aboutsummaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2017-01-04selinux_common: remove EXTRA_OEMAKE = "-e"wenzong/selinux-2.6Wenzong Fan
Some variables are exported by top Makefile and updated from sub Makefile (such as PCRE_LDFLAGS, DISABLE_FLAGS ...). The '-e' option prevents those variables from updating in the sub Makefile and causes libselinux build errors: | label.lo:(.data.rel.ro.local+0x20): undefined reference to `selabel_property_init' | label.lo:(.data.rel.ro.local+0x28): undefined reference to `selabel_service_init' oe-core also cleaned such default value from commit: aeb65386 Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
2017-01-04secilc: uprev to 2.6 (20161014)Wenzong Fan
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
2017-01-04sepolgen: uprev to 2.6 (20161014)Wenzong Fan
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
2017-01-04policycoreutils: uprev to 2.6 (20161014)Wenzong Fan
* rebase patch: - policycoreutils-process-ValueError-for-sepolicy-seobject.patch Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
2017-01-04checkpolicy: uprev to 2.6 (20161014)Wenzong Fan
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
2017-01-04libsemanage: uprev to 2.6 (20161014)Wenzong Fan
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
2017-01-04libselinux: uprev to 2.6 (20161014)Wenzong Fan
* rebase patch: - libselinux-make-O_CLOEXEC-optional.patch * cleanup patches: - libselinux-only-mount-proc-if-necessary.patch - libselinux-procattr-return-einval-for-0-pid.patch - libselinux-procattr-return-error-on-invalid-pid.patch * other fixes: - remove useless variables according to latest Makefile - update FILES_${PN}-python to match the installed file: '${libdir}/python2.7/site-packages/_selinux.so'. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
2017-01-04libsepol: uprev to 2.6 (20161014)Wenzong Fan
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
2017-01-04selinux: uprev include file to 20161014Wenzong Fan
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
2016-11-01iproute2: make packageconfig selinux workKai Kang
iproute2 calls command pkg-config to check whether libselinux exists then enable or disable selinux support. That makes packageconfig doesn't work. The packageconfig selinux is set by checking whether distro feature selinux exists in with-selinux.bbclass. Modify the configure result file with same criteria. Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-11-01libpcre_%.bbappend: add missing symlink libpcre.so.1Ioan-Adrian Ratiu
This bbappend moves sysroot lib libpcre.so.x.x.x from /usr/lib to /lib and symlinks /usr/lib/libpcre.so to ../../lib/libpcre.so.x.x.x, but this causes certain recipes dependent on libpcre (like pango) to fail because they also expect libpcre.so.1 to exist which this recipe omits to create. (the reason why the lib is moved in the first place is to avoid a QA issue because there's a risk for /usr to be on another partition) Signed-off-by: Ioan-Adrian Ratiu <adrian.ratiu@ni.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-10-27eudev: remove explicit setenforce call in initJoe MacDonald
When using udev-cache, the eudev init script had been explicitly calling 'setenforce 1'. That's no longer necessary with updates to other parts of eudev and the presence of the call prevented booting core-image-selinux* systems in permissive mode. Remove the call to allow permissive booting. [YOCTO #7506] Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-09-22dhcp: sync init-server with oe-coreWenzong Fan
oe-core commit: a162416119ec9deee9fef53455d1281abe573681 dhcpd: create dhcpd user for dhcp dameon Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-09-22selinux: update policy-version to 30Wenzong Fan
Both selinux 2.5 and kernel 4.8 support Max Policy Version 30. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-09-01refpolicy-minimum: systemd: fix for syslogShrikant Bobade
syslog & getty related allow rules required to fix the syslog mixup with boot log, while using systemd as init manager. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-09-01refpolicy-minimum: systemd: fix for systemd tmp-files servicesShrikant Bobade
fix for systemd tmp files setup services: systemd-journal-flush.service & systemd-logind.service. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-09-01refpolicy-minimum: systemd: fix for login & journal serviceShrikant Bobade
1. fix for systemd services: login & journal wile using refpolicy-minimum and systemd as init manager. 2. fix login duration after providing root password. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-09-01refpolicy-minimum: systemd: mount: enable required refpolicy booleansShrikant Bobade
enable required refpolicy booleans for these modules mount: allow_mount_anyfile & systemd:systemd_tmpfiles_manage_all Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-09-01refpolicy-minimum: init: fix reboot with systemd as init manager.Shrikant Bobade
add allow rule to fix avc denial during system reboot. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-09-01refpolicy-minimum: locallogin: add allow rules for type local_login_tShrikant Bobade
add allow rules for locallogin module avc denials. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-09-01refpolicy-minimum: systemd: mount: logging: authlogin: add allow rulesShrikant Bobade
add allow rules for avc denails for systemd, mount, logging & authlogin modules. without this change we are getting avc. denials from these modules. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-09-01refpolicy-minimum: audit: logging: getty: audit related allow rulesShrikant Bobade
