summaryrefslogtreecommitdiffstats
path: root/recipes-security/refpolicy
Commit message (Collapse)AuthorAgeFilesLines
* refpolicy: Forward patch to apply cleanly on thudthudKhem Raj2019-02-273-35/+11
| | | | | | | Also fix devtool generated warnings by refreshing patches Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: fix up all refpolicy 20170224 builds for thudJoe MacDonald2018-10-304-32/+51
| | | | Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy_git.inc: lock SRCREVs on the actual version hashesAwais Belal2018-10-301-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | Using AUTOREV in the main repository has its downsides. 1. The checked out version isn't actually the version depicted by PV. 2. Breaks builds in scenarios where network isn't available or BB_NO_NETWORK is used even after sources are already fetched. 1 is self explanatory, for 2 whenever SRCREV is set to AUTOREV and SRCPV is used in PV the fetcher tries to access the network in order to determine SRCPV (bb.fetch2.get_srcrev) and fails for obvious reasons during parsing even when versioned recipes are used as PREFERRED_VERSION because parsing still happens for recipes that are in BB's search paths and we see. Traceback (most recent call last): bb.data_smart.ExpansionError: Failure expanding variable SRCPV, expression was ${@bb.fetch2.get_srcrev(d)} which triggered exception NetworkAccess: Network access disabled through BB_NO_NETWORK (or set indirectly due to use of BB_FETCH_PREMIRRORONLY) but access requested with command git -c core.fsyncobjectfiles=0 ls-remote git://github.com/TresysTechnology/refpolicy.git (for url git://github.com/TresysTechnology/refpolicy.git) So we lock the REVs and do that with a soft assignment which allows overriding the REVs from elsewhere. Signed-off-by: Awais Belal <awais_belal@mentor.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* Fix URL, update refpolicy patches and dependenciesSajjad Ahmed2018-01-199-59/+370
| | | | | | | | | | * audit_2.7.6.bb : fix error [gzip: stdin: not in gzip format] and checksum * refpolicy-minimum_git.bb : fix [Failed to resolve typeattributeset statement], dependency for "fsadm" in init.pp * refpolicy-targeted_2.20170204.bb : added version dependent patches * patches : separate patches for release 2.20170204 version and 2.20170805+git version Signed-off-by: Sajjad Ahmed <sajjad_ahmed@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy: Add '/bin/bash.bash', an update-alternative to the policyMark Hatle2017-09-144-0/+50
| | | | Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* refpolicy-git: Update to lastest git versionMark Hatle2017-09-143-79/+33
| | | | Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* refpolicy_common: depends on semodule-utils-nativeWenzong Fan2017-09-131-1/+1
| | | | | | | | Those tools have been moved from policycoreutils to semodule-utils: semodule_deps, semodule_expand, semodule_link, semodule_package Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* refpolicy: fix a typo in RDEPENDSJackie Huang2017-09-081-1/+1
| | | | | | | Underscore ("_") should be used for variable overrides. Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* refpolicy-git: clean up fallout from stable uprevJoe MacDonald2017-05-0417-107/+98
| | | | Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy: Update to 20170204 releaseJoe MacDonald2017-05-0452-404/+593
| | | | | | | This updates all of the common policies. standard, minimum, mls and targeted. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy: update git recipesJoe MacDonald2017-05-0343-446/+391
| | | | | | | | | The targeted, mls and minimum recipes had fallen far behind the upstream refpolicy repository. Refresh all patches and discard ones that are obviously no longer needed. This should not have any functional change on the policies. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-mls: user native bzip2 instead of hostAlexandru Moise2017-05-021-1/+3
| | | | | | | | | | | | The behavior of b{zip,unzip}2 an vary from host to host with regards to a number of things such as return value or permissions. We should always use the native bzip2 package to keep the behavior deterministic. This change prevents a warning at do_package_qa task of refpolicy-mls package. Signed-off-by: Alexandru Moise <alexandru.moise@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-git: Update patchesJoe MacDonald2017-01-0645-418/+501
