summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* refpolicy: update to latest git revHEADmasterYi Zhao2026-06-062-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * fbae93917 btrfs (#1144) * da94ce004 dmesg: allow dmesg_t access to init script stream sockets * 78f8b23d4 fapolicyd: fix issue with tmpfs_t write * 319ac618d fsadm (#1129) * 7d1dc1f06 systemd: allow tmpfiles to handle auditd_log_t * d30582816 systemd: allow tmpfiles to relabel various unlabeled objects * 01f6bb2bc systemd: allow tmpfiles to setrlimit * d156ca9a6 sshd: guard dbus calls with optional_policy * 6b7da9b01 sudo: guard auth_use_pam_systemd call * cd06b5f4b authlogin: guard auth_use_pam_systemd->dbus_system_bus_client calls with optional_policy * 586caeace Add SELinux policy support for Userspace Resource Manager (URM) (#1097) * 4e360aab8 tor_pluggable_transports2 (#1133) * 444f9a669 apt_dpkg_strict (#1131) * 2cc5c825b corecommands: label /usr/share/pam/security/namespace.init as bin_t * 6aeb605e8 authlogin: allow pam_domain to read /usr/share/pam * d97274873 systemd: resolved has a systemd-networkd hook * fac3aba88 systemd: allow resolved access to /etc/localtime * a57ca559e authlogin: systemd reads /proc/sys/kernel/random/boot_id via nss * f6e4064fe Add boolean user_ptrace to allow user domains to strace themselves * d25098a7d incus: Update module to reflect new incus selinux support * 73be75170 selinux: Add selinux_read_fs interface * a75373c3b incus: Allow setting of per instance oom_score_adj * a8ff7c56b incus: Add incus_entry_type interface * e4684de6d incus: Fix start of virtual networking in incus >=6.15 * 4b38f2f05 virt: Add virt_relabel_images interface * 3b11df9e2 container: Add container_write_all_container_state interface * 0dbad021c qemu: Update incus support * 69141a369 qemu: Add qemu_manage_image_symlinks interface * 373d1ee9f qemu: Add qemu_write_state interface * 6ef6df8b0 qemu: Add qemu_getattr interface * 5684dae89 selinux: allow ModemManager to send DBus messages to initrc_t. * a7d4c1333 libvirt_leasesh: Added read and search permission on kernel sysctls * 75079752d systemd-coredum: Added sepolicy permission to read namespace file * e0fd56a58 refpolicy: Addressing denial seen on alsa to allow write on event dev node * 694c913f8 tee_supplicant: Add necessary SELinux policy for qtee_supplicant * eb28c5a1b su: use auth_use_pam * e396a31e2 systemd: allow user systemd-tmpfiles to setfscreate * 26f457f50 systemd: allow systemd-userwork to speak to systemd-machined * 8762d07ad systemd: allow systemd-nsresourced to interact w/ bpf * 0b7c88000 kernel: treat /efi similarly to /boot * 99d522a1d snmpd: snmpd doesn't seem to need dac_override capability * 192fe63a2 gpg: adapt to Gentoo's app-alternatives/gpg * ebafd639e selinux: allow seatd to use unallocated TTYs * cea89176e https://picasa.google.com/ * 8d49a23bd matrixd: gatekeep postgresql calls in an optional policy block * 169f725b3 newrole_t, run_init_t: call auth_run_pam() * ffadd83c7 ping: allow execution and PTY access * e15ac27e0 devices: Add label for /dev/isst_interface * d4084b9fa Add new kernel security class memfd_file and new kernel permissions * 928e3bcbb Add new policy cababilities * 559688316 userdomain: kernel_dontaudit_request_load_module for all users * 0e76a2a30 Add op-tee based tee supplicant policy Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* libselinux-python: remove all RECORD filesZhixiong Chi2026-05-091-10/+3
| | | | | | | | | | | | In order to support reproducible builds[1], we delete the RECORD file for selinux-python recipe, please refer the details in the patch comments for the selinux-python recipes. Here we do the same behavior to keep the solution consistency. [1] https://reproducible-builds.org/ Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* selinux-python: remove all RECORD filesZhixiong Chi2026-05-091-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Python modules install metadata into a .dist-info directory, one of which is RECORD, which contains the files that were installed and their checksum[1]. This is typically used by pip to validate the install, or to know what files to remove when the module is uninstalled. This is slightly problematic when we need to do patching of installed .py files in do_install(), as the RECORD file has already been written at that point. However, the RECORD files only really have a use outside of a system- managed environment, which our python packages are. We already have commands to verify and remove