diff options
| author |   Stephane Desneux <stephane.desneux@iot.bzh> | 2017-03-27 16:44:59 +0200 |
|---|---|---|
| committer | Stephane Desneux <stephane.desneux@iot.bzh> | 2017-03-27 16:46:17 +0200 |
| commit | 7fcf42ba21c2a00a60f32140924fefc3cc39ad28 (patch) | |
| tree | 49b2eaa11dd2c241dd7fe77b74b7ced1ac1d1d81 /meta-app-framework | |
| parent | 5875cc45a671b1a3e7671ec84ec6ebb1ab17696a (diff) | |
| parent | 976e5d5e866d4099e55a50e0fa8d898ea36ad371 (diff) | |
Merge: migrate appfw from meta-agl-extra
Change-Id: Ic56b86228bb748a54352e79acadf0da1c947be76
Signed-off-by: Stephane Desneux <stephane.desneux@iot.bzh>
Diffstat (limited to 'meta-app-framework')
57 files changed, 1893 insertions, 0 deletions
diff --git a/meta-app-framework/classes/aglwgt.bbclass b/meta-app-framework/classes/aglwgt.bbclass new file mode 100644 index 000000000..afe9a5516 --- /dev/null +++ b/meta-app-framework/classes/aglwgt.bbclass @@ -0,0 +1,61 @@ +# +# aglwgt bbclass +# +# Jan-Simon Moeller, jsmoeller@linuxfoundation.org +# +# This class expects a "make package" target in the makefile +# which creates the wgt files in the package/ subfolder. +# The makefile needs to use wgtpkg-pack. +# + + +# 'wgtpkg-pack' in af-main-native is required. +DEPENDS_append = " af-main-native" + +# for bindings af-binder is required. +DEPENDS_append = " af-binder" + +do_aglwgt_package() { + cd ${B} + make package || ( \ + bbwarn "Your makefile must support the 'make package' target" ; \ + bbwarn "and generate a .wgt file using wgtpack in the"; \ + bbwarn "subfolder ./package/ !" ; \ + bbwarn "Fix your package as it will not work within the SDK" ; \ + bbwarn "See: https://wiki.automotivelinux.org/troubleshooting/app-recipes" \ + ) +} + +python () { + d.setVarFlag('do_aglwgt_deploy', 'fakeroot', '1') +} + + +POST_INSTALL_LEVEL ?= "10" +POST_INSTALL_SCRIPT ?= "${POST_INSTALL_LEVEL}-${PN}.sh" + +EXTRA_WGT_POSTINSTALL ?= "" + +do_aglwgt_deploy() { + install -d ${D}/usr/AGL/apps + install -m 0644 ${B}/package/*.wgt ${D}/usr/AGL/apps/ + APP_FILES="" + for file in ${D}/usr/AGL/apps/*.wgt;do + APP_FILES="${APP_FILES} $(basename $file)"; + done + install -d ${D}/${sysconfdir}/agl-postinsts + cat > ${D}/${sysconfdir}/agl-postinsts/${POST_INSTALL_SCRIPT} <<EOF +#!/bin/sh -e +for file in ${APP_FILES}; do + /usr/bin/afm-install install /usr/AGL/apps/\$file +done +sync +${EXTRA_WGT_POSTINSTALL} +EOF + chmod a+x ${D}/${sysconfdir}/agl-postinsts/${POST_INSTALL_SCRIPT} +} + +FILES_${PN} += "/usr/AGL/apps/*.wgt ${sysconfdir}/agl-postinsts/${POST_INSTALL_SCRIPT}" + +addtask aglwgt_deploy before do_package after do_install +addtask aglwgt_package before do_aglwgt_deploy after do_compile diff --git a/meta-app-framework/conf/include/agl-appfw-smack.inc b/meta-app-framework/conf/include/agl-appfw-smack.inc new file mode 100644 index 000000000..133f6b04c --- /dev/null +++ b/meta-app-framework/conf/include/agl-appfw-smack.inc @@ -0,0 +1,16 @@ +# enable security features (smack, cynara) - required by Application Framework +OVERRIDES .= ":smack" +DISTRO_FEATURES_append = " smack dbus-cynara xattr" + +# use tar-native to support SMACK extended attributes independently of host config +IMAGE_CMD_TAR = "tar --xattrs --xattrs-include='*'" +IMAGE_DEPENDS_tar_append = " tar-replacement-native" +EXTRANATIVEPATH += "tar-native" + +# security: enable ssh server in place of dropbear to support PAM on user sessions +IMAGE_FEATURES += "ssh-server-openssh" + +# enforce copy of xattrs (to be removed, see SPEC-475) +PACKAGECONFIG_append_pn-shadow = " attr" +PACKAGECONFIG_append_pn-shadow-native = " attr" + diff --git a/meta-app-framework/conf/layer.conf b/meta-app-framework/conf/layer.conf new file mode 100644 index 000000000..f74ebd658 --- /dev/null +++ b/meta-app-framework/conf/layer.conf @@ -0,0 +1,11 @@ +# We have a conf and classes directory, add to BBPATH +BBPATH .= ":${LAYERDIR}" + +# We have recipes-* directories, add to BBFILES +BBFILES += "${LAYERDIR}/recipes-*/*/*.bb \ + ${LAYERDIR}/recipes-*/*/*.bbappend" + +BBFILE_COLLECTIONS += "app-framework" +BBFILE_PATTERN_app-framework = "^${LAYERDIR}/" +BBFILE_PRIORITY_app-framework = "7" + diff --git a/meta-app-framework/recipes-config/agl-users/agl-users_0.1.bb b/meta-app-framework/recipes-config/agl-users/agl-users_0.1.bb new file mode 100644 index 000000000..832c51c99 --- /dev/null +++ b/meta-app-framework/recipes-config/agl-users/agl-users_0.1.bb @@ -0,0 +1,21 @@ +inherit allarch useradd + +SUMMARY = "AGL Users Seed" +DESCRIPTION = "This is a core framework component that\ + defines how users are managed and who are the default users." + +LICENSE = "MIT" +LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384361b4de20420" + + +SRC_URI = "" + +ALLOW_EMPTY_${PN} = "1" + +USERADD_PACKAGES = "${PN}" + +USERADD_PARAM_${PN} = "\ + -g users -d /home/agl-driver -m -K PASS_MAX_DAYS=-1 agl-driver ; \ + -g users -d /home/agl-passenger -m -K PASS_MAX_DAYS=-1 agl-passenger \ +" + diff --git a/meta-app-framework/recipes-core/af-binder/af-binder_1.0.bb b/meta-app-framework/recipes-core/af-binder/af-binder_1.0.bb new file mode 100644 index 000000000..2ecb2aa94 --- /dev/null +++ b/meta-app-framework/recipes-core/af-binder/af-binder_1.0.bb @@ -0,0 +1,78 @@ +SUMMARY = "HTTP REST interface to automotive backends for HTML5 UI support" +DESCRIPTION = "Automotive-Framework-Binder Daemon provides a HTTP REST \ +interface to various automotive-oriented bindings, \ +allowing HTML5 UIs to send platform-specific requests in a secure way." +HOMEPAGE = "https://gerrit.automotivelinux.org/gerrit/#/admin/projects/src/app-framework-binder" + +LICENSE = "Apache-2.0" +LIC_FILES_CHKSUM = "file://LICENSE-2.0.txt;md5=3b83ef96387f14655fc854ddc3c6bd57" + +DEPENDS = "file json-c libmicrohttpd systemd util-linux openssl" + +SRC_URI_git = "git://gerrit.automotivelinux.org/gerrit/src/app-framework-binder;protocol=https;branch=master" +SRC_URI_files = "" +SRC_URI = "${SRC_URI_git} \ + ${SRC_URI_files} \ + " + +SRCREV = "e85e5d8ffe242f826b5f98e2834407b5d4c46690" +S = "${WORKDIR}/git" + +inherit cmake pkgconfig + +FILES_${PN} += "${datadir}" + +pkg_postinst_${PN}() { + mkdir -p "$D${libdir}/afb" +} + +############################################# +# setup meta package +############################################# +PACKAGES += "${PN}-meta" +ALLOW_EMPTY_${PN}-meta = "1" + +############################################# +# setup sample binding packages +############################################# +PACKAGES_DYNAMIC = "${PN}-binding-*" + +python populate_packages_prepend () { + afb_libdir = d.expand('${libdir}/afb') + postinst = d.getVar('binding_postinst', True) + pkgs = [] + pkgs_dbg = [] + + pkgs += do_split_packages(d, afb_libdir, '(.*)-api\.so$', d.expand('${PN}-binding-%s'), 'AFB binding for %s', postinst=postinst, extra_depends=d.expand('${PN}')) + pkgs += do_split_packages(d, afb_libdir, '(.*(?!-api))\.so$', d.expand('${PN}-binding-%s'), 'AFB binding for %s', postinst=postinst, extra_depends=d.expand('${PN}')) + + pkgs_dbg += do_split_packages(d, oe.path.join(afb_libdir, ".debug"), '(.*)-api\.so$', d.expand('${PN}-binding-%s-dbg'), 'AFB binding for %s, debug info', postinst=postinst, extra_depends=d.expand('${PN}')) + pkgs_dbg += do_split_packages(d, oe.path.join(afb_libdir, ".debug"), '(.*(?!-api))\.so$', d.expand('${PN}-binding-%s-dbg'), 'AFB binding for %s, debug info', postinst=postinst, extra_depends=d.expand('${PN}')) + + metapkg = d.getVar('PN', True) + '-meta' + d.setVar('RDEPENDS_' + metapkg, ' '.join(pkgs)) +} + +############################################# +# setup libafbwsc package +############################################# +PACKAGES =+ "libafbwsc libafbwsc-dev libafbwsc-dbg" + +FILES_libafbwsc = "\ + ${libdir}/libafbwsc.so.* \ +" +FILES_libafbwsc-dev = "\ + ${includedir}/afb/afb-wsj1.h \ + ${includedir}/afb/afb-ws-client.h \ + ${bindir}/afb-client-demo \ + ${libdir}/libafbwsc.so \ + ${libdir}/pkgconfig/libafbwsc.pc \ +" +FILES_libafbwsc-dbg = "\ + ${libdir}/.debug/libafbwsc.so.* \ + ${bindir}/.debug/afb-client-demo \ +" +RDEPENDS_libafbwsc-dbg += "${PN}-dbg libafbwsc-dev" + +RDEPENDS_${PN}-dev += "libafbwsc-dev" + diff --git a/meta-app-framework/recipes-core/af-main/af-main/Hack-to-allow-the-debugging.patch b/meta-app-framework/recipes-core/af-main/af-main/Hack-to-allow-the-debugging.patch new file mode 100644 index 000000000..44e8bce1e --- /dev/null +++ b/meta-app-framework/recipes-core/af-main/af-main/Hack-to-allow-the-debugging.patch @@ -0,0 +1,29 @@ +From a4fbfb88f1b7c4f4287d9279767220fae80d26da Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jos=C3=A9=20Bollo?= <jose.bollo@iot.bzh> +Date: Thu, 21 Jan 2016 15:07:29 +0100 +Subject: [PATCH] Hack to allow the debugging + +This is a temporarily fix to continue debugging +afm-main. This should be removed later. + +Change-Id: I2f10f0cb1fce2ee30bd0754ad2e7bc8e2f6513aa +--- + conf/afm-user-daemon.conf | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/conf/afm-user-daemon.conf b/conf/afm-user-daemon.conf +index 801c7ae..98a3152 100644 +--- a/conf/afm-user-daemon.conf ++++ b/conf/afm-user-daemon.conf +@@ -25,7 +25,7 @@ + </policy> + + <policy context="default"> +- <deny own="org.AGL.afm.user"/> ++ <allow own="org.AGL.afm.user"/> + <allow send_destination="org.AGL.afm.system"/> + </policy> + +-- +2.1.4 + diff --git a/meta-app-framework/recipes-core/af-main/af-main/add-qt-wayland-shell-integration.patch b/meta-app-framework/recipes-core/af-main/af-main/add-qt-wayland-shell-integration.patch new file mode 100644 index 000000000..c92415b80 --- /dev/null +++ b/meta-app-framework/recipes-core/af-main/af-main/add-qt-wayland-shell-integration.patch @@ -0,0 +1,12 @@ +diff --git a/conf/afm-unit.conf b/conf/afm-unit.conf +index 82113ef..2fbc9e2 100644 +--- a/conf/afm-unit.conf ++++ b/conf/afm-unit.conf +@@ -127,6 +127,7 @@ SuccessExitStatus=0 SIGKILL + WorkingDirectory=-{{&#metadata.app-data-dir}}/{{id}} + ExecStartPre=/bin/mkdir -p {{&#metadata.app-data-dir}}/{{id}} + Environment=AFM_APP_INSTALL_DIR={{:#metadata.install-dir}} ++Environment=QT_WAYLAND_SHELL_INTEGRATION=ivi-shell + + %systemd-unit user + {{#required-permission.urn:AGL:permission::public:hidden}}\ diff --git a/meta-app-framework/recipes-core/af-main/af-main/afm-install b/meta-app-framework/recipes-core/af-main/af-main/afm-install new file mode 100755 index 000000000..6d37baed8 --- /dev/null +++ b/meta-app-framework/recipes-core/af-main/af-main/afm-install @@ -0,0 +1,44 @@ +#!