summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* kernel: Remove non-existing kernel optionzeusHe Zhe2019-10-251-1/+0
| | | | | | | | CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE has been remove from mainline kernel by the commit be6ec88f41ba ("selinux: Remove SECURITY_SELINUX_BOOTPARAM_VALUE"). Signed-off-by: He Zhe <zhe.he@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* layer.conf: add zeus compatibilityJoe MacDonald2019-10-181-1/+1
| | | | | | | | | | | | Also remove thud and warrior, based on: f5170305dcff (compat: remove thud from warrior layer compatibility list) Since thud or warrior users are expected to use the 'thud' or 'warrior' branch. Signed-off-by: Nicolas Dechesne <nicolas.dechesne@linaro.org> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* Update MAINTAINERS with new email addrMark Hatle2019-10-171-1/+1
| | | | Signed-off-by: Mark Hatle <mark.hatle@kernel.crashing.org>
* audit: explicitly disable golang bindingsYi Zhao2019-09-171-0/+1
| | | | | | | | Disable golang bindings to avoid potential host contamination issue. Fixes: https://bugzilla.yoctoproject.org/show_bug.cgi?id=13166 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* conf/layer.conf: use BBFILES_DYNAMIC for dynamic layersRobert Yang2019-09-096-4/+7
| | | | | | | | | | | | | | | | | | | | | | | | | The previous code add all BBFILE_COLLECTIONS/recipes*/*/*.bbappend to BBFILES, which causes the parsing very slow when there are many layers, e.g., I have 87 layers: * Before: $ rm -fr tmp-glibc/ cache; time bitbake -p real 0m45.173s user 0m0.560s sys 0m0.060s * After: $ rm -fr tmp-glibc/ cache; time bitbake -p real 0m25.542s user 0m0.572s sys 0m0.040s It wasted 20s which wasn't worth (The host has 128 threads, it should cost more time on less power host), use BBFILES_DYNAMIC can fix the problem. Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-autorelabel: disable enforcing mode before relabelYi Zhao2019-09-091-3/+6
| | | | | | | | | | | The commit b0d31db104d9a4e94bc1409c2ffcc1d82f4a780f introduced an issue when first boot with bootparams="selinux=1 enforcing=1". At first boot, all files are unlabeled including /sbin/setfiles. The relabel operations are not permitted under enforcing mode. So we need to disable enforcing mode before relabel. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* util-linux: drop obsolete patchYi Zhao2019-08-291-28/+0
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* setools: update SRC_URIYi Zhao2019-08-291-1/+1
| | | | | | | | | SETools has moved from https://github.com/TresysTechnology/setools to https://github.com/SELinuxProject/setools See: https://github.com/TresysTechnology/setools/wiki Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* mcstrans: specify INITDIRYi Zhao2019-08-291-1/+1
| | | | | | | | | By default the mcstrans init script will be installed to /etc/rc.d/init.d directory. Specify INITDIR to install it to /etc/init.d directory. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-python: Fix dependency for ntpathLorenz Kofler2019-08-281-0/+1
| | | | | | | | | On yocto warrior the semanage tool didn't work correctly, because it couldn't find ntpath module. It turned out that this module is now part of the package python-misc, therefore add dependency to python-misc. Signed-off-by: Lorenz Kofler <lorenz@sigma-star.at> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-init: use systemd (re)labellingMark Asselstine2019-08-284-16/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | Boot loops were being seen when booting with selinux enabled, when the init system in use is systemd. Once logs were retrieved from the failing system the error was found to be selinux-init.sh[284]: /sbin/restorecon: Could not set context for /sys/fs/cgroup/cpuacct: Read-only file system selinux-init.sh[284]: /sbin/restorecon: Could not set context for /sys/fs/cgroup/cpu: Read-only file system Systemd mounts /sys/fs/cgroup read-only and the (re)labelling code used by selinux-init.sh is unable to handle this. On top of this the system is basically presenting two methods of (re)labelling; using the built in systemd approach via selinux-autorelabel.service *and* the code we have in selinux-init.sh. This can get confusing especially given that most online resources will speak to the systemd approach using selinux-autorelabel.service and /.autorelabel. These changes leave the current approach in place when sysvinit is the init system used, but if systemd is being used we make use of it's internal (re)labelling functionality. Overall the workflow remains the same but we now avoid boot loops (systemd remounts /sys/fs/cgroup rw during the (re)labelling procedure). Signed-off-by: Mark Asselstine <mark.asselstine@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-sandbox: add runtime dependency on python-coreYi Zhao2019-08-281-0/+1
