makedevs: support optional files
PATCH v14 1/4 makedevs: support optional files
Add the 'F' file type to makedevs, that allows a file to be optional. With this option, the line is just silently skipped if the file doesn't exist (or is not a regular file).
This is useful for _PERMISSIONS where the file can be configured out by package-specific configuration that is not directly handled by Buildroot, like busybox.
---
v14:
- Split off the makedevs change in a separate patch.
- Fix it - AFAICS, the original patch would just skip all F lines.
--- package/makedevs/makedevs.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
package/makedevs/makedevs.c +4 -1
@@ -570,9 +570,12 @@ int main(int argc, char **argv) ret =EXIT_FAILURE ; goto loop; } - }else if (type =='f' ) { + }else if (type =='f' || type =='F' ) {struct stat st;if ((stat (full_name, &st) <0 || !S_ISREG (st.st_mode))) { +if (type =='F' ) { +continue ;/*Ignore optional files*/ + }bb_perror_msg ("line %d: regular file '%s' does not exist" , linenum, full_name); ret =EXIT_FAILURE ; goto loop;
Signature · 1 line
2.13.2
PATCH v14 2/4 busybox: applets as individual binaries
From: Clayton Shotwell <[email protected]>
The individual binaries option of busybox allows for the applets that would usually be symlinks to be built as individual applications that link against a shared library.
This feature is needed for SELinux to allow the applications to run under the correct SELinux context.
The patch being added allows the individual applications to be installed and will be upstreamed to the busybox developers.
The initial work for this change was done by Thomas Petazzoni <[email protected]>.
[Thomas:
- add help text in Config.in option.
- rename BUSYBOX_CONFIGURE_INDIVIDUAL_BINARIES to BUSYBOX_SET_INDIVIDUAL_BINARIES to be consistent with other variables.
- call BUSYBOX_INSTALL_INDIVIDUAL_BINARIES in BUSYBOX_INSTALL_TARGET_CMDS, not in BUSYBOX_INSTALL_INIT_SYSV.]
[Arnout:
- revert to the "optional file" approach in makedevs;
- reword Config.in comment text to match our usual pattern;
- abbreviate comment about how suid applets are found a little;
- all applets are optional (each one may have been unselected from the busybox config).]
---
v14:
- revert to the "optional file" approach in makedevs;
- reword Config.in comment text to match our usual pattern;
- abbreviate comment about how suid applets are found a little;
- all applets are optional (each one may have been unselected from the busybox config).
--- package/busybox/Config.in | 16 ++++++++++++++++ package/busybox/busybox.mk | 37 +++++++++++++++++++++++++++++++++++++ 2 files changed, 53 insertions(+)
package/busybox/Config.in +16 -0
@@ -56,6 +56,22 @@ config BR2_PACKAGE_BUSYBOX_SELINUX crond, then individual binaries have to be enabled for the SELinux type transitions to occur properly. +config BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES + bool "Individual binaries" + depends on !BR2_STATIC_LIBS + depends on !BR2_bfin # libbusybox.so link issue + help + By default (i.e with this option disabled), Busybox is + installed as a single binary in /bin/busybox and all applets + are a symbolic link to /bin/busybox. + + With this option enabled, each applet is a separate binary, + which is needed for proper operation with SELinux. + +comment "Busybox individual binaries need a toolchain w/ dynamic library" + depends on BR2_STATIC_LIBS + depends on !BR2_bfin + config BR2_PACKAGE_BUSYBOX_WATCHDOG bool "Install the watchdog daemon startup script" help
