projects/guix·blob python-team · refs

418 lines · 17.2 KiB

1;;; GNU Guix --- Functional package management for GNU
2;;; Copyright © 2016, 2017, 2018 Ricardo Wurmus <[email protected]>
3;;; Copyright © 2018 Tobias Geerinckx-Rice <[email protected]>
4;;; Copyright © 2019, 2020, 2022 Marius Bakke <[email protected]>
5;;; Copyright © 2021 Efraim Flashner <[email protected]>
6;;; Copyright © 2021 Guillaume Le Vaillant <[email protected]>
7;;;
8;;; This file is part of GNU Guix.
9;;;
10;;; GNU Guix is free software; you can redistribute it and/or modify it
11;;; under the terms of the GNU General Public License as published by
12;;; the Free Software Foundation; either version 3 of the License, or (at
13;;; your option) any later version.
14;;;
15;;; GNU Guix is distributed in the hope that it will be useful, but
16;;; WITHOUT ANY WARRANTY; without even the implied warranty of
17;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18;;; GNU General Public License for more details.
19;;;
20;;; You should have received a copy of the GNU General Public License
21;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
22
23(define-module (gnu packages selinux)
24 #:use-module ((guix licenses) #:prefix license:)
25 #:use-module (guix packages)
26 #:use-module (guix gexp)
27 #:use-module (guix download)
28 #:use-module (guix git-download)
29 #:use-module (guix utils)
30 #:use-module (guix build-system gnu)
31 #:use-module (guix build-system pyproject)
32 #:use-module (gnu packages)
33 #:use-module (gnu packages admin)
34 #:use-module (gnu packages bison)
35 #:use-module (gnu packages check)
36 #:use-module (gnu packages crypto)
37 #:use-module (gnu packages docbook)
38 #:use-module (gnu packages compiler-tools)
39 #:use-module (gnu packages gettext)
40 #:use-module (gnu packages glib)
41 #:use-module (gnu packages linux)
42 #:use-module (gnu packages networking)
43 #:use-module (gnu packages pcre)
44 #:use-module (gnu packages pkg-config)
45 #:use-module (gnu packages python)
46 #:use-module (gnu packages python-build)
47 #:use-module (gnu packages python-check)
48 #:use-module (gnu packages python-xyz)
49 #:use-module (gnu packages qt)
50 #:use-module (gnu packages swig)
51 #:use-module (gnu packages xml)
52 #:use-module (srfi srfi-1))
53
54;; Update the SELinux packages together!
55
56(define-public libsepol
57 (package
58 (name "libsepol")
59 (version "3.4")
60 (source (origin
61 (method git-fetch)
62 (uri (git-reference
63 (url "https://github.com/SELinuxProject/selinux")
64 (commit version)))
65 (file-name (git-file-name "selinux" version))
66 (sha256
67 (base32
68 "1lcmgmfr0q7g5cwg6b7jm6ncw8cw6c1jblkm93v1g37bfhcgrqc0"))
69 (patches (search-patches "libsepol-versioned-docbook.patch"))))
70 (build-system gnu-build-system)
71 (arguments
72 (list
73 #:tests? #f ; tests require checkpolicy, which requires libsepol
74 #:test-target "test"
75 #:make-flags
76 #~(let ((out #$output))
77 (list (string-append "PREFIX=" out)
78 (string-append "SHLIBDIR=" out "/lib")
79 (string-append "MAN3DIR=" out "/share/man/man3")
80 (string-append "MAN5DIR=" out "/share/man/man5")
81 (string-append "MAN8DIR=" out "/share/man/man8")
82 (string-append "CFLAGS=-Wno-error")
83 (string-append "LDFLAGS=-Wl,-rpath=" out "/lib")
84 (string-append "CC=" #$(cc-for-target))))
85 #:phases
86 #~(modify-phases %standard-phases
87 (delete 'configure)
88 (add-after 'unpack 'enter-dir
89 (lambda _ (chdir #$name)))
90 (add-after 'enter-dir 'portability
91 (lambda _
92 (substitute* "src/ibpkeys.c"
93 (("#include \"ibpkey_internal.h\"" line)
94 (string-append line "\n#include <inttypes.h>\n"))
95 (("%#lx") "%#\" PRIx64 \"")))))))
96 (native-inputs
97 (list flex))
98 (home-page "https://selinuxproject.org/")
99 (synopsis "Library for manipulating SELinux policies")
100 (description
101 "The libsepol library provides an API for the manipulation of SELinux
102binary policies. It is used by @code{checkpolicy} (the policy compiler) and
103similar tools, and programs such as @code{load_policy}, which must perform
104specific transformations on binary policies (for example, customizing policy
105boolean settings).")
