summaryrefslogtreecommitdiffstats
path: root/recipes-security
Commit message (Collapse)AuthorAgeFilesLines
* audit: fix host contamination for swigYi Zhao2019-12-302-0/+58
| | | | | | | | | | | | | | The audit build uses swig to generate a python wrapper. But there is a hardcoded include directory in auditswig.i, which causes header files on the host to be used when building. This will cause build error on some old systems. e.g. on CentOS7 with buildtools: audit_wrap.c: In function '_wrap_audit_rule_flags_set': audit_wrap.c:5018:19: error: dereferencing pointer to incomplete type 'struct audit_rule' 5018 if (arg1) (arg1)->flags = arg2; ^~ Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-initsh.inc: install selinux-init.sh and selinux-labeldev.sh when ↵Yi Zhao2019-12-302-5/+7
| | | | | | | | | | | | | | using systemd The commit 5fd3c5b71edb99659aeb5cb5903088d84517382e introduced an issue that selinux-init.sh and selinux-labeldev.sh are not installed when using systemd which will cause the selinux-ini.service and selinux-labeldev.service fail to startup. Move the do_install codes from selinux-autorelabel to selinux-initsh.inc to make sure install these scripts when using systemd. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy: switch to python3Yi Zhao2019-12-241-3/+3
| | | | | | | | * Switch to python3 * Update policy-version to 31 to match selinux 2.9 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy: add UPSTREAM_CHECK_GITTAGREGEXYi Zhao2019-12-242-0/+4
| | | | | | | | Add UPSTREAM_CHECK_GITTAGREGEX to make devtool check-upgrade-status works. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* libsemanage: fix race issue in parallel buildYi Zhao2019-12-241-1/+1
| | | | | | | | | | | | | | | | | | | | | | | The install-pywarp target doesn't depend on swigify target because the semanage.py is not generated by swigify target but pywrap target. Here is the dependency chain: install-pywrap -> pywrap -> $(SWIGSO) -> $(SWIGLOBJ) -> $(SWIGCOUT) -> semanage.py But in the recipe, the swigify target is added explicitly in do_install: do_install_append() { oe_runmake install-pywrap swigify \ [snip] } This target will regenerate the semanage.py when do_install. So there will be a potential race issue in parallel build. The install-pywrap target is trying to install semanage.py when swigify target is generating the file. Then an empty semanage.py will be installed. Remove the target swigify to fix this issue. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* libselinux-python: fix race issue in parallel buildYi Zhao2019-12-241-1/+1
| | | | | | | | | | | | | | | | | | | | | | | The install-pywarp target doesn't depend on swigify target because the selinux.py is not generated by swigify target but pywrap target. Here is the dependency chain: install-pywrap -> pywrap -> $(SWIGFILES) -> $(SWIGPYOUT) -> $(SWIGCOUT) -> selinux.py But in the recipe, the swigify target is added explicitly in do_install: do_install_append() { oe_runmake install-pywrap swigify \ [snip] } This target will regenerate the selinux.py when do_install. So there will be a potential race issue in parallel build. The install-pywrap target is trying to install selinux.py when swigify target is generating the file. Then an empty selinux.py will be installed. Remove the target swigify to fix this issue. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* audit: switch to python3Yi Zhao2019-12-194-173/+4
| | | | | | | | | | | | * Switch to python3 * Drop patches: audit-python-configure.patch audit-python.patch fix-swig-host-contamination.patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* setools: upgrade 4.1.1 -> 4.2.2Yi Zhao2019-12-194-169/+19
| | | | | | | | | | | * Switch to python3 * Drop patches: Fix-build-failure-with-GCC-7-due-to-possible-truncat.patch setools4-fix-cross-compiling-errors-for-powerpc-mips.patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* semodule-utils: uprev to 2.9 (20190315)Yi Zhao2019-12-192-7/+7
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-gui: uprev to 2.9 (20190315)Yi Zhao2019-12-193-8/+8
| | | | | | | * Switch to python3 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-sandbox: uprev to 2.9 (20190315)Yi Zhao2019-12-194-17/+16
| | | | | | | | * Switch to python3 * Rebase patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-dbus: uprev to 2.9 (20190315)Yi Zhao2019-12-193-8/+8
| | | | | | | * Switch to python3 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-python: uprev to 2.9 (20190315)Yi Zhao2019-12-196-121/+40
| | | | | | | | | | | | | * Switch to python3 * Drop patches: fix-TypeError-for-seobject.py.patch process-ValueError-for-sepolicy-seobject.patch * Rebase patches Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* restorecond: uprev to 2.9 (20190315)Yi Zhao2019-12-193-19/+24
