Skip to contentSkip to conversation

package/libapparmor: new package

PATCH New Angelo Compagnucci 2 participants 4 messages Mar 26, 2020 – Mar 27, 2020

lore
Share & tools
lore

Angelo Compagnucci

author
#0 lore raw

PATCH v3 1/2 package/libapparmor: new package

This patch adds libapparmor and its mandatory tools.

* The first step is to compile libraries/libapparmor using the autotools infrastructure. Autoreconf is needed due to the attached patches. Libapparmor library needs to be installed in staging directory before compiling the rest of the tools.
* The second step is to compile the mandatory parser and binutils sub directories, this is done in POST_INSTALL_STAGING_HOOKS.
* If python3 is available, swig bindings are compiled.
* parser/apparmor.systemd is actually a systemv init script
* All Apparmor kernel code is now upstream, so no other patches are needed.

Signed-off-by Angelo Compagnucci <[email protected]>
---
 DEVELOPERS                                    |  1 +
 linux/linux.mk                                |  6 ++
 package/Config.in                             |  1 +
 ...el-fixing-for-crosscompiling-environ.patch | 96 +++++++++++++++++++
 ...ng-setup.py-call-when-crosscompiling.patch | 30 ++++++
 package/libapparmor/Config.in                 | 34 +++++++
 package/libapparmor/libapparmor.hash          |  3 +
 package/libapparmor/libapparmor.mk            | 68 +++++++++++++
 8 files changed, 239 insertions(+)
 create mode 100644 package/libapparmor/0001-m4-ac_python_devel-fixing-for-crosscompiling-environ.patch
 create mode 100644 package/libapparmor/0002-libapparmor-fixing-setup.py-call-when-crosscompiling.patch
 create mode 100644 package/libapparmor/Config.in
 create mode 100644 package/libapparmor/libapparmor.hash
 create mode 100644 package/libapparmor/libapparmor.mk
DEVELOPERS +1 -0
index 1fb4e65755..3ab96b8707 100644
@@ -196,6 +196,7 @@ N:	Angelo Compagnucci <[email protected]>
 F:	package/corkscrew/
 F:	package/fail2ban/
 F:	package/i2c-tools/
+F:	package/libapparmor/
 F:	package/mender/
 F:	package/mender-artifact/
 F:	package/mono/
linux/linux.mk +6 -0
index b2ceeecafb..18327be7ef 100644
@@ -361,6 +361,12 @@ define LINUX_KCONFIG_FIXUP_CMDS
 	$(if $(BR2_PACKAGE_INTEL_MICROCODE),
 		$(call KCONFIG_ENABLE_OPT,CONFIG_MICROCODE,$(@D)/.config)
 		$(call KCONFIG_ENABLE_OPT,CONFIG_MICROCODE_INTEL,$(@D)/.config))
+	$(if $(BR2_PACKAGE_LIBAPPARMOR),
+		$(call KCONFIG_ENABLE_OPT,CONFIG_AUDIT,$(@D)/.config)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_SECURITY,$(@D)/.config)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_SECURITY_APPARMOR,$(@D)/.config)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_DEFAULT_SECURITY_APPARMOR,$(@D)/.config)
+		$(call KCONFIG_SET_OPT,CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE,1,$(@D)/.config))
 	$(if $(BR2_PACKAGE_KTAP),
 		$(call KCONFIG_ENABLE_OPT,CONFIG_DEBUG_FS,$(@D)/.config)
 		$(call KCONFIG_ENABLE_OPT,CONFIG_ENABLE_DEFAULT_TRACERS,$(@D)/.config)
package/Config.in +1 -0
index 614ec921e5..31445af0f3 100644
@@ -1883,6 +1883,7 @@ endif
 endmenu
 
 menu "Security"
+	source "package/libapparmor/Config.in"
 	source "package/libselinux/Config.in"
 	source "package/libsemanage/Config.in"
 	source "package/libsepol/Config.in"
package/libapparmor/0001-m4-ac_python_devel-fixing-for-crosscompiling-environ.patch new file +96 -0

