summaryrefslogtreecommitdiffstats
path: root/recipes-security/refpolicy
Commit message (Collapse)AuthorAgeFilesLines
...
* refpolicy: fix ftpwho install dirRoy Li2014-02-122-0/+28
| | | | | | | ftpwho is installed into /usr/bin, not /usr/sbin. Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: Allow ping to get/set capabilitiesWenzong Fan2014-01-282-0/+36
| | | | | | | | When ping is installed with capabilities instead of being marked setuid, then the ping_t domain needs to be allowed to getcap/setcap. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* refpolicy: fix real path for swapoffWenzong Fan2014-01-281-9/+10
| | | | Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
* refpolicy: fix real path for cpioWenzong Fan2014-01-282-0/+26
| | | | Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
* selinux: set policy-version to 28Wenzong Fan2014-01-281-0/+2
| | | | | The default policy version of new selinux toolchains is 29, to fit kernel 3.10.x, set it to 28.
* refpolicy: fix new symlink for policy.kernWenzong Fan2014-01-261-0/+4
| | | | | | | | | New 2.2 release of libsemanage removes policy.kern and replace with symlink from Dan Walsh. It is a host path while cross-compiling, so fix this path. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* refpolicy: fix real path for udevadmWenzong Fan2014-01-261-6/+14
| | | | Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
* refpolicy: fix real path for udevdWenzong Fan2014-01-102-0/+28
| | | | | | | | | | | In Yocto the real path for udevd is /lib/udev/udevd, this patch fixes the init issues like: udevd[87]: setfilecon /dev/vcsa2 failed: Operation not permitted udevd[89]: setfilecon /dev/fb0 failed: Operation not permitted Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* policy: Create compressed_policy distro featureJoe MacDonald2013-12-051-10/+22
| | | | | | | | | | | There is a small cost to having compressed policy files on the final image both in terms of memory requirements and load times. In nearly all circumstances this is negligible, but this adds a DISTRO_FEATURE that can be used to enable it, if desired. The default selinux distros will enable the feature by default. Signed-off-by: Joe MacDonald <joe@deserted.net>
* bzip SELinux policy modules in ${datadir}Philip Tricca2013-12-051-4/+5
| | | | | | | | | | | | | The 'semodule' utility can operate on compresed modules so the only cost of this change is a slower module load time when invoking 'semodule -i' on a running system (increased CPU load due to bzip2). That said my tests show more than 100M reduction in ext3 image size of core-image-selinux. This last metric is a bit skewed as the image includes two policies. Still, a reduction in the size of the refpolicy package by 1/2 is significant. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy-standard: Use default variables from refpolicy_common.incPhilip Tricca2013-11-061-8/+0
| | | | | Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy-mls: Use default variables from refpolicy_common.incPhilip Tricca2013-11-061-12/+0
| | | | | Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy-mcs: Use default variables from refpolicy_common.incPhilip Tricca2013-11-061-10/+0
| | | | | Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* Move common POLICY_* variables to refpolicy_common.incPhilip Tricca2013-11-061-0/+12
| | | | | | | | Use default assignment to allow variables to be overriden by recipes that include refpolicy_common.inc Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* Add recipe to build the MCS refpolicy.Philip Tricca2013-10-301-0/+23
| | | | | | | | This is the default policy type used by most (all?) distros that support SELinux. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* Remove runtime dependency on policycoreutils from the reference policy.Philip Tricca2013-10-151-1/+1
| | | | | | | | | The only thing refpol needs to depend on at runtime are the things necessary to load the policy. If sysvinit is patched to load the policy (which it is) then we only need the config. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* busybox: alternatives link to sh wrappers for commandsXin Ouyang2013-10-022-2/+7
| | | | | | | | | | | | | | | | | | | | | | While directly using busybox[.[no]suid] as the alternatives' targets, commands could not get correct security labels. ~# ls -l /sbin/getty ..... /sbin/getty -> /bin/busybox.nosuid ~# ls -Z /bin/busybox.nosuid system_u:object_r:bin_t:s0 /bin/busybox.nosuid Add sh wrappers for commands so selinux could work fine. ~# ls -l /sbin/getty ..... /sbin/getty -> /usr/lib/busybox/sbin/getty ~# ls -Z /usr/lib/busybox/sbin/getty system_u:object_r:getty_exec_t:s0 /usr/lib/busybox/sbin/getty ~# cat /usr/lib/busybox/sbin/getty #!/bin/busybox.nosuid Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy*: remove old version recipes and patches.Xin Ouyang2013-10-0244-2380/+0
| | | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy*: add new version 2.20130424Xin Ouyang2013-10-0239-0/+1753
