SELinux Buildroot Additions
v4 cover SELinux Buildroot Additions
### Highlevel updates in v4 of these patches
* sepolgen is reconfigured as solely a host package
* Fixed my kconfig messup in v3
### What's SELinux?
Security-Enhanced Linux (SELinux) is a Linux feature that provides a variety of security policies, including U.S. Department of Defense style mandatory access controls (MAC), through the use of Linux Security Modules (LSM) in the Linux kernel. It is not a Linux distribution, but rather a set of modifications that can be applied to Unix-like operating systems, such as Linux and BSD.
Running SELinux under a Linux distribution requires three things:
An SELinux enabled kernel, SELinux Userspace tools and libraries, and SELinux Policies (mostly based on the Reference Policy). Some common Linux programs will also need to be patched/compiled with SELinux features. (Credit Archlinux wiki)
### What's in this patchset?
This patchset adds the required userspace tools, libraries, example QEMU target, existing package modifications, and initial policy to Buildroot.
The design approach took a minimalist view to the selinux capability. The necessary packages have been added but all the ways in which they could be used (target vs host) are not exposed. One example is the audit2allow framework that requires python. This is currently setup for "host only use" to post analyze audit service output. It could also be setup for target use but it would require the target to have python and other supporting libs present.
Another aspect that utilized known SELinux capable applications was for init and logging. We choose to use sysvinit and rsyslog instead of the busybox applet version. This simplified getting this initial configuration pulled together. Use of busybox applications is definitely an area where things could slim down with more time and testing.
Lastly, the building of libselinux was limited to a set of architectures and libraries that have been tested. An area for future work will be to enable broader use.
Some references to help with the review of this patchset. Arch and Gentoo implementation and design details:
https://wiki.archlinux.org/index.php/SELinux
http://wiki.gentoo.org/wiki/SELinux
http://wiki.gentoo.org/wiki/SELinux/Installation
### Details of changes from previous patchsets
This is a new round of patches based on the v5 patchset from last year. The changes since v5 consist of:
* The removal of on target policy debugging using audit2allow. The host tools have been setup to provide a offline capability for analyzing audit output.
* The example qemu configuration defaults to using full versions of applications instead of the busybox applets. This simplified the configuration but as a side affect grew the filesystem size. There is definitely opportunity to slim down the approach to just using busybox applets (I've still included the patches that enable the capability to create individual applets).
* Added documentation of the qemu target to that targets readme
* Updated for structural changes (OPTS vs OPT, patch naming, improvements to existing packages)
* Autobuilder was modified to run against our upstreaming branch and has has logged a number of builds. There are definitely uclibc issues.
Since Refpolicy is heavily tailored for a projects use, the package exposed options of using the provided version with patches or a custom GIT repo. Here's a bit more detail on those assumptions.
* Refpolicy as the package defines with default patches plus possibly some global patches applied. Using a default modules config file provided in the package folder or provided by the user.
* Refpolicy looking at specific git repo revisions. Using a modules config file from within that git repo.
* Repolicy using src override which assumes the same as the git repo case for where the modules config file originates.
### What's next:
* Testing out support for using busybox applets instead of sysvinit/util-linux/etc.
* Updating the qemu example to use a auto generated busybox config based on package selections and selinux being enabled.
* qemu targets for ARM and PPC
Clayton Shotwell (11):
checkpolicy: new package
sepolgen: new package
python-pyxml: new package
refpolicy: new package qemu_x86_selinux_defconfig: base SELinux QEMU image for x86
Matt Weber (23):
sqlite: Add host build support
setools: new package
python-pyparsing: Add host build option
audit: new package
policycoreutils: new package
repolicy: base policy modifications for embedded target
refpolicy: custom git repo
shadow: new package
busybox: applets as individual binaries
busybox: selinux support
busybox: added linux-pam support
busybox: default selinux config which disables init and uses sysvinit
linux-pam: selinux support
sysvinit: added libselinux dependency
dbus: selinux file context support
logrotate: selinux support
openssh: selinux and pam support
util-linux: selinux, audit, and pam support
vim: selinux support
rsyslog: fix config file comment style
qemu x86 readme: documented selinux target
readline: host support for host-sqlite
libsemanage: cleanup python use and license definition
board/qemu/x86/busybox-selinux.config | 1038 ++++++++++++++ board/qemu/x86/linux-3.12-selinux.config | 77 ++ board/qemu/x86/readme.txt | 20 +- configs/qemu_x86_selinux_defconfig | 53 + package/Config.in | 16 + package/Config.in.host | 1 + .../0001-cross-compile-header-creation-fix.patch | 1424 ++++++++++++++++++++ package/audit/0002-remove-zos-plugin.patch | 35 + package/audit/Config.in | 10 + package/audit/S01auditd | 172 +++ package/audit/audit.hash | 2 + package/audit/audit.mk | 57 + ...s-Add-installation-of-individual-binaries.patch | 103 ++ ...ags-strip-non-l-arguments-returned-by-pkg.patch | 28 + package/busybox/Config.in | 10 + package/busybox/busybox.mk | 52 + package/dbus/S30dbus | 4 + package/dbus/dbus.mk | 14 + package/libsemanage/Config.in | 10 - package/libsemanage/libsemanage.mk | 54 +- .../linux-pam-08-audit-log-acct_message_ret.patch | 16 + package/linux-pam/linux-pam.mk | 58 +- package/linux-pam/system-auth.pamd | 15 + package/logrotate/logrotate.mk | 11 +- package/openssh/openssh.mk | 12 + .../policycoreutils/0001-cross-compile-fixes.patch | 332 +++++ package/policycoreutils/Config.in | 71 + package/policycoreutils/S15restorecond | 85 ++ package/policycoreutils/policycoreutils.hash | 2 + package/policycoreutils/policycoreutils.mk | 243 ++++ package/python-pyparsing/python-pyparsing.mk | 1 + package/python-pyxml/Config.in | 11 + package/python-pyxml/python-xml.hash | 2 + package/python-pyxml/python-xml.mk | 32 + package/readline/readline.mk | 1 + package/refpolicy-contrib/Config.in | 20 + package/refpolicy-contrib/refpolicy-contrib.mk | 19 + package/refpolicy/0001-gentoo-hardened-fixes.patch | 1250 +++++++++++++++++ package/refpolicy/0002-baseDirectoryChanges.patch | 32 + package/refpolicy/0003-filesChanges.patch | 62 + package/refpolicy/0004-initChanges.patch | 20 + package/refpolicy/0005-selinuxutilChanges.patch | 96 ++ package/refpolicy/0006-sshChanges.patch | 22 + package/refpolicy/0007-loggingChanges.patch | 80 ++ package/refpolicy/0008-mountChanges.patch | 11 + package/refpolicy/0009-sysadmChanges.patch | 24 + package/refpolicy/0010-authloginChanges.patch | 14 + package/refpolicy/0011-localloginChanges.patch | 13 + package/refpolicy/0012-udevChanges.patch | 14 + package/refpolicy/0013-netutilsChanges.patch | 13 + package/refpolicy/0014-devicesChanges.patch | 48 + package/refpolicy/0015-awk-fix.patch | 37 + .../refpolicy/0016-enablePolyinstantiation.patch | 11 + package/refpolicy/Config.in | 93 ++ package/refpolicy/S12selinux | 137 ++ package/refpolicy/config | 8 + package/refpolicy/modules.conf | 406 ++++++ package/refpolicy/refpolicy.hash | 2 + package/refpolicy/refpolicy.mk | 109 ++ package/rsyslog/rsyslog.mk | 4 + package/sepolgen/Config.in.host | 7 + package/sepolgen/sepolgen.hash | 2 + package/sepolgen/sepolgen.mk | 30 + package/setools/0001-cross-compile-fixes.patch | 121 ++ .../setools/0002-swig-typedef-python-fixes.patch | 1014 ++++++++++++++ package/setools/Config.in | 28 + package/setools/setools.hash | 2 + package/setools/setools.mk | 86 ++ package/shadow/Config.in | 13 + package/shadow/shadow.hash | 2 + package/shadow/shadow.mk | 61 + package/sqlite/sqlite.mk | 1 + .../sysvinit-0010-fix-WITH-SELINUX-define.patch | 24 + package/sysvinit/sysvinit.mk | 11 +- package/util-linux/util-linux.mk | 21 + package/vim/vim.mk | 7 + 76 files changed, 8001 insertions(+), 46 deletions(-) create mode 100644 board/qemu/x86/busybox-selinux.config create mode 100644 board/qemu/x86/linux-3.12-selinux.config create mode 100644 configs/qemu_x86_selinux_defconfig create mode 100644 package/audit/0001-cross-compile-header-creation-fix.patch create mode 100644 package/audit/0002-remove-zos-plugin.patch create mode 100644 package/audit/Config.in create mode 100644 package/audit/S01auditd create mode 100644 package/audit/audit.hash create mode 100644 package/audit/audit.mk create mode 100644 package/busybox/0007-applets-Add-installation-of-individual-binaries.patch create mode 100644 package/busybox/0008-Makefile.flags-strip-non-l-arguments-returned-by-pkg.patch mode change 100755 => 100644 package/dbus/S30dbus create mode 100644 package/linux-pam/linux-pam-08-audit-log-acct_message_ret.patch create mode 100644 package/linux-pam/system-auth.pamd create mode 100644 package/policycoreutils/0001-cross-compile-fixes.patch create mode 100644 package/policycoreutils/Config.in create mode 100644 package/policycoreutils/S15restorecond create mode 100644 package/policycoreutils/policycoreutils.hash create mode 100644 package/policycoreutils/policycoreutils.mk create mode 100644 package/python-pyxml/Config.in create mode 100644 package/python-pyxml/python-xml.hash create mode 100644 package/python-pyxml/python-xml.mk create mode 100644 package/refpolicy-contrib/Config.in create mode 100644 package/refpolicy-contrib/refpolicy-contrib.mk create mode 100644 package/refpolicy/0001-gentoo-hardened-fixes.patch create mode 100644 package/refpolicy/0002-baseDirectoryChanges.patch create mode 100644 package/refpolicy/0003-filesChanges.patch create mode 100644 package/refpolicy/0004-initChanges.patch create mode 100644 package/refpolicy/0005-selinuxutilChanges.patch create mode 100644 package/refpolicy/0006-sshChanges.patch create mode 100644 package/refpolicy/0007-loggingChanges.patch create mode 100644 package/refpolicy/0008-mountChanges.patch create mode 100644 package/refpolicy/0009-sysadmChanges.patch create mode 100644 package/refpolicy/0010-authloginChanges.patch create mode 100644 package/refpolicy/0011-localloginChanges.patch create mode 100644 package/refpolicy/0012-udevChanges.patch create mode 100644 package/refpolicy/0013-netutilsChanges.patch create mode 100644 package/refpolicy/0014-devicesChanges.patch create mode 100644 package/refpolicy/0015-awk-fix.patch create mode 100644 package/refpolicy/0016-enablePolyinstantiation.patch create mode 100644 package/refpolicy/Config.in create mode 100644 package/refpolicy/S12selinux create mode 100644 package/refpolicy/config create mode 100644 package/refpolicy/modules.conf create mode 100644 package/refpolicy/refpolicy.hash create mode 100644 package/refpolicy/refpolicy.mk create mode 100644 package/sepolgen/Config.in.host create mode 100644 package/sepolgen/sepolgen.hash create mode 100644 package/sepolgen/sepolgen.mk create mode 100644 package/setools/0001-cross-compile-fixes.patch create mode 100644 package/setools/0002-swig-typedef-python-fixes.patch create mode 100644 package/setools/Config.in create mode 100644 package/setools/setools.hash create mode 100644 package/setools/setools.mk create mode 100644 package/shadow/Config.in create mode 100644 package/shadow/shadow.hash create mode 100644 package/shadow/shadow.mk create mode 100644 package/sysvinit/sysvinit-0010-fix-WITH-SELINUX-define.patch
Signature · 1 line
1.9.1
PATCH v4 1/27 sepolgen: new package
From: Clayton Shotwell <[email protected]>
Signed-off-by Clayton Shotwell <[email protected]>
Signed-off-by Matthew Weber <[email protected]>
---
[Matt W:
Changes v3 -> v4
- Fixed Kconfig files, moved libsepol instead of sepolgen by mistake.
Changes v2 -> v3
- Moved Config.in to be Config.in.host as this package is now only used as a host dependency for the policycoreutils.
Changes v1 -> v2
- Moved make install install to the end of the command
- Removed python kconfig depend since package just used for host building
- Updated site to github
- Handle Python 2 vs. Python 3 for the host package.
package/Config.in.host | 1 + package/sepolgen/Config.in.host | 7 +++++++ package/sepolgen/sepolgen.hash | 2 ++ package/sepolgen/sepolgen.mk | 30 ++++++++++++++++++++++++++++++ 4 files changed, 40 insertions(+) create mode 100644 package/sepolgen/Config.in.host create mode 100644 package/sepolgen/sepolgen.hash create mode 100644 package/sepolgen/sepolgen.mk
package/Config.in.host +1 -0
@@ -21,6 +21,7 @@ menu "Host utilities" source "package/pwgen/Config.in.host" source "package/qemu/Config.in.host" source "package/sam-ba/Config.in.host" + source "package/sepolgen/Config.in.host" source "package/squashfs/Config.in.host" source "package/sunxi-tools/Config.in.host" source "package/uboot-tools/Config.in.host"
package/sepolgen/Config.in.host new file +7 -0
@@ -0,0 +1,7 @@ +config BR2_PACKAGE_SEPOLGEN + bool "host sepolgen" + help + sepolgen is a python module/library that forms the core + of the modern audit2allow (a rewrite). + + http://selinuxproject.org/page/Main_Page
package/sepolgen/sepolgen.hash new file +2 -0
@@ -0,0 +1,2 @@ +# https://github.com/SELinuxProject/selinux/wiki/Releases +sha256 8a1c6d3a78c9b6ad3555c74def555f65a62950bf21c111c585bfc382fec3a645 sepolgen-1.1.9.tar.gz
package/sepolgen/sepolgen.mk new file +30 -0
@@ -0,0 +1,30 @@ +################################################################################ +# +# sepolgen +# +################################################################################ + +SEPOLGEN_VERSION = 1.1.9 +SEPOLGEN_SITE = https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20130423 +SEPOLGEN_LICENSE = GPLv2 +SEPOLGEN_LICENSE_FILES = COPYING + +ifeq ($(BR2_PACKAGE_PYTHON3),y) +HOST_SEPOLGEN_DEPENDENCIES = host-python3 +HOST_SEPOLGEN_MAKE_CMDS = $(HOST_CONFIGURE_OPTS) \ + PYTHONLIBDIR=/usr/lib/python$(PYTHON3_VERSION_MAJOR)/site-packages +else +HOST_SEPOLGEN_DEPENDENCIES = host-python +HOST_SEPOLGEN_MAKE_CMDS = $(HOST_CONFIGURE_OPTS) \ + PYTHONLIBDIR=/usr/lib/python$(PYTHON_VERSION_MAJOR)/site-packages +endif + +define HOST_SEPOLGEN_BUILD_CMDS + $(MAKE) -C $(@D) $(HOST_SEPOLGEN_MAKE_CMDS) DESTDIR=$(HOST_DIR) +endef + +define HOST_SEPOLGEN_INSTALL_CMDS + $(MAKE) -C $(@D) $(HOST_SEPOLGEN_MAKE_CMDS) DESTDIR=$(HOST_DIR) install +endef + +$(eval $(host-generic-package))
Signature · 1 line
1.9.1
PATCH v4 1/27 sepolgen: new package
Dear Matt Weber,
package/sepolgen/Config.in.host line 5
Quoted 11 lines · Matt Weber
package/sepolgen/Config.in.host new file +5
-0@@ -0,0 +1,7 @@ +config BR2_PACKAGE_SEPOLGEN + bool "host sepolgen" + help + sepolgen is a python module/library that forms the core + of the modern audit2allow (a rewrite).
If it's simply a module/library used as a dependency of another package, then there is no need to have a Config.in entry for it.
And Config.in entries for host packages should be BR2_PACKAGE_HOST_<foo>. But I don't think this package should have a menuconfig entry.
Thomas
Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons Embedded Linux, Kernel and Android engineering http://free-electrons.com
PATCH v4 2/27 sqlite: Add host build support
In reply to Matt WeberSigned-off-by Clayton Shotwell <[email protected]>
--- package/sqlite/sqlite.mk | 1 + 1 file changed, 1 insertion(+)
package/sqlite/sqlite.mk +1 -0
@@ -57,3 +57,4 @@ SQLITE_CONF_OPTS += --disable-readline endif $(eval $(autotools-package)) +$(eval $(host-autotools-package))
Signature · 1 line
1.9.1
PATCH v4 3/27 setools: new package
In reply to Matt WeberSigned-off-by Clayton Shotwell <[email protected]>
Signed-off-by Matthew Weber <[email protected]>
---
[Matt W:
Changes v2 -> v3
- Fixed kconfig menu as sepolgen removal removed initial menu entry to add to
Changes v1 -> v2
- Handle Python 2 vs. Python 3 for the host package.
- Added hash file
- Updated download site
package/Config.in | 4 + package/setools/0001-cross-compile-fixes.patch | 121 +++ .../setools/0002-swig-typedef-python-fixes.patch | 1014 ++++++++++++++++++++ package/setools/Config.in | 28 + package/setools/setools.hash | 2 + package/setools/setools.mk | 86 ++ 6 files changed, 1255 insertions(+) create mode 100644 package/setools/0001-cross-compile-fixes.patch create mode 100644 package/setools/0002-swig-typedef-python-fixes.patch create mode 100644 package/setools/Config.in create mode 100644 package/setools/setools.hash create mode 100644 package/setools/setools.mk
package/Config.in +4 -0
@@ -1200,6 +1200,10 @@ menu "Real-Time" source "package/xenomai/Config.in" endmenu +menu "Security" + source "package/setools/Config.in" +endmenu + menu "Shell and utilities" comment "Shells" if BR2_PACKAGE_BUSYBOX_SHOW_OTHERS
package/setools/0001-cross-compile-fixes.patch new file +121 -0
121 lines not on this page · raw message
package/setools/0002-swig-typedef-python-fixes.patch new file +1014 -0
1,014 lines not on this page · raw message
package/setools/Config.in new file +28 -0
@@ -0,0 +1,28 @@ +config BR2_PACKAGE_SETOOLS + bool "setools" + select BR2_PACKAGE_LIBSELINUX + select BR2_PACKAGE_SQLITE + select BR2_PACKAGE_LIBXML2 + select BR2_PACKAGE_BZIP2 + # No direct limitation to build other arch or libc(s). + # Limiting based on qemu tested arch(s). + depends on BR2_powerpc || BR2_powerpc64 || \ + BR2_i386 || BR2_x86_64 || BR2_arm + depends on BR2_TOOLCHAIN_USES_GLIBC # UCLIBC needs testing + depends on BR2_TOOLCHAIN_HAS_THREADS + depends on BR2_LARGEFILE + help + SETools is an open source project designed to facilitate + SELinux policy analysis. The primary tools are: + * apol - analyze a SELinux policy. + * seaudit - analyze audit messages from SELinux. + * seaudit-report - generate highly-customized audit log + reports. + * sechecker - command line tool for performing modular + checks on an SELinux policy. + * sediff - semantic policy difference tool for SELinux. + * secmds - command-line tools to analyze and search SELinux + policy. + +comment "setools needs a toolchain w/ largefile, threads" + depends on !BR2_TOOLCHAIN_HAS_THREADS || !BR2_LARGEFILE
package/setools/setools.hash new file +2 -0
@@ -0,0 +1,2 @@ +#Locally computed +sha256 44387ecc9a231ec536a937783440cd8960a72c51f14bffc1604b7525e341e999 setools-3.3.8.tar.bz2
package/setools/setools.mk new file +86 -0
86 lines not on this page · raw message
Signature · 1 line
1.9.1
PATCH v4 3/27 setools: new package
Dear Matt Weber,
package/setools/0001-cross-compile-fixes.patch line 4
Quoted 10 lines · Matt Weber
package/setools/0001-cross-compile-fixes.patch new file +4
-0@@ -0,0 +1,121 @@ +Correct build issues to enable cross compiling. These rechanges require the +package to be auto reconfigured. + +Signed-off-by Clayton Shotwell <[email protected]>
This seems to be a mixed bag of various issues. Can we split that up into separate patches? Can they be submitted upstream? I don't require them to be applied upstream, but if possible at least submitted.
package/setools/0002-swig-typedef-python-fixes.patch line 3
Quoted 9 lines
package/setools/0002-swig-typedef-python-fixes.patch new file +3
-0@@ -0,0 +1,1014 @@ +Correct swig typdef naming convention errors that cause the build to break. + +Signed-off-by Clayton Shotwell <[email protected]>
Why is this error happening? Why isn't this fixed upstream? Are we using a different swig version?
Quoted 11 lines
package/setools/setools.mk new file +5
-0@@ -0,0 +1,86 @@ +################################################################################ +# +# setools +# +################################################################################
package/setools/setools.mk line 15
Quoted 10 lines
package/setools/setools.mk new file +10
-0+ +SETOOLS_VERSION = 3.3.8 +SETOOLS_SITE = https://github.com/TresysTechnology/setools3/archive/ +SETOOLS_DEPENDENCIES = libselinux sqlite libxml2 bzip2 + +SETOOLS_INSTALL_STAGING = YES + +SETOOLS_AUTORECONF = YES +SETOOLS_AUTORECONF_OPTS = -i -s +SETOOLS_LIBTOOL_PATCH = NO
Please comments to explain why. Especially the libtool patch disabling.
Quoted 53 lines
package/setools/setools.mk new file +53
-0+# Notes: Need "disable-selinux-check" so the configure does not check to see if host has +# selinux enabled. +SETOOLS_CONF_OPTS = \ + --disable-debug \ + --disable-gui \ + --disable-bwidget-check \ + --disable-selinux-check \ + --disable-swig-java \ + --disable-swig-python \ + --disable-swig-tcl \ + --with-sepol-devel="$(STAGING_DIR)/usr" \ + --with-selinux-devel="$(STAGING_DIR)/usr" + + +HOST_SETOOLS_DEPENDENCIES = host-libselinux host-libsepol host-sqlite \ + host-libxml2 host-bzip2 + +HOST_SETOOLS_AUTORECONF = YES +HOST_SETOOLS_AUTORECONF_OPTS = -i -s + +# Notes: Need "disable-selinux-check" so the configure does not check to see if host has +# selinux enabled. +HOST_SETOOLS_CONF_OPTS = \ + --disable-debug \ + --disable-gui \ + --disable-bwidget-check \ + --disable-selinux-check \ + --disable-swig-java \ + --disable-swig-python \ + --disable-swig-tcl \ + --with-sepol-devel="$(HOST_DIR)/usr" \ + --with-selinux-devel="$(HOST_DIR)/usr" + +# python related conf options +HOST_SETOOLS_DEPENDENCIES += host-swig +HOST_SETOOLS_CONF_ENV += \ + am_cv_pathless_PYTHON=python \ + ac_cv_path_PYTHON=$(HOST_DIR)/usr/bin/python \ + am_cv_python_platform=linux2 +HOST_SETOOLS_CONF_OPTS += \ + --enable-swig-python \ + PYTHON_LDFLAGS="-L$(HOST_DIR)/usr/lib/" + +ifeq ($(BR2_PACKAGE_PYTHON3),y) +HOST_SETOOLS_DEPENDENCIES += host-python3 +HOST_SETOOLS_CONF_ENV += \ + am_cv_python_version=$(PYTHON3_VERSION) \ + am_cv_python_pythondir=$(HOST_DIR)/usr/lib/python$(PYTHON3_VERSION_MAJOR)/site-packages \ + am_cv_python_pyexecdir=$(HOST_DIR)/usr/lib/python$(PYTHON3_VERSION_MAJOR)/site-packages \ + am_cv_python_includes=-I$(HOST_DIR)/usr/include/python$(PYTHON3_VERSION_MAJOR) +HOST_SETOOLS_CONF_OPTS += \ + PYTHON_CPPFLAGS="-I$(HOST_DIR)/usr/include/python$(PYTHON3_VERSION_MAJOR)" \ + PYTHON_SITE_PKG="$(HOST_DIR)/usr/lib/python$(PYTHON3_VERSION_MAJOR)/site-packages" \
package/setools/setools.mk line 79
Quoted 10 lines
package/setools/setools.mk new file +10
-0+ PYTHON_EXTRA_LIBS="-lpthread -ldl -lutil -lpython$(PYTHON3_VERSION_MAJOR)" +else +HOST_SETOOLS_DEPENDENCIES += host-python +HOST_SETOOLS_CONF_ENV += \ + am_cv_python_version=$(PYTHON_VERSION) \ + am_cv_python_pythondir=$(HOST_DIR)/usr/lib/python$(PYTHON_VERSION_MAJOR)/site-packages \ + am_cv_python_pyexecdir=$(HOST_DIR)/usr/lib/python$(PYTHON_VERSION_MAJOR)/site-packages \ + am_cv_python_includes=-I$(HOST_DIR)/usr/include/python$(PYTHON_VERSION_MAJOR) +HOST_SETOOLS_CONF_OPTS += \ + --enable-swig-python \
This option is already passed above.
package/setools/setools.mk line 83
Quoted 4 lines
package/setools/setools.mk new file +4
-0+ PYTHON_CPPFLAGS="-I$(HOST_DIR)/usr/include/python$(PYTHON_VERSION_MAJOR)" \ + PYTHON_SITE_PKG="$(HOST_DIR)/usr/lib/python$(PYTHON_VERSION_MAJOR)/site-packages" \ + PYTHON_EXTRA_LIBS="-lpthread -ldl -lutil -lpython$(PYTHON_VERSION_MAJOR)" +endif
This really looks like a big mess of options. The configure script of setools is that stupid that it needs to be told gazillions of details? Some of them several times like am_cv_python_includes + PYTHON_CPPFLAGS ?
Also, please add a comment explaining why the host variant depends on python, but not the target variant.
