aboutsummaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2019-04-15libselinux.inc: Add python-shell to libselinux-python RDEPENDS.master-nextChris PeBenito
The libselinux SWIG wrapper imports shutil. Signed-off-by: Chris PeBenito <Christopher.PeBenito@microsoft.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2019-04-15audit: change to use ${WORKDIR} instead ${S}/../Chen Qi
The do_install function is assuming that ${S}/../ is ${WORKDIR}, but this is not true when using `devtool modify audit'. So change to use ${WORKDIR}. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2019-04-14setools: fix build failure with gcc 7Kai Kang
Backport patch from setools upstream to fix build failure with GCC 7 due to possible truncation of snprintf output. It could be reproduced on 64 bit bsps such as qemux86-64 and qemumips64 with configs: SELECTED_OPTIMIZATION = "${DEBUG_OPTIMIZATION}" DEBUG_BUILD = "1" Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2019-04-14layer.conf: update to warrior release name seriesKai Kang
Sync with oe-core to update to warrior release name series. Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2019-04-14selinux: remove git versionYi Zhao
The git version of libselinux libsemanage libsepol checkpolicy and policycoreutils are far behind the master branch and now they can not build due to the do_patch error. The current stable 2.8 version works well so we can remove them. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2019-04-14packagegroup-selinux-minimal: add selinux-initLuca Boccassi
When trying to build a minimal image (eg: without python), the default user on autologin is not mapped to the intended user/role/domain: # id -Z system_u:system_r:kernel_t:s0 And the following error is displayed on autologin: Unable to get valid context for <user> While on an image built with the core-selinux packagegroup: # id -Z unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 Adding selinux-init to the minimal package list fixes the issue. This package does not seem to bring along additional dependencies. Signed-off-by: Luca Boccassi <bluca@debian.org> Signed-off-by: Joe MacDonald <joe@deserted.net>
2019-04-14libpcre: do no create links when compiling for windowsSinan Kaya
lipcre-native is trying to create symbolic links to so files when used with meta-mingw. Remove this condition for mingw builds. Signed-off-by: Sinan Kaya <okaya@kernel.org> Signed-off-by: Joe MacDonald <joe@deserted.net>
2019-04-14selinux-image.bbclass: using append instead of += for IMAGE_PREPROCESS_COMMANDYi Zhao
Fix AVC denied error when booting: type=AVC msg=audit(1548055920.478:86): avc: denied { execute } for pid=366 comm="audispd" path="/lib/ld-2.28.so" dev="vda" ino=7545 scontext=system_u:system_r:audisp_t:s15:c0.c1023 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file permissive=1 type=AVC msg=audit(1548055920.478:87): avc: denied { open } for pid=366 comm="audispd" path="/lib/libc-2.28.so" dev="vda" ino=7558 scontext=system_u:system_r:audisp_t:s15:c0.c1023 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file permissive=1 When using "+=" for IMAGE_PREPROCESS_COMMAND, the selinux_set_labels process would run before prelink process to set the security labels for the files. But the label for /lib/libc-2.28.so and /lib/ld-2.28.so would be changed after run prelink process. Use "_append" to make sure the selinux_set_labels process run after prelink process. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2019-04-14openssh: update sshd_configYi Zhao
Update sshd_config based on openssh 7.9p1. Drop the deprecated option UsePrivilegeSeparation Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2019-04-14core-image-selinux.bb: remove trailing whitespaceYi Zhao
Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2019-04-12refpolicy: update to 2.20190201 and git HEAD policiesJoe MacDonald
Additionally, the README has fallen out of date, update it to reflect the current reality of layer dependencies. Signed-off-by: Joe MacDonald <joe@deserted.net>
2019-03-25Backport patches from upstream to fix build with muslLuca Boccassi
Audit 2.8.4 fails to build with musl. The fixes have been committed to the upstream master branch and can be backported. Building with glibc is unaffected. Signed-off-by: Luca Boccassi <luca.boccassi@microsoft.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2019-03-25meson-selinux.bbclass: add for meson build systemKai Kang
Add meson-selinux.bbclass for meson build system. It used '-Dselinux=true/false' to enable/disable 'selinux' rather than --enable-selinux or --with-selinux. Inherit meson-selinux for glib-2.0 to fix configure failure. Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2019-03-22linux-yocto: add bbappend for kernel 5.0Yi Zhao
Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2018-10-30refpolicy: fix up all refpolicy 20170224 builds for current masterJoe MacDonald
