summaryrefslogtreecommitdiffstats
path: root/recipes-security
Commit message (Collapse)AuthorAgeFilesLines
* policycoreutils: fix genhomedircon constructiondylanJoe Slater2013-08-012-1/+28
| | | | | | | | | | CQID: 418197 Reference /usr/sbin instead of the directory into which the script is installed on the host. Signed-off-by: Joe Slater <jslater@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* audit: Fixed swig host contamination issueAnders Hedlund2013-08-013-5/+56
| | | | | | | | | | | | | CQID: 428272 The audit build uses swig to generate a python wrapper. Unfortunately, the swig info file references host include directories. Some of these were previously noticed and eliminated, but the one fixed here was not. Signed-off-by: Anders Hedlund <anders.hedlund@windriver.com> Signed-off-by: Joe Slater <jslater@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* packagegroup-core-selinux: Rename from task to packagegroupMark Hatle2013-08-022-5/+5
| | | | | | | | | Also fix ALLOW_EMPTY, oe-core does not allow ALLOW_EMPTY w/o a package name. Adjust references in core-image-selinux to the new packagegroup filename. Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* selinux packages: uprev git recipes to lastest tag 20130423.Xin Ouyang2013-06-1810-19/+95
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* policycoreutils: Revert "run_init: If open_init_pty ..."Xin Ouyang2013-06-052-1/+42
| | | | | | | | | | | | This reverts commit d46e88abb6e1f7b0228c30c98ba4fb739e63cda3. In d46e88ab, run_init will not use open_init_pty as Redhat did. Our old refpolicy still does no work well with this, and make init scripts fail to start so revert it. This patch should be dropped while refpolicy is upreved to 2.20120725+. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* policycoreutils: Revert "restorecon: only update type by default"Xin Ouyang2013-05-282-1/+319
| | | | | | | | | | | This reverts uprev commit 96cedba3e59aa474f0f040da5108a17bba45ce6c. 96cedb will cause wrong security contexts for /dev/ while using MLS type of old refpolicy, so revert it. This patch should be dropped while refpolicy is upreved to 2.20120725+. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* libselinux: Revert libpcre for old refpolicy compatibleXin Ouyang2013-05-283-36/+961
| | | | | | | | | | | | | This reverts upstream libpcre commits. libselinux 2.1.12 uses libpcre to do file path matching instead of glibc regex. Because there are some differences between glibc regex and pcre functions, this will cause wrong security contexts for files while using old refpolicy. This patch should be dropped while refpolicy is upreved to 2.20120725+. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* libsemanage: drop flag: -Wno-unused-but-set-variableRandy MacLeod2013-05-013-4/+25
| | | | | | | | | The flag: -Wno-unused-but-set-variable isn't supported on older versions of gcc such as gcc-4.1.2 which is the native compiler for RHEL-5.9. Drop this warning flag for both the native and target builds. Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* libselinux: drop flag: -Wno-unused-but-set-variableRandy MacLeod2013-04-302-3/+23
| | | | | | | | | The flag: -Wno-unused-but-set-variable isn't supported on older versions of gcc such as gcc-4.1.2 which is the native compiler for RHEL-5.9. I've droped this warning flag for both the native and target builds. Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* selinux userspace: uprev to release 2.20120924Xin Ouyang2013-04-2422-4083/+118
| | | | | | | | | | | | | | | | | Upreved packages: - checkpolicy to 2.1.11 - libselinux to 2.1.12 - libsemanage to 2.1.9 - libsepol to 2.1.8 - policycoreutils to 2.1.13 - sepolgen to 1.1.8 Misc changes: - libselinux has a new depend for libpcre - drop patches that new version merged - set PR to r0 for new version Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* audit: use generated headers for cross compilingXin Ouyang2013-04-013-334/+2442
| | | | | | | | | | | | | | | | | | | Default audit Makefile will generate native executables in lib/ and auparse/, which are named as gen_*_h and run on the hosts to create *_tables.h/*tabs.h header files for the targets. This is inappropriate for our cross compiling because they need linux-libc-headers from the host. Even worse, on some old hosts, build will fail because some .h files in the old linux-libc-headers (<= 2.6.29) has incomplete DEFINE lists for the audit system. So add *tables.h/*tabs.h header files which are generated from linux-libc-headers-3.4, and do not generate and run those native executables. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: oe-core /var/log symlink policy for apacheXin Ouyang2013-03-193-1/+30
