summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* refpolicy / minimum: support compressed policyWenzong Fan2014-08-281-8/+18
| | | | | Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* refpolicy: split do_install to three stepsWenzong Fan2014-08-281-14/+25
| | | | | | | | | | | | | Split do_install() to: + prepare_policy_store() + rebuild_policy() + install_misc_files() This allows to make partial change to do_install() instead of re-write it totally from specific refpolicy bb file. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* libcap-ng: CVE-2014-3215Shan Hai2014-08-282-1/+82
| | | | | | | | | | | | | | | seunshare in policycoreutils 2.2.5 is owned by root with 4755 permissions, and executes programs in a way that changes the relationship between the setuid system call and the getresuid saved set-user-ID value, which makes it easier for local users to gain privileges by leveraging a program that mistakenly expected that it could permanently drop privileges. Pick a patch from below link to address the CVE-2014-3215. https://bugzilla.redhat.com/attachment.cgi?id=829864 Signed-off-by: Shan Hai <shan.hai@windriver.com> Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* gnupg: remove PRChong Lu2014-08-281-2/+0
| | | | | | | Remove PR, since oe-core has a new version. Signed-off-by: Chong Lu <Chong.Lu@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* rpm: remove PRChong Lu2014-08-281-2/+0
| | | | | | | Remove PR, since oe-core has a new version. Signed-off-by: Chong Lu <Chong.Lu@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* swig-native: repair patching errorJoe MacDonald2014-07-191-8/+9
| | | | Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* swig: use pkg-config for pcre detection.Koen Kooi2014-07-152-1/+67
| | | | | | | | | | Adapted from the original patch submitted to meta-oe for swig 2.0.12. OE-core commit 5870bd272b0b077d0826fb900b251884c1c05061 sabotaged the binconfig way. Signed-off-by: Koen Kooi <koen.kooi@linaro.org> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* rpm: bbappend to 5.4.14 to fit oe-coreXin Ouyang2014-07-141-0/+0
| | | | Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* gnupg: use wildcard in nameArmin Kuster2014-07-011-0/+0
| | | | | | | There are two versions of gnupg so limit the wildcard to the 2.x series Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* dhcp/init-server: restorecon for dhcpd*.leasesWenzong Fan2014-06-231-0/+8
| | | | | | | | | | | | | | | dhcp-server fails to start with avc denied error: avc: denied { read } for pid=571 comm="dhcpd" \ name="dhcpd.leases" dev="hda" ino=63911 \ scontext=system_u:system_r:dhcpd_t:s0-s15:c0.c1023 \ tcontext=system_u:object_r:dhcp_state_t:s0 tclass=file The type for dhcpd.leases is not correct, just fix it before dhcp- server started. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* dhcp: make a copy of init-serverWenzong Fan2014-06-232-0/+47
| | | | | Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* initscripts/devpts.sh: fix context for /dev/ptsWenzong Fan2014-06-231-0/+1
| | | | | | | | | | | | | devpts use file_use_trans to allocate security contexts. As there are no range_trans rules for initrc_t mounting devpts, the security level of mountpoint will be derived from the initrc process, to be systemhigh (s15:c0.c1023), instead of expected systemlow(s0). This will block login shells to search PTYs, so use restorecon to fix this. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* initscripts: add a local copy of devpts.shWenzong Fan2014-06-232-0/+30
| | | | | | | | Start point to make SELinux specific changes in devpts.sh, copied from oe-core layer. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* libpcre: Use wildcard for version number in bbappend.Xin Ouyang2014-06-231-0/+0
| | | | Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* setools: Add bison-native and flex-native to DEPENDSChong Lu2014-06-021-1/+1
| | | | | | | Avoid policy_scan.c: No such file or directory Signed-off-by: Chong Lu <Chong.Lu@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* refpolicy: Allow udev the block_suspend capabilityJackie Huang2014-06-022-0/+26
| | | | | | | | | | Fix the avc denied issue: type=1400 audit(1399440994.656:14): avc: denied { block_suspend } for pid=80 comm="udevd" capability=36 scontext=system_u:system_r:udev_t:s0-s15:c0.c1023 tcontext=system_u:system_r:udev_t:s0-s15:c0.c1023 tclass=capability2 The patch is backported from upstream Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* setools: not override do_configure in autotools class.Xin Ouyang2014-05-161-7/+7
| | | | Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* refpolicy-*: un-inherit because not autotools packageXin Ouyang2014-05-161-4/+3
| | | | Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* kernel: remove 3.8 bbappend to follow oe-core changes.Xin Ouyang2014-05-161-7/+0
| | | | Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* mesa: Use wildcard for version number in bbappend.Xin Ouyang2014-05-161-0/+0
| | | | Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* psmisc: Use wildcard for version number in bbappend.Xin Ouyang2014-05-162-267/+0
| | | | Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* augeas: Use wildcard for version number in bbappend.Xin Ouyang2014-05-161-0/+0
| | | | Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* util-linux: Use wildcard for version number in bbappend.Xin Ouyang2014-05-162-8/+3
| | | | Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* glib-2.0: Use wildcard for version number in bbappend.Xin Ouyang2014-05-161-0/+0
| | | | Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* dbus: Use wildcard for version number in bbappend.Xin Ouyang2014-05-161-0/+0
| | | | Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* openssh: Use wildcard for version number in bbappend.Xin Ouyang2014-05-161-0/+0
| | | | Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* bind: Use wildcard for version number in bbappend.Xin Ouyang2014-05-161-0/+0
| | | | Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* initscripts/checkroot.sh: restore file contexts for /runJackie Huang2014-05-091-0/+2
| | | | | | | | | The file contexts for /run is incorrect while running checkroot.sh in boot time which causes mount fail to create new dir and file in /run, so restore the security contexts in it. Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* linux-yocto: migrate from 3.10 to 3.14Joe MacDonald2014-05-091-1/+0
| | | | | | | | The default kernel is now 3.14. Since the removal of PRINC support leaves the 3.10 recipe in a difficult-to-work-with state, now seems like a good time to move to the new kernel. Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: remove PRINC warningHongxu Jia2014-05-097-7/+6
| | | | | | | | | | Bump up PR and remove PRINC. Set it to something suitably large that it's unlikely to break anyone's package feed and so that it shows it's clearly an exception case. Obviously this is just a staging activity until the next update when we don't include anything of the sort. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* checkpolicy: remove PRINC warningHongxu Jia2014-05-093-4/+2
| | | | | | | | | | Bump up PR and remove PRINC. Set it to something suitably large that it's unlikely to break anyone's package feed and so that it shows it's clearly an exception case. Obviously this is just a staging activity until the next update when we don't include anything of the sort. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libselinux: remove PRINC warningHongxu Jia2014-05-093-4/+2
| | | | | | | | | | Bump up PR and remove PRINC. Set it to something suitably large that it's unlikely to break anyone's package feed and so that it shows it's clearly an exception case. Obviously this is just a staging activity until the next update when we don't include anything of the sort. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libsemanage: remove PRINC warningHongxu Jia2014-05-093-4/+2
| | | | | | | | | | Bump up PR and remove PRINC. Set it to something suitably large that it's unlikely to break anyone's package feed and so that it shows it's clearly an exception case. Obviously this is just a staging activity until the next update when we don't include anything of the sort. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libsepol: remove PRINC warningHongxu Jia2014-05-093-4/+2
| | | | | | | | | | Bump up PR and remove PRINC. Set it to something suitably large that it's unlikely to break anyone's package feed and so that it shows it's clearly an exception case. Obviously this is just a staging activity until the next update when we don't include anything of the sort. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* sepolgen: remove PRINC warningHongxu Jia2014-05-093-4/+2
| | | | | | | | | | Bump up PR and remove PRINC. Set it to something suitably large that it's unlikely to break anyone's package feed and so that it shows it's clearly an exception case. Obviously this is just a staging activity until the next update when we don't include anything of the sort. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libpcre_8.34.bbappend: remove PRINC warningHongxu Jia2014-05-091-1/+1
| | | | | | | | | | | | The libpcre has been upgrade to 8.34 in oe-core, but since we were still using PRINC until now, we'll need to keep it around (in a PR form), so set it to something suitably large that it's unlikely to break anyone's package feed and so that it shows it's clearly an exception case. Obviously this is just a staging activity until the next update when we don't include anything of the sort. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* policycoreutils: remove PRINC warningHongxu Jia2014-05-093-4/+2
