SELinux Buildroot Additions
v8 cover SELinux Buildroot Additions
### Highlevel updates in v8 of these patches
* Dropped several patches because they have been committed already
* Refactored the policycoreutils patch to make it more upstreamable
* Added a new patch to add the audit package startup script which was removed from the audit package before it was committed due issues
* Corrected various minor issues in many other patches
### What's SELinux?
Security-Enhanced Linux (SELinux) is a Linux feature that provides a variety of security policies, including U.S. Department of Defense style mandatory access controls (MAC), through the use of Linux Security Modules (LSM) in the Linux kernel. It is not a Linux distribution, but rather a set of modifications that can be applied to Unix-like operating systems, such as Linux and BSD.
Running SELinux under a Linux distribution requires three things:
An SELinux enabled kernel, SELinux Userspace tools and libraries, and SELinux Policies (mostly based on the Reference Policy). Some common Linux programs will also need to be patched/compiled with SELinux features. (Credit Archlinux wiki)
### What's in this patchset?
This patchset adds the required userspace tools, libraries, example QEMU target, existing package modifications, and initial policy to Buildroot.
The design approach took a minimalist view to the selinux capability. The necessary packages have been added but all the ways in which they could be used (target vs host) are not exposed. One example is the audit2allow framework that requires python. This is currently setup for "host only use" to post analyze audit service output. It could also be setup for target use but it would require the target to have python and other supporting libs present.
Another aspect that utilized known SELinux capable applications was for init and logging. We choose to use sysvinit and rsyslog instead of the busybox applet version. This simplified getting this initial configuration pulled together.
Lastly, the building of libselinux was limited to a set of architectures and libraries that have been tested. An area for future work will be to enable broader use.
Some references to help with the review of this patchset. Arch and Gentoo implementation and design details:
https://wiki.archlinux.org/index.php/SELinux
http://wiki.gentoo.org/wiki/SELinux
http://wiki.gentoo.org/wiki/SELinux/Installation
### Details of changes from previous patchsets
This is a new round of patches based on the v5 patchset from last year. The changes since v4 consist of:
* The removal of on target policy debugging using audit2allow. The host tools have been setup to provide offline capability for analyzing audit output.
* The example qemu configuration defaults to using full versions of applications instead of the busybox applets. This simplified the configuration but as a side effect grew the filesystem size. There is definitely opportunity to slim down the approach to just using busybox applets (I've still included the patches that enable the capability to create individual applets).
* Added documentation of the qemu target to that targets readme
* Updated for structural changes (OPTS vs OPT, patch naming, improvements to existing packages)
* Autobuilder was modified to run against our upstreaming branch and has has logged a couple weeks of builds and almost all of the issues are resolved against the current upstream.
Since Refpolicy is heavily tailored for a projects use, the package exposed options of using the provided version with patches or a custom GIT repo. Here's a bit more detail on those assumptions.
* Refpolicy as the package defines with default patches plus possibly some global patches applied. Using a default modules config file provided in the package folder or provided by the user.
* Refpolicy looking at specific git repo revisions. Using a modules config file from within that git repo.
* Repolicy using src override which assumes the same as the git repo case for where the modules config file originates.
### What's next:
* Testing out support for using busybox applets instead of sysvinit/util-linux/etc.
* qemu targets for ARM and PPC
Clayton Shotwell (8):
policycoreutils: new package
refpolicy: new package
busybox: applets as individual binaries
busybox: selinux support
qemu x86 selinux: base br defconfig
squashfs: Add xattr support
cpio: new package
audit: Add startup script
Matt Weber (8):
linux-pam: selinux support
busybox: added linux-pam support
sysvinit: added libselinux dependency
dbus: selinux file context support
openssh: selinux and pam support
util-linux: selinux, audit, and pam support
rsyslog: fix config file comment style
qemu x86 selinux: added common selinux support files
board/common_selinux/busybox-selinux.config | 1058 ++++++++++++++++++++ board/common_selinux/post_build.sh | 30 + .../common_selinux/skeleton/etc/audit/auditd.conf | 32 + .../skeleton/etc/audit/rules.d/audit.rules | 3 + board/common_selinux/skeleton/etc/fstab | 15 + board/common_selinux/skeleton/etc/inittab | 29 + board/common_selinux/skeleton_permissions.txt | 26 + board/qemu/x86/linux-4.0-selinux.config | 77 ++ board/qemu/x86/readme.txt | 17 + configs/qemu_x86_selinux_defconfig | 67 ++ package/Config.in | 4 + package/Config.in.host | 1 + package/audit/S01auditd | 80 ++ package/audit/audit.mk | 4 + ...s-Add-installation-of-individual-binaries.patch | 103 ++ ...ags-strip-non-l-arguments-returned-by-pkg.patch | 28 + package/busybox/Config.in | 25 + package/busybox/busybox.mk | 57 ++ package/cpio/Config.in | 8 + package/cpio/Config.in.host | 6 + package/cpio/cpio.hash | 9 + package/cpio/cpio.mk | 27 + package/dbus/S30dbus | 4 + package/dbus/dbus.mk | 14 + package/linux-pam/linux-pam.mk | 56 +- package/linux-pam/system-auth.pamd | 15 + package/openssh/openssh.mk | 16 + ...IR-to-all-paths-that-use-an-absolute-path.patch | 258 +++++ .../0002-Allow-CFLAGS-to-be-overwritten.patch | 57 ++ ...licy-python-install-arguments-to-be-a-var.patch | 42 + package/policycoreutils/Config.in | 59 ++ package/policycoreutils/policycoreutils.hash | 2 + package/policycoreutils/policycoreutils.mk | 107 ++ package/refpolicy-contrib/Config.in | 19 + package/refpolicy-contrib/refpolicy-contrib.mk | 18 + .../0001-Fix-awk-references-to-use-variable.patch | 42 + package/refpolicy/Config.in | 99 ++ package/refpolicy/S00selinux | 136 +++ package/refpolicy/config | 8 + package/refpolicy/modules.conf | 406 ++++++++ package/refpolicy/refpolicy.hash | 2 + package/refpolicy/refpolicy.mk | 120 +++ .../rsyslog/0001-fix-config-file-comments.patch | 37 + package/squashfs/squashfs.mk | 8 +- ...1-Fix-SELinux-compile-flags-and-libraries.patch | 44 + package/sysvinit/sysvinit.mk | 5 + package/util-linux/util-linux.mk | 27 + 47 files changed, 3304 insertions(+), 3 deletions(-) create mode 100644 board/common_selinux/busybox-selinux.config create mode 100755 board/common_selinux/post_build.sh create mode 100644 board/common_selinux/skeleton/etc/audit/auditd.conf create mode 100644 board/common_selinux/skeleton/etc/audit/rules.d/audit.rules create mode 100755 board/common_selinux/skeleton/etc/fstab create mode 100755 board/common_selinux/skeleton/etc/inittab create mode 100755 board/common_selinux/skeleton_permissions.txt create mode 100644 board/qemu/x86/linux-4.0-selinux.config create mode 100644 configs/qemu_x86_selinux_defconfig create mode 100644 package/audit/S01auditd create mode 100644 package/busybox/0002-applets-Add-installation-of-individual-binaries.patch create mode 100644 package/busybox/0008-Makefile.flags-strip-non-l-arguments-returned-by-pkg.patch create mode 100644 package/cpio/Config.in create mode 100644 package/cpio/Config.in.host create mode 100644 package/cpio/cpio.hash create mode 100644 package/cpio/cpio.mk mode change 100755 => 100644 package/dbus/S30dbus create mode 100644 package/linux-pam/system-auth.pamd create mode 100644 package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch create mode 100644 package/policycoreutils/0002-Allow-CFLAGS-to-be-overwritten.patch create mode 100644 package/policycoreutils/0003-Change-sepolicy-python-install-arguments-to-be-a-var.patch create mode 100644 package/policycoreutils/Config.in create mode 100644 package/policycoreutils/policycoreutils.hash create mode 100644 package/policycoreutils/policycoreutils.mk create mode 100644 package/refpolicy-contrib/Config.in create mode 100644 package/refpolicy-contrib/refpolicy-contrib.mk create mode 100644 package/refpolicy/2.20130424/0001-Fix-awk-references-to-use-variable.patch create mode 100644 package/refpolicy/Config.in create mode 100644 package/refpolicy/S00selinux create mode 100644 package/refpolicy/config create mode 100644 package/refpolicy/modules.conf create mode 100644 package/refpolicy/refpolicy.hash create mode 100644 package/refpolicy/refpolicy.mk create mode 100644 package/rsyslog/0001-fix-config-file-comments.patch create mode 100644 package/sysvinit/0001-Fix-SELinux-compile-flags-and-libraries.patch
Signature · 1 line
1.9.1
PATCH v8 1/16 policycoreutils: new package
Signed-off-by Clayton Shotwell <[email protected]>
Signed-off-by Matt Weber <[email protected]>
---
Changes v7 -> v8:
- Cleaned up indentations in policycoreutils.mk (Suggested by Thomas P.)
- Fixed sed separator (Suggested by Thomas P.)
- Cleaned up cross compile patches and make options (Suggested by Thomas P.)
- Changed dbus-glib dependency to a select and cleaned up the dependencies (Suggested by Thomas P.)
Changes v6 -> v7:
- No changes
Changes v5 -> v6:
- No changes
Changes v4 -> v5:
- Updated depends and removed glibc dependency (Matt W.)
- Updated site to github (Matt W.)
- Added host python 2/3 support (Matt W.)
- Removed sandbox and mctrans support (Matt W.)
- Removed restorcon init script (Matt W.)
- Agree as optional settings were removed so menu isn't needed (Suggested by Ryan B. and Thomas P.)
- added Config.in select for LIBCAP_NG (Suggested by Thomas P.)
- cleaned up pam/audit ifeq (Suggested by Thomas P.)
- fixed CFLAGS to include target_cflags instead of += (Suggested by Thomas P.)
- Refactored lists of build/install steps into loops (Suggested by Thomas P.)
- Removed += on first host depends assignment (Suggested by Thomas P.)
- Refactored host make opts assignments (Suggested by Thomas P.)
- Limited to glibc because of fts.h, some uclibc toolchains have it others don't. Eventually this would be good to fix with the updated method of file traversal. (Matt W.)
- Gettext fixups for uclibc support. Counter productive as we now limit to glibc only. (Matt W.)
- Added musl as possible lib type (Matt W.)
- Removed largefile dependency (Clayton S.)
- Changed dbus-glib select to a depends on in the Config.in (suggested by Ryan B.)
Changes v3 -> v4:
- Add a select for the libselinux Python bindings when debugging is enabled. This will cause Python to be built for the target (suggested by Thomas P.)
- Cleaned up the configure comments (suggested by Thomas).
- Added a dependency on BR2_USE_MMU for the debugging option because python requires it (suggested by Thomas P.)
- Removed the dependencies on audit and linux-pam. Both packages are now optional dependencies based on whether or not the package has been selected
- Moved the dependency on dbus-glib to only the restorecond option where it is used
- Added a INSTALL_INIT_SYSV for the restorecond daemon rather than just installing it directly
- Adding a dependency on glibc
- Removed the clean commands
Changes v2 -> v3:
- Added dependencies on BR2_TOOLCHAIN_HAS_THREADS and BR2_LARGEFILE (suggested by Thomas P.)
- Changes patch naming convention (suggested by Thomas P.)
- Added selects for linux-pam and audit
Changes v1 -> v2:
- General cleanup to the mk file to conform to the standard format
- Fixed the patch naming to avoid using the version number
- Cleaned up the patch to include a signed-off-by line
- Changed package dependencies into selects in the config
--- package/Config.in | 1 + ...IR-to-all-paths-that-use-an-absolute-path.patch | 258 +++++++++++++++++++++ .../0002-Allow-CFLAGS-to-be-overwritten.patch | 57 +++++ ...licy-python-install-arguments-to-be-a-var.patch | 42 ++++ package/policycoreutils/Config.in | 59 +++++ package/policycoreutils/policycoreutils.hash | 2 + package/policycoreutils/policycoreutils.mk | 107 +++++++++ 7 files changed, 526 insertions(+) create mode 100644 package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch create mode 100644 package/policycoreutils/0002-Allow-CFLAGS-to-be-overwritten.patch create mode 100644 package/policycoreutils/0003-Change-sepolicy-python-install-arguments-to-be-a-var.patch create mode 100644 package/policycoreutils/Config.in create mode 100644 package/policycoreutils/policycoreutils.hash create mode 100644 package/policycoreutils/policycoreutils.mk
package/Config.in +1 -0
@@ -1351,6 +1351,7 @@ menu "Real-Time" endmenu menu "Security" + source "package/policycoreutils/Config.in" source "package/setools/Config.in" endmenu
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch new file +258 -0
258 lines not on this page · raw message
package/policycoreutils/0002-Allow-CFLAGS-to-be-overwritten.patch new file +57 -0
57 lines not on this page · raw message
package/policycoreutils/0003-Change-sepolicy-python-install-arguments-to-be-a-var.patch new file +42 -0
42 lines not on this page · raw message
package/policycoreutils/Config.in new file +59 -0
59 lines not on this page · raw message
package/policycoreutils/policycoreutils.hash new file +2 -0
@@ -0,0 +1,2 @@ +# https://github.com/SELinuxProject/selinux/wiki/Releases +sha256 b6881741f9f9988346a73bfeccb0299941dc117349753f0ef3f23ee86f06c1b5 policycoreutils-2.1.14.tar.gz
package/policycoreutils/policycoreutils.mk new file +107 -0
107 lines not on this page · raw message
Signature · 1 line
1.9.1
PATCH v8 1/16 policycoreutils: new package
Clayton, all,
On Sat, Jul 11, 2015 at 1:27 AM, Clayton Shotwell
<[email protected]> wrote:
[...]
Quoted 43 lines
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch new file +37
-0@@ -0,0 +1,258 @@ +From a8eea90050551e42d4dc81867853f351282f9f90 Mon Sep 17 00:00:00 2001 +From: Clayton Shotwell <[email protected]> +Date: Fri, 10 Jul 2015 11:44:08 -0500 +Subject: [PATCH 1/3] Add DESTDIR to all paths that use an absolute path + +To aid in cross compiling, add the DESTDIR variable to the start of all +of the paths used during compilation. Most paths already used DESTDIR. + +Signed-off-by: Clayton Shotwell <[email protected]> +--- + Makefile | 4 ++-- + audit2allow/Makefile | 2 +- + load_policy/Makefile | 2 +- + mcstrans/src/Makefile | 11 +++++++---- + mcstrans/utils/Makefile | 9 ++++++--- + newrole/Makefile | 12 ++++++------ + restorecond/Makefile | 6 ++++-- + run_init/Makefile | 12 ++++++------ + sepolicy/Makefile | 2 +- + setfiles/Makefile | 4 ++-- + 10 files changed, 36 insertions(+), 28 deletions(-) + +diff --git a/Makefile b/Makefile +index 3980799..0fca022 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,8 +1,8 @@ + SUBDIRS = sepolicy setfiles semanage load_policy newrole run_init sandbox secon audit2allow audit2why sestatus semodule_package semodule semodule_link semodule_expand semodule_deps sepolgen-ifgen setsebool scripts po man gui + +-INOTIFYH = $(shell ls /usr/include/sys/inotify.h 2>/dev/null) ++INOTIFYH = $(shell ls $(DESTDIR)/usr/include/sys/inotify.h 2>/dev/null) + +-ifeq (${INOTIFYH}, /usr/include/sys/inotify.h) ++ifeq (${INOTIFYH}, $(DESTDIR)/usr/include/sys/inotify.h) + SUBDIRS += restorecond + endif +
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch line 47
Quoted 10 lines
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch new file +10
-0+diff --git a/audit2allow/Makefile b/audit2allow/Makefile +index 88635d4..933e520 100644 +--- a/audit2allow/Makefile ++++ b/audit2allow/Makefile +@@ -3,7 +3,7 @@ PREFIX ?= $(DESTDIR)/usr + BINDIR ?= $(PREFIX)/bin + LIBDIR ?= $(PREFIX)/lib + MANDIR ?= $(PREFIX)/share/man +-LOCALEDIR ?= /usr/share/locale ++LOCALEDIR ?= $(DESTDIR)/usr/share/locale
nit: could be set to: $(PREFIX)/share/locale
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch line 60
Quoted 13 lines
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch new file +13
-0+ + all: ; + +diff --git a/load_policy/Makefile b/load_policy/Makefile +index 7c5bab0..4129d8f 100644 +--- a/load_policy/Makefile ++++ b/load_policy/Makefile +@@ -3,7 +3,7 @@ PREFIX ?= $(DESTDIR)/usr + SBINDIR ?= $(DESTDIR)/sbin + USRSBINDIR ?= $(PREFIX)/sbin + MANDIR ?= $(PREFIX)/share/man +-LOCALEDIR ?= /usr/share/locale ++LOCALEDIR ?= $(DESTDIR)/usr/share/locale
ditto
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch line 69
Quoted 9 lines
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch new file +9
-0+ + CFLAGS ?= -Werror -Wall -W + override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\"" +diff --git a/mcstrans/src/Makefile b/mcstrans/src/Makefile +index fb44490..1982b43 100644 +--- a/mcstrans/src/Makefile ++++ b/mcstrans/src/Makefile +@@ -1,15 +1,18 @@ + ARCH = $(shell uname -i)
This can break target build, no? Unless you set ARCH=... on the right of make. (I don't something like that in the *.mk.)
Note that for the host, BR2_HOSTARCH is also defined.
Quoted 10 lines
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch new file +10
-0+ ifeq "$(ARCH)" "x86_64" + # In case of 64 bit system, use these lines +- LIBDIR=/usr/lib64 +-else ++ LIBDIR=$(DESTDIR)/usr/lib64 ++else + ifeq "$(ARCH)" "i686" + # In case of 32 bit system, use these lines +- LIBDIR=/usr/lib ++ LIBDIR=$(DESTDIR)/usr/lib
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch line 89
Quoted 10 lines
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch new file +10
-0+ else + ifeq "$(ARCH)" "i386" + # In case of 32 bit system, use these lines +- LIBDIR=/usr/lib ++ LIBDIR=$(DESTDIR)/usr/lib ++else ++ # Default to these lines if arch is unknown ++ LIBDIR=$(DESTDIR)/usr/lib + endif + endif
Note that a couple of targets set BR2_ARCH to i486 or i586, see [1].
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch line 96
Quoted 7 lines
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch new file +7
-0+ endif +diff --git a/mcstrans/utils/Makefile b/mcstrans/utils/Makefile +index 1ffb027..dcdc68b 100644 +--- a/mcstrans/utils/Makefile ++++ b/mcstrans/utils/Makefile +@@ -5,15 +5,18 @@ BINDIR ?= $(PREFIX)/sbin + ARCH = $(shell uname -i)
ditto here and below.
