smack: Add new package
PATCH 1/2 smack: Add new package
--- recipes-security/smack/files/run-ptest | 3 ++ .../smack/files/smack_generator_make_fixup.patch | 18 ++++++++++ recipes-security/smack/smack_1.3.0.bb | 42 ++++++++++++++++++++++ 3 files changed, 63 insertions(+) create mode 100644 recipes-security/smack/files/run-ptest create mode 100644 recipes-security/smack/files/smack_generator_make_fixup.patch create mode 100644 recipes-security/smack/smack_1.3.0.bb
recipes-security/smack/files/run-ptest new file +3 -0
@@ -0,0 +1,3 @@ +#!/bin/sh +./tests/make_policies.bash ./tests/generator +./tests/make_policies.bash ./tests/generator labels
recipes-security/smack/files/smack_generator_make_fixup.patch new file +18 -0
@@ -0,0 +1,18 @@ +Upstream-Status: Pending + +Signed-off-by: Armin Kuster <[email protected]> + + +Index: git/tests/Makefile +=================================================================== +--- git.orig/tests/Makefile ++++ git/tests/Makefile +@@ -4,7 +4,7 @@ clean: + rm -rf ./out ./generator + + generator: generator.c +- gcc -Wall -O3 generator.c -o ./generator ++ ${CC} generator.c -o ./generator + + policies: ./generator ./make_policies.bash + ./make_policies.bash ./generator
recipes-security/smack/smack_1.3.0.bb new file +42 -0
42 lines not on this page · raw message
Signature · 1 line
2.7.4
PATCH 2/2 smack kernel: add smack kernel config fragments
--- recipes-kernel/linux/linux-yocto-4.8/smack-default-lsm.cfg | 2 ++ recipes-kernel/linux/linux-yocto-4.8/smack.cfg | 8 ++++++++ recipes-kernel/linux/linux-yocto_4.8.bbappend | 5 +++++ 3 files changed, 15 insertions(+) create mode 100644 recipes-kernel/linux/linux-yocto-4.8/smack-default-lsm.cfg create mode 100644 recipes-kernel/linux/linux-yocto-4.8/smack.cfg
recipes-kernel/linux/linux-yocto-4.8/smack-default-lsm.cfg new file +2 -0
@@ -0,0 +1,2 @@ +CONFIG_DEFAULT_SECURITY="smack" +CONFIG_DEFAULT_SECURITY_SMACK=y
recipes-kernel/linux/linux-yocto-4.8/smack.cfg new file +8 -0
@@ -0,0 +1,8 @@ +CONFIG_IP_NF_SECURITY=m +CONFIG_IP6_NF_SECURITY=m +CONFIG_EXT2_FS_SECURITY=y +CONFIG_EXT3_FS_SECURITY=y +CONFIG_EXT4_FS_SECURITY=y +CONFIG_SECURITY=y +CONFIG_SECURITY_SMACK=y +CONFIG_TMPFS_XATTR=y
recipes-kernel/linux/linux-yocto_4.8.bbappend +5 -0
@@ -5,3 +5,8 @@ SRC_URI += "\ ${@bb.utils.contains('DISTRO_FEATURES', 'tpm', ' file://tpm.cfg', '', d)} \ ${@bb.utils.contains('DISTRO_FEATURES', 'tpm', ' file://tpm.scc', '', d)} \ " + +SRC_URI += "\ + ${@bb.utils.contains('DISTRO_FEATURES', 'smack', ' file://smack.cfg', '', d)} \ + ${@bb.utils.contains('DISTRO_FEATURES', 'smack', ' file://smack-default-lsm.cfg', '', d)} \ +"
Signature · 1 line
2.7.4
Re: [meta-security][PATCH 2/2] smack kernel: add smack kernel config fragments
Quoted 23 lines · Armin Kuster
