aboutsummaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2013-01-05packages: inherit enable-selinuxXin Ouyang
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2013-01-05layer: add selinux/audit bbclassesXin Ouyang
Add bbclasses only for target packages to enable selinux support, not native/nativesdk/cross/crosssdk pacakges. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2013-01-05selinux packages: create include files.Xin Ouyang
Create include files for selinux userspace packages: * checkpolicy.inc * libselinux.inc * libsemanage.inc * libsepol.inc * policycoreutils.inc * sepolgen.inc Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-12-25libsemanage: fix path length limits.Xin Ouyang
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-12-20sed: fix parallel compile error with libselinuxXin Ouyang
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-12-12policycoreutils: install init script under /etc/init.d/Roy.Li
Signed-off-by: Roy.Li <rongqing.li@windriver.com> Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-12-05libcgroup: fix hard coded /lib to ${base_libdir}Xin Ouyang
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-11-30checkpolicy+libsemanage: flex+bison native dependsXin Ouyang
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-11-27refpolicy: standard/mls policy should set UBAC=nXin Ouyang
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-11-27refpolicy: fix policy to allow nfsd works.Xin Ouyang
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-11-19selinux-config: update the init scriptXin Ouyang
Fix the hard-coded security type for /dev/null and /dev/console. Check rootfs if support xattrs before do relabel. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-11-12refpolicy*: make to use pythonnativeXin Ouyang
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-11-07libcgroup: add bbappend and remove bb filesXin Ouyang
libcgroup is placed in oe-core now. http://git.openembedded.org/openembedded-core/commit/?id=6ef8e6f2f9b0583fa0881e0dfc52462405b21ede So remove bb files from meta-selinux and add bbappend. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-11-01policycoreutils: backport to remove empty po filesXin Ouyang
et, gl, and id .po files contained no translations. This can cause build errors. Delete those puppies. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-10-18kernel: default enable selinux for this layer.Xin Ouyang
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-10-18setools: add libxml2 DEPENDS.Xin Ouyang
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-10-18openssl: disable execstack in CFLAGXin Ouyang
"-Wa,--noexecstack" will mark objects as requiring executable stack, this is a dangerous CFLAG and would cause security issues. So disable it as most distros did. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-10-18selinux-config: add init scriptXin Ouyang
This script will be installed as 0selinux-init, in runlevel S and sequence number 0. It will start before any other init script. * relabel /dev for restorecon/fixfiles running * rebuild policy and relabel the rootfs if /.autorelabel placed. * relabel the rootfs if it is first booting. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-10-18document: add FAQ file for selinuxXin Ouyang
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-10-18core-image-selinux: update task-* to packagegroup-*Xin Ouyang
oe-core has changed task-* recipes to packagegroup-*, so we should follow this. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-10-18tinylogin: create script wrappers for selinuxXin Ouyang
Symlink can not execute will security contexts, so create script wrappers for tinylogin commands instead of symlinks. Also add tinylogin's login command as a alternative. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-10-18lsof: version 4.86 for oe-core uprev.Xin Ouyang
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-10-18udev: initscript restore security context for /devXin Ouyang
Poky/oe-core has set CONFIG_DEVTMPFS_MOUNT=y for kernel to mount /dev with devtmpfs itself. With MLS policy, kernel is running in s15:c0.c1023 level, so /dev will be relabeled to this high level too. This will cause processes running with low levels can not visit /dev directory. So, we just run restorecon /dev to fix this. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-10-18sysklogd: initscripts restorecon for log devicesXin Ouyang
sysklogd would create /dev/log and create log files in /var/log with the default security contexts while starting. So we should restore the correct security contexts. The initscript file is from oe-core, and add these lines after the start action. test ! -x /sbin/restorecon || \ /sbin/restorecon -R /dev/log /var/log/ Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-10-18initscripts: restorecon after populate-volatileXin Ouyang
populate-volatile.sh creates new directories in /var/volatile/ while booting, so we should restore the security contexts in it. Also touch /var/log/lastlog to set correct security contexts. populate-volatile.sh is imported for oe-core, and add these two lines at the end. touch /var/log/lastlog test ! -x /sbin/restorecon || /sbin/restorecon -R /var/volatile/ Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-10-18libpam: add pam-plugin-selinux to RDEPENDSXin Ouyang
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-10-18shadow: pam config for login to use pam_selinux moduleXin Ouyang
