domenico/openwrt_NSS_ACW
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

procd: add selinux variant

Browse Source 
This commit adds a `selinux` variant to `procd` allowing to load an
SELinux policy at boot.

Signed-off-by: Paul Spooren <mail@aparcar.org>
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
This commit is contained in:
Paul Spooren
2020-08-11 18:49:44 -10:00
committed by Daniel Golle
parent a0df664531
commit 962e73c1a4
1 changed files with 31 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
package/system/procd/Makefile
View File

@@ -41,18 +41,34 @@ TARGET_LDFLAGS += $(if $(CONFIG_USE_GLIBC),-lrt)
TARGET_CFLAGS += -flto TARGET_CFLAGS += -flto
TARGET_LDFLAGS += -flto TARGET_LDFLAGS += -flto
define Package/procd define Package/procd/Default
SECTION:=base SECTION:=base
CATEGORY:=Base system CATEGORY:=Base system
DEPENDS:=+ubusd +ubus +libjson-script +ubox +USE_GLIBC:librt +libubox +libubus +libblobmsg-json +libjson-c +PACKAGE_libselinux:libselinux DEPENDS:=+ubusd +ubus +libjson-script +ubox +USE_GLIBC:librt +libubox \
+libubus +libblobmsg-json +libjson-c
TITLE:=OpenWrt system process manager TITLE:=OpenWrt system process manager
USERID:=:dialout=20 :audio=29 USERID:=:dialout=20 :audio=29
endef endef
define Package/procd
$(call Package/procd/Default)
VARIANT:=default
CONFLICTS:=procd-selinux
endef
define Package/procd-selinux
$(call Package/procd/Default)
DEPENDS += +libselinux
TITLE += with SELinux support
PROVIDES:=procd
VARIANT:=selinux
endef
define Package/procd-ujail define Package/procd-ujail
SECTION:=base SECTION:=base
CATEGORY:=Base system CATEGORY:=Base system
DEPENDS:=@KERNEL_NAMESPACES +@KERNEL_UTS_NS +@KERNEL_IPC_NS +@KERNEL_PID_NS +libubox +libubus +libblobmsg-json DEPENDS:=@KERNEL_NAMESPACES +@KERNEL_UTS_NS +@KERNEL_IPC_NS +@KERNEL_PID_NS \
+libubox +libubus +libblobmsg-json
TITLE:=OpenWrt process jail helper TITLE:=OpenWrt process jail helper
endef endef
@@ -66,7 +82,8 @@ endef
define Package/procd-seccomp define Package/procd-seccomp
SECTION:=base SECTION:=base
CATEGORY:=Base system CATEGORY:=Base system
DEPENDS:=@(arm||armeb||mips||mipsel||i386||powerpc||x86_64) @!TARGET_uml @KERNEL_SECCOMP +libubox +libblobmsg-json DEPENDS:=@(arm||armeb||mips||mipsel||i386||powerpc||x86_64) @!TARGET_uml \
@KERNEL_SECCOMP +libubox +libblobmsg-json
TITLE:=OpenWrt process seccomp helper + utrace TITLE:=OpenWrt process seccomp helper + utrace
endef endef
@@ -80,7 +97,7 @@ endef
define Package/procd/config define Package/procd/config
menu "Configuration" menu "Configuration"
depends on PACKAGE_procd depends on PACKAGE_procd || PACKAGE_procd-selinux
config PROCD_SHOW_BOOT config PROCD_SHOW_BOOT
bool bool
@@ -94,6 +111,11 @@ config PROCD_ZRAM_TMPFS
endmenu endmenu
endef endef
Package/procd-selinux/config = $(Package/procd/config)
ifeq ($(BUILD_VARIANT),selinux)
CMAKE_OPTIONS += -DSELINUX=1
endif
ifeq ($(CONFIG_PROCD_SHOW_BOOT),y) ifeq ($(CONFIG_PROCD_SHOW_BOOT),y)
CMAKE_OPTIONS += -DSHOW_BOOT_ON_CONSOLE=1 CMAKE_OPTIONS += -DSHOW_BOOT_ON_CONSOLE=1
@@ -108,8 +130,7 @@ ifdef CONFIG_PACKAGE_procd-ujail
endif endif
SECCOMP=$(if $(CONFIG_PACKAGE_procd-seccomp),1,0) SECCOMP=$(if $(CONFIG_PACKAGE_procd-seccomp),1,0)
SELINUX=$(if $(CONFIG_PACKAGE_libselinux),1,0) CMAKE_OPTIONS += -DSECCOMP_SUPPORT=$(SECCOMP) -DUTRACE_SUPPORT=$(SECCOMP)
CMAKE_OPTIONS += -DSECCOMP_SUPPORT=$(SECCOMP) -DUTRACE_SUPPORT=$(SECCOMP) -DSELINUX=$(SELINUX)
define Package/procd/install define Package/procd/install
$(INSTALL_DIR) $(1)/sbin $(1)/etc $(1)/lib/functions $(INSTALL_DIR) $(1)/sbin $(1)/etc $(1)/lib/functions
@@ -121,6 +142,8 @@ define Package/procd/install
$(INSTALL_DATA) ./files/procd.sh $(1)/lib/functions/ $(INSTALL_DATA) ./files/procd.sh $(1)/lib/functions/
endef endef
Package/procd-selinux/install = $(Package/procd/install)
define Package/procd-ujail/install define Package/procd-ujail/install
$(INSTALL_DIR) $(1)/sbin $(INSTALL_DIR) $(1)/sbin
$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/ujail $(1)/sbin/ $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/ujail $(1)/sbin/
@@ -151,6 +174,7 @@ define Package/uxc/install
endef endef
$(eval $(call BuildPackage,procd)) $(eval $(call BuildPackage,procd))
$(eval $(call BuildPackage,procd-selinux))
$(eval $(call BuildPackage,procd-ujail)) $(eval $(call BuildPackage,procd-ujail))
$(eval $(call BuildPackage,procd-ujail-console)) $(eval $(call BuildPackage,procd-ujail-console))
$(eval $(call BuildPackage,procd-seccomp)) $(eval $(call BuildPackage,procd-seccomp))