Signed-off-by Armin Kuster <[email protected]>--- recipes-kernel/linux/linux-yocto-4.8/smack-default-lsm.cfg | 2 ++ recipes-kernel/linux/linux-yocto-4.8/smack.cfg | 8 ++++++++ recipes-kernel/linux/linux-yocto_4.8.bbappend | 5 +++++ 3 files changed, 15 insertions(+) create mode 100644 recipes-kernel/linux/linux-yocto-4.8/smack-default-lsm.cfg create mode 100644 recipes-kernel/linux/linux-yocto-4.8/smack.cfgrecipes-kernel/linux/linux-yocto-4.8/smack-default-lsm.cfg new file +2
-0@@ -0,0 +1,2 @@ +CONFIG_DEFAULT_SECURITY="smack" +CONFIG_DEFAULT_SECURITY_SMACK=yrecipes-kernel/linux/linux-yocto-4.8/smack.cfg new file +0
-0
recipes-kernel/linux/linux-yocto-4.8/smack.cfg line 8
Quoted 8 lines
recipes-kernel/linux/linux-yocto-4.8/smack.cfg new file +8
-0@@ -0,0 +1,8 @@ +CONFIG_IP_NF_SECURITY=m +CONFIG_IP6_NF_SECURITY=m +CONFIG_EXT2_FS_SECURITY=y +CONFIG_EXT3_FS_SECURITY=y +CONFIG_EXT4_FS_SECURITY=y +CONFIG_SECURITY=y +CONFIG_SECURITY_SMACK=y +CONFIG_TMPFS_XATTR=y
Were these two files perhaps copied from
https://github.com/01org/meta-intel-iot-security/tree/master/meta-security-smack/recipes-kernel/linux/linux ?
Just wondering, they look, hmm, very familiar ;-)
Can you say a bit more about your plans regarding Smack support in meta-security? A recipe for the userspace tool and the kernel config is a start, but for a fully functional Smack-enabled image, the rootfs also needs to be set up a bit differently.
I can imagine that it would be worthwhile to take more of the things done in meta-intel-iot-security and then deprecate that layer.
Signature · 6 lines
Best Regards, Patrick Ohly The content of this message is my personal opinion only and although I am an employee of Intel, the statements I make here in no way represent Intel's position on the issue, nor am I authorized to speak on behalf of Intel on this matter.
Re: [meta-security][PATCH 2/2] smack kernel: add smack kernel config fragments
Quoted 39 lines · Patrick Ohly
Quoted 23 lines · Armin Kuster
Signed-off-by Armin Kuster <[email protected]>---
recipes-kernel/linux/linux-yocto-4.8/smack-default-lsm.cfg | 2 ++ recipes-kernel/linux/linux-yocto-4.8/smack.cfg | 8 ++++++++ recipes-kernel/linux/linux-yocto_4.8.bbappend | 5 +++++ 3 files changed, 15 insertions(+)create mode 100644 recipes-kernel/linux/linux-yocto-4.8/smack-default-lsm.cfg create mode 100644 recipes-kernel/linux/linux-yocto-4.8/smack.cfg
recipes-kernel/linux/linux-yocto-4.8/smack-default-lsm.cfg new file +2
-0@@ -0,0 +1,2 @@ +CONFIG_DEFAULT_SECURITY="smack" +CONFIG_DEFAULT_SECURITY_SMACK=yrecipes-kernel/linux/linux-yocto-4.8/smack.cfg new file +0
-0recipes-kernel/linux/linux-yocto-4.8/smack.cfg line 8
Quoted 8 lines
recipes-kernel/linux/linux-yocto-4.8/smack.cfg new file +8
-0@@ -0,0 +1,8 @@ +CONFIG_IP_NF_SECURITY=m +CONFIG_IP6_NF_SECURITY=m +CONFIG_EXT2_FS_SECURITY=y +CONFIG_EXT3_FS_SECURITY=y +CONFIG_EXT4_FS_SECURITY=y +CONFIG_SECURITY=y +CONFIG_SECURITY_SMACK=y +CONFIG_TMPFS_XATTR=yWere these two files perhaps copied from
https://github.com/01org/meta-intel-iot-security/tree/master/meta-security-smack/recipes-kernel/linux/linux ?
