Skip to contentSkip to conversation

smack: Add new package

PATCH Superseded Armin Kuster 3 participants 8 messages Oct 26, 2016 – Oct 28, 2016

v1 of 2 Superseded Latest is v2 →

lore
Share & tools
lore

Armin Kuster

author
#0 lore raw

PATCH 1/2 smack: Add new package

Signed-off-by Armin Kuster <[email protected]>
---
 recipes-security/smack/files/run-ptest             |  3 ++
 .../smack/files/smack_generator_make_fixup.patch   | 18 ++++++++++
 recipes-security/smack/smack_1.3.0.bb              | 42 ++++++++++++++++++++++
 3 files changed, 63 insertions(+)
 create mode 100644 recipes-security/smack/files/run-ptest
 create mode 100644 recipes-security/smack/files/smack_generator_make_fixup.patch
 create mode 100644 recipes-security/smack/smack_1.3.0.bb
recipes-security/smack/files/run-ptest new file +3 -0
new file mode 100644
index 0000000..049a9b4
@@ -0,0 +1,3 @@
+#!/bin/sh
+./tests/make_policies.bash ./tests/generator
+./tests/make_policies.bash ./tests/generator labels
recipes-security/smack/files/smack_generator_make_fixup.patch new file +18 -0
new file mode 100644
index 0000000..8bafc5e
@@ -0,0 +1,18 @@
+Upstream-Status: Pending
+
+Signed-off-by: Armin Kuster <[email protected]>
+
+
+Index: git/tests/Makefile
+===================================================================
+--- git.orig/tests/Makefile
++++ git/tests/Makefile
+@@ -4,7 +4,7 @@ clean:
+ 	rm -rf ./out ./generator
+ 
+ generator: generator.c
+-	gcc -Wall -O3 generator.c -o ./generator
++	${CC}  generator.c -o ./generator
+ 
+ policies: ./generator ./make_policies.bash
+ 	./make_policies.bash ./generator
recipes-security/smack/smack_1.3.0.bb new file +42 -0

42 lines not on this page · raw message

Signature · 1 line
2.7.4
author
#1 lore raw

PATCH 2/2 smack kernel: add smack kernel config fragments

Signed-off-by Armin Kuster <[email protected]>
---
 recipes-kernel/linux/linux-yocto-4.8/smack-default-lsm.cfg | 2 ++
 recipes-kernel/linux/linux-yocto-4.8/smack.cfg             | 8 ++++++++
 recipes-kernel/linux/linux-yocto_4.8.bbappend              | 5 +++++
 3 files changed, 15 insertions(+)
 create mode 100644 recipes-kernel/linux/linux-yocto-4.8/smack-default-lsm.cfg
 create mode 100644 recipes-kernel/linux/linux-yocto-4.8/smack.cfg
recipes-kernel/linux/linux-yocto-4.8/smack-default-lsm.cfg new file +2 -0
new file mode 100644
index 0000000..b5c4845
@@ -0,0 +1,2 @@
+CONFIG_DEFAULT_SECURITY="smack"
+CONFIG_DEFAULT_SECURITY_SMACK=y
recipes-kernel/linux/linux-yocto-4.8/smack.cfg new file +8 -0
new file mode 100644
index 0000000..62f465a
@@ -0,0 +1,8 @@
+CONFIG_IP_NF_SECURITY=m
+CONFIG_IP6_NF_SECURITY=m
+CONFIG_EXT2_FS_SECURITY=y
+CONFIG_EXT3_FS_SECURITY=y
+CONFIG_EXT4_FS_SECURITY=y
+CONFIG_SECURITY=y
+CONFIG_SECURITY_SMACK=y
+CONFIG_TMPFS_XATTR=y
recipes-kernel/linux/linux-yocto_4.8.bbappend +5 -0
index 0e6960e..048e8fd 100644
@@ -5,3 +5,8 @@ SRC_URI += "\
         ${@bb.utils.contains('DISTRO_FEATURES', 'tpm', ' file://tpm.cfg', '', d)} \
         ${@bb.utils.contains('DISTRO_FEATURES', 'tpm', ' file://tpm.scc', '', d)} \
 "
+
+SRC_URI += "\
+        ${@bb.utils.contains('DISTRO_FEATURES', 'smack', ' file://smack.cfg', '', d)} \
+        ${@bb.utils.contains('DISTRO_FEATURES', 'smack', ' file://smack-default-lsm.cfg', '', d)} \
+"
Signature · 1 line
2.7.4
#2 lore raw

