diff options
| -rw-r--r-- | recipes-core/sysvinit/files/sysvinit-fix-is_selinux_enabled.patch | 71 | ||||
| -rw-r--r-- | recipes-core/sysvinit/sysvinit_2.9%.bbappend (renamed from recipes-core/sysvinit/sysvinit_2.88dsf.bbappend) | 2 | ||||
| -rw-r--r-- | recipes-core/sysvinit/sysvinit_selinux.inc (renamed from recipes-core/sysvinit/sysvinit-2.88dsf_selinux.inc) | 2 |
3 files changed, 1 insertions, 74 deletions
diff --git a/recipes-core/sysvinit/files/sysvinit-fix-is_selinux_enabled.patch b/recipes-core/sysvinit/files/sysvinit-fix-is_selinux_enabled.patch deleted file mode 100644 index 62703b1..0000000 --- a/recipes-core/sysvinit/files/sysvinit-fix-is_selinux_enabled.patch +++ /dev/null | |||
| @@ -1,71 +0,0 @@ | |||
| 1 | From 0db0276202094c8d902fc93a18eca453b6211f8a Mon Sep 17 00:00:00 2001 | ||
| 2 | From: Xin Ouyang <Xin.Ouyang@windriver.com> | ||
| 3 | Date: Thu, 12 Apr 2012 10:48:04 +0800 | ||
| 4 | Subject: [PATCH] sysvinit: Fix is_selinux_enabled() for libselinux | ||
| 5 | |||
| 6 | is_selinux_enabled()!=1 means SELinux is disabled by kernel | ||
| 7 | or SELinux is enabled but policy is not loaded. | ||
| 8 | Only at this time, /sbin/init program should call | ||
| 9 | selinux_init_load_policy() to detect whether SELinux is enabled | ||
| 10 | and to load SELinux policy. | ||
| 11 | |||
| 12 | This is fixed already in the upstream sysvinit, | ||
| 13 | http://svn.savannah.nongnu.org/viewvc/sysvinit/trunk/src/init.c?root=sysvinit&r1=72&r2=90 | ||
| 14 | --- | ||
| 15 | src/init.c | 33 +++++++++++++-------------------- | ||
| 16 | 1 files changed, 13 insertions(+), 20 deletions(-) | ||
| 17 | |||
| 18 | diff --git a/src/init.c b/src/init.c | ||
| 19 | index 27532ad..75ccf25 100644 | ||
| 20 | --- a/src/init.c | ||
| 21 | +++ b/src/init.c | ||
| 22 | @@ -54,10 +54,6 @@ | ||
| 23 | |||
| 24 | #ifdef WITH_SELINUX | ||
| 25 | # include <selinux/selinux.h> | ||
| 26 | -# include <sys/mount.h> | ||
| 27 | -# ifndef MNT_DETACH /* present in glibc 2.10, missing in 2.7 */ | ||
| 28 | -# define MNT_DETACH 2 | ||
| 29 | -# endif | ||
| 30 | #endif | ||
| 31 | |||
| 32 | #ifdef __i386__ | ||
| 33 | @@ -2869,22 +2865,19 @@ int main(int argc, char **argv) | ||
| 34 | |||
| 35 | #ifdef WITH_SELINUX | ||
| 36 | if (getenv("SELINUX_INIT") == NULL) { | ||
| 37 | - const int rc = mount("proc", "/proc", "proc", 0, 0); | ||
| 38 | - if (is_selinux_enabled() > 0) { | ||
| 39 | - putenv("SELINUX_INIT=YES"); | ||
| 40 | - if (rc == 0) umount2("/proc", MNT_DETACH); | ||
| 41 | - if (selinux_init_load_policy(&enforce) == 0) { | ||
| 42 | - execv(myname, argv); | ||
| 43 | - } else { | ||
| 44 | - if (enforce > 0) { | ||
| 45 | - /* SELinux in enforcing mode but load_policy failed */ | ||
| 46 | - /* At this point, we probably can't open /dev/console, so log() won't work */ | ||
| 47 | - fprintf(stderr,"Unable to load SELinux Policy. Machine is in enforcing mode. Halting now.\n"); | ||
| 48 | - exit(1); | ||
| 49 | - } | ||
| 50 | - } | ||
| 51 | - } | ||
| 52 | - if (rc == 0) umount2("/proc", MNT_DETACH); | ||
| 53 | + if (is_selinux_enabled() != 1) { | ||
| 54 | + if (selinux_init_load_policy(&enforce) == 0) { | ||
| 55 | + putenv("SELINUX_INIT=YES"); | ||
| 56 | + execv(myname, argv); | ||
| 57 | + } else { | ||
| 58 | + if (enforce > 0) { | ||
| 59 | + /* SELinux in enforcing mode but load_policy failed */ | ||
| 60 | + /* At this point, we probably can't open /dev/console, so log() won't work */ | ||
| 61 | + fprintf(stderr,"Unable to load SELinux Policy. Machine is in enforcing mode. Halting now.\n"); | ||
| 62 | + exit(1); | ||
| 63 | + } | ||
| 64 | + } | ||
| 65 | + } | ||
| 66 | } | ||
| 67 | #endif | ||
| 68 | /* Start booting. */ | ||
| 69 | -- | ||
| 70 | 1.7.5.4 | ||
| 71 | |||
diff --git a/recipes-core/sysvinit/sysvinit_2.88dsf.bbappend b/recipes-core/sysvinit/sysvinit_2.9%.bbappend index 9df30b6..4ec2267 100644 --- a/recipes-core/sysvinit/sysvinit_2.88dsf.bbappend +++ b/recipes-core/sysvinit/sysvinit_2.9%.bbappend | |||
| @@ -1 +1 @@ | |||
| require ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'sysvinit-2.88dsf_selinux.inc', '', d)} | require ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'sysvinit_selinux.inc', '', d)} | ||
diff --git a/recipes-core/sysvinit/sysvinit-2.88dsf_selinux.inc b/recipes-core/sysvinit/sysvinit_selinux.inc index fcfbdb7..2e54330 100644 --- a/recipes-core/sysvinit/sysvinit-2.88dsf_selinux.inc +++ b/recipes-core/sysvinit/sysvinit_selinux.inc | |||
| @@ -2,8 +2,6 @@ FILESEXTRAPATHS_prepend := "${THISDIR}/files:" | |||
| 2 | 2 | ||
| 3 | B = "${S}" | 3 | B = "${S}" |
| 4 | 4 | ||
| 5 | SRC_URI += "file://sysvinit-fix-is_selinux_enabled.patch" | ||
| 6 | |||
| 7 | inherit selinux | 5 | inherit selinux |
| 8 | 6 | ||
| 9 | DEPENDS += "${LIBSELINUX}" | 7 | DEPENDS += "${LIBSELINUX}" |