Quoted 6 lines
Just wondering, they look, hmm, very familiar ;-)
Can you say a bit more about your plans regarding Smack support in meta-security? A recipe for the userspace tool and the kernel config is a start, but for a fully functional Smack-enabled image, the rootfs also needs to be set up a bit differently.
FWIW meta-security seems to be right place for smack related infra.
Quoted 19 lines
I can imagine that it would be worthwhile to take more of the things done in meta-intel-iot-security and then deprecate that layer.
--
Best Regards, Patrick OhlyThe content of this message is my personal opinion only and although I am an employee of Intel, the statements I make here in no way represent Intel's position on the issue, nor am I authorized to speak on behalf of Intel on this matter.
--
_______________________________________________
yocto mailing list
[email protected]
https://lists.yoctoproject.org/listinfo/yocto
Re: [meta-security][PATCH 2/2] smack kernel: add smack kernel config fragments
Quoted 7 lines · Khem Raj
Quoted 5 lines · Patrick Ohly
Can you say a bit more about your plans regarding Smack support in meta-security? A recipe for the userspace tool and the kernel config is a start, but for a fully functional Smack-enabled image, the rootfs also needs to be set up a bit differently.
FWIW meta-security seems to be right place for smack related infra.
I don't disagree :-) But it would be good to know more about the rest of the infrastructure before adding (or reviewing) bits and pieces that by themselves don't do much.
Signature · 6 lines
Best Regards, Patrick Ohly The content of this message is my personal opinion only and although I am an employee of Intel, the statements I make here in no way represent Intel's position on the issue, nor am I authorized to speak on behalf of Intel on this matter.
Re: [meta-security][PATCH 2/2] smack kernel: add smack kernel config fragments
Quoted 10 lines · Patrick Ohly
Quoted 6 lines · Khem Raj
Quoted 5 lines · Patrick Ohly
Can you say a bit more about your plans regarding Smack support in meta-security? A recipe for the userspace tool and the kernel config is a start, but for a fully functional Smack-enabled image, the rootfs also needs to be set up a bit differently.
FWIW meta-security seems to be right place for smack related infra.
I don't disagree :-) But it would be good to know more about the rest of the infrastructure before adding (or reviewing) bits and pieces that by themselves don't do much.
I start of with basic support and refine over time. Your statement can apply for many components within meta-secuirty. I recently started adding test images. Providing configurations or solutions for a niche area is outside the scope for this general layer, IMHO. I could be convinced otherwise. I tend not to wait for 100% solution before sending out bits for review.
thanks for your input.
Regards,
Armin
Quoted 1 line
Re: [meta-security][PATCH 2/2] smack kernel: add smack kernel config fragments
Quoted 12 lines · On Oct 28, 2016, at 8:41 AM, akuster808 <[email protected]> wrote:
Quoted 6 lines · Patrick Ohly
Quoted 5 lines · Khem Raj
Quoted 5 lines · Patrick Ohly
Can you say a bit more about your plans regarding Smack support in meta-security? A recipe for the userspace tool and the kernel config is a start, but for a fully functional Smack-enabled image, the rootfs also needs to be set up a bit differently.
Quoted 5 lines
Quoted 4 lines
Quoted 1 line
FWIW meta-security seems to be right place for smack related infra.
I don't disagree :-) But it would be good to know more about the rest of the infrastructure before adding (or reviewing) bits and pieces that by themselves don't do much.
I start of with basic support and refine over time. Your statement can apply for many components within meta-secuirty. I recently started adding test images. Providing configurations or solutions for a niche area is outside the scope for this general layer, IMHO. I could be convinced otherwise. I tend not to wait for 100% solution before sending out bits for review.
its a good start. If you have some more patches on the way to complete the solution, that would be good to share.
Quoted 7 lines
thanks for your input.
