summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* checkpolicy: remove link against libfldizzyJoe MacDonald2014-11-102-3/+5
| | | | | | | An updated version of the patch to drop linking against libfl was required. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* Update maintainers listJoe MacDonald2014-11-051-0/+5
| | | | Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* Merge branch 'master-next'Joe MacDonald2014-11-0572-1957/+207
|\ | | | | | | Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
| * userspace: update core selinux userspace toolsJoe MacDonald2014-11-0115-1551/+63
| | | | | | | | | | | | Update to the latest stable release, 20140506. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
| * dhcp: remove the unrecognised without-selinux configuration warningRoy.Li2014-09-241-1/+1
| | | | | | | | | | | | | | | | | | dhcp 4.3 has no selinux related configuration options, but it needs the correct initscript when SELinux is enabled, so inherit selinux, not inherit with-selinux Signed-off-by: Roy.Li <rongqing.li@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
| * Globally replace 'base_contains' calls with 'bb.utils.contains'Joe MacDonald2014-09-245-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Based on oe-core commit: commit 1528e596d4906c33e4be83fcf691cfe76d340ff3 Author: Otavio Salvador <otavio@ossystems.com.br> Date: Thu Apr 24 15:59:20 2014 -0300 Globally replace 'base_contains' calls with 'bb.utils.contains' The base_contains is kept as a compatibility method and we ought to not use it in OE-Core so we can remove it from base metadata in future. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
| * Use compressed_policy by default, and clear distro featureXin Ouyang2014-09-223-36/+17
| | | | | | | | | | | | | | | | | | | | | | Original refpolicy install compressed policy modules to policy store, but leave datadir ones uncompressed. After, a "compressed_policy" distro feature is added for compressing the datadir ones. This simple mechanism is unworthy for a distro feature, just clear it and use compressed policy modules by default. Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
| * refpolicy-minimum: add fixed prepare_policy_store().Xin Ouyang2014-09-221-0/+28
| | | | | | | | | | | | | | Original prepare_policy_store() has a naming bug for compressed_policy, fix that and let prepare_policy_store() back. Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
| * refpolicy: clean up old policy and patchesJoe MacDonald2014-09-1949-2156/+0
| | | | | | | | | | | | | | Now that the updated refpolicy core variants are available, remove the previous recipe and patches. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
| * refpolicy-minimum: update base refpolicy 20140311Joe MacDonald2014-09-192-58/+29
| | | | | | | | | | | | | | A simple forward-port of refpolicy-minimum to use the 20140311 base refpolicy. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
| * refpolicy-targeted: update base refpolicy 20140311Joe MacDonald2014-09-192-41/+34
| | | | | | | | | | | | | | | | A simple forward-port of refpolicy-targeted to use the 20140311 base refpolicy. Now that the updated refpolicy core variants are available, remove the previous recipe. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
| * refpolicy: update refpolicy to 20140311 releaseJoe MacDonald2014-09-1946-6/+1927
| | | | | | | | | | | | | | | | | | A straight update from refpolicy 2.20130424 to 2.20140311 for the core policy variants and forward-porting of policy patches as appropriate. Now that the updated refpolicy core variants are available, remove the previous recipe. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* | dhcp: remove the unrecognised without-selinux configuration warningRoy.Li2014-09-241-1/+1
| | | | | | | | | | | | | | | | | | dhcp 4.3 has no selinux related configuration options, but it needs the correct initscript when SELinux is enabled, so inherit selinux, not inherit with-selinux Signed-off-by: Roy.Li <rongqing.li@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* | Globally replace 'base_contains' calls with 'bb.utils.contains'Joe MacDonald2014-09-167-11/+11
|/ | | | | | | | | | | | | | | Based on oe-core commit: commit 1528e596d4906c33e4be83fcf691cfe76d340ff3 Author: Otavio Salvador <otavio@ossystems.com.br> Date: Thu Apr 24 15:59:20 2014 -0300 Globally replace 'base_contains' calls with 'bb.utils.contains' The base_contains is kept as a compatibility method and we ought to not use it in OE-Core so we can remove it from base metadata in future. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-userspace: update userspace SRC_URI and checksumsJoe MacDonald2014-09-1610-17/+23
| | | | | | | | | Trac has been turned off on OSS. Update all SRC_URI links for the userspace components to point at the github project releases. The github releases also have a slightly different directory structure in the tarballs, requiring an update of the checksums as well. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* shadow: add missing libsemanage conditional depend.Xin Ouyang2014-09-121-0/+2
| | | | Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* kernel: remove obsoleting bbappend to fit oe-core.Xin Ouyang2014-09-121-7/+0
| | | | Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* at: Use wildcard for version number in bbappend.Xin Ouyang2014-09-121-0/+0
| | | | Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* shadow: Use wildcard for version number in bbappend.Xin Ouyang2014-09-121-1/+1
| | | | Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* Enable two options to ensure selinux can boot upZhenhua Luo2014-08-281-0/+2
| | | | | | | | * CONFIG_SECURITY=y * CONFIG_SECURITYFS=y Signed-off-by: Zhenhua Luo <zhenhua.luo@freescale.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* refpolicy / minimum: support compressed policyWenzong Fan2014-08-281-8/+18
| | | | | Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* refpolicy: split do_install to three stepsWenzong Fan2014-08-281-14/+25
| | | | | | | | | | | | | Split do_install() to: + prepare_policy_store() + rebuild_policy() + install_misc_files() This allows to make partial change to do_install() instead of re-write it totally from specific refpolicy bb file. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* libcap-ng: CVE-2014-3215Shan Hai2014-08-282-1/+82
