summaryrefslogtreecommitdiffstats
path: root/recipes-security
diff options
context:
space:
mode:
authorArmin Kuster <akuster808@gmail.com>2019-03-30 14:12:41 -0700
committerArmin Kuster <akuster808@gmail.com>2019-03-31 10:37:09 -0700
commit75e609f7b14b57b27143ec9e8d818fc5fab6d106 (patch)
tree7ac38794680a5f6eda5eb907aeac47ae5e173854 /recipes-security
parent00f00d28971355a1a5ce9d38b617adfd991104bd (diff)
downloadmeta-security-75e609f7b14b57b27143ec9e8d818fc5fab6d106.tar.gz
reorg: move mac recipes to recipes-mac
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Diffstat (limited to 'recipes-security')
-rw-r--r--recipes-security/AppArmor/apparmor_2.12.bb154
-rw-r--r--recipes-security/AppArmor/files/apparmor227
-rw-r--r--recipes-security/AppArmor/files/apparmor.rc98
-rw-r--r--recipes-security/AppArmor/files/apparmor.service22
-rw-r--r--recipes-security/AppArmor/files/crosscompile_perl_bindings.patch25
-rw-r--r--recipes-security/AppArmor/files/disable_pdf.patch33
-rw-r--r--recipes-security/AppArmor/files/disable_perl_h_check.patch19
-rw-r--r--recipes-security/AppArmor/files/functions271
-rw-r--r--recipes-security/AppArmor/files/run-ptest4
-rw-r--r--recipes-security/AppArmor/files/tool-paths.patch37
-rw-r--r--recipes-security/smack/files/run-ptest3
-rw-r--r--recipes-security/smack/files/smack_generator_make_fixup.patch18
-rw-r--r--recipes-security/smack/smack_1.3.1.bb54
13 files changed, 0 insertions, 965 deletions
diff --git a/recipes-security/AppArmor/apparmor_2.12.bb b/recipes-security/AppArmor/apparmor_2.12.bb
deleted file mode 100644
index efa93e6..0000000
--- a/recipes-security/AppArmor/apparmor_2.12.bb
+++ /dev/null
@@ -1,154 +0,0 @@
1SUMMARY = "AppArmor another MAC control system"
2DESCRIPTION = "user-space parser utility for AppArmor \
3 This provides the system initialization scripts needed to use the \
4 AppArmor Mandatory Access Control system, including the AppArmor Parser \
5 which is required to convert AppArmor text profiles into machine-readable \
6 policies that are loaded into the kernel for use with the AppArmor Linux \
7 Security Module."
8HOMEAPAGE = "http://apparmor.net/"
9SECTION = "admin"
10
11LICENSE = "GPLv2 & GPLv2+ & BSD-3-Clause & LGPLv2.1+"
12LIC_FILES_CHKSUM = "file://${S}/LICENSE;md5=fd57a4b0bc782d7b80fd431f10bbf9d0"
13
14DEPENDS = "bison-native apr gettext-native coreutils-native"
15
16SRC_URI = " \
17 http://archive.ubuntu.com/ubuntu/pool/main/a/${BPN}/${BPN}_${PV}.orig.tar.gz \
18 file://disable_perl_h_check.patch \
19 file://crosscompile_perl_bindings.patch \
20 file://tool-paths.patch \
21 file://apparmor.rc \
22 file://functions \
23 file://apparmor \
24 file://apparmor.service \
25 file://run-ptest \
26 "
27
28SRC_URI[md5sum] = "49054f58042f8e51ea92cc866575a833"
29SRC_URI[sha256sum] = "8a2b0cd083faa4d0640f579024be3a629faa7db3b99540798a1a050e2eaba056"
30
31PARALLEL_MAKE = ""
32
33inherit pkgconfig autotools-brokensep update-rc.d python3native perlnative ptest cpan manpages systemd
34
35PACKAGECONFIG ??= "python perl"
36PACKAGECONFIG[manpages] = "--enable-man-pages, --disable-man-pages"
37PACKAGECONFIG[python] = "--with-python, --without-python, python3 swig-native"
38PACKAGECONFIG[perl] = "--with-perl, --without-perl, perl perl-native swig-native"
39PACKAGECONFIG[apache2] = ",,apache2,"
40
41PAMLIB="${@bb.utils.contains('DISTRO_FEATURES', 'pam', '1', '0', d)}"
42HTTPD="${@bb.utils.contains('PACKAGECONFIG', 'apache2', '1', '0', d)}"
43
44
45python() {
46 if 'apache2' in d.getVar('PACKAGECONFIG').split() and \
47 'webserver' not in d.getVar('BBFILE_COLLECTIONS').split():
48 raise bb.parse.SkipRecipe('Requires meta-webserver to be present.')
