summaryrefslogtreecommitdiffstats
path: root/recipes-security
Commit message (Collapse)AuthorAgeFilesLines
* refpolicy: remove version 2.20190201Yi Zhao2020-07-1450-2523/+0
| | | | | | | | There is no need to maintain two versions of repolicy. Drop this version and only keep the git version. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* checkpolicy: remove unused te_assertionsMingli Yu2020-07-132-0/+49
| | | | | | | | | | | | | Backport a patch to remove unused te_assertions to fix the build failure on fedora 32. Fixes: | /build/tmp-glibc/hosttools/ld: policy_define.o:(.bss+0x28): multiple definition of `te_assertions'/build/tmp-glibc/hosttools/ld: policy_define.o:(.bss+0x28): multiple definition of `te_assertions'; y.tab.o:(.bss+0x18): first defined here | collect2: error: ld returned 1 exit status | make: *** [Makefile:33: checkpolicy] Error 1 Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libsepol: fix build errors on Fedora 32Yi Zhao2020-06-153-0/+600
| | | | | | | | | | | | | | | Backport 2 patches to fix the build errors on Fedora 32. Fixes: [snip] ../cil/src/cil_verify.lo:(.bss+0x4f0): multiple definition of `CIL_KEY_CONS_T3'; ../cil/src/cil_verify.lo:(.bss+0x4f8): multiple definition of `CIL_KEY_CONS_T2'; ../cil/src/cil_verify.lo:(.bss+0x500): multiple definition of `CIL_KEY_CONS_T1'; ../cil/src/cil_verify.lo:(.bss+0x508): multiple definition of `cil_mem_error_handler'; [snip] Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libselinux-python: Fix one invalid linkChangqing Li2020-04-302-0/+53
| | | | | | | | | when host arch and target arch are different, the extension suffix of host is different with target one, so there will be a invalid link. Fix by update the way to create the link. Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* semodule-utils: upgrade to 3.0 (20191204)Yi Zhao2020-04-152-7/+7
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-gui: upgrade to 3.0 (20191204)Yi Zhao2020-04-152-7/+7
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-sandbox: upgrade to 3.0 (20191204)Yi Zhao2020-04-152-7/+7
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-dbus: upgrade to 3.0 (20191204)Yi Zhao2020-04-152-7/+7
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-python: upgrade to 3.0 (20191204)Yi Zhao2020-04-154-25/+15
| | | | | | | Refresh fix-sepolicy-install-path.patch. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* restorecond: upgrade to 3.0 (20191204)Yi Zhao2020-04-153-8/+8
| | | | | | | Fix typo in patch. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* mcstrans: upgrade to 3.0 (20191204)Yi Zhao2020-04-152-7/+7
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* policycoreutils: upgrade to 3.0 (20191204)Yi Zhao2020-04-152-8/+7
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* secilc: upgrade to 3.0 (20191204)Yi Zhao2020-04-152-7/+7
| | | | | | | License-Update: fix misspellings Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* checkpolicy: upgrade to 3.0 (20191204)Yi Zhao2020-04-152-7/+7
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* libsemanage: upgrade to 3.0 (20191204)Yi Zhao2020-04-155-13/+13
| | | | | | | | * Refresh libsemanage-allow-to-disable-audit-support.patch * Fix typos in patches. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* libselinux-python: upgrade to 3.0 (20191204)Yi Zhao2020-04-153-7/+38
| | | | | | | | | * Inherit python3native as the libselinux uses python distutils to install selinux python bindings now. * Add a patch to fix python modules install path for multilib. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* libselinux: upgrade to 3.0 (20191204)Yi Zhao2020-04-156-7/+46
| | | | | | | | * Backport a patch to fix build failure with musl. * Fix typos in patches. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* libsepol: upgrade to 3.0 (20191204)Yi Zhao2020-04-152-7/+7
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux: upgrade inc files to 3.0 (20191204)Yi Zhao2020-04-151-1/+1
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* setools: upgrade 4.2.2 -> 4.3.0Yi Zhao2020-04-151-3/+5
| | | | | | | Remove __pycache__ directories when do_install. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* clean up getVar() usageJoe MacDonald2020-04-033-3/+3
| | | | | | | | | | | 83eac4de updated the usage of getVar() in classes/selinux.bbclass to leave out the default expand parameter. This is consistent with the usage in the core layers. Bring all other calls to getVar() in the layer into alignment with this approach. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* audit: add clock_settime64 syscallMingli Yu2020-02-192-0/+43