| | | | | | | * Rebase patches Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* mcstrans: uprev to 2.9 (20190315)Yi Zhao2019-12-195-23/+32
| | | | | | | * Rebase patches Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* policycoreutils: uprev to 2.9 (20190315)Yi Zhao2019-12-193-20/+12
| | | | | | | * Switch to python3 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* secilc: uprev to 2.9 (20190315)Yi Zhao2019-12-192-7/+7
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* checkpolicy: uprev to 2.9 (20190315)Yi Zhao2019-12-192-7/+7
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* libsemanage: uprev to 2.9 (20190315)Yi Zhao2019-12-1910-128/+70
| | | | | | | | | | | | | | | * Switch to python3 * Drop patches: libsemanage-fix-path-nologin.patch 0001-src-Makefile-fix-includedir-in-libselinux.pc.patch * Rebase patches * Update policy version to 31 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* libselinux-python: add recipeYi Zhao2019-12-192-0/+58
| | | | | | | | | After switch to python3, There is a loop dependency error with libselinux-python package when build libselinux. Split the original libselinux recipe into libselinux and libselinux-python. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* libselinux: uprev to 2.9 (20190315)Yi Zhao2019-12-194-116/+6
| | | | | | | | | | | | | | * Switch to python3 * Drop patches: 0001-libselinux-Do-not-define-gettid-if-glibc-2.30-is-use.patch 0001-src-Makefile-fix-includedir-in-libselinux.pc.patch * Split into libselinux recipe and libselinux-python recipe to fix the loop dependency error. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* libsepol: uprev to 2.9 (20190315)Yi Zhao2019-12-193-38/+7
| | | | | | | * Drop patch 0001-src-Makefile-fix-includedir-in-libsepol.pc.patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux: uprev inc files to 2.9 (20190315)Yi Zhao2019-12-193-8/+9
| | | | | | | | * Update SRC_URI * Add UPSTREAM_CHECK_URI and UPSTREAM_CHECK_REGEX Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* support policy module configuration at recipe levelJoe MacDonald2019-12-093-0/+31
| | | | | | | | | On highly storage-limited machines it may be beneficial to completely remove some or all non-essential policy modules. refpolicy already supports this with the 'no' option in modules.conf, so we'll just expose this feature (with an appropriate warning) at the recipe-level. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* autorelabel: only selinux-autorelabel need autorelabel fileChristophe PRIOUZEAU2019-12-092-7/+9
| | | | | | | | | | With previous implementation, several packages provided .autorelabel file while only selinux-autorelabel manage it. If there is several packages which try to install .autorelabel file, an issue occur during installation of packagegroup-core-selinux. Signed-off-by: Christophe Priouzeau <christophe.priouzeau@st.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* audit: explicitly disable golang bindingsYi Zhao2019-09-171-0/+1
| | | | | | | | Disable golang bindings to avoid potential host contamination issue. Fixes: https://bugzilla.yoctoproject.org/show_bug.cgi?id=13166 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-autorelabel: disable enforcing mode before relabelYi Zhao2019-09-091-3/+6
| | | | | | | | | | | The commit b0d31db104d9a4e94bc1409c2ffcc1d82f4a780f introduced an issue when first boot with bootparams="selinux=1 enforcing=1". At first boot, all files are unlabeled including /sbin/setfiles. The relabel operations are not permitted under enforcing mode. So we need to disable enforcing mode before relabel. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* setools: update SRC_URIYi Zhao2019-08-291-1/+1
| | | | | | | | | SETools has moved from https://github.com/TresysTechnology/setools to https://github.com/SELinuxProject/setools See: https://github.com/TresysTechnology/setools/wiki Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* mcstrans: specify INITDIRYi Zhao2019-08-291-1/+1
| | | | | | | | | By default the mcstrans init script will be installed to /etc/rc.d/init.d directory. Specify INITDIR to install it to /etc/init.d directory. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-python: Fix dependency for ntpathLorenz Kofler2019-08-281-0/+1
