summaryrefslogtreecommitdiffstats
path: root/recipes-security
Commit message (Collapse)AuthorAgeFilesLines
...
* refpolicy: Update policy install and bootstrap process for CIL.Philip Tricca2015-09-171-14/+26
| | | | | | | | | | | | | | | | The policy modules are now installed into /var/lib/selinux instead of /etc/selinux. Policies now have priorities. This is represented as part of the path under /var/lib/selinux. The new intermediate policy representation requires that we install the policy package as 3 files (hll, cil & lang_ext) instead of just the *.pp as before. The cil is generated from the hll (the pp file) using the new 'pp' utility. The base policy module now lives with all of the other modules. policy.kern has gone away. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* setools: Add patch to support 2.4 toolstack.Philip Tricca2015-09-173-35/+115
| | | | | Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* policycoreutuils: Bump version to 2.4.Philip Tricca2015-09-173-5/+83
| | | | | | | | | | | | This integrates the new hll tool for compiling pp files into cil. The hack to stage pp into the sysroot is a bit weird but the libexec dir seems to be something bitbake doesn't account for. Had to pull one patch from upstream to build the MLS policy. This fixes an error where the auditadm_r and secadm_r roles end up defined twice in the CIL. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* libsemanage: Bump version to 2.4.Philip Tricca2015-09-172-14/+13
| | | | | Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* checkpolicy: Bump version to 2.4.Philip Tricca2015-09-172-7/+7
| | | | | Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* libselinux: Bump version to 2.4.Philip Tricca2015-09-171-3/+3
| | | | | Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* libsepol: Bump version to 2.4.Philip Tricca2015-09-172-7/+7
| | | | | Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* Add common files for 20150202 SELinux userspace release.Philip Tricca2015-09-171-0/+5
| | | | | | | | | | Note the change in the URL from the last release. We were pulling source tarballs generated by GitHub as part of its reponse to the addition of tags. The SELinux project maintains their own releases on the wiki at: https://github.com/SELinuxProject/selinux/wiki/Releases Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* Use the SELinux project release tarballs.Philip Tricca2015-09-088-18/+14
| | | | | | | | | | | | | | | | The SRC_URI used for the last SELinux userspace upgrade was the wrong one. We were using the URI generated by GitHub when tags are added to a repo. These are not the SELinux release tarballs. The SELinux project generates and releases tarballs for each tool and posts them to their GitHub wiki 'Releases' page: https://github.com/SELinuxProject/selinux/wiki/Releases. This patch fixes this URI, fixes the SELINUX_RELEASE variable that didn't get updated during the last upgrade, removes the workaround for the 'S' variable and fixes up the SRC_URI hashes. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* audit: remove add-system-call-table-for-ARM.patchRobert Yang2015-08-142-48/+0
| | | | | | | | | | There isn't lib/machinetabs.h any more, there isn't data structures like "static const char machine_strings", either. This fixed a do_patch error when arm. Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* libcap-ng: upgrade 0.7.4 -> 0.7.7Wenzong Fan2015-08-143-100/+41
| | | | | | | | | | | | | | | | | | | | * Port changes from meta-oe: commit bce4dba5546480c8e43c6442959ac7d0a4ef32f6 Author: Li xin <lixin.fnst@cn.fujitsu.com> Date: Thu Jul 23 15:29:31 2015 +0800 libcap-ng: upgrade 0.7.4 -> 0.7.7 Update python.patch,since the contents has been changed. Signed-off-by: Li Xin <lixin.fnst@cn.fujitsu.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> * Remove patch CVE-2014-3215.patch that included by 0.7.7 Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* libselinux: get pywrap depends on selinux.pyWenzong Fan2015-08-143-0/+33
| | | | | | | | | | | | | | | | | | | | | | The selinux.py will be installed as selinux/__init__.py, just make sure it has been generated completely while starting "make install-pywrap". This fixes below errors that caused by an empty "selinux/__init__.py" on target: $ /usr/sbin/semanage -h Traceback (most recent call last): File "/usr/sbin/semanage", line 30, in <module> import seobject File "/usr/lib64/python2.7/site-packages/seobject.py", line 27, in <module> import sepolicy File "/usr/lib64/python2.7/site-packages/sepolicy/__init__.py", line 226, in <module> def get_file_equiv_modified(fc_path = selinux.selinux_file_context_path()): AttributeError: 'module' object has no attribute 'selinux_file_context_path' Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* audit: fix qa warning, update config optionShrikant Bobade2015-08-141-1/+1
| | | | | | | | update config option '--with-armeb' to '--with-arm' for audit qa warning fix. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-config: make DEFAULT_POLICY and DEFAULT_ENFORCING configurableJosep Puigdemont2015-08-141-5/+7
