summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* refpolicy: update to latest git revHEADwalnascarmasterYi Zhao2025-04-222-7/+7
| | | | | | | | | | | * 5a6c7d8bf systemd: Add log env to systemd-machine-id-setup. * 33af8dfa4 Module for ipmitool * a3a6b1704 oddjob: allow oddjob_mkhomedir_t privfd:fd use * 621eb6caf systemd: allow reading /dev/cpu/0/msr * fb0e9cdda Remove unneeded backticks from gen_tunable * 2240e1a89 locallogin: allow sulogin_t user_tty_device_t rw Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* refpolicy: update to latest revYi Zhao2025-04-022-22/+6
| | | | | | | | | | | | | | | | | | | | | | | | * d05a0d068 networkmanager: Watch systemd directories for nm-session-monitor. * 3a60340e9 systemd: allow systemd-hostnamed and systemd-rfkill to get attributes of nsfs inodes * ccbf1d66f fixup! Allow to specify module version * d664ebbaa Allow to specify module version * 1c8a95dbc Fix mislabeling of /etc/shadow * ec2b2befd locallogin: allow sulogin_t unconfined domtrans * 450522052 use init_use_script_ptys for knotc in initscript * 79dda56d3 locallogin: dontaudit sulogin_t checkpoint_restore * 4b3b8e7ce lldpad: Configure FW-LLDP on i40e NICs. * ed9d87976 Revert "Merge pull request #867 from PPN-SD/upd-knot-sel" * e053fced8 files, init: filetrans /run/machine-id etc_runtime_t * c5a76add7 firewalld: fix firewalld_t firewalld_tmpfs_t exec * 8a4043060 firewalld: fix lib_t Python cache denial auditing * bcb8e1d4d unconfined: fix oddjob security_compute_sid * ec8a5080a Permit init_t to start a detached screen session * b025e0ec4 Add setcap to knotd / add knotc_initrc_domtrans * 231960371 chronyd: fix dac_read_search denials Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* selinux: upgrade 3.8 -> 3.8.1Yi Zhao2025-03-1015-1/+1
| | | | | | | | | | ChangeLog: https://github.com/SELinuxProject/selinux/releases/tag/3.8.1 * libsemanage: improved performance of semanage store rebuild Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
* refpolicy: update to 20250213+gitYi Zhao2025-03-0767-243/+461
| | | | | | | | | | | | ChangeLog: https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20250213 * Add tool for validating appconfig contexts files. * Add netlink extended permissions definitions. * Updates for Systemd up to v257. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
* selinux: upgrade 3.7 -> 3.8Yi Zhao2025-03-0723-539/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | ChangeLog: https://github.com/SELinuxProject/selinux/releases/tag/3.8 * libsemanage: Preserve file context and ownership in policy store * libselinux: deprecate security_disable(3) * libsepol: Support nlmsg extended permissions * libsepol: Add policy capability netlink_xperm * libsemanage: Optionally allow duplicate declarations * policycoreutils: introduce unsetfiles * libselinux/utils: introduce selabel_compare * improved selabel_lookup performance * libselinux: support parallel usage of selabel_lookup(3) * libsepol: add support for xperms in conditional policies * Improved man pages * Code improvements and bug fixes * Always build for LFS mode on 32-bit archs. * libsemanage: Mute error messages from selinux_restorecon introduced in 3.8-rc1 * Regex spec ordering is restored to pre 3.8-rc1 * Binary fcontext files format changed, files using old format are ignored * Code improvements and bug fixes License-Update: White space cleanup for libsemanage/LICENSE Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
* setools: inherit cython classYi Zhao2025-03-071-6/+2
| | | | | | | | Use the new cython class to avoid duplicated fixup code to remove build paths. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
* compat: add walnascar to compat listJoe MacDonald2024-12-101-1/+1
| | | | Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
* SELinux-FAQ: drop debug-tweaksYi Zhao2024-12-101-1/+1
| | | | | | | | The debug-tweaks IMAGE_FEATURE has been removed in oe-core. Replace it with allow-empty-password. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
* libsemanage: fix build with swig 4.3Yi Zhao2024-12-102-0/+423
| | | | | | | | | Backport a patch to fix build with swig 4.3[1]. [1] https://github.com/SELinuxProject/selinux/issues/447 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
* libselinux-python: fix build with swig 4.3Yi Zhao2024-12-102-0/+92
| | | | | | | | | Backport a patch to fix build with swig 4.3[1]. [1] https://github.com/SELinuxProject/selinux/issues/447 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