Thanks,
Thomas
Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons Embedded Linux, Kernel and Android engineering http://free-electrons.com
PATCH v4 4/27 python-pyparsing: Add host build option
In reply to Matt WeberSigned-off-by Clayton Shotwell <[email protected]>
--- package/python-pyparsing/python-pyparsing.mk | 1 + 1 file changed, 1 insertion(+)
package/python-pyparsing/python-pyparsing.mk +1 -0
@@ -12,3 +12,4 @@ PYTHON_PYPARSING_LICENSE_FILES = LICENSE PYTHON_PYPARSING_SETUP_TYPE = distutils $(eval $(python-package)) +$(eval $(host-python-package))
Signature · 1 line
1.9.1
PATCH v4 5/27 audit: new package
In reply to Matt WeberSigned-off-by Clayton Shotwell <[email protected]>
Signed-off-by Matthew Weber <[email protected]>
---
[Matt W:
- Removed limitation on glibc only build
- Updated static lib build option variable name
package/Config.in | 1 + .../0001-cross-compile-header-creation-fix.patch | 1424 ++++++++++++++++++++ package/audit/0002-remove-zos-plugin.patch | 35 + package/audit/Config.in | 10 + package/audit/S01auditd | 172 +++ package/audit/audit.hash | 2 + package/audit/audit.mk | 57 + 7 files changed, 1701 insertions(+) create mode 100644 package/audit/0001-cross-compile-header-creation-fix.patch create mode 100644 package/audit/0002-remove-zos-plugin.patch create mode 100644 package/audit/Config.in create mode 100644 package/audit/S01auditd create mode 100644 package/audit/audit.hash create mode 100644 package/audit/audit.mk
package/Config.in +1 -0
@@ -1239,6 +1239,7 @@ endmenu menu "System tools" source "package/acl/Config.in" source "package/attr/Config.in" + source "package/audit/Config.in" if BR2_PACKAGE_BUSYBOX_SHOW_OTHERS source "package/bootutils/Config.in" source "package/coreutils/Config.in"
package/audit/0001-cross-compile-header-creation-fix.patch new file +1424 -0
1,424 lines not on this page · raw message
package/audit/0002-remove-zos-plugin.patch new file +35 -0
@@ -0,0 +1,35 @@ +Removed the step to build the zos-remote. + +Signed-off-by Clayton Shotwell <[email protected]> +--- +--- a/audisp/plugins/Makefile.am 2012-08-28 10:33:03.582396601 -0500 ++++ b/audisp/plugins/Makefile.am 2012-08-28 10:33:14.162399662 -0500 +@@ -22,7 +22,7 @@ + + CONFIG_CLEAN_FILES = *.loT *.rej *.orig + +-SUBDIRS = builtins zos-remote remote ++SUBDIRS = builtins remote + #SUBDIRS = builtins zos-remote + if HAVE_PRELUDE + SUBDIRS += prelude +--- a/audisp/plugins/Makefile.in 2012-08-28 10:33:03.592380390 -0500 ++++ b/audisp/plugins/Makefile.in 2012-08-28 10:35:38.482397668 -0500 +@@ -84,7 +84,7 @@ + distdir + ETAGS = etags + CTAGS = ctags +-DIST_SUBDIRS = builtins zos-remote remote prelude ++DIST_SUBDIRS = builtins remote prelude + DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) + am__relativize = \ + dir0=`pwd`; \ +@@ -242,7 +242,7 @@ + top_builddir = @top_builddir@ + top_srcdir = @top_srcdir@ + CONFIG_CLEAN_FILES = *.loT *.rej *.orig +-SUBDIRS = builtins zos-remote remote $(am__append_1) ++SUBDIRS = builtins remote $(am__append_1) + all: all-recursive + + .SUFFIXES:
package/audit/Config.in new file +10 -0
@@ -0,0 +1,10 @@ +config BR2_PACKAGE_AUDIT + bool "audit" + help + The audit package contains the user space utilities for + storing and searching the audit records generate by + the audit subsystem in the Linux 2.6 kernel + + Note: The z/OS remote plugin is disabled in this package + + http://people.redhat.com/sgrubb/audit/
package/audit/S01auditd new file +172 -0
172 lines not on this page · raw message
package/audit/audit.hash new file +2 -0
@@ -0,0 +1,2 @@ +#Locally computed +sha256 8872e0b5392888789061db8034164305ef0e1b34543e1e7004d275f039081d29 audit-2.3.2.tar.gz
package/audit/audit.mk new file +57 -0
57 lines not on this page · raw message
Signature · 1 line
1.9.1
PATCH v4 5/27 audit: new package
Dear Matt Weber,
Quoted 6 lines · Matt Weber
package/audit/0001-cross-compile-header-creation-fix.patch new file +0
-0
package/audit/0001-cross-compile-header-creation-fix.patch line 9
Quoted 9 lines
package/audit/0001-cross-compile-header-creation-fix.patch new file +9
-0@@ -0,0 +1,1424 @@ +Rework the build system to generate the required header files using a +Python script rather than compiling executables. This change has +to be made because the executables that are generated are built for +the target architecture and are generally not compilable on the host +build machine. + +The code has been submitted to the audit maintainers for review. +The first of three patches can be seen at the following link. +https://www.redhat.com/archives/linux-audit/2013-August/msg00043.html
Have you received some feedback from the maintainers?
This stuff looks really, really scary. Please include in the patch description an explanation of why a rewrite in Python is needed instead of using a C version. I remember we had this discussion a while ago, but I don't remember the reason.
In general, whenever something is weird/unusual, please add comments. Either in the code (preferred) or in the commit log. This will help review immensely, as it will answer questions that reviewers will have.
Quoted 34 lines
package/audit/Config.in new file +10
-0@@ -0,0 +1,10 @@ +config BR2_PACKAGE_AUDIT + bool "audit" + help + The audit package contains the user space utilities for + storing and searching the audit records generate by + the audit subsystem in the Linux 2.6 kernel + + Note: The z/OS remote plugin is disabled in this package + + http://people.redhat.com/sgrubb/audit/package/audit/S01auditd new file +12
-0@@ -0,0 +1,172 @@ +#!/bin/sh +# +# auditd This starts and stops auditd +# +# description: This starts the Linux Auditing System Daemon, \ +# which collects security related events in a dedicated \ +# audit log. If this daemon is turned off, audit events \ +# will be sent to syslog. +# +# processname: /sbin/auditd +# config: /etc/sysconfig/auditd +# config: /etc/audit/auditd.conf
package/audit/S01auditd line 22
Quoted 10 lines
package/audit/S01auditd new file +10
-0+# pidfile: /var/run/auditd.pid +# +# Return values according to LSB for all commands but status: +# 0 - success +# 1 - generic or unspecified error +# 3 - unimplemented feature (e.g. "reload") +# 4 - insufficient privilege +# 5 - program is not installed +# 6 - program is not configured +# 7 - program is not running
We don't have this error code stuff in any other Buildroot init script.
Quoted 61 lines
package/audit/S01auditd new file +61
-0+# +prog="auditd" + +# Check that we are root ... so non-root users stop here +test $EUID=0 || exit 4 + +# Check config +test -f /etc/sysconfig/auditd && . /etc/sysconfig/auditd + +RETVAL=0 +LOCK=/var/lock/subsys/auditd + +start(){ + echo -n "Initializing $prog: " + + if [ ! -e $LOCK ]; then + test -x /sbin/auditd || exit 5 + test -f /etc/audit/auditd.conf || exit 6 + + # Create dir to store log files in if one doesn't exist + test -d /var/log/audit || mkdir -p /var/log/audit && /sbin/restorecon /var/log/audit + + # Run audit daemon executable + $prog + RETVAL=$? + if test $RETVAL = 0 ; then + test -d /var/lock/subsys || mkdir -p /var/lock/subsys + touch $LOCK + # Load the default rules + test -f /etc/audit/audit.rules && /sbin/auditctl -R /etc/audit/audit.rules >/dev/null + echo "OK" + else + echo "FAILED: auditd failed to start" + fi + else + echo "FAILED: auditd already started, stop first" + RETVAL=1 + fi + return $RETVAL +} + +stop(){ + echo -n "Uninitializing $prog: " + if [ -e $LOCK ]; then + killall -TERM $prog + RETVAL=$? + if [ $RETVAL ]; then + rm -f $LOCK + # Remove watches so shutdown works cleanly + if test x"$AUDITD_CLEAN_STOP" != "x" ; then + if test "`echo $AUDITD_CLEAN_STOP | tr 'NO' 'no'`" != "no" + then + /sbin/auditctl -D >/dev/null + fi + fi + if test x"$AUDITD_STOP_DISABLE" != "x" ; then + if test "`echo $AUDITD_STOP_DISABLE | tr 'NO' 'no'`" != "no" + then + /sbin/auditctl -e 0 >/dev/null + fi + fi
package/audit/S01auditd line 93
Quoted 10 lines
package/audit/S01auditd new file +10
-0+ echo "OK" + else + echo "FAILED: auditd not stopped" + fi + else + echo "FAILED: auditd not started" + RETVAL=1 + fi + return $RETVAL +}
Can we use start-stop-daemon and make the whole initscript look more like other Buildroot provided init scripts?
Quoted 6 lines
package/audit/S01auditd new file +6
-0+rotate(){ + echo -n "Rotating auditd logs: " + if [ -e $LOCK ]; then + killall -USR1 $prog + RETVAL=$? + if [ $RETVAL ]; then
package/audit/S01auditd line 129
Quoted 10 lines
package/audit/S01auditd new file +10
-0+ echo "OK" + else + echo "FAILED" + fi + else + echo "FAILED: auditd not started" + RETVAL=1 + fi + return $RETVAL +}
We don't have this in any other Buildroot init script.
Can you make this more Buildroot-looking?
Quoted 6 lines
package/audit/audit.mk new file +0
-0
package/audit/audit.mk line 8
Quoted 8 lines
package/audit/audit.mk new file +8
-0@@ -0,0 +1,57 @@ +################################################################################ +# +# audit +# +################################################################################ + +AUDIT_VERSION:=2.3.2 +AUDIT_SITE:=http://people.redhat.com/sgrubb/audit/
No :=, please use =.
package/audit/audit.mk line 9
Quoted 1 line
package/audit/audit.mk new file +1
-0+AUDIT_DEPENDENCIES = host-python-pyparsing
I think explicitly depending on host-python here would be good.
package/audit/audit.mk line 17
Quoted 8 lines
package/audit/audit.mk new file +8
-0+AUDIT_LICENSE = GPLv2 +AUDIT_LICENSE_FILES = COPYING + +AUDIT_INSTALL_STAGING = YES + +AUDIT_AUTORECONF = YES +AUDIT_AUTORECONF_OPTS = -i -s -I m4 +AUDIT_LIBTOOL_PATCH = NO
Please add comments about why autoreconf is needed, and while the libtool patch needs to be disabled.
package/audit/audit.mk line 24
Quoted 7 lines
package/audit/audit.mk new file +7
-0+ +# Audit will be looking for applications to be in the root +# /sbin folder rather than in /usr/sbin folder +AUDIT_CONF_OPTS = --sbindir=/sbin + +AUDIT_CONF_ENV += CFLAGS="$(TARGET_CFLAGS) -I$(STAGING_DIR)/usr/include/python$(PYTHON_VERSION_MAJOR)" +AUDIT_CONF_OPTS += --with-python=no
This seems crazy: you're saying to not use python, but you're passing some -I flags to the Python headers. Please add more comments to explain what's going on.
package/audit/audit.mk line 28
Quoted 4 lines
package/audit/audit.mk new file +4
-0+ +ifeq ($(BR2_PACKAGE_LIBCAP_NG),y) + AUDIT_DEPENDENCIES += libcap-ng + AUDIT_CONF_OPTS += --with-libcap-ng=yes
We typically don't intend those lines anymore.
package/audit/audit.mk line 41
Quoted 13 lines
package/audit/audit.mk new file +13
-0+else + AUDIT_CONF_OPTS += --with-libcap-ng=no +endif + +ifeq ($(BR2_armeb),y) + AUDIT_CONF_OPT += --with-armeb +endif +ifeq ($(BR2_arm),y) + AUDIT_CONF_OPT += --with-armeb +endif +ifeq ($(BR2_aarch64),y) + AUDIT_CONF_OPT += --with-aarch64 +endif
What happens for the other architectures? Why only armeb, arm and aarch64 have special handling?
package/audit/audit.mk line 45
Quoted 4 lines
package/audit/audit.mk new file +4
-0+ +ifeq ($(BR2_STATIC_LIBS),y) + AUDIT_CONF_OPTS += --enable-shared=no +endif
Buildroot is already passing --disable-shared when BR2_STATIC_LIBS=y, which is the same as --enable-shared=no with the autotools. So this looks unneeded.
Best regards,
Thomas
Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons Embedded Linux, Kernel and Android engineering http://free-electrons.com
PATCH v4 6/27 policycoreutils: new package
In reply to Matt WeberSigned-off-by Clayton Shotwell <[email protected]>
Signed-off-by Matt Weber <[email protected]>
---
[Matt W:
- Updated depends and removed glibc dependency
- Updated site to github
- Added host python 2/3 support
package/Config.in | 3 + .../policycoreutils/0001-cross-compile-fixes.patch | 332 +++++++++++++++++++++ package/policycoreutils/Config.in | 71 +++++ package/policycoreutils/S15restorecond | 85 ++++++ package/policycoreutils/policycoreutils.hash | 2 + package/policycoreutils/policycoreutils.mk | 243 +++++++++++++++ 6 files changed, 736 insertions(+) create mode 100644 package/policycoreutils/0001-cross-compile-fixes.patch create mode 100644 package/policycoreutils/Config.in create mode 100644 package/policycoreutils/S15restorecond create mode 100644 package/policycoreutils/policycoreutils.hash create mode 100644 package/policycoreutils/policycoreutils.mk
package/Config.in +3 -0
@@ -1201,6 +1201,9 @@ menu "Real-Time" endmenu menu "Security" +menu "policycoreutils" + source "package/policycoreutils/Config.in" +endmenu source "package/setools/Config.in" endmenu
package/policycoreutils/0001-cross-compile-fixes.patch new file +332 -0
332 lines not on this page · raw message
package/policycoreutils/Config.in new file +71 -0
71 lines not on this page · raw message
package/policycoreutils/S15restorecond new file +85 -0
85 lines not on this page · raw message
package/policycoreutils/policycoreutils.hash new file +2 -0
@@ -0,0 +1,2 @@ +# https://github.com/SELinuxProject/selinux/wiki/Releases +sha256 b6881741f9f9988346a73bfeccb0299941dc117349753f0ef3f23ee86f06c1b5 policycoreutils-2.1.14.tar.gz
package/policycoreutils/policycoreutils.mk new file +243 -0
243 lines not on this page · raw message
Signature · 1 line
1.9.1
PATCH v4 6/27 policycoreutils: new package
Dear Matt Weber,
package/Config.in menu "Real-Time" · line 1206
Quoted 4 lines · Matt Weber
menu "Security"
package/Config.in +3
-0+menu "policycoreutils" + source "package/policycoreutils/Config.in" +endmenu
Why a menu...endmenu here? If you really want a menu, it should be defined inside this package Config.in file, not in package/Config.in.
package/policycoreutils/0001-cross-compile-fixes.patch line 3
Quoted 9 lines
package/policycoreutils/0001-cross-compile-fixes.patch new file +3
-0@@ -0,0 +1,332 @@ +Patch to enable cross compile build and install. + +Signed-off-by Clayton Shotwell <[email protected]>
Please split that up in several patches, for the different issues. And submit upstream.
package/policycoreutils/0001-cross-compile-fixes.patch line 39
Quoted 5 lines
package/policycoreutils/0001-cross-compile-fixes.patch new file +5
-0+-INOTIFYH = $(shell ls /usr/include/sys/inotify.h 2>/dev/null) ++INOTIFYH = $(shell ls $(DESTDIR)/usr/include/sys/inotify.h 2>/dev/null) + +-ifeq (${INOTIFYH}, /usr/include/sys/inotify.h) ++ifeq (${INOTIFYH}, $(DESTDIR)/usr/include/sys/inotify.h)
This is really horrible :-/. If you do a build with DESTDIR=$(TARGET_DIR), things won't work because there are no headers in $(TARGET_DIR). It's not going to cause a practical problem, but it's not nice.
package/policycoreutils/0001-cross-compile-fixes.patch line 176
Quoted 4 lines
package/policycoreutils/0001-cross-compile-fixes.patch new file +4
-0+ CFLAGS ?= -g -Werror -Wall -W +-override CFLAGS += -I$(PREFIX)/include $(DBUSFLAGS) -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include -I/usr/lib/glib-2.0/include ++override CFLAGS += -I$(PREFIX)/include $(DBUSFLAGS) -I$(PREFIX)/include/glib-2.0 \ ++ -I$(PREFIX)/lib64/glib-2.0/include -I$(PREFIX)/lib/glib-2.0/include
Can we do something sane, like:
$(shell pkg-config --cflags glib-2.0)
package/policycoreutils/0001-cross-compile-fixes.patch line 183
Quoted 6 lines
package/policycoreutils/0001-cross-compile-fixes.patch new file +6
-0+ LDLIBS += -lselinux $(DBUSLIB) -lglib-2.0 -L$(LIBDIR) + + all: restorecond + ++%.o: %.c ++ $(CC) $(CFLAGS) -c -o $@ $<
Huh? This is normally part of make implicit rules. I don't see why you would need this.
package/policycoreutils/0001-cross-compile-fixes.patch line 267
Quoted 12 lines
package/policycoreutils/0001-cross-compile-fixes.patch new file +12
-0++PYTHON_ARGS = LDSHARED="$(CC) -shared" \ ++ CROSS_COMPILING=yes \ ++ _python_sysroot=$(DESTDIR) \ ++ _python_srcdir=$(PYTHON_SRC) \ ++ _python_prefix=/usr \ ++ _python_exec_prefix=/usr ++ + all: python-build + + python-build: info.c search.c common.h policy.h policy.c +- $(PYTHON) setup.py build ++ $(PYTHON_ARGS) $(PYTHON) setup.py build
This is not really great, as this cannot be upstreamed: some of those Python variables only exist because the patches Buildroot has on Python. Maybe the Buildroot .mk file should pass them, instead?
package/policycoreutils/0001-cross-compile-fixes.patch line 312
Quoted 4 lines
package/policycoreutils/0001-cross-compile-fixes.patch new file +4
-0+-PROGRESS_STEP=$(shell grep "^\#define STAR_COUNT" restore.h | awk -S '{ print $$3 }') +-ABORT_ON_ERRORS=$(shell grep "^\#define ABORT_ON_ERRORS" setfiles.c | awk -S '{ print $$3 }') ++PROGRESS_STEP=$(shell grep "^\#define STAR_COUNT" restore.h | awk '{ print $$3 }') ++ABORT_ON_ERRORS=$(shell grep "^\#define ABORT_ON_ERRORS" setfiles.c | awk '{ print $$3 }')
Removing -S. Why?
package/policycoreutils/Config.in line 4
Quoted 10 lines
package/policycoreutils/Config.in new file +4
-0@@ -0,0 +1,71 @@ +config BR2_PACKAGE_POLICYCOREUTILS + bool "policycoreutils" + select BR2_PACKAGE_LIBSEMANAGE + select BR2_PACKAGE_SEPOLGEN # host python bindings
Not clear what you mean by "host python bindings" here. Host package dependencies are not reflected in Config.in files.
Quoted 13 lines
package/policycoreutils/Config.in new file +13
-0+if BR2_PACKAGE_POLICYCOREUTILS + +config BR2_PACKAGE_POLICYCOREUTILS_RESTORECOND + bool "restorecond Utility" + select BR2_PACKAGE_DBUS_GLIB + depends on BR2_USE_WCHAR # dbus-glib + depends on BR2_USE_MMU # dbus-glib + help + Enable restorecond to be built + +comment "restorecond needs a toolchain w/ wchar, mmu" + depends on !BR2_USE_WCHAR || !BR2_USE_MMU +
package/policycoreutils/Config.in line 62
Quoted 10 lines
package/policycoreutils/Config.in new file +10
-0+config BR2_PACKAGE_POLICYCOREUTILS_MCSTRANS + bool "mcstrans Utility" + select BR2_PACKAGE_PCRE + select BR2_PACKAGE_LIBCAP + help + Enable mcstrans to be built + +config BR2_PACKAGE_POLICYCOREUTILS_SANDBOX + bool "sandbox Utility" + select BR2_PACKAGE_POLICYCOREUTILS_POLICY_DEBUGGING
Where is this option defined?
Quoted 90 lines
package/policycoreutils/Config.in new file +9
-0+ select BR2_PACKAGE_LIBCGROUP + depends on BR2_INSTALL_LIBSTDCPP # libcgroup + help + Enable sandbox to be built + +comment "policycoreutils sandbox needs an toolchain w/ C++" + depends on !BR2_INSTALL_LIBSTDCPP + +endifpackage/policycoreutils/S15restorecond new file +75
-0@@ -0,0 +1,85 @@ +#!/bin/sh +# +# restorecond: Daemon used to maintain path file context +# +# description: restorecond uses inotify to look for creation of new files \ +# listed in the /etc/selinux/restorecond.conf file, and restores the \ +# correct security context. +# +# processname: /usr/sbin/restorecond +# config: /etc/selinux/restorecond.conf +# pidfile: /var/run/restorecond.pid +# +# Return values according to LSB for all commands but status: +# 0 - success +# 1 - generic or unspecified error +# 2 - invalid or excess argument(s) +# 3 - unimplemented feature (e.g. "reload") +# 4 - insufficient privilege +# 5 - program is not installed +# 6 - program is not configured +# 7 - program is not running + +PATH=/sbin:/bin:/usr/bin:/usr/sbin + +[ -x /usr/sbin/selinuxenabled ] && /usr/sbin/selinuxenabled || exit 7 + +# Check that we are root ... so non-root users stop here +test $EUID = 0 || exit 4 + +test -x /usr/sbin/restorecond || exit 5 +test -f /etc/selinux/restorecond.conf || exit 6 + +RETVAL=0 + +start() +{ + echo -n $"Starting restorecond: " + unset HOME MAIL USER USERNAME + /usr/sbin/restorecond + RETVAL=$? + touch /var/lock/subsys/restorecond + echo + return $RETVAL +} + +stop() +{ + echo -n $"Shutting down restorecond: " + killproc restorecond + RETVAL=$? + rm -f /var/lock/subsys/restorecond + echo + return $RETVAL +} + +restart() +{ + stop + start +} + +# See how we were called. +case "$1" in + start) + start + ;; + stop) + stop + ;; + status) + status restorecond + RETVAL=$? + ;; + force-reload|restart|reload) + restart
package/policycoreutils/S15restorecond line 85
Quoted 10 lines
package/policycoreutils/S15restorecond new file +10
-0+ ;; + condrestart) + [ -e /var/lock/subsys/restorecond ] && restart || : + ;; + *) + echo $"Usage: $0 {start|stop|restart|force-reload|status|condrestart}" + RETVAL=3 +esac + +exit $RETVAL
Same comment as for other init scripts: please make this more similar to other Buildroot init scripts.
Quoted 8 lines
package/policycoreutils/policycoreutils.mk new file +2
-0@@ -0,0 +1,243 @@ +################################################################################ +#
package/policycoreutils/policycoreutils.mk line 12
Quoted 10 lines
package/policycoreutils/policycoreutils.mk new file +10
-0+# policycoreutils +# +################################################################################ + +POLICYCOREUTILS_VERSION = 2.1.14 +POLICYCOREUTILS_SITE = https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20130423 +POLICYCOREUTILS_LICENSE = GPLv2 +POLICYCOREUTILS_LICENSE_FILES = COPYING + +POLICYCOREUTILS_DEPENDENCIES = libsemanage libcap-ng
Why is libcap-ng a mandatory dependency here, but not referenced in the Config.in file?
Quoted 8 lines
package/policycoreutils/policycoreutils.mk new file +8
-0+ +ifeq ($(BR2_PACKAGE_LINUX_PAM),y) + POLICYCOREUTILS_DEPENDENCIES += linux-pam + POLICYCOREUTILS_MAKE_OPTS += NAMESPACE_PRIV=y +define POLICYCOREUTILS_INSTALL_TARGET_LINUX_PAM_CONFS + $(INSTALL) -D -m 0644 $(@D)/newrole/newrole-lspp.pamd $(TARGET_DIR)/etc/pam.d/newrole + $(INSTALL) -D -m 0644 $(@D)/run_init/run_init.pamd $(TARGET_DIR)/etc/pam.d/run_init +endef
package/policycoreutils/policycoreutils.mk line 30
Quoted 10 lines
package/policycoreutils/policycoreutils.mk new file +10
-0+endif + +ifeq ($(BR2_PACKAGE_AUDIT),y) + POLICYCOREUTILS_DEPENDENCIES += audit + POLICYCOREUTILS_MAKE_OPTS += AUDIT_LOG_PRIV=y +endif + +# Enable LSPP_PRIV if both audit and linux pam are enabled +ifeq ($(BR2_PACKAGE_LINUX_PAM),y) +ifeq ($(BR2_PACKAGE_AUDIT),y)
This can be:
ifeq ($(BR2_PACKAGE_LINUX_PAM)$(BR2_PACKAGE_AUDIT),yy)
package/policycoreutils/policycoreutils.mk line 40
Quoted 10 lines
package/policycoreutils/policycoreutils.mk new file +10
-0+ POLICYCOREUTILS_MAKE_OPTS += LSPP_PRIV=y +endif +endif + +# Undefining _FILE_OFFSET_BITS here because of a "bug" with glibc fts.h +# large file support. +# See https://bugzilla.redhat.com/show_bug.cgi?id=574992 for more information +POLICYCOREUTILS_MAKE_OPTS = \ + $(TARGET_CONFIGURE_OPTS) \ + CFLAGS+="-U_FILE_OFFSET_BITS"
Should be:
CFLAGS="$(TARGET_CFLAGS) -U_FILE_OFFSET_BITS"
In some other packages, I've opted for a filter-out, seehttp://git.buildroot.net/buildroot/tree/package/musl/musl.mk#n24. But maybe a -U<foo> as you did is better.
package/policycoreutils/policycoreutils.mk line 48
Quoted 8 lines
package/policycoreutils/policycoreutils.mk new file +8
-0+ +ifeq ($(BR2_PACKAGE_POLICYCOREUTILS_RESTORECOND),y) + +POLICYCOREUTILS_DEPENDENCIES += dbus-glib + +define POLICYCOREUTILS_RESTORECOND_BUILD_CMDS + $(MAKE) -C $(@D)/restorecond $(POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR="$(STAGING_DIR)" all
No quotes around $(STAGING_DIR), we don't do it anywhere else.
package/policycoreutils/policycoreutils.mk line 53
Quoted 5 lines
package/policycoreutils/policycoreutils.mk new file +5
-0+endef + +define POLICYCOREUTILS_RESTORECOND_INSTALL_TARGET_CMDS + $(MAKE) -C $(@D)/restorecond $(POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR="$(TARGET_DIR)" install
Ditto.
