policycoreutils: new package

From: Clayton Shotwell <[email protected]>

This package contains the core policy utilities that are required for basic operation of an SELinux system.

---
Changes: v12 -> v13:
- Incorporated changes found here: https://patchwork.ozlabs.org/patch/649176/

Changes v11 -> v12:
- splitted DESTDIR and CFLAGS patches into three patches( DESTDIR,PREFIX and removal of ARCH).

Changes v10 -> v11:
- Removed LDFLAGS="-Wl,-rpath,$(HOST_DIR)/usr/lib" as it is overriding LDFLAGS.
- Removed patch PREFIX number in the subject line .
- Replaced line LDFLAGS="-Wl,-rpath,$(HOST_DIR)/usr/lib" with LDFLAGS="$(HOST_LDFLAGS)".
- Added patch to disable dbuslib flags in policycoreutils .
- Added libglib2 dependency for restorecond.

Changes v9 -> v10:
- Added LDFLAGS for HOST_POLICYCOREUTILS_MAKE_OPTS:LDFLAGS="-Wl,-rpath,$(HOST_DIR)/usr/lib"

Changes v8 -> v9:
- Cleaned up DESTDIR references in patches to use PREFIX instead (suggested by Samuel)
- Added the use of the ARCH to pass the host and target architectures to the build (Suggested by Samuel)

Changes v7 -> v8:
- Cleaned up indentations in policycoreutils.mk (Suggested by Thomas P.)
- Fixed sed separator (Suggested by Thomas P.)
- Cleaned up cross compile patches and make options (Suggested by Thomas P.)
- Changed dbus-glib dependency to a select and cleaned up the dependencies (Suggested by Thomas P.)

Changes v6 -> v7:
- No changes

Changes v5 -> v6:
- No changes

Changes v4 -> v5:
- Updated depends and removed glibc dependency (Matt W.)
- Updated site to github (Matt W.)
- Added host python 2/3 support (Matt W.)
- Removed sandbox and mctrans support (Matt W.)
- Removed restorcon init script (Matt W.)
- Agree as optional settings were removed so menu isn't needed (Suggested by Ryan B. and Thomas P.)
- added Config.in select for LIBCAP_NG (Suggested by Thomas P.)
- cleaned up pam/audit ifeq (Suggested by Thomas P.)
- fixed CFLAGS to include target_cflags instead of += (Suggested by Thomas P.)
- Refactored lists of build/install steps into loops (Suggested by Thomas P.)
- Removed += on first host depends assignment (Suggested by Thomas P.)
- Refactored host make opts assignments (Suggested by Thomas P.)
- Limited to glibc because of fts.h, some uclibc toolchains have it others don't. Eventually this would be good to fix with the updated method of file traversal. (Matt W.)
- Gettext fixups for uclibc support. Counter productive as we now limit to glibc only. (Matt W.)
- Added musl as possible lib type (Matt W.)
- Removed largefile dependency (Clayton S.)
- Changed dbus-glib select to a depends on in the Config.in (suggested by Ryan B.)

Changes v3 -> v4:
- Add a select for the libselinux Python bindings when debugging is enabled. This will cause Python to be built for the target (suggested by Thomas P.)
- Cleaned up the configure comments (suggested by Thomas).
- Added a dependency on BR2_USE_MMU for the debugging option because python requires it (suggested by Thomas P.)
- Removed the dependencies on audit and linux-pam. Both packages are now optional dependencies based on whether or not the package has been selected
- Moved the dependency on dbus-glib to only the restorecond option where it is used
- Added a INSTALL_INIT_SYSV for the restorecond daemon rather than just installing it directly
- Adding a dependency on glibc
- Removed the clean commands

Changes v2 -> v3:
- Added dependencies on BR2_TOOLCHAIN_HAS_THREADS and BR2_LARGEFILE (suggested by Thomas P.)
- Changes patch naming convention (suggested by Thomas P.)
- Added selects for linux-pam and audit

Changes v1 -> v2:
- General cleanup to the mk file to conform to the standard format
- Fixed the patch naming to avoid using the version number
- Cleaned up the patch to include a signed-off-by line
- Changed package dependencies into selects in the config

---
 package/Config.in                                  |   1 +
 ...IR-to-all-paths-that-use-an-absolute-path.patch | 131 +++++++++++++
 .../0002-Add-PREFIX-to-host-paths.patch            | 211 +++++++++++++++++++++
 .../0003-Remove-hardcoded-arch-variable.patch      |  43 +++++
 ...licy-python-install-arguments-to-be-a-var.patch |  42 ++++
 .../0005-Check-to-see-if-DBUS-is-enabled.patch     |  56 ++++++
 package/policycoreutils/Config.in                  |  59 ++++++
 package/policycoreutils/policycoreutils.hash       |   2 +
 package/policycoreutils/policycoreutils.mk         | 111 +++++++++++
 9 files changed, 656 insertions(+)
 create mode 100644 package/policycoreutils/0001-Add-DESTDIR-to-all-paths-that-use-an-absolute-path.patch
 create mode 100644 package/policycoreutils/0002-Add-PREFIX-to-host-paths.patch
 create mode 100644 package/policycoreutils/0003-Remove-hardcoded-arch-variable.patch
 create mode 100644 package/policycoreutils/0004-Change-sepolicy-python-install-arguments-to-be-a-var.patch
 create mode 100644 package/policycoreutils/0005-Check-to-see-if-DBUS-is-enabled.patch
 create mode 100644 package/policycoreutils/Config.in
 create mode 100644 package/policycoreutils/policycoreutils.hash
 create mode 100644 package/policycoreutils/policycoreutils.mk

index 9399f63..8091e33 100644
@@ -1657,6 +1657,7 @@ menu "Real-Time"
 endmenu
 
 menu "Security"
+	source "package/policycoreutils/Config.in"
 	source "package/setools/Config.in"
 endmenu
 

new file mode 100644
index 0000000..44cb0c3
@@ -0,0 +1,2 @@
+# https://github.com/SELinuxProject/selinux/wiki/Releases
+sha256 329382cfe9fa977678abf541dcd8fe3847cf0c83b24654c8f7322343907078a1 policycoreutils-2.5.tar.gz

1.9.1

From: Clayton Shotwell <[email protected]>

The patch is for adding selinux reference policy (refpolicy). It is a complete SELinux policy that can be used as the system policy for a variety of systems and used as the basis for creating other policies.

Changes were made to this patch in between versions 12 and 13 for which the change history can be found here: https://patchwork.ozlabs.org/patch/649175/

---
Changes: v12 -> v13:
- Incorporated changes found here: https://patchwork.ozlabs.org/patch/649175/

Changes v11 -> v12:
- No changes

Changes v10 -> v11:
- Removed refpolicy-contrib package to maintain it as a seperate patch (suggested by Thomas)
- Removed /sbin/restorecon condition check and added comments in S00selinux( how /proc/mounts are used to discover tmpfs mounts)
- Removed variable REFPOLICY_POLICY_COMPILE and made Minor Indentation changes (suggested by Thomas).

