| Andrew Geissler | 615f2f1 | 2022-07-15 14:00:58 -0500 | [diff] [blame^] | 1 | # |
| 2 | # Copyright 2022 Armin Kuster <akuster808@gmail.com> |
| 3 | # |
| 4 | SUMMARY = "Linux namespaces and seccomp-bpf sandbox" |
| 5 | DESCRIPTION = "Firejail is a SUID sandbox program that reduces the risk of security breaches \ |
| 6 | by restricting the running environment of untrusted applications using Linux namespaces, \ |
| 7 | seccomp-bpf and Linux capabilities." |
| 8 | |
| 9 | LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263" |
| 10 | LICENSE = "GPL-2.0-only" |
| 11 | |
| 12 | SRCREV = "b4b08d21cd95725c9d55dfdb6987fcc6d7893247" |
| 13 | SRC_URI = "git://github.com/netblue30/firejail.git;protocol=https;branch=master \ |
| 14 | file://exclude_seccomp_util_compiles.patch \ |
| 15 | " |
| 16 | |
| 17 | DEPENDS = "libseccomp" |
| 18 | |
| 19 | S = "${WORKDIR}/git" |
| 20 | |
| 21 | inherit autotools-brokensep pkgconfig bash-completion features_check |
| 22 | |
| 23 | REQUIRED_DISTRO_FEATURES = "seccomp" |
| 24 | |
| 25 | PACKAGECONFIG ?= "" |
| 26 | PACKAGECONFIG += "${@bb.utils.contains('DISTRO_FEATURES', 'apparmor', 'apparmor', '', d)}" |
| 27 | PACKAGECONFIG += "${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'selinux', '', d)}" |
| 28 | PACKAGECONFIG += "${@bb.utils.contains('DISTRO_FEATURES', 'x11', 'x11', '', d)}" |
| 29 | |
| 30 | PACKAGECONFIG[apparmor] = "--enable-apparmor, --disable-apparmor, apparmor, apparmor" |
| 31 | PACKAGECONFIG[selinux] = "--enable-selinux, --disable-selinux, libselinux" |
| 32 | PACKAGECONFIG[x11] = " --enable-x11, --disable-x11, " |
| 33 | PACKAGECONFIG[dbusproxy] = ", --disable-dbusproxy, " |
| 34 | PACKAGECONFIG[notmpfs] = ", --disable-usertmpfs ," |
| 35 | PACKAGECONFIG[nofiretunnel] = ", --disable-firetunnel , " |
| 36 | PACKAGECONFIG[noprivatehome] = ", --disable-private-home, " |
| 37 | PACKAGECONFIG[nochroot] = ", --disable-chroot, " |
| 38 | PACKAGECONFIG[nonetwork] = ", --disable-network, " |
| 39 | PACKAGECONFIG[nouserns] = ", --disable-userns, " |
| 40 | PACKAGECONFIG[nofiletransfer] = ", --disable-file-transfer, " |
| 41 | PACKAGECONFIG[nosuid] = ", --disable-suid, " |
| 42 | |
| 43 | EXTRA_OECONF = "--disable-man --enable-busybox-workaround" |
| 44 | |
| 45 | PACKAGES:append = " ${PN}-vim ${PN}-zsh" |
| 46 | |
| 47 | FILES:${PN}-vim = "${datadir}/vim/" |
| 48 | FILES:${PN}-zsh = "${datadir}/zsh/" |
| 49 | |
| 50 | pkg_postinst_ontarget:${PN} () { |
| 51 | ${libdir}/${BPN}/fseccomp default ${libdir}/${BPN}/seccomp |
| 52 | ${libdir}/${BPN}/fsec-optimize ${libdir}/${BPN}/seccomp |
| 53 | ${libdir}/${BPN}/fseccomp default ${libdir}/${BPN}/seccomp.debug allow-debuggers |
| 54 | ${libdir}/${BPN}/fsec-optimize ${libdir}/${BPN}/seccomp.debug |
| 55 | ${libdir}/${BPN}/fseccomp secondary 32 ${libdir}/${BPN}/seccomp.32 |
| 56 | ${libdir}/${BPN}/fsec-optimize ${libdir}/${BPN}/seccomp.32 |
| 57 | ${libdir}/${BPN}/fseccomp secondary block ${libdir}/${BPN}/seccomp.block_secondary |
| 58 | ${libdir}/${BPN}/fseccomp memory-deny-write-execute ${libdir}/${BPN}/seccomp.mdwx |
| 59 | } |
| 60 | |
| 61 | COMPATIBLE_MACHINE:mips64 = "(!.*mips64).*" |
| 62 | |
| 63 | RDEPENDS:${PN} = "bash" |