[meta-security][PATCH 01/11] README: add git-config tips

[meta-security][PATCH 01/11] README: add git-config tips

[Ross Burton]

Signed-off-by: Ross Burton <ross.burton@intel.com>
---
 README | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/README b/README
index e238271..c15fea9 100644
--- a/README
+++ b/README
@@ -57,6 +57,13 @@ Send pull requests, patches, comments or questions to yocto@yoctoproject.org
 When sending single patches, please using something like:
 'git send-email -1 --to yocto@yoctoproject.org --subject-prefix=meta-security][PATCH'
 
+These values can be set as defaults for this repository:
+
+$ git config sendemail.to yocto@yoctoproject.org
+$ git config format.subjectPrefix meta-security][PATCH
+
+Now you can just do 'git send-email origin/master' to send all local patches.
+
 Maintainers:    Armin Kuster <akuster808@gmail.com>
                 Saul Wold <sgw@linux.intel.com>
 
-- 
2.11.0

[meta-security][PATCH 02/11] README: remove Saul from maintainers

[Ross Burton]

Signed-off-by: Ross Burton <ross.burton@intel.com>
---
 README | 1 -
 1 file changed, 1 deletion(-)

diff --git a/README b/README
index c15fea9..5abb0e2 100644
--- a/README
+++ b/README
@@ -65,7 +65,6 @@ $ git config format.subjectPrefix meta-security][PATCH
 Now you can just do 'git send-email origin/master' to send all local patches.
 
 Maintainers:    Armin Kuster <akuster808@gmail.com>
-                Saul Wold <sgw@linux.intel.com>
 
 
 License
-- 
2.11.0

[meta-security][PATCH 03/11] apparmor: add missing bash dependency

[Ross Burton]

testsuite/parser/tst/minimize.sh is a bash script, so until it is reviewed add a
bash dependency to apparmor-ptest.

Signed-off-by: Ross Burton <ross.burton@intel.com>
---
 recipes-security/AppArmor/apparmor_2.12.bb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/recipes-security/AppArmor/apparmor_2.12.bb b/recipes-security/AppArmor/apparmor_2.12.bb
index e3f8dc9..2cf5b7d 100644
--- a/recipes-security/AppArmor/apparmor_2.12.bb
+++ b/recipes-security/AppArmor/apparmor_2.12.bb
@@ -156,4 +156,4 @@ ALLOW_EMPTY_${PN} = "1"
 RDEPENDS_${PN} += "bash lsb"
 RDEPENDS_${PN} += "${@bb.utils.contains('PACKAGECONFIG','python','python3 python3-modules','', d)}"
 RDEPENDS_${PN}_remove += "${@bb.utils.contains('PACKAGECONFIG','perl','','perl', d)}"
-RDEPENDS_${PN}-ptest += "perl coreutils dbus-lib"
+RDEPENDS_${PN}-ptest += "perl coreutils dbus-lib bash"
-- 
2.11.0

[meta-security][PATCH 04/11] apparmor: enable static libraries neatly

[Ross Burton]

No need to fiddle with the configure arguments as we can just neuter
disable-static.inc.

Signed-off-by: Ross Burton <ross.burton@intel.com>
---
 recipes-security/AppArmor/apparmor_2.12.bb | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/recipes-security/AppArmor/apparmor_2.12.bb b/recipes-security/AppArmor/apparmor_2.12.bb
index 2cf5b7d..303d5c7 100644
--- a/recipes-security/AppArmor/apparmor_2.12.bb
+++ b/recipes-security/AppArmor/apparmor_2.12.bb
@@ -50,8 +50,7 @@ python() {
         raise bb.parse.SkipRecipe('Requires meta-webserver to be present.')
 }
 
-CONFIGUREOPTS_remove = "--disable-static"
-EXTRA_OECONF_append = " --enable-static"
+DISABLE_STATIC = ""
 
 do_configure() {
 	cd ${S}/libraries/libapparmor
-- 
2.11.0

[meta-security][PATCH 05/11] apparmor: remove redundant S

[Ross Burton]

This is the default value, so remove it.

