summaryrefslogtreecommitdiffstats
path: root/meta-agl-bsp/meta-raspberrypi/recipes-bsp/u-boot-otascript
diff options
context:
space:
mode:
authorAnton Gerasimov <anton@advancedtelematic.com>2017-04-11 16:49:11 +0200
committerJan-Simon Moeller <jsmoeller@linuxfoundation.org>2017-04-24 12:09:43 +0000
commit8807f8e2268ee5297fac4f82e24bff8ba03e43c1 (patch)
tree1923ed1d572185b68e21bdc4dd3df6a331e0a56b /meta-agl-bsp/meta-raspberrypi/recipes-bsp/u-boot-otascript
parent61bf6803fdce1cac3f6cb5c7fabe2e5fe81d5450 (diff)
Switch to meta-updater
Replace SOTA-related sections with includes, moved u-boot-ota common to minnowboard and qemu to meta-agl-bsp Change-Id: I0629a63154ff90bd712f621297b886505a2f462c Signed-off-by: Anton Gerasimov <anton@advancedtelematic.com> Reviewed-on: https://gerrit.automotivelinux.org/gerrit/9189 Reviewed-by: Jan-Simon Moeller <jsmoeller@linuxfoundation.org> Tested-by: Jan-Simon Moeller <jsmoeller@linuxfoundation.org>
Diffstat (limited to 'meta-agl-bsp/meta-raspberrypi/recipes-bsp/u-boot-otascript')
-rw-r--r--meta-agl-bsp/meta-raspberrypi/recipes-bsp/u-boot-otascript/u-boot-otascript.bb32
-rw-r--r--meta-agl-bsp/meta-raspberrypi/recipes-bsp/u-boot-otascript/u-boot-otascript/boot.scr3
-rw-r--r--meta-agl-bsp/meta-raspberrypi/recipes-bsp/u-boot-otascript/u-boot-otascript/uEnv.cma.txt7
-rw-r--r--meta-agl-bsp/meta-raspberrypi/recipes-bsp/u-boot-otascript/u-boot-otascript/uEnv.txt7
4 files changed, 49 insertions, 0 deletions
diff --git a/meta-agl-bsp/meta-raspberrypi/recipes-bsp/u-boot-otascript/u-boot-otascript.bb b/meta-agl-bsp/meta-raspberrypi/recipes-bsp/u-boot-otascript/u-boot-otascript.bb
new file mode 100644
index 000000000..ccaefc715
--- /dev/null
+++ b/meta-agl-bsp/meta-raspberrypi/recipes-bsp/u-boot-otascript/u-boot-otascript.bb
@@ -0,0 +1,32 @@
+DESCRIPTION = "Boot script for launching OTA-enabled images on raspberrypi"
+LICENSE = "MIT"
+LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384361b4de20420"
+
+DEPENDS = "u-boot-mkimage-native"
+
+COMPATIBLE_MACHINE = "raspberrypi"
+
+SRC_URI = "file://boot.scr \
+ file://uEnv.txt \
+ file://uEnv.cma.txt \
+ "
+
+S = "${WORKDIR}"
+
+inherit deploy
+
+do_deploy() {
+ install -d ${DEPLOYDIR}/bcm2835-bootfiles
+
+ mkimage -A arm -O linux -T script -C none -a 0 -e 0 -n "Ostree boot script" -d ${S}/boot.scr ${DEPLOYDIR}/bcm2835-bootfiles/boot.scr
+ if [ "${ENABLE_CMA}" = "1" ]; then
+ install -m 0755 ${S}/uEnv.cma.txt ${DEPLOYDIR}/bcm2835-bootfiles/uEnv.txt
+ else
+ install -m 0755 ${S}/uEnv.txt ${DEPLOYDIR}/bcm2835-bootfiles/uEnv.txt
+ fi
+}
+
+addtask deploy before do_package after do_install
+do_deploy[dirs] += "${DEPLOYDIR}/bcm2835-bootfiles"
+
+PACKAGE_ARCH = "${MACHINE_ARCH}"