| | | | | | | Make DEFAULT_POLICY and DEFAULT_ENFORCING configurations more flexible. Signed-off-by: Maxin B. John <maxin.john@enea.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-image: Add new image class to label the rootfs, use it for selinux ↵Philip Tricca2015-08-082-2/+2
| | | | | | | images. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* policycoreutils: Patch setfiles to add FTS_NOCHDIR to fts_flags.Philip Tricca2015-08-082-0/+26
| | | | | Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-minimum: update base refpolicy to git repoShrikant Bobade2015-08-071-0/+48
| | | | | | | | A simple forward-port of refpolicy-minimum to use the refpolicy from git repository. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-standard: update base refpolicy to git repoShrikant Bobade2015-08-071-0/+8
| | | | | | | | A simple forward-port of refpolicy-standard to use the refpolicy from git repository. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-mls: update base refpolicy to git repoShrikant Bobade2015-08-071-0/+10
| | | | | | | | A simple forward-port of refpolicy-mls to use the refpolicy from git repository. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-mcs: update base refpolicy to git repoShrikant Bobade2015-08-071-0/+11
| | | | | | | | A simple forward-port of refpolicy-mcs to use the refpolicy from git repository. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-targeted: update base refpolicy to git repoShrikant Bobade2015-08-071-0/+20
| | | | | | | | A simple forward-port of refpolicy-targeted to use the refpolicy from git repository. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy git: rebase patches with code baseShrikant Bobade2015-08-075-77/+74
| | | | | | | | | During forward-port of these patches from refpolicy 20140311, requires rebase with the refpolicy git repos head master code base,in order to resolve the patch conflicts. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy git: update refpolicy to git repositoryShrikant Bobade2015-08-0744-0/+1976
| | | | | | | | | | | | | | | | A straight update from refpolicy 2.20140311 to refpolicy git repository for the core policy variants and forward-porting of policy patches as appropriate. This approach is useful for building refpolicy & refpolicy-contrib directly from the git repos, rather than release tarballs. It helps to check the refpolicy based on source commits by just updating the git repo rev. as appropriate in refpolicy_git.inc ref: https://github.com/TresysTechnology/refpolicy/wiki Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-minimum: update base refpolicy 20141203Shrikant Bobade2015-08-071-0/+48
| | | | | | | | A simple forward-port of refpolicy-minimum to use the 20141203 base refpolicy. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-standard: update base refpolicy 20141203Shrikant Bobade2015-08-071-0/+8
| | | | | | | | A simple forward-port of refpolicy-standard to use the 20141203 base refpolicy. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-mls: update base refpolicy 20141203Shrikant Bobade2015-08-071-0/+10
| | | | | | | | A simple forward-port of refpolicy-mls to use the 20141203 base refpolicy. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-mcs: update base refpolicy 20141203Shrikant Bobade2015-08-071-0/+11
| | | | | | | | A simple forward-port of refpolicy-mcs to use the 20141203 base refpolicy. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy-targeted: update base refpolicy 20141203Shrikant Bobade2015-08-071-0/+20
| | | | | | | | A simple forward-port of refpolicy-targeted to use the 20141203 base refpolicy. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy 20141203: rebase patches with code baseShrikant Bobade2015-08-075-78/+73
| | | | | | | | | During forward-port of these patches from refpolicy 2014120311, requires rebase with the refpolicy 20141203 code base, in order to resolve the patch conflicts. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy: update refpolicy to 20141203 releaseShrikant Bobade2015-08-0744-0/+1974
| | | | | | | | | | A straight update from refpolicy 2.20140311 to 2.20141203 for the core policy variants and forward-porting of policy patches as appropriate. ref: https://github.com/TresysTechnology/refpolicy/wiki Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy: correct SELINUX_DEVEL_PATHWenzong Fan2015-08-071-1/+9
| | | | | | | | | The sepolgen.conf should be installed with devel package to correct the default value of SELINUX_DEVEL_PATH, Makefile will be searched from that path while building policies on target. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* policycoreutils: install /var/lib/selinuxWenzong Fan2015-08-071-0/+6
| | | | | | | | | This dir is required for running command: $ semanage permissive [OPTS] Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* audit: upgrade 2.3.2 -> 2.4.3Li xin2015-08-076-3065/+125
