summaryrefslogtreecommitdiffstats
path: root/recipes-security
Commit message (Collapse)AuthorAgeFilesLines
* refpolicy: file contexts for alternatives of shadowXin Ouyang2013-01-223-1/+36
| | | | | | CQID: WIND00399962 Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* policycoreutils: inherit selinuxXin Ouyang2013-01-221-5/+5
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* audit: admin tools&daemons install to base_sbindirXin Ouyang2013-01-223-39/+7
| | | | | | | | audit admin tools and daemons should install to base_sbindir, so they can get correct security labels after selinux restorecon command. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: add user_tty_device_t into customizable_typesXin Ouyang2013-01-092-0/+10
| | | | | | | Add user_tty_device_t as a customizable_type, so that restorecon -R /dev will not complain about it or modify the security labels. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: change hard-coded pachesXin Ouyang2013-01-091-10/+10
| | | | | | | - /etc -> ${sysconfdir} - /usr/share -> ${datadir} Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* audit: enable auditd service for default runlevelsXin Ouyang2013-01-071-2/+6
| | | | | | CQID: WIND00397456 Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* selinux packages: create include files.Xin Ouyang2013-01-0519-485/+285
| | | | | | | | | | | | Create include files for selinux userspace packages: * checkpolicy.inc * libselinux.inc * libsemanage.inc * libsepol.inc * policycoreutils.inc * sepolgen.inc Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* libsemanage: fix path length limits.Xin Ouyang2012-12-253-8/+38
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* policycoreutils: install init script under /etc/init.d/Roy.Li2012-12-122-2/+4
| | | | | Signed-off-by: Roy.Li <rongqing.li@windriver.com> Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* checkpolicy+libsemanage: flex+bison native dependsXin Ouyang2012-11-294-8/+8
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: standard/mls policy should set UBAC=nXin Ouyang2012-11-263-2/+5
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: fix policy to allow nfsd works.Xin Ouyang2012-11-264-2/+72
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* selinux-config: update the init scriptXin Ouyang2012-11-192-11/+41
| | | | | | | Fix the hard-coded security type for /dev/null and /dev/console. Check rootfs if support xattrs before do relabel. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy*: make to use pythonnativeXin Ouyang2012-11-083-3/+3
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* policycoreutils: backport to remove empty po filesXin Ouyang2012-11-013-2/+3813
| | | | | | | et, gl, and id .po files contained no translations. This can cause build errors. Delete those puppies. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* setools: add libxml2 DEPENDS.Xin Ouyang2012-10-181-1/+1
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* selinux-config: add init scriptXin Ouyang2012-10-182-2/+53
| | | | | | | | | | | This script will be installed as 0selinux-init, in runlevel S and sequence number 0. It will start before any other init script. * relabel /dev for restorecon/fixfiles running * rebuild policy and relabel the rootfs if /.autorelabel placed. * relabel the rootfs if it is first booting. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* core-image-selinux: update task-* to packagegroup-*Xin Ouyang2012-10-181-2/+2
| | | | | | | oe-core has changed task-* recipes to packagegroup-*, so we should follow this. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* policycoreutils: add pam config for newrole/run_initXin Ouyang2012-10-184-9/+52
| | | | | | Also fix missing RDEPENDS for setools-* Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: xconsole_device_t as a dev_nodeXin Ouyang2012-10-182-0/+28
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: add poky specific rules for packages.Xin Ouyang2012-10-1811-0/+735
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: Fix specific file contexts for pokyXin Ouyang2012-10-188-2/+245
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: uprev to version 2.20120725.Xin Ouyang2012-10-187-1554/+14
| | | | | | | | | | | Patches are migrated or droped for new version. * poky-fc-etc_init.d.patch: droped because file_contexts.subs_dist is defined to instead. * fix-mount-to-write-mountpoints-dirs.patch: droped because the rules is not needed now. * poky-fc-update-alternatives_sysvinit.patch: migrated. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* libcap-ng: pythonnative, add swig-native dependXin Ouyang2012-10-152-8/+6
| | | | | | | libcap-ng need native python while do_configure, and native swig while do_compile, so add them. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* policycoreutils: disable QA checkes for fixfiles.Xin Ouyang2012-10-112-2/+6
| | | | | | | | | | | | | | | | fixfiles in /sbin would run some /usr/bin binaries to cause these QA warnings. WARNING: Shell scripts in base_bindir and base_sbindir should not reference anything in exec_prefix Since fixfiles is installed into /sbin in most Linux distros, changing this path may cause runtime errors for some hard coded binaries. So, disable unsafe-references-in-scripts QA checkes. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* audit: fix package issues.Xin Ouyang2012-10-111-9/+20
| | | | | | | | | | | | Rename two packages and change files in them. * audit-libs -> audit : main package, for libraries * audit -> auditd : for daemon binaries Libraries are changed to install into ${base_libdir}. The two fixes are used to fix QA issues and fit the Debian policy. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* libselinux: fix Public Domain license warning.Xin Ouyang2012-10-092-4/+4
