summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* README: Update statusMark Hatle2013-10-021-0/+6
| | | | | Signed-off-by: Mark Hatle <mark.hatle@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libcap-ng: Uprev libcap-ngMark Hatle2013-10-021-6/+3
| | | | | Signed-off-by: Mark Hatle <mark.hatle@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* audit: Uprev to audit 2.3.2Mark Hatle2013-10-026-2564/+234
| | | | | | | | Refactor the audit cross compiling patch. The new patch might have some minor host dependencies. If so, let me know! Signed-off-by: Mark Hatle <mark.hatle@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* swig: Update to latest swig from meta-openembeddedMark Hatle2013-10-024-16/+115
| | | | | | | | | | Updated from: git://git.openembedded.org/meta-openembedded/meta-oe/recipes-devtools/swig As of commit 1d536390dcafe4d539335dec2173aa9ddc3d8b51 Signed-off-by: Mark Hatle <mark.hatle@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* python-ipy: Uprev to latest 0.81 versionMark Hatle2013-10-021-4/+2
| | | | | Signed-off-by: Mark Hatle <mark.hatle@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* distro/*: Update the distro filesMark Hatle2013-10-022-4/+2
| | | | | | | | | Make the oe-selinux.conf the base configuration file. Ensure that we enable acl and xattr support as well. Signed-off-by: Mark Hatle <mark.hatle@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* layer.conf: avoid unnecessary early expansion with :=Christopher Larson2013-10-021-3/+3
| | | | | | | bitbake handles immediate expansions of LAYERDIR for us automatically. Signed-off-by: Christopher Larson <chris_larson@mentor.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* selinux: remove reference to locale env files from loginQiang Chen2013-10-022-4/+1
| | | | | | | | | | | | | | | [ CQID: WIND00425413 ] pam.d/login refered to the /etc/default/locale env file. This file is not used in oe-core/Poky. Remove the this reference to avoid error messages in auth.log. Signed-off-by: Qiang Chen <qiang.chen@windriver.com> Signed-off-by: Jeff Polk <jeff.polk@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* linux-yocto: Add support for the 3.10 kernelMark Hatle2013-10-022-0/+6
| | | | | | | Also update the selinux.cfg file to add ext4, jfs, and jffs2 support. Signed-off-by: Mark Hatle <mark.hatle@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* kernel: add BBAPPEND for linux 3.10Xin Ouyang2013-10-021-0/+6
| | | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* busybox: alternatives link to sh wrappers for commandsXin Ouyang2013-10-023-2/+94
| | | | | | | | | | | | | | | | | | | | | | While directly using busybox[.[no]suid] as the alternatives' targets, commands could not get correct security labels. ~# ls -l /sbin/getty ..... /sbin/getty -> /bin/busybox.nosuid ~# ls -Z /bin/busybox.nosuid system_u:object_r:bin_t:s0 /bin/busybox.nosuid Add sh wrappers for commands so selinux could work fine. ~# ls -l /sbin/getty ..... /sbin/getty -> /usr/lib/busybox/sbin/getty ~# ls -Z /usr/lib/busybox/sbin/getty system_u:object_r:getty_exec_t:s0 /usr/lib/busybox/sbin/getty ~# cat /usr/lib/busybox/sbin/getty #!/bin/busybox.nosuid Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy*: remove old version recipes and patches.Xin Ouyang2013-10-0244-2380/+0
| | | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy*: add new version 2.20130424Xin Ouyang2013-10-0239-0/+1753
| | | | | | | | | | | | | | | | | | | These patches are removed because new version merged: - poky-fc-update-alternatives_tinylogin.patch - poky-fc-fix-prefix-path_rpc.patch - poky-fc-fix-portmap.patch - poky-fc-cgroup.patch - poky-fc-networkmanager.patch - poky-policy-allow-dbusd-to-setrlimit-itself.patch - poky-policy-allow-dbusd-to-exec-shell-commands.patch - poky-policy-allow-nfsd-to-bind-nfs-port.patch Add two new patches: + poky-policy-fix-setfiles-statvfs-get-file-count.patch + poky-policy-fix-dmesg-to-use-dev-kmsg.patch Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* udev/init: work around dev-cache restore problemsJoe MacDonald2013-10-022-29/+66
| | | | | | | | | | | | | | | | Restoring from the dev-cache with selinux enforcing causes various failures as devices are lacking, at a minimum, reasonable types and attributes. If, on the other hand, we at least create the cache with selinux and xattrs preserved and restored, we get significantly fewer errors and warnings on boot and we can successfully restore the context further down in init anyway. It still leaves some devices mislabeled, though, and still produces warnings on boot. Previous versions of the initscript removed all use of the dev-cache, if need be, we fall back to that. It is possible to get the middle-ground behaviour by defining use_udev_cache at the top of the udev initscript. Signed-off-by: Joe MacDonald <joe@deserted.net>
