summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* libselinux: upgrade to 3.1 (20200710)Yi Zhao2021-01-145-79/+64
| | | | | | | | | | | | Drop backported and obsolete patches: 0001-Fix-building-against-musl-and-uClibc-libc-libraries.patch libselinux-drop-Wno-unused-but-set-variable.patch Add patch to fix build on musl: 0001-libselinux-do-not-define-gettid-for-musl.patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libsepol: upgrade to 3.1 (20200710)Yi Zhao2021-01-144-607/+8
| | | | | | | | | Drop backported patches: 0001-libsepol-fix-CIL_KEY_-build-errors-with-fno-common.patch 0001-libsepol-remove-leftovers-of-cil_mem_error_handler.patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* selinux: upgrade inc files to 3.1 (20200710)Yi Zhao2021-01-142-3/+2
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* audit: upgrade 2.8.5 -> 3.0Yi Zhao2021-01-146-234/+35
| | | | | | | | | | | | | | | * Drop backported patches: 0001-Header-definitions-need-to-be-external-when-building.patch 0001-lib-i386_table.h-add-new-syscall.patch Add-substitue-functions-for-strndupa-rawmemchr.patch * Refresh patch: Fixed-swig-host-contamination-issue.patch * Update auditd.service. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* audit: enable arm/aarch64 processor support by defaultYi Zhao2021-01-141-2/+2
| | | | | | | | | | | | | | | | | We encountered a runtime error for auditctl on lib32 image for aarch64: root@xilinx-zynqmp:~# auditctl -a always,exit -F arch=b32 -S adjtimex -k TEST-time-change arch elf mapping not found The root cause is the aarch64 processor support is not enabled for arm build. Refer to Debian[1] and Fedora[2], actually we can enable arm/aarch64 processor support unconditionally. [1] https://salsa.debian.org/debian/audit/-/commit/8c6b2049bafb52712ca981e73d5b79d5bd97e08e [2] https://src.fedoraproject.org/rpms/audit/blob/master/f/audit.spec Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libselinux-python: inherit python3targetconfigYi Zhao2020-12-151-1/+1
| | | | | | | | | | | | | The python3 target configuration has been split into own class in oe-core commit 5a118d4e7985fa88f04c3611f8db813f0dafce75. Inherit it to fix the build error. Fixes: selinuxswig_python_wrap.o: file not recognized: File format not recognized collect2: error: ld returned 1 exit status Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* setools: fix build with Python 3.9Yi Zhao2020-11-121-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | The Py_UNICODE_COPY, Py_UNICODE_FILL, PyUnicode_WSTR_LENGTH, PyUnicode_FromUnicode(), PyUnicode_AsUnicode(), _PyUnicode_AsUnicode, and PyUnicode_AsUnicodeAndSize() are marked as deprecated in Python 3.9. (See: https://docs.python.org/3/whatsnew/3.9.html). But the current python3-cython (0.29.21) hasn't adapt it yet. Append '-Wno-deprecated-declarations' in CFLAGS as a workaround to fix the build issue. Fixes: In file included from /build/tmp-glibc/work/corei7-64-wrs-linux/setools/4.3.0-r0/recipe-sysroot/usr/include/python3.9/unicodeobject.h:1026, from /build/tmp-glibc/work/corei7-64-wrs-linux/setools/4.3.0-r0/recipe-sysroot/usr/include/python3.9/Python.h:97, from setools/policyrep.c:49: /build/tmp-glibc/work/corei7-64-wrs-linux/setools/4.3.0-r0/recipe-sysroot/usr/include/python3.9/cpython/unicodeobject.h:446:26: note: declared here 446 | static inline Py_ssize_t _PyUnicode_get_wstr_length(PyObject *op) { | ^~~~~~~~~~~~~~~~~~~~~~~~~~ setools/policyrep.c:97302:3: error: 'PyUnicode_AsUnicode' is deprecated [-Werror=deprecated-declarations] Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* conf/layer.conf: Bump to gatesgarthAnibal Limon2020-10-241-1/+1
| | | | | Signed-off-by: Aníbal Limón <anibal.limon@linaro.org> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: update file context for ifconfigYi Zhao2020-09-232-0/+32
| | | | | | | | | The ifconfig was moved from sbin to bin with oe-core commit: c9caff40ff61c08e24a84922f8d7c8e9cdf8883e. Update the file context for it. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* selinux-*.service: install to sysinit.targetYi Zhao2020-09-233-3/+3
| | | | | | | | | The selinux-init/autorelabel/labeldev services have a constraint of Before=sysinit.arget. So it is better to install them to sysinit.target rather than multi-user.target. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* selinux-*.bb: fix typosYi Zhao2020-09-233-3/+3
| | | | | | | | Fixes: ${PN}_RDEPENDS -> RDEPENDS_${PN} Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* net-tools: drop patchYi Zhao2020-09-232-248/+0
| | | | | | | The netstat-selinux-support.patch has been merged upstream. So drop it. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* dhcp: remove bbappend fileChen Qi2020-09-183-56/+0
| | | | | | | dhcp has been removed, thus removing its bbappend file. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* audit: Backport gcc10 fix for common defaultAlex Kiernan2020-09-182-0/+29
| | | | | Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* setools: Add native supportOleksii Miroshko2020-09-183-0/+10
| | | | | | | | Enable using setools for analyzing the built SELinux policy during the build. Signed-off-by: Oleksii Miroshko <miroshko@gmail.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: update to 20200229+gitYi Zhao2020-07-14110-1681/+2982
| | | | | | | | | * Drop obsolete and unused patches. * Rebase patches. * Add patches to make systemd and sysvinit can work with all policy types. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* sysklogd: set correct security context for /var/log in initscriptYi Zhao2020-07-141-1/+1
| | | | | | | | | | We don't need to set security context for /dev/log after syslogd daemon startup because it is already set by udev. We just need to set the correct security context for symbolic link /var/log before syslogd startup. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* audit: set correct security context for /var/log/auditYi Zhao2020-07-141-1/+1
| | | | | | | | | | | | | | By default /var/log is a symbolic link of /var/volatile/log. But restorecon does not follow symbolic links then we will encounter the following error when set /var/log/audit directory: $ /sbin/restorecon -F /var/log/audit /sbin/restorecon: SELinux: Could not get canonical path for /var/log/audit restorecon: Permission denied. Use readlink to find the real path before set security context. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* refpolicy: remove version 2.20190201Yi Zhao2020-07-1450-2523/+0
| | | | | | | | There is no need to maintain two versions of repolicy. Drop this version and only keep the git version. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* checkpolicy: remove unused te_assertionsMingli Yu2020-07-132-0/+49
| | | | | | | | | | | | | Backport a patch to remove unused te_assertions to fix the build failure on fedora 32. Fixes: | /build/tmp-glibc/hosttools/ld: policy_define.o:(.bss+0x28): multiple definition of `te_assertions'/build/tmp-glibc/hosttools/ld: policy_define.o:(.bss+0x28): multiple definition of `te_assertions'; y.tab.o:(.bss+0x18): first defined here | collect2: error: ld returned 1 exit status | make: *** [Makefile:33: checkpolicy] Error 1 Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libsepol: fix build errors on Fedora 32Yi Zhao2020-06-153-0/+600
| | | | | | | | | | | | | | | Backport 2 patches to fix the build errors on Fedora 32. Fixes: [snip] ../cil/src/cil_verify.lo:(.bss+0x4f0): multiple definition of `CIL_KEY_CONS_T3'; ../cil/src/cil_verify.lo:(.bss+0x4f8): multiple definition of `CIL_KEY_CONS_T2'; ../cil/src/cil_verify.lo:(.bss+0x500): multiple definition of `CIL_KEY_CONS_T1'; ../cil/src/cil_verify.lo:(.bss+0x508): multiple definition of `cil_mem_error_handler'; [snip] Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libselinux-python: Fix one invalid linkChangqing Li2020-04-302-0/+53
| | | | | | | | | when host arch and target arch are different, the extension suffix of host is different with target one, so there will be a invalid link. Fix by update the way to create the link. Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* semodule-utils: upgrade to 3.0 (20191204)Yi Zhao2020-04-152-7/+7
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-gui: upgrade to 3.0 (20191204)Yi Zhao2020-04-152-7/+7
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-sandbox: upgrade to 3.0 (20191204)Yi Zhao2020-04-152-7/+7
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-dbus: upgrade to 3.0 (20191204)Yi Zhao2020-04-152-7/+7
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-python: upgrade to 3.0 (20191204)Yi Zhao2020-04-154-25/+15
| | | | | | | Refresh fix-sepolicy-install-path.patch. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* restorecond: upgrade to 3.0 (20191204)Yi Zhao2020-04-153-8/+8
| | | | | | | Fix typo in patch. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* mcstrans: upgrade to 3.0 (20191204)Yi Zhao2020-04-152-7/+7
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* policycoreutils: upgrade to 3.0 (20191204)Yi Zhao2020-04-152-8/+7
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* secilc: upgrade to 3.0 (20191204)Yi Zhao2020-04-152-7/+7
| | | | | | | License-Update: fix misspellings Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* checkpolicy: upgrade to 3.0 (20191204)Yi Zhao2020-04-152-7/+7
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* libsemanage: upgrade to 3.0 (20191204)Yi Zhao2020-04-155-13/+13
| | | | | | | | * Refresh libsemanage-allow-to-disable-audit-support.patch * Fix typos in patches. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* libselinux-python: upgrade to 3.0 (20191204)Yi Zhao2020-04-153-7/+38