49}
50
51DISABLE_STATIC = ""
52
53do_configure() {
54 cd ${S}/libraries/libapparmor
55 aclocal
56 autoconf --force
57 libtoolize --automake -c --force
58 automake -ac
59 ./configure ${CONFIGUREOPTS} ${EXTRA_OECONF}
60}
61
62do_compile () {
63 oe_runmake -C ${B}/libraries/libapparmor
64 oe_runmake -C ${B}/binutils
65 oe_runmake -C ${B}/utils
66 oe_runmake -C ${B}/parser
67 oe_runmake -C ${B}/profiles
68
69 if test -z "${HTTPD}" ; then
70 oe_runmake -C ${B}/changehat/mod_apparmor
71 fi
72
73 if test -z "${PAMLIB}" ; then
74 oe_runmake -C ${B}/changehat/pam_apparmor
75 fi
76}
77
78do_install () {
79 install -d ${D}/${INIT_D_DIR}
80 install -d ${D}/lib/apparmor
81
82 oe_runmake -C ${B}/libraries/libapparmor DESTDIR="${D}" install
83 oe_runmake -C ${B}/binutils DESTDIR="${D}" install
84 oe_runmake -C ${B}/utils DESTDIR="${D}" install
85 oe_runmake -C ${B}/parser DESTDIR="${D}" install
86 oe_runmake -C ${B}/profiles DESTDIR="${D}" install
87
88 # If perl is disabled this script won't be any good
89 if ! ${@bb.utils.contains('PACKAGECONFIG','perl','true','false', d)}; then
90 rm -f ${D}${sbindir}/aa-notify
91 fi
92
93 if test -z "${HTTPD}" ; then
94 oe_runmake -C ${B}/changehat/mod_apparmor DESTDIR="${D}" install
95 fi
96
97 if test -z "${PAMLIB}" ; then
98 oe_runmake -C ${B}/changehat/pam_apparmor DESTDIR="${D}" install
99 fi
100
101 # aa-easyprof is installed by python-tools-setup.py, fix it up
102 sed -i -e 's:/usr/bin/env.*:/usr/bin/python3:' ${D}${bindir}/aa-easyprof
103 chmod 0755 ${D}${bindir}/aa-easyprof
104
105 install ${WORKDIR}/apparmor ${D}/${INIT_D_DIR}/apparmor
106 install ${WORKDIR}/functions ${D}/lib/apparmor
107 install -d ${D}${systemd_system_unitdir}
108 install ${WORKDIR}/apparmor.service ${D}${systemd_system_unitdir}
109}
110
111do_compile_ptest () {
112 oe_runmake -C ${B}/tests/regression/apparmor
113 oe_runmake -C ${B}/parser/tst
114 oe_runmake -C ${B}/libraries/libapparmor
115}
116
117do_install_ptest () {
118 t=${D}/${PTEST_PATH}/testsuite
119 install -d ${t}
120 install -d ${t}/tests/regression/apparmor
121 cp -rf ${B}/tests/regression/apparmor ${t}/tests/regression
122
123 install -d ${t}/parser/tst
124 cp -rf ${B}/parser/tst ${t}/parser
125 cp ${B}/parser/apparmor_parser ${t}/parser
126 cp ${B}/parser/frob_slack_rc ${t}/parser
127
128 install -d ${t}/libraries/libapparmor
129 cp -rf ${B}/libraries/libapparmor ${t}/libraries
130
131 install -d ${t}/common
132 cp -rf ${B}/common ${t}
133
134 install -d ${t}/binutils
135 cp -rf ${B}/binutils ${t}
136}
137
138INITSCRIPT_PACKAGES = "${PN}"
139INITSCRIPT_NAME = "apparmor"
140INITSCRIPT_PARAMS = "start 16 2 3 4 5 . stop 35 0 1 6 ."
141
142SYSTEMD_PACKAGES = "${PN}"
143SYSTEMD_SERVICE_${PN} = "apparmor.service"
144SYSTEMD_AUTO_ENABLE = "disable"
145
146PACKAGES += "mod-${PN}"
147
148FILES_${PN} += "/lib/apparmor/ ${sysconfdir}/apparmor ${PYTHON_SITEPACKAGES_DIR}"
149FILES_mod-${PN} = "${libdir}/apache2/modules/*"
150
151RDEPENDS_${PN} += "bash lsb"
152RDEPENDS_${PN} += "${@bb.utils.contains('PACKAGECONFIG','python','python3 python3-modules','', d)}"
153RDEPENDS_${PN}_remove += "${@bb.utils.contains('PACKAGECONFIG','perl','','perl', d)}"
154RDEPENDS_${PN}-ptest += "perl coreutils dbus-lib bash"
diff --git a/recipes-security/AppArmor/files/apparmor b/recipes-security/AppArmor/files/apparmor
deleted file mode 100644
index ac3ab9a..0000000
--- a/recipes-security/AppArmor/files/apparmor
+++ /dev/null
@@ -1,227 +0,0 @@
1#!/bin/sh
2# ----------------------------------------------------------------------
3# Copyright (c) 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007
4# NOVELL (All rights reserved)
5# Copyright (c) 2008, 2009 Canonical, Ltd.
6#
7# This program is free software; you can redistribute it and/or
8# modify it under the terms of version 2 of the GNU General Public
9# License published by the Free Software Foundation.
10#
11# This program is distributed in the hope that it will be useful,
12# but WITHOUT ANY WARRANTY; without even the implied warranty of
13# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14# GNU General Public License for more details.
15#
16# You should have received a copy of the GNU General Public License
17# along with this program; if not, contact Novell, Inc.
18# ----------------------------------------------------------------------
19# Authors:
20# Steve Beattie <steve.beattie@canonical.com>
21# Kees Cook <kees@ubuntu.com>
22#
23# /etc/init.d/apparmor
24#
25### BEGIN INIT INFO
26# Provides: apparmor
27# Required-Start: $local_fs
28# Required-Stop: umountfs
29# Default-Start: S
30# Default-Stop:
31# Short-Description: AppArmor initialization
32# Description: AppArmor init script. This script loads all AppArmor profiles.
33### END INIT INFO
34
35log_daemon_msg() {
36 echo $*
37}
38
39log_end_msg () {
40 retval=$1
41 if [ $retval -eq 0 ]; then
42 echo "."
43 else
44 echo " failed!"
45 fi
46 return $retval
47}
48
49. /lib/apparmor/functions
50. /lib/lsb/init-functions
51
52usage() {
53 echo "Usage: $0 {start|stop|restart|reload|force-reload|status|recache}"
54}
55
56test -x ${PARSER} || exit 0 # by debian policy
57# LSM is built-in, so it is either there or not enabled for this boot
58test -d /sys/module/apparmor || exit 0
59
60securityfs() {
61 # Need securityfs for any mode
62 if [ ! -d "${AA_SFS}" ]; then
63 if cut -d" " -f2,3 /proc/mounts | grep -q "^${SECURITYFS} securityfs"'$' ; then
64 log_daemon_msg "AppArmor not available as kernel LSM."