add allow rules for audit.log file & resolve dependent avc denials. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-09-01refpolicy-minimum: systemd:unconfined:lib: add systemd services allow rulesShrikant Bobade
systemd allow rules for systemd service file operations: start, stop, restart & allow rule for unconfined systemd service. without this change we are geting avc denials and access denied to perform operations on service file. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-09-01refpolicy_common.inc: add refpolicy minimum banner at selinux config.Shrikant Bobade
Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-09-01selinux-labeldev: add systemd service file supportShrikant Bobade
add systemd service file for handling selinux labeldev, this change improves handling of systemd service functionality like:status check, debug etc. compared to sysvinit compatibility mode scripts. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-09-01selinux-autorelabel: add systemd service file supportShrikant Bobade
add systemd service file for handling selinux autorelabel, this change improves handling of systemd service functionality like:status check, re-run, debug etc. compared to sysvinit compatibility mode scripts. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-09-01selinux-init: add systemd service file supportShrikant Bobade
add systemd service file for handling selinux initialization, this change improves handling of systemd service functionality like:status check, debug etc. compared to sysvinit compatibility mode scripts. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-09-01selinux-initsh.inc: add systemd supportShrikant Bobade
add support for systemd service file and handling of script required by systemd service file. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-09-01audit: 2.5 -> 2.6.6Wang Xin
1) Upgrade audit from 2.5 to 2.6.6. 2) Modify audit-python.patch, since the data has changed. Signed-off-by: Wang Xin <wangxin2015.fnst@cn.fujitsu.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-08-09augeas: Move to meta-python optional layerJoe MacDonald
Augeas lives in meta-python, but meta-selinux shouldn't specifically require meta-python in every build, so make the bbappend optional using the standard mechanism already present in the layer.conf. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-08-08refpolicy-targeted: remove duplicate type rulesWenzong Fan
Remove duplicate type rules from init_t to init_script_file_type, they have been included by systemd policies. This also fixes the errors while installing modules for refpolicy-targeted if systemd support is enabled: | Conflicting type rules | Binary policy creation failed at line 327 of \ .../tmp/work/qemux86-poky-linux/refpolicy-targeted/git-r0/image\ /var/lib/selinux/targeted/tmp/modules/100/init/cil | Failed to generate binary | semodule: Failed! Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-07-07refpolicy: remove virtual prefix for runtime providersJoe MacDonald
In keeping with the approach of only providing a single default policy at runtime, we were originally using a virtual/refpolicy dependency and filling it with one of our specific refpolicy implementations. This works well enough for some package systems, but fails for others (specifically deb, possibly more). Since the intent was to only have one present in the default image anyway, we'll just throw out the 'virtual/' part of the RPROVIDES and related dependencies across the board. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-07-04README: update with systemd & virtual/refpolicy detailsShrikant Bobade
add init manager user guidelines and examples for using refpolicy with perticular version and type. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-06-22e2fsprogs: Update bbappendJoe MacDonald
e2fsprogs has been updated with oe-core commit f221f331704c0bdfc7c1dd361e666ce2158fe282 Update our bbappend accordingly. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com> Signed-off-by: Philip Tricca <flihp@twobit.us>
2016-06-16iproute2: fix qa warning by using with-selinuxShrikant Bobade
WARNING: iproute2-4.6.0-r0 do_package_qa: QA Issue: iproute2-ss rdepends on libselinux, but it isn't a build dependency, missing libselinux in DEPENDS or PACKAGECONFIG? [build-deps] Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-06-16packagegroup-selinux-policycoreutils: add policycoreutils-hllShrikant Bobade
we need policycoreutils-hll to insert custom policy module/package, without it semodule install fail with error: libsemanage.semanage_pipe_data: Unable to execute /usr/libexec/selinux/hll/ pp : No such file or directory libsemanage.semanage_direct_commit: Failed to compile hll files into cil files. (No such file or directory). semodule: Failed! Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-06-16sepolgen: inherit python-dirRobert Yang
Fixed: sepolgen-1.2.3: sepolgen: Files/directories were installed but not shipped in any package: /usr /usr/lib /usr/lib/python /usr/lib/python/site-packages /usr/lib/python/site-packages/sepolgen /usr/lib/python/site-packages/sepolgen/lex.py /usr/lib/python/site-packages/sepolgen/matching.py /usr/lib/python/site-packages/sepolgen/sepolgeni18n.py /usr/lib/python/site-packages/sepolgen/__init__.py /usr/lib/python/site-packages/sepolgen/classperms.py /usr/lib/python/site-packages/sepolgen/refparser.py /usr/lib/python/site-packages/sepolgen/module.py /usr/lib/python/site-packages/sepolgen/objectmodel.py /usr/lib/python/site-packages/sepolgen/interfaces.py /usr/lib/python/site-packages/sepolgen/access.py /usr/lib/python/site-packages/sepolgen/output.py /usr/lib/python/site-packages/sepolgen/refpolicy.py /usr/lib/python/site-packages/sepolgen/defaults.py /usr/lib/python/site-packages/sepolgen/audit.py /usr/lib/python/site-packages/sepolgen/yacc.py /usr/lib/python/site-packages/sepolgen/util.py /usr/lib/python/site-packages/sepolgen/policygen.py Please set FILES such that these items are packaged. Alternatively if they are unneeded, avoid installing them or delete them within do_install. sepolgen: 22 installed and not shipped files. [installed-vs-shipped] Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-06-16libsemanage: inherit python-dirRobert Yang