Quoted 63 lines
package/policycoreutils/policycoreutils.mk new file +63
-0+ rm $(TARGET_DIR)/etc/init.d/restorecond +endef + +define POLICYCOREUTILS_RESTORECOND_INSTALL_INIT_SYSV + $(INSTALL) -m 0755 package/policycoreutils/S15restorecond \ + $(TARGET_DIR)/etc/init.d/ +endef + +endif # End of BR2_PACKAGE_POLICYCOREUTILS_RESTORECOND + +ifeq ($(BR2_PACKAGE_POLICYCOREUTILS_MCSTRANS),y) + +POLICYCOREUTILS_DEPENDENCIES += pcre libcap + +define POLICYCOREUTILS_MCSTRANS_BUILD_CMDS + $(MAKE) -C $(@D)/mcstrans $(TARGET_CONFIGURE_OPTS) \ + DESTDIR="$(STAGING_DIR)" all +endef + +define POLICYCOREUTILS_MCSTRANS_INSTALL_TARGET_CMDS + $(MAKE) -C $(@D)/mcstrans $(TARGET_CONFIGURE_OPTS) \ + DESTDIR="$(TARGET_DIR)" install +endef + +endif # End of BR2_PACKAGE_POLICYCOREUTILS_MCSTRANS + +ifeq ($(BR2_PACKAGE_POLICYCOREUTILS_SANDBOX),y) + +POLICYCOREUTILS_DEPENDENCIES += libcgroup + +define POLICYCOREUTILS_SANDBOX_BUILD_CMDS + $(MAKE) -C $(@D)/sandbox $(TARGET_CONFIGURE_OPTS) \ + DESTDIR="$(STAGING_DIR)" all +endef + +define POLICYCOREUTILS_SANDBOX_INSTALL_TARGET_CMDS + $(MAKE) -C $(@D)/sandbox $(TARGET_CONFIGURE_OPTS) \ + DESTDIR="$(TARGET_DIR)" install +endef + +endif # End of BR2_PACKAGE_POLICYCOREUTILS_SANDBOX + +define POLICYCOREUTILS_BUILD_CMDS + $(MAKE) -C $(@D)/load_policy $(POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR="$(STAGING_DIR)" all + $(MAKE) -C $(@D)/newrole $(POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR="$(STAGING_DIR)" all + $(MAKE) -C $(@D)/run_init $(POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR="$(STAGING_DIR)" all + $(MAKE) -C $(@D)/secon $(POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR="$(STAGING_DIR)" all + $(MAKE) -C $(@D)/semodule $(POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR="$(STAGING_DIR)" all + $(MAKE) -C $(@D)/semodule_deps $(POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR="$(STAGING_DIR)" all + $(MAKE) -C $(@D)/semodule_expand $(POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR="$(STAGING_DIR)" all + $(MAKE) -C $(@D)/semodule_link $(POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR="$(STAGING_DIR)" all + $(MAKE) -C $(@D)/semodule_package $(POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR="$(STAGING_DIR)" all + $(MAKE) -C $(@D)/sepolgen-ifgen $(POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR="$(STAGING_DIR)" all
package/policycoreutils/policycoreutils.mk line 126
Quoted 10 lines
package/policycoreutils/policycoreutils.mk new file +10
-0+ $(MAKE) -C $(@D)/sestatus $(POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR="$(STAGING_DIR)" all + $(MAKE) -C $(@D)/setfiles $(POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR="$(STAGING_DIR)" all + $(MAKE) -C $(@D)/setsebool $(POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR="$(STAGING_DIR)" all + $(POLICYCOREUTILS_RESTORECOND_BUILD_CMDS) + $(POLICYCOREUTILS_MCSTRANS_BUILD_CMDS) + $(POLICYCOREUTILS_SANDBOX_BUILD_CMDS) +endef
Very repetitive, no? What about:
POLICYCOREUTILS_MAKE_DIRS = load_policy newrole run_init \ secon semodule semodule_deps semodule_expand semodule_link \ semodule_package sepolgen-ifgen sestatus setfiles setsebool
ifeq ($(BR2_PACKAGE_POLICYCOREUTILS_RESTORECOND),y) POLICYCOREUTILS_DEPENDENCIES += dbus-glib POLICYCOREUTILS_MAKE_DIRS + restorecond endif
ifeq ($(BR2_PACKAGE_POLICYCOREUTILS_MCSTRANS),y)POLICYCOREUTILS_DEPENDENCIES += pcre libcapPOLICYCOREUTILS_MAKE_DIRS + mcstrans
endif
... ditto for sandbox ...
and then:
define POLICYCOREUTILS_BUILD_CMDS
for dir in $(POLICYCOREUTILS_MAKE_DIRS) ; do \
$(MAKE) -C $(@D)/$${dir} $(POLICYCOREUTILS_MAKE_OPTS) DESTDIR=$(STAGING_DIR) all || exit 1 ; \
doneendef
define POLICYCOREUTILS_INSTALL_TARGET_CMDS
for dir in $(POLICYCOREUTILS_MAKE_DIRS) ; do \
$(MAKE) -C $(@D)/$${dir} $(POLICYCOREUTILS_MAKE_OPTS) DESTDIR=$(TARGET_DIR) install || exit 1 ; \
doneendef
Seems a bit smarter, no?
package/policycoreutils/policycoreutils.mk line 152
Quoted 1 line
package/policycoreutils/policycoreutils.mk new file +1
-0+HOST_POLICYCOREUTILS_DEPENDENCIES += host-libsemanage host-dbus-glib host-sepolgen host-setools
Why a += ?
Quoted 14 lines
package/policycoreutils/policycoreutils.mk new file +14
-0+ +# Undefining _FILE_OFFSET_BITS here because of a "bug" with glibc fts.h +# large file support. +# See https://bugzilla.redhat.com/show_bug.cgi?id=574992 for more information +HOST_POLICYCOREUTILS_MAKE_OPTS = \ + $(HOST_CONFIGURE_OPTS) \ + CFLAGS+="-U_FILE_OFFSET_BITS" \ + PYTHON="$(HOST_DIR)/usr/bin/python" + +ifeq ($(BR2_PACKAGE_PYTHON3),y) +HOST_POLICYCOREUTILS_DEPENDENCIES += host-python3 +HOST_POLICYCOREUTILS_MAKE_OPTS = \ + $(HOST_CONFIGURE_OPTS) \ + CFLAGS+="-U_FILE_OFFSET_BITS" \
package/policycoreutils/policycoreutils.mk line 176
Quoted 10 lines
package/policycoreutils/policycoreutils.mk new file +10
-0+ PYLIBVER="python$(PYTHON3_VERSION_MAJOR)" \ + PYTHON_SRC="$(BUILD_DIR)/host-python$(PYTHON3_VERSION)" +else +HOST_POLICYCOREUTILS_DEPENDENCIES += host-python +HOST_POLICYCOREUTILS_MAKE_OPTS = \ + $(HOST_CONFIGURE_OPTS) \ + CFLAGS+="-U_FILE_OFFSET_BITS" \ + PYLIBVER="python$(PYTHON_VERSION_MAJOR)" \ + PYTHON_SRC="$(BUILD_DIR)/host-python$(PYTHON_VERSION)" +endif
Why do you duplicate things?
Quoted 53 lines
package/policycoreutils/policycoreutils.mk new file +53
-0+# Note: We are only building the programs required by the refpolicy build +define HOST_POLICYCOREUTILS_BUILD_CMDS + $(MAKE) -C $(@D)/semodule $(HOST_POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR=$(HOST_DIR) + $(MAKE) -C $(@D)/semodule_package $(HOST_POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR=$(HOST_DIR) + $(MAKE) -C $(@D)/semodule_link $(HOST_POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR=$(HOST_DIR) + $(MAKE) -C $(@D)/semodule_expand $(HOST_POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR=$(HOST_DIR) + $(MAKE) -C $(@D)/semodule_deps $(HOST_POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR=$(HOST_DIR) + $(MAKE) -C $(@D)/load_policy $(HOST_POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR=$(HOST_DIR) + $(MAKE) -C $(@D)/setfiles $(HOST_POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR=$(HOST_DIR) + $(MAKE) -C $(@D)/restorecond $(HOST_POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR="$(HOST_DIR)" all + $(MAKE) -C $(@D)/audit2allow $(HOST_POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR="$(HOST_DIR)" all + $(MAKE) -C $(@D)/audit2why $(HOST_POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR="$(HOST_DIR)" all + $(MAKE) -C $(@D)/scripts $(HOST_POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR="$(HOST_DIR)" all + $(MAKE) -C $(@D)/semanage $(HOST_POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR="$(HOST_DIR)" all + $(MAKE) -C $(@D)/sepolicy $(HOST_POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR="$(HOST_DIR)" all +endef + +define HOST_POLICYCOREUTILS_INSTALL_CMDS + $(MAKE) -C $(@D)/semodule install $(HOST_POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR=$(HOST_DIR) + $(MAKE) -C $(@D)/semodule_package install $(HOST_POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR=$(HOST_DIR) + $(MAKE) -C $(@D)/semodule_link install $(HOST_POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR=$(HOST_DIR) + $(MAKE) -C $(@D)/semodule_expand install $(HOST_POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR=$(HOST_DIR) + $(MAKE) -C $(@D)/semodule_deps install $(HOST_POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR=$(HOST_DIR) + $(MAKE) -C $(@D)/load_policy install $(HOST_POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR=$(HOST_DIR) + $(MAKE) -C $(@D)/setfiles install $(HOST_POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR=$(HOST_DIR) + $(MAKE) -C $(@D)/restorecond install $(HOST_POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR=$(HOST_DIR) + $(MAKE) -C $(@D)/audit2allow install $(HOST_POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR=$(HOST_DIR) + $(MAKE) -C $(@D)/audit2why install $(HOST_POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR=$(HOST_DIR) + $(MAKE) -C $(@D)/scripts install $(HOST_POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR=$(HOST_DIR)
package/policycoreutils/policycoreutils.mk line 240
Quoted 10 lines
package/policycoreutils/policycoreutils.mk new file +10
-0+ $(MAKE) -C $(@D)/semanage install $(HOST_POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR=$(HOST_DIR) + $(MAKE) -C $(@D)/sepolicy install $(HOST_POLICYCOREUTILS_MAKE_OPTS) \ + DESTDIR=$(HOST_DIR) + # Fix python paths + $(SED) 's~/usr/bin/~$(HOST_DIR)/usr/bin/~g' $(HOST_DIR)/usr/bin/audit2allow + $(SED) 's~/usr/bin/~$(HOST_DIR)/usr/bin/~g' $(HOST_DIR)/usr/bin/audit2why + $(SED) 's~/usr/bin/~$(HOST_DIR)/usr/bin/~g' $(HOST_DIR)/usr/bin/sepolgen-ifgen + $(SED) 's~/usr/bin/~$(HOST_DIR)/usr/bin/~g' $(HOST_DIR)/usr/bin/sepolicy +endef
Same comment, please refactor.
package/policycoreutils/policycoreutils.mk line 243
Quoted 3 lines
package/policycoreutils/policycoreutils.mk new file +3
-0+ +$(eval $(generic-package)) +$(eval $(host-generic-package))
Thanks,
Thomas
Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons Embedded Linux, Kernel and Android engineering http://free-electrons.com
PATCH v4 7/27 python-pyxml: new package
In reply to Matt WeberFrom: Clayton Shotwell <[email protected]>
Signed-off-by Clayton Shotwell <[email protected]>
Signed-off-by Matthew Weber <[email protected]>
---
[Matt W:
- Updated to use python package type
- Added hash file
package/Config.in | 1 + package/python-pyxml/Config.in | 11 +++++++++++ package/python-pyxml/python-xml.hash | 2 ++ package/python-pyxml/python-xml.mk | 32 ++++++++++++++++++++++++++++++++ 4 files changed, 46 insertions(+) create mode 100644 package/python-pyxml/Config.in create mode 100644 package/python-pyxml/python-xml.hash create mode 100644 package/python-pyxml/python-xml.mk
package/Config.in +1 -0
@@ -538,6 +538,7 @@ menu "external python modules" source "package/python-pysnmp-apps/Config.in" source "package/python-pysnmp-mibs/Config.in" source "package/python-pyusb/Config.in" + source "package/python-pyxml/Config.in" source "package/python-pyzmq/Config.in" source "package/python-requests/Config.in" source "package/python-rtslib-fb/Config.in"
package/python-pyxml/Config.in new file +11 -0
@@ -0,0 +1,11 @@ +config BR2_PACKAGE_PYTHON_PYXML + bool "python-pyxml" + depends on BR2_PACKAGE_PYTHON + help + This is the Python XML package. The distribution contains a + validating XML parser, an implementation of the SAX and DOM + programming interfaces, an interface to the Expat parser (and the + Expat parser itself), and a C helper module that can speed up + xmllib.py by a factor of 5. There's even documentation! + + http://pyxml.sourceforge.net/topics/index.html
package/python-pyxml/python-xml.hash new file +2 -0
@@ -0,0 +1,2 @@ +#Locally computed +sha256 9fab66f9584fb8e67aebd8745a5c97bf1c5a2e2e461adf68862bcec64e448c13 PyXML-0.8.4.tar.gz
package/python-pyxml/python-xml.mk new file +32 -0
@@ -0,0 +1,32 @@ +################################################################################ +# +# python-pyxml +# +################################################################################ + +PYTHON_PYXML_VERSION = 0.8.4 +PYTHON_PYXML_SOURCE = PyXML-$(PYTHON_PYXML_VERSION).tar.gz +PYTHON_PYXML_SITE = http://downloads.sourceforge.net/project/pyxml/pyxml/0.8.4/ +PYTHON_PYXML_LICENSE = BSD-3c +PYTHON_PYXML_LICENSE_FILES = LICENSE +PYTHON_PYXML_SETUP_TYPE = distutils +PYTHON_PYXML_DEPENDENCIES = host-python python expat + +PYTHON_PYXML_INSTALL_STAGING = NO + +define PYTHON_PYXML_CONFIGURE_CMDS + (cd $(@D); \ + $(HOST_DIR)/usr/bin/python setup.py \ + config --with-libexpat=$(STAGING_DIR)/usr) +endef + +HOST_PYTHON_PYXML_DEPENDENCIES = host-python host-expat + +define HOST_PYTHON_PYXML_CONFIGURE_CMDS + (cd $(@D); \ + $(HOST_DIR)/usr/bin/python setup.py \ + config --with-libexpat=$(HOST_DIR)/usr) +endef + +$(eval $(python-package)) +$(eval $(host-python-package))
Signature · 1 line
1.9.1
PATCH v4 8/27 refpolicy: new package
In reply to Matt WeberFrom: Clayton Shotwell <[email protected]>
Signed-off-by Clayton Shotwell <[email protected]>
Signed-off-by Matt Weber <[email protected]>
---
[Matt W:
- Removed TODO and dependency on glibc
package/Config.in | 3 + package/refpolicy/0001-gentoo-hardened-fixes.patch | 1250 ++++++++++++++++++++ package/refpolicy/0002-awk-fix.patch | 37 + package/refpolicy/Config.in | 71 ++ package/refpolicy/S12selinux | 137 +++ package/refpolicy/config | 8 + package/refpolicy/modules.conf | 406 +++++++ package/refpolicy/refpolicy.hash | 2 + package/refpolicy/refpolicy.mk | 87 ++ 9 files changed, 2001 insertions(+) create mode 100644 package/refpolicy/0001-gentoo-hardened-fixes.patch create mode 100644 package/refpolicy/0002-awk-fix.patch create mode 100644 package/refpolicy/Config.in create mode 100644 package/refpolicy/S12selinux create mode 100644 package/refpolicy/config create mode 100644 package/refpolicy/modules.conf create mode 100644 package/refpolicy/refpolicy.hash create mode 100644 package/refpolicy/refpolicy.mk
package/Config.in +3 -0
@@ -1205,6 +1205,9 @@ menu "Security" menu "policycoreutils" source "package/policycoreutils/Config.in" endmenu +menu "refpolicy" + source "package/refpolicy/Config.in" +endmenu source "package/setools/Config.in" endmenu
package/refpolicy/0001-gentoo-hardened-fixes.patch new file +1250 -0
1,250 lines not on this page · raw message
package/refpolicy/0002-awk-fix.patch new file +37 -0
@@ -0,0 +1,37 @@ +Use AWK variable instead of the hardcoded awk + +The refpolicy build system uses some awk expressions that need GNU +awk, and not some other version of awk. Unfortunately, while the +Makefile nicely defines a AWK variable pointing to gawk by default, +there are several places where it hardcodes the usage of 'awk' without +the variable. This patch fixes those instances by using the AWK +vairable everywhere. + +Signed-off-by: Thomas Petazzoni <[email protected]> + +Index: refpolicy-2.20130424/Makefile +=================================================================== +--- refpolicy-2.20130424.orig/Makefile 2013-02-25 16:29:33.000000000 +0100 ++++ refpolicy-2.20130424/Makefile 2013-11-24 22:29:19.000000000 +0100 +@@ -292,9 +292,9 @@ + cmdline_off := $(addsuffix .te,$(APPS_OFF)) + + # extract settings from modules.conf +-mod_conf_base := $(addsuffix .te,$(sort $(shell awk '/^[[:blank:]]*[[:alpha:]]/{ if ($$3 == "$(configbase)") print $$1 }' $(mod_conf) 2> /dev/null))) +-mod_conf_mods := $(addsuffix .te,$(sort $(shell awk '/^[[:blank:]]*[[:alpha:]]/{ if ($$3 == "$(configmod)") print $$1 }' $(mod_conf) 2> /dev/null))) +-mod_conf_off := $(addsuffix .te,$(sort $(shell awk '/^[[:blank:]]*[[:alpha:]]/{ if ($$3 == "$(configoff)") print $$1 }' $(mod_conf) 2> /dev/null))) ++mod_conf_base := $(addsuffix .te,$(sort $(shell $(AWK) '/^[[:blank:]]*[[:alpha:]]/{ if ($$3 == "$(configbase)") print $$1 }' $(mod_conf) 2> /dev/null))) ++mod_conf_mods := $(addsuffix .te,$(sort $(shell $(AWK) '/^[[:blank:]]*[[:alpha:]]/{ if ($$3 == "$(configmod)") print $$1 }' $(mod_conf) 2> /dev/null))) ++mod_conf_off := $(addsuffix .te,$(sort $(shell $(AWK) '/^[[:blank:]]*[[:alpha:]]/{ if ($$3 == "$(configoff)") print $$1 }' $(mod_conf) 2> /dev/null))) + + base_mods := $(cmdline_base) + mod_mods := $(cmdline_mods) +@@ -308,7 +308,7 @@ + off_mods += $(filter-out $(base_mods) $(mod_mods) $(off_mods),$(notdir $(detected_mods))) + + # filesystems to be used in labeling targets +-filesystems = $(shell mount | grep -v "context=" | egrep -v '\((|.*,)bind(,.*|)\)' | awk '/(ext[234]|btrfs| xfs| jfs).*rw/{print $$3}';) ++filesystems = $(shell mount | grep -v "context=" | egrep -v '\((|.*,)bind(,.*|)\)' | $(AWK) '/(ext[234]|btrfs| xfs| jfs).*rw/{print $$3}';) + fs_names := "btrfs ext2 ext3 ext4 xfs jfs" + + ########################################
package/refpolicy/Config.in new file +71 -0
71 lines not on this page · raw message
package/refpolicy/S12selinux new file +137 -0
137 lines not on this page · raw message
package/refpolicy/config new file +8 -0
@@ -0,0 +1,8 @@ +# This file controls the state of SELinux on the system. +# SELINUX= can take one of these three values: +# enforcing - SELinux security policy is enforced. +# permissive - SELinux prints warnings instead of enforcing. +# disabled - No SELinux policy is loaded. +SELINUX=permissive +# SELINUXTYPE= name of the selinux policy to use +SELINUXTYPE=refpolicy
package/refpolicy/modules.conf new file +406 -0
406 lines not on this page · raw message
package/refpolicy/refpolicy.hash new file +2 -0
@@ -0,0 +1,2 @@ +#Locally computed +sha256 6039ba854f244a39dc727cc7db25632f7b933bb271c803772d754d4354f5aef4 refpolicy-2.20130424.tar.bz2
package/refpolicy/refpolicy.mk new file +87 -0
87 lines not on this page · raw message
Signature · 1 line
1.9.1
PATCH v4 9/27 repolicy: base policy modifications for embedded target
In reply to Matt WeberSigned-off-by Matthew Weber <[email protected]>
---
[Matt W:
- Cleaned up headers
package/refpolicy/0002-baseDirectoryChanges.patch | 32 ++++++++
package/refpolicy/0003-filesChanges.patch | 62 ++++++++++++++
package/refpolicy/0004-initChanges.patch | 20 +++++
package/refpolicy/0005-selinuxutilChanges.patch | 96 ++++++++++++++++++++++
package/refpolicy/0006-sshChanges.patch | 22 +++++
package/refpolicy/0007-loggingChanges.patch | 80 ++++++++++++++++++
package/refpolicy/0008-mountChanges.patch | 11 +++
package/refpolicy/0009-sysadmChanges.patch | 24 ++++++
package/refpolicy/0010-authloginChanges.patch | 14 ++++
package/refpolicy/0011-localloginChanges.patch | 13 +++
package/refpolicy/0012-udevChanges.patch | 14 ++++
package/refpolicy/0013-netutilsChanges.patch | 13 +++
package/refpolicy/0014-devicesChanges.patch | 48 +++++++++++
.../{0002-awk-fix.patch => 0015-awk-fix.patch} | 0
.../refpolicy/0016-enablePolyinstantiation.patch | 11 +++
15 files changed, 460 insertions(+)
create mode 100644 package/refpolicy/0002-baseDirectoryChanges.patch
create mode 100644 package/refpolicy/0003-filesChanges.patch
create mode 100644 package/refpolicy/0004-initChanges.patch
create mode 100644 package/refpolicy/0005-selinuxutilChanges.patch
create mode 100644 package/refpolicy/0006-sshChanges.patch
create mode 100644 package/refpolicy/0007-loggingChanges.patch
create mode 100644 package/refpolicy/0008-mountChanges.patch
create mode 100644 package/refpolicy/0009-sysadmChanges.patch
create mode 100644 package/refpolicy/0010-authloginChanges.patch
create mode 100644 package/refpolicy/0011-localloginChanges.patch
create mode 100644 package/refpolicy/0012-udevChanges.patch
create mode 100644 package/refpolicy/0013-netutilsChanges.patch
create mode 100644 package/refpolicy/0014-devicesChanges.patch
rename package/refpolicy/{0002-awk-fix.patch => 0015-awk-fix.patch} (100%)
create mode 100644 package/refpolicy/0016-enablePolyinstantiation.patchpackage/refpolicy/0002-baseDirectoryChanges.patch new file +32 -0
@@ -0,0 +1,32 @@ +################################################################################ +# Copyright 2012-2015, Rockwell Collins. All rights reserved. +################################################################################ +# +# Making changes for base folders in our build. +# +# /data - usr_t +# /apps - usr_t +# /lib64 - lib_t +# +diff -urN output/build/refpolicy-2.20120725/policy/modules/kernel/files.fc output/build/refpolicy-2.20120725-changes/policy/modules/kernel/files.fc +diff -urN output/build/refpolicy-2.20120725/policy/modules/system/libraries.fc output/build/refpolicy-2.20120725-changes/policy/modules/system/libraries.fc +--- a/policy/modules/system/libraries.fc 2012-05-10 09:26:34.000000000 -0500 ++++ b/policy/modules/system/libraries.fc 2012-09-06 12:52:25.000000000 -0500 +@@ -36,6 +36,7 @@ + # /lib(64)? + # + /lib -d gen_context(system_u:object_r:lib_t,s0) ++/lib64 -l gen_context(system_u:object_r:lib_t,s0) + /lib/.* gen_context(system_u:object_r:lib_t,s0) + /lib/ld-[^/]*\.so(\.[^/]*)* -- gen_context(system_u:object_r:ld_so_t,s0) + +--- a/policy/modules/system/sysnetwork.fc 2012-09-11 08:28:21.954620259 -0500 ++++ b/policy/modules/system/sysnetwork.fc 2012-09-11 08:28:32.133742548 -0500 +@@ -24,6 +24,7 @@ + /etc/hosts\.deny.* -- gen_context(system_u:object_r:net_conf_t,s0) + /etc/denyhosts.* -- gen_context(system_u:object_r:net_conf_t,s0) + /etc/resolv\.conf.* -- gen_context(system_u:object_r:net_conf_t,s0) ++/tmp/resolv\.conf.* -- gen_context(system_u:object_r:net_conf_t,s0) + /etc/yp\.conf.* -- gen_context(system_u:object_r:net_conf_t,s0) + + /etc/dhcp3(/.*)? gen_context(system_u:object_r:dhcp_etc_t,s0)
package/refpolicy/0003-filesChanges.patch new file +62 -0
62 lines not on this page · raw message
package/refpolicy/0004-initChanges.patch new file +20 -0
@@ -0,0 +1,20 @@ +--- a/policy/modules/system/init.te 2012-07-25 13:33:04.000000000 -0500 ++++ b/policy/modules/system/init.te 2012-09-07 09:41:21.000000000 -0500 +@@ -96,6 +96,7 @@ + + # Use capabilities. old rule: + allow init_t self:capability ~sys_module; ++allow init_t self:capability2 syslog; + # is ~sys_module really needed? observed: + # sys_boot + # sys_tty_config +--- a/policy/modules/system/init.fc 2012-05-10 09:18:41.000000000 -0500 ++++ b/policy/modules/system/init.fc 2012-09-07 15:15:31.000000000 -0500 +@@ -58,6 +58,7 @@ + # /var + # + /var/run/utmp -- gen_context(system_u:object_r:initrc_var_run_t,s0) ++/tmp/utmp -- gen_context(system_u:object_r:initrc_var_run_t,s0) + /var/run/runlevel\.dir gen_context(system_u:object_r:initrc_var_run_t,s0) + /var/run/random-seed -- gen_context(system_u:object_r:initrc_var_run_t,s0) + /var/run/setmixer_flag -- gen_context(system_u:object_r:initrc_var_run_t,s0)
package/refpolicy/0005-selinuxutilChanges.patch new file +96 -0
96 lines not on this page · raw message
package/refpolicy/0006-sshChanges.patch new file +22 -0
@@ -0,0 +1,22 @@ +--- a/policy/modules/services/ssh.te 2012-03-30 07:48:20.000000000 -0500 ++++ b/policy/modules/services/ssh.te 2012-09-07 15:37:30.000000000 -0500 +@@ -10,7 +10,7 @@ + ## allow host key based authentication + ## </p> + ## </desc> +-gen_tunable(allow_ssh_keysign, false) ++gen_tunable(allow_ssh_keysign, true) + + ## <desc> + ## <p> +@@ -233,6 +233,10 @@ + manage_sock_files_pattern(sshd_t, sshd_tmp_t, sshd_tmp_t) + files_tmp_filetrans(sshd_t, sshd_tmp_t, { dir file sock_file }) + ++logging_send_syslog_msg(sshd_t) ++ ++init_manage_utmp(sshd_t) ++ + kernel_search_key(sshd_t) + kernel_link_key(sshd_t) +
package/refpolicy/0007-loggingChanges.patch new file +80 -0
80 lines not on this page · raw message
package/refpolicy/0008-mountChanges.patch new file +11 -0
@@ -0,0 +1,11 @@ +--- a/policy/modules/system/mount.te 2012-07-25 13:33:04.000000000 -0500 ++++ b/policy/modules/system/mount.te 2012-09-17 09:14:29.000000000 -0500 +@@ -92,7 +92,7 @@ + files_dontaudit_write_all_mountpoints(mount_t) + files_dontaudit_setattr_all_mountpoints(mount_t) + +-fs_getattr_xattr_fs(mount_t) ++fs_getattr_all_fs(mount_t) + fs_getattr_cifs(mount_t) + fs_mount_all_fs(mount_t) + fs_unmount_all_fs(mount_t)
package/refpolicy/0009-sysadmChanges.patch new file +24 -0
@@ -0,0 +1,24 @@ +--- a/policy/modules/roles/sysadm.te 2012-07-25 13:33:05.000000000 -0500 ++++ b/policy/modules/roles/sysadm.te 2012-09-18 15:27:15.000000000 -0500 +@@ -39,6 +39,10 @@ + userdom_manage_user_home_dirs(sysadm_t) + userdom_home_filetrans_user_home_dir(sysadm_t) + ++# Add blk and chr files for dataloading ++files_manage_isid_type_blk_files(sysadm_t) ++files_manage_isid_type_chr_files(sysadm_t) ++ + ifdef(`direct_sysadm_daemon',` + optional_policy(` + init_run_daemon(sysadm_t, sysadm_r) +@@ -270,6 +274,10 @@ + ') + + optional_policy(` ++ ppp_run(sysadm_t, sysadm_r) ++') ++ ++optional_policy(` + pyzor_role(sysadm_r, sysadm_t) + ') +
package/refpolicy/0010-authloginChanges.patch new file +14 -0
@@ -0,0 +1,14 @@ +--- a/policy/modules/system/authlogin.te 2012-07-25 13:33:04.000000000 -0500 ++++ b/policy/modules/system/authlogin.te 2012-09-18 07:11:17.000000000 -0500 +@@ -109,8 +109,10 @@ + files_read_etc_files(chkpwd_t) + # for nscd + files_dontaudit_search_var(chkpwd_t) ++files_dontaudit_search_tmp(chkpwd_t) ++dev_dontaudit_search_sysfs(chkpwd_t) + +-fs_dontaudit_getattr_xattr_fs(chkpwd_t) ++fs_dontaudit_getattr_all_fs(chkpwd_t) + + term_dontaudit_use_console(chkpwd_t) + term_dontaudit_use_unallocated_ttys(chkpwd_t)
package/refpolicy/0011-localloginChanges.patch new file +13 -0
@@ -0,0 +1,13 @@ +################################################################################ +# Copyright 2012-2015, Rockwell Collins. All rights reserved. +################################################################################ +--- a/policy/modules/system/locallogin.te 2012-05-04 08:14:47.000000000 -0500 ++++ b/policy/modules/system/locallogin.te 2012-10-18 08:38:32.000000000 -0500 +@@ -86,6 +86,7 @@ + dev_dontaudit_setattr_misc_dev(local_login_t) + dev_dontaudit_getattr_scanner_dev(local_login_t) + dev_dontaudit_setattr_scanner_dev(local_login_t) ++dev_dontaudit_getattr_sysfs_fs(local_login_t) + dev_dontaudit_search_sysfs(local_login_t) + dev_dontaudit_getattr_video_dev(local_login_t) + dev_dontaudit_setattr_video_dev(local_login_t)
package/refpolicy/0012-udevChanges.patch new file +14 -0
@@ -0,0 +1,14 @@ +################################################################################ +# Copyright 2012-2015, Rockwell Collins. All rights reserved. +################################################################################ +--- a/policy/modules/system/udev.fc 2012-05-04 08:14:47.000000000 -0500 ++++ b/policy/modules/system/udev.fc 2012-10-17 15:02:24.000000000 -0500 +@@ -29,7 +29,7 @@ + /usr/bin/udevinfo -- gen_context(system_u:object_r:udev_exec_t,s0) + + /var/run/PackageKit/udev(/.*)? gen_context(system_u:object_r:udev_var_run_t,s0) +-/var/run/udev(/.*)? gen_context(system_u:object_r:udev_tbl_t,s0) ++/tmp/udev(/.*)? gen_context(system_u:object_r:udev_var_run_t,s0) + + ifdef(`distro_debian',` + /var/run/xen-hotplug -d gen_context(system_u:object_r:udev_var_run_t,s0)
package/refpolicy/0013-netutilsChanges.patch new file +13 -0
@@ -0,0 +1,13 @@ +################################################################################ +# Copyright 2012-2015, Rockwell Collins. All rights reserved. +################################################################################ +--- a/policy/modules/admin/netutils.te 2012-05-04 08:14:47.000000000 -0500 ++++ b/policy/modules/admin/netutils.te 2012-10-18 07:25:25.000000000 -0500 +@@ -105,6 +105,7 @@ + + allow ping_t self:capability { setuid net_raw }; + dontaudit ping_t self:capability sys_tty_config; ++allow ping_t self:process { getcap setcap }; + allow ping_t self:tcp_socket create_socket_perms; + allow ping_t self:rawip_socket { create ioctl read write bind getopt setopt }; + allow ping_t self:packet_socket { create ioctl read write bind getopt setopt };
package/refpolicy/0014-devicesChanges.patch new file +48 -0
48 lines not on this page · raw message
package/refpolicy/0015-awk-fix.patch renamed from package/refpolicy/0002-awk-fix.patch +0 -0
package/refpolicy/0016-enablePolyinstantiation.patch new file +11 -0
@@ -0,0 +1,11 @@ +--- a/policy/global_tunables 2012-03-30 07:48:20.000000000 -0500 ++++ b/policy/global_tunables 2012-09-13 09:31:38.000000000 -0500 +@@ -37,7 +37,7 @@ + ## Enable polyinstantiated directory support. + ## </p> + ## </desc> +-gen_tunable(allow_polyinstantiation,false) ++gen_tunable(allow_polyinstantiation,true) + + ## <desc> + ## <p>
Signature · 1 line
1.9.1
PATCH v4 9/27 repolicy: base policy modifications for embedded target
Dear Matt Weber,
So lots of patches doing weird stuff, no description in any of patches, and no commit log at all. Please explain what's going on here, and why we would want to have all this stuff in Buildroot.