65 log_end_msg 1
66 exit 1
67 else
68 log_daemon_msg "Mounting securityfs on ${SECURITYFS}"
69 if ! mount -t securityfs none "${SECURITYFS}"; then
70 log_end_msg 1
71 exit 1
72 fi
73 fi
74 fi
75 if [ ! -w "$AA_SFS"/.load ]; then
76 log_daemon_msg "Insufficient privileges to change profiles."
77 log_end_msg 1
78 exit 1
79 fi
80}
81
82handle_system_policy_package_updates() {
83 apparmor_was_updated=0
84
85 if ! compare_previous_version ; then
86 # On snappy flavors, if the current and previous versions are
87 # different then clear the system cache. snappy will handle
88 # "$PROFILES_CACHE_VAR" itself (on Touch flavors
89 # compare_previous_version always returns '0' since snappy
90 # isn't available).
91 clear_cache_system
92 apparmor_was_updated=1
93 elif ! compare_and_save_debsums apparmor ; then
94 # If the system policy has been updated since the last time we
95 # ran, clear the cache to prevent potentially stale binary
96 # cache files after an Ubuntu image based upgrade (LP:
97 # #1350673). This can be removed once all system image flavors
98 # move to snappy (on snappy systems compare_and_save_debsums
99 # always returns '0' since /var/lib/dpkg doesn't exist).
100 clear_cache
101 apparmor_was_updated=1
102 fi
103
104 if [ -x /usr/bin/aa-clickhook ] || [ -x /usr/bin/aa-profile-hook ] ; then
105 # If packages for system policy that affect click packages have
106 # been updated since the last time we ran, run aa-clickhook -f
107 force_clickhook=0
108 force_profile_hook=0
109 if ! compare_and_save_debsums apparmor-easyprof-ubuntu ; then
110 force_clickhook=1
111 fi
112 if ! compare_and_save_debsums apparmor-easyprof-ubuntu-snappy ; then
113 force_clickhook=1
114 fi
115 if ! compare_and_save_debsums click-apparmor ; then
116 force_clickhook=1
117 force_profile_hook=1
118 fi
119 if [ -x /usr/bin/aa-clickhook ] && ([ $force_clickhook -eq 1 ] || [ $apparmor_was_updated -eq 1 ]) ; then
120 aa-clickhook -f
121 fi
122 if [ -x /usr/bin/aa-profile-hook ] && ([ $force_profile_hook -eq 1 ] || [ $apparmor_was_updated -eq 1 ]) ; then
123 aa-profile-hook -f
124 fi
125 fi
126}
127
128# Allow "recache" even when running on the liveCD
129if [ "$1" = "recache" ]; then
130 log_daemon_msg "Recaching AppArmor profiles"
131 recache_profiles
132 rc=$?
133 log_end_msg "$rc"
134 exit $rc
135fi
136
137# do not perform start/stop/reload actions when running from liveCD
138test -d /rofs/etc/apparmor.d && exit 0
139
140rc=255
141case "$1" in
142 start)
143 if test -x /sbin/systemd-detect-virt && \
144 systemd-detect-virt --quiet --container && \
145 ! is_container_with_internal_policy; then
146 log_daemon_msg "Not starting AppArmor in container"
147 log_end_msg 0
148 exit 0
149 fi
150 log_daemon_msg "Starting AppArmor profiles"
151 securityfs
152 # That is only useful for click, snappy and system images,
153 # i.e. not in Debian. And it reads and writes to /var, that
154 # can be remote-mounted, so it would prevent us from using
155 # Before=sysinit.target without possibly introducing dependency
156 # loops.
157 handle_system_policy_package_updates
158 load_configured_profiles
159 rc=$?
160 log_end_msg "$rc"
161 ;;
162 stop)
163 log_daemon_msg "Clearing AppArmor profiles cache"
164 clear_cache
165 rc=$?
166 log_end_msg "$rc"
167 cat >&2 <<EOM
168All profile caches have been cleared, but no profiles have been unloaded.
169Unloading profiles will leave already running processes permanently
170unconfined, which can lead to unexpected situations.
171
172To set a process to complain mode, use the command line tool
173'aa-complain'. To really tear down all profiles, run the init script
174with the 'teardown' option."
175EOM
176 ;;
177 teardown)
178 if test -x /sbin/systemd-detect-virt && \
179 systemd-detect-virt --quiet --container && \
180 ! is_container_with_internal_policy; then
181 log_daemon_msg "Not tearing down AppArmor in container"
182 log_end_msg 0
183 exit 0
184 fi
185 log_daemon_msg "Unloading AppArmor profiles"
186 securityfs
187 running_profile_names | while read profile; do
188 if ! unload_profile "$profile" ; then
189 log_end_msg 1
190 exit 1
191 fi
192 done
193 rc=0
194 log_end_msg $rc
195 ;;
196 restart|reload|force-reload)
197 if test -x /sbin/systemd-detect-virt && \
198 systemd-detect-virt --quiet --container && \
199 ! is_container_with_internal_policy; then
200 log_daemon_msg "Not reloading AppArmor in container"
201 log_end_msg 0
202 exit 0
203 fi
204 log_daemon_msg "Reloading AppArmor profiles"
205 securityfs
206 clear_cache
207 load_configured_profiles
208 rc=$?
209 unload_obsolete_profiles
210
211 log_end_msg "$rc"
212 ;;
213 status)
214 securityfs
215 if [ -x /usr/sbin/aa-status ]; then
216 aa-status --verbose
217 else
218 cat "$AA_SFS"/profiles
219 fi
220 rc=$?
