mirror of
https://git.yoctoproject.org/meta-security
synced 2026-05-31 12:50:19 +00:00
Li Zhou
a289f22878
Because "x86_64" and "arm64" aren't valid in bitbake OVERRIDES,
they should be corrected to "x86-64" and "aarch64".
On the other side, "x86_64" and "arch64" aren't valid MACHINE
name.
So correct the way to "only allow x86-64 and arm64 to build":
COMPATIBLE_MACHINE = "(-)" => disallow all machine first
COMPATIBLE_MACHINE:aarch64 = "(.*)" => when arch "aarch64" in
OVERRIDES, allow all machines.
COMPATIBLE_MACHINE:x86-64 = "(.*)" => when arch "x84-64" in
OVERRIDES, allow all machines.
Fix 1dd076d3a7 ("firejail: only allow x86-64 and arm64 to build")
Signed-off-by: Li Zhou <li.zhou@windriver.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
65 lines
2.6 KiB
BlitzBasic
65 lines
2.6 KiB
BlitzBasic
#
|
|
# Copyright 2022 Armin Kuster <akuster808@gmail.com>
|
|
#
|
|
SUMMARY = "Linux namespaces and seccomp-bpf sandbox"
|
|
DESCRIPTION = "Firejail is a SUID sandbox program that reduces the risk of security breaches \
|
|
by restricting the running environment of untrusted applications using Linux namespaces, \
|
|
seccomp-bpf and Linux capabilities."
|
|
|
|
LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263"
|
|
LICENSE = "GPL-2.0-only"
|
|
|
|
SRCREV = "2551bc71f14052344666f3ca2ad67f5b798020b9"
|
|
SRC_URI = "git://github.com/netblue30/firejail.git;protocol=https;branch=master \
|
|
file://exclude_seccomp_util_compiles.patch \
|
|
"
|
|
|
|
DEPENDS = "libseccomp"
|
|
|
|
inherit autotools-brokensep pkgconfig bash-completion features_check
|
|
|
|
REQUIRED_DISTRO_FEATURES = "seccomp"
|
|
|
|
PACKAGECONFIG ?= ""
|
|
PACKAGECONFIG += "${@bb.utils.contains('DISTRO_FEATURES', 'apparmor', 'apparmor', '', d)}"
|
|
PACKAGECONFIG += "${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'selinux', '', d)}"
|
|
PACKAGECONFIG += "${@bb.utils.contains('DISTRO_FEATURES', 'x11', 'x11', '', d)}"
|
|
|
|
PACKAGECONFIG[apparmor] = "--enable-apparmor, --disable-apparmor, apparmor, apparmor"
|
|
PACKAGECONFIG[selinux] = "--enable-selinux, --disable-selinux, libselinux"
|
|
PACKAGECONFIG[x11] = " --enable-x11, --disable-x11, "
|
|
PACKAGECONFIG[dbusproxy] = ", --disable-dbusproxy, "
|
|
PACKAGECONFIG[notmpfs] = ", --disable-usertmpfs ,"
|
|
PACKAGECONFIG[nofiretunnel] = ", --disable-firetunnel , "
|
|
PACKAGECONFIG[noprivatehome] = ", --disable-private-home, "
|
|
PACKAGECONFIG[nochroot] = ", --disable-chroot, "
|
|
PACKAGECONFIG[nonetwork] = ", --disable-network, "
|
|
PACKAGECONFIG[nouserns] = ", --disable-userns, "
|
|
PACKAGECONFIG[nofiletransfer] = ", --disable-file-transfer, "
|
|
PACKAGECONFIG[nosuid] = ", --disable-suid, "
|
|
|
|
EXTRA_OECONF = "--disable-man --enable-busybox-workaround"
|
|
|
|
PACKAGES:append = " ${PN}-vim ${PN}-zsh"
|
|
|
|
FILES:${PN}-vim = "${datadir}/vim/"
|
|
FILES:${PN}-zsh = "${datadir}/zsh/"
|
|
FILES:${PN}-dev = "${datadir}/gtksourceview-5/"
|
|
|
|
pkg_postinst_ontarget:${PN} () {
|
|
${libdir}/${BPN}/fseccomp default ${libdir}/${BPN}/seccomp
|
|
${libdir}/${BPN}/fsec-optimize ${libdir}/${BPN}/seccomp
|
|
${libdir}/${BPN}/fseccomp default ${libdir}/${BPN}/seccomp.debug allow-debuggers
|
|
${libdir}/${BPN}/fsec-optimize ${libdir}/${BPN}/seccomp.debug
|
|
${libdir}/${BPN}/fseccomp secondary 32 ${libdir}/${BPN}/seccomp.32
|
|
${libdir}/${BPN}/fsec-optimize ${libdir}/${BPN}/seccomp.32
|
|
${libdir}/${BPN}/fseccomp secondary block ${libdir}/${BPN}/seccomp.block_secondary
|
|
${libdir}/${BPN}/fseccomp memory-deny-write-execute ${libdir}/${BPN}/seccomp.mdwx
|
|
}
|
|
|
|
COMPATIBLE_MACHINE = "(-)"
|
|
COMPATIBLE_MACHINE:aarch64 = "(.*)"
|
|
COMPATIBLE_MACHINE:x86-64 = "(.*)"
|
|
|
|
RDEPENDS:${PN} = "bash"
|