Changed v9 -> v10:
- Removed trailing slash at the end (REFPOLICY_SITE = http://oss.tresys.com/files/refpolicy)
- Adds new menu option to select the SELinux state to be written
to the /etc/selinux/config file for the target (D. Graziano)

Changes v8 -> v9:
- Minor nit picks on spacing (Suggested by Samuel)

Changes v7 -> v8:
- Changes REFPOLICY_MAKE_CMDS to REFPOLICY_MAKE_OPTS (Suggested by Samuel)
- Added a help section to the custom git repo to explain why the refpolicy-contrib option is needed (Suggested by Samuel)
- Added rsync exclusions to ensure no unneeded files are copied during the refpolicy-contrib sync (Suggested by Samuel)

Changes v6 -> v7:
- Moving the refpolicy patch into a version specific folder to prevent it from being applied to the custom git repos. (Clayton S.)

Changes v5 -> v6:
- Fixed references to GIT in config files (Suggested by Ryan B.)
- Removed execute permissions on files (Suggested by Ryan B.)
- Fixed spelling error and changed staging install to always install the documentation (Suggested by Samuel)

Changes v4 -> v5:
- Removed TODO and dependency on glibc (Matt W.)
- Added lib depends to meet policycoreutils limitation on std lib

    (Matt W.)

- Added comment for when an option is not defined (Matt W.)
- Removed largefile, locale, and wchar dependencies (Clayton S.)
- Remove dependancy on host-python-pyxml (Ryan B.)
- Forced package to use $(HOST_DIR)/usr/bin/python2 for python executable (Ryan B.)
- Added host-python dependency (Clayton S.)
- Removed config menu (suggested by Thomas P.)
- Added patch to fix awk issue (Clayton S.)

Changes v3 -> v4:
- Added a dependency on host-gawk and correct the awk calls

    in the makefile to use $(AWK)

- Changed the default policy name to br_policy to differentiate the policy generated from refpolicy
- Added a install step to create a /.autorelabel file to cause the file system to be relabeled by S12SELinux init script
- Adding a default modules.conf file with an option to specify a different one. This will decrease the build time for refpolicy by removing unused policies. (implemented by Thomas P.)
- Cleaned up the configure comments (implemented by Thomas).
- Added a check to only install the documentation if the Buildroot option is enabled
- Removed the build because the install step completes the same process. Also removed the clean step because it is being removed globally from buildroot (implemented by Thomas P.)
- Added more error handling to the startup script to print a warning if SELinux fails to install the policy if it exists. This can be caused by the kernel not being configured with SELinux enabled

Changes v2 -> v3:
- Changes patch naming convention (suggested by Thomas P.)
- Added dependencies on BR2_TOOLCHAIN_HAS_THREADS and BR2_LARGEFILE (suggested by Thomas P.)
- Removed configure option for a specific patch folder (suggested by Thomas P.)
- Removed distribution configuration option (suggested by Thomas)
- Changed the monolithic configuration option to a modular configuration option (suggested by Thomas P.)
- Removed the refpolicy name option (suggested by Thomas P.)
- Corrected gramatical and comment errors (suggested by Thomas P.)
- Multiple style corrections to the mk file (suggested by Thomas P.)
- Added a comment to clairfy the usage of the the host build options for a target build

Changes v1 -> v2:
- General cleanup to the mk file to conform to the standard format
- Fixed the patch naming to match the standard 4 digit numbering
- Changed package dependencies into selects in the config

---
 package/Config.in                                  |    1 +
 .../0001-Fix-awk-references-to-use-variable.patch  |   42 +
 package/refpolicy/Config.in                        |  146 +++
 package/refpolicy/S00selinux                       |  126 ++
 package/refpolicy/booleans.conf                    | 1278 ++++++++++++++++++++
 package/refpolicy/config                           |    8 +
 package/refpolicy/modules.conf                     |  430 +++++++
 package/refpolicy/refpolicy.hash                   |    2 +
 package/refpolicy/refpolicy.mk                     |  111 ++
 9 files changed, 2144 insertions(+)
 create mode 100644 package/refpolicy/0001-Fix-awk-references-to-use-variable.patch
 create mode 100644 package/refpolicy/Config.in
 create mode 100644 package/refpolicy/S00selinux
 create mode 100644 package/refpolicy/booleans.conf
 create mode 100644 package/refpolicy/config
 create mode 100644 package/refpolicy/modules.conf
 create mode 100644 package/refpolicy/refpolicy.hash
 create mode 100644 package/refpolicy/refpolicy.mk

index 8091e33..853fc6e 100644
@@ -1658,6 +1658,7 @@ endmenu
 
 menu "Security"
 	source "package/policycoreutils/Config.in"
+	source "package/refpolicy/Config.in"
 	source "package/setools/Config.in"
 endmenu
 

new file mode 100644
index 0000000..5eee807
@@ -0,0 +1,8 @@
+# This file controls the state of SELinux on the system.
+# SELINUX= can take one of these three values:
+#     enforcing - SELinux security policy is enforced.
+#     permissive - SELinux prints warnings instead of enforcing.
+#     disabled - No SELinux policy is loaded.
+SELINUX=permissive
+# SELINUXTYPE= name of the selinux policy to use
+SELINUXTYPE=refpolicy

new file mode 100644
index 0000000..c10de45
@@ -0,0 +1,2 @@
+#From https://github.com/TresysTechnology/refpolicy/wiki/DownloadRelease
+sha256 2dd2f45a7132137afe8302805c3b7839739759b9ab73dd1815c01afe34ac99de  refpolicy-2.20151208.tar.bz2

1.9.1

Hello,

This patch/commit is too complicated / too long. Please try to split it into smaller chunks by only introducing the very mandatory functionality first, and progressively add more capabilities.

It also has a number of issues. See below for the details.

	bool "Standard"
	help
	  ....

	bool ...
	help
	  ....

	echo SELINUX=$(BR2_PACKAGE_REFPOLICY_STATE) > $(TARGET_DIR)/etc/selinux/config
	echo SELINUXTYPE=$(BR2_PACKAGE_REFPOLICY_NAME) >> $(TARGET_DIR)/etc/selinux/config

Thomas Petazzoni, CTO, Free Electrons
Embedded Linux and Kernel engineering
http://free-electrons.com

Hello,

I checked by doing a build test: the target policycoreutils dependency is not needed for build time, and it seems like the host-setools dependency is also not needed.

Could you double check this, by doing a build which has *only* refpolicy enabled and nothing else, and verify that the dependencies are really necessary?

Thanks a lot,

Thomas

Thomas Petazzoni, CTO, Free Electrons
Embedded Linux and Kernel engineering
http://free-electrons.com

Hello,

I have performed a build with only refpolicy enabled and you are correct. I will update this to remove that dependency. I am also currently working to address your other comments.

Thanks for your feedback!

Bryce Ferguson
Software Engineer
Airborne Information Solutions \ Secure Platforms

400 Collins Rd NE Cedar Rapids, Iowa 52498

Bryce.Ferguson at rockwellcollins.com

Hello,

policies.

atch/649175/

I have split this commit in three which should replace this one. In these commits, I have also addressed your comments.

policycoreutils

Fixed in new set of commits.

Fixed in new set of commits.

The "Standard SELinux policy" is type enforcement only. I have specified that in the new set of commits.

Fixed typos in new set of commits.

Fixed indentation in new set of commits.

Dropped in new set of commits.

Yes refpolicy uses the git submodule. This has been removed in the new set of commits.