/bin/sh + +pretty() { + sed \ + -e '/^method return .*/d' \ + -e 's/^Error org.freedesktop.DBus.Error.Failed: "\?\(.*\)"\?$/ERROR: \1/' \ + -e 's/^ string "\(.*\)"/\1/' \ + -e 's/},/&\n/' +} + +send() { + dbus-send --system --print-reply \ + --dest=org.AGL.afm.system \ + /org/AGL/afm/system \ + org.AGL.afm.system.$1 \ + "string:$2" | + pretty +} + +case "$1" in + + add|install) + f=$(realpath $2) + send install '{"wgt":"'"$f"'","force":true}' + ;; + + -h|--help|help) + cat << EOC + +The commands are: + + add wgt + install wgt install the wgt file + +EOC + ;; + + *) + echo "unknown command $1" >&2 + exit 1 + ;; +esac + + diff --git a/meta-app-framework/recipes-core/af-main/af-main_1.0.bb b/meta-app-framework/recipes-core/af-main/af-main_1.0.bb new file mode 100644 index 000000000..3c1b692f3 --- /dev/null +++ b/meta-app-framework/recipes-core/af-main/af-main_1.0.bb @@ -0,0 +1,106 @@ +require af-main_${PV}.inc + +# NOTE: using libcap-native and setcap in install doesn't work +# NOTE: there is no SYSTEMD_USER_SERVICE_... +# NOTE: maybe setting afm_name to agl-framework is cleaner but has implications +# NOTE: there is a hack of security for using groups and dbus (to be checked) +# NOTE: using ZIP programs creates directories with mode 777 (very bad) + +inherit cmake pkgconfig useradd systemd +BBCLASSEXTEND = "native" + +SECTION = "base" + +DEPENDS = "openssl libxml2 xmlsec1 systemd libzip json-c systemd security-manager libcap-native af-binder" +DEPENDS_class-native = "openssl libxml2 xmlsec1 libzip json-c" + +EXTRA_OECMAKE_class-native = "\ + -DUSE_LIBZIP=1 \ + -DUSE_SIMULATION=1 \ + -DUSE_SDK=1 \ + -Dafm_name=${afm_name} \ + -Dafm_confdir=${afm_confdir} \ + -Dafm_datadir=${afm_datadir} \ +" + +EXTRA_OECMAKE = "\ + -DUSE_LIBZIP=1 \ + -DUSE_SIMULATION=0 \ + -DUSE_SDK=0 \ + -Dafm_name=${afm_name} \ + -Dafm_confdir=${afm_confdir} \ + -Dafm_datadir=${afm_datadir} \ + -Dsystemd_units_root=${systemd_units_root} \ + -DUNITDIR_USER=${systemd_user_unitdir} \ + -DUNITDIR_SYSTEM=${systemd_system_unitdir} \ +" + +USERADD_PACKAGES = "${PN}" +USERADD_PARAM_${PN} = "-g ${afm_name} -d ${afm_datadir} -r ${afm_name}" +GROUPADD_PARAM_${PN} = "-r ${afm_name}" + +SYSTEMD_SERVICE_${PN} = "afm-system-daemon.service" +SYSTEMD_AUTO_ENABLE = "enable" + +FILES_${PN} += "\ + ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', '${systemd_user_unitdir}/afm-user-daemon.service', '', d)} \ +" +RDEPENDS_${PN}_append_smack = " smack-userspace" +DEPENDS_append_smack = " smack-userspace-native" + +# short hacks here +SRC_URI += "\ + file://Hack-to-allow-the-debugging.patch \ +" + +# tools used to install wgt at first boot +SRC_URI += "\ + file://afm-install \ + file://add-qt-wayland-shell-integration.patch \ +" + +do_install_append() { + install -d ${D}${bindir} + install -d -m 0775 ${D}${systemd_units_root}/{system,user} + install -d -m 0775 ${D}${systemd_units_root}/{system,user}/default.target.wants + install -d ${D}${afm_datadir}/{applications,icons} + if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then + mkdir -p ${D}${sysconfdir}/systemd/{system,user}/default.target.wants + ln -sf ${systemd_user_unitdir}/afm-user-daemon.service ${D}${sysconfdir}/systemd/user/default.target.wants + fi + install -m 0755 ${WORKDIR}/afm-install ${D}${bindir} +} + +do_install_append_qemux86-64() { + sed -i -e '/LD_PRELOAD=\/usr\/lib\/libEGL.so/d' ${D}${systemd_user_unitdir}/afm-user-daemon.service +} + +pkg_postinst_${PN}() { + if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then + chgrp ${afm_name} $D${systemd_units_root}/{system,user}/{default.target.wants,.} + fi + chown ${afm_name}:${afm_name} $D${afm_datadir}/{applications,icons,.} + setcap cap_mac_override,cap_dac_override=ep $D${bindir}/afm-system-daemon + setcap cap_mac_override,cap_mac_admin,cap_setgid=ep $D${bindir}/afm-user-daemon +} + +pkg_postinst_${PN}_smack() { + if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then + chgrp ${afm_name} $D${systemd_units_root}/{system,user}/{default.target.wants,.} + chsmack -a 'System::Shared' -t $D${systemd_units_root}/{system,user}/{default.target.wants,.} + fi + chown ${afm_name}:${afm_name} $D${afm_datadir}/{applications,icons,.} + chsmack -a 'System::Shared' -t $D${afm_datadir}/{applications,icons,.} + setcap cap_mac_override,cap_dac_override=ep $D${bindir}/afm-system-daemon + setcap cap_mac_override,cap_mac_admin,cap_setgid=ep $D${bindir}/afm-user-daemon +} +FILES_${PN} += " ${systemd_units_root} " + +PACKAGES =+ "${PN}-binding ${PN}-binding-dbg" +FILES_${PN}-binding = " ${afb_binding_dir}/afm-main-binding.so " +FILES_${PN}-binding-dbg = " ${afb_binding_dir}/.debug/afm-main-binding.so " + +PACKAGES =+ "${PN}-tools ${PN}-tools-dbg" +FILES_${PN}-tools = "${bindir}/wgtpkg-*" +FILES_${PN}-tools-dbg = "${bindir}/.debug/wgtpkg-*" + diff --git a/meta-app-framework/recipes-core/af-main/af-main_1.0.inc b/meta-app-framework/recipes-core/af-main/af-main_1.0.inc new file mode 100644 index 000000000..6ce87ed71 --- /dev/null +++ b/meta-app-framework/recipes-core/af-main/af-main_1.0.inc @@ -0,0 +1,26 @@ +SUMMARY = "AGL Framework Main part" +DESCRIPTION = "\ +This is a core framework component for managing \ +applications, widgets, and components. \ +" + +HOMEPAGE = "https://gerrit.automotivelinux.org/gerrit/#/admin/projects/src/app-framework-main" +LICENSE = "Apache-2.0" +LIC_FILES_CHKSUM = "file://COPYING;md5=3b83ef96387f14655fc854ddc3c6bd57" + +SRC_URI_git = "git://gerrit.automotivelinux.org/gerrit/src/app-framework-main;protocol=https;branch=master" +SRC_URI_files = "" +SRC_URI = "${SRC_URI_git} \ + ${SRC_URI_files} \ + " + +SRCREV = "255c83029f56e8d90e7ce185b007c4ca65afec1e" + +S = "${WORKDIR}/git" + +afm_name = "afm" +afm_confdir = "${sysconfdir}/${afm_name}" +afm_datadir = "/var/local/lib/${afm_name}" +afb_binding_dir = "${libdir}/afb" +systemd_units_root = "/usr/local/lib/systemd" + diff --git a/meta-app-framework/recipes-core/af-main/nativesdk-af-main_1.0.bb b/meta-app-framework/recipes-core/af-main/nativesdk-af-main_1.0.bb new file mode 100644 index 000000000..8d044345f --- /dev/null +++ b/meta-app-framework/recipes-core/af-main/nativesdk-af-main_1.0.bb @@ -0,0 +1,26 @@ +require af-main_${PV}.inc + +inherit nativesdk cmake pkgconfig + +SECTION = "base" + +DEPENDS = "nativesdk-openssl nativesdk-libxml2 nativesdk-xmlsec1 nativesdk-libzip nativesdk-json-c" + +EXTRA_OECMAKE = "\ + -DUSE_LIBZIP=1 \ + -DUSE_SIMULATION=1 \ + -DUSE_SDK=1 \ + -Dafm_name=${afm_name} \ + -Dafm_confdir=${afm_confdir} \ + -Dafm_datadir=${afm_datadir} \ +" + +do_install_append() { + # remove unused .pc file we don't want to package + rm -rf ${D}/${libdir} +} + +PACKAGES = "${PN}-tools ${PN}-tools-dbg" +FILES_${PN}-tools = "${bindir}/wgtpkg-* ${afm_confdir}/*" +FILES_${PN}-tools-dbg = "${bindir}/.debug/wgtpkg-*" + diff --git a/meta-app-framework/recipes-core/base-files/base-files_%.bbappend b/meta-app-framework/recipes-core/base-files/base-files_%.bbappend new file mode 100644 index 000000000..7e12bc829 --- /dev/null +++ b/meta-app-framework/recipes-core/base-files/base-files_%.bbappend @@ -0,0 +1,22 @@ +DEPENDS_append_smack = " smack-userspace-native" +RDEPENDS_${PN}_append_smack = " smack-userspace" + +do_install_append() { + install -d ${D}/${sysconfdir}/skel/app-data + install -d ${D}/${sysconfdir}/skel/.config +} + +do_install_append_smack () { + install -d ${D}/${sysconfdir}/smack/accesses.d + cat > ${D}/${sysconfdir}/smack/accesses.d/default-access-domains-no-user <<EOF +System User::App-Shared rwxat +System User::Home rwxat +EOF + chmod 0644 ${D}/${sysconfdir}/smack/accesses.d/default-access-domains-no-user +} + +pkg_postinst_${PN}_append_smack() { + chsmack -r -a 'User::Home' -t -D $D/${sysconfdir}/skel + chsmack -a 'User::App-Shared' -D $D/${sysconfdir}/skel/app-data +} + diff --git a/meta-app-framework/recipes-core/packagegroups/nativesdk-packagegroup-sdk-host.bbappend b/meta-app-framework/recipes-core/packagegroups/nativesdk-packagegroup-sdk-host.bbappend new file mode 100644 index 000000000..ca0b54f73 --- /dev/null +++ b/meta-app-framework/recipes-core/packagegroups/nativesdk-packagegroup-sdk-host.bbappend @@ -0,0 +1,2 @@ +RDEPENDS_${PN} =+ "nativesdk-af-main-tools" + diff --git a/meta-app-framework/recipes-core/packagegroups/packagegroup-agl-app-framework-examples.bb b/meta-app-framework/recipes-core/packagegroups/packagegroup-agl-app-framework-examples.bb new file mode 100644 index 000000000..e95b7548b --- /dev/null +++ b/meta-app-framework/recipes-core/packagegroups/packagegroup-agl-app-framework-examples.bb @@ -0,0 +1,16 @@ +SUMMARY = "AGL Application Framework examples" +DESCRIPTION = "The set of examples associated to the AGL Application Framework" +LICENSE = "MIT" + +inherit packagegroup + +PACKAGES = "\ + packagegroup-agl-app-framework-examples \ + " + +ALLOW_EMPTY_${PN} = "1" + +RDEPENDS_${PN} += "\ + afm-client \ + afb-client \ + " diff --git a/meta-app-framework/recipes-core/packagegroups/packagegroup-agl-app-framework.bb b/meta-app-framework/recipes-core/packagegroups/packagegroup-agl-app-framework.bb new file mode 100644 index 000000000..0fdaabc91 --- /dev/null +++ b/meta-app-framework/recipes-core/packagegroups/packagegroup-agl-app-framework.bb @@ -0,0 +1,20 @@ +SUMMARY = "AGL Application Framework core packages" +DESCRIPTION = "The set of packages required by the AGL Application Framework" +LICENSE = "MIT" + +inherit packagegroup + +PACKAGES = "\ + packagegroup-agl-app-framework \ + " + +ALLOW_EMPTY_${PN} = "1" + +RDEPENDS_${PN} += "\ + af-binder \ + af-binder-binding-afb-dbus-binding \ + af-binder-binding-authlogin \ + libafbwsc \ + af-main \ + ${@bb.utils.contains('DISTRO_FEATURES', 'webruntime', 'virtual/webruntime', '', d)} \ + " diff --git a/meta-app-framework/recipes-core/packagegroups/packagegroup-agl-core-security.bbappend b/meta-app-framework/recipes-core/packagegroups/packagegroup-agl-core-security.bbappend new file mode 100644 index 000000000..0c9efe465 --- /dev/null +++ b/meta-app-framework/recipes-core/packagegroups/packagegroup-agl-core-security.bbappend @@ -0,0 +1,9 @@ +RDEPENDS_${PN} += "\ + xmlsec1 \ + cynara \ + dbus-cynara \ + security-manager \ + security-manager-policy \ + agl-users \ + " + diff --git a/meta-app-framework/recipes-core/packagegroups/packagegroup-agl-image-minimal.bbappend b/meta-app-framework/recipes-core/packagegroups/packagegroup-agl-image-minimal.bbappend new file mode 100644 index 000000000..ad09e5ddf --- /dev/null +++ b/meta-app-framework/recipes-core/packagegroups/packagegroup-agl-image-minimal.bbappend @@ -0,0 +1,3 @@ +RDEPENDS_${PN} += "\ + packagegroup-agl-app-framework \ + " diff --git a/meta-app-framework/recipes-core/security-manager/security-manager/0001-Adapt-rules-to-AGL.patch b/meta-app-framework/recipes-core/security-manager/security-manager/0001-Adapt-rules-to-AGL.patch new file mode 100644 index 000000000..4c91f7fa3 --- /dev/null +++ b/meta-app-framework/recipes-core/security-manager/security-manager/0001-Adapt-rules-to-AGL.patch @@ -0,0 +1,50 @@ +From 935e4e4e746b5ffcda80c80097dc75c2581c1a89 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jos=C3=A9=20Bollo?