From f70d712e4f505f5c5b50ae17f4f023d20a667568 Mon Sep 17 00:00:00 2001 From: José Bollo Date: Wed, 24 Jan 2018 11:38:43 +0100 Subject: Integrate parts of meta-intel-iot-security MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds the recipes of the sub layers - meta-security-framework - meta-security-smack Change-Id: I618608008a3b3d1d34adb6e38048110f13ac0643 Signed-off-by: José Bollo --- .../connman/connman_%.bbappend | 32 ++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 meta-security/recipes-connectivity/connman/connman_%.bbappend (limited to 'meta-security/recipes-connectivity/connman') diff --git a/meta-security/recipes-connectivity/connman/connman_%.bbappend b/meta-security/recipes-connectivity/connman/connman_%.bbappend new file mode 100644 index 000000000..f66c1e79b --- /dev/null +++ b/meta-security/recipes-connectivity/connman/connman_%.bbappend @@ -0,0 +1,32 @@ +# Recent ConnMan releases started limiting the capabilities of +# ConnMan. When running on a Smack-enabled system, that change has the +# effect that connmand can no longer change network settings under +# /proc/net because the Smack label of /proc is "_", and connmand +# running with label "System" has no write access to that. +# +# It works when running as normal root with unrestricted capabilities +# because then CAP_MAC_OVERRIDE (a Smack-specific capability) allows +# the process to ignore Smack rules. +# +# We need to ensure that connmand still has that capability. +# +# The alternative would be to set up fine-grained labelling of +# /proc with corresponding rules, which is considerably more work +# and also may depend on kernel changes (like supporting smackfsroot +# for procfs, which seems to be missing at the moment). +# +# Because the solution is to some extend specific to the environment +# in which connmand runs, this change is not submitted upstream +# and it can be overridden by a distro via FIX_CONNMAN_CAPABILITIES. + +FIX_CONNMAN_CAPABILITIES ??= "" +FIX_CONNMAN_CAPABILITIES_with-lsm-smack ??= "fix_connman_capabilities" +do_install[postfuncs] += "${FIX_CONNMAN_CAPABILITIES}" + +fix_connman_capabilities () { + service="${D}/${systemd_unitdir}/system/connman.service" + if [ -f "$service" ] && + grep -q '^CapabilityBoundingSet=' "$service"; then + sed -i -e 's/^CapabilityBoundingSet=/CapabilityBoundingSet=CAP_MAC_OVERRIDE /' "$service" + fi +} -- cgit 1.2.3-korg