| | | | | | | | | On yocto warrior the semanage tool didn't work correctly, because it couldn't find ntpath module. It turned out that this module is now part of the package python-misc, therefore add dependency to python-misc. Signed-off-by: Lorenz Kofler <lorenz@sigma-star.at> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-init: use systemd (re)labellingMark Asselstine2019-08-284-16/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | Boot loops were being seen when booting with selinux enabled, when the init system in use is systemd. Once logs were retrieved from the failing system the error was found to be selinux-init.sh[284]: /sbin/restorecon: Could not set context for /sys/fs/cgroup/cpuacct: Read-only file system selinux-init.sh[284]: /sbin/restorecon: Could not set context for /sys/fs/cgroup/cpu: Read-only file system Systemd mounts /sys/fs/cgroup read-only and the (re)labelling code used by selinux-init.sh is unable to handle this. On top of this the system is basically presenting two methods of (re)labelling; using the built in systemd approach via selinux-autorelabel.service *and* the code we have in selinux-init.sh. This can get confusing especially given that most online resources will speak to the systemd approach using selinux-autorelabel.service and /.autorelabel. These changes leave the current approach in place when sysvinit is the init system used, but if systemd is being used we make use of it's internal (re)labelling functionality. Overall the workflow remains the same but we now avoid boot loops (systemd remounts /sys/fs/cgroup rw during the (re)labelling procedure). Signed-off-by: Mark Asselstine <mark.asselstine@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-sandbox: add runtime dependency on python-coreYi Zhao2019-08-281-0/+1
| | | | | | | | | Fixes: ERROR: QA Issue: /usr/share/sandbox/start contained in package selinux-sandbox requires /usr/bin/python, but no providers found in RDEPENDS_selinux-sandbox? [file-rdeps] Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-python: add python-core as runtime dependencyYi Zhao2019-08-281-0/+3
| | | | | | | | | | | | | Fix QA issues: QA Issue: /usr/lib64/python2.7/site-packages/seobject.py contained in package selinux-python requires /usr/bin/python, but no providers found in RDEPENDS_selinux-python? [file-rdeps] QA Issue: /usr/bin/audit2allow contained in package selinux-python-audit2allow requires /usr/bin/python, but no providers found in RDEPENDS_selinux-python-audit2allow? [file-rdeps] QA Issue: /usr/bin/chcat contained in package selinux-python-chcat requires /usr/bin/python, but no providers found in RDEPENDS_selinux-python-chcat? [file-rdeps] Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* mcstrans: specify SBINDIRJoe Slater2019-08-281-0/+3
| | | | | | | | | We need SBINDIR to be compatible with the usrmerge distro feature. The update to version 2.8 (commit c55c0aca...) removed the definition, perhaps because the "${D}/" prefix broke the build. Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* libselinux: fix build with glibc 2.30Yi Zhao2019-08-282-0/+61
| | | | | | | | | | | | | | | | | Fix build error: procattr.c:27:14: error: static declaration of 'gettid' follows non-static declaration 27 | static pid_t gettid(void) | ^~~~~~ In file included from /buildarea/build/tmp/work/core2-64-poky-linux/libselinux/2.8-r0/recipe-sysroot/usr/include/unistd.h:1170, from procattr.c:2: /buildarea/build/tmp/work/core2-64-poky-linux/libselinux/2.8-r0/recipe-sysroot/usr/include/bits/unistd_ext.h:34:16: note: previous declaration of 'gettid' was here 34 | extern __pid_t gettid (void) __THROW; | ^~~~~~ Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* audit: use git fetcher instead of the tarball sourceMingli Yu2019-07-081-3/+4
| | | | | | | | | | | Per http://people.redhat.com/sgrubb/audit/, the tarball source moves to https://github.com/linux-audit/audit-userspace, and since commit [21f84fc insane: add sanity checks to SRC_URI] applied in oe-core, do not use unstable github archive tarballs, so use git instead. Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* audit: upgrade 2.8.4 -> 2.8.5Yi Zhao2019-07-087-84/+35
| | | | | | | | | | * Drop backport patch: 0001-Remove-strdupa-as-suggested-in-pull-request-25.patch * Refresh all patches. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* setools: do not use unstable github archive tarballsHongxu Jia2019-06-061-3/+3
| | | | | | | | Since commit [21f84fc insane: add sanity checks to SRC_URI] applied in oe-core, do not use unstable github archive tarballs Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy: update source checksums for refpolicy 20190201Yi Zhao2019-04-231-2/+2
| | | | | | | | The previous md5sum and sha256sum are not correct. See: https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20190201 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libselinux.inc: Add python-shell to libselinux-python RDEPENDS.master-nextChris PeBenito2019-04-151-1/+1
