From 4fefe83c3203c11fadbe43637a3058284b60427b Mon Sep 17 00:00:00 2001 From: Mark Hatle Date: Fri, 8 Sep 2017 10:44:23 -0500 Subject: Refactor to conform to YP Compat requirements Change the references to check for the distribution flag of 'selinux' being set before taking any action within the bbappends. This prevents the signature from being modified. Also remove PR changes, as they are no longer allowed. Signed-off-by: Mark Hatle --- recipes-core/busybox/busybox_%.bbappend | 88 +------------ recipes-core/busybox/busybox_selinux.inc | 85 ++++++++++++ recipes-core/coreutils/coreutils_%.bbappend | 3 +- recipes-core/dbus/dbus_%.bbappend | 3 +- recipes-core/eudev/eudev/init | 143 --------------------- recipes-core/eudev/eudev/udev-cache | 32 ----- recipes-core/eudev/eudev_%.bbappend | 3 +- recipes-core/eudev/eudev_selinux.inc | 3 + recipes-core/eudev/files/init | 143 +++++++++++++++++++++ recipes-core/eudev/files/udev-cache | 32 +++++ recipes-core/glib-2.0/glib-2.0_%.bbappend | 2 +- recipes-core/initscripts/files/devpts.sh | 29 +++++ .../initscripts/initscripts-1.0_selinux.inc | 11 ++ recipes-core/initscripts/initscripts/devpts.sh | 29 ----- recipes-core/initscripts/initscripts_1.0.bbappend | 14 +- recipes-core/libcgroup/libcgroup_%.bbappend | 13 +- recipes-core/libcgroup/libcgroup_selinux.inc | 10 ++ recipes-core/systemd/systemd_%.bbappend | 2 +- .../files/sysvinit-fix-is_selinux_enabled.patch | 71 ++++++++++ .../sysvinit-fix-is_selinux_enabled.patch | 71 ---------- recipes-core/sysvinit/sysvinit-2.88dsf_selinux.inc | 11 ++ recipes-core/sysvinit/sysvinit_2.88dsf.bbappend | 15 +-- recipes-core/util-linux/util-linux_%.bbappend | 4 +- 23 files changed, 407 insertions(+), 410 deletions(-) create mode 100644 recipes-core/busybox/busybox_selinux.inc delete mode 100644 recipes-core/eudev/eudev/init delete mode 100644 recipes-core/eudev/eudev/udev-cache create mode 100644 recipes-core/eudev/eudev_selinux.inc create mode 100644 recipes-core/eudev/files/init create mode 100644 recipes-core/eudev/files/udev-cache create mode 100755 recipes-core/initscripts/files/devpts.sh create mode 100644 recipes-core/initscripts/initscripts-1.0_selinux.inc delete mode 100755 recipes-core/initscripts/initscripts/devpts.sh create mode 100644 recipes-core/libcgroup/libcgroup_selinux.inc create mode 100644 recipes-core/sysvinit/files/sysvinit-fix-is_selinux_enabled.patch delete mode 100644 recipes-core/sysvinit/sysvinit-2.88dsf/sysvinit-fix-is_selinux_enabled.patch create mode 100644 recipes-core/sysvinit/sysvinit-2.88dsf_selinux.inc (limited to 'recipes-core') diff --git a/recipes-core/busybox/busybox_%.bbappend b/recipes-core/busybox/busybox_%.bbappend index b4935b2..7719d3b 100644 --- a/recipes-core/busybox/busybox_%.bbappend +++ b/recipes-core/busybox/busybox_%.bbappend @@ -1,87 +1 @@ -PR .= ".1" - -FILES_${PN} += "${libdir}/${PN}" - -# We should use sh wrappers instead of links so the commands could get correct -# security labels -python create_sh_wrapper_reset_alternative_vars () { - # We need to load the full set of busybox provides from the /etc/busybox.links - # Use this to see the update-alternatives with the right information - - dvar = d.getVar('D', True) - pn = d.getVar('PN', True) - - def create_sh_alternative_vars(links, target, mode): - import shutil - # Create sh wrapper template - fwp = open("busybox_wrapper", 'w') - fwp.write("#!%s" % (target)) - os.fchmod(fwp.fileno(), mode) - fwp.close() - # Install the sh wrappers and alternatives reset to link to them - wpdir = os.path.join(d.getVar('libdir', True), pn) - wpdir_dest = '%s%s' % (dvar, wpdir) - if not os.path.exists(wpdir_dest): - os.makedirs(wpdir_dest) - f = open('%s%s' % (dvar, links), 'r') - for alt_link_name in f: - alt_link_name = alt_link_name.strip() - alt_name = os.path.basename(alt_link_name) - # Copy script wrapper to wp_path - alt_wppath = '%s%s' % (wpdir, alt_link_name) - alt_wppath_dest = '%s%s' % (wpdir_dest, alt_link_name) - alt_wpdir_dest = os.path.dirname(alt_wppath_dest) - if not os.path.exists(alt_wpdir_dest): - os.makedirs(alt_wpdir_dest) - shutil.copy2("busybox_wrapper", alt_wppath_dest) - # Re-set alternatives - # Match