| | | | | | | | | Fixes: ERROR: QA Issue: /usr/share/sandbox/start contained in package selinux-sandbox requires /usr/bin/python, but no providers found in RDEPENDS_selinux-sandbox? [file-rdeps] Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-python: add python-core as runtime dependencyYi Zhao2019-08-281-0/+3
| | | | | | | | | | | | | Fix QA issues: QA Issue: /usr/lib64/python2.7/site-packages/seobject.py contained in package selinux-python requires /usr/bin/python, but no providers found in RDEPENDS_selinux-python? [file-rdeps] QA Issue: /usr/bin/audit2allow contained in package selinux-python-audit2allow requires /usr/bin/python, but no providers found in RDEPENDS_selinux-python-audit2allow? [file-rdeps] QA Issue: /usr/bin/chcat contained in package selinux-python-chcat requires /usr/bin/python, but no providers found in RDEPENDS_selinux-python-chcat? [file-rdeps] Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* mcstrans: specify SBINDIRJoe Slater2019-08-281-0/+3
| | | | | | | | | We need SBINDIR to be compatible with the usrmerge distro feature. The update to version 2.8 (commit c55c0aca...) removed the definition, perhaps because the "${D}/" prefix broke the build. Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* libselinux: fix build with glibc 2.30Yi Zhao2019-08-282-0/+61
| | | | | | | | | | | | | | | | | Fix build error: procattr.c:27:14: error: static declaration of 'gettid' follows non-static declaration 27 | static pid_t gettid(void) | ^~~~~~ In file included from /buildarea/build/tmp/work/core2-64-poky-linux/libselinux/2.8-r0/recipe-sysroot/usr/include/unistd.h:1170, from procattr.c:2: /buildarea/build/tmp/work/core2-64-poky-linux/libselinux/2.8-r0/recipe-sysroot/usr/include/bits/unistd_ext.h:34:16: note: previous declaration of 'gettid' was here 34 | extern __pid_t gettid (void) __THROW; | ^~~~~~ Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* audit: use git fetcher instead of the tarball sourceMingli Yu2019-07-081-3/+4
| | | | | | | | | | | Per http://people.redhat.com/sgrubb/audit/, the tarball source moves to https://github.com/linux-audit/audit-userspace, and since commit [21f84fc insane: add sanity checks to SRC_URI] applied in oe-core, do not use unstable github archive tarballs, so use git instead. Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* audit: upgrade 2.8.4 -> 2.8.5Yi Zhao2019-07-087-84/+35
| | | | | | | | | | * Drop backport patch: 0001-Remove-strdupa-as-suggested-in-pull-request-25.patch * Refresh all patches. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* glib-2.0: fix configure error for meson buildYi Zhao2019-06-152-1/+5
| | | | | | | | | | | | In glib 2.60.x, it turns selinux into a meson feature. We should use '-Dselinux=enabled/disabled' rather than '-Dselinux=true/false' to enable/disable the feature. Add meso-enable-selinux.bbclass for this change and inherit it in glib-2.0 bbappend to fix the configure error. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* setools: do not use unstable github archive tarballsHongxu Jia2019-06-061-3/+3
| | | | | | | | Since commit [21f84fc insane: add sanity checks to SRC_URI] applied in oe-core, do not use unstable github archive tarballs Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* mesa: switch to meson buildYi Zhao2019-06-062-7/+1
| | | | | | | | | The mesa had been converted to use meson build system in oe-core commit c72b6d46d392bfbcf54154f43663a7a8ada8c567. Update the bbappend to adapt it. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* findutils: drop obsolete patchYi Zhao2019-06-061-499/+0
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* refpolicy: update source checksums for refpolicy 20190201Yi Zhao2019-04-231-2/+2
| | | | | | | | The previous md5sum and sha256sum are not correct. See: https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20190201 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* busybox: disable PTEST_BINDIRKai Kang2019-04-181-0/+2
| | | | | | | | | | A new feature has been added in oe-core to use update-alternative mechanism for ptest. But it conflicts with current patch in meta-selinux. So do not use this new feature for ptest when build with selinux. Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libselinux.inc: Add python-shell to libselinux-python RDEPENDS.master-nextChris PeBenito2019-04-151-1/+1
| | | | | | | The libselinux SWIG wrapper imports shutil. Signed-off-by: Chris PeBenito <Christopher.PeBenito@microsoft.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* audit: change to use ${WORKDIR} instead ${S}/../Chen Qi2019-04-151-1/+1