Quoted 22 lines
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch new file +22
-0+ ifeq "$(ARCH)" "x86_64" + # In case of 64 bit system, use these lines +- LIBDIR=/usr/lib64 ++ LIBDIR=$(DESTDIR)/usr/lib64 + else + ifeq "$(ARCH)" "i686" + # In case of 32 bit system, use these lines +- LIBDIR=/usr/lib ++ LIBDIR=$(DESTDIR)/usr/lib + else + ifeq "$(ARCH)" "i386" + # In case of 32 bit system, use these lines +- LIBDIR=/usr/lib ++ LIBDIR=$(DESTDIR)/usr/lib ++else ++ # Default to these lines if arch is unknown ++ LIBDIR=$(DESTDIR)/usr/lib + endif + endif + endif +diff --git a/newrole/Makefile b/newrole/Makefile +index 646cd4d..a876ff3 100644
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch line 128
Quoted 10 lines
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch new file +10
-0+--- a/newrole/Makefile ++++ b/newrole/Makefile +@@ -3,9 +3,9 @@ PREFIX ?= $(DESTDIR)/usr + BINDIR ?= $(PREFIX)/bin + MANDIR ?= $(PREFIX)/share/man + ETCDIR ?= $(DESTDIR)/etc +-LOCALEDIR = /usr/share/locale +-PAMH = $(shell ls /usr/include/security/pam_appl.h 2>/dev/null) +-AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null) ++LOCALEDIR = $(DESTDIR)/usr/share/locale
or s@/usr@$(PREFIX)@
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch line 129
Quoted 1 line
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch new file +1
-0++PAMH = $(shell ls $(DESTDIR)/usr/include/security/pam_appl.h 2>/dev/null)
ditto
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch line 130
Quoted 1 line
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch new file +1
-0++AUDITH = $(shell ls $(DESTDIR)/usr/include/libaudit.h 2>/dev/null)
ditto
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch line 139
Quoted 9 lines
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch new file +9
-0+ # Enable capabilities to permit newrole to generate audit records. + # This will make newrole a setuid root program. + # The capabilities used are: CAP_AUDIT_WRITE. +@@ -24,7 +24,7 @@ CFLAGS ?= -Werror -Wall -W + EXTRA_OBJS = + override CFLAGS += -DVERSION=\"$(VERSION)\" $(LDFLAGS) -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\"" + LDLIBS += -lselinux -L$(PREFIX)/lib +-ifeq ($(PAMH), /usr/include/security/pam_appl.h) ++ifeq ($(PAMH), $(DESTDIR)/usr/include/security/pam_appl.h)
ditto
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch line 148
Quoted 9 lines
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch new file +9
-0+ override CFLAGS += -DUSE_PAM + EXTRA_OBJS += hashtab.o + LDLIBS += -lpam -lpam_misc +@@ -32,7 +32,7 @@ else + override CFLAGS += -D_XOPEN_SOURCE=500 + LDLIBS += -lcrypt + endif +-ifeq ($(AUDITH), /usr/include/libaudit.h) ++ifeq ($(AUDITH), $(DESTDIR)/usr/include/libaudit.h)
ditto
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch line 157
Quoted 9 lines
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch new file +9
-0+ override CFLAGS += -DUSE_AUDIT + LDLIBS += -laudit + endif +@@ -66,7 +66,7 @@ install: all + test -d $(MANDIR)/man1 || install -m 755 -d $(MANDIR)/man1 + install -m $(MODE) newrole $(BINDIR) + install -m 644 newrole.1 $(MANDIR)/man1/ +-ifeq ($(PAMH), /usr/include/security/pam_appl.h) ++ifeq ($(PAMH), $(DESTDIR)/usr/include/security/pam_appl.h)
ditto
Quoted 27 lines
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch new file +27
-0+ test -d $(ETCDIR)/pam.d || install -m 755 -d $(ETCDIR)/pam.d + ifeq ($(LSPP_PRIV),y) + install -m 644 newrole-lspp.pamd $(ETCDIR)/pam.d/newrole +diff --git a/restorecond/Makefile b/restorecond/Makefile +index 3074542..7c40f95 100644 +--- a/restorecond/Makefile ++++ b/restorecond/Makefile +@@ -10,11 +10,13 @@ autostart_DATA = sealertauto.desktop + INITDIR = $(DESTDIR)/etc/rc.d/init.d + SELINUXDIR = $(DESTDIR)/etc/selinux + +-DBUSFLAGS = -DHAVE_DBUS -I/usr/include/dbus-1.0 -I/usr/lib64/dbus-1.0/include -I/usr/lib/dbus-1.0/include ++DBUSFLAGS = -DHAVE_DBUS -I$(PREFIX)/include/dbus-1.0 -I$(PREFIX)/lib64/dbus-1.0/include \ ++ -I$(PREFIX)/lib/dbus-1.0/include + DBUSLIB = -ldbus-glib-1 -ldbus-1 + + CFLAGS ?= -g -Werror -Wall -W +-override CFLAGS += -I$(PREFIX)/include $(DBUSFLAGS) -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include -I/usr/lib/glib-2.0/include ++override CFLAGS += -I$(PREFIX)/include $(DBUSFLAGS) -I$(PREFIX)/include/glib-2.0 \ ++ -I$(PREFIX)/lib64/glib-2.0/include -I$(PREFIX)/lib/glib-2.0/include + + LDLIBS += -lselinux $(DBUSLIB) -lglib-2.0 -L$(LIBDIR) + +diff --git a/run_init/Makefile b/run_init/Makefile +index 12b39b4..3c6f58a 100644 +--- a/run_init/Makefile ++++ b/run_init/Makefile
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch line 194
Quoted 10 lines
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch new file +10
-0+@@ -4,21 +4,21 @@ PREFIX ?= $(DESTDIR)/usr + SBINDIR ?= $(PREFIX)/sbin + MANDIR ?= $(PREFIX)/share/man + ETCDIR ?= $(DESTDIR)/etc +-LOCALEDIR ?= /usr/share/locale +-PAMH = $(shell ls /usr/include/security/pam_appl.h 2>/dev/null) +-AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null) ++LOCALEDIR ?= $(DESTDIR)/usr/share/locale ++PAMH = $(shell ls $(DESTDIR)/usr/include/security/pam_appl.h 2>/dev/null) ++AUDITH = $(shell ls $(DESTDIR)/usr/include/libaudit.h 2>/dev/null)
ditto
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch line 200
Quoted 6 lines
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch new file +6
-0+ + CFLAGS ?= -Werror -Wall -W + override CFLAGS += -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\"" + LDLIBS += -lselinux -L$(PREFIX)/lib +-ifeq ($(PAMH), /usr/include/security/pam_appl.h) ++ifeq ($(PAMH), $(DESTDIR)/usr/include/security/pam_appl.h)
ditto
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch line 208
Quoted 8 lines
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch new file +8
-0+ override CFLAGS += -DUSE_PAM + LDLIBS += -lpam -lpam_misc + else + override CFLAGS += -D_XOPEN_SOURCE=500 + LDLIBS += -lcrypt + endif +-ifeq ($(AUDITH), /usr/include/libaudit.h) ++ifeq ($(AUDITH), $(DESTDIR)/usr/include/libaudit.h)
ditto
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch line 217
Quoted 9 lines
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch new file +9
-0+ override CFLAGS += -DUSE_AUDIT + LDLIBS += -laudit + endif +@@ -38,7 +38,7 @@ install: all + install -m 755 open_init_pty $(SBINDIR) + install -m 644 run_init.8 $(MANDIR)/man8/ + install -m 644 open_init_pty.8 $(MANDIR)/man8/ +-ifeq ($(PAMH), /usr/include/security/pam_appl.h) ++ifeq ($(PAMH), $(DESTDIR)/usr/include/security/pam_appl.h)
ditto
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch line 230
Quoted 13 lines
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch new file +13
-0+ install -m 644 run_init.pamd $(ETCDIR)/pam.d/run_init + endif + +diff --git a/sepolicy/Makefile b/sepolicy/Makefile +index 11b534f..1074d26 100644 +--- a/sepolicy/Makefile ++++ b/sepolicy/Makefile +@@ -5,7 +5,7 @@ LIBDIR ?= $(PREFIX)/lib + BINDIR ?= $(PREFIX)/bin + SBINDIR ?= $(PREFIX)/sbin + MANDIR ?= $(PREFIX)/share/man +-LOCALEDIR ?= /usr/share/locale ++LOCALEDIR ?= $(DESTDIR)/usr/share/locale
ditto
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch line 243
Quoted 13 lines
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch new file +13
-0+ PYTHON ?= /usr/bin/python + BASHCOMPLETIONDIR ?= $(DESTDIR)/etc/bash_completion.d/ + SHAREDIR ?= $(PREFIX)/share/sandbox +diff --git a/setfiles/Makefile b/setfiles/Makefile +index 4b44b3c..dc04d9a 100644 +--- a/setfiles/Makefile ++++ b/setfiles/Makefile +@@ -3,7 +3,7 @@ PREFIX ?= $(DESTDIR)/usr + SBINDIR ?= $(DESTDIR)/sbin + MANDIR = $(PREFIX)/share/man + LIBDIR ?= $(PREFIX)/lib +-AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null) ++AUDITH = $(shell ls $(DESTDIR)/usr/include/libaudit.h 2>/dev/null)
ditto
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch line 252
Quoted 9 lines
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch new file +9
-0+ + PROGRESS_STEP=$(shell grep "^\#define STAR_COUNT" restore.h | awk -S '{ print $$3 }') + ABORT_ON_ERRORS=$(shell grep "^\#define ABORT_ON_ERRORS" setfiles.c | awk -S '{ print $$3 }') +@@ -12,7 +12,7 @@ CFLAGS = -g -Werror -Wall -W + override CFLAGS += -I$(PREFIX)/include + LDLIBS = -lselinux -lsepol -L$(LIBDIR) + +-ifeq ($(AUDITH), /usr/include/libaudit.h) ++ifeq ($(AUDITH), $(DESTDIR)/usr/include/libaudit.h)
ditto
Quoted 27 lines
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch new file +6
-0+ override CFLAGS += -DUSE_AUDIT + LDLIBS += -laudit + endif +-- +1.9.1 +package/policycoreutils/0002-Allow-CFLAGS-to-be-overwritten.patch new file +15
-0@@ -0,0 +1,57 @@ +From 656740d38ad34cbd5a89e900dab82ec521d0a522 Mon Sep 17 00:00:00 2001 +From: Clayton Shotwell <[email protected]> +Date: Fri, 10 Jul 2015 11:47:09 -0500 +Subject: [PATCH 2/3] Allow CFLAGS to be overwritten + +Allow all CFLAGS declarations to be overwritten to aid in cross +compiling. + +Signed-off-by: Clayton Shotwell <[email protected]> +--- + sepolicy/Makefile | 2 +- + sestatus/Makefile | 2 +- + setfiles/Makefile | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) +
package/policycoreutils/0002-Allow-CFLAGS-to-be-overwritten.patch line 25
Quoted 10 lines
package/policycoreutils/0002-Allow-CFLAGS-to-be-overwritten.patch new file +10
-0+diff --git a/sepolicy/Makefile b/sepolicy/Makefile +index 1074d26..9d44ac2 100644 +--- a/sepolicy/Makefile ++++ b/sepolicy/Makefile +@@ -9,7 +9,7 @@ LOCALEDIR ?= $(DESTDIR)/usr/share/locale + PYTHON ?= /usr/bin/python + BASHCOMPLETIONDIR ?= $(DESTDIR)/etc/bash_completion.d/ + SHAREDIR ?= $(PREFIX)/share/sandbox +-override CFLAGS = $(LDFLAGS) -I$(PREFIX)/include -DPACKAGE="policycoreutils" -Wall -Werror -Wextra -W -DSHARED -shared ++override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DPACKAGE="policycoreutils" -Wall -Werror -Wextra -W -DSHARED -shared
Ditch -Werror here please, otherwise it will always be in the CFLAGS :-/
Quoted 52 lines
package/policycoreutils/0002-Allow-CFLAGS-to-be-overwritten.patch new file +32
-0+ + BASHCOMPLETIONS=sepolicy-bash-completion.sh + +diff --git a/sestatus/Makefile b/sestatus/Makefile +index c5db7a3..c04ff00 100644 +--- a/sestatus/Makefile ++++ b/sestatus/Makefile +@@ -5,7 +5,7 @@ MANDIR = $(PREFIX)/share/man + ETCDIR ?= $(DESTDIR)/etc + LIBDIR ?= $(PREFIX)/lib + +-CFLAGS = -Werror -Wall -W ++CFLAGS ?= -Werror -Wall -W + override CFLAGS += -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64 + LDLIBS = -lselinux -L$(LIBDIR) + +diff --git a/setfiles/Makefile b/setfiles/Makefile +index dc04d9a..67d9ef0 100644 +--- a/setfiles/Makefile ++++ b/setfiles/Makefile +@@ -8,7 +8,7 @@ AUDITH = $(shell ls $(DESTDIR)/usr/include/libaudit.h 2>/dev/null) + PROGRESS_STEP=$(shell grep "^\#define STAR_COUNT" restore.h | awk -S '{ print $$3 }') + ABORT_ON_ERRORS=$(shell grep "^\#define ABORT_ON_ERRORS" setfiles.c | awk -S '{ print $$3 }') + +-CFLAGS = -g -Werror -Wall -W ++CFLAGS ?= -g -Werror -Wall -W + override CFLAGS += -I$(PREFIX)/include + LDLIBS = -lselinux -lsepol -L$(LIBDIR) + +-- +1.9.1 +package/policycoreutils/0003-Change-sepolicy-python-install-arguments-to-be-a-var.patch new file +14
-0@@ -0,0 +1,42 @@ +From c8f1022be057cfe28101fbd0d6dedf6f42477ffc Mon Sep 17 00:00:00 2001 +From: Clayton Shotwell <[email protected]> +Date: Fri, 10 Jul 2015 11:56:49 -0500 +Subject: [PATCH 3/3] Change sepolicy python install arguments to be a variable + +To allow the python install arguments to be overwritten, change the +arguments to be a variable. This also cleans up the DESTDIR detection a +little bit. + +Signed-off-by: Clayton Shotwell <[email protected]> +--- + sepolicy/Makefile | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) +
package/policycoreutils/0003-Change-sepolicy-python-install-arguments-to-be-a-var.patch line 24
Quoted 10 lines
package/policycoreutils/0003-Change-sepolicy-python-install-arguments-to-be-a-var.patch new file +10
-0+diff --git a/sepolicy/Makefile b/sepolicy/Makefile +index 9d44ac2..bd8a383 100644 +--- a/sepolicy/Makefile ++++ b/sepolicy/Makefile +@@ -7,6 +7,11 @@ SBINDIR ?= $(PREFIX)/sbin + MANDIR ?= $(PREFIX)/share/man + LOCALEDIR ?= $(DESTDIR)/usr/share/locale + PYTHON ?= /usr/bin/python ++ifneq (,$(DESTDIR)) ++PYTHON_INSTALL_ARGS ?= --root $(DESTDIR)
Why not a += ?
Can it be preset through the env. or command line?
Quoted 61 lines
package/policycoreutils/0003-Change-sepolicy-python-install-arguments-to-be-a-var.patch new file +18
-0++else ++PYTHON_INSTALL_ARGS ?= ++endif + BASHCOMPLETIONDIR ?= $(DESTDIR)/etc/bash_completion.d/ + SHAREDIR ?= $(PREFIX)/share/sandbox + override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DPACKAGE="policycoreutils" -Wall -Werror -Wextra -W -DSHARED -shared +@@ -23,7 +28,7 @@ clean: + -rm -rf build *~ \#* *pyc .#* + + install: +- $(PYTHON) setup.py install `test -n "$(DESTDIR)" && echo --root $(DESTDIR)` ++ $(PYTHON) setup.py install $(PYTHON_INSTALL_ARGS) + [ -d $(BINDIR) ] || mkdir -p $(BINDIR) + install -m 755 sepolicy.py $(BINDIR)/sepolicy + -mkdir -p $(MANDIR)/man8 +-- +1.9.1 +package/policycoreutils/Config.in new file +37
-0@@ -0,0 +1,59 @@ +config BR2_PACKAGE_POLICYCOREUTILS + bool "policycoreutils" + select BR2_PACKAGE_LIBSEMANAGE + select BR2_PACKAGE_LIBCAP_NG + select BR2_PACKAGE_GETTEXT if BR2_NEEDS_GETTEXT + depends on BR2_TOOLCHAIN_HAS_THREADS # libsemanage + depends on BR2_TOOLCHAIN_USES_GLIBC || BR2_TOOLCHAIN_USES_MUSL # uses fts.h + help + Policycoreutils is a collection of policy utilities (originally + the "core" set of utilities needed to use SELinux, although it + has grown a bit over time), which have different dependencies. + sestatus, secon, run_init, and newrole only use libselinux. + load_policy and setfiles only use libselinux and libsepol. + semodule and semanage use libsemanage (and thus bring in + dependencies on libsepol and libselinux as well). setsebool + uses libselinux to make non-persistent boolean changes (via + the kernel interface) and uses libsemanage to make persistent + boolean changes. + + The base package will install the following utilities: + load_policy + newrole + restorecond + run_init + secon + semodule + semodule_deps + semodule_expand + semodule_link + semodule_package + sepolgen-ifgen + sestatus + setfiles + setsebool + + http://selinuxproject.org/page/Main_Page +
package/policycoreutils/Config.in line 47
Quoted 10 lines
package/policycoreutils/Config.in new file +10
-0+comment "policycoreutils needs a glibc or musl toolchain w/ threads" + depends on !BR2_TOOLCHAIN_HAS_THREADS \ + || !(BR2_TOOLCHAIN_USES_GLIBC || BR2_TOOLCHAIN_USES_MUSL) + +if BR2_PACKAGE_POLICYCOREUTILS + +config BR2_PACKAGE_POLICYCOREUTILS_RESTORECOND + bool "restorecond Utility" + select BR2_PACKAGE_DBUS_GLIB + depends on BR2_PACKAGE_DBUS
Why a "depends on" instead of a select?
Quoted 53 lines
package/policycoreutils/Config.in new file +12
-0+ depends on BR2_USE_WCHAR # glib2 + depends on BR2_TOOLCHAIN_HAS_THREADS # glib2 + depends on BR2_USE_MMU # glib2 + help + Enable restorecond to be built + +comment "restorecond needs a toolchain w/ wchar, threads, dbus" + depends on BR2_USE_MMU + depends on BR2_PACKAGE_DBUS + depends on !BR2_USE_WCHAR || !BR2_TOOLCHAIN_HAS_THREADS + +endifpackage/policycoreutils/policycoreutils.hash new file +2
-0@@ -0,0 +1,2 @@ +# https://github.com/SELinuxProject/selinux/wiki/Releases +sha256 b6881741f9f9988346a73bfeccb0299941dc117349753f0ef3f23ee86f06c1b5 policycoreutils-2.1.14.tar.gzpackage/policycoreutils/policycoreutils.mk new file +27
-0@@ -0,0 +1,107 @@ +################################################################################ +# +# policycoreutils +# +################################################################################ + +POLICYCOREUTILS_VERSION = 2.1.14 +POLICYCOREUTILS_SITE = https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20130423 +POLICYCOREUTILS_LICENSE = GPLv2 +POLICYCOREUTILS_LICENSE_FILES = COPYING + +# gettext for load_policy.c use of libintl_* functions +POLICYCOREUTILS_DEPENDENCIES = libsemanage libcap-ng $(if $(BR2_NEEDS_GETTEXT),gettext) + +ifeq ($(BR2_PACKAGE_LINUX_PAM),y) +POLICYCOREUTILS_DEPENDENCIES += linux-pam +POLICYCOREUTILS_MAKE_OPTS += NAMESPACE_PRIV=y +define POLICYCOREUTILS_INSTALL_TARGET_LINUX_PAM_CONFS + $(INSTALL) -D -m 0644 $(@D)/newrole/newrole-lspp.pamd $(TARGET_DIR)/etc/pam.d/newrole + $(INSTALL) -D -m 0644 $(@D)/run_init/run_init.pamd $(TARGET_DIR)/etc/pam.d/run_init +endef +endif + +ifeq ($(BR2_PACKAGE_AUDIT),y) +POLICYCOREUTILS_DEPENDENCIES += audit +POLICYCOREUTILS_MAKE_OPTS += AUDIT_LOG_PRIV=y +endif
package/policycoreutils/policycoreutils.mk line 37
Quoted 10 lines
package/policycoreutils/policycoreutils.mk new file +10
-0+ +# Enable LSPP_PRIV if both audit and linux pam are enabled +ifeq ($(BR2_PACKAGE_LINUX_PAM)$(BR2_PACKAGE_AUDIT),yy) +POLICYCOREUTILS_MAKE_OPTS += LSPP_PRIV=y +endif + +# Undefining _FILE_OFFSET_BITS here because of a "bug" with glibc fts.h +# large file support. +# See https://bugzilla.redhat.com/show_bug.cgi?id=574992 for more information +POLICYCOREUTILS_MAKE_OPTS = \
s/=/+=/
Otherwise, options set for linux-pam and audit are lost.
Also, no ARCH=$(BR2_ARCH) in the *_MAKE_OPTS (see my comment above)?
Quoted 73 lines
package/policycoreutils/policycoreutils.mk new file +70
-1+ CC="$(TARGET_CC)" \ + CFLAGS="$(TARGET_CFLAGS) -U_FILE_OFFSET_BITS" \ + LDFLAGS="$(TARGET_LDFLAGS) $(if $(BR2_NEEDS_GETTEXT),-lintl)" + +POLICYCOREUTILS_MAKE_DIRS = load_policy newrole run_init \ + secon semodule semodule_deps semodule_expand semodule_link \ + semodule_package sepolgen-ifgen sestatus setfiles setsebool + +ifeq ($(BR2_PACKAGE_POLICYCOREUTILS_RESTORECOND),y) +POLICYCOREUTILS_DEPENDENCIES += dbus-glib +POLICYCOREUTILS_MAKE_DIRS += restorecond +endif + +define POLICYCOREUTILS_BUILD_CMDS + for dir in $(POLICYCOREUTILS_MAKE_DIRS) ; do \ + $(MAKE) -C $(@D)/$${dir} $(POLICYCOREUTILS_MAKE_OPTS) DESTDIR=$(STAGING_DIR) all || exit 1 ; \ + done +endef + +define POLICYCOREUTILS_INSTALL_TARGET_CMDS + for dir in $(POLICYCOREUTILS_MAKE_DIRS) ; do \ + $(MAKE) -C $(@D)/$${dir} $(POLICYCOREUTILS_MAKE_OPTS) DESTDIR=$(TARGET_DIR) install || exit 1 ; \ + done +endef + +HOST_POLICYCOREUTILS_DEPENDENCIES = host-libsemanage host-dbus-glib host-sepolgen host-setools + +# Undefining _FILE_OFFSET_BITS here because of a "bug" with glibc fts.h +# large file support. +# See https://bugzilla.redhat.com/show_bug.cgi?id=574992 for more information +HOST_POLICYCOREUTILS_MAKE_OPTS = \ + CC="$(HOSTCC)" \ + CFLAGS="$(HOST_CFLAGS) -U_FILE_OFFSET_BITS" \ + PYTHON="$(HOST_DIR)/usr/bin/python" \ + PYTHON_INSTALL_ARGS="$(HOST_PKG_PYTHON_DISTUTILS_INSTALL_OPTS)" + + +ifeq ($(BR2_PACKAGE_PYTHON3),y) +HOST_POLICYCOREUTILS_DEPENDENCIES += host-python3 +HOST_POLICYCOREUTILS_MAKE_OPTS += \ + PYLIBVER="python$(PYTHON3_VERSION_MAJOR)" +else +HOST_POLICYCOREUTILS_DEPENDENCIES += host-python +HOST_POLICYCOREUTILS_MAKE_OPTS += \ + PYLIBVER="python$(PYTHON_VERSION_MAJOR)" +endif + +# Note: We are only building the programs required by the refpolicy build +HOST_POLICYCOREUTILS_MAKE_DIRS = load_policy semodule semodule_deps semodule_expand semodule_link \ + semodule_package setfiles restorecond audit2allow audit2why scripts semanage sepolicy + +define HOST_POLICYCOREUTILS_BUILD_CMDS + for dir in $(HOST_POLICYCOREUTILS_MAKE_DIRS) ; do \ + $(MAKE) -C $(@D)/$${dir} $(HOST_POLICYCOREUTILS_MAKE_OPTS) DESTDIR=$(HOST_DIR) all || exit 1 ; \ + done +endef + +define HOST_POLICYCOREUTILS_INSTALL_CMDS + for dir in $(HOST_POLICYCOREUTILS_MAKE_DIRS) ; do \ + $(MAKE) -C $(@D)/$${dir} $(HOST_POLICYCOREUTILS_MAKE_OPTS) DESTDIR=$(HOST_DIR) install || exit 1 ; \ + done + # Fix python paths + $(SED) 's%/usr/bin/%$(HOST_DIR)/usr/bin/%g' $(HOST_DIR)/usr/bin/audit2allow + $(SED) 's%/usr/bin/%$(HOST_DIR)/usr/bin/%g' $(HOST_DIR)/usr/bin/audit2why + $(SED) 's%/usr/bin/%$(HOST_DIR)/usr/bin/%g' $(HOST_DIR)/usr/bin/sepolgen-ifgen + $(SED) 's%/usr/bin/%$(HOST_DIR)/usr/bin/%g' $(HOST_DIR)/usr/bin/sepolicy +endef + +$(eval $(generic-package)) +$(eval $(host-generic-package)) --1.9.1
Quoted 4 lines
_______________________________________________
buildroot mailing list
buildroot at busybox.net
http://lists.busybox.net/mailman/listinfo/buildroot
[1] http://git.buildroot.net/buildroot/tree/arch/Config.in.x86#n201
Regards,
Signature · 1 line
Samuel
PATCH v8 1/16 policycoreutils: new package
Samuel,
Quoted 51 lines · Samuel Martin
Clayton, all,
On Sat, Jul 11, 2015 at 1:27 AM, Clayton Shotwell
<[email protected]> wrote:
[...]Quoted 46 lines
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch new file +40
-0@@ -0,0 +1,258 @@ +From a8eea90050551e42d4dc81867853f351282f9f90 Mon Sep 17 00:00:00 2001 +From: Clayton Shotwell <[email protected]> +Date: Fri, 10 Jul 2015 11:44:08 -0500 +Subject: [PATCH 1/3] Add DESTDIR to all paths that use an absolute path + +To aid in cross compiling, add the DESTDIR variable to the start of all +of the paths used during compilation. Most paths already used DESTDIR. + +Signed-off-by: Clayton Shotwell <[email protected]> +--- + Makefile | 4 ++-- + audit2allow/Makefile | 2 +- + load_policy/Makefile | 2 +- + mcstrans/src/Makefile | 11 +++++++---- + mcstrans/utils/Makefile | 9 ++++++--- + newrole/Makefile | 12 ++++++------ + restorecond/Makefile | 6 ++++-- + run_init/Makefile | 12 ++++++------ + sepolicy/Makefile | 2 +- + setfiles/Makefile | 4 ++-- + 10 files changed, 36 insertions(+), 28 deletions(-) + +diff --git a/Makefile b/Makefile +index 3980799..0fca022 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,8 +1,8 @@ + SUBDIRS = sepolicy setfiles semanage load_policy newrole run_init sandbox secon audit2allow audit2why sestatus semodule_package semodule semodule_link semodule_expand semodule_deps sepolgen-ifgen setsebool scripts po man gui + +-INOTIFYH = $(shell ls /usr/include/sys/inotify.h 2>/dev/null) ++INOTIFYH = $(shell ls $(DESTDIR)/usr/include/sys/inotify.h 2>/dev/null) + +-ifeq (${INOTIFYH}, /usr/include/sys/inotify.h) ++ifeq (${INOTIFYH}, $(DESTDIR)/usr/include/sys/inotify.h) + SUBDIRS += restorecond + endif + +diff --git a/audit2allow/Makefile b/audit2allow/Makefile +index 88635d4..933e520 100644 +--- a/audit2allow/Makefile
Quoted 8 lines
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch line 47
Quoted 7 lines
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch new file +7
-0++++ b/audit2allow/Makefile +@@ -3,7 +3,7 @@ PREFIX ?= $(DESTDIR)/usr + BINDIR ?= $(PREFIX)/bin + LIBDIR ?= $(PREFIX)/lib + MANDIR ?= $(PREFIX)/share/man +-LOCALEDIR ?= /usr/share/locale ++LOCALEDIR ?= $(DESTDIR)/usr/share/localenit: could be set to: $(PREFIX)/share/locale
That does make it a little cleaner. I'll change all of the DESTDIR to PREFIX for this change.
Quoted 4 lines
Quoted 4 lines
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch new file +4
-0+ + CFLAGS ?= -Werror -Wall -W + override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DUSE_NLS -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\"" +diff --git a/mcstrans/src/Makefile b/mcstrans/src/Makefile
Quoted 8 lines
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch line 69
Quoted 5 lines
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch new file +5
-0+index fb44490..1982b43 100644 +--- a/mcstrans/src/Makefile ++++ b/mcstrans/src/Makefile +@@ -1,15 +1,18 @@ + ARCH = $(shell uname -i)This can break target build, no? Unless you set ARCH=... on the right of make. (I don't something like that in the *.mk.)
Note that for the host,BR2_HOSTARCHis also defined.
Good point. Seems like a lot of trouble to determine which lib directory to use. I'll look making the ARCH variable a ?= and see about defining the ARCH in policycoreutils.mk.
Quoted 20 lines
Quoted 10 lines
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch new file +10
-0+ ifeq "$(ARCH)" "x86_64" + # In case of 64 bit system, use these lines +- LIBDIR=/usr/lib64 +-else ++ LIBDIR=$(DESTDIR)/usr/lib64 ++else + ifeq "$(ARCH)" "i686" + # In case of 32 bit system, use these lines +- LIBDIR=/usr/lib ++ LIBDIR=$(DESTDIR)/usr/libpackage/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch line 89
Quoted 10 lines
package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch new file +10
-0+ else + ifeq "$(ARCH)" "i386" + # In case of 32 bit system, use these lines +- LIBDIR=/usr/lib ++ LIBDIR=$(DESTDIR)/usr/lib ++else ++ # Default to these lines if arch is unknown ++ LIBDIR=$(DESTDIR)/usr/lib + endif + endif
Quoted 1 line
Note that a couple of targets set
BR2_ARCHto i486 or i586, see [1].