= <jose.bollo@iot.bzh> +Date: Wed, 19 Oct 2016 13:45:54 +0200 +Subject: [PATCH] Adapt rules to AGL +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +AGL distribution uses the repository https://github.com/01org/meta-intel-iot-security.git +as basis for the integration of security framework. The security framework +that it provides is an evolution of the security framework of tizen refited +to the distribution Ostro of Intel. This refit took the decision to simplify +the model by removing the running label "User". More can be viewed here: +https://github.com/01org/meta-intel-iot-security/pull/116 + +This commits adapt the template to the rules that are now needed +after this evolution. + +It also integrates one other evolutions: the shared label becomes User::App-Shared instead +of User::App::Shared to avoid collision with application of id "Shared". + +Change-Id: Ieb566b63f8c8e691b5f75e06499a3b576d042546 +Signed-off-by: José Bollo <jose.bollo@iot.bzh> +--- + policy/app-rules-template.smack | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/policy/app-rules-template.smack b/policy/app-rules-template.smack +index 1311169..b4cd2e3 100644 +--- a/policy/app-rules-template.smack ++++ b/policy/app-rules-template.smack +@@ -1,12 +1,10 @@ +-System ~APP~ rwx ++System ~APP~ rwxa ++System ~PKG~ rwxat + ~APP~ System wx + ~APP~ System::Shared rx + ~APP~ System::Run rwxat + ~APP~ System::Log rwxa + ~APP~ _ l +-User ~APP~ rwxa +-User ~PKG~ rwxat +-~APP~ User wx + ~APP~ User::Home rxl +-~APP~ User::App::Shared rwxat ++~APP~ User::App-Shared rwxat + ~APP~ ~PKG~ rwxat +-- +2.7.4 + diff --git a/meta-app-framework/recipes-core/security-manager/security-manager/0001-Fix-Cmake-conf-for-gcc6-build.patch b/meta-app-framework/recipes-core/security-manager/security-manager/0001-Fix-Cmake-conf-for-gcc6-build.patch new file mode 100644 index 000000000..43a3ee103 --- /dev/null +++ b/meta-app-framework/recipes-core/security-manager/security-manager/0001-Fix-Cmake-conf-for-gcc6-build.patch @@ -0,0 +1,40 @@ +From 19c99315a5dcba3b696c30d1fdd42a1dcd574a80 Mon Sep 17 00:00:00 2001 +From: Ronan <ronan.lemartret@iot.bzh> +Date: Thu, 13 Oct 2016 11:37:47 +0200 +Subject: [PATCH] Fix Cmake conf for gcc6 build + +Signed-off-by: Ronan <ronan.lemartret@iot.bzh> +--- + src/cmd/CMakeLists.txt | 4 +--- + src/server/CMakeLists.txt | 1 - + 2 files changed, 1 insertion(+), 4 deletions(-) + +diff --git a/src/cmd/CMakeLists.txt b/src/cmd/CMakeLists.txt +index ee9a160..aa7a12c 100644 +--- a/src/cmd/CMakeLists.txt ++++ b/src/cmd/CMakeLists.txt +@@ -1,8 +1,6 @@ + FIND_PACKAGE(Boost REQUIRED COMPONENTS program_options) + +-INCLUDE_DIRECTORIES(SYSTEM +- ${Boost_INCLUDE_DIRS} +- ) ++ + + INCLUDE_DIRECTORIES( + ${INCLUDE_PATH} +diff --git a/src/server/CMakeLists.txt b/src/server/CMakeLists.txt +index 753eb96..8eef25d 100644 +--- a/src/server/CMakeLists.txt ++++ b/src/server/CMakeLists.txt +@@ -8,7 +8,6 @@ FIND_PACKAGE(Threads REQUIRED) + + INCLUDE_DIRECTORIES(SYSTEM + ${SERVER_DEP_INCLUDE_DIRS} +- ${Boost_INCLUDE_DIRS} + ${Threads_INCLUDE_DIRS} + ) + +-- +2.6.6 + diff --git a/meta-app-framework/recipes-core/security-manager/security-manager/0001-Fix-gcc6-build.patch b/meta-app-framework/recipes-core/security-manager/security-manager/0001-Fix-gcc6-build.patch new file mode 100644 index 000000000..1b3c8c427 --- /dev/null +++ b/meta-app-framework/recipes-core/security-manager/security-manager/0001-Fix-gcc6-build.patch @@ -0,0 +1,38 @@ +From cb9acc2b723b297ee373bf814282711f02657aa5 Mon Sep 17 00:00:00 2001 +From: Ronan <ronan.lemartret@iot.bzh> +Date: Wed, 12 Oct 2016 17:48:55 +0200 +Subject: [PATCH] Fix gcc6 build + +Signed-off-by: ronan <ronan@ot.bzh> +--- + src/client/client-security-manager.cpp | 1 + + src/common/include/privilege_db.h | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/src/client/client-security-manager.cpp b/src/client/client-security-manager.cpp +index 74a6b30..347cddd 100644 +--- a/src/client/client-security-manager.cpp ++++ b/src/client/client-security-manager.cpp +@@ -46,6 +46,7 @@ + #include <service_impl.h> + #include <security-manager.h> + #include <client-offline.h> ++#include <linux/xattr.h> + + static const char *EMPTY = ""; + +diff --git a/src/common/include/privilege_db.h b/src/common/include/privilege_db.h +index 03c6680..8dd39a1 100644 +--- a/src/common/include/privilege_db.h ++++ b/src/common/include/privilege_db.h +@@ -32,6 +32,7 @@ + #include <map> + #include <stdbool.h> + #include <string> ++#include <vector> + + #include <dpl/db/sql_connection.h> + +-- +2.6.6 + diff --git a/meta-app-framework/recipes-core/security-manager/security-manager/Removing-tizen-platform-config.patch b/meta-app-framework/recipes-core/security-manager/security-manager/Removing-tizen-platform-config.patch new file mode 100644 index 000000000..4830db2a8 --- /dev/null +++ b/meta-app-framework/recipes-core/security-manager/security-manager/Removing-tizen-platform-config.patch @@ -0,0 +1,196 @@ +From 72e66d0e42f3bb6efd689ce33b1df407d94b3c60 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jos=C3=A9=20Bollo?= <jose.bollo@iot.bzh> +Date: Mon, 16 Nov 2015 14:26:25 +0100 +Subject: [PATCH] Removing tizen-platform-config + +Change-Id: Ic832a2b75229517b09faba969c27fb1a4b490121 +--- + policy/security-manager-policy-reload | 2 +- + src/common/file-lock.cpp | 4 +--- + src/common/include/file-lock.h | 1 - + src/common/include/privilege_db.h | 3 +-- + src/common/service_impl.cpp | 39 +++++++++++------------------------ + src/common/smack-rules.cpp | 12 ++++------- + 6 files changed, 19 insertions(+), 42 deletions(-) + +diff --git a/policy/security-manager-policy-reload b/policy/security-manager-policy-reload +index 6f211c6..ed8047a 100755 +--- a/policy/security-manager-policy-reload ++++ b/policy/security-manager-policy-reload +@@ -2,7 +2,7 @@ + + POLICY_PATH=/usr/share/security-manager/policy + PRIVILEGE_GROUP_MAPPING=$POLICY_PATH/privilege-group.list +-DB_FILE=`tzplatform-get TZ_SYS_DB | cut -d= -f2`/.security-manager.db ++DB_FILE=/var/db/security-manager/.security-manager.db + + # Create default buckets + while read bucket default_policy +diff --git a/src/common/file-lock.cpp b/src/common/file-lock.cpp +index 6f3996c..1dada17 100644 +--- a/src/common/file-lock.cpp ++++ b/src/common/file-lock.cpp +@@ -30,9 +30,7 @@ + + namespace SecurityManager { + +-char const * const SERVICE_LOCK_FILE = tzplatform_mkpath3(TZ_SYS_RUN, +- "lock", +- "security-manager.lock"); ++char const * const SERVICE_LOCK_FILE = "/var/run/lock/security-manager.lock"; + + FileLocker::FileLocker(const std::string &lockFile, bool blocking) + { +diff --git a/src/common/include/file-lock.h b/src/common/include/file-lock.h +index 604b019..21a86a0 100644 +--- a/src/common/include/file-lock.h ++++ b/src/common/include/file-lock.h +@@ -29,7 +29,6 @@ + + #include <dpl/exception.h> + #include <dpl/noncopyable.h> +-#include <tzplatform_config.h> + + namespace SecurityManager { + +diff --git a/src/common/include/privilege_db.h b/src/common/include/privilege_db.h +index 4d73d90..03c6680 100644 +--- a/src/common/include/privilege_db.h ++++ b/src/common/include/privilege_db.h +@@ -34,14 +34,13 @@ + #include <string> + + #include <dpl/db/sql_connection.h> +-#include <tzplatform_config.h> + + #ifndef PRIVILEGE_DB_H_ + #define PRIVILEGE_DB_H_ + + namespace SecurityManager { + +-const char *const PRIVILEGE_DB_PATH = tzplatform_mkpath(TZ_SYS_DB, ".security-manager.db"); ++const char *const PRIVILEGE_DB_PATH = "/var/db/security-manager/.security-manager.db"; + + enum class QueryType { + EGetPkgPrivileges, +diff --git a/src/common/service_impl.cpp b/src/common/service_impl.cpp +index ae305d3..65cc8b5 100644 +--- a/src/common/service_impl.cpp ++++ b/src/common/service_impl.cpp +@@ -32,7 +32,6 @@ + #include <algorithm> + + #include <dpl/log/log.h> +-#include <tzplatform_config.h> + + #include "protocols.h" + #include "privilege_db.h" +@@ -131,7 +130,13 @@ static inline int validatePolicy(policy_entry &policyEntry, std::string uidStr, + + static uid_t getGlobalUserId(void) + { +- static uid_t globaluid = tzplatform_getuid(TZ_SYS_GLOBALAPP_USER); ++ static uid_t globaluid = 0; ++ if (!globaluid) { ++ struct passwd pw, *p; ++ char buf[4096]; ++ int rc = getpwnam_r("userapp", &pw, buf, sizeof buf, &p); ++ globaluid = (rc || p == NULL) ? 