| | | | | | | | | | The do_install function is assuming that ${S}/../ is ${WORKDIR}, but this is not true when using `devtool modify audit'. So change to use ${WORKDIR}. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* setools: fix build failure with gcc 7Kai Kang2019-04-141-16/+74
| | | | | | | | | | | | Backport patch from setools upstream to fix build failure with GCC 7 due to possible truncation of snprintf output. It could be reproduced on 64 bit bsps such as qemux86-64 and qemumips64 with configs: SELECTED_OPTIMIZATION = "${DEBUG_OPTIMIZATION}" DEBUG_BUILD = "1" Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* layer.conf: update to warrior release name seriesKai Kang2019-04-141-1/+1
| | | | | | | Sync with oe-core to update to warrior release name series. Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* selinux: remove git versionYi Zhao2019-04-146-62/+0
| | | | | | | | | | The git version of libselinux libsemanage libsepol checkpolicy and policycoreutils are far behind the master branch and now they can not build due to the do_patch error. The current stable 2.8 version works well so we can remove them. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* packagegroup-selinux-minimal: add selinux-initLuca Boccassi2019-04-141-0/+1
| | | | | | | | | | | | | | | | | | | | | | | When trying to build a minimal image (eg: without python), the default user on autologin is not mapped to the intended user/role/domain: # id -Z system_u:system_r:kernel_t:s0 And the following error is displayed on autologin: Unable to get valid context for <user> While on an image built with the core-selinux packagegroup: # id -Z unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 Adding selinux-init to the minimal package list fixes the issue. This package does not seem to bring along additional dependencies. Signed-off-by: Luca Boccassi <bluca@debian.org> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libpcre: do no create links when compiling for windowsSinan Kaya2019-04-141-7/+13
| | | | | | | | lipcre-native is trying to create symbolic links to so files when used with meta-mingw. Remove this condition for mingw builds. Signed-off-by: Sinan Kaya <okaya@kernel.org> Signed-off-by: Joe MacDonald <joe@deserted.net>
* selinux-image.bbclass: using append instead of += for IMAGE_PREPROCESS_COMMANDYi Zhao2019-04-141-1/+1
| | | | | | | | | | | | | | | | | | | | | | | Fix AVC denied error when booting: type=AVC msg=audit(1548055920.478:86): avc: denied { execute } for pid=366 comm="audispd" path="/lib/ld-2.28.so" dev="vda" ino=7545 scontext=system_u:system_r:audisp_t:s15:c0.c1023 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file permissive=1 type=AVC msg=audit(1548055920.478:87): avc: denied { open } for pid=366 comm="audispd" path="/lib/libc-2.28.so" dev="vda" ino=7558 scontext=system_u:system_r:audisp_t:s15:c0.c1023 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file permissive=1 When using "+=" for IMAGE_PREPROCESS_COMMAND, the selinux_set_labels process would run before prelink process to set the security labels for the files. But the label for /lib/libc-2.28.so and /lib/ld-2.28.so would be changed after run prelink process. Use "_append" to make sure the selinux_set_labels process run after prelink process. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* openssh: update sshd_configYi Zhao2019-04-141-27/+26
| | | | | | | | Update sshd_config based on openssh 7.9p1. Drop the deprecated option UsePrivilegeSeparation Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* core-image-selinux.bb: remove trailing whitespaceYi Zhao2019-04-141-1/+1
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: update to 2.20190201 and git HEAD policiesJoe MacDonald2019-04-12156-3748/+3145
| | | | | | | Additionally, the README has fallen out of date, update it to reflect the current reality of layer dependencies. Signed-off-by: Joe MacDonald <joe@deserted.net>
* Backport patches from upstream to fix build with muslLuca Boccassi2019-03-253-0/+183
| | | | | | | | | Audit 2.8.4 fails to build with musl. The fixes have been committed to the upstream master branch and can be backported. Building with glibc is unaffected. Signed-off-by: Luca Boccassi <luca.boccassi@microsoft.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* meson-selinux.bbclass: add for meson build systemKai Kang2019-03-252-1/+5
| | | | | | | | | | | Add meson-selinux.bbclass for meson build system. It used '-Dselinux=true/false' to enable/disable 'selinux' rather than --enable-selinux or --with-selinux. Inherit meson-selinux for glib-2.0 to fix configure failure. Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* linux-yocto: add bbappend for kernel 5.0Yi Zhao2019-03-221-0/+1