modules (opkg, dpkg, rpm) and the RECORD file existing simply allows people to 'sudo pip' and alter the package- managed directories outside of the package manager. This is not a good idea, and some other distros remove the RECORD file to stop this possibility: - Debian[2] - Fedora[3] - Gentoo[4] [1] https://peps.python.org/pep-0491/#the-dist-info-directory [2] https://salsa.debian.org/python-team/tools/dh-python/-/blob/master/dhpython/fs.py?ref_type=heads#L185 [3] https://src.fedoraproject.org/rpms/pyproject-rpm-macros/blob/rawhide/f/macros.pyproject#_105 [4] https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=73c49f3c00415dee99407dabba8d3b22895c9d25 Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* libselinux-python: fix do_install line continuation and variable typoRong Fu2026-04-201-5/+5
| | | | | | | | Add missing line continuation backslash after PREFIX=${prefix} in do_install(). Fix variable name typo: rename 'dicect_url_json' to 'direct_url_json'. Signed-off-by: Rong Fu <rong.fu.cn@windriver.com> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* refpolicy_common: enable PARALLEL_MAKEEtienne Cordonnier2026-04-161-2/+0
| | | | | | | | | | | | | | | Using parallel make threads speeds up the build. This line was added in https://git.yoctoproject.org/meta-selinux/commit/?id=1139c40cb687deefddc31c5fbc8ab61f3d50402f in 2012. The parallel build of refpolicy was fixed in 2014 in commit "Fix parallel build of the policy": https://github.com/SELinuxProject/refpolicy/commit/c1c11fa2f8ca03d47adaf31bca4b257459448c19 I've tested a build of core-image-full-cmdline with yocto master branch as well as a custom image and it seems to work without issues. Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* libsemanage: disable LTO to fix buildpaths QA failureThomas Perrot2026-04-091-0/+4
| | | | | | | | | | Fat LTO objects in the static library embed original source paths in .gnu.lto_* IR sections. Unlike DWARF output, these sections are not affected by -ffile-prefix-map, causing TMPDIR references to survive into the installed libsepol-staticdev package. Signed-off-by: Thomas Perrot <thomas.perrot@bootlin.com> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* libselinux: disable LTO to fix buildpaths QA failureThomas Perrot2026-04-091-0/+4
| | | | | | | | | | Fat LTO objects in the static library embed original source paths in .gnu.lto_* IR sections. Unlike DWARF output, these sections are not affected by -ffile-prefix-map, causing TMPDIR references to survive into the installed libselinux-staticdev package. Signed-off-by: Thomas Perrot <thomas.perrot@bootlin.com> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* libsepol: disable LTO to fix buildpaths QA failureThomas Perrot2026-04-091-0/+4
| | | | | | | | | | Fat LTO objects in the static library embed original source paths in .gnu.lto_* IR sections. Unlike DWARF output, these sections are not affected by -ffile-prefix-map, causing TMPDIR references to survive into the installed libsepol-staticdev package. Signed-off-by: Thomas Perrot <thomas.perrot@bootlin.com> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* refpolicy: update to latest git revYi Zhao2026-04-032-4/+4
| | | | | | | | | | | | | * 9ff571c79 refpolicy: donotaudit rsyslogd for net_admin capability on self * aa350841e refpolicy: Added policy for modprob to read blacklist-video.conf lnk_file * eef80d415 refpolicy: Added policy for systemd_user_runtime_dir_t to read tmp_t directory * 2a85bb850 refpolicy: Added policy for rpcbind * bd3c6e00e refpolicy: Added dontaudit on docker_t to manage /usr directory * 2aad2d57f kernel: add kernel_read_transparent_hugepage_sysfs interface * aacef5aae varnishd: update fcontexts for vinyl-cache rename * e393fdc3c virt: label libvirt hook scripts with dedicated exec type Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* layer.conf: update to wrynose release seriesYi Zhao2026-03-191-1/+1
| | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* refpolicy: upgrade to 20260312Yi Zhao2026-03-181-2/+2
| | | | | | | | | | | | | | * ab1fbc994 systemd: allow systemd-sysusers to send audit messages * b30600233 systemd: use systemd_stream_connect_userdb() for user runtime client * cf596dfcf systemd: support LogNamespace * 113205a65 sechecker.ini: Add net_admin to kmod_t. * 89379c0b2 kmod: add net_admin capability to kmod_t * 1efb8ead4 tee_supplicant: Introduce SELinux domain for tee_supplicant * 0e00aeb25 Define security policy for DSP FastRPC daemons * cdc9ae133 chronyd: Add urandom access for chronyc UTI_GetRandomBytesUrandom. * 1ffcf999e devices: Rename FastRPC interfaces to follow dev_ naming convention Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* selinux_common: Correct `CVE_PRODUCT` valueHet Patel2026-03-161-1/+1