package/busybox/busybox.mk +37 -0
@@ -60,9 +60,33 @@ BUSYBOX_KCONFIG_FRAGMENT_FILES = $(call qstrip,$(BR2_PACKAGE_BUSYBOX_CONFIG_FRAG BUSYBOX_KCONFIG_EDITORS = menuconfig xconfig gconfig BUSYBOX_KCONFIG_OPTS = $(BUSYBOX_MAKE_OPTS) +ifeq ($(BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES),y) +define BUSYBOX_PERMISSIONS + /usr/share/udhcpc/default.script f 755 0 0 - - - - - +# Set permissions on all applets with BB_SUID_REQUIRE and BB_SUID_MAYBE. +# 12 Applets are pulled from applets.h using grep command : +# grep -r -e "APPLET.*BB_SUID_REQUIRE\|APPLET.*BB_SUID_MAYBE" \ +# $(@D)/include/applets.h +# These applets are added to the device table and the makedev file +# ignores the files with type 'F' ( optional files). + /usr/bin/wall F 4755 0 0 - - - - - + /bin/ping F 4755 0 0 - - - - - + /bin/ping6 F 4755 0 0 - - - - - + /usr/bin/crontab F 4755 0 0 - - - - - + /sbin/findfs F 4755 0 0 - - - - - + /bin/login F 4755 0 0 - - - - - + /bin/mount F 4755 0 0 - - - - - + /usr/bin/passwd F 4755 0 0 - - - - - + /bin/su F 4755 0 0 - - - - - + /usr/bin/traceroute F 4755 0 0 - - - - - + /usr/bin/traceroute6 F 4755 0 0 - - - - - + /usr/bin/vlock F 4755 0 0 - - - - - +endef +else define BUSYBOX_PERMISSIONS /bin/busybox f 4755 0 0 - - - - - endef +endif # If mdev will be used for device creation enable it and copy S10mdev to /etc/init.d ifeq ($(BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_MDEV),y)
@@ -171,6 +195,17 @@ define BUSYBOX_SET_SELINUX endef endif +ifeq ($(BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES),y) +define BUSYBOX_SET_INDIVIDUAL_BINARIES + $(call KCONFIG_ENABLE_OPT,CONFIG_BUILD_LIBBUSYBOX,$(BUSYBOX_BUILD_CONFIG)) + $(call KCONFIG_ENABLE_OPT,CONFIG_FEATURE_INDIVIDUAL,$(BUSYBOX_BUILD_CONFIG)) +endef + +define BUSYBOX_INSTALL_INDIVIDUAL_BINARIES + rm -f $(TARGET_DIR)/bin/busybox +endef +endif + define BUSYBOX_INSTALL_LOGGING_SCRIPT if grep -q CONFIG_SYSLOGD=y $(@D)/.config; then \ $(INSTALL) -m 0755 -D package/busybox/S01logging \
@@ -228,6 +263,7 @@ define BUSYBOX_KCONFIG_FIXUP_CMDS $(BUSYBOX_SET_INIT) $(BUSYBOX_SET_WATCHDOG) $(BUSYBOX_SET_SELINUX) + $(BUSYBOX_SET_INDIVIDUAL_BINARIES) $(BUSYBOX_MUSL_TWEAKS) endef
@@ -251,6 +287,7 @@ define BUSYBOX_INSTALL_INIT_SYSV $(BUSYBOX_INSTALL_LOGGING_SCRIPT) $(BUSYBOX_INSTALL_WATCHDOG_SCRIPT) $(BUSYBOX_INSTALL_TELNET_SCRIPT) + $(BUSYBOX_INSTALL_INDIVIDUAL_BINARIES) endef # Checks to give errors that the user can understand
Signature · 1 line
2.13.2
PATCH v14 2/4 busybox: applets as individual binaries
Hello,
package/busybox/busybox.mk BUSYBOX_KCONFIG_FRAGMENT_FILES = $(call qstrip,$(BR2_PACKAGE_BUSYBOX_CONFIG_FRAG · line 65
Quoted 3 lines · Arnout Vandecappelle (Essensium/Mind)
package/busybox/busybox.mk +3
-0+ifeq ($(BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES),y) +define BUSYBOX_PERMISSIONS + /usr/share/udhcpc/default.script f 755 0 0 - - - - -
This shouldn't have been added by this patch, so I've dropped this line. And applied your patch. Thanks!