Thanks,
Thomas
Quoted 585 lines · Matt Weber
Signed-off-by Matthew Weber <[email protected]>---
[Matt W:
- Cleaned up headerspackage/refpolicy/0002-baseDirectoryChanges.patch | 32 ++++++++ package/refpolicy/0003-filesChanges.patch | 62 ++++++++++++++ package/refpolicy/0004-initChanges.patch | 20 +++++ package/refpolicy/0005-selinuxutilChanges.patch | 96 ++++++++++++++++++++++ package/refpolicy/0006-sshChanges.patch | 22 +++++ package/refpolicy/0007-loggingChanges.patch | 80 ++++++++++++++++++ package/refpolicy/0008-mountChanges.patch | 11 +++ package/refpolicy/0009-sysadmChanges.patch | 24 ++++++ package/refpolicy/0010-authloginChanges.patch | 14 ++++ package/refpolicy/0011-localloginChanges.patch | 13 +++ package/refpolicy/0012-udevChanges.patch | 14 ++++ package/refpolicy/0013-netutilsChanges.patch | 13 +++ package/refpolicy/0014-devicesChanges.patch | 48 +++++++++++ .../{0002-awk-fix.patch => 0015-awk-fix.patch} | 0 .../refpolicy/0016-enablePolyinstantiation.patch | 11 +++ 15 files changed, 460 insertions(+) create mode 100644 package/refpolicy/0002-baseDirectoryChanges.patch create mode 100644 package/refpolicy/0003-filesChanges.patch create mode 100644 package/refpolicy/0004-initChanges.patch create mode 100644 package/refpolicy/0005-selinuxutilChanges.patch create mode 100644 package/refpolicy/0006-sshChanges.patch create mode 100644 package/refpolicy/0007-loggingChanges.patch create mode 100644 package/refpolicy/0008-mountChanges.patch create mode 100644 package/refpolicy/0009-sysadmChanges.patch create mode 100644 package/refpolicy/0010-authloginChanges.patch create mode 100644 package/refpolicy/0011-localloginChanges.patch create mode 100644 package/refpolicy/0012-udevChanges.patch create mode 100644 package/refpolicy/0013-netutilsChanges.patch create mode 100644 package/refpolicy/0014-devicesChanges.patch rename package/refpolicy/{0002-awk-fix.patch => 0015-awk-fix.patch} (100%) create mode 100644 package/refpolicy/0016-enablePolyinstantiation.patchpackage/refpolicy/0002-baseDirectoryChanges.patch new file +32
-0@@ -0,0 +1,32 @@ +################################################################################ +# Copyright 2012-2015, Rockwell Collins. All rights reserved. +################################################################################ +# +# Making changes for base folders in our build. +# +# /data - usr_t +# /apps - usr_t +# /lib64 - lib_t +# +diff -urN output/build/refpolicy-2.20120725/policy/modules/kernel/files.fc output/build/refpolicy-2.20120725-changes/policy/modules/kernel/files.fc +diff -urN output/build/refpolicy-2.20120725/policy/modules/system/libraries.fc output/build/refpolicy-2.20120725-changes/policy/modules/system/libraries.fc +--- a/policy/modules/system/libraries.fc 2012-05-10 09:26:34.000000000 -0500 ++++ b/policy/modules/system/libraries.fc 2012-09-06 12:52:25.000000000 -0500 +@@ -36,6 +36,7 @@ + # /lib(64)? + # + /lib -d gen_context(system_u:object_r:lib_t,s0) ++/lib64 -l gen_context(system_u:object_r:lib_t,s0) + /lib/.* gen_context(system_u:object_r:lib_t,s0) + /lib/ld-[^/]*\.so(\.[^/]*)* -- gen_context(system_u:object_r:ld_so_t,s0) + +--- a/policy/modules/system/sysnetwork.fc 2012-09-11 08:28:21.954620259 -0500 ++++ b/policy/modules/system/sysnetwork.fc 2012-09-11 08:28:32.133742548 -0500 +@@ -24,6 +24,7 @@ + /etc/hosts\.deny.* -- gen_context(system_u:object_r:net_conf_t,s0) + /etc/denyhosts.* -- gen_context(system_u:object_r:net_conf_t,s0) + /etc/resolv\.conf.* -- gen_context(system_u:object_r:net_conf_t,s0) ++/tmp/resolv\.conf.* -- gen_context(system_u:object_r:net_conf_t,s0) + /etc/yp\.conf.* -- gen_context(system_u:object_r:net_conf_t,s0) + + /etc/dhcp3(/.*)? gen_context(system_u:object_r:dhcp_etc_t,s0)package/refpolicy/0003-filesChanges.patch new file +62
-0@@ -0,0 +1,62 @@ +################################################################################ +# Copyright 2012-2015, Rockwell Collins. All rights reserved. +################################################################################ +--- a/policy/modules/kernel/files.fc 2012-06-26 08:46:32.000000000 -0500 ++++ b/policy/modules/kernel/files.fc 2012-10-17 15:28:41.000000000 -0500 +@@ -36,6 +36,11 @@ + /boot/System\.map(-.*)? -- gen_context(system_u:object_r:system_map_t,s0) + + # ++# /data ++# ++/data -d gen_context(system_u:object_r:usr_t,s0) ++ ++# + # /emul + # + /emul -d gen_context(system_u:object_r:usr_t,s0) +@@ -48,6 +53,7 @@ + /etc/.* gen_context(system_u:object_r:etc_t,s0) + /etc/\.fstab\.hal\..+ -- gen_context(system_u:object_r:etc_runtime_t,s0) + /etc/blkid(/.*)? gen_context(system_u:object_r:etc_runtime_t,s0) ++/etc/blkid.tab(.*)? -- gen_context(system_u:object_r:etc_runtime_t,s0) + /etc/cmtab -- gen_context(system_u:object_r:etc_runtime_t,s0) + /etc/fstab\.REVOKE -- gen_context(system_u:object_r:etc_runtime_t,s0) + /etc/ioctl\.save -- gen_context(system_u:object_r:etc_runtime_t,s0) +@@ -164,7 +170,7 @@ + # + # /run + # +-/run -d gen_context(system_u:object_r:var_run_t,s0-mls_systemhigh) ++/run -l gen_context(system_u:object_r:var_run_t,s0-mls_systemhigh) + /run/.* gen_context(system_u:object_r:var_run_t,s0) + /run/.*\.*pid <<none>> + /run/lock(/.*)? gen_context(system_u:object_r:var_lock_t,s0) +--- a/policy/modules/kernel/files.if 2012-07-24 07:48:06.000000000 -0500 ++++ b/policy/modules/kernel/files.if 2012-10-17 15:14:13.000000000 -0500 +@@ -6264,6 +6264,25 @@ + + ######################################## + ## <summary> ++## Read the contents of generic spool ++## symlinks (/var/spool). ++## </summary> ++## <param name="domain"> ++## <summary> ++## Domain allowed access. ++## </summary> ++## </param> ++# ++interface(`files_read_spool_lnk',` ++ gen_require(` ++ type var_t, var_spool_t; ++ ') ++ ++ read_lnk_files_pattern($1, var_t, var_spool_t) ++') ++ ++######################################## ++## <summary> + ## Do not audit attempts to search generic + ## spool directories. + ## </summary>package/refpolicy/0004-initChanges.patch new file +20
-0@@ -0,0 +1,20 @@ +--- a/policy/modules/system/init.te 2012-07-25 13:33:04.000000000 -0500 ++++ b/policy/modules/system/init.te 2012-09-07 09:41:21.000000000 -0500 +@@ -96,6 +96,7 @@ + + # Use capabilities. old rule: + allow init_t self:capability ~sys_module; ++allow init_t self:capability2 syslog; + # is ~sys_module really needed? observed: + # sys_boot + # sys_tty_config +--- a/policy/modules/system/init.fc 2012-05-10 09:18:41.000000000 -0500 ++++ b/policy/modules/system/init.fc 2012-09-07 15:15:31.000000000 -0500 +@@ -58,6 +58,7 @@ + # /var + # + /var/run/utmp -- gen_context(system_u:object_r:initrc_var_run_t,s0) ++/tmp/utmp -- gen_context(system_u:object_r:initrc_var_run_t,s0) + /var/run/runlevel\.dir gen_context(system_u:object_r:initrc_var_run_t,s0) + /var/run/random-seed -- gen_context(system_u:object_r:initrc_var_run_t,s0) + /var/run/setmixer_flag -- gen_context(system_u:object_r:initrc_var_run_t,s0)package/refpolicy/0005-selinuxutilChanges.patch new file +96
-0@@ -0,0 +1,96 @@ +################################################################################ +# Copyright 2012-2015, Rockwell Collins. All rights reserved. +################################################################################ +--- a/policy/modules/system/selinuxutil.fc 2012-05-10 09:27:24.000000000 -0500 ++++ b/policy/modules/system/selinuxutil.fc 2012-10-17 13:42:40.961227129 -0500 +@@ -51,3 +51,4 @@ + # /var/run + # + /var/run/restorecond\.pid -- gen_context(system_u:object_r:restorecond_var_run_t,s0) ++/tmp/restorecond\.pid -- gen_context(system_u:object_r:restorecond_var_run_t,s0) +--- a/policy/modules/system/selinuxutil.te 2012-07-25 13:33:04.000000000 -0500 ++++ b/policy/modules/system/selinuxutil.te 2012-10-17 15:14:28.000000000 -0500 +@@ -144,7 +144,7 @@ + # directory search permissions for path to source and binary policy files + files_search_etc(checkpolicy_t) + +-fs_getattr_xattr_fs(checkpolicy_t) ++fs_getattr_all_fs(checkpolicy_t) + + term_use_console(checkpolicy_t) + +@@ -176,7 +176,7 @@ + files_read_etc_files(load_policy_t) + files_read_etc_runtime_files(load_policy_t) + +-fs_getattr_xattr_fs(load_policy_t) ++fs_getattr_all_fs(load_policy_t) + + mls_file_read_all_levels(load_policy_t) + +@@ -244,6 +244,7 @@ + corecmd_read_bin_symlinks(newrole_t) + + dev_read_urand(newrole_t) ++dev_search_sysfs(newrole_t) + + domain_use_interactive_fds(newrole_t) + # for when the user types "exec newrole" at the command line: +@@ -253,7 +254,7 @@ + files_read_var_files(newrole_t) + files_read_var_symlinks(newrole_t) + +-fs_getattr_xattr_fs(newrole_t) ++fs_getattr_all_fs(newrole_t) + fs_search_auto_mountpoints(newrole_t) + + mls_file_read_all_levels(newrole_t) +@@ -323,6 +324,7 @@ + + allow restorecond_t restorecond_var_run_t:file manage_file_perms; + files_pid_filetrans(restorecond_t, restorecond_var_run_t, file) ++files_tmp_filetrans(restorecond_t, restorecond_var_run_t, file) + + kernel_use_fds(restorecond_t) + kernel_rw_pipes(restorecond_t) +@@ -330,7 +332,7 @@ + + fs_relabelfrom_noxattr_fs(restorecond_t) + fs_dontaudit_list_nfs(restorecond_t) +-fs_getattr_xattr_fs(restorecond_t) ++fs_getattr_all_fs(restorecond_t) + fs_list_inotifyfs(restorecond_t) + + selinux_validate_context(restorecond_t) +@@ -388,7 +390,7 @@ + files_read_etc_files(run_init_t) + files_dontaudit_search_all_dirs(run_init_t) + +-fs_getattr_xattr_fs(run_init_t) ++fs_getattr_all_fs(run_init_t) + + mls_rangetrans_source(run_init_t) + +@@ -543,6 +545,13 @@ + kernel_dontaudit_list_all_sysctls(setfiles_t) + + dev_relabel_all_dev_nodes(setfiles_t) ++dev_search_sysfs(setfiles_t) ++ ++# Need to be able to write to /dev/console before it is relabeled ++dev_rw_generic_chr_files(setfiles_t) ++ ++# Need for the /var/spool symlink configuration ++files_read_spool_lnk(setfiles_t); + + domain_use_interactive_fds(setfiles_t) + domain_dontaudit_search_all_domains_state(setfiles_t) +@@ -553,7 +562,7 @@ + files_relabel_all_files(setfiles_t) + files_read_usr_symlinks(setfiles_t) + +-fs_getattr_xattr_fs(setfiles_t) ++fs_getattr_all_fs(setfiles_t) + fs_list_all(setfiles_t) + fs_search_auto_mountpoints(setfiles_t) + fs_relabelfrom_noxattr_fs(setfiles_t)package/refpolicy/0006-sshChanges.patch new file +22
-0@@ -0,0 +1,22 @@ +--- a/policy/modules/services/ssh.te 2012-03-30 07:48:20.000000000 -0500 ++++ b/policy/modules/services/ssh.te 2012-09-07 15:37:30.000000000 -0500 +@@ -10,7 +10,7 @@ + ## allow host key based authentication + ## </p> + ## </desc> +-gen_tunable(allow_ssh_keysign, false) ++gen_tunable(allow_ssh_keysign, true) + + ## <desc> + ## <p> +@@ -233,6 +233,10 @@ + manage_sock_files_pattern(sshd_t, sshd_tmp_t, sshd_tmp_t) + files_tmp_filetrans(sshd_t, sshd_tmp_t, { dir file sock_file }) + ++logging_send_syslog_msg(sshd_t) ++ ++init_manage_utmp(sshd_t) ++ + kernel_search_key(sshd_t) + kernel_link_key(sshd_t) +package/refpolicy/0007-loggingChanges.patch new file +80
-0@@ -0,0 +1,80 @@ +################################################################################ +# Copyright 2012-2015, Rockwell Collins. All rights reserved. +################################################################################ +--- a/policy/modules/system/logging.fc 2012-05-04 08:14:47.000000000 -0500 ++++ b/policy/modules/system/logging.fc 2012-10-16 08:44:24.000000000 -0500 +@@ -56,21 +56,21 @@ + /var/named/chroot/dev/log -s gen_context(system_u:object_r:devlog_t,s0) + ') + +-/var/run/audit_events -s gen_context(system_u:object_r:auditd_var_run_t,mls_systemhigh) +-/var/run/audispd_events -s gen_context(system_u:object_r:audisp_var_run_t,mls_systemhigh) +-/var/run/auditd\.pid -- gen_context(system_u:object_r:auditd_var_run_t,mls_systemhigh) +-/var/run/auditd_sock -s gen_context(system_u:object_r:auditd_var_run_t,mls_systemhigh) +-/var/run/klogd\.pid -- gen_context(system_u:object_r:klogd_var_run_t,s0) +-/var/run/log -s gen_context(system_u:object_r:devlog_t,s0) +-/var/run/metalog\.pid -- gen_context(system_u:object_r:syslogd_var_run_t,s0) +-/var/run/syslogd\.pid -- gen_context(system_u:object_r:syslogd_var_run_t,mls_systemhigh) +-/var/run/syslog-ng.ctl -- gen_context(system_u:object_r:syslogd_var_run_t,s0) +-/var/run/syslog-ng(/.*)? gen_context(system_u:object_r:syslogd_var_run_t,s0) ++/tmp/audit_events -s gen_context(system_u:object_r:auditd_var_run_t,mls_systemhigh) ++/tmp/audispd_events -s gen_context(system_u:object_r:audisp_var_run_t,mls_systemhigh) ++/tmp/auditd\.pid -- gen_context(system_u:object_r:auditd_var_run_t,mls_systemhigh) ++/tmp/auditd_sock -s gen_context(system_u:object_r:auditd_var_run_t,mls_systemhigh) ++/tmp/klogd\.pid -- gen_context(system_u:object_r:klogd_tmp_t,s0) ++/tmp/log -s gen_context(system_u:object_r:devlog_t,s0) ++/tmp/metalog\.pid -- gen_context(system_u:object_r:syslogd_tmp_t,s0) ++/tmp/syslogd\.pid -- gen_context(system_u:object_r:syslogd_tmp_t,mls_systemhigh) ++/tmp/syslog-ng.ctl -- gen_context(system_u:object_r:syslogd_tmp_t,s0) ++/tmp/syslog-ng(/.*)? gen_context(system_u:object_r:syslogd_tmp_t,s0) + +-/var/spool/audit(/.*)? gen_context(system_u:object_r:audit_spool_t,mls_systemhigh) +-/var/spool/bacula/log(/.*)? gen_context(system_u:object_r:var_log_t,s0) +-/var/spool/postfix/pid -d gen_context(system_u:object_r:var_run_t,s0) +-/var/spool/plymouth/boot\.log gen_context(system_u:object_r:var_log_t,mls_systemhigh) +-/var/spool/rsyslog(/.*)? gen_context(system_u:object_r:var_log_t,s0) ++/tmp/audit(/.*)? gen_context(system_u:object_r:audit_spool_t,mls_systemhigh) ++/tmp/bacula/log(/.*)? gen_context(system_u:object_r:var_log_t,s0) ++/tmp/postfix/pid -d gen_context(system_u:object_r:var_run_t,s0) ++/tmp/plymouth/boot\.log gen_context(system_u:object_r:var_log_t,mls_systemhigh) ++/tmp/rsyslog(/.*)? gen_context(system_u:object_r:var_log_t,s0) + + /var/tinydns/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0) +--- a/policy/modules/system/logging.te 2012-07-25 13:33:04.000000000 -0500 ++++ b/policy/modules/system/logging.te 2012-09-18 08:25:54.000000000 -0500 +@@ -50,7 +50,7 @@ + + type klogd_t; + type klogd_exec_t; +-init_daemon_domain(klogd_t, klogd_exec_t) ++init_domain(klogd_t, klogd_exec_t) + + type klogd_tmp_t; + files_tmp_file(klogd_tmp_t) +@@ -63,7 +63,7 @@ + + type syslogd_t; + type syslogd_exec_t; +-init_daemon_domain(syslogd_t, syslogd_exec_t) ++init_domain(syslogd_t, syslogd_exec_t) + + type syslogd_initrc_exec_t; + init_script_file(syslogd_initrc_exec_t) +@@ -97,6 +97,9 @@ + read_files_pattern(auditctl_t, auditd_etc_t, auditd_etc_t) + allow auditctl_t auditd_etc_t:dir list_dir_perms; + ++# Need for the /var/spool symlink configuration ++files_read_spool_lnk(auditctl_t); ++ + # Needed for adding watches + files_getattr_all_dirs(auditctl_t) + files_getattr_all_files(auditctl_t) +@@ -143,6 +146,7 @@ + manage_files_pattern(auditd_t, auditd_var_run_t, auditd_var_run_t) + manage_sock_files_pattern(auditd_t, auditd_var_run_t, auditd_var_run_t) + files_pid_filetrans(auditd_t, auditd_var_run_t, { file sock_file }) ++files_tmp_filetrans(auditd_t, auditd_var_run_t, { file sock_file }) + + kernel_read_kernel_sysctls(auditd_t) + # Needs to be able to run dispatcher. see /etc/audit/auditd.confpackage/refpolicy/0008-mountChanges.patch new file +11
-0@@ -0,0 +1,11 @@ +--- a/policy/modules/system/mount.te 2012-07-25 13:33:04.000000000 -0500 ++++ b/policy/modules/system/mount.te 2012-09-17 09:14:29.000000000 -0500 +@@ -92,7 +92,7 @@ + files_dontaudit_write_all_mountpoints(mount_t) + files_dontaudit_setattr_all_mountpoints(mount_t) + +-fs_getattr_xattr_fs(mount_t) ++fs_getattr_all_fs(mount_t) + fs_getattr_cifs(mount_t) + fs_mount_all_fs(mount_t) + fs_unmount_all_fs(mount_t)package/refpolicy/0009-sysadmChanges.patch new file +24
-0@@ -0,0 +1,24 @@ +--- a/policy/modules/roles/sysadm.te 2012-07-25 13:33:05.000000000 -0500 ++++ b/policy/modules/roles/sysadm.te 2012-09-18 15:27:15.000000000 -0500 +@@ -39,6 +39,10 @@ + userdom_manage_user_home_dirs(sysadm_t) + userdom_home_filetrans_user_home_dir(sysadm_t) + ++# Add blk and chr files for dataloading ++files_manage_isid_type_blk_files(sysadm_t) ++files_manage_isid_type_chr_files(sysadm_t) ++ + ifdef(`direct_sysadm_daemon',` + optional_policy(` + init_run_daemon(sysadm_t, sysadm_r) +@@ -270,6 +274,10 @@ + ') + + optional_policy(` ++ ppp_run(sysadm_t, sysadm_r) ++') ++ ++optional_policy(` + pyzor_role(sysadm_r, sysadm_t) + ') +package/refpolicy/0010-authloginChanges.patch new file +14
-0@@ -0,0 +1,14 @@ +--- a/policy/modules/system/authlogin.te 2012-07-25 13:33:04.000000000 -0500 ++++ b/policy/modules/system/authlogin.te 2012-09-18 07:11:17.000000000 -0500 +@@ -109,8 +109,10 @@ + files_read_etc_files(chkpwd_t) + # for nscd + files_dontaudit_search_var(chkpwd_t) ++files_dontaudit_search_tmp(chkpwd_t) ++dev_dontaudit_search_sysfs(chkpwd_t) + +-fs_dontaudit_getattr_xattr_fs(chkpwd_t) ++fs_dontaudit_getattr_all_fs(chkpwd_t) + + term_dontaudit_use_console(chkpwd_t) + term_dontaudit_use_unallocated_ttys(chkpwd_t)package/refpolicy/0011-localloginChanges.patch new file +13
-0@@ -0,0 +1,13 @@ +################################################################################ +# Copyright 2012-2015, Rockwell Collins. All rights reserved. +################################################################################ +--- a/policy/modules/system/locallogin.te 2012-05-04 08:14:47.000000000 -0500 ++++ b/policy/modules/system/locallogin.te 2012-10-18 08:38:32.000000000 -0500 +@@ -86,6 +86,7 @@ + dev_dontaudit_setattr_misc_dev(local_login_t) + dev_dontaudit_getattr_scanner_dev(local_login_t) + dev_dontaudit_setattr_scanner_dev(local_login_t) ++dev_dontaudit_getattr_sysfs_fs(local_login_t) + dev_dontaudit_search_sysfs(local_login_t) + dev_dontaudit_getattr_video_dev(local_login_t) + dev_dontaudit_setattr_video_dev(local_login_t)package/refpolicy/0012-udevChanges.patch new file +14
