xserver: Branch 'server-1.7-nominations' - 5 commits

Eamon Walsh ewalsh at kemper.freedesktop.org
Tue Feb 23 15:35:48 PST 2010


 Xext/xselinux.c         |  131 +++++++++++++++---------------------------------
 Xext/xselinux.h         |    8 +-
 configure.ac            |   11 +---
 include/dix-config.h.in |    2 
 4 files changed, 48 insertions(+), 104 deletions(-)

New commits:
commit 1f96c0371845d5904b7d4c8fe71ee545b649faca
Author: Eamon Walsh <ewalsh at tycho.nsa.gov>
Date:   Wed Feb 3 15:40:47 2010 -0500

    xselinux: Bump extension minor version.
    
    Changes introduced in this version:
    	- 3 window-related requests now handle pixmaps also.
    
    Signed-off-by: Eamon Walsh <ewalsh at tycho.nsa.gov>
    Reviewed-by: Keith Packard <keithp at keithp.com>
    (cherry picked from commit db4f676f25c6d8e58263d5151942be730592d444)

diff --git a/Xext/xselinux.h b/Xext/xselinux.h
index 6fa66d3..69c2437 100644
--- a/Xext/xselinux.h
+++ b/Xext/xselinux.h
@@ -25,7 +25,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 /* Extension info */
 #define SELINUX_EXTENSION_NAME		"SELinux"
 #define SELINUX_MAJOR_VERSION		1
-#define SELINUX_MINOR_VERSION		0
+#define SELINUX_MINOR_VERSION		1
 #define SELinuxNumberEvents		0
 #define SELinuxNumberErrors		0
 
commit dd9573d4086ca24c59a99a0a2019bf20c61b0f64
Author: Eamon Walsh <ewalsh at tycho.nsa.gov>
Date:   Wed Feb 3 15:38:57 2010 -0500

    xselinux: Rename window-related requests that now support pixmaps.
    
    Renamed requests:
    	SetWindowCreateContext -> SetDrawableCreateContext
    	GetWindowCreateContext -> GetDrawableCreateContext
    	GetWindowContext -> GetDrawableContext
    
    Signed-off-by: Eamon Walsh <ewalsh at tycho.nsa.gov>
    Reviewed-by: Keith Packard <keithp at keithp.com>

diff --git a/Xext/xselinux.c b/Xext/xselinux.c
index a1c1b83..b6bf67c 100644
--- a/Xext/xselinux.c
+++ b/Xext/xselinux.c
@@ -1355,7 +1355,7 @@ ProcSELinuxGetDeviceContext(ClientPtr client)
 }
 
 static int
-ProcSELinuxGetWindowContext(ClientPtr client)
+ProcSELinuxGetDrawableContext(ClientPtr client)
 {
     DrawablePtr pDraw;
     PrivateRec **privatePtr;
@@ -1620,12 +1620,12 @@ ProcSELinuxDispatch(ClientPtr client)
 	return ProcSELinuxSetDeviceContext(client);
     case X_SELinuxGetDeviceContext:
 	return ProcSELinuxGetDeviceContext(client);
-    case X_SELinuxSetWindowCreateContext:
+    case X_SELinuxSetDrawableCreateContext:
 	return ProcSELinuxSetCreateContext(client, CTX_WIN);
-    case X_SELinuxGetWindowCreateContext:
+    case X_SELinuxGetDrawableCreateContext:
 	return ProcSELinuxGetCreateContext(client, CTX_WIN);
-    case X_SELinuxGetWindowContext:
-	return ProcSELinuxGetWindowContext(client);
+    case X_SELinuxGetDrawableContext:
+	return ProcSELinuxGetDrawableContext(client);
     case X_SELinuxSetPropertyCreateContext:
 	return ProcSELinuxSetCreateContext(client, CTX_PRP);
     case X_SELinuxGetPropertyCreateContext:
@@ -1708,14 +1708,14 @@ SProcSELinuxGetDeviceContext(ClientPtr client)
 }
 
 static int
-SProcSELinuxGetWindowContext(ClientPtr client)
+SProcSELinuxGetDrawableContext(ClientPtr client)
 {
     REQUEST(SELinuxGetContextReq);
     int n;
 
