# libselinux-1.34 fails to build

## Growlizing

Hey.

Been using gentoo as a router, but with no enhanced security. So I figured I'd try to change that. Yesterday I started off and was planning on enabling alot of security all the way from the start (did a fresh install with a stage3-hardened). Compiled a new hardened kernel with lots of the selinux/pax/grsecurity stuff (been trying to read some about them, but not 100% sure how they will work on my comp). When the time came, I changed profile to 

```

lrwxrwxrwx 1 root root 49 Jun 21 20:35 /etc/make.profile -> /usr/portage/profiles/selinux/2007.0/x86/hardened

```

And thought this was going great, compared to that I've never done selinux or real security on gentoo. Still haven't installed a lot of programs - only the basics, like cron, logrotate (<-- I've learned before that this is utterly important not to forget xD), syslog, dhcpcd, grub. Now when I try to compile libselinux, it fails:

```

matchpathcon.lo: In function `set_matchpathcon_flags':

matchpathcon.c:(.text+0x2ac): undefined reference to `___tls_get_addr'

matchpathcon.lo: In function `.L148':

matchpathcon.c:(.text+0xcf1): undefined reference to `___tls_get_addr'

matchpathcon.lo: In function `matchpathcon_init_prefix_internal':

matchpathcon.c:(.text+0x10ab): undefined reference to `___tls_get_addr'

matchpathcon.lo: In function `matchpathcon':

matchpathcon.c:(.text+0x1bfb): undefined reference to `___tls_get_addr'

matchpathcon.lo: In function `selinux_file_context_verify':

matchpathcon.c:(.text+0x1fd4): undefined reference to `___tls_get_addr'

matchpathcon.lo:matchpathcon.c:(.text+0x2105): more undefined references to `___tls_get_addr' follow

collect2: ld returned 1 exit status

make[1]: *** [libselinux.so.1] Error 1

make[1]: Leaving directory `/var/tmp/portage/sys-libs/libselinux-1.34.0/work/libselinux-1.34.0/src'

make: *** [all] Error 2

!!! ERROR: sys-libs/libselinux-1.34.0 failed.

Call stack:

  ebuild.sh, line 1615:   Called dyn_compile

  ebuild.sh, line 972:   Called qa_call 'src_compile'

  ebuild.sh, line 44:   Called src_compile

  libselinux-1.34.0.ebuild, line 38:   Called die

```

Is there something I've missed? Do I need to change profile to the 2005.1? Is there anything I've done wrong, should check or similar? Anyone with tips in general?  :Razz: 

When trying to emerge a earlier version of libselinux, it says it's masked by profile, so it didn't seem like a too great idea to unmask it.

----------

## Hu

What is the output of emerge --info?

The TLS name suggests it may be related to thread-local storage, so knowing your USE flags and glibc version may prove helpful.  That said, I have never seen this error, and probably cannot solve your problem even with this information.  Someone more familiar with the new SELinux profiles probably can, once the extra information is available.

----------

## Growlizing

emerge --info:

```

Portage 2.1.2.7 (selinux/2007.0/x86/hardened, gcc-3.4.6, glibc-2.3.6-r5, 2.6.20-hardened-r5 i686)

=================================================================

System uname: 2.6.20-hardened-r5 i686 Pentium II (Deschutes)

Gentoo Base System release 1.12.9

Timestamp of tree: Thu, 21 Jun 2007 21:50:01 +0000

dev-lang/python:     2.4.4-r4

dev-python/pycrypto: 2.0.1-r5

sys-apps/sandbox:    1.2.17

sys-devel/autoconf:  2.60

sys-devel/automake:  1.9.6-r2, 1.10

sys-devel/binutils:  2.16.1-r3

sys-devel/gcc-config: 1.3.16

sys-devel/libtool:   1.5.22

virtual/os-headers:  2.6.17-r2

ACCEPT_KEYWORDS="x86"

AUTOCLEAN="yes"

CBUILD="i686-pc-linux-gnu"

CFLAGS="-mtune=i686 -O2 -pipe -fforce-addr -march=i686"

CHOST="i686-pc-linux-gnu"

CONFIG_PROTECT="/etc"

CONFIG_PROTECT_MASK="/etc/env.d /etc/gconf /etc/revdep-rebuild /etc/terminfo"

CXXFLAGS="-mtune=i686 -O2 -pipe -fforce-addr -march=i686"

DISTDIR="/usr/portage/distfiles"

FEATURES="distlocks loadpolicy metadata-transfer sandbox selinux sesandbox sfperms strict"

GENTOO_MIRRORS="http://mirror.gentoo.no/ "

MAKEOPTS="-j2"

PKGDIR="/usr/portage/packages"

PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --filter=H_**/files/digest-*"

PORTAGE_TMPDIR="/var/tmp"

PORTDIR="/usr/portage"

SYNC="rsync://rsync.europe.gentoo.org/gentoo-portage"

USE="berkdb bitmap-fonts cli cracklib crypt cups dri fortran gdbm gpm hardened iconv ipv6 isdnlog libg++ midi mudflap ncurses nls nptl nptlonly openmp pam pcre perl pic pppd python readline reflection selinux session spl ssl tcpd truetype-fonts type1-fonts unicode x86 xorg zlib" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1 emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mulaw multi null plug rate route share shm softvol" ELIBC="glibc" INPUT_DEVICES="keyboard mouse" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" USERLAND="GNU" VIDEO_CARDS="apm ark chips cirrus cyrix dummy fbdev glint i128 i740 i810 imstt mach64 mga neomagic nsc nv r128 radeon rendition s3 s3virge savage siliconmotion sis sisusb tdfx tga trident tseng v4l vesa vga via voodoo"

Unset:  CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, LDFLAGS, LINGUAS, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, PORTDIR_OVERLAY
```

