(PA-4844) Patch the autogenerated selinux C extension #620

joshcooper · 2023-01-20T00:39:42Z

Calling into selinux from Ruby 3.2 generates a warning:

selinux.so: warning: undefining the allocator of T_DATA class swig_runtime_data

This is because ruby 3.2 requires C extensions to "either use rb_define_alloc_func() to overwrite it or rb_undef_alloc_func() to delete it."[1] The selinux C extension selinuxswig_ruby_wrap.c is autogenerated by swig from the selinuxswig_i template.

swig 4.1.1 contains the fix for this[2] but we are using an older version on RHEL7. So patch the autogenerated C extension, which needs to happen after the code is generated and before it's compiled.

[1] https://github.com/ruby/ruby/blob/6963f8f743b42f9004a0879cd66c550f18987352/doc/extension.rdoc#label-Write+the+C+Code
[2] swig/swig@962f090

Calling into selinux from Ruby 3.2 generates a warning: selinux.so: warning: undefining the allocator of T_DATA class swig_runtime_data This is because ruby 3.2 requires C extensions to "either use rb_define_alloc_func() to overwrite it or rb_undef_alloc_func() to delete it."[1] The selinux C extension selinuxswig_ruby_wrap.c is autogenerated by swig from the selinuxswig_i template. swig 4.1.1 contains the fix for this[2] but we are using an older version on RHEL7. So patch the autogenerated C extension, which needs to happen after the code is generated and before it's compiled. [1] https://github.com/ruby/ruby/blob/6963f8f743b42f9004a0879cd66c550f18987352/doc/extension.rdoc#label-Write+the+C+Code [2] swig/swig@962f090

joshcooper · 2023-01-20T00:40:39Z

I built this manually and verified it doesn't generate the error we were seeing in https://tickets.puppetlabs.com/browse/PA-4844

[root@asocial-reef ~]# openssl sha1 /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/3.2.0/x86_64-linux/selinux.so
SHA1(/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/3.2.0/x86_64-linux/selinux.so)= a3dee1c0b0914dad0d6ae4afa62d72d0fd757b7d
[root@asocial-reef ~]# /opt/puppetlabs/puppet/bin/puppet apply -e 'notice($facts["ruby"])'
Notice: Scope(Class[main]): {platform => x86_64-linux, sitedir => /opt/puppetlabs/puppet/lib/ruby/site_ruby/3.2.0, version => 3.2.0}

github-actions · 2023-01-20T00:40:58Z

⚠️ DISCLAIMER

This task is still experimental, it can be invoked locally provided that development dependencies are installed (bundle install --with development).

Ensure all your local changes are committed, then run bundle exec rake vanagon:component_diff -- [options].

Run the task with --help to see all available options. If you notice unexpected behavior or want to suggest improvements, ping #prod-puppet-agent on Slack.

Here is what your code changes would affect:

Project `agent-runtime-main`

Platform name: `el-8-x86_64`

Component 'ruby-selinux'

Field: build[0][6]

+ /usr/bin/patch --strip=0 --fuzz=0 --ignore-whitespace --no-backup-if-mismatch < ../selinuxswig_ruby_wrap.patch

Field: sources[0]

+ {"url"=>"file://resources/patches/ruby-selinux/selinuxswig_ruby_wrap.patch"}

Platform name: `el-7-ppc64`

Component 'ruby-selinux'

Field: build[0][6]

+ /usr/bin/patch --strip=0 --fuzz=0 --ignore-whitespace --no-backup-if-mismatch < ../selinuxswig_ruby_wrap.patch

Field: sources[0]

+ {"url"=>"file://resources/patches/ruby-selinux/selinuxswig_ruby_wrap.patch"}

Platform name: `debian-10-armhf`

Component 'ruby-selinux'

Field: build[0][6]

+ /usr/bin/patch --strip=0 --fuzz=0 --ignore-whitespace --no-backup-if-mismatch < ../selinuxswig_ruby_wrap.patch

Field: sources[0]

+ {"url"=>"file://resources/patches/ruby-selinux/selinuxswig_ruby_wrap.patch"}

Platform name: `redhatfips-7-x86_64`

Component 'ruby-selinux'