* libpam: drop packageconfig for selinuxYi Zhao2024-12-101-3/+0
| | | | | | | | | | Remove PACKAGECONFIG[selinux] as it has been added to libpam recipe in oe-core[1] and updated for meson. [1] https://git.openembedded.org/openembedded-core/commit/?id=15d0cb7c4b1278e869f440f949f5e9af2d305429 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
* selinux-python: fix sepolicy runtime errorYi Zhao2024-10-102-0/+62
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For some distributions (e.g. Yocto) that do not provide system-release/distribution-release file, libdnf can not get releasever variable, causing conf.substitutions['releasever'] to not be set. This will cause 'sepolicy generate' command to fail with the following error on these distributions: $ sepolicy generate --init /usr/local/bin/foo Traceback (most recent call last): File "/usr/bin/sepolicy", line 702, in <module> args.func(args) File "/usr/bin/sepolicy", line 569, in generate mypolicy.gen_writeable() File "/usr/lib/python3.12/site-packages/sepolicy/generate.py", line 1302, in gen_writeable self.__extract_rpms() File "/usr/lib/python3.12/site-packages/sepolicy/generate.py", line 1268, in __extract_rpms base.read_all_repos() File "/usr/lib/python3.12/site-packages/dnf/base.py", line 554, in read_all_repos for repo in reader: ^^^^^^ File "/usr/lib/python3.12/site-packages/dnf/conf/read.py", line 42, in __iter__ for r in self._get_repos(self.conf.config_file_path): ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3.12/site-packages/dnf/conf/read.py", line 109, in _get_repos parser.setSubstitutions(substs) File "/usr/lib/python3.12/site-packages/libdnf/conf.py", line 1643, in setSubstitutions return _conf.ConfigParser_setSubstitutions(self, substitutions) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ TypeError: in method 'ConfigParser_setSubstitutions', argument 2 of type 'std::map< std::string,std::string,std::less< std::string >,std::allocator< std::pair< std::string const,std::string > > > const &' Set conf.substitutions['releasever'] to empty str if releasever is None. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
* refpolicy: upgrade 20240226+git -> 20240916+gitYi Zhao2024-10-0962-135/+224
| | | | | | | | | | | | | | | | | | ChangeLog: https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20240916 Notable Changes Added sechecker configuration for GitHub CI actions. Cleaned up concerning permissions uncovered by sechecker Removed extremely deprecated domains in cups (ptal) and xen (xend/xm) Systemd updates up to v256 Various container fixes New Modules haproxy Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
* layer.conf: set LAYERSERIES_COMPAT to styheadDmitry Baryshkov2024-09-241-1/+1
| | | | | | | OE-Core has switched the master branch to styhead, follow the change. Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
* refpolicy: update to latest git revYi Zhao2024-09-245-141/+108
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Update policy for systemd-v256 c20cf2214 systemd: allow systemd-hostnamed to read vsock device 4f3437040 systemd: fix policy for systemd-ssh-generator d852b7540 devices: add label vsock_device_t for /dev/vsock a4a7b830f systemd: add policy for systemd-nsresourced 47081be47 systemd: allow system --user to create netlink_route_socket 78cacc708 systemd: allow systemd-networkd to manage sock files under /run/systemd/netif 29d0bb8c3 systemd: set context to systemd_networkd_var_lib_t for /var/lib/systemd/network 22fd3ddad Allow interactive user terminal output for the NetLabel management tool. c1284c601 bluetooth: Move line. 50a5555f2 Adding SE Policy rules to allow usage of unix stream sockets by dbus and bluetooth contexts when Gatt notifications are turned on by remote. 2b8fa2b4a kubernetes: allow kubelet to connect all TCP ports 9ab94df30 container: allow reading generic certs 7530dfa3c testing: add container_kvm_t to net admin exempt list 47eced9be Makefile: drop duplicate quotes b0b0d52dd various: rules required for DV manipulation in kubevirt 21e4a44c0 container: add container_kvm_t and supporting kubevirt rules a9bd177bb iptables: allow reading container engine tmp files af0b40824 container: allow spc various rules for kubevirt d585f08c2 container, kubernetes: add supporting rules for kubevirt and multus 9f37f86b2 dbus: dontaudit session bus domains the netadmin capability d9ca32f5a container: allow super privileged containers to manage BPF dirs 1900fbe68 kubernetes: allow kubelet to create unlabeled dirs b9c8ba607 haproxy: allow interactive usage 846804c58 podman: allow managing init runtime units 8787b3d8d iptables: allow reading usr files * Drop obsolete patches: 0033-policy-modules-services-rpcbind-allow-rpcbind_t-to-c.patch 0039-policy-modules-system-authlogin-fix-login-errors-aft.patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
