diff options
Diffstat (limited to 'meta-app-framework')
4 files changed, 23 insertions, 20 deletions
diff --git a/meta-app-framework/recipes-kernel/linux/linux-%.bbappend b/meta-app-framework/recipes-kernel/linux/linux-%.bbappend index acce6cc1b..807da11f1 100644 --- a/meta-app-framework/recipes-kernel/linux/linux-%.bbappend +++ b/meta-app-framework/recipes-kernel/linux/linux-%.bbappend @@ -1,2 +1 @@ -require ${@bb.utils.contains('APPFW_ENABLED', '1', 'linux-appfw.inc', '', d)} - +require ${@bb.utils.contains('APPFW_ENABLED', '1', 'linux-appfw.inc', '', d) if bb.data.inherits_class('kernel', d) else ''} diff --git a/meta-app-framework/recipes-kernel/linux/linux-appfw.inc b/meta-app-framework/recipes-kernel/linux/linux-appfw.inc index cbf6567e0..1b6d1b6a8 100644 --- a/meta-app-framework/recipes-kernel/linux/linux-appfw.inc +++ b/meta-app-framework/recipes-kernel/linux/linux-appfw.inc @@ -1,21 +1,23 @@ FILESEXTRAPATHS_prepend := "${THISDIR}/linux:" -IS_KERNEL_RECIPE := "${@bb.data.inherits_class('kernel', d) and 'yes' or 'no'}" -SMACK_KERNEL_SRC_URI_no = "" -SMACK_KERNEL_SRC_URI_yes = "" +# Enable SMACK support without making it the default explicitly. +AGL_KCONFIG_FRAGMENTS += "smack.cfg" -# Kernel config fragment enabling Smack, without making it the default explicitly. -SMACK_KERNEL_SRC_URI_yes += "file://smack.cfg" - -# When added, set Smack as the default LSM. -SMACK_DEFAULT_SECURITY_CFG = "file://smack-default-lsm.cfg" -# Add it by default, can be overridden by changing this variable here. -SMACK_DEFAULT_SECURITY ??= "${SMACK_DEFAULT_SECURITY_CFG}" -SMACK_KERNEL_SRC_URI_yes += " ${SMACK_DEFAULT_SECURITY}" - -# add audit.cfg -SMACK_KERNEL_SRC_URI_yes += " file://audit.cfg" - - -SRC_URI_append_with-lsm-smack = "${SMACK_KERNEL_SRC_URI_${IS_KERNEL_RECIPE}}" +# Enable SMACK as default LSM, can be overridden by changing this +# variable to e.g. "". +# +# NOTE: +# We use a different fragment for kernels older than 5.x that predate +# the switch to using CONFIG_LSM instead of CONFIG_DEFAULT_SECURITY. +# For simplicity, logic to handle the change being made in 5.1 instead +# of 5.0 has been omitted; in practice this should not be a problem +# since no current BSPs have been seen that use 5.0.x. If a BSP +# kernel recipe does not set LINUX_VERSION, the kernel being 5.x or +# newer is assumed as the default behavior. +LINUX_VERSION_MAJOR = "${@(d.getVar('LINUX_VERSION') or "5.x").split('.')[0]}" +SMACK_DEFAULT_SUFFIX = "${@'' if int(d.getVar('LINUX_VERSION_MAJOR') or 0) >= 5 else '-old'}" +SMACK_DEFAULT_SECURITY ??= "smack-default-lsm${SMACK_DEFAULT_SUFFIX}.cfg" +AGL_KCONFIG_FRAGMENTS += "${SMACK_DEFAULT_SECURITY}" +# Enable audit support +AGL_KCONFIG_FRAGMENTS += "audit.cfg" diff --git a/meta-app-framework/recipes-kernel/linux/linux/smack-default-lsm-old.cfg b/meta-app-framework/recipes-kernel/linux/linux/smack-default-lsm-old.cfg new file mode 100644 index 000000000..b5c48454e --- /dev/null +++ b/meta-app-framework/recipes-kernel/linux/linux/smack-default-lsm-old.cfg @@ -0,0 +1,2 @@ +CONFIG_DEFAULT_SECURITY="smack" +CONFIG_DEFAULT_SECURITY_SMACK=y diff --git a/meta-app-framework/recipes-kernel/linux/linux/smack-default-lsm.cfg b/meta-app-framework/recipes-kernel/linux/linux/smack-default-lsm.cfg index b5c48454e..4791ebab3 100644 --- a/meta-app-framework/recipes-kernel/linux/linux/smack-default-lsm.cfg +++ b/meta-app-framework/recipes-kernel/linux/linux/smack-default-lsm.cfg @@ -1,2 +1,2 @@ -CONFIG_DEFAULT_SECURITY="smack" CONFIG_DEFAULT_SECURITY_SMACK=y +CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,smack,selinux,tomoyo,apparmor" |