summaryrefslogtreecommitdiffstats
path: root/recipes-security
Commit message (Collapse)AuthorAgeFilesLines
* sepolgen: migrate SRC_URI to 1.2.1Wenzong Fan2014-01-102-4/+4
| | | | | | | (From meta-selinux master rev: a4fb1cec4d5952713bf533ea6f1ab23ddffe903b) Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* policycoreutils: migrate SRC_URI and patches to 2.2.5Wenzong Fan2014-01-106-67/+32
| | | | | | | | | | | | | | This patch is removed since it is merged by new version: - policycoreutils-fix-strict-prototypes.patch These two patches are updated: - policycoreutils-fix-sepolicy-install-path.patch - policycoreutils-make-O_CLOEXEC-optional.patch (From meta-selinux master rev: e19c88195b667506e0450947cfec11e75f386d47) Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* libsepol: migrate SRC_URI to 2.2Wenzong Fan2014-01-104-40/+8
| | | | | | | | | | Removed patch and ported changes to 2.2 bbfile: - libsepol-Change-ranlib-for-cross-compiling.patch (From meta-selinux master rev: fd8729d82d7667e60faeff863ee9c192240582a3) Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* libsemanage: migrate SRC_URI to 2.2Wenzong Fan2014-01-103-8/+10
| | | | | | | | | | Updated patch: - libsemanage-fix-path-nologin.patch (From meta-selinux master rev: 9bd03e1bddb9348656d368a19fb6b57e94073847) Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* libselinux: migrate SRC_URI and patches to 2.2Wenzong Fan2014-01-104-66/+10
| | | | | | | | | | | These two patches are removed since they are merged by new version: - libselinux-fix-init-load-policy.patch - libselinux-pcre-link-order.patch (From meta-selinux master rev: f04f030a1d19089580deb9905b0b24aaf53be750) Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* checkpolicy: migrate SRC_URI to 2.2Wenzong Fan2014-01-102-4/+4
| | | | | | | (From meta-selinux master rev: a4b25c05a1e35a308c360723f37df6974520fa62) Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* selinux userspace: uprev packages to release 20131030Wenzong Fan2014-01-109-15/+13
| | | | | | | | | | | | | | | | | Upreved packages: - checkpolicy to 2.2 - libselinux to 2.2 - libsemanage to 2.2 - libsepol to 2.2 - policycoreutils to 2.2.5 - sepolgen to 1.2.1 Migrate patches in next commits. (From meta-selinux master rev: dc3cd6149ce443e693d2ed490d0fa3fa01f68a45) Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* policycoreutils: Patch Makefile to get load_policy symlink right.Philip Tricca2014-01-102-0/+20
| | | | | | | | | | | Setting DESTDIR in the policycoreutils do_install creates a bad symlink for load_policy. This patch fixes up the Makefile to create the symlink relative to DESTDIR. (From meta-selinux master rev: f5e042c80a298eaec5dbdd8477c8f75268589a56) Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* policy: Create compressed_policy distro featureJoe MacDonald2014-01-101-10/+22
| | | | | | | | | | | | | | There is a small cost to having compressed policy files on the final image both in terms of memory requirements and load times. In nearly all circumstances this is negligible, but this adds a DISTRO_FEATURE that can be used to enable it, if desired. The default selinux distros will enable the feature by default. (From meta-selinux master rev: 2209cb5fc21c1ad5a7471897528ed64170f70219) Signed-off-by: Joe MacDonald <joe@deserted.net> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* bzip SELinux policy modules in ${datadir}Philip Tricca2014-01-101-4/+5
| | | | | | | | | | | | | | | | The 'semodule' utility can operate on compresed modules so the only cost of this change is a slower module load time when invoking 'semodule -i' on a running system (increased CPU load due to bzip2). That said my tests show more than 100M reduction in ext3 image size of core-image-selinux. This last metric is a bit skewed as the image includes two policies. Still, a reduction in the size of the refpolicy package by 1/2 is significant. (From meta-selinux master rev: d549fef3f4c41140b8f74263724deb75c9b5908e) Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* libselinux / libsemanage: work around FD_CLOEXEC and SOCK_CLOEXEC absenceJoe MacDonald2013-11-145-0/+113
