summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* selinux-config: make DEFAULT_POLICY and DEFAULT_ENFORCING configurableJosep Puigdemont2015-08-141-5/+7
| | | | | | | Make DEFAULT_POLICY and DEFAULT_ENFORCING configurations more flexible. Signed-off-by: Maxin B. John <maxin.john@enea.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* e2fsprogs: Implement xattr block cache with simple linked list.Philip Tricca2015-08-082-0/+182
| | | | | Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* e2fsprogs: Add stub functions for an xattr cache and struct to hold the ↵Philip Tricca2015-08-082-0/+176
| | | | | | | header and block data. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* e2fsprogs: Copy xattr block from source file.Philip Tricca2015-08-082-0/+342
| | | | | Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* e2fsprogs: Add xattr security prefix data to lib/ext2fs/ext2_ext_attr.hPhilip Tricca2015-08-082-0/+21
| | | | | Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* e2fsprogs: Insert calls to xattr module into mke2fs and build xattr code.Philip Tricca2015-08-082-0/+165
| | | | | Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* e2fsprogs: Add bbappend and stub for xattr module.Philip Tricca2015-08-082-0/+62
| | | | | Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-image: Add new image class to label the rootfs, use it for selinux ↵Philip Tricca2015-08-083-2/+10
| | | | | | | images. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* policycoreutils: Patch setfiles to add FTS_NOCHDIR to fts_flags.Philip Tricca2015-08-082-0/+26
| | | | | Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* README : update supported refpolicy version detailsShrikant Bobade2015-08-071-0/+14
| | | | | | | | | README updated with the supported refpolicy version details and information of refpolicy building from git repository. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-minimum: update base refpolicy to git repoShrikant Bobade2015-08-071-0/+48
| | | | | | | | A simple forward-port of refpolicy-minimum to use the refpolicy from git repository. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-standard: update base refpolicy to git repoShrikant Bobade2015-08-071-0/+8
| | | | | | | | A simple forward-port of refpolicy-standard to use the refpolicy from git repository. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-mls: update base refpolicy to git repoShrikant Bobade2015-08-071-0/+10
| | | | | | | | A simple forward-port of refpolicy-mls to use the refpolicy from git repository. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-mcs: update base refpolicy to git repoShrikant Bobade2015-08-071-0/+11
| | | | | | | | A simple forward-port of refpolicy-mcs to use the refpolicy from git repository. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-targeted: update base refpolicy to git repoShrikant Bobade2015-08-071-0/+20
| | | | | | | | A simple forward-port of refpolicy-targeted to use the refpolicy from git repository. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy git: rebase patches with code baseShrikant Bobade2015-08-075-77/+74
| | | | | | | | | During forward-port of these patches from refpolicy 20140311, requires rebase with the refpolicy git repos head master code base,in order to resolve the patch conflicts. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy git: update refpolicy to git repositoryShrikant Bobade2015-08-0744-0/+1976
| | | | | | | | | | | | | | | | A straight update from refpolicy 2.20140311 to refpolicy git repository for the core policy variants and forward-porting of policy patches as appropriate. This approach is useful for building refpolicy & refpolicy-contrib directly from the git repos, rather than release tarballs. It helps to check the refpolicy based on source commits by just updating the git repo rev. as appropriate in refpolicy_git.inc ref: https://github.com/TresysTechnology/refpolicy/wiki Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-minimum: update base refpolicy 20141203Shrikant Bobade2015-08-071-0/+48
| | | | | | | | A simple forward-port of refpolicy-minimum to use the 20141203 base refpolicy. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-standard: update base refpolicy 20141203Shrikant Bobade2015-08-071-0/+8
| | | | | | | | A simple forward-port of refpolicy-standard to use the 20141203 base refpolicy. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-mls: update base refpolicy 20141203Shrikant Bobade2015-08-071-0/+10