coreutils - if alt_name == '[': - alt_name = 'lbracket' - d.appendVar('ALTERNATIVE_%s' % (pn), ' ' + alt_name) - d.setVarFlag('ALTERNATIVE_LINK_NAME', alt_name, alt_link_name) - if os.path.exists(alt_wppath_dest): - d.setVarFlag('ALTERNATIVE_TARGET', alt_name, alt_wppath) - f.close() - - os.remove("busybox_wrapper") - return - - if os.path.exists('%s/etc/busybox.links' % (dvar)): - create_sh_alternative_vars("/etc/busybox.links", "/bin/busybox", 0o0755) - else: - create_sh_alternative_vars("/etc/busybox.links.nosuid", "/bin/busybox.nosuid", 0o0755) - create_sh_alternative_vars("/etc/busybox.links.suid", "/bin/busybox.suid", 0o4755) -} - -# Add to PACKAGEBUILDPKGD so it could override the alternatives, which are set in -# do_package_prepend() section of busybox_*.bb. -PACKAGEBUILDPKGD_prepend = "create_sh_wrapper_reset_alternative_vars " - -# Use sh wrappers instead of links -pkg_postinst_${PN} () { - # This part of code is dedicated to the on target upgrade problem. - # It's known that if we don't make appropriate symlinks before update-alternatives calls, - # there will be errors indicating missing commands such as 'sed'. - # These symlinks will later be updated by update-alternatives calls. - test -n 2 > /dev/null || alias test='busybox test' - if test "x$D" = "x"; then - # Remove busybox.nosuid if it's a symlink, because this situation indicates - # that we're installing or upgrading to a one-binary busybox. - if test -h /bin/busybox.nosuid; then - rm -f /bin/busybox.nosuid - fi - for suffix in "" ".nosuid" ".suid"; do - if test -e /etc/busybox.links$suffix; then - while read link; do - if test ! -e "$link"; then - # we can use busybox here because even if we are using splitted busybox - # we've made a symlink from /bin/busybox to /bin/busybox.nosuid. - busybox echo "#!/bin/busybox$suffix" > $link - fi - done < /etc/busybox.links$suffix - fi - done - fi -} - +require ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', '${BPN}_selinux.inc', '', d)} diff --git a/recipes-core/busybox/busybox_selinux.inc b/recipes-core/busybox/busybox_selinux.inc new file mode 100644 index 0000000..3f20815 --- /dev/null +++ b/recipes-core/busybox/busybox_selinux.inc @@ -0,0 +1,85 @@ +FILES_${PN} += "${libdir}/${PN}" + +# We should use sh wrappers instead of links so the commands could get correct +# security labels +python create_sh_wrapper_reset_alternative_vars () { + # We need to load the full set of busybox provides from the /etc/busybox.links + # Use this to see the update-alternatives with the right information + + dvar = d.getVar('D', True) + pn = d.getVar('PN', True) + + def create_sh_alternative_vars(links, target, mode): + import shutil + # Create sh wrapper template + fwp = open("busybox_wrapper", 'w') + fwp.write("#!%s" % (target)) + os.fchmod(fwp.fileno(), mode) + fwp.close() + # Install the sh wrappers and alternatives reset to link to them + wpdir = os.path.join(d.getVar('libdir', True), pn) + wpdir_dest = '%s%s' % (dvar, wpdir) + if not os.path.exists(wpdir_dest): + os.makedirs(wpdir_dest) + f = open('%s%s' % (dvar, links), 'r') + for alt_link_name in f: + alt_link_name = alt_link_name.strip() + alt_name = os.path.basename(alt_link_name) + # Copy script wrapper to wp_path + alt_wppath = '%s%s' % (wpdir, alt_link_name) + alt_wppath_dest = '%s%s' % (wpdir_dest, alt_link_name) + alt_wpdir_dest = os.path.dirname(alt_wppath_dest) + if not os.path.exists(alt_wpdir_dest): + os.makedirs(alt_wpdir_dest) + shutil.copy2("busybox_wrapper", alt_wppath_dest) + # Re-set alternatives + # Match coreutils + if alt_name == '[': + alt_name = 'lbracket' + d.appendVar('ALTERNATIVE_%s' % (pn), ' ' + alt_name) + d.setVarFlag('ALTERNATIVE_LINK_NAME', alt_name, alt_link_name) + if os.path.exists(alt_wppath_dest): + d.setVarFlag('ALTERNATIVE_TARGET', alt_name, alt_wppath) + f.close() + + os.remove("busybox_wrapper") + return + + if os.path.exists('%s/etc/busybox.links' % (dvar)): + create_sh_alternative_vars("/etc/busybox.links", "/bin/busybox", 0o0755) + else: + create_sh_alternative_vars("/etc/busybox.links.nosuid", "/bin/busybox.nosuid", 0o0755) + create_sh_alternative_vars("/etc/busybox.links.suid", "/bin/busybox.suid", 