Signed-off-by: Ross Burton <ross.burton@intel.com>
---
 recipes-security/AppArmor/apparmor_2.12.bb | 2 --
 1 file changed, 2 deletions(-)

diff --git a/recipes-security/AppArmor/apparmor_2.12.bb b/recipes-security/AppArmor/apparmor_2.12.bb
index 303d5c7..6434e42 100644
--- a/recipes-security/AppArmor/apparmor_2.12.bb
+++ b/recipes-security/AppArmor/apparmor_2.12.bb
@@ -32,8 +32,6 @@ PARALLEL_MAKE = ""
 inherit pkgconfig autotools-brokensep update-rc.d python3native perlnative ptest cpan
 inherit ${@bb.utils.contains('VIRTUAL-RUNTIME_init_manager','systemd','systemd','', d)}
 
-S = "${WORKDIR}/apparmor-${PV}"
-
 PACKAGECONFIG ?="man python perl"
 PACKAGECONFIG[man] = "--enable-man-pages, --disable-man-pages"
 PACKAGECONFIG[python] = "--with-python, --without-python, python3 swig-native"
-- 
2.11.0

[meta-security][PATCH 06/11] apparmor: use manpages class

[Ross Burton]

The manpages class handles enabling/disabling the man pages based on the
api-documentation DISTRO_FEATURE, and ensures that mandb is called.

Signed-off-by: Ross Burton <ross.burton@intel.com>
---
 recipes-security/AppArmor/apparmor_2.12.bb | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/recipes-security/AppArmor/apparmor_2.12.bb b/recipes-security/AppArmor/apparmor_2.12.bb
index 6434e42..529414f 100644
--- a/recipes-security/AppArmor/apparmor_2.12.bb
+++ b/recipes-security/AppArmor/apparmor_2.12.bb
@@ -29,11 +29,11 @@ SRC_URI[sha256sum] = "8a2b0cd083faa4d0640f579024be3a629faa7db3b99540798a1a050e2e
 
 PARALLEL_MAKE = ""
 
-inherit pkgconfig autotools-brokensep update-rc.d python3native perlnative ptest cpan
+inherit pkgconfig autotools-brokensep update-rc.d python3native perlnative ptest cpan manpages
 inherit ${@bb.utils.contains('VIRTUAL-RUNTIME_init_manager','systemd','systemd','', d)}
 
-PACKAGECONFIG ?="man python perl"
-PACKAGECONFIG[man] = "--enable-man-pages, --disable-man-pages"
+PACKAGECONFIG ??= "python perl"
+PACKAGECONFIG[manpages] = "--enable-man-pages, --disable-man-pages"
 PACKAGECONFIG[python] = "--with-python, --without-python, python3 swig-native"
 PACKAGECONFIG[perl] = "--with-perl, --without-perl, perl perl-native swig-native"
 PACKAGECONFIG[apache2] = ",,apache2,"
-- 
2.11.0

[meta-security][PATCH 07/11] apparmor: no need to conditionalise PACKAGES

[Ross Burton]

A package with no content is not generated, so there's no need to conditionalise
assignments to PACKAGES.

Signed-off-by: Ross Burton <ross.burton@intel.com>
---
 recipes-security/AppArmor/apparmor_2.12.bb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/recipes-security/AppArmor/apparmor_2.12.bb b/recipes-security/AppArmor/apparmor_2.12.bb
index 529414f..b5ac613 100644
--- a/recipes-security/AppArmor/apparmor_2.12.bb
+++ b/recipes-security/AppArmor/apparmor_2.12.bb
@@ -143,7 +143,7 @@ SYSTEMD_PACKAGES = "${PN}"
 SYSTEMD_SERVICE_${PN} = "apparmor.service"
 SYSTEMD_AUTO_ENABLE = "disable"
 
-PACKAGES += "${@bb.utils.contains('PACKAGECONFIG', 'apache2', 'mod-${PN}', '', d)}"
+PACKAGES += "mod-${PN}"
 
 FILES_${PN} += "/lib/apparmor/ ${sysconfdir}/apparmor ${PYTHON_SITEPACKAGES_DIR}"
 FILES_mod-${PN} = "${libdir}/apache2/modules/*"
-- 
2.11.0

[meta-security][PATCH 08/11] apparmor: remove pointless ALLOW_EMPTY

[Ross Burton]

${PN} has content, so there's no need to set ALLOW_EMPTY_${PN}.

