[Buildroot] [PATCH v7 00/22] SELinux Buildroot Additions

Clayton Shotwell clayton.shotwell at rockwellcollins.com
Tue Jun 2 13:28:16 UTC 2015


### Highlevel updates in v7 of these patches
 * Fixed setools configure issue related to searching for Python
   when it is not needed
 * Moved the refpolicy patch into a version specific folder so it does
   not get applied when the custom git repos are used
 * Fixed host-linux-pam missing dependency on host-pkgconf
 * Added hash file for cpio package
 * Fixed a missing cpio dependency on argp-standalone for uClibc
   toolchains

### What's SELinux?

Security-Enhanced Linux (SELinux) is a Linux feature that provides
a variety of security policies, including U.S. Department of Defense
style mandatory access controls (MAC), through the use of Linux
Security Modules (LSM) in the Linux kernel. It is not a Linux
distribution, but rather a set of modifications that can be applied
to Unix-like operating systems, such as Linux and BSD.

Running SELinux under a Linux distribution requires three things:
An SELinux enabled kernel, SELinux Userspace tools and libraries,
and SELinux Policies (mostly based on the Reference Policy). Some
common Linux programs will also need to be patched/compiled with
SELinux features. (Credit Archlinux wiki)

### What's in this patchset?

This patchset adds the required userspace tools, libraries, example
QEMU target, existing package modifications, and initial policy
to Buildroot.
The design approach took a minimalist view to the selinux capability.
The necessary packages have been added but all the ways in which they
could be used (target vs host) are not exposed. One example is
the audit2allow framework that requires python. This is currently
setup for "host only use" to post analyze audit service output. It
could also be setup for target use but it would require the target
to have python and other supporting libs present.
Another aspect that utilized known SELinux capable applications
was for init and logging. We choose to use sysvinit and rsyslog
instead of the busybox applet version. This simplified getting
this initial configuration pulled together.
Lastly, the building of libselinux was limited to a set of
architectures and libraries that have been tested. An area for
future work will be to enable broader use.

Some references to help with the review of this patchset.
Arch and Gentoo implementation and design details:
  https://wiki.archlinux.org/index.php/SELinux
  http://wiki.gentoo.org/wiki/SELinux
  http://wiki.gentoo.org/wiki/SELinux/Installation

### Details of changes from previous patchsets

This is a new round of patches based on the v5 patchset from
last year. The changes since v4 consist of:
 * The removal of on target policy debugging using audit2allow.
   The host tools have been setup to provide offline capability
   for analyzing audit output.
 * The example qemu configuration defaults to using full versions
   of applications instead of the busybox applets. This simplified
   the configuration but as a side effect grew the filesystem size.
   There is definitely opportunity to slim down the approach to
   just using busybox applets (I've still included the patches
   that enable the capability to create individual applets).
 * Added documentation of the qemu target to that targets readme
 * Updated for structural changes (OPTS vs OPT, patch naming,
   improvements to existing packages)
 * Autobuilder was modified to run against our upstreaming
   branch and has has logged a couple weeks of builds and almost
   all of the issues are resolved against the current upstream.

Since Refpolicy is heavily tailored for a projects use, the
package exposed options of using the provided version with
patches or a custom GIT repo. Here's a bit more detail on
those assumptions.
  * Refpolicy as the package defines with default patches
    plus possibly some global patches applied. Using a default
    modules config file provided in the package folder or
    provided by the user.
  * Refpolicy looking at specific git repo revisions. Using a
    modules config file from within that git repo.
  * Repolicy using src override which assumes the same as the
    git repo case for where the modules config file originates.