221 ;;
222 *)
223 usage
224 rc=1
225 ;;
226 esac
227exit $rc
diff --git a/recipes-security/AppArmor/files/apparmor.rc b/recipes-security/AppArmor/files/apparmor.rc
deleted file mode 100644
index 1507d7b..0000000
--- a/recipes-security/AppArmor/files/apparmor.rc
+++ /dev/null
@@ -1,98 +0,0 @@
1description "Pre-cache and pre-load apparmor profiles"
2author "Dimitri John Ledkov <xnox@ubuntu.com> and Jamie Strandboge <jamie@ubuntu.com>"
3
4task
5
6start on starting rc-sysinit
7
8script
9 [ -d /rofs/etc/apparmor.d ] && exit 0 # do not load on liveCD
10 [ -d /sys/module/apparmor ] || exit 0 # do not load without AppArmor
11 [ -x /sbin/apparmor_parser ] || exit 0 # do not load without parser
12
13 . /lib/apparmor/functions
14
15 systemd-detect-virt --quiet --container && ! is_container_with_internal_policy && exit 0 || true
16
17 # Need securityfs for any mode
18 if [ ! -d /sys/kernel/security/apparmor ]; then
19 if cut -d" " -f2,3 /proc/mounts | grep -q "^/sys/kernel/security securityfs"'$' ; then
20 exit 0
21 else
22 mount -t securityfs none /sys/kernel/security || exit 0
23 fi
24 fi
25
26 [ -w /sys/kernel/security/apparmor/.load ] || exit 0
27
28 apparmor_was_updated=0
29 if ! compare_previous_version ; then
30 # On snappy flavors, if the current and previous versions are
31 # different then clear the system cache. snappy will handle
32 # "$PROFILES_CACHE_VAR" itself (on Touch flavors
33 # compare_previous_version always returns '0' since snappy
34 # isn't available).
35 clear_cache_system
36 apparmor_was_updated=1
37 elif ! compare_and_save_debsums apparmor ; then
38 # If the system policy has been updated since the last time we
39 # ran, clear the cache to prevent potentially stale binary
40 # cache files after an Ubuntu image based upgrade (LP:
41 # #1350673). This can be removed once all system image flavors
42 # move to snappy (on snappy systems compare_and_save_debsums
43 # always returns '0' since /var/lib/dpkg doesn't exist).
44 clear_cache
45 apparmor_was_updated=1
46 fi
47
48 if [ -x /usr/bin/aa-clickhook ] || [ -x /usr/bin/aa-profile-hook ] ; then
49 # If packages for system policy that affect click packages have
50 # been updated since the last time we ran, run aa-clickhook -f
51 force_clickhook=0
52 force_profile_hook=0
53 if ! compare_and_save_debsums apparmor-easyprof-ubuntu ; then
54 force_clickhook=1
55 fi
56 if ! compare_and_save_debsums apparmor-easyprof-ubuntu-snappy ; then
57 force_clickhook=1
58 fi
59 if ! compare_and_save_debsums click-apparmor ; then
60 force_clickhook=1
61 force_profile_hook=1
62 fi
63 if [ -x /usr/bin/aa-clickhook ] && ([ $force_clickhook -eq 1 ] || [ $apparmor_was_updated -eq 1 ]) ; then
64 aa-clickhook -f
65 fi
66 if [ -x /usr/bin/aa-profile-hook ] && ([ $force_profile_hook -eq 1 ] || [ $apparmor_was_updated -eq 1 ]) ; then
67 aa-profile-hook -f
68 fi
69 fi
70
71 if [ "$ACTION" = "teardown" ]; then
72 running_profile_names | while read profile; do
73 unload_profile "$profile"
74 done
75 exit 0
76 fi
77
78 if [ "$ACTION" = "clear" ]; then
79 clear_cache
80 exit 0
81 fi
82
83 if [ "$ACTION" = "reload" ] || [ "$ACTION" = "force-reload" ]; then
84 clear_cache
85 load_configured_profiles
86 unload_obsolete_profiles
87 exit 0
88 fi
89
90 # Note: if apparmor-easyprof-ubuntu md5sums didn't match up above,
91 # aa-clickhook will have already compiled the policy, generated the cache
92 # files and loaded them into the kernel by this point, so reloading click
93 # policy from cache, while fairly fast (<2 seconds for 250 profiles on
94 # armhf), is redundant. Fixing this would complicate the logic quite a bit
95 # and it wouldn't improve the (by far) common case (ie, when
96 # 'aa-clickhook -f' is not run).
97 load_configured_profiles
98end script
diff --git a/recipes-security/AppArmor/files/apparmor.service b/recipes-security/AppArmor/files/apparmor.service
deleted file mode 100644
index e66afe4..0000000
--- a/recipes-security/AppArmor/files/apparmor.service
+++ /dev/null
@@ -1,22 +0,0 @@
1[Unit]
2Description=AppArmor initialization
3After=local-fs.target
4Before=sysinit.target
5AssertPathIsReadWrite=/sys/kernel/security/apparmor/.load
6ConditionSecurity=apparmor
7DefaultDependencies=no
8Documentation=man:apparmor(7)
9Documentation=http://wiki.apparmor.net/
10
11# Don't start this unit on the Ubuntu Live CD
12ConditionPathExists=!/rofs/etc/apparmor.d
13
14[Service]
15Type=oneshot
16RemainAfterExit=yes
17ExecStart=/etc/init.d/apparmor start
18ExecStop=/etc/init.d/apparmor stop
19ExecReload=/etc/init.d/apparmor reload
20
21[Install]
22WantedBy=sysinit.target
diff --git a/recipes-security/AppArmor/files/crosscompile_perl_bindings.patch b/recipes-security/AppArmor/files/crosscompile_perl_bindings.patch
deleted file mode 100644
index ef55de7..0000000
--- a/recipes-security/AppArmor/files/crosscompile_perl_bindings.patch
+++ /dev/null
@@ -1,25 +0,0 @@
1Upstream-Status: Inappropriate [configuration]
2
3As we're cross-compiling here we need to override CC/LD that MakeMaker has
4stuck in the generated Makefile with our cross tools. In this case, linking is
5done via the compiler rather than the linker directly so pass in CC not LD
6here.