0o4755) +} + +# Add to PACKAGEBUILDPKGD so it could override the alternatives, which are set in +# do_package_prepend() section of busybox_*.bb. +PACKAGEBUILDPKGD_prepend = "create_sh_wrapper_reset_alternative_vars " + +# Use sh wrappers instead of links +pkg_postinst_${PN} () { + # This part of code is dedicated to the on target upgrade problem. + # It's known that if we don't make appropriate symlinks before update-alternatives calls, + # there will be errors indicating missing commands such as 'sed'. + # These symlinks will later be updated by update-alternatives calls. + test -n 2 > /dev/null || alias test='busybox test' + if test "x$D" = "x"; then + # Remove busybox.nosuid if it's a symlink, because this situation indicates + # that we're installing or upgrading to a one-binary busybox. + if test -h /bin/busybox.nosuid; then + rm -f /bin/busybox.nosuid + fi + for suffix in "" ".nosuid" ".suid"; do + if test -e /etc/busybox.links$suffix; then + while read link; do + if test ! -e "$link"; then + # we can use busybox here because even if we are using splitted busybox + # we've made a symlink from /bin/busybox to /bin/busybox.nosuid. + busybox echo "#!/bin/busybox$suffix" > $link + fi + done < /etc/busybox.links$suffix + fi + done + fi +} + diff --git a/recipes-core/coreutils/coreutils_%.bbappend b/recipes-core/coreutils/coreutils_%.bbappend index c1e8ed6..7b9a2dc 100644 --- a/recipes-core/coreutils/coreutils_%.bbappend +++ b/recipes-core/coreutils/coreutils_%.bbappend @@ -1 +1,2 @@ -inherit with-selinux +inherit ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'with-selinux', '', d)} + diff --git a/recipes-core/dbus/dbus_%.bbappend b/recipes-core/dbus/dbus_%.bbappend index 8c11cac..ee221e2 100644 --- a/recipes-core/dbus/dbus_%.bbappend +++ b/recipes-core/dbus/dbus_%.bbappend @@ -1 +1,2 @@ -inherit enable-selinux +inherit ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'enable-selinux', '', d)} + diff --git a/recipes-core/eudev/eudev/init b/recipes-core/eudev/eudev/init deleted file mode 100644 index ee64f86..0000000 --- a/recipes-core/eudev/eudev/init +++ /dev/null @@ -1,143 +0,0 @@ -#!/bin/sh - -### BEGIN INIT INFO -# Provides: udev -# Required-Start: mountvirtfs -# Required-Stop: -# Default-Start: S -# Default-Stop: -# Short-Description: Start udevd, populate /dev and load drivers. -### END INIT INFO - -export TZ=/etc/localtime - -[ -d /sys/class ] || exit 1 -[ -r /proc/mounts ] || exit 1 -[ -x @UDEVD@ ] || exit 1 -if [ "$use_udev_cache" != "" ]; then - [ -f /etc/default/udev-cache ] && . /etc/default/udev-cache -fi -[ -f /etc/udev/udev.conf ] && . /etc/udev/udev.conf -[ -f /etc/default/rcS ] && . /etc/default/rcS - -readfiles () { - READDATA="" - for filename in $@; do - if [ -r $filename ]; then - while read line; do - READDATA="$READDATA$line" - done < $filename - fi - done -} - -kill_udevd () { - pid=`pidof -x udevd` - [ -n "$pid" ] && kill $pid -} - -case "$1" in - start) - export ACTION=add - # propagate /dev from /sys - echo "Starting udev" - - # Check for requireed devtmpfs before trying to start udev and - # mount a no-existant fs. - if ! grep -q devtmpfs /proc/filesystems - then - echo "Missing devtmpfs, which is required for udev to run"; - echo "Halting..." - halt - fi - # mount the devtmpfs on /dev, if not already done - LANG=C awk '$2 == "/dev" && ($3 == "devtmpfs") { exit 1 }' /proc/mounts && { - mount -n -o mode=0755 -t devtmpfs none "/dev" - } - [ -e /dev/pts ] || mkdir -m 0755 /dev/pts - [ -e /dev/shm ] || mkdir -m 1777 /dev/shm - # the automount rule for udev needs /tmp directory available, as /tmp is a symlink - # to /var/tmp which in turn is a symlink to /var/volatile/tmp, we need to make sure - # /var/volatile/tmp directory to be available. - mkdir -p /var/volatile/tmp - - # restorecon /run early to allow mdadm creating dir /run/mdadm - test ! -x /sbin/restorecon || /sbin/restorecon -F /run - - # Cache handling. - # A list of files which are used as a criteria to judge whether the udev cache could be reused. - CMP_FILE_LIST="/proc/version /proc/cmdline /proc/devices /proc/atags" - if [ "$use_udev_cache" != "" ]; then - if [ "$DEVCACHE" != "" ]; then - if [ -e $DEVCACHE ]; then - readfiles $CMP_FILE_LIST - NEWDATA="$READDATA" - readfiles /etc/udev/cache.data - OLDDATA="$READDATA" - if [ "$OLDDATA" = "$NEWDATA" ]; then - tar --directory=/ -xf $DEVCACHE > /dev/null 2>&1 - not_first_boot=1 - [ "$VERBOSE" != "no" ] && echo "udev: using cache file $DEVCACHE" - [ -e /dev/shm/udev.cache ] && rm -f /dev/shm/udev.cache - else - # Output detailed reason why the cached /dev is not used - if [ "$VERBOSE" != "no" ]; then - echo "udev: udev cache not used" - echo "udev: we use $CMP_FILE_LIST as criteria to judge whether the cache /dev could be resued" - echo "udev: olddata: $OLDDATA" - echo "udev: newdata: $NEWDATA" - fi - echo "$NEWDATA" > /dev/shm/udev.cache - fi - else - if [ "$ROOTFS_READ_ONLY" != "yes" ]; then - # If rootfs is not read-only, it's possible that a new udev cache would be generated; - # otherwise, we do not bother to read files. - readfiles $CMP_FILE_LIST - echo "$READDATA" > /dev/shm/udev.cache - fi - fi - fi - fi - - # make_extra_nodes - kill_udevd > "/dev/null" 2>&1 - - # trigger the sorted events - echo -e '\000\000\000\000' > /proc/sys/kernel/hotplug - @UDEVD@ -d - - udevadm control --env=STARTUP=1 - if [ "$not_first_boot" != "" ];then - udevadm trigger --action=add --subsystem-nomatch=tty --subsystem-nomatch=mem --subsystem-nomatch=vc --subsystem-nomatch=vtconsole --subsystem-nomatch=misc --subsystem-nomatch=dcon --subsystem-nomatch=pci_bus --subsystem-nomatch=graphics --subsystem-nomatch=backlight --subsystem-nomatch=video4linux --subsystem-nomatch=platform - (udevadm settle --timeout=10; udevadm control --env=STARTUP=)& - else - udevadm trigger --action=add - udevadm settle - fi - - test ! -x /sbin/restorecon || /sbin/restorecon -F /dev /dev/shm /dev/pts - - ;; - stop) - echo "Stopping udevd" - start-stop-daemon --stop --name udevd --quiet - ;; - restart) - $0 stop - sleep 1 - $0 start - ;; - status) - pid=`pidof -x udevd` - if [ -n "$pid" ]; then - echo "udevd (pid $pid) is running ..." - else - echo "udevd is stopped" - fi - ;; - *) - echo "Usage: $0 {start|stop|status|restart}" - exit 1 -esac -exit 0 diff --git a/recipes-core/eudev/eudev/udev-cache b/recipes-core/eudev/eudev/udev-cache deleted file mode 100644 index 6898577..0000000 --- a/recipes-core/eudev/eudev/udev-cache +++ /dev/null @@ -1,32 +0,0 @@ -#!/bin/sh -e - -### BEGIN INIT INFO -# Provides: udev-cache -# Required-Start: mountall -# Required-Stop: -# Default-Start: S -# Default-Stop: -# Short-Description: cache /dev to speedup the udev next boot -### END INIT INFO - -export TZ=/etc/localtime - -[ -r /proc/mounts ] || exit 1 -[ -x @UDEVD@ ] || exit 1 -[ -d /sys/class ] || exit 1 - -[ -f /etc/default/rcS ] && . /etc/default/rcS -[ -f /etc/default/udev-cache ] && . /etc/default/udev-cache - -if [ "$ROOTFS_READ_ONLY" = "yes" ]; then - [ "$VERBOSE" != "no" ] && echo "udev-cache: read-only rootfs, skip generating udev-cache" - exit 0 -fi - -if [ "$DEVCACHE" != "" -a -e /dev/shm/udev.cache ]; then - echo "Populating dev cache" - tar --directory=/ --selinux --xattrs -cf "$DEVCACHE" dev - mv /dev/shm/udev.cache /etc/udev/cache.data -fi - -exit 0 diff --git a/recipes-core/eudev/eudev_%.bbappend b/recipes-core/eudev/eudev_%.bbappend index e1e7cd1..b0b03ec 100644 --- a/recipes-core/eudev/eudev_%.bbappend +++ b/recipes-core/eudev/eudev_%.bbappend @@ -1,3 +1,2 @@ -FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:" +require ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', '${BPN}_selinux.inc', '', d)} -inherit enable-selinux diff --git a/recipes-core/eudev/eudev_selinux.inc b/recipes-core/eudev/eudev_selinux.inc new file mode 100644 index 0000000..2ad6b13 --- /dev/null +++ b/recipes-core/eudev/eudev_selinux.inc @@ -0,0 +1,3 @@ +FILESEXTRAPATHS_prepend := "${THISDIR}/files:" + +inherit enable-selinux diff --git a/recipes-core/eudev/files/init b/recipes-core/eudev/files/init new file mode 100644 index 0000000..ee64f86 --- /dev/null +++ b/recipes-core/eudev/files/init @@ -0,0 +1,143 @@ +#!