diff options
| author | Mark Hatle <mark.hatle@windriver.com> | 2017-09-08 10:44:23 -0500 |
|---|---|---|
| committer | Mark Hatle <mark.hatle@windriver.com> | 2017-09-14 08:29:01 -0500 |
| commit | 4fefe83c3203c11fadbe43637a3058284b60427b (patch) | |
| tree | af4b33f05100c12ed16851f5dd4129f0e176da25 /recipes-core | |
| parent | 694b8d1f1a590083e4445d6941f24b412ec0f206 (diff) | |
| download | meta-selinux-4fefe83c3203c11fadbe43637a3058284b60427b.tar.gz | |
Refactor to conform to YP Compat requirements
Change the references to check for the distribution flag of 'selinux' being
set before taking any action within the bbappends. This prevents the
signature from being modified.
Also remove PR changes, as they are no longer allowed.
Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
Diffstat (limited to 'recipes-core')
19 files changed, 132 insertions, 135 deletions
diff --git a/recipes-core/busybox/busybox_%.bbappend b/recipes-core/busybox/busybox_%.bbappend index b4935b2..7719d3b 100644 --- a/recipes-core/busybox/busybox_%.bbappend +++ b/recipes-core/busybox/busybox_%.bbappend | |||
| @@ -1,87 +1 @@ | |||
| 1 | PR .= ".1" | require ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', '${BPN}_selinux.inc', '', d)} | |
| 2 | |||
| 3 | FILES_${PN} += "${libdir}/${PN}" | ||
| 4 | |||
| 5 | # We should use sh wrappers instead of links so the commands could get correct | ||
| 6 | # security labels | ||
| 7 | python create_sh_wrapper_reset_alternative_vars () { | ||
| 8 | # We need to load the full set of busybox provides from the /etc/busybox.links | ||
| 9 | # Use this to see the update-alternatives with the right information | ||
| 10 | |||
| 11 | dvar = d.getVar('D', True) | ||
| 12 | pn = d.getVar('PN', True) | ||
| 13 | |||
| 14 | def create_sh_alternative_vars(links, target, mode): | ||
| 15 | import shutil | ||
| 16 | # Create sh wrapper template | ||
| 17 | fwp = open("busybox_wrapper", 'w') | ||
| 18 | fwp.write("#!%s" % (target)) | ||
| 19 | os.fchmod(fwp.fileno(), mode) | ||
| 20 | fwp.close() | ||
| 21 | # Install the sh wrappers and alternatives reset to link to them | ||
| 22 | wpdir = os.path.join(d.getVar('libdir', True), pn) | ||
| 23 | wpdir_dest = '%s%s' % (dvar, wpdir) | ||
| 24 | if not os.path.exists(wpdir_dest): | ||
| 25 | os.makedirs(wpdir_dest) | ||
| 26 | f = open('%s%s' % (dvar, links), 'r') | ||
| 27 | for alt_link_name in f: | ||
| 28 | alt_link_name = alt_link_name.strip() | ||
| 29 | alt_name = os.path.basename(alt_link_name) | ||
| 30 | # Copy script wrapper to wp_path | ||
| 31 | alt_wppath = '%s%s' % (wpdir, alt_link_name) | ||
| 32 | alt_wppath_dest = '%s%s' % (wpdir_dest, alt_link_name) | ||
| 33 | alt_wpdir_dest = os.path.dirname(alt_wppath_dest) | ||
| 34 | if not os.path.exists(alt_wpdir_dest): | ||
| 35 | os.makedirs(alt_wpdir_dest) | ||
| 36 | shutil.copy2("busybox_wrapper", alt_wppath_dest) | ||
| 37 | # Re-set alternatives | ||
| 38 | # Match coreutils | ||
| 39 | if alt_name == '[': | ||