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: fix up all refpolicy 20170224 builds for current masterJoe MacDonald2018-10-304-32/+51
| | | | Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy_git.inc: lock SRCREVs on the actual version hashesAwais Belal2018-10-231-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | Using AUTOREV in the main repository has its downsides. 1. The checked out version isn't actually the version depicted by PV. 2. Breaks builds in scenarios where network isn't available or BB_NO_NETWORK is used even after sources are already fetched. 1 is self explanatory, for 2 whenever SRCREV is set to AUTOREV and SRCPV is used in PV the fetcher tries to access the network in order to determine SRCPV (bb.fetch2.get_srcrev) and fails for obvious reasons during parsing even when versioned recipes are used as PREFERRED_VERSION because parsing still happens for recipes that are in BB's search paths and we see. Traceback (most recent call last): bb.data_smart.ExpansionError: Failure expanding variable SRCPV, expression was ${@bb.fetch2.get_srcrev(d)} which triggered exception NetworkAccess: Network access disabled through BB_NO_NETWORK (or set indirectly due to use of BB_FETCH_PREMIRRORONLY) but access requested with command git -c core.fsyncobjectfiles=0 ls-remote git://github.com/TresysTechnology/refpolicy.git (for url git://github.com/TresysTechnology/refpolicy.git) So we lock the REVs and do that with a soft assignment which allows overriding the REVs from elsewhere. Signed-off-by: Awais Belal <awais_belal@mentor.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libpcre_selinux.inc: fix do_install failure if .so file does not existChen Qi2018-10-231-1/+1
| | | | | | | | | | | In case of the existence of meta-mingw, the library is .dll instead of .so and these .dll files are in ${bindir}. We need to check the existence of the .so file before doing readlink, otherwise do_install fails. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libselinux: Fix build with musl libc.Piotr Tworek2018-10-231-0/+2
| | | | | | | | | | Musl libc does not implement file traversal functions from fts.h. Oe-core provides fts library which implements those. Libselinux makefile allows us to use such additional library by specifying required linker flags via FTS_LDLIBS variable. Signed-off-by: Piotr Tworek <tworaz666@gmail.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* setools: Add missing python runtime deps.Piotr Tworek2018-10-231-1/+2
| | | | | | | | | | The package needs logging, json and argparse modules to start. Additionaly, it also needs libselinux-python in order to really work. Without it it'll just print an error message instructing the user to install it. Signed-off-by: Piotr Tworek <tworaz666@gmail.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* layer.conf: update LAYERSERIES_COMPAT `sumo' -> `thud'Hongxu Jia2018-10-221-1/+1
| | | | | | | | | Since `9ec5a8a layer.conf: Drop sumo from LAYERSERIES_CORENAMES' and `9867924 layer.conf: Add thud to LAYERSERIES_CORENAMES' applied in oe-core, update LAYERSERIES_COMPAT `sumo' -> `thud' Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* policycorutils: package files in base_sbindir.Eric Chanudet2018-09-091-7/+6
| | | | | | | | | | | SBINDIR was changed to ${base_sbindir} in commit: 8cc9c17 policycoreutils: fix installed-but-not-shipped on updated recipes FILES_${PN}-* must now capture files installed in ${base_sbindir} accordingly. Signed-off-by: Eric Chanudet <chanudete@ainfosec.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* policycoreutils: fix installed-but-not-shipped on updated recipesJoe MacDonald2018-09-073-60/+1
| | | | Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* audit: uprev to 2.8.4Yi Zhao2018-09-071-9/+10
| | | | | | | Add aarch64 support Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* packagegroup-selinux-policycoreutils: remove semodule-utils-semodule-depsYi Zhao2018-09-071-1/+0
| | | | | | | | Remove package semodule-utils-semodule-deps as it had been removed upstream. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-gui: uprev to 2.8 (20180524)Yi Zhao2018-09-072-7/+7
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-dbus: uprev to 2.8 (20180524)Yi Zhao2018-09-072-7/+7
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* semodule-utils: uprev to 2.8 (20180524)Yi Zhao2018-09-073-9/+7
| | | | | | | Remove package semodule-deps as it had been removed upstream. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-03 02:30:17 +0000