Add util-linux-agetty to core-image-selinux IMAGE_INSTALL.

Currently logins to core-image-selinux images through a getty (serial)
fail. This is caused by the use of the busybox getty. SELinux depends
on executable files and their labels to transition between types.
The symlink to busybox is not sufficient to cause the getty processes
to transition to the right SELinux context. Using a getty binary
like the one provided by util-linux fixes this.

Signed-off-by: Philip Tricca <flihp@twobit.us>
Signed-off-by: Joe MacDonald <joe@deserted.net>
openssh: add PACKAGECONFIG data regarding audit

Define audit related parameters, but do not enable
audit support by default.

Signed-off-by: Joe Slater <jslater@windriver.com>
Signed-off-by: Joe MacDonald <joe@deserted.net>
Resend: Install policy headers and include them in the refpolicy dev package.

To do this we call the 'install-headers' make target at the end of
do_install. We then add the interface 'include' directory to the
dev package leaving only the policy modules in the main policy
package. This allows projects that ship their own SELinux policy
(not in the refpolicy) to build the refpolicy headers / interface
files by using the Makefile supplied by refpolicy.

Signed-off-by: Philip Tricca <flihp@twobit.us>
Signed-off-by: Joe MacDonald <joe@deserted.net>
Check for the availability of 'secon' and 'setenforce' in the selinux-init.sh script.

This is for consistency and to aid in debugging.

Signed-off-by: Philip Tricca <flihp@twobit.us>
Signed-off-by: Joe MacDonald <joe@deserted.net>
Add ${bindir}/sepolgen to system-config-selinux package.

Currently the policycoreutils package has a broken link from
${bindir}/sepolgen to ${datadir}/system-config-selinux/polgen.py.
All of the other polgen stuff is in system-config-selinux so
adding sepolgen to same package seems like the right thing to do.

Signed-off-by: Philip Tricca <flihp@twobit.us>
Signed-off-by: Joe MacDonald <joe@deserted.net>
tar: add acl dependency information

If acl is a distro feature, we want to depend
on it.  Note that without the xattrs patch, tar
cannot deal with acl information.

Signed-off-by: Joe Slater <jslater@windriver.com>
Signed-off-by: Joe MacDonald <joe@deserted.net>
selinux userspace: uprev packages to release 20130423

Upreved packages:
 - checkpolicy to 2.1.12
 - libselinux to 2.1.13
 - libsemanage to 2.1.10
 - libsepol to 2.1.9
 - policycoreutils to 2.1.14
 - sepolgen to 1.1.9

Migrate patches in next commits.

Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
Signed-off-by: Joe MacDonald <joe@deserted.net>
checkpolicy: migrate SRC_URI to 2.1.12

Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
Signed-off-by: Joe MacDonald <joe@deserted.net>
libselinux: migrate SRC_URI and patches to 2.1.13

We will also uprev refpolicy, so remove "revert-libpcre.patch".

Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
Signed-off-by: Joe MacDonald <joe@deserted.net>
libsemanage: migrate SRC_URI to 2.1.10

Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
Signed-off-by: Joe MacDonald <joe@deserted.net>
libsepol: migrate SRC_URI to 2.1.9

Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
Signed-off-by: Joe MacDonald <joe@deserted.net>
policycoreutils: migrate SRC_URI and patches to 2.1.14

2.1.14 imports a new python module: sepolicy, so add setools to
DEPENDS and split new files to policycoreutils-python.

Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
Signed-off-by: Joe MacDonald <joe@deserted.net>
sepolgen: migrate SRC_URI to 1.1.9

Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
Signed-off-by: Joe MacDonald <joe@deserted.net>
policycoreutils: fix wrong newrole/run_init pam config

Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
Signed-off-by: Joe MacDonald <joe@deserted.net>
always force to restore file contexts in initscripts

In policycoreutils-2.13+, restorecon changes its default behaviour,
and does not restore context if the file' type is correct, even its
mcs/mls level is incorrect.
We should force it always to restore file contexts in initscripts to
avoid issues.

Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
Signed-off-by: Joe MacDonald <joe@deserted.net>
udev/init: sync to latest poky version

[ CQID: WIND00424385 ]

Sync with the latest init file from poky as of 09172013.  Changes include:

	- adding /sbin/restorecon on start
	- specifying full path for /sbin/udevadm

Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
Signed-off-by: Joe MacDonald <joe@deserted.net>
udev/init: work around dev-cache restore problems

Restoring from the dev-cache with selinux enforcing causes various
failures as devices are lacking, at a minimum, reasonable types and
attributes.  If, on the other hand, we at least create the cache with
selinux and xattrs preserved and restored, we get significantly fewer
errors and warnings on boot and we can successfully restore the context
further down in init anyway.  It still leaves some devices mislabeled,
though, and still produces warnings on boot.

Previous versions of the initscript removed all use of the dev-cache,
if need be, we fall back to that.  It is possible to get the middle-ground
behaviour by defining use_udev_cache at the top of the udev initscript.

Signed-off-by: Joe MacDonald <joe@deserted.net>
refpolicy*: add new version 2.20130424

These patches are removed because new version merged:
 - poky-fc-update-alternatives_tinylogin.patch
 - poky-fc-fix-prefix-path_rpc.patch
 - poky-fc-fix-portmap.patch
 - poky-fc-cgroup.patch
 - poky-fc-networkmanager.patch
 - poky-policy-allow-dbusd-to-setrlimit-itself.patch
 - poky-policy-allow-dbusd-to-exec-shell-commands.patch
 - poky-policy-allow-nfsd-to-bind-nfs-port.patch

Add two new patches:
 + poky-policy-fix-setfiles-statvfs-get-file-count.patch
 + poky-policy-fix-dmesg-to-use-dev-kmsg.patch

Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
Signed-off-by: Joe MacDonald <joe@deserted.net>
refpolicy*: remove old version recipes and patches.

Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
Signed-off-by: Joe MacDonald <joe@deserted.net>
busybox: alternatives link to sh wrappers for commands

While directly using busybox[.[no]suid] as the alternatives'
targets, commands could not get correct security labels.

 ~# ls -l /sbin/getty
 ..... /sbin/getty -> /bin/busybox.nosuid
 ~# ls -Z /bin/busybox.nosuid
 system_u:object_r:bin_t:s0 /bin/busybox.nosuid

Add sh wrappers for commands so selinux could work fine.

 ~# ls -l /sbin/getty
 ..... /sbin/getty -> /usr/lib/busybox/sbin/getty
 ~# ls -Z /usr/lib/busybox/sbin/getty
 system_u:object_r:getty_exec_t:s0 /usr/lib/busybox/sbin/getty
 ~# cat /usr/lib/busybox/sbin/getty
 #!/bin/busybox.nosuid

Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
Signed-off-by: Joe MacDonald <joe@deserted.net>