diff --git a/meta-agl-bsp/meta-raspberrypi/recipes-bsp/u-boot-otascript/u-boot-otascript/boot.scr b/meta-agl-bsp/meta-raspberrypi/recipes-bsp/u-boot-otascript/u-boot-otascript/boot.scr
new file mode 100644
index 000000000..dc13f85b2
--- /dev/null
+++ b/meta-agl-bsp/meta-raspberrypi/recipes-bsp/u-boot-otascript/u-boot-otascript/boot.scr
@@ -0,0 +1,3 @@
+fatload mmc 0:1 $loadaddr /uEnv.txt
+env import -t $loadaddr $filesize
+run bootcmd
diff --git a/meta-agl-bsp/meta-raspberrypi/recipes-bsp/u-boot-otascript/u-boot-otascript/uEnv.cma.txt b/meta-agl-bsp/meta-raspberrypi/recipes-bsp/u-boot-otascript/u-boot-otascript/uEnv.cma.txt
new file mode 100644
index 000000000..611119f09
--- /dev/null
+++ b/meta-agl-bsp/meta-raspberrypi/recipes-bsp/u-boot-otascript/u-boot-otascript/uEnv.cma.txt
@@ -0,0 +1,7 @@
+fdt_addr_r=0x0c800000
+bootcmd_dtb=fdt addr $fdt_addr_r; fdt get value bootargs_fdt /chosen bootargs
+bootcmd_otenv=ext2load mmc 0:2 $loadaddr /boot/loader/uEnv.txt; env import -t $loadaddr $filesize
+bootcmd_args=setenv bootargs "$bootargs $bootargs_fdt ostree_root=/dev/mmcblk0p2 root=/dev/ram0 rw rootwait rootdelay=2 ramdisk_size=8192 coherent_pool=6M smsc95xx.turbo_mode=N"
+bootcmd_load=ext2load mmc 0:2 $kernel_addr_r "/boot"$kernel_image; ext2load mmc 0:2 $ramdisk_addr_r "/boot"$ramdisk_image
+bootcmd_run=bootm $kernel_addr_r $ramdisk_addr_r $fdt_addr_r
+bootcmd=run bootcmd_dtb; run bootcmd_otenv; run bootcmd_args; run bootcmd_load; run bootcmd_run
diff --git a/meta-agl-bsp/meta-raspberrypi/recipes-bsp/u-boot-otascript/u-boot-otascript/uEnv.txt b/meta-agl-bsp/meta-raspberrypi/recipes-bsp/u-boot-otascript/u-boot-otascript/uEnv.txt
new file mode 100644
index 000000000..f6c05709b
--- /dev/null
+++ b/meta-agl-bsp/meta-raspberrypi/recipes-bsp/u-boot-otascript/u-boot-otascript/uEnv.txt
@@ -0,0 +1,7 @@
+fdt_addr_r=0x0c800000
+bootcmd_dtb=fdt addr $fdt_addr_r; fdt get value bootargs_fdt /chosen bootargs
+bootcmd_otenv=ext2load mmc 0:2 $loadaddr /boot/loader/uEnv.txt; env import -t $loadaddr $filesize
+bootcmd_args=setenv bootargs "$bootargs $bootargs_fdt ostree_root=/dev/mmcblk0p2 root=/dev/ram0 rw rootwait rootdelay=2 ramdisk_size=8192"
+bootcmd_load=ext2load mmc 0:2 $kernel_addr_r "/boot"$kernel_image; ext2load mmc 0:2 $ramdisk_addr_r "/boot"$ramdisk_image
+bootcmd_run=bootm $kernel_addr_r $ramdisk_addr_r $fdt_addr_r
+bootcmd=run bootcmd_dtb; run bootcmd_otenv; run bootcmd_args; run bootcmd_load; run bootcmd_run
} /* Name.Variable.Instance */ .highlight .vm { color: #336699 } /* Name.Variable.Magic */ .highlight .il { color: #0000DD; font-weight: bold } /* Literal.Number.Integer.Long */ } 
Smack: Privilege check on key operations

