CaROS/meta-selinux
3
0
Fork 0
mirror of git://git.yoctoproject.org/meta-selinux synced 2026-01-01 13:58:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

refpolicy-minimum: update base refpolicy 20140311

Browse Source 
A simple forward-port of refpolicy-minimum to use the 20140311 base
refpolicy.

Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
This commit is contained in:
Joe MacDonald 2014-09-19 16:55:06 -04:00
parent df9d891616
commit 0834a07d00
2 changed files with 29 additions and 58 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

58
recipes-security/refpolicy/refpolicy-minimum_2.20130424.bb
View File

@ -1,58 +0,0 @@
PR = "r99"
include refpolicy-targeted_${PV}.bb
SUMMARY = "SELinux minimum policy"
DESCRIPTION = "\
This is a minimum reference policy with just core policy modules, and \
could be used as a base for customizing targeted policy. \
Pretty much everything runs as initrc_t or unconfined_t so all of the \
domains are unconfined. \
"
POLICY_NAME = "minimum"
FILESEXTRAPATHS_prepend := "${THISDIR}/files:${THISDIR}/refpolicy-${PV}:${THISDIR}/refpolicy-targeted:"
CORE_POLICY_MODULES = "unconfined \
selinuxutil storage sysnetwork \
application libraries miscfiles logging userdomain \
init mount modutils getty authlogin locallogin \
"
# nscd caches libc-issued requests to the name service.
# Without nscd.pp, commands want to use these caches will be blocked.
EXTRA_POLICY_MODULES += "nscd"
# pam_mail module enables checking and display of mailbox status upon
# "login", so "login" process will access to /var/spool/mail.
EXTRA_POLICY_MODULES += "mta"
POLICY_MODULES_MIN = "${CORE_POLICY_MODULES} ${EXTRA_POLICY_MODULES}"
# re-write the same func from refpolicy_common.inc
prepare_policy_store () {
oe_runmake 'DESTDIR=${D}' 'prefix=${D}${prefix}' install
# Prepare to create policy store
mkdir -p ${D}${sysconfdir}/selinux/
mkdir -p ${D}${sysconfdir}/selinux/${POLICY_NAME}/policy
mkdir -p ${D}${sysconfdir}/selinux/${POLICY_NAME}/modules/active/modules
mkdir -p ${D}${sysconfdir}/selinux/${POLICY_NAME}/contexts/files
touch ${D}${sysconfdir}/selinux/${POLICY_NAME}/contexts/files/file_contexts.local
if ${@base_contains('DISTRO_FEATURES','compressed_policy','true','false',d)}; then
bzip2 base.pp
cp base.pp.bz2 ${D}${sysconfdir}/selinux/${POLICY_NAME}/modules/active/base.pp
for i in ${POLICY_MODULES_MIN}; do
bzip2 $i
cp ${i}.bz2 ${D}${sysconfdir}/selinux/${POLICY_NAME}/modules/active/modules/`basename $i`
done
else
bzip2 -c ${D}${datadir}/selinux/${POLICY_NAME}/base.pp > \
${D}${sysconfdir}/selinux/${POLICY_NAME}/modules/active/base.pp
for i in ${POLICY_MODULES_MIN}; do
bzip2 -c ${D}${datadir}/selinux/${POLICY_NAME}/$i.pp > \
${D}${sysconfdir}/selinux/${POLICY_NAME}/modules/active/modules/$i.pp
done
fi
}

29
recipes-security/refpolicy/refpolicy-minimum_2.20140311.bb Normal file
View File

@ -0,0 +1,29 @@
include refpolicy-targeted_${PV}.bb
SUMMARY = "SELinux minimum policy"
DESCRIPTION = "\
This is a minimum reference policy with just core policy modules, and \
could be used as a base for customizing targeted policy. \
Pretty much everything runs as initrc_t or unconfined_t so all of the \
domains are unconfined. \
"
POLICY_NAME = "minimum"
FILESEXTRAPATHS_prepend := "${THISDIR}/files:${THISDIR}/refpolicy-${PV}:${THISDIR}/refpolicy-targeted:"
CORE_POLICY_MODULES = "unconfined \
selinuxutil storage sysnetwork \
application libraries miscfiles logging userdomain \
init mount modutils getty authlogin locallogin \
"
# nscd caches libc-issued requests to the name service.
# Without nscd.pp, commands want to use these caches will be blocked.
EXTRA_POLICY_MODULES += "nscd"
# pam_mail module enables checking and display of mailbox status upon
# "login", so "login" process will access to /var/spool/mail.
EXTRA_POLICY_MODULES += "mta"
POLICY_MODULES_MIN = "${CORE_POLICY_MODULES} ${EXTRA_POLICY_MODULES}"