96 lines not on this page · raw message

package/libapparmor/0002-libapparmor-fixing-setup.py-call-when-crosscompiling.patch new file +30 -0
new file mode 100644
index 0000000000..8d6ca86e47
@@ -0,0 +1,30 @@
+From cf61d1257b9a5f12fdf6f4dd6a2746f77b23a8a0 Mon Sep 17 00:00:00 2001
+From: Angelo Compagnucci <[email protected]>
+Date: Tue, 24 Mar 2020 23:02:08 +0100
+Subject: [PATCH] libapparmor: fixing setup.py call when crosscompiling
+
+When crosscompiling, setupy.py should be called passing the settings
+discovered by ac_python_devel.m4 and not using the default system
+settings.
+
+Signed-off-by: Angelo Compagnucci <[email protected]>
+---
+ libraries/libapparmor/swig/python/Makefile.am | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libraries/libapparmor/swig/python/Makefile.am b/libraries/libapparmor/swig/python/Makefile.am
+index 421acba9..6c60181e 100644
+--- a/libraries/libapparmor/swig/python/Makefile.am
++++ b/libraries/libapparmor/swig/python/Makefile.am
+@@ -11,7 +11,7 @@ MOSTLYCLEANFILES=libapparmor_wrap.c LibAppArmor.py
+ 
+ all-local: libapparmor_wrap.c setup.py
+ 	if test ! -f libapparmor_wrap.c; then cp $(srcdir)/libapparmor_wrap.c . ; fi
+-	$(PYTHON) setup.py build
++	CC="$(CC)" CFLAGS="$(PYTHON_CPPFLAGS)" LDSHARED="$(CC) -shared" LDFLAGS="$(PYTHON_LDFLAGS)" $(PYTHON) setup.py build
+ 
+ install-exec-local:
+ 	$(PYTHON) setup.py install --root="/$(DESTDIR)" --prefix="$(prefix)"
+-- 
+2.17.1
+
package/libapparmor/Config.in new file +34 -0
new file mode 100644
index 0000000000..c93199cf37
@@ -0,0 +1,34 @@
+config BR2_PACKAGE_LIBAPPARMOR
+	bool "libapparmor"
+	depends on BR2_USE_WCHAR
+	select BR2_PACKAGE_BUSYBOX_SHOW_OTHERS
+	select BR2_PACKAGE_GREP
+	select BR2_PACKAGE_PYTHON3_READLINE if BR2_PACKAGE_PYTHON3
+	help
+	  AppArmor is an effective and easy-to-use Linux application
+	  security system. AppArmor proactively protects the operating
+	  system and applications from external or internal threats,
+	  even zero-day attacks, by enforcing good behavior and
+	  preventing even unknown application flaws from being exploited.
+	  AppArmor security policies completely define what system
+	  resources individual applications can access, and with what
+	  privileges. A number of default policies are included with
+	  AppArmor, and using a combination of advanced static analysis
+	  and learning-based tools, AppArmor policies for even very
+	  complex applications can be deployed successfully in a
+	  matter of hours.
+
+	  http://wiki.apparmor.net
+
+if BR2_PACKAGE_LIBAPPARMOR
+
+config BR2_PACKAGE_LIBAPPARMOR_PROFILES
+	bool "install profiles"
+	default y
+	help
+	  This option install Apparmor default profiles
+
+endif
+
+comment "AppArmor needs needs a toolchain w/ wchar"
+	depends on !BR2_USE_WCHAR
package/libapparmor/libapparmor.hash new file +3 -0
new file mode 100644
index 0000000000..e5ae65d91c
@@ -0,0 +1,3 @@
+# locally computed
+sha256  267053234c68cdb122c5294d7c276b6e2f5fa7e75c6c2d23e3ce69f95d9a7639  apparmor-2.13.3.tar.gz
+sha256  a7e0cdcbea5c14927cedfc600d46526bdcbb1eb0a4d951e2ea53c2a6de159cb4  LICENSE
package/libapparmor/libapparmor.mk new file +68 -0

68 lines not on this page · raw message

Signature · 1 line
2.17.1
author
#1 lore raw

PATCH v3 2/2 package/libapparmor-utils: new package

This patch adds libapparmor related tools.