106 (license license:lgpl2.1+)))
107
108(define-public checkpolicy
109 (package/inherit libsepol
110 (name "checkpolicy")
111 (arguments
112 (list
113 #:tests? #f ; there is no check target
114 #:make-flags
115 #~(list (string-append "PREFIX=" #$output)
116 (string-append "LIBSEPOLA="
117 (search-input-file %build-inputs
118 "/lib/libsepol.a"))
119 (string-append "CC=" #$(cc-for-target)))
120 #:phases
121 #~(modify-phases %standard-phases
122 (delete 'configure)
123 (delete 'portability)
124 (add-after 'unpack 'enter-dir
125 (lambda _ (chdir #$name))))))
126 (inputs
127 (list libsepol))
128 (native-inputs
129 (list bison flex))
130 (synopsis "Check SELinux security policy configurations and modules")
131 (description
132 "This package provides the tools \"checkpolicy\" and \"checkmodule\".
133Checkpolicy is a program that checks and compiles a SELinux security policy
134configuration into a binary representation that can be loaded into the kernel.
135Checkmodule is a program that checks and compiles a SELinux security policy
136module into a binary representation.")
137 ;; GPLv2 only
138 (license license:gpl2)))
139
140(define-public libselinux
141 (package/inherit libsepol
142 (name "libselinux")
143 (outputs '("out" "python"))
144 (arguments
145 (substitute-keyword-arguments arguments
146 ((#:make-flags flags)
147 #~(cons* "PYTHON=python3"
148 (string-append "LIBSEPOLA="
149 (search-input-file %build-inputs
150 "/lib/libsepol.a"))
151 (string-append "PYTHONLIBDIR="
152 #$output:python
153 "/lib/python"
154 #$(version-major+minor (package-version python))
155 "/site-packages/")
156 #$flags))
157 ((#:phases phases)
158 #~(modify-phases #$phases
159 (delete 'portability)
160 (replace 'enter-dir
161 (lambda _ (chdir #$name)))
162 (add-after 'build 'pywrap
163 (lambda* (#:key make-flags #:allow-other-keys)
164 (apply invoke "make" "pywrap" make-flags)))
165 (add-after 'install 'install-pywrap
166 (lambda* (#:key make-flags #:allow-other-keys)
167 ;; The build system uses "python setup.py install" to install
168 ;; Python bindings. Instruct it to use the correct output.
169 (substitute* "src/Makefile"
170 (("--prefix=\\$\\(PREFIX\\)")
171 (string-append "--prefix=" #$output:python
172 ;; Python 3.10 refuses to execute the install
173 ;; command unless these flags are present.
174 " --single-version-externally-managed"
175 " --root=/")))
176
177 (apply invoke "make" "install-pywrap" make-flags)))))))
178 ;; These libraries are in "Requires.private" in libselinux.pc.
179 (propagated-inputs
180 (list libsepol pcre2))
181 ;; For pywrap phase
182 (inputs
183 (list python-wrapper))
184 ;; These inputs are only needed for the pywrap phase.
185 (native-inputs
186 (list pkg-config python-setuptools swig-4.0))
187 (supported-systems (remove target-hurd? %supported-systems))
188 (synopsis "SELinux core libraries and utilities")
189 (description
190 "The libselinux library provides an API for SELinux applications to get
191and set process and file security contexts, and to obtain security policy
192decisions. It is required for any applications that use the SELinux API, and
193used by all applications that are SELinux-aware. This package also includes
194the core SELinux management utilities.")