-0@@ -0,0 +1,14 @@ +################################################################################ +# Copyright 2012-2015, Rockwell Collins. All rights reserved. +################################################################################ +--- a/policy/modules/system/udev.fc 2012-05-04 08:14:47.000000000 -0500 ++++ b/policy/modules/system/udev.fc 2012-10-17 15:02:24.000000000 -0500 +@@ -29,7 +29,7 @@ + /usr/bin/udevinfo -- gen_context(system_u:object_r:udev_exec_t,s0) + + /var/run/PackageKit/udev(/.*)? gen_context(system_u:object_r:udev_var_run_t,s0) +-/var/run/udev(/.*)? gen_context(system_u:object_r:udev_tbl_t,s0) ++/tmp/udev(/.*)? gen_context(system_u:object_r:udev_var_run_t,s0) + + ifdef(`distro_debian',` + /var/run/xen-hotplug -d gen_context(system_u:object_r:udev_var_run_t,s0)package/refpolicy/0013-netutilsChanges.patch new file +13
-0@@ -0,0 +1,13 @@ +################################################################################ +# Copyright 2012-2015, Rockwell Collins. All rights reserved. +################################################################################ +--- a/policy/modules/admin/netutils.te 2012-05-04 08:14:47.000000000 -0500 ++++ b/policy/modules/admin/netutils.te 2012-10-18 07:25:25.000000000 -0500 +@@ -105,6 +105,7 @@ + + allow ping_t self:capability { setuid net_raw }; + dontaudit ping_t self:capability sys_tty_config; ++allow ping_t self:process { getcap setcap }; + allow ping_t self:tcp_socket create_socket_perms; + allow ping_t self:rawip_socket { create ioctl read write bind getopt setopt }; + allow ping_t self:packet_socket { create ioctl read write bind getopt setopt };package/refpolicy/0014-devicesChanges.patch new file +48
-0@@ -0,0 +1,48 @@ +################################################################################ +# Copyright 2012-2015, Rockwell Collins. All rights reserved. +################################################################################ +--- a/policy/modules/kernel/devices.if 2012-05-10 08:25:34.000000000 -0500 ++++ b/policy/modules/kernel/devices.if 2012-10-18 08:40:43.000000000 -0500 +@@ -3836,6 +3836,42 @@ + + ######################################## + ## <summary> ++## Get attributes of sysfs filesystems. ++## </summary> ++## <param name="domain"> ++## <summary> ++## Domain allowed access. ++## </summary> ++## </param> ++# ++interface(`dev_getattr_sysfs_fs',` ++ gen_require(` ++ type sysfs_t; ++ ') ++ ++ allow $1 sysfs_t:filesystem getattr; ++') ++ ++######################################## ++## <summary> ++## Don't audit get attributes of sysfs filesystems. ++## </summary> ++## <param name="domain"> ++## <summary> ++## Domain allowed access. ++## </summary> ++## </param> ++# ++interface(`dev_dontaudit_getattr_sysfs_fs',` ++ gen_require(` ++ type sysfs_t; ++ ') ++ ++ dontaudit $1 sysfs_t:filesystem getattr; ++') ++ ++######################################## ++## <summary> + ## Search the sysfs directories. + ## </summary> + ## <param name="domain">package/refpolicy/0015-awk-fix.patch renamed from package/refpolicy/0002-awk-fix.patch +0
-0package/refpolicy/0016-enablePolyinstantiation.patch new file +11
-0@@ -0,0 +1,11 @@ +--- a/policy/global_tunables 2012-03-30 07:48:20.000000000 -0500 ++++ b/policy/global_tunables 2012-09-13 09:31:38.000000000 -0500 +@@ -37,7 +37,7 @@ + ## Enable polyinstantiated directory support. + ## </p> + ## </desc> +-gen_tunable(allow_polyinstantiation,false) ++gen_tunable(allow_polyinstantiation,true) + + ## <desc> + ## <p>
Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons Embedded Linux, Kernel and Android engineering http://free-electrons.com
PATCH v4 10/27 refpolicy: custom git repo
In reply to Matt WeberSigned-off-by Matthew Weber <[email protected]>
--- package/Config.in | 1 + package/refpolicy-contrib/Config.in | 20 +++++++++++++++++ package/refpolicy-contrib/refpolicy-contrib.mk | 19 ++++++++++++++++ package/refpolicy/Config.in | 22 +++++++++++++++++++ package/refpolicy/refpolicy.mk | 30 ++++++++++++++++++++++---- 5 files changed, 88 insertions(+), 4 deletions(-) create mode 100644 package/refpolicy-contrib/Config.in create mode 100644 package/refpolicy-contrib/refpolicy-contrib.mk
package/Config.in +1 -0
@@ -1207,6 +1207,7 @@ menu "policycoreutils" endmenu menu "refpolicy" source "package/refpolicy/Config.in" + source "package/refpolicy-contrib/Config.in" endmenu source "package/setools/Config.in" endmenu
package/refpolicy-contrib/Config.in new file +20 -0
@@ -0,0 +1,20 @@ +if BR2_REFPOLICY_CUSTOM_GIT + +comment "A refpolicy contrib repository is required if using a refpolicy repo. (Contrib is a GIT submodule of refpolicy)" + +config BR2_PACKAGE_REFPOLICY_CONTRIB + bool "refpolicy-contrib" + help + A GIT submodule of the refpolicy package. + + +config BR2_REFPOLICY_CONTRIB_CUSTOM_REPO_URL + string "URL of custom contrib submodule repository" + +config BR2_REFPOLICY_CONTRIB_CUSTOM_REPO_VERSION + string "Custom contrib submodule repository version" + help + Revision to use in the typical format used by Git + e.g. a SHA id, a tag, branch, .. + +endif
package/refpolicy-contrib/refpolicy-contrib.mk new file +19 -0
@@ -0,0 +1,19 @@ +################################################################################ +# +# refpolicy-contrib +# +################################################################################ + +ifeq ($(BR2_REFPOLICY_CUSTOM_GIT),y) +REFPOLICY_CONTRIB_SITE = $(call qstrip,$(BR2_REFPOLICY_CONTRIB_CUSTOM_REPO_URL)) +REFPOLICY_CONTRIB_VERSION = $(call qstrip,$(BR2_REFPOLICY_CONTRIB_CUSTOM_REPO_VERSION)) +REFPOLICY_CONTRIB_SITE_METHOD = git + +# Inherits license from refpolicy as normally this is a submodule +REFPOLICY_CONTRIB_LICENSE = GPLv2 +REFPOLICY_CONTRIB_LICENSE_FILES = COPYING +endif + +# If refpolicy is from release archive, this contrib content is part of it. + +$(eval $(generic-package))
package/refpolicy/Config.in +22 -0
@@ -59,6 +59,8 @@ config BR2_PACKAGE_REFPOLICY_MODULES_FILE SELinux policy modules to be included in the compiled policy. See policy/modules.conf in the refpolicy sources for the complete list of available modules. + NOTE: This file is only used if a Custom GIT repo is + not specified. config BR2_PACKAGE_REFPOLICY_MODULAR bool "Build a modular SELinux policy"
@@ -68,4 +70,24 @@ config BR2_PACKAGE_REFPOLICY_MODULAR target. A modular policy can also be built if policies need to be modified without reloading the target. +config BR2_PACKAGE_REFPOLICY_CUSTOM_GIT + bool "Custom Git repository" + select BR2_PACKAGE_REFPOLICY_CONTRIB + help + This option allows Buildroot to get the refpolicy source + code from a Git repository. + +if BR2_PACKAGE_REFPOLICY_CUSTOM_GIT + +config BR2_PACKAGE_REFPOLICY_CUSTOM_REPO_URL + string "URL of custom repository" + +config BR2_PACKAGE_REFPOLICY_CUSTOM_REPO_VERSION + string "Custom repository version" + help + Revision to use in the typical format used by Git + e.g. a SHA id, a tag, branch, .. + +endif + endif
package/refpolicy/refpolicy.mk +26 -4
@@ -4,16 +4,23 @@ # ################################################################################ +ifeq ($(BR2_PACKAGE_REFPOLICY_CUSTOM_GIT),y) +REFPOLICY_SITE = $(call qstrip,$(BR2_PACKAGE_REFPOLICY_CUSTOM_REPO_URL)) +REFPOLICY_VERSION = $(call qstrip,$(BR2_PACKAGE_REFPOLICY_CUSTOM_REPO_VERSION)) +REFPOLICY_SITE_METHOD = git +REFPOLICY_DEPENDENCIES += refpolicy-contrib +else REFPOLICY_VERSION = 2.20130424 REFPOLICY_SOURCE = refpolicy-$(REFPOLICY_VERSION).tar.bz2 REFPOLICY_SITE = http://oss.tresys.com/files/refpolicy/ +endif REFPOLICY_LICENSE = GPLv2 REFPOLICY_LICENSE_FILES = COPYING # Cannot use multiple threads to build the reference policy REFPOLICY_MAKE = $(TARGET_MAKE_ENV) $(MAKE1) -REFPOLICY_DEPENDENCIES = host-m4 host-checkpolicy host-policycoreutils \ +REFPOLICY_DEPENDENCIES += host-m4 host-checkpolicy host-policycoreutils \ host-setools host-python-pyxml host-gawk policycoreutils REFPOLICY_INSTALL_STAGING = YES
@@ -37,18 +44,33 @@ else REFPOLICY_MONOLITHIC = y endif +ifeq ($(BR2_PACKAGE_REFPOLICY_CUSTOM_GIT),y) +define REFPOLICY_GIT_SUBMODULE_SETUP + rsync -ar $(REFPOLICY_CONTRIB_DIR)/* $(@D)/policy/modules/contrib/ +endef +else +define REFPOLICY_CUSTOM_MODULES_CONF + cp -f $(REFPOLICY_MODULES_FILE) $(@D)/policy/modules.conf +endef +endif + define REFPOLICY_CONFIGURE_CMDS $(REFPOLICY_GIT_SUBMODULE_SETUP) # If an external repo is used to build refpolicy, this preserves the # custom modules.conf which defines the enabled components. - [ -f $(@D)/policy/modules.conf ] && mv $(@D)/policy/modules.conf $(@D)/modules.conf.bk + if [ -f $(@D)/policy/modules.conf ]; then \ + mv $(@D)/policy/modules.conf $(@D)/modules.conf.bk ; \ + fi $(REFPOLICY_MAKE) -C $(@D) bare $(REFPOLICY_MAKE_CMDS) DESTDIR=$(STAGING_DIR) $(SED) "/TYPE/c\TYPE = $(BR2_PACKAGE_REFPOLICY_TYPE)" $(@D)/build.conf $(SED) "/MONOLITHIC/c\MONOLITHIC = $(REFPOLICY_MONOLITHIC)" $(@D)/build.conf $(SED) "/NAME/c\NAME = $(REFPOLICY_POLICY_NAME)" $(@D)/build.conf $(REFPOLICY_MAKE) -C $(@D) conf $(REFPOLICY_MAKE_CMDS) DESTDIR=$(STAGING_DIR) - [ -f $(@D)/modules.conf.bk ] && echo "[Preserved modules.conf]" && \ - mv $(@D)/modules.conf.bk $(@D)/policy/modules.conf + if [ -f $(@D)/modules.conf.bk ]; then \ + echo "[Preserved modules.conf]" ; \ + mv $(@D)/modules.conf.bk $(@D)/policy/modules.conf ; \ + fi + $(REFPOLICY_CUSTOM_MODULES_CONF) endef define REFPOLICY_INSTALL_STAGING_CMDS
Signature · 1 line
1.9.1
PATCH v4 11/27 shadow: new package
In reply to Matt WeberSigned-off-by Clayton Shotwell <[email protected]>
Signed-off-by Matthew Weber <[email protected]>
---
[Matt W:
- added hash
- bumped version
package/Config.in | 3 +++ package/shadow/Config.in | 13 ++++++++++ package/shadow/shadow.hash | 2 ++ package/shadow/shadow.mk | 61 ++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 79 insertions(+) create mode 100644 package/shadow/Config.in create mode 100644 package/shadow/shadow.hash create mode 100644 package/shadow/shadow.mk
package/Config.in +3 -0
@@ -1233,6 +1233,9 @@ comment "Utilities" source "package/logsurfer/Config.in" source "package/pinentry/Config.in" source "package/screen/Config.in" +if BR2_PACKAGE_BUSYBOX_SHOW_OTHERS + source "package/shadow/Config.in" +endif source "package/sudo/Config.in" if BR2_PACKAGE_BUSYBOX_SHOW_OTHERS source "package/time/Config.in"
package/shadow/Config.in new file +13 -0
@@ -0,0 +1,13 @@ +config BR2_PACKAGE_SHADOW + bool "shadow" + help + The shadow-utils package includes the necessary programs for + converting UNIX password files to the shadow password format, plus + programs for managing user and group accounts. The pwconv command + converts passwords to the shadow password format. The pwunconv command + unconverts shadow passwords and generates an npasswd file (a standard + UNIX password file). The pwck command checks the integrity of password + and shadow files. The lastlog command prints out the last login times + for all users. The useradd, userdel, and usermod commands are used for + managing user accounts. The groupadd, groupdel, and groupmod commands + are used for managing group accounts.
package/shadow/shadow.hash new file +2 -0
@@ -0,0 +1,2 @@ +#Locally computed +sha256 aa32333748d68b58ed3a83625f0165e0f6b9dc4639e6377c9300c6bf4fe978fb shadow-4.1.5.1.tar.bz2
package/shadow/shadow.mk new file +61 -0
61 lines not on this page · raw message
Signature · 1 line
1.9.1
PATCH v4 12/27 busybox: applets as individual binaries
In reply to Matt WeberThe individual binaries option of busybox allows for the applets that would usually be symlinks to be built as individual applications that link against a shared library.
This feature is needed for SELinux to allow the applications to run under the correct SELinux context.
The patch being added allows the individual applications to be installed and will be upstreamed to the busybox developers.
The initial work for this change was done by Thomas Petazzoni <[email protected]>.
Signed-off-by Clayton Shotwell <[email protected]>
Signed-off-by Matthew Weber <[email protected]>
---
[Matt W:
- Renamed to follow latest patch naming convention
...s-Add-installation-of-individual-binaries.patch | 103 +++++++++++++++++++++ package/busybox/Config.in | 7 ++ package/busybox/busybox.mk | 34 +++++++ 3 files changed, 144 insertions(+) create mode 100644 package/busybox/0007-applets-Add-installation-of-individual-binaries.patch
package/busybox/0007-applets-Add-installation-of-individual-binaries.patch new file +103 -0
@@ -0,0 +1,103 @@ +From 3451b55054a6fe2073a21301938802a27dec835d Mon Sep 17 00:00:00 2001 +From: Clayton Shotwell <[email protected]> +Date: Mon, 16 Dec 2013 14:45:33 -0600 +Subject: [PATCH 5/5] applets: Add installation of individual binaries + +Adding support to install individual binaries if the option is +enabled. This also installs the shared libbusybox.so.* library. + +Signed-off-by: Clayton Shotwell <[email protected]> +--- + Makefile.custom | 4 ++++ + applets/install.sh | 26 ++++++++++++++++++++++++-- + 2 files changed, 28 insertions(+), 2 deletions(-) + +diff --git a/Makefile.custom b/Makefile.custom +index 6da79e6..e4dc4dc 100644 +--- a/Makefile.custom ++++ b/Makefile.custom +@@ -23,6 +23,10 @@ ifeq ($(CONFIG_INSTALL_SH_APPLET_SCRIPT_WRAPPER),y) + INSTALL_OPTS:= --scriptwrapper + endif + endif ++ifeq ($(CONFIG_FEATURE_INDIVIDUAL),y) ++INSTALL_OPTS:= --binaries ++LIBBUSYBOX_SONAME:= 0_lib/libbusybox.so.$(BB_VER) ++endif + install: $(srctree)/applets/install.sh busybox busybox.links + $(Q)DO_INSTALL_LIBS="$(strip $(LIBBUSYBOX_SONAME) $(DO_INSTALL_LIBS))" \ + $(SHELL) $< $(CONFIG_PREFIX) $(INSTALL_OPTS) +diff --git a/applets/install.sh b/applets/install.sh +index 95b4719..d01c98d 100755 +--- a/applets/install.sh ++++ b/applets/install.sh +@@ -5,19 +5,26 @@ export LC_CTYPE=POSIX + + prefix=$1 + if [ -z "$prefix" ]; then +- echo "usage: applets/install.sh DESTINATION [--symlinks/--hardlinks/--scriptwrapper]" ++ echo "usage: applets/install.sh DESTINATION [--symlinks/--hardlinks/--binaries/--scriptwrapper]" + exit 1 + fi + ++# Source the configuration ++. ./.config ++ + h=`sort busybox.links | uniq` + ++sharedlib_dir="0_lib" ++ + linkopts="" + scriptwrapper="n" ++binaries="n" + cleanup="0" + noclobber="0" + case "$2" in + --hardlinks) linkopts="-f";; + --symlinks) linkopts="-fs";; ++ --binaries) binaries="y";; + --scriptwrapper) scriptwrapper="y";swrapall="y";; + --sw-sh-hard) scriptwrapper="y";linkopts="-f";; + --sw-sh-sym) scriptwrapper="y";linkopts="-fs";; +@@ -40,8 +47,9 @@ if [ -n "$DO_INSTALL_LIBS" ] && [ "$DO_INSTALL_LIBS" != "n" ]; then + for i in $DO_INSTALL_LIBS; do + rm -f "$prefix/$libdir/$i" || exit 1 + if [ -f "$i" ]; then ++ echo " Installing $i to the target@$prefix/$libdir/" + cp -pPR "$i" "$prefix/$libdir/" || exit 1 +- chmod 0644 "$prefix/$libdir/$i" || exit 1 ++ chmod 0644 "$prefix/$libdir/`basename $i`" || exit 1 + fi + done + fi +@@ -68,6 +76,7 @@ install -m 755 busybox "$prefix/bin/busybox" || exit 1 + + for i in $h; do + appdir=`dirname "$i"` ++ app=`basename "$i"` + mkdir -p "$prefix/$appdir" || exit 1 + if [ "$scriptwrapper" = "y" ]; then + if [ "$swrapall" != "y" ] && [ "$i" = "/bin/sh" ]; then +@@ -78,6 +87,19 @@ for i in $h; do + chmod +x "$prefix/$i" + fi + echo " $prefix/$i" ++ elif [ "$binaries" = "y" ]; then ++ # Copy the binary over rather ++ if [ -e $sharedlib_dir/$app ]; then ++ if [ "$noclobber" = "0" ] || [ ! -e "$prefix/$i" ]; then ++ echo " Copying $sharedlib_dir/$app to $prefix/$i" ++ cp -a $sharedlib_dir/$app $prefix/$i || exit 1 ++ else ++ echo " $prefix/$i already exists" ++ fi ++ else ++ echo "Error: Could not find $sharedlib_dir/$app" ++ exit 1 ++ fi + else + if [ "$2" = "--hardlinks" ]; then + bb_path="$prefix/bin/busybox" +-- +1.7.1 +
package/busybox/Config.in +7 -0
@@ -26,6 +26,13 @@ config BR2_PACKAGE_BUSYBOX_SHOW_OTHERS Show packages in menuconfig that are potentially also provided by busybox. +config BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES + bool "Individual binaries" + depends on !BR2_PREFER_STATIC_LIB + +comment "Busybox individual binaries depends on dynamic libraries" + depends on BR2_PREFER_STATIC_LIB + config BR2_PACKAGE_BUSYBOX_WATCHDOG bool "Install the watchdog daemon startup script" help
package/busybox/busybox.mk +34 -0
@@ -49,10 +49,31 @@ BUSYBOX_KCONFIG_FILE = $(BUSYBOX_CONFIG_FILE) BUSYBOX_KCONFIG_EDITORS = menuconfig xconfig gconfig BUSYBOX_KCONFIG_OPTS = $(BUSYBOX_MAKE_OPTS) +ifeq ($(BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES),y) +define BUSYBOX_PERMISSIONS +# Applets with BB_SUID_REQUIRE +/usr/bin/crontab f 4755 0 0 - - - - - +/bin/login f 4755 0 0 - - - - - +/usr/bin/passwd f 4755 0 0 - - - - - +/bin/su f 4755 0 0 - - - - - +/usr/bin/vlock f 4755 0 0 - - - - - +/usr/bin/wall f 4755 0 0 - - - - - +# Applets with BB_SUID_MAYBE +/bin/ping f 4755 0 0 - - - - - +/bin/ping6 f 4755 0 0 - - - - - +/sbin/findfs f 4755 0 0 - - - - - +/bin/mount f 4755 0 0 - - - - - +/usr/bin/traceroute f 4755 0 0 - - - - - +/usr/bin/traceroute6 f 4755 0 0 - - - - - +# Other files +/usr/share/udhcpc/default.script f 755 0 0 - - - - - +endef +else define BUSYBOX_PERMISSIONS /bin/busybox f 4755 0 0 - - - - - /usr/share/udhcpc/default.script f 755 0 0 - - - - - endef +endif # If mdev will be used for device creation enable it and copy S10mdev to /etc/init.d ifeq ($(BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_MDEV),y)
@@ -161,6 +182,17 @@ define BUSYBOX_SET_INIT endef endif +ifeq ($(BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES),y) +define BUSYBOX_CONFIGURE_INDIVIDUAL_BINARIES + $(call KCONFIG_ENABLE_OPT,CONFIG_BUILD_LIBBUSYBOX,$(BUSYBOX_BUILD_CONFIG)) + $(call KCONFIG_ENABLE_OPT,CONFIG_FEATURE_INDIVIDUAL,$(BUSYBOX_BUILD_CONFIG)) +endef + +define BUSYBOX_INSTALL_INDIVIDUAL_BINARIES + rm -f $(TARGET_DIR)/bin/busybox +endef +endif + define BUSYBOX_INSTALL_LOGGING_SCRIPT if grep -q CONFIG_SYSLOGD=y $(@D)/.config; then \ $(INSTALL) -m 0755 -D package/busybox/S01logging \
@@ -198,6 +230,7 @@ define BUSYBOX_KCONFIG_FIXUP_CMDS $(BUSYBOX_INTERNAL_SHADOW_PASSWORDS) $(BUSYBOX_SET_INIT) $(BUSYBOX_SET_WATCHDOG) + $(BUSYBOX_CONFIGURE_INDIVIDUAL_BINARIES) endef define BUSYBOX_CONFIGURE_CMDS
@@ -221,6 +254,7 @@ define BUSYBOX_INSTALL_INIT_SYSV $(BUSYBOX_INSTALL_MDEV_SCRIPT) $(BUSYBOX_INSTALL_LOGGING_SCRIPT) $(BUSYBOX_INSTALL_WATCHDOG_SCRIPT) + $(BUSYBOX_INSTALL_INDIVIDUAL_BINARIES) endef $(eval $(kconfig-package))
Signature · 1 line
1.9.1
PATCH v4 13/27 busybox: selinux support
In reply to Matt WeberAdd a configure option to enable the SELinux support in the busybox configuration from the Buildroot menuconfig.
