[meta-security][PATCH 1/2] smack: Add new package

[meta-security][PATCH 1/2] smack: Add new package

[Armin Kuster]

Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
 recipes-security/smack/files/run-ptest             |  3 ++
 .../smack/files/smack_generator_make_fixup.patch   | 18 ++++++++++
 recipes-security/smack/smack_1.3.0.bb              | 42 ++++++++++++++++++++++
 3 files changed, 63 insertions(+)
 create mode 100644 recipes-security/smack/files/run-ptest
 create mode 100644 recipes-security/smack/files/smack_generator_make_fixup.patch
 create mode 100644 recipes-security/smack/smack_1.3.0.bb

diff --git a/recipes-security/smack/files/run-ptest b/recipes-security/smack/files/run-ptest
new file mode 100644
index 0000000..049a9b4
--- /dev/null
+++ b/recipes-security/smack/files/run-ptest
@@ -0,0 +1,3 @@
+#!/bin/sh
+./tests/make_policies.bash ./tests/generator
+./tests/make_policies.bash ./tests/generator labels
diff --git a/recipes-security/smack/files/smack_generator_make_fixup.patch b/recipes-security/smack/files/smack_generator_make_fixup.patch
new file mode 100644
index 0000000..8bafc5e
--- /dev/null
+++ b/recipes-security/smack/files/smack_generator_make_fixup.patch
@@ -0,0 +1,18 @@
+Upstream-Status: Pending
+
+Signed-off-by: Armin Kuster <akuster808@gmail.com>
+
+
+Index: git/tests/Makefile
+===================================================================
+--- git.orig/tests/Makefile
++++ git/tests/Makefile
+@@ -4,7 +4,7 @@ clean:
+ 	rm -rf ./out ./generator
+ 
+ generator: generator.c
+-	gcc -Wall -O3 generator.c -o ./generator
++	${CC}  generator.c -o ./generator
+ 
+ policies: ./generator ./make_policies.bash
+ 	./make_policies.bash ./generator
diff --git a/recipes-security/smack/smack_1.3.0.bb b/recipes-security/smack/smack_1.3.0.bb
new file mode 100644
index 0000000..46d305e
--- /dev/null
+++ b/recipes-security/smack/smack_1.3.0.bb
@@ -0,0 +1,42 @@
+DESCRIPTION = "Selection of tools for developers working with Smack"
+HOMEPAGE = "https://github.com/smack-team/smack"
+SECTION = "Security/Access Control"
+LICENSE = "LGPL-2.1"
+
+LIC_FILES_CHKSUM = "file://COPYING;md5=4fbd65380cdd255951079008b364516c"
+
+SRCREV = "478f68d182c5070f510482194d3e097b11c21907"
+SRC_URI = " \
+	git://github.com/smack-team/smack.git;branch=v1.3.x \
+	file://smack_generator_make_fixup.patch \
+	file://run-ptest"
+
+PV = "1.3.0+git${SRCPV}"
+
+inherit autotools pkgconfig systemd ptest
+
+S = "${WORKDIR}/git"
+
+PACKAGECONFIG ??= ""
+PACKAGECONG += "${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'systemd', '', d)}"
+
+PACKAGECONFIG[systemd] = "--with-systemdsystemunitdir=DIR"
+PACKAGECONFIG[systemd] = "--with-systemdsystemunitdir=${systemd_system_unitdir}, --without-systemdsystemunitdir, systemd"
+
+do_compile_append () {
+	oe_runmake -C ${S}/tests generator
+}
+
+do_install_ptest () {
+	install -d ${D}${PTEST_PATH}/tests
+	install ${S}/tests/generator ${D}/${PTEST_PATH}/tests
+	install ${S}/tests/generate-rules.sh ${D}${PTEST_PATH}/tests
+	install ${S}/tests/make_policies.bash ${D}${PTEST_PATH}/tests
+}
+
+FILES_${PN}-ptest += "generator"
+
+RDEPENDS_${PN} += "coreutils"
+RDEPENDS_${PN}-ptest += "make bash bc"
+
+BBCLASSEXTEND = "native"
-- 
2.7.4

[meta-security][PATCH 2/2] smack kernel: add smack kernel config fragments

[Armin Kuster]

Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
 recipes-kernel/linux/linux-yocto-4.8/smack-default-lsm.cfg | 2 ++
 recipes-kernel/linux/linux-yocto-4.8/smack.cfg             | 8 ++++++++
 recipes-kernel/linux/linux-yocto_4.8.bbappend              | 5 +++++
 3 files changed, 15 insertions(+)
 create mode 100644 recipes-kernel/linux/linux-yocto-4.8/smack-default-lsm.cfg
 create mode 100644 recipes-kernel/linux/linux-yocto-4.8/smack.cfg

diff --git a/recipes-kernel/linux/linux-yocto-4.8/smack-default-lsm.cfg b/recipes-kernel/linux/linux-yocto-4.8/smack-default-lsm.cfg
new file mode 100644
index 0000000..b5c4845
--- /dev/null
+++ b/recipes-kernel/linux/linux-yocto-4.8/smack-default-lsm.cfg
@@ -0,0 +1,2 @@
+CONFIG_DEFAULT_SECURITY="smack"
+CONFIG_DEFAULT_SECURITY_SMACK=y
diff --git a/recipes-kernel/linux/linux-yocto-4.8/smack.cfg b/recipes-kernel/linux/linux-yocto-4.8/smack.cfg
new file mode 100644
index 0000000..62f465a
--- /dev/null
+++ b/recipes-kernel/linux/linux-yocto-4.8/smack.cfg
@@ -0,0 +1,8 @@
+CONFIG_IP_NF_SECURITY=m
+CONFIG_IP6_NF_SECURITY=m
+CONFIG_EXT2_FS_SECURITY=y
+CONFIG_EXT3_FS_SECURITY=y
+CONFIG_EXT4_FS_SECURITY=y
+CONFIG_SECURITY=y
+CONFIG_SECURITY_SMACK=y
+CONFIG_TMPFS_XATTR=y
diff --git a/recipes-kernel/linux/linux-yocto_4.8.bbappend b/recipes-kernel/linux/linux-yocto_4.8.bbappend
index 0e6960e..048e8fd 100644
--- a/recipes-kernel/linux/linux-yocto_4.8.bbappend
+++ b/recipes-kernel/linux/linux-yocto_4.8.bbappend
@@ -5,3 +5,8 @@ SRC_URI += "\
         ${@bb.utils.contains('DISTRO_FEATURES', 'tpm', ' file://tpm.cfg', '', d)} \
         ${@bb.utils.contains('DISTRO_FEATURES', 'tpm', ' file://tpm.scc', '', d)} \
 "
+
+SRC_URI += "\
+        ${@bb.utils.contains('DISTRO_FEATURES', 'smack', ' file://smack.cfg', '', d)} \
+        ${@bb.utils.contains('DISTRO_FEATURES', 'smack', ' file://smack-default-lsm.cfg', '', d)} \
+"
-- 
2.7.4

Re: [meta-security][PATCH 2/2] smack kernel: add smack kernel config fragments

[Patrick Ohly]

On Wed, 2016-10-26 at 08:00 -0700, Armin Kuster wrote:
> Signed-off-by: Armin Kuster <akuster808@gmail.com>
> ---
>  recipes-kernel/linux/linux-yocto-4.8/smack-default-lsm.cfg | 2 ++
>  recipes-kernel/linux/linux-yocto-4.8/smack.cfg             | 8 ++++++++
>  recipes-kernel/linux/linux-yocto_4.8.bbappend              | 5 +++++
>  3 files changed, 15 insertions(+)
>  create mode 100644 recipes-kernel/linux/linux-yocto-4.8/smack-default-lsm.cfg
>  create mode 100644 recipes-kernel/linux/linux-yocto-4.8/smack.cfg
> 
> diff --git a/recipes-kernel/linux/linux-yocto-4.8/smack-default-lsm.cfg b/recipes-kernel/linux/linux-yocto-4.8/smack-default-lsm.cfg
> new file mode 100644
> index 0000000..b5c4845
> --- /dev/null
> +++ b/recipes-kernel/linux/linux-yocto-4.8/smack-default-lsm.cfg
> @@ -0,0 +1,2 @@
> +CONFIG_DEFAULT_SECURITY="smack"
> +CONFIG_DEFAULT_SECURITY_SMACK=y
> diff --git a/recipes-kernel/linux/linux-yocto-4.8/smack.cfg b/recipes-kernel/linux/linux-yocto-4.8/smack.cfg
> new file mode 100644
> index 0000000..62f465a
> --- /dev/null
> +++ b/recipes-kernel/linux/linux-yocto-4.8/smack.cfg
> @@ -0,0 +1,8 @@
> +CONFIG_IP_NF_SECURITY=m
> +CONFIG_IP6_NF_SECURITY=m
> +CONFIG_EXT2_FS_SECURITY=y
> +CONFIG_EXT3_FS_SECURITY=y
> +CONFIG_EXT4_FS_SECURITY=y
> +CONFIG_SECURITY=y
> +CONFIG_SECURITY_SMACK=y
> +CONFIG_TMPFS_XATTR=y

Were these two files perhaps copied from
https://github.com/01org/meta-intel-iot-security/tree/master/meta-security-smack/recipes-kernel/linux/linux ?