     REQUEST_SIZE_MATCH(SELinuxGetContextReq);
     swapl(&stuff->id, n);
-    return ProcSELinuxGetWindowContext(client);
+    return ProcSELinuxGetDrawableContext(client);
 }
 
 static int
@@ -1782,12 +1782,12 @@ SProcSELinuxDispatch(ClientPtr client)
 	return SProcSELinuxSetDeviceContext(client);
     case X_SELinuxGetDeviceContext:
 	return SProcSELinuxGetDeviceContext(client);
-    case X_SELinuxSetWindowCreateContext:
+    case X_SELinuxSetDrawableCreateContext:
 	return SProcSELinuxSetCreateContext(client, CTX_WIN);
-    case X_SELinuxGetWindowCreateContext:
+    case X_SELinuxGetDrawableCreateContext:
 	return ProcSELinuxGetCreateContext(client, CTX_WIN);
-    case X_SELinuxGetWindowContext:
-	return SProcSELinuxGetWindowContext(client);
+    case X_SELinuxGetDrawableContext:
+	return SProcSELinuxGetDrawableContext(client);
     case X_SELinuxSetPropertyCreateContext:
 	return SProcSELinuxSetCreateContext(client, CTX_PRP);
     case X_SELinuxGetPropertyCreateContext:
diff --git a/Xext/xselinux.h b/Xext/xselinux.h
index fef207a..6fa66d3 100644
--- a/Xext/xselinux.h
+++ b/Xext/xselinux.h
@@ -35,9 +35,9 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #define X_SELinuxGetDeviceCreateContext		2
 #define X_SELinuxSetDeviceContext		3
 #define X_SELinuxGetDeviceContext		4
-#define X_SELinuxSetWindowCreateContext		5
-#define X_SELinuxGetWindowCreateContext		6
-#define X_SELinuxGetWindowContext		7
+#define X_SELinuxSetDrawableCreateContext	5
+#define X_SELinuxGetDrawableCreateContext	6
+#define X_SELinuxGetDrawableContext		7
 #define X_SELinuxSetPropertyCreateContext	8
 #define X_SELinuxGetPropertyCreateContext	9
 #define X_SELinuxSetPropertyUseContext		10
commit 7cec236a03917841131941ce97bd1dfd4a027327
Author: Eamon Walsh <ewalsh at tycho.nsa.gov>
Date:   Wed Feb 3 15:08:40 2010 -0500

    xselinux: Allow GetWindowContext to be used for pixmaps as well.
    
    Signed-off-by: Eamon Walsh <ewalsh at tycho.nsa.gov>
    Reviewed-by: Keith Packard <keithp at keithp.com>

diff --git a/Xext/xselinux.c b/Xext/xselinux.c
index 4382c21..a1c1b83 100644
--- a/Xext/xselinux.c
+++ b/Xext/xselinux.c
@@ -1357,18 +1357,26 @@ ProcSELinuxGetDeviceContext(ClientPtr client)
 static int
 ProcSELinuxGetWindowContext(ClientPtr client)
 {
-    WindowPtr pWin;
+    DrawablePtr pDraw;
+    PrivateRec **privatePtr;
     SELinuxObjectRec *obj;
     int rc;
 
     REQUEST(SELinuxGetContextReq);
     REQUEST_SIZE_MATCH(SELinuxGetContextReq);
 
-    rc = dixLookupWindow(&pWin, stuff->id, client, DixGetAttrAccess);
+    rc = dixLookupDrawable(&pDraw, stuff->id, client,
+			   M_WINDOW | M_DRAWABLE_PIXMAP,
+			   DixGetAttrAccess);
     if (rc != Success)
 	return rc;
 
