Use autotools path variables instead of hardcoded paths

All paths were hardcoded (e.g. /etc/fapolicyd/, /var/lib/fapolicyd,
/run/fapolicyd/), which meant building with the default prefix
(--prefix=/usr/local) resulted in binaries that still looked for
config and state in /etc and /var. This is a common developer
workflow when building and testing upstream without RPM packaging.

- paths.h: replace hardcoded paths with SYSCONFDIR, LOCALSTATEDIR,
  RUNSTATEDIR, DATADIR defines passed via CFLAGS
- trust-file.h: remove duplicate TRUST_FILE_PATH/TRUST_DIR_PATH,
  include paths.h
- fagenrules, fapolicyd.service, fapolicyd-tmpfiles.conf: convert
  to .in templates with @sysconfdir@, @runstatedir@, @sbindir@,
  @localstatedir@ substitution
- configure.ac: fix systemdsystemunitdir NONE expansion bug,
  add --with-systemdsystemunitdir
- database.c: create trust database directory at startup if missing,
  with proper ownership (uid/gid from config)
- fapolicyd.c: include pidfile path in error message
- database.c: include data_dir path in mdb_env_open error message
- Move fapolicyd-rpm-loader from bin to libexec (BINARYDIR renamed
  to LIBEXECDIR). The loader is an internal helper spawned by the
  daemon, not a user-facing executable.

Co-developed-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: rmetrich

configure.ac

@@ -209,9 +209,11 @@ AS_HELP_STRING([--enable-stress],
 use_stress=$enableval,use_stress=no)
 AM_CONDITIONAL(WITH_STRESS, test x$use_stress = xyes)
 
-dnl FIXME some day pass this on the command line
-def_systemdsystemunitdir=${prefix}/lib/systemd/system
-AC_SUBST([systemdsystemunitdir], [$def_systemdsystemunitdir])
+AC_ARG_WITH([systemdsystemunitdir],
+    AS_HELP_STRING([--with-systemdsystemunitdir=DIR], [systemd system unit directory]),
+    [systemdsystemunitdir=$withval],
+    [systemdsystemunitdir=\${prefix}/lib/systemd/system])
+AC_SUBST([systemdsystemunitdir])
 
 echo .
 echo Checking for required header files

fapolicyd.spec

@@ -122,7 +122,6 @@ popd
 
 %install
 %make_install
-install -p -m 644 -D init/%{name}-tmpfiles.conf %{buildroot}/%{_tmpfilesdir}/%{name}.conf
 mkdir -p %{buildroot}/%{_localstatedir}/lib/%{name}
 mkdir -p %{buildroot}/run/%{name}
 mkdir -p %{buildroot}%{_sysconfdir}/%{name}/trust.d
@@ -249,11 +248,11 @@ fi
 %config(noreplace) %attr(644,root,%{name}) %{_sysconfdir}/%{name}/%{name}.trust
 %ghost %attr(644,root,%{name}) %{_sysconfdir}/%{name}/compiled.rules
 %attr(644,root,root) %{_unitdir}/%{name}.service
-%attr(644,root,root) %{_tmpfilesdir}/%{name}.conf
+%attr(644,root,root) %{_tmpfilesdir}/%{name}-tmpfiles.conf
 %attr(755,root,root) %{_sbindir}/%{name}
 %attr(755,root,root) %{_sbindir}/%{name}-cli
 %attr(755,root,root) %{_sbindir}/%{name}-perf-test
-%attr(755,root,root) %{_bindir}/%{name}-rpm-loader
+%attr(755,root,root) %{_libexecdir}/%{name}-rpm-loader
 %attr(755,root,root) %{_sbindir}/fagenrules
 %attr(644,root,root) %{_mandir}/man8/*
 %attr(644,root,root) %{_mandir}/man5/*

init/Makefile.am

@@ -1,12 +1,12 @@
 EXTRA_DIST = \
-	fapolicyd.service \
+	fapolicyd.service.in \
 	fapolicyd.conf \
 	fapolicyd-filter.conf \
 	fapolicyd.trust \
-	fapolicyd-tmpfiles.conf \
+	fapolicyd-tmpfiles.conf.in \
 	fapolicyd-magic \
 	fapolicyd.bash_completion \
-	fagenrules
+	fagenrules.in
 