| | | | | | | | | * Inherit python3native as the libselinux uses python distutils to install selinux python bindings now. * Add a patch to fix python modules install path for multilib. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* libselinux: upgrade to 3.0 (20191204)Yi Zhao2020-04-156-7/+46
| | | | | | | | * Backport a patch to fix build failure with musl. * Fix typos in patches. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* libsepol: upgrade to 3.0 (20191204)Yi Zhao2020-04-152-7/+7
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux: upgrade inc files to 3.0 (20191204)Yi Zhao2020-04-151-1/+1
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* setools: upgrade 4.2.2 -> 4.3.0Yi Zhao2020-04-151-3/+5
| | | | | | | Remove __pycache__ directories when do_install. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* bind: install volatiles file with correct nameYi Zhao2020-04-071-1/+1
| | | | | | | Install volatiles file as 04_bind rather than volatiles.04_bind. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* eudev: remove udev-cache and sync the initscript to latest oe-core versionYi Zhao2020-04-072-87/+11
| | | | | | | | | | The udev-cache has been remove in oe-core commit 048f4149b8438c521e8b65a3c96d850a9b4a3e5b. So we can also remove it. Also sync the initscript to latest oe-core version. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* sysklogd: sync the initscript to latest oe-core versionYi Zhao2020-04-071-18/+29
| | | | | | | | | The sysklogd has been updated to 2.1.1 in oe-core and the klogd was removed from this version since syslogd performs logging of kernel messages. So we update the initscript to adapt it. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* clean up getVar() usageJoe MacDonald2020-04-034-7/+7
| | | | | | | | | | | 83eac4de updated the usage of getVar() in classes/selinux.bbclass to leave out the default expand parameter. This is consistent with the usage in the core layers. Bring all other calls to getVar() in the layer into alignment with this approach. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* layer.conf: update LAYERSERIES_COMPAT for dunfellYi Zhao2020-04-031-1/+1
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux.bbclass: remove True option in getVar()Yi Zhao2020-04-031-2/+2
| | | | | | | | The getVar() defaults to expanding by default, thus remove the True option from all getVar() calls. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* linux-yocto: drop 4.x bbappendYi Zhao2020-02-261-1/+0
| | | | | | | | The linux-yocto 4.x recipes have been dropped in oe-core. We can remove the bbappend. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* audit: add clock_settime64 syscallMingli Yu2020-02-192-0/+43
| | | | | | | | | | | | | | | | | | | | | | | On 32bit system, After upgrade glibc to 2.31 # strace -o /tmp/test.log date -s 09:16:45 # tail -f /tmp/test.log close(3) = 0 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=114, ...}) = 0 clock_settime64(CLOCK_REALTIME, {tv_sec=1582103805, tv_nsec=0}) = 0 fstat64(1, {st_mode=S_IFCHR|0600, st_rdev=makedev(0x4, 0x40), ...}) = 0 ioctl(1, TCGETS, {B115200 opost isig icanon echo ...}) = 0 write(1, "Wed Feb 19 09:16:45 UTC 2020\n", 29) = 29 close(1) = 0 close(2) = 0 exit_group(0) = ? +++ exited with 0 +++ It means the clock_settime64 syscall is used, so add the syscall. Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* findutils: make append genericJeremy Puhlman2020-01-301-0/+0
| | | | | Signed-off-by: Jeremy Puhlman <jpuhlman@mvista.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* python: move appends to a dynamic-layerJeremy Puhlman2020-01-304-0/+2
| | | | | Signed-off-by: Jeremy Puhlman <jpuhlman@mvista.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* audit: fix host contamination for swigYi Zhao2019-12-302-0/+58
| | | | | | | | | | | | | | The audit build uses swig to generate a python wrapper. But there is a hardcoded include directory in auditswig.i, which causes header files on the host to be used when building. This will cause build error on some old systems. e.g. on CentOS7 with buildtools: audit_wrap.c: In function '_wrap_audit_rule_flags_set': audit_wrap.c:5018:19: error: dereferencing pointer to incomplete type 'struct audit_rule' 5018 if (arg1) (arg1)->flags = arg2; ^~ Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-initsh.inc: install selinux-init.sh and selinux-labeldev.sh when ↵Yi Zhao2019-12-302-5/+7
| | | | | | | | | | | | | | using systemd The commit 5fd3c5b71edb99659aeb5cb5903088d84517382e introduced an issue that selinux-init.sh and selinux-labeldev.sh are not installed when using systemd which will cause the selinux-ini.service and selinux-labeldev.service fail to startup. Move the do_install codes from selinux-autorelabel to selinux-initsh.inc to make sure install these scripts when using systemd. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-04 12:54:45 +0000