* setools: switch to PEP-517 build backendYi Zhao2024-08-261-4/+3
| | | | | | | | | | Fix QA warning: WARNING: setools-4.5.1-r0 do_check_backend: QA Issue: inherits setuptools3 but has pyproject.toml with setuptools.build_meta, use the correct class [pep517-backend] Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
* mesa: rename mesa_%.bbappend to mesa.bbappendYi Zhao2024-08-261-0/+0
| | | | | | | | | | The mesa recipe in oe-core layer was renamed to mesa.bb in commit[1]. Rename bbappend to adapt this change. [1] https://git.openembedded.org/openembedded-core/commit/?id=f5cfb3e23603cefb2f3f6bfe776afaedefd10808 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
* Add SELinux specific configuration snippet for busybox.Weisser, Pascal2024-08-262-0/+7
| | | | | | | | | This patch adds a SELinux specific configuration snippet for busybox to enable SELinux support in busybox out of the box. This is needed to enable SELinux specific command line options for certain commands like ps -Z. Signed-off-by: "Weisser, Pascal" <pascal.weisser.ext@karlstorz.com> Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
* README: use simpler syntax to enable systemdEtienne Cordonnier2024-08-261-4/+1
| | | | | | | | The variable INIT_MANAGER was added in yocto version Zeus / 3.0 and makes the selection of systemd easier. See https://git.yoctoproject.org/poky/commit/?id=7508711b3835cc7890d46fda1b4a1c3da196ec9a for details. Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com> Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
* Fwd: [yocto-patches] [meta-selinux][PATCH 2/2] README: remove outdated sectionYi Zhao2024-08-261-16/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 X-Mozilla-Keys: Received: from MW4PR11MB6983.namprd11.prod.outlook.com (2603:10b6:303:226::12) by DS0PR11MB6399.namprd11.prod.outlook.com with HTTPS; Fri, 21 Jun 2024 12:13:05 +0000 Received: from DM6PR17CA0028.namprd17.prod.outlook.com (2603:10b6:5:1b3::41) by MW4PR11MB6983.namprd11.prod.outlook.com (2603:10b6:303:226::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7698.24; Fri, 21 Jun 2024 12:13:01 +0000 Received: from CY4PEPF0000E9CF.namprd03.prod.outlook.com (2603:10b6:5:1b3:cafe::64) by DM6PR17CA0028.outlook.office365.com (2603:10b6:5:1b3::41) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7677.32 via Frontend Transport; Fri, 21 Jun 2024 12:13:01 +0000 Authentication-Results: spf=softfail (sender IP is 205.220.178.238) smtp.mailfrom=lists.yoctoproject.org; dkim=pass (signature was verified) header.d=lists.yoctoproject.org;dmarc=pass action=none header.from=lists.yoctoproject.org;compauth=pass reason=100 Received-SPF: SoftFail (protection.outlook.com: domain of transitioning lists.yoctoproject.org discourages use of 205.220.178.238 as permitted sender) Received: from mx0b-0064b401.pphosted.com (205.220.178.238) by CY4PEPF0000E9CF.mail.protection.outlook.com (10.167.241.134) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7677.15 via Frontend Transport; Fri, 21 Jun 2024 12:13:00 +0000 Received: from pps.filterd (m0250811.ppops.net [127.0.0.1]) by mx0a-0064b401.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 45LA0WVw013142 for <yi.zhao@eng.windriver.com>; Fri, 21 Jun 2024 12:13:00 GMT Resent-Message-Id: <202406211213.45LA0WVw013142@mx0a-0064b401.pphosted.com> Authentication-Results-Original: ppops.net; spf=pass smtp.mailfrom=bounce+126057+363+7283133+13170635@lists.yoctoproject.org; dkim=pass header.d=lists.yoctoproject.org header.s=20240206 Received: from mail05.groups.io (mail05.groups.io [45.79.224.7]) by mx0a-0064b401.pphosted.com (PPS) with ESMTPS id 3yvrmrgtbe-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT) for <yi.zhao@eng.windriver.com>; Fri, 21 Jun 2024 12:12:59 +0000 (GMT) DKIM-Signature: a=rsa-sha256; bh=TT8ntwmtKtPl2tB6NiVOkhrQfWZFAtwP5vxbH3GHUC0=; c=relaxed/simple; d=lists.yoctoproject.org; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References:MIME-Version:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Resent-Date:Resent-From:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Transfer-Encoding; s=20240206; t=1718971979; v=1; b=oNCPpe+FXA6wWG5PFsJ1giL/cmLr5NfA2NWYha0yoXxFyARMduazg2zyaf/6QGaU662OnzYP