| | | | | | | | | | | | | | | | | | | | | | | The current `CVE_PRODUCT` value (`kernel:selinux`) is incorrect for this recipe. Root Cause Analysis: `CVE-2020-10751` is reported against the `kernel:selinux` CPE, and its fix (https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fb73974172ff) applies to the Linux kernel source tree. This change is unrelated to the source code used by this recipe. Change Justification: `CVE-2021-36084` is reported against the `selinux_project:selinux` CPE. Its fix (https://github.com/SELinuxProject/selinux/commit/f34d3d30c832) directly applies to the SELinux source repository used by this recipe, confirming the vulnerability is applicable to this product. Based on this analysis, `CVE_PRODUCT` has been updated to the correct value: `selinux_project:selinux` Signed-off-by: Het Patel <hetpat@cisco.com> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* refpolicy: update to latest git revYi Zhao2026-02-1266-127/+403
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 859c83274 loadkeys: allow loadkeys to read and write tmpfs files * 249573c16 systemd: set label for /run/userdb * 2b296cfd5 Add policy support for Qualcomm FastRPC devices * ff5bd4b6e sepolicy: Add sepolicy rules for bluetooth Notify failures * 8bd8bcce0 systemd: fixes for systemd-user-runtime-dir * 93533d690 ofono: allow ofonod to read localization file * 0636c25d0 Add local policy comment for pd_mapper_t * c8aef7c55 pd-mapper: Introduce SELinux domain for pd-mapper * 0b6686d45 file_contexts.subs: Improve comment grammar * 1783c0c4e ofono: introduce dedicated SELinux domain ofono_t * 4a507774a dbus: Remove permissions from unprivileged user * 4a1caa541 systemd: systemd-pcrphase read /etc/crypto-policies * 62df0656a userdomain: Remove permissions from unprivileged user * b91cef911 obexctl: Add sepolicy for obexctl to work in ssh * 43ef3db9b Sepolicy changes for brctl to access devpts * dc09a7554 crio: various fixes * c09e51c2e init: allow using system container BPF programs * 209a6c32f podman: allow watching systemd-resolved runtime * e9721fb96 container: allow execute_no_trans on container_tmpfs_t files * 3137f0388 netutils: allow network access in a user namespace * 0ffef59b3 systemd: dontaudit user session getattr generic blk devices * 22bb0f57a systemd: allow socket activation for systemd-resolved * d70476c36 tuned: various fixes * 1ed2834f0 kanidm: hookup systemd unit dir management * 16022b3a3 init, systemd: add interfaces for systemd managed unit dirs * 5f4841dea systemd: allow journalctl to search log directory * 8df481716 build-policy: Add temp backwards compatibility * e02eed27f validate/diff-policy.yml: Fix library usage. * d978a9512 ci: add module storage test * 7ef63156c ci: Create artifact of the workdir if the build fails. * b63504dfc build-userspace/setools.yml: Add commit hash to cache ID. * 14233d24a tests.yml: Increase userspace to v3.9. * 93a6a5339 locallogin: allow local_login_t lastlog_t create,delete * 1f0dbdbef authlogin: add auth_create_lastlog and auth_delete_lastlog * 6aa166162 authlogin: label /var/lib/lastlog (lastlog2) * 4b01becb5 snmpd doesn't seem to need sys_ptrace capability * 41ebe4a52 init: Fix typo in init.if comment * 47c348f5a Suppressing denial for systemd login to read process init scripts * 5cd787409 logging: allow miscfiles_read_generic_certs(syslogd_t) * 7c0a3dff6 logging: allow syslogd_t syslog_tls_port_t name_connect * b0be996ea Adding rules for virt module * bed6cef8d Adding rules for mount to search configfs * f1fef8e23 Add sepolicy for bootloader to create directory in dosfs * 1e55618a2 gcc_config_t: allow reading cgroup files for cpu.max * 1ea2d3de5 firewalld: Allow firewall-cmd to be called from systemd * 1b0172c86 Wireshark patch to allow execmem (which it unfortunately needs), allow (#1039) * cdaa2e506 games (#1026) * d68c6b921 Label ~/.cache/gstreamer-[0-9\.]+(/.