555 : p->pw_uid; ++ } + return globaluid; + } + +@@ -161,37 +166,17 @@ static inline bool isSubDir(const char *parent, const char *subdir) + + static bool getUserAppDir(const uid_t &uid, std::string &userAppDir) + { +- struct tzplatform_context *tz_ctx = nullptr; +- +- if (tzplatform_context_create(&tz_ctx)) +- return false; +- +- if (tzplatform_context_set_user(tz_ctx, uid)) { +- tzplatform_context_destroy(tz_ctx); +- tz_ctx = nullptr; ++ struct passwd pw, *p; ++ char buf[4096]; ++ int rc = getpwuid_r(uid, &pw, buf, sizeof buf, &p); ++ if (rc || p == NULL) + return false; +- } +- +- enum tzplatform_variable id = +- (uid == getGlobalUserId()) ? TZ_SYS_RW_APP : TZ_USER_APP; +- const char *appDir = tzplatform_context_getenv(tz_ctx, id); +- if (!appDir) { +- tzplatform_context_destroy(tz_ctx); +- tz_ctx = nullptr; +- return false; +- } +- +- userAppDir = appDir; +- +- tzplatform_context_destroy(tz_ctx); +- tz_ctx = nullptr; +- ++ userAppDir = p->pw_dir; + return true; + } + + static inline bool installRequestAuthCheck(const app_inst_req &req, uid_t uid, bool &isCorrectPath, std::string &appPath) + { +- std::string userHome; + std::string userAppDir; + std::stringstream correctPath; + +diff --git a/src/common/smack-rules.cpp b/src/common/smack-rules.cpp +index d834e42..8b5728b 100644 +--- a/src/common/smack-rules.cpp ++++ b/src/common/smack-rules.cpp +@@ -34,7 +34,6 @@ + #include <memory> + + #include <dpl/log/log.h> +-#include <tzplatform_config.h> + + #include "smack-labels.h" + #include "smack-rules.h" +@@ -43,7 +42,7 @@ namespace SecurityManager { + + const char *const SMACK_APP_LABEL_TEMPLATE = "~APP~"; + const char *const SMACK_PKG_LABEL_TEMPLATE = "~PKG~"; +-const char *const APP_RULES_TEMPLATE_FILE_PATH = tzplatform_mkpath4(TZ_SYS_SHARE, "security-manager", "policy", "app-rules-template.smack"); ++const char *const APP_RULES_TEMPLATE_FILE_PATH = "/usr/share/security-manager/policy/app-rules-template.smack"; + const char *const SMACK_APP_IN_PACKAGE_PERMS = "rwxat"; + + SmackRules::SmackRules() +@@ -237,14 +236,12 @@ void SmackRules::generatePackageCrossDeps(const std::vector<std::string> &pkgCon + + std::string SmackRules::getPackageRulesFilePath(const std::string &pkgId) + { +- std::string path(tzplatform_mkpath3(TZ_SYS_SMACK, "accesses.d", ("pkg_" + pkgId).c_str())); +- return path; ++ return "/etc/smack/accesses.d/pkg_" + pkgId; + } + + std::string SmackRules::getApplicationRulesFilePath(const std::string &appId) + { +- std::string path(tzplatform_mkpath3(TZ_SYS_SMACK, "accesses.d", ("app_" + appId).c_str())); +- return path; ++ return "/etc/smack/accesses.d/app_" + appId; + } + void SmackRules::installApplicationPrivilegesRules(const std::string &appId, const std::string &pkgId, + const std::vector<std::string> &pkgContents, const std::vector<std::string> &privileges) +@@ -256,8 +253,7 @@ void SmackRules::installApplicationPrivilegesRules(const std::string &appId, con + for (auto privilege : privileges) { + if (privilege.empty()) + continue; +- std::string fprivilege ( privilege + "-template.smack"); +- std::string path(tzplatform_mkpath4(TZ_SYS_SHARE, "security-manager", "policy", fprivilege.c_str())); ++ std::string path = "/usr/share/security-manager/policy/" + privilege + "-template.smack"; + if( stat(path.c_str(), &buffer) == 0) + smackRules.addFromTemplateFile(appId, pkgId, path); + } +-- +2.1.4 + diff --git a/meta-app-framework/recipes-core/security-manager/security-manager/init-security-manager-db.service b/meta-app-framework/recipes-core/security-manager/security-manager/init-security-manager-db.service new file mode 100644 index 000000000..8ed5e8601 --- /dev/null +++ b/meta-app-framework/recipes-core/security-manager/security-manager/init-security-manager-db.service @@ -0,0 +1,15 @@ +# +# Install security-manager DB to /var + +[Unit] +Description=Install Security Manager database +After=sysinit.target +Before=security-manager.service + +[Install] +WantedBy=default.target + +[Service] +Type=oneshot +User=root +ExecStart=/usr/bin/init-security-manager-db.sh diff --git a/meta-app-framework/recipes-core/security-manager/security-manager/init-security-manager-db.sh b/meta-app-framework/recipes-core/security-manager/security-manager/init-security-manager-db.sh new file mode 100644 index 000000000..ef41286c8 --- /dev/null +++ b/meta-app-framework/recipes-core/security-manager/security-manager/init-security-manager-db.sh @@ -0,0 +1,6 @@ +#!/bin/sh + +if [ ! -e "/var/db/security-manager" ]; then + mkdir -p /var/db + cp -ra /usr/dbspace/ /var/db/security-manager +fi diff --git a/meta-app-framework/recipes-core/security-manager/security-manager_%.bbappend b/meta-app-framework/recipes-core/security-manager/security-manager_%.bbappend new file mode 100644 index 000000000..23ceb2937 --- /dev/null +++ b/meta-app-framework/recipes-core/security-manager/security-manager_%.bbappend @@ -0,0 +1,22 @@ +FILESEXTRAPATHS_prepend := "${THISDIR}/security-manager:" + +SRC_URI += " file://0001-Adapt-rules-to-AGL.patch \ + file://init-security-manager-db.service \ + file://init-security-manager-db.sh \ + file://0001-Fix-gcc6-build.patch \ + file://0001-Fix-Cmake-conf-for-gcc6-build.patch \ +" + +FILES_${PN}_append = "${bindir}/init-security-manager-db.sh \ + ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', '${systemd_unitdir}/system/init-security-manager-db.service', '', d)} \ +" + +do_install_append () { + install -p -D ${WORKDIR}/init-security-manager-db.sh ${D}${bindir}/init-security-manager-db.sh + if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then + mkdir -p ${D}${systemd_unitdir}/system + mkdir -p ${D}${sysconfdir}/systemd/system/default.target.wants + install -m 644 -p -D ${WORKDIR}/init-security-manager-db.service ${D}${systemd_unitdir}/system/init-security-manager-db.service + ln -sf ${systemd_unitdir}/system/init-security-manager-db.service ${D}${sysconfdir}/systemd/system/default.target.wants + fi +} diff --git a/meta-app-framework/recipes-core/web-runtime/web-runtime/web-runtime b/meta-app-framework/recipes-core/web-runtime/web-runtime/web-runtime new file mode 100755 index 000000000..ca712e155 --- /dev/null +++ b/meta-app-framework/recipes-core/web-runtime/web-runtime/web-runtime @@ -0,0 +1,2 @@ +#!/bin/sh +exec /usr/bin/qt5/qmlscene "$1" /usr/bin/web-runtime-webkit.qml diff --git a/meta-app-framework/recipes-core/web-runtime/web-runtime/web-runtime-webkit.qml b/meta-app-framework/recipes-core/web-runtime/web-runtime/web-runtime-webkit.qml new file mode 100644 index 000000000..d18b672cd --- /dev/null +++ b/meta-app-framework/recipes-core/web-runtime/web-runtime/web-runtime-webkit.qml @@ -0,0 +1,13 @@ +import QtQuick 2.1 +import QtQuick.Controls 1.1 +import QtWebKit 3.0 + +ApplicationWindow { + width: 1024 + height: 768 + visible: true + WebView { + url: Qt.application.arguments[1] + anchors.fill: parent + } +} diff --git a/meta-app-framework/recipes-core/web-runtime/web-runtime/web-runtime.qml b/meta-app-framework/recipes-core/web-runtime/web-runtime/web-runtime.qml new file mode 100644 index 000000000..afe8a77d0 --- /dev/null +++ b/meta-app-framework/recipes-core/web-runtime/web-runtime/web-runtime.qml @@ -0,0 +1,13 @@ +import QtQuick 2.1 +import QtQuick.Controls 1.1 +import QtWebEngine 1.1 + +ApplicationWindow { + width: 1024 + height: 768 + visible: true + WebEngineView { + url: Qt.application.arguments[1] + anchors.fill: parent + } +} diff --git a/meta-app-framework/recipes-core/web-runtime/web-runtime_0.1.bb b/meta-app-framework/recipes-core/web-runtime/web-runtime_0.1.bb new file mode 100644 index 000000000..fa149875c --- /dev/null +++ b/meta-app-framework/recipes-core/web-runtime/web-runtime_0.1.bb @@ -0,0 +1,34 @@ +inherit allarch + +SUMMARY = "Provides the 'web-runtime' command" +DESCRIPTION = "The command 'web-runtime' is an abstraction that allows to " + +LICENSE = "MIT" +LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384361b4de20420" + +SRC_URI = "\ + file://web-runtime;md5sum=6114c0bdd20290912a423fa01beb50f0 \ + file://web-runtime.qml;md5sum=5d6a379e9b7e5654319e5ba638824a58 \ + file://web-runtime-webkit.qml;md5sum=4daf9df39078634c27a7923d37e82e3d \ +" + +RDEPENDS_${PN} = "qtwebkit-qmlplugins" + +do_configure() { + : +} + +do_install() { + install -d ${D}${bindir} + install -m 0755 ${WORKDIR}/web-runtime ${D}${bindir}/web-runtime + install -m 0644 ${WORKDIR}/web-runtime.qml ${D}${bindir}/web-runtime.qml + install -m 0644 ${WORKDIR}/web-runtime-webkit.qml ${D}${bindir}/web-runtime-webkit.qml +} + +do_install_append_rcar-gen2() { + # workaround for porter board: force the use of libEGL provided by mesa at runtime + # otherwise, the proprietary libEGL is used and a problem then occurs due to a missing EGL function + sed -i 's|^\(exec /usr/bin/qt5/qmlscene\)|LD_PRELOAD=/usr/lib/libEGL.so \1|g' ${D}${bindir}/web-runtime +} + + diff --git a/meta-app-framework/recipes-devtools/run-agl-postinsts/run-agl-postinsts_1.0.bbappend b/meta-app-framework/recipes-devtools/run-agl-postinsts/run-agl-postinsts_1.0.bbappend new file mode 100644 index 000000000..590ab708a --- /dev/null +++ b/meta-app-framework/recipes-devtools/run-agl-postinsts/run-agl-postinsts_1.0.bbappend @@ -0,0 +1 @@ +SYSTEMD_SERVICE_AFTER_append = " afm-system-daemon.service" diff --git a/meta-app-framework/recipes-example/afb-client/afb-client_1.0.bb b/meta-app-framework/recipes-example/afb-client/afb-client_1.0.bb new file mode 100644 index 000000000..21605d20b --- /dev/null +++ b/meta-app-framework/recipes-example/afb-client/afb-client_1.0.bb @@ -0,0 +1,29 @@ +SUMMARY = "HTML5 demo template for AFB" +DESCRIPTION = "afb-client is a sample AngularJS/HTML5 application using \ +Application Framework Binder with token binding." +HOMEPAGE = "http://www.iot.bzh" + +LICENSE = "GPLv3+" +LIC_FILES_CHKSUM = "file://LICENSE;md5=6cb04bdb88e11107e3af4d8e3f301be5" + +#DEPENDS = "nodejs-native" +RDEPENDS_${PN} = "af-binder af-binder-binding-authlogin" + +SRC_URI_git = "git://gerrit.automotivelinux.org/gerrit/src/app-framework-demo;protocol=https;branch=master" +SRC_URI_files = "file://afb-client \ + " +SRC_URI = "${SRC_URI_git} \ + ${SRC_URI_files} \ + " +SRCREV = "9e9b459fa27d7a359a060024c9639b99b45813d5" +S = "${WORKDIR}/git/afb-client" + +do_install () { + mkdir -p ${D}/${datadir}/agl/afb-client + cp -ra ${S}/dist.prod/* ${D}/${datadir}/agl/afb-client/ + + mkdir -p ${D}/${bindir} + install -m 0755 ${WORKDIR}/afb-client ${D}/${bindir}/afb-client +} + +FILES_${PN} += "${datadir}" diff --git a/meta-app-framework/recipes-example/afb-client/files/afb-client b/meta-app-framework/recipes-example/afb-client/files/afb-client new file mode 100644 index 000000000..99e6aa968 --- /dev/null +++ b/meta-app-framework/recipes-example/afb-client/files/afb-client @@ -0,0 +1,7 @@ +#!