Signed-off-by Thomas Petazzoni <[email protected]>
Signed-off-by Clayton Shotwell <[email protected]>
Signed-off-by Matt Weber <[email protected]>
---
[Matt W:
- Renamed to follow patch naming convention
...ags-strip-non-l-arguments-returned-by-pkg.patch | 28 ++++++++++++++++++++++ package/busybox/Config.in | 3 +++ package/busybox/busybox.mk | 8 +++++++ 3 files changed, 39 insertions(+) create mode 100644 package/busybox/0008-Makefile.flags-strip-non-l-arguments-returned-by-pkg.patch
package/busybox/0008-Makefile.flags-strip-non-l-arguments-returned-by-pkg.patch new file +28 -0
@@ -0,0 +1,28 @@ +From 67eb23d2be8aba3c474dac81a15b0fa11e5847b7 Mon Sep 17 00:00:00 2001 +From: Thomas Petazzoni <[email protected]> +Date: Mon, 25 Nov 2013 22:51:53 +0100 +Subject: [PATCH] Makefile.flags: strip non -l arguments returned by pkg-config + +Signed-off-by: Thomas Petazzoni <[email protected]> +--- + Makefile.flags | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/Makefile.flags b/Makefile.flags +index 307afa7..885e323 100644 +--- a/Makefile.flags ++++ b/Makefile.flags +@@ -141,7 +141,9 @@ ifeq ($(CONFIG_SELINUX),y) + SELINUX_PC_MODULES = libselinux libsepol + $(eval $(call pkg_check_modules,SELINUX,$(SELINUX_PC_MODULES))) + CPPFLAGS += $(SELINUX_CFLAGS) +-LDLIBS += $(if $(SELINUX_LIBS),$(SELINUX_LIBS:-l%=%),$(SELINUX_PC_MODULES:lib%=%)) ++LDLIBS += $(if $(SELINUX_LIBS),\ ++ $(patsubst -l%,%,$(filter -l%,$(SELINUX_LIBS))),\ ++ $(SELINUX_PC_MODULES:lib%=%)) + endif + + ifeq ($(CONFIG_EFENCE),y) +-- +1.8.1.2 +
package/busybox/Config.in +3 -0
@@ -33,6 +33,9 @@ config BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES comment "Busybox individual binaries depends on dynamic libraries" depends on BR2_PREFER_STATIC_LIB +config BR2_PACKAGE_BUSYBOX_SELINUX + bool "Enable SELinux support" + config BR2_PACKAGE_BUSYBOX_WATCHDOG bool "Install the watchdog daemon startup script" help
package/busybox/busybox.mk +8 -0
@@ -193,6 +193,13 @@ define BUSYBOX_INSTALL_INDIVIDUAL_BINARIES endef endif +ifeq ($(BR2_PACKAGE_BUSYBOX_SELINUX),y) +BUSYBOX_DEPENDENCIES += host-pkgconf libselinux libsepol +define BUSYBOX_SET_SELINUX + $(call KCONFIG_ENABLE_OPT,CONFIG_SELINUX,$(BUSYBOX_BUILD_CONFIG)) +endef +endif + define BUSYBOX_INSTALL_LOGGING_SCRIPT if grep -q CONFIG_SYSLOGD=y $(@D)/.config; then \ $(INSTALL) -m 0755 -D package/busybox/S01logging \
@@ -231,6 +238,7 @@ define BUSYBOX_KCONFIG_FIXUP_CMDS $(BUSYBOX_SET_INIT) $(BUSYBOX_SET_WATCHDOG) $(BUSYBOX_CONFIGURE_INDIVIDUAL_BINARIES) + $(BUSYBOX_SET_SELINUX) endef define BUSYBOX_CONFIGURE_CMDS
Signature · 1 line
1.9.1
PATCH v4 14/27 busybox: added linux-pam support
In reply to Matt WeberFrom: Matt Weber <[email protected]>
Signed-off-by Matt Weber <[email protected]>
--- package/busybox/busybox.mk | 10 ++++++++++ 1 file changed, 10 insertions(+)
package/busybox/busybox.mk +10 -0
@@ -193,10 +193,19 @@ define BUSYBOX_INSTALL_INDIVIDUAL_BINARIES endef endif +ifeq ($(BR2_PACKAGE_LINUX_PAM),y) +define BUSYBOX_LINUX_PAM + $(call KCONFIG_ENABLE_OPT,CONFIG_PAM,$(BUSYBOX_BUILD_CONFIG)) +endef +BUSYBOX_DEPENDENCIES += linux-pam +endif + ifeq ($(BR2_PACKAGE_BUSYBOX_SELINUX),y) BUSYBOX_DEPENDENCIES += host-pkgconf libselinux libsepol define BUSYBOX_SET_SELINUX $(call KCONFIG_ENABLE_OPT,CONFIG_SELINUX,$(BUSYBOX_BUILD_CONFIG)) + $(call KCONFIG_ENABLE_OPT,CONFIG_SELINUXENABLED,$(BUSYBOX_BUILD_CONFIG)) + endef endif
@@ -234,6 +243,7 @@ define BUSYBOX_KCONFIG_FIXUP_CMDS $(BUSYBOX_SET_CRYPT_SHA) $(BUSYBOX_NETKITBASE) $(BUSYBOX_NETKITTELNET) + $(BUSYBOX_LINUX_PAM) $(BUSYBOX_INTERNAL_SHADOW_PASSWORDS) $(BUSYBOX_SET_INIT) $(BUSYBOX_SET_WATCHDOG)
Signature · 1 line
1.9.1
PATCH v4 15/27 busybox: default selinux config which disables init and uses sysvinit
In reply to Matt WeberFrom: Matt Weber <[email protected]>
Signed-off-by Matthew Weber <[email protected]>
--- board/qemu/x86/busybox-selinux.config | 1038 +++++++++++++++++++++++++++++++++ 1 file changed, 1038 insertions(+) create mode 100644 board/qemu/x86/busybox-selinux.config
board/qemu/x86/busybox-selinux.config new file +1038 -0
@@ -0,0 +1,1038 @@ +# +# Automatically generated make config: don't edit +# Busybox version: 1.22.1 +# Tue Sep 16 07:34:52 2014 +# +CONFIG_HAVE_DOT_CONFIG=y + +# +# Busybox Settings +# + +# +# General Configuration +# +CONFIG_DESKTOP=y +# CONFIG_EXTRA_COMPAT is not set +CONFIG_INCLUDE_SUSv2=y +# CONFIG_USE_PORTABLE_CODE is not set +CONFIG_PLATFORM_LINUX=y +CONFIG_FEATURE_BUFFERS_USE_MALLOC=y +# CONFIG_FEATURE_BUFFERS_GO_ON_STACK is not set +# CONFIG_FEATURE_BUFFERS_GO_IN_BSS is not set +CONFIG_SHOW_USAGE=y +CONFIG_FEATURE_VERBOSE_USAGE=y +# CONFIG_FEATURE_COMPRESS_USAGE is not set +CONFIG_FEATURE_INSTALLER=y +# CONFIG_INSTALL_NO_USR is not set +# CONFIG_LOCALE_SUPPORT is not set +# CONFIG_UNICODE_SUPPORT is not set +# CONFIG_UNICODE_USING_LOCALE is not set +# CONFIG_FEATURE_CHECK_UNICODE_IN_ENV is not set +CONFIG_SUBST_WCHAR=0 +CONFIG_LAST_SUPPORTED_WCHAR=0 +# CONFIG_UNICODE_COMBINING_WCHARS is not set +# CONFIG_UNICODE_WIDE_WCHARS is not set +# CONFIG_UNICODE_BIDI_SUPPORT is not set +# CONFIG_UNICODE_NEUTRAL_TABLE is not set +# CONFIG_UNICODE_PRESERVE_BROKEN is not set +CONFIG_LONG_OPTS=y +CONFIG_FEATURE_DEVPTS=y +CONFIG_FEATURE_CLEAN_UP=y +CONFIG_FEATURE_UTMP=y +CONFIG_FEATURE_WTMP=y +# CONFIG_FEATURE_PIDFILE is not set +CONFIG_PID_FILE_PATH="" +CONFIG_FEATURE_SUID=y +# CONFIG_FEATURE_SUID_CONFIG is not set +# CONFIG_FEATURE_SUID_CONFIG_QUIET is not set +CONFIG_SELINUX=y +# CONFIG_FEATURE_PREFER_APPLETS is not set +CONFIG_BUSYBOX_EXEC_PATH="/proc/self/exe" +CONFIG_FEATURE_SYSLOG=y +CONFIG_FEATURE_HAVE_RPC=y + +# +# Build Options +# +# CONFIG_STATIC is not set +# CONFIG_PIE is not set +# CONFIG_NOMMU is not set +CONFIG_BUILD_LIBBUSYBOX=y +CONFIG_FEATURE_INDIVIDUAL=y +# CONFIG_FEATURE_SHARED_BUSYBOX is not set +CONFIG_LFS=y +CONFIG_CROSS_COMPILER_PREFIX="" +CONFIG_SYSROOT="" +CONFIG_EXTRA_CFLAGS="" +CONFIG_EXTRA_LDFLAGS="" +CONFIG_EXTRA_LDLIBS="" + +# +# Debugging Options +# +# CONFIG_DEBUG is not set +# CONFIG_DEBUG_PESSIMIZE is not set +# CONFIG_WERROR is not set +CONFIG_NO_DEBUG_LIB=y +# CONFIG_DMALLOC is not set +# CONFIG_EFENCE is not set + +# +# Installation Options ("make install" behavior) +# +CONFIG_INSTALL_APPLET_SYMLINKS=y +# CONFIG_INSTALL_APPLET_HARDLINKS is not set +# CONFIG_INSTALL_APPLET_SCRIPT_WRAPPERS is not set +# CONFIG_INSTALL_APPLET_DONT is not set +# CONFIG_INSTALL_SH_APPLET_SYMLINK is not set +# CONFIG_INSTALL_SH_APPLET_HARDLINK is not set +# CONFIG_INSTALL_SH_APPLET_SCRIPT_WRAPPER is not set +CONFIG_PREFIX="./_install" + +# +# Busybox Library Tuning +# +# CONFIG_FEATURE_SYSTEMD is not set +CONFIG_FEATURE_RTMINMAX=y +CONFIG_PASSWORD_MINLEN=6 +CONFIG_MD5_SMALL=1 +CONFIG_SHA3_SMALL=1 +# CONFIG_FEATURE_FAST_TOP is not set +# CONFIG_FEATURE_ETC_NETWORKS is not set +CONFIG_FEATURE_USE_TERMIOS=y +CONFIG_FEATURE_EDITING=y +CONFIG_FEATURE_EDITING_MAX_LEN=1024 +CONFIG_FEATURE_EDITING_VI=y +CONFIG_FEATURE_EDITING_HISTORY=999 +CONFIG_FEATURE_EDITING_SAVEHISTORY=y +# CONFIG_FEATURE_EDITING_SAVE_ON_EXIT is not set +CONFIG_FEATURE_REVERSE_SEARCH=y +CONFIG_FEATURE_TAB_COMPLETION=y +# CONFIG_FEATURE_USERNAME_COMPLETION is not set +CONFIG_FEATURE_EDITING_FANCY_PROMPT=y +# CONFIG_FEATURE_EDITING_ASK_TERMINAL is not set +CONFIG_FEATURE_NON_POSIX_CP=y +# CONFIG_FEATURE_VERBOSE_CP_MESSAGE is not set +CONFIG_FEATURE_COPYBUF_KB=4 +CONFIG_FEATURE_SKIP_ROOTFS=y +CONFIG_MONOTONIC_SYSCALL=y +CONFIG_IOCTL_HEX2STR_ERROR=y +CONFIG_FEATURE_HWIB=y + +# +# Applets +# + +# +# Archival Utilities +# +# CONFIG_FEATURE_SEAMLESS_XZ is not set +# CONFIG_FEATURE_SEAMLESS_LZMA is not set +# CONFIG_FEATURE_SEAMLESS_BZ2 is not set +# CONFIG_FEATURE_SEAMLESS_GZ is not set +# CONFIG_FEATURE_SEAMLESS_Z is not set +CONFIG_AR=y +# CONFIG_FEATURE_AR_LONG_FILENAMES is not set +CONFIG_FEATURE_AR_CREATE=y +# CONFIG_UNCOMPRESS is not set +CONFIG_GUNZIP=y +CONFIG_BUNZIP2=y +CONFIG_UNLZMA=y +# CONFIG_FEATURE_LZMA_FAST is not set +CONFIG_LZMA=y +CONFIG_UNXZ=y +CONFIG_XZ=y +# CONFIG_BZIP2 is not set +CONFIG_CPIO=y +# CONFIG_FEATURE_CPIO_O is not set +# CONFIG_FEATURE_CPIO_P is not set +# CONFIG_DPKG is not set +# CONFIG_DPKG_DEB is not set +# CONFIG_FEATURE_DPKG_DEB_EXTRACT_ONLY is not set +CONFIG_GZIP=y +# CONFIG_FEATURE_GZIP_LONG_OPTIONS is not set +CONFIG_GZIP_FAST=0 +# CONFIG_LZOP is not set +# CONFIG_LZOP_COMPR_HIGH is not set +# CONFIG_RPM is not set +# CONFIG_RPM2CPIO is not set +CONFIG_TAR=y +CONFIG_FEATURE_TAR_CREATE=y +# CONFIG_FEATURE_TAR_AUTODETECT is not set +CONFIG_FEATURE_TAR_FROM=y +# CONFIG_FEATURE_TAR_OLDGNU_COMPATIBILITY is not set +# CONFIG_FEATURE_TAR_OLDSUN_COMPATIBILITY is not set +CONFIG_FEATURE_TAR_GNU_EXTENSIONS=y +CONFIG_FEATURE_TAR_LONG_OPTIONS=y +CONFIG_FEATURE_TAR_TO_COMMAND=y +# CONFIG_FEATURE_TAR_UNAME_GNAME is not set +# CONFIG_FEATURE_TAR_NOPRESERVE_TIME is not set +CONFIG_FEATURE_TAR_SELINUX=y +CONFIG_UNZIP=y + +# +# Coreutils +# +CONFIG_BASENAME=y +CONFIG_CAT=y +CONFIG_DATE=y +CONFIG_FEATURE_DATE_ISOFMT=y +# CONFIG_FEATURE_DATE_NANO is not set +CONFIG_FEATURE_DATE_COMPAT=y +CONFIG_HOSTID=y +CONFIG_ID=y +CONFIG_GROUPS=y +CONFIG_TEST=y +CONFIG_FEATURE_TEST_64=y +CONFIG_TOUCH=y +CONFIG_FEATURE_TOUCH_NODEREF=y +CONFIG_FEATURE_TOUCH_SUSV3=y +CONFIG_TR=y +CONFIG_FEATURE_TR_CLASSES=y +CONFIG_FEATURE_TR_EQUIV=y +# CONFIG_BASE64 is not set +CONFIG_WHO=y +CONFIG_USERS=y +# CONFIG_CAL is not set +CONFIG_CATV=y +CONFIG_CHGRP=y +CONFIG_CHMOD=y +CONFIG_CHOWN=y +# CONFIG_FEATURE_CHOWN_LONG_OPTIONS is not set +CONFIG_CHROOT=y +CONFIG_CKSUM=y +# CONFIG_COMM is not set +CONFIG_CP=y +# CONFIG_FEATURE_CP_LONG_OPTIONS is not set +CONFIG_CUT=y +CONFIG_DD=y +CONFIG_FEATURE_DD_SIGNAL_HANDLING=y +# CONFIG_FEATURE_DD_THIRD_STATUS_LINE is not set +CONFIG_FEATURE_DD_IBS_OBS=y +CONFIG_DF=y +# CONFIG_FEATURE_DF_FANCY is not set +CONFIG_DIRNAME=y +CONFIG_DOS2UNIX=y +CONFIG_UNIX2DOS=y +CONFIG_DU=y +CONFIG_FEATURE_DU_DEFAULT_BLOCKSIZE_1K=y +CONFIG_ECHO=y +CONFIG_FEATURE_FANCY_ECHO=y +CONFIG_ENV=y +# CONFIG_FEATURE_ENV_LONG_OPTIONS is not set +# CONFIG_EXPAND is not set +# CONFIG_FEATURE_EXPAND_LONG_OPTIONS is not set +CONFIG_EXPR=y +CONFIG_EXPR_MATH_SUPPORT_64=y +CONFIG_FALSE=y +CONFIG_FOLD=y +# CONFIG_FSYNC is not set +CONFIG_HEAD=y +CONFIG_FEATURE_FANCY_HEAD=y +CONFIG_INSTALL=y +CONFIG_FEATURE_INSTALL_LONG_OPTIONS=y +CONFIG_LN=y +CONFIG_LOGNAME=y +CONFIG_LS=y +CONFIG_FEATURE_LS_FILETYPES=y +CONFIG_FEATURE_LS_FOLLOWLINKS=y +CONFIG_FEATURE_LS_RECURSIVE=y +CONFIG_FEATURE_LS_SORTFILES=y +CONFIG_FEATURE_LS_TIMESTAMPS=y +CONFIG_FEATURE_LS_USERNAME=y +CONFIG_FEATURE_LS_COLOR=y +CONFIG_FEATURE_LS_COLOR_IS_DEFAULT=y +CONFIG_MD5SUM=y +CONFIG_MKDIR=y +CONFIG_FEATURE_MKDIR_LONG_OPTIONS=y +CONFIG_MKFIFO=y +CONFIG_MKNOD=y +CONFIG_MV=y +CONFIG_FEATURE_MV_LONG_OPTIONS=y +CONFIG_NICE=y +CONFIG_NOHUP=y +CONFIG_OD=y +CONFIG_PRINTENV=y +CONFIG_PRINTF=y +CONFIG_PWD=y +CONFIG_READLINK=y +CONFIG_FEATURE_READLINK_FOLLOW=y +CONFIG_REALPATH=y +CONFIG_RM=y +CONFIG_RMDIR=y +# CONFIG_FEATURE_RMDIR_LONG_OPTIONS is not set +CONFIG_SEQ=y +CONFIG_SHA1SUM=y +CONFIG_SHA256SUM=y +CONFIG_SHA512SUM=y +CONFIG_SHA3SUM=y +CONFIG_SLEEP=y +CONFIG_FEATURE_FANCY_SLEEP=y +CONFIG_FEATURE_FLOAT_SLEEP=y +CONFIG_SORT=y +CONFIG_FEATURE_SORT_BIG=y +# CONFIG_SPLIT is not set +# CONFIG_FEATURE_SPLIT_FANCY is not set +# CONFIG_STAT is not set +# CONFIG_FEATURE_STAT_FORMAT is not set +CONFIG_STTY=y +# CONFIG_SUM is not set +CONFIG_SYNC=y +# CONFIG_TAC is not set +CONFIG_TAIL=y +CONFIG_FEATURE_FANCY_TAIL=y +CONFIG_TEE=y +CONFIG_FEATURE_TEE_USE_BLOCK_IO=y +CONFIG_TRUE=y +CONFIG_TTY=y +CONFIG_UNAME=y +# CONFIG_UNEXPAND is not set +# CONFIG_FEATURE_UNEXPAND_LONG_OPTIONS is not set +CONFIG_UNIQ=y +CONFIG_USLEEP=y +CONFIG_UUDECODE=y +CONFIG_UUENCODE=y +CONFIG_WC=y +# CONFIG_FEATURE_WC_LARGE is not set +CONFIG_WHOAMI=y +CONFIG_YES=y + +# +# Common options for cp and mv +# +CONFIG_FEATURE_PRESERVE_HARDLINKS=y + +# +# Common options for ls, more and telnet +# +CONFIG_FEATURE_AUTOWIDTH=y + +# +# Common options for df, du, ls +# +CONFIG_FEATURE_HUMAN_READABLE=y + +# +# Common options for md5sum, sha1sum, sha256sum, sha512sum, sha3sum +# +CONFIG_FEATURE_MD5_SHA1_SUM_CHECK=y + +# +# Console Utilities +# +CONFIG_CHVT=y +# CONFIG_FGCONSOLE is not set +CONFIG_CLEAR=y +CONFIG_DEALLOCVT=y +CONFIG_DUMPKMAP=y +# CONFIG_KBD_MODE is not set +CONFIG_LOADFONT=y +CONFIG_LOADKMAP=y +CONFIG_OPENVT=y +CONFIG_RESET=y +CONFIG_RESIZE=y +CONFIG_FEATURE_RESIZE_PRINT=y +CONFIG_SETCONSOLE=y +# CONFIG_FEATURE_SETCONSOLE_LONG_OPTIONS is not set +# CONFIG_SETFONT is not set +# CONFIG_FEATURE_SETFONT_TEXTUAL_MAP is not set +CONFIG_DEFAULT_SETFONT_DIR="" +CONFIG_SETKEYCODES=y +CONFIG_SETLOGCONS=y +# CONFIG_SHOWKEY is not set + +# +# Common options for loadfont and setfont +# +CONFIG_FEATURE_LOADFONT_PSF2=y +CONFIG_FEATURE_LOADFONT_RAW=y + +# +# Debian Utilities +# +CONFIG_MKTEMP=y +CONFIG_PIPE_PROGRESS=y +CONFIG_RUN_PARTS=y +CONFIG_FEATURE_RUN_PARTS_LONG_OPTIONS=y +# CONFIG_FEATURE_RUN_PARTS_FANCY is not set +CONFIG_START_STOP_DAEMON=y +CONFIG_FEATURE_START_STOP_DAEMON_FANCY=y +CONFIG_FEATURE_START_STOP_DAEMON_LONG_OPTIONS=y +CONFIG_WHICH=y + +# +# Editors +# +CONFIG_AWK=y +# CONFIG_FEATURE_AWK_LIBM is not set +CONFIG_FEATURE_AWK_GNU_EXTENSIONS=y +CONFIG_CMP=y +CONFIG_DIFF=y +# CONFIG_FEATURE_DIFF_LONG_OPTIONS is not set +CONFIG_FEATURE_DIFF_DIR=y +# CONFIG_ED is not set +CONFIG_PATCH=y +CONFIG_SED=y +CONFIG_VI=y +CONFIG_FEATURE_VI_MAX_LEN=4096 +CONFIG_FEATURE_VI_8BIT=y +CONFIG_FEATURE_VI_COLON=y +CONFIG_FEATURE_VI_YANKMARK=y +CONFIG_FEATURE_VI_SEARCH=y +# CONFIG_FEATURE_VI_REGEX_SEARCH is not set +CONFIG_FEATURE_VI_USE_SIGNALS=y +CONFIG_FEATURE_VI_DOT_CMD=y +CONFIG_FEATURE_VI_READONLY=y +CONFIG_FEATURE_VI_SETOPTS=y +CONFIG_FEATURE_VI_SET=y +CONFIG_FEATURE_VI_WIN_RESIZE=y +CONFIG_FEATURE_VI_ASK_TERMINAL=y +CONFIG_FEATURE_ALLOW_EXEC=y + +# +# Finding Utilities +# +CONFIG_FIND=y +CONFIG_FEATURE_FIND_PRINT0=y +CONFIG_FEATURE_FIND_MTIME=y +CONFIG_FEATURE_FIND_MMIN=y +CONFIG_FEATURE_FIND_PERM=y +CONFIG_FEATURE_FIND_TYPE=y +CONFIG_FEATURE_FIND_XDEV=y +CONFIG_FEATURE_FIND_MAXDEPTH=y +CONFIG_FEATURE_FIND_NEWER=y +# CONFIG_FEATURE_FIND_INUM is not set +CONFIG_FEATURE_FIND_EXEC=y +CONFIG_FEATURE_FIND_USER=y +CONFIG_FEATURE_FIND_GROUP=y +CONFIG_FEATURE_FIND_NOT=y +CONFIG_FEATURE_FIND_DEPTH=y +CONFIG_FEATURE_FIND_PAREN=y +CONFIG_FEATURE_FIND_SIZE=y +CONFIG_FEATURE_FIND_PRUNE=y +# CONFIG_FEATURE_FIND_DELETE is not set +CONFIG_FEATURE_FIND_PATH=y +CONFIG_FEATURE_FIND_REGEX=y +# CONFIG_FEATURE_FIND_CONTEXT is not set +# CONFIG_FEATURE_FIND_LINKS is not set +CONFIG_GREP=y +CONFIG_FEATURE_GREP_EGREP_ALIAS=y +CONFIG_FEATURE_GREP_FGREP_ALIAS=y +CONFIG_FEATURE_GREP_CONTEXT=y +CONFIG_XARGS=y +# CONFIG_FEATURE_XARGS_SUPPORT_CONFIRMATION is not set +CONFIG_FEATURE_XARGS_SUPPORT_QUOTES=y +CONFIG_FEATURE_XARGS_SUPPORT_TERMOPT=y +CONFIG_FEATURE_XARGS_SUPPORT_ZERO_TERM=y + +# +# Init Utilities +# +# CONFIG_BOOTCHARTD is not set +# CONFIG_FEATURE_BOOTCHARTD_BLOATED_HEADER is not set +# CONFIG_FEATURE_BOOTCHARTD_CONFIG_FILE is not set +# CONFIG_HALT is not set +# CONFIG_FEATURE_CALL_TELINIT is not set +CONFIG_TELINIT_PATH="" +# CONFIG_INIT is not set +# CONFIG_FEATURE_USE_INITTAB is not set +# CONFIG_FEATURE_KILL_REMOVED is not set +CONFIG_FEATURE_KILL_DELAY=0 +# CONFIG_FEATURE_INIT_SCTTY is not set +# CONFIG_FEATURE_INIT_SYSLOG is not set +# CONFIG_FEATURE_EXTRA_QUIET is not set +# CONFIG_FEATURE_INIT_COREDUMPS is not set +# CONFIG_FEATURE_INITRD is not set +CONFIG_INIT_TERMINAL_TYPE="" +CONFIG_MESG=y +CONFIG_FEATURE_MESG_ENABLE_ONLY_GROUP=y + +# +# Login/Password Management Utilities +# +# CONFIG_ADD_SHELL is not set +# CONFIG_REMOVE_SHELL is not set +# CONFIG_FEATURE_SHADOWPASSWDS is not set +# CONFIG_USE_BB_PWD_GRP is not set +# CONFIG_USE_BB_SHADOW is not set +# CONFIG_USE_BB_CRYPT is not set +# CONFIG_USE_BB_CRYPT_SHA is not set +# CONFIG_ADDUSER is not set +# CONFIG_FEATURE_ADDUSER_LONG_OPTIONS is not set +# CONFIG_FEATURE_CHECK_NAMES is not set +CONFIG_FIRST_SYSTEM_ID=0 +CONFIG_LAST_SYSTEM_ID=0 +# CONFIG_ADDGROUP is not set +# CONFIG_FEATURE_ADDGROUP_LONG_OPTIONS is not set +# CONFIG_FEATURE_ADDUSER_TO_GROUP is not set +# CONFIG_DELUSER is not set +# CONFIG_DELGROUP is not set +# CONFIG_FEATURE_DEL_USER_FROM_GROUP is not set +CONFIG_GETTY=y +CONFIG_LOGIN=y +CONFIG_LOGIN_SESSION_AS_CHILD=y +CONFIG_PAM=y +CONFIG_LOGIN_SCRIPTS=y +CONFIG_FEATURE_NOLOGIN=y +CONFIG_FEATURE_SECURETTY=y +# CONFIG_PASSWD is not set +# CONFIG_FEATURE_PASSWD_WEAK_CHECK is not set +# CONFIG_CRYPTPW is not set +# CONFIG_CHPASSWD is not set +CONFIG_FEATURE_DEFAULT_PASSWD_ALGO="" +# CONFIG_SU is not set +# CONFIG_FEATURE_SU_SYSLOG is not set +# CONFIG_FEATURE_SU_CHECKS_SHELLS is not set +# CONFIG_SULOGIN is not set +# CONFIG_VLOCK is not set + +# +# Linux Ext2 FS Progs +# +# CONFIG_CHATTR is not set +# CONFIG_FSCK