summaryrefslogtreecommitdiffstats
path: root/recipes-core
diff options
context:
space:
mode:
authorMark Hatle <mark.hatle@windriver.com>2017-09-08 10:44:23 -0500
committerMark Hatle <mark.hatle@windriver.com>2017-09-14 08:29:01 -0500
commit4fefe83c3203c11fadbe43637a3058284b60427b (patch)
treeaf4b33f05100c12ed16851f5dd4129f0e176da25 /recipes-core
parent694b8d1f1a590083e4445d6941f24b412ec0f206 (diff)
downloadmeta-selinux-4fefe83c3203c11fadbe43637a3058284b60427b.tar.gz
Refactor to conform to YP Compat requirements
Change the references to check for the distribution flag of 'selinux' being set before taking any action within the bbappends. This prevents the signature from being modified. Also remove PR changes, as they are no longer allowed. Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
Diffstat (limited to 'recipes-core')
-rw-r--r--recipes-core/busybox/busybox_%.bbappend88
-rw-r--r--recipes-core/busybox/busybox_selinux.inc85
-rw-r--r--recipes-core/coreutils/coreutils_%.bbappend3
-rw-r--r--recipes-core/dbus/dbus_%.bbappend3
-rw-r--r--recipes-core/eudev/eudev_%.bbappend3
-rw-r--r--recipes-core/eudev/eudev_selinux.inc3
-rw-r--r--recipes-core/eudev/files/init (renamed from recipes-core/eudev/eudev/init)0
-rw-r--r--recipes-core/eudev/files/udev-cache (renamed from recipes-core/eudev/eudev/udev-cache)0
-rw-r--r--recipes-core/glib-2.0/glib-2.0_%.bbappend2
-rwxr-xr-xrecipes-core/initscripts/files/devpts.sh (renamed from recipes-core/initscripts/initscripts/devpts.sh)0
-rw-r--r--recipes-core/initscripts/initscripts-1.0_selinux.inc11
-rw-r--r--recipes-core/initscripts/initscripts_1.0.bbappend14
-rw-r--r--recipes-core/libcgroup/libcgroup_%.bbappend13
-rw-r--r--recipes-core/libcgroup/libcgroup_selinux.inc10
-rw-r--r--recipes-core/systemd/systemd_%.bbappend2
-rw-r--r--recipes-core/sysvinit/files/sysvinit-fix-is_selinux_enabled.patch (renamed from recipes-core/sysvinit/sysvinit-2.88dsf/sysvinit-fix-is_selinux_enabled.patch)0
-rw-r--r--recipes-core/sysvinit/sysvinit-2.88dsf_selinux.inc11
-rw-r--r--recipes-core/sysvinit/sysvinit_2.88dsf.bbappend15
-rw-r--r--recipes-core/util-linux/util-linux_%.bbappend4
19 files changed, 132 insertions, 135 deletions
diff --git a/recipes-core/busybox/busybox_%.bbappend b/recipes-core/busybox/busybox_%.bbappend
index b4935b2..7719d3b 100644
--- a/recipes-core/busybox/busybox_%.bbappend
+++ b/recipes-core/busybox/busybox_%.bbappend
@@ -1,87 +1 @@
1PR .= ".1" require ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', '${BPN}_selinux.inc', '', d)}
2
3FILES_${PN} += "${libdir}/${PN}"
4
5# We should use sh wrappers instead of links so the commands could get correct
6# security labels
7python create_sh_wrapper_reset_alternative_vars () {
8 # We need to load the full set of busybox provides from the /etc/busybox.links
9 # Use this to see the update-alternatives with the right information
10
11 dvar = d.getVar('D', True)
12 pn = d.getVar('PN', True)
13
14 def create_sh_alternative_vars(links, target, mode):
15 import shutil
16 # Create sh wrapper template
17 fwp = open("busybox_wrapper", 'w')
18 fwp.write("#!%s" % (target))
19 os.fchmod(fwp.fileno(), mode)
20 fwp.close()
21 # Install the sh wrappers and alternatives reset to link to them
22 wpdir = os.path.join(d.getVar('libdir', True), pn)
23 wpdir_dest = '%s%s' % (dvar, wpdir)
