Excerpts from Bill Peck's message of 2015-03-23 23:11 +10:00:
On 03/23/2015 04:12 AM, Dan Callaghan wrote:
> One small issue I just noticed with the RHEL7 builds of restraint.
> They
> require the latest selinux-policy, since they are built against the
> current buildroot, but that version of selinux-policy is probably not in
> any RHEL7 composes aside from the very newest ones.
>
> I think we need to pre-build a policy module using the RHEL7.0 GA
> selinux-policy and commit it to source, the way we did for beah. I will
> look into it some more this week.
This has been a problem for a while and I appreciate any patches to help
here.
Thinking about it some more, I wonder if the best solution might be to
just make the Koji buildroots we are using be the RHEL7 GA release,
instead of the latest RHEL7 buildroots. RHEL's compatibility guarantees
mean that a binary built against the .0 GA release should work forever.
As long as we don't hit any build-time bugs in the GA packages it should
be fine.
As well as fixing the problem of selinux-policy requirements, it will
also help avoid us accidentally linking against some newly added glibc
symbols or whatever else.
We can do the same for RHEL4-6 as well but I guess we would only need to
go back to the oldest EUS that is still alive, rather than all the way
back to .0 GA.
I will try this out later and see how it goes.
--
Dan Callaghan <dcallagh(a)redhat.com>
Software Engineer, Products & Technologies Operations
Red Hat, Inc.