is not set +# CONFIG_LSATTR is not set +# CONFIG_TUNE2FS is not set + +# +# Linux Module Utilities +# +# CONFIG_MODINFO is not set +# CONFIG_MODPROBE_SMALL is not set +# CONFIG_FEATURE_MODPROBE_SMALL_OPTIONS_ON_CMDLINE is not set +# CONFIG_FEATURE_MODPROBE_SMALL_CHECK_ALREADY_LOADED is not set +# CONFIG_INSMOD is not set +# CONFIG_RMMOD is not set +# CONFIG_LSMOD is not set +# CONFIG_FEATURE_LSMOD_PRETTY_2_6_OUTPUT is not set +# CONFIG_MODPROBE is not set +# CONFIG_FEATURE_MODPROBE_BLACKLIST is not set +# CONFIG_DEPMOD is not set + +# +# Options common to multiple modutils +# +# CONFIG_FEATURE_2_4_MODULES is not set +# CONFIG_FEATURE_INSMOD_TRY_MMAP is not set +# CONFIG_FEATURE_INSMOD_VERSION_CHECKING is not set +# CONFIG_FEATURE_INSMOD_KSYMOOPS_SYMBOLS is not set +# CONFIG_FEATURE_INSMOD_LOADINKMEM is not set +# CONFIG_FEATURE_INSMOD_LOAD_MAP is not set +# CONFIG_FEATURE_INSMOD_LOAD_MAP_FULL is not set +# CONFIG_FEATURE_CHECK_TAINTED_MODULE is not set +# CONFIG_FEATURE_MODUTILS_ALIAS is not set +# CONFIG_FEATURE_MODUTILS_SYMBOLS is not set +CONFIG_DEFAULT_MODULES_DIR="" +CONFIG_DEFAULT_DEPMOD_FILE="" + +# +# Linux System Utilities +# +# CONFIG_BLOCKDEV is not set +CONFIG_FSTRIM=y +CONFIG_MDEV=y +CONFIG_FEATURE_MDEV_CONF=y +CONFIG_FEATURE_MDEV_RENAME=y +# CONFIG_FEATURE_MDEV_RENAME_REGEXP is not set +CONFIG_FEATURE_MDEV_EXEC=y +# CONFIG_FEATURE_MDEV_LOAD_FIRMWARE is not set +# CONFIG_REV is not set +# CONFIG_ACPID is not set +# CONFIG_FEATURE_ACPID_COMPAT is not set +CONFIG_BLKID=y +# CONFIG_FEATURE_BLKID_TYPE is not set +CONFIG_DMESG=y +CONFIG_FEATURE_DMESG_PRETTY=y +# CONFIG_FBSET is not set +# CONFIG_FEATURE_FBSET_FANCY is not set +# CONFIG_FEATURE_FBSET_READMODE is not set +CONFIG_FDFLUSH=y +CONFIG_FDFORMAT=y +CONFIG_FDISK=y +# CONFIG_FDISK_SUPPORT_LARGE_DISKS is not set +CONFIG_FEATURE_FDISK_WRITABLE=y +# CONFIG_FEATURE_AIX_LABEL is not set +# CONFIG_FEATURE_SGI_LABEL is not set +# CONFIG_FEATURE_SUN_LABEL is not set +# CONFIG_FEATURE_OSF_LABEL is not set +CONFIG_FEATURE_GPT_LABEL=y +CONFIG_FEATURE_FDISK_ADVANCED=y +# CONFIG_FINDFS is not set +# CONFIG_FLOCK is not set +CONFIG_FREERAMDISK=y +# CONFIG_FSCK_MINIX is not set +# CONFIG_MKFS_EXT2 is not set +# CONFIG_MKFS_MINIX is not set +# CONFIG_FEATURE_MINIX2 is not set +# CONFIG_MKFS_REISER is not set +# CONFIG_MKFS_VFAT is not set +CONFIG_GETOPT=y +CONFIG_FEATURE_GETOPT_LONG=y +CONFIG_HEXDUMP=y +# CONFIG_FEATURE_HEXDUMP_REVERSE is not set +# CONFIG_HD is not set +CONFIG_HWCLOCK=y +CONFIG_FEATURE_HWCLOCK_LONG_OPTIONS=y +CONFIG_FEATURE_HWCLOCK_ADJTIME_FHS=y +CONFIG_IPCRM=y +CONFIG_IPCS=y +CONFIG_LOSETUP=y +CONFIG_LSPCI=y +CONFIG_LSUSB=y +CONFIG_MKSWAP=y +# CONFIG_FEATURE_MKSWAP_UUID is not set +CONFIG_MORE=y +CONFIG_MOUNT=y +# CONFIG_FEATURE_MOUNT_FAKE is not set +CONFIG_FEATURE_MOUNT_VERBOSE=y +CONFIG_FEATURE_MOUNT_HELPERS=y +CONFIG_FEATURE_MOUNT_LABEL=y +CONFIG_FEATURE_MOUNT_NFS=y +CONFIG_FEATURE_MOUNT_CIFS=y +CONFIG_FEATURE_MOUNT_FLAGS=y +CONFIG_FEATURE_MOUNT_FSTAB=y +# CONFIG_PIVOT_ROOT is not set +CONFIG_RDATE=y +# CONFIG_RDEV is not set +CONFIG_READPROFILE=y +# CONFIG_RTCWAKE is not set +# CONFIG_SCRIPT is not set +# CONFIG_SCRIPTREPLAY is not set +CONFIG_SETARCH=y +CONFIG_SWAPONOFF=y +# CONFIG_FEATURE_SWAPON_PRI is not set +CONFIG_SWITCH_ROOT=y +CONFIG_UMOUNT=y +CONFIG_FEATURE_UMOUNT_ALL=y + +# +# Common options for mount/umount +# +CONFIG_FEATURE_MOUNT_LOOP=y +CONFIG_FEATURE_MOUNT_LOOP_CREATE=y +# CONFIG_FEATURE_MTAB_SUPPORT is not set +CONFIG_VOLUMEID=y + +# +# Filesystem/Volume identification +# +# CONFIG_FEATURE_VOLUMEID_BTRFS is not set +# CONFIG_FEATURE_VOLUMEID_CRAMFS is not set +CONFIG_FEATURE_VOLUMEID_EXFAT=y +CONFIG_FEATURE_VOLUMEID_EXT=y +CONFIG_FEATURE_VOLUMEID_F2FS=y +CONFIG_FEATURE_VOLUMEID_FAT=y +# CONFIG_FEATURE_VOLUMEID_HFS is not set +# CONFIG_FEATURE_VOLUMEID_ISO9660 is not set +# CONFIG_FEATURE_VOLUMEID_JFS is not set +# CONFIG_FEATURE_VOLUMEID_LINUXRAID is not set +# CONFIG_FEATURE_VOLUMEID_LINUXSWAP is not set +# CONFIG_FEATURE_VOLUMEID_LUKS is not set +# CONFIG_FEATURE_VOLUMEID_NILFS is not set +# CONFIG_FEATURE_VOLUMEID_NTFS is not set +# CONFIG_FEATURE_VOLUMEID_OCFS2 is not set +# CONFIG_FEATURE_VOLUMEID_REISERFS is not set +# CONFIG_FEATURE_VOLUMEID_ROMFS is not set +# CONFIG_FEATURE_VOLUMEID_SQUASHFS is not set +# CONFIG_FEATURE_VOLUMEID_SYSV is not set +# CONFIG_FEATURE_VOLUMEID_UDF is not set +# CONFIG_FEATURE_VOLUMEID_XFS is not set + +# +# Miscellaneous Utilities +# +# CONFIG_CONSPY is not set +CONFIG_LESS=y +CONFIG_FEATURE_LESS_MAXLINES=9999999 +CONFIG_FEATURE_LESS_BRACKETS=y +CONFIG_FEATURE_LESS_FLAGS=y +# CONFIG_FEATURE_LESS_MARKS is not set +CONFIG_FEATURE_LESS_REGEXP=y +# CONFIG_FEATURE_LESS_WINCH is not set +# CONFIG_FEATURE_LESS_ASK_TERMINAL is not set +# CONFIG_FEATURE_LESS_DASHCMD is not set +# CONFIG_FEATURE_LESS_LINENUMS is not set +# CONFIG_NANDWRITE is not set +# CONFIG_NANDDUMP is not set +# CONFIG_RFKILL is not set +CONFIG_SETSERIAL=y +# CONFIG_UBIATTACH is not set +# CONFIG_UBIDETACH is not set +# CONFIG_UBIMKVOL is not set +# CONFIG_UBIRMVOL is not set +# CONFIG_UBIRSVOL is not set +# CONFIG_UBIUPDATEVOL is not set +# CONFIG_WALL is not set +# CONFIG_ADJTIMEX is not set +# CONFIG_BBCONFIG is not set +# CONFIG_FEATURE_COMPRESS_BBCONFIG is not set +# CONFIG_BEEP is not set +CONFIG_FEATURE_BEEP_FREQ=0 +CONFIG_FEATURE_BEEP_LENGTH_MS=0 +# CONFIG_CHAT is not set +# CONFIG_FEATURE_CHAT_NOFAIL is not set +# CONFIG_FEATURE_CHAT_TTY_HIFI is not set +# CONFIG_FEATURE_CHAT_IMPLICIT_CR is not set +# CONFIG_FEATURE_CHAT_SWALLOW_OPTS is not set +# CONFIG_FEATURE_CHAT_SEND_ESCAPES is not set +# CONFIG_FEATURE_CHAT_VAR_ABORT_LEN is not set +# CONFIG_FEATURE_CHAT_CLR_ABORT is not set +CONFIG_CHRT=y +CONFIG_CROND=y +# CONFIG_FEATURE_CROND_D is not set +# CONFIG_FEATURE_CROND_CALL_SENDMAIL is not set +CONFIG_FEATURE_CROND_DIR="/var/spool/cron" +CONFIG_CRONTAB=y +CONFIG_DC=y +# CONFIG_FEATURE_DC_LIBM is not set +# CONFIG_DEVFSD is not set +# CONFIG_DEVFSD_MODLOAD is not set +# CONFIG_DEVFSD_FG_NP is not set +# CONFIG_DEVFSD_VERBOSE is not set +# CONFIG_FEATURE_DEVFS is not set +CONFIG_DEVMEM=y +CONFIG_EJECT=y +# CONFIG_FEATURE_EJECT_SCSI is not set +# CONFIG_FBSPLASH is not set +# CONFIG_FLASHCP is not set +# CONFIG_FLASH_LOCK is not set +# CONFIG_FLASH_UNLOCK is not set +# CONFIG_FLASH_ERASEALL is not set +# CONFIG_IONICE is not set +# CONFIG_INOTIFYD is not set +CONFIG_LAST=y +CONFIG_FEATURE_LAST_SMALL=y +# CONFIG_FEATURE_LAST_FANCY is not set +CONFIG_HDPARM=y +CONFIG_FEATURE_HDPARM_GET_IDENTITY=y +# CONFIG_FEATURE_HDPARM_HDIO_SCAN_HWIF is not set +# CONFIG_FEATURE_HDPARM_HDIO_UNREGISTER_HWIF is not set +# CONFIG_FEATURE_HDPARM_HDIO_DRIVE_RESET is not set +# CONFIG_FEATURE_HDPARM_HDIO_TRISTATE_HWIF is not set +# CONFIG_FEATURE_HDPARM_HDIO_GETSET_DMA is not set +CONFIG_MAKEDEVS=y +# CONFIG_FEATURE_MAKEDEVS_LEAF is not set +CONFIG_FEATURE_MAKEDEVS_TABLE=y +# CONFIG_MAN is not set +CONFIG_MICROCOM=y +CONFIG_MOUNTPOINT=y +CONFIG_MT=y +# CONFIG_RAIDAUTORUN is not set +# CONFIG_READAHEAD is not set +CONFIG_RUNLEVEL=y +# CONFIG_RX is not set +CONFIG_SETSID=y +CONFIG_STRINGS=y +# CONFIG_TASKSET is not set +# CONFIG_FEATURE_TASKSET_FANCY is not set +CONFIG_TIME=y +# CONFIG_TIMEOUT is not set +# CONFIG_TTYSIZE is not set +# CONFIG_VOLNAME is not set +CONFIG_WATCHDOG=y + +# +# Networking Utilities +# +CONFIG_NAMEIF=y +# CONFIG_FEATURE_NAMEIF_EXTENDED is not set +# CONFIG_NBDCLIENT is not set +# CONFIG_NC is not set +# CONFIG_NC_SERVER is not set +# CONFIG_NC_EXTRA is not set +# CONFIG_NC_110_COMPAT is not set +CONFIG_PING=y +# CONFIG_PING6 is not set +CONFIG_FEATURE_FANCY_PING=y +# CONFIG_WHOIS is not set +CONFIG_FEATURE_IPV6=y +# CONFIG_FEATURE_UNIX_LOCAL is not set +# CONFIG_FEATURE_PREFER_IPV4_ADDRESS is not set +# CONFIG_VERBOSE_RESOLUTION_ERRORS is not set +# CONFIG_ARP is not set +CONFIG_ARPING=y +# CONFIG_BRCTL is not set +# CONFIG_FEATURE_BRCTL_FANCY is not set +# CONFIG_FEATURE_BRCTL_SHOW is not set +CONFIG_DNSD=y +CONFIG_ETHER_WAKE=y +# CONFIG_FAKEIDENTD is not set +# CONFIG_FTPD is not set +# CONFIG_FEATURE_FTP_WRITE is not set +# CONFIG_FEATURE_FTPD_ACCEPT_BROKEN_LIST is not set +# CONFIG_FTPGET is not set +# CONFIG_FTPPUT is not set +# CONFIG_FEATURE_FTPGETPUT_LONG_OPTIONS is not set +CONFIG_HOSTNAME=y +# CONFIG_HTTPD is not set +# CONFIG_FEATURE_HTTPD_RANGES is not set +# CONFIG_FEATURE_HTTPD_USE_SENDFILE is not set +# CONFIG_FEATURE_HTTPD_SETUID is not set +# CONFIG_FEATURE_HTTPD_BASIC_AUTH is not set +# CONFIG_FEATURE_HTTPD_AUTH_MD5 is not set +# CONFIG_FEATURE_HTTPD_CGI is not set +# CONFIG_FEATURE_HTTPD_CONFIG_WITH_SCRIPT_INTERPR is not set +# CONFIG_FEATURE_HTTPD_SET_REMOTE_PORT_TO_ENV is not set +# CONFIG_FEATURE_HTTPD_ENCODE_URL_STR is not set +# CONFIG_FEATURE_HTTPD_ERROR_PAGES is not set +# CONFIG_FEATURE_HTTPD_PROXY is not set +# CONFIG_FEATURE_HTTPD_GZIP is not set +CONFIG_IFCONFIG=y +CONFIG_FEATURE_IFCONFIG_STATUS=y +CONFIG_FEATURE_IFCONFIG_SLIP=y +CONFIG_FEATURE_IFCONFIG_MEMSTART_IOADDR_IRQ=y +CONFIG_FEATURE_IFCONFIG_HW=y +# CONFIG_FEATURE_IFCONFIG_BROADCAST_PLUS is not set +# CONFIG_IFENSLAVE is not set +# CONFIG_IFPLUGD is not set +CONFIG_IFUPDOWN=y +CONFIG_IFUPDOWN_IFSTATE_PATH="/var/run/ifstate" +CONFIG_FEATURE_IFUPDOWN_IP=y +# CONFIG_FEATURE_IFUPDOWN_IP_BUILTIN is not set +# CONFIG_FEATURE_IFUPDOWN_IFCONFIG_BUILTIN is not set +CONFIG_FEATURE_IFUPDOWN_IPV4=y +CONFIG_FEATURE_IFUPDOWN_IPV6=y +CONFIG_FEATURE_IFUPDOWN_MAPPING=y +# CONFIG_FEATURE_IFUPDOWN_EXTERNAL_DHCP is not set +# CONFIG_INETD is not set +# CONFIG_FEATURE_INETD_SUPPORT_BUILTIN_ECHO is not set +# CONFIG_FEATURE_INETD_SUPPORT_BUILTIN_DISCARD is not set +# CONFIG_FEATURE_INETD_SUPPORT_BUILTIN_TIME is not set +# CONFIG_FEATURE_INETD_SUPPORT_BUILTIN_DAYTIME is not set +# CONFIG_FEATURE_INETD_SUPPORT_BUILTIN_CHARGEN is not set +# CONFIG_FEATURE_INETD_RPC is not set +CONFIG_IP=y +CONFIG_FEATURE_IP_ADDRESS=y +CONFIG_FEATURE_IP_LINK=y +CONFIG_FEATURE_IP_ROUTE=y +CONFIG_FEATURE_IP_TUNNEL=y +CONFIG_FEATURE_IP_RULE=y +CONFIG_FEATURE_IP_SHORT_FORMS=y +# CONFIG_FEATURE_IP_RARE_PROTOCOLS is not set +CONFIG_IPADDR=y +CONFIG_IPLINK=y +CONFIG_IPROUTE=y +CONFIG_IPTUNNEL=y +CONFIG_IPRULE=y +# CONFIG_IPCALC is not set +# CONFIG_FEATURE_IPCALC_FANCY is not set +# CONFIG_FEATURE_IPCALC_LONG_OPTIONS is not set +CONFIG_NETSTAT=y +# CONFIG_FEATURE_NETSTAT_WIDE is not set +# CONFIG_FEATURE_NETSTAT_PRG is not set +CONFIG_NSLOOKUP=y +# CONFIG_NTPD is not set +# CONFIG_FEATURE_NTPD_SERVER is not set +# CONFIG_PSCAN is not set +CONFIG_ROUTE=y +# CONFIG_SLATTACH is not set +# CONFIG_TCPSVD is not set +CONFIG_TELNET=y +CONFIG_FEATURE_TELNET_TTYPE=y +CONFIG_FEATURE_TELNET_AUTOLOGIN=y +# CONFIG_TELNETD is not set +# CONFIG_FEATURE_TELNETD_STANDALONE is not set +# CONFIG_FEATURE_TELNETD_INETD_WAIT is not set +CONFIG_TFTP=y +# CONFIG_TFTPD is not set + +# +# Common options for tftp/tftpd +# +CONFIG_FEATURE_TFTP_GET=y +CONFIG_FEATURE_TFTP_PUT=y +CONFIG_FEATURE_TFTP_BLOCKSIZE=y +# CONFIG_FEATURE_TFTP_PROGRESS_BAR is not set +# CONFIG_TFTP_DEBUG is not set +CONFIG_TRACEROUTE=y +# CONFIG_TRACEROUTE6 is not set +# CONFIG_FEATURE_TRACEROUTE_VERBOSE is not set +# CONFIG_FEATURE_TRACEROUTE_SOURCE_ROUTE is not set +# CONFIG_FEATURE_TRACEROUTE_USE_ICMP is not set +# CONFIG_TUNCTL is not set +# CONFIG_FEATURE_TUNCTL_UG is not set +# CONFIG_UDHCPC6 is not set +# CONFIG_UDHCPD is not set +# CONFIG_DHCPRELAY is not set +# CONFIG_DUMPLEASES is not set +# CONFIG_FEATURE_UDHCPD_WRITE_LEASES_EARLY is not set +# CONFIG_FEATURE_UDHCPD_BASE_IP_ON_MAC is not set +CONFIG_DHCPD_LEASES_FILE="" +CONFIG_UDHCPC=y +CONFIG_FEATURE_UDHCPC_ARPING=y +# CONFIG_FEATURE_UDHCP_PORT is not set +CONFIG_UDHCP_DEBUG=0 +# CONFIG_FEATURE_UDHCP_RFC3397 is not set +CONFIG_FEATURE_UDHCP_8021Q=y +CONFIG_UDHCPC_DEFAULT_SCRIPT="/usr/share/udhcpc/default.script" +CONFIG_UDHCPC_SLACK_FOR_BUGGY_SERVERS=80 +CONFIG_IFUPDOWN_UDHCPC_CMD_OPTIONS="-R -n" +# CONFIG_UDPSVD is not set +CONFIG_VCONFIG=y +CONFIG_WGET=y +CONFIG_FEATURE_WGET_STATUSBAR=y +CONFIG_FEATURE_WGET_AUTHENTICATION=y +CONFIG_FEATURE_WGET_LONG_OPTIONS=y +CONFIG_FEATURE_WGET_TIMEOUT=y +# CONFIG_ZCIP is not set + +# +# Print Utilities +# +# CONFIG_LPD is not set +# CONFIG_LPR is not set +# CONFIG_LPQ is not set + +# +# Mail Utilities +# +# CONFIG_MAKEMIME is not set +CONFIG_FEATURE_MIME_CHARSET="" +# CONFIG_POPMAILDIR is not set +# CONFIG_FEATURE_POPMAILDIR_DELIVERY is not set +# CONFIG_REFORMIME is not set +# CONFIG_FEATURE_REFORMIME_COMPAT is not set +# CONFIG_SENDMAIL is not set + +# +# Process Utilities +# +# CONFIG_IOSTAT is not set +CONFIG_LSOF=y +# CONFIG_MPSTAT is not set +# CONFIG_NMETER is not set +# CONFIG_PMAP is not set +# CONFIG_POWERTOP is not set +# CONFIG_PSTREE is not set +# CONFIG_PWDX is not set +# CONFIG_SMEMCAP is not set +CONFIG_TOP=y +CONFIG_FEATURE_TOP_CPU_USAGE_PERCENTAGE=y +CONFIG_FEATURE_TOP_CPU_GLOBAL_PERCENTS=y +# CONFIG_FEATURE_TOP_SMP_CPU is not set +# CONFIG_FEATURE_TOP_DECIMALS is not set +# CONFIG_FEATURE_TOP_SMP_PROCESS is not set +# CONFIG_FEATURE_TOPMEM is not set +CONFIG_UPTIME=y +# CONFIG_FEATURE_UPTIME_UTMP_SUPPORT is not set +CONFIG_FREE=y +CONFIG_FUSER=y +CONFIG_KILL=y +CONFIG_KILLALL=y +CONFIG_KILLALL5=y +# CONFIG_PGREP is not set +CONFIG_PIDOF=y +CONFIG_FEATURE_PIDOF_SINGLE=y +CONFIG_FEATURE_PIDOF_OMIT=y +# CONFIG_PKILL is not set +CONFIG_PS=y +# CONFIG_FEATURE_PS_WIDE is not set +# CONFIG_FEATURE_PS_LONG is not set +# CONFIG_FEATURE_PS_TIME is not set +# CONFIG_FEATURE_PS_ADDITIONAL_COLUMNS is not set +# CONFIG_FEATURE_PS_UNUSUAL_SYSTEMS is not set +CONFIG_RENICE=y +CONFIG_BB_SYSCTL=y +# CONFIG_FEATURE_SHOW_THREADS is not set +CONFIG_WATCH=y + +# +# Runit Utilities +# +# CONFIG_RUNSV is not set +# CONFIG_RUNSVDIR is not set +# CONFIG_FEATURE_RUNSVDIR_LOG is not set +# CONFIG_SV is not set +CONFIG_SV_DEFAULT_SERVICE_DIR="" +# CONFIG_SVLOGD is not set +# CONFIG_CHPST is not set +# CONFIG_SETUIDGID is not set +# CONFIG_ENVUIDGID is not set +# CONFIG_ENVDIR is not set +# CONFIG_SOFTLIMIT is not set + +# +# SELinux Utilities +# +# CONFIG_CHCON is not set +# CONFIG_FEATURE_CHCON_LONG_OPTIONS is not set +# CONFIG_GETENFORCE is not set +# CONFIG_GETSEBOOL is not set +# CONFIG_LOAD_POLICY is not set +# CONFIG_MATCHPATHCON is not set +# CONFIG_RESTORECON is not set +# CONFIG_RUNCON is not set +# CONFIG_FEATURE_RUNCON_LONG_OPTIONS is not set +# CONFIG_SELINUXENABLED is not set +# CONFIG_SETENFORCE is not set +# CONFIG_SETFILES is not set +# CONFIG_FEATURE_SETFILES_CHECK_OPTION is not set +# CONFIG_SETSEBOOL is not set +# CONFIG_SESTATUS is not set + +# +# Shells +# +CONFIG_ASH=y +CONFIG_ASH_BASH_COMPAT=y +CONFIG_ASH_IDLE_TIMEOUT=y +CONFIG_ASH_JOB_CONTROL=y +CONFIG_ASH_ALIAS=y +CONFIG_ASH_GETOPTS=y +CONFIG_ASH_BUILTIN_ECHO=y +CONFIG_ASH_BUILTIN_PRINTF=y +CONFIG_ASH_BUILTIN_TEST=y +CONFIG_ASH_CMDCMD=y +# CONFIG_ASH_MAIL is not set +CONFIG_ASH_OPTIMIZE_FOR_SIZE=y +CONFIG_ASH_RANDOM_SUPPORT=y +CONFIG_ASH_EXPAND_PRMT=y +# CONFIG_CTTYHACK is not set +# CONFIG_HUSH is not set +# CONFIG_HUSH_BASH_COMPAT is not set +# CONFIG_HUSH_BRACE_EXPANSION is not set +# CONFIG_HUSH_HELP is not set +# CONFIG_HUSH_INTERACTIVE is not set +# CONFIG_HUSH_SAVEHISTORY is not set +# CONFIG_HUSH_JOB is not set +# CONFIG_HUSH_TICK is not set +# CONFIG_HUSH_IF is not set +# CONFIG_HUSH_LOOPS is not set +# CONFIG_HUSH_CASE is not set +# CONFIG_HUSH_FUNCTIONS is not set +# CONFIG_HUSH_LOCAL is not set +# CONFIG_HUSH_RANDOM_SUPPORT is not set +# CONFIG_HUSH_EXPORT_N is not set +# CONFIG_HUSH_MODE_X is not set +# CONFIG_MSH is not set +CONFIG_FEATURE_SH_IS_ASH=y +# CONFIG_FEATURE_SH_IS_HUSH is not set +# CONFIG_FEATURE_SH_IS_NONE is not set +CONFIG_FEATURE_BASH_IS_ASH=y +# CONFIG_FEATURE_BASH_IS_HUSH is not set +# CONFIG_FEATURE_BASH_IS_NONE is not set +CONFIG_SH_MATH_SUPPORT=y +# CONFIG_SH_MATH_SUPPORT_64 is not set +CONFIG_FEATURE_SH_EXTRA_QUIET=y +# CONFIG_FEATURE_SH_STANDALONE is not set +# CONFIG_FEATURE_SH_NOFORK is not set +# CONFIG_FEATURE_SH_HISTFILESIZE is not set + +# +# System Logging Utilities +# +# CONFIG_SYSLOGD is not set +# CONFIG_FEATURE_ROTATE_LOGFILE is not set +# CONFIG_FEATURE_REMOTE_LOG is not set +# CONFIG_FEATURE_SYSLOGD_DUP is not set +# CONFIG_FEATURE_SYSLOGD_CFG is not set +CONFIG_FEATURE_SYSLOGD_READ_BUFFER_SIZE=0 +# CONFIG_FEATURE_IPC_SYSLOG is not set +CONFIG_FEATURE_IPC_SYSLOG_BUFFER_SIZE=0 +# CONFIG_LOGREAD is not set +# CONFIG_FEATURE_LOGREAD_REDUCED_LOCKING is not set +# CONFIG_FEATURE_KMSG_SYSLOG is not set +# CONFIG_KLOGD is not set +# CONFIG_FEATURE_KLOGD_KLOGCTL is not set +CONFIG_LOGGER=y
Signature · 1 line
1.9.1
PATCH v4 16/27 qemu_x86_selinux_defconfig: base SELinux QEMU image for x86
In reply to Matt WeberFrom: Clayton Shotwell <[email protected]>
This will build a base SELinux system that boots with SELinux in permissive mode.