/bin/sh + +### BEGIN INIT INFO +# Provides: udev +# Required-Start: mountvirtfs +# Required-Stop: +# Default-Start: S +# Default-Stop: +# Short-Description: Start udevd, populate /dev and load drivers. +### END INIT INFO + +export TZ=/etc/localtime + +[ -d /sys/class ] || exit 1 +[ -r /proc/mounts ] || exit 1 +[ -x @UDEVD@ ] || exit 1 +if [ "$use_udev_cache" != "" ]; then + [ -f /etc/default/udev-cache ] && . /etc/default/udev-cache +fi +[ -f /etc/udev/udev.conf ] && . /etc/udev/udev.conf +[ -f /etc/default/rcS ] && . /etc/default/rcS + +readfiles () { + READDATA="" + for filename in $@; do + if [ -r $filename ]; then + while read line; do + READDATA="$READDATA$line" + done < $filename + fi + done +} + +kill_udevd () { + pid=`pidof -x udevd` + [ -n "$pid" ] && kill $pid +} + +case "$1" in + start) + export ACTION=add + # propagate /dev from /sys + echo "Starting udev" + + # Check for requireed devtmpfs before trying to start udev and + # mount a no-existant fs. + if ! grep -q devtmpfs /proc/filesystems + then + echo "Missing devtmpfs, which is required for udev to run"; + echo "Halting..." + halt + fi + # mount the devtmpfs on /dev, if not already done + LANG=C awk '$2 == "/dev" && ($3 == "devtmpfs") { exit 1 }' /proc/mounts && { + mount -n -o mode=0755 -t devtmpfs none "/dev" + } + [ -e /dev/pts ] || mkdir -m 0755 /dev/pts + [ -e /dev/shm ] || mkdir -m 1777 /dev/shm + # the automount rule for udev needs /tmp directory available, as /tmp is a symlink + # to /var/tmp which in turn is a symlink to /var/volatile/tmp, we need to make sure + # /var/volatile/tmp directory to be available. + mkdir -p /var/volatile/tmp + + # restorecon /run early to allow mdadm creating dir /run/mdadm + test ! -x /sbin/restorecon || /sbin/restorecon -F /run + + # Cache handling. + # A list of files which are used as a criteria to judge whether the udev cache could be reused. + CMP_FILE_LIST="/proc/version /proc/cmdline /proc/devices /proc/atags" + if [ "$use_udev_cache" != "" ]; then + if [ "$DEVCACHE" != "" ]; then + if [ -e $DEVCACHE ]; then + readfiles $CMP_FILE_LIST + NEWDATA="$READDATA" + readfiles /etc/udev/cache.data + OLDDATA="$READDATA" + if [ "$OLDDATA" = "$NEWDATA" ]; then + tar --directory=/ -xf $DEVCACHE > /dev/null 2>&1 + not_first_boot=1 + [ "$VERBOSE" != "no" ] && echo "udev: using cache file $DEVCACHE" + [ -e /dev/shm/udev.cache ] && rm -f /dev/shm/udev.cache + else + # Output detailed reason why the cached /dev is not used + if [ "$VERBOSE" != "no" ]; then + echo "udev: udev cache not used" + echo "udev: we use $CMP_FILE_LIST as criteria to judge whether the cache /dev could be resued" + echo "udev: olddata: $OLDDATA" + echo "udev: newdata: $NEWDATA" + fi + echo "$NEWDATA" > /dev/shm/udev.cache + fi + else + if [ "$ROOTFS_READ_ONLY" != "yes" ]; then + # If rootfs is not read-only, it's possible that a new udev cache would be generated; + # otherwise, we do not bother to read files. + readfiles $CMP_FILE_LIST + echo "$READDATA" > /dev/shm/udev.cache + fi + fi + fi + fi + + # make_extra_nodes + kill_udevd > "/dev/null" 2>&1 + + # trigger the sorted events + echo -e '\000\000\000\000' > /proc/sys/kernel/hotplug + @UDEVD@ -d + + udevadm control --env=STARTUP=1 + if [ "$not_first_boot" != "" ];then + udevadm trigger --action=add --subsystem-nomatch=tty --subsystem-nomatch=mem --subsystem-nomatch=vc --subsystem-nomatch=vtconsole --subsystem-nomatch=misc --subsystem-nomatch=dcon --subsystem-nomatch=pci_bus --subsystem-nomatch=graphics --subsystem-nomatch=backlight --subsystem-nomatch=video4linux --subsystem-nomatch=platform + (udevadm settle --timeout=10; udevadm control --env=STARTUP=)& + else + udevadm trigger --action=add + udevadm settle + fi + + test ! -x /sbin/restorecon || /sbin/restorecon -F /dev /dev/shm /dev/pts + + ;; + stop) + echo "Stopping udevd" + start-stop-daemon --stop --name udevd --quiet + ;; + restart) + $0 stop + sleep 1 + $0 start + ;; + status) + pid=`pidof -x udevd` + if [ -n "$pid" ]; then + echo "udevd (pid $pid) is running ..." + else + echo "udevd is stopped" + fi + ;; + *) + echo "Usage: $0 {start|stop|status|restart}" + exit 1 +esac +exit 0 diff --git a/recipes-core/eudev/files/udev-cache b/recipes-core/eudev/files/udev-cache new file mode 100644 index 0000000..6898577 --- /dev/null +++ b/recipes-core/eudev/files/udev-cache @@ -0,0 +1,32 @@ +#!