aboutsummaryrefslogtreecommitdiffstats
path: root/recipes-security
AgeCommit message (Collapse)Author
2014-11-10checkpolicy: remove link against libfldizzyJoe MacDonald
An updated version of the patch to drop linking against libfl was required. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2014-11-01userspace: update core selinux userspace toolsJoe MacDonald
Update to the latest stable release, 20140506. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2014-09-24Globally replace 'base_contains' calls with 'bb.utils.contains'Joe MacDonald
Based on oe-core commit: commit 1528e596d4906c33e4be83fcf691cfe76d340ff3 Author: Otavio Salvador <otavio@ossystems.com.br> Date: Thu Apr 24 15:59:20 2014 -0300 Globally replace 'base_contains' calls with 'bb.utils.contains' The base_contains is kept as a compatibility method and we ought to not use it in OE-Core so we can remove it from base metadata in future. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2014-09-22Use compressed_policy by default, and clear distro featureXin Ouyang
Original refpolicy install compressed policy modules to policy store, but leave datadir ones uncompressed. After, a "compressed_policy" distro feature is added for compressing the datadir ones. This simple mechanism is unworthy for a distro feature, just clear it and use compressed policy modules by default. Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
2014-09-22refpolicy-minimum: add fixed prepare_policy_store().Xin Ouyang
Original prepare_policy_store() has a naming bug for compressed_policy, fix that and let prepare_policy_store() back. Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
2014-09-19refpolicy: clean up old policy and patchesJoe MacDonald
Now that the updated refpolicy core variants are available, remove the previous recipe and patches. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2014-09-19refpolicy-minimum: update base refpolicy 20140311Joe MacDonald
A simple forward-port of refpolicy-minimum to use the 20140311 base refpolicy. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2014-09-19refpolicy-targeted: update base refpolicy 20140311Joe MacDonald
A simple forward-port of refpolicy-targeted to use the 20140311 base refpolicy. Now that the updated refpolicy core variants are available, remove the previous recipe. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2014-09-19refpolicy: update refpolicy to 20140311 releaseJoe MacDonald
A straight update from refpolicy 2.20130424 to 2.20140311 for the core policy variants and forward-porting of policy patches as appropriate. Now that the updated refpolicy core variants are available, remove the previous recipe. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2014-09-16selinux-userspace: update userspace SRC_URI and checksumsJoe MacDonald
Trac has been turned off on OSS. Update all SRC_URI links for the userspace components to point at the github project releases. The github releases also have a slightly different directory structure in the tarballs, requiring an update of the checksums as well. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2014-08-28refpolicy / minimum: support compressed policyWenzong Fan
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
2014-08-28refpolicy: split do_install to three stepsWenzong Fan
Split do_install() to: + prepare_policy_store() + rebuild_policy() + install_misc_files() This allows to make partial change to do_install() instead of re-write it totally from specific refpolicy bb file. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
2014-08-28libcap-ng: CVE-2014-3215Shan Hai
seunshare in policycoreutils 2.2.5 is owned by root with 4755 permissions, and executes programs in a way that changes the relationship between the setuid system call and the getresuid saved set-user-ID value, which makes it easier for local users to gain privileges by leveraging a program that mistakenly expected that it could permanently drop privileges. Pick a patch from below link to address the CVE-2014-3215. https://bugzilla.redhat.com/attachment.cgi?id=829864 Signed-off-by: Shan Hai <shan.hai@windriver.com> Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
2014-06-02setools: Add bison-native and flex-native to DEPENDSChong Lu
Avoid policy_scan.c: No such file or directory Signed-off-by: Chong Lu <Chong.Lu@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
2014-06-02refpolicy: Allow udev the block_suspend capabilityJackie Huang
Fix the avc denied issue: type=1400 audit(1399440994.656:14): avc: denied { block_suspend } for pid=80 comm="udevd" capability=36 scontext=system_u:system_r:udev_t:s0-s15:c0.c1023 tcontext=system_u:system_r:udev_t:s0-s15:c0.c1023 tclass=capability2 The patch is backported from upstream Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
2014-05-16setools: not override do_configure in autotools class.Xin Ouyang
Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
2014-05-16refpolicy-*: un-inherit because not autotools packageXin Ouyang
Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
2014-05-09refpolicy: remove PRINC warningHongxu Jia
Bump up PR and remove PRINC. Set it to something suitably large that it's unlikely to break anyone's package feed and so that it shows it's clearly an exception case. Obviously this is just a staging activity until the next update when we don't include anything of the sort. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2014-05-09checkpolicy: remove PRINC warningHongxu Jia
Bump up PR and remove PRINC. Set it to something suitably large that it's unlikely to break anyone's package feed and so that it shows it's clearly an exception case. Obviously this is just a staging activity until the next update when we don't include anything of the sort. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2014-05-09libselinux: remove PRINC warningHongxu Jia
Bump up PR and remove PRINC. Set it to something suitably large that it's unlikely to break anyone's package feed and so that it shows it's clearly an exception case. Obviously this is just a staging activity until the next update when we don't include anything of the sort. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2014-05-09libsemanage: remove PRINC warningHongxu Jia
Bump up PR and remove PRINC. Set it to something suitably large that it's unlikely to break anyone's package feed and so that it shows it's clearly an exception case. Obviously this is just a staging activity until the next update when we don't include anything of the sort. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2014-05-09libsepol: remove PRINC warningHongxu Jia
Bump up PR and remove PRINC. Set it to something suitably large that it's unlikely to break anyone's package feed and so that it shows it's clearly an exception case. Obviously this is just a staging activity until the next update when we don't include anything of the sort. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2014-05-09sepolgen: remove PRINC warningHongxu Jia
Bump up PR and remove PRINC. Set it to something suitably large that it's unlikely to break anyone's package feed and so that it shows it's clearly an exception case. Obviously this is just a staging activity until the next update when we don't include anything of the sort. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2014-05-09policycoreutils: remove PRINC warningHongxu Jia
Bump up PR and remove PRINC. Set it to something suitably large that it's unlikely to break anyone's package feed and so that it shows it's clearly an exception case. Obviously this is just a staging activity until the next update when we don't include anything of the sort. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2014-05-07libsemanage: disable expand-check on policy loadJoe MacDonald
For small policy modules it's not necessary to walk the hierarchy on load. On embedded devices that are low-powered or resource-constrained disabling the hierarchy processing can make the difference between seconds and (many) minutes of load time (or being able to load the policy at all). Signed-off-by: Joe MacDonald <joe@deserted.net>
2014-04-24policycoreutils: fix TypeError for seobject.pyWenzong Fan
Fix python error about: File "/usr/lib64/python2.7/site-packages/seobject.py", line 109, in log message += " sename=" + sename TypeError: cannot concatenate 'str' and 'NoneType' objects Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2014-04-24policycoreutils / semanage: process ValueError for sepolicy, seobjectWenzong Fan
The sepolicy, seobject modules raise many unprocessed ValueError, just process them in semanage to make the script proivdes error message but not error trace. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2014-04-24refpolicy: add setrans.conf for mcs/mls policyWenzong Fan
Add initial version for setrans.conf: - setrans-mls.conf: copied from \ policycoreutils/mcstrans/share/examples/default/setrans.conf - setrans-mcs.conf: copied from radhat policy. This fixes below issue: $ chcat -L IOError: No such file or directory: \ '/etc/selinux/$POLICY_NAME/setrans.conf' Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2014-04-24audit: Enable ARM System Call Audit in user space.Han Chao
Audit System Call needs kernel and user space support. In user space it needs system call table for ARM. It also needs a configure option --with-armeb for build audit. Audit system call also needs enable kernel config CONFIG_AUDITSYSCALL. Signed-off-by: Han Chao <chan@windriver.com> Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2014-04-24refpolicy: add minimum targeted policyWenzong Fan
This is a minimum targeted policy with just core policy modules, and could be used as a base for customizing targeted policy. Pretty much everything runs as initrc_t or unconfined_t so all of the domains are unconfined. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2014-04-24refpolicy: add targeted policy typeWenzong Fan
