NetCube-Systems-Austria/kumquat-buildroot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
a7062df327
kumquat-buildroot/package/refpolicy/refpolicy.mk

135 lines
3.9 KiB
Makefile
Raw Normal View History

refpolicy: new package The patch is for adding selinux reference policy (refpolicy). It is a complete SELinux policy that can be used as the system policy for a variety of systems and used as the basis for creating other policies. Signed-off-by: Adam Duskett <Adamduskett@outlook.com> Tested-by: Matt Weber <matthew.weber@rockwellcollins.com> Acked-by: Matt Weber <matthew.weber@rockwellcollins.com> [Thomas: - add entry to DEVELOPERS file - remove redundant dependencies - drop unused REFPOLICY_PYINC option - use SPDX tag for license - minor formatting fixes.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-05-20 22:41:41 +02:00
################################################################################
#
# refpolicy
#
################################################################################
REFPOLICY_LICENSE = GPL-2.0
REFPOLICY_LICENSE_FILES = COPYING
package/refpolicy: fix REFPOLICY_CPE_ID_VENDOR cpe:2.3:a:selinuxproject:refpolicy is a valid CPE identifier for this package: https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Aselinuxproject%3Arefpolicy Indeed, cpe:2.3:a:tresys:refpolicy has been deprecated since April 21th: <cpe-item name="cpe:/a:tresys:refpolicy:2.20180701" deprecated="true" deprecation_date="2021-04-21T16:55:43.710Z"> <title xml:lang="en-US">Tresys refpolicy 2.20180701</title> <reference href="https://github.com/TresysTechnology/refpolicy">Product</reference> <cpe-23:cpe23-item name="cpe:2.3:a:tresys:refpolicy:2.20180701:*:*:*:*:*:*:*"> <cpe-23:deprecated-by name="cpe:2.3:a:selinuxproject:refpolicy:2.20180701:*:*:*:*:*:*:*" type="NAME_CORRECTION"/> Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2021-05-15 13:25:27 +02:00
REFPOLICY_CPE_ID_VENDOR = selinuxproject
refpolicy: new package The patch is for adding selinux reference policy (refpolicy). It is a complete SELinux policy that can be used as the system policy for a variety of systems and used as the basis for creating other policies. Signed-off-by: Adam Duskett <Adamduskett@outlook.com> Tested-by: Matt Weber <matthew.weber@rockwellcollins.com> Acked-by: Matt Weber <matthew.weber@rockwellcollins.com> [Thomas: - add entry to DEVELOPERS file - remove redundant dependencies - drop unused REFPOLICY_PYINC option - use SPDX tag for license - minor formatting fixes.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-05-20 22:41:41 +02:00
REFPOLICY_INSTALL_STAGING = YES
REFPOLICY_DEPENDENCIES = \
host-m4 \
host-checkpolicy \
host-policycoreutils \
package/refpolicy: bump version to 2.20190609 Other changes: - Depend on host-python3, as python2 support was removed. Signed-off-by: Adam Duskett <aduskett@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-02-03 14:29:48 +01:00
host-python3 \
refpolicy: new package The patch is for adding selinux reference policy (refpolicy). It is a complete SELinux policy that can be used as the system policy for a variety of systems and used as the basis for creating other policies. Signed-off-by: Adam Duskett <Adamduskett@outlook.com> Tested-by: Matt Weber <matthew.weber@rockwellcollins.com> Acked-by: Matt Weber <matthew.weber@rockwellcollins.com> [Thomas: - add entry to DEVELOPERS file - remove redundant dependencies - drop unused REFPOLICY_PYINC option - use SPDX tag for license - minor formatting fixes.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-05-20 22:41:41 +02:00
host-setools \
package/refpolicy: make sure xmllint is used When parsing and adding modules the refpolicy build system checks their validity using xmllint. By default the host system version is used and if not found an error is displayed but the build is not stopped. This leads to interesting issues where modules are not added correctly to modules.conf[1] (other possible issues are likely). Fix this by adding a dependency on host-libxml2 and explicitly use the xmllint binary built by Buildroot. [1] https://lore.kernel.org/buildroot/20210830114531.2285178-1-jose.pekkarinen@unikie.com/ Tested-by: José Pekkarinen <jose.pekkarinen@unikie.com> Signed-off-by: Antoine Tenart <atenart@kernel.org> Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2021-09-23 11:21:36 +02:00
