Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/495242/?format=api
{ "id": 495242, "url": "http://patchwork.ozlabs.org/api/patches/495242/?format=api", "web_url": "http://patchwork.ozlabs.org/project/buildroot/patch/1436905227-26937-14-git-send-email-clayton.shotwell@rockwellcollins.com/", "project": { "id": 27, "url": "http://patchwork.ozlabs.org/api/projects/27/?format=api", "name": "Buildroot development", "link_name": "buildroot", "list_id": "buildroot.buildroot.org", "list_email": "buildroot@buildroot.org", "web_url": "", "scm_url": "", "webscm_url": "", "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<1436905227-26937-14-git-send-email-clayton.shotwell@rockwellcollins.com>", "list_archive_url": null, "date": "2015-07-14T20:20:25", "name": "[v9,13/15] qemu x86 selinux: base br defconfig", "commit_ref": null, "pull_url": null, "state": "superseded", "archived": false, "hash": "872e5df96578c42a010736d8fa8d76454c87af76", "submitter": { "id": 64481, "url": "http://patchwork.ozlabs.org/api/people/64481/?format=api", "name": "Clayton Shotwell", "email": "clayton.shotwell@rockwellcollins.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/buildroot/patch/1436905227-26937-14-git-send-email-clayton.shotwell@rockwellcollins.com/mbox/", "series": [], "comments": "http://patchwork.ozlabs.org/api/patches/495242/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/495242/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<buildroot-bounces@busybox.net>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "buildroot@lists.busybox.net" ], "Delivered-To": [ "patchwork-incoming@bilbo.ozlabs.org", "buildroot@osuosl.org" ], "Received": [ "from fraxinus.osuosl.org (smtp4.osuosl.org [140.211.166.137])\n\tby ozlabs.org (Postfix) with ESMTP id 652A5140772\n\tfor <incoming@patchwork.ozlabs.org>;\n\tWed, 15 Jul 2015 06:21:37 +1000 (AEST)", "from localhost (localhost [127.0.0.1])\n\tby fraxinus.osuosl.org (Postfix) with ESMTP id AF4BAA42F8;\n\tTue, 14 Jul 2015 20:21:36 +0000 (UTC)", "from fraxinus.osuosl.org ([127.0.0.1])\n\tby localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024)\n\twith ESMTP id ognMKGuA96Jn; Tue, 14 Jul 2015 20:21:34 +0000 (UTC)", "from ash.osuosl.org (ash.osuosl.org [140.211.166.34])\n\tby fraxinus.osuosl.org (Postfix) with ESMTP id 3BB8FA4390;\n\tTue, 14 Jul 2015 20:21:06 +0000 (UTC)", "from silver.osuosl.org (smtp3.osuosl.org [140.211.166.136])\n\tby ash.osuosl.org (Postfix) with ESMTP id 101771C1FCC\n\tfor <buildroot@lists.busybox.net>;\n\tTue, 14 Jul 2015 20:20:59 +0000 (UTC)", "from localhost (localhost [127.0.0.1])\n\tby silver.osuosl.org (Postfix) with ESMTP id F23BC26461\n\tfor <buildroot@lists.busybox.net>;\n\tTue, 14 Jul 2015 20:20:58 +0000 (UTC)", "from silver.osuosl.org ([127.0.0.1])\n\tby localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024)\n\twith ESMTP id LrV8hJJnPNM0 for <buildroot@lists.busybox.net>;\n\tTue, 14 Jul 2015 20:20:58 +0000 (UTC)", "from da1vs02.rockwellcollins.com (da1vs02.rockwellcollins.com\n\t[205.175.227.29])\n\tby silver.osuosl.org (Postfix) with ESMTPS id 0BFD7260EF\n\tfor <buildroot@buildroot.org>; Tue, 14 Jul 2015 20:20:57 +0000 (UTC)", "from ofwda1n02.rockwellcollins.com (HELO\n\tcrulimr02.rockwellcollins.com) ([205.175.227.14])\n\tby da1vs02.rockwellcollins.com with ESMTP; 14 Jul 2015 15:20:57 -0500" ], "X-Virus-Scanned": [ "amavisd-new at osuosl.org", "amavisd-new at osuosl.org" ], "X-Greylist": "domain auto-whitelisted by SQLgrey-1.7.6", "X-Received": "from thehammer.rockwellcollins.com (unknown [192.168.141.197])\n\tby crulimr02.rockwellcollins.com (Postfix) with ESMTP id 023D560150; \n\tTue, 14 Jul 2015 15:20:57 -0500 (CDT)", "From": "Clayton Shotwell <clayton.shotwell@rockwellcollins.com>", "To": "buildroot@buildroot.org", "Date": "Tue, 14 Jul 2015 15:20:25 -0500", "Message-Id": "<1436905227-26937-14-git-send-email-clayton.shotwell@rockwellcollins.com>", "X-Mailer": "git-send-email 1.9.1", "In-Reply-To": "<1436905227-26937-1-git-send-email-clayton.shotwell@rockwellcollins.com>", "References": "<1436905227-26937-1-git-send-email-clayton.shotwell@rockwellcollins.com>", "Cc": "Clayton Shotwell <clayton.shotwell@rockwellcollins.com>", "Subject": "[Buildroot] [PATCH v9 13/15] qemu x86 selinux: base br defconfig", "X-BeenThere": "buildroot@busybox.net", "X-Mailman-Version": "2.1.18-1", "Precedence": "list", "List-Id": "Discussion and development of buildroot <buildroot.busybox.net>", "List-Unsubscribe": "<http://lists.busybox.net/mailman/options/buildroot>,\n\t<mailto:buildroot-request@busybox.net?subject=unsubscribe>", "List-Archive": "<http://lists.busybox.net/pipermail/buildroot/>", "List-Post": "<mailto:buildroot@busybox.net>", "List-Help": "<mailto:buildroot-request@busybox.net?subject=help>", "List-Subscribe": "<http://lists.busybox.net/mailman/listinfo/buildroot>,\n\t<mailto:buildroot-request@busybox.net?subject=subscribe>", "MIME-Version": "1.0", "Content-Type": "text/plain; charset=\"us-ascii\"", "Content-Transfer-Encoding": "7bit", "Errors-To": "buildroot-bounces@busybox.net", "Sender": "\"buildroot\" <buildroot-bounces@busybox.net>" }, "content": "This will build a base SELinux system that boots with SELinux\nin permissive mode. Also adding documentation on how to use it.\n\nSigned-off-by: Clayton Shotwell <clayton.shotwell@rockwellcollins.com>\nSigned-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>\n\n---\nChanges v8 -> v9:\n - No changes\n\nChanges v7 -> v8:\n - No changes\n\nChanges v6 -> v7:\n - No changes\n\nChanges v5 -> v6:\n - No changes\n\nChanges v4 -> v5:\n - Update the qemu_x86_defconfig to the 4.0 kernel series (Clayton S.)\n\nChanges v1 -> v4:\n - Did not exist\n---\n board/qemu/x86/linux-4.0-selinux.config | 77 +++++++++++++++++++++++++++++++++\n board/qemu/x86/readme.txt | 17 ++++++++\n configs/qemu_x86_selinux_defconfig | 67 ++++++++++++++++++++++++++++\n 3 files changed, 161 insertions(+)\n create mode 100644 board/qemu/x86/linux-4.0-selinux.config\n create mode 100644 configs/qemu_x86_selinux_defconfig", "diff": "diff --git a/board/qemu/x86/linux-4.0-selinux.config