| 40 | alt_name = 'lbracket' | ||
| 41 | d.appendVar('ALTERNATIVE_%s' % (pn), ' ' + alt_name) | ||
| 42 | d.setVarFlag('ALTERNATIVE_LINK_NAME', alt_name, alt_link_name) | ||
| 43 | if os.path.exists(alt_wppath_dest): | ||
| 44 | d.setVarFlag('ALTERNATIVE_TARGET', alt_name, alt_wppath) | ||
| 45 | f.close() | ||
| 46 | |||
| 47 | os.remove("busybox_wrapper") | ||
| 48 | return | ||
| 49 | |||
| 50 | if os.path.exists('%s/etc/busybox.links' % (dvar)): | ||
| 51 | create_sh_alternative_vars("/etc/busybox.links", "/bin/busybox", 0o0755) | ||
| 52 | else: | ||
| 53 | create_sh_alternative_vars("/etc/busybox.links.nosuid", "/bin/busybox.nosuid", 0o0755) | ||
| 54 | create_sh_alternative_vars("/etc/busybox.links.suid", "/bin/busybox.suid", 0o4755) | ||
| 55 | } | ||
| 56 | |||
| 57 | # Add to PACKAGEBUILDPKGD so it could override the alternatives, which are set in | ||
| 58 | # do_package_prepend() section of busybox_*.bb. | ||
| 59 | PACKAGEBUILDPKGD_prepend = "create_sh_wrapper_reset_alternative_vars " | ||
| 60 | |||
| 61 | # Use sh wrappers instead of links | ||
| 62 | pkg_postinst_${PN} () { | ||
| 63 | # This part of code is dedicated to the on target upgrade problem. | ||
| 64 | # It's known that if we don't make appropriate symlinks before update-alternatives calls, | ||
| 65 | # there will be errors indicating missing commands such as 'sed'. | ||
| 66 | # These symlinks will later be updated by update-alternatives calls. | ||
| 67 | test -n 2 > /dev/null || alias test='busybox test' | ||
| 68 | if test "x$D" = "x"; then | ||
| 69 | # Remove busybox.nosuid if it's a symlink, because this situation indicates | ||
| 70 | # that we're installing or upgrading to a one-binary busybox. | ||
| 71 | if test -h /bin/busybox.nosuid; then | ||
| 72 | rm -f /bin/busybox.nosuid | ||
| 73 | fi | ||
| 74 | for suffix in "" ".nosuid" ".suid"; do | ||
| 75 | if test -e /etc/busybox.links$suffix; then | ||
| 76 | while read link; do | ||
| 77 | if test ! -e "$link"; then | ||
| 78 | # we can use busybox here because even if we are using splitted busybox | ||
| 79 | # we've made a symlink from /bin/busybox to /bin/busybox.nosuid. | ||
| 80 | busybox echo "#!/bin/busybox$suffix" > $link | ||
| 81 | fi | ||
| 82 | done < /etc/busybox.links$suffix | ||
| 83 | fi | ||
| 84 | done | ||
| 85 | fi | ||
| 86 | } | ||
| 87 | |||
diff --git a/recipes-core/busybox/busybox_selinux.inc b/recipes-core/busybox/busybox_selinux.inc new file mode 100644 index 0000000..3f20815 --- /dev/null +++ b/recipes-core/busybox/busybox_selinux.inc | |||
| @@ -0,0 +1,85 @@ | |||
| 1 | FILES_${PN} += "${libdir}/${PN}" | ||
| 2 | |||
| 3 | # We should use sh wrappers instead of links so the commands could get correct | ||
| 4 | # security labels | ||
| 5 | python create_sh_wrapper_reset_alternative_vars () { | ||
| 6 | # We need to load the full set of busybox provides from the /etc/busybox.links | ||
| 7 | # Use this to see the update-alternatives with the right information | ||