I'll have to look through some different architecture to see which ones use lib and which use lib64.
[...]
Quoted 24 lines
Quoted 24 lines
package/policycoreutils/0002-Allow-CFLAGS-to-be-overwritten.patch new file +18
-0@@ -0,0 +1,57 @@ +From 656740d38ad34cbd5a89e900dab82ec521d0a522 Mon Sep 17 00:00:00 2001 +From: Clayton Shotwell <[email protected]> +Date: Fri, 10 Jul 2015 11:47:09 -0500 +Subject: [PATCH 2/3] Allow CFLAGS to be overwritten + +Allow all CFLAGS declarations to be overwritten to aid in cross +compiling. + +Signed-off-by: Clayton Shotwell <[email protected]> +--- + sepolicy/Makefile | 2 +- + sestatus/Makefile | 2 +- + setfiles/Makefile | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/sepolicy/Makefile b/sepolicy/Makefile +index 1074d26..9d44ac2 100644 +--- a/sepolicy/Makefile
Quoted 8 lines
package/policycoreutils/0002-Allow-CFLAGS-to-be-overwritten.patch line 25
Quoted 7 lines
package/policycoreutils/0002-Allow-CFLAGS-to-be-overwritten.patch new file +7
-0++++ b/sepolicy/Makefile +@@ -9,7 +9,7 @@ LOCALEDIR ?= $(DESTDIR)/usr/share/locale + PYTHON ?= /usr/bin/python + BASHCOMPLETIONDIR ?= $(DESTDIR)/etc/bash_completion.d/ + SHAREDIR ?= $(PREFIX)/share/sandbox +-override CFLAGS = $(LDFLAGS) -I$(PREFIX)/include -DPACKAGE="policycoreutils" -Wall -Werror -Wextra -W -DSHARED -shared ++override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DPACKAGE="policycoreutils" -Wall -Werror -Wextra -W -DSHARED -sharedDitch -Werror here please, otherwise it will always be in the CFLAGS :-/
Will it? I would assume it would only apply for the calls in this Makefile. I checked the make output and could not find a reference to any of the flags being used. I'm going to leave it as is for now.
Quoted 56 lines
Quoted 56 lines
package/policycoreutils/0002-Allow-CFLAGS-to-be-overwritten.patch new file +32
-0+ + BASHCOMPLETIONS=sepolicy-bash-completion.sh + +diff --git a/sestatus/Makefile b/sestatus/Makefile +index c5db7a3..c04ff00 100644 +--- a/sestatus/Makefile ++++ b/sestatus/Makefile +@@ -5,7 +5,7 @@ MANDIR = $(PREFIX)/share/man + ETCDIR ?= $(DESTDIR)/etc + LIBDIR ?= $(PREFIX)/lib + +-CFLAGS = -Werror -Wall -W ++CFLAGS ?= -Werror -Wall -W + override CFLAGS += -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64 + LDLIBS = -lselinux -L$(LIBDIR) + +diff --git a/setfiles/Makefile b/setfiles/Makefile +index dc04d9a..67d9ef0 100644 +--- a/setfiles/Makefile ++++ b/setfiles/Makefile +@@ -8,7 +8,7 @@ AUDITH = $(shell ls $(DESTDIR)/usr/include/libaudit.h 2>/dev/null) + PROGRESS_STEP=$(shell grep "^\#define STAR_COUNT" restore.h | awk -S '{ print $$3 }') + ABORT_ON_ERRORS=$(shell grep "^\#define ABORT_ON_ERRORS" setfiles.c | awk -S '{ print $$3 }') + +-CFLAGS = -g -Werror -Wall -W ++CFLAGS ?= -g -Werror -Wall -W + override CFLAGS += -I$(PREFIX)/include + LDLIBS = -lselinux -lsepol -L$(LIBDIR) + +-- +1.9.1 +package/policycoreutils/0003-Change-sepolicy-python-install-arguments-to-be-a-var.patch new file +18
-0@@ -0,0 +1,42 @@ +From c8f1022be057cfe28101fbd0d6dedf6f42477ffc Mon Sep 17 00:00:00 2001 +From: Clayton Shotwell <[email protected]> +Date: Fri, 10 Jul 2015 11:56:49 -0500 +Subject: [PATCH 3/3] Change sepolicy python install arguments to be a variable + +To allow the python install arguments to be overwritten, change the +arguments to be a variable. This also cleans up the DESTDIR detection a +little bit. + +Signed-off-by: Clayton Shotwell <[email protected]> +--- + sepolicy/Makefile | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/sepolicy/Makefile b/sepolicy/Makefile +index 9d44ac2..bd8a383 100644 +--- a/sepolicy/Makefile ++++ b/sepolicy/Makefile
Quoted 8 lines
package/policycoreutils/0003-Change-sepolicy-python-install-arguments-to-be-a-var.patch line 24
Quoted 6 lines
package/policycoreutils/0003-Change-sepolicy-python-install-arguments-to-be-a-var.patch new file +6
-0+@@ -7,6 +7,11 @@ SBINDIR ?= $(PREFIX)/sbin + MANDIR ?= $(PREFIX)/share/man + LOCALEDIR ?= $(DESTDIR)/usr/share/locale + PYTHON ?= /usr/bin/python ++ifneq (,$(DESTDIR)) ++PYTHON_INSTALL_ARGS ?= --root $(DESTDIR)Why not a += ?
Can it be preset through the env. or command line?
I was looking at the python package framework and it handles the host vs target builds quite differently. The --root needs to be set to / in the target builds and not set at all for the host builds. By doing it this way, I can keep the original file almost the same but still provide the hooks Buildroot needs to install it in the correct place.
Quoted 64 lines
Quoted 64 lines
package/policycoreutils/0003-Change-sepolicy-python-install-arguments-to-be-a-var.patch new file +18
-0++else ++PYTHON_INSTALL_ARGS ?= ++endif + BASHCOMPLETIONDIR ?= $(DESTDIR)/etc/bash_completion.d/ + SHAREDIR ?= $(PREFIX)/share/sandbox + override CFLAGS += $(LDFLAGS) -I$(PREFIX)/include -DPACKAGE="policycoreutils" -Wall -Werror -Wextra -W -DSHARED -shared +@@ -23,7 +28,7 @@ clean: + -rm -rf build *~ \#* *pyc .#* + + install: +- $(PYTHON) setup.py install `test -n "$(DESTDIR)" && echo --root $(DESTDIR)` ++ $(PYTHON) setup.py install $(PYTHON_INSTALL_ARGS) + [ -d $(BINDIR) ] || mkdir -p $(BINDIR) + install -m 755 sepolicy.py $(BINDIR)/sepolicy + -mkdir -p $(MANDIR)/man8 +-- +1.9.1 +package/policycoreutils/Config.in new file +40
-0@@ -0,0 +1,59 @@ +config BR2_PACKAGE_POLICYCOREUTILS + bool "policycoreutils" + select BR2_PACKAGE_LIBSEMANAGE + select BR2_PACKAGE_LIBCAP_NG + select BR2_PACKAGE_GETTEXT if BR2_NEEDS_GETTEXT + depends on BR2_TOOLCHAIN_HAS_THREADS # libsemanage + depends on BR2_TOOLCHAIN_USES_GLIBC || BR2_TOOLCHAIN_USES_MUSL # uses fts.h + help + Policycoreutils is a collection of policy utilities (originally + the "core" set of utilities needed to use SELinux, although it + has grown a bit over time), which have different dependencies. + sestatus, secon, run_init, and newrole only use libselinux. + load_policy and setfiles only use libselinux and libsepol. + semodule and semanage use libsemanage (and thus bring in + dependencies on libsepol and libselinux as well). setsebool + uses libselinux to make non-persistent boolean changes (via + the kernel interface) and uses libsemanage to make persistent + boolean changes. + + The base package will install the following utilities: + load_policy + newrole + restorecond + run_init + secon + semodule + semodule_deps + semodule_expand + semodule_link + semodule_package + sepolgen-ifgen + sestatus + setfiles + setsebool + + http://selinuxproject.org/page/Main_Page + +comment "policycoreutils needs a glibc or musl toolchain w/ threads" + depends on !BR2_TOOLCHAIN_HAS_THREADS \ + || !(BR2_TOOLCHAIN_USES_GLIBC || BR2_TOOLCHAIN_USES_MUSL)
Quoted 8 lines
package/policycoreutils/Config.in line 47
Quoted 7 lines
package/policycoreutils/Config.in new file +7
-0+ +if BR2_PACKAGE_POLICYCOREUTILS + +config BR2_PACKAGE_POLICYCOREUTILS_RESTORECOND + bool "restorecond Utility" + select BR2_PACKAGE_DBUS_GLIB + depends on BR2_PACKAGE_DBUSWhy a "depends on" instead of a select?
This was a suggestion from Thomas P. Since DBUS is a large package with a lot of infrastructure, depend on it (it is also a dependency of DBUS_GLIB) and select dbus-glib
Quoted 66 lines
Quoted 53 lines
package/policycoreutils/Config.in new file +12
-0+ depends on BR2_USE_WCHAR # glib2 + depends on BR2_TOOLCHAIN_HAS_THREADS # glib2 + depends on BR2_USE_MMU # glib2 + help + Enable restorecond to be built + +comment "restorecond needs a toolchain w/ wchar, threads, dbus" + depends on BR2_USE_MMU + depends on BR2_PACKAGE_DBUS + depends on !BR2_USE_WCHAR || !BR2_TOOLCHAIN_HAS_THREADS + +endifpackage/policycoreutils/policycoreutils.hash new file +2
-0@@ -0,0 +1,2 @@ +# https://github.com/SELinuxProject/selinux/wiki/Releases +sha256 b6881741f9f9988346a73bfeccb0299941dc117349753f0ef3f23ee86f06c1b5 policycoreutils-2.1.14.tar.gzpackage/policycoreutils/policycoreutils.mk new file +27
-0@@ -0,0 +1,107 @@ +################################################################################ +# +# policycoreutils +# +################################################################################ + +POLICYCOREUTILS_VERSION = 2.1.14 +POLICYCOREUTILS_SITE = https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20130423 +POLICYCOREUTILS_LICENSE = GPLv2 +POLICYCOREUTILS_LICENSE_FILES = COPYING + +# gettext for load_policy.c use of libintl_* functions +POLICYCOREUTILS_DEPENDENCIES = libsemanage libcap-ng $(if $(BR2_NEEDS_GETTEXT),gettext) + +ifeq ($(BR2_PACKAGE_LINUX_PAM),y) +POLICYCOREUTILS_DEPENDENCIES += linux-pam +POLICYCOREUTILS_MAKE_OPTS += NAMESPACE_PRIV=y +define POLICYCOREUTILS_INSTALL_TARGET_LINUX_PAM_CONFS + $(INSTALL) -D -m 0644 $(@D)/newrole/newrole-lspp.pamd $(TARGET_DIR)/etc/pam.d/newrole + $(INSTALL) -D -m 0644 $(@D)/run_init/run_init.pamd $(TARGET_DIR)/etc/pam.d/run_init +endef +endif + +ifeq ($(BR2_PACKAGE_AUDIT),y) +POLICYCOREUTILS_DEPENDENCIES += audit +POLICYCOREUTILS_MAKE_OPTS += AUDIT_LOG_PRIV=y +endifpackage/policycoreutils/policycoreutils.mk line 37
Quoted 10 lines
package/policycoreutils/policycoreutils.mk new file +10
-0+ +# Enable LSPP_PRIV if both audit and linux pam are enabled +ifeq ($(BR2_PACKAGE_LINUX_PAM)$(BR2_PACKAGE_AUDIT),yy) +POLICYCOREUTILS_MAKE_OPTS += LSPP_PRIV=y +endif + +# Undefining _FILE_OFFSET_BITS here because of a "bug" with glibc fts.h +# large file support. +# See https://bugzilla.redhat.com/show_bug.cgi?id=574992 for more information +POLICYCOREUTILS_MAKE_OPTS = \s/=/+=/
Otherwise, options set for linux-pam and audit are lost.
Quoted 1 line
Also, no ARCH=$(BR2_ARCH) in the
*_MAKE_OPTS(see my comment above)?
Will add per comment above.
Thanks,
Clayton
Clayton Shotwell
Senior Software Engineer, Rockwell Collins
clayton.shotwell at rockwellcollins.com
PATCH v8 1/16 policycoreutils: new package
Quoted 2 lines · Clayton Shotwell
I'll have to look through some different architecture to see which ones use lib and which use lib64.
That shouldn't matter for us, since we symlink lib64 -> lib (or lib32 -> lib).
Regards,
Arnout
Signature · 6 lines
Arnout Vandecappelle arnout at mind be Senior Embedded Software Architect +32-16-286500 Essensium/Mind http://www.mind.be G.Geenslaan 9, 3001 Leuven, Belgium BE 872 984 063 RPR Leuven LinkedIn profile: http://www.linkedin.com/in/arnoutvandecappelle GPG fingerprint: 7493 020B C7E3 8618 8DEC 222C 82EB F404 F9AC 0DDF
PATCH v8 2/16 refpolicy: new package
In reply to Clayton ShotwellFrom: Clayton Shotwell <[email protected]>
Signed-off-by Clayton Shotwell <[email protected]>
Signed-off-by Matt Weber <[email protected]>
---
Changes v7 -> v8:
- Changes REFPOLICY_MAKE_CMDS to REFPOLICY_MAKE_OPTS (Suggested by Samuel)
- Added a help section to the custom git repo to explain why the refpolicy-contrib option is needed (Suggested by Samuel)
- Added rsync exclusions to ensure no unneeded files are copied during the refpolicy-contrib sync (Suggested by Samuel)
Changes v6 -> v7:
- Moving the refpolicy patch into a version specific folder to prevent it from being applied to the custom git repos. (Clayton S.)
Changes v5 -> v6:
- Fixed references to GIT in config files (Suggested by Ryan B.)
- Removed execute permissions on files (Suggested by Ryan B.)
- Fixed spelling error and changed staging install to always install the documentation (Suggested by Samuel)
Changes v4 -> v5:
- Removed TODO and dependency on glibc (Matt W.)
- Added lib depends to meet policycoreutils limitation on std lib
(Matt W.)
- Added comment for when an option is not defined (Matt W.)
- Removed largefile, locale, and wchar dependencies (Clayton S.)
- Remove dependancy on host-python-pyxml (Ryan B.)
- Forced package to use $(HOST_DIR)/usr/bin/python2 for python executable (Ryan B.)
- Added host-python dependency (Clayton S.)
- Removed config menu (suggested by Thomas P.)
- Added patch to fix awk issue (Clayton S.)
Changes v3 -> v4:
- Added a dependency on host-gawk and correct the awk calls
in the makefile to use $(AWK)
- Changed the default policy name to br_policy to differentiate the policy generated from refpolicy
- Added a install step to create a /.autorelabel file to cause the file system to be relabeled by S12SELinux init script
- Adding a default modules.conf file with an option to specify a different one. This will decrease the build time for refpolicy by removing unused policies. (implemented by Thomas P.)
- Cleaned up the configure comments (implemented by Thomas).
- Added a check to only install the documentation if the Buildroot option is enabled
- Removed the build because the install step completes the same process. Also removed the clean step because it is being removed globally from buildroot (implemented by Thomas P.)
- Added more error handling to the startup script to print a warning if SELinux fails to install the policy if it exists. This can be caused by the kernel not being configured with SELinux enabled
Changes v2 -> v3:
- Changes patch naming convention (suggested by Thomas P.)
- Added dependencies on BR2_TOOLCHAIN_HAS_THREADS and BR2_LARGEFILE (suggested by Thomas P.)
- Removed configure option for a specific patch folder (suggested by Thomas P.)
- Removed distribution configuration option (suggested by Thomas)
- Changed the monolithic configuration option to a modular configuration option (suggested by Thomas P.)
- Removed the refpolicy name option (suggested by Thomas P.)
- Corrected gramatical and comment errors (suggested by Thomas P.)
- Multiple style corrections to the mk file (suggested by Thomas P.)
- Added a comment to clairfy the usage of the the host build options for a target build
Changes v1 -> v2:
- General cleanup to the mk file to conform to the standard format
- Fixed the patch naming to match the standard 4 digit numbering
- Changed package dependencies into selects in the config
--- package/Config.in | 2 + package/refpolicy-contrib/Config.in | 19 + package/refpolicy-contrib/refpolicy-contrib.mk | 18 + .../0001-Fix-awk-references-to-use-variable.patch | 42 +++ package/refpolicy/Config.in | 99 +++++ package/refpolicy/S00selinux | 136 +++++++ package/refpolicy/config | 8 + package/refpolicy/modules.conf | 406 +++++++++++++++++++++ package/refpolicy/refpolicy.hash | 2 + package/refpolicy/refpolicy.mk | 120 ++++++ 10 files changed, 852 insertions(+) create mode 100644 package/refpolicy-contrib/Config.in create mode 100644 package/refpolicy-contrib/refpolicy-contrib.mk create mode 100644 package/refpolicy/2.20130424/0001-Fix-awk-references-to-use-variable.patch create mode 100644 package/refpolicy/Config.in create mode 100644 package/refpolicy/S00selinux create mode 100644 package/refpolicy/config create mode 100644 package/refpolicy/modules.conf create mode 100644 package/refpolicy/refpolicy.hash create mode 100644 package/refpolicy/refpolicy.mk
package/Config.in +2 -0
@@ -1352,6 +1352,8 @@ endmenu menu "Security" source "package/policycoreutils/Config.in" + source "package/refpolicy/Config.in" + source "package/refpolicy-contrib/Config.in" source "package/setools/Config.in" endmenu
package/refpolicy-contrib/Config.in new file +19 -0
@@ -0,0 +1,19 @@ +if BR2_PACKAGE_REFPOLICY_CUSTOM_GIT + +comment "A refpolicy contrib repository is required if using a refpolicy repo. (Contrib is a Git submodule of refpolicy)" + +config BR2_PACKAGE_REFPOLICY_CONTRIB + bool "refpolicy-contrib" + help + A Git submodule of the refpolicy package. + +config BR2_PACKAGE_REFPOLICY_CONTRIB_CUSTOM_REPO_URL + string "URL of custom contrib submodule repository" + +config BR2_PACKAGE_REFPOLICY_CONTRIB_CUSTOM_REPO_VERSION + string "Custom contrib submodule repository version" + help + Revision to use in the typical format used by Git + e.g. a SHA id, a tag, branch, .. + +endif
package/refpolicy-contrib/refpolicy-contrib.mk new file +18 -0
@@ -0,0 +1,18 @@ +################################################################################ +# +# refpolicy-contrib +# +################################################################################ + +ifeq ($(BR2_PACKAGE_REFPOLICY_CUSTOM_GIT),y) +REFPOLICY_CONTRIB_SITE = $(call qstrip,$(BR2_PACKAGE_REFPOLICY_CONTRIB_CUSTOM_REPO_URL)) +REFPOLICY_CONTRIB_VERSION = $(call qstrip,$(BR2_PACKAGE_REFPOLICY_CONTRIB_CUSTOM_REPO_VERSION)) +REFPOLICY_CONTRIB_SITE_METHOD = git + +# Inherits license from refpolicy as normally this is a submodule +REFPOLICY_CONTRIB_LICENSE = GPLv2 +endif + +# If refpolicy is from release archive, this contrib content is part of it. + +$(eval $(generic-package))
package/refpolicy/2.20130424/0001-Fix-awk-references-to-use-variable.patch new file +42 -0
42 lines not on this page · raw message
package/refpolicy/Config.in new file +99 -0
99 lines not on this page · raw message
package/refpolicy/S00selinux new file +136 -0
136 lines not on this page · raw message
package/refpolicy/config new file +8 -0
@@ -0,0 +1,8 @@ +# This file controls the state of SELinux on the system. +# SELINUX= can take one of these three values: +# enforcing - SELinux security policy is enforced. +# permissive - SELinux prints warnings instead of enforcing. +# disabled - No SELinux policy is loaded. +SELINUX=permissive +# SELINUXTYPE= name of the selinux policy to use +SELINUXTYPE=refpolicy
package/refpolicy/modules.conf new file +406 -0
406 lines not on this page · raw message
package/refpolicy/refpolicy.hash new file +2 -0
@@ -0,0 +1,2 @@ +#From https://github.com/TresysTechnology/refpolicy/wiki/DownloadRelease +sha256 6039ba854f244a39dc727cc7db25632f7b933bb271c803772d754d4354f5aef4 refpolicy-2.20130424.tar.bz2
package/refpolicy/refpolicy.mk new file +120 -0
120 lines not on this page · raw message
Signature · 1 line
1.9.1
PATCH v8 2/16 refpolicy: new package
Clayton, all,
Quoted 4 lines · Clayton Shotwell
From: Clayton Shotwell <[email protected]>
Signed-off-by Clayton Shotwell <[email protected]>Signed-off-by Matt Weber <[email protected]>
Reviewed-by Samuel Martin <[email protected]>
But still some nits ;-)
[...]
Quoted 13 lines
package/refpolicy/Config.in new file +7
-0@@ -0,0 +1,99 @@ +config BR2_PACKAGE_REFPOLICY + bool "refpolicy" + select BR2_PACKAGE_POLICYCOREUTILS + select BR2_PACKAGE_BUSYBOX_SELINUX if BR2_PACKAGE_BUSYBOX + depends on BR2_TOOLCHAIN_HAS_THREADS # policycoreutils + depends on BR2_TOOLCHAIN_USES_GLIBC || BR2_TOOLCHAIN_USES_MUSL # policycoreutils + help
package/refpolicy/Config.in line 17
Quoted 10 lines
package/refpolicy/Config.in new file +10
-0+ The SELinux Reference Policy project (refpolicy) is a + complete SELinux policy that can be used as the system + policy for a variety of systems and used as the basis + for creating other policies. Reference Policy was originally + based on the NSA example policy, but aims to accomplish + many additional goals. + + The current refpolicy does not fully support Buildroot + and needs modifications to work with the default system + file layout. These changes should be added as patches to
nit: s/layout. These/layout. These/
Quoted 6 lines
package/refpolicy/Config.in new file +6
-0+ the refpolicy that modify a single SELinux policy. + +comment "refpolicy needs a toolchain w/ threads, glibc or musl" + depends on !BR2_TOOLCHAIN_HAS_THREADS \ + || !(BR2_TOOLCHAIN_USES_GLIBC || BR2_TOOLCHAIN_USES_MUSL) +
[...]
Quoted 55 lines
package/refpolicy/refpolicy.mk new file +49
-0@@ -0,0 +1,120 @@ +################################################################################ +# +# refpolicy +# +################################################################################ + +ifeq ($(BR2_PACKAGE_REFPOLICY_CUSTOM_GIT),y) +REFPOLICY_SITE = $(call qstrip,$(BR2_PACKAGE_REFPOLICY_CUSTOM_REPO_URL)) +REFPOLICY_VERSION = $(call qstrip,$(BR2_PACKAGE_REFPOLICY_CUSTOM_REPO_VERSION)) +REFPOLICY_SITE_METHOD = git +REFPOLICY_DEPENDENCIES += refpolicy-contrib +else +REFPOLICY_VERSION = 2.20130424 +REFPOLICY_SOURCE = refpolicy-$(REFPOLICY_VERSION).tar.bz2 +REFPOLICY_SITE = http://oss.tresys.com/files/refpolicy/ +endif +REFPOLICY_LICENSE = GPLv2 +REFPOLICY_LICENSE_FILES = COPYING + +# Cannot use multiple threads to build the reference policy +REFPOLICY_MAKE = $(TARGET_MAKE_ENV) $(MAKE1) + +REFPOLICY_DEPENDENCIES += host-m4 host-checkpolicy host-policycoreutils \ + host-setools host-gawk host-python policycoreutils + +REFPOLICY_INSTALL_STAGING = YES + +REFPOLICY_POLICY_NAME = br_policy + +# To apply board specific customizations, create a refpolicy folder in +# BR2_GLOBAL_PATCH_DIR. These patches will be applied after the patches +# in package/refpolicy + +# Passing the HOST_CONFIGURE_OPTS to the target build because all of the +# build utilities are expected to be on system. This fools the make files +# into using the host built utilities to compile the SELinux policy for +# the target. +# +# Note, the TEST_TOOLCHAIN option will also set the +# LD_LIBRARY_PATH at run time. +REFPOLICY_MAKE_OPTS = $(HOST_CONFIGURE_OPTS) \ + TEST_TOOLCHAIN="$(HOST_DIR)" + +# Build requires python2 to run +REFPOLICY_MAKE_ENV = \ + PYTHON="$(HOST_DIR)/usr/bin/python2" \ + AWK="$(HOST_DIR)/usr/bin/gawk" \ + M4="$(HOST_DIR)/usr/bin/m4" +
package/refpolicy/refpolicy.mk line 59
Quoted 10 lines
package/refpolicy/refpolicy.mk new file +10
-0+ +ifeq ($(BR2_PACKAGE_REFPOLICY_MODULAR),y) + REFPOLICY_MONOLITHIC = n +else + REFPOLICY_MONOLITHIC = y +endif + +ifeq ($(BR2_PACKAGE_REFPOLICY_CUSTOM_GIT),y) +define REFPOLICY_GIT_SUBMODULE_SETUP + rsync -ar $(RSYNC_VCS_EXCLUSIONS) $(REFPOLICY_CONTRIB_DIR)/* $(@D)/policy/modules/contrib/
nit: wrap at ~70-80 characters
package/refpolicy/refpolicy.mk line 67
Quoted 8 lines
package/refpolicy/refpolicy.mk new file +8
-0+endef +else +REFPOLICY_MODULES_FILE = $(call qstrip,$(BR2_PACKAGE_REFPOLICY_MODULES_FILE)) +define REFPOLICY_CUSTOM_MODULES_CONF + cp $(REFPOLICY_MODULES_FILE) $(@D)/policy/modules.conf +endef +endif +
[...]
