audit: fix package issues.

Rename two packages and change files in them.
 * audit-libs -> audit : main package, for libraries
 * audit -> auditd     : for daemon binaries

Libraries are changed to install into ${base_libdir}.

The two fixes are used to fix QA issues and fit the Debian policy.

Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
policycoreutils: disable QA checkes for fixfiles.

fixfiles in /sbin would run some /usr/bin binaries to cause these
QA warnings.

WARNING: Shell scripts in base_bindir and base_sbindir should not
reference anything in exec_prefix

Since fixfiles is installed into /sbin in most Linux distros,
changing this path may cause runtime errors for some hard coded
binaries.

So, disable unsafe-references-in-scripts QA checkes.

Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
libcap-ng: pythonnative, add swig-native depend

libcap-ng need native python while do_configure, and native swig
while do_compile, so add them.

Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
refpolicy: uprev to version 2.20120725.

Patches are migrated or droped for new version.
 * poky-fc-etc_init.d.patch: droped because file_contexts.subs_dist
       is defined to instead.
 * fix-mount-to-write-mountpoints-dirs.patch: droped because the
       rules is not needed now.
 * poky-fc-update-alternatives_sysvinit.patch: migrated.

Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
refpolicy: Fix specific file contexts for poky

Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
refpolicy: add poky specific rules for packages.

Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
refpolicy: xconsole_device_t as a dev_node

Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
openssh: enable pam and selinux.

sshd_config file from oe-core to set "UsePAM yes".
sshd file (pam config for sshd) from oe-core to add pam_selinux module.

Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
policycoreutils: add pam config for newrole/run_init

Also fix missing RDEPENDS for setools-*

Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
shadow: pam config for login to use pam_selinux module

login should use pam_selinux module to label security contexts of
processes while login into system.

Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
libpam: add pam-plugin-selinux to RDEPENDS

Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
initscripts: restorecon after populate-volatile

populate-volatile.sh creates new directories in /var/volatile/ while
booting, so we should restore the security contexts in it.
Also touch /var/log/lastlog to set correct security contexts.

populate-volatile.sh is imported for oe-core, and add these two
lines at the end.

touch /var/log/lastlog
test ! -x /sbin/restorecon || /sbin/restorecon -R /var/volatile/

Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
sysklogd: initscripts restorecon for log devices

sysklogd would create /dev/log and create log files in /var/log
with the default security contexts while starting.
So we should restore the correct security contexts.

The initscript file is from oe-core, and add these lines after
the start action.

test ! -x /sbin/restorecon || \
	/sbin/restorecon -R /dev/log /var/log/

Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
udev: initscript restore security context for /dev

Poky/oe-core has set CONFIG_DEVTMPFS_MOUNT=y for kernel to mount
/dev with devtmpfs itself.

With MLS policy, kernel is running in s15:c0.c1023 level, so /dev
will be relabeled to this high level too.
This will cause processes running with low levels can not visit
/dev directory.

So, we just run restorecon /dev to fix this.

Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
lsof: version 4.86 for oe-core uprev.

Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
tinylogin: create script wrappers for selinux

Symlink can not execute will security contexts, so create script
wrappers for tinylogin commands instead of symlinks.

Also add tinylogin's login command as a alternative.

Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
core-image-selinux: update task-* to packagegroup-*

oe-core has changed task-* recipes to packagegroup-*, so we should
follow this.

Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
document: add FAQ file for selinux

Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
selinux-config: add init script

This script will be installed as 0selinux-init, in runlevel S and
sequence number 0. It will start before any other init script.

* relabel /dev for restorecon/fixfiles running
* rebuild policy and relabel the rootfs if /.autorelabel placed.
* relabel the rootfs if it is first booting.

Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
openssl: disable execstack in CFLAG

"-Wa,--noexecstack" will mark objects as requiring executable stack,
this is a dangerous CFLAG and would cause security issues.

So disable it as most distros did.

Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>