| | | | | | | | | | | | | | | [ CQID: WIND00438478 ] [ CQID: WIND00439485 ] Turns out some of the truly old hosts don't even really recognize FD_CLOEXEC and most of the older ones don't know about SOCK_CLOEXEC. Work around each (define FD_CLOEXEC to something sensible, simply don't use SOCK_CLOEXEC, produce warnings in either event). Signed-off-by: Joe MacDonald <joe.macdonald@windriver.com> Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* libselinux / policycoreutils: optional O_CLOEXECJoe MacDonald2013-11-144-0/+152
| | | | | | | | | | | [ CQID: WIND00438478 ] We still have hosts that pre-date the inclusion of O_CLOEXEC (Linux 2.6.23) so compile the flag out when building on classic distros. Signed-off-by: Joe MacDonald <joe.macdonald@windriver.com> Signed-off-by: Jeff Polk <jeff.polk@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* refpolicy-standard: Use default variables from refpolicy_common.incPhilip Tricca2013-11-061-8/+0
| | | | | Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy-mls: Use default variables from refpolicy_common.incPhilip Tricca2013-11-061-12/+0
| | | | | Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy-mcs: Use default variables from refpolicy_common.incPhilip Tricca2013-11-061-10/+0
| | | | | Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* Move common POLICY_* variables to refpolicy_common.incPhilip Tricca2013-11-061-0/+12
| | | | | | | | Use default assignment to allow variables to be overriden by recipes that include refpolicy_common.inc Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* Add recipe to build the MCS refpolicy.Philip Tricca2013-10-301-0/+23
| | | | | | | | This is the default policy type used by most (all?) distros that support SELinux. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* audit: address x-compile issuesJoe MacDonald2013-10-231-416/+2933
| | | | | | | | | The previous approach works well for modern hosts but older ones still require the pre-gen'd header files to behave nicely in a x-compile environment. So we generate them, patch them in and remove the bits of the Makefile that may take it upon itself to re-gen them again. Signed-off-by: Joe MacDonald <joe@deserted.net>
* Add packagegroup for policycoreutils packages.Philip Tricca2013-10-152-3/+38
| | | | | | | | | | The policycoreutils package previously included most everything in the base package. This packagegroup is intended to fill the role of the old policycoreutils package and pull in all packages from the policycoreutils recipe. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* Add packagegroup and image recipe for minimal SELinux image.Philip Tricca2013-10-152-0/+41
| | | | | | | | | This is intended to demonstrate the minimal set packages necessary to boot and load a system with SELinux enabled. Specifically we don't need any of the packages that depend on python. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* Remove runtime dependency on policycoreutils from the reference policy.Philip Tricca2013-10-151-1/+1
| | | | | | | | | The only thing refpol needs to depend on at runtime are the things necessary to load the policy. If sysvinit is patched to load the policy (which it is) then we only need the config. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* Remove unnecessary RDEPENDS_${BPN}.Philip Tricca2013-10-151-15/+0
| | | | | | | | | | Now that the policycoreutuils package is empty no need for RDEPENDS. Doing this in the commit that broke up the policycoreutuils package made the diff hard to read. Figured it best to break it out for readability. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* Break policycoreutils out into separate packages for the various utilities.Philip Tricca2013-10-151-10/+178
| | | | | | | | | | The driver beind this is to allow images to be built with the minimal tools necessary to load a policy. Breaking all of the stuff that's dependent on python out from the core utils allows us to make much smaller images. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* policycoreutils: avoid shell for checking target-special actionsMark Hatle2013-10-021-3/+1
| | | | | | | | do_install was modified to only do the special actions in the target case, instead of using shell to check what mode we were running in. Signed-off-by: Mark Hatle <mark.hatle@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* setools: Uprev setoolsMark Hatle2013-10-022-2787/+10