Thomas
Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons Embedded Linux and Kernel engineering http://free-electrons.com
PATCH v14 3/4 qemu x86 selinux: added common selinux support files
In reply to Arnout Vandecappelle (Essensium/Mind)From: Matt Weber <[email protected]>
Add a default busybox SELinux config which disables init and uses sysvinit. Add base skeleton with inittab and fstab tailored to selinux Add base skeleton audit configuration (didn't seem to merit being the package default).
[Arnout:
- Include linux-selinux-fragment.config in this patch already;
- Renamed a number of files/directories.]
---
v14:
- Reordered before adding the qemu_selinux defconfig that uses this stuff.
- Include linux-selinux-fragment.config in this patch already.
- Renamed a number of files/directories.
--- .../common_selinux/busybox-selinux-fragment.config | 32 ++++++++++++++++++++++ .../fs-overlay/etc/audit/auditd.conf | 32 ++++++++++++++++++++++ .../fs-overlay/etc/audit/rules.d/audit.rules | 3 ++ board/common_selinux/fs-overlay/etc/fstab | 15 ++++++++++ board/common_selinux/fs-overlay/etc/inittab | 29 ++++++++++++++++++++ board/common_selinux/linux-selinux-fragment.config | 19 +++++++++++++ board/common_selinux/permissions.txt | 26 ++++++++++++++++++ board/common_selinux/post_build.sh | 30 ++++++++++++++++++++ 8 files changed, 186 insertions(+) create mode 100644 board/common_selinux/busybox-selinux-fragment.config create mode 100644 board/common_selinux/fs-overlay/etc/audit/auditd.conf create mode 100644 board/common_selinux/fs-overlay/etc/audit/rules.d/audit.rules create mode 100755 board/common_selinux/fs-overlay/etc/fstab create mode 100755 board/common_selinux/fs-overlay/etc/inittab create mode 100644 board/common_selinux/linux-selinux-fragment.config create mode 100755 board/common_selinux/permissions.txt create mode 100755 board/common_selinux/post_build.sh
board/common_selinux/busybox-selinux-fragment.config new file +32 -0
@@ -0,0 +1,32 @@ +CONFIG_BUILD_LIBBUSYBOX=y +CONFIG_CHCON=y +CONFIG_DEFAULT_DEPMOD_FILE="" +CONFIG_DEFAULT_MODULES_DIR="" +CONFIG_FATATTR=y +CONFIG_FEATURE_BASH_IS_ASH=y +CONFIG_FEATURE_CHCON_LONG_OPTIONS=y +CONFIG_FEATURE_DEFAULT_PASSWD_ALGO="" +CONFIG_FEATURE_FIND_INUM=y +CONFIG_FEATURE_HAVE_RPC=y +CONFIG_FEATURE_INDIVIDUAL=y +CONFIG_FEATURE_LAST_SMALL=y +CONFIG_FEATURE_MOUNT_HELPERS=y +CONFIG_FEATURE_MOUNT_LABEL=y +CONFIG_FEATURE_MOUNT_NFS=y +CONFIG_FEATURE_MOUNT_VERBOSE=y +CONFIG_FEATURE_RUNCON_LONG_OPTIONS=y +CONFIG_FEATURE_SWAPON_DISCARD=y +CONFIG_FEATURE_SYSLOGD_READ_BUFFER_SIZE=0 +CONFIG_FEATURE_TAR_SELINUX=y +CONFIG_FEATURE_TOUCH_NODEREF=y +CONFIG_FIRST_SYSTEM_ID=0 +CONFIG_GROUPS=y +CONFIG_INIT_TERMINAL_TYPE="" +CONFIG_LAST_ID=0 +CONFIG_LAST_SYSTEM_ID=0 +CONFIG_PAM=y +CONFIG_RUNCON=y +CONFIG_SELINUXENABLED=y +CONFIG_SELINUX=y +CONFIG_SHUF=y +CONFIG_USERS=y
board/common_selinux/fs-overlay/etc/audit/auditd.conf new file +32 -0