| 8 | |||
| 9 | dvar = d.getVar('D', True) | ||
| 10 | pn = d.getVar('PN', True) | ||
| 11 | |||
| 12 | def create_sh_alternative_vars(links, target, mode): | ||
| 13 | import shutil | ||
| 14 | # Create sh wrapper template | ||
| 15 | fwp = open("busybox_wrapper", 'w') | ||
| 16 | fwp.write("#!%s" % (target)) | ||
| 17 | os.fchmod(fwp.fileno(), mode) | ||
| 18 | fwp.close() | ||
| 19 | # Install the sh wrappers and alternatives reset to link to them | ||
| 20 | wpdir = os.path.join(d.getVar('libdir', True), pn) | ||
| 21 | wpdir_dest = '%s%s' % (dvar, wpdir) | ||
| 22 | if not os.path.exists(wpdir_dest): | ||
| 23 | os.makedirs(wpdir_dest) | ||
| 24 | f = open('%s%s' % (dvar, links), 'r') | ||
| 25 | for alt_link_name in f: | ||
| 26 | alt_link_name = alt_link_name.strip() | ||
| 27 | alt_name = os.path.basename(alt_link_name) | ||
| 28 | # Copy script wrapper to wp_path | ||
| 29 | alt_wppath = '%s%s' % (wpdir, alt_link_name) | ||
| 30 | alt_wppath_dest = '%s%s' % (wpdir_dest, alt_link_name) | ||
| 31 | alt_wpdir_dest = os.path.dirname(alt_wppath_dest) | ||
| 32 | if not os.path.exists(alt_wpdir_dest): | ||
| 33 | os.makedirs(alt_wpdir_dest) | ||
| 34 | shutil.copy2("busybox_wrapper", alt_wppath_dest) | ||
| 35 | # Re-set alternatives | ||
| 36 | # Match coreutils | ||
| 37 | if alt_name == '[': | ||
| 38 | alt_name = 'lbracket' | ||
| 39 | d.appendVar('ALTERNATIVE_%s' % (pn), ' ' + alt_name) | ||
| 40 | d.setVarFlag('ALTERNATIVE_LINK_NAME', alt_name, alt_link_name) | ||
| 41 | if os.path.exists(alt_wppath_dest): | ||
| 42 | d.setVarFlag('ALTERNATIVE_TARGET', alt_name, alt_wppath) | ||
| 43 | f.close() | ||
| 44 | |||
| 45 | os.remove("busybox_wrapper") | ||
| 46 | return | ||
| 47 | |||
| 48 | if os.path.exists('%s/etc/busybox.links' % (dvar)): | ||
| 49 | create_sh_alternative_vars("/etc/busybox.links", "/bin/busybox", 0o0755) | ||
| 50 | else: | ||
| 51 | create_sh_alternative_vars("/etc/busybox.links.nosuid", "/bin/busybox.nosuid", 0o0755) | ||
| 52 | create_sh_alternative_vars("/etc/busybox.links.suid", "/bin/busybox.suid", 0o4755) | ||
| 53 | } | ||
| 54 | |||
| 55 | # Add to PACKAGEBUILDPKGD so it could override the alternatives, which are set in | ||
| 56 | # do_package_prepend() section of busybox_*.bb. | ||
| 57 | PACKAGEBUILDPKGD_prepend = "create_sh_wrapper_reset_alternative_vars " | ||
| 58 | |||
| 59 | # Use sh wrappers instead of links | ||
| 60 | pkg_postinst_${PN} () { | ||
| 61 | # This part of code is dedicated to the on target upgrade problem. | ||
| 62 | # It's known that if we don't make appropriate symlinks before update-alternatives calls, | ||
| 63 | # there will be errors indicating missing commands such as 'sed'. | ||
| 64 | # These symlinks will later be updated by update-alternatives calls. | ||
| 65 | test -n 2 > /dev/null || alias test='busybox test' | ||
| 66 | if test "x$D" = "x"; then | ||
| 67 | # Remove busybox.nosuid if it's a symlink, because this situation indicates | ||