/bin/sh -e + +### BEGIN INIT INFO +# Provides: udev-cache +# Required-Start: mountall +# Required-Stop: +# Default-Start: S +# Default-Stop: +# Short-Description: cache /dev to speedup the udev next boot +### END INIT INFO + +export TZ=/etc/localtime + +[ -r /proc/mounts ] || exit 1 +[ -x @UDEVD@ ] || exit 1 +[ -d /sys/class ] || exit 1 + +[ -f /etc/default/rcS ] && . /etc/default/rcS +[ -f /etc/default/udev-cache ] && . /etc/default/udev-cache + +if [ "$ROOTFS_READ_ONLY" = "yes" ]; then + [ "$VERBOSE" != "no" ] && echo "udev-cache: read-only rootfs, skip generating udev-cache" + exit 0 +fi + +if [ "$DEVCACHE" != "" -a -e /dev/shm/udev.cache ]; then + echo "Populating dev cache" + tar --directory=/ --selinux --xattrs -cf "$DEVCACHE" dev + mv /dev/shm/udev.cache /etc/udev/cache.data +fi + +exit 0 diff --git a/recipes-core/glib-2.0/glib-2.0_%.bbappend b/recipes-core/glib-2.0/glib-2.0_%.bbappend index 8c11cac..74e22b3 100644 --- a/recipes-core/glib-2.0/glib-2.0_%.bbappend +++ b/recipes-core/glib-2.0/glib-2.0_%.bbappend @@ -1 +1 @@ -inherit enable-selinux +inherit ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'enable-selinux', '', d)} diff --git a/recipes-core/initscripts/files/devpts.sh b/recipes-core/initscripts/files/devpts.sh new file mode 100755 index 0000000..a0b037f --- /dev/null +++ b/recipes-core/initscripts/files/devpts.sh @@ -0,0 +1,29 @@ +#!/bin/sh +### BEGIN INIT INFO +# Provides: devpts +# Required-Start: udev +# Required-Stop: +# Default-Start: S +# Default-Stop: +# Short-Description: Mount /dev/pts file systems. +### END INIT INFO + +. /etc/default/devpts + +if grep -q devpts /proc/filesystems +then + # + # Create multiplexor device. + # + test -c /dev/ptmx || mknod -m 666 /dev/ptmx c 5 2 + + # + # Mount /dev/pts if needed. + # + if ! grep -q devpts /proc/mounts + then + mkdir -p /dev/pts + mount -t devpts devpts /dev/pts -ogid=${TTYGRP},mode=${TTYMODE} + test ! -x /sbin/restorecon || /sbin/restorecon -F /dev/pts + fi +fi diff --git a/recipes-core/initscripts/initscripts-1.0_selinux.inc b/recipes-core/initscripts/initscripts-1.0_selinux.inc new file mode 100644 index 0000000..6e8a9b6 --- /dev/null +++ b/recipes-core/initscripts/initscripts-1.0_selinux.inc @@ -0,0 +1,11 @@ +FILESEXTRAPATHS_prepend := "${THISDIR}/files:" + +do_install_append () { + cat <<-EOF >> ${D}${sysconfdir}/init.d/populate-volatile.sh +touch /var/log/lastlog +test ! -x /sbin/restorecon || /sbin/restorecon -iRF /var/volatile/ /var/lib /run \ + /etc/resolv.conf /etc/adjtime +EOF + sed -i '/mount -n -o remount,$rootmode/i\test ! -x /sbin/restorecon || /sbin/restorecon -iRF /run' \ + ${D}${sysconfdir}/init.d/checkroot.sh +} diff --git a/recipes-core/initscripts/initscripts/devpts.sh b/recipes-core/initscripts/initscripts/devpts.sh deleted file mode 100755 index a0b037f..0000000 --- a/recipes-core/initscripts/initscripts/devpts.sh +++ /dev/null @@ -1,29 +0,0 @@ -#!/bin/sh -### BEGIN INIT INFO -# Provides: devpts -# Required-Start: udev -# Required-Stop: -# Default-Start: S -# Default-Stop: -# Short-Description: Mount /dev/pts file systems. -### END INIT INFO - -. /etc/default/devpts - -if grep -q devpts /proc/filesystems -then - # - # Create multiplexor device. - # - test -c /dev/ptmx || mknod -m 666 /dev/ptmx c 5 2 - - # - # Mount /dev/pts if needed. - # - if ! grep -q devpts /proc/mounts - then - mkdir -p /dev/pts - mount -t devpts devpts /dev/pts -ogid=${TTYGRP},mode=${TTYMODE} - test ! -x /sbin/restorecon || /sbin/restorecon -F /dev/pts - fi -fi diff --git a/recipes-core/initscripts/initscripts_1.0.bbappend b/recipes-core/initscripts/initscripts_1.0.bbappend index 0fc7a5e..4f9950b 100644 --- a/recipes-core/initscripts/initscripts_1.0.bbappend +++ b/recipes-core/initscripts/initscripts_1.0.bbappend @@ -1,13 +1 @@ -PR .