-    obj = dixLookupPrivate(&pWin->devPrivates, objectKey);
+    if (pDraw->type == M_DRAWABLE_PIXMAP)
+	privatePtr = &((PixmapPtr)pDraw)->devPrivates;
+    else
+	privatePtr = &((WindowPtr)pDraw)->devPrivates;
+
+    obj = dixLookupPrivate(privatePtr, objectKey);
     return SELinuxSendContextReply(client, obj->sid);
 }
 
commit 1b6f498b84de7f79de735b004b8e16b9a31d228c
Author: Eamon Walsh <ewalsh at tycho.nsa.gov>
Date:   Wed Jan 6 12:52:51 2010 -0500

    xselinux: Remove reference counting calls for SID objects.
    
    Starting with libselinux 2.0.86, SID objects are no longer
    reference counted and the sidput() and sidget() calls are no-ops.
    
    Signed-off-by: Eamon Walsh <ewalsh at tycho.nsa.gov>
    Reviewed-by: Keith Packard <keithp at keithp.com>

diff --git a/Xext/xselinux.c b/Xext/xselinux.c
index 60a18d1..4382c21 100644
--- a/Xext/xselinux.c
+++ b/Xext/xselinux.c
@@ -112,9 +112,6 @@ typedef struct {
 /* labeling handle */
 static struct selabel_handle *label_hnd;
 
-/* whether AVC is active */
-static int avc_active;
-
 /* atoms for window label properties */
 static Atom atom_ctx;
 static Atom atom_client_ctx;
@@ -238,20 +235,17 @@ SELinuxSelectionToSID(Atom selection, SELinuxSubjectRec *subj,
 
     /* Check for an override context next */
     if (subj->sel_use_sid) {
-	sidget(tsid = subj->sel_use_sid);
+	tsid = subj->sel_use_sid;
 	goto out;
     }
 
-    sidget(tsid = obj->sid);
+    tsid = obj->sid;
 
     /* Polyinstantiate if necessary to obtain the final SID */
-    if (obj->poly) {
-	sidput(tsid);
-	if (avc_compute_member(subj->sid, obj->sid,
-			       SECCLASS_X_SELECTION, &tsid) < 0) {
-	    ErrorF("SELinux: a compute_member call failed!\n");
-	    return BadValue;
-	}
+    if (obj->poly && avc_compute_member(subj->sid, obj->sid,
+					SECCLASS_X_SELECTION, &tsid) < 0) {
+	ErrorF("SELinux: a compute_member call failed!\n");
+	return BadValue;
     }
 out:
     *sid_rtn = tsid;
@@ -278,7 +272,7 @@ SELinuxPropertyToSID(Atom property, SELinuxSubjectRec *subj,
 
     /* Check for an override context next */
     if (subj->prp_use_sid) {
-	sidget(tsid = subj->prp_use_sid);
+	tsid = subj->prp_use_sid;
 	goto out;
     }
 
@@ -295,10 +289,8 @@ SELinuxPropertyToSID(Atom property, SELinuxSubjectRec *subj,
 	if (avc_compute_member(subj->sid, tsid2,
 			       SECCLASS_X_PROPERTY, &tsid) < 0) {
 	    ErrorF("SELinux: a compute_member call failed!\n");
-	    sidput(tsid2);
 	    return BadValue;
 	}
-	sidput(tsid2);
     }
 out:
     *sid_rtn = tsid;
@@ -438,9 +430,7 @@ SELinuxLabelClient(ClientPtr client)
     security_context_t ctx;
 
     subj = dixLookupPrivate(&client->devPrivates, subjectKey);
-    sidput(subj->sid);
     obj = dixLookupPrivate(&client->devPrivates, objectKey);
-    sidput(obj->sid);
 