host-gawk \
host-libxml2
refpolicy: new package The patch is for adding selinux reference policy (refpolicy). It is a complete SELinux policy that can be used as the system policy for a variety of systems and used as the basis for creating other policies. Signed-off-by: Adam Duskett <Adamduskett@outlook.com> Tested-by: Matt Weber <matthew.weber@rockwellcollins.com> Acked-by: Matt Weber <matthew.weber@rockwellcollins.com> [Thomas: - add entry to DEVELOPERS file - remove redundant dependencies - drop unused REFPOLICY_PYINC option - use SPDX tag for license - minor formatting fixes.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-05-20 22:41:41 +02:00
package/refpolicy: allow to provide a custom refpolicy Add support for the user to provide a fully custom refpolicy. When this is used, modules aren't disabled anymore and packages do not select refpolicy available modules either. The custom refpolicy must define the full policy explicitly, and must be a fork of the original refpolicy, to have the same build system. This is added to allow users to fully control an SELinux policy, by providing a complete custom policy. Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-07-31 12:10:37 +02:00
ifeq ($(BR2_PACKAGE_REFPOLICY_CUSTOM_GIT),y)
REFPOLICY_VERSION = $(call qstrip,$(BR2_PACKAGE_REFPOLICY_CUSTOM_REPO_VERSION))
REFPOLICY_SITE = $(call qstrip,$(BR2_PACKAGE_REFPOLICY_CUSTOM_REPO_URL))
REFPOLICY_SITE_METHOD = git
BR_NO_CHECK_HASH_FOR += $(REFPOLICY_SOURCE)
else
package/refpolicy: bump to version 2.20220106 Drop patches (already in version) https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20220106 Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2022-01-08 18:47:49 +01:00
REFPOLICY_VERSION = 2.20220106
package/refpolicy: allow to provide a custom refpolicy Add support for the user to provide a fully custom refpolicy. When this is used, modules aren't disabled anymore and packages do not select refpolicy available modules either. The custom refpolicy must define the full policy explicitly, and must be a fork of the original refpolicy, to have the same build system. This is added to allow users to fully control an SELinux policy, by providing a complete custom policy. Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-07-31 12:10:37 +02:00
REFPOLICY_SOURCE = refpolicy-$(REFPOLICY_VERSION).tar.bz2
package/refpolicy: bump version to 2.20210908 - Drop upstreamed patches - Add Upstream status to remaining patch - Update indentation in hash file (two spaces) - Fix the following build failure with wireshark raised since commit 975ab2fa88a0c94b362499ea8ad99222f335fb45 thanks to https://github.com/SELinuxProject/refpolicy/commit/d5c571c85567fe191fcc64dfb99b36788f806ceb: Compiling targeted policy.31 env LD_LIBRARY_PATH="/tmp/instance-0/output-1/host/lib:/tmp/instance-0/output-1/host/usr/lib" /tmp/instance-0/output-1/host/usr/bin/checkpolicy -c 31 -U deny -S -O -E policy.conf -o policy.31 policy/modules/apps/wireshark.te:96:ERROR 'unknown type xdg_downloads_t' at token ';' on line 645315: #line 96 allow wireshark_t xdg_downloads_t:dir { getattr search open }; checkpolicy: error(s) encountered while parsing configuration make[1]: *** [Rules.monolithic:79: policy.31] Error 1 https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20210908 Fixes: - http://autobuild.buildroot.org/results/dfbc667e0c17072ddab89a03244f572d5234da50 Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2021-09-09 07:57:58 +02:00
REFPOLICY_SITE = https://github.com/SELinuxProject/refpolicy/releases/download/RELEASE_$(subst .,_,$(REFPOLICY_VERSION))
package/refpolicy: allow to provide a custom refpolicy Add support for the user to provide a fully custom refpolicy. When this is used, modules aren't disabled anymore and packages do not select refpolicy available modules either. The custom refpolicy must define the full policy explicitly, and must be a fork of the original refpolicy, to have the same build system. This is added to allow users to fully control an SELinux policy, by providing a complete custom policy. Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-07-31 12:10:37 +02:00