= ".3" - -FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:" - -do_install_append () { - cat <<-EOF >> ${D}${sysconfdir}/init.d/populate-volatile.sh -touch /var/log/lastlog -test ! -x /sbin/restorecon || /sbin/restorecon -iRF /var/volatile/ /var/lib /run \ - /etc/resolv.conf /etc/adjtime -EOF - sed -i '/mount -n -o remount,$rootmode/i\test ! -x /sbin/restorecon || /sbin/restorecon -iRF /run' \ - ${D}${sysconfdir}/init.d/checkroot.sh -} +require ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'initscripts-1.0_selinux.inc', '', d)} diff --git a/recipes-core/libcgroup/libcgroup_%.bbappend b/recipes-core/libcgroup/libcgroup_%.bbappend index b7e0c5f..7719d3b 100644 --- a/recipes-core/libcgroup/libcgroup_%.bbappend +++ b/recipes-core/libcgroup/libcgroup_%.bbappend @@ -1,12 +1 @@ -PR .= ".3" - -EXTRA_OECONF_virtclass-native = "--enable-pam=no" - -do_install_append() { - test ! -f ${D}${base_libdir}/security/pam_cgroup.so.0.0.0 || { - mv -f ${D}${base_libdir}/security/pam_cgroup.so.0.0.0 ${D}${base_libdir}/security/pam_cgroup.so - rm -f ${D}${base_libdir}/security/pam_cgroup.so.* - } -} - -BBCLASSEXTEND = "native" +require ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', '${BPN}_selinux.inc', '', d)} diff --git a/recipes-core/libcgroup/libcgroup_selinux.inc b/recipes-core/libcgroup/libcgroup_selinux.inc new file mode 100644 index 0000000..f81188f --- /dev/null +++ b/recipes-core/libcgroup/libcgroup_selinux.inc @@ -0,0 +1,10 @@ +EXTRA_OECONF_virtclass-native = "--enable-pam=no" + +do_install_append() { + test ! -f ${D}${base_libdir}/security/pam_cgroup.so.0.0.0 || { + mv -f ${D}${base_libdir}/security/pam_cgroup.so.0.0.0 ${D}${base_libdir}/security/pam_cgroup.so + rm -f ${D}${base_libdir}/security/pam_cgroup.so.* + } +} + +BBCLASSEXTEND = "native" diff --git a/recipes-core/systemd/systemd_%.bbappend b/recipes-core/systemd/systemd_%.bbappend index f1bdaf8..5ac3adb 100644 --- a/recipes-core/systemd/systemd_%.bbappend +++ b/recipes-core/systemd/systemd_%.bbappend @@ -1 +1 @@ -inherit enable-audit +inherit ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'enable-audit', '', d)} diff --git a/recipes-core/sysvinit/files/sysvinit-fix-is_selinux_enabled.patch b/recipes-core/sysvinit/files/sysvinit-fix-is_selinux_enabled.patch new file mode 100644 index 0000000..62703b1 --- /dev/null +++ b/recipes-core/sysvinit/files/sysvinit-fix-is_selinux_enabled.patch @@ -0,0 +1,71 @@ +From 0db0276202094c8d902fc93a18eca453b6211f8a Mon Sep 17 00:00:00 2001 +From: Xin Ouyang +Date: Thu, 12 Apr 2012 10:48:04 +0800 +Subject: [PATCH] sysvinit: Fix is_selinux_enabled() for libselinux + +is_selinux_enabled()!=1 means SELinux is disabled by kernel +or SELinux is enabled but policy is not loaded. +Only at this time, /sbin/init program should call +selinux_init_load_policy() to detect whether SELinux is enabled +and to load SELinux policy. + +This is fixed already in the upstream sysvinit, +http://svn.savannah.nongnu.org/viewvc/sysvinit/trunk/src/init.c?root=sysvinit&r1=72&r2=90 +--- + src/init.c | 33 +++++++++++++-------------------- + 1 files changed, 13 insertions(+), 20 deletions(-) + +diff --git a/src/init.c b/src/init.c +index 27532ad..75ccf25 100644 +--- a/src/init.c ++++ b/src/init.c +@@ -54,10 +54,6 @@ + + #ifdef WITH_SELINUX + # include +-# include +-# ifndef MNT_DETACH /* present in glibc 2.10, missing in 2.7 */ +-# define MNT_DETACH 2 +-# endif + #endif + + #ifdef __i386__ +@@ -2869,22 +2865,19 @@ int main(int argc, char **argv) + + #ifdef WITH_SELINUX + if (getenv("SELINUX_INIT") == NULL) { +- const int rc = mount("proc", "/proc", "proc", 0, 0); +- if (is_selinux_enabled() > 0) { +- putenv("SELINUX_INIT=YES"); +- if (rc == 0) umount2("/proc", MNT_DETACH); +- if (selinux_init_load_policy(&enforce) == 0) { +- execv(myname, argv); +- } else { +- if (enforce > 0) { +- /* SELinux in enforcing mode but load_policy failed */ +- /* At this point, we probably can't open /dev/console, so log() won't work */ +- fprintf(stderr,"Unable to load SELinux Policy. Machine is in enforcing mode. Halting now.\n"); +- exit(1); +- } +- } +- } +- if (rc == 0) umount2("/proc", MNT_DETACH); ++ if (is_selinux_enabled() != 1) { ++ if (selinux_init_load_policy(&enforce) == 0) { ++ putenv("SELINUX_INIT=YES"); ++ execv(myname, argv); ++ } else { ++ if (enforce > 0) { ++ /* SELinux in enforcing mode but load_policy failed */ ++ /* At this point, we probably can't open /dev/console, so log() won't work */ ++ fprintf(stderr,"Unable to load SELinux Policy. Machine is in enforcing mode. Halting now.