7
8Signed-Off-By: Tom Rini <trini@konsulko.com>
9
10--- a/libraries/libapparmor/swig/perl/Makefile.am.orig 2017-06-13 19:04:43.296676212 -0400
11+++ b/libraries/libapparmor/swig/perl/Makefile.am 2017-06-13 19:05:03.488676693 -0400
12@@ -16,11 +16,11 @@
13
14 LibAppArmor.so: libapparmor_wrap.c Makefile.perl
15 if test ! -f libapparmor_wrap.c; then cp $(srcdir)/libapparmor_wrap.c . ; fi
16- $(MAKE) -fMakefile.perl
17+ $(MAKE) -fMakefile.perl CC='$(CC)' LD='$(CC)'
18 if test $(top_srcdir) != $(top_builddir) ; then rm -f libapparmor_wrap.c ; fi
19
20 install-exec-local: Makefile.perl
21- $(MAKE) -fMakefile.perl install_vendor
22+ $(MAKE) -fMakefile.perl install_vendor CC='$(CC)' LD='$(CC)'
23
24 # sadly there is no make uninstall for perl
25 #uninstall-local: Makefile.perl
diff --git a/recipes-security/AppArmor/files/disable_pdf.patch b/recipes-security/AppArmor/files/disable_pdf.patch
deleted file mode 100644
index c6b4bdd..0000000
--- a/recipes-security/AppArmor/files/disable_pdf.patch
+++ /dev/null
@@ -1,33 +0,0 @@
1Index: apparmor-2.10.95/parser/Makefile
2===================================================================
3--- apparmor-2.10.95.orig/parser/Makefile
4+++ apparmor-2.10.95/parser/Makefile
5@@ -139,17 +139,6 @@ export Q VERBOSE BUILD_OUTPUT
6 po/${NAME}.pot: ${SRCS} ${HDRS}
7 $(MAKE) -C po ${NAME}.pot NAME=${NAME} SOURCES="${SRCS} ${HDRS}"
8
9-techdoc.pdf: techdoc.tex
10- timestamp=$(shell date --utc "+%Y%m%d%H%M%S%z" -r $< );\
11- while pdflatex "\def\fixedpdfdate{$$timestamp}\input $<" ${BUILD_OUTPUT} || exit 1 ; \
12- grep -q "Label(s) may have changed" techdoc.log; \
13- do :; done
14-
15-techdoc/index.html: techdoc.pdf
16- latex2html -show_section_numbers -split 0 -noinfo -nonavigation -noaddress techdoc.tex ${BUILD_OUTPUT}
17-
18-techdoc.txt: techdoc/index.html
19- w3m -dump $< > $@
20
21 # targets arranged this way so that people who don't want full docs can
22 # pick specific targets they want.
23@@ -159,9 +148,7 @@ manpages: $(MANPAGES)
24
25 htmlmanpages: $(HTMLMANPAGES)
26
27-pdf: techdoc.pdf
28-
29-docs: manpages htmlmanpages pdf
30+docs: manpages htmlmanpages
31
32 indep: docs
33 $(Q)$(MAKE) -C po all
diff --git a/recipes-security/AppArmor/files/disable_perl_h_check.patch b/recipes-security/AppArmor/files/disable_perl_h_check.patch
deleted file mode 100644
index cf2640f..0000000
--- a/recipes-security/AppArmor/files/disable_perl_h_check.patch
+++ /dev/null
@@ -1,19 +0,0 @@
1Upstream-Status: Inappropriate [configuration]
2
3Remove file check for $perl_includedir/perl.h. AC_CHECK_FILE will fail on
4cross compilation. Rather than try and get a compile check to work here,
5we know that we have what's required via our metadata so remove only this
6check.
7
8Signed-Off-By: Tom Rini <trini@konsulko.com>
9
10--- a/libraries/libapparmor/configure.ac.orig 2017-06-13 16:41:38.668471495 -0400
11+++ b/libraries/libapparmor/configure.ac 2017-06-13 16:41:40.708471543 -0400
12@@ -58,7 +58,6 @@
13 AC_PATH_PROG(PERL, perl)
14 test -z "$PERL" && AC_MSG_ERROR([perl is required when enabling perl bindings])
15 perl_includedir="`$PERL -e 'use Config; print $Config{archlib}'`/CORE"
16- AC_CHECK_FILE($perl_includedir/perl.h, enable_perl=yes, enable_perl=no)
17 fi
18
19
diff --git a/recipes-security/AppArmor/files/functions b/recipes-security/AppArmor/files/functions
deleted file mode 100644
index cef8cfe..0000000
--- a/recipes-security/AppArmor/files/functions
+++ /dev/null
@@ -1,271 +0,0 @@
1# /lib/apparmor/functions for Debian -*- shell-script -*-
2# ----------------------------------------------------------------------
3# Copyright (c) 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007
4# NOVELL (All rights reserved)
5# Copyright (c) 2008-2010 Canonical, Ltd.
6#
7# This program is free software; you can redistribute it and/or
8# modify it under the terms of version 2 of the GNU General Public
9# License published by the Free Software Foundation.
