summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Update maintainer list.denzilXin Ouyang2013-06-141-0/+6
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* openssl: remove bbappend since oe-core mergedXin Ouyang2013-04-161-3/+0
| | | | | | | | | oe-core has used "-Wa,--noexecstack" in CFLAG not only for native now, so the bbappend should be removed. http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/meta/recipes-connectivity/openssl/openssl.inc?id=4fb837687dd68363f25fbfc15207dd05d1369661 Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* shadow/openssh: use pam_selinux only if target_selinux enabledXin Ouyang2013-04-152-6/+6
| | | | | | | | | | We add pam conf files for login/sshd to use pam_selinux module. When selinux is not in DISTRO_FEATURES, pam-plugin-selinux would not be built, this will cause runtime errors to not allow users to login in on the console or ssh. Use @target_selinux() to enable these pam conf files conditionally. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* swig: denzil branch should use virtclass-native OVERRIDESXin Ouyang2013-04-081-1/+1
| | | | | | | oe-core denzil branch still uses virtclass-native OVERRIDES, not class-native, so fix this. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* audit: use generated headers for cross compilingXin Ouyang2013-04-023-334/+2442
| | | | | | | | | | | | | | | | | | | Default audit Makefile will generate native executables in lib/ and auparse/, which are named as gen_*_h and run on the hosts to create *_tables.h/*tabs.h header files for the targets. This is inappropriate for our cross compiling because they need linux-libc-headers from the host. Even worse, on some old hosts, build will fail because some .h files in the old linux-libc-headers (<= 2.6.29) has incomplete DEFINE lists for the audit system. So add *tables.h/*tabs.h header files which are generated from linux-libc-headers-3.4, and do not generate and run those native executables. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* python-ipy: fix PN -> BPN in do_install for multilibsJackie Huang2013-03-191-3/+3
| | | | Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
* ustr: fix PN -> BPN in do_install for multilibsJackie Huang2013-03-191-6/+6
| | | | Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
* refpolicy: oe-core /var/log symlink policy for apacheXin Ouyang2013-03-193-1/+30
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy*: fix file contexts for many oe-core recipesXin Ouyang2013-03-1915-0/+403
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* libcap-ng: fix the QA issue for libcap-ng.so*Xin Ouyang2013-03-191-1/+11
| | | | | | | Some binaries in base_sbindir have libcap-ng.so* depends, so move libcap-ng.so* to avoid QA warnings. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: two patches for nfs-kernel-serverXin Ouyang2013-03-095-4/+104
| | | | | | | | We still miss some rules for nfsd to bind on nfs ports, so add a patch to fix this. oe-core changed nfsd to use portmap, so also fix file contexts for portmap. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* openssl: uprev to fit oe-core versionXin Ouyang2013-03-071-0/+0
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* initscript: append restorecon lines instead of a final scriptXin Ouyang2013-03-052-204/+7
| | | | | | | | | | | | Current meta-selinux provides a populate-volatile.sh for adding restorecon lines to the oe-core script. If other meta layers would add a new populate-volatile.sh, it will override the oe-core and meta-selinux ones and cause selinux issues. So append restorecon lines to the original script instead of a final script. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* bind: restore rndc.key security contextXin Ouyang2013-03-021-3/+6
| | | | | | | rndc.key would be labeled with wrong named_zone_t inherited from /etc/bind while creating, so restorecon on it. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* swig: add native wrapper for SWIGLIBXin Ouyang2013-02-271-1/+8
| | | | | | | | | | | | Native swig will read datas from hard-coded SWIGLIB or the same environment variable. While using sstate, the hard-coded SWIGLIB will point to the project that create original sstates. This would cause build issues, so add a wrapper to set the environment variable SWIGLIB to a relative path on current sysroot. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* bind: use volatiles to create /var subdirs.Xin Ouyang2013-02-272-0/+14
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: add selinux-config RDEPENDSXin Ouyang2013-02-271-1/+1
| | | | | | | Conflicts: recipes-security/refpolicy/refpolicy_common.inc Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: fix file contexts for bindXin Ouyang2013-02-272-0/+37
| | | | | | | Some files of bind are not installed to default pathes, fix the security contexts for these files. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: add rules for /var/cache symlinkXin Ouyang2013-02-272-0/+510
| | | | | | | | /var/cache is a symlink in poky, so we need allow rules for files to read lnk_file while doing search/list/delete/rw.. in /var/cache/ directory. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* policycoreutils: target build alway need libcgroup&libcap-ngXin Ouyang2013-02-171-2/+4
| | | | | | | | | | Target package policycoreutils-sandbox always needs libcgroup and libcap-ng, so it should not be conditional. Conflicts: recipes-security/selinux/policycoreutils.inc Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* libsemanage: fix incorrect path for nologinXin Ouyang2013-02-173-4/+43
| | | | | | | shadow package of oe-core and Debian has installed nologin into /usr/sbin, so fix this path. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* mesa-dri: inherit enable-selinuxXin Ouyang2013-01-311-0/+3
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* coreutils: inherit with-selinuxXin Ouyang2013-01-311-0/+3
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* libxcb: inherit enable-selinuxXin Ouyang2013-01-311-0/+8