endif
refpolicy: new package The patch is for adding selinux reference policy (refpolicy). It is a complete SELinux policy that can be used as the system policy for a variety of systems and used as the basis for creating other policies. Signed-off-by: Adam Duskett <Adamduskett@outlook.com> Tested-by: Matt Weber <matthew.weber@rockwellcollins.com> Acked-by: Matt Weber <matthew.weber@rockwellcollins.com> [Thomas: - add entry to DEVELOPERS file - remove redundant dependencies - drop unused REFPOLICY_PYINC option - use SPDX tag for license - minor formatting fixes.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-05-20 22:41:41 +02:00
# Cannot use multiple threads to build the reference policy
REFPOLICY_MAKE = \
package/refpolicy: bump version to 2.20190609 Other changes: - Depend on host-python3, as python2 support was removed. Signed-off-by: Adam Duskett <aduskett@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-02-03 14:29:48 +01:00
PYTHON=$(HOST_DIR)/usr/bin/python3 \
package/refpolicy: make sure xmllint is used When parsing and adding modules the refpolicy build system checks their validity using xmllint. By default the host system version is used and if not found an error is displayed but the build is not stopped. This leads to interesting issues where modules are not added correctly to modules.conf[1] (other possible issues are likely). Fix this by adding a dependency on host-libxml2 and explicitly use the xmllint binary built by Buildroot. [1] https://lore.kernel.org/buildroot/20210830114531.2285178-1-jose.pekkarinen@unikie.com/ Tested-by: José Pekkarinen <jose.pekkarinen@unikie.com> Signed-off-by: Antoine Tenart <atenart@kernel.org> Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2021-09-23 11:21:36 +02:00
XMLLINT=$(LIBXML2_HOST_BINARY) \
refpolicy: new package The patch is for adding selinux reference policy (refpolicy). It is a complete SELinux policy that can be used as the system policy for a variety of systems and used as the basis for creating other policies. Signed-off-by: Adam Duskett <Adamduskett@outlook.com> Tested-by: Matt Weber <matthew.weber@rockwellcollins.com> Acked-by: Matt Weber <matthew.weber@rockwellcollins.com> [Thomas: - add entry to DEVELOPERS file - remove redundant dependencies - drop unused REFPOLICY_PYINC option - use SPDX tag for license - minor formatting fixes.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-05-20 22:41:41 +02:00
TEST_TOOLCHAIN=$(HOST_DIR) \
$(TARGET_MAKE_ENV) \
$(MAKE1)
package/libsepol: change policy version to an int The policy version has to be a number, as such, set the type to int. Due to the type change, we can't any longer do the legacy handling of re-using the refpolicy policy version. Signed-off-by: Adam Duskett <aduskett@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-02-03 14:29:50 +01:00
REFPOLICY_POLICY_VERSION = $(BR2_PACKAGE_LIBSEPOL_POLICY_VERSION)
refpolicy: add ability to set default state. SELinux requires a config file in /etc/selinux which controls the state of SELinux on the system. This config file has two options set in it: SELINUX which set's the state of selinux on boot. SELINUXTYPE which should equal the name of the policy. In this case, the default name is targeted. This patch adds: - A choice menu on Config.in that allows the user to select a default SELinux state. - A basic config file that will be installed to target/etc/selinux and will set SELINUX= to the selected state. Signed-off-by: Adam Duskett <Adamduskett@outlook.com> Acked-by: Matt Weber <matthew.weber@rockwellcollins.com> [Thomas: - rename option to BR2_PACKAGE_REFPOLICY_POLICY_STATE - qstrip the variable - drop unused REFPOLICY_NAME variable.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-05-20 22:41:43 +02:00
REFPOLICY_POLICY_STATE = \
$(call qstrip,$(BR2_PACKAGE_REFPOLICY_POLICY_STATE))