195 (license license:public-domain)))
196
197(define-public libsemanage
198 (package/inherit libsepol
199 (name "libsemanage")
200 (arguments
201 (substitute-keyword-arguments arguments
202 ((#:make-flags flags)
203 #~(cons* "PYTHON=python3"
204 (string-append "PYTHONLIBDIR="
205 #$output
206 "/lib/python"
207 #$(version-major+minor (package-version python))
208 "/site-packages/")
209 #$flags))
210 ((#:phases phases)
211 #~(modify-phases #$phases
212 (delete 'portability)
213 (replace 'enter-dir
214 (lambda _ (chdir #$name)))
215 (add-before 'install 'adjust-semanage-conf-location
216 (lambda _
217 (substitute* "src/Makefile"
218 (("DEFAULT_SEMANAGE_CONF_LOCATION=/etc")
219 "DEFAULT_SEMANAGE_CONF_LOCATION=$(PREFIX)/etc"))))
220 (add-after 'build 'pywrap
221 (lambda* (#:key make-flags #:allow-other-keys)
222 (apply invoke "make" "pywrap" make-flags)))
223 (add-after 'install 'install-pywrap
224 (lambda* (#:key make-flags #:allow-other-keys)
225 (apply invoke "make" "install-pywrap" make-flags)))))))
226 (inputs
227 (list audit libsepol libselinux python-wrapper))
228 (native-inputs
229 (list bison flex pkg-config swig-4.0))
230 (synopsis "SELinux policy management libraries")
231 (description
232 "The libsemanage library provides an API for the manipulation of SELinux
233binary policies.")
234 (license license:lgpl2.1+)))
235
236(define-public secilc
237 (package/inherit libsepol
238 (name "secilc")
239 (arguments
240 (substitute-keyword-arguments arguments
241 ((#:phases phases)
242 #~(modify-phases #$phases
243 (delete 'portability)
244 (replace 'enter-dir
245 (lambda _ (chdir #$name)))))))
246 (inputs
247 (list libsepol))
248 (native-inputs
249 (list docbook-xml-4.2 docbook-xsl xmlto))
250 (synopsis "SELinux common intermediate language (CIL) compiler")
251 (description "The SELinux CIL compiler is a compiler that converts the
252@dfn{common intermediate language} (CIL) into a kernel binary policy file.")
253 (license license:bsd-2)))
254
255(define-public python-sepolgen
256 (package/inherit libsepol
257 (name "python-sepolgen")
258 (arguments
259 (substitute-keyword-arguments arguments
260 ((#:modules _ #~%default-gnu-modules)
261 '((srfi srfi-1)
262 (guix build gnu-build-system)
263 (guix build utils)))
264 ((#:phases phases)
265 #~(modify-phases #$phases
266 (delete 'portability)
267 (replace 'enter-dir
268 (lambda _ (chdir "python/sepolgen")))
269 ;; By default all Python files would be installed to
270 ;; $out/gnu/store/...-python-.../, so we override the
271 ;; PACKAGEDIR to fix this.
272 (add-after 'enter-dir 'fix-target-path
273 (lambda* (#:key inputs #:allow-other-keys)
274 (let ((get-python-version
275 (lambda (python)
276 (let* ((version (last (string-split python #\-)))
277 (components (string-split version #\.))
278 (major+minor (take components 2)))
279 (string-join major+minor "."))))
280 (python (dirname (dirname (search-input-file
281 inputs "bin/python3")))))
282 (substitute* "src/sepolgen/Makefile"
283 (("^PACKAGEDIR.*")
284 (string-append "PACKAGEDIR="
285 #$output
286 "/lib/python"
287 (get-python-version python)
288 "/site-packages/sepolgen")))
289 (substitute* "src/share/Makefile"
290 (("\\$\\(DESTDIR\\)") #$output)))))))))
291 (inputs
292 (list python-wrapper))
293 (native-inputs '())
294 (synopsis "Python module for generating SELinux policies")
295 (description
296 "This package contains a Python module that forms the core of
297@code{audit2allow}, a part of the package @code{policycoreutils}. The
298sepolgen library contains: Reference Policy Representation, which are Objects
299for representing policies and the reference policy interfaces. It has objects
300and algorithms for representing access and sets of access in an abstract way
301and searching that access. It also has a parser for reference policy
302\"headers\". It contains infrastructure for parsing SELinux related messages
303as produced by the audit system. It has facilities for generating policy
304based on required access.")
