[meta-selinux][PATCH] systemd: create /var/lib/systemd/backlight in advance

[meta-selinux][PATCH] systemd: create /var/lib/systemd/backlight in advance

[wenzong.fan]

From: Wenzong Fan <wenzong.fan@windriver.com>

The systemd-backlight@.service which called after selinux-init.service
will create /var/lib/systemd/backlight with incorrect security labels,
this causes the systemd-backlight service fails to start and stop.

Creating /var/lib/systemd/backlight in advance to make sure it could
always be relabelled by selinux-init while first booting.

Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
---
 recipes-core/systemd/systemd_%.bbappend | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/recipes-core/systemd/systemd_%.bbappend b/recipes-core/systemd/systemd_%.bbappend
index 5ac3adb..b17e70a 100644
--- a/recipes-core/systemd/systemd_%.bbappend
+++ b/recipes-core/systemd/systemd_%.bbappend
@@ -1 +1,7 @@
 inherit ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'enable-audit', '', d)}
+
+do_install_append() {
+	if ${@bb.utils.contains('PACKAGECONFIG', 'backlight', 'true', 'false', d)}; then
+		install -d ${D}${localstatedir}/lib/systemd/backlight
+	fi
+}
-- 
2.8.1

Re: [meta-selinux][PATCH] systemd: create /var/lib/systemd/backlight in advance

[akuster808]

On 04/19/2018 12:15 AM, wenzong.fan@windriver.com wrote:
> From: Wenzong Fan <wenzong.fan@windriver.com>
>
> The systemd-backlight@.service which called after selinux-init.service
> will create /var/lib/systemd/backlight with incorrect security labels,
> this causes the systemd-backlight service fails to start and stop.
>
> Creating /var/lib/systemd/backlight in advance to make sure it could
> always be relabelled by selinux-init while first booting.
>
> Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
> ---
>  recipes-core/systemd/systemd_%.bbappend | 6 ++++++
>  1 file changed, 6 insertions(+)
>
> diff --git a/recipes-core/systemd/systemd_%.bbappend b/recipes-core/systemd/systemd_%.bbappend
> index 5ac3adb..b17e70a 100644
> --- a/recipes-core/systemd/systemd_%.bbappend
> +++ b/recipes-core/systemd/systemd_%.bbappend
> @@ -1 +1,7 @@
>  inherit ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'enable-audit', '', d)}
> +
> +do_install_append() {
> +	if ${@bb.utils.contains('PACKAGECONFIG', 'backlight', 'true', 'false', d)}; then
> +		install -d ${D}${localstatedir}/lib/systemd/backlight
> +	fi
> +}
Wont this affect the hash when running the yocto-check-layer ??

See
http://git.yoctoproject.org/cgit/cgit.cgi/meta-selinux/commit/?id=4fefe83c3203c11fadbe43637a3058284b60427b
for examples.

- armin

Re: [meta-selinux][PATCH] systemd: create /var/lib/systemd/backlight in advance

[wenzong fan]

On 04/19/2018 10:05 PM, akuster808 wrote:
> 
> 
> On 04/19/2018 12:15 AM, wenzong.fan@windriver.com wrote:
>> From: Wenzong Fan <wenzong.fan@windriver.com>
>>
>> The systemd-backlight@.service which called after selinux-init.service
>> will create /var/lib/systemd/backlight with incorrect security labels,
>> this causes the systemd-backlight service fails to start and stop.
>>
>> Creating /var/lib/systemd/backlight in advance to make sure it could
>> always be relabelled by selinux-init while first booting.
>>
>> Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
>> ---
>>   recipes-core/systemd/systemd_%.bbappend | 6 ++++++
>>   1 file changed, 6 insertions(+)
>>
>> diff --git a/recipes-core/systemd/systemd_%.bbappend b/recipes-core/systemd/systemd_%.bbappend
>> index 5ac3adb..b17e70a 100644
>> --- a/recipes-core/systemd/systemd_%.bbappend
>> +++ b/recipes-core/systemd/systemd_%.bbappend
>> @@ -1 +1,7 @@
>>   inherit ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'enable-audit', '', d)}
>> +
>> +do_install_append() {
>> +	if ${@bb.utils.contains('PACKAGECONFIG', 'backlight', 'true', 'false', d)}; then
>> +		install -d ${D}${localstatedir}/lib/systemd/backlight
>> +	fi
>> +}
> Wont this affect the hash when running the yocto-check-layer ??
> 
> See
> http://git.yoctoproject.org/cgit/cgit.cgi/meta-selinux/commit/?id=4fefe83c3203c11fadbe43637a3058284b60427b
> for examples.

Oops, I'll refresh the patch and send V2.

Thanks
Wenzong

> 
> - armin
>