PATCH 1/2] yocto-kernel: add apparmor fragments

new file mode 100644
index 0000000..1dc4168
@@ -0,0 +1,13 @@
+CONFIG_AUDIT=y
+CONFIG_AUDITSYSCALL=y
+CONFIG_AUDIT_WATCH=y
+CONFIG_AUDIT_TREE=y
+# CONFIG_NETFILTER_XT_TARGET_AUDIT is not set
+CONFIG_SECURITY_PATH=y
+# CONFIG_SECURITY_SELINUX is not set
+CONFIG_SECURITY_APPARMOR=y
+CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE=1
+CONFIG_SECURITY_APPARMOR_HASH=y
+CONFIG_SECURITY_APPARMOR_HASH_DEFAULT=y
+CONFIG_INTEGRITY_AUDIT=y
+# CONFIG_DEFAULT_SECURITY_APPARMOR is not set

index 048e8fd..78d5101 100644
@@ -4,6 +4,7 @@ FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}-4.8:"
 SRC_URI += "\
         ${@bb.utils.contains('DISTRO_FEATURES', 'tpm', ' file://tpm.cfg', '', d)} \
         ${@bb.utils.contains('DISTRO_FEATURES', 'tpm', ' file://tpm.scc', '', d)} \
+        ${@bb.utils.contains('DISTRO_FEATURES', 'apparmor', ' file://apparmor.cfg', '', d)} \
 "
 
 SRC_URI += "\

new file mode 100644
index 0000000..de09e29
@@ -0,0 +1,116 @@
+SUMMARY = "AppArmor another MAC control system"
+DESCRIPTION = "user-space parser utility for AppArmor \
+ This provides the system initialization scripts needed to use the \
+ AppArmor Mandatory Access Control system, including the AppArmor Parser \
+ which is required to convert AppArmor text profiles into machine-readable \
+ policies that are loaded into the kernel for use with the AppArmor Linux \
+ Security Module."
+HOMEAPAGE = "http://apparmor.net/"
+SECTION = "admin"
+
+LICENSE = "GPLv2 & GPLv2+ & BSD-3-Clause & LGPLv2.1+"
+LIC_FILES_CHKSUM = "file://${S}/LICENSE;md5=fd57a4b0bc782d7b80fd431f10bbf9d0"
+
+DEPENDS = "bison-native apr apache2"
+
+SRC_URI = " \
+	http://archive.ubuntu.com/ubuntu/pool/main/a/${BPN}/${BPN}_${PV}.orig.tar.gz \
+	file://disable_pdf.patch \
+	file://apparmor.rc \
+	file://functions \
+	file://apparmor \
+	file://apparmor.service \
+	"
+
+SRC_URI[md5sum] = "71a13b9d6ae0bca4f5375984df1a51e7"
+SRC_URI[sha256sum] = "3f659a599718f4a5e2a33140916715f574a5cb3634a6b9ed6d29f7b0617e4d1a"
+
+PARALLEL_MAKE = ""
+
+inherit pkgconfig autotools-brokensep update-rc.d python-dir ${@bb.utils.contains('VIRTUAL-RUNTIME_init_manager','systemd','systemd','', d)}
+
+S = "${WORKDIR}/apparmor-${PV}"
+
+PACKAGECONFIG ?="man"
+PACKAGECONFIG[man] = "--enable-man-pages, --disable-man-pages"
+
+PAMLIB="${@bb.utils.contains('DISTRO_FEATURES', 'pam', '1', '0', d)}"
+
+do_configure() {
+	cd ${S}/libraries/libapparmor
+	autoconf --force
+	libtoolize --automake -c
+	automake -ac
+	./configure ${CONFIGUREOPTS} ${EXTRA_OECONF}
+	sed -i -e 's#^YACC.*#YACC := bison#' ${S}/parser/Makefile
+	sed -i -e 's#^LEX.*#LEX := flex#' ${S}/parser/Makefile
+}
+
+do_compile () {
+	cd ${S}/libraries/libapparmor
+	oe_runmake
+        cd ${S}/binutils
+        oe_runmake
+        cd ${S}/utils
+        oe_runmake
+	cd ${S}/parser
+        oe_runmake
+	cd ${S}/profiles
+        oe_runmake
+
+ 	cd ${S}/changehat/mod_apparmor
+        oe_runmake
+
+	if test -z "${PAMLIB}" ; then
+		cd ${S}/changehat/pam_apparmor
+        	oe_runmake
+	fi
+}
+
+do_install () {
+	install -d ${D}/${INIT_D_DIR}
+	install -d ${D}/lib/apparmor
+		
+	cd ${S}/libraries/libapparmor
+	oe_runmake DESTDIR="${D}" install
+
+        cd ${S}/binutils
+	oe_runmake DESTDIR="${D}" install
+
+        cd ${S}/utils
+	oe_runmake DESTDIR="${D}" install
+
+	cd ${S}/parser
+	oe_runmake DESTDIR="${D}" install
+
+	cd ${S}/profiles
+	oe_runmake DESTDIR="${D}" install
+
+ 	cd ${S}/changehat/mod_apparmor
+	oe_runmake DESTDIR="${D}" install
+
+	if test -z "${PAMLIB}" ; then
+		cd ${S}/changehat/pam_apparmor
+		oe_runmake DESTDIR="${D}" install
+	fi
+
+	install ${WORKDIR}/apparmor ${D}/${INIT_D_DIR}/apparmor
+
+	install ${WORKDIR}/functions ${D}/lib/apparmor
+}
+
+INITSCRIPT_PACKAGES = "${PN}"
+INITSCRIPT_NAME = "apparmor"
+INITSCRIPT_PARAMS = "start 16 2 3 4 5 . stop 35 0 1 6 ."
+
+SYSTEMD_PACKAGES = "${PN}"
+SYSTEMD_SERVICE_${PN} = "apparmor.service"
+SYSTEMD_AUTO_ENABLE = "disable"
+
+PACKAGES += "python-${PN} mod-${PN}"
+
+FILES_${PN} += "/lib/apparmor/ ${sysconfdir}/apparmor"
+FILES_mod-${PN} = "${libdir}/apache2/modules/*"
+FILES_python-${PN} = "${PYTHON_SITEPACKAGES_DIR}"
+
+RDEPENDS_${PN} += "bash perl"

