summaryrefslogtreecommitdiffstats
path: root/recipes-security/refpolicy
Commit message (Collapse)AuthorAgeFilesLines
...
* refpolicy_common: Sanity test DEFAULT_ENFORCING value and set default.Philip Tricca2016-04-041-0/+10
| | | | | | | | | | Use the anonymous python function to be sure the value set for 'SELINUX' in the config file is something useful. In the event that DEFAULT_ENFORCING isn't set to one of the 3 permissible values we set it to 'permissive'. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* Integrate selinux-config into refpolicy_common.Philip Tricca2016-04-041-2/+28
| | | | | | | | | With the virutal package there's no need for a separate recipe to build the config. This can be generated and included as part of the policy package. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy: Setup virtual/refpolicy provider.Philip Tricca2016-04-041-0/+3
| | | | | | | | | | | | This allows us to provide a default policy through the PREFERRED_PROVIDER mechanism for each of the example distro configs. Consumers of meta-selinux will be able to override this at the config level instead of having to depend on a specific policy package. We do lose the ability install more than one policy package but this falls in line with the embedded nature of the project. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy: Remove 2.20140311 release.Philip Tricca2016-03-2149-2071/+0
| | | | Signed-off-by: Philip Tricca <flihp@twobit.us>
* refpolicy: Replace 2.2014120 with release 2.20151208.Philip Tricca2016-03-2149-75/+31
| | | | | | | This was mostly straight forward. Had to refresh a single patch: poky-policy-fix-new-SELINUXMNT-in-sys.patch Signed-off-by: Philip Tricca <flihp@twobit.us>
* refpolicy: Add support for the SYSTEMD build.conf option.Stephen Smalley2016-03-171-0/+2
| | | | | | | | | | | | refpolicy has introduced a new build.conf option, SYSTEMD=y, to enable rules specific to using systemd as the init system. In particular, without setting this option, rules for direct domain transitions from init_t to daemon domains are not included in the policy. Define a POLICY_SYSTEMD variable in the refpolicy common include file that can be set elsewhere to enable this support. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Philip Tricca <flihp@twobit.us>
* refpolicy: update for change in libsemanage 2.5Stephen Smalley2016-03-171-2/+2
| | | | | | | | libsemanage 2.5 renamed /var/lib/selinux/tmp to /var/lib/selinux/final; update the refpolicy recipe accordingly. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Philip Tricca <flihp@twobit.us>
* refpolicy-git: Refresh poky-policy-fix-new-SELINUXMNT-in-sys.patch.Philip Tricca2015-11-271-75/+25
| | | | | Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-minimum: update prepare_policy_storeWenzong Fan2015-11-271-11/+30
| | | | | | | | | | | | | | | | | * update prepare_policy_store() for supporting SELinux 2.4 & CIL, the logic is from refpolicy_common.inc but with minimum set of policy modules; * add extra policy modules that required by sysnetwork, without those modules the install process will fail with error: | Failed to resolve roletype statement at 62 of \ .../image/var/lib/selinux/minimum/tmp/modules/100/sysnetwork/cil | Failed to resolve ast | semodule: Failed! Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-targeted: rebase patchesWenzong Fan2015-11-272-41/+56
| | | | | | | | | | rebase patches against latest git sources: * refpolicy-fix-optional-issue-on-sysadm-module.patch * refpolicy-unconfined_u-default-user.patch Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy: fix exit code issue of bzip2Wenzong Fan2015-10-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'bzip2 -qt $moudle_name.pp' has different exit codes on different distributions, for example: * On Redhat/CentOS/Fedora, OpenSUSE: $ bzip2 -qt /tmp/tor.pp bzip2: /tmp/tor.pp: bad magic number (file not created by bzip2) $ echo $? 0 This causes install errors: unzip2: /path/to/*.pp is not a bzip2 file. libsepol.module_package_read_offsets: module package header truncated Failed to read policy package * Ubuntu has fixed it: $ bzip2 -qt /tmp/tor.pp bzip2: /tmp/tor.pp: bad magic number (file not created by bzip2) $ echo $? 2 The difference involved by '-q' options, remove it would get the bzip2 works consistently. bzip2-native has the same issue, anyway it should be fixed separately. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy: SRCREV_FORMAT neededJoe Slater2015-10-221-0/+1
| | | | | Signed-off-by: Joe Slater <jslater@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy: Update policy install and bootstrap process for CIL.Philip Tricca2015-09-171-14/+26
| | | | | | | | | | | | | | | | The policy modules are now installed into /var/lib/selinux instead of /etc/selinux. Policies now have priorities. This is represented as part of the path under /var/lib/selinux. The new intermediate policy representation requires that we install the policy package as 3 files (hll, cil & lang_ext) instead of just the *.pp as before. The cil is generated from the hll (the pp file) using the new 'pp' utility. The base policy module now lives with all of the other modules. policy.kern has gone away. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-minimum: update base refpolicy to git repoShrikant Bobade2015-08-071-0/+48
