aboutsummaryrefslogtreecommitdiffstats
path: root/recipes-security
AgeCommit message (Collapse)Author
2013-04-02audit: use generated headers for cross compilingXin Ouyang
Default audit Makefile will generate native executables in lib/ and auparse/, which are named as gen_*_h and run on the hosts to create *_tables.h/*tabs.h header files for the targets. This is inappropriate for our cross compiling because they need linux-libc-headers from the host. Even worse, on some old hosts, build will fail because some .h files in the old linux-libc-headers (<= 2.6.29) has incomplete DEFINE lists for the audit system. So add *tables.h/*tabs.h header files which are generated from linux-libc-headers-3.4, and do not generate and run those native executables. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2013-03-19refpolicy: oe-core /var/log symlink policy for apacheXin Ouyang
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2013-03-19refpolicy*: fix file contexts for many oe-core recipesXin Ouyang
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2013-03-19libcap-ng: fix the QA issue for libcap-ng.so*Xin Ouyang
Some binaries in base_sbindir have libcap-ng.so* depends, so move libcap-ng.so* to avoid QA warnings. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2013-03-09refpolicy: two patches for nfs-kernel-serverXin Ouyang
We still miss some rules for nfsd to bind on nfs ports, so add a patch to fix this. oe-core changed nfsd to use portmap, so also fix file contexts for portmap. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2013-02-27refpolicy: add selinux-config RDEPENDSXin Ouyang
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2013-02-27refpolicy: fix file contexts for bindXin Ouyang
Some files of bind are not installed to default pathes, fix the security contexts for these files. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2013-02-27refpolicy: add rules for /var/cache symlinkXin Ouyang
/var/cache is a symlink in poky, so we need allow rules for files to read lnk_file while doing search/list/delete/rw.. in /var/cache/ directory. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2013-02-17policycoreutils: target build alway need libcgroup&libcap-ngXin Ouyang
Target package policycoreutils-sandbox always needs libcgroup and libcap-ng, so it should not be conditional. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2013-02-17libsemanage: fix incorrect path for nologinXin Ouyang
shadow package of oe-core and Debian has installed nologin into /usr/sbin, so fix this path. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2013-01-30libcap-ng: remove old versionXin Ouyang
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2013-01-28setools: fix incorrect PYTHON_LDFLAGS.Xin Ouyang
PYTHON_LDFLAGS is considered as the full path of libpython2.7.so, dirname of the .so file will be expanded into -L<DIR>. As a result, current PYTHON_LDFLAGS cause this compile result: ${CC} ... -L-LXXX/tmp/sysroots/qemux86-64/usr/lib64 -L-lapol -lqpol -o _sesearch.so So "-lapol" is ignored, fix this. CQID: WIND00400717 Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2013-01-23refpolicy: policy fixes for seutils and auditd_log_tXin Ouyang
Two patches to fix these two issue: * Current policy has incomplete allow rules for selinux utils to manage selinux config files and policy store. * auditd_log_t(/var/log/audit/audit.log) is also placed in var_log_t, so add related rules. CQID: WIND00396415 Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2013-01-22refpolicy: file contexts for alternatives of shadowXin Ouyang
CQID: WIND00399962 Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2013-01-22policycoreutils: inherit selinuxXin Ouyang
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2013-01-22audit: admin tools&daemons install to base_sbindirXin Ouyang
audit admin tools and daemons should install to base_sbindir, so they can get correct security labels after selinux restorecon command. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2013-01-09refpolicy: add user_tty_device_t into customizable_typesXin Ouyang
Add user_tty_device_t as a customizable_type, so that restorecon -R /dev will not complain about it or modify the security labels. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2013-01-09refpolicy: change hard-coded pachesXin Ouyang
- /etc -> ${sysconfdir} - /usr/share -> ${datadir} Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2013-01-07audit: enable auditd service for default runlevelsXin Ouyang
CQID: WIND00397456 Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2013-01-05selinux packages: create include files.Xin Ouyang
Create include files for selinux userspace packages: * checkpolicy.inc * libselinux.inc * libsemanage.inc * libsepol.inc * policycoreutils.inc * sepolgen.inc Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-12-25libsemanage: fix path length limits.Xin Ouyang
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-12-12policycoreutils: install init script under /etc/init.d/Roy.Li
Signed-off-by: Roy.Li <rongqing.li@windriver.com> Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-11-30checkpolicy+libsemanage: flex+bison native dependsXin Ouyang
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-11-27refpolicy: standard/mls policy should set UBAC=nXin Ouyang
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-11-27refpolicy: fix policy to allow nfsd works.Xin Ouyang
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-11-19selinux-config: update the init scriptXin Ouyang