refpolicy: add ability to specify policy version Refpolicy by default will build the highest version supported. This may cause older kernels to not load the policy. This patch adds a custom policy version string which is defaulted to 30, which is the highest supported as of today. Signed-off-by: Adam Duskett <Adamduskett@outlook.com> Acked-by: Matt Weber <matthew.weber@rockwellcollins.com> [Thomas: - rename option to BR2_PACKAGE_REFPOLICY_POLICY_VERSION - use qstrip to remove double quotes] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-05-20 22:41:42 +02:00
package/refpolicy: allow to provide a custom refpolicy Add support for the user to provide a fully custom refpolicy. When this is used, modules aren't disabled anymore and packages do not select refpolicy available modules either. The custom refpolicy must define the full policy explicitly, and must be a fork of the original refpolicy, to have the same build system. This is added to allow users to fully control an SELinux policy, by providing a complete custom policy. Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-07-31 12:10:37 +02:00
ifeq ($(BR2_PACKAGE_REFPOLICY_UPSTREAM_VERSION),y)
package/refpolicy: allow providing user defined modules Allow users to provide custom SELinux modules to be part of the final policy. A new configuration variable is added, pointing to list of directories containing the custom modules. SELinux modules do require a metadata.xml file to be well integrated in the refpolicy build. If this file isn't provided, it will be automatically created. For now, this option requires the extra modules to be directly into the BR2_REFPOLICY_EXTRA_MODULES directory, and subfolders aren't supported. They may never be, as having subfolders could introduce issues when two different modules have the same name (which isn't supported by the refpolicy). Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-07-31 12:10:35 +02:00
# Allow to provide out-of-tree SELinux modules in addition to the ones
# in the refpolicy.
package/refpolicy: allow packages to provide their own SELinux modules Allow packages to have an 'selinux' subfolder containing SELinux modules (sources) to be synced and compiled within the refpolicy, if the package is selected. Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-07-31 12:10:38 +02:00
REFPOLICY_EXTRA_MODULES_DIRS = \
package/refpolicy: ensure REFPOLICY_EXTRA_MODULES_DIRS is empty when it should be When both BR2_REFPOLICY_EXTRA_MODULES_DIRS and PACKAGES_SELINUX_EXTRA_MODULES_DIRS are empty, we expect REFPOLICY_EXTRA_MODULES_DIRS to also be empty. However, due to spaces, this is not the case. This commit adds a $(strip ...) call to ensure it is the case. Thanks to this, the check on whether REFPOLICY_EXTRA_MODULES_DIRS is empty later on will really work as it should. Reported-by: Antoine Ténart <antoine.tenart@bootlin.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-09-04 17:19:16 +02:00
$(strip \
$(call qstrip,$(BR2_REFPOLICY_EXTRA_MODULES_DIRS)) \
$(PACKAGES_SELINUX_EXTRA_MODULES_DIRS))
package/refpolicy: allow providing user defined modules Allow users to provide custom SELinux modules to be part of the final policy. A new configuration variable is added, pointing to list of directories containing the custom modules. SELinux modules do require a metadata.xml file to be well integrated in the refpolicy build. If this file isn't provided, it will be automatically created. For now, this option requires the extra modules to be directly into the BR2_REFPOLICY_EXTRA_MODULES directory, and subfolders aren't supported. They may never be, as having subfolders could introduce issues when two different modules have the same name (which isn't supported by the refpolicy). Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-07-31 12:10:35 +02:00
$(foreach dir,$(REFPOLICY_EXTRA_MODULES_DIRS),\
$(if $(wildcard $(dir)),,\
$(error BR2_REFPOLICY_EXTRA_MODULES_DIRS contains nonexistent directory $(dir))))
