Update buildroot 2020.02.01 (#622)

* Update buildroot 2020.02.01 Signed-off-by: Pascal Vizeli <pvizeli@syshack.ch> * Fix LN * Fix wpa Signed-off-by: Pascal Vizeli <pvizeli@syshack.ch> * Fix lint Signed-off-by: Pascal Vizeli <pvizeli@syshack.ch> * fix-network Signed-off-by: Pascal Vizeli <pvizeli@syshack.ch> * Fix script Signed-off-by: Pascal Vizeli <pvizeli@syshack.ch>
2020-04-16 20:03:01 +02:00
parent 0c2b5aff65
commit 5a6678147e
6201 changed files with 73436 additions and 70757 deletions
--- a/buildroot/package/libselinux/0002-revert-ln-relative.patch
+++ b/buildroot/package/libselinux/0002-revert-ln-relative.patch
@@ -1,26 +0,0 @@
-Makefile: revert libselinux: use ln --relative to create .so symlinks
-
-This reverts 71393a181d63c9baae5fe8dcaeb9411d1f253998
-
-ln --relative is too recent to be available in all distributions,
-especially enterprise-grade distros that can stick around as long as
-they are maintained (up to 10 years in some cases?).
-
-For the sake of Buildroot, revert the upstream patch.
-
-Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
-Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
-[Update for 2.8 (with assumption that SHLIBDIR=LIBDIR)]
-
-diff -durNw libselinux-2.7.orig/src/Makefile libselinux-2.7/src/Makefile
--- libselinux-2.7.orig/src/Makefile	2018-01-15 20:53:50.168525700 +0100
-+++ libselinux-2.7/src/Makefile	2018-01-15 20:55:27.061858005 +0100
-@@ -181,7 +181,7 @@
-	install -m 755 $(LIBSO) $(DESTDIR)$(SHLIBDIR)
-	test -d $(DESTDIR)$(LIBDIR)/pkgconfig || install -m 755 -d $(DESTDIR)$(LIBDIR)/pkgconfig
-	install -m 644 $(LIBPC) $(DESTDIR)$(LIBDIR)/pkgconfig
-	ln -sf --relative $(DESTDIR)$(SHLIBDIR)/$(LIBSO) $(DESTDIR)$(LIBDIR)/$(TARGET)
-+	cd $(DESTDIR)$(LIBDIR) && ln -sf $(LIBSO) $(TARGET)
- 
- install-pywrap: pywrap
-	test -d $(DESTDIR)$(PYTHONLIBDIR)/selinux || install -m 755 -d $(DESTDIR)$(PYTHONLIBDIR)/selinux
--- a/buildroot/package/libselinux/0003-Fix-build-break-around-__atomic_-with-GCC-4.7.patch
+++ b/buildroot/package/libselinux/0003-Fix-build-break-around-__atomic_-with-GCC-4.7.patch
@@ -1,70 +0,0 @@
-From abe76789f8e7ce61b357f693eaed5b28feab5ce2 Mon Sep 17 00:00:00 2001
-From: Hollis Blanchard <hollis_blanchard@mentor.com>
-Date: Mon, 13 Aug 2018 12:11:33 -0700
-Subject: [PATCH] Fix build break around __atomic_*() with GCC<4.7
-
-The __atomic_* GCC primitives were introduced in GCC 4.7, but Red Hat
-Enterprise Linux 6.x (for example) provides GCC 4.4. Tweak the current code to
-use the (most conservative) __sync_synchronize() primitive provided by those
-older GCC versions.
-
-(Really, no __atomic or __sync operations are needed here at all, since POSIX
-4.12 "Memory Synchronization" says pthread_mutex_lock() and
-pthread_mutex_unlock() "synchronize memory with respect to other threads"...)
-
-Signed-off-by: Hollis Blanchard <hollis_blanchard@mentor.com>
---
- src/label_file.h | 18 ++++++++++++++++++
- 1 file changed, 18 insertions(+)