The custom git repository stuff was an artifact of an outdated method we were using. I have removed it in the new set of commits.

b/package/refpolicy/booleans.conf

Refpolicy generates modules.conf and booleans.conf as part of the build. The files here are taken from the build and paired down to a minimal amount of functionality to cut down on build times. Each of them I have added as a separate commit to keep the patch sizes down.

modules.conf

See comment above.

the

files

We tracked this problem down and it ended up being one support tool that wasn't building correctly. The reason it previously worked was because refpolicy doesn't build C application or binaries. It uses python to build bytecode binary files for the policy. A fix has been added for this in the new set of patches.

This was another artifact from an internal build process and has been removed in the new set of patches.

2_PACKAGE_REFPOLICY_NAME)/policy

2_PACKAGE_REFPOLICY_NAME)/modules/active/modules

2_PACKAGE_REFPOLICY_NAME)/contexts/files

exts/files/file_contexts.local

I have removed the modular policy option in the new set of patches.

Thank you so much for the feedback!

Bryce Ferguson
Software Engineer
Airborne Information Solutions \ Secure Platforms

400 Collins Rd NE Cedar Rapids, Iowa 52498

Bryce.Ferguson at rockwellcollins.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.busybox.net/pipermail/buildroot/attachments/20170105/62137b3a/attachment.html>

From: Niranjan <[email protected]>

This patch creates system-auth.pamd file for pam services and adds host-linux-pam variant for creating pam.d files.

---
Changes v12 -> v13:
- No changes

Changes v11 -> v12:
- No changes

Changes v10 -> v11:
- Added host-linux-pam variant as it is the dependency for creating pam_conv1 files.
- Removed semicolon at the end of if condition (after fi).
- Merged system auth patch with host selinux dependencies patch

Changes v9 -> v10:
- Dropped host linux-pam variant,optional selinux and audit dependencies and created seperate Patches (Suggedted by Thomas).

Changes v8 -> v9:
- No changes

Changes v7 -> v8:
- Removed sub-shell around the config file install block and refactored the block to use absolute paths for the copying (Suggested by Samuel)
- Changed the enable-db=no configure option to disable-db to be consistent with the rest of the configure options (Suggested by Samuel)

Changes v6 -> v7:
- Added missing host-pkgconf dependency and removed unneeded host-autoconf dependency(Clayton S.)

Changes v5 -> v6:
- No changes

Changes v4 -> v5:
- Dropping unneeded patch (Clayton S.)

Changes v1 -> v4:
- Did not exist

---
 package/linux-pam/linux-pam.mk     | 41 +++++++++++++++++++++++++++++++++++++-
 package/linux-pam/system-auth.pamd | 15 ++++++++++++++
 2 files changed, 55 insertions(+), 1 deletion(-)
 create mode 100644 package/linux-pam/system-auth.pamd

index 6ce3839..57c2be2 100644
@@ -8,15 +8,18 @@ LINUX_PAM_VERSION = 1.3.0
 LINUX_PAM_SOURCE = Linux-PAM-$(LINUX_PAM_VERSION).tar.bz2
 LINUX_PAM_SITE = http://linux-pam.org/library
 LINUX_PAM_INSTALL_STAGING = YES
+# disable cracklib in linux pam config options
 LINUX_PAM_CONF_OPTS = \
 	--disable-prelude \
 	--disable-isadir \
 	--disable-nis \
 	--disable-db \
+	--disable-cracklib \
 	--disable-regenerate-docu \
 	--enable-securedir=/lib/security \
 	--libdir=/lib
-LINUX_PAM_DEPENDENCIES = flex host-flex host-pkgconf
+# host-linux-pam is needed for creating pam conf files
+LINUX_PAM_DEPENDENCIES = flex host-flex host-pkgconf host-linux-pam
 LINUX_PAM_AUTORECONF = YES
 LINUX_PAM_LICENSE = BSD-3c
 LINUX_PAM_LICENSE_FILES = Copyright

@@ -48,6 +51,42 @@ define LINUX_PAM_INSTALL_CONFIG
 		$(TARGET_DIR)/etc/pam.d/other
 endef
 
+# Use the host-pam pam_conv1 app to create the pam.d files
+define LINUX_PAM_CONFIG_FILE_TARGET_INSTALL
+	if [ -d $(TARGET_DIR)/etc/pam.d/ ]; then \
+		mv $(TARGET_DIR)/etc/pam.d/ $(TARGET_DIR)/etc/pam.d.orig/; \
+	fi
+	cd $(TARGET_DIR)/etc/ && cat $(@D)/conf/pam.conf | $(HOST_DIR)/usr/bin/pam_conv1; \
+	if [ -d $(TARGET_DIR)/etc/pam.d.orig ]; then \
+		cp -a $(TARGET_DIR)/etc/pam.d/* $(TARGET_DIR)/etc/pam.d.orig/; \
+		rm -rf $(TARGET_DIR)/etc/pam.d/; \
+		mv $(TARGET_DIR)/etc/pam.d.orig/ $(TARGET_DIR)/etc/pam.d/; \
+	fi
+	$(INSTALL) -D -m 0644 package/linux-pam/system-auth.pamd $(TARGET_DIR)/etc/pam.d/system-auth
+endef
+
+LINUX_PAM_POST_INSTALL_TARGET_HOOKS += LINUX_PAM_CONFIG_FILE_TARGET_INSTALL
 LINUX_PAM_POST_INSTALL_TARGET_HOOKS += LINUX_PAM_INSTALL_CONFIG
 
+HOST_LINUX_PAM_DEPENDENCIES = host-flex host-pkgconf
+
+HOST_LINUX_PAM_CONF_OPTS = \
+	--disable-rpath \
+	--enable-read-both-confs \
+	--disable-regenerate-docu \
+	--disable-isadir \
+	--disable-nis \
+	--enable-securedir=/lib/security \
+	--disable-prelude \
+	--disable-cracklib \
+	--disable-lckpwdf \
+	--disable-db \
+	--disable-selinux \
+	--disable-audit \
+
+define HOST_LINUX_PAM_INSTALL_CMDS
+	$(INSTALL) -D -m 755 $(@D)/conf/pam_conv1/pam_conv1 $(HOST_DIR)/usr/bin/pam_conv1
+endef
+
 $(eval $(autotools-package))
+$(eval $(host-autotools-package))

new file mode 100644
index 0000000..2fa116a
@@ -0,0 +1,15 @@
+#%PAM-1.0
+auth        required      pam_env.so
+auth        sufficient    pam_unix.so
+auth        required      pam_deny.so
+
+account     required      pam_unix.so
+
+#password    required      pam_cracklib.so try_first_pass retry=3
+password    sufficient    pam_unix.so md5 shadow try_first_pass
+password    required      pam_deny.so
+
+session     optional      pam_keyinit.so revoke
+session     required      pam_limits.so
+session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
+session     required      pam_unix.so

1.9.1

When SELinux support is enabled, the login pam file installed by linux-pam should be adjusted to use the pam_selinux.so module.

To achieve this in a reasonably simple manner, we introduce the SELinux related lines in login.pam as comments, and if SELinux support is enabled, turn those commented lines into real lines.