24 if not os.path.exists(wpdir_dest):
25 os.makedirs(wpdir_dest)
26 f = open('%s%s' % (dvar, links), 'r')
27 for alt_link_name in f:
28 alt_link_name = alt_link_name.strip()
29 alt_name = os.path.basename(alt_link_name)
30 # Copy script wrapper to wp_path
31 alt_wppath = '%s%s' % (wpdir, alt_link_name)
32 alt_wppath_dest = '%s%s' % (wpdir_dest, alt_link_name)
33 alt_wpdir_dest = os.path.dirname(alt_wppath_dest)
34 if not os.path.exists(alt_wpdir_dest):
35 os.makedirs(alt_wpdir_dest)
36 shutil.copy2("busybox_wrapper", alt_wppath_dest)
37 # Re-set alternatives
38 # Match coreutils
39 if alt_name == '[':
40 alt_name = 'lbracket'
41 d.appendVar('ALTERNATIVE_%s' % (pn), ' ' + alt_name)
42 d.setVarFlag('ALTERNATIVE_LINK_NAME', alt_name, alt_link_name)
43 if os.path.exists(alt_wppath_dest):
44 d.setVarFlag('ALTERNATIVE_TARGET', alt_name, alt_wppath)
45 f.close()
46
47 os.remove("busybox_wrapper")
48 return
49
50 if os.path.exists('%s/etc/busybox.links' % (dvar)):
51 create_sh_alternative_vars("/etc/busybox.links", "/bin/busybox", 0o0755)
52 else:
53 create_sh_alternative_vars("/etc/busybox.links.nosuid", "/bin/busybox.nosuid", 0o0755)
54 create_sh_alternative_vars("/etc/busybox.links.suid", "/bin/busybox.suid", 0o4755)
55}
56
57# Add to PACKAGEBUILDPKGD so it could override the alternatives, which are set in
58# do_package_prepend() section of busybox_*.bb.
59PACKAGEBUILDPKGD_prepend = "create_sh_wrapper_reset_alternative_vars "
60
61# Use sh wrappers instead of links
62pkg_postinst_${PN} () {
63 # This part of code is dedicated to the on target upgrade problem.
64 # It's known that if we don't make appropriate symlinks before update-alternatives calls,
65 # there will be errors indicating missing commands such as 'sed'.
66 # These symlinks will later be updated by update-alternatives calls.
67 test -n 2 > /dev/null || alias test='busybox test'
68 if test "x$D" = "x"; then
69 # Remove busybox.nosuid if it's a symlink, because this situation indicates
70 # that we're installing or upgrading to a one-binary busybox.
71 if test -h /bin/busybox.nosuid; then
72 rm -f /bin/busybox.nosuid
73 fi
74 for suffix in "" ".nosuid" ".suid"; do
75 if test -e /etc/busybox.links$suffix; then
76 while read link; do
77 if test ! -e "$link"; then
78 # we can use busybox here because even if we are using splitted busybox
79 # we've made a symlink from /bin/busybox to /bin/busybox.nosuid.
80 busybox echo "#!/bin/busybox$suffix" > $link
81 fi
82 done < /etc/busybox.links$suffix
83 fi
84 done
85 fi
86}
87
diff --git a/recipes-core/busybox/busybox_selinux.inc b/recipes-core/busybox/busybox_selinux.inc
new file mode 100644
index 0000000..3f20815
--- /dev/null
+++ b/recipes-core/busybox/busybox_selinux.inc
@@ -0,0 +1,85 @@
1FILES_${PN} += "${libdir}/${PN}"
2
3# We should use sh wrappers instead of links so the commands could get correct
4# security labels
5python create_sh_wrapper_reset_alternative_vars () {
6 # We need to load the full set of busybox provides from the /etc/busybox.links
7 # Use this to see the update-alternatives with the right information
8
9 dvar = d.getVar('D', True)
10 pn = d.getVar('PN', True)
11
12 def create_sh_alternative_vars(links, target, mode):
13 import shutil
14 # Create sh wrapper template
15 fwp = open("busybox_wrapper", 'w')
16 fwp.write("#!%s" % (target))
17 os.fchmod(fwp.fileno(), mode)
