From 6531eee347709a4b5f2e74cca8f907c2ec18321f Mon Sep 17 00:00:00 2001 From: Thomas Petazzoni Date: Tue, 11 Aug 2020 09:43:51 -0500 Subject: [PATCH 01/11] libsepol: add new package Signed-off-by: Thomas Petazzoni [rebase, update to 3.1] Signed-off-by: W. Michael Petullo --- package/libs/libsepol/Makefile | 66 ++++++++++++++++++++++++++++++++++ 1 file changed, 66 insertions(+) create mode 100644 package/libs/libsepol/Makefile diff --git a/package/libs/libsepol/Makefile b/package/libs/libsepol/Makefile new file mode 100644 index 0000000000..cd49ed008d --- /dev/null +++ b/package/libs/libsepol/Makefile @@ -0,0 +1,66 @@ +# +# This is free software, licensed under the GNU General Public License v2. +# See /LICENSE for more information. +# + +include $(TOPDIR)/rules.mk + +PKG_NAME:=libsepol +PKG_VERSION:=3.1 +PKG_RELEASE:=1 + +PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz +PKG_SOURCE_URL:=https://github.com/SELinuxProject/selinux/releases/download/20200710 +PKG_HASH:=ae6778d01443fdd38cd30eeee846494e19f4d407b09872580372f4aa4bf8a3cc + +PKG_MAINTAINER:=Thomas Petazzoni + +include $(INCLUDE_DIR)/package.mk + +define Package/libsepol + SECTION:=libs + CATEGORY:=Libraries + TITLE:=SELinux binary policy manipulation library + URL:=http://selinuxproject.org/page/Main_Page +endef + +define Package/libsepol/description + Libsepol is the binary policy manipulation library. It doesn't + depend upon or use any of the other SELinux components. +endef #' + +include $(INCLUDE_DIR)/host-build.mk + +HOST_MAKE_FLAGS += \ + PREFIX=$(STAGING_DIR_HOSTPKG) \ + SHLIBDIR=$(STAGING_DIR_HOSTPKG)/lib + +MAKE_FLAGS += \ + SHLIBDIR=/usr/lib + +define Build/Compile + $(call Build/Compile/Default,all) +endef + +define Build/Install + $(call Build/Install/Default,install) +endef + +define Build/InstallDev + $(INSTALL_DIR) $(1)/usr/include + $(CP) $(PKG_INSTALL_DIR)/usr/include/* $(1)/usr/include/ + $(INSTALL_DIR) $(1)/usr/lib + $(CP) $(PKG_INSTALL_DIR)/usr/lib/* $(1)/usr/lib/ + $(INSTALL_DIR) $(1)/usr/lib/pkgconfig + $(INSTALL_DATA) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/libsepol.pc $(1)/usr/lib/pkgconfig/ + $(SED) 's,/usr/include,$$$${prefix}/include,g' $(1)/usr/lib/pkgconfig/libsepol.pc + $(SED) 's,/usr/lib,$$$${exec_prefix}/lib,g' $(1)/usr/lib/pkgconfig/libsepol.pc +endef + +define Package/libsepol/install + $(INSTALL_DIR) $(1)/usr/lib + $(CP) $(PKG_INSTALL_DIR)/usr/lib/libsepol.so.* $(1)/usr/lib/ +endef + +$(eval $(call HostBuild)) +$(eval $(call BuildPackage,libsepol)) From a0df664531325ab8603b1b5d2c1b8c99303138c7 Mon Sep 17 00:00:00 2001 From: Thomas Petazzoni Date: Tue, 11 Aug 2020 18:48:33 -0500 Subject: [PATCH 02/11] libselinux: add new package Signed-off-by: Thomas Petazzoni [rebase, update to 3.1] Signed-off-by: W. Michael Petullo --- package/libs/libselinux/Makefile | 79 ++++++++++++++++++++++++++++++++ 1 file changed, 79 insertions(+) create mode 100644 package/libs/libselinux/Makefile diff --git a/package/libs/libselinux/Makefile b/package/libs/libselinux/Makefile new file mode 100644 index 0000000000..893476f5de --- /dev/null +++ b/package/libs/libselinux/Makefile @@ -0,0 +1,79 @@ +# +# This is free software, licensed under the GNU General Public License v2. +# See /LICENSE for more information. +# + +include $(TOPDIR)/rules.mk + +PKG_NAME:=libselinux +PKG_VERSION:=3.1 +PKG_RELEASE:=1 + +PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz +PKG_SOURCE_URL:=https://github.com/SELinuxProject/selinux/releases/download/20200710 +PKG_HASH:=ea5dcbb4d859e3f999c26a13c630da2f16dff9462e3cc8cb7b458ac157d112e7 +HOST_BUILD_DEPENDS:=libsepol/host pcre/host + +PKG_MAINTAINER:=Thomas Petazzoni + +include $(INCLUDE_DIR)/package.mk + +define Package/libselinux + SECTION:=libs + DEPENDS:=+libsepol +libpcre +musl-fts +@KERNEL_SECURITY +@KERNEL_SECURITY_NETWORK +@KERNEL_SECURITY_SELINUX + CATEGORY:=Libraries + TITLE:=Runtime SELinux library + URL:=http://selinuxproject.org/page/Main_Page +endef + +define Package/libselinux/description + libselinux is the runtime SELinux library that provides + interfaces (e.g. library functions for the SELinux kernel + APIs like getcon(), other support functions like + getseuserbyname()) to SELinux-aware applications. libselinux + may use the shared libsepol to manipulate the binary policy + if necessary (e.g. to downgrade the policy format to an + older version supported by the kernel) when loading policy. +endef + +include $(INCLUDE_DIR)/host-build.mk + +# Needed to link libselinux utilities, which link against +# libselinux.so, which indirectly depends on libpcre.so, installed in +# $(STAGING_DIR_HOSTPKG). +HOST_LDFLAGS += -Wl,-rpath="$(STAGING_DIR_HOSTPKG)/lib" + +HOST_MAKE_FLAGS += \ + PREFIX=$(STAGING_DIR_HOSTPKG) \ + SHLIBDIR=$(STAGING_DIR_HOSTPKG)/lib + +MAKE_FLAGS += \ + FTS_LDLIBS=-lfts \ + SHLIBDIR=/usr/lib \ + +define Build/Compile + $(call Build/Compile/Default,all) +endef + +define Build/Install + $(call Build/Install/Default,install) +endef + +define Build/InstallDev + $(INSTALL_DIR) $(1)/usr/include + $(CP) $(PKG_INSTALL_DIR)/usr/include/* $(1)/usr/include/ + $(INSTALL_DIR) $(1)/usr/lib + $(CP) $(PKG_INSTALL_DIR)/usr/lib/* $(1)/usr/lib/ + $(INSTALL_DIR) $(1)/usr/lib/pkgconfig + $(INSTALL_DATA) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/libselinux.pc $(1)/usr/lib/pkgconfig/ + $(SED) 's,/usr/include,$$$${prefix}/include,g' $(1)/usr/lib/pkgconfig/libselinux.pc + $(SED) 's,/usr/lib,$$$${exec_prefix}/lib,g' $(1)/usr/lib/pkgconfig/libselinux.pc +endef + +define Package/libselinux/install + $(INSTALL_DIR) $(1)/usr/lib + $(CP) $(PKG_INSTALL_DIR)/usr/lib/libselinux.so.