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* gnupg: inherit enable-selinuxXin Ouyang2013-01-311-0/+5
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* libcap-ng: remove old versionXin Ouyang2013-01-301-30/+0
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* sed: backport configure option with-selinuxwenzong.fan@windriver.com2013-01-292-5/+71
| | | | | | | | | Backport configure option with-selinux from master. If the feature selinux is enabled, sed should depend on iti; Otherwise sed doesn't need to depend on selinux at all. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* rpm: inherit with-selinuxXin Ouyang2013-01-281-3/+2
| | | | | | | We should also enable selinux only for target rpm, so inherit with-selinux. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* setools: fix incorrect PYTHON_LDFLAGS.Xin Ouyang2013-01-281-2/+2
| | | | | | | | | | | | | PYTHON_LDFLAGS is considered as the full path of libpython2.7.so, dirname of the .so file will be expanded into -L<DIR>. As a result, current PYTHON_LDFLAGS cause this compile result: ${CC} ... -L-LXXX/tmp/sysroots/qemux86-64/usr/lib64 -L-lapol -lqpol -o _sesearch.so So "-lapol" is ignored, fix this. CQID: WIND00400717 Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: policy fixes for seutils and auditd_log_tXin Ouyang2013-01-233-12/+104
| | | | | | | | | | | | Two patches to fix these two issue: * Current policy has incomplete allow rules for selinux utils to manage selinux config files and policy store. * auditd_log_t(/var/log/audit/audit.log) is also placed in var_log_t, so add related rules. CQID: WIND00396415 Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: file contexts for alternatives of shadowXin Ouyang2013-01-223-1/+36
| | | | | | CQID: WIND00399962 Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* policycoreutils: inherit selinuxXin Ouyang2013-01-221-5/+5
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* audit: admin tools&daemons install to base_sbindirXin Ouyang2013-01-223-39/+7
| | | | | | | | audit admin tools and daemons should install to base_sbindir, so they can get correct security labels after selinux restorecon command. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* glib-2.0: config option should be --enable-selinuxXin Ouyang2013-01-181-2/+2
| | | | | | | --with-selinux is consided as unrecognized option while do_configure, so change it to --enable-selinux, Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* python: disable exit handler to rw history fileXin Ouyang2013-01-182-0/+31
| | | | | | | | | | | | oe-core adds a exit handler to rw python command history file (~/.python-history). There are no allow rules for every user&role to use create/read/write ~/.python-history, and it is also improper to add rules because these rules would blow up the user&role's scope of authority. So disable the handler, if selinux enabled. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: add user_tty_device_t into customizable_typesXin Ouyang2013-01-092-0/+10
| | | | | | | Add user_tty_device_t as a customizable_type, so that restorecon -R /dev will not complain about it or modify the security labels. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: change hard-coded pachesXin Ouyang2013-01-091-10/+10
| | | | | | | - /etc -> ${sysconfdir} - /usr/share -> ${datadir} Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* tinylogin: add passwd alternativeXin Ouyang2013-01-091-1/+4
| | | | | | | | | | | | | | | In meta-selinux layer, tinylogin links are installed as script wrappers instead of symlinks to get their security labels. So, they should use alternatives if there are same commands provided by other packages. passwd -> passwd.tinylogin -> passwd.shadow Merged from msster, Conflicts: recipes-core/tinylogin/tinylogin_1.4.bbappend Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* audit: enable auditd service for default runlevelsXin Ouyang2013-01-071-2/+6
| | | | | | | | | CQID: WIND00397456 Conflicts: recipes-security/audit/audit_2.2.1.bb Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* packages: inherit selinuxXin Ouyang2013-01-055-14/+24
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* packages: inherit with-selinuxXin Ouyang2013-01-0512-53/+24
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* packages: inherit enable-selinuxXin Ouyang2013-01-055-23/+11
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* layer: add selinux/audit bbclassesXin Ouyang2013-01-055-0/+30
| | | | | | | Add bbclasses only for target packages to enable selinux support, not native/nativesdk/cross/crosssdk pacakges. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* selinux packages: create include files.Xin Ouyang2013-01-0519-481/+283
| | | | | | | | | | | | | | | | | | | | Create include files for selinux userspace packages: * checkpolicy.inc * libselinux.inc * libsemanage.inc * libsepol.inc * policycoreutils.inc * sepolgen.inc Merge from master/danny branch. Conflicts: recipes-security/selinux/libselinux_2.1.9.bb recipes-security/selinux/libselinux_git.bb recipes-security/selinux/policycoreutils_2.1.10.bb recipes-security/selinux/policycoreutils_git.bb Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* libsemanage: fix path length limits.Xin Ouyang2012-12-253-8/+38
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* sed: fix parallel compile error with libselinuxXin Ouyang2012-12-202-0/+75
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* policycoreutils: install init script under /etc/init.d/Roy.Li2012-12-122-2/+4
| | | | | Signed-off-by: Roy.Li <rongqing.li@windriver.com> Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* checkpolicy+libsemanage: flex+bison native dependsXin Ouyang2012-11-304-8/+8
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: standard/mls policy should set UBAC=nXin Ouyang2012-11-273-2/+5
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: fix policy to allow nfsd works.Xin Ouyang2012-11-274-2/+72
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-21 16:08:34 +0000