---
 package/linux-pam/linux-pam.mk | 5 +++++
 package/linux-pam/login.pam    | 2 ++
 2 files changed, 7 insertions(+)

index 6ce3839..c8ba30f 100644
@@ -29,6 +29,10 @@ endif
 ifeq ($(BR2_PACKAGE_LIBSELINUX),y)
 LINUX_PAM_CONF_OPTS += --enable-selinux
 LINUX_PAM_DEPENDENCIES += libselinux
+define LINUX_PAM_SELINUX_PAMFILE_TWEAK
+	$(SED) 's/^# \(.*pam_selinux.so.*\)$$/\1/' \
+		$(TARGET_DIR)/etc/pam.d/login
+endef
 else
 LINUX_PAM_CONF_OPTS += --disable-selinux
 endif

@@ -46,6 +50,7 @@ define LINUX_PAM_INSTALL_CONFIG
 		$(TARGET_DIR)/etc/pam.d/login
 	$(INSTALL) -m 0644 -D package/linux-pam/other.pam \
 		$(TARGET_DIR)/etc/pam.d/other
+	$(LINUX_PAM_SELINUX_PAMFILE_TWEAK)
 endef
 
 LINUX_PAM_POST_INSTALL_TARGET_HOOKS += LINUX_PAM_INSTALL_CONFIG

index 01f5632..5df7db6 100644
@@ -4,7 +4,9 @@ account		required	pam_unix.so
 
 password	required	pam_unix.so nullok
 
+# session	required	pam_selinux.so close
 session		required	pam_limits.so
 session		required	pam_env.so
 session		required	pam_unix.so
 session		optional	pam_lastlog.so
+# session	required	pam_selinux.so open

2.7.4

Hello,

I've applied both patches. They have been tested by Bryce, and nobody objected to the approach.

Thomas

Thomas Petazzoni, CTO, Free Electrons
Embedded Linux, Kernel and Android engineering
http://free-electrons.com

Performed a build with this package enabled using the qemu selinux defconfig which is part of the outstanding v13 patchset found here:http://patchwork.ozlabs.org/bundle/UraniumKnight/rc_selinux_v13/. For the test, this was applied in the stead of PATCH 4/8
(http://patchwork.ozlabs.org/patch/686677/)

From: Matt Weber <[email protected]>

This patch adds optional libselinux support to the util-linux package, and also tweaks the PAM files instealled by util-linux to work properly in an SELinux context.

Like was done for linux-pam, the tweak is done by having the SELinux related lines commented out in the original PAM file, and uncommented when SELinux support is enabled.

---
 package/util-linux/su.pam        |  2 ++
 package/util-linux/util-linux.mk | 14 ++++++++++++++
 2 files changed, 16 insertions(+)

index f000c39..84b1860 100644
@@ -7,7 +7,9 @@ account		required	pam_unix.so
 
 password	required	pam_unix.so nullok
 
+# session	required	pam_selinux.so close
 session		required	pam_limits.so
 session		required	pam_env.so
 session		required	pam_unix.so
 session		optional	pam_lastlog.so
+# session	required	pam_selinux.so open

index cf03fd4..7140554 100644
@@ -63,6 +63,19 @@ endif
 UTIL_LINUX_CONF_ENV += LIBS="$(UTIL_LINUX_LIBS)"
 UTIL_LINUX_MAKE_OPTS += LIBS="$(UTIL_LINUX_LIBS)"
 
+ifeq ($(BR2_PACKAGE_LIBSELINUX),y)
+UTIL_LINUX_DEPENDENCIES += libselinux
+UTIL_LINUX_CONF_OPTS += --with-selinux
+define UTIL_LINUX_SELINUX_PAMFILES_TWEAK
+	$(foreach f,su su-l,
+		$(SED) 's/^# \(.*pam_selinux.so.*\)$$/\1/' \
+			$(TARGET_DIR)/etc/pam.d/$(f)
+	)
+endef
+else
+UTIL_LINUX_CONF_OPTS += --without-selinux
+endif
+
 # Used by cramfs utils
 UTIL_LINUX_DEPENDENCIES += $(if $(BR2_PACKAGE_ZLIB),zlib)
 

@@ -179,6 +192,7 @@ define UTIL_LINUX_INSTALL_PAMFILES
 		$(TARGET_DIR)/etc/pam.d/su
 	$(INSTALL) -m 0644 package/util-linux/su.pam \
 		$(TARGET_DIR)/etc/pam.d/su-l
+	$(UTIL_LINUX_SELINUX_PAMFILES_TWEAK)
 endef
 endif
 

2.7.4

Performed a build with this package enabled using the qemu selinux defconfig which is part of the outstanding v13 patchset found here:http://patchwork.ozlabs.org/bundle/UraniumKnight/rc_selinux_v13/. For the test, this was applied in the stead of PATCH 4/8
(http://patchwork.ozlabs.org/patch/686677/)

From: Matt Weber <[email protected]>

This patch adds optional libselinux ,audit and pam support to linux utilities.

---
Changes v12 -> v13:
- No changes

Changes v11 -> v12:
- No changes

Changes v10 -> v11:
- Comment added to explain how the SED expression writes to pam files.

Changes v9 -> v10:
- No changes

Changes v8 -> v9:
- No changes

Changes v7 -> v8:
- No changes

Changes v6 -> v7:
- No changes

Changes v5 -> v6:
- No changes

Changes v4 -> v5:
- Update the selinux busybox config to the latest version of busybox (Clayton S.)

Changes v1 -> v4:
- Did not exist

---
 package/util-linux/util-linux.mk | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

index bd6508c..934fe2f 100644
@@ -63,6 +63,20 @@ endif
 UTIL_LINUX_CONF_ENV += LIBS="$(UTIL_LINUX_LIBS)"
 UTIL_LINUX_MAKE_OPTS += LIBS="$(UTIL_LINUX_LIBS)"
 
+ifeq ($(BR2_PACKAGE_LIBSELINUX),y)
+UTIL_LINUX_DEPENDENCIES += libselinux
+UTIL_LINUX_CONF_OPTS += --with-selinux
+else
+UTIL_LINUX_CONF_OPTS += --without-selinux
+endif
+
+ifeq ($(BR2_PACKAGE_AUDIT),y)
+UTIL_LINUX_DEPENDENCIES += audit
+UTIL_LINUX_CONF_OPTS += --with-audit
+else
+UTIL_LINUX_CONF_OPTS += --without-audit
+endif
+
 # Used by cramfs utils
 UTIL_LINUX_DEPENDENCIES += $(if $(BR2_PACKAGE_ZLIB),zlib)
 

@@ -179,9 +193,25 @@ define UTIL_LINUX_INSTALL_PAMFILES
 	$(INSTALL) -m 0644 package/util-linux/su.pam \
 		$(TARGET_DIR)/etc/pam.d/su-l
 endef
+
+# Add the required hooks to the pam files if SELinux is enabled
+# SED expression adds these lines to /etc/pam.d/login,/etc/pam.d/su-l and /etc/pam.d/su files
+#   session		required	pam_selinux.so close
+#   session		required	pam_selinux.so open
+ifeq ($(BR2_PACKAGE_LIBSELINUX),y)
+define UTIL_LINUX_FIXUP_PAMFILES
+	for file in login su su-l ; do \
+		$(SED) '/selinux/d' $(TARGET_DIR)/etc/pam.d/$${file}; \
+		$(SED) '0,/session/s/session/session		required	pam_selinux.so close\nsession/' $(TARGET_DIR)/etc/pam.d/$${file}; \
+		echo "session		required	pam_selinux.so open" >> $(TARGET_DIR)/etc/pam.d/$${file}; \
+	done
+endef
+endif
+
 endif
 
 UTIL_LINUX_POST_INSTALL_TARGET_HOOKS += UTIL_LINUX_INSTALL_PAMFILES
+UTIL_LINUX_POST_INSTALL_TARGET_HOOKS += UTIL_LINUX_FIXUP_PAMFILES
 
 # Install agetty->getty symlink to avoid breakage when there's no busybox
 ifeq ($(BR2_PACKAGE_UTIL_LINUX_AGETTY),y)

1.9.1

Hello,

Hello,

There are a few things I don't like in this patch. I'm going to submit two alternative patches as a replacement. I'm interested in your feedback about those replacement patches (especially if they work fine for you).