* $(1)/usr/lib/ +endef + +$(eval $(call HostBuild)) +$(eval $(call BuildPackage,libselinux)) From 962e73c1a42ec1ef7cc6ba7574204688f90d64a0 Mon Sep 17 00:00:00 2001 From: Paul Spooren Date: Tue, 11 Aug 2020 18:49:44 -1000 Subject: [PATCH 03/11] procd: add selinux variant This commit adds a `selinux` variant to `procd` allowing to load an SELinux policy at boot. Signed-off-by: Paul Spooren Signed-off-by: Daniel Golle --- package/system/procd/Makefile | 38 ++++++++++++++++++++++++++++------- 1 file changed, 31 insertions(+), 7 deletions(-) diff --git a/package/system/procd/Makefile b/package/system/procd/Makefile index 17a871b15c..e3f538e066 100644 --- a/package/system/procd/Makefile +++ b/package/system/procd/Makefile @@ -41,18 +41,34 @@ TARGET_LDFLAGS += $(if $(CONFIG_USE_GLIBC),-lrt) TARGET_CFLAGS += -flto TARGET_LDFLAGS += -flto -define Package/procd +define Package/procd/Default SECTION:=base CATEGORY:=Base system - DEPENDS:=+ubusd +ubus +libjson-script +ubox +USE_GLIBC:librt +libubox +libubus +libblobmsg-json +libjson-c +PACKAGE_libselinux:libselinux + DEPENDS:=+ubusd +ubus +libjson-script +ubox +USE_GLIBC:librt +libubox \ + +libubus +libblobmsg-json +libjson-c TITLE:=OpenWrt system process manager USERID:=:dialout=20 :audio=29 endef +define Package/procd + $(call Package/procd/Default) + VARIANT:=default + CONFLICTS:=procd-selinux +endef + +define Package/procd-selinux + $(call Package/procd/Default) + DEPENDS += +libselinux + TITLE += with SELinux support + PROVIDES:=procd + VARIANT:=selinux +endef + define Package/procd-ujail SECTION:=base CATEGORY:=Base system - DEPENDS:=@KERNEL_NAMESPACES +@KERNEL_UTS_NS +@KERNEL_IPC_NS +@KERNEL_PID_NS +libubox +libubus +libblobmsg-json + DEPENDS:=@KERNEL_NAMESPACES +@KERNEL_UTS_NS +@KERNEL_IPC_NS +@KERNEL_PID_NS \ + +libubox +libubus +libblobmsg-json TITLE:=OpenWrt process jail helper endef @@ -66,7 +82,8 @@ endef define Package/procd-seccomp SECTION:=base CATEGORY:=Base system - DEPENDS:=@(arm||armeb||mips||mipsel||i386||powerpc||x86_64) @!TARGET_uml @KERNEL_SECCOMP +libubox +libblobmsg-json + DEPENDS:=@(arm||armeb||mips||mipsel||i386||powerpc||x86_64) @!TARGET_uml \ + @KERNEL_SECCOMP +libubox +libblobmsg-json TITLE:=OpenWrt process seccomp helper + utrace endef @@ -80,7 +97,7 @@ endef define Package/procd/config menu "Configuration" - depends on PACKAGE_procd + depends on PACKAGE_procd || PACKAGE_procd-selinux config PROCD_SHOW_BOOT bool @@ -94,6 +111,11 @@ config PROCD_ZRAM_TMPFS endmenu endef +Package/procd-selinux/config = $(Package/procd/config) + +ifeq ($(BUILD_VARIANT),selinux) + CMAKE_OPTIONS += -DSELINUX=1 +endif ifeq ($(CONFIG_PROCD_SHOW_BOOT),y) CMAKE_OPTIONS += -DSHOW_BOOT_ON_CONSOLE=1 @@ -108,8 +130,7 @@ ifdef CONFIG_PACKAGE_procd-ujail endif SECCOMP=$(if $(CONFIG_PACKAGE_procd-seccomp),1,0) -SELINUX=$(if $(CONFIG_PACKAGE_libselinux),1,0) -CMAKE_OPTIONS += -DSECCOMP_SUPPORT=$(SECCOMP) -DUTRACE_SUPPORT=$(SECCOMP) -DSELINUX=$(SELINUX) +CMAKE_OPTIONS += -DSECCOMP_SUPPORT=$(SECCOMP) -DUTRACE_SUPPORT=$(SECCOMP) define Package/procd/install $(INSTALL_DIR) $(1)/sbin $(1)/etc $(1)/lib/functions @@ -121,6 +142,8 @@ define Package/procd/install $(INSTALL_DATA) ./files/procd.sh $(1)/lib/functions/ endef +Package/procd-selinux/install = $(Package/procd/install) + define Package/procd-ujail/install $(INSTALL_DIR) $(1)/sbin $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/ujail $(1)/sbin/ @@ -151,6 +174,7 @@ define Package/uxc/install endef $(eval $(call BuildPackage,procd)) +$(eval $(call BuildPackage,procd-selinux)) $(eval $(call BuildPackage,procd-ujail)) $(eval $(call BuildPackage,procd-ujail-console)) $(eval $(call BuildPackage,procd-seccomp)) From e16b84df15c1eac7b389fb715c9d00969acf3b30 Mon Sep 17 00:00:00 2001 From: Daniel Golle Date: Thu, 13 Aug 2020 11:27:39 +0100 Subject: [PATCH 04/11] pcre: import from packages feeds libselinux require pcre, import to to core so it can build without packages feeds. Signed-off-by: Daniel Golle --- package/libs/pcre/Config.in | 11 ++++ package/libs/pcre/Makefile | 119 ++++++++++++++++++++++++++++++++++++ 2 files changed, 130 insertions(+) create mode 100644 package/libs/pcre/Config.in create mode 100644 package/libs/pcre/Makefile diff --git a/package/libs/pcre/Config.in b/package/libs/pcre/Config.in new file mode 100644 index 0000000000..15e75fc753 --- /dev/null +++ b/package/libs/pcre/Config.in @@ -0,0 +1,11 @@ +config PCRE_JIT_ENABLED + bool + depends on PACKAGE_libpcre && (arm || i386 || i686 || x86_64 || mips || mipsel || powerpc || sparc) + default y if (arm || i686 || x86_64) + prompt "Enable JIT compiler support" + help + Enable JIT (Just-In-Time) compiler support. + + Enabling this option can give an about 10x performance increase on JIT operations. It can be desireable for e.g. high performance Apache mod_rewrite or HA-Proxy reqrep operations. + + However, JIT should _only_ be enabled on architectures that are supported. Enabling JIT on unsupported platforms will result in a compilation failure. A list of supported architectures can be found here: https://pcre.org/original/doc/html/pcrejit.html#SEC3 . diff --git a/package/libs/pcre/Makefile b/package/libs/pcre/Makefile new file mode 100644 index 0000000000..b638c876da --- /dev/null +++ b/package/libs/pcre/Makefile @@ -0,0 +1,119 @@ +# +# Copyright (C) 2006-2015 OpenWrt.org +# +# This is free software, licensed under the GNU General Public License v2. +# See /LICENSE for more information. +# + +include $(TOPDIR)/rules.mk + +PKG_NAME:=pcre +PKG_VERSION:=8.44 +PKG_RELEASE:=2 + +PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2 +PKG_SOURCE_URL:=@SF/$(PKG_NAME) +PKG_HASH:=19108658b23b3ec5058edc9f66ac545ea19f9537234be1ec62b714c84399366d + +PKG_MAINTAINER:=Thomas Heil +PKG_LICENSE:=BSD-3-Clause +PKG_LICENSE_FILES:=LICENCE +PKG_CPE_ID:=cpe:/a:pcre:pcre + +PKG_INSTALL:=1 +PKG_BUILD_PARALLEL:=1 + +PKG_CONFIG_DEPENDS:=\ + CONFIG_PACKAGE_libpcrecpp \ + CONFIG_PCRE_JIT_ENABLED + +include $(INCLUDE_DIR)/uclibc++.mk +include $(INCLUDE_DIR)/package.mk + +define Package/libpcre/default + SECTION:=libs + CATEGORY:=Libraries + URL:=https://www.pcre.org/ +endef + +define Package/libpcre/config + source "$(SOURCE)/Config.in" +endef + +define Package/libpcre + $(call Package/libpcre/default) + TITLE:=A Perl Compatible Regular Expression library +endef + +define Package/libpcre16 + $(call Package/libpcre/default) + TITLE:=A Perl Compatible Regular Expression library (16bit support) +endef + +define Package/libpcre32 + $(call Package/libpcre/default) + TITLE:=A Perl Compatible Regular Expression library (32bit support) +endef + +define Package/libpcrecpp + $(call Package/libpcre/default) + TITLE:=C++ wrapper for Perl Compatible Regular Expression library + DEPENDS:=+libpcre $(CXX_DEPENDS) +endef + +TARGET_CFLAGS += $(FPIC) + +CONFIGURE_ARGS += \ + --enable-utf8 \ + --enable-unicode-properties \ + --enable-pcre16 \ + --enable-pcre32 \ + $(if $(CONFIG_PCRE_JIT_ENABLED),--enable-jit,--disable-jit) \ + --with-match-limit-recursion=16000 \ + $(if $(CONFIG_PACKAGE_libpcrecpp),--enable,--disable)-cpp + +MAKE_FLAGS += \ + CFLAGS="$(TARGET_CFLAGS)" + +define Build/InstallDev + $(INSTALL_DIR) $(1)/usr/bin + $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/pcre-config $(1)/usr/bin/ + + $(INSTALL_DIR) $(2)/bin + $(LN) $(STAGING_DIR)/usr/bin/pcre-config $(2)/bin + + $(INSTALL_DIR) $(1)/usr/include + $(CP) $(PKG_INSTALL_DIR)/usr/include/pcre*.h $(1)/usr/include/ + + $(INSTALL_DIR) $(1)/usr/lib + $(CP) $(PKG_INSTALL_DIR)/usr/lib/libpcre*.{a,so*} $(1)/usr/lib/ + + $(INSTALL_DIR) $(1)/usr/lib/pkgconfig + $(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/libpcre*.pc $(1)/usr/lib/pkgconfig/ +endef + +define Package/libpcre/install + $(INSTALL_DIR) $(1)/usr/lib + $(CP) $(PKG_INSTALL_DIR)/usr/lib/libpcre{,posix}.so.* $(1)/usr/lib/ + $(CP) $(PKG_INSTALL_DIR)/usr/lib/libpcre.so $(1)/usr/lib/ +endef + +define Package/libpcre16/install + $(INSTALL_DIR) $(1)/usr/lib + $(CP) $(PKG_INSTALL_DIR)/usr/lib/libpcre16.so* $(1)/usr/lib/ +endef + +define Package/libpcre32/install + $(INSTALL_DIR) $(1)/usr/lib + $(CP) $(PKG_INSTALL_DIR)/usr/lib/libpcre32.so* $(1)/usr/lib/ +endef + +define Package/libpcrecpp/install + $(INSTALL_DIR) $(1)/usr/lib + $(CP) $(PKG_INSTALL_DIR)/usr/lib/libpcrecpp.so.* $(1)/usr/lib/ +endef + +$(eval $(call BuildPackage,libpcre)) +$(eval $(call BuildPackage,libpcre16)) +$(eval $(call BuildPackage,libpcre32)) +$(eval $(call BuildPackage,libpcrecpp)) From ab4c6f1632f0691da969e2e42e14719716c90485 Mon Sep 17 00:00:00 2001 From: Daniel Golle Date: Thu, 13 Aug 2020 11:43:18 +0100 Subject: [PATCH 05/11] musl-fts: import from packages feed libselinux requires musl-fts to build with musl. Import it from packages feed as well. Signed-off-by: Daniel Golle --- package/libs/musl-fts/Makefile | 60 ++++++++++++++++++++++++++++++++++ 1 file changed, 60 insertions(+) create mode 100644 package/libs/musl-fts/Makefile diff --git a/package/libs/musl-fts/Makefile b/package/libs/musl-fts/Makefile new file mode 100644 index 0000000000..494f700f8a --- /dev/null +++ b/package/libs/musl-fts/Makefile @@ -0,0 +1,60 @@ +# +# Copyright (C) 2017 Lucian Cristian +# +# This is free software, licensed under the GNU General Public License v2. +# See /LICENSE for more information. +# updated to work with latest source from abrasive +# + +include $(TOPDIR)/rules.mk + +PKG_NAME:=musl-fts +PKG_VERSION:=1.2.7 +PKG_RELEASE:=1 + +PKG_SOURCE_PROTO:=git +PKG_SOURCE_URL:=https://github.com/pullmoll/musl-fts.git +PKG_SOURCE_VERSION:=0bde52df588e8969879a2cae51c3a4774ec62472 +PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz +PKG_MIRROR_HASH:=29c62a600128e9189b1b2e1aea568546178eedf739527f657873b3b773072ecb + +PKG_MAINTAINER:=Lucian Cristian + +PKG_LICENSE:=LGPL-2.1 +PKG_LICENSE_FILES:=COPYING AUTHORS + +PKG_FIXUP:=autoreconf +PKG_REMOVE_FILES:=autogen.sh + +PKG_BUILD_PARALLEL:=1 +PKG_INSTALL:=1 + +include $(INCLUDE_DIR)/package.mk + +define Package/musl-fts + SECTION:=libs + CATEGORY:=Libraries + TITLE:=fts implementation for musl libc + URL:=https://github.com/pullmoll/musl-fts + DEPENDS:= +libpthread +endef + +define Package/musl-fts/description + The musl-fts package implements the fts(3) functions fts_open, fts_read, fts_children, fts_set and fts_close, which are missing in musl libc. +endef + + +define Build/InstallDev + $(INSTALL_DIR) $(1)/usr/include + $(CP) $(PKG_INSTALL_DIR)/usr/include/fts.h $(1)/usr/include/ + $(INSTALL_DIR) $(1)/usr/lib/pkgconfig + $(CP) $(PKG_INSTALL_DIR)/usr/lib/libfts.so* $(1)/usr/lib/ + $(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/musl-fts.pc $(1)/usr/lib/pkgconfig/ +endef + +define Package/musl-fts/install + $(INSTALL_DIR) $(1)/usr/lib + $(CP) $(PKG_INSTALL_DIR)/usr/lib/libfts.so* $(1)/usr/lib/ +endef + +$(eval $(call BuildPackage,musl-fts)) From ddf3e5c22d8a9706e92920a16ee74ee8c16b2ce3 Mon Sep 17 00:00:00 2001 From: Adrian Schmutzler Date: Wed, 12 Aug 2020 20:10:12 +0200 Subject: [PATCH 06/11] ramips/mt7621: create common DTSI for Mikrotik devices This moves some common definitions for Mikrotik devices, mainly routerboot partitions and reset key, to a common DTSI file. While at it, remove unused hard_config DT label. Signed-off-by: Adrian Schmutzler --- target/linux/ramips/dts/mt7621_mikrotik.dtsi | 72 +++++++++++++++ .../mt7621_mikrotik_routerboard-750gr3.dts | 89 +++---------------- .../dts/mt7621_mikrotik_routerboard-m11g.dts | 77 ++-------------- .../dts/mt7621_mikrotik_routerboard-m33g.dts | 69 +------------- 4 files changed, 93 insertions(+), 214 deletions(-) create mode 100644 target/linux/ramips/dts/mt7621_mikrotik.dtsi diff --git a/target/linux/ramips/dts/mt7621_mikrotik.dtsi b/target/linux/ramips/dts/mt7621_mikrotik.dtsi new file mode 100644 index 0000000000..1fc523ea14 --- /dev/null +++ b/target/linux/ramips/dts/mt7621_mikrotik.dtsi @@ -0,0 +1,72 @@ +// SPDX-License-Identifier: GPL-2.0-or-later OR MIT + +#include "mt7621.dtsi" + +#include +#include + +/ { + chosen { + bootargs = "console=ttyS0,115200"; + }; + + keys: keys { + compatible = "gpio-keys"; + + reset { + label = "reset"; + gpios = <&gpio 18 GPIO_ACTIVE_LOW>; + linux,code = ; + }; + }; +}; + +&spi0 { + status = "okay"; + + flash@0 { + compatible = "jedec,spi-nor"; + reg = <0>; + spi-max-frequency = <33000000>; + + partitions: partitions { + compatible = "fixed-partitions"; + #address-cells = <1>; + #size-cells = <1>; + + partition@0 { + label = "RouterBoot"; + reg = <0x0 0x40000>; + read-only; + compatible = "mikrotik,routerboot-partitions"; + #address-cells = <1>; + #size-cells = <1>; + + partition@0 { + label = "bootloader1"; + reg = <0x0 0x0>; + read-only; + }; + + hard_config { + read-only; + }; + + partition@10000 { + label = "bootloader2"; + reg = <0x10000 0xf000>; + read-only; + }; + + soft_config { + }; + + partition@30000 { + label = "bios"; + reg = <0x30000 0x1000>; + read-only; + }; + }; + }; + }; +}; diff --git a/target/linux/ramips/dts/mt7621_mikrotik_routerboard-750gr3.dts b/target/linux/ramips/dts/mt7621_mikrotik_routerboard-750gr3.dts index f767599e98..60315a46e7 100644 --- a/target/linux/ramips/dts/mt7621_mikrotik_routerboard-750gr3.dts +++ b/target/linux/ramips/dts/mt7621_mikrotik_routerboard-750gr3.dts @@ -1,10 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-or-later OR MIT /dts-v1/; -#include "mt7621.dtsi" - -#include -#include +#include "mt7621_mikrotik.dtsi" / { compatible = "mikrotik,routerboard-750gr3", "mediatek,mt7621-soc"; @@ -17,10 +14,6 @@ led-upgrade = &led_usr; }; - chosen { - bootargs = "console=ttyS0,115200"; - }; - leds { compatible = "gpio-leds"; @@ -36,22 +29,6 @@ }; }; - keys { - compatible = "gpio-keys"; - - mode { - label = "mode"; - gpios = <&gpio 13 GPIO_ACTIVE_LOW>; - linux,code = ; - }; - - reset { - label = "reset"; - gpios = <&gpio 18 GPIO_ACTIVE_LOW>; - linux,code = ; - }; - }; - gpio_export { compatible = "gpio-export"; #size-cells = <0>; @@ -71,59 +48,19 @@ }; }; -&spi0 { - status = "okay"; +&keys { + mode { + label = "mode"; + gpios = <&gpio 13 GPIO_ACTIVE_LOW>; + linux,code = ; + }; +}; - flash@0 { - compatible = "jedec,spi-nor"; - reg = <0>; - spi-max-frequency = <20000000>; - - partitions { - compatible = "fixed-partitions"; - #address-cells = <1>; - #size-cells = <1>; - - partition@0 { - label = "RouterBoot"; - reg = <0x0 0x40000>; - read-only; - compatible = "mikrotik,routerboot-partitions"; - #address-cells = <1>; - #size-cells = <1>; - - partition@0 { - label = "bootloader1"; - reg = <0x0 0x0>; - read-only; - }; - - hard_config: hard_config { - read-only; - }; - - partition@10000 { - label = "bootloader2"; - reg = <0x10000 0xf000>; - read-only; - }; - - soft_config { - }; - - partition@30000 { - label = "bios"; - reg = <0x30000 0x1000>; - read-only; - }; - }; - - partition@40000 { - compatible = "mikrotik,minor"; - label = "firmware"; - reg = <0x040000 0xfc0000>; - }; - }; +&partitions { + partition@40000 { + compatible = "mikrotik,minor"; + label = "firmware"; + reg = <0x040000 0xfc0000>; }; }; diff --git a/target/linux/ramips/dts/mt7621_mikrotik_routerboard-m11g.dts b/target/linux/ramips/dts/mt7621_mikrotik_routerboard-m11g.dts index cb13590017..4e352bb122 100644 --- a/target/linux/ramips/dts/mt7621_mikrotik_routerboard-m11g.dts +++ b/target/linux/ramips/dts/mt7621_mikrotik_routerboard-m11g.dts @@ -1,9 +1,6 @@ /dts-v1/; -#include "mt7621.dtsi" - -#include -#include +#include "mt7621_mikrotik.dtsi" / { compatible = "mikrotik,routerboard-m11g", "mediatek,mt7621-soc"; @@ -16,10 +13,6 @@ led-upgrade = &led_usr; }; - chosen { - bootargs = "console=ttyS0,115200"; - }; - leds { compatible = "gpio-leds"; @@ -54,16 +47,6 @@ }; }; - keys { - compatible = "gpio-keys"; - - res { - label = "reset"; - gpios = <&gpio 18 GPIO_ACTIVE_LOW>; - linux,code = ; - }; - }; - pcie0_vcc_reg { compatible = "regulator-fixed"; regulator-name = "pcie0_vcc"; @@ -77,59 +60,11 @@ }; }; -&spi0 { - status = "okay"; - - flash@0 { - compatible = "jedec,spi-nor"; - reg = <0>; - spi-max-frequency = <33000000>; - - partitions { - compatible = "fixed-partitions"; - #address-cells = <1>; - #size-cells = <1>; - - partition@0 { - label = "RouterBoot"; - reg = <0x0 0x40000>; - read-only; - compatible = "mikrotik,routerboot-partitions"; - #address-cells = <1>; - #size-cells = <1>; - - partition@0 { - label = "bootloader1"; - reg = <0x0 0x0>; - read-only; - }; - - hard_config: hard_config { - read-only; - }; - - partition@10000 { - label = "bootloader2"; - reg = <0x10000 0xf000>; - read-only; - }; - - soft_config { - }; - - partition@30000 { - label = "bios"; - reg = <0x30000 0x1000>; - read-only; - }; - }; - - partition@40000 { - compatible = "mikrotik,minor"; - label = "firmware"; - reg = <0x040000 0xFC0000>; - }; - }; +&partitions { + partition@40000 { + compatible = "mikrotik,minor"; + label = "firmware"; + reg = <0x040000 0xfc0000>; }; }; diff --git a/target/linux/ramips/dts/mt7621_mikrotik_routerboard-m33g.dts b/target/linux/ramips/dts/mt7621_mikrotik_routerboard-m33g.dts index ebe85b09a1..48d368a5a9 100644 --- a/target/linux/ramips/dts/mt7621_mikrotik_routerboard-m33g.dts +++ b/target/linux/ramips/dts/mt7621_mikrotik_routerboard-m33g.dts @@ -1,9 +1,6 @@ /dts-v1/; -#include "mt7621.dtsi" - -#include -#include +#include "mt7621_mikrotik.dtsi" / { compatible = "mikrotik,routerboard-m33g", "mediatek,mt7621-soc"; @@ -16,10 +13,6 @@ led-upgrade = &led_usr; }; - chosen { - bootargs = "console=ttyS0,115200"; - }; - leds { compatible = "gpio-leds"; @@ -29,16 +22,6 @@ }; }; - keys { - compatible = "gpio-keys"; - - res { - label = "res"; - gpios = <&gpio 18 GPIO_ACTIVE_LOW>; - linux,code = ; - }; - }; - pcie0_vcc_reg { compatible = "regulator-fixed"; regulator-name = "pcie0_vcc"; @@ -88,54 +71,6 @@ }; &spi0 { - status = "okay"; - - flash@0 { - compatible = "jedec,spi-nor"; - reg = <0>; - spi-max-frequency = <33000000>; - - partitions { - compatible = "fixed-partitions"; - #address-cells = <1>; - #size-cells = <1>; - - partition@0 { - label = "RouterBoot"; - reg = <0x0 0x40000>; - read-only; - compatible = "mikrotik,routerboot-partitions"; - #address-cells = <1>; - #size-cells = <1>; - - partition@0 { - label = "bootloader1"; - reg = <0x0 0x0>; - read-only; - }; - - hard_config: hard_config { - read-only; - }; - - partition@10000 { - label = "bootloader2"; - reg = <0x10000 0xf000>; - read-only; - }; - - soft_config { - }; - - partition@30000 { - label = "bios"; - reg = <0x30000 0x1000>; - read-only; - }; - }; - }; - }; - flash@1 { compatible = "jedec,spi-nor"; reg = <1>; @@ -151,7 +86,7 @@ partition@40000 { compatible = "mikrotik,minor"; label = "firmware"; - reg = <0x040000 0xFC0000>; + reg = <0x040000 0xfc0000>; }; }; }; From 74438d54198d928d68c695da15b35aebfbecf27b Mon Sep 17 00:00:00 2001 From: John Thomson Date: Thu, 11 Jun 2020 08:15:40 +1000 Subject: [PATCH 07/11] ramips: add support for MikroTik RouterBOARD 760iGS (hEX S) This patch adds support for the MikroTik RouterBOARD 760iGS router. It is similar to the already supported RouterBOARD 750Gr3. The 760iGS device features an added SFP cage, and passive PoE out on port 5 compared to the RB750Gr3. https://mikrotik.com/product/hex_s Specifications: - SoC: MediaTek MT7621A - CPU: 880MHz - Flash: 16 MB - RAM: 256 MB - Ethernet: 5x 10/100/1000 Mbps - SFP cage - USB port - microSD slot Unsupported: - Beeper (requires PWM driver) - ZT2046Q (ADS7846 compatible) on SPI as slave 1 (CS1) The linux driver requires an interrupt, and pendown GPIO These are unknown, and not needed with the touchscreen only used for temperature and voltage monitoring. ads7846 hwmon: temp0 is degrees Celsius temp1 is voltage * 32 GPIOs: - 07: input passive PoE out (lan5) compatible (Mikrotik) device connected - 17: output passive PoE out (lan5) switch Installation through RouterBoot follows the usual MikroTik method https://openwrt.org/toh/mikrotik/common To boot to intramfs image in RAM: 1. Setup TFTP server to serve intramfs image. 