Field: build[0][6]

+ /usr/bin/patch --strip=0 --fuzz=0 --ignore-whitespace --no-backup-if-mismatch < ../selinuxswig_ruby_wrap.patch

Field: sources[0]

+ {"url"=>"file://resources/patches/ruby-selinux/selinuxswig_ruby_wrap.patch"}

Platform name: `fedora-36-x86_64`

Component 'ruby-selinux'

Field: build[0][6]

+ /usr/bin/patch --strip=0 --fuzz=0 --ignore-whitespace --no-backup-if-mismatch < ../selinuxswig_ruby_wrap.patch

Field: sources[0]

+ {"url"=>"file://resources/patches/ruby-selinux/selinuxswig_ruby_wrap.patch"}

Platform name: `ubuntu-22.04-amd64`

Component 'ruby-selinux'

Field: build[0][6]

+ /usr/bin/patch --strip=0 --fuzz=0 --ignore-whitespace --no-backup-if-mismatch < ../selinuxswig_ruby_wrap.patch

Field: sources[0]

+ {"url"=>"file://resources/patches/ruby-selinux/selinuxswig_ruby_wrap.patch"}

Platform name: `ubuntu-18.04-aarch64`

Component 'ruby-selinux'

Field: build[0][6]

+ /usr/bin/patch --strip=0 --fuzz=0 --ignore-whitespace --no-backup-if-mismatch < ../selinuxswig_ruby_wrap.patch

Field: sources[0]

+ {"url"=>"file://resources/patches/ruby-selinux/selinuxswig_ruby_wrap.patch"}

Platform name: `el-8-ppc64le`

Component 'ruby-selinux'

Field: build[0][6]

+ /usr/bin/patch --strip=0 --fuzz=0 --ignore-whitespace --no-backup-if-mismatch < ../selinuxswig_ruby_wrap.patch

Field: sources[0]

+ {"url"=>"file://resources/patches/ruby-selinux/selinuxswig_ruby_wrap.patch"}

Platform name: `debian-11-amd64`

Component 'ruby-selinux'

Field: build[0][6]

+ /usr/bin/patch --strip=0 --fuzz=0 --ignore-whitespace --no-backup-if-mismatch < ../selinuxswig_ruby_wrap.patch

Field: sources[0]

+ {"url"=>"file://resources/patches/ruby-selinux/selinuxswig_ruby_wrap.patch"}

Platform name: `el-9-x86_64`

Component 'ruby-selinux'

Field: build[0][6]

+ /usr/bin/patch --strip=0 --fuzz=0 --ignore-whitespace --no-backup-if-mismatch < ../selinuxswig_ruby_wrap.patch

Field: sources[0]

+ {"url"=>"file://resources/patches/ruby-selinux/selinuxswig_ruby_wrap.patch"}

Platform name: `ubuntu-20.04-aarch64`

Component 'ruby-selinux'

Field: build[0][6]

+ /usr/bin/patch --strip=0 --fuzz=0 --ignore-whitespace --no-backup-if-mismatch < ../selinuxswig_ruby_wrap.patch

Field: sources[0]

+ {"url"=>"file://resources/patches/ruby-selinux/selinuxswig_ruby_wrap.patch"}

Platform name: `el-6-i386`

Component 'ruby-selinux'

Field: build[0][6]

+ /usr/bin/patch --strip=0 --fuzz=0 --ignore-whitespace --no-backup-if-mismatch < ../selinuxswig_ruby_wrap.patch

Field: sources[0]

+ {"url"=>"file://resources/patches/ruby-selinux/selinuxswig_ruby_wrap.patch"}

Platform name: `ubuntu-20.04-amd64`

Component 'ruby-selinux'

Field: build[0][6]

+ /usr/bin/patch --strip=0 --fuzz=0 --ignore-whitespace --no-backup-if-mismatch < ../selinuxswig_ruby_wrap.patch

Field: sources[0]

+ {"url"=>"file://resources/patches/ruby-selinux/selinuxswig_ruby_wrap.patch"}

Platform name: `debian-10-amd64`

Component 'ruby-selinux'

