diff options
Diffstat (limited to 'meta-app-framework')
10 files changed, 14 insertions, 176 deletions
diff --git a/meta-app-framework/conf/include/agl-appfw-smack.inc b/meta-app-framework/conf/include/agl-appfw-smack.inc index b77a5d17c..b6b998a9b 100644 --- a/meta-app-framework/conf/include/agl-appfw-smack.inc +++ b/meta-app-framework/conf/include/agl-appfw-smack.inc @@ -1,6 +1,6 @@ # enable security features (smack, cynara) - required by Application Framework -OVERRIDES .= ":smack" -DISTRO_FEATURES_append = " smack dbus-cynara xattr" +OVERRIDES .= ":with-lsm-smack" +DISTRO_FEATURES_append = " smack xattr" # use tar-native to support SMACK extended attributes independently of host config IMAGE_CMD_TAR = "tar --xattrs --xattrs-include='*'" diff --git a/meta-app-framework/recipes-core/af-main/af-main_1.0.bb b/meta-app-framework/recipes-core/af-main/af-main_1.0.bb index 8ac661527..e160486b2 100644 --- a/meta-app-framework/recipes-core/af-main/af-main_1.0.bb +++ b/meta-app-framework/recipes-core/af-main/af-main_1.0.bb @@ -14,7 +14,7 @@ DEPENDS = "openssl libxml2 xmlsec1 systemd libzip json-c systemd security-manage DEPENDS_class-native = "openssl libxml2 xmlsec1 libzip json-c" RDEPENDS_${PN}_class-target += "af-binder-tools" -PACKAGE_WRITE_DEPS_append_smack = " smack-userspace-native libcap-native" +PACKAGE_WRITE_DEPS_append_with-lsm-smack = " smack-native libcap-native" EXTRA_OECMAKE_class-native = "\ -DUSE_LIBZIP=1 \ @@ -46,8 +46,8 @@ GROUPADD_PARAM_${PN} = "-r ${afm_name}" FILES_${PN} += "\ ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', '${systemd_user_unitdir}/afm-user-daemon.service', '', d)} \ " -RDEPENDS_${PN}_append_smack = " smack-userspace bash" -DEPENDS_append_smack = " smack-userspace-native" +RDEPENDS_${PN}_append_with-lsm-smack = " smack bash" +DEPENDS_append_with-lsm-smack = " smack-native" # short hacks here SRC_URI += "\ @@ -90,7 +90,7 @@ pkg_postinst_${PN}() { chown ${afm_name}:${afm_name} $D${afm_datadir}/icons } -pkg_postinst_${PN}_append_smack() { +pkg_postinst_${PN}_append_with-lsm-smack() { if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then chsmack -a 'System::Shared' -t $D${systemd_units_root}/system chsmack -a 'System::Shared' -t $D${systemd_units_root}/system/afm-user-session@.target.wants diff --git a/meta-app-framework/recipes-core/base-files/base-files_%.bbappend b/meta-app-framework/recipes-core/base-files/base-files_%.bbappend index 636bcc4df..b837d03ad 100644 --- a/meta-app-framework/recipes-core/base-files/base-files_%.bbappend +++ b/meta-app-framework/recipes-core/base-files/base-files_%.bbappend @@ -1,5 +1,5 @@ -RDEPENDS_${PN}_append_smack = " smack-userspace" -PACKAGE_WRITE_DEPS_append_smack = " smack-userspace-native" +RDEPENDS_${PN}_append_with-lsm-smack = " smack" +PACKAGE_WRITE_DEPS_append_with-lsm-smack = " smack-native" do_install_append() { install -d ${D}/${sysconfdir}/skel/app-data @@ -13,7 +13,7 @@ do_install_append() { ln -s ../../var/local ${D}/usr/local } -do_install_append_smack () { +do_install_append_with-lsm-smack () { install -d ${D}/${sysconfdir}/smack/accesses.d cat > ${D}/${sysconfdir}/smack/accesses.d/default-access-domains-no-user <<EOF System User::App-Shared rwxat @@ -22,7 +22,7 @@ EOF chmod 0644 ${D}/${sysconfdir}/smack/accesses.d/default-access-domains-no-user } -pkg_postinst_${PN}_append_smack() { +pkg_postinst_${PN}_append_with-lsm-smack() { chsmack -r -a 'User::Home' -t -D $D/${sysconfdir}/skel chsmack -a 'User::App-Shared' -D $D/${sysconfdir}/skel/app-data cp -rTf --preserve=all $D/${sysconfdir}/skel $D/${ROOT_HOME} diff --git a/meta-app-framework/recipes-core/packagegroups/packagegroup-agl-core-security.bbappend b/meta-app-framework/recipes-core/packagegroups/packagegroup-agl-core-security.bbappend index 0c9efe465..a8d04ab6d 100644 --- a/meta-app-framework/recipes-core/packagegroups/packagegroup-agl-core-security.bbappend +++ b/meta-app-framework/recipes-core/packagegroups/packagegroup-agl-core-security.bbappend @@ -1,7 +1,6 @@ RDEPENDS_${PN} += "\ xmlsec1 \ cynara \ - dbus-cynara \ security-manager \ security-manager-policy \ agl-users \ diff --git a/meta-app-framework/recipes-core/security-manager/security-manager_%.bbappend b/meta-app-framework/recipes-core/security-manager/security-manager_%.bbappend index 92b79572f..61c933a7e 100644 --- a/meta-app-framework/recipes-core/security-manager/security-manager_%.bbappend +++ b/meta-app-framework/recipes-core/security-manager/security-manager_%.bbappend @@ -1,6 +1,6 @@ FILESEXTRAPATHS_prepend := "${THISDIR}/security-manager:" -PACKAGE_WRITE_DEPS_append_smack = " smack-userspace-native" +PACKAGE_WRITE_DEPS_append_with-lsm-smack = " smack-native" SRC_URI += " file://0001-Adapt-rules-to-AGL.patch \ file://init-security-manager-db.service \ diff --git a/meta-app-framework/recipes-kernel/linux/linux-%.bbappend b/meta-app-framework/recipes-kernel/linux/linux-%.bbappend index 02595efdf..fba5bf13d 100644 --- a/meta-app-framework/recipes-kernel/linux/linux-%.bbappend +++ b/meta-app-framework/recipes-kernel/linux/linux-%.bbappend @@ -1,3 +1,3 @@ FILESEXTRAPATHS_prepend := "${THISDIR}/linux:" -SRC_URI_append_smack = " file://audit.cfg" +SRC_URI_append_with-lsm-smack = " file://audit.cfg" diff --git a/meta-app-framework/recipes-kernel/linux/linux-yocto_4.12.bbappend b/meta-app-framework/recipes-kernel/linux/linux-yocto_4.12.bbappend index b1eadaffa..5ae62d586 100644 --- a/meta-app-framework/recipes-kernel/linux/linux-yocto_4.12.bbappend +++ b/meta-app-framework/recipes-kernel/linux/linux-yocto_4.12.bbappend @@ -3,7 +3,7 @@ FILESEXTRAPATHS_prepend := "${THISDIR}/linux/linux-yocto-4.12:" #------------------------------------------------------------------------- # smack patches for handling bluetooth -SRC_URI_append_smack = "\ +SRC_URI_append_with-lsm-smack = "\ file://0002-smack-fix-cache-of-access-labels.patch \ file://0003-Smack-ignore-null-signal-in-smack_task_kill.patch \ file://0004-Smack-Assign-smack_known_web-label-for-kernel-thread.patch \ diff --git a/meta-app-framework/recipes-security/cynara/cynara_git.bbappend b/meta-app-framework/recipes-security/cynara/cynara_git.bbappend deleted file mode 100644 index 4c38da1cc..000000000 --- a/meta-app-framework/recipes-security/cynara/cynara_git.bbappend +++ /dev/null @@ -1,44 +0,0 @@ -FILESEXTRAPATHS_prepend := "${THISDIR}/${BPN}:" -SRC_URI_append = " file://0001-gcc-7-requires-include-functional-for-std-function.patch" - -CXXFLAGS_append = " -Wimplicit-fallthrough=0" - -pkg_postinst_${PN} () { - # Fail on error. - set -e - - # It would be nice to run the code below while building an image, - # but currently the calls to cynara-db-chsgen (a binary) in - # cynara-db-migration (a script) prevent that. Rely instead - # on OE's support for running failed postinst scripts at first boot. - if [ x"$D" != "x" ]; then - exit 1 - fi - - mkdir -p $D${sysconfdir}/cynara - ${CHSMACK} -a System $D${sysconfdir}/cynara - - # Strip git patch level information, the version comparison code - # in cynara-db-migration only expect major.minor.patch version numbers. - VERSION=${@d.getVar('PV',d,1).split('+git')[0]} - if [ -d $D${localstatedir}/cynara ] ; then - # upgrade - echo "NOTE: updating cynara DB to version $VERSION" - $D${sbindir}/cynara-db-migration upgrade -f 0.0.0 -t $VERSION - else - # install - echo "NOTE: creating cynara DB for version $VERSION" - mkdir -p $D${localstatedir}/cynara - ${CHSMACK} -a System $D${localstatedir}/cynara - $D${sbindir}/cynara-db-migration install -t $VERSION - fi - - # Workaround for systemd.bbclass issue: it would call - # "systemctl start" without "--no-block", but because - # the service is not ready to run at the time when - # this scripts gets executed by run-postinsts.service, - # booting deadlocks. - echo "NOTE: enabling and starting cynara service" - systemctl enable cynara - systemctl start --no-block cynara -} diff --git a/meta-app-framework/recipes-support/xmlsec1/xmlsec1/Only-require-libxslt-in-.pc-files-when-necessary.patch b/meta-app-framework/recipes-support/xmlsec1/xmlsec1/Only-require-libxslt-in-.pc-files-when-necessary.patch deleted file mode 100644 index c92df77f0..000000000 --- a/meta-app-framework/recipes-support/xmlsec1/xmlsec1/Only-require-libxslt-in-.pc-files-when-necessary.patch +++ /dev/null @@ -1,115 +0,0 @@ -From 1e39acf581ef47876b058da41774cbc92560d797 Mon Sep 17 00:00:00 2001 -From: Manuel Bachmann <manuel.bachmann@iot.bzh> -Date: Wed, 27 Jan 2016 14:16:40 +0100 -Subject: [PATCH] Only require libxslt in .pc files when necessary - -If we build xmlsec without libxslt ("--without-libxslt" at -configure time), dependent packages will still require it -because it is unconditionally mentioned in .pc files (used -by pkg-config). - -We now make sure that this dependency is mentioned only if -the configure script validates libxslt presence. - -Signed-off-by: Manuel Bachmann <manuel.bachmann@iot.bzh> ---- - configure.in | 4 ++++ - xmlsec-gcrypt.pc.in | 2 +- - xmlsec-gnutls.pc.in | 2 +- - xmlsec-nss.pc.in | 2 +- - xmlsec-openssl.pc.in | 2 +- - xmlsec.pc.in | 2 +- - 6 files changed, 9 insertions(+), 5 deletions(-) - -diff --git a/configure.in b/configure.in -index 7d976d0..a8350a9 100644 ---- a/configure.in -+++ b/configure.in -@@ -255,6 +255,7 @@ dnl ========================================================================== - dnl find libxslt - dnl ========================================================================== - XMLSEC_NO_LIBXSLT="1" -+LIBXSLT_COND="libxslt >=" - LIBXSLT_MIN_VERSION=1.0.20 - LIBXSLT_CONFIG="xslt-config" - LIBXSLT_CFLAGS="" -@@ -324,6 +325,8 @@ fi - if test "z$LIBXSLT_FOUND" = "zyes" ; then - XMLSEC_NO_LIBXSLT="0" - else -+ LIBXSLT_COND="" -+ LIBXSLT_MIN_VERSION="" - XMLSEC_DEFINES="$XMLSEC_DEFINES -DXMLSEC_NO_XSLT=1" - fi - -@@ -332,6 +335,7 @@ AC_SUBST(LIBXSLT_CFLAGS) - AC_SUBST(LIBXSLT_LIBS) - AC_SUBST(LIBXSLT_CONFIG) - AC_SUBST(LIBXSLT_MIN_VERSION) -+AC_SUBST(LIBXSLT_COND) - - dnl ========================================================================== - dnl See if we can find a crypto library -diff --git a/xmlsec-gcrypt.pc.in b/xmlsec-gcrypt.pc.in -index 1c00496..33bc2ff 100644 ---- a/xmlsec-gcrypt.pc.in -+++ b/xmlsec-gcrypt.pc.in -@@ -6,6 +6,6 @@ includedir=@includedir@ - Name: xmlsec1-gcrypt - Version: @VERSION@ - Description: XML Security Library implements XML Signature and XML Encryption standards --Requires: libxml-2.0 >= @LIBXML_MIN_VERSION@ libxslt >= @LIBXSLT_MIN_VERSION@ -+Requires: libxml-2.0 >= @LIBXML_MIN_VERSION@ @LIBXSLT_COND@ @LIBXSLT_MIN_VERSION@ - Cflags: -DXMLSEC_CRYPTO=\"gcrypt\" @XMLSEC_GCRYPT_CFLAGS@ - Libs: @XMLSEC_GCRYPT_LIBS@ -diff --git a/xmlsec-gnutls.pc.in b/xmlsec-gnutls.pc.in -index e538cd4..d01cf82 100644 ---- a/xmlsec-gnutls.pc.in -+++ b/xmlsec-gnutls.pc.in -@@ -6,6 +6,6 @@ includedir=@includedir@ - Name: xmlsec1-gnutls - Version: @VERSION@ - Description: XML Security Library implements XML Signature and XML Encryption standards --Requires: libxml-2.0 >= @LIBXML_MIN_VERSION@ libxslt >= @LIBXSLT_MIN_VERSION@ -+Requires: libxml-2.0 >= @LIBXML_MIN_VERSION@ @LIBXSLT_COND@ @LIBXSLT_MIN_VERSION@ - Cflags: -DXMLSEC_CRYPTO=\"gnutls\" @XMLSEC_GNUTLS_CFLAGS@ - Libs: @XMLSEC_GNUTLS_LIBS@ -diff --git a/xmlsec-nss.pc.in b/xmlsec-nss.pc.in -index a6d6c5c..75f0232 100644 ---- a/xmlsec-nss.pc.in -+++ b/xmlsec-nss.pc.in -@@ -6,6 +6,6 @@ includedir=@includedir@ - Name: xmlsec1-nss - Version: @VERSION@ - Description: XML Security Library implements XML Signature and XML Encryption standards --Requires: libxml-2.0 >= @LIBXML_MIN_VERSION@ libxslt >= @LIBXSLT_MIN_VERSION@ @NSPR_PACKAGE@ >= @MOZILLA_MIN_VERSION@ @NSS_PACKAGE@ >= @MOZILLA_MIN_VERSION@ -+Requires: libxml-2.0 >= @LIBXML_MIN_VERSION@ @LIBXSLT_COND@ @LIBXSLT_MIN_VERSION@ @NSPR_PACKAGE@ >= @MOZILLA_MIN_VERSION@ @NSS_PACKAGE@ >= @MOZILLA_MIN_VERSION@ - Cflags: -DXMLSEC_CRYPTO=\"nss\" -DXMLSEC_CRYPTO_NSS=1 @XMLSEC_CORE_CFLAGS@ - Libs: -L${libdir} -lxmlsec1-nss @XMLSEC_CORE_LIBS@ -diff --git a/xmlsec-openssl.pc.in b/xmlsec-openssl.pc.in -index 85ee2b0..e9d0651 100644 ---- a/xmlsec-openssl.pc.in -+++ b/xmlsec-openssl.pc.in -@@ -6,6 +6,6 @@ includedir=@includedir@ - Name: xmlsec1-openssl - Version: @VERSION@ - Description: XML Security Library implements XML Signature and XML Encryption standards --Requires: libxml-2.0 >= @LIBXML_MIN_VERSION@ libxslt >= @LIBXSLT_MIN_VERSION@ -+Requires: libxml-2.0 >= @LIBXML_MIN_VERSION@ @LIBXSLT_COND@ @LIBXSLT_MIN_VERSION@ - Cflags: -DXMLSEC_CRYPTO=\"openssl\" @XMLSEC_OPENSSL_CFLAGS@ - Libs: @XMLSEC_OPENSSL_LIBS@ -diff --git a/xmlsec.pc.in b/xmlsec.pc.in -index a750ab8..14ea670 100644 ---- a/xmlsec.pc.in -+++ b/xmlsec.pc.in -@@ -6,6 +6,6 @@ includedir=@includedir@ - Name: xmlsec1 - Version: @VERSION@ - Description: XML Security Library implements XML Signature and XML Encryption standards --Requires: libxml-2.0 >= @LIBXML_MIN_VERSION@ libxslt >= @LIBXSLT_MIN_VERSION@ -+Requires: libxml-2.0 >= @LIBXML_MIN_VERSION@ @LIBXSLT_COND@ @LIBXSLT_MIN_VERSION@ - Cflags: -DXMLSEC_CRYPTO=\"@XMLSEC_CRYPTO@\" -DXMLSEC_CRYPTO_DYNAMIC_LOADING=1 @XMLSEC_CORE_CFLAGS@ - Libs: -L${libdir} @XMLSEC_CORE_LIBS@ --- -2.6.2 - diff --git a/meta-app-framework/recipes-support/xmlsec1/xmlsec1_1.%.bbappend b/meta-app-framework/recipes-support/xmlsec1/xmlsec1_1.%.bbappend index 8f1972f07..ea1017a9e 100644 --- a/meta-app-framework/recipes-support/xmlsec1/xmlsec1_1.%.bbappend +++ b/meta-app-framework/recipes-support/xmlsec1/xmlsec1_1.%.bbappend @@ -1,6 +1,4 @@ -FILESEXTRAPATHS_append := ":${THISDIR}/${PN}" -SRC_URI += "file://Only-require-libxslt-in-.pc-files-when-necessary.patch" -DEPENDS += "libxml2" +DEPENDS = "libtool libxml2 libxslt openssl" BBCLASSEXTEND = "native nativesdk" |