-
-diff --git a/src/label_file.h b/src/label_file.h
-index 2fa85474..47859baf 100644
--- a/src/label_file.h
-+++ b/src/label_file.h
-@@ -351,8 +351,14 @@ static inline int compile_regex(struct saved_data *data, struct spec *spec,
- 	 * init_routine does not take a parameter, it's not possible
- 	 * to use, so we generate the same effect with atomics and a
- 	 * mutex */
-+#ifdef __ATOMIC_RELAXED
- 	regex_compiled =
- 		__atomic_load_n(&spec->regex_compiled, __ATOMIC_ACQUIRE);
-+#else
-+	/* GCC <4.7 */
-+	__sync_synchronize();
-+	regex_compiled = spec->regex_compiled;
-+#endif
- 	if (regex_compiled) {
- 		return 0; /* already done */
- 	}
-@@ -360,8 +366,14 @@ static inline int compile_regex(struct saved_data *data, struct spec *spec,
- 	__pthread_mutex_lock(&spec->regex_lock);
- 	/* Check if another thread compiled the regex while we waited
- 	 * on the mutex */
-+#ifdef __ATOMIC_RELAXED
- 	regex_compiled =
- 		__atomic_load_n(&spec->regex_compiled, __ATOMIC_ACQUIRE);
-+#else
-+	/* GCC <4.7 */
-+	__sync_synchronize();
-+	regex_compiled = spec->regex_compiled;
-+#endif
- 	if (regex_compiled) {
- 		__pthread_mutex_unlock(&spec->regex_lock);
- 		return 0;
-@@ -404,7 +416,13 @@ static inline int compile_regex(struct saved_data *data, struct spec *spec,
- 	}
- 
- 	/* Done. */
-+#ifdef __ATOMIC_RELAXED
- 	__atomic_store_n(&spec->regex_compiled, true, __ATOMIC_RELEASE);
-+#else
-+	/* GCC <4.7 */
-+	spec->regex_compiled = true;
-+	__sync_synchronize();
-+#endif
- 	__pthread_mutex_unlock(&spec->regex_lock);
- 	return 0;
- }
-- 
-2.13.0
-
--- a/buildroot/package/libselinux/0003-libselinux-Use-Python-distutils-to-install-SELinux-p.patch
+++ b/buildroot/package/libselinux/0003-libselinux-Use-Python-distutils-to-install-SELinux-p.patch
@@ -0,0 +1,207 @@
+From 89c296e7e9219f54c74f8c3f42940100cbcac962 Mon Sep 17 00:00:00 2001
+From: Petr Lautrbach <plautrba@redhat.com>
+Date: Fri, 7 Jun 2019 17:35:44 +0200
+Subject: [PATCH] libselinux: Use Python distutils to install SELinux python
+ bindings
+
+Follow officially documented way how to build C extension modules using
+distutils - https://docs.python.org/3.8/extending/building.html#building
+
+Fixes:
+
+- selinux python module fails to load when it's built using SWIG-4.0:
+
+>>> import selinux
+Traceback (most recent call last):
+  File "<stdin>", line 1, in <module>
+  File "/usr/lib64/python3.7/site-packages/selinux/__init__.py", line 13, in <module>
+    from . import _selinux
+ImportError: cannot import name '_selinux' from 'selinux' (/usr/lib64/python3.7/site-packages/selinux/__init__.py)
+
+SWIG-4.0 changed (again?) its behavior so that it uses: from . import _selinux
+which looks for _selinux module in the same directory as where __init__.py is -
+$(PYLIBDIR)/site-packages/selinux. But _selinux module is installed into
+$(PYLIBDIR)/site-packages/ since a9604c30a5e2f ("libselinux: Change the location
+of _selinux.so").
+