Edit:

Have tried with and without my custom useflags, which are:

USE="-X -kde -gnome -gtk -qt -alsa -jack mysql php -apache -apache2 mmx hardened pic selinux"

----------

## Growlizing

Bump.

Anyone?

----------

## Hu

I had hoped someone familiar with the new SELinux profiles would spot this and give you an well informed answer.  Lacking that, I will make an educated guess based on the names of the missing functions that a newer glibc is required.  This is a guess, so it may well not solve your problem.  Try emerging a sys-devel/glibc from the 2.5 series and let us know the results.

Given the importance of glibc, I recommend creating a system backup and/or bootable CD before you proceed.  Also, if glibc is masked for your profile, do not unmask it.  Packages get masked for a good reason and merging a masked core package is just asking for trouble, in my opinion.

----------

## Growlizing

Ok. Will try. Haven't unmasked a single package, and not using keywords for any packages at all. It's a completely fresh install. Also, I have already re-emerged glibc since the initial install. Can do it once more though.

Edit:

As the libselinux-package (which doesn't compile), is listed as a dep for emerging a new glibc, I'm trying to rebuild the whole system (emerge -e world)). Reporting back tomorrow, even though I doubt this slow-ass comp is finished by then. =)

----------

## R. Bosch

Do you use stage3-hardened?

What I noticed was, that glibc Won't compile wih selinux support.

At the stage where you're about to revamp glibc, run `emerge -av glibc` and selinux has an unwelcome dash  :Sad: 

I'm trying to install selinux aswell, but run in a policy problem. They're loaded, but won't work.

So ,you might also check this problem while you're at it  :Wink: 

You can use the script and compare notes. Note that I have my portage tree at /media/portage for easy access.

----------

## Growlizing

Hmm:

```

emerge -va glibc

These are the packages that would be merged, in order:

Calculating dependencies... done!

[ebuild  N    ] sys-libs/libselinux-1.34.0  123 kB

[ebuild     U ] sys-libs/glibc-2.5-r3 [2.3.6-r5] USE="nls nptl* nptlonly* (selinux*) -build -debug% -glibc-compat20 -glibc-omitfp (-hardened*) (-multilib) -profile (-erandom%)" 16,223 kB

Total: 2 packages (1 upgrade, 1 new), Size of downloads: 16,345 kB

```

-hardened and selinux*? I guess the first rebuild/upgrade of glibc I tried didn't finish xD

Edit:

Yes, I used stage3-hardened.

----------

## Hu

A note in several of the older SELinux package.mask files explains the problem:

```
# Shouldn't be merging these SELinux packages on this profile

# but this keeps repoman happy since they require >=glibc-2.4

# 20061009 pebenito

```

=sys-libs/glibc-2.5-r3 is only marked as requiring sys-libs/libselinux, but does not specify a version.  You may be able to get past this by installing an older version of libselinux (which I hope will build against your older glibc), then building the new glibc (which should be satisfied once you have libselinux at all), then upgrading libselinux (just for the sake of being up-to-date).  If you want to try this, run emerge --oneshot '<sys-libs/libselinux-1.34.0' to install an older version.

Another possibility would be to USE=-selinux emerge glibc (which will not require libselinux), then emerge libselinux, then re-emerge glibc with USE=selinux.