2. Plug Ethernet cable into WAN port. 3. Unplug power, hold reset button and plug power in. Wait (~25 seconds) for beep and then release reset button. The SFP LED will be lit in RouterBoot, but will not be lit in OpenWRT. 4. Wait for a minute. Router should be running OpenWrt, check by plugging in to port 2-5 and going to 192.168.1.1. To install OpenWrt to flash: 1. Follow steps above to boot intramfs image in RAM. 2. Flash the sysupgrade.bin image with web interface or sysupgrade. 3. Once the router reboots you will be running OpenWrt from flash. OEM firmware differences: - RouterOS assigns a different MAC address for each port - The first address (E01 on the sticker) is used for wan (ether1 in OEM). - The next address is used for lan2. - The last address (E06 on the sticker) is used for sfp. [Initial port work, shared dtsi] Signed-off-by: Vince Grassia [SFP support and GPIO identification] Signed-off-by: Luka Logar [Misc. fixes and submission] Signed-off-by: John Thomson [rebase, drop uart3 from state_default on 750gr3, minor commit title/message facelift] Signed-off-by: Adrian Schmutzler --- .../mt7621_mikrotik_routerboard-750gr3.dts | 72 +------------------ .../mt7621_mikrotik_routerboard-760igs.dts | 69 ++++++++++++++++++ .../dts/mt7621_mikrotik_routerboard-7xx.dtsi | 72 +++++++++++++++++++ target/linux/ramips/image/mt7621.mk | 7 ++ .../mt7621/base-files/etc/board.d/01_leds | 3 + .../mt7621/base-files/etc/board.d/02_network | 4 ++ .../base-files/etc/board.d/03_gpio_switches | 3 + .../mt7621/base-files/lib/upgrade/platform.sh | 1 + 8 files changed, 161 insertions(+), 70 deletions(-) create mode 100644 target/linux/ramips/dts/mt7621_mikrotik_routerboard-760igs.dts create mode 100644 target/linux/ramips/dts/mt7621_mikrotik_routerboard-7xx.dtsi diff --git a/target/linux/ramips/dts/mt7621_mikrotik_routerboard-750gr3.dts b/target/linux/ramips/dts/mt7621_mikrotik_routerboard-750gr3.dts index 60315a46e7..baa42ee8ed 100644 --- a/target/linux/ramips/dts/mt7621_mikrotik_routerboard-750gr3.dts +++ b/target/linux/ramips/dts/mt7621_mikrotik_routerboard-750gr3.dts @@ -1,7 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-or-later OR MIT /dts-v1/; -#include "mt7621_mikrotik.dtsi" +#include "mt7621_mikrotik_routerboard-7xx.dtsi" / { compatible = "mikrotik,routerboard-750gr3", "mediatek,mt7621-soc"; @@ -28,79 +28,11 @@ gpios = <&gpio 0 GPIO_ACTIVE_HIGH>; }; }; - - gpio_export { - compatible = "gpio-export"; - #size-cells = <0>; - - buzzer { - /* Beeper requires PWM for frequency selection */ - gpio-export,name = "buzzer"; - gpio-export,output = <0>; - gpios = <&gpio 15 GPIO_ACTIVE_HIGH>; - }; - - usb_power { - gpio-export,name = "usb_power"; - gpio-export,output = <1>; - gpios = <&gpio 12 GPIO_ACTIVE_HIGH>; - }; - }; -}; - -&keys { - mode { - label = "mode"; - gpios = <&gpio 13 GPIO_ACTIVE_LOW>; - linux,code = ; - }; -}; - -&partitions { - partition@40000 { - compatible = "mikrotik,minor"; - label = "firmware"; - reg = <0x040000 0xfc0000>; - }; -}; - -&switch0 { - ports { - port@0 { - status = "okay"; - label = "wan"; - }; - - port@1 { - status = "okay"; - label = "lan2"; - }; - - port@2 { - status = "okay"; - label = "lan3"; - }; - - port@3 { - status = "okay"; - label = "lan4"; - }; - - port@4 { - status = "okay"; - label = "lan5"; - }; - }; }; &state_default { gpio { - /* via gpio7 (uart3 group) the PoE status can be read */ - groups = "uart2", "uart3", "jtag", "wdt"; + groups = "uart2", "jtag", "wdt"; function = "gpio"; }; }; - -&sdhci { - status = "okay"; -}; diff --git a/target/linux/ramips/dts/mt7621_mikrotik_routerboard-760igs.dts b/target/linux/ramips/dts/mt7621_mikrotik_routerboard-760igs.dts new file mode 100644 index 0000000000..dd2de11dce --- /dev/null +++ b/target/linux/ramips/dts/mt7621_mikrotik_routerboard-760igs.dts @@ -0,0 +1,69 @@ +// SPDX-License-Identifier: GPL-2.0-or-later OR MIT +/dts-v1/; + +#include "mt7621_mikrotik_routerboard-7xx.dtsi" + +/ { + compatible = "mikrotik,routerboard-760igs", "mediatek,mt7621-soc"; + model = "MikroTik RouterBOARD 760iGS"; + + aliases { + led-boot = &led_pwr; + led-failsafe = &led_pwr; + led-running = &led_pwr; + led-upgrade = &led_pwr; + }; + + leds { + compatible = "gpio-leds"; + + led_pwr: pwr { + label = "routerboard-760igs:blue:pwr"; + gpios = <&gpio 16 GPIO_ACTIVE_HIGH>; + default-state = "on"; + }; + + sfp { + label = "routerboard-760igs:blue:sfp"; + gpios = <&gpio 9 GPIO_ACTIVE_HIGH>; + }; + }; + + sfp1: sfp1 { + compatible = "sff,sfp"; + i2c-bus = <&i2c>; + los-gpios = <&gpio 6 GPIO_ACTIVE_HIGH>; + mod-def0-gpios = <&gpio 8 GPIO_ACTIVE_LOW>; + tx-disable-gpios = <&gpio 10 GPIO_ACTIVE_HIGH>; + maximum-power-milliwatt = <1000>; + }; +}; + +&mdio { + ephy7: ethernet-phy@7 { + reg = <7>; + sfp = <&sfp1>; + }; +}; + +&gmac1 { + status = "okay"; + + label = "sfp"; + phy-handle = <&ephy7>; +}; + +&i2c { + status = "okay"; +}; + +&state_default { + gpio { + /* gpio7 (uart3 group) goes high when + * port5 (PoE out) is cabled to a + * Mikrotik PoE-in capable port, + * such as port1 on another rb760iGS */ + groups = "uart2", "uart3", "jtag", "wdt"; + function = "gpio"; + }; +}; diff --git a/target/linux/ramips/dts/mt7621_mikrotik_routerboard-7xx.dtsi b/target/linux/ramips/dts/mt7621_mikrotik_routerboard-7xx.dtsi new file mode 100644 index 0000000000..b8fae51c3b --- /dev/null +++ b/target/linux/ramips/dts/mt7621_mikrotik_routerboard-7xx.dtsi @@ -0,0 +1,72 @@ +// SPDX-License-Identifier: GPL-2.0-or-later OR MIT + +#include "mt7621_mikrotik.dtsi" + +/ { + gpio_export { + compatible = "gpio-export"; + #size-cells = <0>; + + buzzer { + /* Beeper requires PWM for frequency selection */ + gpio-export,name = "buzzer"; + gpio-export,output = <0>; + gpios = <&gpio 15 GPIO_ACTIVE_HIGH>; + }; + + usb_power { + gpio-export,name = "usb_power"; + gpio-export,output = <1>; + gpios = <&gpio 12 GPIO_ACTIVE_HIGH>; + }; + }; +}; + +&keys { + mode { + label = "mode"; + gpios = <&gpio 13 GPIO_ACTIVE_LOW>; + linux,code = ; + }; +}; + +&partitions { + partition@40000 { + compatible = "mikrotik,minor"; + label = "firmware"; + reg = <0x040000 0xfc0000>; + }; +}; + +&switch0 { + ports { + port@0 { + status = "okay"; + label = "wan"; + }; + + port@1 { + status = "okay"; + label = "lan2"; + }; + + port@2 { + status = "okay"; + label = "lan3"; + }; + + port@3 { + status = "okay"; + label = "lan4"; + }; + + port@4 { + status = "okay"; + label = "lan5"; + }; + }; +}; + +&sdhci { + status = "okay"; +}; diff --git a/target/linux/ramips/image/mt7621.mk b/target/linux/ramips/image/mt7621.mk index 16b74c7b3e..060b322ea0 100644 --- a/target/linux/ramips/image/mt7621.mk +++ b/target/linux/ramips/image/mt7621.mk @@ -708,6 +708,13 @@ define Device/mikrotik_routerboard-750gr3 endef TARGET_DEVICES += mikrotik_routerboard-750gr3 +define Device/mikrotik_routerboard-760igs + $(Device/MikroTik) + DEVICE_MODEL := RouterBOARD 760iGS + DEVICE_PACKAGES += kmod-sfp -wpad-basic +endef +TARGET_DEVICES += mikrotik_routerboard-760igs + define Device/mikrotik_routerboard-m11g $(Device/MikroTik) DEVICE_MODEL := RouterBOARD M11G diff --git a/target/linux/ramips/mt7621/base-files/etc/board.d/01_leds b/target/linux/ramips/mt7621/base-files/etc/board.d/01_leds index 63c0bce083..8708de33c1 100755 --- a/target/linux/ramips/mt7621/base-files/etc/board.d/01_leds +++ b/target/linux/ramips/mt7621/base-files/etc/board.d/01_leds @@ -48,6 +48,9 @@ linksys,ea7500-v2) ucidef_set_led_netdev "lan4" "lan4 link" "$boardname:green:lan4" "lan4" "link" ucidef_set_led_netdev "wan" "wan link" "$boardname:green:wan" "wan" "link" ;; +mikrotik,routerboard-760igs) + ucidef_set_led_netdev "sfp" "SFP" "$boardname:blue:sfp" "sfp" + ;; mikrotik,routerboard-m11g) ucidef_set_rssimon "wlan0" "200000" "1" ucidef_set_led_rssi "rssilow" "RSSILOW" "$boardname:green:rssi0" "wlan0" "1" "100" diff --git a/target/linux/ramips/mt7621/base-files/etc/board.d/02_network b/target/linux/ramips/mt7621/base-files/etc/board.d/02_network index b9f2740a1b..cf3df76c08 100755 --- a/target/linux/ramips/mt7621/base-files/etc/board.d/02_network +++ b/target/linux/ramips/mt7621/base-files/etc/board.d/02_network @@ -48,6 +48,9 @@ ramips_setup_interfaces() mikrotik,routerboard-750gr3) ucidef_set_interfaces_lan_wan "lan2 lan3 lan4 lan5" "wan" ;; + mikrotik,routerboard-760igs) + ucidef_set_interfaces_lan_wan "lan2 lan3 lan4 lan5" "wan sfp" + ;; ubnt,edgerouter-x) ucidef_set_interfaces_lan_wan "eth1 eth2 eth3 eth4" "eth0" ;; @@ -108,6 +111,7 @@ ramips_setup_macs() label_mac=$lan_mac ;; mikrotik,routerboard-750gr3|\ + mikrotik,routerboard-760igs|\ mikrotik,routerboard-m11g|\ mikrotik,routerboard-m33g) label_mac=$(cat "/sys/firmware/mikrotik/hard_config/mac_base") diff --git a/target/linux/ramips/mt7621/base-files/etc/board.d/03_gpio_switches b/target/linux/ramips/mt7621/base-files/etc/board.d/03_gpio_switches index 7787ddcbc7..f809df7f2f 100755 --- a/target/linux/ramips/mt7621/base-files/etc/board.d/03_gpio_switches +++ b/target/linux/ramips/mt7621/base-files/etc/board.d/03_gpio_switches @@ -7,6 +7,9 @@ board_config_update board=$(board_name) case "$board" in +mikrotik,routerboard-760igs) + ucidef_add_gpio_switch "poe_passthrough" "PoE Passthrough" "497" + ;; telco-electronics,x1) ucidef_add_gpio_switch "modem_reset" "Modem Reset" "16" ;; diff --git a/target/linux/ramips/mt7621/base-files/lib/upgrade/platform.sh b/target/linux/ramips/mt7621/base-files/lib/upgrade/platform.sh index a411a7a033..90749f589b 100755 --- a/target/linux/ramips/mt7621/base-files/lib/upgrade/platform.sh +++ b/target/linux/ramips/mt7621/base-files/lib/upgrade/platform.sh @@ -28,6 +28,7 @@ platform_do_upgrade() { } ;; mikrotik,routerboard-750gr3|\ + mikrotik,routerboard-760igs|\ mikrotik,routerboard-m11g|\ mikrotik,routerboard-m33g) [ -z "$(rootfs_type)" ] && mtd erase firmware From ef765ceb0924134658876512132af5184c4dd947 Mon