mirror of
https://git.yoctoproject.org/meta-security
synced 2026-05-31 12:50:19 +00:00
apparmor: update to 3.0
skip ptest for now, on todo list for fix. Runtime test pass remove patch now included in update: 0001-regression-tests-Don-t-build-syscall_sysctl-if-missi.patch Signed-off-by: Armin Kuster <akuster808@gmail.com>
This commit is contained in:
Armin Kuster
committed by
Armin Kuster
Armin Kuster
parent
21489a2942
commit
b8c437bf70
+91
@@ -0,0 +1,91 @@
|
||||
From 5ed21abbef4d4c2983e70bd2868fb817150e883e Mon Sep 17 00:00:00 2001
|
||||
From: Armin Kuster <akuster808@gmail.com>
|
||||
Date: Sat, 3 Oct 2020 11:26:46 -0700
|
||||
Subject: [PATCH] Revert "profiles: Update 'make check' to select tools based
|
||||
on USE_SYSTEM"
|
||||
|
||||
This reverts commit 6016f931ebf7b61e1358f19453ef262d9d184a4e.
|
||||
|
||||
Upstream-Statue: OE specific
|
||||
These changes cause during packaging with perms changing.
|
||||
|
||||
Signed-off-by: Armin Kuster <akuster808@gmail.com>
|
||||
|
||||
---
|
||||
profiles/Makefile | 50 ++++++++++-------------------------------------
|
||||
1 file changed, 10 insertions(+), 40 deletions(-)
|
||||
|
||||
diff --git a/profiles/Makefile b/profiles/Makefile
|
||||
index ba47fc16..5384cb05 100644
|
||||
--- a/profiles/Makefile
|
||||
+++ b/profiles/Makefile
|
||||
@@ -35,49 +35,9 @@ EXTRAS_SOURCE=./apparmor/profiles/extras/
|
||||
SUBDIRS=$(shell find ${PROFILES_SOURCE} -type d -print)
|
||||
TOPLEVEL_PROFILES=$(filter-out ${SUBDIRS}, $(wildcard ${PROFILES_SOURCE}/*))
|
||||
|
||||
-ifdef USE_SYSTEM
|
||||
- PYTHONPATH=
|
||||
- PARSER?=apparmor_parser
|
||||
- LOGPROF?=aa-logprof
|
||||
-else
|
||||
- # PYTHON_DIST_BUILD_PATH based on libapparmor/swig/python/test/Makefile.am
|
||||
- PYTHON_DIST_BUILD_PATH = ../libraries/libapparmor/swig/python/build/$$($(PYTHON) -c "import distutils.util; import platform; print(\"lib.%s-%s\" %(distutils.util.get_platform(), platform.python_version()[:3]))")
|
||||
- LIBAPPARMOR_PATH=../libraries/libapparmor/src/.libs/
|
||||
- LD_LIBRARY_PATH=$(LIBAPPARMOR_PATH):$(PYTHON_DIST_BUILD_PATH)
|
||||
- PYTHONPATH=../utils/:$(PYTHON_DIST_BUILD_PATH)
|
||||
- PARSER?=../parser/apparmor_parser
|
||||
- # use ../utils logprof
|
||||
- LOGPROF?=LD_LIBRARY_PATH=$(LD_LIBRARY_PATH) PYTHONPATH=$(PYTHONPATH) $(PYTHON) ../utils/aa-logprof
|
||||
-endif
|
||||
-
|
||||
# $(PWD) is wrong when using "make -C profiles" - explicitely set it here to get the right value
|
||||
PWD=$(shell pwd)
|
||||
|
||||
-.PHONY: test-dependencies
|
||||
-test-dependencies: __parser __libapparmor
|
||||
-
|
||||
-
|
||||
-.PHONY: __parser __libapparmor
|
||||
-__parser:
|
||||
-ifndef USE_SYSTEM
|
||||
- @if [ ! -f $(PARSER) ]; then \
|
||||
- echo "error: $(PARSER) is missing. Pick one of these possible solutions:" 1>&2; \
|
||||
- echo " 1) Test using the in-tree parser by building it first and then trying again. See the top-level README for help." 1>&2; \
|
||||
- echo " 2) Test using the system parser by adding USE_SYSTEM=1 to your make command." 1>&2; \
|
||||
- exit 1; \
|
||||
- fi
|
||||
-endif
|
||||
-
|
||||
-__libapparmor:
|
||||
-ifndef USE_SYSTEM
|
||||
- @if [ ! -f $(LIBAPPARMOR_PATH)libapparmor.so ]; then \
|
||||
- echo "error: $(LIBAPPARMOR_PATH)libapparmor.so is missing. Pick one of these possible solutions:" 1>&2; \
|
||||
- echo " 1) Build against the in-tree libapparmor by building it first and then trying again. See the top-level README for help." 1>&2; \
|
||||
- echo " 2) Build against the system libapparmor by adding USE_SYSTEM=1 to your make command." 1>&2; \
|
||||
- exit 1; \
|
||||
- fi
|
||||
-endif
|
||||
-
|
||||
local:
|
||||
for profile in ${TOPLEVEL_PROFILES}; do \
|
||||
fn=$$(basename $$profile); \
|
||||
@@ -109,6 +69,16 @@ else
|
||||
Q=
|
||||
endif
|
||||
|
||||
+ifndef PARSER
|
||||
+# use system parser
|
||||
+PARSER=../parser/apparmor_parser
|
||||
+endif
|
||||
+
|
||||
+ifndef LOGPROF
|
||||
+# use ../utils logprof
|
||||
+LOGPROF=PYTHONPATH=../utils $(PYTHON) ../utils/aa-logprof
|
||||
+endif
|
||||
+
|
||||
.PHONY: docs
|
||||
# docs: should we have some here?
|
||||
docs:
|
||||
--
|
||||
2.17.1
|
||||
|
||||
@@ -0,0 +1,43 @@
|
||||
From c9baef0c70122e1be33b627874772e6e9a5d7744 Mon Sep 17 00:00:00 2001
|
||||
From: Armin Kuster <akuster808@gmail.com>
|
||||
Date: Fri, 2 Oct 2020 19:43:44 -0700
|
||||
Subject: [PATCH] apparmor: fix manpage order
|
||||
|
||||
It trys to create a symlink before the man pages are installed.
|
||||
|
||||
ln -sf aa-status.8 /(path}/apparmor/3.0-r0/image/usr/share/man/man8/apparmor_status.8
|
||||
| ln: failed to create symbolic link '{path}/apparmor/3.0-r0/image/usr/share/man/man8/apparmor_status.8': No such file or directory
|
||||
|
||||
Upstream-Status: Pending
|
||||
Signed-off-by: Armin Kuster <akuster808@gmail.com>
|
||||
|
||||
...
|
||||
|
||||
install -d /{path}/apparmor/3.0-r0/image/usr/share/man/man8 ; install -m 644 aa-status.8 /{path}/apparmor/3.0-r0/image/usr/share/man/man8;
|
||||
|
||||
Signed-off-by: Armin Kuster <akuster@mvista.com>
|
||||
---
|
||||
binutils/Makefile | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/binutils/Makefile b/binutils/Makefile
|
||||
index 99e54875..3f1d0011 100644
|
||||
--- a/binutils/Makefile
|
||||
+++ b/binutils/Makefile
|
||||
@@ -156,12 +156,12 @@ install-arch: arch
|
||||
install -m 755 -d ${SBINDIR}
|
||||
ln -sf aa-status ${SBINDIR}/apparmor_status
|
||||
install -m 755 ${SBINTOOLS} ${SBINDIR}
|
||||
- ln -sf aa-status.8 ${DESTDIR}/${MANDIR}/man8/apparmor_status.8
|
||||
|
||||
.PHONY: install-indep
|
||||
install-indep: indep
|
||||
$(MAKE) -C po install NAME=${NAME} DESTDIR=${DESTDIR}
|
||||
$(MAKE) install_manpages DESTDIR=${DESTDIR}
|
||||
+ ln -sf aa-status.8 ${DESTDIR}/${MANDIR}/man8/apparmor_status.8
|
||||
|
||||
ifndef VERBOSE
|
||||
.SILENT: clean
|
||||
--
|
||||
2.17.1
|
||||
|
||||
-96
@@ -1,96 +0,0 @@
|
||||
From 7a7c7fb346ded6f017c8df44486778a5f032d41a Mon Sep 17 00:00:00 2001
|
||||
From: John Johansen <john.johansen@canonical.com>
|
||||
Date: Tue, 29 Sep 2020 03:05:22 -0700
|
||||
Subject: [PATCH] regression tests: Don't build syscall_sysctl if missing
|
||||
kernel headers
|
||||
|
||||
sys/sysctl.h is not guaranteed to exist anymore since
|
||||
https://sourceware.org/pipermail/glibc-cvs/2020q2/069366.html
|
||||
|
||||
which is a follow on to the kernel commit
|
||||
61a47c1ad3a4 sysctl: Remove the sysctl system call
|
||||
|
||||
While the syscall_sysctl currently checks if the kernel supports
|
||||
sysctrs before running the tests. The tests can't even build if the
|
||||
kernel headers don't have the sysctl defines.