18 fwp.close()
19 # Install the sh wrappers and alternatives reset to link to them
20 wpdir = os.path.join(d.getVar('libdir', True), pn)
21 wpdir_dest = '%s%s' % (dvar, wpdir)
22 if not os.path.exists(wpdir_dest):
23 os.makedirs(wpdir_dest)
24 f = open('%s%s' % (dvar, links), 'r')
25 for alt_link_name in f:
26 alt_link_name = alt_link_name.strip()
27 alt_name = os.path.basename(alt_link_name)
28 # Copy script wrapper to wp_path
29 alt_wppath = '%s%s' % (wpdir, alt_link_name)
30 alt_wppath_dest = '%s%s' % (wpdir_dest, alt_link_name)
31 alt_wpdir_dest = os.path.dirname(alt_wppath_dest)
32 if not os.path.exists(alt_wpdir_dest):
33 os.makedirs(alt_wpdir_dest)
34 shutil.copy2("busybox_wrapper", alt_wppath_dest)
35 # Re-set alternatives
36 # Match coreutils
37 if alt_name == '[':
38 alt_name = 'lbracket'
39 d.appendVar('ALTERNATIVE_%s' % (pn), ' ' + alt_name)
40 d.setVarFlag('ALTERNATIVE_LINK_NAME', alt_name, alt_link_name)
41 if os.path.exists(alt_wppath_dest):
42 d.setVarFlag('ALTERNATIVE_TARGET', alt_name, alt_wppath)
43 f.close()
44
45 os.remove("busybox_wrapper")
46 return
47
48 if os.path.exists('%s/etc/busybox.links' % (dvar)):
49 create_sh_alternative_vars("/etc/busybox.links", "/bin/busybox", 0o0755)
50 else:
51 create_sh_alternative_vars("/etc/busybox.links.nosuid", "/bin/busybox.nosuid", 0o0755)
52 create_sh_alternative_vars("/etc/busybox.links.suid", "/bin/busybox.suid", 0o4755)
53}
54
55# Add to PACKAGEBUILDPKGD so it could override the alternatives, which are set in
56# do_package_prepend() section of busybox_*.bb.
57PACKAGEBUILDPKGD_prepend = "create_sh_wrapper_reset_alternative_vars "
58
59# Use sh wrappers instead of links
60pkg_postinst_${PN} () {
61 # This part of code is dedicated to the on target upgrade problem.
62 # It's known that if we don't make appropriate symlinks before update-alternatives calls,
63 # there will be errors indicating missing commands such as 'sed'.
64 # These symlinks will later be updated by update-alternatives calls.
65 test -n 2 > /dev/null || alias test='busybox test'
66 if test "x$D" = "x"; then
67 # Remove busybox.nosuid if it's a symlink, because this situation indicates
68 # that we're installing or upgrading to a one-binary busybox.
69 if test -h /bin/busybox.nosuid; then
70 rm -f /bin/busybox.nosuid
71 fi
72 for suffix in "" ".nosuid" ".suid"; do
73 if test -e /etc/busybox.links$suffix; then
74 while read link; do
75 if test ! -e "$link"; then
76 # we can use busybox here because even if we are using splitted busybox
77 # we've made a symlink from /bin/busybox to /bin/busybox.nosuid.
78 busybox echo "#!/bin/busybox$suffix" > $link
79 fi
80 done < /etc/busybox.links$suffix
81 fi
82 done
83 fi
84}
85
diff --git a/recipes-core/coreutils/coreutils_%.bbappend b/recipes-core/coreutils/coreutils_%.bbappend
index c1e8ed6..7b9a2dc 100644
--- a/recipes-core/coreutils/coreutils_%.bbappend
+++ b/recipes-core/coreutils/coreutils_%.bbappend
@@ -1 +1,2 @@
1inherit with-selinux 1inherit ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'with-selinux', '', d)}
2
diff --git a/recipes-core/dbus/dbus_%.bbappend b/recipes-core/dbus/dbus_%.bbappend
index 8c11cac..ee221e2 100644
--- a/recipes-core/dbus/dbus_%.bbappend
+++ b/recipes-core/dbus/dbus_%.bbappend
@@ -1 +1,2 @@
