mirrors/meta-security
1
0
Fork 0
mirror of https://git.yoctoproject.org/meta-security synced 2026-06-02 01:20:29 +00:00
Code Issues Projects Releases Wiki Activity

apparmor: Additional runtime fixes

Browse Source 
- We need various python3 modules and we can only really solve this
  problem by including all python3-modules.
- aa-easyprof needs to have its shebang corrected, do so.
- The apparmor initscript depends on functions that LSB does not require
  so we must provide them.  In some cases it's using non-standard
  function, so we just use more appropriate names.
- The apparmor sysvinit-style initscript assumes that
  systemd-detect-virt will exist on the filesystem.  Change this to
  check that it does before trying to execute it.

[for aa-easyprof:]
Reported-by: Anders Montonen <Anders.Montonen@iki.fi>
Signed-off-by: Tom Rini <trini@konsulko.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>

Signed-off-by: Armin Kuster <akuster808@gmail.com>
This commit is contained in:
Tom Rini
2017-07-11 08:36:29 -04:00
committed by Armin Kuster
parent aae40f506a
commit 25b8f02eea
2 changed files with 28 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
recipes-security/AppArmor/apparmor_2.11.0.bb
+5 -1
View File
@@ -79,6 +79,10 @@ do_install () {
oe_runmake -C ${B}/changehat/pam_apparmor DESTDIR="${D}" install
fi
# aa-easyprof is installed by python-tools-setup.py, fix it up
sed -i -e 's:/usr/bin/env.*:/usr/bin/python3:' ${D}${bindir}/aa-easyprof
chmod 0755 ${D}${bindir}/aa-easyprof
install ${WORKDIR}/apparmor ${D}/${INIT_D_DIR}/apparmor
install ${WORKDIR}/functions ${D}/lib/apparmor
}
@@ -124,6 +128,6 @@ FILES_${PN} += "/lib/apparmor/ ${sysconfdir}/apparmor ${PYTHON_SITEPACKAGES_DIR}
FILES_mod-${PN} = "${libdir}/apache2/modules/*"
RDEPENDS_${PN} += "bash lsb"
RDEPENDS_${PN} += "${@bb.utils.contains('PACKAGECONFIG','python','python3 python3-argparse python3-json','', d)}"
RDEPENDS_${PN} += "${@bb.utils.contains('PACKAGECONFIG','python','python3 python3-modules','', d)}"
RDEPENDS_${PN}_remove += "${@bb.utils.contains('PACKAGECONFIG','perl','','perl', d)}"
RDEPENDS_${PN}-ptest += "coreutils dbus-lib"
recipes-security/AppArmor/files/apparmor
+23 -7
View File
@@ -32,6 +32,20 @@
# Description: AppArmor init script. This script loads all AppArmor profiles.
### END INIT INFO
log_daemon_msg() {
echo $*
}
log_end_msg () {
retval=$1
if [ $retval -eq 0 ]; then
echo "."
else
echo " failed!"
fi
return $retval
}
. /lib/apparmor/functions
. /lib/lsb/init-functions
@@ -47,20 +61,19 @@ securityfs() {
# Need securityfs for any mode
if [ ! -d "${AA_SFS}" ]; then
if cut -d" " -f2,3 /proc/mounts | grep -q "^${SECURITYFS} securityfs"'$' ; then
log_action_msg "AppArmor not available as kernel LSM."
log_daemon_msg "AppArmor not available as kernel LSM."
log_end_msg 1
exit 1
else
log_action_begin_msg "Mounting securityfs on ${SECURITYFS}"
log_daemon_msg "Mounting securityfs on ${SECURITYFS}"
if ! mount -t securityfs none "${SECURITYFS}"; then
log_action_end_msg 1
log_end_msg 1
exit 1
fi
fi
fi
if [ ! -w "$AA_SFS"/.load ]; then
log_action_msg "Insufficient privileges to change profiles."
log_daemon_msg "Insufficient privileges to change profiles."
log_end_msg 1
exit 1
fi
@@ -127,7 +140,8 @@ test -d /rofs/etc/apparmor.d && exit 0
rc=255
case "$1" in
start)
if systemd-detect-virt --quiet --container && \
if test -x /sbin/systemd-detect-virt && \
systemd-detect-virt --quiet --container && \
! is_container_with_internal_policy; then
log_daemon_msg "Not starting AppArmor in container"
log_end_msg 0
@@ -161,7 +175,8 @@ with the 'teardown' option."
EOM
;;
teardown)
if systemd-detect-virt --quiet --container && \
if test -x /sbin/systemd-detect-virt && \
systemd-detect-virt --quiet --container && \
! is_container_with_internal_policy; then
log_daemon_msg "Not tearing down AppArmor in container"
log_end_msg 0
@@ -179,7 +194,8 @@ EOM
log_end_msg $rc
;;
restart|reload|force-reload)
if systemd-detect-virt --quiet --container && \
if test -x /sbin/systemd-detect-virt && \
systemd-detect-virt --quiet --container && \
! is_container_with_internal_policy; then
log_daemon_msg "Not reloading AppArmor in container"
log_end_msg 0