linux/meta-selinux.git, branch warrior

Update MAINTAINERS with new email addr

2019-10-18T16:01:57+00:00

Signed-off-by: Mark Hatle Signed-off-by: Joe MacDonald

Revert glib-2.0: fix configure error for meson build

2019-10-18T14:57:07+00:00

On Warrior branch, glib-2.0 is in version 2.58.3 so we need to revert commit [bb0c9c3abcb] until then. Signed-off-by: Vincent Prince Signed-off-by: Joe MacDonald

compat: remove thud from warrior layer compatibility list

2019-09-18T09:02:51+00:00

Based on this discussion: https://www.mail-archive.com/yocto@yoctoproject.org/msg45785.html the warrior branch does not build against oe-core thud any longer. Since that's not really intended to be a supported use caes anyway, remove the layer compatibility statement for thud. Signed-off-by: Joe MacDonald

selinux-python: Fix dependency for ntpath

2019-08-28T14:35:12+00:00

On yocto warrior the semanage tool didn't work correctly, because it couldn't find ntpath module. It turned out that this module is now part of the package python-misc, therefore add dependency to python-misc. Signed-off-by: Lorenz Kofler Signed-off-by: Joe MacDonald

selinux-init: use systemd (re)labelling

2019-08-28T14:28:06+00:00

Boot loops were being seen when booting with selinux enabled, when the init system in use is systemd. Once logs were retrieved from the failing system the error was found to be selinux-init.sh[284]: /sbin/restorecon: Could not set context for /sys/fs/cgroup/cpuacct: Read-only file system selinux-init.sh[284]: /sbin/restorecon: Could not set context for /sys/fs/cgroup/cpu: Read-only file system Systemd mounts /sys/fs/cgroup read-only and the (re)labelling code used by selinux-init.sh is unable to handle this. On top of this the system is basically presenting two methods of (re)labelling; using the built in systemd approach via selinux-autorelabel.service *and* the code we have in selinux-init.sh. This can get confusing especially given that most online resources will speak to the systemd approach using selinux-autorelabel.service and /.autorelabel. These changes leave the current approach in place when sysvinit is the init system used, but if systemd is being used we make use of it's internal (re)labelling functionality. Overall the workflow remains the same but we now avoid boot loops (systemd remounts /sys/fs/cgroup rw during the (re)labelling procedure). Signed-off-by: Mark Asselstine Signed-off-by: Joe MacDonald

selinux-sandbox: add runtime dependency on python-core

2019-08-28T14:28:06+00:00

Fixes: ERROR: QA Issue: /usr/share/sandbox/start contained in package selinux-sandbox requires /usr/bin/python, but no providers found in RDEPENDS_selinux-sandbox? [file-rdeps] Signed-off-by: Yi Zhao Signed-off-by: Joe MacDonald

selinux-python: add python-core as runtime dependency

2019-08-28T14:28:06+00:00

Fix QA issues: QA Issue: /usr/lib64/python2.7/site-packages/seobject.py contained in package selinux-python requires /usr/bin/python, but no providers found in RDEPENDS_selinux-python? [file-rdeps] QA Issue: /usr/bin/audit2allow contained in package selinux-python-audit2allow requires /usr/bin/python, but no providers found in RDEPENDS_selinux-python-audit2allow? [file-rdeps] QA Issue: /usr/bin/chcat contained in package selinux-python-chcat requires /usr/bin/python, but no providers found in RDEPENDS_selinux-python-chcat? [file-rdeps] Signed-off-by: Yi Zhao Signed-off-by: Joe MacDonald

mcstrans: specify SBINDIR

2019-08-28T14:26:52+00:00

We need SBINDIR to be compatible with the usrmerge distro feature. The update to version 2.8 (commit c55c0aca...) removed the definition, perhaps because the "${D}/" prefix broke the build. Signed-off-by: Joe Slater Signed-off-by: Joe MacDonald

libselinux: fix build with glibc 2.30

2019-08-28T14:26:52+00:00

Fix build error: procattr.c:27:14: error: static declaration of 'gettid' follows non-static declaration 27 | static pid_t gettid(void) | ^~~~~~ In file included from /buildarea/build/tmp/work/core2-64-poky-linux/libselinux/2.8-r0/recipe-sysroot/usr/include/unistd.h:1170, from procattr.c:2: /buildarea/build/tmp/work/core2-64-poky-linux/libselinux/2.8-r0/recipe-sysroot/usr/include/bits/unistd_ext.h:34:16: note: previous declaration of 'gettid' was here 34 | extern __pid_t gettid (void) __THROW; | ^~~~~~ Signed-off-by: Yi Zhao Signed-off-by: Joe MacDonald

audit: use git fetcher instead of the tarball source

2019-07-09T02:24:25+00:00

Per http://people.redhat.com/sgrubb/audit/, the tarball source moves to https://github.com/linux-audit/audit-userspace, and since commit [21f84fc insane: add sanity checks to SRC_URI] applied in oe-core, do not use unstable github archive tarballs, so use git instead. Signed-off-by: Mingli Yu Signed-off-by: Joe MacDonald