/bin/sh + +if [ -z "${XDG_RUNTIME_DIR+1}" ]; then + export XDG_RUNTIME_DIR=/run/user/$UID +fi +LD_PRELOAD=/usr/lib/libEGL.so /usr/bin/qt5/qmlscene http://localhost:1234/opa /usr/share/agl/afb-viewer.qml + diff --git a/meta-app-framework/recipes-example/afm-client/afm-client_1.0.bb b/meta-app-framework/recipes-example/afm-client/afm-client_1.0.bb new file mode 100644 index 000000000..4cd80db64 --- /dev/null +++ b/meta-app-framework/recipes-example/afm-client/afm-client_1.0.bb @@ -0,0 +1,40 @@ +SUMMARY = "Sample client for AFM to install/start/stop/remove applications" +DESCRIPTION = "afm-client is a sample AngularJS/HTML5 application using \ +Application Framework Manager to install, start, stop, or remove \ +applications provided as .wgt widget packages." +HOMEPAGE = "http://www.iot.bzh" + +inherit systemd + +LICENSE = "GPLv3+" +LIC_FILES_CHKSUM = "file://LICENSE;md5=6cb04bdb88e11107e3af4d8e3f301be5" + +#DEPENDS = "nodejs-native" +RDEPENDS_${PN} = "af-main af-binder af-main-binding af-binder-binding-demopost af-binder-binding-authlogin" + +SRC_URI_git = "git://gerrit.automotivelinux.org/gerrit/src/app-framework-demo;protocol=https;branch=master" +SRC_URI_files = "file://afm-client \ + file://afm-client.service \ + " +SRC_URI = "${SRC_URI_git} \ + ${SRC_URI_files} \ + " +SRCREV = "9e9b459fa27d7a359a060024c9639b99b45813d5" +S = "${WORKDIR}/git/afm-client" + +do_install () { + mkdir -p ${D}/${datadir}/agl/afm-client + cp -ra ${S}/dist.prod/* ${D}/${datadir}/agl/afm-client/ + + mkdir -p ${D}/${bindir} + install -m 0755 ${WORKDIR}/afm-client ${D}/${bindir}/afm-client + + if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then + install -d ${D}${systemd_user_unitdir} + install -d ${D}${sysconfdir}/systemd/user/default.target.wants + install -m 0644 ${WORKDIR}/afm-client.service ${D}/${systemd_user_unitdir}/afm-client.service + ln -sf ${systemd_user_unitdir}/afm-client.service ${D}${sysconfdir}/systemd/user/default.target.wants + fi +} + +FILES_${PN} += "${datadir} ${systemd_user_unitdir}" diff --git a/meta-app-framework/recipes-example/afm-client/files/afm-client b/meta-app-framework/recipes-example/afm-client/files/afm-client new file mode 100644 index 000000000..ba868e93d --- /dev/null +++ b/meta-app-framework/recipes-example/afm-client/files/afm-client @@ -0,0 +1,7 @@ +#!/bin/sh + +if [ -z "${XDG_RUNTIME_DIR+1}" ]; then + export XDG_RUNTIME_DIR=/run/user/$UID +fi +LD_PRELOAD=/usr/lib/libEGL.so /usr/bin/web-runtime http://localhost:1236/opa + diff --git a/meta-app-framework/recipes-example/afm-client/files/afm-client.service b/meta-app-framework/recipes-example/afm-client/files/afm-client.service new file mode 100644 index 000000000..735717439 --- /dev/null +++ b/meta-app-framework/recipes-example/afm-client/files/afm-client.service @@ -0,0 +1,11 @@ +[Unit] +Description=Simplest application manager + +[Service] +ExecStart=/usr/bin/afb-daemon --mode=remote --port=1234 --token='' --sessiondir=/home/root/.afb-daemon --rootdir=/usr/share/agl/afm-client --alias=/icons:/var/lib/afm/icons +Restart=on-failure +RestartSec=5 + +[Install] +WantedBy=default.target + diff --git a/meta-app-framework/recipes-extended/shadow/files/0001-useradd-copy-extended-attributes-of-home-native.patch b/meta-app-framework/recipes-extended/shadow/files/0001-useradd-copy-extended-attributes-of-home-native.patch new file mode 100644 index 000000000..ff420d8a2 --- /dev/null +++ b/meta-app-framework/recipes-extended/shadow/files/0001-useradd-copy-extended-attributes-of-home-native.patch @@ -0,0 +1,45 @@ +From 008637fc8bd7f601eb6554d572bba025613913b7 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jos=C3=A9=20Bollo?= <jose.bollo@iot.bzh> +Date: Wed, 8 Mar 2017 14:10:10 +0100 +Subject: [PATCH] useradd: copy extended attributes of home (native) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The Home directory wasn't getting the extended attributes +of /etc/skel. This patch fixes that issue and adds the copy +of the extended attributes of the root of the home directory. + +Change-Id: Ib6836e1b18c4c7f73e02c1f1fc9558dc749ba9da +Signed-off-by: José Bollo <jose.bollo@iot.bzh> +--- + src/useradd.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/src/useradd.c b/src/useradd.c +index 4c418af..8ba8af6 100644 +--- a/src/useradd.c ++++ b/src/useradd.c +@@ -55,6 +55,9 @@ + #include <sys/stat.h> + #include <sys/types.h> + #include <time.h> ++#ifdef WITH_ATTR ++#include <attr/libattr.h> ++#endif + #include "chkname.h" + #include "defines.h" + #include "faillog.h" +@@ -1950,6 +1953,9 @@ static void create_home (void) + chown (user_home, user_id, user_gid); + chmod (user_home, + 0777 & ~getdef_num ("UMASK", GETDEF_DEFAULT_UMASK)); ++#ifdef WITH_ATTR ++ attr_copy_file (def_template, user_home, NULL, NULL); ++#endif + home_added = true; + #ifdef WITH_AUDIT + audit_logger (AUDIT_ADD_USER, Prog, +-- +2.9.3 + diff --git a/meta-app-framework/recipes-extended/shadow/files/0001-useradd-copy-extended-attributes-of-home.patch b/meta-app-framework/recipes-extended/shadow/files/0001-useradd-copy-extended-attributes-of-home.patch new file mode 100644 index 000000000..f231c3cfe --- /dev/null +++ b/meta-app-framework/recipes-extended/shadow/files/0001-useradd-copy-extended-attributes-of-home.patch @@ -0,0 +1,45 @@ +From acec93540eba6899661c607408498ac72ab07a47 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jos=C3=A9=20Bollo?= <jose.bollo@iot.bzh> +Date: Tue, 7 Mar 2017 16:03:03 +0100 +Subject: [PATCH] useradd: copy extended attributes of home +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The Home directory wasn't getting the extended attributes +of /etc/skel. This patch fixes that issue and adds the copy +of the extended attributes of the root of the home directory. + +Change-Id: Icd633f7c6c494efd2a30cb8f04c306f749ad0c3b +Signed-off-by: José Bollo <jose.bollo@iot.bzh> +--- + src/useradd.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/src/useradd.c b/src/useradd.c +index a8a1f76..8aefb9c 100644 +--- a/src/useradd.c ++++ b/src/useradd.c +@@ -52,6 +52,9 @@ + #include <sys/stat.h> + #include <sys/types.h> + #include <time.h> ++#ifdef WITH_ATTR ++#include <attr/libattr.h> ++#endif + #include "chkname.h" + #include "defines.h" + #include "faillog.h" +@@ -1915,6 +1918,9 @@ static void create_home (void) + chown (user_home, user_id, user_gid); + chmod (user_home, + 0777 & ~getdef_num ("UMASK", GETDEF_DEFAULT_UMASK)); ++#ifdef WITH_ATTR ++ attr_copy_file (def_template, user_home, NULL, NULL); ++#endif + home_added = true; + #ifdef WITH_AUDIT + audit_logger (AUDIT_ADD_USER, Prog, +-- +2.9.3 + diff --git a/meta-app-framework/recipes-extended/shadow/shadow_%.bbappend b/meta-app-framework/recipes-extended/shadow/shadow_%.bbappend new file mode 100644 index 000000000..f08435502 --- /dev/null +++ b/meta-app-framework/recipes-extended/shadow/shadow_%.bbappend @@ -0,0 +1,4 @@ +FILESEXTRAPATHS_prepend := "${THISDIR}/files:" + +SRC_URI_append_class-target = " file://0001-useradd-copy-extended-attributes-of-home.patch " +SRC_URI_append_class-native = " file://0001-useradd-copy-extended-attributes-of-home-native.patch " diff --git a/meta-app-framework/recipes-kernel/linux/linux-%.bbappend b/meta-app-framework/recipes-kernel/linux/linux-%.bbappend new file mode 100644 index 000000000..02595efdf --- /dev/null +++ b/meta-app-framework/recipes-kernel/linux/linux-%.bbappend @@ -0,0 +1,3 @@ +FILESEXTRAPATHS_prepend := "${THISDIR}/linux:" +SRC_URI_append_smack = " file://audit.cfg" + diff --git a/meta-app-framework/recipes-kernel/linux/linux-yocto_4.1.bbappend b/meta-app-framework/recipes-kernel/linux/linux-yocto_4.1.bbappend new file mode 100644 index 000000000..c1c657201 --- /dev/null +++ b/meta-app-framework/recipes-kernel/linux/linux-yocto_4.1.bbappend @@ -0,0 +1,12 @@ +FILESEXTRAPATHS_prepend := "${THISDIR}/linux/linux-yocto-4.1:" + +#------------------------------------------------------------------------- +# smack patches for handling bluetooth + +SRC_URI_append_smack = "\ + file://0001-Smack-File-receive-for-sockets.patch \ + file://0002-smack-fix-cache-of-access-labels.patch \ + file://0003-Smack-ignore-null-signal-in-smack_task_kill.patch \ + file://0004-Smack-Assign-smack_known_web-label-for-kernel-thread.patch \ +" + diff --git a/meta-app-framework/recipes-kernel/linux/linux-yocto_4.4.bbappend b/meta-app-framework/recipes-kernel/linux/linux-yocto_4.4.bbappend new file mode 100644 index 000000000..51df08719 --- /dev/null +++ b/meta-app-framework/recipes-kernel/linux/linux-yocto_4.4.bbappend @@ -0,0 +1,11 @@ +FILESEXTRAPATHS_prepend := "${THISDIR}/linux/linux-yocto-4.4:" + +#------------------------------------------------------------------------- +# smack patches for handling bluetooth + +SRC_URI_append_smack = "\ + file://0002-smack-fix-cache-of-access-labels.patch \ + file://0003-Smack-ignore-null-signal-in-smack_task_kill.patch \ + file://0004-Smack-Assign-smack_known_web-label-for-kernel-thread.patch \ +" + diff --git a/meta-app-framework/recipes-kernel/linux/linux/audit.cfg b/meta-app-framework/recipes-kernel/linux/linux/audit.cfg new file mode 100644 index 000000000..214dbe33f --- /dev/null +++ b/meta-app-framework/recipes-kernel/linux/linux/audit.cfg @@ -0,0 +1,2 @@ +CONFIG_AUDIT=y +CONFIG_AUDITSYSCALL=y diff --git a/meta-app-framework/recipes-kernel/linux/linux/linux-yocto-4.1/0001-Smack-File-receive-for-sockets.patch b/meta-app-framework/recipes-kernel/linux/linux/linux-yocto-4.1/0001-Smack-File-receive-for-sockets.patch new file mode 100644 index 000000000..b0c5ee8f4 --- /dev/null +++ b/meta-app-framework/recipes-kernel/linux/linux/linux-yocto-4.1/0001-Smack-File-receive-for-sockets.patch @@ -0,0 +1,62 @@ +From 2e65b888820ea372984d412cee3bd7dcba05d7d2 Mon Sep 17 00:00:00 2001 +From: Casey Schaufler <casey@schaufler-ca.com> +Date: Mon, 7 Dec 2015 14:34:32 -0800 +Subject: [PATCH 1/4] Smack: File receive for sockets + +The existing file receive hook checks for access on +the file inode even for UDS. This is not right, as +the inode is not used by Smack to make access checks +for sockets. This change checks for an appropriate +access relationship between the receiving (current) +process and the socket. If the process can't write +to the socket's send label or the socket's receive +label can't write to the process fail. + +This will allow the legitimate cases, where the +socket sender and socket receiver can freely communicate. +Only strangly set socket labels should cause a problem. + +Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> +--- + security/smack/smack_lsm.