13568 2019-10-02 22:05:58 +0000 Multiple issues with AppArmor recipe 2019-10-18 18:55:07 +0000 1 1 7 Build System, Metadata & Runtime Other YP Layers meta-security 2.6.4 All Multiple RESOLVED FIXED with backport Undecided normal 3.1 M4 1 Anders.Montonen akuster --- --- No (bug/feature does not impact docs) oldest_to_newest 85156 0 Anders.Montonen 2019-10-02 22:05:58 +0000 These issues were found with Thud, but I believe they affect all releases. 1. systemd.bbclass will delete the init script installed under /etc/init.d if "sysvinit" is not in DISTRO_FEATURES. This can be worked around with the following kludge: python() { if 'postfuncs' in d.getVarFlags('do_install'): postfuncs = d.getVarFlags('do_install')['postfuncs'].replace('rm_sysvinit_initddir', '') d.setVarFlags('do_install', { 'postfuncs': postfuncs }) } 2. The /lib/apparmor/functions script does not work with BusyBox xargs. Fixed by adding findutils to RDEPENDS. 3. The /lib/apparmor/functions script also requires "getconf", which is explicitly deleted by libc-common.bbclass. 85157 1 akuster 2019-10-02 22:48:28 +0000 Thanks for the defect. How can i reproduce this so that maybe I can fix and test for future regressions? 85203 2 Anders.Montonen 2019-10-03 19:45:33 +0000 I'm using a custom distro based on the demo images from the meta-atmel layer, but I believe the following will suffice: In the distro conf: DISTRO_FEATURES_append = " systemd apparmor" DISTRO_FEATURES_BACKFILL_CONSIDERED += "sysvinit" VIRTUAL-RUNTIME_init_manager = "systemd" VIRTUAL-RUNTIME_initscripts = "systemd-compat-units" Create an apparmor_%.bbappend: PTEST_ENABLED = "0" # The tests do not build SYSTEMD_AUTO_ENABLE = "enable" Add apparmor IMAGE_INSTALL. When the image boots, the apparmor service should start, but currently fails. 85204 3 Anders.Montonen 2019-10-03 21:51:58 +0000 There was another BusyBox incompatibility in the functions script. This is the "works for me" bbappend I ended up with: apparmor_%.bbappend: PTEST_ENABLED = "0" python() { if 'postfuncs' in d.getVarFlags('do_install'): postfuncs = d.getVarFlags('do_install')['postfuncs'].replace('rm_sysvinit_initddir', '') d.setVarFlags('do_install', { 'postfuncs': postfuncs }) } do_install_append() { sed -i -e 's/getconf _NPROCESSORS_ONLN/nproc/' ${D}/lib/apparmor/functions sed -i -e 's/ls -AU/ls -A/' ${D}/lib/apparmor/functions } SYSTEMD_AUTO_ENABLE = "enable" RDEPENDS_${PN}_append = " findutils" 85277 4 akuster 2019-10-09 17:32:39 +0000 I have time to look into this today. 85351 5 akuster 2019-10-16 17:02:39 +0000 patch on list https://patchwork.openembedded.org/patch/165852/ this passes the apparmor test with and w/o systemd enabled. 85395 6 akuster 2019-10-18 18:55:07 +0000 this should be fixed in master and zeus now.