package/refpolicy: smaller monolithic policy The refpolicy is configured to use a monolithic build, compiling all the available modules (whether they're 'base' or 'modules' ones) in the binary policy. The result is a quite big SELinux policy, with a lot more rules than what would be needed in a Buildroot image. Refactor the refpolicy build configuration to enable less modules by default. To achieve this, all the modules marked as being part of the 'base' policy are kept but all the modules marked as being only 'modules' are disabled. Then a static list of modules (in addition to the already selected 'base' ones) are enabled. The result is a much smaller refpolicy: tests showed a reduction of the binary policy from 2.4M to 249K (~90% smaller). This minimal set of SELinux modules should allow to boot a system in enforcing mode in the future. It currently does not work, not because extra modules are needed, but because of required changes within the selected modules. This patch would break backward compatibility as the refpolicy will no longer have all the modules provided by the project, but only those selected. This should not be an issue as this configuration was not suitable directly for a real system. Modifications had to be done. If we still find out later that this is an issue for someone, we'll have the ability to mimic what was done previously thanks to other mechanisms (such as providing the upstream policy as a "custom" policy location). Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-07-31 12:10:29 +02:00
REFPOLICY_MODULES = \
application \
authlogin \
getty \
init \
libraries \
locallogin \
logging \
miscfiles \
modutils \
mount \
selinuxutil \
storage \
sysadm \
sysnetwork \
unconfined \
package/refpolicy: allow packages to select SELinux modules Add support for packages to enable SELinux modules already supported by the refpolicy, but not selected by default in its policy. With this commit, packages will be able to do something like: SYSTEMD_SELINUX_MODULES = systemd udev to enable additional SELinux modules. Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-07-31 12:10:30 +02:00
userdomain \
package/refpolicy: allow providing user defined modules Allow users to provide custom SELinux modules to be part of the final policy. A new configuration variable is added, pointing to list of directories containing the custom modules. SELinux modules do require a metadata.xml file to be well integrated in the refpolicy build. If this file isn't provided, it will be automatically created. For now, this option requires the extra modules to be directly into the BR2_REFPOLICY_EXTRA_MODULES directory, and subfolders aren't supported. They may never be, as having subfolders could introduce issues when two different modules have the same name (which isn't supported by the refpolicy). Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-07-31 12:10:35 +02:00
$(PACKAGES_SELINUX_MODULES) \
package/refpolicy: allow selecting additional modules Allow users to select additional modules available in the refpolicy, to be built in the binary policy. This will allow non-base modules to be selected based on the user use-case and to select extra module dependencies when providing out-of-tree modules. Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-07-31 12:10:36 +02:00
$(call qstrip,$(BR2_REFPOLICY_EXTRA_MODULES)) \
package/refpolicy: allow providing user defined modules Allow users to provide custom SELinux modules to be part of the final policy. A new configuration variable is added, pointing to list of directories containing the custom modules. SELinux modules do require a metadata.xml file to be well integrated in the refpolicy build. If this file isn't provided, it will be automatically created. For now, this option requires the extra modules to be directly into the BR2_REFPOLICY_EXTRA_MODULES directory, and subfolders aren't supported. They may never be, as having subfolders could introduce issues when two different modules have the same name (which isn't supported by the refpolicy). Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-07-31 12:10:35 +02:00
$(foreach d,$(REFPOLICY_EXTRA_MODULES_DIRS),\
$(basename $(notdir $(wildcard $(d)/*.te))))
define REFPOLICY_COPY_EXTRA_MODULES
mkdir -p $(@D)/policy/modules/buildroot
rsync -au $(addsuffix /*,$(REFPOLICY_EXTRA_MODULES_DIRS)) \
$(@D)/policy/modules/buildroot/
if [ ! -f $(@D)/policy/modules/buildroot/metadata.xml ]; then \
echo "<summary>Buildroot extra modules</summary>" > \
$(@D)/policy/modules/buildroot/metadata.xml; \
fi
endef