Re: [meta-security][PATCH 2/2] smack kernel: add smack kernel config fragments

Quoted 23 lines · Armin Kuster
Signed-off-by Armin Kuster <[email protected]>
---
 recipes-kernel/linux/linux-yocto-4.8/smack-default-lsm.cfg | 2 ++
 recipes-kernel/linux/linux-yocto-4.8/smack.cfg             | 8 ++++++++
 recipes-kernel/linux/linux-yocto_4.8.bbappend              | 5 +++++
 3 files changed, 15 insertions(+)
 create mode 100644 recipes-kernel/linux/linux-yocto-4.8/smack-default-lsm.cfg
 create mode 100644 recipes-kernel/linux/linux-yocto-4.8/smack.cfg
recipes-kernel/linux/linux-yocto-4.8/smack-default-lsm.cfg new file +2 -0
new file mode 100644
index 0000000..b5c4845
@@ -0,0 +1,2 @@
+CONFIG_DEFAULT_SECURITY="smack"
+CONFIG_DEFAULT_SECURITY_SMACK=y
recipes-kernel/linux/linux-yocto-4.8/smack.cfg new file +0 -0
new file mode 100644
index 0000000..62f465a

recipes-kernel/linux/linux-yocto-4.8/smack.cfg line 8

Quoted 8 lines
recipes-kernel/linux/linux-yocto-4.8/smack.cfg new file +8 -0
@@ -0,0 +1,8 @@
+CONFIG_IP_NF_SECURITY=m
+CONFIG_IP6_NF_SECURITY=m
+CONFIG_EXT2_FS_SECURITY=y
+CONFIG_EXT3_FS_SECURITY=y
+CONFIG_EXT4_FS_SECURITY=y
+CONFIG_SECURITY=y
+CONFIG_SECURITY_SMACK=y
+CONFIG_TMPFS_XATTR=y

Were these two files perhaps copied from
https://github.com/01org/meta-intel-iot-security/tree/master/meta-security-smack/recipes-kernel/linux/linux ?

Just wondering, they look, hmm, very familiar ;-)

Can you say a bit more about your plans regarding Smack support in meta-security? A recipe for the userspace tool and the kernel config is a start, but for a fully functional Smack-enabled image, the rootfs also needs to be set up a bit differently.

I can imagine that it would be worthwhile to take more of the things done in meta-intel-iot-security and then deprecate that layer.

Signature · 6 lines
Best Regards, Patrick Ohly

The content of this message is my personal opinion only and although
I am an employee of Intel, the statements I make here in no way
represent Intel's position on the issue, nor am I authorized to speak
on behalf of Intel on this matter.
#3 lore raw

Re: [meta-security][PATCH 2/2] smack kernel: add smack kernel config fragments

Quoted 39 lines · Patrick Ohly
Quoted 23 lines · Armin Kuster
Signed-off-by Armin Kuster <[email protected]>

---

recipes-kernel/linux/linux-yocto-4.8/smack-default-lsm.cfg | 2 ++
recipes-kernel/linux/linux-yocto-4.8/smack.cfg             | 8 ++++++++
recipes-kernel/linux/linux-yocto_4.8.bbappend              | 5 +++++
3 files changed, 15 insertions(+)

create mode 100644 recipes-kernel/linux/linux-yocto-4.8/smack-default-lsm.cfg create mode 100644 recipes-kernel/linux/linux-yocto-4.8/smack.cfg

recipes-kernel/linux/linux-yocto-4.8/smack-default-lsm.cfg new file +2 -0
new file mode 100644
index 0000000..b5c4845
@@ -0,0 +1,2 @@
+CONFIG_DEFAULT_SECURITY="smack"
+CONFIG_DEFAULT_SECURITY_SMACK=y
recipes-kernel/linux/linux-yocto-4.8/smack.cfg new file +0 -0
new file mode 100644
index 0000000..62f465a

recipes-kernel/linux/linux-yocto-4.8/smack.cfg line 8

Quoted 8 lines
recipes-kernel/linux/linux-yocto-4.8/smack.cfg new file +8 -0
@@ -0,0 +1,8 @@
+CONFIG_IP_NF_SECURITY=m
+CONFIG_IP6_NF_SECURITY=m
+CONFIG_EXT2_FS_SECURITY=y
+CONFIG_EXT3_FS_SECURITY=y
+CONFIG_EXT4_FS_SECURITY=y
+CONFIG_SECURITY=y
+CONFIG_SECURITY_SMACK=y
+CONFIG_TMPFS_XATTR=y

Were these two files perhaps copied from
https://github.com/01org/meta-intel-iot-security/tree/master/meta-security-smack/recipes-kernel/linux/linux ?