### What's next:

* Testing out support for using busybox applets instead of
  sysvinit/util-linux/etc.
* qemu targets for ARM and PPC

Clayton Shotwell (11):
  sqlite: Add host build support
  python-pyparsing: Add host build option
  audit: new package
  policycoreutils: new package
  refpolicy: new package
  busybox: applets as individual binaries
  busybox: selinux support
  qemu x86 selinux: base br defconfig
  squashfs: Add xattr support
  mtd: Add xattr support
  cpio: new package

Matt Weber (11):
  setools: new package
  linux-pam: selinux support
  busybox: added linux-pam support
  sysvinit: added libselinux dependency
  dbus: selinux file context support
  openssh: selinux and pam support
  util-linux: selinux, audit, and pam support
  vim: selinux support
  rsyslog: fix config file comment style
  qemu x86 selinux: added common selinux support files
  libsemanage: cleanup python use and license definition

 board/common_selinux/busybox-selinux.config        | 1058 ++++++++++++++++++++
 board/common_selinux/post_build.sh                 |   30 +
 .../common_selinux/skeleton/etc/audit/auditd.conf  |   32 +
 .../skeleton/etc/audit/rules.d/audit.rules         |    3 +
 board/common_selinux/skeleton/etc/fstab            |   15 +
 board/common_selinux/skeleton/etc/inittab          |   29 +
 board/common_selinux/skeleton_permissions.txt      |   26 +
 board/qemu/x86/linux-4.0-selinux.config            |   77 ++
 board/qemu/x86/readme.txt                          |   17 +
 configs/qemu_x86_selinux_defconfig                 |   67 ++
 package/Config.in                                  |    9 +
 package/Config.in.host                             |    1 +
 package/audit/0001-Enable-cross-compiling.patch    |  773 ++++++++++++++
 .../0002-Make-zos-remote-plugin-optional.patch     |   56 ++
 ...03-Default-ADDR_NO_RANDOMIZE-if-not-found.patch |   44 +
 ...o-not-call-posix_fallocate-if-unavailable.patch |   47 +
 ...Fix-header-detection-when-cross-compiling.patch |   46 +
 package/audit/Config.in                            |   18 +
 package/audit/S01auditd                            |   99 ++
 package/audit/audit.hash                           |    2 +
 package/audit/audit.mk                             |   43 +
 ...s-Add-installation-of-individual-binaries.patch |  103 ++
 ...ags-strip-non-l-arguments-returned-by-pkg.patch |   28 +
 package/busybox/Config.in                          |   26 +
 package/busybox/busybox.mk                         |   58 ++
 package/cpio/0001-stdio.in.patch                   |   19 +
 package/cpio/0002-CVE-2014-9112.patch              |  218 ++++
 package/cpio/0003-testsuite-CVE-2014-9112.patch    |   36 +
 .../0004-check_for_symlinks-CVE-2015-1197.patch    |  158 +++
 package/cpio/0005-stat.patch                       |   31 +
 package/cpio/Config.in                             |    8 +
 package/cpio/Config.in.host                        |    6 +
 package/cpio/cpio.hash                             |    2 +
 package/cpio/cpio.mk                               |   21 +
 package/dbus/S30dbus                               |    4 +
 package/dbus/dbus.mk                               |   14 +
 package/libsemanage/Config.in                      |   10 -
 package/libsemanage/libsemanage.mk                 |   54 +-
 package/linux-pam/linux-pam.mk                     |   58 +-
 package/linux-pam/system-auth.pamd                 |   15 +
 package/mtd/mtd.mk                                 |   15 +-
 package/openssh/openssh.mk                         |   16 +
 .../policycoreutils/0001-cross-compile-fixes.patch |  332 ++++++
 package/policycoreutils/Config.in                  |   53 +
 package/policycoreutils/policycoreutils.hash       |    2 +
 package/policycoreutils/policycoreutils.mk         |  107 ++
 package/python-pyparsing/python-pyparsing.mk       |    1 +
 package/refpolicy-contrib/Config.in                |   19 +
 package/refpolicy-contrib/refpolicy-contrib.mk     |   18 +
 .../0001-Fix-awk-references-to-use-variable.patch  |   42 +
 package/refpolicy/Config.in                        |   91 ++
 package/refpolicy/S00selinux                       |  136 +++
