summaryrefslogtreecommitdiffstats
path: root/recipes-security
Commit message (Collapse)AuthorAgeFilesLines
...
* audit: Enable ARM System Call Audit in user space.Han Chao2014-04-242-0/+48
| | | | | | | | | | | | Audit System Call needs kernel and user space support. In user space it needs system call table for ARM. It also needs a configure option --with-armeb for build audit. Audit system call also needs enable kernel config CONFIG_AUDITSYSCALL. Signed-off-by: Han Chao <chan@windriver.com> Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: add minimum targeted policyWenzong Fan2014-04-241-0/+46
| | | | | | | | | | This is a minimum targeted policy with just core policy modules, and could be used as a base for customizing targeted policy. Pretty much everything runs as initrc_t or unconfined_t so all of the domains are unconfined. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: add targeted policy typeWenzong Fan2014-04-243-0/+276
| | | | | | | | | | | This SELinux policy would targeted most of service domains for lock down, and users and admins will login in with unconfined_t domain. So they would have the same access to the system as if SELinux was not enabled, when running commands and services which are not targeted. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* audit: Fix lack of a default audit.rulesMark Hatle2014-04-072-1/+6
| | | | | | | | | | | | | | | Various components were failing, and upon investigation it was noted that the audit.rules file referenced by the initscript wasn't available. There was however a copy under the rules.d directory. Investigating the audit.spec file (which in the upstream source) showed that it was expected that the version in the rules.d should be copied into /etc/audit. Do this and correct the systemd services file to use the same file. Signed-off-by: Mark Hatle <mark.hatle@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* policycoreutils: Add missing dependencies to semanagePeter Seebach2014-04-031-0/+2
| | | | | | | | The semanage utility requires python-compression (for "import gzip") and python-xml (for "import xml.etree.ElementTree"). Signed-off-by: Peter Seebach <peter.seebach@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* checkpolicy: Don't link against libflChong Lu2014-04-032-0/+46
| | | | | | | | | | In policy_scan.l file, we have already removed all references to yywrap by adding "%option noyywrap" statements to each flex source file that doesn't override yywrap. After this, we no longer need to link against libfl and so no longer get errors about undefined references to yylex. Signed-off-by: Chong Lu <Chong.Lu@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* policycoreutils: drop the patch for old refpolicyJackie Huang2014-04-033-42/+0
| | | | | | | | | | The patch policycoreutils-revert-run_init-open_init_pty.patch is only for refpolicy version older than 2.20120725, now the refpolicy is updated to 2.20130424 so drop the patch or it will make run_init fail to start some init scripts. Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* policycoreutils: semanageJoe Slater2014-04-032-1/+23
| | | | | | | | | When modifying an selinux login record, seobject.py, may try to log a value, self.sename, which has been preset to "None" and this will fail. So, we set it to something useful. Signed-off-by: Joe Slater <jslater@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: add rules for /var/log symlink on pokyWenzong Fan2014-04-033-0/+61
| | | | | Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: associate tmpfs_t (shm) to device_t (devtmpfs) file systemsWenzong Fan2014-04-032-0/+31
| | | | | | | The patch is backported from upstream. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: make proftpd be able to workRoy Li2014-04-032-0/+40
| | | | | Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* audit: fix the permission of configuration fileRoy Li2014-04-031-0/+3
| | | | | | | A ordinary use should not to access auditd configuration files Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* audit: Add systemd supportRoy Li2014-04-033-2/+38
| | | | | | | Audit unit file is from https://fedorahosted.org/audit/browser/trunk/init.d/auditd.service Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: allow sysadm to run rpcbindRoy Li2014-04-032-0/+34
| | | | | Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* core-image-selinux: update 'core-basic' packagegroupJoe MacDonald2014-04-031-1/+1
| | | | | | | packagegroup-core-basic has been renamed to packagegroup-full-cmdline, update our core-image-selinux. Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: Updated FILESEXTRAPATHS_prepend valueAlexandru.Vaduva2014-04-031-1/+1
| | | | | | | | | | | | The value was defined as: FILESEXTRAPATHS_prepend := "${THISDIR}/refpolicy-${PV}:" and changed it to: FILESEXTRAPATHS_prepend := "${THISDIR}/refpolicy-2.20130424:" becase the bb that inherit this overwrites the PV every time, changing its name. Signed-off-by: Alexandru.Vaduva <Alexandru.Vaduva@enea.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: fix real path for su.shadowWenzong Fan2014-02-132-0/+26
| | | | | Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: backport two patches to fix dhclient, hostname and ifconfigRoy Li2014-02-123-0/+102
| | | | | Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: fix ftpwho install dirRoy Li2014-02-122-0/+28
| | | | | | | ftpwho is installed into /usr/bin, not /usr/sbin. Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: Allow ping to get/set capabilitiesWenzong Fan2014-01-282-0/+36
| | | | | | | | When ping is installed with capabilities instead of being marked setuid, then the ping_t domain needs to be allowed to getcap/setcap. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* refpolicy: fix real path for swapoffWenzong Fan2014-01-281-9/+10
| | | | Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
* refpolicy: fix real path for cpioWenzong Fan2014-01-282-0/+26
| | | | Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
* selinux: set policy-version to 28Wenzong Fan2014-01-282-0/+6
| | | | | The default policy version of new selinux toolchains is 29, to fit kernel 3.10.x, set it to 28.