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy*: fix file contexts for many oe-core recipesXin Ouyang2013-03-1915-0/+403
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* libcap-ng: fix the QA issue for libcap-ng.so*Xin Ouyang2013-03-151-1/+11
| | | | | | | Some binaries in base_sbindir have libcap-ng.so* depends, so move libcap-ng.so* to avoid QA warnings. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: two patches for nfs-kernel-serverXin Ouyang2013-03-095-4/+104
| | | | | | | | We still miss some rules for nfsd to bind on nfs ports, so add a patch to fix this. oe-core changed nfsd to use portmap, so also fix file contexts for portmap. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: add selinux-config RDEPENDSXin Ouyang2013-02-271-1/+1
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: fix file contexts for bindXin Ouyang2013-02-272-0/+37
| | | | | | | Some files of bind are not installed to default pathes, fix the security contexts for these files. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: add rules for /var/cache symlinkXin Ouyang2013-02-272-0/+510
| | | | | | | | /var/cache is a symlink in poky, so we need allow rules for files to read lnk_file while doing search/list/delete/rw.. in /var/cache/ directory. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* policycoreutils: target build alway need libcgroup&libcap-ngXin Ouyang2013-02-171-2/+4
| | | | | | | Target package policycoreutils-sandbox always needs libcgroup and libcap-ng, so it should not be conditional. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* libsemanage: fix incorrect path for nologinXin Ouyang2013-02-173-4/+43
| | | | | | | shadow package of oe-core and Debian has installed nologin into /usr/sbin, so fix this path. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* libcap-ng: remove old versionXin Ouyang2013-01-301-30/+0
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* setools: fix incorrect PYTHON_LDFLAGS.Xin Ouyang2013-01-241-2/+2
| | | | | | | | | | | | | PYTHON_LDFLAGS is considered as the full path of libpython2.7.so, dirname of the .so file will be expanded into -L<DIR>. As a result, current PYTHON_LDFLAGS cause this compile result: ${CC} ... -L-LXXX/tmp/sysroots/qemux86-64/usr/lib64 -L-lapol -lqpol -o _sesearch.so So "-lapol" is ignored, fix this. CQID: WIND00400717 Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: policy fixes for seutils and auditd_log_tXin Ouyang2013-01-233-12/+104
| | | | | | | | | | | | Two patches to fix these two issue: * Current policy has incomplete allow rules for selinux utils to manage selinux config files and policy store. * auditd_log_t(/var/log/audit/audit.log) is also placed in var_log_t, so add related rules. CQID: WIND00396415 Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: file contexts for alternatives of shadowXin Ouyang2013-01-223-1/+36
| | | | | | CQID: WIND00399962 Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* policycoreutils: inherit selinuxXin Ouyang2013-01-221-5/+5
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* audit: admin tools&daemons install to base_sbindirXin Ouyang2013-01-223-39/+7
| | | | | | | | audit admin tools and daemons should install to base_sbindir, so they can get correct security labels after selinux restorecon command. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: add user_tty_device_t into customizable_typesXin Ouyang2013-01-092-0/+10
| | | | | | | Add user_tty_device_t as a customizable_type, so that restorecon -R /dev will not complain about it or modify the security labels. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: change hard-coded pachesXin Ouyang2013-01-091-10/+10
| | | | | | | - /etc -> ${sysconfdir} - /usr/share -> ${datadir} Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* audit: enable auditd service for default runlevelsXin Ouyang2013-01-071-2/+6
| | | | | | CQID: WIND00397456 Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* selinux packages: create include files.Xin Ouyang2013-01-0519-485/+285
| | | | | | | | | | | | Create include files for selinux userspace packages: * checkpolicy.inc * libselinux.inc * libsemanage.inc * libsepol.inc * policycoreutils.inc * sepolgen.inc Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* libsemanage: fix path length limits.Xin Ouyang2012-12-253-8/+38