| | | | | | | A number of upstream changes caused patch conflicts or duplication in the final policy. Update the list of git patches appropriately. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux: update policy-version to 30Wenzong Fan2016-09-221-1/+1
| | | | | | | Both selinux 2.5 and kernel 4.8 support Max Policy Version 30. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-minimum: systemd: fix for syslogShrikant Bobade2016-09-012-0/+70
| | | | | | | | syslog & getty related allow rules required to fix the syslog mixup with boot log, while using systemd as init manager. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-minimum: systemd: fix for systemd tmp-files servicesShrikant Bobade2016-09-012-0/+112
| | | | | | | | fix for systemd tmp files setup services: systemd-journal-flush.service & systemd-logind.service. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-minimum: systemd: fix for login & journal serviceShrikant Bobade2016-09-012-0/+106
| | | | | | | | | 1. fix for systemd services: login & journal wile using refpolicy-minimum and systemd as init manager. 2. fix login duration after providing root password. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-minimum: systemd: mount: enable required refpolicy booleansShrikant Bobade2016-09-012-0/+48
| | | | | | | | enable required refpolicy booleans for these modules mount: allow_mount_anyfile & systemd:systemd_tmpfiles_manage_all Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-minimum: init: fix reboot with systemd as init manager.Shrikant Bobade2016-09-012-0/+37
| | | | | | | add allow rule to fix avc denial during system reboot. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-minimum: locallogin: add allow rules for type local_login_tShrikant Bobade2016-09-012-0/+54
| | | | | | | add allow rules for locallogin module avc denials. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-minimum: systemd: mount: logging: authlogin: add allow rulesShrikant Bobade2016-09-012-0/+94
| | | | | | | | | add allow rules for avc denails for systemd, mount, logging & authlogin modules. without this change we are getting avc. denials from these modules. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-minimum: audit: logging: getty: audit related allow rulesShrikant Bobade2016-09-012-0/+68
| | | | | | | add allow rules for audit.log file & resolve dependent avc denials. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-minimum: systemd:unconfined:lib: add systemd services allow rulesShrikant Bobade2016-09-012-0/+131
| | | | | | | | | | | systemd allow rules for systemd service file operations: start, stop, restart & allow rule for unconfined systemd service. without this change we are geting avc denials and access denied to perform operations on service file. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy_common.inc: add refpolicy minimum banner at selinux config.Shrikant Bobade2016-09-011-0/+1
| | | | | Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-targeted: remove duplicate type rulesWenzong Fan2016-08-083-0/+48
| | | | | | | | | | | | | | | | | Remove duplicate type rules from init_t to init_script_file_type, they have been included by systemd policies. This also fixes the errors while installing modules for refpolicy-targeted if systemd support is enabled: | Conflicting type rules | Binary policy creation failed at line 327 of \ .../tmp/work/qemux86-poky-linux/refpolicy-targeted/git-r0/image\ /var/lib/selinux/targeted/tmp/modules/100/init/cil | Failed to generate binary | semodule: Failed! Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy: remove virtual prefix for runtime providersJoe MacDonald2016-07-071-1/+1
| | | | | | | | | | | | | | In keeping with the approach of only providing a single default policy at runtime, we were originally using a virtual/refpolicy dependency and filling it with one of our specific refpolicy implementations. This works well enough for some package systems, but fails for others (specifically deb, possibly more). Since the intent was to only have one present in the default image anyway, we'll just throw out the 'virtual/' part of the RPROVIDES and related dependencies across the board. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy_common.inc: enable conditional systemd supportShrikant Bobade2016-05-271-1/+1
| | | | | | | | | refpolicy now introduced systemd support using POLICY_SYSTEMD variable, with systemd enabled setup we need the refpolicy with systemd support, so enable systemd support based on DISTRO_FEATURES. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-minimum_2.20151208: add systemd dependent policy modulesShrikant Bobade2016-05-271-0/+2
