CaROS/meta-selinux
3
0
Fork 0
mirror of git://git.yoctoproject.org/meta-selinux synced 2026-01-01 13:58:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

base-files: set correct label for /var/volatile

Browse Source 
By default /var/volatile will be mounted with tmpfs_t instead of var_t
label, which will cause us to have to add some extra rules to eliminate
avc denials of some services.

Set rootcontext for /var/volatile in fstab to make sure it is mounted
with correct label.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Joe MacDonald <joe@deserted.net>
This commit is contained in:
Yi Zhao 2022-11-02 15:30:50 +08:00 committed by Joe MacDonald
parent cccf2bbe02
commit 08a2705c00
2 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
recipes-core/base-files/base-files_%.bbappend Normal file
View File

@ -0,0 +1 @@
require ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'base-files_selinux.inc', '', d)}

13
recipes-core/base-files/base-files_selinux.inc Normal file
View File

@ -0,0 +1,13 @@
REFPOLICY_TYPE = "${@d.getVar('PREFERRED_PROVIDER_virtual/refpolicy').split('-')[1] or ''}"
do_install:append () {
if [ -n "${REFPOLICY_TYPE}" ]; then
if [ "${REFPOLICY_TYPE}" = "standard" ]; then
sed -i 's/\s*\/var\/volatile\s*tmpfs\s*defaults/&,rootcontext=system_u:object_r:var_t/' \
${D}${sysconfdir}/fstab
else
sed -i 's/\s*\/var\/volatile\s*tmpfs\s*defaults/&,rootcontext=system_u:object_r:var_t:s0/' \
${D}${sysconfdir}/fstab
fi
fi
}