Signed-off-by Angelo Compagnucci <[email protected]>
---
 DEVELOPERS                                    |  1 +
 package/Config.in                             |  1 +
 package/libapparmor-utils/Config.in           |  7 ++
 .../libapparmor-utils/libapparmor-utils.hash  |  3 +
 .../libapparmor-utils/libapparmor-utils.mk    | 65 +++++++++++++++++++
 5 files changed, 77 insertions(+)
 create mode 100644 package/libapparmor-utils/Config.in
 create mode 100644 package/libapparmor-utils/libapparmor-utils.hash
 create mode 100644 package/libapparmor-utils/libapparmor-utils.mk
DEVELOPERS +1 -0
index 3ab96b8707..d86c61b416 100644
@@ -197,6 +197,7 @@ F:	package/corkscrew/
 F:	package/fail2ban/
 F:	package/i2c-tools/
 F:	package/libapparmor/
+F:	package/libapparmor-utils/
 F:	package/mender/
 F:	package/mender-artifact/
 F:	package/mono/
package/Config.in +1 -0
index 31445af0f3..6702ca4b6e 100644
@@ -1884,6 +1884,7 @@ endmenu
 
 menu "Security"
 	source "package/libapparmor/Config.in"
+	source "package/libapparmor-utils/Config.in"
 	source "package/libselinux/Config.in"
 	source "package/libsemanage/Config.in"
 	source "package/libsepol/Config.in"
package/libapparmor-utils/Config.in new file +7 -0
new file mode 100644
index 0000000000..4fe1074f5d
@@ -0,0 +1,7 @@
+config BR2_PACKAGE_LIBAPPARMOR_UTILS
+	bool "libapparmor utilities"
+	depends on BR2_PACKAGE_LIBAPPARMOR
+	help
+	  Apparmor userspace utils, pam module and apache module
+
+	  http://wiki.apparmor.net
package/libapparmor-utils/libapparmor-utils.hash new file +3 -0
new file mode 100644
index 0000000000..e5ae65d91c
@@ -0,0 +1,3 @@
+# locally computed
+sha256  267053234c68cdb122c5294d7c276b6e2f5fa7e75c6c2d23e3ce69f95d9a7639  apparmor-2.13.3.tar.gz
+sha256  a7e0cdcbea5c14927cedfc600d46526bdcbb1eb0a4d951e2ea53c2a6de159cb4  LICENSE
package/libapparmor-utils/libapparmor-utils.mk new file +65 -0

65 lines not on this page · raw message

Signature · 1 line
2.17.1
#2 lore raw

PATCH v3 2/2 package/libapparmor-utils: new package

Hello Angelo,

Quoted 6 lines · On Thu, 26 Mar 2020 23:56:41 +0100 Angelo Compagnucci…
package/libapparmor-utils/libapparmor-utils.mk new file +0 -0
new file mode 100644
index 0000000000..3b2b47be07

package/libapparmor-utils/libapparmor-utils.mk line 9

Quoted 9 lines
package/libapparmor-utils/libapparmor-utils.mk new file +9 -0
@@ -0,0 +1,65 @@
+################################################################################
+#
+# libapparmor-utils
+#
+################################################################################
+
+LIBAPPARMOR_UTILS_BASE_VERSION = 2.13
+LIBAPPARMOR_UTILS_VERSION = $(LIBAPPARMOR_UTILS_BASE_VERSION).3
+LIBAPPARMOR_UTILS_SOURCE = apparmor-$(LIBAPPARMOR_UTILS_VERSION).tar.gz

This is using the same source code as the libapparmor package, so unless there is a very solid reason for having a separate package (and it should be explained in the commit log), we prefer in Buildroot to have one package for one upstream project, so this logic should go into package/libapparmor/.

Thanks!

Thomas

Signature · 3 lines
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
#3 lore raw

PATCH v3 1/2 package/libapparmor: new package

In reply to Angelo Compagnucci

Hello,

Quoted 13 lines · On Thu, 26 Mar 2020 23:56:40 +0100 Angelo Compagnucci…

This patch adds libapparmor and its mandatory tools.

* The first step is to compile libraries/libapparmor using the autotools infrastructure. Autoreconf is needed due to the attached patches. Libapparmor library needs to be installed in staging directory before compiling the rest of the tools.
* The second step is to compile the mandatory parser and binutils sub directories, this is done in POST_INSTALL_STAGING_HOOKS.
* If python3 is available, swig bindings are compiled.
* parser/apparmor.systemd is actually a systemv init script
* All Apparmor kernel code is now upstream, so no other patches are needed.

Quoted 1 line
Signed-off-by Angelo Compagnucci <[email protected]>

What are the changes between versions? I.e, what does this v3 changes compared to v2 ?

Thanks!

Thomas

Signature · 3 lines
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com