This SELinux policy would targeted most of service domains for lock down, and users and admins will login in with unconfined_t domain. So they would have the same access to the system as if SELinux was not enabled, when running commands and services which are not targeted. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2014-04-07audit: Fix lack of a default audit.rulesMark Hatle
Various components were failing, and upon investigation it was noted that the audit.rules file referenced by the initscript wasn't available. There was however a copy under the rules.d directory. Investigating the audit.spec file (which in the upstream source) showed that it was expected that the version in the rules.d should be copied into /etc/audit. Do this and correct the systemd services file to use the same file. Signed-off-by: Mark Hatle <mark.hatle@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2014-04-03policycoreutils: Add missing dependencies to semanagePeter Seebach
The semanage utility requires python-compression (for "import gzip") and python-xml (for "import xml.etree.ElementTree"). Signed-off-by: Peter Seebach <peter.seebach@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2014-04-03checkpolicy: Don't link against libflChong Lu
In policy_scan.l file, we have already removed all references to yywrap by adding "%option noyywrap" statements to each flex source file that doesn't override yywrap. After this, we no longer need to link against libfl and so no longer get errors about undefined references to yylex. Signed-off-by: Chong Lu <Chong.Lu@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2014-04-03policycoreutils: drop the patch for old refpolicyJackie Huang
The patch policycoreutils-revert-run_init-open_init_pty.patch is only for refpolicy version older than 2.20120725, now the refpolicy is updated to 2.20130424 so drop the patch or it will make run_init fail to start some init scripts. Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2014-04-03policycoreutils: semanageJoe Slater
When modifying an selinux login record, seobject.py, may try to log a value, self.sename, which has been preset to "None" and this will fail. So, we set it to something useful. Signed-off-by: Joe Slater <jslater@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2014-04-03refpolicy: add rules for /var/log symlink on pokyWenzong Fan
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2014-04-03refpolicy: associate tmpfs_t (shm) to device_t (devtmpfs) file systemsWenzong Fan
The patch is backported from upstream. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2014-04-03refpolicy: make proftpd be able to workRoy Li
Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2014-04-03audit: fix the permission of configuration fileRoy Li
A ordinary use should not to access auditd configuration files Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2014-04-03audit: Add systemd supportRoy Li
Audit unit file is from https://fedorahosted.org/audit/browser/trunk/init.d/auditd.service Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2014-04-03refpolicy: allow sysadm to run rpcbindRoy Li
Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2014-04-03core-image-selinux: update 'core-basic' packagegroupJoe MacDonald
packagegroup-core-basic has been renamed to packagegroup-full-cmdline, update our core-image-selinux. Signed-off-by: Joe MacDonald <joe@deserted.net>
2014-04-03refpolicy: Updated FILESEXTRAPATHS_prepend valueAlexandru.Vaduva
The value was defined as: FILESEXTRAPATHS_prepend := "${THISDIR}/refpolicy-${PV}:" and changed it to: FILESEXTRAPATHS_prepend := "${THISDIR}/refpolicy-2.20130424:" becase the bb that inherit this overwrites the PV every time, changing its name. Signed-off-by: Alexandru.Vaduva <Alexandru.Vaduva@enea.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2014-02-13refpolicy: fix real path for su.shadowWenzong Fan
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2014-02-12refpolicy: backport two patches to fix dhclient, hostname and ifconfigRoy Li
Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2014-02-12refpolicy: fix ftpwho install dirRoy Li
ftpwho is installed into /usr/bin, not /usr/sbin. Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2014-01-28refpolicy: Allow ping to get/set capabilitiesWenzong Fan
When ping is installed with capabilities instead of being marked setuid, then the ping_t domain needs to be allowed to getcap/setcap. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
2014-01-28refpolicy: fix real path for swapoffWenzong Fan
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
2014-01-28refpolicy: fix real path for cpioWenzong Fan
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-05-01 14:53:53 +0000