linux/meta-selinux.git/recipes-security, branch master-next

libselinux.inc: Add python-shell to libselinux-python RDEPENDS.

2019-04-15T16:57:51+00:00

The libselinux SWIG wrapper imports shutil. Signed-off-by: Chris PeBenito Signed-off-by: Joe MacDonald

audit: change to use ${WORKDIR} instead ${S}/../

2019-04-15T13:02:21+00:00

The do_install function is assuming that ${S}/../ is ${WORKDIR}, but this is not true when using `devtool modify audit'. So change to use ${WORKDIR}. Signed-off-by: Chen Qi Signed-off-by: Joe MacDonald

setools: fix build failure with gcc 7

2019-04-14T21:29:57+00:00

Backport patch from setools upstream to fix build failure with GCC 7 due to possible truncation of snprintf output. It could be reproduced on 64 bit bsps such as qemux86-64 and qemumips64 with configs: SELECTED_OPTIMIZATION = "${DEBUG_OPTIMIZATION}" DEBUG_BUILD = "1" Signed-off-by: Kai Kang Signed-off-by: Joe MacDonald

selinux: remove git version

2019-04-14T21:20:56+00:00

The git version of libselinux libsemanage libsepol checkpolicy and policycoreutils are far behind the master branch and now they can not build due to the do_patch error. The current stable 2.8 version works well so we can remove them. Signed-off-by: Yi Zhao Signed-off-by: Joe MacDonald

packagegroup-selinux-minimal: add selinux-init

2019-04-14T21:14:54+00:00

When trying to build a minimal image (eg: without python), the default user on autologin is not mapped to the intended user/role/domain: # id -Z system_u:system_r:kernel_t:s0 And the following error is displayed on autologin: Unable to get valid context for While on an image built with the core-selinux packagegroup: # id -Z unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 Adding selinux-init to the minimal package list fixes the issue. This package does not seem to bring along additional dependencies. Signed-off-by: Luca Boccassi Signed-off-by: Joe MacDonald

core-image-selinux.bb: remove trailing whitespace

2019-04-14T21:07:16+00:00

Signed-off-by: Yi Zhao Signed-off-by: Joe MacDonald

refpolicy: update to 2.20190201 and git HEAD policies

2019-04-12T19:28:38+00:00

Additionally, the README has fallen out of date, update it to reflect the current reality of layer dependencies. Signed-off-by: Joe MacDonald

Backport patches from upstream to fix build with musl

2019-03-25T08:43:53+00:00

Audit 2.8.4 fails to build with musl. The fixes have been committed to the upstream master branch and can be backported. Building with glibc is unaffected. Signed-off-by: Luca Boccassi Signed-off-by: Joe MacDonald

refpolicy: fix up all refpolicy 20170224 builds for current master

2018-10-30T12:05:29+00:00

Signed-off-by: Joe MacDonald

refpolicy_git.inc: lock SRCREVs on the actual version hashes

2018-10-23T12:18:05+00:00

Using AUTOREV in the main repository has its downsides. 1. The checked out version isn't actually the version depicted by PV. 2. Breaks builds in scenarios where network isn't available or BB_NO_NETWORK is used even after sources are already fetched. 1 is self explanatory, for 2 whenever SRCREV is set to AUTOREV and SRCPV is used in PV the fetcher tries to access the network in order to determine SRCPV (bb.fetch2.get_srcrev) and fails for obvious reasons during parsing even when versioned recipes are used as PREFERRED_VERSION because parsing still happens for recipes that are in BB's search paths and we see. Traceback (most recent call last): bb.data_smart.ExpansionError: Failure expanding variable SRCPV, expression was ${@bb.fetch2.get_srcrev(d)} which triggered exception NetworkAccess: Network access disabled through BB_NO_NETWORK (or set indirectly due to use of BB_FETCH_PREMIRRORONLY) but access requested with command git -c core.fsyncobjectfiles=0 ls-remote git://github.com/TresysTechnology/refpolicy.git (for url git://github.com/TresysTechnology/refpolicy.git) So we lock the REVs and do that with a soft assignment which allows overriding the REVs from elsewhere. Signed-off-by: Awais Belal Signed-off-by: Joe MacDonald