Field: build[0][6]

+ /usr/bin/patch --strip=0 --fuzz=0 --ignore-whitespace --no-backup-if-mismatch < ../selinuxswig_ruby_wrap.patch

Field: sources[0]

+ {"url"=>"file://resources/patches/ruby-selinux/selinuxswig_ruby_wrap.patch"}

Platform name: `el-7-ppc64le`

Component 'ruby-selinux'

Field: build[0][6]

+ /usr/bin/patch --strip=0 --fuzz=0 --ignore-whitespace --no-backup-if-mismatch < ../selinuxswig_ruby_wrap.patch

Field: sources[0]

+ {"url"=>"file://resources/patches/ruby-selinux/selinuxswig_ruby_wrap.patch"}

Platform name: `debian-11-armhf`

Component 'ruby-selinux'

Field: build[0][6]

+ /usr/bin/patch --strip=0 --fuzz=0 --ignore-whitespace --no-backup-if-mismatch < ../selinuxswig_ruby_wrap.patch

Field: sources[0]

+ {"url"=>"file://resources/patches/ruby-selinux/selinuxswig_ruby_wrap.patch"}

Platform name: `ubuntu-22.04-aarch64`

Component 'ruby-selinux'

Field: build[0][6]

+ /usr/bin/patch --strip=0 --fuzz=0 --ignore-whitespace --no-backup-if-mismatch < ../selinuxswig_ruby_wrap.patch

Field: sources[0]

+ {"url"=>"file://resources/patches/ruby-selinux/selinuxswig_ruby_wrap.patch"}

Platform name: `el-7-aarch64`

Component 'ruby-selinux'

Field: build[0][6]

+ /usr/bin/patch --strip=0 --fuzz=0 --ignore-whitespace --no-backup-if-mismatch < ../selinuxswig_ruby_wrap.patch

Field: sources[0]

+ {"url"=>"file://resources/patches/ruby-selinux/selinuxswig_ruby_wrap.patch"}

Platform name: `el-8-aarch64`

Component 'ruby-selinux'

Field: build[0][6]

+ /usr/bin/patch --strip=0 --fuzz=0 --ignore-whitespace --no-backup-if-mismatch < ../selinuxswig_ruby_wrap.patch

Field: sources[0]

+ {"url"=>"file://resources/patches/ruby-selinux/selinuxswig_ruby_wrap.patch"}

Platform name: `ubuntu-18.04-amd64`

Component 'ruby-selinux'

Field: build[0][6]

+ /usr/bin/patch --strip=0 --fuzz=0 --ignore-whitespace --no-backup-if-mismatch < ../selinuxswig_ruby_wrap.patch

Field: sources[0]

+ {"url"=>"file://resources/patches/ruby-selinux/selinuxswig_ruby_wrap.patch"}

Platform name: `el-7-x86_64`

Component 'ruby-selinux'

Field: build[0][6]

+ /usr/bin/patch --strip=0 --fuzz=0 --ignore-whitespace --no-backup-if-mismatch < ../selinuxswig_ruby_wrap.patch

Field: sources[0]

+ {"url"=>"file://resources/patches/ruby-selinux/selinuxswig_ruby_wrap.patch"}

Platform name: `redhatfips-8-x86_64`

Component 'ruby-selinux'

Field: build[0][6]

+ /usr/bin/patch --strip=0 --fuzz=0 --ignore-whitespace --no-backup-if-mismatch < ../selinuxswig_ruby_wrap.patch

Field: sources[0]

+ {"url"=>"file://resources/patches/ruby-selinux/selinuxswig_ruby_wrap.patch"}

Platform name: `el-6-x86_64`

Component 'ruby-selinux'

Field: build[0][6]

+ /usr/bin/patch --strip=0 --fuzz=0 --ignore-whitespace --no-backup-if-mismatch < ../selinuxswig_ruby_wrap.patch

Field: sources[0]