+- audit2why python module fails to build with Python 3.8
+
+cc -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -DOVERRIDE_GETTID=0 -I../include -D_GNU_SOURCE -DDISABLE_RPM -DNO_ANDROID_BACKEND -DUSE_PCRE2 -DPCRE2_CODE_UNIT_WIDTH=8  -Wl,-z,relro -Wl,--as-needed  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -L. -shared -o python-3.8audit2why.so python-3.8audit2why.lo -lselinux -l:libsepol.a  -Wl,-soname,audit2why.so,--version-script=audit2why.map,-z,defs
+/usr/bin/ld: python-3.8audit2why.lo: in function `finish':
+/builddir/build/BUILD/libselinux-2.9/src/audit2why.c:166: undefined reference to `PyArg_ParseTuple'
+/usr/bin/ld: python-3.8audit2why.lo: in function `_Py_INCREF':
+/usr/include/python3.8/object.h:449: undefined reference to `_Py_NoneStruct'
+/usr/bin/ld: /usr/include/python3.8/object.h:449: undefined reference to `_Py_NoneStruct'
+/usr/bin/ld: python-3.8audit2why.lo: in function `check_booleans':
+/builddir/build/BUILD/libselinux-2.9/src/audit2why.c:84: undefined reference to `PyExc_RuntimeError'
+...
+
+It's related to the following Python change
+https://docs.python.org/dev/whatsnew/3.8.html#debug-build-uses-the-same-abi-as-release-build
+
+Python distutils adds correct link options automatically.
+
+- selinux python module doesn't provide any Python metadata
+
+When selinux python module was built manually, it didn't provide any metadata.
+distutils takes care about that so that selinux Python module is visible for
+pip:
+
+$ pip3 list | grep selinux
+selinux              2.9
+
+Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
+[Upstream: commit 2efa06857575e4118e91ca250b6b92da68b130d5]
+Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+---
+ src/.gitignore |  2 +-
+ src/Makefile   | 36 ++++++++----------------------------
+ src/setup.py   | 24 ++++++++++++++++++++++++
+ 3 files changed, 33 insertions(+), 29 deletions(-)
+ create mode 100644 libselinux/src/setup.py
+
+diff --git a/src/.gitignore b/src/.gitignore
+index 4dcc3b3b..428afe5a 100644
+--- a/src/.gitignore
+++ b/src/.gitignore
+@@ -1,4 +1,4 @@
+ selinux.py
+-selinuxswig_wrap.c
+selinuxswig_python_wrap.c
+ selinuxswig_python_exception.i
+ selinuxswig_ruby_wrap.c
+diff --git a/src/Makefile b/src/Makefile
+index e9ed0383..2b1696a0 100644
+--- a/src/Makefile
+++ b/src/Makefile
+@@ -36,7 +36,7 @@ TARGET=libselinux.so
+ LIBPC=libselinux.pc
+ SWIGIF= selinuxswig_python.i selinuxswig_python_exception.i
+ SWIGRUBYIF= selinuxswig_ruby.i
+-SWIGCOUT= selinuxswig_wrap.c
+SWIGCOUT= selinuxswig_python_wrap.c
+ SWIGPYOUT= selinux.py
+ SWIGRUBYCOUT= selinuxswig_ruby_wrap.c
+ SWIGLOBJ:= $(patsubst %.c,$(PYPREFIX)%.lo,$(SWIGCOUT))
+@@ -55,7 +55,7 @@ ifeq ($(LIBSEPOLA),)
+         LDLIBS_LIBSEPOLA := -l:libsepol.a
+ endif
+ 
+-GENERATED=$(SWIGCOUT) $(SWIGRUBYCOUT) selinuxswig_python_exception.i
+GENERATED=$(SWIGCOUT) $(SWIGRUBYCOUT) $(SWIGCOUT) selinuxswig_python_exception.i
+ SRCS= $(filter-out $(GENERATED) audit2why.c, $(sort $(wildcard *.c)))