Just wondering, they look, hmm, very familiar ;-)

Can you say a bit more about your plans regarding Smack support in
meta-security? A recipe for the userspace tool and the kernel config is
a start, but for a fully functional Smack-enabled image, the rootfs also
needs to be set up a bit differently.

I can imagine that it would be worthwhile to take more of the things
done in meta-intel-iot-security and then deprecate that layer.

-- 
Best Regards, Patrick Ohly

The content of this message is my personal opinion only and although
I am an employee of Intel, the statements I make here in no way
represent Intel's position on the issue, nor am I authorized to speak
on behalf of Intel on this matter.

Re: [meta-security][PATCH 2/2] smack kernel: add smack kernel config fragments

[Khem Raj]

[-- Attachment #1: Type: text/plain, Size: 2640 bytes --]


> On Oct 27, 2016, at 12:22 AM, Patrick Ohly <patrick.ohly@intel.com> wrote:
> 
> On Wed, 2016-10-26 at 08:00 -0700, Armin Kuster wrote:
>> Signed-off-by: Armin Kuster <akuster808@gmail.com>
>> ---
>> recipes-kernel/linux/linux-yocto-4.8/smack-default-lsm.cfg | 2 ++
>> recipes-kernel/linux/linux-yocto-4.8/smack.cfg             | 8 ++++++++
>> recipes-kernel/linux/linux-yocto_4.8.bbappend              | 5 +++++
>> 3 files changed, 15 insertions(+)
>> create mode 100644 recipes-kernel/linux/linux-yocto-4.8/smack-default-lsm.cfg
>> create mode 100644 recipes-kernel/linux/linux-yocto-4.8/smack.cfg
>> 
>> diff --git a/recipes-kernel/linux/linux-yocto-4.8/smack-default-lsm.cfg b/recipes-kernel/linux/linux-yocto-4.8/smack-default-lsm.cfg
>> new file mode 100644
>> index 0000000..b5c4845
>> --- /dev/null
>> +++ b/recipes-kernel/linux/linux-yocto-4.8/smack-default-lsm.cfg
>> @@ -0,0 +1,2 @@
>> +CONFIG_DEFAULT_SECURITY="smack"
>> +CONFIG_DEFAULT_SECURITY_SMACK=y
>> diff --git a/recipes-kernel/linux/linux-yocto-4.8/smack.cfg b/recipes-kernel/linux/linux-yocto-4.8/smack.cfg
>> new file mode 100644
>> index 0000000..62f465a
>> --- /dev/null
>> +++ b/recipes-kernel/linux/linux-yocto-4.8/smack.cfg
>> @@ -0,0 +1,8 @@
>> +CONFIG_IP_NF_SECURITY=m
>> +CONFIG_IP6_NF_SECURITY=m
>> +CONFIG_EXT2_FS_SECURITY=y
>> +CONFIG_EXT3_FS_SECURITY=y
>> +CONFIG_EXT4_FS_SECURITY=y
>> +CONFIG_SECURITY=y
>> +CONFIG_SECURITY_SMACK=y
>> +CONFIG_TMPFS_XATTR=y
> 
> Were these two files perhaps copied from
> https://github.com/01org/meta-intel-iot-security/tree/master/meta-security-smack/recipes-kernel/linux/linux ?
> 
> Just wondering, they look, hmm, very familiar ;-)
> 
> Can you say a bit more about your plans regarding Smack support in
> meta-security? A recipe for the userspace tool and the kernel config is
> a start, but for a fully functional Smack-enabled image, the rootfs also
> needs to be set up a bit differently.

FWIW meta-security seems to be right place for smack related infra.

