summaryrefslogtreecommitdiffstats
path: root/recipes-security
Commit message (Collapse)AuthorAgeFilesLines
...
* policycoreutils: install /var/lib/selinuxWenzong Fan2015-08-071-0/+6
| | | | | | | | | This dir is required for running command: $ semanage permissive [OPTS] Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* audit: upgrade 2.3.2 -> 2.4.3Li xin2015-08-076-3065/+125
| | | | | | | | | | | | | | | | 1) Remove audit-for-cross-compiling.patch and disable-ldap.patch since it it not needed anymore. 2) Modify audit-python-configure.patch audit-python.patch fix-swig-host-contamination.patch,since configure.ac and Makefile.am has been changed in 2.4.3 3) Warning Fix: -WARNING: QA Issue: audit: configure was passed unrecognised options: --without-ldap [unknown-configure-option] -WARNING: QA Issue: audit: Files/directories were installed but not shipped in any package Signed-off-by: Li Xin <lixin.fnst@cn.fujitsu.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* mcstrans: remove dependency on bash in initscriptJoe MacDonald2015-08-072-0/+13
| | | | | | | There were no apparent bashisms in mcstrans.init, so remove the dependency on bash. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* policycoreutils: enable mcstransdRoy Li2015-08-075-4/+126
| | | | | | | | | mcstransd is a daemon to translate SELinux MCS/MLS sensitivity labels, policycoreutils includes mcstransd whose version is newer than that from http://mcstrans.sourcearchive.com/ Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* Fix setools building (-fPIC error)tprrt2015-08-071-0/+3
| | | | | Signed-off-by: tprrt <tprrt@tupi.fr> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-config: fix the S directory not existant warningDmitry Eremin-Solenikov2015-05-111-0/+2
| | | | | | | | Fix the warning reporing that ${S} directory does not exist by pointing S to ${WORKDIR}. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-config: allow to override 'enforcing' status of SELinuxDmitry Eremin-Solenikov2015-05-111-1/+2
| | | | | | | | Move the 'enforcing' setting to the DEFAULT_ENFORCING variable to allow one to override that setting in a bbappend file. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* audit: add bash to audtid runtime dependsDmitry Eremin-Solenikov2015-04-161-0/+1
| | | | | | | | | This is to fix the following QA warning: audit-2.3.2: auditd requires /bin/bash, but no providers in its RDEPENDS [file-rdeps] Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* policycoreutils: address QA issuesJoe MacDonald2015-02-203-2/+136
| | | | | | | | Both the fixfiles and sandbox utilities had dependencies on bash when they didn't really need to. Update sandbox and patch fixfiles. ifgen is python script, so ensure that python is listed as a runtime dependency. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* audit-systemd: allow manual stop as sysvinitJackie Huang2015-01-261-1/+0
| | | | | | | The audit service should be manually stopped with systemd. Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* pkggrp-core-selinux: coreutils additionShrikant Bobade2015-01-121-0/+1
| | | | | | | | To add coreutils to packagegroup-core-selinux inorder to get chcon avaibility. Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-init: update for systemdShrikant Bobade2015-01-121-2/+2
| | | | | | | | | | | selinux-init.sh updated to reboot system normally to fix the labelling during systemd execution. Due to force reboot labelling won't be proper and system continuously reboot to label it like first time boot. Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* V2 refpolicy:20140311 update for systemdShrikant Bobade2015-01-122-0/+47
| | | | | | | | Systemd init type and related allow rules updated for refpolicy. Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* checkpolicy: remove link against libfldizzyJoe MacDonald2014-11-102-3/+5
| | | | | | | An updated version of the patch to drop linking against libfl was required. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* userspace: update core selinux userspace toolsJoe MacDonald2014-11-0115-1551/+63
| | | | | | Update to the latest stable release, 20140506. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* Globally replace 'base_contains' calls with 'bb.utils.contains'Joe MacDonald2014-09-242-4/+4
| | | | | | | | | | | | | | | Based on oe-core commit: commit 1528e596d4906c33e4be83fcf691cfe76d340ff3 Author: Otavio Salvador <otavio@ossystems.com.br> Date: Thu Apr 24 15:59:20 2014 -0300 Globally replace 'base_contains' calls with 'bb.utils.contains' The base_contains is kept as a compatibility method and we ought to not use it in OE-Core so we can remove it from base metadata in future. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* Use compressed_policy by default, and clear distro featureXin Ouyang2014-09-222-35/+16
| | | | | | | | | | | Original refpolicy install compressed policy modules to policy store, but leave datadir ones uncompressed. After, a "compressed_policy" distro feature is added for compressing the datadir ones. This simple mechanism is unworthy for a distro feature, just clear it and use compressed policy modules by default. Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* refpolicy-minimum: add fixed prepare_policy_store().Xin Ouyang2014-09-221-0/+28
| | | | | | | Original prepare_policy_store() has a naming bug for compressed_policy, fix that and let prepare_policy_store() back. Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* refpolicy: clean up old policy and patchesJoe MacDonald2014-09-1949-2156/+0