| | | | | Signed-off-by: Mark Hatle <mark.hatle@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libcap-ng: Uprev libcap-ngMark Hatle2013-10-021-6/+3
| | | | | Signed-off-by: Mark Hatle <mark.hatle@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* audit: Uprev to audit 2.3.2Mark Hatle2013-10-026-2564/+234
| | | | | | | | Refactor the audit cross compiling patch. The new patch might have some minor host dependencies. If so, let me know! Signed-off-by: Mark Hatle <mark.hatle@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* busybox: alternatives link to sh wrappers for commandsXin Ouyang2013-10-022-2/+7
| | | | | | | | | | | | | | | | | | | | | | While directly using busybox[.[no]suid] as the alternatives' targets, commands could not get correct security labels. ~# ls -l /sbin/getty ..... /sbin/getty -> /bin/busybox.nosuid ~# ls -Z /bin/busybox.nosuid system_u:object_r:bin_t:s0 /bin/busybox.nosuid Add sh wrappers for commands so selinux could work fine. ~# ls -l /sbin/getty ..... /sbin/getty -> /usr/lib/busybox/sbin/getty ~# ls -Z /usr/lib/busybox/sbin/getty system_u:object_r:getty_exec_t:s0 /usr/lib/busybox/sbin/getty ~# cat /usr/lib/busybox/sbin/getty #!/bin/busybox.nosuid Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy*: remove old version recipes and patches.Xin Ouyang2013-10-0244-2380/+0
| | | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy*: add new version 2.20130424Xin Ouyang2013-10-0239-0/+1753
| | | | | | | | | | | | | | | | | | | These patches are removed because new version merged: - poky-fc-update-alternatives_tinylogin.patch - poky-fc-fix-prefix-path_rpc.patch - poky-fc-fix-portmap.patch - poky-fc-cgroup.patch - poky-fc-networkmanager.patch - poky-policy-allow-dbusd-to-setrlimit-itself.patch - poky-policy-allow-dbusd-to-exec-shell-commands.patch - poky-policy-allow-nfsd-to-bind-nfs-port.patch Add two new patches: + poky-policy-fix-setfiles-statvfs-get-file-count.patch + poky-policy-fix-dmesg-to-use-dev-kmsg.patch Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* always force to restore file contexts in initscriptsXin Ouyang2013-10-024-6/+6
| | | | | | | | | | | In policycoreutils-2.13+, restorecon changes its default behaviour, and does not restore context if the file' type is correct, even its mcs/mls level is incorrect. We should force it always to restore file contexts in initscripts to avoid issues. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* policycoreutils: fix wrong newrole/run_init pam configXin Ouyang2013-10-022-6/+6
| | | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* sepolgen: migrate SRC_URI to 1.1.9Xin Ouyang2013-10-021-3/+3
| | | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* policycoreutils: migrate SRC_URI and patches to 2.1.14Xin Ouyang2013-10-025-350/+52
| | | | | | | | 2.1.14 imports a new python module: sepolicy, so add setools to DEPENDS and split new files to policycoreutils-python. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libsepol: migrate SRC_URI to 2.1.9Xin Ouyang2013-10-021-3/+3
| | | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libsemanage: migrate SRC_URI to 2.1.10Xin Ouyang2013-10-021-4/+4
| | | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libselinux: migrate SRC_URI and patches to 2.1.13Xin Ouyang2013-10-022-964/+5
| | | | | | | We will also uprev refpolicy, so remove "revert-libpcre.patch". Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* checkpolicy: migrate SRC_URI to 2.1.12Xin Ouyang2013-10-021-3/+3
| | | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* selinux userspace: uprev packages to release 20130423Xin Ouyang2013-10-028-12/+12
| | | | | | | | | | | | | | | Upreved packages: - checkpolicy to 2.1.12 - libselinux to 2.1.13 - libsemanage to 2.1.10 - libsepol to 2.1.9 - policycoreutils to 2.1.14 - sepolgen to 1.1.9 Migrate patches in next commits. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* Add ${bindir}/sepolgen to system-config-selinux package.Philip Tricca2013-09-271-1/+4
