1 files changed, 82 insertions, 36 deletions

diff --git a/recipes-security/refpolicy/refpolicy_common.inc b/recipes-security/refpolicy/refpolicy_common.inc
index 1d9ca93..46cbfa3 100644
--- a/recipes-security/refpolicy/refpolicy_common.inc
+++ b/recipes-security/refpolicy/refpolicy_common.inc
@@ -18,41 +18,87 @@ SRC_URI += "file://customizable_types  \
 # refpolicy should provide a version of these and place them in your own
 # refpolicy-${PV} directory.
 SRC_URI += " \
-        file://0001-fc-subs-volatile-alias-common-var-volatile-paths.patch \
-        file://0002-fc-subs-busybox-set-aliases-for-bin-sbin-and-usr.patch \
-        file://0003-fc-sysklogd-apply-policy-to-sysklogd-symlink.patch \
-        file://0004-fc-hostname-apply-policy-to-common-yocto-hostname-al.patch \
-        file://0005-fc-bash-apply-usr-bin-bash-context-to-bin-bash.bash.patch \
-        file://0006-fc-resolv.conf-label-resolv.conf-in-var-run-properly.patch \
-        file://0007-fc-login-apply-login-context-to-login.shadow.patch \
-        file://0008-fc-bind-fix-real-path-for-bind.patch \
-        file://0009-fc-hwclock-add-hwclock-alternatives.patch \
-        file://0010-fc-dmesg-apply-policy-to-dmesg-alternatives.patch \
-        file://0011-fc-ssh-apply-policy-to-ssh-alternatives.patch \
-        file://0012-fc-sysnetwork-apply-policy-to-ip-alternatives.patch \
-        file://0013-fc-udev-apply-policy-to-udevadm-in-libexec.patch \
-        file://0014-fc-rpm-apply-rpm_exec-policy-to-cpio-binaries.patch \
-        file://0015-fc-su-apply-policy-to-su-alternatives.patch \
-        file://0016-fc-fstools-fix-real-path-for-fstools.patch \
-        file://0017-policy-module-logging-Add-the-syslogd_t-to-trusted-o.patch \
-        file://0018-policy-module-logging-add-rules-for-the-symlink-of-v.patch \
-        file://0019-policy-module-logging-add-rules-for-syslogd-symlink-.patch \
-        file://0020-policy-module-logging-add-domain-rules-for-the-subdi.patch \
-        file://0021-policy-module-files-add-rules-for-the-symlink-of-tmp.patch \
-        file://0022-policy-module-terminals-add-rules-for-bsdpty_device_.patch \
-        file://0023-policy-module-terminals-don-t-audit-tty_device_t-in-.patch \
-        file://0024-policy-module-rpc-allow-nfsd-to-exec-shell-commands.patch \
-        file://0025-policy-module-rpc-fix-policy-for-nfsserver-to-mount-.patch \
-        file://0026-policy-module-sysfs-fix-for-new-SELINUXMNT-in-sys.patch \
-        file://0027-policy-module-rpc-allow-sysadm-to-run-rpcinfo.patch \
-        file://0028-policy-module-userdomain-fix-selinux-utils-to-manage.patch \
-        file://0029-policy-module-selinuxutil-fix-setfiles-statvfs-to-ge.patch \
-        file://0030-policy-module-admin-fix-dmesg-to-use-dev-kmsg-as-def.patch \
-        file://0031-policy-module-ftp-add-ftpd_t-to-mls_file_write_all_l.patch \
-        file://0032-policy-module-init-update-for-systemd-related-allow-.patch \
-        file://0033-refpolicy-minimum-make-sysadmin-module-optional.patch \
-        file://0034-policy-module-apache-add-rules-for-the-symlink-of-va.patch \
-   "
+        file://0001-fc-subs-volatile-alias-common-var-volatile-paths.patch \
+        file://0002-fc-subs-busybox-set-aliases-for-bin-sbin-and-usr.patch \
+        file://0003-fc-hostname-apply-policy-to-common-yocto-hostname-al.patch \
+        file://0004-fc-bash-apply-usr-bin-bash-context-to-bin-bash.bash.patch \
+        file://0005-fc-resolv.conf-label-resolv.conf-in-var-run-properly.patch \
+        file://0006-fc-login-apply-login-context-to-login.shadow.patch \
+        file://0007-fc-bind-fix-real-path-for-bind.patch \
+        file://0008-fc-hwclock-add-hwclock-alternatives.patch \
+        file://0009-fc-dmesg-apply-policy-to-dmesg-alternatives.patch \
+        file://0010-fc-ssh-apply-policy-to-ssh-alternatives.patch \
+        file://0011-fc-sysnetwork-apply-policy-to-ip-alternatives.patch \
+        file://0012-fc-udev-apply-policy-to-udevadm-in-libexec.patch \
+        file://0013-fc-rpm-apply-rpm_exec-policy-to-cpio-binaries.patch \
+        file://0014-fc-su-apply-policy-to-su-alternatives.patch \
+        file://0015-fc-fstools-fix-real-path-for-fstools.patch \
+        file://0016-fc-init-fix-update-alternatives-for-sysvinit.patch \
+        file://0017-fc-brctl-apply-policy-to-brctl-alternatives.patch \
+        file://0018-fc-corecommands-apply-policy-to-nologin-alternatives.patch \
+        file://0019-fc-locallogin-apply-policy-to-sulogin-alternatives.patch \
+        file://0020-fc-ntp-apply-policy-to-ntpd-alternatives.patch \
+        file://0021-fc-kerberos-apply-policy-to-kerberos-alternatives.patch \
+        file://0022-fc-ldap-apply-policy-to-ldap-alternatives.patch \
+        file://0023-fc-postgresql-apply-policy-to-postgresql-alternative.patch \
+        file://0024-fc-screen-apply-policy-to-screen-alternatives.patch \