+ 
+ MAX_STACK_SIZE=32768
+@@ -125,25 +125,18 @@ DISABLE_FLAGS+= -DNO_ANDROID_BACKEND
+ SRCS:= $(filter-out label_backends_android.c, $(SRCS))
+ endif
+ 
+-SWIG = swig -Wall -python -o $(SWIGCOUT) -outdir ./ $(DISABLE_FLAGS)
+-
+ SWIGRUBY = swig -Wall -ruby -o $(SWIGRUBYCOUT) -outdir ./ $(DISABLE_FLAGS)
+ 
+ all: $(LIBA) $(LIBSO) $(LIBPC)
+ 
+-pywrap: all $(SWIGFILES) $(AUDIT2WHYSO)
+pywrap: all selinuxswig_python_exception.i
+	CFLAGS="$(CFLAGS) $(SWIG_CFLAGS)" $(PYTHON) setup.py build_ext -I $(DESTDIR)$(INCLUDEDIR) -L $(DESTDIR)$(LIBDIR)
+ 
+ rubywrap: all $(SWIGRUBYSO)
+ 
+-$(SWIGLOBJ): $(SWIGCOUT)
+-	$(CC) $(CFLAGS) $(SWIG_CFLAGS) $(PYINC) -fPIC -DSHARED -c -o $@ $<
+-
+ $(SWIGRUBYLOBJ): $(SWIGRUBYCOUT)
+ 	$(CC) $(CFLAGS) $(SWIG_CFLAGS) $(RUBYINC) -fPIC -DSHARED -c -o $@ $<
+ 
+-$(SWIGSO): $(SWIGLOBJ)
+-	$(CC) $(CFLAGS) $(LDFLAGS) -L. -shared -o $@ $< -lselinux $(PYLIBS)
+-
+ $(SWIGRUBYSO): $(SWIGRUBYLOBJ)
+ 	$(CC) $(CFLAGS) $(LDFLAGS) -L. -shared -o $@ $^ -lselinux $(RUBYLIBS)
+ 
+@@ -161,29 +154,15 @@ $(LIBPC): $(LIBPC).in ../VERSION
+ selinuxswig_python_exception.i: ../include/selinux/selinux.h
+ 	bash -e exception.sh > $@ || (rm -f $@ ; false)
+ 
+-$(AUDIT2WHYLOBJ): audit2why.c
+-	$(CC) $(filter-out -Werror, $(CFLAGS)) $(PYINC) -fPIC -DSHARED -c -o $@ $<
+-
+-$(AUDIT2WHYSO): $(AUDIT2WHYLOBJ) $(LIBSEPOLA)
+-	$(CC) $(CFLAGS) $(LDFLAGS) -L. -shared -o $@ $^ -lselinux $(LDLIBS_LIBSEPOLA) $(PYLIBS) -Wl,-soname,audit2why.so,--version-script=audit2why.map,-z,defs
+-
+ %.o:  %.c policy.h
+ 	$(CC) $(CFLAGS) $(TLSFLAGS) -c -o $@ $<
+ 
+ %.lo:  %.c policy.h
+ 	$(CC) $(CFLAGS) -fPIC -DSHARED -c -o $@ $<
+ 
+-$(SWIGCOUT): $(SWIGIF)
+-	$(SWIG) $<
+-
+-$(SWIGPYOUT): $(SWIGCOUT)
+-
+ $(SWIGRUBYCOUT): $(SWIGRUBYIF)
+ 	$(SWIGRUBY) $<
+ 
+-swigify: $(SWIGIF)
+-	$(SWIG) $<
+-
+ install: all 
+ 	test -d $(DESTDIR)$(LIBDIR) || install -m 755 -d $(DESTDIR)$(LIBDIR)
+ 	install -m 644 $(LIBA) $(DESTDIR)$(LIBDIR)
+@@ -194,10 +173,9 @@ install: all
+ 	ln -sf --relative $(DESTDIR)$(SHLIBDIR)/$(LIBSO) $(DESTDIR)$(LIBDIR)/$(TARGET)
+ 
+ install-pywrap: pywrap
+-	test -d $(DESTDIR)$(PYTHONLIBDIR)/selinux || install -m 755 -d $(DESTDIR)$(PYTHONLIBDIR)/selinux
+-	install -m 755 $(SWIGSO) $(DESTDIR)$(PYTHONLIBDIR)/_selinux$(PYCEXT)
+-	install -m 755 $(AUDIT2WHYSO) $(DESTDIR)$(PYTHONLIBDIR)/selinux/audit2why$(PYCEXT)
+	$(PYTHON) setup.py install --prefix=$(PREFIX) `test -n "$(DESTDIR)" && echo --root $(DESTDIR)`
+ 	install -m 644 $(SWIGPYOUT) $(DESTDIR)$(PYTHONLIBDIR)/selinux/__init__.py
+	ln -sf --relative $(DESTDIR)$(PYTHONLIBDIR)/selinux/_selinux$(PYCEXT) $(DESTDIR)$(PYTHONLIBDIR)/_selinux$(PYCEXT)
+ 
+ install-rubywrap: rubywrap
+ 	test -d $(DESTDIR)$(RUBYINSTALL) || install -m 755 -d $(DESTDIR)$(RUBYINSTALL) 
+@@ -208,6 +186,8 @@ relabel:
+ 
+ clean-pywrap:
+ 	-rm -f $(SWIGLOBJ) $(SWIGSO) $(AUDIT2WHYLOBJ) $(AUDIT2WHYSO)
+	$(PYTHON) setup.py clean
+	-rm -rf build *~ \#* *pyc .#*