Bfdr+Yta/S/BxaeUo6jMeKA0CELYniZXEmzkMMPUW9oOoGJpK29MkZsotQ1PsTyhqsZM8fqRPU2 4u0/tvwf7I44QH90p9Ez2oWuaIhB+SxhDY0uTmKBcqZvcVSToxvcfwlU2r77+fhL2M6RyHeVZnp 3DAbIjdDXyiqaEXtaIy06z7vFihoc9RxqbzL1PWyxQXBu5y79P3a1y7LcOuCERozN62OxH8Kiz9 fQq0CENBGBK+vbMJcJJgLkNuhxelpJGhb1JW3JWxreZcw== X-Received: by 127.0.0.2 with SMTP id 0pmZYY7284468x6vNDtZU1pU; Fri, 21 Jun 2024 05:12:58 -0700 X-Received: from mail-lj1-f172.google.com (mail-lj1-f172.google.com [209.85.208.172]) by mx.groups.io with SMTP id smtpd.web10.71540.1718971978379416264 for <yocto-patches@lists.yoctoproject.org>; Fri, 21 Jun 2024 05:12:58 -0700 X-Received: by mail-lj1-f172.google.com with SMTP id 38308e7fff4ca-2ec1620a956so21817691fa.1 for <yocto-patches@lists.yoctoproject.org>; Fri, 21 Jun 2024 05:12:58 -0700 (PDT) X-Gm-Message-State: nrEzuOGVtkykRxLyHa0VzQPAx7283133AA= X-Google-Smtp-Source: AGHT+IFyLIDTVCwYyNsenevEXQWEkW9asNR53S/NqYVKPbIUuFdagEvHbs5qQ1AASpDTZog8ph4UOw== X-Received: by 2002:a2e:7d0b:0:b0:2ec:1a8b:c374 with SMTP id 38308e7fff4ca-2ec3cff5446mr46722221fa.45.1718971975521; Fri, 21 Jun 2024 05:12:55 -0700 (PDT) X-Received: from lj8k2dq3.sc-core.net ([85.237.126.22]) by smtp.gmail.com with ESMTPSA id 4fb4d7f45d1cf-57d305616f5sm863931a12.80.2024.06.21.05.12.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 21 Jun 2024 05:12:55 -0700 (PDT) From: "Etienne Cordonnier via lists.yoctoproject.org" <ecordonnier=snap.com@lists.yoctoproject.org> To: yocto-patches@lists.yoctoproject.org Cc: Etienne Cordonnier <ecordonnier@snap.com> Subject: [yocto-patches] [meta-selinux][PATCH 2/2] README: remove outdated section Date: Fri, 21 Jun 2024 14:12:39 +0200 Message-Id: <20240621121239.594152-2-ecordonnier@snap.com> In-Reply-To: <20240621121239.594152-1-ecordonnier@snap.com> References: <20240621121239.594152-1-ecordonnier@snap.com> Precedence: Bulk List-Subscribe: <mailto:yocto-patches+subscribe@lists.yoctoproject.org> List-Help: <mailto:yocto-patches+help@lists.yoctoproject.org> Sender: yocto-patches@lists.yoctoproject.org List-Id: <yocto-patches.lists.yoctoproject.org> Mailing-List: list yocto-patches@lists.yoctoproject.org; contact yocto-patches+owner@lists.yoctoproject.org Delivered-To: mailing list yocto-patches@lists.yoctoproject.org Resent-Date: Fri, 21 Jun 2024 05:12:58 -0700 Resent-From: ecordonnier@snap.com Reply-To: yocto-patches@lists.yoctoproject.org List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: <https://lists.yoctoproject.org/g/yocto-patches/leave/13170635/7283133/1683771902/plugh> Content-Transfer-Encoding: 8bit X-Proofpoint-GUID: FWA5om2eLEoo41KSX0E6Qqgsi7jqRrZS X-Proofpoint-ORIG-GUID: FWA5om2eLEoo41KSX0E6Qqgsi7jqRrZS X-CLX-Response: 1TFkXGxISEQpMehcbHhMRCllEF2NAWxITa3J8QFlcEQpYWBdtenhATX8cZUx jWhEKeE4Xb0RwWktyU0ZJfXsRCnhLF216eEBNfxxlTGNaEQp5TBdjGmgfGFlQQE0FQxEKQ0gXBx gdEhEKQ1kXBxgSGREKQ0kXGgQaGhoRCllNF2dmchEKWUkXGnEaEBp3BhscEnEeHRAadwYYGgYaE QpZXhdsbGYRCklGF11DRE5YQ1xPWHVCRVleT04RCklHF3hPTREKQ04XbH1rH0VHGE9mb0VFHhth eXIabxx7W01ZQx1AW3hYcHkRClhcFx8EGgQZHBwFGxoEGxsaBBsZHgQZHhAbHhofGhEKXlkXTlt SZkcRCk1cFx8dHhEKTFoXaG1dTV0RCkxGF29ra15raxEKQk8XbR5SRwEYcEhmcmsRCkNaFx4fBB 0TBBgYHgQdEQpCXhcbEQpESRcbEQpCRhdjQFsSE2tyfEBZXBEKQkcXYXNiWHtDfkxTXm8RCkJcF xsRCkJLF2RveEl8XU4eRG0BEQpCSRdvRHBaS3JTRkl9exEKQkUXY1sTSHIFf0B/a2URCkJOF29E cFpLclNGSX17EQpCTBdrZHkYSVBlZmh5ZREKQmwXaXsbH3sbH3tbZ1gRCkJAF29gZHAbTXJoQVh BEQpCWBdoQkhsRkJ+bmVgGREKWlgXHhEKeUMXbnN8GHJZUxloTFwRCllLFx8aGR4RClpLFx8aGR 4RCnBnF2ZaemJjGRhtWEB/EBkaEQpwaBdlZ09+f05LTGMaHxAZGhEKcGgXZU1vaWgbeHpTXHgQG hEKcGgXb1phfWVPS2FlW0MQGhEKcGgXZm0BY2hEAUN/cFkQGhEKcGgXa15jTmR9X3tyTEsQGhEK cGgXZRxlRXheS2keRVAQGhEKcGgXYR97Xk9rSx5iHVAQGhEKcGgXZ2NyGkwbbXNvUm8QGhEKcH0 XZG0YSR0BTBsYfBoQGhEKcH0XZ31ec3h/bGhGZl8QGhEKcH0XYR15TxxtbV5dfVMQGhEKcGcXb0 R6RRhQE0gackMQGRoRCnB9F2hEUxJfY19BXX5HEBoRCnBnF2hhRBNvb3IFYkNiEBkaEQpwfxdpX R9GXVkZH0VcWRATEhEKcF8XY2J6RmxLAUBBe0MQGhEKcF8Xelxfem1GE119E2wQHhIRCnBfF2Ae T3BHXB9vRk9PEBsbEhEKcF8XbB1STEVhQEFZY3MQGRoRCnBsF2l8HV9tUGxsclpeEBoRCm1+Fxo RClhNF0sRIA== X-CLX-Shades: MLX X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1039,Hydra:6.0.680,FMLib:17.12.28.16 definitions=2024-06-21_04,2024-06-21_01,2024-05-17_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 bulkscore=0 priorityscore=149 malwarescore=0 adultscore=0 mlxlogscore=999 phishscore=0 impostorscore=0 mlxscore=0 suspectscore=0 