package/refpolicy: smaller monolithic policy The refpolicy is configured to use a monolithic build, compiling all the available modules (whether they're 'base' or 'modules' ones) in the binary policy. The result is a quite big SELinux policy, with a lot more rules than what would be needed in a Buildroot image. Refactor the refpolicy build configuration to enable less modules by default. To achieve this, all the modules marked as being part of the 'base' policy are kept but all the modules marked as being only 'modules' are disabled. Then a static list of modules (in addition to the already selected 'base' ones) are enabled. The result is a much smaller refpolicy: tests showed a reduction of the binary policy from 2.4M to 249K (~90% smaller). This minimal set of SELinux modules should allow to boot a system in enforcing mode in the future. It currently does not work, not because extra modules are needed, but because of required changes within the selected modules. This patch would break backward compatibility as the refpolicy will no longer have all the modules provided by the project, but only those selected. This should not be an issue as this configuration was not suitable directly for a real system. Modifications had to be done. If we still find out later that this is an issue for someone, we'll have the ability to mimic what was done previously thanks to other mechanisms (such as providing the upstream policy as a "custom" policy location). Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-07-31 12:10:29 +02:00
# In the context of a monolithic policy enabling a piece of the policy as
# 'base' or 'module' is equivalent, so we enable them as 'base'.
define REFPOLICY_CONFIGURE_MODULES
$(SED) "s/ = module/ = no/g" $(@D)/policy/modules.conf
package/refpolicy: allow packages to select SELinux modules Add support for packages to enable SELinux modules already supported by the refpolicy, but not selected by default in its policy. With this commit, packages will be able to do something like: SYSTEMD_SELINUX_MODULES = systemd udev to enable additional SELinux modules. Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-07-31 12:10:30 +02:00
$(foreach m,$(sort $(REFPOLICY_MODULES)),
package/refpolicy: smaller monolithic policy The refpolicy is configured to use a monolithic build, compiling all the available modules (whether they're 'base' or 'modules' ones) in the binary policy. The result is a quite big SELinux policy, with a lot more rules than what would be needed in a Buildroot image. Refactor the refpolicy build configuration to enable less modules by default. To achieve this, all the modules marked as being part of the 'base' policy are kept but all the modules marked as being only 'modules' are disabled. Then a static list of modules (in addition to the already selected 'base' ones) are enabled. The result is a much smaller refpolicy: tests showed a reduction of the binary policy from 2.4M to 249K (~90% smaller). This minimal set of SELinux modules should allow to boot a system in enforcing mode in the future. It currently does not work, not because extra modules are needed, but because of required changes within the selected modules. This patch would break backward compatibility as the refpolicy will no longer have all the modules provided by the project, but only those selected. This should not be an issue as this configuration was not suitable directly for a real system. Modifications had to be done. If we still find out later that this is an issue for someone, we'll have the ability to mimic what was done previously thanks to other mechanisms (such as providing the upstream policy as a "custom" policy location). Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-07-31 12:10:29 +02:00
$(SED) "/^$(m) =/c\$(m) = base" $(@D)/policy/modules.conf
)
endef
package/refpolicy: allow to provide a custom refpolicy Add support for the user to provide a fully custom refpolicy. When this is used, modules aren't disabled anymore and packages do not select refpolicy available modules either. The custom refpolicy must define the full policy explicitly, and must be a fork of the original refpolicy, to have the same build system. This is added to allow users to fully control an SELinux policy, by providing a complete custom policy. Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-07-31 12:10:37 +02:00