* refpolicy: fix new symlink for policy.kernWenzong Fan2014-01-261-0/+4
| | | | | | | | | New 2.2 release of libsemanage removes policy.kern and replace with symlink from Dan Walsh. It is a host path while cross-compiling, so fix this path. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* refpolicy: fix real path for udevadmWenzong Fan2014-01-261-6/+14
| | | | Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
* libsemanage: fix DEPENDS override issueWenzong Fan2014-01-231-1/+1
| | | | | | | Don't override DEPENDS for target build, the "audit" should be appended to it. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
* libsemanage-native: remove audit-native dependencyWenzong Fan2014-01-204-0/+128
| | | | | | | | | * native tools don't need audit support; * audit 2.3.2 or laters require kernel headers >= 2.6.30, this causes audit-native can't be built on some older distributions. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* Revert "libsemanage: add audit dependency"Wenzong Fan2014-01-202-8/+2
| | | | | | | This reverts commit 146bd8c6bc3bc0e9e96a8517263f28f7915b871d. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* libselinux: uprev to small fix version 2.2.2Wenzong Fan2014-01-201-2/+2
| | | | | Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* selinux: remove PREFERRED_VERSION configsWenzong Fan2014-01-201-7/+0
| | | | | | | | We are using the latest version for selinux userspace packages, so remove the PREFERRED_VERSION configs. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* audit: the ldap option should be "--without-ldap"Xin Ouyang2014-01-131-1/+1
| | | | Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* refpolicy: fix real path for udevdWenzong Fan2014-01-102-0/+28
| | | | | | | | | | | In Yocto the real path for udevd is /lib/udev/udevd, this patch fixes the init issues like: udevd[87]: setfilecon /dev/vcsa2 failed: Operation not permitted udevd[89]: setfilecon /dev/fb0 failed: Operation not permitted Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* selinux packagegroups: update LIC_FILES_CHKSUMWenzong Fan2014-01-103-3/+3
| | | | | Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* policycoreutils: fix QA issuesWenzong Fan2014-01-101-3/+7
| | | | | | | | | | | | | | | ERROR: QA Issue: policycoreutils: Files/directories were installed \ but not shipped /usr/share/icons/hicolor/24x24/apps/system-config-selinux.png /usr/share/bash-completion/completions/setsebool /usr/share/bash-completion/completions/sepolicy /usr/share/bash-completion/completions/semanage /usr/share/dbus-1/system-services/org.selinux.service /usr/share/polkit-1/actions/org.selinux.config.policy /usr/share/polkit-1/actions/org.selinux.policy Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* libsemanage: add audit dependencyWenzong Fan2014-01-102-2/+8
| | | | | | | Building libsemanage 2.2 need the header libaudit.h. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* sepolgen: migrate SRC_URI to 1.2.1Wenzong Fan2014-01-102-4/+4
| | | | | Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* policycoreutils: migrate SRC_URI and patches to 2.2.5Wenzong Fan2014-01-106-67/+32
| | | | | | | | | | | | This patch is removed since it is merged by new version: - policycoreutils-fix-strict-prototypes.patch These two patches are updated: - policycoreutils-fix-sepolicy-install-path.patch - policycoreutils-make-O_CLOEXEC-optional.patch Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* libsepol: migrate SRC_URI to 2.2Wenzong Fan2014-01-104-40/+8
| | | | | | | | Removed patch and ported changes to 2.2 bbfile: - libsepol-Change-ranlib-for-cross-compiling.patch Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* libsemanage: migrate SRC_URI to 2.2Wenzong Fan2014-01-103-8/+10