@@ -0,0 +1,32 @@ +# +# This file controls the configuration of the audit daemon +# + +log_file = /var/log/audit/audit.log +log_format = RAW +log_group = root +priority_boost = 4 +flush = INCREMENTAL +freq = 20 +num_logs = 5 +disp_qos = lossy +dispatcher = /usr/sbin/audispd +name_format = NONE +##name = mydomain +max_log_file = 6 +max_log_file_action = ROTATE +space_left = 75 +space_left_action = IGNORE +action_mail_acct = root +admin_space_left = 50 +admin_space_left_action = IGNORE +disk_full_action = IGNORE +disk_error_action = IGNORE +##tcp_listen_port = +tcp_listen_queue = 5 +tcp_max_per_addr = 1 +##tcp_client_ports = 1024-65535 +tcp_client_max_idle = 0 +enable_krb5 = no +krb5_principal = auditd +##krb5_key_file = /etc/audit/audit.key
board/common_selinux/fs-overlay/etc/audit/rules.d/audit.rules new file +3 -0
@@ -0,0 +1,3 @@ +-D +-b 1024 +-e 2
board/common_selinux/fs-overlay/etc/fstab new file +15 -0
@@ -0,0 +1,15 @@ +# /etc/fstab: static file system information. +# +# <file system> <mount pt> <type> <options> <dump> <pass> +/dev/root / ext3 rw,noauto 0 1 +proc /proc proc defaults 0 0 +devpts /dev/pts devpts defaults,gid=5,mode=620 0 0 +tmpfs /dev/shm tmpfs mode=0700,nodev,nosuid,noexec,size=1M 0 0 +tmpfs /tmp tmpfs mode=0700,nodev,nosuid,noexec,size=200M 0 0 +tmpfs /var/cache tmpfs mode=0700,nodev,nosuid,noexec,size=1M 0 0 +tmpfs /var/lock tmpfs mode=0700,nodev,nosuid,noexec,size=1M 0 0 +tmpfs /var/log tmpfs mode=0700,nodev,nosuid,noexec,size=50M 0 0 +tmpfs /var/run tmpfs mode=0700,nodev,nosuid,noexec,size=1M 0 0 +tmpfs /var/spool tmpfs mode=0700,nodev,nosuid,noexec,size=1M 0 0 +sysfs /sys sysfs defaults 0 0 +none /selinux selinuxfs noauto 0 0
board/common_selinux/fs-overlay/etc/inittab new file +29 -0
@@ -0,0 +1,29 @@ +# /etc/inittab +# +# This inittab is a basic inittab sample for sysvinit, which mimics +# Buildroot's default inittab for BusyBox. +id:1:initdefault: + +proc::sysinit:/bin/mount -t proc proc /proc +sysf::sysinit:/bin/mount -t sysfs sysfs /sys +dpts::sysinit:/bin/mkdir -p /dev/pts -Z `matchpathcon -n /dev/pts` +dshm::sysinit:/bin/mkdir -p /dev/shm -Z `matchpathcon -n /dev/shm` +mpts::sysinit:/bin/mkdir -p /dev/pts +mshm::sysinit:/bin/mkdir -p /dev/shm +fsck::sysinit:/sbin/fsck -ARy +moun::sysinit:/bin/mount -a +host::sysinit:/bin/hostname -F /etc/hostname + +# now run any rc scripts +init::bootwait:/etc/init.d/rcS + +S0::respawn:/sbin/getty -L ttyS0 115200 vt100 # GENERIC_SERIAL + +# Stuff to do before rebooting +shd0:06:wait:/etc/init.d/rcK +shd1:06:wait:/sbin/swapoff -a +shd2:06:wait:/bin/umount -a -r + +# The usual halt or reboot actions +hlt0:0:wait:/sbin/halt -dhp +reb0:6:wait:/sbin/reboot
board/common_selinux/linux-selinux-fragment.config new file +19 -0
@@ -0,0 +1,19 @@ +CONFIG_AUDIT=y +CONFIG_MODULES=y +CONFIG_IP_PNP=y +CONFIG_DEVTMPFS=y +CONFIG_DEVTMPFS_MOUNT=y +CONFIG_EXT2_FS=y +CONFIG_EXT2_FS_XATTR=y +CONFIG_EXT2_FS_POSIX_ACL=y +CONFIG_EXT2_FS_SECURITY=y +CONFIG_EXT3_FS=y +CONFIG_EXT3_FS_POSIX_ACL=y +CONFIG_EXT3_FS_SECURITY=y +CONFIG_NFS_FS=y +CONFIG_ROOT_NFS=y +CONFIG_SECURITY=y +CONFIG_SECURITY_NETWORK=y +CONFIG_SECURITY_SELINUX=y +CONFIG_SECURITY_SELINUX_BOOTPARAM=y +CONFIG_CRYPTO_ANSI_CPRNG=y