| | | | | | | | A simple forward-port of refpolicy-mls to use the 20141203 base refpolicy. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-mcs: update base refpolicy 20141203Shrikant Bobade2015-08-071-0/+11
| | | | | | | | A simple forward-port of refpolicy-mcs to use the 20141203 base refpolicy. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-targeted: update base refpolicy 20141203Shrikant Bobade2015-08-071-0/+20
| | | | | | | | A simple forward-port of refpolicy-targeted to use the 20141203 base refpolicy. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy 20141203: rebase patches with code baseShrikant Bobade2015-08-075-78/+73
| | | | | | | | | During forward-port of these patches from refpolicy 2014120311, requires rebase with the refpolicy 20141203 code base, in order to resolve the patch conflicts. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy: update refpolicy to 20141203 releaseShrikant Bobade2015-08-0744-0/+1974
| | | | | | | | | | A straight update from refpolicy 2.20140311 to 2.20141203 for the core policy variants and forward-porting of policy patches as appropriate. ref: https://github.com/TresysTechnology/refpolicy/wiki Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* README: update supported linux-yocto versionsShrikant Bobade2015-08-071-0/+10
| | | | | | | | | README updated with the list of supported linux-yocto versions and details to use it while preparing selinux enabled images. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* linux-yocto: enable selinux support for kernel v4.1Shrikant Bobade2015-08-071-0/+8
| | | | | | | | The default kernel is now v4.1. So we need the selinux support for kernel v4.1, inorder to get selinux enabled images out of box. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy: correct SELINUX_DEVEL_PATHWenzong Fan2015-08-071-1/+9
| | | | | | | | | The sepolgen.conf should be installed with devel package to correct the default value of SELINUX_DEVEL_PATH, Makefile will be searched from that path while building policies on target. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* policycoreutils: install /var/lib/selinuxWenzong Fan2015-08-071-0/+6
| | | | | | | | | This dir is required for running command: $ semanage permissive [OPTS] Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* initscripts: fix contexts for /etc/resolv.conf, adjtimeWenzong Fan2015-08-071-1/+2
| | | | | | | | | | | | Restore contexts for /etc/{resolv.conf, adjtime}, they are created dynamically and the incorrect contexts maybe prevent some programs from valid accessing. /etc/resolv.conf: etc_t:SystemHigh -> etc_t:SystemLow /etc/adjtime: etc_t:SystemHigh -> adjtime_t:SystemLow Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* audit: upgrade 2.3.2 -> 2.4.3Li xin2015-08-076-3065/+125
| | | | | | | | | | | | | | | | 1) Remove audit-for-cross-compiling.patch and disable-ldap.patch since it it not needed anymore. 2) Modify audit-python-configure.patch audit-python.patch fix-swig-host-contamination.patch,since configure.ac and Makefile.am has been changed in 2.4.3 3) Warning Fix: -WARNING: QA Issue: audit: configure was passed unrecognised options: --without-ldap [unknown-configure-option] -WARNING: QA Issue: audit: Files/directories were installed but not shipped in any package Signed-off-by: Li Xin <lixin.fnst@cn.fujitsu.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* udev: restorecon /run to allow mdadm creating /run/mdadmWenzong Fan2015-08-071-0/+3
| | | | | | | | | | | | | | | | | | | This change bases on the factors during bootup: a. the default type for /run is var_run_t; b. the type for /run will be changed to tmpfs_t after tmpfs mounted; c. the type for /run will be fixed after populate-volatile.sh run. udev service is started in b->c period, fix the type for /run from udev init script to remove: avc: denied { write } for pid=294 comm="mdadm" \ name="/" dev="tmpfs" ino=10581 \ scontext=system_u:system_r:mdadm_t:s0-s15:c0.c1023 \ tcontext=system_u:object_r:tmpfs_t:s0 tclass=dir Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* mcstrans: remove dependency on bash in initscriptJoe MacDonald2015-08-072-0/+13
| | | | | | | There were no apparent bashisms in mcstrans.init, so remove the dependency on bash. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* policycoreutils: enable mcstransdRoy Li2015-08-075-4/+126
| | | | | | | | | mcstransd is a daemon to translate SELinux MCS/MLS sensitivity labels, policycoreutils includes mcstransd whose version is newer than that from http://mcstrans.sourcearchive.com/ Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* Fix setools building (-fPIC error)tprrt2015-08-071-0/+3