| | | | | | | Now that the updated refpolicy core variants are available, remove the previous recipe and patches. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-minimum: update base refpolicy 20140311Joe MacDonald2014-09-192-58/+29
| | | | | | | A simple forward-port of refpolicy-minimum to use the 20140311 base refpolicy. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-targeted: update base refpolicy 20140311Joe MacDonald2014-09-192-41/+34
| | | | | | | | A simple forward-port of refpolicy-targeted to use the 20140311 base refpolicy. Now that the updated refpolicy core variants are available, remove the previous recipe. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy: update refpolicy to 20140311 releaseJoe MacDonald2014-09-1946-6/+1927
| | | | | | | | | A straight update from refpolicy 2.20130424 to 2.20140311 for the core policy variants and forward-porting of policy patches as appropriate. Now that the updated refpolicy core variants are available, remove the previous recipe. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-userspace: update userspace SRC_URI and checksumsJoe MacDonald2014-09-1610-17/+23
| | | | | | | | | Trac has been turned off on OSS. Update all SRC_URI links for the userspace components to point at the github project releases. The github releases also have a slightly different directory structure in the tarballs, requiring an update of the checksums as well. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy / minimum: support compressed policyWenzong Fan2014-08-281-8/+18
| | | | | Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* refpolicy: split do_install to three stepsWenzong Fan2014-08-281-14/+25
| | | | | | | | | | | | | Split do_install() to: + prepare_policy_store() + rebuild_policy() + install_misc_files() This allows to make partial change to do_install() instead of re-write it totally from specific refpolicy bb file. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* libcap-ng: CVE-2014-3215Shan Hai2014-08-282-1/+82
| | | | | | | | | | | | | | | seunshare in policycoreutils 2.2.5 is owned by root with 4755 permissions, and executes programs in a way that changes the relationship between the setuid system call and the getresuid saved set-user-ID value, which makes it easier for local users to gain privileges by leveraging a program that mistakenly expected that it could permanently drop privileges. Pick a patch from below link to address the CVE-2014-3215. https://bugzilla.redhat.com/attachment.cgi?id=829864 Signed-off-by: Shan Hai <shan.hai@windriver.com> Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* setools: Add bison-native and flex-native to DEPENDSChong Lu2014-06-021-1/+1
| | | | | | | Avoid policy_scan.c: No such file or directory Signed-off-by: Chong Lu <Chong.Lu@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* refpolicy: Allow udev the block_suspend capabilityJackie Huang2014-06-022-0/+26
| | | | | | | | | | Fix the avc denied issue: type=1400 audit(1399440994.656:14): avc: denied { block_suspend } for pid=80 comm="udevd" capability=36 scontext=system_u:system_r:udev_t:s0-s15:c0.c1023 tcontext=system_u:system_r:udev_t:s0-s15:c0.c1023 tclass=capability2 The patch is backported from upstream Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* setools: not override do_configure in autotools class.Xin Ouyang2014-05-161-7/+7
| | | | Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* refpolicy-*: un-inherit because not autotools packageXin Ouyang2014-05-161-4/+3
| | | | Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* refpolicy: remove PRINC warningHongxu Jia2014-05-097-7/+6
| | | | | | | | | | Bump up PR and remove PRINC. Set it to something suitably large that it's unlikely to break anyone's package feed and so that it shows it's clearly an exception case. Obviously this is just a staging activity until the next update when we don't include anything of the sort. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* checkpolicy: remove PRINC warningHongxu Jia2014-05-093-4/+2
| | | | | | | | | | Bump up PR and remove PRINC. Set it to something suitably large that it's unlikely to break anyone's package feed and so that it shows it's clearly an exception case. Obviously this is just a staging activity until the next update when we don't include anything of the sort. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libselinux: remove PRINC warningHongxu Jia2014-05-093-4/+2
| | | | | | | | | | Bump up PR and remove PRINC. Set it to something suitably large that it's unlikely to break anyone's package feed and so that it shows it's clearly an exception case. Obviously this is just a staging activity until the next update when we don't include anything of the sort. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libsemanage: remove PRINC warningHongxu Jia2014-05-093-4/+2
| | | | | | | | | | Bump up PR and remove PRINC. Set it to something suitably large that it's unlikely to break anyone's package feed and so that it shows it's clearly an exception case. Obviously this is just a staging activity until the next update when we don't include anything of the sort. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libsepol: remove PRINC warningHongxu Jia2014-05-093-4/+2
| | | | | | | | | | Bump up PR and remove PRINC. Set it to something suitably large that it's unlikely to break anyone's package feed and so that it shows it's clearly an exception case. Obviously this is just a staging activity until the next update when we don't include anything of the sort. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* sepolgen: remove PRINC warningHongxu Jia2014-05-093-4/+2