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c +index b644757..487b2f3 100644 +--- a/security/smack/smack_lsm.c ++++ b/security/smack/smack_lsm.c +@@ -1672,9 +1672,31 @@ static int smack_file_receive(struct file *file) + int may = 0; + struct smk_audit_info ad; + struct inode *inode = file_inode(file); ++ struct socket *sock; ++ struct task_smack *tsp; ++ struct socket_smack *ssp; + + smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); + smk_ad_setfield_u_fs_path(&ad, file->f_path); ++ ++ if (S_ISSOCK(inode->i_mode)) { ++ sock = SOCKET_I(inode); ++ ssp = sock->sk->sk_security; ++ tsp = current_security(); ++ /* ++ * If the receiving process can't write to the ++ * passed socket or if the passed socket can't ++ * write to the receiving process don't accept ++ * the passed socket. ++ */ ++ rc = smk_access(tsp->smk_task, ssp->smk_out, MAY_WRITE, &ad); ++ rc = smk_bu_file(file, may, rc); ++ if (rc < 0) ++ return rc; ++ rc = smk_access(ssp->smk_in, tsp->smk_task, MAY_WRITE, &ad); ++ rc = smk_bu_file(file, may, rc); ++ return rc; ++ } + /* + * This code relies on bitmasks. + */ +-- +2.7.4 + diff --git a/meta-app-framework/recipes-kernel/linux/linux/linux-yocto-4.1/0002-smack-fix-cache-of-access-labels.patch b/meta-app-framework/recipes-kernel/linux/linux/linux-yocto-4.1/0002-smack-fix-cache-of-access-labels.patch new file mode 100644 index 000000000..51c3b31ec --- /dev/null +++ b/meta-app-framework/recipes-kernel/linux/linux/linux-yocto-4.1/0002-smack-fix-cache-of-access-labels.patch @@ -0,0 +1,43 @@ +From 5bcea0fc4e5360deca133e211fdc76717a1693a4 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jos=C3=A9=20Bollo?= <jobol@nonadev.net> +Date: Tue, 12 Jan 2016 21:23:40 +0100 +Subject: [PATCH 2/4] smack: fix cache of access labels +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Before this commit, removing the access property of +a file, aka, the extended attribute security.SMACK64 +was not effictive until the cache had been cleaned. + +This patch fixes that problem. + +Signed-off-by: José Bollo <jobol@nonadev.net> +Acked-by: Casey Schaufler <casey@schaufler-ca.com> +--- + security/smack/smack_lsm.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c +index 487b2f3..b9393e3 100644 +--- a/security/smack/smack_lsm.c ++++ b/security/smack/smack_lsm.c +@@ -1256,9 +1256,13 @@ static int smack_inode_removexattr(struct dentry *dentry, const char *name) + * Don't do anything special for these. + * XATTR_NAME_SMACKIPIN + * XATTR_NAME_SMACKIPOUT +- * XATTR_NAME_SMACKEXEC + */ +- if (strcmp(name, XATTR_NAME_SMACK) == 0) ++ if (strcmp(name, XATTR_NAME_SMACK) == 0) { ++ struct super_block *sbp = d_backing_inode(dentry)->i_sb; ++ struct superblock_smack *sbsp = sbp->s_security; ++ ++ isp->smk_inode = sbsp->smk_default; ++ } else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0) + isp->smk_task = NULL; + else if (strcmp(name, XATTR_NAME_SMACKMMAP) == 0) + isp->smk_mmap = NULL; +-- +2.7.4 + diff --git a/meta-app-framework/recipes-kernel/linux/linux/linux-yocto-4.1/0003-Smack-ignore-null-signal-in-smack_task_kill.patch b/meta-app-framework/recipes-kernel/linux/linux/linux-yocto-4.1/0003-Smack-ignore-null-signal-in-smack_task_kill.patch new file mode 100644 index 000000000..67761ae46 --- /dev/null +++ b/meta-app-framework/recipes-kernel/linux/linux/linux-yocto-4.1/0003-Smack-ignore-null-signal-in-smack_task_kill.patch @@ -0,0 +1,39 @@ +From aa63c4f8ece0c54a9be735ac38667f11fcd6f44a Mon Sep 17 00:00:00 2001 +From: Rafal Krypa <r.krypa@samsung.com> +Date: Mon, 4 Apr 2016 11:14:53 +0200 +Subject: [PATCH 3/4] Smack: ignore null signal in smack_task_kill + +Kill with signal number 0 is commonly used for checking PID existence. +Smack treated such cases like any other kills, although no signal is +actually delivered when sig == 0. + +Checking permissions when sig == 0 didn't prevent an unprivileged caller +from learning whether PID exists or not. When it existed, kernel returned +EPERM, when it didn't - ESRCH. The only effect of policy check in such +case is noise in audit logs. + +This change lets Smack silently ignore kill() invocations with sig == 0. + +Signed-off-by: Rafal Krypa <r.krypa@samsung.com> +Acked-by: Casey Schaufler <casey@schaufler-ca.com> +--- + security/smack/smack_lsm.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c +index b9393e3..c916f58 100644 +--- a/security/smack/smack_lsm.c ++++ b/security/smack/smack_lsm.c +@@ -2056,6 +2056,9 @@ static int smack_task_kill(struct task_struct *p, struct siginfo *info, + struct smack_known *tkp = smk_of_task_struct(p); + int rc; + ++ if (!sig) ++ return 0; /* null signal; existence test */ ++ + smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK); + smk_ad_setfield_u_tsk(&ad, p); + /* +-- +2.7.4 + diff --git a/meta-app-framework/recipes-kernel/linux/linux/linux-yocto-4.1/0004-Smack-Assign-smack_known_web-label-for-kernel-thread.patch b/meta-app-framework/recipes-kernel/linux/linux/linux-yocto-4.1/0004-Smack-Assign-smack_known_web-label-for-kernel-thread.patch new file mode 100644 index 000000000..4281c201c --- /dev/null +++ b/meta-app-framework/recipes-kernel/linux/linux/linux-yocto-4.1/0004-Smack-Assign-smack_known_web-label-for-kernel-thread.patch @@ -0,0 +1,49 @@ +From b2b9e7ec8e79ede841104f76464f4b77c057b011 Mon Sep 17 00:00:00 2001 +From: jooseong lee <jooseong.lee@samsung.com> +Date: Thu, 3 Nov 2016 10:55:43 +0100 +Subject: [PATCH 4/4] Smack: Assign smack_known_web label for kernel thread's +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Assign smack_known_web label for kernel thread's socket in the sk_alloc_security hook + +Creating struct sock by sk_alloc function in various kernel subsystems +like bluetooth dosen't call smack_socket_post_create(). In such case, +received sock label is the floor('_') label and makes access deny. + +Refers-to: https://review.tizen.org/gerrit/#/c/80717/4 + +Change-Id: I2e5c9359bfede84a988fd4d4d74cdb9dfdfc52d8 +Signed-off-by: jooseong lee <jooseong.lee@samsung.com> +Signed-off-by: José Bollo <jose.bollo@iot.bzh> +--- + security/smack/smack_lsm.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c +index c916f58..cc6769b 100644 +--- a/security/smack/smack_lsm.c ++++ b/security/smack/smack_lsm.c +@@ -2138,8 +2138,16 @@ static int smack_sk_alloc_security(struct sock *sk, int family, gfp_t gfp_flags) + if (ssp == NULL) + return -ENOMEM; + +- ssp->smk_in = skp; +- ssp->smk_out = skp; ++ /* ++ * Sockets created by kernel threads receive web label. ++ */ ++ if (unlikely(current->flags & PF_KTHREAD)) { ++ ssp->smk_in = &smack_known_web; ++ ssp->smk_out = &smack_known_web; ++ } else { ++ ssp->smk_in = skp; ++ ssp->smk_out = skp; ++ } + ssp->smk_packet = NULL; + + sk->sk_security = ssp; +-- +2.7.4 + diff --git a/meta-app-framework/recipes-kernel/linux/linux/linux-yocto-4.4/0001-Smack-File-receive-for-sockets.patch b/meta-app-framework/recipes-kernel/linux/linux/linux-yocto-4.4/0001-Smack-File-receive-for-sockets.patch new file mode 100644 index 000000000..4021e5d38 --- /dev/null +++ b/meta-app-framework/recipes-kernel/linux/linux/linux-yocto-4.4/0001-Smack-File-receive-for-sockets.patch @@ -0,0 +1,65 @@ +From 2b206c36b16e72cfe41cd22448d8527359ffd962 Mon Sep 17 00:00:00 2001 +From: Casey Schaufler <casey@schaufler-ca.com> +Date: Mon, 7 Dec 2015 14:34:32 -0800 +Subject: [PATCH 1/4] Smack: File receive for sockets + +The existing file receive hook checks for access on +the file inode even for UDS. This is not right, as +the inode is not used by Smack to make access checks +for sockets. This change checks for an appropriate +access relationship between the receiving (current) +process and the socket. If the process can't write +to the socket's send label or the socket's receive +label can't write to the process fail. + +This will allow the legitimate cases, where the +socket sender and socket receiver can freely communicate. +Only strangly set socket labels should cause a problem. + +Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> +--- + security/smack/smack_lsm.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c +index ff81026..b20ef06 100644 +--- a/security/smack/smack_lsm.c ++++ b/security/smack/smack_lsm.c +@@ -1860,12 +1860,34 @@ static int smack_file_receive(struct file *file) + int may = 0; + struct smk_audit_info ad; + struct inode *inode = file_inode(file); ++ struct socket *sock; ++ struct task_smack *tsp; ++ struct socket_smack *ssp; + + if (unlikely(IS_PRIVATE(inode))) + return 0; + + smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); + smk_ad_setfield_u_fs_path(&ad, file->f_path); ++ ++ if (S_ISSOCK(inode->i_mode)) { ++ sock = SOCKET_I(inode); ++ ssp = sock->sk->sk_security; ++ tsp = current_security(); ++ /* ++ * If the receiving process can't write to the ++ * passed socket or if the passed socket can't ++ * write to the receiving process don't accept ++ * the passed socket. ++ */ ++ rc = smk_access(tsp->smk_task, ssp->smk_out, MAY_WRITE, &ad); ++ rc = smk_bu_file(file, may, rc); ++ if (rc < 0) ++ return rc; ++ rc = smk_access(ssp->smk_in, tsp->smk_task, MAY_WRITE, &ad); ++ rc = smk_bu_file(file, may, rc); ++ return rc; ++ } + /* + * This code relies on bitmasks. + */ +-- +2.7.4 + diff --git a/meta-app-framework/recipes-kernel/linux/linux/linux-yocto-4.4/0002-smack-fix-cache-of-access-labels.patch b/meta-app-framework/recipes-kernel/linux/linux/linux-yocto-4.4/0002-smack-fix-cache-of-access-labels.patch new file mode 100644 index 000000000..c516f3aa5 --- /dev/null +++ b/meta-app-framework/recipes-kernel/linux/linux/linux-yocto-4.4/0002-smack-fix-cache-of-access-labels.patch @@ -0,0 +1,43 @@ +From 99267706991ab84bd44ceaea9a7ec886bbdd58e0 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jos=C3=A9=20Bollo?