211 lines not on this page · raw message

98 lines not on this page · raw message

new file mode 100644
index 0000000..e66afe4
@@ -0,0 +1,22 @@
+[Unit]
+Description=AppArmor initialization
+After=local-fs.target
+Before=sysinit.target
+AssertPathIsReadWrite=/sys/kernel/security/apparmor/.load
+ConditionSecurity=apparmor
+DefaultDependencies=no
+Documentation=man:apparmor(7)
+Documentation=http://wiki.apparmor.net/
+
+# Don't start this unit on the Ubuntu Live CD
+ConditionPathExists=!/rofs/etc/apparmor.d
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/etc/init.d/apparmor start
+ExecStop=/etc/init.d/apparmor stop
+ExecReload=/etc/init.d/apparmor reload
+
+[Install]
+WantedBy=sysinit.target

new file mode 100644
index 0000000..c6b4bdd
@@ -0,0 +1,33 @@
+Index: apparmor-2.10.95/parser/Makefile
+===================================================================
+--- apparmor-2.10.95.orig/parser/Makefile
++++ apparmor-2.10.95/parser/Makefile
+@@ -139,17 +139,6 @@ export Q VERBOSE BUILD_OUTPUT
+ po/${NAME}.pot: ${SRCS} ${HDRS}
+ 	$(MAKE) -C po ${NAME}.pot NAME=${NAME} SOURCES="${SRCS} ${HDRS}"
+ 
+-techdoc.pdf: techdoc.tex
+-	timestamp=$(shell date --utc "+%Y%m%d%H%M%S%z" -r $< );\
+-	while pdflatex "\def\fixedpdfdate{$$timestamp}\input $<" ${BUILD_OUTPUT} || exit 1 ; \
+-		grep -q "Label(s) may have changed" techdoc.log; \
+-	do :; done
+-
+-techdoc/index.html: techdoc.pdf
+-	latex2html -show_section_numbers -split 0 -noinfo -nonavigation -noaddress techdoc.tex ${BUILD_OUTPUT}
+-
+-techdoc.txt: techdoc/index.html
+-	w3m -dump $< > $@
+ 
+ # targets arranged this way so that people who don't want full docs can
+ # pick specific targets they want.
+@@ -159,9 +148,7 @@ manpages:	$(MANPAGES)
+ 
+ htmlmanpages:	$(HTMLMANPAGES)
+ 
+-pdf:	techdoc.pdf
+-
+-docs:	manpages htmlmanpages pdf
++docs:	manpages htmlmanpages 
+ 
+ indep: docs
+ 	$(Q)$(MAKE) -C po all

271 lines not on this page · raw message