summaryrefslogtreecommitdiffstats
path: root/meta-security/recipes-kernel
diff options
context:
space:
mode:
authorJan-Simon Möller <jsmoeller@linuxfoundation.org>2018-02-14 10:55:35 +0100
committerJan-Simon Möller <jsmoeller@linuxfoundation.org>2018-02-14 10:55:35 +0100
commit317c8a08a6b5943517e67c5ea80b0a9a83a10d63 (patch)
treebf2b27dc9068924b59b46d2e153936c77be954c3 /meta-security/recipes-kernel
parentb6dc44f585b839ab1a2f0133b74958037fe1cb64 (diff)
parentc9ce37905acd879db107eafe309678053073e086 (diff)
Merge remote-tracking branch 'agl/sandbox/ronan/rocko' into HEAD
* agl/sandbox/ronan/rocko: (58 commits) Update ulcb conf file Remove unsed gstreamer backport [GEN3] add preferred version on omx package run-(agl-)postinst: Emit progress to console meta-security: Remove unused content Upgrade wayland-ivi-extension Revert "Fix kernel gcc7 issue" remove backport commit Revert "Fix CVE-2017-1000364 by backporting the patches for gen3" Remove fix for optee-os Remove gcc 6 fix Update rcar gen3 kernel bbappend version Update rcar gen3 driver Remove porter machine dbus-cynara: Upgrade to 1.10.20 xmlsec1: switch to meta-security version systemd: earlier smack label switch cynara: upgrade to 0.14.10 Remove smack recipe Integrate parts of meta-intel-iot-security ... Bug-AGL: SPEC-1181 Signed-off-by: Jan-Simon Möller <jsmoeller@linuxfoundation.org> Conflicts: meta-app-framework/recipes-security/cynara/cynara_git.bbappend Change-Id: I9875fcb31e960038ce6c23165c99b52a3bd1a1c0
Diffstat (limited to 'meta-security/recipes-kernel')
-rw-r--r--meta-security/recipes-kernel/linux/linux-%.bbappend17
-rw-r--r--meta-security/recipes-kernel/linux/linux/audit.cfg2
-rw-r--r--meta-security/recipes-kernel/linux/linux/smack-default-lsm.cfg2
-rw-r--r--meta-security/recipes-kernel/linux/linux/smack.cfg8
4 files changed, 29 insertions, 0 deletions
diff --git a/meta-security/recipes-kernel/linux/linux-%.bbappend b/meta-security/recipes-kernel/linux/linux-%.bbappend
new file mode 100644
index 000000000..717d32e3a
--- /dev/null
+++ b/meta-security/recipes-kernel/linux/linux-%.bbappend
@@ -0,0 +1,17 @@
+FILESEXTRAPATHS_prepend := "${THISDIR}/linux:"
+
+IS_KERNEL_RECIPE := "${@bb.data.inherits_class('kernel', d) and 'yes' or 'no'}"
+SMACK_KERNEL_SRC_URI_no = ""
+SMACK_KERNEL_SRC_URI_yes = ""
+
+# Kernel config fragment enabling Smack, without making it the default explicitly.
+SMACK_KERNEL_SRC_URI_yes += "file://smack.cfg"
+
+# When added, set Smack as the default LSM.
+SMACK_DEFAULT_SECURITY_CFG = "file://smack-default-lsm.cfg"
+
+# Add it by default, can be overridden by changing this variable here.
+SMACK_DEFAULT_SECURITY ??= "${SMACK_DEFAULT_SECURITY_CFG}"
+SMACK_KERNEL_SRC_URI_yes += " ${SMACK_DEFAULT_SECURITY}"
+
+SRC_URI_append_with-lsm-smack = "${SMACK_KERNEL_SRC_URI_${IS_KERNEL_RECIPE}}"
diff --git a/meta-security/recipes-kernel/linux/linux/audit.cfg b/meta-security/recipes-kernel/linux/linux/audit.cfg
new file mode 100644
index 000000000..214dbe33f
--- /dev/null
+++ b/meta-security/recipes-kernel/linux/linux/audit.cfg
@@ -0,0 +1,2 @@
+CONFIG_AUDIT=y
+CONFIG_AUDITSYSCALL=y
diff --git a/meta-security/recipes-kernel/linux/linux/smack-default-lsm.cfg b/meta-security/recipes-kernel/linux/linux/smack-default-lsm.cfg
new file mode 100644
index 000000000..b5c48454e
--- /dev/null
+++ b/meta-security/recipes-kernel/linux/linux/smack-default-lsm.cfg
@@ -0,0 +1,2 @@
+CONFIG_DEFAULT_SECURITY="smack"
+CONFIG_DEFAULT_SECURITY_SMACK=y
diff --git a/meta-security/recipes-kernel/linux/linux/smack.cfg b/meta-security/recipes-kernel/linux/linux/smack.cfg
new file mode 100644
index 000000000..62f465a45
--- /dev/null
+++ b/meta-security/recipes-kernel/linux/linux/smack.cfg
@@ -0,0 +1,8 @@
+CONFIG_IP_NF_SECURITY=m
+CONFIG_IP6_NF_SECURITY=m
+CONFIG_EXT2_FS_SECURITY=y
+CONFIG_EXT3_FS_SECURITY=y
+CONFIG_EXT4_FS_SECURITY=y
+CONFIG_SECURITY=y
+CONFIG_SECURITY_SMACK=y
+CONFIG_TMPFS_XATTR=y