     /* Try to get a context from the socket */
     if (fd < 0 || getpeercon_raw(fd, &ctx) < 0) {
@@ -484,7 +474,7 @@ finish:
 	FatalError("SELinux: client %d: context_to_sid_raw(%s) failed\n",
 		   client->index, ctx);
 
-    sidget(obj->sid = subj->sid);
+    obj->sid = subj->sid;
     freecon(ctx);
 }
 
@@ -505,7 +495,6 @@ SELinuxLabelInitial(void)
     subj = dixLookupPrivate(&serverClient->devPrivates, subjectKey);
     obj = dixLookupPrivate(&serverClient->devPrivates, objectKey);
     subj->privileged = 1;
-    sidput(subj->sid);
 
     /* Use the context of the X server process for the serverClient */
     if (getcon_raw(&ctx) < 0)
@@ -515,7 +504,7 @@ SELinuxLabelInitial(void)
     if (avc_context_to_sid_raw(ctx, &subj->sid) < 0)
 	FatalError("SELinux: serverClient: context_to_sid(%s) failed\n", ctx);
 
-    sidget(obj->sid = subj->sid);
+    obj->sid = subj->sid;
     freecon(ctx);
 
     srec.client = serverClient;
@@ -545,7 +534,7 @@ SELinuxLabelResource(XaceResourceAccessRec *rec, SELinuxSubjectRec *subj,
 
     /* Check for a create context */
     if (rec->rtype & RC_DRAWABLE && subj->win_create_sid) {
-	sidget(obj->sid = subj->win_create_sid);
+	obj->sid = subj->win_create_sid;
 	return Success;
     }
 
@@ -673,17 +662,14 @@ SELinuxDevice(CallbackListPtr *pcbl, pointer unused, pointer calldata)
 	SELinuxSubjectRec *dsubj;
 	dsubj = dixLookupPrivate(&rec->dev->devPrivates, subjectKey);
 
-	sidput(dsubj->sid);
-	sidput(obj->sid);
-
 	if (subj->dev_create_sid) {
 	    /* Label the device with the create context */
-	    sidget(obj->sid = subj->dev_create_sid);
-	    sidget(dsubj->sid = subj->dev_create_sid);
+	    obj->sid = subj->dev_create_sid;
+	    dsubj->sid = subj->dev_create_sid;
 	} else {
 	    /* Label the device directly with the process SID */
-	    sidget(obj->sid = subj->sid);
-	    sidget(dsubj->sid = subj->sid);
+	    obj->sid = subj->sid;
+	    dsubj->sid = subj->sid;
 	}
     }
 
@@ -807,8 +793,6 @@ SELinuxExtension(CallbackListPtr *pcbl, pointer unused, pointer calldata)
 	    return;
 	}
 
-	sidput(obj->sid);
-
 	/* Perform a transition to obtain the final SID */
 	if (avc_compute_create(serv->sid, sid, SECCLASS_X_EXTENSION,
 			       &obj->sid) < 0) {
@@ -846,7 +830,6 @@ SELinuxSelection(CallbackListPtr *pcbl, pointer unused, pointer calldata)
 
     /* If this is a new object that needs labeling, do it now */
     if (access_mode & DixCreateAccess) {
-	sidput(obj->sid);
 	rc = SELinuxSelectionToSID(name, subj, &obj->sid, &obj->poly);
 	if (rc != Success)
 	    obj->sid = unlabeled_sid;
@@ -864,7 +847,6 @@ SELinuxSelection(CallbackListPtr *pcbl, pointer unused, pointer calldata)
 		break;
 	    obj = dixLookupPrivate(&pSel->devPrivates, objectKey);
 	}
-	sidput(tsid);
 	
 	if (pSel)
 	    *rec->ppSel = pSel;
@@ -883,11 +865,10 @@ SELinuxSelection(CallbackListPtr *pcbl, pointer unused, pointer calldata)
     /* Label the content (advisory only) */
     if (access_mode & DixSetAttrAccess) {
 	data = dixLookupPrivate(&pSel->devPrivates, dataKey);
-	sidput(data->sid);
 	if (subj->sel_create_sid)
-	    sidget(data->sid = subj->sel_create_sid);
+	    data->sid = subj->sel_create_sid;
 	else
-	    sidget(data->sid = obj->sid);
+	    data->sid = obj->sid;
     }
 }
 