| | | | | | | | A simple forward-port of refpolicy-minimum to use the refpolicy from git repository. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-standard: update base refpolicy to git repoShrikant Bobade2015-08-071-0/+8
| | | | | | | | A simple forward-port of refpolicy-standard to use the refpolicy from git repository. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-mls: update base refpolicy to git repoShrikant Bobade2015-08-071-0/+10
| | | | | | | | A simple forward-port of refpolicy-mls to use the refpolicy from git repository. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-mcs: update base refpolicy to git repoShrikant Bobade2015-08-071-0/+11
| | | | | | | | A simple forward-port of refpolicy-mcs to use the refpolicy from git repository. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-targeted: update base refpolicy to git repoShrikant Bobade2015-08-071-0/+20
| | | | | | | | A simple forward-port of refpolicy-targeted to use the refpolicy from git repository. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy git: rebase patches with code baseShrikant Bobade2015-08-075-77/+74
| | | | | | | | | During forward-port of these patches from refpolicy 20140311, requires rebase with the refpolicy git repos head master code base,in order to resolve the patch conflicts. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy git: update refpolicy to git repositoryShrikant Bobade2015-08-0744-0/+1976
| | | | | | | | | | | | | | | | A straight update from refpolicy 2.20140311 to refpolicy git repository for the core policy variants and forward-porting of policy patches as appropriate. This approach is useful for building refpolicy & refpolicy-contrib directly from the git repos, rather than release tarballs. It helps to check the refpolicy based on source commits by just updating the git repo rev. as appropriate in refpolicy_git.inc ref: https://github.com/TresysTechnology/refpolicy/wiki Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-minimum: update base refpolicy 20141203Shrikant Bobade2015-08-071-0/+48
| | | | | | | | A simple forward-port of refpolicy-minimum to use the 20141203 base refpolicy. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-standard: update base refpolicy 20141203Shrikant Bobade2015-08-071-0/+8
| | | | | | | | A simple forward-port of refpolicy-standard to use the 20141203 base refpolicy. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-mls: update base refpolicy 20141203Shrikant Bobade2015-08-071-0/+10
| | | | | | | | A simple forward-port of refpolicy-mls to use the 20141203 base refpolicy. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-mcs: update base refpolicy 20141203Shrikant Bobade2015-08-071-0/+11
| | | | | | | | A simple forward-port of refpolicy-mcs to use the 20141203 base refpolicy. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-targeted: update base refpolicy 20141203Shrikant Bobade2015-08-071-0/+20
| | | | | | | | A simple forward-port of refpolicy-targeted to use the 20141203 base refpolicy. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy 20141203: rebase patches with code baseShrikant Bobade2015-08-075-78/+73
| | | | | | | | | During forward-port of these patches from refpolicy 2014120311, requires rebase with the refpolicy 20141203 code base, in order to resolve the patch conflicts. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy: update refpolicy to 20141203 releaseShrikant Bobade2015-08-0744-0/+1974
| | | | | | | | | | A straight update from refpolicy 2.20140311 to 2.20141203 for the core policy variants and forward-porting of policy patches as appropriate. ref: https://github.com/TresysTechnology/refpolicy/wiki Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy: correct SELINUX_DEVEL_PATHWenzong Fan2015-08-071-1/+9
| | | | | | | | | The sepolgen.conf should be installed with devel package to correct the default value of SELINUX_DEVEL_PATH, Makefile will be searched from that path while building policies on target. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* V2 refpolicy:20140311 update for systemdShrikant Bobade2015-01-122-0/+47
| | | | | | | | Systemd init type and related allow rules updated for refpolicy. Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* Use compressed_policy by default, and clear distro featureXin Ouyang2014-09-222-35/+16
| | | | | | | | | | | Original refpolicy install compressed policy modules to policy store, but leave datadir ones uncompressed. After, a "compressed_policy" distro feature is added for compressing the datadir ones. This simple mechanism is unworthy for a distro feature, just clear it and use compressed policy modules by default. Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* refpolicy-minimum: add fixed prepare_policy_store().Xin Ouyang2014-09-221-0/+28
| | | | | | | Original prepare_policy_store() has a naming bug for compressed_policy, fix that and let prepare_policy_store() back. Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* refpolicy: clean up old policy and patchesJoe MacDonald2014-09-1949-2156/+0