305 ;; GPLv2 only
306 (license license:gpl2)))
307
308(define-public python-setools
309 (package
310 (name "python-setools")
311 (version "4.5.0")
312 (source
313 (origin
314 (method git-fetch)
315 (uri (git-reference
316 (url "https://github.com/SELinuxProject/setools")
317 (commit version)))
318 (file-name (git-file-name name version))
319 (sha256
320 (base32 "0wm79r0lg0rk6dycf7kjp6gzmbykmq0g0qvz5cdqbwyf3n318bp3"))))
321 (build-system pyproject-build-system)
322 (arguments
323 (list
324 #:test-flags #~(list "tests")
325 #:phases
326 #~(modify-phases %standard-phases
327 (add-before 'build 'pre-build
328 (lambda* (#:key inputs #:allow-other-keys)
329 (setenv "SEPOL"
330 (search-input-file inputs "/lib/libsepol.a"))
331 ;; Tests assume /usr/bin/checkpolicy, override with
332 ;; CHECKPOLICY env variable.
333 (setenv "CHECKPOLICY"
334 (search-input-file inputs "/bin/checkpolicy"))))
335 (add-before 'check 'remove-local-source
336 (lambda _
337 (delete-file-recursively "setools"))))))
338 (native-inputs
339 (list bison
340 checkpolicy
341 flex
342 python-cython
343 python-pytest
344 python-pytest-qt
345 python-setuptools
346 swig-4.4))
347 (inputs
348 (list libsepol
349 libselinux
350 python-pyqt-6))
351 (propagated-inputs
352 (list python-networkx))
353 (home-page "https://github.com/SELinuxProject/setools")
354 (synopsis "Tools for SELinux policy analysis")
355 (description "SETools is a collection of graphical tools, command-line
356tools, and libraries designed to facilitate SELinux policy analysis.")
357 ;; Some programs are under GPL, all libraries under LGPL.
358 (license (list license:lgpl2.1+
359 license:gpl2+))))
360
361(define-public policycoreutils
362 (package/inherit libsepol
363 (name "policycoreutils")
364 (arguments
365 (list
366 #:test-target "test"
367 #:make-flags
368 #~(let ((out #$output))
369 (list (string-append "CC=" #$(cc-for-target))
370 (string-append "PREFIX=" out)
371 (string-append "LOCALEDIR=" out "/share/locale")
372 (string-append "BASHCOMPLETIONDIR=" out
373 "/share/bash-completion/completions")
374 "INSTALL=install -c -p"
375 "INSTALL_DIR=install -d"
376 ;; These ones are needed because some Makefiles define the
377 ;; directories relative to DESTDIR, not relative to PREFIX.
378 (string-append "SBINDIR=" out "/sbin")
379 (string-append "ETCDIR=" out "/etc")
380 (string-append "SYSCONFDIR=" out "/etc/sysconfig")
381 (string-append "MAN5DIR=" out "/share/man/man5")
382 (string-append "INSTALL_NLS_DIR=" out "/share/locale")
383 (string-append "AUTOSTARTDIR=" out "/etc/xdg/autostart")
384 (string-append "DBUSSERVICEDIR=" out "/share/dbus-1/services")
385 (string-append "SYSTEMDDIR=" out "/lib/systemd")
386 (string-append "INITDIR=" out "/etc/rc.d/init.d")
387 (string-append "SELINUXDIR=" out "/etc/selinux")))
388 #:phases
389 #~(modify-phases %standard-phases
390 (delete 'configure)
391 (add-after 'unpack 'enter-dir
392 (lambda _ (chdir #$name)))
393 (add-after 'enter-dir 'ignore-/usr-tests
394 (lambda* (#:key inputs #:allow-other-keys)
395 ;; Rewrite lookup paths for header files.
396 (substitute* '("newrole/Makefile"
397 "setfiles/Makefile"
398 "run_init/Makefile")
399 (("/usr(/include/security/pam_appl.h)" _ file)
400 (search-input-file inputs file))
401 (("/usr(/include/libaudit.h)" _ file)
402 (search-input-file inputs file))))))))
403 (inputs
404 (list audit
405 linux-pam
406 libsepol
407 libselinux
408 libsemanage
409 libxcrypt))
410 (native-inputs
411 (list gettext-minimal))
412 (synopsis "SELinux core utilities")
413 (description "The policycoreutils package contains the core utilities that
414are required for the basic operation of an SELinux-enabled GNU system and its
415policies. These utilities include @code{load_policy} to load policies,
416@code{setfiles} to label file systems, @code{newrole} to switch roles, and
417@code{run_init} to run service scripts in their proper context.")
418 (license license:gpl2+)))