= <jobol@nonadev.net> +Date: Tue, 12 Jan 2016 21:23:40 +0100 +Subject: [PATCH 2/4] smack: fix cache of access labels +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Before this commit, removing the access property of +a file, aka, the extended attribute security.SMACK64 +was not effictive until the cache had been cleaned. + +This patch fixes that problem. + +Signed-off-by: José Bollo <jobol@nonadev.net> +Acked-by: Casey Schaufler <casey@schaufler-ca.com> +--- + security/smack/smack_lsm.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c +index b20ef06..b2bcb14 100644 +--- a/security/smack/smack_lsm.c ++++ b/security/smack/smack_lsm.c +@@ -1444,9 +1444,13 @@ static int smack_inode_removexattr(struct dentry *dentry, const char *name) + * Don't do anything special for these. + * XATTR_NAME_SMACKIPIN + * XATTR_NAME_SMACKIPOUT +- * XATTR_NAME_SMACKEXEC + */ +- if (strcmp(name, XATTR_NAME_SMACK) == 0) ++ if (strcmp(name, XATTR_NAME_SMACK) == 0) { ++ struct super_block *sbp = d_backing_inode(dentry)->i_sb; ++ struct superblock_smack *sbsp = sbp->s_security; ++ ++ isp->smk_inode = sbsp->smk_default; ++ } else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0) + isp->smk_task = NULL; + else if (strcmp(name, XATTR_NAME_SMACKMMAP) == 0) + isp->smk_mmap = NULL; +-- +2.7.4 + diff --git a/meta-app-framework/recipes-kernel/linux/linux/linux-yocto-4.4/0003-Smack-ignore-null-signal-in-smack_task_kill.patch b/meta-app-framework/recipes-kernel/linux/linux/linux-yocto-4.4/0003-Smack-ignore-null-signal-in-smack_task_kill.patch new file mode 100644 index 000000000..c9180bb9f --- /dev/null +++ b/meta-app-framework/recipes-kernel/linux/linux/linux-yocto-4.4/0003-Smack-ignore-null-signal-in-smack_task_kill.patch @@ -0,0 +1,39 @@ +From ec4eb03af07b0fbc330aecca6ac4ebd6accd8825 Mon Sep 17 00:00:00 2001 +From: Rafal Krypa <r.krypa@samsung.com> +Date: Mon, 4 Apr 2016 11:14:53 +0200 +Subject: [PATCH 3/4] Smack: ignore null signal in smack_task_kill + +Kill with signal number 0 is commonly used for checking PID existence. +Smack treated such cases like any other kills, although no signal is +actually delivered when sig == 0. + +Checking permissions when sig == 0 didn't prevent an unprivileged caller +from learning whether PID exists or not. When it existed, kernel returned +EPERM, when it didn't - ESRCH. The only effect of policy check in such +case is noise in audit logs. + +This change lets Smack silently ignore kill() invocations with sig == 0. + +Signed-off-by: Rafal Krypa <r.krypa@samsung.com> +Acked-by: Casey Schaufler <casey@schaufler-ca.com> +--- + security/smack/smack_lsm.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c +index b2bcb14..cf8a93f 100644 +--- a/security/smack/smack_lsm.c ++++ b/security/smack/smack_lsm.c +@@ -2239,6 +2239,9 @@ static int smack_task_kill(struct task_struct *p, struct siginfo *info, + struct smack_known *tkp = smk_of_task_struct(p); + int rc; + ++ if (!sig) ++ return 0; /* null signal; existence test */ ++ + smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK); + smk_ad_setfield_u_tsk(&ad, p); + /* +-- +2.7.4 + diff --git a/meta-app-framework/recipes-kernel/linux/linux/linux-yocto-4.4/0004-Smack-Assign-smack_known_web-label-for-kernel-thread.patch b/meta-app-framework/recipes-kernel/linux/linux/linux-yocto-4.4/0004-Smack-Assign-smack_known_web-label-for-kernel-thread.patch new file mode 100644 index 000000000..a1eeac3d7 --- /dev/null +++ b/meta-app-framework/recipes-kernel/linux/linux/linux-yocto-4.4/0004-Smack-Assign-smack_known_web-label-for-kernel-thread.patch @@ -0,0 +1,49 @@ +From c8bbb0f916de54610513e376070aea531af19dd6 Mon Sep 17 00:00:00 2001 +From: jooseong lee <jooseong.lee@samsung.com> +Date: Thu, 3 Nov 2016 10:55:43 +0100 +Subject: [PATCH 4/4] Smack: Assign smack_known_web label for kernel thread's +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Assign smack_known_web label for kernel thread's socket in the sk_alloc_security hook + +Creating struct sock by sk_alloc function in various kernel subsystems +like bluetooth dosen't call smack_socket_post_create(). In such case, +received sock label is the floor('_') label and makes access deny. + +Refers-to: https://review.tizen.org/gerrit/#/c/80717/4 + +Change-Id: I2e5c9359bfede84a988fd4d4d74cdb9dfdfc52d8 +Signed-off-by: jooseong lee <jooseong.lee@samsung.com> +Signed-off-by: José Bollo <jose.bollo@iot.bzh> +--- + security/smack/smack_lsm.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c +index cf8a93f..21651bc 100644 +--- a/security/smack/smack_lsm.c ++++ b/security/smack/smack_lsm.c +@@ -2321,8 +2321,16 @@ static int smack_sk_alloc_security(struct sock *sk, int family, gfp_t gfp_flags) + if (ssp == NULL) + return -ENOMEM; + +- ssp->smk_in = skp; +- ssp->smk_out = skp; ++ /* ++ * Sockets created by kernel threads receive web label. ++ */ ++ if (unlikely(current->flags & PF_KTHREAD)) { ++ ssp->smk_in = &smack_known_web; ++ ssp->smk_out = &smack_known_web; ++ } else { ++ ssp->smk_in = skp; ++ ssp->smk_out = skp; ++ } + ssp->smk_packet = NULL; + + sk->sk_security = ssp; +-- +2.7.4 + diff --git a/meta-app-framework/recipes-support/libcap/libcap/removing-capability-enforcement.patch b/meta-app-framework/recipes-support/libcap/libcap/removing-capability-enforcement.patch new file mode 100644 index 000000000..fa359fa87 --- /dev/null +++ b/meta-app-framework/recipes-support/libcap/libcap/removing-capability-enforcement.patch @@ -0,0 +1,87 @@ +From c34b2725817d4fd1fd6878bbb16617cb9e3e3a70 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jos=C3=A9=20Bollo?= <jose.bollo@iot.bzh> +Date: Fri, 22 Jan 2016 16:23:59 +0100 +Subject: [PATCH] removing capability enforcement + +Signed-off-by: ronan <ronan@iot.bzh> + +Change-Id: Idb724192ceab176a611bbed45c0ebc9c8eb5dd30 +--- + progs/setcap.c | 45 +-------------------------------------------- + 1 file changed, 1 insertion(+), 44 deletions(-) + +diff --git a/progs/setcap.c b/progs/setcap.c +index 7304343..71999b6 100644 +--- a/progs/setcap.c ++++ b/progs/setcap.c +@@ -58,11 +58,9 @@ static int read_caps(int quiet, const char *filename, char *buffer) + + int main(int argc, char **argv) + { +- int tried_to_cap_setfcap = 0; + char buffer[MAXCAP+1]; + int retval, quiet=0, verify=0; + cap_t mycaps; +- cap_value_t capflag; + + if (argc < 3) { + usage(); +@@ -150,54 +148,13 @@ int main(int argc, char **argv) + printf("%s: OK\n", *argv); + } + } else { +- if (!tried_to_cap_setfcap) { +- capflag = CAP_SETFCAP; +- +- /* +- * Raise the effective CAP_SETFCAP. +- */ +- if (cap_set_flag(mycaps, CAP_EFFECTIVE, 1, &capflag, CAP_SET) +- != 0) { +- perror("unable to manipulate CAP_SETFCAP - " +- "try a newer libcap?"); +- exit(1); +- } +- if (cap_set_proc(mycaps) != 0) { +- perror("unable to set CAP_SETFCAP effective capability"); +- exit(1); +- } +- tried_to_cap_setfcap = 1; +- } + retval = cap_set_file(*++argv, cap_d); + if (retval != 0) { +- int explained = 0; + int oerrno = errno; +-#ifdef linux +- cap_value_t cap; +- cap_flag_value_t per_state; +- +- for (cap = 0; +- cap_get_flag(cap_d, cap, CAP_PERMITTED, &per_state) != -1; +- cap++) { +- cap_flag_value_t inh_state, eff_state; +- +- cap_get_flag(cap_d, cap, CAP_INHERITABLE, &inh_state); +- cap_get_flag(cap_d, cap, CAP_EFFECTIVE, &eff_state); +- if ((inh_state | per_state) != eff_state) { +- fprintf(stderr, "NOTE: Under Linux, effective file capabilities must either be empty, or\n" +- " exactly match the union of selected permitted and inheritable bits.\n"); +- explained = 1; +- break; +- } +- } +-#endif /* def linux */ +- + fprintf(stderr, + "Failed to set capabilities on file `%s' (%s)\n", + argv[0], strerror(oerrno)); +- if (!explained) { +- usage(); +- } ++ + } + } + if (cap_d) { +-- +2.6.6 + diff --git a/meta-app-framework/recipes-support/libcap/libcap_%.bbappend b/meta-app-framework/recipes-support/libcap/libcap_%.bbappend new file mode 100644 index 000000000..fbe893501 --- /dev/null +++ b/meta-app-framework/recipes-support/libcap/libcap_%.bbappend @@ -0,0 +1,5 @@ +FILESEXTRAPATHS_append_class-native := ":${THISDIR}/${PN}" +SRC_URI_append_class-native = " file://removing-capability-enforcement.patch" +PACKAGECONFIG_class-native ?= "attr" +DEPENDS_append_class-native = " attr-native" + diff --git a/meta-app-framework/recipes-support/libmicrohttpd/libmicrohttpd/allows-upgrade.patch b/meta-app-framework/recipes-support/libmicrohttpd/libmicrohttpd/allows-upgrade.patch new file mode 100644 index 000000000..19601a537 --- /dev/null +++ b/meta-app-framework/recipes-support/libmicrohttpd/libmicrohttpd/allows-upgrade.patch @@ -0,0 +1,81 @@ +diff -Naur a/src/microhttpd/connection.c b/src/microhttpd/connection.c +--- a/src/microhttpd/connection.c 2016-04-08 21:02:26.000000000 +0200 ++++ b/src/microhttpd/connection.c 2016-08-29 22:41:53.790560238 +0200 +@@ -708,6 +708,8 @@ + * "keep-alive", we proceed to use the default for the respective HTTP + * version (which is conservative for HTTP 1.0, but might be a bit + * optimistic for HTTP 1.1). ++ * In the case of Upgrade, the header Connection should not be set ++ * to keep-alive. + * + * @param connection the connection to check for keepalive + * @return #MHD_YES if (based on the request), a keepalive is +@@ -750,6 +752,59 @@ + + + /** ++ * Should we try to keep the given connection alive? We can use the ++ * TCP stream for a second request if the connection is HTTP 1.1 and ++ * the "Connection" header either does not exist or is not set to ++ * "close", or if the connection is HTTP 1.0 and the "Connection" ++ * header is explicitly set to "keep-alive". If no HTTP version is ++ * specified (or if it is not 1.0 or 1.1), we definitively close the ++ * connection. If the "Connection" header is not exactly "close" or ++ * "keep-alive", we proceed to use the default for the respective HTTP ++ * version (which is conservative for HTTP 1.0, but might be a bit ++ * optimistic for HTTP 1.1). ++ * In the