+ {"url"=>"file://resources/patches/ruby-selinux/selinuxswig_ruby_wrap.patch"}

This issue is very similar to PA-4844 (puppetlabs#620) except it affects augeas instead of selinux When puppet is run with Ruby 3.2, this warning is generated: `/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/augeas.rb:48: warning: undefining the allocator of T_DATA class Augeas` This commit patches the autogenerated augeas C extension so there is no warning for augeas

After puppetlabs/puppet#9349 was merged the warning: undefining the allocator of T_DATA class SWIG::TYPE_p_selabel_handle error popped up again on RHEL-8 x86_64. We ran into this previously and thought puppetlabs#620 fixed it completely. This issue was completely fixed in swig 4.2.0+. This commit patches selinuxswig_ruby_wrap.c with swig/swig@aa21014 and is applied after the patch from puppetlabs#620 since the fix in swig/swig@aa21014 came after.

joshcooper requested review from a team as code owners January 20, 2023 00:39

mhashizume approved these changes Jan 20, 2023

View reviewed changes

mhashizume merged commit 6aa7d2e into puppetlabs:master Jan 20, 2023

AriaXLi mentioned this pull request May 15, 2023

(PA-5430) Patch augeas C extension #667

Merged

joshcooper mentioned this pull request Jun 7, 2024

(PUP-7126) Use selabel_lookup instead of matchpathcon puppetlabs/puppet#9349

Merged

joshcooper deleted the swig_selinux_4844 branch June 7, 2024 17:31

AriaXLi mentioned this pull request Jun 12, 2024

(PA-6549) Fix warning:undefining the allocator of T_DATA class #860

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

(PA-4844) Patch the autogenerated selinux C extension #620

(PA-4844) Patch the autogenerated selinux C extension #620

joshcooper commented Jan 20, 2023

joshcooper commented Jan 20, 2023

github-actions bot commented Jan 20, 2023

(PA-4844) Patch the autogenerated selinux C extension #620

(PA-4844) Patch the autogenerated selinux C extension #620

Conversation

joshcooper commented Jan 20, 2023

joshcooper commented Jan 20, 2023

github-actions bot commented Jan 20, 2023

⚠️ DISCLAIMER

Here is what your code changes would affect:

Project agent-runtime-main

Platform name: el-8-x86_64

Platform name: el-7-ppc64

Platform name: debian-10-armhf

Platform name: redhatfips-7-x86_64

Platform name: fedora-36-x86_64

Platform name: ubuntu-22.04-amd64

Platform name: ubuntu-18.04-aarch64

Platform name: el-8-ppc64le

Platform name: debian-11-amd64

Platform name: el-9-x86_64

Platform name: ubuntu-20.04-aarch64

Platform name: el-6-i386

Platform name: ubuntu-20.04-amd64

Platform name: debian-10-amd64

Platform name: el-7-ppc64le

Platform name: debian-11-armhf

Platform name: ubuntu-22.04-aarch64

Platform name: el-7-aarch64

Platform name: el-8-aarch64

Platform name: ubuntu-18.04-amd64

Platform name: el-7-x86_64

Platform name: redhatfips-8-x86_64

Platform name: el-6-x86_64

Project `agent-runtime-main`

Platform name: `el-8-x86_64`

Platform name: `el-7-ppc64`

Platform name: `debian-10-armhf`

Platform name: `redhatfips-7-x86_64`

Platform name: `fedora-36-x86_64`

Platform name: `ubuntu-22.04-amd64`

Platform name: `ubuntu-18.04-aarch64`

Platform name: `el-8-ppc64le`

Platform name: `debian-11-amd64`

Platform name: `el-9-x86_64`

Platform name: `ubuntu-20.04-aarch64`

Platform name: `el-6-i386`

Platform name: `ubuntu-20.04-amd64`

Platform name: `debian-10-amd64`

Platform name: `el-7-ppc64le`

Platform name: `debian-11-armhf`

Platform name: `ubuntu-22.04-aarch64`

Platform name: `el-7-aarch64`

Platform name: `el-8-aarch64`

Platform name: `ubuntu-18.04-amd64`

Platform name: `el-7-x86_64`

Platform name: `redhatfips-8-x86_64`

Platform name: `el-6-x86_64`