summaryrefslogtreecommitdiffstats
path: root/recipes-security
Commit message (Collapse)AuthorAgeFilesLines
...
* libselinux: uprev to 2.9 (20190315)Yi Zhao2019-12-194-116/+6
| | | | | | | | | | | | | | * Switch to python3 * Drop patches: 0001-libselinux-Do-not-define-gettid-if-glibc-2.30-is-use.patch 0001-src-Makefile-fix-includedir-in-libselinux.pc.patch * Split into libselinux recipe and libselinux-python recipe to fix the loop dependency error. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* libsepol: uprev to 2.9 (20190315)Yi Zhao2019-12-193-38/+7
| | | | | | | * Drop patch 0001-src-Makefile-fix-includedir-in-libsepol.pc.patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux: uprev inc files to 2.9 (20190315)Yi Zhao2019-12-193-8/+9
| | | | | | | | * Update SRC_URI * Add UPSTREAM_CHECK_URI and UPSTREAM_CHECK_REGEX Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* support policy module configuration at recipe levelJoe MacDonald2019-12-093-0/+31
| | | | | | | | | On highly storage-limited machines it may be beneficial to completely remove some or all non-essential policy modules. refpolicy already supports this with the 'no' option in modules.conf, so we'll just expose this feature (with an appropriate warning) at the recipe-level. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* autorelabel: only selinux-autorelabel need autorelabel fileChristophe PRIOUZEAU2019-12-092-7/+9
| | | | | | | | | | With previous implementation, several packages provided .autorelabel file while only selinux-autorelabel manage it. If there is several packages which try to install .autorelabel file, an issue occur during installation of packagegroup-core-selinux. Signed-off-by: Christophe Priouzeau <christophe.priouzeau@st.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* audit: explicitly disable golang bindingsYi Zhao2019-09-171-0/+1
| | | | | | | | Disable golang bindings to avoid potential host contamination issue. Fixes: https://bugzilla.yoctoproject.org/show_bug.cgi?id=13166 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-autorelabel: disable enforcing mode before relabelYi Zhao2019-09-091-3/+6
| | | | | | | | | | | The commit b0d31db104d9a4e94bc1409c2ffcc1d82f4a780f introduced an issue when first boot with bootparams="selinux=1 enforcing=1". At first boot, all files are unlabeled including /sbin/setfiles. The relabel operations are not permitted under enforcing mode. So we need to disable enforcing mode before relabel. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* setools: update SRC_URIYi Zhao2019-08-291-1/+1
| | | | | | | | | SETools has moved from https://github.com/TresysTechnology/setools to https://github.com/SELinuxProject/setools See: https://github.com/TresysTechnology/setools/wiki Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* mcstrans: specify INITDIRYi Zhao2019-08-291-1/+1
| | | | | | | | | By default the mcstrans init script will be installed to /etc/rc.d/init.d directory. Specify INITDIR to install it to /etc/init.d directory. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-python: Fix dependency for ntpathLorenz Kofler2019-08-281-0/+1
| | | | | | | | | On yocto warrior the semanage tool didn't work correctly, because it couldn't find ntpath module. It turned out that this module is now part of the package python-misc, therefore add dependency to python-misc. Signed-off-by: Lorenz Kofler <lorenz@sigma-star.at> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-init: use systemd (re)labellingMark Asselstine2019-08-284-16/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | Boot loops were being seen when booting with selinux enabled, when the init system in use is systemd. Once logs were retrieved from the failing system the error was found to be selinux-init.sh[284]: /sbin/restorecon: Could not set context for /sys/fs/cgroup/cpuacct: Read-only file system selinux-init.sh[284]: /sbin/restorecon: Could not set context for /sys/fs/cgroup/cpu: Read-only file system Systemd mounts /sys/fs/cgroup read-only and the (re)labelling code used by selinux-init.sh is unable to handle this. On top of this the system is basically presenting two methods of (re)labelling; using