b/board/qemu/x86/linux-4.0-selinux.config\nnew file mode 100644\nindex 0000000..89ab0dc\n--- /dev/null\n+++ b/board/qemu/x86/linux-4.0-selinux.config\n@@ -0,0 +1,77 @@\n+# CONFIG_LOCALVERSION_AUTO is not set\n+# CONFIG_SWAP is not set\n+CONFIG_AUDIT=y\n+# CONFIG_COMPAT_BRK is not set\n+CONFIG_MODULES=y\n+# CONFIG_BLK_DEV_BSG is not set\n+# CONFIG_IOSCHED_DEADLINE is not set\n+# CONFIG_IOSCHED_CFQ is not set\n+# CONFIG_X86_EXTENDED_PLATFORM is not set\n+# CONFIG_SCHED_OMIT_FRAME_POINTER is not set\n+# CONFIG_MTRR_SANITIZER is not set\n+# CONFIG_SECCOMP is not set\n+# CONFIG_RELOCATABLE is not set\n+CONFIG_NET=y\n+CONFIG_PACKET=y\n+CONFIG_UNIX=y\n+CONFIG_INET=y\n+CONFIG_IP_PNP=y\n+# CONFIG_INET_XFRM_MODE_TRANSPORT is not set\n+# CONFIG_INET_XFRM_MODE_TUNNEL is not set\n+# CONFIG_INET_XFRM_MODE_BEET is not set\n+# CONFIG_INET_LRO is not set\n+# CONFIG_INET_DIAG is not set\n+# CONFIG_IPV6 is not set\n+# CONFIG_WIRELESS is not set\n+CONFIG_DEVTMPFS=y\n+CONFIG_DEVTMPFS_MOUNT=y\n+# CONFIG_PREVENT_FIRMWARE_BUILD is not set\n+# CONFIG_FIRMWARE_IN_KERNEL is not set\n+# CONFIG_BLK_DEV is not set\n+CONFIG_BLK_DEV_SD=y\n+CONFIG_ATA=y\n+CONFIG_ATA_PIIX=y\n+CONFIG_NETDEVICES=y\n+CONFIG_NE2K_PCI=y\n+CONFIG_8139CP=y\n+# CONFIG_WLAN is not set\n+# CONFIG_INPUT_MOUSEDEV_PSAUX is not set\n+# CONFIG_INPUT_MOUSE is not set\n+# CONFIG_SERIO_SERPORT is not set\n+# CONFIG_LEGACY_PTYS is not set\n+# CONFIG_DEVKMEM is not set\n+CONFIG_SERIAL_8250=y\n+CONFIG_SERIAL_8250_CONSOLE=y\n+# CONFIG_HW_RANDOM is not set\n+# CONFIG_HWMON is not set\n+CONFIG_SOUND=y\n+CONFIG_SND=y\n+CONFIG_SND_HDA_INTEL=y\n+# CONFIG_USB_SUPPORT is not set\n+# CONFIG_X86_PLATFORM_DEVICES is not set\n+# CONFIG_DMIID is not set\n+CONFIG_EXT2_FS=y\n+CONFIG_EXT2_FS_XATTR=y\n+CONFIG_EXT2_FS_POSIX_ACL=y\n+CONFIG_EXT2_FS_SECURITY=y\n+CONFIG_EXT3_FS=y\n+CONFIG_EXT3_FS_POSIX_ACL=y\n+CONFIG_EXT3_FS_SECURITY=y\n+# CONFIG_DNOTIFY is not set\n+# CONFIG_INOTIFY_USER is not set\n+CONFIG_TMPFS=y\n+CONFIG_TMPFS_POSIX_ACL=y\n+# CONFIG_MISC_FILESYSTEMS is not set\n+CONFIG_NFS_FS=y\n+CONFIG_ROOT_NFS=y\n+# CONFIG_ENABLE_WARN_DEPRECATED is not set\n+# CONFIG_ENABLE_MUST_CHECK is not set\n+# CONFIG_UNUSED_SYMBOLS is not set\n+# CONFIG_FRAME_POINTER is not set\n+# CONFIG_X86_VERBOSE_BOOTUP is not set\n+CONFIG_SECURITY=y\n+CONFIG_SECURITY_NETWORK=y\n+CONFIG_SECURITY_SELINUX=y\n+CONFIG_SECURITY_SELINUX_BOOTPARAM=y\n+CONFIG_CRYPTO_ANSI_CPRNG=y\n+# CONFIG_VIRTUALIZATION is not set\ndiff --git a/board/qemu/x86/readme.txt b/board/qemu/x86/readme.txt\nindex 85d5c60..032d714 100644\n--- a/board/qemu/x86/readme.txt\n+++ b/board/qemu/x86/readme.txt\n@@ -5,3 +5,20 @@ Run the emulation with:\n The login prompt will appear in the graphical window.