summaryrefslogtreecommitdiffstats
path: root/recipes-security/selinux
Commit message (Collapse)AuthorAgeFilesLines
* checkpolicy: remove link against libfldizzyJoe MacDonald2014-11-102-3/+5
| | | | | | | An updated version of the patch to drop linking against libfl was required. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* userspace: update core selinux userspace toolsJoe MacDonald2014-11-0112-39/+27
| | | | | | Update to the latest stable release, 20140506. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* Globally replace 'base_contains' calls with 'bb.utils.contains'Joe MacDonald2014-09-241-3/+3
| | | | | | | | | | | | | | | Based on oe-core commit: commit 1528e596d4906c33e4be83fcf691cfe76d340ff3 Author: Otavio Salvador <otavio@ossystems.com.br> Date: Thu Apr 24 15:59:20 2014 -0300 Globally replace 'base_contains' calls with 'bb.utils.contains' The base_contains is kept as a compatibility method and we ought to not use it in OE-Core so we can remove it from base metadata in future. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* selinux-userspace: update userspace SRC_URI and checksumsJoe MacDonald2014-09-169-16/+22
| | | | | | | | | Trac has been turned off on OSS. Update all SRC_URI links for the userspace components to point at the github project releases. The github releases also have a slightly different directory structure in the tarballs, requiring an update of the checksums as well. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* checkpolicy: remove PRINC warningHongxu Jia2014-05-093-4/+2
| | | | | | | | | | Bump up PR and remove PRINC. Set it to something suitably large that it's unlikely to break anyone's package feed and so that it shows it's clearly an exception case. Obviously this is just a staging activity until the next update when we don't include anything of the sort. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libselinux: remove PRINC warningHongxu Jia2014-05-093-4/+2
| | | | | | | | | | Bump up PR and remove PRINC. Set it to something suitably large that it's unlikely to break anyone's package feed and so that it shows it's clearly an exception case. Obviously this is just a staging activity until the next update when we don't include anything of the sort. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libsemanage: remove PRINC warningHongxu Jia2014-05-093-4/+2
| | | | | | | | | | Bump up PR and remove PRINC. Set it to something suitably large that it's unlikely to break anyone's package feed and so that it shows it's clearly an exception case. Obviously this is just a staging activity until the next update when we don't include anything of the sort. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libsepol: remove PRINC warningHongxu Jia2014-05-093-4/+2
| | | | | | | | | | Bump up PR and remove PRINC. Set it to something suitably large that it's unlikely to break anyone's package feed and so that it shows it's clearly an exception case. Obviously this is just a staging activity until the next update when we don't include anything of the sort. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* sepolgen: remove PRINC warningHongxu Jia2014-05-093-4/+2
| | | | | | | | | | Bump up PR and remove PRINC. Set it to something suitably large that it's unlikely to break anyone's package feed and so that it shows it's clearly an exception case. Obviously this is just a staging activity until the next update when we don't include anything of the sort. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* policycoreutils: remove PRINC warningHongxu Jia2014-05-093-4/+2
| | | | | | | | | | Bump up PR and remove PRINC. Set it to something suitably large that it's unlikely to break anyone's package feed and so that it shows it's clearly an exception case. Obviously this is just a staging activity until the next update when we don't include anything of the sort. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libsemanage: disable expand-check on policy loadJoe MacDonald2014-05-072-0/+33
| | | | | | | | | For small policy modules it's not necessary to walk the hierarchy on load. On embedded devices that are low-powered or resource-constrained disabling the hierarchy processing can make the difference between seconds and (many) minutes of load time (or being able to load the policy at all). Signed-off-by: Joe MacDonald <joe@deserted.net>
* policycoreutils: fix TypeError for seobject.pyWenzong Fan2014-04-242-0/+33
| | | | | | | | | | | Fix python error about: File "/usr/lib64/python2.7/site-packages/seobject.py", line 109, in log message += " sename=" + sename TypeError: cannot concatenate 'str' and 'NoneType' objects Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* policycoreutils / semanage: process ValueError for sepolicy, seobjectWenzong Fan2014-04-242-0/+49
| | | | | | | | | The sepolicy, seobject modules raise many unprocessed ValueError, just process them in semanage to make the script proivdes error message but not error trace. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* policycoreutils: Add missing dependencies to semanagePeter Seebach2014-04-031-0/+2
| | | | | | | | The semanage utility requires python-compression (for "import gzip") and python-xml (for "import xml.etree.ElementTree"). Signed-off-by: Peter Seebach <peter.seebach@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* checkpolicy: Don't link against libflChong Lu2014-04-032-0/+46
| | | | | | | | | | In policy_scan.l file, we have already removed all references to yywrap by adding "%option noyywrap" statements to each flex source file that doesn't override yywrap. After this, we no longer need to link against libfl and so no longer get errors about undefined references to yylex. Signed-off-by: Chong Lu <Chong.Lu@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* policycoreutils: drop the patch for old refpolicyJackie Huang2014-04-033-42/+0
| | | | | | | | | | The patch policycoreutils-revert-run_init-open_init_pty.patch is only for refpolicy version older than 2.20120725, now the refpolicy is updated to 2.20130424 so drop the patch or it will make run_init fail to start some init scripts. Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* policycoreutils: semanageJoe Slater2014-04-032-1/+23
| | | | | | | | | When modifying an selinux login record, seobject.py, may try to log a value, self.sename, which has been preset to "None" and this will fail. So, we set it to something useful. Signed-off-by: Joe Slater <jslater@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* selinux: set policy-version to 28Wenzong Fan2014-01-281-0/+4
| | | | | The default policy version of new selinux toolchains is 29, to fit kernel 3.10.x, set it to 28.
