Re: [XEN PATCH] xen: allow XSM_FLASK_POLICY only if checkpolicy binary is available

[Anthony PERARD <anthony.perard@xxxxxxxxxx>]

On Fri, Jul 16, 2021 at 04:26:39PM +0100, George Dunlap wrote:
> 
> 
> > On Jul 14, 2021, at 5:17 PM, Anthony PERARD <anthony.perard@xxxxxxxxxx> 
> > wrote:
> > 
> > This will help prevent the CI loop from having build failures when
> > `checkpolicy` isn't available, when doing "randconfig" jobs.
> 
> Hang on, just to clarify what’s going on here.
> 
> ‘randconfig’ is setting CONFIG_XSM_FLASK_POLICY in the .config file; and then 
> when the build happens, we error out because one of the required components 
> isn’t there.
> 
> What this patch does is to make it so that if someone explicitly sets 
> CONFIG_XSM_FLASK_POLICY=y, but doesn’t have checkpolicy, the build system 
> will silently disable the policy behind their backs without telling them?
> 
> Or does the randconfig test run kConfig one more time, at which point *then* 
> the .config will be disabled?
> 
> The former I think is broken; the latter I think is fine.

That's right, Xen's build system is broken.

Kconfig doesn't say whether a given .config is correct or not, it
removes non existing CONFIG_* setting as well as those that are missing
dependencies. This isn't new, this is the default, this is how Linux is
using Kconfig.

But there's a way out of that.
There's an option to prevent Kconfig from updating .config, setting
KCONFIG_NOSILENTUPDATE in the environment (see docs/misc/kconfig.rst).
But that won't work as expected with the Xen build system because to
update the config via "syncconfig" doesn't prevent the build system from
building Xen (and probably fail later).
If it were working, build would fail, and user would have to run
"oldconfig" or other *config targets, and check the result (diff
.config.old .config).

Cheers,

-- 
Anthony PERARD