@@ -912,7 +893,6 @@ SELinuxProperty(CallbackListPtr *pcbl, pointer unused, pointer calldata)
 
     /* If this is a new object that needs labeling, do it now */
     if (rec->access_mode & DixCreateAccess) {
-	sidput(obj->sid);
 	rc = SELinuxPropertyToSID(name, subj, &obj->sid, &obj->poly);
 	if (rc != Success) {
 	    rec->status = rc;
@@ -931,7 +911,6 @@ SELinuxProperty(CallbackListPtr *pcbl, pointer unused, pointer calldata)
 		break;
 	    obj = dixLookupPrivate(&pProp->devPrivates, objectKey);
 	}
-	sidput(tsid);
 
 	if (pProp)
 	    *rec->ppProp = pProp;
@@ -950,11 +929,10 @@ SELinuxProperty(CallbackListPtr *pcbl, pointer unused, pointer calldata)
     /* Label the content (advisory only) */
     if (rec->access_mode & DixWriteAccess) {
 	data = dixLookupPrivate(&pProp->devPrivates, dataKey);
-	sidput(data->sid);
 	if (subj->prp_create_sid)
-	    sidget(data->sid = subj->prp_create_sid);
+	    data->sid = subj->prp_create_sid;
 	else
-	    sidget(data->sid = obj->sid);
+	    data->sid = obj->sid;
     }
 }
 
@@ -1031,8 +1009,6 @@ SELinuxScreen(CallbackListPtr *pcbl, pointer is_saver, pointer calldata)
 
     /* If this is a new object that needs labeling, do it now */
     if (access_mode & DixCreateAccess) {
-	sidput(obj->sid);
-
 	/* Perform a transition to obtain the final SID */
 	if (avc_compute_create(subj->sid, subj->sid, SECCLASS_X_SCREEN,
 			       &obj->sid) < 0) {
@@ -1164,7 +1140,6 @@ SELinuxSubjectInit(CallbackListPtr *pcbl, pointer unused, pointer calldata)
     PrivateCallbackRec *rec = calldata;
     SELinuxSubjectRec *subj = *rec->value;
 
-    sidget(unlabeled_sid);
     subj->sid = unlabeled_sid;
 
     avc_entry_ref_init(&subj->aeref);
@@ -1177,14 +1152,6 @@ SELinuxSubjectFree(CallbackListPtr *pcbl, pointer unused, pointer calldata)
     SELinuxSubjectRec *subj = *rec->value;
 
     xfree(subj->command);
-
-    if (avc_active) {
-	sidput(subj->sid);
-	sidput(subj->dev_create_sid);
-	sidput(subj->win_create_sid);
-	sidput(subj->sel_create_sid);
-	sidput(subj->prp_create_sid);
-    }
 }
 
 static void
@@ -1193,20 +1160,9 @@ SELinuxObjectInit(CallbackListPtr *pcbl, pointer unused, pointer calldata)
     PrivateCallbackRec *rec = calldata;
     SELinuxObjectRec *obj = *rec->value;
 
-    sidget(unlabeled_sid);
     obj->sid = unlabeled_sid;
 }
 
-static void
-SELinuxObjectFree(CallbackListPtr *pcbl, pointer unused, pointer calldata)
-{
-    PrivateCallbackRec *rec = calldata;
-    SELinuxObjectRec *obj = *rec->value;
-
-    if (avc_active)
-	sidput(obj->sid);
-}
-
 