Thomas Petazzoni, CTO, Free Electrons
Embedded Linux and Kernel engineering
http://free-electrons.com

Hello,

Instead of this patch, we have applied commit 373b7efdb308fcb7607cbef63ee4d2644b46136f, which serves the same purpose. So I've marked this patch as Rejected in patchwork.

Best regards,

Thomas

Thomas Petazzoni, CTO, Free Electrons
Embedded Linux, Kernel and Android engineering
http://free-electrons.com

From: Clayton Shotwell <[email protected]>

The individual binaries option of busybox allows for the applets that would usually be symlinks to be built as individual applications that link against a shared library.

This feature is needed for SELinux to allow the applications to run under the correct SELinux context.

The patch being added allows the individual applications to be installed and will be upstreamed to the busybox developers.

The initial work for this change was done by Thomas Petazzoni <[email protected]>.

---
Changes v12 -> v13:
- Fixed indentation issue in makedevs.c line:590

Changes v11 -> v12:
- No changes

Changes v10 -> v11:
- Removed BUSYBOX_MAKEDEV_PERMISSIONS logic and added all 12 applets to BUSYBOX_PERMISSIONS variable.
- Changed makedevs.c file to ignore optional files with type=F ( files which does not exist).

Changes v9 -> v10:
- Removed 0002-applets-Add-installation-of-individual-binaries.patch as it was upstreamed.

Changes v8 -> v9:
- No changes

Changes v7 -> v8:
- Changed individual binaries comment to be !BR2_bfin (Suggested by Samuel)

Changes v6 -> v7:
- No changes

Changes v5 -> v6:
- No changes

Changes v4 -> v5:
- Renamed to follow latest patch naming convention (Matt W.)
- Updated to use BR2_STATIC_LIBS instead of old PREFERRED (Matt W.)
- Added depends to make sure bfin can't build shared lib busybox lib for individual binary use. Looks like shared lib creation doesn't error out but the objects don't get placed into the elf. Then the trylink fails on linking the first individual applet. (Matt W.)
- Made suid permissions setting dynamic for applets actually being installed (Clayton S.)

Changes v1 -> v4:
- Did not exist

---
 package/busybox/Config.in   |  9 +++++++++
 package/busybox/busybox.mk  | 40 ++++++++++++++++++++++++++++++++++++++++
 package/makedevs/makedevs.c |  2 ++
 3 files changed, 51 insertions(+)

index 7ef3f0e..d4c85b0 100644
@@ -54,6 +54,15 @@ config BR2_PACKAGE_BUSYBOX_SELINUX
 	  crond, then individual binaries have to be enabled for the
 	  SELinux type transitions to occur properly.
 
+config BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES
+	bool "Individual binaries"
+	depends on !BR2_STATIC_LIBS
+	depends on !BR2_bfin # libbusybox.so link issue
+
+comment "Busybox individual binaries depends on dynamic libraries"
+	depends on BR2_STATIC_LIBS
+	depends on !BR2_bfin
+
 config BR2_PACKAGE_BUSYBOX_WATCHDOG
 	bool "Install the watchdog daemon startup script"
 	help

index fc23a90..7d14209 100644
@@ -54,9 +54,36 @@ BUSYBOX_KCONFIG_FRAGMENT_FILES = $(call qstrip,$(BR2_PACKAGE_BUSYBOX_CONFIG_FRAG
 BUSYBOX_KCONFIG_EDITORS = menuconfig xconfig gconfig
 BUSYBOX_KCONFIG_OPTS = $(BUSYBOX_MAKE_OPTS)
 
+ifeq ($(BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES),y)
+define BUSYBOX_PERMISSIONS
+	/usr/share/udhcpc/default.script f 755  0  0 - - - - -
+# Set permissions on all applets with BB_SUID_REQUIRE and BB_SUID_MAYBE.
+# 12 Applets are pulled from applets.h using grep command :
+#  grep -r -e "APPLET.*BB_SUID_REQUIRE\|APPLET.*BB_SUID_MAYBE" \
+#  $(@D)/include/applets.h 
+#  o/p:  
+#   wall,ping,ping6,crontab,findfs,login,mount,passwd,su,traceroute 
+#   traceroute6 and vlock.
+# These applets are added to the device table and the makedev file
+# ignores the files with type 'F' ( optional files).
+	/usr/bin/wall 			 F 4755 0  0 - - - - -
+	/bin/ping 			 f 4755 0  0 - - - - -
+	/bin/ping6 			 F 4755 0  0 - - - - -
+	/usr/bin/crontab 		 f 4755 0  0 - - - - -
+	/sbin/findfs 			 F 4755 0  0 - - - - -
+	/bin/login 			 F 4755 0  0 - - - - -
+	/bin/mount 			 f 4755 0  0 - - - - -
+	/usr/bin/passwd 		 F 4755 0  0 - - - - -
+	/bin/su 			 F 4755 0  0 - - - - -
+	/usr/bin/traceroute 		 f 4755 0  0 - - - - -
+	/usr/bin/traceroute6 		 F 4755 0  0 - - - - -
+	/usr/bin/vlock 			 F 4755 0  0 - - - - -
+endef
+else
 define BUSYBOX_PERMISSIONS
 	/bin/busybox                     f 4755 0  0 - - - - -
 endef
+endif
 
 # If mdev will be used for device creation enable it and copy S10mdev to /etc/init.d
 ifeq ($(BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_MDEV),y)

@@ -164,6 +191,17 @@ define BUSYBOX_SET_SELINUX
 endef
 endif
 
+ifeq ($(BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES),y)
+define BUSYBOX_CONFIGURE_INDIVIDUAL_BINARIES
+	$(call KCONFIG_ENABLE_OPT,CONFIG_BUILD_LIBBUSYBOX,$(BUSYBOX_BUILD_CONFIG))
+	$(call KCONFIG_ENABLE_OPT,CONFIG_FEATURE_INDIVIDUAL,$(BUSYBOX_BUILD_CONFIG))
+endef
+
+define BUSYBOX_INSTALL_INDIVIDUAL_BINARIES
+	rm -f $(TARGET_DIR)/bin/busybox
+endef
+endif
+
 define BUSYBOX_INSTALL_LOGGING_SCRIPT
 	if grep -q CONFIG_SYSLOGD=y $(@D)/.config; then \
 		$(INSTALL) -m 0755 -D package/busybox/S01logging \

@@ -221,6 +259,7 @@ define BUSYBOX_KCONFIG_FIXUP_CMDS
 	$(BUSYBOX_SET_INIT)
 	$(BUSYBOX_SET_WATCHDOG)
 	$(BUSYBOX_SET_SELINUX)
+	$(BUSYBOX_CONFIGURE_INDIVIDUAL_BINARIES)
 	$(BUSYBOX_MUSL_TWEAKS)
 endef
 

@@ -244,6 +283,7 @@ define BUSYBOX_INSTALL_INIT_SYSV
 	$(BUSYBOX_INSTALL_LOGGING_SCRIPT)
 	$(BUSYBOX_INSTALL_WATCHDOG_SCRIPT)
 	$(BUSYBOX_INSTALL_TELNET_SCRIPT)
+	$(BUSYBOX_INSTALL_INDIVIDUAL_BINARIES)
 endef
 
 # Checks to give errors that the user can understand

index cacb144..0909e2d 100644
@@ -587,6 +587,8 @@ int main(int argc, char **argv)
 				ret = EXIT_FAILURE;
 				goto loop;
 			}
+		} else if (type == 'F') {
+           continue; /*Ignore optional files*/
 		} else if (type == 'r') {
 			recursive_uid = uid;
 			recursive_gid = gid;

1.9.1

From: Clayton Shotwell <[email protected]>

This will build a base SELinux system that boots with SELinux in permissive mode. Also adding documentation on how to use it.