Regards,
Signature · 1 line
Samuel
PATCH v8 2/16 refpolicy: new package
Samuel,
Quoted 29 lines · Samuel Martin
Clayton, all,
Quoted 4 lines · Clayton Shotwell
From: Clayton Shotwell <[email protected]>
Signed-off-by Clayton Shotwell <[email protected]>Signed-off-by Matt Weber <[email protected]>Reviewed-by Samuel Martin <[email protected]>But still some nits ;-)
[...]
Quoted 16 lines
package/refpolicy/Config.in new file +10
-0@@ -0,0 +1,99 @@ +config BR2_PACKAGE_REFPOLICY + bool "refpolicy" + select BR2_PACKAGE_POLICYCOREUTILS + select BR2_PACKAGE_BUSYBOX_SELINUX if BR2_PACKAGE_BUSYBOX + depends on BR2_TOOLCHAIN_HAS_THREADS # policycoreutils + depends on BR2_TOOLCHAIN_USES_GLIBC || BR2_TOOLCHAIN_USES_MUSL # policycoreutils + help + The SELinux Reference Policy project (refpolicy) is a + complete SELinux policy that can be used as the system + policy for a variety of systems and used as the basis
Quoted 8 lines
package/refpolicy/Config.in line 17
Quoted 7 lines
package/refpolicy/Config.in new file +7
-0+ for creating other policies. Reference Policy was originally + based on the NSA example policy, but aims to accomplish + many additional goals. + + The current refpolicy does not fully support Buildroot + and needs modifications to work with the default system + file layout. These changes should be added as patches tonit: s/layout. These/layout. These/
Fixed.
Quoted 67 lines
Quoted 6 lines
package/refpolicy/Config.in new file +6
-0+ the refpolicy that modify a single SELinux policy. + +comment "refpolicy needs a toolchain w/ threads, glibc or musl" + depends on !BR2_TOOLCHAIN_HAS_THREADS \ + || !(BR2_TOOLCHAIN_USES_GLIBC || BR2_TOOLCHAIN_USES_MUSL) +[...]
Quoted 58 lines
package/refpolicy/refpolicy.mk new file +52
-0@@ -0,0 +1,120 @@ +################################################################################ +# +# refpolicy +# +################################################################################ + +ifeq ($(BR2_PACKAGE_REFPOLICY_CUSTOM_GIT),y) +REFPOLICY_SITE = $(call qstrip,$(BR2_PACKAGE_REFPOLICY_CUSTOM_REPO_URL)) +REFPOLICY_VERSION = $(call qstrip,$(BR2_PACKAGE_REFPOLICY_CUSTOM_REPO_VERSION)) +REFPOLICY_SITE_METHOD = git +REFPOLICY_DEPENDENCIES += refpolicy-contrib +else +REFPOLICY_VERSION = 2.20130424 +REFPOLICY_SOURCE = refpolicy-$(REFPOLICY_VERSION).tar.bz2 +REFPOLICY_SITE = http://oss.tresys.com/files/refpolicy/ +endif +REFPOLICY_LICENSE = GPLv2 +REFPOLICY_LICENSE_FILES = COPYING + +# Cannot use multiple threads to build the reference policy +REFPOLICY_MAKE = $(TARGET_MAKE_ENV) $(MAKE1) + +REFPOLICY_DEPENDENCIES += host-m4 host-checkpolicy host-policycoreutils \ + host-setools host-gawk host-python policycoreutils + +REFPOLICY_INSTALL_STAGING = YES + +REFPOLICY_POLICY_NAME = br_policy + +# To apply board specific customizations, create a refpolicy folder in +# BR2_GLOBAL_PATCH_DIR. These patches will be applied after the patches +# in package/refpolicy + +# Passing the HOST_CONFIGURE_OPTS to the target build because all of the +# build utilities are expected to be on system. This fools the make files +# into using the host built utilities to compile the SELinux policy for +# the target. +# +# Note, the TEST_TOOLCHAIN option will also set the +# LD_LIBRARY_PATH at run time. +REFPOLICY_MAKE_OPTS = $(HOST_CONFIGURE_OPTS) \ + TEST_TOOLCHAIN="$(HOST_DIR)" + +# Build requires python2 to run +REFPOLICY_MAKE_ENV = \ + PYTHON="$(HOST_DIR)/usr/bin/python2" \ + AWK="$(HOST_DIR)/usr/bin/gawk" \ + M4="$(HOST_DIR)/usr/bin/m4" + + +ifeq ($(BR2_PACKAGE_REFPOLICY_MODULAR),y) + REFPOLICY_MONOLITHIC = n
Quoted 8 lines
package/refpolicy/refpolicy.mk line 59
Quoted 7 lines
package/refpolicy/refpolicy.mk new file +7
-0+else + REFPOLICY_MONOLITHIC = y +endif + +ifeq ($(BR2_PACKAGE_REFPOLICY_CUSTOM_GIT),y) +define REFPOLICY_GIT_SUBMODULE_SETUP + rsync -ar $(RSYNC_VCS_EXCLUSIONS) $(REFPOLICY_CONTRIB_DIR)/* $(@D)/policy/modules/contrib/nit: wrap at ~70-80 characters
Fixed.
Thanks,
Clayton
Clayton Shotwell
Senior Software Engineer, Rockwell Collins
clayton.shotwell at rockwellcollins.com
PATCH v8 3/16 busybox: applets as individual binaries
In reply to Clayton ShotwellThe individual binaries option of busybox allows for the applets that would usually be symlinks to be built as individual applications that link against a shared library.
This feature is needed for SELinux to allow the applications to run under the correct SELinux context.
The patch being added allows the individual applications to be installed and will be upstreamed to the busybox developers.
The initial work for this change was done by Thomas Petazzoni <[email protected]>.
Signed-off-by Clayton Shotwell <[email protected]>
Signed-off-by Matthew Weber <[email protected]>
---
Changes v7 -> v8:
- Changed individual binaries comment to be !BR2_bfin (Suggested by Samuel)
Changes v6 -> v7:
- No changes
Changes v5 -> v6:
- No changes
Changes v4 -> v5:
- Renamed to follow latest patch naming convention (Matt W.)
- Updated to use BR2_STATIC_LIBS instead of old PREFERRED (Matt W.)
- Added depends to make sure bfin can't build shared lib busybox lib for individual binary use. Looks like shared lib creation doesn't error out but the objects don't get placed into the elf. Then the trylink fails on linking the first individual applet. (Matt W.)
- Made suid permissions setting dynamic for applets actually being installed (Clayton S.)
Changes v1 -> v4:
- Did not exist
--- ...s-Add-installation-of-individual-binaries.patch | 103 +++++++++++++++++++++ package/busybox/Config.in | 9 ++ package/busybox/busybox.mk | 41 ++++++++ 3 files changed, 153 insertions(+) create mode 100644 package/busybox/0002-applets-Add-installation-of-individual-binaries.patch
package/busybox/0002-applets-Add-installation-of-individual-binaries.patch new file +103 -0
@@ -0,0 +1,103 @@ +From 3451b55054a6fe2073a21301938802a27dec835d Mon Sep 17 00:00:00 2001 +From: Clayton Shotwell <[email protected]> +Date: Mon, 16 Dec 2013 14:45:33 -0600 +Subject: [PATCH 5/5] applets: Add installation of individual binaries + +Adding support to install individual binaries if the option is +enabled. This also installs the shared libbusybox.so.* library. + +Signed-off-by: Clayton Shotwell <[email protected]> +--- + Makefile.custom | 4 ++++ + applets/install.sh | 26 ++++++++++++++++++++++++-- + 2 files changed, 28 insertions(+), 2 deletions(-) + +diff --git a/Makefile.custom b/Makefile.custom +index 6da79e6..e4dc4dc 100644 +--- a/Makefile.custom ++++ b/Makefile.custom +@@ -23,6 +23,10 @@ ifeq ($(CONFIG_INSTALL_SH_APPLET_SCRIPT_WRAPPER),y) + INSTALL_OPTS:= --scriptwrapper + endif + endif ++ifeq ($(CONFIG_FEATURE_INDIVIDUAL),y) ++INSTALL_OPTS:= --binaries ++LIBBUSYBOX_SONAME:= 0_lib/libbusybox.so.$(BB_VER) ++endif + install: $(srctree)/applets/install.sh busybox busybox.links + $(Q)DO_INSTALL_LIBS="$(strip $(LIBBUSYBOX_SONAME) $(DO_INSTALL_LIBS))" \ + $(SHELL) $< $(CONFIG_PREFIX) $(INSTALL_OPTS) +diff --git a/applets/install.sh b/applets/install.sh +index 95b4719..d01c98d 100755 +--- a/applets/install.sh ++++ b/applets/install.sh +@@ -5,19 +5,26 @@ export LC_CTYPE=POSIX + + prefix=$1 + if [ -z "$prefix" ]; then +- echo "usage: applets/install.sh DESTINATION [--symlinks/--hardlinks/--scriptwrapper]" ++ echo "usage: applets/install.sh DESTINATION [--symlinks/--hardlinks/--binaries/--scriptwrapper]" + exit 1 + fi + ++# Source the configuration ++. ./.config ++ + h=`sort busybox.links | uniq` + ++sharedlib_dir="0_lib" ++ + linkopts="" + scriptwrapper="n" ++binaries="n" + cleanup="0" + noclobber="0" + case "$2" in + --hardlinks) linkopts="-f";; + --symlinks) linkopts="-fs";; ++ --binaries) binaries="y";; + --scriptwrapper) scriptwrapper="y";swrapall="y";; + --sw-sh-hard) scriptwrapper="y";linkopts="-f";; + --sw-sh-sym) scriptwrapper="y";linkopts="-fs";; +@@ -40,8 +47,9 @@ if [ -n "$DO_INSTALL_LIBS" ] && [ "$DO_INSTALL_LIBS" != "n" ]; then + for i in $DO_INSTALL_LIBS; do + rm -f "$prefix/$libdir/$i" || exit 1 + if [ -f "$i" ]; then ++ echo " Installing $i to the target@$prefix/$libdir/" + cp -pPR "$i" "$prefix/$libdir/" || exit 1 +- chmod 0644 "$prefix/$libdir/$i" || exit 1 ++ chmod 0644 "$prefix/$libdir/`basename $i`" || exit 1 + fi + done + fi +@@ -68,6 +76,7 @@ install -m 755 busybox "$prefix/bin/busybox" || exit 1 + + for i in $h; do + appdir=`dirname "$i"` ++ app=`basename "$i"` + mkdir -p "$prefix/$appdir" || exit 1 + if [ "$scriptwrapper" = "y" ]; then + if [ "$swrapall" != "y" ] && [ "$i" = "/bin/sh" ]; then +@@ -78,6 +87,19 @@ for i in $h; do + chmod +x "$prefix/$i" + fi + echo " $prefix/$i" ++ elif [ "$binaries" = "y" ]; then ++ # Copy the binary over rather ++ if [ -e $sharedlib_dir/$app ]; then ++ if [ "$noclobber" = "0" ] || [ ! -e "$prefix/$i" ]; then ++ echo " Copying $sharedlib_dir/$app to $prefix/$i" ++ cp -pPR $sharedlib_dir/$app $prefix/$i || exit 1 ++ else ++ echo " $prefix/$i already exists" ++ fi ++ else ++ echo "Error: Could not find $sharedlib_dir/$app" ++ exit 1 ++ fi + else + if [ "$2" = "--hardlinks" ]; then + bb_path="$prefix/bin/busybox" +-- +1.7.1 +
package/busybox/Config.in +9 -0
@@ -32,6 +32,15 @@ config BR2_PACKAGE_BUSYBOX_SHOW_OTHERS Show packages in menuconfig that are potentially also provided by busybox. +config BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES + bool "Individual binaries" + depends on !BR2_STATIC_LIBS + depends on !BR2_bfin # libbusybox.so link issue + +comment "Busybox individual binaries depends on dynamic libraries" + depends on BR2_STATIC_LIBS + depends on !BR2_bfin + config BR2_PACKAGE_BUSYBOX_WATCHDOG bool "Install the watchdog daemon startup script" help
package/busybox/busybox.mk +41 -0
69 lines not on this page · raw message
Signature · 1 line
1.9.1
PATCH v8 3/16 busybox: applets as individual binaries
Quoted 7 lines · Clayton Shotwell
The individual binaries option of busybox allows for the applets that would usually be symlinks to be built as individual applications that link against a shared library.
This feature is needed for SELinux to allow the applications to run under the correct SELinux context.
Quoted 8 lines
The patch being added allows the individual applications to be installed and will be upstreamed to the busybox developers.
The initial work for this change was done by Thomas Petazzoni <[email protected]>.
Signed-off-by Clayton Shotwell <[email protected]>Signed-off-by Matthew Weber <[email protected]>
Reviewed-by Samuel Martin <[email protected]>
Regards,
Signature · 1 line
Samuel
PATCH v8 4/16 busybox: selinux support
In reply to Clayton ShotwellAdd a configure option to enable the SELinux support in the busybox configuration from the Buildroot menuconfig.
Signed-off-by Thomas Petazzoni <[email protected]>
Signed-off-by Clayton Shotwell <[email protected]>
Signed-off-by Matt Weber <[email protected]>
---
Changes v7 -> v8:
- Fixed typos and removed extra line (Suggested by Samuel)
Changes v6 -> v7:
- No changes
Changes v5 -> v6:
- Added help text to the SELinux configuration option (Suggested by Thomas P. and Samuel)
Changes v4 -> v5:
- Renamed to follow patch naming convention (Matt W.)
- Added a dependency on having threads for the busybox SELinux flag to ensure it does not cause libselinux to build when threads are not available. Also added a select for libselinux to make the linking apparent. (Clayton S.)
- Add dependency on not static libs for libselinux (Clayton S.)
Changes v1 -> v4:
- Did not exist
--- ...ags-strip-non-l-arguments-returned-by-pkg.patch | 28 ++++++++++++++++++++++ package/busybox/Config.in | 16 +++++++++++++ package/busybox/busybox.mk | 9 +++++++ 3 files changed, 53 insertions(+) create mode 100644 package/busybox/0008-Makefile.flags-strip-non-l-arguments-returned-by-pkg.patch
package/busybox/0008-Makefile.flags-strip-non-l-arguments-returned-by-pkg.patch new file +28 -0
@@ -0,0 +1,28 @@ +From 67eb23d2be8aba3c474dac81a15b0fa11e5847b7 Mon Sep 17 00:00:00 2001 +From: Thomas Petazzoni <[email protected]> +Date: Mon, 25 Nov 2013 22:51:53 +0100 +Subject: [PATCH] Makefile.flags: strip non -l arguments returned by pkg-config + +Signed-off-by: Thomas Petazzoni <[email protected]> +--- + Makefile.flags | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/Makefile.flags b/Makefile.flags +index 307afa7..885e323 100644 +--- a/Makefile.flags ++++ b/Makefile.flags +@@ -141,7 +141,9 @@ ifeq ($(CONFIG_SELINUX),y) + SELINUX_PC_MODULES = libselinux libsepol + $(eval $(call pkg_check_modules,SELINUX,$(SELINUX_PC_MODULES))) + CPPFLAGS += $(SELINUX_CFLAGS) +-LDLIBS += $(if $(SELINUX_LIBS),$(SELINUX_LIBS:-l%=%),$(SELINUX_PC_MODULES:lib%=%)) ++LDLIBS += $(if $(SELINUX_LIBS),\ ++ $(patsubst -l%,%,$(filter -l%,$(SELINUX_LIBS))),\ ++ $(SELINUX_PC_MODULES:lib%=%)) + endif + + ifeq ($(CONFIG_EFENCE),y) +-- +1.8.1.2 +
package/busybox/Config.in +16 -0
@@ -41,6 +41,22 @@ comment "Busybox individual binaries depends on dynamic libraries" depends on BR2_STATIC_LIBS depends on !BR2_bfin +config BR2_PACKAGE_BUSYBOX_SELINUX + select BR2_PACKAGE_LIBSELINUX + depends on BR2_TOOLCHAIN_HAS_THREADS + depends on !BR2_STATIC_LIBS + bool "Enable SELinux support" + help + Enable SELinux support in BusyBox. Please note that depending on + your BusyBox configuration and the SELinux policy implementation, + you may want to also enable BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES. + + For instance, if your BusyBox configuration only uses a couple of + minor BusyBox features, such as simple command line utilities, the + symlinked version of BusyBox can be used to save space. If BusyBox + provides more features, such as crond, then individual binaries + have to be enabled for the SELinux type transitions to occur properly. + config BR2_PACKAGE_BUSYBOX_WATCHDOG bool "Install the watchdog daemon startup script" help
package/busybox/busybox.mk +9 -0
@@ -172,6 +172,14 @@ define BUSYBOX_INSTALL_INDIVIDUAL_BINARIES endef endif +ifeq ($(BR2_PACKAGE_BUSYBOX_SELINUX),y) +BUSYBOX_DEPENDENCIES += host-pkgconf libselinux libsepol +define BUSYBOX_SET_SELINUX + $(call KCONFIG_ENABLE_OPT,CONFIG_SELINUX,$(BUSYBOX_BUILD_CONFIG)) + $(call KCONFIG_ENABLE_OPT,CONFIG_SELINUXENABLED,$(BUSYBOX_BUILD_CONFIG)) +endef +endif + define BUSYBOX_INSTALL_LOGGING_SCRIPT if grep -q CONFIG_SYSLOGD=y $(@D)/.config; then \ $(INSTALL) -m 0755 -D package/busybox/S01logging \
@@ -217,6 +225,7 @@ define BUSYBOX_KCONFIG_FIXUP_CMDS $(BUSYBOX_SET_INIT) $(BUSYBOX_SET_WATCHDOG) $(BUSYBOX_CONFIGURE_INDIVIDUAL_BINARIES) + $(BUSYBOX_SET_SELINUX) endef define BUSYBOX_CONFIGURE_CMDS
Signature · 1 line
1.9.1
PATCH v8 4/16 busybox: selinux support
Quoted 6 lines · Clayton Shotwell
Add a configure option to enable the SELinux support in the busybox configuration from the Buildroot menuconfig.
Signed-off-by Thomas Petazzoni <[email protected]>Signed-off-by Clayton Shotwell <[email protected]>Signed-off-by Matt Weber <[email protected]>
Reviewed-by Samuel Martin <[email protected]>
Regards,
Signature · 1 line
Samuel
PATCH v8 5/16 linux-pam: selinux support
In reply to Clayton ShotwellFrom: Matt Weber <[email protected]>
Signed-off-by Matthew Weber <[email protected]>
---
Changes v7 -> v8:
- Removed sub-shell around the config file install block and refactored the block to use absolute paths for the copying (Suggested by Samuel)
- Changed the enable-db=no configure option to disable-db to be consistent with the rest of the configure options (Suggested by Samuel)
Changes v6 -> v7:
- Added missing host-pkgconf dependency and removed unneeded host-autoconf dependency(Clayton S.)
Changes v5 -> v6:
- No changes
Changes v4 -> v5:
- Dropping unneeded patch (Clayton S.)
Changes v1 -> v4:
- Did not exist
--- package/linux-pam/linux-pam.mk | 56 +++++++++++++++++++++++++++++++++++++- package/linux-pam/system-auth.pamd | 15 ++++++++++ 2 files changed, 70 insertions(+), 1 deletion(-) create mode 100644 package/linux-pam/system-auth.pamd
package/linux-pam/linux-pam.mk +55 -1
@@ -8,6 +8,9 @@ LINUX_PAM_VERSION = 1.1.8 LINUX_PAM_SOURCE = Linux-PAM-$(LINUX_PAM_VERSION).tar.bz2 LINUX_PAM_SITE = http://linux-pam.org/library LINUX_PAM_INSTALL_STAGING = YES + +# lckpwdf is included with shadow +# cracklib and libdb are not currently present in buildroot LINUX_PAM_CONF_OPTS = \ --disable-prelude \ --disable-isadir \
@@ -15,8 +18,10 @@ LINUX_PAM_CONF_OPTS = \ --disable-db \ --disable-regenerate-docu \ --enable-securedir=/lib/security \ + --disable-cracklib \ --libdir=/lib -LINUX_PAM_DEPENDENCIES = flex host-flex host-pkgconf + +LINUX_PAM_DEPENDENCIES = flex host-flex host-pkgconf host-linux-pam LINUX_PAM_AUTORECONF = YES LINUX_PAM_LICENSE = BSD-3c LINUX_PAM_LICENSE_FILES = Copyright
@@ -26,12 +31,61 @@ LINUX_PAM_DEPENDENCIES += gettext LINUX_PAM_MAKE_OPTS += LIBS=-lintl endif +ifeq ($(BR2_PACKAGE_LIBSELINUX),y) + LINUX_PAM_CONF_OPTS += --enable-selinux + LINUX_PAM_DEPENDENCIES += libselinux +else + LINUX_PAM_CONF_OPTS += --disable-selinux +endif + +ifeq ($(BR2_PACKAGE_AUDIT),y) + LINUX_PAM_CONF_OPTS += --enable-audit + LINUX_PAM_DEPENDENCIES += audit +else + LINUX_PAM_CONF_OPTS += --disable-audit +endif + # Install default pam config (deny everything) define LINUX_PAM_INSTALL_CONFIG $(INSTALL) -m 0644 -D package/linux-pam/other.pam \ $(TARGET_DIR)/etc/pam.d/other endef +# Use the host-pam pam_conv1 app to create the pam.d files +define LINUX_PAM_CONFIG_FILE_TARGET_INSTALL + if [ -d $(TARGET_DIR)/etc/pam.d/ ]; then \ + mv $(TARGET_DIR)/etc/pam.d/ $(TARGET_DIR)/etc/pam.d.orig/; \ + fi; \ + cd $(TARGET_DIR)/etc/ && \ + cat $(@D)/conf/pam.conf | $(HOST_DIR)/usr/bin/pam_conv1; \ + if [ -d $(TARGET_DIR)/etc/pam.d.orig ]; then \ + cp -a $(TARGET_DIR)/etc/pam.d/* $(TARGET_DIR)/etc/pam.d.orig/; \ + rm -rf $(TARGET_DIR)/etc/pam.d/; \ + mv $(TARGET_DIR)/etc/pam.d.orig/ $(TARGET_DIR)/etc/pam.d/; \ + fi; + $(INSTALL) -D -m 0644 package/linux-pam/system-auth.pamd $(TARGET_DIR)/etc/pam.d/system-auth +endef + +LINUX_PAM_POST_INSTALL_TARGET_HOOKS += LINUX_PAM_CONFIG_FILE_TARGET_INSTALL LINUX_PAM_POST_INSTALL_TARGET_HOOKS += LINUX_PAM_INSTALL_CONFIG +HOST_LINUX_PAM_DEPENDENCIES = host-flex host-pkgconf + +HOST_LINUX_PAM_CONF_OPTS = --disable-rpath \ + --enable-read-both-confs \ + --disable-regenerate-docu \ + --disable-isadir \ + --disable-nis \ + --enable-securedir=/lib/security \ + --disable-prelude \ + --disable-cracklib \ + --disable-lckpwdf \ + --disable-db \ + --disable-selinux \ + --disable-audit \ + +define HOST_LINUX_PAM_INSTALL_CMDS + $(INSTALL) -m 755 $(@D)/conf/pam_conv1/pam_conv1 $(HOST_DIR)/usr/bin/ +endef $(eval $(autotools-package)) +$(eval $(host-autotools-package))
package/linux-pam/system-auth.pamd new file +15 -0
@@ -0,0 +1,15 @@ +#%PAM-1.0 +auth required pam_env.so +auth sufficient pam_unix.so +auth required pam_deny.so + +account required pam_unix.so + +#password required pam_cracklib.so try_first_pass retry=3 +password sufficient pam_unix.so md5 shadow try_first_pass +password required pam_deny.so + +session optional pam_keyinit.so revoke +session required pam_limits.so +session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid +session required pam_unix.so
Signature · 1 line
1.9.1
PATCH v8 5/16 linux-pam: selinux support
Quoted 3 lines · Clayton Shotwell
From: Matt Weber <[email protected]>
Signed-off-by Matthew Weber <[email protected]>
Reviewed-by Samuel Martin <[email protected]>
Regards,
Signature · 1 line
Samuel
PATCH v8 6/16 busybox: added linux-pam support
In reply to Clayton ShotwellFrom: Matt Weber <[email protected]>
Signed-off-by Matt Weber <[email protected]>
---
Changes v7 -> v8:
- No changes
Changes v6 -> v7:
- No changes
Changes v5 -> v6:
- No changes
Changes v4 -> v5:
- No changes
Changes v1 -> v4:
- Did not exist
--- package/busybox/busybox.mk | 7 +++++++ 1 file changed, 7 insertions(+)
package/busybox/busybox.mk +7 -0
@@ -172,6 +172,13 @@ define BUSYBOX_INSTALL_INDIVIDUAL_BINARIES endef endif +ifeq ($(BR2_PACKAGE_LINUX_PAM),y) +define BUSYBOX_LINUX_PAM + $(call KCONFIG_ENABLE_OPT,CONFIG_PAM,$(BUSYBOX_BUILD_CONFIG)) +endef +BUSYBOX_DEPENDENCIES += linux-pam +endif + ifeq ($(BR2_PACKAGE_BUSYBOX_SELINUX),y) BUSYBOX_DEPENDENCIES += host-pkgconf libselinux libsepol define BUSYBOX_SET_SELINUX
Signature · 1 line
1.9.1
PATCH v8 6/16 busybox: added linux-pam support
Quoted 3 lines · Clayton Shotwell
From: Matt Weber <[email protected]>
Signed-off-by Matt Weber <[email protected]>
Reviewed-by Samuel Martin <[email protected]>
Regards,
Signature · 1 line
Samuel
PATCH v8 7/16 sysvinit: added libselinux dependency
In reply to Clayton ShotwellFrom: Matt Weber <[email protected]>
Signed-off-by Matthew Weber <[email protected]>
---
Changes v7 -> v8:
- No changes
Changes v6 -> v7:
- No changes
Changes v5 -> v6:
- No changes
Changes v4 -> v5:
- Removed unnecessary += when adding buysbox dependency (Ryan B.)
