ExternalVendorCode/openwrt
1
0
Fork 0
mirror of https://github.com/openwrt/openwrt.git synced 2025-02-24 18:41:00 +00:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity

buildsystem: add CONFIG_SECCOMP

Browse Source 
Until now, this feature was switched on via the kernel configuration
option KERNEL_SECCOMP.

The follwing change a7f794cd2aa104fdbd4c6e38f9b76373bf9b96e1 now requires that
the package procd-seccomp must also enabled for buildinmg.

However, this is not the case we have no dependency and the imagebuilder
cannot build the image, because of the implicit package selection.

This change adds a new configuration option CONFIG_SECCOMP.
The new option  has the same behaviour as the configuration
option CONFIG_SELINUX.

If the CONFIG_SECCOMP is selected then the package procd-seccomp and
KERNEL_SECCOMP is enabled for this build.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
This commit is contained in:
Florian Eckert 2021-10-15 09:19:12 +02:00 committed by Daniel Golle
parent 3a93704a63
commit b118efa0d2
No known key found for this signature in database
GPG Key ID: 5A8F39C31C3217CA
3 changed files with 14 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
config/Config-build.in
View File

@ -386,4 +386,16 @@ menu "Global build settings"
endchoice
config SECCOMP
bool "Enable SECCOMP"
select KERNEL_SECCOMP
select PACKAGE_procd-seccomp
depends on (aarch64 || arm || armeb || mips || mipsel || i386 || powerpc || x86_64)
depends on !TARGET_uml
default y
help
This option enables seccomp kernel features to safely
execute untrusted bytecode and selects the seccomp-variants
of procd
endmenu

2
include/target.mk
View File

@ -39,7 +39,7 @@ DEFAULT_PACKAGES+=procd-ujail
endif
# include seccomp ld-preload hooks if kernel supports it
ifneq ($(CONFIG_KERNEL_SECCOMP),)
ifneq ($(CONFIG_SECCOMP),)
DEFAULT_PACKAGES+=procd-seccomp
endif

3
package/system/procd/Makefile
View File

@ -82,8 +82,7 @@ endef
define Package/procd-seccomp
SECTION:=base
CATEGORY:=Base system
DEPENDS:=@(aarch64||arm||armeb||mips||mipsel||i386||powerpc||x86_64) @!TARGET_uml \
@KERNEL_SECCOMP +libubox +libblobmsg-json
DEPENDS:=@SECCOMP +libubox +libblobmsg-json
TITLE:=OpenWrt process seccomp helper + utrace
endef