Quoted 6 lines

Just wondering, they look, hmm, very familiar ;-)

Can you say a bit more about your plans regarding Smack support in meta-security? A recipe for the userspace tool and the kernel config is a start, but for a fully functional Smack-enabled image, the rootfs also needs to be set up a bit differently.

FWIW meta-security seems to be right place for smack related infra.

Quoted 19 lines

I can imagine that it would be worthwhile to take more of the things done in meta-intel-iot-security and then deprecate that layer.

--
Best Regards, Patrick Ohly

The content of this message is my personal opinion only and although I am an employee of Intel, the statements I make here in no way represent Intel's position on the issue, nor am I authorized to speak on behalf of Intel on this matter.

--
_______________________________________________
yocto mailing list
[email protected]
https://lists.yoctoproject.org/listinfo/yocto

#4 lore raw

Re: [meta-security][PATCH 2/2] smack kernel: add smack kernel config fragments

Quoted 7 lines · Khem Raj
Quoted 5 lines · Patrick Ohly

Can you say a bit more about your plans regarding Smack support in meta-security? A recipe for the userspace tool and the kernel config is a start, but for a fully functional Smack-enabled image, the rootfs also needs to be set up a bit differently.

FWIW meta-security seems to be right place for smack related infra.

I don't disagree :-) But it would be good to know more about the rest of the infrastructure before adding (or reviewing) bits and pieces that by themselves don't do much.

Signature · 6 lines
Best Regards, Patrick Ohly

The content of this message is my personal opinion only and although
I am an employee of Intel, the statements I make here in no way
represent Intel's position on the issue, nor am I authorized to speak
on behalf of Intel on this matter.
author
#5 lore raw

Re: [meta-security][PATCH 2/2] smack kernel: add smack kernel config fragments

Quoted 10 lines · Patrick Ohly
Quoted 6 lines · Khem Raj
Quoted 5 lines · Patrick Ohly

Can you say a bit more about your plans regarding Smack support in meta-security? A recipe for the userspace tool and the kernel config is a start, but for a fully functional Smack-enabled image, the rootfs also needs to be set up a bit differently.

FWIW meta-security seems to be right place for smack related infra.

I don't disagree :-) But it would be good to know more about the rest of the infrastructure before adding (or reviewing) bits and pieces that by themselves don't do much.

I start of with basic support and refine over time. Your statement can apply for many components within meta-secuirty. I recently started adding test images. Providing configurations or solutions for a niche area is outside the scope for this general layer, IMHO. I could be convinced otherwise. I tend not to wait for 100% solution before sending out bits for review.

thanks for your input.

Regards,
Armin

Quoted 1 line
#6 lore raw

Re: [meta-security][PATCH 2/2] smack kernel: add smack kernel config fragments

Quoted 12 lines · On Oct 28, 2016, at 8:41 AM, akuster808 <[email protected]> wrote:
Quoted 6 lines · Patrick Ohly
Quoted 5 lines · Khem Raj
Quoted 5 lines · Patrick Ohly

Can you say a bit more about your plans regarding Smack support in meta-security? A recipe for the userspace tool and the kernel config is a start, but for a fully functional Smack-enabled image, the rootfs also needs to be set up a bit differently.

Quoted 5 lines
Quoted 4 lines
Quoted 1 line

FWIW meta-security seems to be right place for smack related infra.

I don't disagree :-) But it would be good to know more about the rest of the infrastructure before adding (or reviewing) bits and pieces that by themselves don't do much.

I start of with basic support and refine over time. Your statement can apply for many components within meta-secuirty. I recently started adding test images. Providing configurations or solutions for a niche area is outside the scope for this general layer, IMHO. I could be convinced otherwise. I tend not to wait for 100% solution before sending out bits for review.

its a good start. If you have some more patches on the way to complete the solution, that would be good to share.

Quoted 7 lines

thanks for your input.