case of Upgrade, the connection should be kept alive even if ++ * the header Connection is not keep-alive. ++ * ++ * @param connection the connection to check for keepalive ++ * @return #MHD_YES if (based on the request), a keepalive is ++ * legal ++ */ ++static int ++should_keepalive (struct MHD_Connection *connection) ++{ ++ const char *end; ++ ++ if (NULL == connection->version) ++ return MHD_NO; ++ if ( (NULL != connection->response) && ++ (0 != (connection->response->flags & MHD_RF_HTTP_VERSION_1_0_ONLY) ) ) ++ return MHD_NO; ++ end = MHD_lookup_connection_value (connection, ++ MHD_HEADER_KIND, ++ MHD_HTTP_HEADER_CONNECTION); ++ if (MHD_str_equal_caseless_(connection->version, ++ MHD_HTTP_VERSION_1_1)) ++ { ++ if (NULL == end) ++ return MHD_YES; ++ if ( (MHD_str_equal_caseless_ (end, "close")) ) ++ return MHD_NO; ++ return MHD_YES; ++ } ++ if (MHD_str_equal_caseless_(connection->version, ++ MHD_HTTP_VERSION_1_0)) ++ { ++ if (NULL == end) ++ return MHD_NO; ++ if (MHD_str_equal_caseless_(end, "Keep-Alive")) ++ return MHD_YES; ++ return MHD_NO; ++ } ++ return MHD_NO; ++} ++ ++ ++/** + * Produce HTTP "Date:" header. + * + * @param date where to write the header, with +@@ -2795,7 +2850,7 @@ + } + if (((MHD_YES == connection->read_closed) && + (0 == connection->read_buffer_offset)) || +- (MHD_NO == keepalive_possible (connection))) ++ (MHD_NO == should_keepalive (connection))) + { + /* have to close for some reason */ + MHD_connection_close_ (connection, diff --git a/meta-app-framework/recipes-support/libmicrohttpd/libmicrohttpd_0.9.49.bb b/meta-app-framework/recipes-support/libmicrohttpd/libmicrohttpd_0.9.49.bb new file mode 100644 index 000000000..9abb2004e --- /dev/null +++ b/meta-app-framework/recipes-support/libmicrohttpd/libmicrohttpd_0.9.49.bb @@ -0,0 +1,25 @@ +DESCRIPTION = "A small C library that is supposed to make it easy to run an HTTP server as part of another application" +HOMEPAGE = "http://www.gnu.org/software/libmicrohttpd/" +LICENSE = "LGPL-2.1+" +LIC_FILES_CHKSUM = "file://COPYING;md5=9331186f4f80db7da0e724bdd6554ee5" +SECTION = "net" +DEPENDS = "libgcrypt gnutls file" + +SRC_URI = "http://ftp.gnu.org/gnu/libmicrohttpd/${BPN}-${PV}.tar.gz" +SRC_URI[md5sum] = "3209aa2ac6199b874a6325342b86edbc" +SRC_URI[sha256sum] = "9407d8252548ab97ace3276e0032f073820073c0599d43baff832902a8dab11c" + +inherit autotools lib_package pkgconfig + +EXTRA_OECONF += "--disable-static --with-gnutls=${STAGING_LIBDIR}/../" + +PACKAGECONFIG ?= "curl" +PACKAGECONFIG_append_class-target = "\ + ${@bb.utils.contains('DISTRO_FEATURES', 'largefile', 'largefile', '', d)} \ +" +PACKAGECONFIG[largefile] = "--enable-largefile,--disable-largefile,," +PACKAGECONFIG[curl] = "--enable-curl,--disable-curl,curl," + +do_compile_append() { + sed -i s:-L${STAGING_LIBDIR}::g libmicrohttpd.pc +} diff --git a/meta-app-framework/recipes-support/libmicrohttpd/libmicrohttpd_0.9.49.bbappend b/meta-app-framework/recipes-support/libmicrohttpd/libmicrohttpd_0.9.49.bbappend new file mode 100644 index 000000000..c26b8119f --- /dev/null +++ b/meta-app-framework/recipes-support/libmicrohttpd/libmicrohttpd_0.9.49.bbappend @@ -0,0 +1,5 @@ + +FILESEXTRAPATHS_append := ":${THISDIR}/${PN}" +SRC_URI += " file://allows-upgrade.patch" + + diff --git a/meta-app-framework/recipes-support/libzip/libzip_1.1.1.bb b/meta-app-framework/recipes-support/libzip/libzip_1.1.1.bb new file mode 100644 index 000000000..450971176 --- /dev/null +++ b/meta-app-framework/recipes-support/libzip/libzip_1.1.1.bb @@ -0,0 +1,32 @@ +inherit autotools + +SUMMARY = "Library providing support for handling zip files" +DESCRIPTION = "\ + This library is wrapping zlib and allows \ + to easily create, browse, inflate of deflate \ + the zip files. \ + It also provides tools for zip comparing, merging or browsing.\ +" + +HOMEPAGE = "http://nih.at/libzip/index.html" +LICENSE = "BSD" +LIC_FILES_CHKSUM = "file://LICENSE;md5=23ebf7ca347ed9703b4ef40824d0ef66" + +SRC_URI = "http://nih.at/libzip/libzip-1.1.1.tar.xz;md5sum=0c86a1a94fbc3ec6724801036726ae1f" + +#SRC_URI = "hg://hg.nih.at/libzip;module=libzip;protocol=http" +#SRCREV = "5895e34af7f9" +#S = "${HGDIR}" + +SECTION = "base" + +DEPENDS = "zlib" + +RDEPENDS_${PN} = "zlib" + +PROVIDES += "${PN}-tools" +RDEPENDS_${PN}-tools = "${PN}" +FILES_${PN}-tools = "${bindir}/zipcmp ${bindir}/zipmerge ${bindir}/ziptool" + +BBCLASSEXTEND = "native nativesdk" + diff --git a/meta-app-framework/recipes-support/xmlsec1/xmlsec1/Only-require-libxslt-in-.pc-files-when-necessary.patch b/meta-app-framework/recipes-support/xmlsec1/xmlsec1/Only-require-libxslt-in-.pc-files-when-necessary.patch new file mode 100644 index 000000000..c92df77f0 --- /dev/null +++ b/meta-app-framework/recipes-support/xmlsec1/xmlsec1/Only-require-libxslt-in-.pc-files-when-necessary.patch @@ -0,0 +1,115 @@ +From 1e39acf581ef47876b058da41774cbc92560d797 Mon Sep 17 00:00:00 2001 +From: Manuel Bachmann <manuel.bachmann@iot.bzh> +Date: Wed, 27 Jan 2016 14:16:40 +0100 +Subject: [PATCH] Only require libxslt in .pc files when necessary + +If we build xmlsec without libxslt ("--without-libxslt" at +configure time), dependent packages will still require it +because it is unconditionally mentioned in .pc files (used +by pkg-config). + +We now make sure that this dependency is mentioned only if +the configure script validates libxslt presence. + +Signed-off-by: Manuel Bachmann <manuel.bachmann@iot.bzh> +--- + configure.in | 4 ++++ + xmlsec-gcrypt.pc.in | 2 +- + xmlsec-gnutls.pc.in | 2 +- + xmlsec-nss.pc.in | 2 +- + xmlsec-openssl.pc.in | 2 +- + xmlsec.pc.in | 2 +- + 6 files changed, 9 insertions(+), 5 deletions(-) + +diff --git a/configure.in b/configure.in +index 7d976d0..a8350a9 100644 +--- a/configure.in ++++ b/configure.in +@@ -255,6 +255,7 @@ dnl ========================================================================== + dnl find libxslt + dnl ========================================================================== + XMLSEC_NO_LIBXSLT="1" ++LIBXSLT_COND="libxslt >=" + LIBXSLT_MIN_VERSION=1.0.20 + LIBXSLT_CONFIG="xslt-config" + LIBXSLT_CFLAGS="" +@@ -324,6 +325,8 @@ fi + if test "z$LIBXSLT_FOUND" = "zyes" ; then + XMLSEC_NO_LIBXSLT="0" + else ++ LIBXSLT_COND="" ++ LIBXSLT_MIN_VERSION="" + XMLSEC_DEFINES="$XMLSEC_DEFINES -DXMLSEC_NO_XSLT=1" + fi + +@@ -332,6 +335,7 @@ AC_SUBST(LIBXSLT_CFLAGS) + AC_SUBST(LIBXSLT_LIBS) + AC_SUBST(LIBXSLT_CONFIG) + AC_SUBST(LIBXSLT_MIN_VERSION) ++AC_SUBST(LIBXSLT_COND) + + dnl ========================================================================== + dnl See if we can find a crypto library +diff --git a/xmlsec-gcrypt.pc.in b/xmlsec-gcrypt.pc.in +index 1c00496..33bc2ff 100644 +--- a/xmlsec-gcrypt.pc.in ++++ b/xmlsec-gcrypt.pc.in +@@ -6,6 +6,6 @@ includedir=@includedir@ + Name: xmlsec1-gcrypt + Version: @VERSION@ + Description: XML Security Library implements XML Signature and XML Encryption standards +-Requires: libxml-2.0 >= @LIBXML_MIN_VERSION@ libxslt >= @LIBXSLT_MIN_VERSION@ ++Requires: libxml-2.0 >= @LIBXML_MIN_VERSION@ @LIBXSLT_COND@ @LIBXSLT_MIN_VERSION@ + Cflags: -DXMLSEC_CRYPTO=\"gcrypt\" @XMLSEC_GCRYPT_CFLAGS@ + Libs: @XMLSEC_GCRYPT_LIBS@ +diff --git a/xmlsec-gnutls.pc.in b/xmlsec-gnutls.pc.in +index e538cd4..d01cf82 100644 +--- a/xmlsec-gnutls.pc.in ++++ b/xmlsec-gnutls.pc.in +@@ -6,6 +6,6 @@ includedir=@includedir@ + Name: xmlsec1-gnutls + Version: @VERSION@ + Description: XML Security Library implements XML Signature and XML Encryption standards +-Requires: libxml-2.0 >= @LIBXML_MIN_VERSION@ libxslt >= @LIBXSLT_MIN_VERSION@ ++Requires: libxml-2.0 >= @LIBXML_MIN_VERSION@ @LIBXSLT_COND@ @LIBXSLT_MIN_VERSION@ + Cflags: -DXMLSEC_CRYPTO=\"gnutls\" @XMLSEC_GNUTLS_CFLAGS@ + Libs: @XMLSEC_GNUTLS_LIBS@ +diff --git a/xmlsec-nss.pc.in b/xmlsec-nss.pc.in +index a6d6c5c..75f0232 100644 +--- a/xmlsec-nss.pc.in ++++ b/xmlsec-nss.pc.in +@@ -6,6 +6,6 @@ includedir=@includedir@ + Name: xmlsec1-nss + Version: @VERSION@ + Description: XML Security Library implements XML Signature and XML Encryption standards +-Requires: libxml-2.0 >= @LIBXML_MIN_VERSION@ libxslt >= @LIBXSLT_MIN_VERSION@ @NSPR_PACKAGE@ >= @MOZILLA_MIN_VERSION@ @NSS_PACKAGE@ >= @MOZILLA_MIN_VERSION@ ++Requires: libxml-2.0 >= @LIBXML_MIN_VERSION@ @LIBXSLT_COND@ @LIBXSLT_MIN_VERSION@ @NSPR_PACKAGE@ >= @MOZILLA_MIN_VERSION@ @NSS_PACKAGE@ >= @MOZILLA_MIN_VERSION@ + Cflags: -DXMLSEC_CRYPTO=\"nss\" -DXMLSEC_CRYPTO_NSS=1 @XMLSEC_CORE_CFLAGS@ + Libs: -L${libdir} -lxmlsec1-nss @XMLSEC_CORE_LIBS@ +diff --git a/xmlsec-openssl.pc.in b/xmlsec-openssl.pc.in +index 85ee2b0..e9d0651 100644 +--- a/xmlsec-openssl.pc.in ++++ b/xmlsec-openssl.pc.in +@@ -6,6 +6,6 @@ includedir=@includedir@ + Name: xmlsec1-openssl + Version: @VERSION@ + Description: XML Security Library implements XML Signature and XML Encryption standards +-Requires: libxml-2.0 >= @LIBXML_MIN_VERSION@ libxslt >= @LIBXSLT_MIN_VERSION@ ++Requires: libxml-2.0 >= @LIBXML_MIN_VERSION@ @LIBXSLT_COND@ @LIBXSLT_MIN_VERSION@ + Cflags: -DXMLSEC_CRYPTO=\"openssl\" @XMLSEC_OPENSSL_CFLAGS@ + Libs: @XMLSEC_OPENSSL_LIBS@ +diff --git a/xmlsec.pc.in b/xmlsec.pc.in +index a750ab8..14ea670 100644 +--- a/xmlsec.pc.in ++++ b/xmlsec.pc.in +@@ -6,6 +6,6 @@ includedir=@includedir@ + Name: xmlsec1 + Version: @VERSION@ + Description: XML Security Library implements XML Signature and XML Encryption standards +-Requires: libxml-2.0 >= @LIBXML_MIN_VERSION@ libxslt >= @LIBXSLT_MIN_VERSION@ ++Requires: libxml-2.0 >= @LIBXML_MIN_VERSION@ @LIBXSLT_COND@ @LIBXSLT_MIN_VERSION@ + Cflags: -DXMLSEC_CRYPTO=\"@XMLSEC_CRYPTO@\" -DXMLSEC_CRYPTO_DYNAMIC_LOADING=1 @XMLSEC_CORE_CFLAGS@ + Libs: -L${libdir} @XMLSEC_CORE_LIBS@ +-- +2.6.2 + diff --git a/meta-app-framework/recipes-support/xmlsec1/xmlsec1_1.%.bbappend b/meta-app-framework/recipes-support/xmlsec1/xmlsec1_1.%.bbappend new file mode 100644 index 000000000..8f1972f07 --- /dev/null +++ b/meta-app-framework/recipes-support/xmlsec1/xmlsec1_1.%.bbappend @@ -0,0 +1,6 @@ +FILESEXTRAPATHS_append := ":${THISDIR}/${PN}" +SRC_URI += "file://Only-require-libxslt-in-.pc-files-when-necessary.patch" + +DEPENDS += "libxml2" + +BBCLASSEXTEND = "native nativesdk" |