10#
11# This program is distributed in the hope that it will be useful,
12# but WITHOUT ANY WARRANTY; without even the implied warranty of
13# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14# GNU General Public License for more details.
15#
16# You should have received a copy of the GNU General Public License
17# along with this program; if not, contact Novell, Inc.
18# ----------------------------------------------------------------------
19# Authors:
20# Kees Cook <kees@ubuntu.com>
21
22PROFILES="/etc/apparmor.d"
23PROFILES_CACHE="$PROFILES/cache"
24PROFILES_VAR="/var/lib/apparmor/profiles"
25PROFILES_SNAPPY="/var/lib/snapd/apparmor/profiles"
26PROFILES_CACHE_VAR="/var/cache/apparmor"
27PARSER="/sbin/apparmor_parser"
28SECURITYFS="/sys/kernel/security"
29export AA_SFS="$SECURITYFS/apparmor"
30
31# Suppress warnings when booting in quiet mode
32quiet_arg=""
33[ "${QUIET:-no}" = yes ] && quiet_arg="-q"
34[ "${quiet:-n}" = y ] && quiet_arg="-q"
35
36foreach_configured_profile() {
37 rc_all="0"
38 for pdir in "$PROFILES" "$PROFILES_VAR" "$PROFILES_SNAPPY" ; do
39 if [ ! -d "$pdir" ]; then
40 continue
41 fi
42 num=`find "$pdir" -type f ! -name '*.md5sums' | wc -l`
43 if [ "$num" = "0" ]; then
44 continue
45 fi
46
47 cache_dir="$PROFILES_CACHE"
48 if [ -d "$PROFILES_CACHE_VAR" ] && [ "$pdir" = "$PROFILES_VAR" ] || [ "$pdir" = "$PROFILES_SNAPPY" ]; then
49 cache_dir="$PROFILES_CACHE_VAR"
50 fi
51 cache_args="--cache-loc=$cache_dir"
52 if [ ! -d "$cache_dir" ]; then
53 cache_args=
54 fi
55
56 # LP: #1383858 - expr tree simplification is too slow for
57 # Touch policy on ARM, so disable it for now
58 cache_extra_args=
59 if [ -d "$PROFILES_CACHE_VAR" ] && [ "$pdir" = "$PROFILES_VAR" ] || [ "$pdir" = "$PROFILES_SNAPPY" ]; then
60 cache_extra_args="-O no-expr-simplify"
61 fi
62
63 # If need to compile everything, then use -n1 with xargs to
64 # take advantage of -P. When cache files are in use, omit -n1
65 # since it is considerably faster on moderately sized profile
66 # sets to give the parser all the profiles to load at once
67 n1_args=
68 num=`find "$cache_dir" -type f ! -name '.features' | wc -l`
69 if [ "$num" = "0" ]; then
70 n1_args="-n1"
71 fi
72
73 (ls -1 "$pdir" | egrep -v '(\.dpkg-(new|old|dist|bak)|~)$' | \
74 while read profile; do
75 if [ -f "$pdir"/"$profile" ]; then
76 echo "$pdir"/"$profile"
77 fi
78 done) | \
79 xargs $n1_args -d"\n" -P$(getconf _NPROCESSORS_ONLN) "$PARSER" "$@" $cache_args $cache_extra_args -- || {
80 rc_all="$?"
81 # FIXME: when the parser properly handles broken
82 # profiles (LP: #1377338), remove this if statement.
83 # For now, if the xargs returns with error, just run
84 # through everything with -n1. (This could be broken
85 # out and refactored, but this is temporary so make it
86 # easy to understand and revert)
87 if [ "$rc_all" != "0" ]; then
88 (ls -1 "$pdir" | \
89 egrep -v '(\.dpkg-(new|old|dist|bak)|~)$' | \
90 while read profile; do
91 if [ -f "$pdir"/"$profile" ]; then
92 echo "$pdir"/"$profile"
93 fi
94 done) | \
95 xargs -n1 -d"\n" -P$(getconf _NPROCESSORS_ONLN) "$PARSER" "$@" $cache_args $cache_extra_args -- || {
96 rc_all="$?"
97 }
98 fi
99 }
100 done
101 return $rc_all
102}
103
104load_configured_profiles() {
105 clear_cache_if_outdated
106 foreach_configured_profile $quiet_arg --write-cache --replace
107}
108
109load_configured_profiles_without_caching() {
110 foreach_configured_profile $quiet_arg --replace
111}
112
113recache_profiles() {
114 clear_cache
115 foreach_configured_profile $quiet_arg --write-cache --skip-kernel-load
116}
117
118configured_profile_names() {
119 foreach_configured_profile $quiet_arg -N 2>/dev/null | LC_COLLATE=C sort | grep -v '//'
120}
121
122running_profile_names() {
123 # Output a sorted list of loaded profiles, skipping libvirt's
124 # dynamically generated files
125 cat "$AA_SFS"/profiles | sed -e "s/ (\(enforce\|complain\))$//" | egrep -v '^libvirt-[0-9a-f\-]+$' | LC_COLLATE=C sort | grep -v '//'
126}
127
128unload_profile() {
129 echo -n "$1" > "$AA_SFS"/.remove
130}
131
132clear_cache() {
133 clear_cache_system
134 clear_cache_var
135}
136
137clear_cache_system() {
138 find "$PROFILES_CACHE" -maxdepth 1 -type f -print0 | xargs -0 rm -f --
139}
140
141clear_cache_var() {
142 find "$PROFILES_CACHE_VAR" -maxdepth 1 -type f -print0 | xargs -0 rm -f --
143}
144
145read_features_dir()
146{
147 for f in `ls -AU "$1"` ; do
148 if [ -f "$1/$f" ] ; then
149 read -r KF < "$1/$f" || true
150 echo -n "$f {$KF } "
151 elif [ -d "$1/$f" ] ; then
152 echo -n "$f {"
153 KF=`read_features_dir "$1/$f"` || true
154 echo -n "$KF} "
155 fi
156 done
157}
158
159clear_cache_if_outdated() {
160 if [ -r "$PROFILES_CACHE"/.features ]; then
161 if [ -d "$AA_SFS"/features ]; then
162 KERN_FEATURES=`read_features_dir "$AA_SFS"/features`
163 else
164 read -r KERN_FEATURES < "$AA_SFS"/features
165 fi
166 CACHE_FEATURES=`tr '\n' ' ' < "$PROFILES_CACHE"/.features`
167 if [ "$KERN_FEATURES" != "$CACHE_FEATURES" ]; then
168 clear_cache
169 fi
170 fi
171}
172
173unload_obsolete_profiles() {
174 # Currently we must re-parse all the profiles to get policy names. :(
175 aa_configured=$(mktemp -t aa-XXXXXX)
176 configured_profile_names > "$aa_configured" || true
177 aa_loaded=$(mktemp -t aa-XXXXXX)
178 running_profile_names > "$aa_loaded" || true
179 LC_COLLATE=C comm -2 -3 "$aa_loaded" "$aa_configured" | while read profile ; do
180 unload_profile "$profile"
181 done
182 rm -f "$aa_configured" "$aa_loaded"
183}
184
185# If the system debsum differs from the saved debsum, the new system debsum is
186# saved and non-zero is returned. Returns 0 if the two debsums matched or if
187# the system debsum file does not exist. This can be removed when system image
188# flavors all move to snappy.
