diff options
| author | Yi Zhao <yi.zhao@windriver.com> | 2019-06-26 12:43:58 +0800 |
|---|---|---|
| committer | Jia Zhang <zhang.jia@linux.alibaba.com> | 2019-06-26 13:05:38 +0800 |
| commit | 392371e4b0e9edd51d3b86edc988e543874be5ed (patch) | |
| tree | 446349769140dc93095e48860af54dfcd1c8e10f | |
| parent | 06f4d3eece142e41a45538ca9ea9c9d60cf4551a (diff) | |
| download | meta-secure-core-392371e4b0e9edd51d3b86edc988e543874be5ed.tar.gz | |
util-linux: only apply the bbappend if ima distro flag set
Run yocto-check-layer-wrapper to check layer compliance of Yocto will report the signatures error:
util-linux:do_compile: 9c04caa1d37ca0fa0caa2f48a01912d1b3d35de2ac668c4cddd6158bbac9c374 ->
53de68708253461d617177c02a60d0e798f5f7727c14cc8e6b9a8bbedc53de99
bitbake-diffsigs --task util-linux do_compile --signature
9c04caa1d37ca0fa0caa2f48a01912d1b3d35de2ac668c4cddd6158bbac9c374
53de68708253461d617177c02a60d0e798f5f7727c14cc8e6b9a8bbedc53de99
Rename util-linux_%.bbappend to util-linux-integrity.inc and add a new
bbappend. Make sure this piece of code should be applied only if the ima
feature is set.
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
| -rw-r--r-- | meta-integrity/recipes-core/util-linux/util-linux-integrity.inc | 19 | ||||
| -rw-r--r-- | meta-integrity/recipes-core/util-linux/util-linux_%.bbappend | 20 |
2 files changed, 20 insertions, 19 deletions
diff --git a/meta-integrity/recipes-core/util-linux/util-linux-integrity.inc b/meta-integrity/recipes-core/util-linux/util-linux-integrity.inc new file mode 100644 index 0000000..d3d498e --- /dev/null +++ b/meta-integrity/recipes-core/util-linux/util-linux-integrity.inc | |||
| @@ -0,0 +1,19 @@ | |||
| 1 | CFLAGS_remove += "-pie -fpie" | ||
| 2 | |||
| 3 | # We need -no-pie in case the default is to generate pie code. | ||
| 4 | # | ||
| 5 | do_compile_append_class-target() { | ||
| 6 | ${CC} ${CFLAGS} ${LDFLAGS} -no-pie -static \ | ||
| 7 | sys-utils/switch_root.o \ | ||
| 8 | -o switch_root.static | ||
| 9 | } | ||
| 10 | |||
| 11 | do_install_append_class-target() { | ||
| 12 | install -d "${D}${sbindir}" | ||
| 13 | install -m 0700 "${B}/switch_root.static" \ | ||
| 14 | "${D}${sbindir}/switch_root.static" | ||
| 15 | } | ||
| 16 | |||
| 17 | PACKAGES =+ "${PN}-switch-root.static" | ||
| 18 | |||
| 19 | FILES_${PN}-switch-root.static = "${sbindir}/switch_root.static" | ||
diff --git a/meta-integrity/recipes-core/util-linux/util-linux_%.bbappend b/meta-integrity/recipes-core/util-linux/util-linux_%.bbappend index d3d498e..e6f8378 100644 --- a/meta-integrity/recipes-core/util-linux/util-linux_%.bbappend +++ b/meta-integrity/recipes-core/util-linux/util-linux_%.bbappend | |||
| @@ -1,19 +1 @@ | |||
| 1 | CFLAGS_remove += "-pie -fpie" | require ${@bb.utils.contains('DISTRO_FEATURES', 'ima', 'util-linux-integrity.inc', '', d)} | |
| 2 | |||
| 3 | # We need -no-pie in case the default is to generate pie code. | ||
| 4 | # | ||
| 5 | do_compile_append_class-target() { | ||
| 6 | ${CC} ${CFLAGS} ${LDFLAGS} -no-pie -static \ | ||
| 7 | sys-utils/switch_root.o \ | ||
| 8 | -o switch_root.static | ||
| 9 | } | ||
| 10 | |||
| 11 | do_install_append_class-target() { | ||
| 12 | install -d "${D}${sbindir}" | ||
| 13 | install -m 0700 "${B}/switch_root.static" \ | ||
| 14 | "${D}${sbindir}/switch_root.static" | ||
| 15 | } | ||
| 16 | |||
| 17 | PACKAGES =+ "${PN}-switch-root.static" | ||
| 18 | |||
| 19 | FILES_${PN}-switch-root.static = "${sbindir}/switch_root.static" | ||