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* policycoreutils: install init script under /etc/init.d/Roy.Li2012-12-122-2/+4
| | | | | Signed-off-by: Roy.Li <rongqing.li@windriver.com> Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* checkpolicy+libsemanage: flex+bison native dependsXin Ouyang2012-11-294-8/+8
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: standard/mls policy should set UBAC=nXin Ouyang2012-11-263-2/+5
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: fix policy to allow nfsd works.Xin Ouyang2012-11-264-2/+72
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* selinux-config: update the init scriptXin Ouyang2012-11-192-11/+41
| | | | | | | Fix the hard-coded security type for /dev/null and /dev/console. Check rootfs if support xattrs before do relabel. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy*: make to use pythonnativeXin Ouyang2012-11-083-3/+3
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* policycoreutils: backport to remove empty po filesXin Ouyang2012-11-013-2/+3813
| | | | | | | et, gl, and id .po files contained no translations. This can cause build errors. Delete those puppies. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* setools: add libxml2 DEPENDS.Xin Ouyang2012-10-181-1/+1
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* selinux-config: add init scriptXin Ouyang2012-10-182-2/+53
| | | | | | | | | | | This script will be installed as 0selinux-init, in runlevel S and sequence number 0. It will start before any other init script. * relabel /dev for restorecon/fixfiles running * rebuild policy and relabel the rootfs if /.autorelabel placed. * relabel the rootfs if it is first booting. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* core-image-selinux: update task-* to packagegroup-*Xin Ouyang2012-10-181-2/+2
| | | | | | | oe-core has changed task-* recipes to packagegroup-*, so we should follow this. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* policycoreutils: add pam config for newrole/run_initXin Ouyang2012-10-184-9/+52
| | | | | | Also fix missing RDEPENDS for setools-* Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: xconsole_device_t as a dev_nodeXin Ouyang2012-10-182-0/+28
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: add poky specific rules for packages.Xin Ouyang2012-10-1811-0/+735
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: Fix specific file contexts for pokyXin Ouyang2012-10-188-2/+245
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* refpolicy: uprev to version 2.20120725.Xin Ouyang2012-10-187-1554/+14
| | | | | | | | | | | Patches are migrated or droped for new version. * poky-fc-etc_init.d.patch: droped because file_contexts.subs_dist is defined to instead. * fix-mount-to-write-mountpoints-dirs.patch: droped because the rules is not needed now. * poky-fc-update-alternatives_sysvinit.patch: migrated. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* libcap-ng: pythonnative, add swig-native dependXin Ouyang2012-10-152-8/+6
| | | | | | | libcap-ng need native python while do_configure, and native swig while do_compile, so add them. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* policycoreutils: disable QA checkes for fixfiles.Xin Ouyang2012-10-112-2/+6
| | | | | | | | | | | | | | | | fixfiles in /sbin would run some /usr/bin binaries to cause these QA warnings. WARNING: Shell scripts in base_bindir and base_sbindir should not reference anything in exec_prefix Since fixfiles is installed into /sbin in most Linux distros, changing this path may cause runtime errors for some hard coded binaries. So, disable unsafe-references-in-scripts QA checkes. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* audit: fix package issues.Xin Ouyang2012-10-111-9/+20
| | | | | | | | | | | | Rename two packages and change files in them. * audit-libs -> audit : main package, for libraries * audit -> auditd : for daemon binaries Libraries are changed to install into ${base_libdir}. The two fixes are used to fix QA issues and fit the Debian policy. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* libselinux: fix Public Domain license warning.Xin Ouyang2012-10-092-4/+4
| | | | | | | The "Public Domain" license now has a common license file placed as PD in Poky/oe-core, so fix this. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-23 04:50:54 +0000