| 68 | # that we're installing or upgrading to a one-binary busybox. | ||
| 69 | if test -h /bin/busybox.nosuid; then | ||
| 70 | rm -f /bin/busybox.nosuid | ||
| 71 | fi | ||
| 72 | for suffix in "" ".nosuid" ".suid"; do | ||
| 73 | if test -e /etc/busybox.links$suffix; then | ||
| 74 | while read link; do | ||
| 75 | if test ! -e "$link"; then | ||
| 76 | # we can use busybox here because even if we are using splitted busybox | ||
| 77 | # we've made a symlink from /bin/busybox to /bin/busybox.nosuid. | ||
| 78 | busybox echo "#!/bin/busybox$suffix" > $link | ||
| 79 | fi | ||
| 80 | done < /etc/busybox.links$suffix | ||
| 81 | fi | ||
| 82 | done | ||
| 83 | fi | ||
| 84 | } | ||
| 85 | |||
diff --git a/recipes-core/coreutils/coreutils_%.bbappend b/recipes-core/coreutils/coreutils_%.bbappend index c1e8ed6..7b9a2dc 100644 --- a/recipes-core/coreutils/coreutils_%.bbappend +++ b/recipes-core/coreutils/coreutils_%.bbappend | |||
| @@ -1 +1,2 @@ | |||
| 1 | inherit with-selinux | 1 | inherit ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'with-selinux', '', d)} |
| 2 | |||
diff --git a/recipes-core/dbus/dbus_%.bbappend b/recipes-core/dbus/dbus_%.bbappend index 8c11cac..ee221e2 100644 --- a/recipes-core/dbus/dbus_%.bbappend +++ b/recipes-core/dbus/dbus_%.bbappend | |||
| @@ -1 +1,2 @@ | |||
| 1 | inherit enable-selinux | 1 | inherit ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'enable-selinux', '', d)} |
| 2 | |||
diff --git a/recipes-core/eudev/eudev_%.bbappend b/recipes-core/eudev/eudev_%.bbappend index e1e7cd1..b0b03ec 100644 --- a/recipes-core/eudev/eudev_%.bbappend +++ b/recipes-core/eudev/eudev_%.bbappend | |||
| @@ -1,3 +1,2 @@ | |||
| 1 | FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:" | 1 | require ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', '${BPN}_selinux.inc', '', d)} |
| 2 | 2 | ||
| 3 | inherit enable-selinux | ||
diff --git a/recipes-core/eudev/eudev_selinux.inc b/recipes-core/eudev/eudev_selinux.inc new file mode 100644 index 0000000..2ad6b13 --- /dev/null +++ b/recipes-core/eudev/eudev_selinux.inc | |||
| @@ -0,0 +1,3 @@ | |||
| 1 | FILESEXTRAPATHS_prepend := "${THISDIR}/files:" | ||
| 2 | |||
| 3 | inherit enable-selinux | ||
diff --git a/recipes-core/eudev/eudev/init b/recipes-core/eudev/files/init index ee64f86..ee64f86 100644 --- a/recipes-core/eudev/eudev/init +++ b/recipes-core/eudev/files/init | |||
diff --git a/recipes-core/eudev/eudev/udev-cache b/recipes-core/eudev/files/udev-cache index 6898577..6898577 100644 --- a/recipes-core/eudev/eudev/udev-cache +++ b/recipes-core/eudev/files/udev-cache | |||
diff --git a/recipes-core/glib-2.0/glib-2.0_%.bbappend b/recipes-core/glib-2.0/glib-2.0_%.bbappend index 8c11cac..74e22b3 100644 --- a/recipes-core/glib-2.0/glib-2.0_%.bbappend +++ b/recipes-core/glib-2.0/glib-2.0_%.bbappend | |||
| @@ -1 +1 @@ | |||
| inherit enable-selinux | inherit ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'enable-selinux', '', d)} | ||