> 
> I can imagine that it would be worthwhile to take more of the things
> done in meta-intel-iot-security and then deprecate that layer.
> 
> --
> Best Regards, Patrick Ohly
> 
> The content of this message is my personal opinion only and although
> I am an employee of Intel, the statements I make here in no way
> represent Intel's position on the issue, nor am I authorized to speak
> on behalf of Intel on this matter.
> 
> 
> 
> --
> _______________________________________________
> yocto mailing list
> yocto@yoctoproject.org
> https://lists.yoctoproject.org/listinfo/yocto


[-- Attachment #2: Message signed with OpenPGP using GPGMail --]
[-- Type: application/pgp-signature, Size: 211 bytes --]

Re: [meta-security][PATCH 2/2] smack kernel: add smack kernel config fragments

[Patrick Ohly]

On Thu, 2016-10-27 at 19:32 -0700, Khem Raj wrote:
> > On Oct 27, 2016, at 12:22 AM, Patrick Ohly <patrick.ohly@intel.com> wrote:
> > Can you say a bit more about your plans regarding Smack support in
> > meta-security? A recipe for the userspace tool and the kernel config is
> > a start, but for a fully functional Smack-enabled image, the rootfs also
> > needs to be set up a bit differently.
> 
> FWIW meta-security seems to be right place for smack related infra.

I don't disagree :-) But it would be good to know more about the rest of
the infrastructure before adding (or reviewing) bits and pieces that by
themselves don't do much.

-- 
Best Regards, Patrick Ohly

The content of this message is my personal opinion only and although
I am an employee of Intel, the statements I make here in no way
represent Intel's position on the issue, nor am I authorized to speak
on behalf of Intel on this matter.

Re: [meta-security][PATCH 2/2] smack kernel: add smack kernel config fragments

[akuster808]

On 10/28/2016 04:20 AM, Patrick Ohly wrote:
> On Thu, 2016-10-27 at 19:32 -0700, Khem Raj wrote:
>>> On Oct 27, 2016, at 12:22 AM, Patrick Ohly <patrick.ohly@intel.com> wrote:
>>> Can you say a bit more about your plans regarding Smack support in
>>> meta-security? A recipe for the userspace tool and the kernel config is
>>> a start, but for a fully functional Smack-enabled image, the rootfs also
>>> needs to be set up a bit differently.
>> FWIW meta-security seems to be right place for smack related infra.
> I don't disagree :-) But it would be good to know more about the rest of
> the infrastructure before adding (or reviewing) bits and pieces that by
> themselves don't do much.
I start of with basic support and refine over time.  Your statement can 
apply for many components within meta-secuirty. I recently started 
adding test images. Providing configurations or solutions for a niche 
area is outside the scope for this general layer, IMHO. I could be 
convinced  otherwise. I tend not to wait for 100% solution before 
sending out bits for review.

thanks for your input.

Regards,
Armin
>

Re: [meta-security][PATCH 2/2] smack kernel: add smack kernel config fragments

[Khem Raj]

[-- Attachment #1: Type: text/plain, Size: 1360 bytes --]


> On Oct 28, 2016, at 8:41 AM, akuster808 <akuster808@gmail.com> wrote:
> 
> 
> 
> On 10/28/2016 04:20 AM, Patrick Ohly wrote:
>> On Thu, 2016-10-27 at 19:32 -0700, Khem Raj wrote:
>>>> On Oct 27, 2016, at 12:22 AM, Patrick Ohly <patrick.ohly@intel.com> wrote:
>>>> Can you say a bit more about your plans regarding Smack support in
>>>> meta-security? A recipe for the userspace tool and the kernel config is
>>>> a start, but for a fully functional Smack-enabled image, the rootfs also
>>>> needs to be set up a bit differently.
>>> FWIW meta-security seems to be right place for smack related infra.
>> I don't disagree :-) But it would be good to know more about the rest of
>> the infrastructure before adding (or reviewing) bits and pieces that by
>> themselves don't do much.
> I start of with basic support and refine over time.  Your statement can apply for many components within meta-secuirty. I recently started adding test images. Providing configurations or solutions for a niche area is outside the scope for this general layer, IMHO. I could be convinced  otherwise. I tend not to wait for 100% solution before sending out bits for review.

its a good start. If you have some more patches on the way to complete
the solution, that would be good to share.

> 
> thanks for your input.
> 
> Regards,
> Armin
>> 
> 


[-- Attachment #2: Message signed with OpenPGP using GPGMail --]
[-- Type: application/pgp-signature, Size: 211 bytes --]

Re: [meta-security][PATCH 1/2] smack: Add new package

[Khem Raj]

[-- Attachment #1: Type: text/plain, Size: 3816 bytes --]


