include: do not override kernel headers with libaudit headers

Overriding <linux/audit.h> to implicitly include <libaudit.h> turns out to
be problematic. Because <linux/audit.h> is pulled in by various other kernel
headers, any source file including those kernel headers indirectly ends up
depending on <libaudit.h>, even if the executable or library being built
does not require libaudit at all.

Let's drop the override header and include <libaudit.h> only where explicitly
needed. This also moves the fallback definitions of AUDIT_SERVICE_* and
MAX_AUDIT_MESSAGE_LENGTH to libaudit-util.h.

diff --git a/src/core/service.c b/src/core/service.c
index 9e4af299f7ec9835265e7a87ffeec0b93db2df16..012336b47a0bac23498613e213c09a0b4eb07891 100644 (file)
--- a/src/core/service.c
+++ b/src/core/service.c
@@ -1,6 +1,5 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <linux/audit.h>        /* IWYU pragma: keep */
 #include <linux/liveupdate.h>
 #include <math.h>
 #include <sys/stat.h>
@@ -36,6 +35,7 @@
 #include "glyph-util.h"
 #include "id128-util.h"
 #include "image-policy.h"
+#include "libaudit-util.h"      /* IWYU pragma: keep */
 #include "log.h"
 #include "luo-util.h"
 #include "manager.h"

diff --git a/src/include/meson.build b/src/include/meson.build
index 9cf7e4dbc8895792a5e9d02f17549e0256938464..5fc8bb6a61e2b389a2a90bf9c34a92fbadb31cdc 100644 (file)
--- a/src/include/meson.build
+++ b/src/include/meson.build
@@ -33,11 +33,6 @@ ipproto_sources = files(
         'uapi/linux/in.h',
 )
 
-# Source files that provides AUDIT_XYZ
-audit_sources = files(
-        'override/linux/audit.h',
-)
-
 # Source files that provides KEY_XYZ
 keyboard_sources = files(
         'uapi/linux/input.h',

diff --git a/src/include/override/linux/audit.h b/src/include/override/linux/audit.h
deleted file mode 100644 (file)
index abdd25b..0000000
--- a/src/include/override/linux/audit.h
+++ /dev/null
@@ -1,33 +0,0 @@
-/* SPDX-License-Identifier: LGPL-2.1-or-later */
-#pragma once
-
-#include_next <linux/audit.h>   /* IWYU pragma: export */
-
-#if HAVE_AUDIT
-#  include <libaudit.h>         /* IWYU pragma: export */
-#endif
-
-#include <assert.h>
-
-/* We use static_assert() directly here instead of assert_cc()
- * because if we include macro.h in this header, the invocation
- * of generate-audit_type-list.sh becomes more complex.
- */
-
-#ifndef AUDIT_SERVICE_START
-#  define AUDIT_SERVICE_START 1130 /* Service (daemon) start */
-#else
-static_assert(AUDIT_SERVICE_START == 1130, "");
-#endif
-
-#ifndef AUDIT_SERVICE_STOP
-#  define AUDIT_SERVICE_STOP 1131 /* Service (daemon) stop */
-#else
-static_assert(AUDIT_SERVICE_STOP == 1131, "");
-#endif
-
-#ifndef MAX_AUDIT_MESSAGE_LENGTH
-#  define MAX_AUDIT_MESSAGE_LENGTH 8970
-#else
-static_assert(MAX_AUDIT_MESSAGE_LENGTH == 8970, "");
-#endif

diff --git a/src/journal/audit_type-to-name.awk b/src/journal/audit_type-to-name.awk
index 5dbba45af1bc56e2ceb9201636e9c5d05c1d72da..ef834ff15eaf11bb604018e3c6bf916dab0089f3 100644 (file)
--- a/src/journal/audit_type-to-name.awk
+++ b/src/journal/audit_type-to-name.awk
@@ -1,6 +1,10 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 
 BEGIN{
+        print "#if HAVE_AUDIT"
+        print "#  include <libaudit.h>"
+        print "#endif"
+        print ""
         print "#include <linux/audit.h>"
         print ""
         print "#include \"audit-type.h\""

diff --git a/src/journal/journald-manager.c b/src/journal/journald-manager.c
index 68f95ea96782ea1160de7ddf78dfac0f3c84ca97..be3532f1ed5d65318e68f8de642600bdef9f6855 100644 (file)
--- a/src/journal/journald-manager.c
+++ b/src/journal/journald-manager.c
@@ -1,6 +1,5 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <linux/audit.h>
 #include <linux/sockios.h>
 #include <sys/stat.h>
 #include <sys/ioctl.h>
@@ -47,6 +46,7 @@
 #include "journald-sync.h"
 #include "journald-syslog.h"
 #include "journald-varlink.h"
+#include "libaudit-util.h"
 #include "log.h"
 #include "log-ratelimit.h"
 #include "memory-util.h"

diff --git a/src/journal/meson.build b/src/journal/meson.build
index 5ac4ae2cd077f98f46ca15cc5d6f992adb12147a..3579265a119313cfaef920ceab28e0b34701b08d 100644 (file)
--- a/src/journal/meson.build
+++ b/src/journal/meson.build
@@ -31,10 +31,19 @@ generated_sources += journald_gperf_c
 systemd_journald_extract_sources += journald_gperf_c
 
 generate_audit_type_list = files('generate-audit_type-list.sh')
+generate_audit_type_command = [env, 'bash', generate_audit_type_list, cpp]
+if libaudit.found()
+        generate_audit_type_command += [
+                '-include', 'libaudit.h',
+                '-I' + libaudit.get_variable('includedir'),
+        ]
+endif
+generate_audit_type_command += system_include_args
+
 audit_type_list_txt = custom_target(
-        input : [generate_audit_type_list, audit_sources],
+        input : [generate_audit_type_list],
         output : 'audit_type-list.txt',
-        command : [env, 'bash', generate_audit_type_list, cpp, system_include_args],
+        command : generate_audit_type_command,
         capture : true)
 
 audit_type_to_name = custom_target(

diff --git a/src/shared/libaudit-util.h b/src/shared/libaudit-util.h
index 8bb05a2fbd3c192d3eab38e7dd9cf6d9925bb097..75cef6f1a04f941de4dfb9bc4b7fbde35ebcdb2d 100644 (file)
--- a/src/shared/libaudit-util.h
+++ b/src/shared/libaudit-util.h
@@ -15,6 +15,26 @@ extern DLSYM_PROTOTYPE(audit_log_user_avc_message);
 extern DLSYM_PROTOTYPE(audit_log_user_comm_message);
 #endif
 
+/* libaudit.h defines these constants.
+ * Define them here too so they can be used even when libaudit.h is unavailable. */
+#ifndef AUDIT_SERVICE_START
+#  define AUDIT_SERVICE_START 1130 /* Service (daemon) start */
+#else
+assert_cc(AUDIT_SERVICE_START == 1130);
+#endif
+
+#ifndef AUDIT_SERVICE_STOP
+#  define AUDIT_SERVICE_STOP 1131 /* Service (daemon) stop */
+#else
+assert_cc(AUDIT_SERVICE_STOP == 1131);
+#endif
+
+#ifndef MAX_AUDIT_MESSAGE_LENGTH
+#  define MAX_AUDIT_MESSAGE_LENGTH 8970
+#else
+assert_cc(MAX_AUDIT_MESSAGE_LENGTH == 8970);
+#endif
+
 bool use_audit(void);
 
 int close_audit_fd(int fd);