| | | | | | | The libselinux SWIG wrapper imports shutil. Signed-off-by: Chris PeBenito <Christopher.PeBenito@microsoft.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* audit: change to use ${WORKDIR} instead ${S}/../Chen Qi2019-04-151-1/+1
| | | | | | | | | | The do_install function is assuming that ${S}/../ is ${WORKDIR}, but this is not true when using `devtool modify audit'. So change to use ${WORKDIR}. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* setools: fix build failure with gcc 7Kai Kang2019-04-141-16/+74
| | | | | | | | | | | | Backport patch from setools upstream to fix build failure with GCC 7 due to possible truncation of snprintf output. It could be reproduced on 64 bit bsps such as qemux86-64 and qemumips64 with configs: SELECTED_OPTIMIZATION = "${DEBUG_OPTIMIZATION}" DEBUG_BUILD = "1" Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* selinux: remove git versionYi Zhao2019-04-146-62/+0
| | | | | | | | | | The git version of libselinux libsemanage libsepol checkpolicy and policycoreutils are far behind the master branch and now they can not build due to the do_patch error. The current stable 2.8 version works well so we can remove them. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* packagegroup-selinux-minimal: add selinux-initLuca Boccassi2019-04-141-0/+1
| | | | | | | | | | | | | | | | | | | | | | | When trying to build a minimal image (eg: without python), the default user on autologin is not mapped to the intended user/role/domain: # id -Z system_u:system_r:kernel_t:s0 And the following error is displayed on autologin: Unable to get valid context for <user> While on an image built with the core-selinux packagegroup: # id -Z unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 Adding selinux-init to the minimal package list fixes the issue. This package does not seem to bring along additional dependencies. Signed-off-by: Luca Boccassi <bluca@debian.org> Signed-off-by: Joe MacDonald <joe@deserted.net>
* core-image-selinux.bb: remove trailing whitespaceYi Zhao2019-04-141-1/+1
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: update to 2.20190201 and git HEAD policiesJoe MacDonald2019-04-12155-3734/+3143
| | | | | | | Additionally, the README has fallen out of date, update it to reflect the current reality of layer dependencies. Signed-off-by: Joe MacDonald <joe@deserted.net>
* Backport patches from upstream to fix build with muslLuca Boccassi2019-03-253-0/+183
| | | | | | | | | Audit 2.8.4 fails to build with musl. The fixes have been committed to the upstream master branch and can be backported. Building with glibc is unaffected. Signed-off-by: Luca Boccassi <luca.boccassi@microsoft.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: fix up all refpolicy 20170224 builds for current masterJoe MacDonald2018-10-304-32/+51
| | | | Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy_git.inc: lock SRCREVs on the actual version hashesAwais Belal2018-10-231-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | Using AUTOREV in the main repository has its downsides. 1. The checked out version isn't actually the version depicted by PV. 2. Breaks builds in scenarios where network isn't available or BB_NO_NETWORK is used even after sources are already fetched. 1 is self explanatory, for 2 whenever SRCREV is set to AUTOREV and SRCPV is used in PV the fetcher tries to access the network in order to determine SRCPV (bb.fetch2.get_srcrev) and fails for obvious reasons during parsing even when versioned recipes are used as PREFERRED_VERSION because parsing still happens for recipes that are in BB's search paths and we see. Traceback (most recent call last): bb.data_smart.ExpansionError: Failure expanding variable SRCPV, expression was ${@bb.fetch2.get_srcrev(d)} which triggered exception NetworkAccess: Network access disabled through BB_NO_NETWORK (or set indirectly due to use of BB_FETCH_PREMIRRORONLY) but access requested with command git -c core.fsyncobjectfiles=0 ls-remote git://github.com/TresysTechnology/refpolicy.git (for url git://github.com/TresysTechnology/refpolicy.git) So we lock the REVs and do that with a soft assignment which allows overriding the REVs from elsewhere. Signed-off-by: Awais Belal <awais_belal@mentor.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libselinux: Fix build with musl libc.Piotr Tworek2018-10-231-0/+2
| | | | | | | | | | Musl libc does not implement file traversal functions from fts.h. Oe-core provides fts library which implements those. Libselinux makefile allows us to use such additional library by specifying required linker flags via FTS_LDLIBS variable. Signed-off-by: Piotr Tworek <tworaz666@gmail.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-04 06:31:58 +0000