| | | | | | | | | | | | | | | | | | | | with systemd enabled refpolicy-minimum build breaks due to missing dependent policy modules, so add the dependent modules: clock, systemd, udev conditionally based on DISTRO_FEATURES. dependent systemd policy modules needed to fix these errors: * Failed to resolve 'adjtime_t' in typeattributeset statement at line 138 of .. modules/100/init/cil * Failed to resolve 'systemd_kmod_conf_t' in typeattributeset statement at line 141 of.. moules/100/init/cil * Failed to resolve 'udev_t' in typeattributeset statement at line 143 of modules/100/init/cil semodule: Failed! Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-minimum_git: add systemd dependent policy modulesShrikant Bobade2016-05-271-0/+2
| | | | | | | | | | | | | | | | | | | | with systemd enabled refpolicy-minimum build breaks due to missing dependent policy modules, so add the dependent modules: clock, systemd, udev conditionally based on DISTRO_FEATURES. dependent systemd policy modules needed to fix these errors: * Failed to resolve 'adjtime_t' in typeattributeset statement at line 138 of .. modules/100/init/cil * Failed to resolve 'systemd_kmod_conf_t' in typeattributeset statement at line 141 of.. moules/100/init/cil * Failed to resolve 'udev_t' in typeattributeset statement at line 143 of modules/100/init/cil semodule: Failed! Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy_common: Use POLICY_NAME instaed of POLICY_TYPE for SELINUXTYPE in ↵Wenzong Fan2016-04-201-1/+1
| | | | | | config. Signed-off-by: Philip Tricca <flihp@twobit.us>
* refpolicy-minimum: port changes for prepare_policy_storeWenzong Fan2016-04-171-11/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | Apply the changes to refpolicy-minimum_2.20151208.bb: commit bfaf278116e6c3a04bb82c9f8a4f8629a0a85df8 Author: Wenzong Fan <wenzong.fan@windriver.com> Date: Tue Oct 27 06:25:04 2015 -0400 refpolicy-minimum: update prepare_policy_store * update prepare_policy_store() for supporting SELinux 2.4 & CIL, the logic is from refpolicy_common.inc but with minimum set of policy modules; * add extra policy modules that required by sysnetwork, without those modules the install process will fail with error: | Failed to resolve roletype statement at 62 of \ .../image/var/lib/selinux/minimum/tmp/modules/100/sysnetwork/cil | Failed to resolve ast | semodule: Failed! Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com> Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
* refpolicy_common: Sanity test DEFAULT_ENFORCING value and set default.Philip Tricca2016-04-041-0/+10
| | | | | | | | | | Use the anonymous python function to be sure the value set for 'SELINUX' in the config file is something useful. In the event that DEFAULT_ENFORCING isn't set to one of the 3 permissible values we set it to 'permissive'. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* Integrate selinux-config into refpolicy_common.Philip Tricca2016-04-041-2/+28
| | | | | | | | | With the virutal package there's no need for a separate recipe to build the config. This can be generated and included as part of the policy package. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy: Setup virtual/refpolicy provider.Philip Tricca2016-04-041-0/+3
| | | | | | | | | | | | This allows us to provide a default policy through the PREFERRED_PROVIDER mechanism for each of the example distro configs. Consumers of meta-selinux will be able to override this at the config level instead of having to depend on a specific policy package. We do lose the ability install more than one policy package but this falls in line with the embedded nature of the project. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy: Remove 2.20140311 release.Philip Tricca2016-03-2149-2071/+0
| | | | Signed-off-by: Philip Tricca <flihp@twobit.us>
* refpolicy: Replace 2.2014120 with release 2.20151208.Philip Tricca2016-03-2149-75/+31
| | | | | | | This was mostly straight forward. Had to refresh a single patch: poky-policy-fix-new-SELINUXMNT-in-sys.patch Signed-off-by: Philip Tricca <flihp@twobit.us>
* refpolicy: Add support for the SYSTEMD build.conf option.Stephen Smalley2016-03-171-0/+2
| | | | | | | | | | | | refpolicy has introduced a new build.conf option, SYSTEMD=y, to enable rules specific to using systemd as the init system. In particular, without setting this option, rules for direct domain transitions from init_t to daemon domains are not included in the policy. Define a POLICY_SYSTEMD variable in the refpolicy common include file that can be set elsewhere to enable this support. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Philip Tricca <flihp@twobit.us>