| | | | | | | | | | | | | | | | | | | | | | | On 32bit system, After upgrade glibc to 2.31 # strace -o /tmp/test.log date -s 09:16:45 # tail -f /tmp/test.log close(3) = 0 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=114, ...}) = 0 clock_settime64(CLOCK_REALTIME, {tv_sec=1582103805, tv_nsec=0}) = 0 fstat64(1, {st_mode=S_IFCHR|0600, st_rdev=makedev(0x4, 0x40), ...}) = 0 ioctl(1, TCGETS, {B115200 opost isig icanon echo ...}) = 0 write(1, "Wed Feb 19 09:16:45 UTC 2020\n", 29) = 29 close(1) = 0 close(2) = 0 exit_group(0) = ? +++ exited with 0 +++ It means the clock_settime64 syscall is used, so add the syscall. Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* audit: fix host contamination for swigYi Zhao2019-12-302-0/+58
| | | | | | | | | | | | | | The audit build uses swig to generate a python wrapper. But there is a hardcoded include directory in auditswig.i, which causes header files on the host to be used when building. This will cause build error on some old systems. e.g. on CentOS7 with buildtools: audit_wrap.c: In function '_wrap_audit_rule_flags_set': audit_wrap.c:5018:19: error: dereferencing pointer to incomplete type 'struct audit_rule' 5018 if (arg1) (arg1)->flags = arg2; ^~ Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-initsh.inc: install selinux-init.sh and selinux-labeldev.sh when ↵Yi Zhao2019-12-302-5/+7
| | | | | | | | | | | | | | using systemd The commit 5fd3c5b71edb99659aeb5cb5903088d84517382e introduced an issue that selinux-init.sh and selinux-labeldev.sh are not installed when using systemd which will cause the selinux-ini.service and selinux-labeldev.service fail to startup. Move the do_install codes from selinux-autorelabel to selinux-initsh.inc to make sure install these scripts when using systemd. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy: switch to python3Yi Zhao2019-12-241-3/+3
| | | | | | | | * Switch to python3 * Update policy-version to 31 to match selinux 2.9 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy: add UPSTREAM_CHECK_GITTAGREGEXYi Zhao2019-12-242-0/+4
| | | | | | | | Add UPSTREAM_CHECK_GITTAGREGEX to make devtool check-upgrade-status works. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* libsemanage: fix race issue in parallel buildYi Zhao2019-12-241-1/+1
| | | | | | | | | | | | | | | | | | | | | | | The install-pywarp target doesn't depend on swigify target because the semanage.py is not generated by swigify target but pywrap target. Here is the dependency chain: install-pywrap -> pywrap -> $(SWIGSO) -> $(SWIGLOBJ) -> $(SWIGCOUT) -> semanage.py But in the recipe, the swigify target is added explicitly in do_install: do_install_append() { oe_runmake install-pywrap swigify \ [snip] } This target will regenerate the semanage.py when do_install. So there will be a potential race issue in parallel build. The install-pywrap target is trying to install semanage.py when swigify target is generating the file. Then an empty semanage.py will be installed. Remove the target swigify to fix this issue. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* libselinux-python: fix race issue in parallel buildYi Zhao2019-12-241-1/+1
| | | | | | | | | | | | | | | | | | | | | | | The install-pywarp target doesn't depend on swigify target because the selinux.py is not generated by swigify target but pywrap target. Here is the dependency chain: install-pywrap -> pywrap -> $(SWIGFILES) -> $(SWIGPYOUT) -> $(SWIGCOUT) -> selinux.py But in the recipe, the swigify target is added explicitly in do_install: do_install_append() { oe_runmake install-pywrap swigify \ [snip] } This target will regenerate the selinux.py when do_install. So there will be a potential race issue in parallel build. The install-pywrap target is trying to install selinux.py when swigify target is generating the file. Then an empty selinux.py will be installed. Remove the target swigify to fix this issue. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* audit: switch to python3Yi Zhao2019-12-194-173/+4
| | | | | | | | | | | | * Switch to python3 * Drop patches: audit-python-configure.patch audit-python.patch fix-swig-host-contamination.patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* setools: upgrade 4.1.1 -> 4.2.2Yi Zhao2019-12-194-169/+19
| | | | | | | | | | | * Switch to python3 * Drop patches: Fix-build-failure-with-GCC-7-due-to-possible-truncat.patch setools4-fix-cross-compiling-errors-for-powerpc-mips.patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* semodule-utils: uprev to 2.9 (20190315)Yi Zhao2019-12-192-7/+7
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-gui: uprev to 2.9 (20190315)Yi Zhao2019-12-193-8/+8