clxscore=188 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.21.0-2406140001 definitions=main-2406210090 domainage_hfrom=5034 domainage_replyto=5034 Return-Path: bounce+126057+363+7283133+13170635@lists.yoctoproject.org X-MS-Exchange-Organization-ExpirationStartTime: 21 Jun 2024 12:13:01.0419 (UTC) X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000 X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit X-MS-Exchange-Organization-Network-Message-Id: 830422a2-9f77-49ae-2947-08dc91eb7ecc X-EOPAttributedMessage: 0 X-EOPTenantAttributedMessage: 8ddb2873-a1ad-4a18-ae4e-4644631433be:0 X-MS-Exchange-Organization-MessageDirectionality: Incoming X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CY4PEPF0000E9CF:EE_|MW4PR11MB6983:EE_|DS0PR11MB6399:EE_ Content-Type: text/plain X-MS-Exchange-Organization-AuthSource: CY4PEPF0000E9CF.namprd03.prod.outlook.com X-MS-Exchange-Organization-AuthAs: Anonymous X-MS-Office365-Filtering-Correlation-Id: 830422a2-9f77-49ae-2947-08dc91eb7ecc X-MS-Exchange-AtpMessageProperties: SA|SL X-MS-Exchange-Organization-SCL: -1 X-Microsoft-Antispam: BCL:0;ARA:13230037|12012899009|4022899006; X-Forefront-Antispam-Report: CIP:205.220.178.238;CTRY:US;LANG:en;SCL:-1;SRV:;IPV:CAL;SFV:SKN;H:mx0b-0064b401.pphosted.com;PTR:mx0b-0064b401.pphosted.com;CAT:NONE;SFS:(13230037)(12012899009)(4022899006);DIR:INB; X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 Jun 2024 12:13:00.6669 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 830422a2-9f77-49ae-2947-08dc91eb7ecc X-MS-Exchange-CrossTenant-Id: 8ddb2873-a1ad-4a18-ae4e-4644631433be X-MS-Exchange-CrossTenant-AuthSource: CY4PEPF0000E9CF.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW4PR11MB6983 X-MS-Exchange-Transport-EndToEndLatency: 00:00:05.0202720 X-MS-Exchange-Processed-By-BccFoldering: 15.20.7698.013 X-Microsoft-Antispam-Mailbox-Delivery: ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003); X-Microsoft-Antispam-Message-Info: =?iso-8859-1?Q?JUhAT0eVIORmMAGo8996vTiWM6l5xMgv0FumAcB5aifCbFk15eo+kvYaic?= =?iso-8859-1?Q?00pu8nEdFRHzE2TuWs+WrlgZvpPI14dei+5XlbX2b2wmuWmPj42Bu+N0lB?= =?iso-8859-1?Q?AeQOOf94yptlMYIGa/pZxfr3uEXfC1ZFJZ+h333plSSiUMogXkwQXogWk9?= =?iso-8859-1?Q?SDNpYCemjIUBirhihIod3yd+uK1fa5vcWdHDXhOIgY0S4zUgtAXeoPoNEM?= =?iso-8859-1?Q?VWlz+LFz2sWfUGQI70Mm5j9g1mu+1ZgtHUSYiB1Sbh+L7TQtj1050YFotW?= =?iso-8859-1?Q?O0NYqW18t2aHsjXRn1AQl2EQTH5dFa7pMErmiuU8nlNn8IrP4yQr2INAsh?= =?iso-8859-1?Q?s+6PqyWiHPKOJTAYOV8nimJCZF4JzMEABvC81gvKT94JN7YfALlc7DbknQ?= =?iso-8859-1?Q?tvWwEtCxmYTjKEvEFVLJvpGmnjAI4wwUVaTr6xh669EkX7ZYAbFtXWuNp+?= =?iso-8859-1?Q?E0JRJeO2PqT87E1ZM1qun2SF3qYZihDncwkVSK9ORGC2hqlp2t7wcpsjfG?= =?iso-8859-1?Q?AG1z/GeDGjWlpouMAYfUOOadJZsSGawBv0jTDsNJLFGXoMpDsqqrXx++pt?= =?iso-8859-1?Q?LK30VPxhoyVNYhaY8VC7TG6azv9PLFSVyibH01nLl4vTEpWw848xStRSAq?= =?iso-8859-1?Q?k8rsQnLbLb9RYyk6lnBFzyzSBriG3yI0f0VGbwhC9O85j+uk1OcxkO4r7P?= =?iso-8859-1?Q?D6Kgr8IinYrVsVhZPawtHR4L7yLcV6Iq7kmZE18YkJYdD8/WFMl++g/Q8e?= =?iso-8859-1?Q?UV91dTny6xvRknYrZuj8Q/RnzjKPwuJ8ekcpmUYSiOA1Kbub/l24Z57WIR?= =?iso-8859-1?Q?rnBrkMKHlm8bEHHhiZMlKZaeyUlpSdbhBd3JAAptpAyiI7mdUdGNJxV8je?= =?iso-8859-1?Q?utx+al1ZcQFQ9TqiX/IuZDO/Ujv7sA5TOD46o8PbhnriFXmAmHdlMH7pl3?= =?iso-8859-1?Q?VIVXAx7ZPvYqtIMOehukUuT52oXmmX+mMbQR/emAmvsFmfWJaeTlUVF55E?= =?iso-8859-1?Q?bpH6YEMEtMi39CGUUaZ4j+1sM5Zl2Ehx2Y1dM9ANpUVPT9Zknoef1Es872?= =?iso-8859-1?Q?lVx57qWjaAc74/1wmwet2PNbTQJiSG3b8Teh1T1qAN75hS+l6sQMxe+IAi?= =?iso-8859-1?Q?IteYiYsCzf4n+HCnz1AacEuRi6qTfAfaDwfJi6Q7JdbLoyI5ppJidRz4+B?= =?iso-8859-1?Q?fZdFdbN1HTPBZrKiOU3Y0UNqCgAD8uzFDH00usbvuzSddC8zhOyJpNyuwT?= =?iso-8859-1?Q?Ww5pLpY94MlhVq6VWqdvhE8PHAlyVAHBg+D4jZo6O8422tRzGFj+pGHHy1?= =?iso-8859-1?Q?QkJb+/aXHbLDYZWT/saWoSwzBy09uUhRMYTT0hP4PCY/lBHdE5nOKUWGp9?= =?iso-8859-1?Q?cxnFlN5Ftl1Fu0HuDnKsnz8h0yy2yIjBRKh81lHiOF9YDbE5ShrGa3LAUu?= =?iso-8859-1?Q?TOAPqJ6cb2EGGDSCugcljVr5fFK2bw19+QO9DRibVxBvowquKCZJ9x2voN?= =?iso-8859-1?Q?5XVmhVe29JhBBtjkTejSuQKPJgB+2awi3xZyLtorikgKqcHS8vKSHFEzzD?= =?iso-8859-1?Q?4jVfZsRGT9DxzFUCjsO22MK3Up81JEprm9VKIoSQ3MPUGiUcSYTLgTPqwq?= =?iso-8859-1?Q?94VX6vo1AgPa1Zl5QZqSeg50wzOklYsazx+/FU7Yx+KB/8LyriDuoDDDtH?= =?iso-8859-1?Q?GauPtzowfw4pknV0UT7UMbnlnwZQYdkHkglSP7B0r4ou4fuUQSVBDJcGVG?= =?iso-8859-1?Q?5s0d+2HVGdlBiDZBBoLtQNpprN1z7ba4gkDaok/mq/3mcPF9xGsWg3prfb?= =?iso-8859-1?Q?TXdUDNXLFyXMSnpHQWQSZHz9yZFxhJIl34LONnCj6GnEDo69wp/RQ8TvIb?= =?iso-8859-1?Q?uPbQmM+NyKp0WX+k51oSlX8DcG7dHpdommpZ2FDrTklFFnTctIH6ccVv9w?= =?iso-8859-1?Q?WkLOMggBVjVKpPtRQAslAMDNOrSF8JFACkD5ZJBIF3pbezdpK5npGCBk/W?