| | | | | | | | | | Bump up PR and remove PRINC. Set it to something suitably large that it's unlikely to break anyone's package feed and so that it shows it's clearly an exception case. Obviously this is just a staging activity until the next update when we don't include anything of the sort. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libsemanage: disable expand-check on policy loadJoe MacDonald2014-05-072-0/+33
| | | | | | | | | For small policy modules it's not necessary to walk the hierarchy on load. On embedded devices that are low-powered or resource-constrained disabling the hierarchy processing can make the difference between seconds and (many) minutes of load time (or being able to load the policy at all). Signed-off-by: Joe MacDonald <joe@deserted.net>
* udev init: restorecon for /dev/shm, /dev/ptsWenzong Fan2014-04-241-1/+1
| | | | | Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* initscripts: always force to restore file contexts for /var/libWenzong Fan2014-04-241-1/+1
| | | | | Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* policycoreutils: fix TypeError for seobject.pyWenzong Fan2014-04-242-0/+33
| | | | | | | | | | | Fix python error about: File "/usr/lib64/python2.7/site-packages/seobject.py", line 109, in log message += " sename=" + sename TypeError: cannot concatenate 'str' and 'NoneType' objects Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* policycoreutils / semanage: process ValueError for sepolicy, seobjectWenzong Fan2014-04-242-0/+49
| | | | | | | | | The sepolicy, seobject modules raise many unprocessed ValueError, just process them in semanage to make the script proivdes error message but not error trace. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: add setrans.conf for mcs/mls policyWenzong Fan2014-04-243-0/+77
| | | | | | | | | | | | | | | Add initial version for setrans.conf: - setrans-mls.conf: copied from \ policycoreutils/mcstrans/share/examples/default/setrans.conf - setrans-mcs.conf: copied from radhat policy. This fixes below issue: $ chcat -L IOError: No such file or directory: \ '/etc/selinux/$POLICY_NAME/setrans.conf' Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* audit: Enable ARM System Call Audit in user space.Han Chao2014-04-242-0/+48
| | | | | | | | | | | | Audit System Call needs kernel and user space support. In user space it needs system call table for ARM. It also needs a configure option --with-armeb for build audit. Audit system call also needs enable kernel config CONFIG_AUDITSYSCALL. Signed-off-by: Han Chao <chan@windriver.com> Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: add minimum targeted policyWenzong Fan2014-04-241-0/+46
| | | | | | | | | | This is a minimum targeted policy with just core policy modules, and could be used as a base for customizing targeted policy. Pretty much everything runs as initrc_t or unconfined_t so all of the domains are unconfined. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: add targeted policy typeWenzong Fan2014-04-243-0/+276
| | | | | | | | | | | This SELinux policy would targeted most of service domains for lock down, and users and admins will login in with unconfined_t domain. So they would have the same access to the system as if SELinux was not enabled, when running commands and services which are not targeted. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* audit: Fix lack of a default audit.rulesMark Hatle2014-04-072-1/+6
| | | | | | | | | | | | | | | Various components were failing, and upon investigation it was noted that the audit.rules file referenced by the initscript wasn't available. There was however a copy under the rules.d directory. Investigating the audit.spec file (which in the upstream source) showed that it was expected that the version in the rules.d should be copied into /etc/audit. Do this and correct the systemd services file to use the same file. Signed-off-by: Mark Hatle <mark.hatle@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* mesa: add dependency on libselinux-nativeJoe Slater2014-04-031-0/+5
| | | | | | | | | mesa builds a host utility named builtin_compiler, and that needs selinux, too, if --enable-selinux is specfied to configure. Signed-off-by: Joe Slater <jslater@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* policycoreutils: Add missing dependencies to semanagePeter Seebach2014-04-031-0/+2
| | | | | | | | The semanage utility requires python-compression (for "import gzip") and python-xml (for "import xml.etree.ElementTree"). Signed-off-by: Peter Seebach <peter.seebach@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* checkpolicy: Don't link against libflChong Lu2014-04-032-0/+46
| | | | | | | | | | In policy_scan.l file, we have already removed all references to yywrap by adding "%option noyywrap" statements to each flex source file that doesn't override yywrap. After this, we no longer need to link against libfl and so no longer get errors about undefined references to yylex. Signed-off-by: Chong Lu <Chong.Lu@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-05 09:53:02 +0000