| | | | | | | | | | Bump up PR and remove PRINC. Set it to something suitably large that it's unlikely to break anyone's package feed and so that it shows it's clearly an exception case. Obviously this is just a staging activity until the next update when we don't include anything of the sort. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* policycoreutils: remove PRINC warningHongxu Jia2014-05-093-4/+2
| | | | | | | | | | Bump up PR and remove PRINC. Set it to something suitably large that it's unlikely to break anyone's package feed and so that it shows it's clearly an exception case. Obviously this is just a staging activity until the next update when we don't include anything of the sort. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libsemanage: disable expand-check on policy loadJoe MacDonald2014-05-072-0/+33
| | | | | | | | | For small policy modules it's not necessary to walk the hierarchy on load. On embedded devices that are low-powered or resource-constrained disabling the hierarchy processing can make the difference between seconds and (many) minutes of load time (or being able to load the policy at all). Signed-off-by: Joe MacDonald <joe@deserted.net>
* policycoreutils: fix TypeError for seobject.pyWenzong Fan2014-04-242-0/+33
| | | | | | | | | | | Fix python error about: File "/usr/lib64/python2.7/site-packages/seobject.py", line 109, in log message += " sename=" + sename TypeError: cannot concatenate 'str' and 'NoneType' objects Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* policycoreutils / semanage: process ValueError for sepolicy, seobjectWenzong Fan2014-04-242-0/+49
| | | | | | | | | The sepolicy, seobject modules raise many unprocessed ValueError, just process them in semanage to make the script proivdes error message but not error trace. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: add setrans.conf for mcs/mls policyWenzong Fan2014-04-243-0/+77
| | | | | | | | | | | | | | | Add initial version for setrans.conf: - setrans-mls.conf: copied from \ policycoreutils/mcstrans/share/examples/default/setrans.conf - setrans-mcs.conf: copied from radhat policy. This fixes below issue: $ chcat -L IOError: No such file or directory: \ '/etc/selinux/$POLICY_NAME/setrans.conf' Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* audit: Enable ARM System Call Audit in user space.Han Chao2014-04-242-0/+48
| | | | | | | | | | | | Audit System Call needs kernel and user space support. In user space it needs system call table for ARM. It also needs a configure option --with-armeb for build audit. Audit system call also needs enable kernel config CONFIG_AUDITSYSCALL. Signed-off-by: Han Chao <chan@windriver.com> Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: add minimum targeted policyWenzong Fan2014-04-241-0/+46
| | | | | | | | | | This is a minimum targeted policy with just core policy modules, and could be used as a base for customizing targeted policy. Pretty much everything runs as initrc_t or unconfined_t so all of the domains are unconfined. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: add targeted policy typeWenzong Fan2014-04-243-0/+276
| | | | | | | | | | | This SELinux policy would targeted most of service domains for lock down, and users and admins will login in with unconfined_t domain. So they would have the same access to the system as if SELinux was not enabled, when running commands and services which are not targeted. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* audit: Fix lack of a default audit.rulesMark Hatle2014-04-072-1/+6
| | | | | | | | | | | | | | | Various components were failing, and upon investigation it was noted that the audit.rules file referenced by the initscript wasn't available. There was however a copy under the rules.d directory. Investigating the audit.spec file (which in the upstream source) showed that it was expected that the version in the rules.d should be copied into /etc/audit. Do this and correct the systemd services file to use the same file. Signed-off-by: Mark Hatle <mark.hatle@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* policycoreutils: Add missing dependencies to semanagePeter Seebach2014-04-031-0/+2
| | | | | | | | The semanage utility requires python-compression (for "import gzip") and python-xml (for "import xml.etree.ElementTree"). Signed-off-by: Peter Seebach <peter.seebach@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* checkpolicy: Don't link against libflChong Lu2014-04-032-0/+46
| | | | | | | | | | In policy_scan.l file, we have already removed all references to yywrap by adding "%option noyywrap" statements to each flex source file that doesn't override yywrap. After this, we no longer need to link against libfl and so no longer get errors about undefined references to yylex. Signed-off-by: Chong Lu <Chong.Lu@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* policycoreutils: drop the patch for old refpolicyJackie Huang2014-04-033-42/+0
| | | | | | | | | | The patch policycoreutils-revert-run_init-open_init_pty.patch is only for refpolicy version older than 2.20120725, now the refpolicy is updated to 2.20130424 so drop the patch or it will make run_init fail to start some init scripts. Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* policycoreutils: semanageJoe Slater2014-04-032-1/+23
| | | | | | | | | When modifying an selinux login record, seobject.py, may try to log a value, self.sename, which has been preset to "None" and this will fail. So, we set it to something useful. Signed-off-by: Joe Slater <jslater@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: add rules for /var/log symlink on pokyWenzong Fan2014-04-033-0/+61
| | | | | Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-04 18:50:44 +0000