the built in systemd approach via selinux-autorelabel.service *and* the code we have in selinux-init.sh. This can get confusing especially given that most online resources will speak to the systemd approach using selinux-autorelabel.service and /.autorelabel. These changes leave the current approach in place when sysvinit is the init system used, but if systemd is being used we make use of it's internal (re)labelling functionality. Overall the workflow remains the same but we now avoid boot loops (systemd remounts /sys/fs/cgroup rw during the (re)labelling procedure). Signed-off-by: Mark Asselstine <mark.asselstine@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-sandbox: add runtime dependency on python-coreYi Zhao2019-08-281-0/+1
| | | | | | | | | Fixes: ERROR: QA Issue: /usr/share/sandbox/start contained in package selinux-sandbox requires /usr/bin/python, but no providers found in RDEPENDS_selinux-sandbox? [file-rdeps] Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-python: add python-core as runtime dependencyYi Zhao2019-08-281-0/+3
| | | | | | | | | | | | | Fix QA issues: QA Issue: /usr/lib64/python2.7/site-packages/seobject.py contained in package selinux-python requires /usr/bin/python, but no providers found in RDEPENDS_selinux-python? [file-rdeps] QA Issue: /usr/bin/audit2allow contained in package selinux-python-audit2allow requires /usr/bin/python, but no providers found in RDEPENDS_selinux-python-audit2allow? [file-rdeps] QA Issue: /usr/bin/chcat contained in package selinux-python-chcat requires /usr/bin/python, but no providers found in RDEPENDS_selinux-python-chcat? [file-rdeps] Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* mcstrans: specify SBINDIRJoe Slater2019-08-281-0/+3
| | | | | | | | | We need SBINDIR to be compatible with the usrmerge distro feature. The update to version 2.8 (commit c55c0aca...) removed the definition, perhaps because the "${D}/" prefix broke the build. Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* libselinux: fix build with glibc 2.30Yi Zhao2019-08-282-0/+61
| | | | | | | | | | | | | | | | | Fix build error: procattr.c:27:14: error: static declaration of 'gettid' follows non-static declaration 27 | static pid_t gettid(void) | ^~~~~~ In file included from /buildarea/build/tmp/work/core2-64-poky-linux/libselinux/2.8-r0/recipe-sysroot/usr/include/unistd.h:1170, from procattr.c:2: /buildarea/build/tmp/work/core2-64-poky-linux/libselinux/2.8-r0/recipe-sysroot/usr/include/bits/unistd_ext.h:34:16: note: previous declaration of 'gettid' was here 34 | extern __pid_t gettid (void) __THROW; | ^~~~~~ Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* audit: use git fetcher instead of the tarball sourceMingli Yu2019-07-081-3/+4
| | | | | | | | | | | Per http://people.redhat.com/sgrubb/audit/, the tarball source moves to https://github.com/linux-audit/audit-userspace, and since commit [21f84fc insane: add sanity checks to SRC_URI] applied in oe-core, do not use unstable github archive tarballs, so use git instead. Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* audit: upgrade 2.8.4 -> 2.8.5Yi Zhao2019-07-087-84/+35
| | | | | | | | | | * Drop backport patch: 0001-Remove-strdupa-as-suggested-in-pull-request-25.patch * Refresh all patches. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* setools: do not use unstable github archive tarballsHongxu Jia2019-06-061-3/+3
| | | | | | | | Since commit [21f84fc insane: add sanity checks to SRC_URI] applied in oe-core, do not use unstable github archive tarballs Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy: update source checksums for refpolicy 20190201Yi Zhao2019-04-231-2/+2
| | | | | | | | The previous md5sum and sha256sum are not correct. See: https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20190201 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libselinux.inc: Add python-shell to libselinux-python RDEPENDS.master-nextChris PeBenito2019-04-151-1/+1
| | | | | | | The libselinux SWIG wrapper imports shutil. Signed-off-by: Chris PeBenito <Christopher.PeBenito@microsoft.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* audit: change to use ${WORKDIR} instead ${S}/../Chen Qi2019-04-151-1/+1