|
||||
|
||||
Fixes: https://gitlab.com/apparmor/apparmor/-/issues/119
|
||||
Fixes: https://bugs.launchpad.net/apparmor/+bug/1897288
|
||||
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/637
|
||||
Signed-off-by: John Johansen <john.johansen@canonical.com>
|
||||
Acked-by: Steve Beattie <steve.beattie@canonical.com>
|
||||
(cherry picked from commit 2e5a266eb715fc7e526520235a6450444775791f)
|
||||
|
||||
Upstream-Status: Backport
|
||||
Signed-off-by: Armin Kuster <akuster808@gmail.com>
|
||||
|
||||
---
|
||||
tests/regression/apparmor/Makefile | 10 +++++++++-
|
||||
tests/regression/apparmor/syscall_sysctl.sh | 15 +++++++++++----
|
||||
2 files changed, 20 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/tests/regression/apparmor/Makefile b/tests/regression/apparmor/Makefile
|
||||
index 198ca421..c3d0cfb7 100644
|
||||
--- a/tests/regression/apparmor/Makefile
|
||||
+++ b/tests/regression/apparmor/Makefile
|
||||
@@ -69,6 +69,9 @@ endif # USE_SYSTEM
|
||||
|
||||
CFLAGS += -g -O0 -Wall -Wstrict-prototypes
|
||||
|
||||
+USE_SYSCTL:=$(shell echo "#include <sys/sysctl.h>" | cpp -dM >/dev/null 2>/dev/null && echo true)
|
||||
+
|
||||
+
|
||||
SRC=access.c \
|
||||
at_secure.c \
|
||||
introspect.c \
|
||||
@@ -130,7 +133,6 @@ SRC=access.c \
|
||||
syscall_sethostname.c \
|
||||
syscall_setdomainname.c \
|
||||
syscall_setscheduler.c \
|
||||
- syscall_sysctl.c \
|
||||
sysctl_proc.c \
|
||||
tcp.c \
|
||||
transition.c \
|
||||
@@ -146,6 +148,12 @@ ifneq (,$(findstring $(shell uname -i),i386 i486 i586 i686 x86 x86_64))
|
||||
SRC+=syscall_ioperm.c syscall_iopl.c
|
||||
endif
|
||||
|
||||
+#only do sysctl syscall test if defines installed and OR supported by the
|
||||
+# kernel
|
||||
+ifeq ($(USE_SYSCTL),true)
|
||||
+SRC+=syscall_sysctl.c
|
||||
+endif
|
||||
+
|
||||
#only do dbus if proper libs are installl
|
||||
ifneq (,$(shell pkg-config --exists dbus-1 && echo TRUE))
|
||||
SRC+=dbus_eavesdrop.c dbus_message.c dbus_service.c dbus_unrequested_reply.c
|
||||
diff --git a/tests/regression/apparmor/syscall_sysctl.sh b/tests/regression/apparmor/syscall_sysctl.sh
|
||||
index f93946f3..5f856984 100644
|
||||
--- a/tests/regression/apparmor/syscall_sysctl.sh
|
||||
+++ b/tests/regression/apparmor/syscall_sysctl.sh
|
||||
@@ -148,11 +148,18 @@ test_sysctl_proc()
|
||||
# check if the kernel supports CONFIG_SYSCTL_SYSCALL
|
||||
# generally we want to encourage kernels to disable it, but if it's
|
||||
# enabled we want to test against it
|
||||
-settest syscall_sysctl
|
||||
-if ! res="$(${test} ro 2>&1)" && [ "$res" = "FAIL: sysctl read failed - Function not implemented" ] ; then
|
||||
- echo " WARNING: syscall sysctl not implemented, skipping tests ..."
|
||||
+# In addition test that sysctl exists in the kernel headers, if it does't
|
||||
+# then we can't even built the syscall_sysctl test
|
||||
+if echo "#include <sys/sysctl.h>" | cpp -dM >/dev/null 2>/dev/null ; then
|
||||
+ settest syscall_sysctl
|
||||
+
|
||||
+ if ! res="$(${test} ro 2>&1)" && [ "$res" = "FAIL: sysctl read failed - Function not implemented" ] ; then
|
||||
+ echo " WARNING: syscall sysctl not implemented, skipping tests ..."
|
||||
+ else
|
||||
+ test_syscall_sysctl
|
||||
+ fi
|
||||
else
|
||||
- test_syscall_sysctl
|
||||
+ echo " WARNING: syscall sysctl not supported by kernel headers, skipping tests ..."
|
||||
fi
|
||||
|
||||
# now test /proc/sys/ paths
|
||||
--
|
||||
2.17.1
|
||||
|
||||
@@ -144,7 +144,7 @@ clear_cache_var() {
|
||||
|
||||
read_features_dir()
|
||||
{
|
||||
for f in `ls -AU "$1"` ; do
|
||||
for f in `ls -A "$1"` ; do
|
||||
if [ -f "$1/$f" ] ; then
|
||||
read -r KF < "$1/$f" || true
|
||||
echo -n "$f {$KF } "
|
||||
|
||||
Reference in New Issue
Block a user