udev/init: work around dev-cache restore problems

Restoring from the dev-cache with selinux enforcing causes various
failures as devices are lacking, at a minimum, reasonable types and
attributes.  If, on the other hand, we at least create the cache with
selinux and xattrs preserved and restored, we get significantly fewer
errors and warnings on boot and we can successfully restore the context
further down in init anyway.  It still leaves some devices mislabeled,
though, and still produces warnings on boot.

Previous versions of the initscript removed all use of the dev-cache,
if need be, we fall back to that.  It is possible to get the middle-ground
behaviour by defining use_udev_cache at the top of the udev initscript.

Signed-off-by: Joe MacDonald <joe@deserted.net>
refpolicy*: add new version 2.20130424

These patches are removed because new version merged:
 - poky-fc-update-alternatives_tinylogin.patch
 - poky-fc-fix-prefix-path_rpc.patch
 - poky-fc-fix-portmap.patch
 - poky-fc-cgroup.patch
 - poky-fc-networkmanager.patch
 - poky-policy-allow-dbusd-to-setrlimit-itself.patch
 - poky-policy-allow-dbusd-to-exec-shell-commands.patch
 - poky-policy-allow-nfsd-to-bind-nfs-port.patch

Add two new patches:
 + poky-policy-fix-setfiles-statvfs-get-file-count.patch
 + poky-policy-fix-dmesg-to-use-dev-kmsg.patch

Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
Signed-off-by: Joe MacDonald <joe@deserted.net>
refpolicy*: remove old version recipes and patches.

Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
Signed-off-by: Joe MacDonald <joe@deserted.net>
busybox: alternatives link to sh wrappers for commands

While directly using busybox[.[no]suid] as the alternatives'
targets, commands could not get correct security labels.

 ~# ls -l /sbin/getty
 ..... /sbin/getty -> /bin/busybox.nosuid
 ~# ls -Z /bin/busybox.nosuid
 system_u:object_r:bin_t:s0 /bin/busybox.nosuid

Add sh wrappers for commands so selinux could work fine.

 ~# ls -l /sbin/getty
 ..... /sbin/getty -> /usr/lib/busybox/sbin/getty
 ~# ls -Z /usr/lib/busybox/sbin/getty
 system_u:object_r:getty_exec_t:s0 /usr/lib/busybox/sbin/getty
 ~# cat /usr/lib/busybox/sbin/getty
 #!/bin/busybox.nosuid

Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
Signed-off-by: Joe MacDonald <joe@deserted.net>
kernel: add BBAPPEND for linux 3.10

Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
Signed-off-by: Joe MacDonald <joe@deserted.net>
linux-yocto: Add support for the 3.10 kernel

Also update the selinux.cfg file to add ext4, jfs, and jffs2 support.

Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
Signed-off-by: Joe MacDonald <joe@deserted.net>
selinux: remove reference to locale env files from login

[ CQID: WIND00425413 ]

pam.d/login refered to the /etc/default/locale env file.

This file is not used in oe-core/Poky.

Remove the this reference to avoid error messages in auth.log.

Signed-off-by: Qiang Chen <qiang.chen@windriver.com>
Signed-off-by: Jeff Polk <jeff.polk@windriver.com>
Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
Signed-off-by: Joe MacDonald <joe@deserted.net>
layer.conf: avoid unnecessary early expansion with :=

bitbake handles immediate expansions of LAYERDIR for us automatically.

Signed-off-by: Christopher Larson <chris_larson@mentor.com>
Signed-off-by: Joe MacDonald <joe@deserted.net>
distro/*: Update the distro files

Make the oe-selinux.conf the base configuration file.

Ensure that we enable acl and xattr support as well.

Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
Signed-off-by: Joe MacDonald <joe@deserted.net>
python-ipy: Uprev to latest 0.81 version

Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
Signed-off-by: Joe MacDonald <joe@deserted.net>
swig: Update to latest swig from meta-openembedded

Updated from:
 git://git.openembedded.org/meta-openembedded/meta-oe/recipes-devtools/swig

 As of commit 1d536390dcafe4d539335dec2173aa9ddc3d8b51

Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
Signed-off-by: Joe MacDonald <joe@deserted.net>
audit: Uprev to audit 2.3.2

Refactor the audit cross compiling patch.  The new patch might have some minor
host dependencies.  If so, let me know!

Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
Signed-off-by: Joe MacDonald <joe@deserted.net>
libcap-ng: Uprev libcap-ng

Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
Signed-off-by: Joe MacDonald <joe@deserted.net>
README: Update status

Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
Signed-off-by: Joe MacDonald <joe@deserted.net>
setools: Uprev setools

Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
Signed-off-by: Joe MacDonald <joe@deserted.net>
policycoreutils: avoid shell for checking target-special actions

do_install was modified to only do the special actions in the target case,
instead of using shell to check what mode we were running in.

Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
Signed-off-by: Joe MacDonald <joe@deserted.net>