Sep 17 00:00:00 2001 From: Adrian Schmutzler Date: Wed, 12 Aug 2020 14:40:00 +0200 Subject: [PATCH 08/11] ath79/mikrotik: add function for loading ath9k caldata The commands to read ath9k caldata on mikrotik subtarget are mostly repetitive, so let's put them into a function to make writing and reading them easier. This function will only be required when patching the MAC address. For cases where it is put correctly into the calibration data by the vendor, caldata_sysfsload_from_file can be used directly as done for ath10k at the moment. Signed-off-by: Adrian Schmutzler --- .../etc/hotplug.d/firmware/10-ath9k-eeprom | 21 ++++++++++++------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/target/linux/ath79/mikrotik/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom b/target/linux/ath79/mikrotik/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom index 30a7759ef2..f2cb1f774f 100644 --- a/target/linux/ath79/mikrotik/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom +++ b/target/linux/ath79/mikrotik/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom @@ -4,6 +4,17 @@ . /lib/functions/caldata.sh +caldata_mikrotik_ath9k() { + local offset=$(($1)) + local count=$(($2)) + local macaddr=$3 + + caldata_from_file $wlan_data $offset $count /tmp/$FIRMWARE + ath9k_patch_mac "$macaddr" /tmp/$FIRMWARE + caldata_sysfsload_from_file /tmp/$FIRMWARE 0x0 $count + rm -f /tmp/$FIRMWARE +} + wlan_data="/sys/firmware/mikrotik/hard_config/wlan_data" mac_base="$(cat /sys/firmware/mikrotik/hard_config/mac_base)" @@ -14,16 +25,10 @@ case "$FIRMWARE" in case $board in mikrotik,routerboard-lhg-2nd|\ mikrotik,routerboard-sxt-5nd-r2) - caldata_from_file $wlan_data 0x1000 0x440 /tmp/$FIRMWARE - ath9k_patch_mac $(macaddr_add "$mac_base" +1) /tmp/$FIRMWARE - caldata_sysfsload_from_file /tmp/$FIRMWARE 0x0 0x440 - rm -f /tmp/$FIRMWARE + caldata_mikrotik_ath9k 0x1000 0x440 $(macaddr_add "$mac_base" +1) ;; mikrotik,routerboard-wap-g-5hact2hnd) - caldata_from_file $wlan_data 0x1000 0x440 /tmp/$FIRMWARE - ath9k_patch_mac $(macaddr_add "$mac_base" +2) /tmp/$FIRMWARE - caldata_sysfsload_from_file /tmp/$FIRMWARE 0x0 0x440 - rm -f /tmp/$FIRMWARE + caldata_mikrotik_ath9k 0x1000 0x440 $(macaddr_add "$mac_base" +2) ;; *) caldata_die "board $board is not supported yet" From 0709f6e798c32cb509964794cd388d10470343f8 Mon Sep 17 00:00:00 2001 From: Daniel Golle Date: Thu, 13 Aug 2020 13:59:01 +0100 Subject: [PATCH 09/11] iproute2: disable SELinux for now Signed-off-by: Daniel Golle --- .../iproute2/patches/300-selinux-configurable.patch | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 package/network/utils/iproute2/patches/300-selinux-configurable.patch diff --git a/package/network/utils/iproute2/patches/300-selinux-configurable.patch b/package/network/utils/iproute2/patches/300-selinux-configurable.patch new file mode 100644 index 0000000000..4cda30f978 --- /dev/null +++ b/package/network/utils/iproute2/patches/300-selinux-configurable.patch @@ -0,0 +1,11 @@ +--- a/configure ++++ b/configure +@@ -244,7 +244,7 @@ check_elf() + check_selinux() + # SELinux is a compile time option in the ss utility + { +- if ${PKG_CONFIG} libselinux --exists; then ++ if [ "${HAVE_SELINUX}" = "y" ] && ${PKG_CONFIG} libselinux --exists; then + echo "HAVE_SELINUX:=y" >>$CONFIG + echo "yes" + From 74dfe25d41b83f51c10f7862184359784b7d7182 Mon Sep 17 00:00:00 2001 From: Daniel Golle Date: Thu, 13 Aug 2020 14:04:30 +0100 Subject: [PATCH 10/11] procd: remove duplicate confguration menu Fixes: 962e73c1a4 ("procd: add selinux variant") Signed-off-by: Daniel Golle --- package/system/procd/Makefile | 2 -- 1 file changed, 2 deletions(-) diff --git a/package/system/procd/Makefile b/package/system/procd/Makefile index e3f538e066..b0c035545e 100644 --- a/package/system/procd/Makefile +++ b/package/system/procd/Makefile @@ -111,8 +111,6 @@ config PROCD_ZRAM_TMPFS endmenu endef -Package/procd-selinux/config = $(Package/procd/config) - ifeq ($(BUILD_VARIANT),selinux) CMAKE_OPTIONS += -DSELINUX=1 endif From ff6b8156916d2fc8f308bd02241a23eea99a1c7f Mon Sep 17 00:00:00 2001 From: Daniel Golle Date: Thu, 13 Aug 2020 14:05:26 +0100 Subject: [PATCH 11/11] libselinux: don't depend on kernel config symbols Dependencies are meant to express actual run-time dependencies and strictly speaking, libselinux can be build and used on kernels without SELinux (not in a very meaningful way, but never mind). Signed-off-by: Daniel Golle --- package/libs/libselinux/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package/libs/libselinux/Makefile b/package/libs/libselinux/Makefile index 893476f5de..b0b2491cc9 100644 --- a/package/libs/libselinux/Makefile +++ b/package/libs/libselinux/Makefile @@ -20,7 +20,7 @@ include $(INCLUDE_DIR)/package.mk define Package/libselinux SECTION:=libs - DEPENDS:=+libsepol +libpcre +musl-fts +@KERNEL_SECURITY +@KERNEL_SECURITY_NETWORK +@KERNEL_SECURITY_SELINUX + DEPENDS:=+libsepol +libpcre +musl-fts CATEGORY:=Libraries TITLE:=Runtime SELinux library URL:=http://selinuxproject.org/page/Main_Page