diff options
author | Yi Zhao <yi.zhao@windriver.com> | 2019-01-25 15:39:41 +0800 |
---|---|---|
committer | Joe MacDonald <joe@deserted.net> | 2019-04-14 17:08:54 -0400 |
commit | 3f850b745ca5a640a38516fce5393318cc78cacc (patch) | |
tree | 82b33d9bd77ea374c41a7112d2eb1ee9177f0adc /classes | |
parent | 00374b531716d368530d6c4d1af03276976c2216 (diff) | |
download | meta-selinux-3f850b745ca5a640a38516fce5393318cc78cacc.tar.gz |
selinux-image.bbclass: using append instead of += for IMAGE_PREPROCESS_COMMAND
Fix AVC denied error when booting:
type=AVC msg=audit(1548055920.478:86): avc: denied { execute } for
pid=366 comm="audispd" path="/lib/ld-2.28.so" dev="vda" ino=7545
scontext=system_u:system_r:audisp_t:s15:c0.c1023
tcontext=system_u:object_r:unlabeled_t:s0 tclass=file permissive=1
type=AVC msg=audit(1548055920.478:87): avc: denied { open } for
pid=366 comm="audispd" path="/lib/libc-2.28.so" dev="vda" ino=7558
scontext=system_u:system_r:audisp_t:s15:c0.c1023
tcontext=system_u:object_r:unlabeled_t:s0 tclass=file permissive=1
When using "+=" for IMAGE_PREPROCESS_COMMAND, the selinux_set_labels
process would run before prelink process to set the security labels for
the files. But the label for /lib/libc-2.28.so and /lib/ld-2.28.so would
be changed after run prelink process. Use "_append" to make sure the
selinux_set_labels process run after prelink process.
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Joe MacDonald <joe@deserted.net>
Diffstat (limited to 'classes')
-rw-r--r-- | classes/selinux-image.bbclass | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/classes/selinux-image.bbclass b/classes/selinux-image.bbclass index 5174dc5..7f157d3 100644 --- a/classes/selinux-image.bbclass +++ b/classes/selinux-image.bbclass | |||
@@ -10,6 +10,6 @@ selinux_set_labels () { | |||
10 | 10 | ||
11 | DEPENDS += "policycoreutils-native" | 11 | DEPENDS += "policycoreutils-native" |
12 | 12 | ||
13 | IMAGE_PREPROCESS_COMMAND += "selinux_set_labels ;" | 13 | IMAGE_PREPROCESS_COMMAND_append = " selinux_set_labels ;" |
14 | 14 | ||
15 | inherit core-image | 15 | inherit core-image |