*)? files (#1042) * a6b9cf804 fapolicyd: support for new /usr/sbin/fapolicyd-rpm-loader * 49e00dc0f chromium: drop the chromium_render_t domain Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* selinux: upgrade 3.9 -> 3.10Yi Zhao2026-02-0618-12/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ChangeLog: https://github.com/SELinuxProject/selinux/releases/tag/3.10 * libsepol: fix TARGET and LIBSO on Darwin * secilc: use correct long option name for -X * Fix problem with bounds statements in optional blocks * libsepol: Fix processing of levels for user rule in an optional block * libsepol: Fix problem with handling type attributes in role-types rule * libsepol: Fix expand_role_attributes_in_attributes() * Allow type attributes to be associated with other type attributes * libsepol: Support functionfs_seclabel policycap * improve semanage man pages: Add examples for -r RANGE flag usage * libselinux: fix parsing of the enforcing kernel cmdline parameter * seunshare: always use translations when printing * treewide: add .clang-format configuration file * setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC * libsepol: add memfd_class capability * semanage: Reset active value when deleting boolean customizations * python/sepolicy: Add support for DNF5 * sandbox/seunshare: Replace system() with execv() to prevent shell injection * libsepol: Tighten checks on MLS range and level when validating * libsepol: Fix potential NULL dereference in policydb_read() * libsepol: Fix potential use of an uninitialized value in link.c * libsepol: add bpf_token_perms polcap * libsepol: Fix possible use-after-free when expanding attributes * libselinux/src/Makefile: build python module without isolation * restorecon: Add option to count relabeled files * Bug fixes Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* openssh: Add pam_env supportClayton Casciato2026-02-021-0/+1
| | | | | | | | | | | | | | | | From: https://git.openembedded.org/openembedded-core/commit/meta/recipes-connectivity/openssh/openssh/sshd?id=4e6762f5967b1996cf31ae100fa49e775dfb2866 Make setting environment variables in /etc/environment or /etc/security/pam_env.conf take effect for ssh session. [ YOCTO # 15767] Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Clayton Casciato <majortomtosourcecontrol@gmail.com> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* linux-yocto: drop CONFIG_EXT3_FS_SECURITYYi Zhao2026-01-221-1/+0
| | | | | | | | CONFIG_EXT3_FS_SECURITY has been removed since kernel 6.18[1]. [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d6ace46c82fd2d3bdb58c35e3dd5cb9e83e136bf Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* selinux-python: fix build with pip 25.3Yi Zhao2026-01-131-0/+1
| | | | | | | | | | | | | | | | | | | | | Set PIP_NO_BUILD_ISOLATION to 0 to fix do_install error: File "/tmp/pip-build-env-ed1bjis8/overlay/lib/python3.13/site-packages/setuptools/_distutils/command/build.py", line 83, in finalize_options if sysconfig.get_config_var('Py_GIL_DISABLED'): ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^ File "tmp/work/x86-64-v3-poky-linux/selinux-python/3.9/recipe-sysroot-native/usr/lib/python3.13/sysconfig/__init__.py", line 591, in get_config_var return get_config_vars().get(name) ~~~~~~~~~~~~~~~^^ File "tmp/work/x86-64-v3-poky-linux/selinux-python/3.9/recipe-sysroot-native/usr/lib/python3.13/sysconfig/__init__.py", line 565, in get_config_vars _init_config_vars() ~~~~~~~~~~~~~~~~~^^ File "tmp/work/x86-64-v3-poky-linux/selinux-python/3.9/recipe-sysroot-native/usr/lib/python3.13/sysconfig/__init__.py", line 503, in _init_config_vars _init_posix(_CONFIG_VARS) ~~~~~~~~~~~^^^^^^^^^^^^^^ File "tmp/work/x86-64-v3-poky-linux/selinux-python/3.9/recipe-sysroot-native/usr/lib/python3.13/sysconfig/__init__.py", line 361, in _init_posix _temp = __import__(name, globals(), locals(), ['build_time_vars'], 0) ModuleNotFoundError: No module named '_sysconfigdata' Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* libselinux-python: fix build with pip 25.3Yi Zhao2026-01-131-0/+1
| | | | | | | | | | | | | | | | | | | | | Set PIP_NO_BUILD_ISOLATION to 0 to fix do_install error: File "/tmp/pip-build-env-feqeamd5/overlay/lib/python3.13/site-packages/setuptools/_distutils/sysconfig.py", line 587, in get_config_var return get_config_vars().get(name) ~~~~~~~~~~~~~~~^^ File "/tmp/pip-build-env-feqeamd5/overlay/lib/python3.13/site-packages/setuptools/_distutils/sysconfig.py", line 565, in get_config_vars _config_vars = sysconfig.get_config_vars().copy() ~~~~~~~~~~~~~~~~~~~~~~~~~^^ File "tmp/work/x86-64-v3-poky-linux/libselinux-python/3.9/recipe-sysroot-native/usr/lib/python3.13/sysconfig/__init__.py", line 565, in get_config_vars _init_config_vars() ~~~~~~~~~~~~~~~~~^^ File "tmp/work/x86-64-v3-poky-linux/libselinux-python/3.9/recipe-sysroot-native/usr/lib/python3.13/sysconfig/__init__.py", line 503, in _init_config_vars _init_posix(_CONFIG_VARS) ~~~~~~~~~~~^^^^^^^^^^^^^^ File "tmp/work/x86-64-v3-poky-linux/libselinux-python/3.9/recipe-sysroot-native/usr/lib/python3.13/sysconfig/__init__.py", line 361, in _init_posix _temp = __import__(name, globals(), locals(), ['build_time_vars'], 0) ModuleNotFoundError: No module named '_sysconfigdata' Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* systemd: remove creation of backlight directory during buildJaihind Yadav2026-01-132-8/+1
