[apparmor] [patch] fix python LibAppArmor import failures with swig > 3.0.8

[Christian Boltz]

Hello,

Am Mittwoch, 14. September 2016, 12:41:33 CEST schrieb Steve Beattie:
> On Wed, Sep 14, 2016 at 02:12:35PM -0500, Tyler Hicks wrote:
> > On 09/14/2016 01:52 PM, Christian Boltz wrote:
> > > renaming LibAppArmor.py to __init__.py breaks the import path
> > > calculation in swig (> 3.0.8)-generated python code, leading to an
> > > error message saying
> > > 
> > >     No module named '_LibAppArmor'
> > > 
> > > Therefore this patch drops renaming the file. To stay compatible
> > > with the> > 
> > >     import LibAppArmor.$function_name
> > > 
> > > syntax, add an __init__.py that does
> > > 
> > >     from LibAppArmor.LibAppArmor import *
> > > 
> > > References: https://bugzilla.opensuse.org/show_bug.cgi?id=987607
> > > 
> > > 
> > > Also adjust .bzrignore for this change.
> > > 
> > > 
> > > 
> > > I propose this patch for trunk and 2.10.
> > > I'm undecided about 2.9 - technically it shares this bug, but I'd
> > > expect that 2.9 users don't use the latest swig ;-) - opinions?
> 
> Ugh, I *really* don't like the 'from LibAppArmor.LibAppArmor import *'
> bit.

Do you have a better solution? ;-)

I asked about this on the swig-user mailinglist some weeks ago, and this 
was the best solution I received. Actually it's the only solution I 
received (besides some more general answers, documentation pointers 
etc.). An interesting detail is that I received this solution off-list 
for whatever reason.


My patch has a big advantage: it works ;-) (and it's already in 
Tumbleweed and Leap 42.2 beta to un-break the aa-* tools)

An alternative option would be to patch the swig-generated python code 
(so that it looks for LibAppArmor._LibAppArmor, not _LibAppArmor), but 
that's clearly worse than an "import *" ;-)


Oh, and another detail might be interesting (and at the same time funny, 
given that Fedora uses SELinux by default ;-)

    PS Fedora now runs all the projects that invoke SWIG during the   
    build when we make new SWIG releases. Can you get apparmor added as 
    a Fedora project and ensure it depends on SWIG, then it'll get 
    tested whenever we release.

> > Acked-by: Tyler Hicks <tyhicks at canonical.com>
> > 
> > Please apply to 2.9, as well. IIRC, this is one of the errors I hit
> > when I run `make check` on the utils/ dir from Ubuntu 16.04 (with
> > swig 3.0.8-0ubuntu3) development machine so it'd be nice if that's
> > fixed in all of our stable branches. Thanks for fixing it!
> 
> Bleah, swig 3.0.8 is seriously broken. It's requiring that the
> _LibAppArmor.so be a globally visible module/shared library, rather
> than being hidden in LibAppArmor._LibAppArmor.

Well, yes and no ;-)

The problem is that it now calculates the import path based on the 
module name, and by renaming LibAppArmor.py to __init__.py, we change 
the module name from LibAppArmor.LibAppArmor to just LibAppArmor. That's 
the name we want - but it also means that swig searches for _LibAppArmor 
instead of LibAppArmor._LibAppArmor.

I'd argue we have to take half of the blaming for renaming 
LibAppArmor.py to __init__.py ;-)  (without that "strange" rename, 
everything works).

For more details, you might want to spend some minutes to read
https://bugzilla.opensuse.org/show_bug.cgi?id=987607 ;-)

> > > Note: you'll need to cleanup your
> > > libraries/libapparmor/swig/python/
> > > directory manually before applying this patch ("make clean" isn't
> > > enough, so check "bzr ignored"), and regenerate the autogenerated
> > > files with autogen.sh and configure afterwards.
> > > 
> > > If there's a "superclean" make target I missed, please tell me ;-)
> 
> make maintainer-clean, I believe (but it's only supported by the
> libapparmor subdirectory).

# make maintainer-clean
...
# bzr ignored | awkcol 1
libraries/libapparmor/Makefile.in
libraries/libapparmor/aclocal.m4
libraries/libapparmor/compile
libraries/libapparmor/config.guess
libraries/libapparmor/config.sub
libraries/libapparmor/configure
libraries/libapparmor/depcomp
libraries/libapparmor/doc/Makefile.in
libraries/libapparmor/include/Makefile.in
libraries/libapparmor/include/sys/Makefile.in
libraries/libapparmor/install-sh
libraries/libapparmor/ltmain.sh
libraries/libapparmor/missing
libraries/libapparmor/src/Makefile.in
libraries/libapparmor/src/scanner.c
libraries/libapparmor/swig/Makefile.in
libraries/libapparmor/swig/perl/Makefile.in
libraries/libapparmor/swig/perl/Makefile.perle
libraries/libapparmor/swig/python/Makefile.in          <----------
libraries/libapparmor/swig/python/test/Makefile.in
libraries/libapparmor/swig/ruby/Makefile.in
libraries/libapparmor/test-driver
libraries/libapparmor/testsuite/Makefile.in
libraries/libapparmor/testsuite/config/Makefile.in
libraries/libapparmor/testsuite/lib/Makefile.in
libraries/libapparmor/testsuite/libaalogparse.test/Makefile.in
libraries/libapparmor/ylwrap

So it cleans up a lot, but not everything.

Needless to say that .../swig/python/Makefile.in contains code from 
Makefile.am and needs to be updated ;-)


Regards,

Christian Boltz
-- 
I would pay to see the fight between the author of pulse-audio and the
author of systemd over what to do here, ;-)
[Morten Welinder in https://bugzilla.novell.com/show_bug.cgi?id=739438]
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 801 bytes
Desc: This is a digitally signed message part.
URL: <https://lists.ubuntu.com/archives/apparmor/attachments/20160914/e9cb638d/attachment.pgp>