\n \n Tested with QEMU 2.2.1\n+\n+-------------------------------------------------------------------\n+\n+Run the SElinux target emulation with:\n+\n+ qemu-system-i386 -M pc -kernel output/images/bzImage -drive file=output/images/rootfs.ext2,if=ide -append \"root=/dev/sda rw console=ttyS0 selinux=1\" -net nic,model=rtl8139 -net user -display none -serial stdio\n+\n+The emulation should reboot once the first time for relabeling and\n+then provide a login prompt. The login is username root and password\n+root because PAM requires a password in this secure configuration. To\n+enable SELinux enforcing at boot, login and edit the\n+/etc/selinux/config and set SELINUX to enforcing. Save and make sure\n+to \"sync\" before restarting the emulation as the ext2 fs would\n+otherwise corrupt when the emulation exits. After enforcing is\n+default, the selinux= provided as part of the qemu \"append\" above can\n+be used to turn enforcing on/off. This configuration would be tailored\n+as part of a targets refpolicy customization.\ndiff --git a/configs/qemu_x86_selinux_defconfig b/configs/qemu_x86_selinux_defconfig\nnew file mode 100644\nindex 0000000..feb4534\n--- /dev/null\n+++ b/configs/qemu_x86_selinux_defconfig\n@@ -0,0 +1,67 @@\n+# Architecture\n+BR2_x86_pentiumpro=y\n+\n+# Default to the latest Code Sourcery\n+BR2_TOOLCHAIN_EXTERNAL=y\n+\n+# Select SYSV init to provide selinux enabled init\n+BR2_INIT_SYSV=y\n+\n+# Default password to allow PAM login\n+BR2_TARGET_GENERIC_ROOT_PASSWD=\"root\"\n+\n+# Default the shell to bash, sh symlinks to busybox which\n+# is not compatible with refpolicy\n+BR2_SYSTEM_BIN_SH_BASH=y\n+\n+# Pull in SELinux specific file overlay to allow login\n+# in enforcing mode.\n+BR2_ROOTFS_DEVICE_TABLE=\"system/device_table.txt board/common_selinux/skeleton_permissions.txt\"\n+BR2_ROOTFS_OVERLAY=\"board/common_selinux/skeleton\"\n+BR2_ROOTFS_POST_BUILD_SCRIPT=\"board/common_selinux/post_build.sh\"\n+\n+# Lock to a kernel that's been tested against selinux libs\n+BR2_LINUX_KERNEL=y\n+BR2_LINUX_KERNEL_CUSTOM_VERSION=y\n+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE=\"4.0\"\n+BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y\n+BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE=\"board/qemu/x86/linux-4.0-selinux.config\"\n+\n+# Customized busybox config providing a tailored\n+# balance of applets vs full apps\n+BR2_PACKAGE_BUSYBOX_CONFIG=\"board/common_selinux/busybox-selinux.config\"\n+\n+# Ensure busybox is built as individual binaries for the\n+# SELinux refpolicy to work correctly\n+BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES=y\n+\n+# Audit service\n+BR2_PACKAGE_AUDIT=y\n+\n+# Enhanced authentication with selinux hooks\n+BR2_PACKAGE_LINUX_PAM=y\n+\n+# Full version of login with SELinux support\n+BR2_PACKAGE_UTIL_LINUX=y\n+BR2_PACKAGE_UTIL_LINUX_BINARIES=y\n+BR2_PACKAGE_UTIL_LINUX_LOGIN_UTILS=y\n+\n+# SSH daemon for secure login\n+BR2_PACKAGE_OPENSSH=y\n+\n+# Provides tools for fs security context relabeling\n+BR2_PACKAGE_POLICYCOREUTILS=y\n+\n+# SELinux policy config/definition\n+BR2_PACKAGE_REFPOLICY=y\n+\n+# Logging daemon\n+BR2_PACKAGE_RSYSLOG=y\n+\n+#rootfs with spare space for fs relabel activity\n+BR2_TARGET_ROOTFS_EXT2=y\n+BR2_TARGET_ROOTFS_EXT2_RESBLKS=5\n+# BR2_TARGET_ROOTFS_TAR is not set\n+\n+# Offline tools for policy analysis/building\n+BR2_PACKAGE_HOST_CHECKPOLICY=y\n", "prefixes": [ "v9", "13/15" ] }