Signed-off-by: Ross Burton <ross.burton@intel.com>
---
 recipes-security/AppArmor/apparmor_2.12.bb | 2 --
 1 file changed, 2 deletions(-)

diff --git a/recipes-security/AppArmor/apparmor_2.12.bb b/recipes-security/AppArmor/apparmor_2.12.bb
index b5ac613..39c45e5 100644
--- a/recipes-security/AppArmor/apparmor_2.12.bb
+++ b/recipes-security/AppArmor/apparmor_2.12.bb
@@ -148,8 +148,6 @@ PACKAGES += "mod-${PN}"
 FILES_${PN} += "/lib/apparmor/ ${sysconfdir}/apparmor ${PYTHON_SITEPACKAGES_DIR}"
 FILES_mod-${PN} = "${libdir}/apache2/modules/*"
 
-ALLOW_EMPTY_${PN} = "1"
-
 RDEPENDS_${PN} += "bash lsb"
 RDEPENDS_${PN} += "${@bb.utils.contains('PACKAGECONFIG','python','python3 python3-modules','', d)}"
 RDEPENDS_${PN}_remove += "${@bb.utils.contains('PACKAGECONFIG','perl','','perl', d)}"
-- 
2.11.0

[meta-security][PATCH 09/11] apparmor: systemd.bbclas is useful even when disabled

[Ross Burton]

The systemd bbclass will remove any systemd files that have been installed if
systemd is disabled, so always install the files and always inherit.

Signed-off-by: Ross Burton <ross.burton@intel.com>
---
 recipes-security/AppArmor/apparmor_2.12.bb | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/recipes-security/AppArmor/apparmor_2.12.bb b/recipes-security/AppArmor/apparmor_2.12.bb
index 39c45e5..92602f3 100644
--- a/recipes-security/AppArmor/apparmor_2.12.bb
+++ b/recipes-security/AppArmor/apparmor_2.12.bb
@@ -29,8 +29,7 @@ SRC_URI[sha256sum] = "8a2b0cd083faa4d0640f579024be3a629faa7db3b99540798a1a050e2e
 
 PARALLEL_MAKE = ""
 
-inherit pkgconfig autotools-brokensep update-rc.d python3native perlnative ptest cpan manpages
-inherit ${@bb.utils.contains('VIRTUAL-RUNTIME_init_manager','systemd','systemd','', d)}
+inherit pkgconfig autotools-brokensep update-rc.d python3native perlnative ptest cpan manpages systemd
 
 PACKAGECONFIG ??= "python perl"
 PACKAGECONFIG[manpages] = "--enable-man-pages, --disable-man-pages"
@@ -101,11 +100,8 @@ do_install () {
 
 	install ${WORKDIR}/apparmor ${D}/${INIT_D_DIR}/apparmor
 	install ${WORKDIR}/functions ${D}/lib/apparmor
-	if [ "${VIRTUAL-RUNTIME_init_manager}" = "systemd" ]; then
-		install -d ${D}${systemd_system_unitdir}
-		install ${WORKDIR}/apparmor.service \
-			${D}${systemd_system_unitdir}
-	fi
+	install -d ${D}${systemd_system_unitdir}
+	install ${WORKDIR}/apparmor.service ${D}${systemd_system_unitdir}
 }
 
 do_compile_ptest () {
-- 
2.11.0

[meta-security][PATCH 10/11] apparmor: if Perl is disabled remove perl-using scripts

[Ross Burton]

aa-notify uses the Perl bindings, so isn't usable when perl is disabled.

Signed-off-by: Ross Burton <ross.burton@intel.com>
---
 recipes-security/AppArmor/apparmor_2.12.bb | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/recipes-security/AppArmor/apparmor_2.12.bb b/recipes-security/AppArmor/apparmor_2.12.bb
index 92602f3..ac03a56 100644
--- a/recipes-security/AppArmor/apparmor_2.12.bb
+++ b/recipes-security/AppArmor/apparmor_2.12.bb
@@ -86,6 +86,11 @@ do_install () {
 	oe_runmake -C ${B}/parser DESTDIR="${D}" install
 	oe_runmake -C ${B}/profiles DESTDIR="${D}" install
 
+	# If perl is disabled this script won't be any good
+	if ! ${@bb.utils.contains('PACKAGECONFIG','perl','true','false', d)}; then
+		rm -f ${D}${sbindir}/aa-notify
+	fi
+
 	if test -z "${HTTPD}" ; then
 		oe_runmake -C ${B}/changehat/mod_apparmor DESTDIR="${D}" install
 	fi
-- 
2.11.0

[meta-security][PATCH 11/11] apparmor: backport a patch to fix tool paths instead of sedding

[Ross Burton]

Sedding is ugly, and as upstream have already fixed this cherry-pick the patch
instead.