| | | | | | | | | | | | | | | seunshare in policycoreutils 2.2.5 is owned by root with 4755 permissions, and executes programs in a way that changes the relationship between the setuid system call and the getresuid saved set-user-ID value, which makes it easier for local users to gain privileges by leveraging a program that mistakenly expected that it could permanently drop privileges. Pick a patch from below link to address the CVE-2014-3215. https://bugzilla.redhat.com/attachment.cgi?id=829864 Signed-off-by: Shan Hai <shan.hai@windriver.com> Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* gnupg: remove PRChong Lu2014-08-281-2/+0
| | | | | | | Remove PR, since oe-core has a new version. Signed-off-by: Chong Lu <Chong.Lu@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* rpm: remove PRChong Lu2014-08-281-2/+0
| | | | | | | Remove PR, since oe-core has a new version. Signed-off-by: Chong Lu <Chong.Lu@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* swig-native: repair patching errorJoe MacDonald2014-07-191-8/+9
| | | | Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* swig: use pkg-config for pcre detection.Koen Kooi2014-07-152-1/+67
| | | | | | | | | | Adapted from the original patch submitted to meta-oe for swig 2.0.12. OE-core commit 5870bd272b0b077d0826fb900b251884c1c05061 sabotaged the binconfig way. Signed-off-by: Koen Kooi <koen.kooi@linaro.org> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* rpm: bbappend to 5.4.14 to fit oe-coreXin Ouyang2014-07-141-0/+0
| | | | Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* gnupg: use wildcard in nameArmin Kuster2014-07-011-0/+0
| | | | | | | There are two versions of gnupg so limit the wildcard to the 2.x series Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* dhcp/init-server: restorecon for dhcpd*.leasesWenzong Fan2014-06-231-0/+8
| | | | | | | | | | | | | | | dhcp-server fails to start with avc denied error: avc: denied { read } for pid=571 comm="dhcpd" \ name="dhcpd.leases" dev="hda" ino=63911 \ scontext=system_u:system_r:dhcpd_t:s0-s15:c0.c1023 \ tcontext=system_u:object_r:dhcp_state_t:s0 tclass=file The type for dhcpd.leases is not correct, just fix it before dhcp- server started. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* dhcp: make a copy of init-serverWenzong Fan2014-06-232-0/+47
| | | | | Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* initscripts/devpts.sh: fix context for /dev/ptsWenzong Fan2014-06-231-0/+1
| | | | | | | | | | | | | devpts use file_use_trans to allocate security contexts. As there are no range_trans rules for initrc_t mounting devpts, the security level of mountpoint will be derived from the initrc process, to be systemhigh (s15:c0.c1023), instead of expected systemlow(s0). This will block login shells to search PTYs, so use restorecon to fix this. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* initscripts: add a local copy of devpts.shWenzong Fan2014-06-232-0/+30
| | | | | | | | Start point to make SELinux specific changes in devpts.sh, copied from oe-core layer. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* libpcre: Use wildcard for version number in bbappend.Xin Ouyang2014-06-231-0/+0
| | | | Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* setools: Add bison-native and flex-native to DEPENDSChong Lu2014-06-021-1/+1
| | | | | | | Avoid policy_scan.c: No such file or directory Signed-off-by: Chong Lu <Chong.Lu@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* refpolicy: Allow udev the block_suspend capabilityJackie Huang2014-06-022-0/+26
| | | | | | | | | | Fix the avc denied issue: type=1400 audit(1399440994.656:14): avc: denied { block_suspend } for pid=80 comm="udevd" capability=36 scontext=system_u:system_r:udev_t:s0-s15:c0.c1023 tcontext=system_u:system_r:udev_t:s0-s15:c0.c1023 tclass=capability2 The patch is backported from upstream Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* setools: not override do_configure in autotools class.Xin Ouyang2014-05-161-7/+7
| | | | Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* refpolicy-*: un-inherit because not autotools packageXin Ouyang2014-05-161-4/+3
| | | | Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* kernel: remove 3.8 bbappend to follow oe-core changes.Xin Ouyang2014-05-161-7/+0
| | | | Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* mesa: Use wildcard for version number in bbappend.Xin Ouyang2014-05-161-0/+0
| | | | Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* psmisc: Use wildcard for version number in bbappend.Xin Ouyang2014-05-162-267/+0
| | | | Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* augeas: Use wildcard for version number in bbappend.Xin Ouyang2014-05-161-0/+0
| | | | Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* util-linux: Use wildcard for version number in bbappend.Xin Ouyang2014-05-162-8/+3
| | | | Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* glib-2.0: Use wildcard for version number in bbappend.Xin Ouyang2014-05-161-0/+0
| | | | Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* dbus: Use wildcard for version number in bbappend.Xin Ouyang2014-05-161-0/+0
| | | | Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* openssh: Use wildcard for version number in bbappend.Xin Ouyang2014-05-161-0/+0
| | | | Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* bind: Use wildcard for version number in bbappend.Xin Ouyang2014-05-161-0/+0
| | | | Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* initscripts/checkroot.sh: restore file contexts for /runJackie Huang2014-05-091-0/+2
| | | | | | | | | The file contexts for /run is incorrect while running checkroot.sh in boot time which causes mount fail to create new dir and file in /run, so restore the security contexts in it. Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* linux-yocto: migrate from 3.10 to 3.14Joe MacDonald2014-05-091-1/+0
| | | | | | | | The default kernel is now 3.14. Since the removal of PRINC support leaves the 3.10 recipe in a difficult-to-work-with state, now seems like a good time to move to the new kernel. Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: remove PRINC warningHongxu Jia2014-05-097-7/+6
| | | | | | | | | | Bump up PR and remove PRINC. Set it to something suitably large that it's unlikely to break anyone's package feed and so that it shows it's clearly an exception case. Obviously this is just a staging activity until the next update when we don't include anything of the sort. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-21 12:31:10 +0000