* udev/init: sync to latest poky versionMark Hatle2013-10-021-55/+103
| | | | | | | | | | | | [ CQID: WIND00424385 ] Sync with the latest init file from poky as of 09172013. Changes include: - adding /sbin/restorecon on start - specifying full path for /sbin/udevadm Signed-off-by: Mark Hatle <mark.hatle@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* always force to restore file contexts in initscriptsXin Ouyang2013-10-0210-15/+15
| | | | | | | | | | | In policycoreutils-2.13+, restorecon changes its default behaviour, and does not restore context if the file' type is correct, even its mcs/mls level is incorrect. We should force it always to restore file contexts in initscripts to avoid issues. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* policycoreutils: fix wrong newrole/run_init pam configXin Ouyang2013-10-022-6/+6
| | | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* sepolgen: migrate SRC_URI to 1.1.9Xin Ouyang2013-10-021-3/+3
| | | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* policycoreutils: migrate SRC_URI and patches to 2.1.14Xin Ouyang2013-10-025-350/+52
| | | | | | | | 2.1.14 imports a new python module: sepolicy, so add setools to DEPENDS and split new files to policycoreutils-python. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libsepol: migrate SRC_URI to 2.1.9Xin Ouyang2013-10-021-3/+3
| | | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libsemanage: migrate SRC_URI to 2.1.10Xin Ouyang2013-10-021-4/+4
| | | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libselinux: migrate SRC_URI and patches to 2.1.13Xin Ouyang2013-10-022-964/+5
| | | | | | | We will also uprev refpolicy, so remove "revert-libpcre.patch". Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* checkpolicy: migrate SRC_URI to 2.1.12Xin Ouyang2013-10-021-3/+3
| | | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* selinux userspace: uprev packages to release 20130423Xin Ouyang2013-10-028-12/+12
| | | | | | | | | | | | | | | Upreved packages: - checkpolicy to 2.1.12 - libselinux to 2.1.13 - libsemanage to 2.1.10 - libsepol to 2.1.9 - policycoreutils to 2.1.14 - sepolgen to 1.1.9 Migrate patches in next commits. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* tar: add acl dependency informationJoe Slater2013-10-021-1/+9
| | | | | | | | | If acl is a distro feature, we want to depend on it. Note that without the xattrs patch, tar cannot deal with acl information. Signed-off-by: Joe Slater <jslater@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* Add ${bindir}/sepolgen to system-config-selinux package.Philip Tricca2013-09-271-1/+4
| | | | | | | | | | Currently the policycoreutils package has a broken link from ${bindir}/sepolgen to ${datadir}/system-config-selinux/polgen.py. All of the other polgen stuff is in system-config-selinux so adding sepolgen to same package seems like the right thing to do. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* Check for the availability of 'secon' and 'setenforce' in the ↵Philip Tricca2013-09-271-3/+5
| | | | | | | | | selinux-init.sh script. This is for consistency and to aid in debugging. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* Resend: Install policy headers and include them in the refpolicy dev package.Philip Tricca2013-09-271-1/+5
| | | | | | | | | | | | To do this we call the 'install-headers' make target at the end of do_install. We then add the interface 'include' directory to the dev package leaving only the policy modules in the main policy package. This allows projects that ship their own SELinux policy (not in the refpolicy) to build the refpolicy headers / interface files by using the Makefile supplied by refpolicy. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* openssh: add PACKAGECONFIG data regarding auditJoe Slater2013-09-271-1/+9
| | | | | | | | Define audit related parameters, but do not enable audit support by default. Signed-off-by: Joe Slater <jslater@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* Add util-linux-agetty to core-image-selinux IMAGE_INSTALL.Philip Tricca2013-09-261-0/+1
