summaryrefslogtreecommitdiffstats
path: root/recipes-security/selinux
Commit message (Collapse)AuthorAgeFilesLines
...
* libselinux / libsemanage: work around FD_CLOEXEC and SOCK_CLOEXEC absenceJoe MacDonald2013-11-145-0/+113
| | | | | | | | | | | | | | | [ CQID: WIND00438478 ] [ CQID: WIND00439485 ] Turns out some of the truly old hosts don't even really recognize FD_CLOEXEC and most of the older ones don't know about SOCK_CLOEXEC. Work around each (define FD_CLOEXEC to something sensible, simply don't use SOCK_CLOEXEC, produce warnings in either event). Signed-off-by: Joe MacDonald <joe.macdonald@windriver.com> Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* libselinux / policycoreutils: optional O_CLOEXECJoe MacDonald2013-11-144-0/+152
| | | | | | | | | | | [ CQID: WIND00438478 ] We still have hosts that pre-date the inclusion of O_CLOEXEC (Linux 2.6.23) so compile the flag out when building on classic distros. Signed-off-by: Joe MacDonald <joe.macdonald@windriver.com> Signed-off-by: Jeff Polk <jeff.polk@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* Remove unnecessary RDEPENDS_${BPN}.Philip Tricca2013-10-151-15/+0
| | | | | | | | | | Now that the policycoreutuils package is empty no need for RDEPENDS. Doing this in the commit that broke up the policycoreutuils package made the diff hard to read. Figured it best to break it out for readability. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* Break policycoreutils out into separate packages for the various utilities.Philip Tricca2013-10-151-10/+178
| | | | | | | | | | The driver beind this is to allow images to be built with the minimal tools necessary to load a policy. Breaking all of the stuff that's dependent on python out from the core utils allows us to make much smaller images. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* policycoreutils: avoid shell for checking target-special actionsMark Hatle2013-10-021-3/+1
| | | | | | | | do_install was modified to only do the special actions in the target case, instead of using shell to check what mode we were running in. Signed-off-by: Mark Hatle <mark.hatle@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* always force to restore file contexts in initscriptsXin Ouyang2013-10-022-4/+4
| | | | | | | | | | | In policycoreutils-2.13+, restorecon changes its default behaviour, and does not restore context if the file' type is correct, even its mcs/mls level is incorrect. We should force it always to restore file contexts in initscripts to avoid issues. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* policycoreutils: fix wrong newrole/run_init pam configXin Ouyang2013-10-022-6/+6
| | | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* sepolgen: migrate SRC_URI to 1.1.9Xin Ouyang2013-10-021-3/+3
| | | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* policycoreutils: migrate SRC_URI and patches to 2.1.14Xin Ouyang2013-10-025-350/+52
| | | | | | | | 2.1.14 imports a new python module: sepolicy, so add setools to DEPENDS and split new files to policycoreutils-python. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libsepol: migrate SRC_URI to 2.1.9Xin Ouyang2013-10-021-3/+3
| | | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libsemanage: migrate SRC_URI to 2.1.10Xin Ouyang2013-10-021-4/+4
| | | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libselinux: migrate SRC_URI and patches to 2.1.13Xin Ouyang2013-10-022-964/+5
| | | | | | | We will also uprev refpolicy, so remove "revert-libpcre.patch". Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* checkpolicy: migrate SRC_URI to 2.1.12Xin Ouyang2013-10-021-3/+3
| | | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* selinux userspace: uprev packages to release 20130423Xin Ouyang2013-10-028-12/+12
| | | | | | | | | | | | | | | Upreved packages: - checkpolicy to 2.1.12 - libselinux to 2.1.13 - libsemanage to 2.1.10 - libsepol to 2.1.9 - policycoreutils to 2.1.14 - sepolgen to 1.1.9 Migrate patches in next commits. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* Add ${bindir}/sepolgen to system-config-selinux package.Philip Tricca2013-09-271-1/+4
| | | | | | | | | | Currently the policycoreutils package has a broken link from ${bindir}/sepolgen to ${datadir}/system-config-selinux/polgen.py. All of the other polgen stuff is in system-config-selinux so adding sepolgen to same package seems like the right thing to do. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* Check for the availability of 'secon' and 'setenforce' in the ↵Philip Tricca2013-09-271-3/+5
| | | | | | | | | selinux-init.sh script. This is for consistency and to aid in debugging. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* Stage SELinux config file in the sysroot.Philip Tricca2013-09-251-0/+3