1inherit enable-selinux 1inherit ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'enable-selinux', '', d)}
2
diff --git a/recipes-core/eudev/eudev_%.bbappend b/recipes-core/eudev/eudev_%.bbappend
index e1e7cd1..b0b03ec 100644
--- a/recipes-core/eudev/eudev_%.bbappend
+++ b/recipes-core/eudev/eudev_%.bbappend
@@ -1,3 +1,2 @@
1FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:" 1require ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', '${BPN}_selinux.inc', '', d)}
2 2
3inherit enable-selinux
diff --git a/recipes-core/eudev/eudev_selinux.inc b/recipes-core/eudev/eudev_selinux.inc
new file mode 100644
index 0000000..2ad6b13
--- /dev/null
+++ b/recipes-core/eudev/eudev_selinux.inc
@@ -0,0 +1,3 @@
1FILESEXTRAPATHS_prepend := "${THISDIR}/files:"
2
3inherit enable-selinux
diff --git a/recipes-core/eudev/eudev/init b/recipes-core/eudev/files/init
index ee64f86..ee64f86 100644
--- a/recipes-core/eudev/eudev/init
+++ b/recipes-core/eudev/files/init
diff --git a/recipes-core/eudev/eudev/udev-cache b/recipes-core/eudev/files/udev-cache
index 6898577..6898577 100644
--- a/recipes-core/eudev/eudev/udev-cache
+++ b/recipes-core/eudev/files/udev-cache
diff --git a/recipes-core/glib-2.0/glib-2.0_%.bbappend b/recipes-core/glib-2.0/glib-2.0_%.bbappend
index 8c11cac..74e22b3 100644
--- a/recipes-core/glib-2.0/glib-2.0_%.bbappend
+++ b/recipes-core/glib-2.0/glib-2.0_%.bbappend
@@ -1 +1 @@
inherit enable-selinux inherit ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'enable-selinux', '', d)}
diff --git a/recipes-core/initscripts/initscripts/devpts.sh b/recipes-core/initscripts/files/devpts.sh
index a0b037f..a0b037f 100755
--- a/recipes-core/initscripts/initscripts/devpts.sh
+++ b/recipes-core/initscripts/files/devpts.sh
diff --git a/recipes-core/initscripts/initscripts-1.0_selinux.inc b/recipes-core/initscripts/initscripts-1.0_selinux.inc
new file mode 100644
index 0000000..6e8a9b6
--- /dev/null
+++ b/recipes-core/initscripts/initscripts-1.0_selinux.inc
@@ -0,0 +1,11 @@
1FILESEXTRAPATHS_prepend := "${THISDIR}/files:"
2
3do_install_append () {
4 cat <<-EOF >> ${D}${sysconfdir}/init.d/populate-volatile.sh
5touch /var/log/lastlog
6test ! -x /sbin/restorecon || /sbin/restorecon -iRF /var/volatile/ /var/lib /run \
7 /etc/resolv.conf /etc/adjtime
8EOF
9 sed -i '/mount -n -o remount,$rootmode/i\test ! -x /sbin/restorecon || /sbin/restorecon -iRF /run' \
10 ${D}${sysconfdir}/init.d/checkroot.sh
11}
diff --git a/recipes-core/initscripts/initscripts_1.0.bbappend b/recipes-core/initscripts/initscripts_1.0.bbappend
index 0fc7a5e..4f9950b 100644
--- a/recipes-core/initscripts/initscripts_1.0.bbappend
+++ b/recipes-core/initscripts/initscripts_1.0.bbappend
@@ -1,13 +1 @@
1PR .= ".3" require ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'initscripts-1.0_selinux.inc', '', d)}
2
3FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:"
4
5do_install_append () {
6 cat <<-EOF >> ${D}${sysconfdir}/init.d/populate-volatile.sh
7touch /var/log/lastlog
8test ! -x /sbin/restorecon || /sbin/restorecon -iRF /var/volatile/ /var/lib /run \
9 /etc/resolv.conf /etc/adjtime
10EOF
11 sed -i '/mount -n -o remount,$rootmode/i\test ! -x /sbin/restorecon || /sbin/restorecon -iRF /run' \
12 ${D}${sysconfdir}/init.d/checkroot.sh
13}
diff --git a/recipes-core/libcgroup/libcgroup_%.bbappend b/recipes-core/libcgroup/libcgroup_%.bbappend