board/common_selinux/permissions.txt new file +26 -0
@@ -0,0 +1,26 @@ +################################################################################ +# +# See <buildroot-source>/package/makedevs/README for details +# +# This device table is used to assign proper ownership and permissions +# on the files in the local-skeleton directory. It doesn't create any device +# file, as it is used in both static device configurations (where /dev/ is static) +# and in dynamic configurations (where devtmpfs, mdev or udev are used). +# +# <name> <type> <mode> <uid> <gid> <major> <minor> <start> <inc> <count> + +# All the necessary file permissions for /etc +/etc/audit/auditd.conf f 644 0 0 - - - - - +/etc/audit/rules.d/audit.rules f 644 0 0 - - - - - +/etc/fstab f 644 0 0 - - - - - +/etc/inittab f 644 0 0 - - - - - + +# Setup entries for all of the /var/* directories that need proper +# mount points +/var/cache d 755 0 0 - - - - - +/var/lib/misc d 755 0 0 - - - - - +/var/lock d 755 0 0 - - - - - +/var/log d 755 0 0 - - - - - +/var/run d 755 0 0 - - - - - +/var/spool d 755 0 0 - - - - - +/var/tmp d 755 0 0 - - - - -
board/common_selinux/post_build.sh new file +30 -0
@@ -0,0 +1,30 @@ +#!/bin/bash +################################################################################ +# +# DESCRIPTION: +# This script will do any "post-build" steps (after all packages are built +# but before image creation). Any filesystem permission issues should be +# fixed in this script. +# +# The script requires following variables to be passed into it. +# $1 - the target directory (passed in by default by buildroot if +# script is BR2_ROOTFS_POST_BUILD_SCRIPT) +# +################################################################################ + +DEST_DIR=$1 + +# For SELinux targets, the /var directory symlinks need to be removed +# and replaced with actual folders. The removal is done here and the +# recreation is done in the permissions file for the common_selinux +# local_skeleton +for link in ${DEST_DIR}/var/{cache,lock,log,run,spool,tmp} ${DEST_DIR}/var/lib/misc; do + if [ -h ${link} ]; then + echo "Removing symlink ${link}" + unlink ${link} + fi +done + +# Replace the /run folder with a symlink to /var/run +rm -rf ${DEST_DIR}/run +ln -sf -t ${DEST_DIR} run var/run
Signature · 1 line
2.13.2
PATCH v14 4/4 qemu x86 selinux: base br defconfig
In reply to Arnout Vandecappelle (Essensium/Mind)From: Clayton Shotwell <[email protected]>
This will build a base SELinux system that boots with SELinux in permissive mode. Also adding documentation on how to use it.
[Arnout:
- Create a 64-bit defconfig instead of a 32-bit one.
- Move the kernel fragment to board/common_selinux.
- Align with qemu_x86_64_defconfig.
- Regenerate .gitlab-ci.yml.]
---
v14:
- Create a 64-bit defconfig instead of a 32-bit one.
- Move the kernel fragment to board/common_selinux.
- Align with qemu_x86_defconfig.
- Regenerate .gitlab-ci.yml.
- Add the defconfig only after the selinux-specific bits have been added.