= =?iso-8859-1?Q?EIQJUCYbpatKkV+rLEHnEyweOnjBnYcr1a0nb1Xo2g78QcoFm4i3G4qIOh?= =?iso-8859-1?Q?s542hYtQGI2BMeoS/oDz9/WDTiUPJGpE/UerwO+Z3YXbg0lLQ6/eMt67vg?= =?iso-8859-1?Q?zYXsQN84xaaiAoMXWA8ICnhc3PNnV3vzNicLtu+c2U6AoAVlilPwSBYPvI?= =?iso-8859-1?Q?B+zin2Ou0pHNeNtPZDfy1UMcQfU+qeF/LkyGI9EfMqPc/w=3D=3D?= MIME-Version: 1.0 From: Etienne Cordonnier <ecordonnier@snap.com> After commit https://git.yoctoproject.org/meta-selinux/commit/?id=9e986d7d794f044464e1af914ddbcd57d8f1c2e9 , it is not possible any more to choose a different version os the refpolicy, and only the git version is maintained. Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com> Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
* shadow: comment out pam_lastlog line in login pam fileYi Zhao2024-07-241-1/+1
| | | | | | | | | | | | | The pam_lastlog module is deprecated and disabled by default in linux-pam since 1.5.3[1]. Comment out this line to avoid loading pam_lastlog module by default. Users can use lastlog2 provided by util-linux as an alternative[2]. [1] https://github.com/linux-pam/linux-pam/commit/357a4ddbe9b4b10ebd805d2af3e32f3ead5b8816 [2] https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/commit/?id=c2e299d0acb2fa4ad1691452fa0eae76520bbdb0 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
* policycoreutils: fix packaging for sestatus binaryAlejandro Enedino Hernandez Samaniego2024-07-241-0/+1
| | | | | | | | | | | | | | | | | | | | sestatus is provided as ${base_sbindir}/sestatus which is currently packaged into PN-sestatus, however, this is only a symlink to the binary located in ${bindir}/sestatus. This causes that when runtime dependencies are calculated, bitbake properly detects a dependency from policycoreutils-sestatus to the main policycoreutils package. Hence the policycoreutils-sestatus package has no usability by itself, this has several implications, but one of them means that it recursively pulls all runtime dependencies, making policycoreutils-sestatus require everything that the main policycoreutils package RDEPENDS on, including python3. By correctly splitting these packages, an image that RDEPENDS only on policycoreutils-sestatus decreases its size by about ~13MB. Signed-off-by: Alejandro Enedino Hernandez Samaniego <alejandro@enedino.org> Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
* refpolicy: update to latest git revYi Zhao2024-07-246-82/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * a6cf20736 filesystem, devices: move gadgetfs to usbfs_t * 75492f95f systemd: make xdg optional * 097d688ff sshd: label sshd-session as sshd_exec_t * b57b6005c Setting bluetooth helper domain for bluetoothctl * 30f451d6a Adding Sepolicy rules to allow pulseaudio to access bluetooth sockets. * 7037c341f systemd: allow logind to use locallogin pidfds * 5f7f494d1 userdomain: allow administrative user to get attributes of shadow history file * 0126cb1e6 node_exporter: allow reading RPC sysctls * 9c90f9f7d asterisk: allow reading certbot lib * bfcaec9ba postfix: allow postfix pipe to watch mail spool * 06a80c3d8 netutils: allow ping to read net sysctls * 2e0509c9e node_exporter: allow reading localization * 50a8cddd1 container: allow containers to execute tmpfs files * 09a747a16 sysadm: make haproxy admin * c8c3ae2cb haproxy: initial policy * 4e97f87ce init: use pidfds from local login * 7fd9032d8 dbus, init: add interface for pidfd usage * a6d6921a9 asterisk: allow watching spool dirs * 72c1d912f su, sudo: allow sudo to signal all su domains * 8b3178248 sudo: allow systemd-logind to read cgroup state of sudo * 871f0b0dd postfix: allow smtpd to mmap SASL keytab files * 578375480 sysnetwork: allow ifconfig to read usr files * 6916e9b20 systemd: allow systemd-logind to use sshd pidfds * 96ebb7c4e Reorder perms and classes * cb68df087 tests.yml: Add policy diff on PRs. * 99258825c tests.yml: Divide into reusable workflows. * 1e4b68930 Reorder perms and classes Drop 0002-refpolicy-minimum-make-xdg-module-optional.patch and 0040-policy-modules-system-systemd-allow-systemd-logind-t.patch which have been merged upstream. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
* refpolicy: fixes for auditctl and rsyslogYi Zhao2024-07-233-6/+53
| | | | | | | | * Allow auditctl to read symlink of var/log directory. * Grant getpcap capability to syslogd_t. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