189compare_and_save_debsums() {
190 pkg="$1"
191
192 if [ -n $pkg ] && [ -d "$PROFILES_VAR" ]; then
193 sums="/var/lib/dpkg/info/${pkg}.md5sums"
194 # store saved md5sums in /var/lib/apparmor/profiles since
195 # /var/cache/apparmor might be cleared by apparmor
196 saved_sums="${PROFILES_VAR}/.${pkg}.md5sums"
197
198 if [ -f "$sums" ] && \
199 ! diff -q "$sums" "$saved_sums" 2>&1 >/dev/null ; then
200 cp -f "$sums" "$saved_sums"
201 return 1
202 fi
203 fi
204
205 return 0
206}
207
208compare_previous_version() {
209 installed="/usr/share/snappy/security-policy-version"
210 previous="/var/lib/snappy/security-policy-version"
211
212 # When just $previous doesn't exist, assume this is a new system with
213 # no cache and don't do anything special.
214 if [ -f "$installed" ] && [ -f "$previous" ]; then
215 pv=`grep '^apparmor/' "$previous" | cut -d ' ' -f 2`
216 iv=`grep '^apparmor/' "$installed" | cut -d ' ' -f 2`
217 if [ -n "$iv" ] && [ -n "$pv" ] && [ "$iv" != "$pv" ]; then
218 # snappy updates $previous elsewhere, so just return
219 return 1
220 fi
221 fi
222
223 return 0
224}
225
226# Checks to see if the current container is capable of having internal AppArmor
227# profiles that should be loaded. Callers of this function should have already
228# verified that they're running inside of a container environment with
229# something like `systemd-detect-virt --container`.
230#
231# The only known container environments capable of supporting internal policy
232# are LXD and LXC environment.
233#
234# Returns 0 if the container environment is capable of having its own internal
235# policy and non-zero otherwise.
236#
237# IMPORTANT: This function will return 0 in the case of a non-LXD/non-LXC
238# system container technology being nested inside of a LXD/LXC container that
239# utilized an AppArmor namespace and profile stacking. The reason 0 will be
240# returned is because .ns_stacked will be "yes" and .ns_name will still match
241# "lx[dc]-*" since the nested system container technology will not have set up
242# a new AppArmor profile namespace. This will result in the nested system
243# container's boot process to experience failed policy loads but the boot
244# process should continue without any loss of functionality. This is an
245# unsupported configuration that cannot be properly handled by this function.
246is_container_with_internal_policy() {
247 local ns_stacked_path="${AA_SFS}/.ns_stacked"
248 local ns_name_path="${AA_SFS}/.ns_name"
249 local ns_stacked
250 local ns_name
251
252 if ! [ -f "$ns_stacked_path" ] || ! [ -f "$ns_name_path" ]; then
253 return 1
254 fi
255
256 read -r ns_stacked < "$ns_stacked_path"
257 if [ "$ns_stacked" != "yes" ]; then
258 return 1
259 fi
260
261 # LXD and LXC set up AppArmor namespaces starting with "lxd-" and
262 # "lxc-", respectively. Return non-zero for all other namespace
263 # identifiers.
264 read -r ns_name < "$ns_name_path"
265 if [ "${ns_name#lxd-*}" = "$ns_name" ] && \
266 [ "${ns_name#lxc-*}" = "$ns_name" ]; then
267 return 1
268 fi
269
270 return 0
271}
diff --git a/recipes-security/AppArmor/files/run-ptest b/recipes-security/AppArmor/files/run-ptest
deleted file mode 100644
index 3b8e427..0000000
--- a/recipes-security/AppArmor/files/run-ptest
+++ /dev/null
@@ -1,4 +0,0 @@
1#! /bin/sh
2cd testsuite
3
4make -C tests/regression/apparmor tests
diff --git a/recipes-security/AppArmor/files/tool-paths.patch b/recipes-security/AppArmor/files/tool-paths.patch
deleted file mode 100644
index aaf08da..0000000
--- a/recipes-security/AppArmor/files/tool-paths.patch
+++ /dev/null
@@ -1,37 +0,0 @@
1Upstream-Status: Backport
2Signed-off-by: Ross Burton <ross.burton@intel.com>
3
4From e7edd937adcbf1b3c8d38a31de5bacb2029b1965 Mon Sep 17 00:00:00 2001
5From: John Johansen <john.johansen@canonical.com>
6Date: Thu, 4 Oct 2018 23:15:28 -0700
7Subject: [PATCH] parser: fix Makefile hardcoded paths to flex and bison
8
9The hardcoded paths for flex and python can break builds on systems
10where those tools are stored in an alternate location. Use which
11to lookup where flex and bison are available.
