From f11a3e7653777ad4342e615f47ec4a5417a2fa96 Mon Sep 17 00:00:00 2001 From: José Bollo Date: Wed, 12 Dec 2018 12:03:43 +0100 Subject: systemd: Refactor build using smack-system-setup MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This changes introduces the new recipe meta-security/recipes-core/smack-system-setup/smack-system-setup_1.bb The purpose is to split the recipe of systemd in two parts: - A part specific to systemd and only systemd It actually includes Smack patches for systemd and a renaming of udev-rules. - A part more oriented on putting the system in order to run with Smack activated. At the end, it will probably save many rebuilds as systemd recipe will evolve less in relation with the setup of the system. As example, the udev rule file "55-udev-smack-default.rules" that setup udev rules specific to smack is no more brought by systemd but by smack-system-setup. Also at the same time, some cleanup and refactoring is done. Note that the ".bbappend" file for systemd is now fixed in version and is including a common file file that records the several known versions. No cleanup was made on the versioned patch for the sake of memory. The cleanup of the history is to be achieved later... Bug-AGL: SPEC-2045 Change-Id: Iacf772142a381729dfdbe98d133a3effc4d6cf68 Signed-off-by: José Bollo --- .../recipes-core/systemd/systemd_%.bbappend | 120 --------------------- 1 file changed, 120 deletions(-) delete mode 100644 meta-security/recipes-core/systemd/systemd_%.bbappend (limited to 'meta-security/recipes-core/systemd/systemd_%.bbappend') diff --git a/meta-security/recipes-core/systemd/systemd_%.bbappend b/meta-security/recipes-core/systemd/systemd_%.bbappend deleted file mode 100644 index 65e28f9de..000000000 --- a/meta-security/recipes-core/systemd/systemd_%.bbappend +++ /dev/null @@ -1,120 +0,0 @@ -FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:" - -# Most patches from sandbox/jobol/v219. Cannot be applied unconditionally -# because systemd panics when booted without Smack support: -# systemd[1]: Cannot determine cgroup we are running in: No such file or directory -# systemd[1]: Failed to allocate manager object: No such file or directory -# [!!!!!!] Failed to allocate manager object, freezing. -# -# There's a slight dependency on the base systemd in 0005-tizen-smack-Handling-network. -# We use the beginning of PV (unexpanded here to prevent a cyclic dependency -# during resolution apparently caused by ${SRCPV}) to pick the right set of -# patches. -# -# Patches are optional. Hopefully we won't need any for systemd >= 229. -SRC_URI_append_with-lsm-smack = " ${@d.getVar('SYSTEMD_SMACK_PATCHES_' + d.getVar('PV', False)[0:3], True) or ''}" - -SYSTEMD_SMACK_PATCHES_216 = " \ -file://0003-tizen-smack-Handling-of-run-and-sys-fs-cgroup-v216.patch \ -file://0004-tizen-smack-Handling-of-dev-v216.patch \ -file://0005-tizen-smack-Handling-network-v216.patch \ -file://0007-tizen-smack-Runs-systemd-journald-with-v216.patch \ -" - -SYSTEMD_SMACK_PATCHES_219 = " \ -file://0003-tizen-smack-Handling-of-run-and-sys-fs-cgroup.patch \ -file://0004-tizen-smack-Handling-of-dev.patch \ -file://0005-tizen-smack-Handling-network.patch \ -file://0007-tizen-smack-Runs-systemd-journald-with.patch \ -" -SYSTEMD_SMACK_PATCHES_225 = " \ -file://0003-tizen-smack-Handling-of-run-and-sys-fs-cgroup.patch \ -file://0004-tizen-smack-Handling-of-dev.patch \ -file://0005-tizen-smack-Handling-network-v225.patch \ -file://0007-tizen-smack-Runs-systemd-journald-with.patch \ -" - -SYSTEMD_SMACK_PATCHES_228 = " \ -file://0005-tizen-smack-Handling-network-v228.patch \ -file://mount-setup.c-fix-handling-of-symlink-Smack-labellin-v228.patch \ -" - -# From Tizen .spec file. -EXTRA_OECONF_append_with-lsm-smack = " --with-smack-run-label=System" - -install_file() { - install -d $(dirname $1) - cat >>$1 - chmod ${2:-0644} $1 -} - -# We need to emulate parts of the filesystem permissions from Tizen here. -# The part for regular files is in base-files.bbappend, but /var/log and -# /var/tmp point into /var/volatile (tmpfs) and get created anew during -# startup. We set these permissions directly after creating them via -# /etc/tmpfiles.d/00-create-volatile.conf -RDEPENDS_${PN}_append_with-lsm-smack = " smack" -do_install_append_with-lsm-smack() { - install_file ${D}${systemd_unitdir}/system/systemd-tmpfiles-setup.service.d/smack.conf <. - # Upstream systemd temporarily had SmackFileSystemRoot for this (https://github.com/systemd/systemd/pull/1664), - # but it was removed again (https://github.com/systemd/systemd/issues/1696) because - # util-linux mount will ignore smackfsroot when Smack is not active. However, - # busybox is not that intelligent. - # - # When using busybox mount, adding smackfsroot=* and booting without - # Smack (i.e. security=none), tmp.mount will fail with an error about - # "Bad mount option smackfsroot". - install_file ${D}${systemd_unitdir}/system/tmp.mount.d/smack.conf < - # - # This is considered a configuration change and thus distro specific. - install_file ${D}${systemd_unitdir}/system/systemd-journald.service.d/smack.conf <. - # - # We simplify the patching by touching only lines which check the result of - # mac_smack_use(). Those are the ones which are used when Smack is active. - # - # smackfsroot=* on /sys/fs/cgroup may be upstreamable, but smackfstransmute=System::Run - # is too distro specific (depends on Smack rules) and thus has to remain here. - sed -i -e 's;\("/sys/fs/cgroup", *"[^"]*", *"[^"]*\)\(.*mac_smack_use.*\);\1,smackfsroot=*\2;' \ - -e 's;\("/run", *"[^"]*", *"[^"]*\)\(.*mac_smack_use.*\);\1,smackfstransmute=System::Run\2;' \ - ${S}/src/core/mount-setup.c -} -- cgit 1.2.3-korg