Signed-off-by Clayton Shotwell <[email protected]>
Signed-off-by Matthew Weber <[email protected]>
--- board/qemu/x86/linux-3.12-selinux.config | 77 ++++++++++++++++++++++++++++++++ configs/qemu_x86_selinux_defconfig | 53 ++++++++++++++++++++++ 2 files changed, 130 insertions(+) create mode 100644 board/qemu/x86/linux-3.12-selinux.config create mode 100644 configs/qemu_x86_selinux_defconfig
board/qemu/x86/linux-3.12-selinux.config new file +77 -0
@@ -0,0 +1,77 @@ +# CONFIG_LOCALVERSION_AUTO is not set +# CONFIG_SWAP is not set +CONFIG_AUDIT=y +# CONFIG_COMPAT_BRK is not set +CONFIG_MODULES=y +# CONFIG_BLK_DEV_BSG is not set +# CONFIG_IOSCHED_DEADLINE is not set +# CONFIG_IOSCHED_CFQ is not set +# CONFIG_X86_EXTENDED_PLATFORM is not set +# CONFIG_SCHED_OMIT_FRAME_POINTER is not set +# CONFIG_MTRR_SANITIZER is not set +# CONFIG_SECCOMP is not set +# CONFIG_RELOCATABLE is not set +CONFIG_NET=y +CONFIG_PACKET=y +CONFIG_UNIX=y +CONFIG_INET=y +CONFIG_IP_PNP=y +# CONFIG_INET_XFRM_MODE_TRANSPORT is not set +# CONFIG_INET_XFRM_MODE_TUNNEL is not set +# CONFIG_INET_XFRM_MODE_BEET is not set +# CONFIG_INET_LRO is not set +# CONFIG_INET_DIAG is not set +# CONFIG_IPV6 is not set +# CONFIG_WIRELESS is not set +CONFIG_DEVTMPFS=y +CONFIG_DEVTMPFS_MOUNT=y +# CONFIG_PREVENT_FIRMWARE_BUILD is not set +# CONFIG_FIRMWARE_IN_KERNEL is not set +# CONFIG_BLK_DEV is not set +CONFIG_BLK_DEV_SD=y +CONFIG_ATA=y +CONFIG_ATA_PIIX=y +CONFIG_NETDEVICES=y +CONFIG_NE2K_PCI=y +CONFIG_8139CP=y +# CONFIG_WLAN is not set +# CONFIG_INPUT_MOUSEDEV_PSAUX is not set +# CONFIG_INPUT_MOUSE is not set +# CONFIG_SERIO_SERPORT is not set +# CONFIG_LEGACY_PTYS is not set +# CONFIG_DEVKMEM is not set +CONFIG_SERIAL_8250=y +CONFIG_SERIAL_8250_CONSOLE=y +# CONFIG_HW_RANDOM is not set +# CONFIG_HWMON is not set +CONFIG_SOUND=y +CONFIG_SND=y +CONFIG_SND_HDA_INTEL=y +# CONFIG_USB_SUPPORT is not set +# CONFIG_X86_PLATFORM_DEVICES is not set +# CONFIG_DMIID is not set +CONFIG_EXT2_FS=y +CONFIG_EXT2_FS_XATTR=y +CONFIG_EXT2_FS_POSIX_ACL=y +CONFIG_EXT2_FS_SECURITY=y +CONFIG_EXT3_FS=y +CONFIG_EXT3_FS_POSIX_ACL=y +CONFIG_EXT3_FS_SECURITY=y +# CONFIG_DNOTIFY is not set +# CONFIG_INOTIFY_USER is not set +CONFIG_TMPFS=y +CONFIG_TMPFS_POSIX_ACL=y +# CONFIG_MISC_FILESYSTEMS is not set +CONFIG_NFS_FS=y +CONFIG_ROOT_NFS=y +# CONFIG_ENABLE_WARN_DEPRECATED is not set +# CONFIG_ENABLE_MUST_CHECK is not set +# CONFIG_UNUSED_SYMBOLS is not set +# CONFIG_FRAME_POINTER is not set +# CONFIG_X86_VERBOSE_BOOTUP is not set +CONFIG_SECURITY=y +CONFIG_SECURITY_NETWORK=y +CONFIG_SECURITY_SELINUX=y +CONFIG_SECURITY_SELINUX_BOOTPARAM=y +CONFIG_CRYPTO_ANSI_CPRNG=y +# CONFIG_VIRTUALIZATION is not set
configs/qemu_x86_selinux_defconfig new file +53 -0
53 lines not on this page · raw message
Signature · 1 line
1.9.1
PATCH v4 17/27 linux-pam: selinux support
In reply to Matt WeberSigned-off-by Matthew Weber <[email protected]>
--- .../linux-pam-08-audit-log-acct_message_ret.patch | 16 ++++++ package/linux-pam/linux-pam.mk | 58 +++++++++++++++++++++- package/linux-pam/system-auth.pamd | 15 ++++++ 3 files changed, 88 insertions(+), 1 deletion(-) create mode 100644 package/linux-pam/linux-pam-08-audit-log-acct_message_ret.patch create mode 100644 package/linux-pam/system-auth.pamd
package/linux-pam/linux-pam-08-audit-log-acct_message_ret.patch new file +16 -0
@@ -0,0 +1,16 @@ +--- a/libpam/pam_audit.c 2011-06-21 04:04:56.000000000 -0500 ++++ b/libpam/pam_audit.c 2012-09-12 08:55:26.000000000 -0500 +@@ -41,11 +41,11 @@ + an official errno number, but must not. It can also be a audit + internal error code. Which makes errno useless :-((. Try the + best to fix it. */ +- errno = -rc; ++ errno = rc; + + pamh->audit_state |= PAMAUDIT_LOGGED; + +- if (rc < 0) { ++ if (rc <= 0) { + if (rc == -EPERM && getuid() != 0) + return 0; + if (errno != old_errno) {
package/linux-pam/linux-pam.mk +57 -1
83 lines not on this page · raw message
package/linux-pam/system-auth.pamd new file +15 -0
@@ -0,0 +1,15 @@ +#%PAM-1.0 +auth required pam_env.so +auth sufficient pam_unix.so +auth required pam_deny.so + +account required pam_unix.so + +#password required pam_cracklib.so try_first_pass retry=3 +password sufficient pam_unix.so md5 shadow try_first_pass +password required pam_deny.so + +session optional pam_keyinit.so revoke +session required pam_limits.so +session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid +session required pam_unix.so
Signature · 1 line
1.9.1
PATCH v4 18/27 sysvinit: added libselinux dependency
In reply to Matt WeberSigned-off-by Matthew Weber <[email protected]>
--- .../sysvinit-0010-fix-WITH-SELINUX-define.patch | 24 ++++++++++++++++++++++ package/sysvinit/sysvinit.mk | 11 +++++++++- 2 files changed, 34 insertions(+), 1 deletion(-) create mode 100644 package/sysvinit/sysvinit-0010-fix-WITH-SELINUX-define.patch
package/sysvinit/sysvinit-0010-fix-WITH-SELINUX-define.patch new file +24 -0
@@ -0,0 +1,24 @@ +--- a/src/Makefile 2010-04-11 04:30:27.000000000 -0500 ++++ b/src/Makefile 2014-09-16 14:07:31.404952266 -0500 +@@ -104,7 +104,7 @@ + + runlevel: runlevel.o + +-sulogin: LDLIBS += $(SULOGINLIBS) $(STATIC) ++sulogin: LDLIBS += $(SULOGINLIBS) $(INITLIBS) $(STATIC) + sulogin: sulogin.o + + wall: dowall.o wall.o +@@ -114,10 +115,10 @@ + bootlogd: LDLIBS += -lutil + bootlogd: bootlogd.o + +-sulogin.o: CPPFLAGS += $(SELINUX_DEF) ++sulogin.o: CFLAGS += $(SELINUX_DEF) + sulogin.o: sulogin.c + +-init.o: CPPFLAGS += $(SELINUX_DEF) ++init.o: CFLAGS += $(SELINUX_DEF) + init.o: init.c init.h set.h reboot.h initreq.h + + utmp.o: utmp.c init.h
package/sysvinit/sysvinit.mk +10 -1
@@ -13,7 +13,16 @@ SYSVINIT_LICENSE_FILES = COPYING # Override BusyBox implementations if BusyBox is enabled. ifeq ($(BR2_PACKAGE_BUSYBOX),y) -SYSVINIT_DEPENDENCIES = busybox +SYSVINIT_DEPENDENCIES += busybox +endif + +ifeq ($(BR2_PACKAGE_LIBSELINUX),y) +SYSVINIT_DEPENDENCIES += libselinux +TARGET_CONFIGURE_OPTS += WITH_SELINUX="yes" ROOT="$(TARGET_DIR)" +endif + +ifeq ($(BR2_PACKAGE_LIBSELINUX),y) +TARGET_CONFIGURE_OPTS += WITH_SELINUX="yes" ROOT="$(TARGET_DIR)" endif define SYSVINIT_DEBIAN_PATCHES
Signature · 1 line
1.9.1
PATCH v4 19/27 dbus: selinux file context support
In reply to Matt WeberSigned-off-by Matthew Weber <[email protected]>
--- package/dbus/S30dbus | 4 ++++ package/dbus/dbus.mk | 14 ++++++++++++++ 2 files changed, 18 insertions(+) mode change 100755 => 100644 package/dbus/S30dbus
package/dbus/S30dbus +4 -0
@@ -17,6 +17,10 @@ [ -d /var/run/dbus ] || mkdir -p /var/run/dbus [ -d /var/lock/subsys ] || mkdir -p /var/lock/subsys [ -d /tmp/dbus ] || mkdir -p /tmp/dbus +[ -d /var/lib/dbus ] || mkdir -p /var/lib/dbus +if [ -e /sbin/restorecon ]; then + restorecon -R /var/run/dbus /var/lock/subsys /tmp/dbus /var/lib/dbus +fi RETVAL=0
package/dbus/dbus.mk +14 -0
@@ -44,6 +44,20 @@ ifeq ($(BR2_microblaze),y) DBUS_CONF_OPTS += --disable-inotify endif +ifeq ($(BR2_PACKAGE_LIBSELINUX),y) +DBUS_CONF_OPTS += --enable-selinux +DBUS_DEPENDENCIES += libselinux +else +DBUS_CONF_OPTS += --disable-selinux +endif + +ifeq ($(BR2_PACKAGE_AUDIT),y) +DBUS_CONF_OPTS += --enable-libaudit +DBUS_DEPENDENCIES += audit libcap-ng +else +DBUS_CONF_OPTS += --disable-libaudit +endif + ifeq ($(BR2_PACKAGE_XLIB_LIBX11),y) DBUS_CONF_OPTS += --with-x DBUS_DEPENDENCIES += xlib_libX11
Signature · 1 line
1.9.1
PATCH v4 20/27 logrotate: selinux support
In reply to Matt WeberSigned-off-by Matthew Weber <[email protected]>
--- package/logrotate/logrotate.mk | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
package/logrotate/logrotate.mk +10 -1
@@ -11,8 +11,17 @@ LOGROTATE_LICENSE_FILES = COPYING LOGROTATE_DEPENDENCIES = popt +LOGROTATE_CFLAGS = $(TARGET_CFLAGS) +LOGROTATE_LDFLAGS = $(TARGET_LDFLAGS) + +ifeq ($(BR2_PACKAGE_LIBSELINUX),y) +LOGROTATE_DEPENDENCIES += libselinux +LOGROTATE_CFLAGS += -DWITH_SELINUX=yes +LOGROTATE_LDFLAGS += -lselinux +endif + define LOGROTATE_BUILD_CMDS - $(MAKE) CC="$(TARGET_CC) $(TARGET_CFLAGS)" LDFLAGS="$(LDFLAGS)" -C $(@D) + $(MAKE) CC="$(TARGET_CC) $(LOGROTATE_CFLAGS)" LDFLAGS="$(LOGROTATE_LDFLAGS)" -C $(@D) endef define LOGROTATE_INSTALL_TARGET_CMDS
Signature · 1 line
1.9.1
PATCH v4 21/27 openssh: selinux and pam support
In reply to Matt WeberSigned-off-by Matthew Weber <[email protected]>
--- package/openssh/openssh.mk | 12 ++++++++++++ 1 file changed, 12 insertions(+)
package/openssh/openssh.mk +12 -0
@@ -29,9 +29,21 @@ endif OPENSSH_DEPENDENCIES = zlib openssl +define OPENSSH_INSTALL_PAM_CONF + $(INSTALL) -D -m 644 $(@D)/contrib/sshd.pam.generic $(TARGET_DIR)/etc/pam.d/sshd + sed -i '/password required \/lib\/security\/pam_cracklib.so/d' $(TARGET_DIR)/etc/pam.d/sshd + sed -i -e 's/\#UsePAM no/UsePAM yes/' $(TARGET_DIR)/etc/ssh/sshd_config +endef + ifeq ($(BR2_PACKAGE_LINUX_PAM),y) OPENSSH_DEPENDENCIES += linux-pam OPENSSH_CONF_OPTS += --with-pam +OPENSSH_POST_INSTALL_TARGET_HOOKS += OPENSSH_INSTALL_PAM_CONF +endif + +ifeq ($(BR2_PACKAGE_LIBSELINUX),y) +OPENSSH_DEPENDENCIES += libselinux +OPENSSH_CONF_OPTS += --with-selinux endif define OPENSSH_INSTALL_INIT_SYSTEMD
Signature · 1 line
1.9.1
PATCH v4 22/27 util-linux: selinux, audit, and pam support
In reply to Matt WeberSigned-off-by Matthew Weber <[email protected]>
--- package/util-linux/util-linux.mk | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+)
package/util-linux/util-linux.mk +21 -0
@@ -51,6 +51,27 @@ ifeq ($(BR2_PACKAGE_LIBCAP_NG),y) UTIL_LINUX_DEPENDENCIES += libcap-ng endif +ifeq ($(BR2_PACKAGE_LIBSELINUX),y) +UTIL_LINUX_DEPENDENCIES += libselinux +UTIL_LINUX_CONF_OPTS += --with-selinux +else +UTIL_LINUX_CONF_OPTS += --without-selinux +endif + +ifeq ($(BR2_PACKAGE_PAM),y) +UTIL_LINUX_DEPENDENCIES += pam +UTIL_LINUX_CONF_OPTS += --with-pam +else +UTIL_LINUX_CONF_OPTS += --without-pam +endif + +ifeq ($(BR2_PACKAGE_AUDIT),y) +UTIL_LINUX_DEPENDENCIES += audit +UTIL_LINUX_CONF_OPTS += --with-audit +else +UTIL_LINUX_CONF_OPTS += --without-audit +endif + # Used by cramfs utils UTIL_LINUX_DEPENDENCIES += $(if $(BR2_PACKAGE_ZLIB),zlib)
Signature · 1 line
1.9.1
PATCH v4 23/27 vim: selinux support
In reply to Matt WeberSigned-off-by Matthew Weber <[email protected]>
--- package/vim/vim.mk | 7 +++++++ 1 file changed, 7 insertions(+)
package/vim/vim.mk +7 -0
@@ -28,6 +28,13 @@ VIM_CONF_OPTS = --with-tlib=ncurses --enable-gui=no --without-x VIM_LICENSE = Charityware VIM_LICENSE_FILES = README.txt +ifeq ($(BR2_PACKAGE_LIBSELINUX),y) +VIM_CONF_OPTS += --enable-selinux +VIM_DEPENDENCIES += libselinux +else +VIM_CONF_OPTS += --disable-selinux +endif + define VIM_INSTALL_TARGET_CMDS cd $(@D)/src; \ $(MAKE) DESTDIR=$(TARGET_DIR) installvimbin; \
Signature · 1 line
1.9.1
PATCH v4 24/27 rsyslog: fix config file comment style
In reply to Matt WeberSigned-off-by Matthew Weber <[email protected]>
--- package/rsyslog/rsyslog.mk | 4 ++++ 1 file changed, 4 insertions(+)
package/rsyslog/rsyslog.mk +4 -0
@@ -54,6 +54,10 @@ endef define RSYSLOG_INSTALL_CONF $(INSTALL) -m 0644 -D $(@D)/platform/redhat/rsyslog.conf \ $(TARGET_DIR)/etc/rsyslog.conf + # Fix invalid config file comment style + $(SED) 's~\/\* ~# ~g' $(TARGET_DIR)/etc/rsyslog.conf + $(SED) 's~ \*\/~# ~g' $(TARGET_DIR)/etc/rsyslog.conf + $(SED) 's~ \*~# ~g' $(TARGET_DIR)/etc/rsyslog.conf mkdir -p $(TARGET_DIR)/etc/rsyslog.d endef
Signature · 1 line
1.9.1
PATCH v4 25/27 qemu x86 readme: documented selinux target
In reply to Matt WeberSigned-off-by Matthew Weber <[email protected]>
--- board/qemu/x86/readme.txt | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-)
board/qemu/x86/readme.txt +19 -1
@@ -4,4 +4,22 @@ Run the emulation with: The login prompt will appear in the graphical window. -Tested with QEMU 2.2.0 +Tested with QEMU 2.1.2 + +------------------------------------------------------------------- + +Run the SElinux target emulation with: + + qemu-system-i386 -M pc -kernel output/images/bzImage -drive file=output/images/rootfs.ext2,if=ide -append "root=/dev/sda rw console=ttyS0 selinux=1" -net nic,model=rtl8139 -net user -display vnc=localhost:1 -serial stdio + +The emulation should reboot once the first time for relabeling and then +provide a login prompt. The login is username root and password root +because PAM requires a password in this secure configuration. +To enable SELinux enforcing at boot, login and edit the /etc/selinux/config +and set SELINUX to enforcing. Save and make sure to "sync" before restarting +the emulation as the ext2 fs would otherwise corrupt when the emulation +exits. After enforcing is default, the selinux= provided as part of the +qemu "append" above can be used to turn enforcing on/off. Currently +the enforcing policy configuration doesn't allow getty login, only ssh login. +This configuration would be tailored as part of a targets refpolicy +customization.
Signature · 1 line
1.9.1
PATCH v4 26/27 readline: host support for host-sqlite
In reply to Matt WeberSigned-off-by Matthew Weber <[email protected]>
--- package/readline/readline.mk | 1 + 1 file changed, 1 insertion(+)
package/readline/readline.mk +1 -0
@@ -19,4 +19,5 @@ endef READLINE_POST_INSTALL_TARGET_HOOKS += READLINE_PURGE_EXAMPLES +$(eval $(host-autotools-package)) $(eval $(autotools-package))
Signature · 1 line
1.9.1
PATCH v4 27/27 libsemanage: cleanup python use and license definition
In reply to Matt WeberThe original package supported python on target, now we just use it as part of the host tools. The license was also mis-assigned.
Signed-off-by Matthew Weber <[email protected]>
--- package/libsemanage/Config.in | 10 ------- package/libsemanage/libsemanage.mk | 54 ++++++++++++++++---------------------- 2 files changed, 22 insertions(+), 42 deletions(-)
package/libsemanage/Config.in +0 -10
@@ -17,15 +17,5 @@ config BR2_PACKAGE_LIBSEMANAGE http://selinuxproject.org/page/Main_Page -if BR2_PACKAGE_LIBSEMANAGE - -config BR2_PACKAGE_LIBSEMANAGE_PYTHON_BINDINGS - depends on BR2_PACKAGE_PYTHON - bool "python bindings" - help - Enable building python bindings - -endif - comment "libsemanage needs a toolchain w/ largefile, threads, dynamic library" depends on !BR2_TOOLCHAIN_HAS_THREADS || !BR2_LARGEFILE || BR2_STATIC_LIBS
package/libsemanage/libsemanage.mk +22 -32
88 lines not on this page · raw message
Signature · 1 line
1.9.1
v4 cover SELinux Buildroot Additions
In reply to Matt WeberDear Matt Weber,
Quoted 8 lines · Matt Weber
### What's SELinux?
Security-Enhanced Linux (SELinux) is a Linux feature that provides a variety of security policies, including
U.S. Department of Defense style mandatory access controls (MAC), through the use of Linux Security Modules (LSM) in the Linux kernel. It is not a Linux distribution, but rather a set of modifications that can be applied to Unix-like operating systems, such as Linux and BSD.
Thanks for your persistence with this major effort. I must say overall I am still a bit scared by the amount of patches needed in the various SELinux components to get them to behave properly in a cross-compilation environment, and I believe those changes should be submitted upstream.
I made the exact same comment back when you submitted the first version in September 2013, but apparently no work has been done to improve upstream with regarding to cross-compilation. I'm certainly not asking for the entire work to be done. But the fact that within the 1.5 years since you first submitted this patch series, you have apparently not worked with upstream to resolve those issues does not make me very comfortable. What tells me that this upstreaming work will start at some point?
Main examples:
- The Swig / setools patch. This patch is quite long, but fairly trivial. Why hasn't it been submitted upstream?
- Clearly, the thing that scares me the most if the replacement of the audit header generation by a Python script. Can we get at least some feedback from upstream on what approach they could accept? See also what Yocto is doing to solve this problem:
http://git.yoctoproject.org/cgit/cgit.cgi/meta-selinux/tree/recipes-security/audit/audit/audit-for-cross-compiling.patch
Can you give me your plans about upstreaming those cross-compilation changes?
Thanks,
Thomas
Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons Embedded Linux, Kernel and Android engineering http://free-electrons.com
v4 cover SELinux Buildroot Additions
Thomas,
Quoted 19 lines · Thomas Petazzoni
Dear Matt Weber,
Quoted 8 lines · Matt Weber
### What's SELinux?
Security-Enhanced Linux (SELinux) is a Linux feature that provides a variety of security policies, including
U.S. Department of Defense style mandatory access controls (MAC), through the use of Linux Security Modules (LSM) in the Linux kernel. It is not a Linux distribution, but rather a set of modifications that can be applied to Unix-like operating systems, such as Linux and BSD.Thanks for your persistence with this major effort. I must say overall I am still a bit scared by the amount of patches needed in the various SELinux components to get them to behave properly in a cross-compilation environment, and I believe those changes should be submitted upstream.
Quoted 8 lines
I made the exact same comment back when you submitted the first version in September 2013, but apparently no work has been done to improve upstream with regarding to cross-compilation. I'm certainly not asking for the entire work to be done. But the fact that within the 1.5 years since you first submitted this patch series, you have apparently not worked with upstream to resolve those issues does not make me very comfortable. What tells me that this upstreaming work will start at some point?
We did get feedback and I'll elaborate more below. In general the packages required to provide SELinux support are tightly interwoven version wise and internally we haven't jumped to the latest yet because of the validation required to do so. Most of the package versions in this patchset are the last stable configuration still used by the majority of other SELinux enabled Linux distributions. There are a few packages that we could definitely pull forward which will improve the cross compiling capability, but at the cost of possibly breaking functionality. (I'm not advocating in any way for the cross compilation patches that I've submitted, they just produce a stable configuration that we're using. So to move forward, we are reviewing those and working back through our upstream email threads to see where things ended up or if we should bump the package.)
Per your other email about patchworks, I'm curious to see if others are interested in SELinux being merged. If there is interest, I would rather take feedback, a couple release cycles, some testing and get the right configuration merged.
Quoted 5 lines
Main examples:
- The Swig / setools patch. This patch is quite long, but fairly trivial. Why hasn't it been submitted upstream?
Tresys released setools as a open source project but wasn't open to feedback to resolve issues. Plus they stopped updating setools3 when they started setools4 (which is a major rework, still trying to figure out impacts to updating to this. the latest does fix cross compilation though by changing to the setuptools for building....).
Quoted 6 lines
- Clearly, the thing that scares me the most if the replacement of the audit header generation by a Python script. Can we get at least some feedback from upstream on what approach they could accept? See also what Yocto is doing to solve this problem:
http://git.yoctoproject.org/cgit/cgit.cgi/meta-selinux/tree/recipes-security/audit/audit/audit-for-cross-compiling.patch
Thanks, will take a look.
I do know that the newer versions have changed things. We have not yet bumped to that version for testing though. I will bump and reassess the impact.
I have found some of Clayton's notes and the email thread but the maintainer never merged our work or confirmed a workaround. I think it might have been because of the pending updates.
Quoted 3 lines
Can you give me your plans about upstreaming those cross-compilation changes?
Will do. In advance, I apologize for the slow responses over the next couple weeks. Clayton is joining me next month and we will have more time to make progress on cleanup and bumping of package versions.
Thanks,
Matt