---
Changes v12 -> v13:
- Bump kernel to 4.8
- Fixed error in fragment config line: 6 (ONFIG_EXT2_FS -> CONFIG_EXT2_FS)

Changes v11 -> v12:
- Bump kernel to 4.6
- Renamed fragment config to be 4.x vs 4.0

Changes v10 -> v11:
- Removed configs BR2_ROOTFS_XXX (post build script,device table and overlay) from this patch and added these configs to another patch (common-selinux-support-files.patch)
- Included configuration BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES in defconfig.

Changes v9 -> v10:
- Changed version number of QEMU from 2.2.1 to 2.3.0

Changes v8 -> v9:
- No changes

Changes v7 -> v8:
- No changes

Changes v6 -> v7:
- No changes

Changes v5 -> v6:
- No changes

Changes v4 -> v5:
- Update the qemu_x86_defconfig to the 4.0 kernel series (Clayton S.)

Changes v1 -> v4:
- Did not exist

---
 board/qemu/x86/linux-4.x-selinux.config | 19 +++++++++++++++++++
 board/qemu/x86/readme.txt               | 17 +++++++++++++++++
 configs/qemu_x86_selinux_defconfig      | 31 +++++++++++++++++++++++++++++++
 3 files changed, 67 insertions(+)
 create mode 100644 board/qemu/x86/linux-4.x-selinux.config
 create mode 100644 configs/qemu_x86_selinux_defconfig

new file mode 100644
index 0000000..6c715f0
@@ -0,0 +1,19 @@
+CONFIG_AUDIT=y
+CONFIG_MODULES=y
+CONFIG_IP_PNP=y
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
+CONFIG_EXT2_FS=y
+CONFIG_EXT2_FS_XATTR=y
+CONFIG_EXT2_FS_POSIX_ACL=y
+CONFIG_EXT2_FS_SECURITY=y
+CONFIG_EXT3_FS=y
+CONFIG_EXT3_FS_POSIX_ACL=y
+CONFIG_EXT3_FS_SECURITY=y
+CONFIG_NFS_FS=y
+CONFIG_ROOT_NFS=y
+CONFIG_SECURITY=y
+CONFIG_SECURITY_NETWORK=y
+CONFIG_SECURITY_SELINUX=y
+CONFIG_SECURITY_SELINUX_BOOTPARAM=y
+CONFIG_CRYPTO_ANSI_CPRNG=y

index 4f2e4c7..f7bf256 100644
@@ -7,3 +7,20 @@ Optionally add -smp N to emulate a SMP system with N CPUs.
 The login prompt will appear in the graphical window.
 
 Tested with QEMU 2.5.0
+
+-------------------------------------------------------------------
+
+Run the SElinux target emulation with:
+
+  qemu-system-i386 -M pc -kernel output/images/bzImage -drive file=output/images/rootfs.ext2,if=ide -append "root=/dev/sda rw console=ttyS0 selinux=1" -net nic,model=rtl8139 -net user -display none -serial stdio
+
+The emulation should reboot once the first time for relabeling and
+then provide a login prompt. The login is username root and password
+root because PAM requires a password in this secure configuration. To
+enable SELinux enforcing at boot, login and edit the
+/etc/selinux/config and set SELINUX to enforcing. Save and make sure
+to "sync" before restarting the emulation as the ext2 fs would
+otherwise corrupt when the emulation exits. After enforcing is
+default, the selinux= provided as part of the qemu "append" above can
+be used to turn enforcing on/off. This configuration would be tailored
+as part of a targets refpolicy customization.

new file mode 100644
index 0000000..ebfe4ca
@@ -0,0 +1,31 @@
+BR2_x86_pentiumpro=y
+
+# Internal tool chain glibc
+BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_4_8=y
+BR2_TOOLCHAIN_BUILDROOT_GLIBC=y
+
+# Select SYSV init to provide selinux enabled init
+BR2_INIT_SYSV=y
+BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt board/common_selinux/skeleton_permissions.txt"
+BR2_TARGET_GENERIC_ROOT_PASSWD="root"
+BR2_ROOTFS_OVERLAY="board/common_selinux/skeleton"
+BR2_ROOTFS_POST_BUILD_SCRIPT="board/common_selinux/post_build.sh"
+BR2_LINUX_KERNEL=y
+BR2_LINUX_KERNEL_CUSTOM_VERSION=y
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="4.8"
+BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
+BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="board/qemu/x86/linux-4.8.config"
+BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="board/qemu/x86/linux-4.x-selinux.config"
+
+# Ensure busybox is built as individual binaries for the
+# SELinux refpolicy to work correctly
+BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES=y
+BR2_PACKAGE_OPENSSH=y
+BR2_PACKAGE_REFPOLICY=y
+BR2_PACKAGE_RSYSLOG=y
+BR2_PACKAGE_UTIL_LINUX=y
+BR2_PACKAGE_UTIL_LINUX_BINARIES=y
+BR2_PACKAGE_UTIL_LINUX_LOGIN_UTILS=y
+BR2_TARGET_ROOTFS_EXT2=y
+BR2_TARGET_ROOTFS_EXT2_RESBLKS=5
+BR2_PACKAGE_HOST_CHECKPOLICY=y

1.9.1

From: Matt Weber <[email protected]>

Add a default busybox SELinux config which disables init and uses sysvinit. Add base skeleton with inittab and fstab tailored to selinux Add base skeleton audit configuration (didn't seem to merit being the package default).

---
Changes v12 -> v13:
- Converted busybox config to fragment config (busybox-selinux-fragment.config)

Changes v11 -> v12:
- No changes

Changes v10 -> v11:
- Added defconfig selinux specific file overlay and busybox config files to this patch as these are introduced in this patch (Suggested by Thomas).

Changes v9 -> v10:
- No changes

Changes v8 -> v9:
- No changes

Changes v7 -> v8:
- No changes

Changes v6 -> v7:
- No changes

Changes v5 -> v6:
- No changes

Changes v4 -> v5:
- Update the selinux busybox config to the latest version of busybox (Clayton S.)