| | | | | | | | | | | | | | | | | | | The recipe previously created ${localstatedir}/lib/systemd/backlight at build time when PACKAGECONFIG included 'backlight'.I Tested it on myboard and can see directory is correctly labeled by SELinux at runtime and the backlight service starts successfully without this step. Removing it simplifies the install process. Example SELinux labeling: ls -laZ /var/lib/systemd/ drwxr-xr-x. 2 root root system_u:object_r:systemd_backlight_var_lib_t:s0 backlight Reference: Previous discussion and initial change: https://docs.yoctoproject.org/pipermail/yocto/2018-April/040854.html Signed-off-by: Jaihind Yadav <quic_jaihindy@quicinc.com> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* refpolicy: Add support to configure policy store rootSasi Kumar Maddineni2026-01-093-7/+24
| | | | | | | | | | | | By default, policy modules(*.pp) are stored in /var directory. Features like: ostree remove files in folders like /var variable data directory while build time. Added support for custom policy store. We can now configure path to custom policy store to variable `POLICY_STORE_ROOT`. Signed-off-by: Sasi Kumar Maddineni <quic_sasikuma@quicinc.com> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* libsemanage: Update policy version in semanage.confSasi Kumar Maddineni2025-12-291-1/+1
| | | | | | | | | | Currently semanage.conf file is being updated with policy version 33. Update semanage.conf file with policy version 35. Signed-off-by: Sasi Kumar Maddineni <quic_sasikuma@quicinc.com> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* selinux-image: Preserve SELinux contexts in tarballsSasi Kumar Maddineni2025-11-281-0/+2
| | | | | | | | | | | | | | Tarball images were created without SELinux context information, causing loss of security labels during extraction while working with features like:ostree. This breaks SELinux policy enforcement and requires relabeling after deployment, adding runtime overhead. Append "--selinux" to IMAGE_CMD_TAR to include SELinux file contexts when generating tarball images. This ensures security labels are preserved across image creation and deployment. Signed-off-by: Sasi Kumar Maddineni <quic_sasikuma@quicinc.com> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* libselinux-python: support reproducible buildsHongxu Jia2025-11-211-1/+11
| | | | | | | | | | | | | Originally, direct_url.json contains build path and it was removed to fix buildpaths issue, but the hash of direct_url.json in RECORD was not updated. In order to support reproducible builds [1], this commit manually updates hash of direct_url.json in RECORD after build path was removed [1] https://reproducible-builds.org/ Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* policycoreutils: remove reference to obsolete codeAnuj Mittal2025-11-191-6/+0
| | | | | | | | | | | | | | The code referenced no longer exists [1]. It was refactored later to change the way modules are loaded [2]. Remove reference to the code, comment and creation of directory as it can be set to something else as well. [1] https://github.com/SELinuxProject/selinux/commit/565ea9832e841075e362db4d188cc7ebb0d4c35e [2] https://github.com/SELinuxProject/selinux/commit/2ff279e21e4715ac49e094b5fae8bc8e84b9e417 Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* selinux-python: make semanage RDEPENDS on sepolgenAnuj Mittal2025-11-191-0/+1
| | | | | | | | | | | | | | | | | | Make the dependency explicit, otherwise when it leads to errors when it is not included. | ~ # semanage permissive | Traceback (most recent call last): | File "/sbin/semanage", line 29, in <module> | import seobject | File "/usr/lib/python3.13/site-packages/seobject.py", line 33, in <module> | import sepolicy | File "/usr/lib/python3.13/site-packages/sepolicy/__init__.py", line 8, in <module> | import sepolgen.defaults as defaults | ModuleNotFoundError: No module named 'sepolgen' Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* refpolicy: update to latest git revYi Zhao2025-11-062-7/+8