* refpolicy: update to latest git revYi Zhao2024-07-233-11/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 2102055d4 devices: Change dev_rw_uhid() to use a policy pattern * 1cbe455a5 device: Move dev_rw_uhid definition * 7a33b4bc8 Sepolicy changes for bluez to access uhid * c6dd4087d selinuxutil: make policykit optional * 10feb47e5 newrole: allow newrole to search faillock runtime directory * bf34d3e5e sysnetwork: fixes for dhcpcd * 4663e613f Adding Sepolicy rules to allow bluetoothctl and dbus-daemon to access unix stream sockets * 27602a932 various: various fixes * 63d50bbaa container, crio, kubernetes: minor fixes * 11e729e27 container, podman: various fixes * ef5954a0e systemd: allow systemd-sysctl to search tmpfs * 472e0442e container: allow containers to getcap * 7876e5151 container: allow system container engines to mmap runtime files * d917092a8 matrixd: add tunable for binding to all unreserved ports * 3dba91dd4 bootloader: allow systemd-boot to manage EFI binaries * ddf395d5d asterisk: allow binding to all unreserved UDP ports * 3bad3696b postgres: add a standalone execmem tunable * ef28f7879 userdom: allow users to read user home dir symlinks * 03711caea dovecot: allow dovecot-auth to read SASL keytab * cd781e783 fail2ban: allow reading net sysctls * ddc6ac493 init: allow systemd to use sshd pidfds * b9c457d80 files context for merged-usr profile on gentoo * 5040dd3b6 Need map perm for cockpit 300.4 * 2ef9838db tests.yml: Add sechecker testing * c62bd5c6c cockpit: Change $1_cockpit_tmpfs_t to a tmpfs file type * 1c694125b certbot: Drop execmem * 349411d55 xen: Drop xend/xm stack * 2a261f916 Allow systemd to pass down sig mask * 2577feb83 cups: Remove PTAL * 5b02b44e5 xen: Revoke kernel module loading permissions * 1c20c002c minissdpd: Revoke kernel module loading permissions * 5671390e2 docker: Fix dockerc typo in container_engine_executable_file * e1bc4830d cron: Use raw entrypoint rule for system_cronjob_t * 0f71792c8 uml: Remove excessive access from user domains on uml_exec_t * 511223e2d Set the type on /etc/machine-info to net_conf_t so hostnamectl can manipulate it (CRUD) * 72fc1b2a3 fix: minor correction in MCS_CATS range comment * cbf56c8ae systemd: allow notify client to stat socket Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
* selinux-python: make GPLv3 dependency optionalEtienne Cordonnier2024-06-291-1/+3
| | | | | Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com> Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
* setools: upgrade 4.4.4 -> 4.5.1Yi Zhao2024-06-291-2/+2
| | | | | | | | | ChangeLog: https://github.com/SELinuxProject/setools/releases/tag/4.5.0 https://github.com/SELinuxProject/setools/releases/tag/4.5.1 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
* selinux: upgrade 3.6 -> 3.7Yi Zhao2024-06-2915-1/+1
| | | | | | | | | | | | | | | | | ChangeLog: https://github.com/SELinuxProject/selinux/releases/tag/3.7 * audit2allow -C for CIL output mode * sepolgen: adjust parse for refpolicy * semanage: Allow modifying records on "add" * semanage: Do not sort local fcontext definitions * Improved man pages * checkpolicy: support CIDR notation for nodecon statements * sandbox: Add support for Wayland * Code improvements and bug fixes Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
* recipes: WORKDIR -> UNPACKDIR transitionChangqing Li2024-06-263-10/+12
| | | | | | | | * WORKDIR -> UNPACKDIR transition * Switch away from S = WORKDIR Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
* packagegroup-selinux-minimal: add missing runtime dependency selinux-autorelabelYi Zhao2024-06-261-0/+1
| | | | | | | | Add selinux-autorelabel to reset the SELinux label on the root filesystem at boot time. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
* MAINTAINERS: fix description of section entriesEtienne Cordonnier2024-06-261-2/+2
| | | | | Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com> Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
* refpolicy: update to latest git revYi Zhao2024-04-191-1/+1
| | | | | | | | | | * 0aff1990e quote: read localization * ab13c0421 getty: grant checkpoint_restore * 3643773ae Update SOS report to work on RHEL9 * 523b279bd Setup domain for dbus selinux interface Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
* MAINTAINERS: update to new yocto-patches mailing listYi Zhao2024-04-191-3/+3
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
* busybox: Fix wrapper creationPhilip Lorenz2024-03-281-3/+3