 fapolicyddir = $(sysconfdir)/fapolicyd
 
@@ -16,16 +16,29 @@ dist_fapolicyd_DATA = \
 	fapolicyd.trust
 
 systemdservicedir = $(systemdsystemunitdir)
-dist_systemdservice_DATA = fapolicyd.service
+systemdservice_DATA = fapolicyd.service
 
 sbin_SCRIPTS = fagenrules
 
+fagenrules: fagenrules.in Makefile
+	$(SED) -e 's|[@]sysconfdir[@]|$(sysconfdir)|g' $< > $@
+	chmod 755 $@
+
+fapolicyd-tmpfiles.conf: fapolicyd-tmpfiles.conf.in Makefile
+	$(SED) -e 's|[@]runstatedir[@]|$(runstatedir)|g' -e 's|[@]localstatedir[@]|$(localstatedir)|g' -e 's|[@]sysconfdir[@]|$(sysconfdir)|g' $< > $@
+
+fapolicyd.service: fapolicyd.service.in Makefile
+	$(SED) -e 's|[@]runstatedir[@]|$(runstatedir)|g' -e 's|[@]sbindir[@]|$(sbindir)|g' $< > $@
+
+tmpfilesdir = $(prefix)/lib/tmpfiles.d
+tmpfiles_DATA = fapolicyd-tmpfiles.conf
+
 completiondir = $(sysconfdir)/bash_completion.d/
 dist_completion_DATA = fapolicyd.bash_completion
 
 MAGIC = fapolicyd-magic.mgc
 pkgdata_DATA = ${MAGIC} 
-CLEANFILES = ${MAGIC}
+CLEANFILES = ${MAGIC} fagenrules fapolicyd.service fapolicyd-tmpfiles.conf
 
 ${MAGIC}: $(EXTRA_DIST)
 	file -C -m ${top_srcdir}/init/fapolicyd-magic

init/fagenrules init/fagenrules.ininit/fagenrules renamed to init/fagenrules.in

@@ -1,15 +1,15 @@
 #!/bin/sh
 
 # Script to concatenate rules files found in a base fapolicyd rules directory
-# to form a single /etc/fapolicyd/compiled.rules file suitable for loading
+# to form a single @sysconfdir@/fapolicyd/compiled.rules file suitable for loading
 # into the daemon
 
 # When forming the interim rules file, both empty lines and comment
 # lines (starting with # or <whitespace>#) are stripped as the source files
 # are processed.
 #
 # Having formed the interim rules file, the script checks if the file is empty
-# or is identical to the existing /etc/fapolicyd/compiled.rules and if either
+# or is identical to the existing @sysconfdir@/fapolicyd/compiled.rules and if either
 # of these cases are true, it does not replace the existing file.
 #
 
@@ -25,9 +25,9 @@
 #   Suffix for previous fapolicyd.rules file if this script replaces it.
 #   The file is left in the destination directory with suffix with $ASuffix
 
-OldDestinationFile=/etc/fapolicyd/fapolicyd.rules
-DestinationFile=/etc/fapolicyd/compiled.rules
-SourceRulesDir=/etc/fapolicyd/rules.d
+OldDestinationFile=@sysconfdir@/fapolicyd/fapolicyd.rules
+DestinationFile=@sysconfdir@/fapolicyd/compiled.rules
+SourceRulesDir=@sysconfdir@/fapolicyd/rules.d
 TmpRules=$(mktemp /tmp/farules.XXXXXXXX)
 ASuffix="prev"
 OnlyCheck=0

init/fapolicyd-tmpfiles.conf

@@ -0,0 +1,3 @@
+d @runstatedir@/fapolicyd 0770 root fapolicyd -
+d @localstatedir@/lib/fapolicyd 770 root fapolicyd -
+Z @sysconfdir@/fapolicyd - root fapolicyd -

init/fapolicyd-tmpfiles.conf.in

@@ -13,10 +13,9 @@ Documentation=man:fapolicyd(8)
 [Service]
 OOMScoreAdjust=-1000
 Type=forking
-RuntimeDirectory=fapolicyd
-PIDFile=/run/fapolicyd.pid
-ExecStartPre=/usr/sbin/fagenrules
-ExecStart=/usr/sbin/fapolicyd
+PIDFile=@runstatedir@/fapolicyd.pid
+ExecStartPre=@sbindir@/fagenrules
+ExecStart=@sbindir@/fapolicyd
 Restart=on-abnormal
 