| | | | | | | | | | | | | | | | 1) Remove audit-for-cross-compiling.patch and disable-ldap.patch since it it not needed anymore. 2) Modify audit-python-configure.patch audit-python.patch fix-swig-host-contamination.patch,since configure.ac and Makefile.am has been changed in 2.4.3 3) Warning Fix: -WARNING: QA Issue: audit: configure was passed unrecognised options: --without-ldap [unknown-configure-option] -WARNING: QA Issue: audit: Files/directories were installed but not shipped in any package Signed-off-by: Li Xin <lixin.fnst@cn.fujitsu.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* mcstrans: remove dependency on bash in initscriptJoe MacDonald2015-08-072-0/+13
| | | | | | | There were no apparent bashisms in mcstrans.init, so remove the dependency on bash. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* policycoreutils: enable mcstransdRoy Li2015-08-075-4/+126
| | | | | | | | | mcstransd is a daemon to translate SELinux MCS/MLS sensitivity labels, policycoreutils includes mcstransd whose version is newer than that from http://mcstrans.sourcearchive.com/ Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* Fix setools building (-fPIC error)tprrt2015-08-071-0/+3
| | | | | Signed-off-by: tprrt <tprrt@tupi.fr> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-config: fix the S directory not existant warningDmitry Eremin-Solenikov2015-05-111-0/+2
| | | | | | | | Fix the warning reporing that ${S} directory does not exist by pointing S to ${WORKDIR}. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-config: allow to override 'enforcing' status of SELinuxDmitry Eremin-Solenikov2015-05-111-1/+2
| | | | | | | | Move the 'enforcing' setting to the DEFAULT_ENFORCING variable to allow one to override that setting in a bbappend file. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* audit: add bash to audtid runtime dependsDmitry Eremin-Solenikov2015-04-161-0/+1
| | | | | | | | | This is to fix the following QA warning: audit-2.3.2: auditd requires /bin/bash, but no providers in its RDEPENDS [file-rdeps] Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* policycoreutils: address QA issuesJoe MacDonald2015-02-203-2/+136
| | | | | | | | Both the fixfiles and sandbox utilities had dependencies on bash when they didn't really need to. Update sandbox and patch fixfiles. ifgen is python script, so ensure that python is listed as a runtime dependency. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* audit-systemd: allow manual stop as sysvinitJackie Huang2015-01-261-1/+0
| | | | | | | The audit service should be manually stopped with systemd. Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* pkggrp-core-selinux: coreutils additionShrikant Bobade2015-01-121-0/+1
| | | | | | | | To add coreutils to packagegroup-core-selinux inorder to get chcon avaibility. Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-init: update for systemdShrikant Bobade2015-01-121-2/+2
| | | | | | | | | | | selinux-init.sh updated to reboot system normally to fix the labelling during systemd execution. Due to force reboot labelling won't be proper and system continuously reboot to label it like first time boot. Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* V2 refpolicy:20140311 update for systemdShrikant Bobade2015-01-122-0/+47
| | | | | | | | Systemd init type and related allow rules updated for refpolicy. Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* checkpolicy: remove link against libfldizzyJoe MacDonald2014-11-102-3/+5
| | | | | | | An updated version of the patch to drop linking against libfl was required. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* userspace: update core selinux userspace toolsJoe MacDonald2014-11-0115-1551/+63
| | | | | | Update to the latest stable release, 20140506. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* Globally replace 'base_contains' calls with 'bb.utils.contains'Joe MacDonald2014-09-242-4/+4
| | | | | | | | | | | | | | | Based on oe-core commit: commit 1528e596d4906c33e4be83fcf691cfe76d340ff3 Author: Otavio Salvador <otavio@ossystems.com.br> Date: Thu Apr 24 15:59:20 2014 -0300 Globally replace 'base_contains' calls with 'bb.utils.contains' The base_contains is kept as a compatibility method and we ought to not use it in OE-Core so we can remove it from base metadata in future. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* Use compressed_policy by default, and clear distro featureXin Ouyang2014-09-222-35/+16
| | | | | | | | | | | Original refpolicy install compressed policy modules to policy store, but leave datadir ones uncompressed. After, a "compressed_policy" distro feature is added for compressing the datadir ones. This simple mechanism is unworthy for a distro feature, just clear it and use compressed policy modules by default. Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* refpolicy-minimum: add fixed prepare_policy_store().Xin Ouyang2014-09-221-0/+28
| | | | | | | Original prepare_policy_store() has a naming bug for compressed_policy, fix that and let prepare_policy_store() back. Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* refpolicy: clean up old policy and patchesJoe MacDonald2014-09-1949-2156/+0
| | | | | | | Now that the updated refpolicy core variants are available, remove the previous recipe and patches. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-07 16:03:31 +0000