+ 
+ clean-rubywrap:
+ 	-rm -f $(SWIGRUBYLOBJ) $(SWIGRUBYSO)
+diff --git a/src/setup.py b/src/setup.py
+new file mode 100644
+index 00000000..4dc03f55
+--- /dev/null
+++ b/src/setup.py
+@@ -0,0 +1,24 @@
+#!/usr/bin/python3
+
+from distutils.core import Extension, setup
+
+setup(
+    name="selinux",
+    version="2.9",
+    description="SELinux python 3 bindings",
+    author="SELinux Project",
+    author_email="selinux@vger.kernel.org",
+    ext_modules=[
+        Extension('selinux._selinux',
+                  sources=['selinuxswig_python.i'],
+                  include_dirs=['../include'],
+                  library_dirs=['.'],
+                  libraries=['selinux']),
+        Extension('selinux.audit2why',
+                  sources=['audit2why.c'],
+                  include_dirs=['../include'],
+                  library_dirs=['.'],
+                  libraries=['selinux'],
+                  extra_link_args=['-l:libsepol.a', '-Wl,--version-script=audit2why.map'])
+    ],
+)
+-- 
+2.21.0
+
--- a/buildroot/package/libselinux/0004-src-Makefile-don-t-pass-bogus-I-and-L-to-python-setu.patch
+++ b/buildroot/package/libselinux/0004-src-Makefile-don-t-pass-bogus-I-and-L-to-python-setu.patch
@@ -0,0 +1,34 @@
+From 4b1568bce5bbdc7bf76a4bbf1066ba7e7b84649f Mon Sep 17 00:00:00 2001
+From: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+Date: Fri, 25 Oct 2019 11:45:04 +0200
+Subject: [PATCH] src/Makefile: don't pass bogus -I and -L to python setup.py
+ build_ext
+
+Using $(DESTDIR) during the build does not follow the normal/standard
+semantic of DESTDIR: it is normally only needed during the
+installation. Therefore, a lot of build systems/environments don't
+pass any DESTDIR at build time, which causes setup.py to be called
+with -I /usr/include -L /usr/lib, which breaks cross-compilation.
+
+[Upstream: https://github.com/SELinuxProject/selinux/pull/183]
+Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+---
+ src/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/Makefile b/src/Makefile
+index 2b1696a0..3b8bad81 100644
+--- a/src/Makefile
+++ b/src/Makefile
+@@ -130,7 +130,7 @@ SWIGRUBY = swig -Wall -ruby -o $(SWIGRUBYCOUT) -outdir ./ $(DISABLE_FLAGS)
+ all: $(LIBA) $(LIBSO) $(LIBPC)
+ 
+ pywrap: all selinuxswig_python_exception.i
+-	CFLAGS="$(CFLAGS) $(SWIG_CFLAGS)" $(PYTHON) setup.py build_ext -I $(DESTDIR)$(INCLUDEDIR) -L $(DESTDIR)$(LIBDIR)
+	CFLAGS="$(CFLAGS) $(SWIG_CFLAGS)" $(PYTHON) setup.py build_ext
+ 
+ rubywrap: all $(SWIGRUBYSO)
+ 
+-- 
+2.21.0
+
--- a/buildroot/package/libselinux/0006-Do-not-use-PYCEXT-and-rely-on-the-installed-file-nam.patch
+++ b/buildroot/package/libselinux/0006-Do-not-use-PYCEXT-and-rely-on-the-installed-file-nam.patch
@@ -0,0 +1,47 @@
+From 0d4da8093bc2ef92b7c6f7fd1f4804f6ebc6cb56 Mon Sep 17 00:00:00 2001
+From: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+Date: Fri, 25 Oct 2019 13:37:14 +0200