- Removed duplicate assignment of OPTS (Matt W.)
- Added description to patch and signed off line (Clayton S.)
Changes v1 -> v4:
- Did not exist
--- ...1-Fix-SELinux-compile-flags-and-libraries.patch | 44 ++++++++++++++++++++++ package/sysvinit/sysvinit.mk | 5 +++ 2 files changed, 49 insertions(+) create mode 100644 package/sysvinit/0001-Fix-SELinux-compile-flags-and-libraries.patch
package/sysvinit/0001-Fix-SELinux-compile-flags-and-libraries.patch new file +44 -0
@@ -0,0 +1,44 @@ +From e7dc523c1850534d98ab90dd02e07ee214e21f24 Mon Sep 17 00:00:00 2001 +From: Clayton Shotwell <[email protected]> +Date: Fri, 1 May 2015 10:58:47 -0500 +Subject: [PATCH] Fix SELinux compile flags and libraries + +The SELinux flags, added as CPPFLAGS, end up getting dropped by the +Makefile. Also ensuring sulogin is linked against libsepol which is +required. + +Signed-off-by: Clayton Shotwell <[email protected]> +--- + src/Makefile | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/src/Makefile b/src/Makefile +index e2b8028..bf1ae81 100644 +--- a/src/Makefile ++++ b/src/Makefile +@@ -104,7 +104,7 @@ utmpdump: utmpdump.o + + runlevel: runlevel.o + +-sulogin: LDLIBS += $(SULOGINLIBS) $(STATIC) ++sulogin: LDLIBS += $(SULOGINLIBS) $(INITLIBS) $(STATIC) + sulogin: sulogin.o + + wall: dowall.o wall.o +@@ -114,10 +114,10 @@ shutdown: dowall.o shutdown.o utmp.o reboot.h + bootlogd: LDLIBS += -lutil + bootlogd: bootlogd.o + +-sulogin.o: CPPFLAGS += $(SELINUX_DEF) +-sulogin.o: sulogin.c ++sulogin.o: CFLAGS += $(SELINUX_DEF) ++sulogin.o: sulogin.c + +-init.o: CPPFLAGS += $(SELINUX_DEF) ++init.o: CFLAGS += $(SELINUX_DEF) + init.o: init.c init.h set.h reboot.h initreq.h + + utmp.o: utmp.c init.h +-- +1.9.1 +
package/sysvinit/sysvinit.mk +5 -0
@@ -16,6 +16,11 @@ ifeq ($(BR2_PACKAGE_BUSYBOX),y) SYSVINIT_DEPENDENCIES = busybox endif +ifeq ($(BR2_PACKAGE_LIBSELINUX),y) +SYSVINIT_DEPENDENCIES += libselinux +TARGET_CONFIGURE_OPTS += WITH_SELINUX="yes" ROOT="$(TARGET_DIR)" +endif + define SYSVINIT_DEBIAN_PATCHES if [ -d $(@D)/debian/patches ]; then \ $(APPLY_PATCHES) $(@D) $(@D)/debian/patches \*.patch; \
Signature · 1 line
1.9.1
PATCH v8 7/16 sysvinit: added libselinux dependency
Quoted 3 lines · Clayton Shotwell
From: Matt Weber <[email protected]>
Signed-off-by Matthew Weber <[email protected]>
Reviewed-by Samuel Martin <[email protected]>
Regards,
Signature · 1 line
Samuel
PATCH v8 8/16 dbus: selinux file context support
In reply to Clayton ShotwellFrom: Matt Weber <[email protected]>
Signed-off-by Matthew Weber <[email protected]>
---
Changes v7 -> v8:
- No changes
Changes v6 -> v7:
- No changes
Changes v5 -> v6:
- No changes
Changes v4 -> v5
- No changes
Changes v1 -> v4:
- Did not exist
--- package/dbus/S30dbus | 4 ++++ package/dbus/dbus.mk | 14 ++++++++++++++ 2 files changed, 18 insertions(+) mode change 100755 => 100644 package/dbus/S30dbus
package/dbus/S30dbus +4 -0
@@ -17,6 +17,10 @@ [ -d /var/run/dbus ] || mkdir -p /var/run/dbus [ -d /var/lock/subsys ] || mkdir -p /var/lock/subsys [ -d /tmp/dbus ] || mkdir -p /tmp/dbus +[ -d /var/lib/dbus ] || mkdir -p /var/lib/dbus +if [ -e /sbin/restorecon ]; then + restorecon -R /var/run/dbus /var/lock/subsys /tmp/dbus /var/lib/dbus +fi RETVAL=0
package/dbus/dbus.mk +14 -0
@@ -44,6 +44,20 @@ ifeq ($(BR2_microblaze),y) DBUS_CONF_OPTS += --disable-inotify endif +ifeq ($(BR2_PACKAGE_LIBSELINUX),y) +DBUS_CONF_OPTS += --enable-selinux +DBUS_DEPENDENCIES += libselinux +else +DBUS_CONF_OPTS += --disable-selinux +endif + +ifeq ($(BR2_PACKAGE_AUDIT),y) +DBUS_CONF_OPTS += --enable-libaudit +DBUS_DEPENDENCIES += audit libcap-ng +else +DBUS_CONF_OPTS += --disable-libaudit +endif + ifeq ($(BR2_PACKAGE_XLIB_LIBX11),y) DBUS_CONF_OPTS += --with-x DBUS_DEPENDENCIES += xlib_libX11
Signature · 1 line
1.9.1
PATCH v8 8/16 dbus: selinux file context support
Quoted 3 lines · Clayton Shotwell
From: Matt Weber <[email protected]>
Signed-off-by Matthew Weber <[email protected]>
Reviewed-by Samuel Martin <[email protected]>
Regards,
Signature · 1 line
Samuel
PATCH v8 9/16 openssh: selinux and pam support
In reply to Clayton ShotwellFrom: Matt Weber <[email protected]>
Signed-off-by Matthew Weber <[email protected]>
---
Changes v7 -> v8:
- Fixed sed calls to use macro (Suggested by Samuel)
Changes v6 -> v7:
- No changes
Changes v5 -> v6:
- No changes
Changes v4 -> v5:
- New patch
- Added without assignments (Matt W.)
- Moved install pam define in conditional (Matt W.)
--- package/openssh/openssh.mk | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
package/openssh/openssh.mk +16 -0
@@ -30,8 +30,24 @@ endif OPENSSH_DEPENDENCIES = zlib openssl ifeq ($(BR2_PACKAGE_LINUX_PAM),y) +define OPENSSH_INSTALL_PAM_CONF + $(INSTALL) -D -m 644 $(@D)/contrib/sshd.pam.generic $(TARGET_DIR)/etc/pam.d/sshd + $(SED) '/password required \/lib\/security\/pam_cracklib.so/d' $(TARGET_DIR)/etc/pam.d/sshd + $(SED) 's/\#UsePAM no/UsePAM yes/' $(TARGET_DIR)/etc/ssh/sshd_config +endef + OPENSSH_DEPENDENCIES += linux-pam OPENSSH_CONF_OPTS += --with-pam +OPENSSH_POST_INSTALL_TARGET_HOOKS += OPENSSH_INSTALL_PAM_CONF +else +OPENSSH_CONF_OPTS += --without-pam +endif + +ifeq ($(BR2_PACKAGE_LIBSELINUX),y) +OPENSSH_DEPENDENCIES += libselinux +OPENSSH_CONF_OPTS += --with-selinux +else +OPENSSH_CONF_OPTS += --without-selinux endif define OPENSSH_INSTALL_INIT_SYSTEMD
Signature · 1 line
1.9.1
PATCH v8 9/16 openssh: selinux and pam support
Quoted 3 lines · Clayton Shotwell
From: Matt Weber <[email protected]>
Signed-off-by Matthew Weber <[email protected]>
Reviewed-by Samuel Martin <[email protected]>
Regards,
Signature · 1 line
Samuel
PATCH v8 10/16 util-linux: selinux, audit, and pam support
In reply to Clayton ShotwellFrom: Matt Weber <[email protected]>
Signed-off-by Matthew Weber <[email protected]>
Signed-off-by Clayton Shotwell <[email protected]>
---
Changes v7 -> v8:
- No changes
Changes v6 -> v7:
- No changes
Changes v5 -> v6:
- No changes
Changes v4 -> v5:
- New patch
- Added pam file tweaks for selinux support (Clayton S.)
--- package/util-linux/util-linux.mk | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+)
package/util-linux/util-linux.mk +27 -0
@@ -59,6 +59,20 @@ ifeq ($(BR2_PACKAGE_LIBCAP_NG),y) UTIL_LINUX_DEPENDENCIES += libcap-ng endif +ifeq ($(BR2_PACKAGE_LIBSELINUX),y) +UTIL_LINUX_DEPENDENCIES += libselinux +UTIL_LINUX_CONF_OPTS += --with-selinux +else +UTIL_LINUX_CONF_OPTS += --without-selinux +endif + +ifeq ($(BR2_PACKAGE_AUDIT),y) +UTIL_LINUX_DEPENDENCIES += audit +UTIL_LINUX_CONF_OPTS += --with-audit +else +UTIL_LINUX_CONF_OPTS += --without-audit +endif + # Used by cramfs utils UTIL_LINUX_DEPENDENCIES += $(if $(BR2_PACKAGE_ZLIB),zlib)
@@ -146,9 +160,22 @@ define UTIL_LINUX_INSTALL_PAMFILES $(INSTALL) -m 0644 package/util-linux/su.pam \ $(TARGET_DIR)/etc/pam.d/su-l endef + +# Add the required hooks to the pam files if SELinux is enabled +ifeq ($(BR2_PACKAGE_LIBSELINUX),y) +define UTIL_LINUX_FIXUP_PAMFILES + for file in login su su-l ; do \ + $(SED) '/selinux/d' $(TARGET_DIR)/etc/pam.d/$${file}; \ + $(SED) '0,/session/s/session/session required pam_selinux.so close\nsession/' $(TARGET_DIR)/etc/pam.d/$${file}; \ + echo "session required pam_selinux.so open" >> $(TARGET_DIR)/etc/pam.d/$${file}; \ + done +endef +endif + endif UTIL_LINUX_POST_INSTALL_TARGET_HOOKS += UTIL_LINUX_INSTALL_PAMFILES +UTIL_LINUX_POST_INSTALL_TARGET_HOOKS += UTIL_LINUX_FIXUP_PAMFILES # Install agetty->getty symlink to avoid breakage when there's no busybox ifeq ($(BR2_PACKAGE_UTIL_LINUX_AGETTY),y)
Signature · 1 line
1.9.1
PATCH v8 10/16 util-linux: selinux, audit, and pam support
Quoted 4 lines · Clayton Shotwell
From: Matt Weber <[email protected]>
Signed-off-by Matthew Weber <[email protected]>Signed-off-by Clayton Shotwell <[email protected]>
Reviewed-by Samuel Martin <[email protected]>
Regards,
Signature · 1 line
Samuel
PATCH v8 11/16 rsyslog: fix config file comment style
In reply to Clayton ShotwellFrom: Matt Weber <[email protected]>
The upstream versions of rsyslog (v8 and higher) have this commit to fix the config file comment issue. Carry this patch here until the version is bumped.
Signed-off-by Matthew Weber <[email protected]>
Signed-off-by Clayton Shotwell <[email protected]>
---
Changes v7 -> v8:
- Reverted change to make file in favor of using upstream patch (Suggested by Samuel)
Changes v6 -> v7:
- No changes
Changes v5 -> v6:
- No changes
--- .../rsyslog/0001-fix-config-file-comments.patch | 37 ++++++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 package/rsyslog/0001-fix-config-file-comments.patch
package/rsyslog/0001-fix-config-file-comments.patch new file +37 -0
@@ -0,0 +1,37 @@ +From fe01c9ec4979c78b6a7caf045cab17ba52d4ad08 Mon Sep 17 00:00:00 2001 +From: Brad Barden <[email protected]> +Date: Sun, 11 Jan 2015 17:52:11 -0600 +Subject: [PATCH] bugfix header in platform/redhat/rsyslog.conf + +the "For more information" doc path includes the string "*/", breaking c-style comment format. fixes #202. +--- + platform/redhat/rsyslog.conf | 19 +++++++++---------- + 1 file changed, 9 insertions(+), 10 deletions(-) + +diff --git a/platform/redhat/rsyslog.conf b/platform/redhat/rsyslog.conf +index 340874d..3df6c7e 100644 +--- a/platform/redhat/rsyslog.conf ++++ b/platform/redhat/rsyslog.conf +@@ -1,13 +1,12 @@ +-/* rsyslog configuration file (for Red Hat-based systems) +- * note that most of this config file uses old-style format, +- * because it is well-known AND quite suitable for simple cases +- * like we have with the default config. For more advanced +- * things, RainerScript configuration is suggested. +- * +- * For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html +- * or latest version online at http://www.rsyslog.com/doc/rsyslog_conf.html +- * If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html +- */ ++# rsyslog configuration file (for Red Hat-based systems) ++# note that most of this config file uses old-style format, ++# because it is well-known AND quite suitable for simple cases ++# like we have with the default config. For more advanced ++# things, RainerScript configuration is suggested. ++# ++# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html ++# or latest version online at http://www.rsyslog.com/doc/rsyslog_conf.html ++# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html + + #### MODULES #### +
Signature · 1 line
1.9.1
Thomas Petazzoni
AppliedPATCH v8 11/16 rsyslog: fix config file comment style
Dear Clayton Shotwell,
Quoted 6 lines · Clayton Shotwell
From: Matt Weber <[email protected]>
The upstream versions of rsyslog (v8 and higher) have this commit to fix the config file comment issue. Carry this patch here until the version is bumped.
Quoted 7 lines
Signed-off-by Matthew Weber <[email protected]>Signed-off-by Clayton Shotwell <[email protected]>---
Changes v7 -> v8:
- Reverted change to make file in favor of using upstream patch (Suggested by Samuel)
Applied, thanks.
Thomas
Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons Embedded Linux, Kernel and Android engineering http://free-electrons.com
PATCH v8 11/16 rsyslog: fix config file comment style
In reply to Clayton ShotwellDear Clayton Shotwell,
Quoted 8 lines · Clayton Shotwell
From: Matt Weber <[email protected]>
The upstream versions of rsyslog (v8 and higher) have this commit to fix the config file comment issue. Carry this patch here until the version is bumped.
Signed-off-by Matthew Weber <[email protected]>Signed-off-by Clayton Shotwell <[email protected]>
I had to revert this patch, because it was breaking the build:
http://autobuild.buildroot.org/results/208/2082f4e8dc5768b03c951f571b9aca976703f952/build-end.log
Indeed the patch you proposed to add to rsyslog is already part of rsyslog 8.9.0 which we use in Buildroot.
Which means you sent this patch without even trying to apply it on rsyslog. Bad! :-)
Best regards,
Thomas
Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons Embedded Linux, Kernel and Android engineering http://free-electrons.com
PATCH v8 11/16 rsyslog: fix config file comment style
Thomas,
Quoted 14 lines · Thomas Petazzoni
Dear Clayton Shotwell,
Quoted 8 lines · Clayton Shotwell
From: Matt Weber <[email protected]>
The upstream versions of rsyslog (v8 and higher) have this commit to fix the config file comment issue. Carry this patch here until the version is bumped.
Signed-off-by Matthew Weber <[email protected]>Signed-off-by Clayton Shotwell <[email protected]>I had to revert this patch, because it was breaking the build:
Quoted 7 lines
http://autobuild.buildroot.org/results/208/2082f4e8dc5768b03c951f571b9aca976703f952/build-end.logIndeed the patch you proposed to add to rsyslog is already part of rsyslog 8.9.0 which we use in Buildroot.
Which means you sent this patch without even trying to apply it on rsyslog. Bad! :-)
You are correct. My bad. That is what I get for trying to rush things before heading out on a Friday.
Thanks,
Clayton
Clayton Shotwell
Senior Software Engineer, Rockwell Collins
clayton.shotwell at rockwellcollins.com
PATCH v8 12/16 qemu x86 selinux: added common selinux support files
In reply to Clayton ShotwellFrom: Matt Weber <[email protected]>
Add a default busybox SELinux config which disables init and uses sysvinit. Add base skeleton with inittab and fstab tailored to selinux Add base skeleton audit configuration (didn't seem to merit being the package default).
Signed-off-by Matthew Weber <[email protected]>
---
Changes v7 -> v8:
- No changes
Changes v6 -> v7:
- No changes
Changes v5 -> v6:
- No changes
Changes v4 -> v5:
- Update the selinux busybox config to the latest version of busybox (Clayton S.)