> On Oct 26, 2016, at 8:00 AM, Armin Kuster <akuster808@gmail.com> wrote:
> 
> Signed-off-by: Armin Kuster <akuster808@gmail.com>
> ---
> recipes-security/smack/files/run-ptest             |  3 ++
> .../smack/files/smack_generator_make_fixup.patch   | 18 ++++++++++
> recipes-security/smack/smack_1.3.0.bb              | 42 ++++++++++++++++++++++
> 3 files changed, 63 insertions(+)
> create mode 100644 recipes-security/smack/files/run-ptest
> create mode 100644 recipes-security/smack/files/smack_generator_make_fixup.patch
> create mode 100644 recipes-security/smack/smack_1.3.0.bb
> 
> diff --git a/recipes-security/smack/files/run-ptest b/recipes-security/smack/files/run-ptest
> new file mode 100644
> index 0000000..049a9b4
> --- /dev/null
> +++ b/recipes-security/smack/files/run-ptest
> @@ -0,0 +1,3 @@
> +#!/bin/sh
> +./tests/make_policies.bash ./tests/generator
> +./tests/make_policies.bash ./tests/generator labels
> diff --git a/recipes-security/smack/files/smack_generator_make_fixup.patch b/recipes-security/smack/files/smack_generator_make_fixup.patch
> new file mode 100644
> index 0000000..8bafc5e
> --- /dev/null
> +++ b/recipes-security/smack/files/smack_generator_make_fixup.patch
> @@ -0,0 +1,18 @@
> +Upstream-Status: Pending
> +
> +Signed-off-by: Armin Kuster <akuster808@gmail.com>
> +
> +
> +Index: git/tests/Makefile
> +===================================================================
> +--- git.orig/tests/Makefile
> ++++ git/tests/Makefile
> +@@ -4,7 +4,7 @@ clean:
> + 	rm -rf ./out ./generator
> +
> + generator: generator.c
> +-	gcc -Wall -O3 generator.c -o ./generator
> ++	${CC}  generator.c -o ./generator

This should be ${CC} ${LDFLAGS} since you are doing compiling and linking in single step
otherwise we may end up with hash-style problems

> +
> + policies: ./generator ./make_policies.bash
> + 	./make_policies.bash ./generator
> diff --git a/recipes-security/smack/smack_1.3.0.bb b/recipes-security/smack/smack_1.3.0.bb
> new file mode 100644
> index 0000000..46d305e
> --- /dev/null
> +++ b/recipes-security/smack/smack_1.3.0.bb
> @@ -0,0 +1,42 @@
> +DESCRIPTION = "Selection of tools for developers working with Smack"
> +HOMEPAGE = "https://github.com/smack-team/smack"
> +SECTION = "Security/Access Control"
> +LICENSE = "LGPL-2.1"
> +
> +LIC_FILES_CHKSUM = "file://COPYING;md5=4fbd65380cdd255951079008b364516c"
> +
> +SRCREV = "478f68d182c5070f510482194d3e097b11c21907"
> +SRC_URI = " \
> +	git://github.com/smack-team/smack.git;branch=v1.3.x \
> +	file://smack_generator_make_fixup.patch \
> +	file://run-ptest"
> +
> +PV = "1.3.0+git${SRCPV}"
> +
> +inherit autotools pkgconfig systemd ptest
> +
> +S = "${WORKDIR}/git"
> +
> +PACKAGECONFIG ??= ""
> +PACKAGECONG += "${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'systemd', '', d)}”
     ^^^^
is this a typo ? and may be it should be _append not +=

> +
> +PACKAGECONFIG[systemd] = "--with-systemdsystemunitdir=DIR"
> +PACKAGECONFIG[systemd] = "--with-systemdsystemunitdir=${systemd_system_unitdir}, --without-systemdsystemunitdir, systemd"
> +
> +do_compile_append () {
> +	oe_runmake -C ${S}/tests generator
> +}
> +
> +do_install_ptest () {
> +	install -d ${D}${PTEST_PATH}/tests
> +	install ${S}/tests/generator ${D}/${PTEST_PATH}/tests
> +	install ${S}/tests/generate-rules.sh ${D}${PTEST_PATH}/tests
> +	install ${S}/tests/make_policies.bash ${D}${PTEST_PATH}/tests
> +}
> +
> +FILES_${PN}-ptest += "generator"
> +
> +RDEPENDS_${PN} += "coreutils"
> +RDEPENDS_${PN}-ptest += "make bash bc"
> +
> +BBCLASSEXTEND = "native"
> --
> 2.7.4
> 
> --
> _______________________________________________
> yocto mailing list
> yocto@yoctoproject.org
> https://lists.yoctoproject.org/listinfo/yocto


[-- Attachment #2: Message signed with OpenPGP using GPGMail --]
[-- Type: application/pgp-signature, Size: 211 bytes --]