endif # BR2_PACKAGE_REFPOLICY_UPSTREAM_VERSION = y
package/refpolicy: enable systemd support This patch enables systemd support in the refpolicy by turning on the 'SYSTEMD' policy build option when systemd is enabled in Buildroot. This enables conditional rules in SELinux policy modules (by defining 'init_systemd'), to better support systemd. Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-07-03 15:19:22 +02:00
ifeq ($(BR2_INIT_SYSTEMD),y)
define REFPOLICY_CONFIGURE_SYSTEMD
$(SED) "/SYSTEMD/c\SYSTEMD = y" $(@D)/build.conf
endef
endif
refpolicy: new package The patch is for adding selinux reference policy (refpolicy). It is a complete SELinux policy that can be used as the system policy for a variety of systems and used as the basis for creating other policies. Signed-off-by: Adam Duskett <Adamduskett@outlook.com> Tested-by: Matt Weber <matthew.weber@rockwellcollins.com> Acked-by: Matt Weber <matthew.weber@rockwellcollins.com> [Thomas: - add entry to DEVELOPERS file - remove redundant dependencies - drop unused REFPOLICY_PYINC option - use SPDX tag for license - minor formatting fixes.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-05-20 22:41:41 +02:00
define REFPOLICY_CONFIGURE_CMDS
refpolicy: add ability to specify policy version Refpolicy by default will build the highest version supported. This may cause older kernels to not load the policy. This patch adds a custom policy version string which is defaulted to 30, which is the highest supported as of today. Signed-off-by: Adam Duskett <Adamduskett@outlook.com> Acked-by: Matt Weber <matthew.weber@rockwellcollins.com> [Thomas: - rename option to BR2_PACKAGE_REFPOLICY_POLICY_VERSION - use qstrip to remove double quotes] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-05-20 22:41:42 +02:00
$(SED) "/OUTPUT_POLICY/c\OUTPUT_POLICY = $(REFPOLICY_POLICY_VERSION)" \
$(@D)/build.conf
refpolicy: new package The patch is for adding selinux reference policy (refpolicy). It is a complete SELinux policy that can be used as the system policy for a variety of systems and used as the basis for creating other policies. Signed-off-by: Adam Duskett <Adamduskett@outlook.com> Tested-by: Matt Weber <matthew.weber@rockwellcollins.com> Acked-by: Matt Weber <matthew.weber@rockwellcollins.com> [Thomas: - add entry to DEVELOPERS file - remove redundant dependencies - drop unused REFPOLICY_PYINC option - use SPDX tag for license - minor formatting fixes.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-05-20 22:41:41 +02:00
$(SED) "/MONOLITHIC/c\MONOLITHIC = y" $(@D)/build.conf
$(SED) "/NAME/c\NAME = targeted" $(@D)/build.conf
package/refpolicy: enable systemd support This patch enables systemd support in the refpolicy by turning on the 'SYSTEMD' policy build option when systemd is enabled in Buildroot. This enables conditional rules in SELinux policy modules (by defining 'init_systemd'), to better support systemd. Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-07-03 15:19:22 +02:00
$(REFPOLICY_CONFIGURE_SYSTEMD)
package/refpolicy: test REFPOLICY_EXTRA_MODULES_DIR differently REFPOLICY_EXTRA_MODULES_DIRS contains $(PACKAGES_SELINUX_EXTRA_MODULES_DIRS) which is filled in by package/pkg-generic.mk with the list of packages that have a selinux/ sub-directory. Due to how variable expansion works, if there is an ifeq/ifneq test of REFPOLICY_EXTRA_MODULES_DIRS, it will only see the value of REFPOLICY_EXTRA_MODULES_DIRS with the list of packages *before* refpolicy in alphabetic ordering. This means that packages after refpolicy in alphabetic ordering would not be taken into account. To fix this, we switch to an $(if ...) test, which allows the variable to really be evaluated during the refpolicy build. This makes sures the expansion is correct. Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-10-06 13:57:26 +02:00
$(if $(REFPOLICY_EXTRA_MODULES_DIRS), \
$(REFPOLICY_COPY_EXTRA_MODULES)
)