+Subject: [PATCH] Do not use PYCEXT, and rely on the installed file name
+
+PYCEXT is computed by asking the Python intrepreter what is the
+file extension used for native Python modules.
+
+Unfortunately, when cross-compiling, the host Python doesn't give the
+proper result: it gives the result matching the build machine, and not
+the target machine. Due to this, the symlink has an incorrect name,
+and doesn't point to the .so file that was actually built/installed.
+
+To address this and keep things simple, this patch just changes the ln
+invocation to rely on the name of the _selinux*.so Python module that
+was installed.
+
+[Upstream: https://github.com/SELinuxProject/selinux/pull/184]
+Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+---
+ src/Makefile | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/src/Makefile b/src/Makefile
+index 799df2b0..95684ed7 100644
+--- a/src/Makefile
+++ b/src/Makefile
+@@ -15,7 +15,6 @@ INCLUDEDIR ?= $(PREFIX)/include
+ PYINC ?= $(shell $(PKG_CONFIG) --cflags $(PYPREFIX))
+ PYLIBS ?= $(shell $(PKG_CONFIG) --libs $(PYPREFIX))
+ PYTHONLIBDIR ?= $(shell $(PYTHON) -c "from distutils.sysconfig import *; print(get_python_lib(plat_specific=1, prefix='$(PREFIX)'))")
+-PYCEXT ?= $(shell $(PYTHON) -c 'import imp;print([s for s,m,t in imp.get_suffixes() if t == imp.C_EXTENSION][0])')
+ RUBYINC ?= $(shell $(RUBY) -e 'puts "-I" + RbConfig::CONFIG["rubyarchhdrdir"] + " -I" + RbConfig::CONFIG["rubyhdrdir"]')
+ RUBYLIBS ?= $(shell $(RUBY) -e 'puts "-L" + RbConfig::CONFIG["libdir"] + " -L" + RbConfig::CONFIG["archlibdir"] + " " + RbConfig::CONFIG["LIBRUBYARG_SHARED"]')
+ RUBYINSTALL ?= $(shell $(RUBY) -e 'puts RbConfig::CONFIG["vendorarchdir"]')
+@@ -175,7 +174,7 @@ install: all
+ install-pywrap: pywrap
+ 	$(PYTHON) setup.py install --prefix=$(PREFIX) `test -n "$(DESTDIR)" && echo --root $(DESTDIR)`
+ 	install -m 644 $(SWIGPYOUT) $(DESTDIR)$(PYTHONLIBDIR)/selinux/__init__.py
+-	ln -sf --relative $(DESTDIR)$(PYTHONLIBDIR)/selinux/_selinux$(PYCEXT) $(DESTDIR)$(PYTHONLIBDIR)/_selinux$(PYCEXT)
+	ln -sf --relative $(DESTDIR)$(PYTHONLIBDIR)/selinux/_selinux*.so $(DESTDIR)$(PYTHONLIBDIR)/
+ 
+ install-rubywrap: rubywrap
+ 	test -d $(DESTDIR)$(RUBYINSTALL) || install -m 755 -d $(DESTDIR)$(RUBYINSTALL) 
+-- 
+2.21.0
+
--- a/buildroot/package/libselinux/Config.in
+++ b/buildroot/package/libselinux/Config.in
@@ -2,12 +2,9 @@ config BR2_PACKAGE_LIBSELINUX
 	bool "libselinux"
 	depends on BR2_TOOLCHAIN_HAS_THREADS
 	depends on !BR2_STATIC_LIBS
-	# Uses <fts.h>, not available in musl or uClibc
-	depends on BR2_TOOLCHAIN_USES_GLIBC
-	# Toolchain issue: "fixup not contained within frag"
-	depends on !BR2_arc
 	select BR2_PACKAGE_LIBSEPOL
 	select BR2_PACKAGE_PCRE
+	select BR2_PACKAGE_MUSL_FTS if !BR2_TOOLCHAIN_USES_GLIBC
 	help
 	  libselinux is the runtime SELinux library that provides
 	  interfaces (e.g. library functions for the SELinux kernel
@@ -19,7 +16,5 @@ config BR2_PACKAGE_LIBSELINUX

