| Summary: | Multiple issues with AppArmor recipe | ||
|---|---|---|---|
| Product: | [Build System, Metadata & Runtime] Other YP Layers | Reporter: | Anders Montonen <Anders.Montonen> |
| Component: | meta-security | Assignee: | Armin Kuster <akuster> |
| Status: | RESOLVED FIXED | QA Contact: | |
| Severity: | normal | ||
| Priority: | Undecided | ||
| Version: | 2.6.4 | ||
| Target Milestone: | 3.1 M4 | ||
| Hardware: | All | ||
| OS: | Multiple | ||
| Whiteboard: | with backport | ||
| OS type for building Yocto: | --- | Type of Regression: | --- |
| Verified: | Documentation change: | No (bug/feature does not impact docs) | |
Thanks for the defect. How can i reproduce this so that maybe I can fix and test for future regressions? I'm using a custom distro based on the demo images from the meta-atmel layer, but I believe the following will suffice: In the distro conf: DISTRO_FEATURES_append = " systemd apparmor" DISTRO_FEATURES_BACKFILL_CONSIDERED += "sysvinit" VIRTUAL-RUNTIME_init_manager = "systemd" VIRTUAL-RUNTIME_initscripts = "systemd-compat-units" Create an apparmor_%.bbappend: PTEST_ENABLED = "0" # The tests do not build SYSTEMD_AUTO_ENABLE = "enable" Add apparmor IMAGE_INSTALL. When the image boots, the apparmor service should start, but currently fails. There was another BusyBox incompatibility in the functions script. This is the "works for me" bbappend I ended up with:
apparmor_%.bbappend:
PTEST_ENABLED = "0"
python() {
if 'postfuncs' in d.getVarFlags('do_install'):
postfuncs = d.getVarFlags('do_install')['postfuncs'].replace('rm_sysvinit_initddir', '')
d.setVarFlags('do_install', { 'postfuncs': postfuncs })
}
do_install_append() {
sed -i -e 's/getconf _NPROCESSORS_ONLN/nproc/' ${D}/lib/apparmor/functions
sed -i -e 's/ls -AU/ls -A/' ${D}/lib/apparmor/functions
}
SYSTEMD_AUTO_ENABLE = "enable"
RDEPENDS_${PN}_append = " findutils"
I have time to look into this today. patch on list https://patchwork.openembedded.org/patch/165852/ this passes the apparmor test with and w/o systemd enabled. this should be fixed in master and zeus now. |
These issues were found with Thud, but I believe they affect all releases. 1. systemd.bbclass will delete the init script installed under /etc/init.d if "sysvinit" is not in DISTRO_FEATURES. This can be worked around with the following kludge: python() { if 'postfuncs' in d.getVarFlags('do_install'): postfuncs = d.getVarFlags('do_install')['postfuncs'].replace('rm_sysvinit_initddir', '') d.setVarFlags('do_install', { 'postfuncs': postfuncs }) } 2. The /lib/apparmor/functions script does not work with BusyBox xargs. Fixed by adding findutils to RDEPENDS. 3. The /lib/apparmor/functions script also requires "getconf", which is explicitly deleted by libc-common.bbclass.