package/refpolicy: fix the configure, build and install steps The refpolicy configure and build step were not correctly defined. The configuration was split between the configure and build step, while both the compilation and the installation were done in the install step. Fix this by moving all the configuration within the configuration step and by adding a call to make in the build step to compile the policy. Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-07-31 12:10:39 +02:00
$(REFPOLICY_MAKE) -C $(@D) bare conf
$(REFPOLICY_CONFIGURE_MODULES)
refpolicy: new package The patch is for adding selinux reference policy (refpolicy). It is a complete SELinux policy that can be used as the system policy for a variety of systems and used as the basis for creating other policies. Signed-off-by: Adam Duskett <Adamduskett@outlook.com> Tested-by: Matt Weber <matthew.weber@rockwellcollins.com> Acked-by: Matt Weber <matthew.weber@rockwellcollins.com> [Thomas: - add entry to DEVELOPERS file - remove redundant dependencies - drop unused REFPOLICY_PYINC option - use SPDX tag for license - minor formatting fixes.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-05-20 22:41:41 +02:00
endef
define REFPOLICY_BUILD_CMDS
package/refpolicy: fix the configure, build and install steps The refpolicy configure and build step were not correctly defined. The configuration was split between the configure and build step, while both the compilation and the installation were done in the install step. Fix this by moving all the configuration within the configuration step and by adding a call to make in the build step to compile the policy. Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-07-31 12:10:39 +02:00
$(REFPOLICY_MAKE) -C $(@D) policy
refpolicy: new package The patch is for adding selinux reference policy (refpolicy). It is a complete SELinux policy that can be used as the system policy for a variety of systems and used as the basis for creating other policies. Signed-off-by: Adam Duskett <Adamduskett@outlook.com> Tested-by: Matt Weber <matthew.weber@rockwellcollins.com> Acked-by: Matt Weber <matthew.weber@rockwellcollins.com> [Thomas: - add entry to DEVELOPERS file - remove redundant dependencies - drop unused REFPOLICY_PYINC option - use SPDX tag for license - minor formatting fixes.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-05-20 22:41:41 +02:00
endef
define REFPOLICY_INSTALL_STAGING_CMDS
$(REFPOLICY_MAKE) -C $(@D) DESTDIR=$(STAGING_DIR) \
install-src install-headers
endef
define REFPOLICY_INSTALL_TARGET_CMDS
$(REFPOLICY_MAKE) -C $(@D) DESTDIR=$(TARGET_DIR) install
refpolicy: add ability to set default state. SELinux requires a config file in /etc/selinux which controls the state of SELinux on the system. This config file has two options set in it: SELINUX which set's the state of selinux on boot. SELINUXTYPE which should equal the name of the policy. In this case, the default name is targeted. This patch adds: - A choice menu on Config.in that allows the user to select a default SELinux state. - A basic config file that will be installed to target/etc/selinux and will set SELINUX= to the selected state. Signed-off-by: Adam Duskett <Adamduskett@outlook.com> Acked-by: Matt Weber <matthew.weber@rockwellcollins.com> [Thomas: - rename option to BR2_PACKAGE_REFPOLICY_POLICY_STATE - qstrip the variable - drop unused REFPOLICY_NAME variable.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-05-20 22:41:43 +02:00
$(INSTALL) -m 0755 -D package/refpolicy/config \
$(TARGET_DIR)/etc/selinux/config
$(SED) "/^SELINUX=/c\SELINUX=$(REFPOLICY_POLICY_STATE)" \
$(TARGET_DIR)/etc/selinux/config
refpolicy: new package The patch is for adding selinux reference policy (refpolicy). It is a complete SELinux policy that can be used as the system policy for a variety of systems and used as the basis for creating other policies. Signed-off-by: Adam Duskett <Adamduskett@outlook.com> Tested-by: Matt Weber <matthew.weber@rockwellcollins.com> Acked-by: Matt Weber <matthew.weber@rockwellcollins.com> [Thomas: - add entry to DEVELOPERS file - remove redundant dependencies - drop unused REFPOLICY_PYINC option - use SPDX tag for license - minor formatting fixes.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-05-20 22:41:41 +02:00
endef
$(eval $(generic-package))
Reference in New Issue Copy Permalink