| | | | | | | * Switch to python3 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-sandbox: uprev to 2.9 (20190315)Yi Zhao2019-12-194-17/+16
| | | | | | | | * Switch to python3 * Rebase patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-dbus: uprev to 2.9 (20190315)Yi Zhao2019-12-193-8/+8
| | | | | | | * Switch to python3 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-python: uprev to 2.9 (20190315)Yi Zhao2019-12-196-121/+40
| | | | | | | | | | | | | * Switch to python3 * Drop patches: fix-TypeError-for-seobject.py.patch process-ValueError-for-sepolicy-seobject.patch * Rebase patches Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* restorecond: uprev to 2.9 (20190315)Yi Zhao2019-12-193-19/+24
| | | | | | | * Rebase patches Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* mcstrans: uprev to 2.9 (20190315)Yi Zhao2019-12-195-23/+32
| | | | | | | * Rebase patches Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* policycoreutils: uprev to 2.9 (20190315)Yi Zhao2019-12-193-20/+12
| | | | | | | * Switch to python3 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* secilc: uprev to 2.9 (20190315)Yi Zhao2019-12-192-7/+7
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* checkpolicy: uprev to 2.9 (20190315)Yi Zhao2019-12-192-7/+7
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* libsemanage: uprev to 2.9 (20190315)Yi Zhao2019-12-1910-128/+70
| | | | | | | | | | | | | | | * Switch to python3 * Drop patches: libsemanage-fix-path-nologin.patch 0001-src-Makefile-fix-includedir-in-libselinux.pc.patch * Rebase patches * Update policy version to 31 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* libselinux-python: add recipeYi Zhao2019-12-192-0/+58
| | | | | | | | | After switch to python3, There is a loop dependency error with libselinux-python package when build libselinux. Split the original libselinux recipe into libselinux and libselinux-python. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* libselinux: uprev to 2.9 (20190315)Yi Zhao2019-12-194-116/+6
| | | | | | | | | | | | | | * Switch to python3 * Drop patches: 0001-libselinux-Do-not-define-gettid-if-glibc-2.30-is-use.patch 0001-src-Makefile-fix-includedir-in-libselinux.pc.patch * Split into libselinux recipe and libselinux-python recipe to fix the loop dependency error. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* libsepol: uprev to 2.9 (20190315)Yi Zhao2019-12-193-38/+7
| | | | | | | * Drop patch 0001-src-Makefile-fix-includedir-in-libsepol.pc.patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux: uprev inc files to 2.9 (20190315)Yi Zhao2019-12-193-8/+9
| | | | | | | | * Update SRC_URI * Add UPSTREAM_CHECK_URI and UPSTREAM_CHECK_REGEX Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* support policy module configuration at recipe levelJoe MacDonald2019-12-093-0/+31
| | | | | | | | | On highly storage-limited machines it may be beneficial to completely remove some or all non-essential policy modules. refpolicy already supports this with the 'no' option in modules.conf, so we'll just expose this feature (with an appropriate warning) at the recipe-level. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* autorelabel: only selinux-autorelabel need autorelabel fileChristophe PRIOUZEAU2019-12-092-7/+9
| | | | | | | | | | With previous implementation, several packages provided .autorelabel file while only selinux-autorelabel manage it. If there is several packages which try to install .autorelabel file, an issue occur during installation of packagegroup-core-selinux. Signed-off-by: Christophe Priouzeau <christophe.priouzeau@st.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* audit: explicitly disable golang bindingsYi Zhao2019-09-171-0/+1
| | | | | | | | Disable golang bindings to avoid potential host contamination issue. Fixes: https://bugzilla.yoctoproject.org/show_bug.cgi?id=13166 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-autorelabel: disable enforcing mode before relabelYi Zhao2019-09-091-3/+6
| | | | | | | | | | | The commit b0d31db104d9a4e94bc1409c2ffcc1d82f4a780f introduced an issue when first boot with bootparams="selinux=1 enforcing=1". At first boot, all files are unlabeled including /sbin/setfiles. The relabel operations are not permitted under enforcing mode. So we need to disable enforcing mode before relabel. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* setools: update SRC_URIYi Zhao2019-08-291-1/+1
| | | | | | | | | SETools has moved from https://github.com/TresysTechnology/setools to https://github.com/SELinuxProject/setools See: https://github.com/TresysTechnology/setools/wiki Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-07 05:48:45 +0000