* refpolicy: update for change in libsemanage 2.5Stephen Smalley2016-03-171-2/+2
| | | | | | | | libsemanage 2.5 renamed /var/lib/selinux/tmp to /var/lib/selinux/final; update the refpolicy recipe accordingly. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Philip Tricca <flihp@twobit.us>
* refpolicy-git: Refresh poky-policy-fix-new-SELINUXMNT-in-sys.patch.Philip Tricca2015-11-271-75/+25
| | | | | Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-minimum: update prepare_policy_storeWenzong Fan2015-11-271-11/+30
| | | | | | | | | | | | | | | | | * update prepare_policy_store() for supporting SELinux 2.4 & CIL, the logic is from refpolicy_common.inc but with minimum set of policy modules; * add extra policy modules that required by sysnetwork, without those modules the install process will fail with error: | Failed to resolve roletype statement at 62 of \ .../image/var/lib/selinux/minimum/tmp/modules/100/sysnetwork/cil | Failed to resolve ast | semodule: Failed! Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-targeted: rebase patchesWenzong Fan2015-11-272-41/+56
| | | | | | | | | | rebase patches against latest git sources: * refpolicy-fix-optional-issue-on-sysadm-module.patch * refpolicy-unconfined_u-default-user.patch Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy: fix exit code issue of bzip2Wenzong Fan2015-10-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'bzip2 -qt $moudle_name.pp' has different exit codes on different distributions, for example: * On Redhat/CentOS/Fedora, OpenSUSE: $ bzip2 -qt /tmp/tor.pp bzip2: /tmp/tor.pp: bad magic number (file not created by bzip2) $ echo $? 0 This causes install errors: unzip2: /path/to/*.pp is not a bzip2 file. libsepol.module_package_read_offsets: module package header truncated Failed to read policy package * Ubuntu has fixed it: $ bzip2 -qt /tmp/tor.pp bzip2: /tmp/tor.pp: bad magic number (file not created by bzip2) $ echo $? 2 The difference involved by '-q' options, remove it would get the bzip2 works consistently. bzip2-native has the same issue, anyway it should be fixed separately. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy: SRCREV_FORMAT neededJoe Slater2015-10-221-0/+1
| | | | | Signed-off-by: Joe Slater <jslater@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy: Update policy install and bootstrap process for CIL.Philip Tricca2015-09-171-14/+26
| | | | | | | | | | | | | | | | The policy modules are now installed into /var/lib/selinux instead of /etc/selinux. Policies now have priorities. This is represented as part of the path under /var/lib/selinux. The new intermediate policy representation requires that we install the policy package as 3 files (hll, cil & lang_ext) instead of just the *.pp as before. The cil is generated from the hll (the pp file) using the new 'pp' utility. The base policy module now lives with all of the other modules. policy.kern has gone away. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-minimum: update base refpolicy to git repoShrikant Bobade2015-08-071-0/+48
| | | | | | | | A simple forward-port of refpolicy-minimum to use the refpolicy from git repository. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-standard: update base refpolicy to git repoShrikant Bobade2015-08-071-0/+8
| | | | | | | | A simple forward-port of refpolicy-standard to use the refpolicy from git repository. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-mls: update base refpolicy to git repoShrikant Bobade2015-08-071-0/+10
| | | | | | | | A simple forward-port of refpolicy-mls to use the refpolicy from git repository. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-mcs: update base refpolicy to git repoShrikant Bobade2015-08-071-0/+11
| | | | | | | | A simple forward-port of refpolicy-mcs to use the refpolicy from git repository. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-targeted: update base refpolicy to git repoShrikant Bobade2015-08-071-0/+20
| | | | | | | | A simple forward-port of refpolicy-targeted to use the refpolicy from git repository. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy git: rebase patches with code baseShrikant Bobade2015-08-075-77/+74
| | | | | | | | | During forward-port of these patches from refpolicy 20140311, requires rebase with the refpolicy git repos head master code base,in order to resolve the patch conflicts. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-23 06:06:10 +0000