12
13This fixes issue #4
14
15Signed-off-by: John Johansen <john.johansen@canonical.com>
16---
17 parser/Makefile | 4 ++--
18 1 file changed, 2 insertions(+), 2 deletions(-)
19
20diff --git a/parser/Makefile b/parser/Makefile
21index 4d370c36..015c218d 100644
22--- a/parser/Makefile
23+++ b/parser/Makefile
24@@ -27,9 +27,9 @@ INSTALL_CONFDIR=${DESTDIR}${CONFDIR}
25 LOCALEDIR=/usr/share/locale
26 MANPAGES=apparmor.d.5 apparmor.7 apparmor_parser.8 subdomain.conf.5
27
28-YACC := /usr/bin/bison
29+YACC := bison
30 YFLAGS := -d
31-LEX := /usr/bin/flex
32+LEX := flex
33 LEXFLAGS = -B -v
34 WARNINGS = -Wall
35 EXTRA_WARNINGS = -Wsign-compare -Wmissing-field-initializers -Wformat-security -Wunused-parameter
36--
372.11.0
diff --git a/recipes-security/smack/files/run-ptest b/recipes-security/smack/files/run-ptest
deleted file mode 100644
index 049a9b4..0000000
--- a/recipes-security/smack/files/run-ptest
+++ /dev/null
@@ -1,3 +0,0 @@
1#!/bin/sh
2./tests/make_policies.bash ./tests/generator
3./tests/make_policies.bash ./tests/generator labels
diff --git a/recipes-security/smack/files/smack_generator_make_fixup.patch b/recipes-security/smack/files/smack_generator_make_fixup.patch
deleted file mode 100644
index 4d677e7..0000000
--- a/recipes-security/smack/files/smack_generator_make_fixup.patch
+++ /dev/null
@@ -1,18 +0,0 @@
1Upstream-Status: Pending
2
3Signed-off-by: Armin Kuster <akuster808@gmail.com>
4
5
6Index: git/tests/Makefile
7===================================================================
8--- git.orig/tests/Makefile
9+++ git/tests/Makefile
10@@ -4,7 +4,7 @@ clean:
11 rm -rf ./out ./generator
12
13 generator: generator.c
14- gcc -Wall -O3 generator.c -o ./generator
15+ ${CC} ${LDFLAGS} generator.c -o ./generator
16
17 policies: ./generator ./make_policies.bash
18 ./make_policies.bash ./generator
diff --git a/recipes-security/smack/smack_1.3.1.bb b/recipes-security/smack/smack_1.3.1.bb
deleted file mode 100644
index 246562a..0000000
--- a/recipes-security/smack/smack_1.3.1.bb
+++ /dev/null
@@ -1,54 +0,0 @@
1DESCRIPTION = "Selection of tools for developers working with Smack"
2HOMEPAGE = "https://github.com/smack-team/smack"
3SECTION = "Security/Access Control"
4LICENSE = "LGPL-2.1"
5
6LIC_FILES_CHKSUM = "file://COPYING;md5=4fbd65380cdd255951079008b364516c"
7
8SRCREV = "4a102c7584b39ce693995ffb65e0918a9df98dd8"
9SRC_URI = " \
10 git://github.com/smack-team/smack.git \
11 file://smack_generator_make_fixup.patch \
12 file://run-ptest"
13
14PV = "1.3.1"
15
16inherit autotools update-rc.d pkgconfig ptest ${@bb.utils.contains('VIRTUAL-RUNTIME_init_manager','systemd','systemd','', d)}
17
18S = "${WORKDIR}/git"
19
20PACKAGECONFIG ??= ""
21PACKAGECONFIG_append = " ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'systemd', '', d)}"
22
23PACKAGECONFIG[systemd] = "--with-systemdsystemunitdir=${systemd_system_unitdir}, --without-systemdsystemunitdir, systemd"
24
25do_compile_append () {
26 oe_runmake -C ${S}/tests generator
27}
28
29do_install_append () {
30 install -d ${D}${sysconfdir}/init.d
31 install -d ${D}${sysconfdir}/smack
32 install -d ${D}${sysconfdir}/smack/accesses.d
33 install -d ${D}${sysconfdir}/smack/cipso.d
34 install ${S}/init/smack.rc ${D}/${sysconfdir}/init.d/smack
35}
36
37do_install_ptest () {
38 install -d ${D}${PTEST_PATH}/tests
39 install ${S}/tests/generator ${D}/${PTEST_PATH}/tests
40 install ${S}/tests/generate-rules.sh ${D}${PTEST_PATH}/tests
41 install ${S}/tests/make_policies.bash ${D}${PTEST_PATH}/tests
42}
43
44INITSCRIPT_PACKAGES = "${PN}"
45INITSCRIPT_NAME = "smack"
46INITSCRIPT_PARAMS = "start 16 2 3 4 5 . stop 35 0 1 6 ."
47
48FILES_${PN} += "${sysconfdir}/init.d/smack"
49FILES_${PN}-ptest += "generator"
50
51RDEPENDS_${PN} += "coreutils"
52RDEPENDS_${PN}-ptest += "make bash bc"
53
54BBCLASSEXTEND = "native"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-07-21 05:10:33 +0000