Signed-off-by: Joe MacDonald <joe@deserted.net>
2018-10-23refpolicy_git.inc: lock SRCREVs on the actual version hashesAwais Belal
Using AUTOREV in the main repository has its downsides. 1. The checked out version isn't actually the version depicted by PV. 2. Breaks builds in scenarios where network isn't available or BB_NO_NETWORK is used even after sources are already fetched. 1 is self explanatory, for 2 whenever SRCREV is set to AUTOREV and SRCPV is used in PV the fetcher tries to access the network in order to determine SRCPV (bb.fetch2.get_srcrev) and fails for obvious reasons during parsing even when versioned recipes are used as PREFERRED_VERSION because parsing still happens for recipes that are in BB's search paths and we see. Traceback (most recent call last): bb.data_smart.ExpansionError: Failure expanding variable SRCPV, expression was ${@bb.fetch2.get_srcrev(d)} which triggered exception NetworkAccess: Network access disabled through BB_NO_NETWORK (or set indirectly due to use of BB_FETCH_PREMIRRORONLY) but access requested with command git -c core.fsyncobjectfiles=0 ls-remote git://github.com/TresysTechnology/refpolicy.git (for url git://github.com/TresysTechnology/refpolicy.git) So we lock the REVs and do that with a soft assignment which allows overriding the REVs from elsewhere. Signed-off-by: Awais Belal <awais_belal@mentor.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2018-10-23libpcre_selinux.inc: fix do_install failure if .so file does not existChen Qi
In case of the existence of meta-mingw, the library is .dll instead of .so and these .dll files are in ${bindir}. We need to check the existence of the .so file before doing readlink, otherwise do_install fails. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2018-10-23libselinux: Fix build with musl libc.Piotr Tworek
Musl libc does not implement file traversal functions from fts.h. Oe-core provides fts library which implements those. Libselinux makefile allows us to use such additional library by specifying required linker flags via FTS_LDLIBS variable. Signed-off-by: Piotr Tworek <tworaz666@gmail.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2018-10-23setools: Add missing python runtime deps.Piotr Tworek
The package needs logging, json and argparse modules to start. Additionaly, it also needs libselinux-python in order to really work. Without it it'll just print an error message instructing the user to install it. Signed-off-by: Piotr Tworek <tworaz666@gmail.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2018-10-22layer.conf: update LAYERSERIES_COMPAT `sumo' -> `thud'Hongxu Jia
Since `9ec5a8a layer.conf: Drop sumo from LAYERSERIES_CORENAMES' and `9867924 layer.conf: Add thud to LAYERSERIES_CORENAMES' applied in oe-core, update LAYERSERIES_COMPAT `sumo' -> `thud' Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2018-09-09policycorutils: package files in base_sbindir.Eric Chanudet
SBINDIR was changed to ${base_sbindir} in commit: 8cc9c17 policycoreutils: fix installed-but-not-shipped on updated recipes FILES_${PN}-* must now capture files installed in ${base_sbindir} accordingly. Signed-off-by: Eric Chanudet <chanudete@ainfosec.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
2018-09-07policycoreutils: fix installed-but-not-shipped on updated recipesJoe MacDonald
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2018-09-07audit: uprev to 2.8.4Yi Zhao
Add aarch64 support Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2018-09-07packagegroup-selinux-policycoreutils: remove semodule-utils-semodule-depsYi Zhao
Remove package semodule-utils-semodule-deps as it had been removed upstream. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2018-09-07selinux-gui: uprev to 2.8 (20180524)Yi Zhao
Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2018-09-07selinux-dbus: uprev to 2.8 (20180524)Yi Zhao
Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2018-09-07semodule-utils: uprev to 2.8 (20180524)Yi Zhao
Remove package semodule-deps as it had been removed upstream. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2018-09-07selinux-python: uprev to 2.8 (20180524)Yi Zhao
Rebase patch: fix-sepolicy-install-path.patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2018-09-07selinux-sandbox: uprev to 2.8 (20180524)Yi Zhao
Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2018-09-07restorecond: uprev to 2.8 (20180524)Yi Zhao
Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2018-09-07mcstrans: uprev to 2.8 (20180524)Yi Zhao
Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2018-09-07policycoreutils: uprev to 2.8 (20180524)Yi Zhao
Remove unused patch: policycoreutils-loadpolicy-symlink.patch Add the following patches to change commands path for backward compatibility: policycoreutils-fix-fixfiles-install-path.patch policycoreutils-fix-fixfiles-install-path.patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2018-09-07secilc: uprev to 2.8 (20180524)Yi Zhao
Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2018-09-07checkpolicy: uprev to 2.8 (20180524)Yi Zhao
Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2018-09-07libsemanage: uprev to 2.8 (20180524)Yi Zhao
Rebase patch: 0001-src-Makefile-fix-includedir-in-libselinux.pc.patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2018-09-07libselinux: uprev to 2.8 (20180524)Yi Zhao
Rebase patch: 0001-src-Makefile-fix-includedir-in-libselinux.pc.patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2018-09-07libsepol: uprev to 2.8 (20180524)Yi Zhao
Rebase patch: 0001-src-Makefile-fix-includedir-in-libsepol.pc.patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2018-09-07selinux: uprev inc files to 2.8 (20180524)Yi Zhao
Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2018-09-07libselinux: fix usrmerge do_installMingli Yu
When usrmerge enabled in DISTRO_FEATURES, the binary actually installed under ${base_sbindir}, so cannot remove ${D}${base_sbindir} when usrmerge enabled. Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2018-09-07policycoreutils: fix usrmerge install pathMingli Yu
Set SBINDIR to ${base_sbindir} to fix below issue when usrmerge enabled in DISTRO_FEATURES | ERROR: QA Issue: policycoreutils-dbg package is not obeying usrmerge distro feature. /sbin should be relocated to /usr. [usrmerge] | WARNING: policycoreutils-2.7-r0 do_package: QA Issue: policycoreutils: Files/directories were installed but not shipped in any package: /sbin/restorecon /sbin/setfiles /sbin/load_policy /sbin/restorecon_xattr /sbin/fixfiles Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2018-08-17mcstrans: define SBINDIR to ${D}/${base_sbindir}Mingli Yu
Add SBINDIR=${D}/${base_sbindir} to EXTRA_OEMAKE to fix below error when usrmerge enabled in DISTRO_FEATURES. ERROR: QA Issue: mcstrans-dbg package is not obeying usrmerge distro feature. /sbin should be relocated to /usr. [usrmerge] Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2018-08-17policycoreutils: add PACKAGECONFIG for libpam, auditWenzong Fan
* make pam and audit support configurable; * remove INITDIR from EXTRA_OEMAKE, the variable is not supported now. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2018-08-17selinux-python: fix installed-vs-shipped QA errorsWenzong Fan
Fix the QA errors when enable multilib: ERROR: selinux-python-2.7-r0 do_package: QA Issue: selinux-python: Files/directories were installed but not shipped in any package: /usr/lib /usr/lib/python2.7 /usr/lib/python2.7/site-packages /usr/lib/python2.7/site-packages/sepolicy-1.1.egg-info [snip] Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2018-08-16README: Document setting PREFERRED_VERSION for refpolicyKhem Raj
When setting preferred version for a given refpolicy we also need to set the PV for refpolicy recipe since its part of the selinux packagegroup and will silently use git version Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2018-08-14libcgroup: replace _virtclass-native with _class-nativeYi Zhao
The _virtclass-native is obsolete. Replace it with _class-native. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2018-08-14policycoreutils: replace _virtclass-native with _class-nativeYi Zhao
The _virtclass-native is obsolete and replaced by _class-native. In recent oe-core commit c5aa33ac483618bc23fbaccb0a18853186f9155d the _virtclass-native override was dropped entirely which caused refpolicy-mls do_install failed: libsemanage.get_home_dirs: Error while fetching users. Returning list so far. libsemanage.semanage_validate_and_compile_fcontexts: setfiles returned error code 1. (No such file or directory). Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2018-08-13selinux-python: refresh patches to fix QA warningYi Zhao
Refresh patches with devtool command to fix do_patch warning Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2018-08-13semodule-utils: resolve dependency error for semodule-utils when building SDKJoe MacDonald
Based on the discussion here: https://www.mail-archive.com/yocto@yoctoproject.org/msg40561.html This should fix the error encountered when building an SDK: nothing provides semodule-utils = 2.7-r0 needed by semodule-utils-dev-2.7-r0.core2-32 Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2018-08-13busybox: fix usrmerge installIoan-Adrian Ratiu
If DISTRO_FEATURES contains usrmerge then busybox binaries are installed under /usr/bin not /bin so use ${base_bindir} to support both paths and avoid QA errors. Signed-off-by: Ioan-Adrian Ratiu <adrian.ratiu@ni.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2018-08-13e2fsprogs: Update patch for current masterJeremy Puhlman
Signed-off-by: Jeremy Puhlman <jpuhlman@mvista.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-05-01 08:11:03 +0000