Changes v1 -> v4:
- Did not exist

---
 .../common_selinux/busybox-selinux-fragment.config | 32 ++++++++++++++++++++++
 board/common_selinux/post_build.sh                 | 30 ++++++++++++++++++++
 .../common_selinux/skeleton/etc/audit/auditd.conf  | 32 ++++++++++++++++++++++
 .../skeleton/etc/audit/rules.d/audit.rules         |  3 ++
 board/common_selinux/skeleton/etc/fstab            | 15 ++++++++++
 board/common_selinux/skeleton/etc/inittab          | 29 ++++++++++++++++++++
 board/common_selinux/skeleton_permissions.txt      | 26 ++++++++++++++++++
 configs/qemu_x86_selinux_defconfig                 | 10 +++++++
 8 files changed, 177 insertions(+)
 create mode 100644 board/common_selinux/busybox-selinux-fragment.config
 create mode 100755 board/common_selinux/post_build.sh
 create mode 100644 board/common_selinux/skeleton/etc/audit/auditd.conf
 create mode 100644 board/common_selinux/skeleton/etc/audit/rules.d/audit.rules
 create mode 100755 board/common_selinux/skeleton/etc/fstab
 create mode 100755 board/common_selinux/skeleton/etc/inittab
 create mode 100755 board/common_selinux/skeleton_permissions.txt

new file mode 100644
index 0000000..7222fac
@@ -0,0 +1,32 @@
+CONFIG_BUILD_LIBBUSYBOX=y
+CONFIG_CHCON=y
+CONFIG_DEFAULT_DEPMOD_FILE=""
+CONFIG_DEFAULT_MODULES_DIR=""
+CONFIG_FATATTR=y
+CONFIG_FEATURE_BASH_IS_ASH=y
+CONFIG_FEATURE_CHCON_LONG_OPTIONS=y
+CONFIG_FEATURE_DEFAULT_PASSWD_ALGO=""
+CONFIG_FEATURE_FIND_INUM=y
+CONFIG_FEATURE_HAVE_RPC=y
+CONFIG_FEATURE_INDIVIDUAL=y
+CONFIG_FEATURE_LAST_SMALL=y
+CONFIG_FEATURE_MOUNT_HELPERS=y
+CONFIG_FEATURE_MOUNT_LABEL=y
+CONFIG_FEATURE_MOUNT_NFS=y
+CONFIG_FEATURE_MOUNT_VERBOSE=y
+CONFIG_FEATURE_RUNCON_LONG_OPTIONS=y
+CONFIG_FEATURE_SWAPON_DISCARD=y
+CONFIG_FEATURE_SYSLOGD_READ_BUFFER_SIZE=0
+CONFIG_FEATURE_TAR_SELINUX=y
+CONFIG_FEATURE_TOUCH_NODEREF=y
+CONFIG_FIRST_SYSTEM_ID=0
+CONFIG_GROUPS=y
+CONFIG_INIT_TERMINAL_TYPE=""
+CONFIG_LAST_ID=0
+CONFIG_LAST_SYSTEM_ID=0
+CONFIG_PAM=y
+CONFIG_RUNCON=y
+CONFIG_SELINUXENABLED=y
+CONFIG_SELINUX=y
+CONFIG_SHUF=y
+CONFIG_USERS=y

new file mode 100755
index 0000000..3509de9
@@ -0,0 +1,30 @@
+#!/bin/bash
+################################################################################
+#
+# DESCRIPTION:
+#     This script will do any "post-build" steps (after all packages are built
+#     but before image creation). Any filesystem permission issues should be
+#     fixed in this script.
+#
+#     The script requires following variables to be passed into it.
+#        $1 - the target directory (passed in by default by buildroot if
+#             script is BR2_ROOTFS_POST_BUILD_SCRIPT)
+#
+################################################################################
+
+DEST_DIR=$1
+
+# For SELinux targets, the /var directory symlinks need to be removed
+# and replaced with actual folders. The removal is done here and the
+# recreation is done in the permissions file for the common_selinux
+# local_skeleton
+for link in ${DEST_DIR}/var/{cache,lock,log,run,spool,tmp} ${DEST_DIR}/var/lib/misc; do
+	if [ -h ${link} ]; then
+		echo "Removing symlink ${link}"
+		unlink ${link}
+	fi
+done
+
+# Replace the /run folder with a symlink to /var/run
+rm -rf ${DEST_DIR}/run
+ln -sf -t ${DEST_DIR} run var/run

new file mode 100644
index 0000000..039b7f0
@@ -0,0 +1,32 @@
+#
+# This file controls the configuration of the audit daemon
+#
+
+log_file = /var/log/audit/audit.log
+log_format = RAW
+log_group = root
+priority_boost = 4
+flush = INCREMENTAL
+freq = 20
+num_logs = 5
+disp_qos = lossy
+dispatcher = /usr/sbin/audispd
+name_format = NONE
+##name = mydomain
+max_log_file = 6 
+max_log_file_action = ROTATE
+space_left = 75
+space_left_action = IGNORE
+action_mail_acct = root
+admin_space_left = 50
+admin_space_left_action = IGNORE
+disk_full_action = IGNORE
+disk_error_action = IGNORE
+##tcp_listen_port = 
+tcp_listen_queue = 5
+tcp_max_per_addr = 1
+##tcp_client_ports = 1024-65535
+tcp_client_max_idle = 0
+enable_krb5 = no
+krb5_principal = auditd
+##krb5_key_file = /etc/audit/audit.key

new file mode 100644
index 0000000..7c90606
@@ -0,0 +1,3 @@
+-D
+-b 1024
+-e 2

new file mode 100755
index 0000000..d772349
@@ -0,0 +1,15 @@
+# /etc/fstab: static file system information.
+#
+# <file system> <mount pt>     <type>    <options>                      <dump> <pass>
+/dev/root       /              ext3      rw,noauto                       0      1
+proc            /proc          proc      defaults                        0      0
+devpts          /dev/pts       devpts    defaults,gid=5,mode=620         0      0
+tmpfs           /dev/shm       tmpfs     mode=0700,nodev,nosuid,noexec,size=1M    0      0
+tmpfs           /tmp           tmpfs     mode=0700,nodev,nosuid,noexec,size=200M  0      0
+tmpfs           /var/cache     tmpfs     mode=0700,nodev,nosuid,noexec,size=1M    0      0
+tmpfs           /var/lock      tmpfs     mode=0700,nodev,nosuid,noexec,size=1M    0      0
+tmpfs           /var/log       tmpfs     mode=0700,nodev,nosuid,noexec,size=50M   0      0
+tmpfs           /var/run       tmpfs     mode=0700,nodev,nosuid,noexec,size=1M    0      0
+tmpfs           /var/spool     tmpfs     mode=0700,nodev,nosuid,noexec,size=1M    0      0
+sysfs           /sys           sysfs     defaults                 0      0
+none            /selinux       selinuxfs noauto                   0      0