* libsemanage: fix DEPENDS override issueWenzong Fan2014-01-231-1/+1
| | | | | | | Don't override DEPENDS for target build, the "audit" should be appended to it. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
* libsemanage-native: remove audit-native dependencyWenzong Fan2014-01-204-0/+128
| | | | | | | | | * native tools don't need audit support; * audit 2.3.2 or laters require kernel headers >= 2.6.30, this causes audit-native can't be built on some older distributions. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* Revert "libsemanage: add audit dependency"Wenzong Fan2014-01-201-1/+1
| | | | | | | This reverts commit 146bd8c6bc3bc0e9e96a8517263f28f7915b871d. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* libselinux: uprev to small fix version 2.2.2Wenzong Fan2014-01-201-2/+2
| | | | | Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* selinux: remove PREFERRED_VERSION configsWenzong Fan2014-01-201-7/+0
| | | | | | | | We are using the latest version for selinux userspace packages, so remove the PREFERRED_VERSION configs. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Xin Ouyang <xin.ouyang@windriver.com>
* policycoreutils: fix QA issuesWenzong Fan2014-01-101-3/+7
| | | | | | | | | | | | | | | ERROR: QA Issue: policycoreutils: Files/directories were installed \ but not shipped /usr/share/icons/hicolor/24x24/apps/system-config-selinux.png /usr/share/bash-completion/completions/setsebool /usr/share/bash-completion/completions/sepolicy /usr/share/bash-completion/completions/semanage /usr/share/dbus-1/system-services/org.selinux.service /usr/share/polkit-1/actions/org.selinux.config.policy /usr/share/polkit-1/actions/org.selinux.policy Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* libsemanage: add audit dependencyWenzong Fan2014-01-101-1/+1
| | | | | | | Building libsemanage 2.2 need the header libaudit.h. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* sepolgen: migrate SRC_URI to 1.2.1Wenzong Fan2014-01-102-4/+4
| | | | | Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* policycoreutils: migrate SRC_URI and patches to 2.2.5Wenzong Fan2014-01-106-67/+32
| | | | | | | | | | | | This patch is removed since it is merged by new version: - policycoreutils-fix-strict-prototypes.patch These two patches are updated: - policycoreutils-fix-sepolicy-install-path.patch - policycoreutils-make-O_CLOEXEC-optional.patch Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* libsepol: migrate SRC_URI to 2.2Wenzong Fan2014-01-104-40/+8
| | | | | | | | Removed patch and ported changes to 2.2 bbfile: - libsepol-Change-ranlib-for-cross-compiling.patch Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* libsemanage: migrate SRC_URI to 2.2Wenzong Fan2014-01-103-8/+10
| | | | | | | | Updated patch: - libsemanage-fix-path-nologin.patch Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* libselinux: migrate SRC_URI and patches to 2.2Wenzong Fan2014-01-104-66/+10
| | | | | | | | | These two patches are removed since they are merged by new version: - libselinux-fix-init-load-policy.patch - libselinux-pcre-link-order.patch Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* checkpolicy: migrate SRC_URI to 2.2Wenzong Fan2014-01-102-4/+4
| | | | | Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* selinux userspace: uprev packages to release 20131030Wenzong Fan2014-01-109-15/+13
| | | | | | | | | | | | | | | Upreved packages: - checkpolicy to 2.2 - libselinux to 2.2 - libsemanage to 2.2 - libsepol to 2.2 - policycoreutils to 2.2.5 - sepolgen to 1.2.1 Migrate patches in next commits. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* policycoreutils: Patch Makefile to get load_policy symlink right.Philip Tricca2014-01-102-0/+20
| | | | | | | | | Setting DESTDIR in the policycoreutils do_install creates a bad symlink for load_policy. This patch fixes up the Makefile to create the symlink relative to DESTDIR. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* libselinux / libsemanage: work around FD_CLOEXEC and SOCK_CLOEXEC absenceJoe MacDonald2013-11-145-0/+113
| | | | | | | | | | | | | | | [ CQID: WIND00438478 ] [ CQID: WIND00439485 ] Turns out some of the truly old hosts don't even really recognize FD_CLOEXEC and most of the older ones don't know about SOCK_CLOEXEC. Work around each (define FD_CLOEXEC to something sensible, simply don't use SOCK_CLOEXEC, produce warnings in either event). Signed-off-by: Joe MacDonald <joe.macdonald@windriver.com> Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* libselinux / policycoreutils: optional O_CLOEXECJoe MacDonald2013-11-144-0/+152