| | | | | | | | | | Currently the policycoreutils package has a broken link from ${bindir}/sepolgen to ${datadir}/system-config-selinux/polgen.py. All of the other polgen stuff is in system-config-selinux so adding sepolgen to same package seems like the right thing to do. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* Check for the availability of 'secon' and 'setenforce' in the ↵Philip Tricca2013-09-271-3/+5
| | | | | | | | | selinux-init.sh script. This is for consistency and to aid in debugging. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* Resend: Install policy headers and include them in the refpolicy dev package.Philip Tricca2013-09-271-1/+5
| | | | | | | | | | | | To do this we call the 'install-headers' make target at the end of do_install. We then add the interface 'include' directory to the dev package leaving only the policy modules in the main policy package. This allows projects that ship their own SELinux policy (not in the refpolicy) to build the refpolicy headers / interface files by using the Makefile supplied by refpolicy. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* Add util-linux-agetty to core-image-selinux IMAGE_INSTALL.Philip Tricca2013-09-261-0/+1
| | | | | | | | | | | | Currently logins to core-image-selinux images through a getty (serial) fail. This is caused by the use of the busybox getty. SELinux depends on executable files and their labels to transition between types. The symlink to busybox is not sufficient to cause the getty processes to transition to the right SELinux context. Using a getty binary like the one provided by util-linux fixes this. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* Stage SELinux config file in the sysroot.Philip Tricca2013-09-251-0/+3
| | | | | | | | | | | | | This is needed to build policy modules outside of the refpolicy. Policy module build systems need to determine the name of the policy that will be in effect on the target host. This allows them to locate the policy headers that will be under $sysroot/usr/share/selinux/$name/include. Given that there *could* be more than one policy installed in the sysroot we can't assume that the policy installed there is the only policy to build against. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* policycoreutils: fix genhomedircon constructionJoe Slater2013-08-012-1/+28
| | | | | | | | | | CQID: 418197 Reference /usr/sbin instead of the directory into which the script is installed on the host. Signed-off-by: Joe Slater <jslater@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* audit: Fixed swig host contamination issueAnders Hedlund2013-08-013-5/+56
| | | | | | | | | | | | | CQID: 428272 The audit build uses swig to generate a python wrapper. Unfortunately, the swig info file references host include directories. Some of these were previously noticed and eliminated, but the one fixed here was not. Signed-off-by: Anders Hedlund <anders.hedlund@windriver.com> Signed-off-by: Joe Slater <jslater@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* packagegroup-core-selinux: Rename from task to packagegroupMark Hatle2013-08-012-5/+5
| | | | | | | | | Also fix ALLOW_EMPTY, oe-core does not allow ALLOW_EMPTY w/o a package name. Adjust references in core-image-selinux to the new packagegroup filename. Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* selinux packages: uprev git recipes to lastest tag 20130423.Xin Ouyang2013-06-1810-19/+95
| | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* policycoreutils: Revert "run_init: If open_init_pty ..."Xin Ouyang2013-06-052-1/+42
| | | | | | | | | | | | This reverts commit d46e88abb6e1f7b0228c30c98ba4fb739e63cda3. In d46e88ab, run_init will not use open_init_pty as Redhat did. Our old refpolicy still does no work well with this, and make init scripts fail to start so revert it. This patch should be dropped while refpolicy is upreved to 2.20120725+. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
* policycoreutils: Revert "restorecon: only update type by default"Xin Ouyang2013-05-282-1/+319
| | | | | | | | | | | This reverts uprev commit 96cedba3e59aa474f0f040da5108a17bba45ce6c. 96cedb will cause wrong security contexts for /dev/ while using MLS type of old refpolicy, so revert it. This patch should be dropped while refpolicy is upreved to 2.20120725+. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-07 11:33:42 +0000