| | | | | | | | | | The do_install function is assuming that ${S}/../ is ${WORKDIR}, but this is not true when using `devtool modify audit'. So change to use ${WORKDIR}. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* setools: fix build failure with gcc 7Kai Kang2019-04-141-16/+74
| | | | | | | | | | | | Backport patch from setools upstream to fix build failure with GCC 7 due to possible truncation of snprintf output. It could be reproduced on 64 bit bsps such as qemux86-64 and qemumips64 with configs: SELECTED_OPTIMIZATION = "${DEBUG_OPTIMIZATION}" DEBUG_BUILD = "1" Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* selinux: remove git versionYi Zhao2019-04-146-62/+0
| | | | | | | | | | The git version of libselinux libsemanage libsepol checkpolicy and policycoreutils are far behind the master branch and now they can not build due to the do_patch error. The current stable 2.8 version works well so we can remove them. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* packagegroup-selinux-minimal: add selinux-initLuca Boccassi2019-04-141-0/+1
| | | | | | | | | | | | | | | | | | | | | | | When trying to build a minimal image (eg: without python), the default user on autologin is not mapped to the intended user/role/domain: # id -Z system_u:system_r:kernel_t:s0 And the following error is displayed on autologin: Unable to get valid context for <user> While on an image built with the core-selinux packagegroup: # id -Z unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 Adding selinux-init to the minimal package list fixes the issue. This package does not seem to bring along additional dependencies. Signed-off-by: Luca Boccassi <bluca@debian.org> Signed-off-by: Joe MacDonald <joe@deserted.net>
* core-image-selinux.bb: remove trailing whitespaceYi Zhao2019-04-141-1/+1
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: update to 2.20190201 and git HEAD policiesJoe MacDonald2019-04-12155-3734/+3143
| | | | | | | Additionally, the README has fallen out of date, update it to reflect the current reality of layer dependencies. Signed-off-by: Joe MacDonald <joe@deserted.net>
* Backport patches from upstream to fix build with muslLuca Boccassi2019-03-253-0/+183
| | | | | | | | | Audit 2.8.4 fails to build with musl. The fixes have been committed to the upstream master branch and can be backported. Building with glibc is unaffected. Signed-off-by: Luca Boccassi <luca.boccassi@microsoft.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: fix up all refpolicy 20170224 builds for current masterJoe MacDonald2018-10-304-32/+51
| | | | Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy_git.inc: lock SRCREVs on the actual version hashesAwais Belal2018-10-231-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | Using AUTOREV in the main repository has its downsides. 1. The checked out version isn't actually the version depicted by PV. 2. Breaks builds in scenarios where network isn't available or BB_NO_NETWORK is used even after sources are already fetched. 1 is self explanatory, for 2 whenever SRCREV is set to AUTOREV and SRCPV is used in PV the fetcher tries to access the network in order to determine SRCPV (bb.fetch2.get_srcrev) and fails for obvious reasons during parsing even when versioned recipes are used as PREFERRED_VERSION because parsing still happens for recipes that are in BB's search paths and we see. Traceback (most recent call last): bb.data_smart.ExpansionError: Failure expanding variable SRCPV, expression was ${@bb.fetch2.get_srcrev(d)} which triggered exception NetworkAccess: Network access disabled through BB_NO_NETWORK (or set indirectly due to use of BB_FETCH_PREMIRRORONLY) but access requested with command git -c core.fsyncobjectfiles=0 ls-remote git://github.com/TresysTechnology/refpolicy.git (for url git://github.com/TresysTechnology/refpolicy.git) So we lock the REVs and do that with a soft assignment which allows overriding the REVs from elsewhere. Signed-off-by: Awais Belal <awais_belal@mentor.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libselinux: Fix build with musl libc.Piotr Tworek2018-10-231-0/+2