 package/refpolicy/config                           |    8 +
 package/refpolicy/modules.conf                     |  406 ++++++++
 package/refpolicy/refpolicy.hash                   |    2 +
 package/refpolicy/refpolicy.mk                     |  117 +++
 package/rsyslog/rsyslog.mk                         |    4 +
 package/setools/0001-cross-compile-fixes.patch     |  125 +++
 package/setools/0002-move-python-check.patch       |   25 +
 package/setools/Config.in                          |   25 +
 package/setools/setools.hash                       |    4 +
 package/setools/setools.mk                         |   84 ++
 package/sqlite/sqlite.mk                           |    1 +
 package/squashfs/squashfs.mk                       |   12 +-
 ...1-Fix-SELinux-compile-flags-and-libraries.patch |   44 +
 package/sysvinit/sysvinit.mk                       |    5 +
 package/util-linux/util-linux.mk                   |   27 +
 package/vim/vim.mk                                 |    7 +
 68 files changed, 5040 insertions(+), 49 deletions(-)
 create mode 100644 board/common_selinux/busybox-selinux.config
 create mode 100755 board/common_selinux/post_build.sh
 create mode 100644 board/common_selinux/skeleton/etc/audit/auditd.conf
 create mode 100644 board/common_selinux/skeleton/etc/audit/rules.d/audit.rules
 create mode 100755 board/common_selinux/skeleton/etc/fstab
 create mode 100755 board/common_selinux/skeleton/etc/inittab
 create mode 100755 board/common_selinux/skeleton_permissions.txt
 create mode 100644 board/qemu/x86/linux-4.0-selinux.config
 create mode 100644 configs/qemu_x86_selinux_defconfig
 create mode 100644 package/audit/0001-Enable-cross-compiling.patch
 create mode 100644 package/audit/0002-Make-zos-remote-plugin-optional.patch
 create mode 100644 package/audit/0003-Default-ADDR_NO_RANDOMIZE-if-not-found.patch
 create mode 100644 package/audit/0004-Do-not-call-posix_fallocate-if-unavailable.patch
 create mode 100644 package/audit/0005-Fix-header-detection-when-cross-compiling.patch
 create mode 100644 package/audit/Config.in
 create mode 100644 package/audit/S01auditd
 create mode 100644 package/audit/audit.hash
 create mode 100644 package/audit/audit.mk
 create mode 100644 package/busybox/0002-applets-Add-installation-of-individual-binaries.patch
 create mode 100644 package/busybox/0008-Makefile.flags-strip-non-l-arguments-returned-by-pkg.patch
 create mode 100644 package/cpio/0001-stdio.in.patch
 create mode 100644 package/cpio/0002-CVE-2014-9112.patch
 create mode 100644 package/cpio/0003-testsuite-CVE-2014-9112.patch
 create mode 100644 package/cpio/0004-check_for_symlinks-CVE-2015-1197.patch
 create mode 100644 package/cpio/0005-stat.patch
 create mode 100644 package/cpio/Config.in
 create mode 100644 package/cpio/Config.in.host
 create mode 100644 package/cpio/cpio.hash
 create mode 100644 package/cpio/cpio.mk
 mode change 100755 => 100644 package/dbus/S30dbus
 create mode 100644 package/linux-pam/system-auth.pamd
 create mode 100644 package/policycoreutils/0001-cross-compile-fixes.patch
 create mode 100644 package/policycoreutils/Config.in
 create mode 100644 package/policycoreutils/policycoreutils.hash
 create mode 100644 package/policycoreutils/policycoreutils.mk
 create mode 100644 package/refpolicy-contrib/Config.in
 create mode 100644 package/refpolicy-contrib/refpolicy-contrib.mk
 create mode 100644 package/refpolicy/2.20130424/0001-Fix-awk-references-to-use-variable.patch
 create mode 100644 package/refpolicy/Config.in
 create mode 100644 package/refpolicy/S00selinux
 create mode 100644 package/refpolicy/config
 create mode 100644 package/refpolicy/modules.conf
 create mode 100644 package/refpolicy/refpolicy.hash
 create mode 100644 package/refpolicy/refpolicy.mk
 create mode 100644 package/setools/0001-cross-compile-fixes.patch
 create mode 100644 package/setools/0002-move-python-check.patch
 create mode 100644 package/setools/Config.in
 create mode 100644 package/setools/setools.hash
 create mode 100644 package/setools/setools.mk
 create mode 100644 package/sysvinit/0001-Fix-SELinux-compile-flags-and-libraries.patch

-- 
1.9.1



More information about the buildroot mailing list