new file mode 100755
index 0000000..05e05b2
@@ -0,0 +1,29 @@
+# /etc/inittab
+#
+# This inittab is a basic inittab sample for sysvinit, which mimics
+# Buildroot's default inittab for BusyBox.
+id:1:initdefault:
+
+proc::sysinit:/bin/mount -t proc proc /proc
+sysf::sysinit:/bin/mount -t sysfs sysfs /sys
+dpts::sysinit:/bin/mkdir -p /dev/pts -Z `matchpathcon -n /dev/pts`
+dshm::sysinit:/bin/mkdir -p /dev/shm -Z `matchpathcon -n /dev/shm`
+mpts::sysinit:/bin/mkdir -p /dev/pts
+mshm::sysinit:/bin/mkdir -p /dev/shm
+fsck::sysinit:/sbin/fsck -ARy
+moun::sysinit:/bin/mount -a
+host::sysinit:/bin/hostname -F /etc/hostname
+
+# now run any rc scripts
+init::bootwait:/etc/init.d/rcS
+
+S0::respawn:/sbin/getty -L  ttyS0 115200 vt100 # GENERIC_SERIAL
+
+# Stuff to do before rebooting
+shd0:06:wait:/etc/init.d/rcK
+shd1:06:wait:/sbin/swapoff -a
+shd2:06:wait:/bin/umount -a -r
+
+# The usual halt or reboot actions
+lt0:0:wait:/sbin/halt -dhp
+reb0:6:wait:/sbin/reboot

new file mode 100755
index 0000000..374adbc
@@ -0,0 +1,26 @@
+################################################################################
+#
+# See <buildroot-source>/package/makedevs/README for details
+#
+# This device table is used to assign proper ownership and permissions
+# on the files in the local-skeleton directory. It doesn't create any device
+# file, as it is used in both static device configurations (where /dev/ is static)
+# and in dynamic configurations (where devtmpfs, mdev or udev are used).
+#
+# <name>				<type>	<mode>	<uid>	<gid>	<major>	<minor>	<start>	<inc>	<count>
+
+# All the necessary file permissions for /etc
+/etc/audit/auditd.conf			f	644	0	0	-	-	-	-	-
+/etc/audit/rules.d/audit.rules		f	644	0	0	-	-	-	-	-
+/etc/fstab				f	644	0	0	-	-	-	-	-
+/etc/inittab				f	644	0	0	-	-	-	-	-
+
+# Setup entries for all of the /var/* directories that need proper
+# mount points
+/var/cache				d	755	0	0	-	-	-	-	-
+/var/lib/misc				d	755	0	0	-	-	-	-	-
+/var/lock				d	755	0	0	-	-	-	-	-
+/var/log				d	755	0	0	-	-	-	-	-
+/var/run				d	755	0	0	-	-	-	-	-
+/var/spool				d	755	0	0	-	-	-	-	-
+/var/tmp				d	755	0	0	-	-	-	-	-

index ebfe4ca..54e9142 100644
@@ -17,6 +17,16 @@ BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="board/qemu/x86/linux-4.8.config"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="board/qemu/x86/linux-4.x-selinux.config"
 
+# Customized busybox config providing a tailored
+# balance of applets vs full apps
+BR2_PACKAGE_BUSYBOX_CONFIG_FRAGMENT_FILES="board/common_selinux/busybox-selinux-fragment.config"
+
+# Pull in SELinux specific file overlay to allow login
+# in enforcing mode.
+BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt board/common_selinux/skeleton_permissions.txt"
+BR2_ROOTFS_OVERLAY="board/common_selinux/skeleton"
+BR2_ROOTFS_POST_BUILD_SCRIPT="board/common_selinux/post_build.sh"
+
 # Ensure busybox is built as individual binaries for the
 # SELinux refpolicy to work correctly
 BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES=y

1.9.1

From: Matt Weber <[email protected]>

Ignore the creation of a symlink when individual binaries are used.

---
Changes v12 -> v13:
- No changes

Changes v11 -> v12:
- Added a comment " allow busybox shell binary to remain when symlink are enabled"

Changes v1 -> v11:
- No changes

---
 package/skeleton/skeleton.mk | 4 ++++
 1 file changed, 4 insertions(+)

index 1000161..40ac3b1 100644
@@ -203,10 +203,14 @@ define SKELETON_BIN_SH
 	rm -f $(TARGET_DIR)/bin/sh
 endef
 else
+#Allow a busybox shell binary to remain and not get replaced by a symlink 
+#if individual binaries are enabled
+ifeq ($(BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES),)
 define SKELETON_BIN_SH
 	ln -sf $(SKELETON_TARGET_GENERIC_BIN_SH) $(TARGET_DIR)/bin/sh
 endef
 endif
+endif
 TARGET_FINALIZE_HOOKS += SKELETON_BIN_SH
 
 ifeq ($(BR2_TARGET_GENERIC_GETTY),y)

1.9.1

Hello,

I've applied your patch to master, with the following changes:

[Thomas:
- Move the Config.in comment at the top of the Config.in file rather than between the main option and its sub-options, as this breaks menuconfig indentation.
- Fix the propagation of the libsemanage dependencies. libsemanage depends on BR2_PACKAGE_AUDIT_ARCH_SUPPORTS and BR2_TOOLCHAIN_USES_GLIBC which were not accounted for. Since it depends on BR2_TOOLCHAIN_USES_GLIBC, then all the gettext related handling becomes useless and has been removed.
- Rename the prompt of the restorecond sub-option to just "restorecond".
- Use TARGET_CONFIGURE_OPTS and HOST_CONFIGURE_OPTS instead of passing LDFLAGS, CC, etc. manually.
- Use make "foreach" function for loops instead of shell "for" loops.
- Rework the explanation of why we're passing DESTDIR at build time.
- Minor formatting tweaks here and there.]

I've also added Clayton as the contact in the DEVELOPERS file for this package. If this is not correct, please send another patch to fix that up. We really want your help to fix build issues that may arise from this package.

Also, could you please have a look at what I answered to:

[PATCH v13 4/8] util-linux: selinux, audit, and pam support

and look at the alternative proposals I made:

https://patchwork.ozlabs.org/patch/703332/
https://patchwork.ozlabs.org/patch/703333/

Thanks,

Thomas

Thomas Petazzoni, CTO, Free Electrons
Embedded Linux, Kernel and Android engineering
http://free-electrons.com

Thomas,

Clayton is still a good contact and if not we'll update.

Definitely will be watching the autobuilder. I'm currently looking at a issue with "-D_FILE_OFFSET_BITS==64"

I'll let Bryce follow up on these.

Thanks!

Matthew L Weber / Pr Software Engineer
Airborne Information Systems / Security Systems and Software / Secure Platforms
MS 131-100, C Ave NE, Cedar Rapids, IA, 52498, USA
www.rockwellcollins.com

Note: Any Export License Required Information and License Restricted
Third Party Intellectual Property (TPIP) content must be encrypted and
sent to matthew.weber at corp.rockwellcollins.com.

Hello,

I will perform a test build with these patches and provide tested-by feedback. I think we will want to use these patches instead of [PATCH v13 4/8]. So, to confirm, I will remove that patch completely as yours will supersede it, correct?

Thanks

Bryce Ferguson
Software Engineer
Airborne Information Solutions \ Secure Platforms

400 Collins Rd NE Cedar Rapids, Iowa 52498

Bryce.Ferguson at rockwellcollins.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.busybox.net/pipermail/buildroot/attachments/20161212/f4273781/attachment.html>

Hello,

Yes, that's the idea. Thanks for the feedback.

Also, I'm on IRC #buildroot, usually starting from 9/9:30 PM CET, which should conveniently fall into the afternoon for you. It would be great if a few folks interested in SELinux in Buildroot on your side could be on IRC so we can quickly exchange on how to move forward with this.

Thanks!

Thomas

Thomas Petazzoni, CTO, Free Electrons
Embedded Linux and Kernel engineering
http://free-electrons.com