| | | | | | | | | | | | | | | | | | | These patches are removed because new version merged: - poky-fc-update-alternatives_tinylogin.patch - poky-fc-fix-prefix-path_rpc.patch - poky-fc-fix-portmap.patch - poky-fc-cgroup.patch - poky-fc-networkmanager.patch - poky-policy-allow-dbusd-to-setrlimit-itself.patch - poky-policy-allow-dbusd-to-exec-shell-commands.patch - poky-policy-allow-nfsd-to-bind-nfs-port.patch Add two new patches: + poky-policy-fix-setfiles-statvfs-get-file-count.patch + poky-policy-fix-dmesg-to-use-dev-kmsg.patch Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* Resend: Install policy headers and include them in the refpolicy dev package.Philip Tricca2013-09-271-1/+5
| | | | | | | | | | | | To do this we call the 'install-headers' make target at the end of do_install. We then add the interface 'include' directory to the dev package leaving only the policy modules in the main policy package. This allows projects that ship their own SELinux policy (not in the refpolicy) to build the refpolicy headers / interface files by using the Makefile supplied by refpolicy. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: oe-core /var/log symlink policy for apacheXin Ouyang2013-03-193-1/+30
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy*: fix file contexts for many oe-core recipesXin Ouyang2013-03-1915-0/+403
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: two patches for nfs-kernel-serverXin Ouyang2013-03-095-4/+104
| | | | | | | | We still miss some rules for nfsd to bind on nfs ports, so add a patch to fix this. oe-core changed nfsd to use portmap, so also fix file contexts for portmap. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: add selinux-config RDEPENDSXin Ouyang2013-02-271-1/+1
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: fix file contexts for bindXin Ouyang2013-02-272-0/+37
| | | | | | | Some files of bind are not installed to default pathes, fix the security contexts for these files. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: add rules for /var/cache symlinkXin Ouyang2013-02-272-0/+510
| | | | | | | | /var/cache is a symlink in poky, so we need allow rules for files to read lnk_file while doing search/list/delete/rw.. in /var/cache/ directory. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: policy fixes for seutils and auditd_log_tXin Ouyang2013-01-233-12/+104
| | | | | | | | | | | | Two patches to fix these two issue: * Current policy has incomplete allow rules for selinux utils to manage selinux config files and policy store. * auditd_log_t(/var/log/audit/audit.log) is also placed in var_log_t, so add related rules. CQID: WIND00396415 Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: file contexts for alternatives of shadowXin Ouyang2013-01-223-1/+36
| | | | | | CQID: WIND00399962 Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: add user_tty_device_t into customizable_typesXin Ouyang2013-01-092-0/+10
| | | | | | | Add user_tty_device_t as a customizable_type, so that restorecon -R /dev will not complain about it or modify the security labels. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: change hard-coded pachesXin Ouyang2013-01-091-10/+10
| | | | | | | - /etc -> ${sysconfdir} - /usr/share -> ${datadir} Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: standard/mls policy should set UBAC=nXin Ouyang2012-11-263-2/+5
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: fix policy to allow nfsd works.Xin Ouyang2012-11-264-2/+72
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy*: make to use pythonnativeXin Ouyang2012-11-083-3/+3
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: xconsole_device_t as a dev_nodeXin Ouyang2012-10-182-0/+28
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: add poky specific rules for packages.Xin Ouyang2012-10-1811-0/+735
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: Fix specific file contexts for pokyXin Ouyang2012-10-188-2/+245
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: uprev to version 2.20120725.Xin Ouyang2012-10-187-1554/+14
| | | | | | | | | | | Patches are migrated or droped for new version. * poky-fc-etc_init.d.patch: droped because file_contexts.subs_dist is defined to instead. * fix-mount-to-write-mountpoints-dirs.patch: droped because the rules is not needed now. * poky-fc-update-alternatives_sysvinit.patch: migrated. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* selinux recipes: inherit pythonnativeXin Ouyang2012-09-261-2/+2
| | | | | | | With new changes in oe-core, recipes which need python-native should "inherit pythonnative". Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: add policy patches for Yocto.Xin Ouyang2012-07-194-0/+1591
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy*: Add RDEPENDS and fix PACKAGE_ARCH.Xin Ouyang2012-06-121-0/+3
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy*: Add filelist for binary packages.Xin Ouyang2012-04-101-0/+3
|
* refpolicy*: Rename bb recipe of standard policy.Xin Ouyang2012-04-101-0/+0
|
* refpolicy*: SELinux policy init version.Xin Ouyang2012-04-104-0/+107
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-24 04:33:38 +0000