Changes v1 -> v4:
- Did not exist
--- board/common_selinux/busybox-selinux.config | 1058 ++++++++++++++++++++ board/common_selinux/post_build.sh | 30 + .../common_selinux/skeleton/etc/audit/auditd.conf | 32 + .../skeleton/etc/audit/rules.d/audit.rules | 3 + board/common_selinux/skeleton/etc/fstab | 15 + board/common_selinux/skeleton/etc/inittab | 29 + board/common_selinux/skeleton_permissions.txt | 26 + 7 files changed, 1193 insertions(+) create mode 100644 board/common_selinux/busybox-selinux.config create mode 100755 board/common_selinux/post_build.sh create mode 100644 board/common_selinux/skeleton/etc/audit/auditd.conf create mode 100644 board/common_selinux/skeleton/etc/audit/rules.d/audit.rules create mode 100755 board/common_selinux/skeleton/etc/fstab create mode 100755 board/common_selinux/skeleton/etc/inittab create mode 100755 board/common_selinux/skeleton_permissions.txt
board/common_selinux/busybox-selinux.config new file +1058 -0
@@ -0,0 +1,1058 @@ +# +# Automatically generated make config: don't edit +# Busybox version: 1.23.2 +# Wed May 6 10:14:52 2015 +# +CONFIG_HAVE_DOT_CONFIG=y + +# +# Busybox Settings +# + +# +# General Configuration +# +CONFIG_DESKTOP=y +# CONFIG_EXTRA_COMPAT is not set +CONFIG_INCLUDE_SUSv2=y +# CONFIG_USE_PORTABLE_CODE is not set +CONFIG_PLATFORM_LINUX=y +CONFIG_FEATURE_BUFFERS_USE_MALLOC=y +# CONFIG_FEATURE_BUFFERS_GO_ON_STACK is not set +# CONFIG_FEATURE_BUFFERS_GO_IN_BSS is not set +CONFIG_SHOW_USAGE=y +CONFIG_FEATURE_VERBOSE_USAGE=y +# CONFIG_FEATURE_COMPRESS_USAGE is not set +CONFIG_FEATURE_INSTALLER=y +# CONFIG_INSTALL_NO_USR is not set +# CONFIG_LOCALE_SUPPORT is not set +# CONFIG_UNICODE_SUPPORT is not set +# CONFIG_UNICODE_USING_LOCALE is not set +# CONFIG_FEATURE_CHECK_UNICODE_IN_ENV is not set +CONFIG_SUBST_WCHAR=0 +CONFIG_LAST_SUPPORTED_WCHAR=0 +# CONFIG_UNICODE_COMBINING_WCHARS is not set +# CONFIG_UNICODE_WIDE_WCHARS is not set +# CONFIG_UNICODE_BIDI_SUPPORT is not set +# CONFIG_UNICODE_NEUTRAL_TABLE is not set +# CONFIG_UNICODE_PRESERVE_BROKEN is not set +CONFIG_PAM=y +CONFIG_FEATURE_USE_SENDFILE=y +CONFIG_LONG_OPTS=y +CONFIG_FEATURE_DEVPTS=y +CONFIG_FEATURE_CLEAN_UP=y +CONFIG_FEATURE_UTMP=y +CONFIG_FEATURE_WTMP=y +# CONFIG_FEATURE_PIDFILE is not set +CONFIG_PID_FILE_PATH="" +CONFIG_FEATURE_SUID=y +# CONFIG_FEATURE_SUID_CONFIG is not set +# CONFIG_FEATURE_SUID_CONFIG_QUIET is not set +CONFIG_SELINUX=y +# CONFIG_FEATURE_PREFER_APPLETS is not set +CONFIG_BUSYBOX_EXEC_PATH="/proc/self/exe" +CONFIG_FEATURE_SYSLOG=y +CONFIG_FEATURE_HAVE_RPC=y + +# +# Build Options +# +# CONFIG_STATIC is not set +# CONFIG_PIE is not set +# CONFIG_NOMMU is not set +CONFIG_BUILD_LIBBUSYBOX=y +CONFIG_FEATURE_INDIVIDUAL=y +# CONFIG_FEATURE_SHARED_BUSYBOX is not set +CONFIG_LFS=y +CONFIG_CROSS_COMPILER_PREFIX="" +CONFIG_SYSROOT="" +CONFIG_EXTRA_CFLAGS="" +CONFIG_EXTRA_LDFLAGS="" +CONFIG_EXTRA_LDLIBS="" + +# +# Debugging Options +# +# CONFIG_DEBUG is not set +# CONFIG_DEBUG_PESSIMIZE is not set +# CONFIG_UNIT_TEST is not set +# CONFIG_WERROR is not set +CONFIG_NO_DEBUG_LIB=y +# CONFIG_DMALLOC is not set +# CONFIG_EFENCE is not set + +# +# Installation Options ("make install" behavior) +# +CONFIG_INSTALL_APPLET_SYMLINKS=y +# CONFIG_INSTALL_APPLET_HARDLINKS is not set +# CONFIG_INSTALL_APPLET_SCRIPT_WRAPPERS is not set +# CONFIG_INSTALL_APPLET_DONT is not set +# CONFIG_INSTALL_SH_APPLET_SYMLINK is not set +# CONFIG_INSTALL_SH_APPLET_HARDLINK is not set +# CONFIG_INSTALL_SH_APPLET_SCRIPT_WRAPPER is not set +CONFIG_PREFIX="./_install" + +# +# Busybox Library Tuning +# +# CONFIG_FEATURE_SYSTEMD is not set +CONFIG_FEATURE_RTMINMAX=y +CONFIG_PASSWORD_MINLEN=6 +CONFIG_MD5_SMALL=1 +CONFIG_SHA3_SMALL=1 +# CONFIG_FEATURE_FAST_TOP is not set +# CONFIG_FEATURE_ETC_NETWORKS is not set +CONFIG_FEATURE_USE_TERMIOS=y +CONFIG_FEATURE_EDITING=y +CONFIG_FEATURE_EDITING_MAX_LEN=1024 +CONFIG_FEATURE_EDITING_VI=y +CONFIG_FEATURE_EDITING_HISTORY=999 +CONFIG_FEATURE_EDITING_SAVEHISTORY=y +# CONFIG_FEATURE_EDITING_SAVE_ON_EXIT is not set +CONFIG_FEATURE_REVERSE_SEARCH=y +CONFIG_FEATURE_TAB_COMPLETION=y +# CONFIG_FEATURE_USERNAME_COMPLETION is not set +CONFIG_FEATURE_EDITING_FANCY_PROMPT=y +# CONFIG_FEATURE_EDITING_ASK_TERMINAL is not set +CONFIG_FEATURE_NON_POSIX_CP=y +# CONFIG_FEATURE_VERBOSE_CP_MESSAGE is not set +CONFIG_FEATURE_COPYBUF_KB=4 +CONFIG_FEATURE_SKIP_ROOTFS=y +CONFIG_MONOTONIC_SYSCALL=y +CONFIG_IOCTL_HEX2STR_ERROR=y +CONFIG_FEATURE_HWIB=y + +# +# Applets +# + +# +# Archival Utilities +# +# CONFIG_FEATURE_SEAMLESS_XZ is not set +# CONFIG_FEATURE_SEAMLESS_LZMA is not set +# CONFIG_FEATURE_SEAMLESS_BZ2 is not set +# CONFIG_FEATURE_SEAMLESS_GZ is not set +# CONFIG_FEATURE_SEAMLESS_Z is not set +CONFIG_AR=y +# CONFIG_FEATURE_AR_LONG_FILENAMES is not set +CONFIG_FEATURE_AR_CREATE=y +# CONFIG_UNCOMPRESS is not set +CONFIG_GUNZIP=y +CONFIG_BUNZIP2=y +CONFIG_UNLZMA=y +# CONFIG_FEATURE_LZMA_FAST is not set +CONFIG_LZMA=y +CONFIG_UNXZ=y +CONFIG_XZ=y +# CONFIG_BZIP2 is not set +CONFIG_CPIO=y +# CONFIG_FEATURE_CPIO_O is not set +# CONFIG_FEATURE_CPIO_P is not set +# CONFIG_DPKG is not set +# CONFIG_DPKG_DEB is not set +# CONFIG_FEATURE_DPKG_DEB_EXTRACT_ONLY is not set +CONFIG_GZIP=y +# CONFIG_FEATURE_GZIP_LONG_OPTIONS is not set +CONFIG_GZIP_FAST=0 +# CONFIG_LZOP is not set +# CONFIG_LZOP_COMPR_HIGH is not set +# CONFIG_RPM is not set +# CONFIG_RPM2CPIO is not set +CONFIG_TAR=y +CONFIG_FEATURE_TAR_CREATE=y +# CONFIG_FEATURE_TAR_AUTODETECT is not set +CONFIG_FEATURE_TAR_FROM=y +# CONFIG_FEATURE_TAR_OLDGNU_COMPATIBILITY is not set +# CONFIG_FEATURE_TAR_OLDSUN_COMPATIBILITY is not set +CONFIG_FEATURE_TAR_GNU_EXTENSIONS=y +CONFIG_FEATURE_TAR_LONG_OPTIONS=y +CONFIG_FEATURE_TAR_TO_COMMAND=y +# CONFIG_FEATURE_TAR_UNAME_GNAME is not set +# CONFIG_FEATURE_TAR_NOPRESERVE_TIME is not set +CONFIG_FEATURE_TAR_SELINUX=y +CONFIG_UNZIP=y + +# +# Coreutils +# +CONFIG_BASENAME=y +CONFIG_CAT=y +CONFIG_DATE=y +CONFIG_FEATURE_DATE_ISOFMT=y +# CONFIG_FEATURE_DATE_NANO is not set +CONFIG_FEATURE_DATE_COMPAT=y +CONFIG_HOSTID=y +CONFIG_ID=y +CONFIG_GROUPS=y +CONFIG_SHUF=y +CONFIG_TEST=y +CONFIG_FEATURE_TEST_64=y +CONFIG_TOUCH=y +CONFIG_FEATURE_TOUCH_NODEREF=y +CONFIG_FEATURE_TOUCH_SUSV3=y +CONFIG_TR=y +CONFIG_FEATURE_TR_CLASSES=y +CONFIG_FEATURE_TR_EQUIV=y +CONFIG_UNLINK=y +# CONFIG_BASE64 is not set +CONFIG_WHO=y +CONFIG_USERS=y +# CONFIG_CAL is not set +CONFIG_CATV=y +CONFIG_CHGRP=y +CONFIG_CHMOD=y +CONFIG_CHOWN=y +# CONFIG_FEATURE_CHOWN_LONG_OPTIONS is not set +CONFIG_CHROOT=y +CONFIG_CKSUM=y +# CONFIG_COMM is not set +CONFIG_CP=y +# CONFIG_FEATURE_CP_LONG_OPTIONS is not set +CONFIG_CUT=y +CONFIG_DD=y +CONFIG_FEATURE_DD_SIGNAL_HANDLING=y +# CONFIG_FEATURE_DD_THIRD_STATUS_LINE is not set +CONFIG_FEATURE_DD_IBS_OBS=y +CONFIG_DF=y +# CONFIG_FEATURE_DF_FANCY is not set +CONFIG_DIRNAME=y +CONFIG_DOS2UNIX=y +CONFIG_UNIX2DOS=y +CONFIG_DU=y +CONFIG_FEATURE_DU_DEFAULT_BLOCKSIZE_1K=y +CONFIG_ECHO=y +CONFIG_FEATURE_FANCY_ECHO=y +CONFIG_ENV=y +# CONFIG_FEATURE_ENV_LONG_OPTIONS is not set +# CONFIG_EXPAND is not set +# CONFIG_FEATURE_EXPAND_LONG_OPTIONS is not set +CONFIG_EXPR=y +CONFIG_EXPR_MATH_SUPPORT_64=y +CONFIG_FALSE=y +CONFIG_FOLD=y +# CONFIG_FSYNC is not set +CONFIG_HEAD=y +CONFIG_FEATURE_FANCY_HEAD=y +CONFIG_INSTALL=y +CONFIG_FEATURE_INSTALL_LONG_OPTIONS=y +CONFIG_LN=y +CONFIG_LOGNAME=y +CONFIG_LS=y +CONFIG_FEATURE_LS_FILETYPES=y +CONFIG_FEATURE_LS_FOLLOWLINKS=y +CONFIG_FEATURE_LS_RECURSIVE=y +CONFIG_FEATURE_LS_SORTFILES=y +CONFIG_FEATURE_LS_TIMESTAMPS=y +CONFIG_FEATURE_LS_USERNAME=y +CONFIG_FEATURE_LS_COLOR=y +CONFIG_FEATURE_LS_COLOR_IS_DEFAULT=y +CONFIG_MD5SUM=y +CONFIG_MKDIR=y +CONFIG_FEATURE_MKDIR_LONG_OPTIONS=y +CONFIG_MKFIFO=y +CONFIG_MKNOD=y +CONFIG_MV=y +CONFIG_FEATURE_MV_LONG_OPTIONS=y +CONFIG_NICE=y +CONFIG_NOHUP=y +CONFIG_OD=y +CONFIG_PRINTENV=y +CONFIG_PRINTF=y +CONFIG_PWD=y +CONFIG_READLINK=y +CONFIG_FEATURE_READLINK_FOLLOW=y +CONFIG_REALPATH=y +CONFIG_RM=y +CONFIG_RMDIR=y +# CONFIG_FEATURE_RMDIR_LONG_OPTIONS is not set +CONFIG_SEQ=y +CONFIG_SHA1SUM=y +CONFIG_SHA256SUM=y +CONFIG_SHA512SUM=y +CONFIG_SHA3SUM=y +CONFIG_SLEEP=y +CONFIG_FEATURE_FANCY_SLEEP=y +CONFIG_FEATURE_FLOAT_SLEEP=y +CONFIG_SORT=y +CONFIG_FEATURE_SORT_BIG=y +# CONFIG_SPLIT is not set +# CONFIG_FEATURE_SPLIT_FANCY is not set +# CONFIG_STAT is not set +# CONFIG_FEATURE_STAT_FORMAT is not set +CONFIG_STTY=y +# CONFIG_SUM is not set +CONFIG_SYNC=y +# CONFIG_TAC is not set +CONFIG_TAIL=y +CONFIG_FEATURE_FANCY_TAIL=y +CONFIG_TEE=y +CONFIG_FEATURE_TEE_USE_BLOCK_IO=y +CONFIG_TRUE=y +CONFIG_TTY=y +CONFIG_UNAME=y +# CONFIG_UNEXPAND is not set +# CONFIG_FEATURE_UNEXPAND_LONG_OPTIONS is not set +CONFIG_UNIQ=y +CONFIG_USLEEP=y +CONFIG_UUDECODE=y +CONFIG_UUENCODE=y +CONFIG_WC=y +# CONFIG_FEATURE_WC_LARGE is not set +CONFIG_WHOAMI=y +CONFIG_YES=y + +# +# Common options +# +CONFIG_FEATURE_VERBOSE=y + +# +# Common options for cp and mv +# +CONFIG_FEATURE_PRESERVE_HARDLINKS=y + +# +# Common options for ls, more and telnet +# +CONFIG_FEATURE_AUTOWIDTH=y + +# +# Common options for df, du, ls +# +CONFIG_FEATURE_HUMAN_READABLE=y + +# +# Common options for md5sum, sha1sum, sha256sum, sha512sum, sha3sum +# +CONFIG_FEATURE_MD5_SHA1_SUM_CHECK=y + +# +# Console Utilities +# +CONFIG_CHVT=y +# CONFIG_FGCONSOLE is not set +CONFIG_CLEAR=y +CONFIG_DEALLOCVT=y +CONFIG_DUMPKMAP=y +# CONFIG_KBD_MODE is not set +CONFIG_LOADFONT=y +CONFIG_LOADKMAP=y +CONFIG_OPENVT=y +CONFIG_RESET=y +CONFIG_RESIZE=y +CONFIG_FEATURE_RESIZE_PRINT=y +CONFIG_SETCONSOLE=y +# CONFIG_FEATURE_SETCONSOLE_LONG_OPTIONS is not set +# CONFIG_SETFONT is not set +# CONFIG_FEATURE_SETFONT_TEXTUAL_MAP is not set +CONFIG_DEFAULT_SETFONT_DIR="" +CONFIG_SETKEYCODES=y +CONFIG_SETLOGCONS=y +# CONFIG_SHOWKEY is not set + +# +# Common options for loadfont and setfont +# +CONFIG_FEATURE_LOADFONT_PSF2=y +CONFIG_FEATURE_LOADFONT_RAW=y + +# +# Debian Utilities +# +CONFIG_MKTEMP=y +CONFIG_PIPE_PROGRESS=y +CONFIG_RUN_PARTS=y +CONFIG_FEATURE_RUN_PARTS_LONG_OPTIONS=y +# CONFIG_FEATURE_RUN_PARTS_FANCY is not set +CONFIG_START_STOP_DAEMON=y +CONFIG_FEATURE_START_STOP_DAEMON_FANCY=y +CONFIG_FEATURE_START_STOP_DAEMON_LONG_OPTIONS=y +CONFIG_WHICH=y + +# +# Editors +# +CONFIG_AWK=y +# CONFIG_FEATURE_AWK_LIBM is not set +CONFIG_FEATURE_AWK_GNU_EXTENSIONS=y +CONFIG_CMP=y +CONFIG_DIFF=y +# CONFIG_FEATURE_DIFF_LONG_OPTIONS is not set +CONFIG_FEATURE_DIFF_DIR=y +# CONFIG_ED is not set +CONFIG_PATCH=y +CONFIG_SED=y +CONFIG_VI=y +CONFIG_FEATURE_VI_MAX_LEN=4096 +CONFIG_FEATURE_VI_8BIT=y +CONFIG_FEATURE_VI_COLON=y +CONFIG_FEATURE_VI_YANKMARK=y +CONFIG_FEATURE_VI_SEARCH=y +# CONFIG_FEATURE_VI_REGEX_SEARCH is not set +CONFIG_FEATURE_VI_USE_SIGNALS=y +CONFIG_FEATURE_VI_DOT_CMD=y +CONFIG_FEATURE_VI_READONLY=y +CONFIG_FEATURE_VI_SETOPTS=y +CONFIG_FEATURE_VI_SET=y +CONFIG_FEATURE_VI_WIN_RESIZE=y +CONFIG_FEATURE_VI_ASK_TERMINAL=y +CONFIG_FEATURE_VI_UNDO=y +CONFIG_FEATURE_VI_UNDO_QUEUE=y +CONFIG_FEATURE_VI_UNDO_QUEUE_MAX=256 +CONFIG_FEATURE_ALLOW_EXEC=y + +# +# Finding Utilities +# +CONFIG_FIND=y +CONFIG_FEATURE_FIND_PRINT0=y +CONFIG_FEATURE_FIND_MTIME=y +CONFIG_FEATURE_FIND_MMIN=y +CONFIG_FEATURE_FIND_PERM=y +CONFIG_FEATURE_FIND_TYPE=y +CONFIG_FEATURE_FIND_XDEV=y +CONFIG_FEATURE_FIND_MAXDEPTH=y +CONFIG_FEATURE_FIND_NEWER=y +CONFIG_FEATURE_FIND_INUM=y +CONFIG_FEATURE_FIND_EXEC=y +CONFIG_FEATURE_FIND_EXEC_PLUS=y +CONFIG_FEATURE_FIND_USER=y +CONFIG_FEATURE_FIND_GROUP=y +CONFIG_FEATURE_FIND_NOT=y +CONFIG_FEATURE_FIND_DEPTH=y +CONFIG_FEATURE_FIND_PAREN=y +CONFIG_FEATURE_FIND_SIZE=y +CONFIG_FEATURE_FIND_PRUNE=y +# CONFIG_FEATURE_FIND_DELETE is not set +CONFIG_FEATURE_FIND_PATH=y +CONFIG_FEATURE_FIND_REGEX=y +# CONFIG_FEATURE_FIND_CONTEXT is not set +# CONFIG_FEATURE_FIND_LINKS is not set +CONFIG_GREP=y +CONFIG_FEATURE_GREP_EGREP_ALIAS=y +CONFIG_FEATURE_GREP_FGREP_ALIAS=y +CONFIG_FEATURE_GREP_CONTEXT=y +CONFIG_XARGS=y +# CONFIG_FEATURE_XARGS_SUPPORT_CONFIRMATION is not set +CONFIG_FEATURE_XARGS_SUPPORT_QUOTES=y +CONFIG_FEATURE_XARGS_SUPPORT_TERMOPT=y +CONFIG_FEATURE_XARGS_SUPPORT_ZERO_TERM=y +CONFIG_FEATURE_XARGS_SUPPORT_REPL_STR=y + +# +# Init Utilities +# +# CONFIG_BOOTCHARTD is not set +# CONFIG_FEATURE_BOOTCHARTD_BLOATED_HEADER is not set +# CONFIG_FEATURE_BOOTCHARTD_CONFIG_FILE is not set +# CONFIG_HALT is not set +# CONFIG_FEATURE_CALL_TELINIT is not set +CONFIG_TELINIT_PATH="" +# CONFIG_INIT is not set +# CONFIG_FEATURE_USE_INITTAB is not set +# CONFIG_FEATURE_KILL_REMOVED is not set +CONFIG_FEATURE_KILL_DELAY=0 +# CONFIG_FEATURE_INIT_SCTTY is not set +# CONFIG_FEATURE_INIT_SYSLOG is not set +# CONFIG_FEATURE_EXTRA_QUIET is not set +# CONFIG_FEATURE_INIT_COREDUMPS is not set +# CONFIG_FEATURE_INITRD is not set +CONFIG_INIT_TERMINAL_TYPE="" +CONFIG_MESG=y +CONFIG_FEATURE_MESG_ENABLE_ONLY_GROUP=y + +# +# Login/Password Management Utilities +# +# CONFIG_ADD_SHELL is not set +# CONFIG_REMOVE_SHELL is not set +# CONFIG_FEATURE_SHADOWPASSWDS is not set +# CONFIG_USE_BB_PWD_GRP is not set +# CONFIG_USE_BB_SHADOW is not set +# CONFIG_USE_BB_CRYPT is not set +# CONFIG_USE_BB_CRYPT_SHA is not set +# CONFIG_ADDUSER is not set +# CONFIG_FEATURE_ADDUSER_LONG_OPTIONS is not set +# CONFIG_FEATURE_CHECK_NAMES is not set +CONFIG_LAST_ID=0 +CONFIG_FIRST_SYSTEM_ID=0 +CONFIG_LAST_SYSTEM_ID=0 +# CONFIG_ADDGROUP is not set +# CONFIG_FEATURE_ADDGROUP_LONG_OPTIONS is not set +# CONFIG_FEATURE_ADDUSER_TO_GROUP is not set +# CONFIG_DELUSER is not set +# CONFIG_DELGROUP is not set +# CONFIG_FEATURE_DEL_USER_FROM_GROUP is not set +CONFIG_GETTY=y +# CONFIG_LOGIN is not set +# CONFIG_LOGIN_SESSION_AS_CHILD is not set +# CONFIG_LOGIN_SCRIPTS is not set +# CONFIG_FEATURE_NOLOGIN is not set +# CONFIG_FEATURE_SECURETTY is not set +# CONFIG_PASSWD is not set +# CONFIG_FEATURE_PASSWD_WEAK_CHECK is not set +# CONFIG_CRYPTPW is not set +# CONFIG_CHPASSWD is not set +CONFIG_FEATURE_DEFAULT_PASSWD_ALGO="" +# CONFIG_SU is not set +# CONFIG_FEATURE_SU_SYSLOG is not set +# CONFIG_FEATURE_SU_CHECKS_SHELLS is not set +# CONFIG_SULOGIN is not set +# CONFIG_VLOCK is not set + +# +# Linux Ext2 FS Progs +# +# CONFIG_CHATTR is not set +CONFIG_FSCK=y +# CONFIG_LSATTR is not set +# CONFIG_TUNE2FS is not set + +# +# Linux Module Utilities +# +# CONFIG_MODINFO is not set +# CONFIG_MODPROBE_SMALL is not set +# CONFIG_FEATURE_MODPROBE_SMALL_OPTIONS_ON_CMDLINE is not set +# CONFIG_FEATURE_MODPROBE_SMALL_CHECK_ALREADY_LOADED is not set +# CONFIG_INSMOD is not set +# CONFIG_RMMOD is not set +# CONFIG_LSMOD is not set +# CONFIG_FEATURE_LSMOD_PRETTY_2_6_OUTPUT is not set +# CONFIG_MODPROBE is not set +# CONFIG_FEATURE_MODPROBE_BLACKLIST is not set +# CONFIG_DEPMOD is not set + +# +# Options common to multiple modutils +# +# CONFIG_FEATURE_2_4_MODULES is not set +# CONFIG_FEATURE_INSMOD_TRY_MMAP is not set +# CONFIG_FEATURE_INSMOD_VERSION_CHECKING is not set +# CONFIG_FEATURE_INSMOD_KSYMOOPS_SYMBOLS is not set +# CONFIG_FEATURE_INSMOD_LOADINKMEM is not set +# CONFIG_FEATURE_INSMOD_LOAD_MAP is not set +# CONFIG_FEATURE_INSMOD_LOAD_MAP_FULL is not set +# CONFIG_FEATURE_CHECK_TAINTED_MODULE is not set +# CONFIG_FEATURE_MODUTILS_ALIAS is not set +# CONFIG_FEATURE_MODUTILS_SYMBOLS is not set +CONFIG_DEFAULT_MODULES_DIR="" +CONFIG_DEFAULT_DEPMOD_FILE="" + +# +# Linux System Utilities +# +# CONFIG_BLOCKDEV is not set +CONFIG_FATATTR=y +CONFIG_FSTRIM=y +CONFIG_MDEV=y +CONFIG_FEATURE_MDEV_CONF=y +CONFIG_FEATURE_MDEV_RENAME=y +# CONFIG_FEATURE_MDEV_RENAME_REGEXP is not set +CONFIG_FEATURE_MDEV_EXEC=y +# CONFIG_FEATURE_MDEV_LOAD_FIRMWARE is not set +# CONFIG_REV is not set +# CONFIG_ACPID is not set +# CONFIG_FEATURE_ACPID_COMPAT is not set +CONFIG_BLKID=y +# CONFIG_FEATURE_BLKID_TYPE is not set +CONFIG_DMESG=y +CONFIG_FEATURE_DMESG_PRETTY=y +# CONFIG_FBSET is not set +# CONFIG_FEATURE_FBSET_FANCY is not set +# CONFIG_FEATURE_FBSET_READMODE is not set +CONFIG_FDFLUSH=y +CONFIG_FDFORMAT=y +CONFIG_FDISK=y +# CONFIG_FDISK_SUPPORT_LARGE_DISKS is not set +CONFIG_FEATURE_FDISK_WRITABLE=y +# CONFIG_FEATURE_AIX_LABEL is not set +# CONFIG_FEATURE_SGI_LABEL is not set +# CONFIG_FEATURE_SUN_LABEL is not set +# CONFIG_FEATURE_OSF_LABEL is not set +CONFIG_FEATURE_GPT_LABEL=y +CONFIG_FEATURE_FDISK_ADVANCED=y +# CONFIG_FINDFS is not set +# CONFIG_FLOCK is not set +CONFIG_FREERAMDISK=y +# CONFIG_FSCK_MINIX is not set +# CONFIG_MKFS_EXT2 is not set +# CONFIG_MKFS_MINIX is not set +# CONFIG_FEATURE_MINIX2 is not set +# CONFIG_MKFS_REISER is not set +# CONFIG_MKFS_VFAT is not set +CONFIG_GETOPT=y +CONFIG_FEATURE_GETOPT_LONG=y +CONFIG_HEXDUMP=y +# CONFIG_FEATURE_HEXDUMP_REVERSE is not set +# CONFIG_HD is not set +CONFIG_HWCLOCK=y +CONFIG_FEATURE_HWCLOCK_LONG_OPTIONS=y +CONFIG_FEATURE_HWCLOCK_ADJTIME_FHS=y +CONFIG_IPCRM=y +CONFIG_IPCS=y +CONFIG_LOSETUP=y +CONFIG_LSPCI=y +CONFIG_LSUSB=y +CONFIG_MKSWAP=y +# CONFIG_FEATURE_MKSWAP_UUID is not set +CONFIG_MORE=y +CONFIG_MOUNT=y +# CONFIG_FEATURE_MOUNT_FAKE is not set +CONFIG_FEATURE_MOUNT_VERBOSE=y +CONFIG_FEATURE_MOUNT_HELPERS=y +CONFIG_FEATURE_MOUNT_LABEL=y +CONFIG_FEATURE_MOUNT_NFS=y +CONFIG_FEATURE_MOUNT_CIFS=y +CONFIG_FEATURE_MOUNT_FLAGS=y +CONFIG_FEATURE_MOUNT_FSTAB=y +# CONFIG_PIVOT_ROOT is not set +CONFIG_RDATE=y +# CONFIG_RDEV is not set +CONFIG_READPROFILE=y +# CONFIG_RTCWAKE is not set +# CONFIG_SCRIPT is not set +# CONFIG_SCRIPTREPLAY is not set +CONFIG_SETARCH=y +CONFIG_SWAPONOFF=y +CONFIG_FEATURE_SWAPON_DISCARD=y +# CONFIG_FEATURE_SWAPON_PRI is not set +CONFIG_SWITCH_ROOT=y +CONFIG_UMOUNT=y +CONFIG_FEATURE_UMOUNT_ALL=y + +# +# Common options for mount/umount +# +CONFIG_FEATURE_MOUNT_LOOP=y +CONFIG_FEATURE_MOUNT_LOOP_CREATE=y +# CONFIG_FEATURE_MTAB_SUPPORT is not set +CONFIG_VOLUMEID=y + +# +# Filesystem/Volume identification +# +# CONFIG_FEATURE_VOLUMEID_BTRFS is not set +# CONFIG_FEATURE_VOLUMEID_CRAMFS is not set +CONFIG_FEATURE_VOLUMEID_EXFAT=y +CONFIG_FEATURE_VOLUMEID_EXT=y +CONFIG_FEATURE_VOLUMEID_F2FS=y +CONFIG_FEATURE_VOLUMEID_FAT=y +# CONFIG_FEATURE_VOLUMEID_HFS is not set +# CONFIG_FEATURE_VOLUMEID_ISO9660 is not set +# CONFIG_FEATURE_VOLUMEID_JFS is not set +# CONFIG_FEATURE_VOLUMEID_LINUXRAID is not set +# CONFIG_FEATURE_VOLUMEID_LINUXSWAP is not set +# CONFIG_FEATURE_VOLUMEID_LUKS is not set +# CONFIG_FEATURE_VOLUMEID_NILFS is not set +# CONFIG_FEATURE_VOLUMEID_NTFS is not set +# CONFIG_FEATURE_VOLUMEID_OCFS2 is not set +# CONFIG_FEATURE_VOLUMEID_REISERFS is not set +# CONFIG_FEATURE_VOLUMEID_ROMFS is not set +# CONFIG_FEATURE_VOLUMEID_SQUASHFS is not set +# CONFIG_FEATURE_VOLUMEID_SYSV is not set +# CONFIG_FEATURE_VOLUMEID_UDF is not set +# CONFIG_FEATURE_VOLUMEID_XFS is not set + +# +# Miscellaneous Utilities +# +# CONFIG_CONSPY is not set +CONFIG_CROND=y +# CONFIG_FEATURE_CROND_D is not set +# CONFIG_FEATURE_CROND_CALL_SENDMAIL is not set +CONFIG_FEATURE_CROND_DIR="/var/spool/cron" +CONFIG_LESS=y +CONFIG_FEATURE_LESS_MAXLINES=9999999 +CONFIG_FEATURE_LESS_BRACKETS=y +CONFIG_FEATURE_LESS_FLAGS=y +# CONFIG_FEATURE_LESS_MARKS is not set +CONFIG_FEATURE_LESS_REGEXP=y +# CONFIG_FEATURE_LESS_WINCH is not set +# CONFIG_FEATURE_LESS_ASK_TERMINAL is not set +# CONFIG_FEATURE_LESS_DASHCMD is not set +# CONFIG_FEATURE_LESS_LINENUMS is not set +# CONFIG_NANDWRITE is not set +# CONFIG_NANDDUMP is not set +# CONFIG_RFKILL is not set +CONFIG_SETSERIAL=y +# CONFIG_TASKSET is not set +# CONFIG_FEATURE_TASKSET_FANCY is not set +# CONFIG_UBIATTACH is not set +# CONFIG_UBIDETACH is not set +# CONFIG_UBIMKVOL is not set +# CONFIG_UBIRMVOL is not set +# CONFIG_UBIRSVOL is not set +# CONFIG_UBIUPDATEVOL is not set +# CONFIG_WALL is not set +# CONFIG_ADJTIMEX is not set +# CONFIG_BBCONFIG is not set +# CONFIG_FEATURE_COMPRESS_BBCONFIG is not set +# CONFIG_BEEP is not set +CONFIG_FEATURE_BEEP_FREQ=0 +CONFIG_FEATURE_BEEP_LENGTH_MS=0 +# CONFIG_CHAT is not set +# CONFIG_FEATURE_CHAT_NOFAIL is not set +# CONFIG_FEATURE_CHAT_TTY_HIFI is not set +# CONFIG_FEATURE_CHAT_IMPLICIT_CR is not set +# CONFIG_FEATURE_CHAT_SWALLOW_OPTS is not set +# CONFIG_FEATURE_CHAT_SEND_ESCAPES is not set +# CONFIG_FEATURE_CHAT_VAR_ABORT_LEN is not set +# CONFIG_FEATURE_CHAT_CLR_ABORT is not set +CONFIG_CHRT=y +CONFIG_CRONTAB=y +CONFIG_DC=y +# CONFIG_FEATURE_DC_LIBM is not set +# CONFIG_DEVFSD is not set +# CONFIG_DEVFSD_MODLOAD is not set +# CONFIG_DEVFSD_FG_NP is not set +# CONFIG_DEVFSD_VERBOSE is not set +# CONFIG_FEATURE_DEVFS is not set +CONFIG_DEVMEM=y +CONFIG_EJECT=y +# CONFIG_FEATURE_EJECT_SCSI is not set +# CONFIG_FBSPLASH is not set +# CONFIG_FLASHCP is not set +# CONFIG_FLASH_LOCK is not set +# CONFIG_FLASH_UNLOCK is not set +# CONFIG_FLASH_ERASEALL is not set +# CONFIG_IONICE is not set +# CONFIG_INOTIFYD is not set +CONFIG_LAST=y +CONFIG_FEATURE_LAST_SMALL=y +# CONFIG_FEATURE_LAST_FANCY is not set +CONFIG_HDPARM=y +CONFIG_FEATURE_HDPARM_GET_IDENTITY=y +# CONFIG_FEATURE_HDPARM_HDIO_SCAN_HWIF is not set +# CONFIG_FEATURE_HDPARM_HDIO_UNREGISTER_HWIF is not set +# CONFIG_FEATURE_HDPARM_HDIO_DRIVE_RESET is not set +# CONFIG_FEATURE_HDPARM_HDIO_TRISTATE_HWIF is not set +# CONFIG_FEATURE_HDPARM_HDIO_GETSET_DMA is not set +CONFIG_MAKEDEVS=y +# CONFIG_FEATURE_MAKEDEVS_LEAF is not set +CONFIG_FEATURE_MAKEDEVS_TABLE=y +# CONFIG_MAN is not set +CONFIG_MICROCOM=y +CONFIG_MOUNTPOINT=y +CONFIG_MT=y +# CONFIG_RAIDAUTORUN is not set +# CONFIG_READAHEAD is not set +CONFIG_RUNLEVEL=y +# CONFIG_RX is not set +CONFIG_SETSID=y +CONFIG_STRINGS=y +CONFIG_TIME=y +# CONFIG_TIMEOUT is not set +# CONFIG_TTYSIZE is not set +# CONFIG_VOLNAME is not set +CONFIG_WATCHDOG=y + +# +# Networking Utilities +# +CONFIG_NAMEIF=y +# CONFIG_FEATURE_NAMEIF_EXTENDED is not set +# CONFIG_NBDCLIENT is not set +# CONFIG_NC is not set +# CONFIG_NC_SERVER is not set +# CONFIG_NC_EXTRA is not set +# CONFIG_NC_110_COMPAT is not set +CONFIG_PING=y +# CONFIG_PING6 is not set +CONFIG_FEATURE_FANCY_PING=y +# CONFIG_WHOIS is not set +CONFIG_FEATURE_IPV6=y +# CONFIG_FEATURE_UNIX_LOCAL is not set +# CONFIG_FEATURE_PREFER_IPV4_ADDRESS is not set +# CONFIG_VERBOSE_RESOLUTION_ERRORS is not set +# CONFIG_ARP is not set +CONFIG_ARPING=y +# CONFIG_BRCTL is not set +# CONFIG_FEATURE_BRCTL_FANCY is not set +# CONFIG_FEATURE_BRCTL_SHOW is not set +CONFIG_DNSD=y +CONFIG_ETHER_WAKE=y +# CONFIG_FAKEIDENTD is not set +# CONFIG_FTPD is not set +# CONFIG_FEATURE_FTP_WRITE is not set +# CONFIG_FEATURE_FTPD_ACCEPT_BROKEN_LIST is not set +# CONFIG_FEATURE_FTP_AUTHENTICATION is not set +# CONFIG_FTPGET is not set +# CONFIG_FTPPUT is not set +# CONFIG_FEATURE_FTPGETPUT_LONG_OPTIONS is not set +CONFIG_HOSTNAME=y +# CONFIG_HTTPD is not set +# CONFIG_FEATURE_HTTPD_RANGES is not set +# CONFIG_FEATURE_HTTPD_SETUID is not set +# CONFIG_FEATURE_HTTPD_BASIC_AUTH is not set +# CONFIG_FEATURE_HTTPD_AUTH_MD5 is not set +# CONFIG_FEATURE_HTTPD_CGI is not set +# CONFIG_FEATURE_HTTPD_CONFIG_WITH_SCRIPT_INTERPR is not set +# CONFIG_FEATURE_HTTPD_SET_REMOTE_PORT_TO_ENV is not set +# CONFIG_FEATURE_HTTPD_ENCODE_URL_STR is not set +# CONFIG_FEATURE_HTTPD_ERROR_PAGES is not set +# CONFIG_FEATURE_HTTPD_PROXY is not set +# CONFIG_FEATURE_HTTPD_GZIP is not set +CONFIG_IFCONFIG=y +CONFIG_FEATURE_IFCONFIG_STATUS=y +CONFIG_FEATURE_IFCONFIG_SLIP=y +CONFIG_FEATURE_IFCONFIG_MEMSTART_IOADDR_IRQ=y +CONFIG_FEATURE_IFCONFIG_HW=y +# CONFIG_FEATURE_IFCONFIG_BROADCAST_PLUS is not set +# CONFIG_IFENSLAVE is not set +# CONFIG_IFPLUGD is not set +CONFIG_IFUPDOWN=y +CONFIG_IFUPDOWN_IFSTATE_PATH="/var/run/ifstate" +CONFIG_FEATURE_IFUPDOWN_IP=y +# CONFIG_FEATURE_IFUPDOWN_IP_BUILTIN is not set +# CONFIG_FEATURE_IFUPDOWN_IFCONFIG_BUILTIN is not set +CONFIG_FEATURE_IFUPDOWN_IPV4=y +CONFIG_FEATURE_IFUPDOWN_IPV6=y +CONFIG_FEATURE_IFUPDOWN_MAPPING=y +# CONFIG_FEATURE_IFUPDOWN_EXTERNAL_DHCP is not set +# CONFIG_INETD is not set +# CONFIG_FEATURE_INETD_SUPPORT_BUILTIN_ECHO is not set +# CONFIG_FEATURE_INETD_SUPPORT_BUILTIN_DISCARD is not set +# CONFIG_FEATURE_INETD_SUPPORT_BUILTIN_TIME is not set +# CONFIG_FEATURE_INETD_SUPPORT_BUILTIN_DAYTIME is not set +# CONFIG_FEATURE_INETD_SUPPORT_BUILTIN_CHARGEN is not set +# CONFIG_FEATURE_INETD_RPC is not set +CONFIG_IP=y +CONFIG_FEATURE_IP_ADDRESS=y +CONFIG_FEATURE_IP_LINK=y +CONFIG_FEATURE_IP_ROUTE=y +CONFIG_FEATURE_IP_TUNNEL=y +CONFIG_FEATURE_IP_RULE=y +CONFIG_FEATURE_IP_SHORT_FORMS=y +# CONFIG_FEATURE_IP_RARE_PROTOCOLS is not set +CONFIG_IPADDR=y +CONFIG_IPLINK=y +CONFIG_IPROUTE=y +CONFIG_IPTUNNEL=y +CONFIG_IPRULE=y +# CONFIG_IPCALC is not set +# CONFIG_FEATURE_IPCALC_FANCY is not set +# CONFIG_FEATURE_IPCALC_LONG_OPTIONS is not set +CONFIG_NETSTAT=y +# CONFIG_FEATURE_NETSTAT_WIDE is not set +# CONFIG_FEATURE_NETSTAT_PRG is not set +CONFIG_NSLOOKUP=y +# CONFIG_NTPD is not set +# CONFIG_FEATURE_NTPD_SERVER is not set +# CONFIG_FEATURE_NTPD_CONF is not set +# CONFIG_PSCAN is not set +CONFIG_ROUTE=y +# CONFIG_SLATTACH is not set +# CONFIG_TCPSVD is not set +CONFIG_TELNET=y +CONFIG_FEATURE_TELNET_TTYPE=y +CONFIG_FEATURE_TELNET_AUTOLOGIN=y +# CONFIG_TELNETD is not set +# CONFIG_FEATURE_TELNETD_STANDALONE is not set +# CONFIG_FEATURE_TELNETD_INETD_WAIT is not set +CONFIG_TFTP=y +# CONFIG_TFTPD is not set + +# +# Common options for tftp/tftpd +# +CONFIG_FEATURE_TFTP_GET=y +CONFIG_FEATURE_TFTP_PUT=y +CONFIG_FEATURE_TFTP_BLOCKSIZE=y +# CONFIG_FEATURE_TFTP_PROGRESS_BAR is not set +# CONFIG_TFTP_DEBUG is not set +CONFIG_TRACEROUTE=y +# CONFIG_TRACEROUTE6 is not set +# CONFIG_FEATURE_TRACEROUTE_VERBOSE is not set +# CONFIG_FEATURE_TRACEROUTE_SOURCE_ROUTE is not set +# CONFIG_FEATURE_TRACEROUTE_USE_ICMP is not set +# CONFIG_TUNCTL is not set +# CONFIG_FEATURE_TUNCTL_UG is not set +# CONFIG_UDHCPC6 is not set +# CONFIG_UDHCPD is not set +# CONFIG_DHCPRELAY is not set +# CONFIG_DUMPLEASES is not set +# CONFIG_FEATURE_UDHCPD_WRITE_LEASES_EARLY is not set +# CONFIG_FEATURE_UDHCPD_BASE_IP_ON_MAC is not set +CONFIG_DHCPD_LEASES_FILE="" +CONFIG_UDHCPC=y +CONFIG_FEATURE_UDHCPC_ARPING=y +CONFIG_FEATURE_UDHCPC_SANITIZEOPT=y +# CONFIG_FEATURE_UDHCP_PORT is not set +CONFIG_UDHCP_DEBUG=0 +# CONFIG_FEATURE_UDHCP_RFC3397 is not set +CONFIG_FEATURE_UDHCP_8021Q=y +CONFIG_UDHCPC_DEFAULT_SCRIPT="/usr/share/udhcpc/default.script" +CONFIG_UDHCPC_SLACK_FOR_BUGGY_SERVERS=80 +CONFIG_IFUPDOWN_UDHCPC_CMD_OPTIONS="-R -n" +# CONFIG_UDPSVD is not set +CONFIG_VCONFIG=y +CONFIG_WGET=y +CONFIG_FEATURE_WGET_STATUSBAR=y +CONFIG_FEATURE_WGET_AUTHENTICATION=y +CONFIG_FEATURE_WGET_LONG_OPTIONS=y +CONFIG_FEATURE_WGET_TIMEOUT=y +# CONFIG_ZCIP is not set + +# +# Print Utilities +# +# CONFIG_LPD is not set +# CONFIG_LPR is not set +# CONFIG_LPQ is not set + +# +# Mail Utilities +# +# CONFIG_MAKEMIME is not set +CONFIG_FEATURE_MIME_CHARSET="" +# CONFIG_POPMAILDIR is not set +# CONFIG_FEATURE_POPMAILDIR_DELIVERY is not set +# CONFIG_REFORMIME is not set +# CONFIG_FEATURE_REFORMIME_COMPAT is not set +# CONFIG_SENDMAIL is not set + +# +# Process Utilities +# +# CONFIG_IOSTAT is not set +CONFIG_LSOF=y +# CONFIG_MPSTAT is not set +# CONFIG_NMETER is not set +# CONFIG_PMAP is not set +# CONFIG_POWERTOP is not set +# CONFIG_PSTREE is not set +# CONFIG_PWDX is not set +# CONFIG_SMEMCAP is not set +CONFIG_TOP=y +CONFIG_FEATURE_TOP_CPU_USAGE_PERCENTAGE=y +CONFIG_FEATURE_TOP_CPU_GLOBAL_PERCENTS=y +# CONFIG_FEATURE_TOP_SMP_CPU is not set +# CONFIG_FEATURE_TOP_DECIMALS is not set +# CONFIG_FEATURE_TOP_SMP_PROCESS is not set +# CONFIG_FEATURE_TOPMEM is not set +CONFIG_UPTIME=y +# CONFIG_FEATURE_UPTIME_UTMP_SUPPORT is not set +CONFIG_FREE=y +CONFIG_FUSER=y +CONFIG_KILL=y +CONFIG_KILLALL=y +CONFIG_KILLALL5=y +# CONFIG_PGREP is not set +CONFIG_PIDOF=y +CONFIG_FEATURE_PIDOF_SINGLE=y +CONFIG_FEATURE_PIDOF_OMIT=y +# CONFIG_PKILL is not set +CONFIG_PS=y +# CONFIG_FEATURE_PS_WIDE is not set +# CONFIG_FEATURE_PS_LONG is not set +# CONFIG_FEATURE_PS_TIME is not set +# CONFIG_FEATURE_PS_ADDITIONAL_COLUMNS is not set +# CONFIG_FEATURE_PS_UNUSUAL_SYSTEMS is not set +CONFIG_RENICE=y +CONFIG_BB_SYSCTL=y +# CONFIG_FEATURE_SHOW_THREADS is not set +CONFIG_WATCH=y + +# +# Runit Utilities +# +# CONFIG_RUNSV is not set +# CONFIG_RUNSVDIR is not set +# CONFIG_FEATURE_RUNSVDIR_LOG is not set +# CONFIG_SV is not set +CONFIG_SV_DEFAULT_SERVICE_DIR="" +# CONFIG_SVLOGD is not set +# CONFIG_CHPST is not set +# CONFIG_SETUIDGID is not set +# CONFIG_ENVUIDGID is not set +# CONFIG_ENVDIR is not set +# CONFIG_SOFTLIMIT is not set + +# +# SELinux Utilities +# +CONFIG_CHCON=y +CONFIG_FEATURE_CHCON_LONG_OPTIONS=y +# CONFIG_GETENFORCE is not set +# CONFIG_GETSEBOOL is not set +# CONFIG_LOAD_POLICY is not set +# CONFIG_MATCHPATHCON is not set +# CONFIG_RESTORECON is not set +CONFIG_RUNCON=y +CONFIG_FEATURE_RUNCON_LONG_OPTIONS=y +CONFIG_SELINUXENABLED=y +# CONFIG_SETENFORCE is not set +# CONFIG_SETFILES is not set +# CONFIG_FEATURE_SETFILES_CHECK_OPTION is not set +# CONFIG_SETSEBOOL is not set +# CONFIG_SESTATUS is not set + +# +# Shells +# +CONFIG_ASH=y +CONFIG_ASH_BASH_COMPAT=y +CONFIG_ASH_IDLE_TIMEOUT=y +CONFIG_ASH_JOB_CONTROL=y +CONFIG_ASH_ALIAS=y +CONFIG_ASH_GETOPTS=y +CONFIG_ASH_BUILTIN_ECHO=y +CONFIG_ASH_BUILTIN_PRINTF=y +CONFIG_ASH_BUILTIN_TEST=y +CONFIG_ASH_HELP=y +CONFIG_ASH_CMDCMD=y +# CONFIG_ASH_MAIL is not set +CONFIG_ASH_OPTIMIZE_FOR_SIZE=y +CONFIG_ASH_RANDOM_SUPPORT=y +CONFIG_ASH_EXPAND_PRMT=y +# CONFIG_CTTYHACK is not set +# CONFIG_HUSH is not set +# CONFIG_HUSH_BASH_COMPAT is not set +# CONFIG_HUSH_BRACE_EXPANSION is not set +# CONFIG_HUSH_HELP is not set +# CONFIG_HUSH_INTERACTIVE is not set +# CONFIG_HUSH_SAVEHISTORY is not set +# CONFIG_HUSH_JOB is not set +# CONFIG_HUSH_TICK is not set +# CONFIG_HUSH_IF is not set +# CONFIG_HUSH_LOOPS is not set +# CONFIG_HUSH_CASE is not set +# CONFIG_HUSH_FUNCTIONS is not set +# CONFIG_HUSH_LOCAL is not set +# CONFIG_HUSH_RANDOM_SUPPORT is not set +# CONFIG_HUSH_EXPORT_N is not set +# CONFIG_HUSH_MODE_X is not set +# CONFIG_MSH is not set +CONFIG_FEATURE_SH_IS_ASH=y +# CONFIG_FEATURE_SH_IS_HUSH is not set +# CONFIG_FEATURE_SH_IS_NONE is not set +CONFIG_FEATURE_BASH_IS_ASH=y +# CONFIG_FEATURE_BASH_IS_HUSH is not set +# CONFIG_FEATURE_BASH_IS_NONE is not set +CONFIG_SH_MATH_SUPPORT=y +# CONFIG_SH_MATH_SUPPORT_64 is not set +CONFIG_FEATURE_SH_EXTRA_QUIET=y +# CONFIG_FEATURE_SH_STANDALONE is not set +# CONFIG_FEATURE_SH_NOFORK is not set +# CONFIG_FEATURE_SH_HISTFILESIZE is not set + +# +# System Logging Utilities +# +# CONFIG_SYSLOGD is not set +# CONFIG_FEATURE_ROTATE_LOGFILE is not set +# CONFIG_FEATURE_REMOTE_LOG is not set +# CONFIG_FEATURE_SYSLOGD_DUP is not set +# CONFIG_FEATURE_SYSLOGD_CFG is not set +CONFIG_FEATURE_SYSLOGD_READ_BUFFER_SIZE=0 +# CONFIG_FEATURE_IPC_SYSLOG is not set +CONFIG_FEATURE_IPC_SYSLOG_BUFFER_SIZE=0 +# CONFIG_LOGREAD is not set +# CONFIG_FEATURE_LOGREAD_REDUCED_LOCKING is not set +# CONFIG_FEATURE_KMSG_SYSLOG is not set +# CONFIG_KLOGD is not set +# CONFIG_FEATURE_KLOGD_KLOGCTL is not set +CONFIG_LOGGER=y
board/common_selinux/post_build.sh new file +30 -0
@@ -0,0 +1,30 @@ +#!/bin/bash +################################################################################ +# +# DESCRIPTION: +# This script will do any "post-build" steps (after all packages are built +# but before image creation). Any filesystem permission issues should be +# fixed in this script. +# +# The script requires following variables to be passed into it. +# $1 - the target directory (passed in by default by buildroot if +# script is BR2_ROOTFS_POST_BUILD_SCRIPT) +# +################################################################################ + +DEST_DIR=$1 + +# For SELinux targets, the /var directory symlinks need to be removed +# and replaced with actual folders. The removal is done here and the +# recreation is done in the permissions file for the common_selinux +# local_skeleton +for link in ${DEST_DIR}/var/{cache,lock,log,run,spool,tmp} ${DEST_DIR}/var/lib/misc; do + if [ -h ${link} ]; then + echo "Removing symlink ${link}" + unlink ${link} + fi +done + +# Replace the /run folder with a symlink to /var/run +rm -rf ${DEST_DIR}/run +ln -sf -t ${DEST_DIR} run var/run
board/common_selinux/skeleton/etc/audit/auditd.conf new file +32 -0
@@ -0,0 +1,32 @@ +# +# This file controls the configuration of the audit daemon +# + +log_file = /var/log/audit/audit.log +log_format = RAW +log_group = root +priority_boost = 4 +flush = INCREMENTAL +freq = 20 +num_logs = 5 +disp_qos = lossy +dispatcher = /usr/sbin/audispd +name_format = NONE +##name = mydomain +max_log_file = 6 +max_log_file_action = ROTATE +space_left = 75 +space_left_action = IGNORE +action_mail_acct = root +admin_space_left = 50 +admin_space_left_action = IGNORE +disk_full_action = IGNORE +disk_error_action = IGNORE +##tcp_listen_port = +tcp_listen_queue = 5 +tcp_max_per_addr = 1 +##tcp_client_ports = 1024-65535 +tcp_client_max_idle = 0 +enable_krb5 = no +krb5_principal = auditd +##krb5_key_file = /etc/audit/audit.key
board/common_selinux/skeleton/etc/audit/rules.d/audit.rules new file +3 -0
@@ -0,0 +1,3 @@ +-D +-b 1024 +-e 2
board/common_selinux/skeleton/etc/fstab new file +15 -0
@@ -0,0 +1,15 @@ +# /etc/fstab: static file system information. +# +# <file system> <mount pt> <type> <options> <dump> <pass> +/dev/root / ext3 rw,noauto 0 1 +proc /proc proc defaults 0 0 +devpts /dev/pts devpts defaults,gid=5,mode=620 0 0 +tmpfs /dev/shm tmpfs mode=0700,nodev,nosuid,noexec,size=1M 0 0 +tmpfs /tmp tmpfs mode=0700,nodev,nosuid,noexec,size=200M 0 0 +tmpfs /var/cache tmpfs mode=0700,nodev,nosuid,noexec,size=1M 0 0 +tmpfs /var/lock tmpfs mode=0700,nodev,nosuid,noexec,size=1M 0 0 +tmpfs /var/log tmpfs mode=0700,nodev,nosuid,noexec,size=50M 0 0 +tmpfs /var/run tmpfs mode=0700,nodev,nosuid,noexec,size=1M 0 0 +tmpfs /var/spool tmpfs mode=0700,nodev,nosuid,noexec,size=1M 0 0 +sysfs /sys sysfs defaults 0 0 +none /selinux selinuxfs noauto 0 0
board/common_selinux/skeleton/etc/inittab new file +29 -0
@@ -0,0 +1,29 @@ +# /etc/inittab +# +# This inittab is a basic inittab sample for sysvinit, which mimics +# Buildroot's default inittab for BusyBox. +id:1:initdefault: + +proc::sysinit:/bin/mount -t proc proc /proc +sysf::sysinit:/bin/mount -t sysfs sysfs /sys +dpts::sysinit:/bin/mkdir -p /dev/pts -Z `matchpathcon -n /dev/pts` +dshm::sysinit:/bin/mkdir -p /dev/shm -Z `matchpathcon -n /dev/shm` +mpts::sysinit:/bin/mkdir -p /dev/pts +mshm::sysinit:/bin/mkdir -p /dev/shm +fsck::sysinit:/sbin/fsck -ARy +moun::sysinit:/bin/mount -a +host::sysinit:/bin/hostname -F /etc/hostname + +# now run any rc scripts +init::bootwait:/etc/init.d/rcS + +S0::respawn:/sbin/getty -L ttyS0 115200 vt100 # GENERIC_SERIAL + +# Stuff to do before rebooting +shd0:06:wait:/etc/init.d/rcK +shd1:06:wait:/sbin/swapoff -a +shd2:06:wait:/bin/umount -a -r + +# The usual halt or reboot actions +lt0:0:wait:/sbin/halt -dhp +reb0:6:wait:/sbin/reboot
board/common_selinux/skeleton_permissions.txt new file +26 -0
@@ -0,0 +1,26 @@ +################################################################################ +# +# See <buildroot-source>/package/makedevs/README for details +# +# This device table is used to assign proper ownership and permissions +# on the files in the local-skeleton directory. It doesn't create any device +# file, as it is used in both static device configurations (where /dev/ is static) +# and in dynamic configurations (where devtmpfs, mdev or udev are used). +# +# <name> <type> <mode> <uid> <gid> <major> <minor> <start> <inc> <count> + +# All the necessary file permissions for /etc +/etc/audit/auditd.conf f 644 0 0 - - - - - +/etc/audit/rules.d/audit.rules f 644 0 0 - - - - - +/etc/fstab f 644 0 0 - - - - - +/etc/inittab f 644 0 0 - - - - - + +# Setup entries for all of the /var/* directories that need proper +# mount points +/var/cache d 755 0 0 - - - - - +/var/lib/misc d 755 0 0 - - - - - +/var/lock d 755 0 0 - - - - - +/var/log d 755 0 0 - - - - - +/var/run d 755 0 0 - - - - - +/var/spool d 755 0 0 - - - - - +/var/tmp d 755 0 0 - - - - -
Signature · 1 line
1.9.1
PATCH v8 13/16 qemu x86 selinux: base br defconfig
In reply to Clayton ShotwellFrom: Clayton Shotwell <[email protected]>
This will build a base SELinux system that boots with SELinux in permissive mode. Also adding documentation on how to use it.