----------

## Growlizing

From /usr/portage/profiles/selinux/2007.0/packages:

```

# SELinux required versionings

>=sys-libs/libsepol-1.16.3

>=sys-libs/libselinux-1.34.0

>=sys-libs/libsemanage-1.10.0

>=sys-apps/policycoreutils-1.34.1

>=sys-apps/checkpolicy-1.34.0

>=sec-policy/selinux-base-policy-20070329

# appropriate version with multiple inheritance

>=sys-apps/portage-2.1.2

# Critical xattr fixes:

>=sys-boot/grub-0.94

>=sys-boot/grub-static-0.94

##############################################################################

```

So I guess I shouldn't try emerging an older version, as it is masked by profile:

```

emerge --oneshot '<sys-libs/libselinux-1.34.0'

```

Can/should you try to override profile-set useflags?

```

USE=-selinux emerge -va glibc

These are the packages that would be merged, in order:

Calculating dependencies... done!

[ebuild  N    ] sys-libs/libselinux-1.34.0  0 kB

[ebuild     U ] sys-libs/glibc-2.5-r3 [2.3.6-r5] USE="nls nptl* nptlonly* (selinux*) -build -debug% -glibc-compat20 -glibc-omitfp (-hardened*) (-multilib) -profile (-erandom%)" 16,223 kB

```

Maybe I really should change profile, emerge new glibc, then go back to the selinux profile? Would that make libselinux compile anyway?

I'll try changing profile to hardened first, if that doesn't work, I'll just try the regular desktop-profile one.

----------

## R. Bosch

Tried the following in a standard stage3-hardened-2.6-2007.0:Updated glibc with profile hardenedCompiled libselinux (successfully)Switched profile from hardened/x86/2.6 to selinux/2007.0/x86/hardenedRecompiled glibc. This still showed selinux/-hardened    :Confused: 

```
ReboliLaptop etc # emerge glibc -av

These are the packages that would be merged, in order:

Calculating dependencies... done!

[ebuild   R   ] sys-libs/glibc-2.5-r3  USE="nls nptl nptlonly (selinux) -build

-debug -glibc-compat20 -glibc-omitfp (-hardened) (-multilib) -profile" 0 kB 

Total: 1 package (1 reinstall), Size of downloads: 0 kB
```

No.  :Sad: 

Selinux and hardened don't go. period IMHO.

A quick read in the ebuild shows nothing (to me) that would indicate a forced -hardened.

If nothing shows here, I'll file A bug if someone doesn't beat me to the punch  :Wink: 

----------

## Growlizing

Recompiled glibc yesterday (took all day xD).

Changed profile to just hardened/x86.

emerge -va glibc - Let it finish  :Wink: 

Changed profile to selinux/2007.0/....

Libselinux-1.34.0 now compiles.

Will continue the install of selinux today or over the weekend.

----------

## R. Bosch

 *Growlizing wrote:*   

> Recompiled glibc yesterday (took all day xD).Changed profile to just hardened/x86.
> 
> emerge -va glibc - Let it finish 
> 
> Changed profile to selinux/2007.0/....
> ...

 Hmmmm....  Looks *very* formiliar.... Look at the reply above yours, Growlizing  :Wink: . I tested various possibilities all morning  :Sad: 

I think you still won't be able to compile the glibc with both selinux *and* hardened support....

Hope you have more success finding the cause than I had.

----------

## Growlizing

Yeah, it's almost the same, only I compiled libselinux _after_ changing to the selinux profile. You compiled while using just the hardened profile. I tried that, but the package was masked, and just tried changing profile back, and it compiled.

And you're right. Glibc still doesn't want to compile with both selinux and hardened use-flags.

----------

## R. Bosch

I had more luck with this profile:

```
/usr/portage/profiles/selinux/2005.1/x86/hardened
```

  :Very Happy: 

```
ReboliLaptop / # emerge glibc -pv

These are the packages that would be merged, in order:

Calculating dependencies... done!

[ebuild  N    ] sys-libs/libsepol-1.12-r1  0 kB

[ebuild  N    ] sys-libs/libselinux-1.30  0 kB

[ebuild   R   ] sys-libs/glibc-2.5-r3  USE="hardened (selinux*) -build -debug

-glibc-compat20 -glibc-omitfp (-multilib) -nls* -nptl* -nptlonly -profile" 0

kB

Total: 3 packages (2 new, 1 reinstall), Size of downloads: 0 kB
```

Not sure how to classify this. Back to the stone-age or the gold-old-times where all works as it should   :Rolling Eyes: 

This is after building glibc in hardened profile first. Then I switched profile. The one that is two years old!

See if it solves an other problem that I'm working on.

----------