diff --git a/recipes-core/initscripts/initscripts/devpts.sh b/recipes-core/initscripts/files/devpts.sh index a0b037f..a0b037f 100755 --- a/recipes-core/initscripts/initscripts/devpts.sh +++ b/recipes-core/initscripts/files/devpts.sh | |||
diff --git a/recipes-core/initscripts/initscripts-1.0_selinux.inc b/recipes-core/initscripts/initscripts-1.0_selinux.inc new file mode 100644 index 0000000..6e8a9b6 --- /dev/null +++ b/recipes-core/initscripts/initscripts-1.0_selinux.inc | |||
| @@ -0,0 +1,11 @@ | |||
| 1 | FILESEXTRAPATHS_prepend := "${THISDIR}/files:" | ||
| 2 | |||
| 3 | do_install_append () { | ||
| 4 | cat <<-EOF >> ${D}${sysconfdir}/init.d/populate-volatile.sh | ||
| 5 | touch /var/log/lastlog | ||
| 6 | test ! -x /sbin/restorecon || /sbin/restorecon -iRF /var/volatile/ /var/lib /run \ | ||
| 7 | /etc/resolv.conf /etc/adjtime | ||
| 8 | EOF | ||
| 9 | sed -i '/mount -n -o remount,$rootmode/i\test ! -x /sbin/restorecon || /sbin/restorecon -iRF /run' \ | ||
| 10 | ${D}${sysconfdir}/init.d/checkroot.sh | ||
| 11 | } | ||
diff --git a/recipes-core/initscripts/initscripts_1.0.bbappend b/recipes-core/initscripts/initscripts_1.0.bbappend index 0fc7a5e..4f9950b 100644 --- a/recipes-core/initscripts/initscripts_1.0.bbappend +++ b/recipes-core/initscripts/initscripts_1.0.bbappend | |||
| @@ -1,13 +1 @@ | |||
| 1 | PR .= ".3" | require ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'initscripts-1.0_selinux.inc', '', d)} | |
| 2 | |||
| 3 | FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:" | ||
| 4 | |||
| 5 | do_install_append () { | ||
| 6 | cat <<-EOF >> ${D}${sysconfdir}/init.d/populate-volatile.sh | ||
| 7 | touch /var/log/lastlog | ||
| 8 | test ! -x /sbin/restorecon || /sbin/restorecon -iRF /var/volatile/ /var/lib /run \ | ||
| 9 | /etc/resolv.conf /etc/adjtime | ||
| 10 | EOF | ||
| 11 | sed -i '/mount -n -o remount,$rootmode/i\test ! -x /sbin/restorecon || /sbin/restorecon -iRF /run' \ | ||
| 12 | ${D}${sysconfdir}/init.d/checkroot.sh | ||
| 13 | } | ||
diff --git a/recipes-core/libcgroup/libcgroup_%.bbappend b/recipes-core/libcgroup/libcgroup_%.bbappend index b7e0c5f..7719d3b 100644 --- a/recipes-core/libcgroup/libcgroup_%.bbappend +++ b/recipes-core/libcgroup/libcgroup_%.bbappend | |||
| @@ -1,12 +1 @@ | |||
| 1 | PR .= ".3" | require ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', '${BPN}_selinux.inc', '', d)} | |
| 2 | |||
| 3 | EXTRA_OECONF_virtclass-native = "--enable-pam=no" | ||
| 4 | |||
| 5 | do_install_append() { | ||
| 6 | test ! -f ${D}${base_libdir}/security/pam_cgroup.so.0.0.0 || { | ||
| 7 | mv -f ${D}${base_libdir}/security/pam_cgroup.so.0.0.0 ${D}${base_libdir}/security/pam_cgroup.so | ||
| 8 | rm -f ${D}${base_libdir}/security/pam_cgroup.so.* | ||
| 9 | } | ||
| 10 | } | ||
| 11 | |||
| 12 | BBCLASSEXTEND = "native" | ||
diff --git a/recipes-core/libcgroup/libcgroup_selinux.inc b/recipes-core/libcgroup/libcgroup_selinux.inc new file mode 100644 index 0000000..f81188f --- /dev/null +++ b/recipes-core/libcgroup/libcgroup_selinux.inc | |||