\n"); ++ exit(1); ++ } ++ } ++ } + } + #endif + /* Start booting. */ +-- +1.7.5.4 + diff --git a/recipes-core/sysvinit/sysvinit-2.88dsf/sysvinit-fix-is_selinux_enabled.patch b/recipes-core/sysvinit/sysvinit-2.88dsf/sysvinit-fix-is_selinux_enabled.patch deleted file mode 100644 index 62703b1..0000000 --- a/recipes-core/sysvinit/sysvinit-2.88dsf/sysvinit-fix-is_selinux_enabled.patch +++ /dev/null @@ -1,71 +0,0 @@ -From 0db0276202094c8d902fc93a18eca453b6211f8a Mon Sep 17 00:00:00 2001 -From: Xin Ouyang -Date: Thu, 12 Apr 2012 10:48:04 +0800 -Subject: [PATCH] sysvinit: Fix is_selinux_enabled() for libselinux - -is_selinux_enabled()!=1 means SELinux is disabled by kernel -or SELinux is enabled but policy is not loaded. -Only at this time, /sbin/init program should call -selinux_init_load_policy() to detect whether SELinux is enabled -and to load SELinux policy. - -This is fixed already in the upstream sysvinit, -http://svn.savannah.nongnu.org/viewvc/sysvinit/trunk/src/init.c?root=sysvinit&r1=72&r2=90 ---- - src/init.c | 33 +++++++++++++-------------------- - 1 files changed, 13 insertions(+), 20 deletions(-) - -diff --git a/src/init.c b/src/init.c -index 27532ad..75ccf25 100644 ---- a/src/init.c -+++ b/src/init.c -@@ -54,10 +54,6 @@ - - #ifdef WITH_SELINUX - # include --# include --# ifndef MNT_DETACH /* present in glibc 2.10, missing in 2.7 */ --# define MNT_DETACH 2 --# endif - #endif - - #ifdef __i386__ -@@ -2869,22 +2865,19 @@ int main(int argc, char **argv) - - #ifdef WITH_SELINUX - if (getenv("SELINUX_INIT") == NULL) { -- const int rc = mount("proc", "/proc", "proc", 0, 0); -- if (is_selinux_enabled() > 0) { -- putenv("SELINUX_INIT=YES"); -- if (rc == 0) umount2("/proc", MNT_DETACH); -- if (selinux_init_load_policy(&enforce) == 0) { -- execv(myname, argv); -- } else { -- if (enforce > 0) { -- /* SELinux in enforcing mode but load_policy failed */ -- /* At this point, we probably can't open /dev/console, so log() won't work */ -- fprintf(stderr,"Unable to load SELinux Policy. Machine is in enforcing mode. Halting now.\n"); -- exit(1); -- } -- } -- } -- if (rc == 0) umount2("/proc", MNT_DETACH); -+ if (is_selinux_enabled() != 1) { -+ if (selinux_init_load_policy(&enforce) == 0) { -+ putenv("SELINUX_INIT=YES"); -+ execv(myname, argv); -+ } else { -+ if (enforce > 0) { -+ /* SELinux in enforcing mode but load_policy failed */ -+ /* At this point, we probably can't open /dev/console, so log() won't work */ -+ fprintf(stderr,"Unable to load SELinux Policy. Machine is in enforcing mode. Halting now.\n"); -+ exit(1); -+ } -+ } -+ } - } - #endif - /* Start booting. */ --- -1.7.5.4 - diff --git a/recipes-core/sysvinit/sysvinit-2.88dsf_selinux.inc b/recipes-core/sysvinit/sysvinit-2.88dsf_selinux.inc new file mode 100644 index 0000000..fcfbdb7 --- /dev/null +++ b/recipes-core/sysvinit/sysvinit-2.88dsf_selinux.inc @@ -0,0 +1,11 @@ +FILESEXTRAPATHS_prepend := "${THISDIR}/files:" + +B = "${S}" + +SRC_URI += "file://sysvinit-fix-is_selinux_enabled.patch" + +inherit selinux + +DEPENDS += "${LIBSELINUX}" + +EXTRA_OEMAKE += "${@target_selinux(d, 'WITH_SELINUX=\"yes\"')}" diff --git a/recipes-core/sysvinit/sysvinit_2.88dsf.bbappend b/recipes-core/sysvinit/sysvinit_2.88dsf.bbappend index 636dc5e..9df30b6 100644 --- a/recipes-core/sysvinit/sysvinit_2.88dsf.bbappend +++ b/recipes-core/sysvinit/sysvinit_2.88dsf.bbappend @@ -1,14 +1 @@ -FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}-${PV}:" - -B = "${S}" - -SRC_URI += "file://sysvinit-fix-is_selinux_enabled.patch" - -inherit selinux - -DEPENDS += "${LIBSELINUX}" - -EXTRA_OEMAKE += "${@target_selinux(d, 'WITH_SELINUX=\"yes\"')}" - -PR .= ".2" - +require ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'sysvinit-2.88dsf_selinux.inc', '', d)} diff --git a/recipes-core/util-linux/util-linux_%.bbappend b/recipes-core/util-linux/util-linux_%.bbappend index 7695b77..b01ad25 100644 --- a/recipes-core/util-linux/util-linux_%.bbappend +++ b/recipes-core/util-linux/util-linux_%.bbappend @@ -1,3 +1 @@ -PR .= ".3" - -inherit with-selinux +inherit ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'with-selinux', '', d)} -- cgit v1.2.3-54-g00ecf