| | | | | | | | | * 739ee699b portage: grant compile domains getattr on chr_files in /dev * 7de9ae015 ssh: set file context for default locations of split binaries * 4af789c43 check_fc_files.py: Add a version suffix match * e93b0cf5e devices: Add iio write and rw interfaces Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* refpolicy: Correct policy version in semanage.conf as per checkpolicySasi Kumar Maddineni2025-10-231-1/+1
| | | | | | | | | | The code "OUTPUT_POLICY=`${STAGING_BINDIR_NATIVE}/checkpolicy -V | cut -d' ' -f1`" assigns OUTPUT_POLICY with 35 and policy.35 is getting generated. So, correcting the policy version in semanage.conf file too. Signed-off-by: Sasi Kumar Maddineni <quic_sasikuma@quicinc.com> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* refpolicy: Remove build path reference from file_contexts.homedirsSasi Kumar Maddineni2025-10-231-0/+2
| | | | | | | | | | | filecontexts.homedirs is getting populated with reference to TMPDIR path and yocto's QA check is flagging it. To avoid this, removing the line that contains TMPDIR path from filecontexts.homedirs. Signed-off-by: Sasi Kumar Maddineni <quic_sasikuma@quicinc.com> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* refpolicy: Use selinux tools from recipe-sysroot pathSasi Kumar Maddineni2025-10-231-0/+2
| | | | | | | | | | | | | | | | | | | The following code snippet from refpolicy shows that the host machine's /sbin, /usr/bin, /usr/sbin paths were configured to use selinux tools, instead from yocto build recipe-sysroot paths. refpolicy/Makefile:47:BINDIR ?= /usr/bin refpolicy/Makefile:48:SBINDIR ?= /usr/sbin refpolicy/Makefile:63:tc_usrbindir := $(BINDIR) refpolicy/Makefile:64:tc_usrsbindir := $(SBINDIR) refpolicy/Makefile:65:tc_sbindir := /sbin Fix: Configured 'tc_usrsbindir' and 'tc_sbindir' with yocto build recipe-sysroot paths. 'tc_usrbindir' already configured as per recipe-sysroot paths. Signed-off-by: Sasi Kumar Maddineni <quic_sasikuma@quicinc.com> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* refpolicy: Skip HLL module processing for monolithic policy buildsSasi Kumar Maddineni2025-10-232-31/+34
| | | | | | | | | | | | Avoid processing and copying high-level language (.pp) modules during do_install when MONOLITHIC=y is set. This prevents build failures due to missing files in /usr/share/selinux/targeted, which are not generated in monolithic mode. Fixes error: cp: cannot stat '/usr/share/selinux/targeted/*.*': No such file or directory Signed-off-by: Sasi Kumar Maddineni <quic_sasikuma@quicinc.com> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* initscripts: fix incompatibility with read-only-rootfsJoão Marcos Costa2025-10-081-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When the read-only-rootfs feature (in IMAGE_FEATURES) is enabled, the populate-volatile.sh script runs at build time. This compensates for the fact that certain essential directories and files cannot be created at runtime, since the root filesystem is read-only. This is handled in oe-core's rootfs-postcommands.bbclass, in read_only_rootfs_hook. However, initscripts-1.0_selinux.inc appends some shell code to populate-volatile.sh considering it will be run in the target, not on the host machine. So, if one uses both read-only-rootfs and selinux (in DISTRO_FEATURES), the recursive call to restorecon is run in the host machine, since populate-volatile.sh is called in build time. This leads to errors such as: | NOTE: Executing read_only_rootfs_hook ... | DEBUG: Executing shell function read_only_rootfs_hook | /sbin/restorecon: Could not read /var/lib/AccountsService/users: Permission denied. | /sbin/restorecon: Could not read /var/lib/NetworkManager: Permission denied. | /sbin/restorecon: Could not read /var/lib/bluetooth: Permission denied. | /sbin/restorecon: Could not read /var/lib/chrony: Permission denied. As a matter of fact, this scenario is a fair reminder not to call bitbake with sudo. This change makes sure the append is only performed if the read-only-rootfs feature is not used. Signed-off-by: João Marcos Costa <joaomarcos.costa@bootlin.com> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* refpolicy: upgrade 20250213+git -> 20250923+gitYi Zhao2025-10-0164-338/+352
| | | | | | | | | | | | | | | | | | | | ChangeLog: https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20250618 https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20250923 Notable Changes 20250618: * Updates to support screen 5.0. * Add labeling for bcachefs. * Various systemd updates and fixes. 20250923: * Several updates and fixes for systemd * Add new permissions and policy capabilities * Drop reiserfs support (it was removed in kernel 6.13) Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* setools: upgrade 4.5.1 -> 4.6.0Yi Zhao2025-09-232-10/+10