| | | | | | | Now that the updated refpolicy core variants are available, remove the previous recipe and patches. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-minimum: update base refpolicy 20140311Joe MacDonald2014-09-192-58/+29
| | | | | | | A simple forward-port of refpolicy-minimum to use the 20140311 base refpolicy. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-targeted: update base refpolicy 20140311Joe MacDonald2014-09-192-41/+34
| | | | | | | | A simple forward-port of refpolicy-targeted to use the 20140311 base refpolicy. Now that the updated refpolicy core variants are available, remove the previous recipe. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy: update refpolicy to 20140311 releaseJoe MacDonald2014-09-1946-6/+1927
| | | | | | | | | A straight update from refpolicy 2.20130424 to 2.20140311 for the core policy variants and forward-porting of policy patches as appropriate. Now that the updated refpolicy core variants are available, remove the previous recipe. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy / minimum: support compressed policyWenzong Fan2014-08-281-8/+18
| | | | | Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* refpolicy: split do_install to three stepsWenzong Fan2014-08-281-14/+25
| | | | | | | | | | | | | Split do_install() to: + prepare_policy_store() + rebuild_policy() + install_misc_files() This allows to make partial change to do_install() instead of re-write it totally from specific refpolicy bb file. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* refpolicy: Allow udev the block_suspend capabilityJackie Huang2014-06-022-0/+26
| | | | | | | | | | Fix the avc denied issue: type=1400 audit(1399440994.656:14): avc: denied { block_suspend } for pid=80 comm="udevd" capability=36 scontext=system_u:system_r:udev_t:s0-s15:c0.c1023 tcontext=system_u:system_r:udev_t:s0-s15:c0.c1023 tclass=capability2 The patch is backported from upstream Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* refpolicy-*: un-inherit because not autotools packageXin Ouyang2014-05-161-4/+3
| | | | Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* refpolicy: remove PRINC warningHongxu Jia2014-05-097-7/+6
| | | | | | | | | | Bump up PR and remove PRINC. Set it to something suitably large that it's unlikely to break anyone's package feed and so that it shows it's clearly an exception case. Obviously this is just a staging activity until the next update when we don't include anything of the sort. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: add setrans.conf for mcs/mls policyWenzong Fan2014-04-243-0/+77
| | | | | | | | | | | | | | | Add initial version for setrans.conf: - setrans-mls.conf: copied from \ policycoreutils/mcstrans/share/examples/default/setrans.conf - setrans-mcs.conf: copied from radhat policy. This fixes below issue: $ chcat -L IOError: No such file or directory: \ '/etc/selinux/$POLICY_NAME/setrans.conf' Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: add minimum targeted policyWenzong Fan2014-04-241-0/+46
| | | | | | | | | | This is a minimum targeted policy with just core policy modules, and could be used as a base for customizing targeted policy. Pretty much everything runs as initrc_t or unconfined_t so all of the domains are unconfined. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: add targeted policy typeWenzong Fan2014-04-243-0/+276
| | | | | | | | | | | This SELinux policy would targeted most of service domains for lock down, and users and admins will login in with unconfined_t domain. So they would have the same access to the system as if SELinux was not enabled, when running commands and services which are not targeted. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: add rules for /var/log symlink on pokyWenzong Fan2014-04-033-0/+61
| | | | | Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: associate tmpfs_t (shm) to device_t (devtmpfs) file systemsWenzong Fan2014-04-032-0/+31
| | | | | | | The patch is backported from upstream. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: make proftpd be able to workRoy Li2014-04-032-0/+40
| | | | | Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: allow sysadm to run rpcbindRoy Li2014-04-032-0/+34
| | | | | Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: Updated FILESEXTRAPATHS_prepend valueAlexandru.Vaduva2014-04-031-1/+1
| | | | | | | | | | | | The value was defined as: FILESEXTRAPATHS_prepend := "${THISDIR}/refpolicy-${PV}:" and changed it to: FILESEXTRAPATHS_prepend := "${THISDIR}/refpolicy-2.20130424:" becase the bb that inherit this overwrites the PV every time, changing its name. Signed-off-by: Alexandru.Vaduva <Alexandru.Vaduva@enea.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: fix real path for su.shadowWenzong Fan2014-02-132-0/+26
| | | | | Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: backport two patches to fix dhclient, hostname and ifconfigRoy Li2014-02-123-0/+102
| | | | | Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-23 16:37:49 +0000