 	  http://selinuxproject.org/page/Main_Page

-comment "libselinux needs a glibc toolchain w/ threads, dynamic library"
-	depends on !BR2_arc
-	depends on !BR2_TOOLCHAIN_HAS_THREADS || BR2_STATIC_LIBS || \
-		!BR2_TOOLCHAIN_USES_GLIBC
+comment "libselinux needs a toolchain w/ threads, dynamic library"
+	depends on !BR2_TOOLCHAIN_HAS_THREADS || BR2_STATIC_LIBS
--- a/buildroot/package/libselinux/libselinux.hash
+++ b/buildroot/package/libselinux/libselinux.hash
@@ -1,5 +1,5 @@
 # From: https://github.com/SELinuxProject/selinux/wiki/Releases
-sha256 31db96ec7643ce10912b3c3f98506a08a9116dcfe151855fd349c3fda96187e1 libselinux-2.8.tar.gz
+sha256 1bccc8873e449587d9a2b2cf253de9b89a8291b9fbc7c59393ca9e5f5f4d2693 libselinux-2.9.tar.gz

 # Hash for license file
 sha256 86657b4c0fe868d7cbd977cb04c63b6c667e08fa51595a7bc846ad4bed8fc364 LICENSE
--- a/buildroot/package/libselinux/libselinux.mk
+++ b/buildroot/package/libselinux/libselinux.mk
@@ -4,42 +4,41 @@
 #
 ################################################################################

-LIBSELINUX_VERSION = 2.8
-LIBSELINUX_SITE = https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20180524
+LIBSELINUX_VERSION = 2.9
+LIBSELINUX_SITE = https://github.com/SELinuxProject/selinux/releases/download/20190315
 LIBSELINUX_LICENSE = Public Domain
 LIBSELINUX_LICENSE_FILES = LICENSE

-LIBSELINUX_DEPENDENCIES = libsepol pcre
+LIBSELINUX_DEPENDENCIES = $(BR2_COREUTILS_HOST_DEPENDENCY) libsepol pcre

 LIBSELINUX_INSTALL_STAGING = YES

-# Filter out D_FILE_OFFSET_BITS=64. This fixes errors caused by glibc 2.22.
 # Set SHLIBDIR to /usr/lib so it has the same value than LIBDIR, as a result
 # we won't have to use a relative path in 0002-revert-ln-relative.patch
 LIBSELINUX_MAKE_OPTS = \
 	$(TARGET_CONFIGURE_OPTS) \
-	CFLAGS="$(filter-out -D_FILE_OFFSET_BITS=64,$(TARGET_CFLAGS))" \
-	LDFLAGS="$(TARGET_LDFLAGS) -lpcre -lpthread" \
 	ARCH=$(KERNEL_ARCH) \
 	SHLIBDIR=/usr/lib

 LIBSELINUX_MAKE_INSTALL_TARGETS = install

+ifeq ($(BR2_TOOLCHAIN_USES_GLIBC),)
+LIBSELINUX_DEPENDENCIES += musl-fts
+LIBSELINUX_MAKE_OPTS += FTS_LDLIBS=-lfts
+endif
+
 ifeq ($(BR2_PACKAGE_PYTHON)$(BR2_PACKAGE_PYTHON3),y)
 ifeq ($(BR2_PACKAGE_PYTHON3),y)
 LIBSELINUX_DEPENDENCIES += python3 host-swig
-LIBSELINUX_PYINC = -I$(STAGING_DIR)/usr/include/python$(PYTHON3_VERSION_MAJOR)m
 LIBSELINUX_PYLIBVER = python$(PYTHON3_VERSION_MAJOR)
 else ifeq ($(BR2_PACKAGE_PYTHON),y)
 LIBSELINUX_DEPENDENCIES += python host-swig
-LIBSELINUX_PYINC = -I$(STAGING_DIR)/usr/include/python$(PYTHON_VERSION_MAJOR)
 LIBSELINUX_PYLIBVER = python$(PYTHON_VERSION_MAJOR)
 endif