| | | | | | | ChangeLog: https://github.com/SELinuxProject/setools/releases/tag/4.6.0 Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* openssh: use config snippet instead of fileLevi Shafter2025-09-183-118/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Config snippets should be used over file overrides since targeted changes may be required in multiple recipes. Since the oe-core sshd_config file now includes /etc/ssh/sshd_config.d/*.conf, the meta-selinux configuration snippet does not require the following: * ChallengeResponseAutnetication: Replaced by KbdInteractiveAuthentication and set to "no" by default * Override default of no subsystems: This is already present * Compression, ClientAliveInterval, and ClientAliveCountMax: No changes required due to identical requirements of meta-selinux Testing process: * Pulled modified meta-selinux layer into Poky and included openssh * Built core-image-sato and ran via qemu * Verified /etc/ssh was as expected with an ssh_config.d directory with the new selinux config snippet inside * Verified system was including selinux config modification by running sshd -T Suggested-by: Clayton Casciato <majortomtosourcecontrol@gmail.com> Signed-off-by: Levi Shafter <lshafter@21sw.us> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* linux-yocto: drop CONFIG_REISERFS_FS_SECURITYYi Zhao2025-09-151-1/+0
| | | | | | | | CONFIG_REISERFS_FS_SECURITY has been removed since kernel 6.13[1]. [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fb6f20ecb121cef4d7946f834a6ee867c4e21b4a Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* selinux-python: fix No module named pipVincent Davis Jr2025-08-271-2/+4
| | | | | | | | | | | | | | | | When running the do install task run into No modules named pip. Add python3-pip-native to DEPENDS so that pip it available. PREFIX variable not being set also appears to effect whether pip is found or not. No reason was found as to why that is. Signed-off-by: Vincent Davis Jr <vince@underview.tech> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* libselinux-python: fix No module named pipVincent Davis Jr2025-08-271-1/+1
| | | | | | | | | | | When running the do install task run into No modules named pip. Add python3-pip-native to DEPENDS so that pip it available. Signed-off-by: Vincent Davis Jr <vince@underview.tech> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* selinux: upgrade 3.8.1 -> 3.9Yi Zhao2025-08-0727-122/+124
| | | | | | | | | | | | | | | | | | | | | | ChangeLog: https://github.com/SELinuxProject/selinux/releases/tag/3.9 * Support static-only builds with DISABLE_SHARED=y * Add restore option to modify user and role portions * setfiles: Add -U option to modify user and role portions * semanage.conf: Add relabel_store config option * semodule: Add [-g PATH |--config=PATH] for an alternate path for the semanage config * libselinux: Fix local literal fcontext definitions priority * libselinux: Fix order for path substitutions * libsepol: Add new 'netif_wildcard' policy capability * checkpolicy: Add support for wildcard netifcon names * libsepol: Allow multiple policycap statements * libsepol: Support genfs_seclabel_wildcard * Replace all links to selinuxproject.org * Bug fixes Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* libselinux-python: Add native supportPoonam Jadhav2025-07-111-0/+2
| | | | | | | | | | | | Add native support for libselinux-python to fix build error for setools-native ERROR: Nothing RPROVIDES 'libselinux-python-native' (but virtual:native: meta-selinux/recipes-security/setools/setools_4.5.1.bb RDEPENDS on or otherwise requires it) Signed-off-by: Poonam Jadhav <poonam.jadhav@kpit.com> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* setools: Add native supportPoonam Jadhav2025-07-111-0/+2
| | | | | | | | Enable using setools native for analyzing the built SELinux policy during the build. Signed-off-by: Poonam Jadhav <poonam.jadhav@kpit.com> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* Adapt to UNPACKDIR changesScott Murray2025-06-3018-28/+9