Fixed: semanageswig_wrap.c:147:21: fatal error: Python.h: No such file or directory Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-06-16eudev: add wildcard versionShrikant Bobade
eudev version at poky updated to v3.2 from v3.1.5, so moving it to use wildcard in order to fix the parsing error. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-05-27refpolicy_common.inc: enable conditional systemd supportShrikant Bobade
refpolicy now introduced systemd support using POLICY_SYSTEMD variable, with systemd enabled setup we need the refpolicy with systemd support, so enable systemd support based on DISTRO_FEATURES. Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-05-27refpolicy-minimum_2.20151208: add systemd dependent policy modulesShrikant Bobade
with systemd enabled refpolicy-minimum build breaks due to missing dependent policy modules, so add the dependent modules: clock, systemd, udev conditionally based on DISTRO_FEATURES. dependent systemd policy modules needed to fix these errors: * Failed to resolve 'adjtime_t' in typeattributeset statement at line 138 of .. modules/100/init/cil * Failed to resolve 'systemd_kmod_conf_t' in typeattributeset statement at line 141 of.. moules/100/init/cil * Failed to resolve 'udev_t' in typeattributeset statement at line 143 of modules/100/init/cil semodule: Failed! Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-05-27refpolicy-minimum_git: add systemd dependent policy modulesShrikant Bobade
with systemd enabled refpolicy-minimum build breaks due to missing dependent policy modules, so add the dependent modules: clock, systemd, udev conditionally based on DISTRO_FEATURES. dependent systemd policy modules needed to fix these errors: * Failed to resolve 'adjtime_t' in typeattributeset statement at line 138 of .. modules/100/init/cil * Failed to resolve 'systemd_kmod_conf_t' in typeattributeset statement at line 141 of.. moules/100/init/cil * Failed to resolve 'udev_t' in typeattributeset statement at line 143 of modules/100/init/cil semodule: Failed! Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-05-27libselinux_git: fix warnings of unavailable patchesShrikant Bobade
Drop unavailable patches entry to fix the warning, even we are using libselinux v2.5 these warnings pop-up during recipes parsing. WARNING:..libselinux_git.bb: Unable to get checksum for libselinux SRC_URI entry libselinux-get-pywrap-depends-on-selinux.py.patch: file could not be found WARNING:..libselinux_git.bb: Unable to get checksum for libselinux SRC_URI entry libselinux-mount-procfs-before-check.patch: file could not be found Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-04-20refpolicy_common: Use POLICY_NAME instaed of POLICY_TYPE for SELINUXTYPE in ↵Wenzong Fan
config. Signed-off-by: Philip Tricca <flihp@twobit.us>
2016-04-17refpolicy-minimum: port changes for prepare_policy_storeWenzong Fan
Apply the changes to refpolicy-minimum_2.20151208.bb: commit bfaf278116e6c3a04bb82c9f8a4f8629a0a85df8 Author: Wenzong Fan <wenzong.fan@windriver.com> Date: Tue Oct 27 06:25:04 2015 -0400 refpolicy-minimum: update prepare_policy_store * update prepare_policy_store() for supporting SELinux 2.4 & CIL, the logic is from refpolicy_common.inc but with minimum set of policy modules; * add extra policy modules that required by sysnetwork, without those modules the install process will fail with error: | Failed to resolve roletype statement at 62 of \ .../image/var/lib/selinux/minimum/tmp/modules/100/sysnetwork/cil | Failed to resolve ast | semodule: Failed! Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com> Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
2016-04-04refpolicy_common: Sanity test DEFAULT_ENFORCING value and set default.Philip Tricca
Use the anonymous python function to be sure the value set for 'SELINUX' in the config file is something useful. In the event that DEFAULT_ENFORCING isn't set to one of the 3 permissible values we set it to 'permissive'. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-04-04Integrate selinux-config into refpolicy_common.Philip Tricca
With the virutal package there's no need for a separate recipe to build the config. This can be generated and included as part of the policy package. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-04-04refpolicy: Setup virtual/refpolicy provider.Philip Tricca
This allows us to provide a default policy through the PREFERRED_PROVIDER mechanism for each of the example distro configs. Consumers of meta-selinux will be able to override this at the config level instead of having to depend on a specific policy package. We do lose the ability install more than one policy package but this falls in line with the embedded nature of the project. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-03-21refpolicy: Remove 2.20140311 release.Philip Tricca
Signed-off-by: Philip Tricca <flihp@twobit.us>
2016-03-21refpolicy: Replace 2.2014120 with release 2.20151208.Philip Tricca
This was mostly straight forward. Had to refresh a single patch: poky-policy-fix-new-SELINUXMNT-in-sys.patch Signed-off-by: Philip Tricca <flihp@twobit.us>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-05-04 16:47:45 +0000