 LIBSELINUX_MAKE_OPTS += \
-	PYINC="$(LIBSELINUX_PYINC)" \
-	PYSITEDIR=$(TARGET_DIR)/usr/lib/$(LIBSELINUX_PYLIBVER)/site-packages \
-	SWIG_LIB="$(HOST_DIR)/share/swig/$(SWIG_VERSION)/"
+	$(PKG_PYTHON_DISTUTILS_ENV) \
+	PYTHON=$(LIBSELINUX_PYLIBVER)

 LIBSELINUX_MAKE_INSTALL_TARGETS += install-pywrap

@@ -52,6 +51,14 @@ define LIBSELINUX_BUILD_PYTHON_BINDINGS
 endef
 endif # python || python3

+# Filter out D_FILE_OFFSET_BITS=64. This fixes errors caused by glibc
+# 2.22. We set CFLAGS and LDFLAGS here because we want to win over the
+# CFLAGS/LDFLAGS definitions passed by $(PKG_PYTHON_DISTUTILS_ENV)
+# when the python binding is enabled.
+LIBSELINUX_MAKE_OPTS += \
+	CFLAGS="$(filter-out -D_FILE_OFFSET_BITS=64,$(TARGET_CFLAGS))" \
+	LDFLAGS="$(TARGET_LDFLAGS) -lpcre -lpthread"
+
 define LIBSELINUX_BUILD_CMDS
 	$(TARGET_MAKE_ENV) $(MAKE) -C $(@D) \
 		$(LIBSELINUX_MAKE_OPTS) all
@@ -66,7 +73,8 @@ endef

 define LIBSELINUX_INSTALL_TARGET_CMDS
 	$(TARGET_MAKE_ENV) $(MAKE) -C $(@D) \
-		$(LIBSELINUX_MAKE_OPTS) DESTDIR=$(TARGET_DIR) install
+		$(LIBSELINUX_MAKE_OPTS) DESTDIR=$(TARGET_DIR) \
+		$(LIBSELINUX_MAKE_INSTALL_TARGETS)
 	# Create the selinuxfs mount point
 	if [ ! -d "$(TARGET_DIR)/selinux" ]; then mkdir $(TARGET_DIR)/selinux; fi
 	if ! grep -q "selinuxfs" $(TARGET_DIR)/etc/fstab; then \
@@ -78,11 +86,9 @@ HOST_LIBSELINUX_DEPENDENCIES = \

 ifeq ($(BR2_PACKAGE_PYTHON3),y)
 HOST_LIBSELINUX_DEPENDENCIES += host-python3
-HOST_LIBSELINUX_PYINC = -I$(HOST_DIR)/include/python$(PYTHON3_VERSION_MAJOR)m/
 HOST_LIBSELINUX_PYLIBVER = python$(PYTHON3_VERSION_MAJOR)
 else
 HOST_LIBSELINUX_DEPENDENCIES += host-python
-HOST_LIBSELINUX_PYINC = -I$(HOST_DIR)/include/python$(PYTHON_VERSION_MAJOR)/
 HOST_LIBSELINUX_PYLIBVER = python$(PYTHON_VERSION_MAJOR)
 endif

@@ -91,9 +97,8 @@ HOST_LIBSELINUX_MAKE_OPTS = \
 	PREFIX=$(HOST_DIR) \
 	SHLIBDIR=$(HOST_DIR)/lib \
 	LDFLAGS="$(HOST_LDFLAGS) -lpcre -lpthread" \
-	PYINC="$(HOST_LIBSELINUX_PYINC)" \
-	PYSITEDIR="$(HOST_DIR)/lib/$(HOST_LIBSELINUX_PYLIBVER)/site-packages" \
-	SWIG_LIB="$(HOST_DIR)/share/swig/$(SWIG_VERSION)/"
+	$(HOST_PKG_PYTHON_DISTUTILS_ENV) \
+	PYTHON=$(HOST_LIBSELINUX_PYLIBVER)

 define HOST_LIBSELINUX_BUILD_CMDS
 	$(HOST_MAKE_ENV) $(MAKE1) -C $(@D) \