I would really like some explanation why the following config options are needed:
BR2_TARGET_GENERIC_ROOT_PASSWD="root" BR2_TARGET_ROOTFS_EXT2_RESBLKS=5
BR2_PACKAGE_OPENSSH=y
BR2_PACKAGE_RSYSLOG=y
BR2_PACKAGE_UTIL_LINUX_LOGIN_UTILS=y BR2_PACKAGE_HOST_CHECKPOLICY=y
I switched to x86_64 because the BR2_i386_pentiumpro variant fails to build glibc:
In file included from ../sysdeps/x86_64/multiarch/strcspn-c.c:22:0,
from ../sysdeps/i386/i686/multiarch/strcspn-c.c:2:
../sysdeps/x86_64/multiarch/varshift.h: In function '__m128i_shift_right':../sysdeps/x86_64/multiarch/varshift.h:26:1: error: SSE vector return without SSE enabled changes the ABI [-Werror=psabi]
{
^
(and more). I couldn't be bothered to debug that, switching to x86_64 was simpler.
--- .gitlab-ci.yml | 1 + board/qemu/x86_64/readme.txt | 17 +++++++++++++ configs/qemu_x86_64_selinux_defconfig | 47 +++++++++++++++++++++++++++++++++++ 3 files changed, 65 insertions(+) create mode 100644 configs/qemu_x86_64_selinux_defconfig
.gitlab-ci.yml +1 -0
@@ -174,6 +174,7 @@ qemu_sh4eb_r2d_defconfig: *defconfig qemu_sparc64_sun4u_defconfig: *defconfig qemu_sparc_ss10_defconfig: *defconfig qemu_x86_64_defconfig: *defconfig +qemu_x86_64_selinux_defconfig: *defconfig qemu_x86_defconfig: *defconfig qemu_xtensa_lx60_defconfig: *defconfig qemu_xtensa_lx60_nommu_defconfig: *defconfig
board/qemu/x86_64/readme.txt +17 -0
@@ -7,3 +7,20 @@ Optionally add -smp N to emulate a SMP system with N CPUs. The login prompt will appear in the graphical window. Tested with QEMU 2.9.0 + +------------------------------------------------------------------- + +Run the SELinux target (based on qemu_x86_64_selinux_defconfig) emulation with: + + qemu-system-x86_64 -M pc -kernel output/images/bzImage -drive file=output/images/rootfs.ext2,if=ide -append "root=/dev/sda rw console=ttyS0 selinux=1" -net nic,model=rtl8139 -net user -display none -serial stdio + +The emulation should reboot once the first time for relabeling and +then provide a login prompt. The login is username root and password +root because PAM requires a password in this secure configuration. To +enable SELinux enforcing at boot, login and edit the +/etc/selinux/config and set SELINUX to enforcing. Save and make sure +to "sync" before restarting the emulation as the ext2 fs would +otherwise corrupt when the emulation exits. After enforcing is +default, the selinux= provided as part of the qemu "append" above can +be used to turn enforcing on/off. This configuration would be tailored +as part of a targets refpolicy customization.
configs/qemu_x86_64_selinux_defconfig new file +47 -0
47 lines not on this page · raw message
Signature · 1 line
2.13.2
Thomas Petazzoni
AppliedPATCH v14 1/4 makedevs: support optional files
In reply to Arnout Vandecappelle (Essensium/Mind)Hello,
Quoted 13 lines · Arnout Vandecappelle (Essensium/Mind)
Add the 'F' file type to makedevs, that allows a file to be optional. With this option, the line is just silently skipped if the file doesn't exist (or is not a regular file).
This is useful for
_PERMISSIONSwhere the file can be configured out by package-specific configuration that is not directly handled by Buildroot, like busybox.Cc Clayton Shotwell <[email protected]>Cc Matthew Weber <[email protected]>Cc Niranjan Reddy <[email protected]>Cc Bryce Ferguson <[email protected]>
Quoted 7 lines
---
v14:
- Split off the makedevs change in a separate patch.
- Fix it - AFAICS, the original patch would just skip all F lines.--- package/makedevs/makedevs.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
Applied to master, thanks.
Thomas
Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons Embedded Linux, Kernel and Android engineering http://free-electrons.com