| | | | | | | | | | | | | This is needed to build policy modules outside of the refpolicy. Policy module build systems need to determine the name of the policy that will be in effect on the target host. This allows them to locate the policy headers that will be under $sysroot/usr/share/selinux/$name/include. Given that there *could* be more than one policy installed in the sysroot we can't assume that the policy installed there is the only policy to build against. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* policycoreutils: fix genhomedircon constructionJoe Slater2013-08-012-1/+28
| | | | | | | | | | CQID: 418197 Reference /usr/sbin instead of the directory into which the script is installed on the host. Signed-off-by: Joe Slater <jslater@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* selinux packages: uprev git recipes to lastest tag 20130423.Xin Ouyang2013-06-1810-19/+95
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* policycoreutils: Revert "run_init: If open_init_pty ..."Xin Ouyang2013-06-052-1/+42
| | | | | | | | | | | | This reverts commit d46e88abb6e1f7b0228c30c98ba4fb739e63cda3. In d46e88ab, run_init will not use open_init_pty as Redhat did. Our old refpolicy still does no work well with this, and make init scripts fail to start so revert it. This patch should be dropped while refpolicy is upreved to 2.20120725+. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* policycoreutils: Revert "restorecon: only update type by default"Xin Ouyang2013-05-282-1/+319
| | | | | | | | | | | This reverts uprev commit 96cedba3e59aa474f0f040da5108a17bba45ce6c. 96cedb will cause wrong security contexts for /dev/ while using MLS type of old refpolicy, so revert it. This patch should be dropped while refpolicy is upreved to 2.20120725+. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* libselinux: Revert libpcre for old refpolicy compatibleXin Ouyang2013-05-283-36/+961
| | | | | | | | | | | | | This reverts upstream libpcre commits. libselinux 2.1.12 uses libpcre to do file path matching instead of glibc regex. Because there are some differences between glibc regex and pcre functions, this will cause wrong security contexts for files while using old refpolicy. This patch should be dropped while refpolicy is upreved to 2.20120725+. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* libsemanage: drop flag: -Wno-unused-but-set-variableRandy MacLeod2013-05-013-4/+25
| | | | | | | | | The flag: -Wno-unused-but-set-variable isn't supported on older versions of gcc such as gcc-4.1.2 which is the native compiler for RHEL-5.9. Drop this warning flag for both the native and target builds. Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* libselinux: drop flag: -Wno-unused-but-set-variableRandy MacLeod2013-04-302-3/+23
| | | | | | | | | The flag: -Wno-unused-but-set-variable isn't supported on older versions of gcc such as gcc-4.1.2 which is the native compiler for RHEL-5.9. I've droped this warning flag for both the native and target builds. Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* selinux userspace: uprev to release 2.20120924Xin Ouyang2013-04-2422-4083/+118
| | | | | | | | | | | | | | | | | Upreved packages: - checkpolicy to 2.1.11 - libselinux to 2.1.12 - libsemanage to 2.1.9 - libsepol to 2.1.8 - policycoreutils to 2.1.13 - sepolgen to 1.1.8 Misc changes: - libselinux has a new depend for libpcre - drop patches that new version merged - set PR to r0 for new version Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* policycoreutils: target build alway need libcgroup&libcap-ngXin Ouyang2013-02-171-2/+4
| | | | | | | Target package policycoreutils-sandbox always needs libcgroup and libcap-ng, so it should not be conditional. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* libsemanage: fix incorrect path for nologinXin Ouyang2013-02-173-4/+43
| | | | | | | shadow package of oe-core and Debian has installed nologin into /usr/sbin, so fix this path. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* policycoreutils: inherit selinuxXin Ouyang2013-01-221-5/+5
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* selinux packages: create include files.Xin Ouyang2013-01-0519-485/+285
| | | | | | | | | | | | Create include files for selinux userspace packages: * checkpolicy.inc * libselinux.inc * libsemanage.inc * libsepol.inc * policycoreutils.inc * sepolgen.inc Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* libsemanage: fix path length limits.Xin Ouyang2012-12-253-8/+38
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* policycoreutils: install init script under /etc/init.d/Roy.Li2012-12-122-2/+4
| | | | | Signed-off-by: Roy.Li <rongqing.li@windriver.com> Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* checkpolicy+libsemanage: flex+bison native dependsXin Ouyang2012-11-294-8/+8
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* selinux-config: update the init scriptXin Ouyang2012-11-192-11/+41
| | | | | | | Fix the hard-coded security type for /dev/null and /dev/console. Check rootfs if support xattrs before do relabel. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* policycoreutils: backport to remove empty po filesXin Ouyang2012-11-013-2/+3813