| | | | | | | | Updated patch: - libsemanage-fix-path-nologin.patch Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* libselinux: migrate SRC_URI and patches to 2.2Wenzong Fan2014-01-104-66/+10
| | | | | | | | | These two patches are removed since they are merged by new version: - libselinux-fix-init-load-policy.patch - libselinux-pcre-link-order.patch Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* checkpolicy: migrate SRC_URI to 2.2Wenzong Fan2014-01-102-4/+4
| | | | | Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* selinux userspace: uprev packages to release 20131030Wenzong Fan2014-01-109-15/+13
| | | | | | | | | | | | | | | Upreved packages: - checkpolicy to 2.2 - libselinux to 2.2 - libsemanage to 2.2 - libsepol to 2.2 - policycoreutils to 2.2.5 - sepolgen to 1.2.1 Migrate patches in next commits. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* policycoreutils: Patch Makefile to get load_policy symlink right.Philip Tricca2014-01-102-0/+20
| | | | | | | | | Setting DESTDIR in the policycoreutils do_install creates a bad symlink for load_policy. This patch fixes up the Makefile to create the symlink relative to DESTDIR. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* policy: Create compressed_policy distro featureJoe MacDonald2013-12-051-10/+22
| | | | | | | | | | | There is a small cost to having compressed policy files on the final image both in terms of memory requirements and load times. In nearly all circumstances this is negligible, but this adds a DISTRO_FEATURE that can be used to enable it, if desired. The default selinux distros will enable the feature by default. Signed-off-by: Joe MacDonald <joe@deserted.net>
* bzip SELinux policy modules in ${datadir}Philip Tricca2013-12-051-4/+5
| | | | | | | | | | | | | The 'semodule' utility can operate on compresed modules so the only cost of this change is a slower module load time when invoking 'semodule -i' on a running system (increased CPU load due to bzip2). That said my tests show more than 100M reduction in ext3 image size of core-image-selinux. This last metric is a bit skewed as the image includes two policies. Still, a reduction in the size of the refpolicy package by 1/2 is significant. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libselinux / libsemanage: work around FD_CLOEXEC and SOCK_CLOEXEC absenceJoe MacDonald2013-11-145-0/+113
| | | | | | | | | | | | | | | [ CQID: WIND00438478 ] [ CQID: WIND00439485 ] Turns out some of the truly old hosts don't even really recognize FD_CLOEXEC and most of the older ones don't know about SOCK_CLOEXEC. Work around each (define FD_CLOEXEC to something sensible, simply don't use SOCK_CLOEXEC, produce warnings in either event). Signed-off-by: Joe MacDonald <joe.macdonald@windriver.com> Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* libselinux / policycoreutils: optional O_CLOEXECJoe MacDonald2013-11-144-0/+152
| | | | | | | | | | | [ CQID: WIND00438478 ] We still have hosts that pre-date the inclusion of O_CLOEXEC (Linux 2.6.23) so compile the flag out when building on classic distros. Signed-off-by: Joe MacDonald <joe.macdonald@windriver.com> Signed-off-by: Jeff Polk <jeff.polk@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* refpolicy-standard: Use default variables from refpolicy_common.incPhilip Tricca2013-11-061-8/+0
| | | | | Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy-mls: Use default variables from refpolicy_common.incPhilip Tricca2013-11-061-12/+0
| | | | | Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy-mcs: Use default variables from refpolicy_common.incPhilip Tricca2013-11-061-10/+0
| | | | | Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-05 02:34:12 +0000