Regards,
Armin

Quoted 1 line
#7 lore raw
In reply to Armin Kuster
Quoted 33 lines · Armin Kuster
Signed-off-by Armin Kuster <[email protected]>

---

recipes-security/smack/files/run-ptest             |  3 ++
.../smack/files/smack_generator_make_fixup.patch   | 18 ++++++++++
recipes-security/smack/smack_1.3.0.bb              | 42 ++++++++++++++++++++++
3 files changed, 63 insertions(+)

create mode 100644 recipes-security/smack/files/run-ptest
create mode 100644 recipes-security/smack/files/smack_generator_make_fixup.patch create mode 100644 recipes-security/smack/smack_1.3.0.bb

recipes-security/smack/files/run-ptest new file +3 -0
new file mode 100644
index 0000000..049a9b4
@@ -0,0 +1,3 @@
+#!/bin/sh
+./tests/make_policies.bash ./tests/generator
+./tests/make_policies.bash ./tests/generator labels
recipes-security/smack/files/smack_generator_make_fixup.patch new file +5 -0
new file mode 100644
index 0000000..8bafc5e
@@ -0,0 +1,18 @@
+Upstream-Status: Pending
+
+Signed-off-by: Armin Kuster <[email protected]>
+
+

recipes-security/smack/files/smack_generator_make_fixup.patch line 15

Quoted 10 lines
recipes-security/smack/files/smack_generator_make_fixup.patch new file +10 -0
+Index: git/tests/Makefile
+===================================================================
+--- git.orig/tests/Makefile
++++ git/tests/Makefile
+@@ -4,7 +4,7 @@ clean:
+ 	rm -rf ./out ./generator
+
+ generator: generator.c
+-	gcc -Wall -O3 generator.c -o ./generator
++	${CC}  generator.c -o ./generator

This should be ${CC} ${LDFLAGS} since you are doing compiling and linking in single step otherwise we may end up with hash-style problems

Quoted 20 lines
recipes-security/smack/files/smack_generator_make_fixup.patch new file +3 -0
+
+ policies: ./generator ./make_policies.bash
+ 	./make_policies.bash ./generator
recipes-security/smack/smack_1.3.0.bb new file +11 -0
new file mode 100644
index 0000000..46d305e
@@ -0,0 +1,42 @@
+DESCRIPTION = "Selection of tools for developers working with Smack"
+HOMEPAGE = "https://github.com/smack-team/smack"
+SECTION = "Security/Access Control"
+LICENSE = "LGPL-2.1"
+
+LIC_FILES_CHKSUM = "file://COPYING;md5=4fbd65380cdd255951079008b364516c"
+
+SRCREV = "478f68d182c5070f510482194d3e097b11c21907"
+SRC_URI = " \
+	git://github.com/smack-team/smack.git;branch=v1.3.x \
+	file://smack_generator_make_fixup.patch \

recipes-security/smack/smack_1.3.0.bb line 21

Quoted 10 lines
recipes-security/smack/smack_1.3.0.bb new file +10 -0
+	file://run-ptest"
+
+PV = "1.3.0+git${SRCPV}"
+
+inherit autotools pkgconfig systemd ptest
+
+S = "${WORKDIR}/git"
+
+PACKAGECONFIG ??= ""
+PACKAGECONG += "${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'systemd', '', d)}”

     ^^^^

is this a typo ? and may be it should be _append not +=

Quoted 29 lines
recipes-security/smack/smack_1.3.0.bb new file +21 -1
+
+PACKAGECONFIG[systemd] = "--with-systemdsystemunitdir=DIR"
+PACKAGECONFIG[systemd] = "--with-systemdsystemunitdir=${systemd_system_unitdir}, --without-systemdsystemunitdir, systemd"
+
+do_compile_append () {
+	oe_runmake -C ${S}/tests generator
+}
+
+do_install_ptest () {
+	install -d ${D}${PTEST_PATH}/tests
+	install ${S}/tests/generator ${D}/${PTEST_PATH}/tests
+	install ${S}/tests/generate-rules.sh ${D}${PTEST_PATH}/tests
+	install ${S}/tests/make_policies.bash ${D}${PTEST_PATH}/tests
+}
+
+FILES_${PN}-ptest += "generator"
+
+RDEPENDS_${PN} += "coreutils"
+RDEPENDS_${PN}-ptest += "make bash bc"
+
+BBCLASSEXTEND = "native"
--

2.7.4

--
_______________________________________________
yocto mailing list
[email protected]
https://lists.yoctoproject.org/listinfo/yocto