| | | | | | | et, gl, and id .po files contained no translations. This can cause build errors. Delete those puppies. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* selinux-config: add init scriptXin Ouyang2012-10-182-2/+53
| | | | | | | | | | | This script will be installed as 0selinux-init, in runlevel S and sequence number 0. It will start before any other init script. * relabel /dev for restorecon/fixfiles running * rebuild policy and relabel the rootfs if /.autorelabel placed. * relabel the rootfs if it is first booting. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* policycoreutils: add pam config for newrole/run_initXin Ouyang2012-10-184-9/+52
| | | | | | Also fix missing RDEPENDS for setools-* Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* policycoreutils: disable QA checkes for fixfiles.Xin Ouyang2012-10-112-2/+6
| | | | | | | | | | | | | | | | fixfiles in /sbin would run some /usr/bin binaries to cause these QA warnings. WARNING: Shell scripts in base_bindir and base_sbindir should not reference anything in exec_prefix Since fixfiles is installed into /sbin in most Linux distros, changing this path may cause runtime errors for some hard coded binaries. So, disable unsafe-references-in-scripts QA checkes. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* libselinux: fix Public Domain license warning.Xin Ouyang2012-10-092-4/+4
| | | | | | | The "Public Domain" license now has a common license file placed as PD in Poky/oe-core, so fix this. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* selinux recipes: inherit pythonnativeXin Ouyang2012-09-264-8/+12
| | | | | | | With new changes in oe-core, recipes which need python-native should "inherit pythonnative". Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* policycoreutils: fix build with pam DISTRO_FEATUREXin Ouyang2012-09-242-4/+4
| | | | | | | If no pam DISTRO_FEATURE, policycoreutils should not build with libpam headers and libraries. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* policycoreutils: rewrite DEPENDS for libcap-ng&libcgroup&pamXin Ouyang2012-08-171-2/+2
| | | | | | | | | EXTRA_DEPENDS is still not null while building native packages, this will add useless depends for libcap-ng&libcgroup&pam and cause build errors. So rewrite these DEPENDS. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* libselinux: Fix indent warning for python codes.Xin Ouyang2012-08-172-10/+10
| | | | | | | | | Fix these warnings: =================== WARNING: Variable get_git_policyconfigarch contains tabs, please remove these(....) Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* policycoreutils: remove format-security from CFLAGS.Xin Ouyang2012-07-233-2/+35
| | | | | | | | Remove -Wno-error=format-security from CFLAGS. and add a patch so we can build policycoreutils if -Werror=format-security enabled. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* python-ipy: rename to fix opkg-build error.Xin Ouyang2012-06-292-2/+2
| | | | | | *** Error: Package name contains illegal characters, (other than [a-z0-9.+-]) Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* selinux: Add bb for default selinux config.Xin Ouyang2012-06-151-0/+33
| | | | | | Now, the default policy is "mls". Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* libselinux_git.bb: Add workaround for bitbake parse issueMark Hatle2012-06-011-2/+2
| | | | | | | | | See Yocto Project bugzilla: https://bugzilla.yoctoproject.org/show_bug.cgi?id=2530 This is a temporary workaround to the parsing issue. Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* selinux: Remove obsolete versionMark Hatle2012-05-189-691/+0
| | | | Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* checkpolicy: Add flex to the DEPENDSMark Hatle2012-05-182-2/+2
| | | | Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* selinux: Remove unnecessary anonymous python blocksJoe MacDonald2012-05-184-22/+14
| | | | | | | | | | | | | | | | | libselinux was attempting to ensure ARCH was set to i386 for any i*86 platform. Replaced the existing code with a simpler construct that accomplishes the same goal. A similar anonymous python block was being used in policycoreutils to identify an optional dependency on libcap-ng and libcgroup. Also replaced with a simpler construct. The newest policycoreutils depends on them both anyway in the current configuration. Signed-off-by: Joe MacDonald <joe.macdonald@windriver.com> Added _git versions. Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* selinux: Change default preferences away from git versionJoe MacDonald2012-05-186-0/+6
| | | | | | | | | | | The preferred versions hould always be the latest stable, not the git recipe. Signed-off-by: Joe MacDonald <joe.macdonald@windriver.com> Revised summary commit message, and added addition _git recipes. Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-04 21:45:58 +0000