Fix the hard-coded security type for /dev/null and /dev/console. Check rootfs if support xattrs before do relabel. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-11-12refpolicy*: make to use pythonnativeXin Ouyang
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-11-01policycoreutils: backport to remove empty po filesXin Ouyang
et, gl, and id .po files contained no translations. This can cause build errors. Delete those puppies. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-10-18setools: add libxml2 DEPENDS.Xin Ouyang
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-10-18selinux-config: add init scriptXin Ouyang
This script will be installed as 0selinux-init, in runlevel S and sequence number 0. It will start before any other init script. * relabel /dev for restorecon/fixfiles running * rebuild policy and relabel the rootfs if /.autorelabel placed. * relabel the rootfs if it is first booting. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-10-18core-image-selinux: update task-* to packagegroup-*Xin Ouyang
oe-core has changed task-* recipes to packagegroup-*, so we should follow this. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-10-18policycoreutils: add pam config for newrole/run_initXin Ouyang
Also fix missing RDEPENDS for setools-* Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-10-18refpolicy: xconsole_device_t as a dev_nodeXin Ouyang
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-10-18refpolicy: add poky specific rules for packages.Xin Ouyang
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-10-18refpolicy: Fix specific file contexts for pokyXin Ouyang
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-10-18refpolicy: uprev to version 2.20120725.Xin Ouyang
Patches are migrated or droped for new version. * poky-fc-etc_init.d.patch: droped because file_contexts.subs_dist is defined to instead. * fix-mount-to-write-mountpoints-dirs.patch: droped because the rules is not needed now. * poky-fc-update-alternatives_sysvinit.patch: migrated. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-10-15libcap-ng: pythonnative, add swig-native dependXin Ouyang
libcap-ng need native python while do_configure, and native swig while do_compile, so add them. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-10-11policycoreutils: disable QA checkes for fixfiles.Xin Ouyang
fixfiles in /sbin would run some /usr/bin binaries to cause these QA warnings. WARNING: Shell scripts in base_bindir and base_sbindir should not reference anything in exec_prefix Since fixfiles is installed into /sbin in most Linux distros, changing this path may cause runtime errors for some hard coded binaries. So, disable unsafe-references-in-scripts QA checkes. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-10-11audit: fix package issues.Xin Ouyang
Rename two packages and change files in them. * audit-libs -> audit : main package, for libraries * audit -> auditd : for daemon binaries Libraries are changed to install into ${base_libdir}. The two fixes are used to fix QA issues and fit the Debian policy. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-10-09libselinux: fix Public Domain license warning.Xin Ouyang
The "Public Domain" license now has a common license file placed as PD in Poky/oe-core, so fix this. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-09-26selinux recipes: inherit pythonnativeXin Ouyang
With new changes in oe-core, recipes which need python-native should "inherit pythonnative". Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-09-24policycoreutils: fix build with pam DISTRO_FEATUREXin Ouyang
If no pam DISTRO_FEATURE, policycoreutils should not build with libpam headers and libraries. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-09-20setools: inherit pythonnativeXin Ouyang
With new changes in oe-core, recipes which need python-native should "inherit pythonnative". Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-09-07audit-2.2.1: copy bits/socket_type.h only if it existsXin Ouyang
eglibc-2.16 splits enum __socket_type from bits/socket.h to bits/socket_type.h, so old eglibc does not have bits/socket_type.h We should copy it only if it exists. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-08-21selinux-task: add necessary packages for selinuxXin Ouyang
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-08-17policycoreutils: rewrite DEPENDS for libcap-ng&libcgroup&pamXin Ouyang
EXTRA_DEPENDS is still not null while building native packages, this will add useless depends for libcap-ng&libcgroup&pam and cause build errors. So rewrite these DEPENDS. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-08-17libselinux: Fix indent warning for python codes.Xin Ouyang
Fix these warnings: =================== WARNING: Variable get_git_policyconfigarch contains tabs, please remove these(....) Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-08-17audit-2.2.1: Add bits/socket_type.h from target libc-headers.Xin Ouyang
We have copied some target kernel headers in 72fb6da. We may get build failures because of missing bits/socket_type.h on some hosts, so add it. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-08-03audit: inherit pythonnativeXin Ouyang
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-07-23policycoreutils: remove format-security from CFLAGS.Xin Ouyang
Remove -Wno-error=format-security from CFLAGS. and add a patch so we can build policycoreutils if -Werror=format-security enabled. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-05-03 16:03:50 +0000