| | | | | Signed-off-by: tprrt <tprrt@tupi.fr> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* libpam: use wildcard for version and cleanupShrikant Bobade2015-08-073-41/+3
| | | | | | | | | use wildcard for version: adopting libpam upgrade from 1.1.6 to 1.2.1, cleanup older recipe and remove patch sepermit-add-DESTDIR-prefix.patch since the changes already available with latest source. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* linux-yocto: enable selinux support for kernel v3.19Shrikant Bobade2015-06-091-0/+8
| | | | | | | | The default kernel is now v3.19. So we need the selinux support for kernel v3.19, inorder to get selinux enabled images out of box. Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-config: fix the S directory not existant warningDmitry Eremin-Solenikov2015-05-111-0/+2
| | | | | | | | Fix the warning reporing that ${S} directory does not exist by pointing S to ${WORKDIR}. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-config: allow to override 'enforcing' status of SELinuxDmitry Eremin-Solenikov2015-05-111-1/+2
| | | | | | | | Move the 'enforcing' setting to the DEFAULT_ENFORCING variable to allow one to override that setting in a bbappend file. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* perf: conditionally add audit to the DEPENDS listDmitry Eremin-Solenikov2015-05-111-0/+1
| | | | | | | | perf can make use of libaudit if it is present. So let's build perf with audit if we are building a SELinux-enabled distribution. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* iscsi-initiator-utils: fix label for initiatorname.iscsifidoWenzong Fan2015-04-162-0/+124
| | | | | | | | | | | | | | This config file was created by postinstall or initscript, the correct label should be "etc_t", run restorecon /etc/iscsi/initiatorname.iscsi to fix it and remove below avc denied issues: avc: denied { read } for pid=6094 comm="iscsid" \ name="initiatorname.iscsi" dev="sda3" ino=1057846 \ scontext=system_u:system_r:iscsid_t:s0-s15:c0.c1023 \ tcontext=system_u:object_r:etc_runtime_t:s0 tclass=file Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* tar: drop acl PACKAGECONFIG overrideDmitry Eremin-Solenikov2015-04-161-5/+0
| | | | | | | | | Now tar has an option for handling acl enabling/disabling. This is correctly handled by main tar recipe in oe-core. Thus let's drop the incorrect PACKAGECONFIG[acl] override from tar_%.bbappend. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* audit: add bash to audtid runtime dependsDmitry Eremin-Solenikov2015-04-161-0/+1
| | | | | | | | | This is to fix the following QA warning: audit-2.3.2: auditd requires /bin/bash, but no providers in its RDEPENDS [file-rdeps] Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* Fix bad path in d382d5Philip Tricca2015-03-041-0/+0
| | | | | | | | | BBFILE_COLLECTIONS for meta-virtualization is 'virtualization-layer'. This is required to get lxc bbappend working when meta-virtualization is added to bblayers.conf. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* python: use wildcard for versionJoe MacDonald2015-02-251-2/+0
| | | | | | | The current python bbappend doesn't include any patches, so it's reasonable to move to a wildcard for the version. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* policycoreutils: address QA issuesJoe MacDonald2015-02-203-2/+136
| | | | | | | | Both the fixfiles and sandbox utilities had dependencies on bash when they didn't really need to. Update sandbox and patch fixfiles. ifgen is python script, so ensure that python is listed as a runtime dependency. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* layer: update configuration and dependenciesJoe MacDonald2015-02-183-4/+18
| | | | | | | | Add in support for optional bbappends based on the presence of other layers in the project and move the lxc recipe to a meta-virtualization location. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* Add explicit dependency on layers with recipes we bbappend.Philip Tricca2015-02-121-1/+7
| | | | | | | | This is a stop-gap to get meaningful error messages to folks till we get per-layer bbappends implemented. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* ustr: Fix use of bad variable in SRC_URI.Philip Tricca2015-02-101-1/+1
| | | | | Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* dhcp: Use wildcard for version number.Philip Tricca2015-02-101-0/+0
| | | | | Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* coreutils: Use wildcard for version and remove PR.Philip Tricca2015-02-101-2/+0
| | | | | Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-23 17:19:25 +0000