login should use pam_selinux module to label security contexts of processes while login into system. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-10-18policycoreutils: add pam config for newrole/run_initXin Ouyang
Also fix missing RDEPENDS for setools-* Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-10-18openssh: enable pam and selinux.Xin Ouyang
sshd_config file from oe-core to set "UsePAM yes". sshd file (pam config for sshd) from oe-core to add pam_selinux module. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-10-18refpolicy: xconsole_device_t as a dev_nodeXin Ouyang
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-10-18refpolicy: add poky specific rules for packages.Xin Ouyang
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-10-18refpolicy: Fix specific file contexts for pokyXin Ouyang
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-10-18refpolicy: uprev to version 2.20120725.Xin Ouyang
Patches are migrated or droped for new version. * poky-fc-etc_init.d.patch: droped because file_contexts.subs_dist is defined to instead. * fix-mount-to-write-mountpoints-dirs.patch: droped because the rules is not needed now. * poky-fc-update-alternatives_sysvinit.patch: migrated. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-10-15libcap-ng: pythonnative, add swig-native dependXin Ouyang
libcap-ng need native python while do_configure, and native swig while do_compile, so add them. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-10-11policycoreutils: disable QA checkes for fixfiles.Xin Ouyang
fixfiles in /sbin would run some /usr/bin binaries to cause these QA warnings. WARNING: Shell scripts in base_bindir and base_sbindir should not reference anything in exec_prefix Since fixfiles is installed into /sbin in most Linux distros, changing this path may cause runtime errors for some hard coded binaries. So, disable unsafe-references-in-scripts QA checkes. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-10-11audit: fix package issues.Xin Ouyang
Rename two packages and change files in them. * audit-libs -> audit : main package, for libraries * audit -> auditd : for daemon binaries Libraries are changed to install into ${base_libdir}. The two fixes are used to fix QA issues and fit the Debian policy. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-10-09libselinux: fix Public Domain license warning.Xin Ouyang
The "Public Domain" license now has a common license file placed as PD in Poky/oe-core, so fix this. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-09-26selinux recipes: inherit pythonnativeXin Ouyang
With new changes in oe-core, recipes which need python-native should "inherit pythonnative". Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-09-24policycoreutils: fix build with pam DISTRO_FEATUREXin Ouyang
If no pam DISTRO_FEATURE, policycoreutils should not build with libpam headers and libraries. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-09-20setools: inherit pythonnativeXin Ouyang
With new changes in oe-core, recipes which need python-native should "inherit pythonnative". Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-09-07audit-2.2.1: copy bits/socket_type.h only if it existsXin Ouyang
eglibc-2.16 splits enum __socket_type from bits/socket.h to bits/socket_type.h, so old eglibc does not have bits/socket_type.h We should copy it only if it exists. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-08-21rpm: fix depend for selinux enabledXin Ouyang
The depends should be: libsepol -> libselinux -> libsemanage -> rpm Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-08-21pam-1.1.6: fix wrong path for sepermit moduleXin Ouyang
Fix this error: =================== | mkdir -p /var/run/sepermit | mkdir: cannot create directory `/var/run/sepermit': Permission denied Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-08-21selinux-task: add necessary packages for selinuxXin Ouyang
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-08-20libpam: change to 1.1.6 for poky master.Xin Ouyang
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-08-17policycoreutils: rewrite DEPENDS for libcap-ng&libcgroup&pamXin Ouyang
EXTRA_DEPENDS is still not null while building native packages, this will add useless depends for libcap-ng&libcgroup&pam and cause build errors. So rewrite these DEPENDS. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-08-17libselinux: Fix indent warning for python codes.Xin Ouyang
Fix these warnings: =================== WARNING: Variable get_git_policyconfigarch contains tabs, please remove these(....) Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-08-17audit-2.2.1: Add bits/socket_type.h from target libc-headers.Xin Ouyang
We have copied some target kernel headers in 72fb6da. We may get build failures because of missing bits/socket_type.h on some hosts, so add it. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-08-13findutils-4.4.2: suitable version of gnulib for selinuxXin Ouyang
Add a suitable version of gnulib into SRC_URI, and run import-gnulib.sh to update it. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
2012-08-10Fetch selinux-at module from gnulib repoAws Ismail
[ CQID: WIND00365962 ] Rather than following the approach in findutils-with-selinux-gnulib.patch, the import-gnulib configuration was modified to enable fetching the latest updates related to selinux support. Specifically, selinux-at module is now in fetched in gnulib in order for it be used by findutils if selinux is enabled. Signed-off-by: Aws Ismail <aws.ismail@windriver.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-06-23 15:27:33 +0000