Signed-off-by: Ross Burton <ross.burton@intel.com>
---
 recipes-security/AppArmor/apparmor_2.12.bb       |  3 +-
 recipes-security/AppArmor/files/tool-paths.patch | 37 ++++++++++++++++++++++++
 2 files changed, 38 insertions(+), 2 deletions(-)
 create mode 100644 recipes-security/AppArmor/files/tool-paths.patch

diff --git a/recipes-security/AppArmor/apparmor_2.12.bb b/recipes-security/AppArmor/apparmor_2.12.bb
index ac03a56..efa93e6 100644
--- a/recipes-security/AppArmor/apparmor_2.12.bb
+++ b/recipes-security/AppArmor/apparmor_2.12.bb
@@ -17,6 +17,7 @@ SRC_URI = " \
 	http://archive.ubuntu.com/ubuntu/pool/main/a/${BPN}/${BPN}_${PV}.orig.tar.gz \
 	file://disable_perl_h_check.patch \
 	file://crosscompile_perl_bindings.patch \
+	file://tool-paths.patch \
 	file://apparmor.rc \
 	file://functions \
 	file://apparmor \
@@ -56,8 +57,6 @@ do_configure() {
 	libtoolize --automake -c --force
 	automake -ac
 	./configure ${CONFIGUREOPTS} ${EXTRA_OECONF}
-	sed -i -e 's#^YACC.*#YACC := bison#' ${S}/parser/Makefile
-	sed -i -e 's#^LEX.*#LEX := flex#' ${S}/parser/Makefile
 }
 
 do_compile () {
diff --git a/recipes-security/AppArmor/files/tool-paths.patch b/recipes-security/AppArmor/files/tool-paths.patch
new file mode 100644
index 0000000..aaf08da
--- /dev/null
+++ b/recipes-security/AppArmor/files/tool-paths.patch
@@ -0,0 +1,37 @@
+Upstream-Status: Backport
+Signed-off-by: Ross Burton <ross.burton@intel.com>
+
+From e7edd937adcbf1b3c8d38a31de5bacb2029b1965 Mon Sep 17 00:00:00 2001
+From: John Johansen <john.johansen@canonical.com>
+Date: Thu, 4 Oct 2018 23:15:28 -0700
+Subject: [PATCH] parser: fix Makefile hardcoded paths to flex and bison
+
+The hardcoded paths for flex and python can break builds on systems
+where those tools are stored in an alternate location. Use which
+to lookup where flex and bison are available.
+
+This fixes issue #4
+
+Signed-off-by: John Johansen <john.johansen@canonical.com>
+---
+ parser/Makefile | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/parser/Makefile b/parser/Makefile
+index 4d370c36..015c218d 100644
+--- a/parser/Makefile
++++ b/parser/Makefile
+@@ -27,9 +27,9 @@ INSTALL_CONFDIR=${DESTDIR}${CONFDIR}
+ LOCALEDIR=/usr/share/locale
+ MANPAGES=apparmor.d.5 apparmor.7 apparmor_parser.8 subdomain.conf.5
+ 
+-YACC	:= /usr/bin/bison
++YACC	:= bison
+ YFLAGS	:= -d
+-LEX	:= /usr/bin/flex
++LEX	:= flex
+ LEXFLAGS = -B -v
+ WARNINGS = -Wall
+ EXTRA_WARNINGS = -Wsign-compare -Wmissing-field-initializers -Wformat-security -Wunused-parameter
+-- 
+2.11.0
-- 
2.11.0

Re: [meta-security][PATCH 01/11] README: add git-config tips

[akuster]

On 1/14/19 6:41 AM, Ross Burton wrote:
> Signed-off-by: Ross Burton <ross.burton@intel.com>
> ---
>  README | 7 +++++++
>  1 file changed, 7 insertions(+)

series merged.

thanks
>
> diff --git a/README b/README
> index e238271..c15fea9 100644
> --- a/README
> +++ b/README
> @@ -57,6 +57,13 @@ Send pull requests, patches, comments or questions to yocto@yoctoproject.org
>  When sending single patches, please using something like:
>  'git send-email -1 --to yocto@yoctoproject.org --subject-prefix=meta-security][PATCH'
>  
> +These values can be set as defaults for this repository:
> +
> +$ git config sendemail.to yocto@yoctoproject.org
> +$ git config format.subjectPrefix meta-security][PATCH
> +
> +Now you can just do 'git send-email origin/master' to send all local patches.
> +
>  Maintainers:    Armin Kuster <akuster808@gmail.com>
>                  Saul Wold <sgw@linux.intel.com>
>