| | | | | | | | | | Musl libc does not implement file traversal functions from fts.h. Oe-core provides fts library which implements those. Libselinux makefile allows us to use such additional library by specifying required linker flags via FTS_LDLIBS variable. Signed-off-by: Piotr Tworek <tworaz666@gmail.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* setools: Add missing python runtime deps.Piotr Tworek2018-10-231-1/+2
| | | | | | | | | | The package needs logging, json and argparse modules to start. Additionaly, it also needs libselinux-python in order to really work. Without it it'll just print an error message instructing the user to install it. Signed-off-by: Piotr Tworek <tworaz666@gmail.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* policycorutils: package files in base_sbindir.Eric Chanudet2018-09-091-7/+6
| | | | | | | | | | | SBINDIR was changed to ${base_sbindir} in commit: 8cc9c17 policycoreutils: fix installed-but-not-shipped on updated recipes FILES_${PN}-* must now capture files installed in ${base_sbindir} accordingly. Signed-off-by: Eric Chanudet <chanudete@ainfosec.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* policycoreutils: fix installed-but-not-shipped on updated recipesJoe MacDonald2018-09-073-60/+1
| | | | Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* audit: uprev to 2.8.4Yi Zhao2018-09-071-9/+10
| | | | | | | Add aarch64 support Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* packagegroup-selinux-policycoreutils: remove semodule-utils-semodule-depsYi Zhao2018-09-071-1/+0
| | | | | | | | Remove package semodule-utils-semodule-deps as it had been removed upstream. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-gui: uprev to 2.8 (20180524)Yi Zhao2018-09-072-7/+7
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-dbus: uprev to 2.8 (20180524)Yi Zhao2018-09-072-7/+7
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* semodule-utils: uprev to 2.8 (20180524)Yi Zhao2018-09-073-9/+7
| | | | | | | Remove package semodule-deps as it had been removed upstream. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-python: uprev to 2.8 (20180524)Yi Zhao2018-09-074-18/+21
| | | | | | | | Rebase patch: fix-sepolicy-install-path.patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-sandbox: uprev to 2.8 (20180524)Yi Zhao2018-09-072-7/+7
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* restorecond: uprev to 2.8 (20180524)Yi Zhao2018-09-073-11/+7
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* mcstrans: uprev to 2.8 (20180524)Yi Zhao2018-09-073-8/+7
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* policycoreutils: uprev to 2.8 (20180524)Yi Zhao2018-09-076-31/+70
| | | | | | | | | | | | | Remove unused patch: policycoreutils-loadpolicy-symlink.patch Add the following patches to change commands path for backward compatibility: policycoreutils-fix-fixfiles-install-path.patch policycoreutils-fix-fixfiles-install-path.patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* secilc: uprev to 2.8 (20180524)Yi Zhao2018-09-072-7/+7
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* checkpolicy: uprev to 2.8 (20180524)Yi Zhao2018-09-073-8/+7
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* libsemanage: uprev to 2.8 (20180524)Yi Zhao2018-09-073-22/+16
| | | | | | | | Rebase patch: 0001-src-Makefile-fix-includedir-in-libselinux.pc.patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* libselinux: uprev to 2.8 (20180524)Yi Zhao2018-09-073-13/+15
| | | | | | | | Rebase patch: 0001-src-Makefile-fix-includedir-in-libselinux.pc.patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* libsepol: uprev to 2.8 (20180524)Yi Zhao2018-09-073-15/+16
| | | | | | | | Rebase patch: 0001-src-Makefile-fix-includedir-in-libsepol.pc.patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux: uprev inc files to 2.8 (20180524)Yi Zhao2018-09-072-5/+6
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* libselinux: fix usrmerge do_installMingli Yu2018-09-071-1/+3
| | | | | | | | | | When usrmerge enabled in DISTRO_FEATURES, the binary actually installed under ${base_sbindir}, so cannot remove ${D}${base_sbindir} when usrmerge enabled. Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-24 02:21:37 +0000