 [Install]

init/fapolicyd.service init/fapolicyd.service.ininit/fapolicyd.service renamed to init/fapolicyd.service.in

@@ -14,7 +14,7 @@ endif
 
 lib_LTLIBRARIES= libfapolicyd.la
 
-fapolicyd_CFLAGS = -std=gnu11 -fPIE -DPIE -pthread -g -W -Wall -Wshadow -Wundef -Wno-unused-result -Wno-unused-parameter -D_GNU_SOURCE
+fapolicyd_CFLAGS = -std=gnu11 -fPIE -DPIE -pthread -g -W -Wall -Wshadow -Wundef -Wno-unused-result -Wno-unused-parameter -D_GNU_SOURCE -DSYSCONFDIR='"$(sysconfdir)"' -DLOCALSTATEDIR='"$(localstatedir)"' -DRUNSTATEDIR='"$(runstatedir)"' -DDATADIR='"$(datadir)"'
 fapolicyd_LDFLAGS = -pie -Wl,-z,relro -Wl,-z,now  -static
 fapolicyd_LDADD = libfapolicyd.la
 
@@ -105,12 +105,12 @@ if WITH_RPM
 libfapolicyd_la_SOURCES += \
 	library/rpm-backend.c
 
-bin_PROGRAMS = fapolicyd-rpm-loader
+libexec_PROGRAMS = fapolicyd-rpm-loader
 
 fapolicyd_rpm_loader_SOURCES = \
 	handler/fapolicyd-rpm-loader.c
 
-fapolicyd_CFLAGS += -DBINARYDIR='"$(bindir)"'
+fapolicyd_CFLAGS += -DLIBEXECDIR='"$(libexecdir)"'
 fapolicyd_rpm_loader_CFLAGS = $(fapolicyd_CFLAGS)
 fapolicyd_rpm_loader_LDFLAGS = $(fapolicyd_LDFLAGS)
 fapolicyd_rpm_loader_LDADD = libfapolicyd.la

src/Makefile.am

@@ -592,8 +592,8 @@ static int write_pid_file(void)
 	}
 	pidfd = open(pidfile, O_CREAT | O_TRUNC | O_NOFOLLOW | O_WRONLY, 0644);
 	if (pidfd < 0) {
-		msg(LOG_ERR, "Unable to create pidfile (%s)",
-			strerror(errno));
+		msg(LOG_ERR, "Unable to create pidfile %s (%s)",
+			pidfile, strerror(errno));
 		return 1;
 	}
 	if (write(pidfd, val, (unsigned int)len) != len) {

src/daemon/fapolicyd.c

@@ -2530,7 +2530,8 @@ static int init_db_with_generations(const conf_t *config,
 
 	rc = mdb_env_open(env, data_dir, flags, 0660);
 	if (rc) {
-		msg(LOG_ERR, "env_open error: %s", mdb_strerror(rc));
+		msg(LOG_ERR, "env_open error on %s: %s", data_dir,
+		    mdb_strerror(rc));
 		/* Clean up environment on failure */
 		mdb_env_close(env);
 		env = NULL;
@@ -4621,6 +4622,16 @@ int init_database(conf_t *config)
 	int rc;
 
 	msg(LOG_INFO, "Initializing the trust database");
+
+	if (mkdir(data_dir, 0770) == 0) {
+		chmod(data_dir, 0770);
+		chown(data_dir, config->uid, config->gid);
+	} else if (errno != EEXIST) {
+		msg(LOG_ERR, "Failed to create trust database directory %s (%s)",
+		    data_dir, strerror(errno));
+		return 1;
+	}
+
 	startup_compaction_target_mb = 0;
 	startup_compaction_fallback_mb = 0;