 /*
  * Extension Dispatch
@@ -1310,7 +1266,6 @@ ProcSELinuxSetCreateContext(ClientPtr client, unsigned offset)
 
     ptr = dixLookupPrivate(privPtr, subjectKey);
     pSid = (security_id_t *)(ptr + offset);
-    sidput(*pSid);
     *pSid = NULL;
 
     rc = Success;
@@ -1371,11 +1326,9 @@ ProcSELinuxSetDeviceContext(ClientPtr client)
     }
 
     subj = dixLookupPrivate(&dev->devPrivates, subjectKey);
-    sidput(subj->sid);
     subj->sid = sid;
     obj = dixLookupPrivate(&dev->devPrivates, objectKey);
-    sidput(obj->sid);
-    sidget(obj->sid = sid);
+    obj->sid = sid;
 
     rc = Success;
 out:
@@ -1912,7 +1865,6 @@ SELinuxResetProc(ExtensionEntry *extEntry)
     RemoveGeneralSocket(netlink_fd);
 
     avc_destroy();
-    avc_active = 0;
 
     /* Free local state */
     xfree(knownAtoms);
@@ -1981,7 +1933,6 @@ SELinuxExtensionInit(INITARGS)
 
     if (avc_open(&avc_option, 1) < 0)
 	FatalError("SELinux: Couldn't initialize SELinux userspace AVC\n");
-    avc_active = 1;
 
     label_hnd = selabel_open(SELABEL_CTX_X, &selabel_option, 1);
     if (!label_hnd)
@@ -2021,9 +1972,7 @@ SELinuxExtensionInit(INITARGS)
     ret &= dixRegisterPrivateInitFunc(subjectKey, SELinuxSubjectInit, NULL);
     ret &= dixRegisterPrivateDeleteFunc(subjectKey, SELinuxSubjectFree, NULL);
     ret &= dixRegisterPrivateInitFunc(objectKey, SELinuxObjectInit, NULL);
-    ret &= dixRegisterPrivateDeleteFunc(objectKey, SELinuxObjectFree, NULL);
     ret &= dixRegisterPrivateInitFunc(dataKey, SELinuxObjectInit, NULL);
-    ret &= dixRegisterPrivateDeleteFunc(dataKey, SELinuxObjectFree, NULL);
 
     ret &= AddCallback(&ClientStateCallback, SELinuxClientState, NULL);
     ret &= AddCallback(&ResourceStateCallback, SELinuxResourceState, NULL);
commit c030ec32b6418e6258b380c0e29971be882a84d4
Author: Eamon Walsh <ewalsh at tycho.nsa.gov>
Date:   Wed Oct 21 19:28:26 2009 -0400

    libselinux now has a pkgconfig file.  Use it.
    
    Also remove HAVE_NETLINK_AVC_ACQUIRE_FD tests, because we now
    require a version of libselinux that has it.
    
    Signed-off-by: Eamon Walsh <ewalsh at tycho.nsa.gov>
    Reviewed-by: Keith Packard <keithp at keithp.com>

diff --git a/Xext/xselinux.c b/Xext/xselinux.c
index a047a00..60a18d1 100644
--- a/Xext/xselinux.c
+++ b/Xext/xselinux.c
@@ -1862,7 +1862,6 @@ SProcSELinuxDispatch(ClientPtr client)
     }
 }
 
-#ifdef HAVE_AVC_NETLINK_ACQUIRE_FD
 static int netlink_fd;
 
 static void
@@ -1876,7 +1875,6 @@ SELinuxWakeupHandler(void *data, int err, void *read_mask)
     if (FD_ISSET(netlink_fd, (fd_set *)read_mask))
         avc_netlink_check_nb();
 }
-#endif
 