| | | | | | | | | | | | | | | | | | | `PACKAGEBUILDPKGD` was dropped in Yocto 4.2 and `PACKAGE_PREPROCESS_FUNCS` should be used instead. The only requirement for wrapper creation is that it is executed before any of the `update-alternatives` hooks are executed. This continues to hold as the call to `create_sh_wrapper_reset_alternative_vars` is prepended only after the `update-alternatives` class has been inherited. Additionally, this also fixes a race condition leading to non-deterministic buildhistory entries in busybox's `sysroot` files. The race condition was caused by the creation of the wrapper files inside `D` (i.e. the image directory) which is also consumed by other tasks such as `do_populate_sysroot` which may be executing in parallel to `do_package`. Signed-off-by: Philip Lorenz <philip.lorenz@bmw.de> Signed-off-by: Joe MacDonald <joe@deserted.net>
* MAINTAINERS: Update contact email addressJoe MacDonald2024-03-201-1/+1
| | | | Signed-off-by: Joe MacDonald <joe@deserted.net>
* layer.conf: update for the scarthgap release seriesYi Zhao2024-03-201-1/+1
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: upgrade 20231002+git -> 20240226+gitYi Zhao2024-03-1261-140/+179
| | | | | | | | | | | | | | | | | | | | | ChangeLog: https://github.com/SELinuxProject/refpolicy/blob/main/Changelog Notable Changes: Many systemd updates up to v255 RPM and dnf fixes Tighten private key handling for Apache Many container and kubernetes improvements Add support for Cilium Update object class definitions up to io_uring:cmd Add additional rules to cloud-init based on sysadm_t * Update to latest git rev. * Refresh patches. * Add a patch to fix reboot timeout error. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: drop ${SRCPV} usageYi Zhao2024-02-281-1/+1
| | | | | | | | | Drop SRCPV as this variable is no longer needed in PV[1]. [1] https://git.openembedded.org/openembedded-core/commit/?id=a8e7b0f932b9ea69b3a218fca18041676c65aba0 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: update to latest git revYi Zhao2024-02-273-11/+11
| | | | | | | Update to latest rev to fix policy for systemd 255. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* eudev: remove PACKAGECONFIG[selinux]Yi Zhao2024-02-271-1/+0
| | | | | | | | | | Drop PACKAGECONFIG[selinux] as it was added to eudev recipe in oe-core[1]. [1] https://git.openembedded.org/openembedded-core/commit/?id=e6c18c9d9d0e11a6a93cca14dbe622707cf25515 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* rpm: remove PACKAGECONFIG[selinux]Yi Zhao2024-02-271-1/+0
| | | | | | | | | Drop PACKAGECONFIG[selinux] as it was added to rpm recipe in oe-core[1]. [1] https://git.openembedded.org/openembedded-core/commit/?id=38549d462b399e3a63335f60a44c8bbced98639a Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libselinux-python: add recipeYi Zhao2024-01-242-29/+59
| | | | | | | | | | | | | | | | | | | We merged libselinux recipe and libselinux-python recipe in commit[1] because we thought the circular dependency was gone. But unfortunately, it still exists. Here are the steps to reproduce: $ echo "DISTRO_FEATURES:append = \" x11\"" >> conf/local.conf $ echo "PACKAGECONFIG:append:pn-python3 = \" tk\"" >> conf/local.conf $ bitbake core-image-selinux -n So we still need to split the libselinux recipe into two recipes: libselinux and libselinux-python. [1] https://git.yoctoproject.org/meta-selinux/commit/?id=62b9c816a5000dc01b28e78213bde26b58cbca9d Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* setools: upgrade 4.4.3 -> 4.4.4Yi Zhao2023-12-182-5/+5
| | | | | | | | | | ChangeLog: https://github.com/SELinuxProject/setools/releases/tag/4.4.4 * Refresh local patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* semodule-utils: upgrade 3.5 -> 3.6Yi Zhao2023-12-181-0/+0
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* selinux-sandbox: upgrade 3.5 -> 3.6Yi Zhao2023-12-181-0/+0
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* selinux-gui: upgrade 3.5 -> 3.6Yi Zhao2023-12-181-0/+0
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* selinux-dbus: upgrade 3.5 -> 3.6Yi Zhao2023-12-181-0/+0
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* selinux-python: upgrade 3.5 -> 3.6Yi Zhao2023-12-182-2/+2
| | | | | | | * Refresh patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* restorecond: upgrade 3.5 -> 3.6Yi Zhao2023-12-181-0/+0
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* mcstrans: upgrade 3.5 -> 3.6Yi Zhao2023-12-181-0/+0
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-05-13 03:33:45 +0000