Signed-off-by Clayton Shotwell <[email protected]>
Signed-off-by Matthew Weber <[email protected]>
---
Changes v7 -> v8:
- No changes
Changes v6 -> v7:
- No changes
Changes v5 -> v6:
- No changes
Changes v4 -> v5:
- Update the qemu_x86_defconfig to the 4.0 kernel series (Clayton S.)
Changes v1 -> v4:
- Did not exist
--- board/qemu/x86/linux-4.0-selinux.config | 77 +++++++++++++++++++++++++++++++++ board/qemu/x86/readme.txt | 17 ++++++++ configs/qemu_x86_selinux_defconfig | 67 ++++++++++++++++++++++++++++ 3 files changed, 161 insertions(+) create mode 100644 board/qemu/x86/linux-4.0-selinux.config create mode 100644 configs/qemu_x86_selinux_defconfig
board/qemu/x86/linux-4.0-selinux.config new file +77 -0
@@ -0,0 +1,77 @@ +# CONFIG_LOCALVERSION_AUTO is not set +# CONFIG_SWAP is not set +CONFIG_AUDIT=y +# CONFIG_COMPAT_BRK is not set +CONFIG_MODULES=y +# CONFIG_BLK_DEV_BSG is not set +# CONFIG_IOSCHED_DEADLINE is not set +# CONFIG_IOSCHED_CFQ is not set +# CONFIG_X86_EXTENDED_PLATFORM is not set +# CONFIG_SCHED_OMIT_FRAME_POINTER is not set +# CONFIG_MTRR_SANITIZER is not set +# CONFIG_SECCOMP is not set +# CONFIG_RELOCATABLE is not set +CONFIG_NET=y +CONFIG_PACKET=y +CONFIG_UNIX=y +CONFIG_INET=y +CONFIG_IP_PNP=y +# CONFIG_INET_XFRM_MODE_TRANSPORT is not set +# CONFIG_INET_XFRM_MODE_TUNNEL is not set +# CONFIG_INET_XFRM_MODE_BEET is not set +# CONFIG_INET_LRO is not set +# CONFIG_INET_DIAG is not set +# CONFIG_IPV6 is not set +# CONFIG_WIRELESS is not set +CONFIG_DEVTMPFS=y +CONFIG_DEVTMPFS_MOUNT=y +# CONFIG_PREVENT_FIRMWARE_BUILD is not set +# CONFIG_FIRMWARE_IN_KERNEL is not set +# CONFIG_BLK_DEV is not set +CONFIG_BLK_DEV_SD=y +CONFIG_ATA=y +CONFIG_ATA_PIIX=y +CONFIG_NETDEVICES=y +CONFIG_NE2K_PCI=y +CONFIG_8139CP=y +# CONFIG_WLAN is not set +# CONFIG_INPUT_MOUSEDEV_PSAUX is not set +# CONFIG_INPUT_MOUSE is not set +# CONFIG_SERIO_SERPORT is not set +# CONFIG_LEGACY_PTYS is not set +# CONFIG_DEVKMEM is not set +CONFIG_SERIAL_8250=y +CONFIG_SERIAL_8250_CONSOLE=y +# CONFIG_HW_RANDOM is not set +# CONFIG_HWMON is not set +CONFIG_SOUND=y +CONFIG_SND=y +CONFIG_SND_HDA_INTEL=y +# CONFIG_USB_SUPPORT is not set +# CONFIG_X86_PLATFORM_DEVICES is not set +# CONFIG_DMIID is not set +CONFIG_EXT2_FS=y +CONFIG_EXT2_FS_XATTR=y +CONFIG_EXT2_FS_POSIX_ACL=y +CONFIG_EXT2_FS_SECURITY=y +CONFIG_EXT3_FS=y +CONFIG_EXT3_FS_POSIX_ACL=y +CONFIG_EXT3_FS_SECURITY=y +# CONFIG_DNOTIFY is not set +# CONFIG_INOTIFY_USER is not set +CONFIG_TMPFS=y +CONFIG_TMPFS_POSIX_ACL=y +# CONFIG_MISC_FILESYSTEMS is not set +CONFIG_NFS_FS=y +CONFIG_ROOT_NFS=y +# CONFIG_ENABLE_WARN_DEPRECATED is not set +# CONFIG_ENABLE_MUST_CHECK is not set +# CONFIG_UNUSED_SYMBOLS is not set +# CONFIG_FRAME_POINTER is not set +# CONFIG_X86_VERBOSE_BOOTUP is not set +CONFIG_SECURITY=y +CONFIG_SECURITY_NETWORK=y +CONFIG_SECURITY_SELINUX=y +CONFIG_SECURITY_SELINUX_BOOTPARAM=y +CONFIG_CRYPTO_ANSI_CPRNG=y +# CONFIG_VIRTUALIZATION is not set
board/qemu/x86/readme.txt +17 -0
@@ -5,3 +5,20 @@ Run the emulation with: The login prompt will appear in the graphical window. Tested with QEMU 2.2.1 + +------------------------------------------------------------------- + +Run the SElinux target emulation with: + + qemu-system-i386 -M pc -kernel output/images/bzImage -drive file=output/images/rootfs.ext2,if=ide -append "root=/dev/sda rw console=ttyS0 selinux=1" -net nic,model=rtl8139 -net user -display none -serial stdio + +The emulation should reboot once the first time for relabeling and +then provide a login prompt. The login is username root and password +root because PAM requires a password in this secure configuration. To +enable SELinux enforcing at boot, login and edit the +/etc/selinux/config and set SELINUX to enforcing. Save and make sure +to "sync" before restarting the emulation as the ext2 fs would +otherwise corrupt when the emulation exits. After enforcing is +default, the selinux= provided as part of the qemu "append" above can +be used to turn enforcing on/off. This configuration would be tailored +as part of a targets refpolicy customization.
configs/qemu_x86_selinux_defconfig new file +67 -0
67 lines not on this page · raw message
Signature · 1 line
1.9.1
PATCH v8 14/16 squashfs: Add xattr support
In reply to Clayton ShotwellAdding extended attribute support for the squashfs tools when the attr package is selected. This is needed for SELinux support.
Signed-off-by Clayton Shotwell <[email protected]>
---
Changes v7 -> v8:
- Reverted changes to the host build options to leave xattr support disabled due to too many host system dependencies issues.
- Cleaned up the target xattr options and added a dependency on attr to ensure it is built before squashfs (Suggested by Thomas P.)
Changes v6 -> v7:
- No changes
Changes v5 -> v6:
- No changes
--- package/squashfs/squashfs.mk | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
package/squashfs/squashfs.mk +6 -2
@@ -10,8 +10,12 @@ SQUASHFS_SITE = http://downloads.sourceforge.net/project/squashfs/squashfs/squas SQUASHFS_LICENSE = GPLv2+ SQUASHFS_LICENSE_FILES = COPYING -# no libattr in BR -SQUASHFS_MAKE_ARGS = XATTR_SUPPORT=0 +ifeq ($(BR2_PACKAGE_ATTR),y) +SQUASHFS_DEPENDENCIES += attr +SQUASHFS_MAKE_ARGS += XATTR_SUPPORT=1 +else +SQUASHFS_MAKE_ARGS += XATTR_SUPPORT=0 +endif ifeq ($(BR2_PACKAGE_SQUASHFS_LZ4),y) SQUASHFS_DEPENDENCIES += lz4
Signature · 1 line
1.9.1
Thomas Petazzoni
AppliedPATCH v8 14/16 squashfs: Add xattr support
Dear Clayton Shotwell,
Quoted 11 lines · Clayton Shotwell
Adding extended attribute support for the squashfs tools when the attr package is selected. This is needed for SELinux support.
Signed-off-by Clayton Shotwell <[email protected]>---
Changes v7 -> v8:
- Reverted changes to the host build options to leave xattr support disabled due to too many host system dependencies issues.
- Cleaned up the target xattr options and added a dependency on attr to ensure it is built before squashfs (Suggested by Thomas P.)
Applied, thanks.
Thomas
Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons Embedded Linux, Kernel and Android engineering http://free-electrons.com
PATCH v8 15/16 cpio: new package
In reply to Clayton ShotwellAdding the cpio archive utility for the target and host. Patches have been pulled from ArchLinux and Debian to fix CVE issues and compile issues.
Signed-off-by Clayton Shotwell <[email protected]>
---
Changes v7 -> v8:
- Corrected the license to be GPLv3+ (Suggested by Thomas P.)
- Changed all of the patches to pull from the various source locations since they were not being modified at all (Suggested by Thomas P.)
Changes v6 -> v7:
- Added dependency on argp-standalone package for uclibc toolchains to fix build error (Clayton S.)
- Added hash file (Clayton S.)
Changes v5 -> v6:
- No changes
--- package/Config.in | 1 + package/Config.in.host | 1 + package/cpio/Config.in | 8 ++++++++ package/cpio/Config.in.host | 6 ++++++ package/cpio/cpio.hash | 9 +++++++++ package/cpio/cpio.mk | 27 +++++++++++++++++++++++++++ 6 files changed, 52 insertions(+) create mode 100644 package/cpio/Config.in create mode 100644 package/cpio/Config.in.host create mode 100644 package/cpio/cpio.hash create mode 100644 package/cpio/cpio.mk
package/Config.in +1 -0
@@ -149,6 +149,7 @@ endmenu menu "Filesystem and flash utilities" source "package/btrfs-progs/Config.in" source "package/cifs-utils/Config.in" + source "package/cpio/Config.in" source "package/cramfs/Config.in" source "package/curlftpfs/Config.in" source "package/dosfstools/Config.in"
package/Config.in.host +1 -0
@@ -1,6 +1,7 @@ menu "Host utilities" source "package/checkpolicy/Config.in.host" + source "package/cpio/Config.in.host" source "package/cramfs/Config.in.host" source "package/dfu-util/Config.in.host" source "package/dos2unix/Config.in.host"
package/cpio/Config.in new file +8 -0
@@ -0,0 +1,8 @@ +config BR2_PACKAGE_CPIO + bool "cpio" + # Need argp.h support + select BR2_PACKAGE_ARGP_STANDALONE if BR2_TOOLCHAIN_USES_UCLIBC + help + cpio archive utility for creation and extraction. + + https://www.gnu.org/software/cpio/
package/cpio/Config.in.host new file +6 -0
@@ -0,0 +1,6 @@ +config BR2_PACKAGE_HOST_CPIO + bool "host cpio" + help + cpio archive utility for creation and extraction. + + https://www.gnu.org/software/cpio/
package/cpio/cpio.hash new file +9 -0
@@ -0,0 +1,9 @@ +# Locally calculated after checking pgp signature +sha256 601b1d774cd6e4cd39416203c91ec59dbd65dd27d79d75e1a9b89497ea643978 cpio-2.11.tar.gz + +# Locally calculated +sha256 903fb87e00813daf257be5d1680ad93770d320c707ab2ec345486958b2e8a21f cpio-2.11-stdio.in.patch +sha256 6b6505a97dda75d24627d9ba461b45ab9ea4764e1a2788d6986eb2978434f25d cpio-2.11-CVE-2014-9112.patch +sha256 0cf7c9749f1c1610aaf46e17eacd6614c5ef8c2114236bcdd08d53e929020ae5 cpio-2.11-testsuite-CVE-2014-9112.patch +sha256 f1f587f70a38363691cbd4dfe89f962c8c57266277f0fbc781910c6a7065be7e cpio-2.11-check_for_symlinks-CVE-2015-1197.patch +sha256 b3d317e3c5705d7f9e503f56540baf3cb6dd1d0e9be0261151a5b08378c2d98c cpio-2.11-stat.patch
package/cpio/cpio.mk new file +27 -0
@@ -0,0 +1,27 @@ +################################################################################ +# +# cpio +# +################################################################################ + +CPIO_VERSION = 2.11 +CPIO_SITE = http://ftp.gnu.org/gnu/cpio +CPIO_LICENSE = GPLv3+ +CPIO_LICENSE_FILES = COPYING +CPIO_PATCH = \ + https://projects.archlinux.org/svntogit/packages.git/plain/cpio/trunk/cpio-2.11-stdio.in.patch \ + https://projects.archlinux.org/svntogit/packages.git/plain/cpio/trunk/cpio-2.11-CVE-2014-9112.patch \ + https://projects.archlinux.org/svntogit/packages.git/plain/cpio/trunk/cpio-2.11-testsuite-CVE-2014-9112.patch \ + https://projects.archlinux.org/svntogit/packages.git/plain/cpio/trunk/cpio-2.11-check_for_symlinks-CVE-2015-1197.patch \ + https://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/app-arch/cpio/files/cpio-2.11-stat.patch + +# cpio uses argp.h which is not provided by uclibc by default. +# Use the argp-standalone package to provide this but make sure +# the host package does not try to use the host version. +ifeq ($(BR2_TOOLCHAIN_USES_UCLIBC),y) +CPIO_DEPENDENCIES += argp-standalone +HOST_CPIO_DEPENDENCIES = +endif + +$(eval $(autotools-package)) +$(eval $(host-autotools-package))
Signature · 1 line
1.9.1
PATCH v8 15/16 cpio: new package
Clayton, all,
Quoted 3 lines · Clayton Shotwell
Adding the cpio archive utility for the target and host. Patches have been pulled from ArchLinux and Debian to fix CVE issues and compile issues.
According to the url, patches are pulled from ArchLinux and Gentoo.
Quoted 130 lines
Signed-off-by Clayton Shotwell <[email protected]>---
Changes v7 -> v8:
- Corrected the license to be GPLv3+ (Suggested by Thomas P.)
- Changed all of the patches to pull from the various source locations since they were not being modified at all (Suggested by Thomas P.)Changes v6 -> v7:
- Added dependency on argp-standalone package for uclibc toolchains to fix build error (Clayton S.)
- Added hash file (Clayton S.)Changes v5 -> v6:
- No changes--- package/Config.in | 1 + package/Config.in.host | 1 + package/cpio/Config.in | 8 ++++++++ package/cpio/Config.in.host | 6 ++++++ package/cpio/cpio.hash | 9 +++++++++ package/cpio/cpio.mk | 27 +++++++++++++++++++++++++++ 6 files changed, 52 insertions(+) create mode 100644 package/cpio/Config.in create mode 100644 package/cpio/Config.in.host create mode 100644 package/cpio/cpio.hash create mode 100644 package/cpio/cpio.mkpackage/Config.in +1
-0@@ -149,6 +149,7 @@ endmenu menu "Filesystem and flash utilities" source "package/btrfs-progs/Config.in" source "package/cifs-utils/Config.in" + source "package/cpio/Config.in" source "package/cramfs/Config.in" source "package/curlftpfs/Config.in" source "package/dosfstools/Config.in"package/Config.in.host +1
-0@@ -1,6 +1,7 @@ menu "Host utilities" source "package/checkpolicy/Config.in.host" + source "package/cpio/Config.in.host" source "package/cramfs/Config.in.host" source "package/dfu-util/Config.in.host" source "package/dos2unix/Config.in.host"package/cpio/Config.in new file +8
-0@@ -0,0 +1,8 @@ +config BR2_PACKAGE_CPIO + bool "cpio" + # Need argp.h support + select BR2_PACKAGE_ARGP_STANDALONE if BR2_TOOLCHAIN_USES_UCLIBC + help + cpio archive utility for creation and extraction. + + https://www.gnu.org/software/cpio/package/cpio/Config.in.host new file +6
-0@@ -0,0 +1,6 @@ +config BR2_PACKAGE_HOST_CPIO + bool "host cpio" + help + cpio archive utility for creation and extraction. + + https://www.gnu.org/software/cpio/package/cpio/cpio.hash new file +9
-0@@ -0,0 +1,9 @@ +# Locally calculated after checking pgp signature +sha256 601b1d774cd6e4cd39416203c91ec59dbd65dd27d79d75e1a9b89497ea643978 cpio-2.11.tar.gz + +# Locally calculated +sha256 903fb87e00813daf257be5d1680ad93770d320c707ab2ec345486958b2e8a21f cpio-2.11-stdio.in.patch +sha256 6b6505a97dda75d24627d9ba461b45ab9ea4764e1a2788d6986eb2978434f25d cpio-2.11-CVE-2014-9112.patch +sha256 0cf7c9749f1c1610aaf46e17eacd6614c5ef8c2114236bcdd08d53e929020ae5 cpio-2.11-testsuite-CVE-2014-9112.patch +sha256 f1f587f70a38363691cbd4dfe89f962c8c57266277f0fbc781910c6a7065be7e cpio-2.11-check_for_symlinks-CVE-2015-1197.patch +sha256 b3d317e3c5705d7f9e503f56540baf3cb6dd1d0e9be0261151a5b08378c2d98c cpio-2.11-stat.patchpackage/cpio/cpio.mk new file +27
-1@@ -0,0 +1,27 @@ +################################################################################ +# +# cpio +# +################################################################################ + +CPIO_VERSION = 2.11 +CPIO_SITE = http://ftp.gnu.org/gnu/cpio +CPIO_LICENSE = GPLv3+ +CPIO_LICENSE_FILES = COPYING +CPIO_PATCH = \ + https://projects.archlinux.org/svntogit/packages.git/plain/cpio/trunk/cpio-2.11-stdio.in.patch \ + https://projects.archlinux.org/svntogit/packages.git/plain/cpio/trunk/cpio-2.11-CVE-2014-9112.patch \ + https://projects.archlinux.org/svntogit/packages.git/plain/cpio/trunk/cpio-2.11-testsuite-CVE-2014-9112.patch \ + https://projects.archlinux.org/svntogit/packages.git/plain/cpio/trunk/cpio-2.11-check_for_symlinks-CVE-2015-1197.patch \ + https://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/app-arch/cpio/files/cpio-2.11-stat.patch + +# cpio uses argp.h which is not provided by uclibc by default. +# Use the argp-standalone package to provide this but make sure +# the host package does not try to use the host version. +ifeq ($(BR2_TOOLCHAIN_USES_UCLIBC),y) +CPIO_DEPENDENCIES += argp-standalone +HOST_CPIO_DEPENDENCIES = +endif + +$(eval $(autotools-package)) +$(eval $(host-autotools-package)) --1.9.1
Quoted 4 lines
_______________________________________________
buildroot mailing list
buildroot at busybox.net
http://lists.busybox.net/mailman/listinfo/buildroot
Regards,
Signature · 1 line
Samuel
PATCH v8 15/16 cpio: new package
Samuel,
Quoted 8 lines · Samuel Martin
Clayton, all,
Quoted 3 lines · Clayton Shotwell
Adding the cpio archive utility for the target and host. Patches have been pulled from ArchLinux and Debian to fix CVE issues and compile issues.
According to the url, patches are pulled from ArchLinux and Gentoo.
That is in fact correct. I'll update the comment so it is correct.
Thanks,
Clayton
Clayton Shotwell
Senior Software Engineer, Rockwell Collins
clayton.shotwell at rockwellcollins.com
PATCH v8 16/16 audit: Add startup script
In reply to Clayton ShotwellThe startup script for the audit package did not meet the buildroot standards when the package was initially merged. Adding a compliant startup script for starting the audit daemon along with rotating the logs and other features.
Signed-off-by Clayton Shotwell <[email protected]>
---
Changes v7 -> v8:
- New patch
--- package/audit/S01auditd | 80 +++++++++++++++++++++++++++++++++++++++++++++++++ package/audit/audit.mk | 4 +++ 2 files changed, 84 insertions(+) create mode 100644 package/audit/S01auditd
package/audit/S01auditd new file +80 -0
@@ -0,0 +1,80 @@ +#!/bin/sh +# +# auditd This starts and stops auditd +# +# description: This starts the Linux Auditing System Daemon, +# which collects security related events in a dedicated +# audit log. If this daemon is turned off, audit events +# will be sent to syslog. +# + +NAME=auditd +DAEMON=/usr/sbin/${NAME} +CONFIG=/etc/audit/auditd.conf +PIDFILE=/var/run/${NAME}.pid + +start(){ + echo -n "Starting ${NAME}: " + + # Create dir to store log files in if one doesn't exist. Create + # the directory with SELinux permissions if possible + command -v matchpathcon >/dev/null 2>&1 + if [ $? = 0 ]; then + mkdir -p /var/log/audit -Z `matchpathcon -n /var/log/audit` + else + mkdir -p /var/log/audit + fi + + # Run audit daemon executable + start-stop-daemon -S -q -p ${PIDFILE} --exec ${DAEMON} + + if [ $? = 0 ]; then + # Load the default rules + test -f /etc/audit/rules.d/audit.rules && /usr/sbin/auditctl -R /etc/audit/rules.d/audit.rules >/dev/null + echo "OK" + else + echo "Failed" + fi +} + +stop(){ + echo -n "Stopping ${NAME}: " + + start-stop-daemon -K -q -p ${PIDFILE} + [ $? = 0 ] && echo "OK" || echo "FAIL" +} + +reload(){ + echo -n "Reloading ${NAME} configuration: " + start-stop-daemon --stop -s 1 -p ${PIDFILE} 1>/dev/null + [ $? = 0 ] && echo "OK" || echo "FAIL" +} + +rotate(){ + echo -n "Rotating ${NAME} logs: " + start-stop-daemon --stop -s 10 -p ${PIDFILE} 1>/dev/null + [ $? = 0 ] && echo "OK" || echo "FAIL" +} + +case "$1" in + start) + start + ;; + stop) + stop + ;; + restart) + stop + start + ;; + reload) + reload + ;; + rotate) + rotate + ;; + *) + echo "Usage: $0 {start|stop|restart|reload|rotate}" + exit 1 + ;; +esac
package/audit/audit.mk +4 -0
@@ -34,6 +34,10 @@ ifeq ($(BR2_aarch64),y) AUDIT_CONF_OPTS += --with-aarch64 endif +define AUDIT_INSTALL_INIT_SYSV + $(INSTALL) -m 755 package/audit/S01auditd $(TARGET_DIR)/etc/init.d/ +endef + define AUDIT_INSTALL_CLEANUP $(RM) -rf $(TARGET_DIR)/etc/rc.d $(RM) -rf $(TARGET_DIR)/etc/sysconfig
Signature · 1 line
1.9.1