Operations on key objects are subjected to Smack policy
even if the process is privileged. This is inconsistent
with the general behavior of Smack and may cause issues
with authentication by privileged daemons. This patch
allows processes with CAP_MAC_OVERRIDE to access keys
even if the Smack rules indicate otherwise.

Reported-by: Jose Bollo <jobol@nonadev.net>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
---
 security/smack/smack.h        |  1 +
 security/smack/smack_access.c | 40 +++++++++++++++++++++++++++++-----------
 security/smack/smack_lsm.c    |  4 ++++
 3 files changed, 34 insertions(+), 11 deletions(-)

diff --git a/security/smack/smack.h b/security/smack/smack.h
index 6a71fc7..f7db791 100644
--- a/security/smack/smack.h
+++ b/security/smack/smack.h
@@ -321,6 +321,7 @@ struct smack_known *smk_import_entry(const char *, int);
 void smk_insert_entry(struct smack_known *skp);
 struct smack_known *smk_find_entry(const char *);
 bool smack_privileged(int cap);
+bool smack_privileged_cred(int cap, const struct cred *cred);
 void smk_destroy_label_list(struct list_head *list);
 
 /*
diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c
index 1a30041..141ffac 100644
--- a/security/smack/smack_access.c
+++ b/security/smack/smack_access.c
@@ -623,26 +623,24 @@ struct smack_known *smack_from_secid(const u32 secid)
 LIST_HEAD(smack_onlycap_list);
 DEFINE_MUTEX(smack_onlycap_lock);
 
-/*
+/**
+ * smack_privileged_cred - are all privilege requirements met by cred
+ * @cap: The requested capability
+ * @cred: the credential to use
+ *
  * Is the task privileged and allowed to be privileged
  * by the onlycap rule.
  *
  * Returns true if the task is allowed to be privileged, false if it's not.
  */
-bool smack_privileged(int cap)
+bool smack_privileged_cred(int cap, const struct cred *cred)
 {
-	struct smack_known *skp = smk_of_current();
+	struct task_smack *tsp = cred->security;
+	struct smack_known *skp = tsp->smk_task;
 	struct smack_known_list_elem *sklep;
 	int rc;
 
-	/*
-	 * All kernel tasks are privileged
-	 */
-	if (unlikely(current->flags & PF_KTHREAD))
-		return true;
-
-	rc = cap_capable(current_cred(), &init_user_ns, cap,
-				SECURITY_CAP_AUDIT);
+	rc = cap_capable(cred, &init_user_ns, cap, SECURITY_CAP_AUDIT);
 	if (rc)
 		return false;
 
@@ -662,3 +660,23 @@ bool smack_privileged(int cap)
 
 	return false;
 }
+
+/**
+ * smack_privileged - are all privilege requirements met
+ * @cap: The requested capability
+ *
+ * Is the task privileged and allowed to be privileged
+ * by the onlycap rule.
+ *
+ * Returns true if the task is allowed to be privileged, false if it's not.
+ */
+bool smack_privileged(int cap)
+{
+	/*
+	 * All kernel tasks are privileged
+	 */
+	if (unlikely(current->flags & PF_KTHREAD))
+		return true;
+
+	return smack_privileged_cred(cap, current_cred());
+}
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 30f2c3d..03fdecb 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -4369,6 +4369,10 @@ static int smack_key_permission(key_ref_t key_ref,
 	 */
 	if (tkp == NULL)
 		return -EACCES;
+
+	if (smack_privileged_cred(CAP_MAC_OVERRIDE, cred))
+		return 0;
+
 #ifdef CONFIG_AUDIT
 	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_KEY);
 	ad.a.u.key_struct.key = keyp->serial;