| | | | | | | | | | | | Currently logins to core-image-selinux images through a getty (serial) fail. This is caused by the use of the busybox getty. SELinux depends on executable files and their labels to transition between types. The symlink to busybox is not sufficient to cause the getty processes to transition to the right SELinux context. Using a getty binary like the one provided by util-linux fixes this. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* documentation: update guidance for runqemuJoe MacDonald2013-09-251-0/+8
| | | | | | | | Testing SELinux on QEMU occasionally results in OOM conditions during a relabel from time to time. Update the documentation to warn about this and suggest a way to avoid the situation. Signed-off-by: Joe MacDonald <joe@deserted.net>
* Stage SELinux config file in the sysroot.Philip Tricca2013-09-251-0/+3
| | | | | | | | | | | | | This is needed to build policy modules outside of the refpolicy. Policy module build systems need to determine the name of the policy that will be in effect on the target host. This allows them to locate the policy headers that will be under $sysroot/usr/share/selinux/$name/include. Given that there *could* be more than one policy installed in the sysroot we can't assume that the policy installed there is the only policy to build against. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* Add leading whitespace to DISTRO_FEATURES_append in oe-selinux.confPhilip Tricca2013-09-231-1/+1
| | | | | | | | | | | The lack of leading whitespace was causing two values in the DISTRO_FEATURES variable to be combined. This was causing 'sysvinit' from DISTRO_FEATURES_BACKFILL and 'pam' (from oe-selinux) to be combined into 'sysvinitpam' thus dropping both from the DISTRO_FEATURES. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* gnupg: uprev to 2.0.20 to fit oe-coreXin Ouyang2013-08-271-0/+0
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* mesa: uprev to oe-core version 9.1.6Xin Ouyang2013-08-221-0/+0
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* sudo: uprev to oe-core version 1.8.7Xin Ouyang2013-08-221-0/+0
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* net-tools: uprev to oe-core version 1.60-25Xin Ouyang2013-08-221-0/+0
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* cronie: uprev to oe-core version 1.4.11Xin Ouyang2013-08-221-0/+0
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* util-linux: uprev to oe-core version 2.23.2Xin Ouyang2013-08-221-0/+0
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* glib-2.0: uprev to oe-core version 2.36.4Xin Ouyang2013-08-221-0/+0
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* policycoreutils: fix genhomedircon constructionJoe Slater2013-08-012-1/+28
| | | | | | | | | | CQID: 418197 Reference /usr/sbin instead of the directory into which the script is installed on the host. Signed-off-by: Joe Slater <jslater@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* audit: Fixed swig host contamination issueAnders Hedlund2013-08-013-5/+56
| | | | | | | | | | | | | CQID: 428272 The audit build uses swig to generate a python wrapper. Unfortunately, the swig info file references host include directories. Some of these were previously noticed and eliminated, but the one fixed here was not. Signed-off-by: Anders Hedlund <anders.hedlund@windriver.com> Signed-off-by: Joe Slater <jslater@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* dbus/glib-2.0/augeas/mesa: Rebase bbappends to oe-core 20130801Mark Hatle2013-08-024-8/+0
| | | | | | Rebase the bbappends to match the current oe-core versions. Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* libxcb: Uprev to latest oe-core versionMark Hatle2013-08-011-0/+0
| | | | Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* tinylogin: No longer in oe-core, remove bbappendMark Hatle2013-08-011-15/+0
| | | | Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* packagegroup-core-selinux: Rename from task to packagegroupMark Hatle2013-08-012-5/+5
| | | | | | | | | Also fix ALLOW_EMPTY, oe-core does not allow ALLOW_EMPTY w/o a package name. Adjust references in core-image-selinux to the new packagegroup filename. Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* selinux packages: uprev git recipes to lastest tag 20130423.Xin Ouyang2013-06-1810-19/+95
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* findutils-4.4.2: fix conflict with new oe-core patchXin Ouyang2013-06-171-1/+1
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* mesa: uprev to 9.1.3 to fit oe-coreXin Ouyang2013-06-171-0/+0
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* libpcre: uprev to 8.33 to fit oe-coreXin Ouyang2013-06-171-0/+0
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-05 22:12:36 +0000