolicy here:

commit 51dc83b2d4cd22cff6fbf6116b954b4f672b90c4
Author: Lukas Vrabec <lvrabec@redhat.com>
Date:   Sun Dec 24 14:31:11 2017 +0100

    Commit removes big SELinux policy patches against tresys refpolicy.
    
    We're quite diverted from upstream policy. This change will use tarballs
    from github projects:
    https://github.com/fedora-selinux/selinux-policy
    https://github.com/fedora-selinux/selinux-policy-contrib

But the introduction of selinuxuser_execstack is even older, it seems to
date back to:

commit c3956376c7bcb2927655da7737fe6c064d746d72
Author: Dan Walsh <dwalsh@redhat.com>
Date:   Fri Jun 8 10:09:54 2012 -0400

    Add booleans.subs_dist to selinux-policy package

And that didn't make it into the RHEL 6 release, only RHEL 7 and later.

I expect other distributions based on refpolicy to still use
allow_execstack, though.

Thanks,
Florian