 
 /*
@@ -1908,12 +1906,10 @@ SELinuxResetProc(ExtensionEntry *extEntry)
     label_hnd = NULL;
 
     audit_close(audit_fd);
-#ifdef HAVE_AVC_NETLINK_ACQUIRE_FD
     avc_netlink_release_fd();
     RemoveBlockAndWakeupHandlers(SELinuxBlockHandler, SELinuxWakeupHandler,
                                  NULL);
     RemoveGeneralSocket(netlink_fd);
-#endif
 
     avc_destroy();
     avc_active = 0;
@@ -2016,12 +2012,10 @@ SELinuxExtensionInit(INITARGS)
     if (atom_client_ctx == BAD_RESOURCE)
 	FatalError("SELinux: Failed to create atom\n");
 
-#ifdef HAVE_AVC_NETLINK_ACQUIRE_FD
     netlink_fd = avc_netlink_acquire_fd();
     AddGeneralSocket(netlink_fd);
     RegisterBlockAndWakeupHandlers(SELinuxBlockHandler, SELinuxWakeupHandler,
                                    NULL);
-#endif
 
     /* Register callbacks */
     ret &= dixRegisterPrivateInitFunc(subjectKey, SELinuxSubjectInit, NULL);
diff --git a/configure.ac b/configure.ac
index 8cb9048..558de87 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1012,16 +1012,11 @@ if test "x$XSELINUX" = xyes; then
 	if test "x$XACE" != xyes; then
 		AC_MSG_ERROR([cannot build SELinux extension without X-ACE])
 	fi
-	AC_CHECK_HEADERS([selinux/selinux.h selinux/avc.h], [], AC_MSG_ERROR([SELinux include files not found]))
-	AC_CHECK_LIB(selinux, avc_init, [], AC_MSG_ERROR([SELinux library not found])) 
 	AC_CHECK_HEADERS([libaudit.h], [], AC_MSG_ERROR([SELinux extension requires audit system headers]))
 	AC_CHECK_LIB(audit, audit_open, [], AC_MSG_ERROR([SELinux extension requires audit system library]))
-        AC_CHECK_DECL(avc_netlink_acquire_fd,
-                      [AC_DEFINE(HAVE_AVC_NETLINK_ACQUIRE_FD, 1, "Have avc_netlink_acquire_fd")],
-                      [],
-                      [#include <selinux/avc.h>])
+	PKG_CHECK_MODULES([SELINUX], [libselinux >= 2.0.86])
+	SELINUX_LIBS="$SELINUX_LIBS -laudit"
 	AC_DEFINE(XSELINUX, 1, [Build SELinux extension])
-	SELINUX_LIB="-lselinux -laudit"
 fi
 
 AM_CONDITIONAL(XCSECURITY, [test "x$XCSECURITY" = xyes])
@@ -1483,7 +1478,7 @@ if test "x$XORG" = xyes; then
 	AC_CHECK_FUNCS([pci_device_vgaarb_init])
 	LIBS=$SAVE_LIBS
 	CFLAGS=$SAVE_CFLAGS
-	XORG_SYS_LIBS="$XORG_SYS_LIBS $PCIACCESS_LIBS $DLOPEN_LIBS $GLX_SYS_LIBS $SELINUX_LIB"
+	XORG_SYS_LIBS="$XORG_SYS_LIBS $PCIACCESS_LIBS $DLOPEN_LIBS $GLX_SYS_LIBS $SELINUX_LIBS"
 	XORG_CFLAGS="$XORG_CFLAGS $PCIACCESS_CFLAGS"
 
 	case $host_os in
diff --git a/include/dix-config.h.in b/include/dix-config.h.in
index 798d9e7..6e450b6 100644
--- a/include/dix-config.h.in
+++ b/include/dix-config.h.in
@@ -431,6 +431,4 @@
 #include "dix-config-apple-verbatim.h"
 #endif
 
-#undef HAVE_AVC_NETLINK_ACQUIRE_FD
-
 #endif /* _DIX_CONFIG_H_ */


More information about the xorg-commit mailing list