Regards,
ArminQuoted 1 line
Quoted 33 lines · Armin Kuster
Signed-off-by Armin Kuster <[email protected]>---
recipes-security/smack/files/run-ptest | 3 ++ .../smack/files/smack_generator_make_fixup.patch | 18 ++++++++++ recipes-security/smack/smack_1.3.0.bb | 42 ++++++++++++++++++++++ 3 files changed, 63 insertions(+)create mode 100644 recipes-security/smack/files/run-ptest
create mode 100644recipes-security/smack/files/smack_generator_make_fixup.patchcreate mode 100644 recipes-security/smack/smack_1.3.0.bbrecipes-security/smack/files/run-ptest new file +3
-0@@ -0,0 +1,3 @@ +#!/bin/sh +./tests/make_policies.bash ./tests/generator +./tests/make_policies.bash ./tests/generator labelsrecipes-security/smack/files/smack_generator_make_fixup.patch new file +5
-0@@ -0,0 +1,18 @@ +Upstream-Status: Pending + +Signed-off-by: Armin Kuster <[email protected]> + +
recipes-security/smack/files/smack_generator_make_fixup.patch line 15
Quoted 10 lines
recipes-security/smack/files/smack_generator_make_fixup.patch new file +10
-0+Index: git/tests/Makefile +=================================================================== +--- git.orig/tests/Makefile ++++ git/tests/Makefile +@@ -4,7 +4,7 @@ clean: + rm -rf ./out ./generator + + generator: generator.c +- gcc -Wall -O3 generator.c -o ./generator ++ ${CC} generator.c -o ./generator
This should be ${CC} ${LDFLAGS} since you are doing compiling and linking in single step otherwise we may end up with hash-style problems
Quoted 20 lines
recipes-security/smack/files/smack_generator_make_fixup.patch new file +3
-0+ + policies: ./generator ./make_policies.bash + ./make_policies.bash ./generatorrecipes-security/smack/smack_1.3.0.bb new file +11
-0@@ -0,0 +1,42 @@ +DESCRIPTION = "Selection of tools for developers working with Smack" +HOMEPAGE = "https://github.com/smack-team/smack" +SECTION = "Security/Access Control" +LICENSE = "LGPL-2.1" + +LIC_FILES_CHKSUM = "file://COPYING;md5=4fbd65380cdd255951079008b364516c" + +SRCREV = "478f68d182c5070f510482194d3e097b11c21907" +SRC_URI = " \ + git://github.com/smack-team/smack.git;branch=v1.3.x \ + file://smack_generator_make_fixup.patch \
recipes-security/smack/smack_1.3.0.bb line 21
Quoted 10 lines
recipes-security/smack/smack_1.3.0.bb new file +10
-0+ file://run-ptest" + +PV = "1.3.0+git${SRCPV}" + +inherit autotools pkgconfig systemd ptest + +S = "${WORKDIR}/git" + +PACKAGECONFIG ??= "" +PACKAGECONG += "${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'systemd', '', d)}”
^^^^
is this a typo ? and may be it should be _append not +=
Quoted 29 lines
recipes-security/smack/smack_1.3.0.bb new file +21
-1+ +PACKAGECONFIG[systemd] = "--with-systemdsystemunitdir=DIR" +PACKAGECONFIG[systemd] = "--with-systemdsystemunitdir=${systemd_system_unitdir}, --without-systemdsystemunitdir, systemd" + +do_compile_append () { + oe_runmake -C ${S}/tests generator +} + +do_install_ptest () { + install -d ${D}${PTEST_PATH}/tests + install ${S}/tests/generator ${D}/${PTEST_PATH}/tests + install ${S}/tests/generate-rules.sh ${D}${PTEST_PATH}/tests + install ${S}/tests/make_policies.bash ${D}${PTEST_PATH}/tests +} + +FILES_${PN}-ptest += "generator" + +RDEPENDS_${PN} += "coreutils" +RDEPENDS_${PN}-ptest += "make bash bc" + +BBCLASSEXTEND = "native" --2.7.4
--
_______________________________________________
yocto mailing list
[email protected]
https://lists.yoctoproject.org/listinfo/yocto