| @@ -0,0 +1,10 @@ | |||
| 1 | EXTRA_OECONF_virtclass-native = "--enable-pam=no" | ||
| 2 | |||
| 3 | do_install_append() { | ||
| 4 | test ! -f ${D}${base_libdir}/security/pam_cgroup.so.0.0.0 || { | ||
| 5 | mv -f ${D}${base_libdir}/security/pam_cgroup.so.0.0.0 ${D}${base_libdir}/security/pam_cgroup.so | ||
| 6 | rm -f ${D}${base_libdir}/security/pam_cgroup.so.* | ||
| 7 | } | ||
| 8 | } | ||
| 9 | |||
| 10 | BBCLASSEXTEND = "native" | ||
diff --git a/recipes-core/systemd/systemd_%.bbappend b/recipes-core/systemd/systemd_%.bbappend index f1bdaf8..5ac3adb 100644 --- a/recipes-core/systemd/systemd_%.bbappend +++ b/recipes-core/systemd/systemd_%.bbappend | |||
| @@ -1 +1 @@ | |||
| inherit enable-audit | inherit ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'enable-audit', '', d)} | ||
diff --git a/recipes-core/sysvinit/sysvinit-2.88dsf/sysvinit-fix-is_selinux_enabled.patch b/recipes-core/sysvinit/files/sysvinit-fix-is_selinux_enabled.patch index 62703b1..62703b1 100644 --- a/recipes-core/sysvinit/sysvinit-2.88dsf/sysvinit-fix-is_selinux_enabled.patch +++ b/recipes-core/sysvinit/files/sysvinit-fix-is_selinux_enabled.patch | |||
diff --git a/recipes-core/sysvinit/sysvinit-2.88dsf_selinux.inc b/recipes-core/sysvinit/sysvinit-2.88dsf_selinux.inc new file mode 100644 index 0000000..fcfbdb7 --- /dev/null +++ b/recipes-core/sysvinit/sysvinit-2.88dsf_selinux.inc | |||
| @@ -0,0 +1,11 @@ | |||
| 1 | FILESEXTRAPATHS_prepend := "${THISDIR}/files:" | ||
| 2 | |||
| 3 | B = "${S}" | ||
| 4 | |||
| 5 | SRC_URI += "file://sysvinit-fix-is_selinux_enabled.patch" | ||
| 6 | |||
| 7 | inherit selinux | ||
| 8 | |||
| 9 | DEPENDS += "${LIBSELINUX}" | ||
| 10 | |||
| 11 | EXTRA_OEMAKE += "${@target_selinux(d, 'WITH_SELINUX=\"yes\"')}" | ||
diff --git a/recipes-core/sysvinit/sysvinit_2.88dsf.bbappend b/recipes-core/sysvinit/sysvinit_2.88dsf.bbappend index 636dc5e..9df30b6 100644 --- a/recipes-core/sysvinit/sysvinit_2.88dsf.bbappend +++ b/recipes-core/sysvinit/sysvinit_2.88dsf.bbappend | |||
| @@ -1,14 +1 @@ | |||
| 1 | FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}-${PV}:" | require ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'sysvinit-2.88dsf_selinux.inc', '', d)} | |
| 2 | |||
| 3 | B = "${S}" | ||
| 4 | |||
| 5 | SRC_URI += "file://sysvinit-fix-is_selinux_enabled.patch" | ||
| 6 | |||
| 7 | inherit selinux | ||
| 8 | |||
| 9 | DEPENDS += "${LIBSELINUX}" | ||
| 10 | |||
| 11 | EXTRA_OEMAKE += "${@target_selinux(d, 'WITH_SELINUX=\"yes\"')}" | ||
| 12 | |||
| 13 | PR .= ".2" | ||
| 14 | |||
diff --git a/recipes-core/util-linux/util-linux_%.bbappend b/recipes-core/util-linux/util-linux_%.bbappend index 7695b77..b01ad25 100644 --- a/recipes-core/util-linux/util-linux_%.bbappend +++ b/recipes-core/util-linux/util-linux_%.bbappend | |||
| @@ -1,3 +1 @@ | |||
| 1 | PR .= ".3" | inherit ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'with-selinux', '', d)} | |
| 2 | |||
| 3 | inherit with-selinux | ||