+        file://0025-fc-usermanage-apply-policy-to-usermanage-alternative.patch \
+        file://0026-fc-getty-add-file-context-to-start_getty.patch \
+        file://0027-fc-init-add-file-context-to-etc-network-if-files.patch \
+        file://0028-fc-vlock-apply-policy-to-vlock-alternatives.patch \
+        file://0029-fc-cron-apply-policy-to-etc-init.d-crond.patch \
+        file://0030-file_contexts.subs_dist-set-aliase-for-root-director.patch \
+        file://0031-policy-modules-system-logging-add-rules-for-the-syml.patch \
+        file://0032-policy-modules-system-logging-add-rules-for-syslogd-.patch \
+        file://0033-policy-modules-system-logging-add-domain-rules-for-t.patch \
+        file://0034-policy-modules-kernel-files-add-rules-for-the-symlin.patch \
+        file://0035-policy-modules-kernel-terminal-add-rules-for-bsdpty_.patch \
+        file://0036-policy-modules-kernel-terminal-don-t-audit-tty_devic.patch \
+        file://0037-policy-modules-services-avahi-allow-avahi_t-to-watch.patch \
+        file://0038-policy-modules-system-getty-allow-getty_t-watch-gett.patch \
+        file://0039-policy-modules-services-bluetooth-allow-bluetooth_t-.patch \
+        file://0040-policy-modules-roles-sysadm-allow-sysadm-to-run-rpci.patch \
+        file://0041-policy-modules-services-rpc-add-capability-dac_read_.patch \
+        file://0042-policy-modules-services-rpcbind-allow-rpcbind_t-to-c.patch \
+        file://0043-policy-modules-services-rngd-fix-security-context-fo.patch \
+        file://0044-policy-modules-system-authlogin-allow-chkpwd_t-to-ma.patch \
+        file://0045-policy-modules-system-udev-allow-udevadm_t-to-search.patch \
+        file://0046-policy-modules-udev-do-not-audit-udevadm_t-to-read-w.patch \
+        file://0047-policy-modules-services-rdisc-allow-rdisc_t-to-searc.patch \
+        file://0048-policy-modules-system-logging-fix-auditd-startup-fai.patch \
+        file://0049-policy-modules-services-ssh-make-respective-init-scr.patch \
+        file://0050-policy-modules-kernel-terminal-allow-loging-to-reset.patch \
+        file://0051-policy-modules-system-selinuxutil-allow-semanage_t-t.patch \
+        file://0052-policy-modules-system-sysnetwork-allow-ifconfig_t-to.patch \
+        file://0053-policy-modules-services-ntp-allow-ntpd_t-to-watch-sy.patch \
+        file://0054-policy-modules-system-systemd-enable-support-for-sys.patch \
+        file://0055-policy-modules-system-logging-fix-systemd-journald-s.patch \
+        file://0056-policy-modules-roles-sysadm-allow-sysadm_t-to-watch-.patch \
+        file://0057-policy-modules-system-systemd-add-capability-mknod-f.patch \
+        file://0058-policy-modules-system-systemd-systemd-gpt-auto-gener.patch \
+        file://0059-policy-modules-services-rpc-fix-policy-for-nfsserver.patch \
+        file://0060-policy-modules-services-rpc-make-rpcd_t-MLS-trusted-.patch \
+        file://0061-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch \
+        file://0062-policy-modules-system-mount-make-mount_t-domain-MLS-.patch \
+        file://0063-policy-modules-system-setrans-allow-setrans-to-acces.patch \
+        file://0064-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch \
+        file://0065-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch \
+        file://0066-policy-modules-system-init-make-init_t-MLS-trusted-f.patch \
+        file://0067-policy-modules-system-systemd-make-systemd-tmpfiles_.patch \
+        file://0068-policy-modules-system-logging-add-the-syslogd_t-to-t.patch \
+        file://0069-policy-modules-system-init-make-init_t-MLS-trusted-f.patch \
+        file://0070-policy-modules-system-init-all-init_t-to-read-any-le.patch \
+        file://0071-policy-modules-system-logging-allow-auditd_t-to-writ.patch \
+        file://0072-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch \
+        file://0073-policy-modules-system-systemd-make-systemd-logind-do.patch \
+        file://0074-policy-modules-system-systemd-systemd-user-sessions-.patch \
+        file://0075-policy-modules-system-systemd-systemd-networkd-make-.patch \
+        file://0076-policy-modules-system-systemd-systemd-resolved-make-.patch \
+        file://0077-policy-modules-system-systemd-make-systemd-modules_t.patch \
+        file://0078-policy-modules-system-systemd-systemd-gpt-auto-gener.patch \
+        file://0079-policy-modules-services-ntp-make-nptd_t-MLS-trusted-.patch \
+        file://0080-policy-modules-services-avahi-make-avahi_t-MLS-trust.patch \
+        "
 
 S = "${WORKDIR}/refpolicy"
 
@@ -85,7 +131,7 @@ POLICY_NAME ?= "${POLICY_TYPE}"
 POLICY_DISTRO ?= "redhat"
 POLICY_UBAC ?= "n"
 POLICY_UNK_PERMS ?= "allow"
-POLICY_DIRECT_INITRC ?= "n"
+POLICY_DIRECT_INITRC ?= "y"
 POLICY_SYSTEMD ?= "${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'y', 'n', d)}"
 POLICY_MONOLITHIC ?= "n"
 POLICY_CUSTOM_BUILDOPT ?= ""