| | | | | | | | | | | | Remove or update S definitions as required to work with oe-core S/UNPACKDIR changes. A default definition of S has been added to selinux_common.inc to avoid duplication in the set of recipes that use it to build packages from different subdirectories of the selinux repo. The three packagegroups test build successfully with these changes. Signed-off-by: Scott Murray <scott.murray@konsulko.com> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* Set compatible layers to whinlatterScott Murray2025-06-261-1/+1
| | | | | | | | whinlatter is the next release, set it as compatible layer since it is not backwards compatible. Signed-off-by: Scott Murray <scott.murray@konsulko.com> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* refpolicy: update to latest git revYi Zhao2025-04-222-7/+7
| | | | | | | | | | | * 5a6c7d8bf systemd: Add log env to systemd-machine-id-setup. * 33af8dfa4 Module for ipmitool * a3a6b1704 oddjob: allow oddjob_mkhomedir_t privfd:fd use * 621eb6caf systemd: allow reading /dev/cpu/0/msr * fb0e9cdda Remove unneeded backticks from gen_tunable * 2240e1a89 locallogin: allow sulogin_t user_tty_device_t rw Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* refpolicy: update to latest revYi Zhao2025-04-022-22/+6
| | | | | | | | | | | | | | | | | | | | | | | | * d05a0d068 networkmanager: Watch systemd directories for nm-session-monitor. * 3a60340e9 systemd: allow systemd-hostnamed and systemd-rfkill to get attributes of nsfs inodes * ccbf1d66f fixup! Allow to specify module version * d664ebbaa Allow to specify module version * 1c8a95dbc Fix mislabeling of /etc/shadow * ec2b2befd locallogin: allow sulogin_t unconfined domtrans * 450522052 use init_use_script_ptys for knotc in initscript * 79dda56d3 locallogin: dontaudit sulogin_t checkpoint_restore * 4b3b8e7ce lldpad: Configure FW-LLDP on i40e NICs. * ed9d87976 Revert "Merge pull request #867 from PPN-SD/upd-knot-sel" * e053fced8 files, init: filetrans /run/machine-id etc_runtime_t * c5a76add7 firewalld: fix firewalld_t firewalld_tmpfs_t exec * 8a4043060 firewalld: fix lib_t Python cache denial auditing * bcb8e1d4d unconfined: fix oddjob security_compute_sid * ec8a5080a Permit init_t to start a detached screen session * b025e0ec4 Add setcap to knotd / add knotc_initrc_domtrans * 231960371 chronyd: fix dac_read_search denials Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* selinux: upgrade 3.8 -> 3.8.1Yi Zhao2025-03-1015-1/+1
| | | | | | | | | | ChangeLog: https://github.com/SELinuxProject/selinux/releases/tag/3.8.1 * libsemanage: improved performance of semanage store rebuild Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
* refpolicy: update to 20250213+gitYi Zhao2025-03-0767-243/+461
| | | | | | | | | | | | ChangeLog: https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20250213 * Add tool for validating appconfig contexts files. * Add netlink extended permissions definitions. * Updates for Systemd up to v257. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
* selinux: upgrade 3.7 -> 3.8Yi Zhao2025-03-0723-539/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | ChangeLog: https://github.com/SELinuxProject/selinux/releases/tag/3.8 * libsemanage: Preserve file context and ownership in policy store * libselinux: deprecate security_disable(3) * libsepol: Support nlmsg extended permissions * libsepol: Add policy capability netlink_xperm * libsemanage: Optionally allow duplicate declarations * policycoreutils: introduce unsetfiles * libselinux/utils: introduce selabel_compare * improved selabel_lookup performance * libselinux: support parallel usage of selabel_lookup(3) * libsepol: add support for xperms in conditional policies * Improved man pages * Code improvements and bug fixes * Always build for LFS mode on 32-bit archs. * libsemanage: Mute error messages from selinux_restorecon introduced in 3.8-rc1 * Regex spec ordering is restored to pre 3.8-rc1 * Binary fcontext files format changed, files using old format are ignored * Code improvements and bug fixes License-Update: White space cleanup for libsemanage/LICENSE Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
* setools: inherit cython classYi Zhao2025-03-071-6/+2
| | | | | | | | Use the new cython class to avoid duplicated fixup code to remove build paths. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
* compat: add walnascar to compat listJoe MacDonald2024-12-101-1/+1
| | | | Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
* SELinux-FAQ: drop debug-tweaksYi Zhao2024-12-101-1/+1
| | | | | | | | The debug-tweaks IMAGE_FEATURE has been removed in oe-core. Replace it with allow-empty-password. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-10-29 19:39:07 +0000