| | | | | | | The "Public Domain" license now has a common license file placed as PD in Poky/oe-core, so fix this. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* selinux recipes: inherit pythonnativeXin Ouyang2012-09-265-10/+14
| | | | | | | With new changes in oe-core, recipes which need python-native should "inherit pythonnative". Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* policycoreutils: fix build with pam DISTRO_FEATUREXin Ouyang2012-09-242-4/+4
| | | | | | | If no pam DISTRO_FEATURE, policycoreutils should not build with libpam headers and libraries. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* setools: inherit pythonnativeXin Ouyang2012-09-201-3/+3
| | | | | | | With new changes in oe-core, recipes which need python-native should "inherit pythonnative". Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* audit-2.2.1: copy bits/socket_type.h only if it existsXin Ouyang2012-09-071-2/+6
| | | | | | | | | eglibc-2.16 splits enum __socket_type from bits/socket.h to bits/socket_type.h, so old eglibc does not have bits/socket_type.h We should copy it only if it exists. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* selinux-task: add necessary packages for selinuxXin Ouyang2012-08-211-0/+4
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* policycoreutils: rewrite DEPENDS for libcap-ng&libcgroup&pamXin Ouyang2012-08-171-2/+2
| | | | | | | | | EXTRA_DEPENDS is still not null while building native packages, this will add useless depends for libcap-ng&libcgroup&pam and cause build errors. So rewrite these DEPENDS. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* libselinux: Fix indent warning for python codes.Xin Ouyang2012-08-172-10/+10
| | | | | | | | | Fix these warnings: =================== WARNING: Variable get_git_policyconfigarch contains tabs, please remove these(....) Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* audit-2.2.1: Add bits/socket_type.h from target libc-headers.Xin Ouyang2012-08-171-0/+1
| | | | | | | | We have copied some target kernel headers in 72fb6da. We may get build failures because of missing bits/socket_type.h on some hosts, so add it. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* audit: inherit pythonnativeXin Ouyang2012-08-032-2/+2
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* policycoreutils: remove format-security from CFLAGS.Xin Ouyang2012-07-233-2/+35
| | | | | | | | Remove -Wno-error=format-security from CFLAGS. and add a patch so we can build policycoreutils if -Werror=format-security enabled. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: add policy patches for Yocto.Xin Ouyang2012-07-194-0/+1591
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* selinux-task: add selinux-configXin Ouyang2012-07-191-0/+1
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* python-ipy: rename to fix opkg-build error.Xin Ouyang2012-06-292-2/+2
| | | | | | *** Error: Package name contains illegal characters, (other than [a-z0-9.+-]) Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* audit: Add .h files from target libc-headers.Xin Ouyang2012-06-281-0/+16
| | | | | | | | | | | | | Just like audit_2.1.3.bb. The executables in lib/, which are named as gen_*_h, will run on the hosts to create *_tables.h/*tabs.h header files for the targets. In some old hosts, build will fail because .h files in the old linux-libc-headers (<= 2.6.29) has incomplete DEFINE lists for the audit system. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* audit: fix python header path in configure.acXin Ouyang2012-06-202-1/+31
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* audit: Uprev auditAmy Fong2012-06-184-0/+554
| | | | | | | | | | | The recipe is derived from 2.1.3 with some changes made. 1. configuration files are updated to look for sbin binaries in /usr/sbin 2. a init.d file was derived from Debian to work with busybox's start-stop-daemon 3. the plugin package contents was fine tuned as some of the files from 2.1.3 were required to let audit run. Signed-off-by: Amy Fong <amy.fong@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* selinux: Add bb for default selinux config.Xin Ouyang2012-06-151-0/+33
| | | | | | Now, the default policy is "mls". Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy*: Add RDEPENDS and fix PACKAGE_ARCH.Xin Ouyang2012-06-121-0/+3
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* libselinux_git.bb: Add workaround for bitbake parse issueMark Hatle2012-06-011-2/+2
| | | | | | | | | See Yocto Project bugzilla: https://bugzilla.yoctoproject.org/show_bug.cgi?id=2530 This is a temporary workaround to the parsing issue. Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* audit: Add audit.h from target libc-headers.Xin Ouyang2012-05-311-0/+11
| | | | | | | | | | | The executables in lib/, which are named as gen_*_h, will run on the hosts to create *_tables.h/*tabs.h header files for the targets. In some old hosts, build will fail because audit.h in the old linux-libc-headers (<= 2.6.29) has a incomplete netlink message list for the audit system. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* selinux: Remove obsolete versionMark Hatle2012-05-189-691/+0
| | | | Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* checkpolicy: Add flex to the DEPENDSMark Hatle2012-05-182-2/+2
| | | | Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* selinux: Remove unnecessary anonymous python blocksJoe MacDonald2012-05-184-22/+14
| | | | | | | | | | | | | | | | | libselinux was attempting to ensure ARCH was set to i386 for any i*86 platform. Replaced the existing code with a simpler construct that accomplishes the same goal. A similar anonymous python block was being used in policycoreutils to identify an optional dependency on libcap-ng and libcgroup. Also replaced with a simpler construct. The newest policycoreutils depends on them both anyway in the current configuration. Signed-off-by: Joe MacDonald <joe.macdonald@windriver.com> Added _git versions. Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-04 11:21:04 +0000