| | | | | | | | | | | [ CQID: WIND00438478 ] We still have hosts that pre-date the inclusion of O_CLOEXEC (Linux 2.6.23) so compile the flag out when building on classic distros. Signed-off-by: Joe MacDonald <joe.macdonald@windriver.com> Signed-off-by: Jeff Polk <jeff.polk@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
* Remove unnecessary RDEPENDS_${BPN}.Philip Tricca2013-10-151-15/+0
| | | | | | | | | | Now that the policycoreutuils package is empty no need for RDEPENDS. Doing this in the commit that broke up the policycoreutuils package made the diff hard to read. Figured it best to break it out for readability. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* Break policycoreutils out into separate packages for the various utilities.Philip Tricca2013-10-151-10/+178
| | | | | | | | | | The driver beind this is to allow images to be built with the minimal tools necessary to load a policy. Breaking all of the stuff that's dependent on python out from the core utils allows us to make much smaller images. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* policycoreutils: avoid shell for checking target-special actionsMark Hatle2013-10-021-3/+1
| | | | | | | | do_install was modified to only do the special actions in the target case, instead of using shell to check what mode we were running in. Signed-off-by: Mark Hatle <mark.hatle@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* always force to restore file contexts in initscriptsXin Ouyang2013-10-022-4/+4
| | | | | | | | | | | In policycoreutils-2.13+, restorecon changes its default behaviour, and does not restore context if the file' type is correct, even its mcs/mls level is incorrect. We should force it always to restore file contexts in initscripts to avoid issues. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* policycoreutils: fix wrong newrole/run_init pam configXin Ouyang2013-10-022-6/+6
| | | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* sepolgen: migrate SRC_URI to 1.1.9Xin Ouyang2013-10-021-3/+3
| | | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* policycoreutils: migrate SRC_URI and patches to 2.1.14Xin Ouyang2013-10-025-350/+52
| | | | | | | | 2.1.14 imports a new python module: sepolicy, so add setools to DEPENDS and split new files to policycoreutils-python. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libsepol: migrate SRC_URI to 2.1.9Xin Ouyang2013-10-021-3/+3
| | | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libsemanage: migrate SRC_URI to 2.1.10Xin Ouyang2013-10-021-4/+4
| | | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* libselinux: migrate SRC_URI and patches to 2.1.13Xin Ouyang2013-10-022-964/+5
| | | | | | | We will also uprev refpolicy, so remove "revert-libpcre.patch". Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* checkpolicy: migrate SRC_URI to 2.1.12Xin Ouyang2013-10-021-3/+3
| | | | | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* selinux userspace: uprev packages to release 20130423Xin Ouyang2013-10-028-12/+12
| | | | | | | | | | | | | | | Upreved packages: - checkpolicy to 2.1.12 - libselinux to 2.1.13 - libsemanage to 2.1.10 - libsepol to 2.1.9 - policycoreutils to 2.1.14 - sepolgen to 1.1.9 Migrate patches in next commits. Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
* Add ${bindir}/sepolgen to system-config-selinux package.Philip Tricca2013-09-271-1/+4
| | | | | | | | | | Currently the policycoreutils package has a broken link from ${bindir}/sepolgen to ${datadir}/system-config-selinux/polgen.py. All of the other polgen stuff is in system-config-selinux so adding sepolgen to same package seems like the right thing to do. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* Check for the availability of 'secon' and 'setenforce' in the ↵Philip Tricca2013-09-271-3/+5
| | | | | | | | | selinux-init.sh script. This is for consistency and to aid in debugging. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
* Stage SELinux config file in the sysroot.Philip Tricca2013-09-251-0/+3
| | | | | | | | | | | | | This is needed to build policy modules outside of the refpolicy. Policy module build systems need to determine the name of the policy that will be in effect on the target host. This allows them to locate the policy headers that will be under $sysroot/usr/share/selinux/$name/include. Given that there *could* be more than one policy installed in the sysroot we can't assume that the policy installed there is the only policy to build against. Signed-off-by: Philip Tricca <flihp@twobit.us> Signed-off-by: Joe MacDonald <joe@deserted.net>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-05-14 07:00:35 +0000