index b7e0c5f..7719d3b 100644
--- a/recipes-core/libcgroup/libcgroup_%.bbappend
+++ b/recipes-core/libcgroup/libcgroup_%.bbappend
@@ -1,12 +1 @@
1PR .= ".3" require ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', '${BPN}_selinux.inc', '', d)}
2
3EXTRA_OECONF_virtclass-native = "--enable-pam=no"
4
5do_install_append() {
6 test ! -f ${D}${base_libdir}/security/pam_cgroup.so.0.0.0 || {
7 mv -f ${D}${base_libdir}/security/pam_cgroup.so.0.0.0 ${D}${base_libdir}/security/pam_cgroup.so
8 rm -f ${D}${base_libdir}/security/pam_cgroup.so.*
9 }
10}
11
12BBCLASSEXTEND = "native"
diff --git a/recipes-core/libcgroup/libcgroup_selinux.inc b/recipes-core/libcgroup/libcgroup_selinux.inc
new file mode 100644
index 0000000..f81188f
--- /dev/null
+++ b/recipes-core/libcgroup/libcgroup_selinux.inc
@@ -0,0 +1,10 @@
1EXTRA_OECONF_virtclass-native = "--enable-pam=no"
2
3do_install_append() {
4 test ! -f ${D}${base_libdir}/security/pam_cgroup.so.0.0.0 || {
5 mv -f ${D}${base_libdir}/security/pam_cgroup.so.0.0.0 ${D}${base_libdir}/security/pam_cgroup.so
6 rm -f ${D}${base_libdir}/security/pam_cgroup.so.*
7 }
8}
9
10BBCLASSEXTEND = "native"
diff --git a/recipes-core/systemd/systemd_%.bbappend b/recipes-core/systemd/systemd_%.bbappend
index f1bdaf8..5ac3adb 100644
--- a/recipes-core/systemd/systemd_%.bbappend
+++ b/recipes-core/systemd/systemd_%.bbappend
@@ -1 +1 @@
inherit enable-audit inherit ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'enable-audit', '', d)}
diff --git a/recipes-core/sysvinit/sysvinit-2.88dsf/sysvinit-fix-is_selinux_enabled.patch b/recipes-core/sysvinit/files/sysvinit-fix-is_selinux_enabled.patch
index 62703b1..62703b1 100644
--- a/recipes-core/sysvinit/sysvinit-2.88dsf/sysvinit-fix-is_selinux_enabled.patch
+++ b/recipes-core/sysvinit/files/sysvinit-fix-is_selinux_enabled.patch
diff --git a/recipes-core/sysvinit/sysvinit-2.88dsf_selinux.inc b/recipes-core/sysvinit/sysvinit-2.88dsf_selinux.inc
new file mode 100644
index 0000000..fcfbdb7
--- /dev/null
+++ b/recipes-core/sysvinit/sysvinit-2.88dsf_selinux.inc
@@ -0,0 +1,11 @@
1FILESEXTRAPATHS_prepend := "${THISDIR}/files:"
2
3B = "${S}"
4
5SRC_URI += "file://sysvinit-fix-is_selinux_enabled.patch"
6
7inherit selinux
8
9DEPENDS += "${LIBSELINUX}"
10
11EXTRA_OEMAKE += "${@target_selinux(d, 'WITH_SELINUX=\"yes\"')}"
diff --git a/recipes-core/sysvinit/sysvinit_2.88dsf.bbappend b/recipes-core/sysvinit/sysvinit_2.88dsf.bbappend
index 636dc5e..9df30b6 100644
--- a/recipes-core/sysvinit/sysvinit_2.88dsf.bbappend
+++ b/recipes-core/sysvinit/sysvinit_2.88dsf.bbappend
@@ -1,14 +1 @@
1FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}-${PV}:" require ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'sysvinit-2.88dsf_selinux.inc', '', d)}
2
3B = "${S}"
4
5SRC_URI += "file://sysvinit-fix-is_selinux_enabled.patch"
6
7inherit selinux
8
9DEPENDS += "${LIBSELINUX}"
10
11EXTRA_OEMAKE += "${@target_selinux(d, 'WITH_SELINUX=\"yes\"')}"
12
13PR .= ".2"
14
diff --git a/recipes-core/util-linux/util-linux_%.bbappend b/recipes-core/util-linux/util-linux_%.bbappend
index 7695b77..b01ad25 100644
--- a/recipes-core/util-linux/util-linux_%.bbappend
+++ b/recipes-core/util-linux/util-linux_%.bbappend
@@ -1,3 +1 @@
1PR .= ".3" inherit ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'with-selinux', '', d)}
2
3inherit with-selinux