X-Git-Url: https://gerrit.automotivelinux.org/gerrit/gitweb?a=blobdiff_plain;f=meta-app-framework%2Frecipes-kernel%2Flinux%2Flinux-appfw.inc;fp=meta-app-framework%2Frecipes-kernel%2Flinux%2Flinux-appfw.inc;h=1b6d1b6a84102f1eb960cf9c6f6f57aa1f08d682;hb=74a7b60c94e21caa47334aeb975bb1af8fcb4efd;hp=cbf6567e013759b7d5cce65b81251ae6f8d392ae;hpb=820d8ac3e5c2ff3e110932e1ed08ea24ffad156c;p=AGL%2Fmeta-agl.git

diff --git a/meta-app-framework/recipes-kernel/linux/linux-appfw.inc b/meta-app-framework/recipes-kernel/linux/linux-appfw.inc
index cbf6567e0..1b6d1b6a8 100644
--- a/meta-app-framework/recipes-kernel/linux/linux-appfw.inc
+++ b/meta-app-framework/recipes-kernel/linux/linux-appfw.inc
@@ -1,21 +1,23 @@
 FILESEXTRAPATHS_prepend := "${THISDIR}/linux:"
 
-IS_KERNEL_RECIPE := "${@bb.data.inherits_class('kernel', d) and 'yes' or 'no'}"
-SMACK_KERNEL_SRC_URI_no = ""
-SMACK_KERNEL_SRC_URI_yes = ""
+# Enable SMACK support without making it the default explicitly.
+AGL_KCONFIG_FRAGMENTS += "smack.cfg"
 
-# Kernel config fragment enabling Smack, without making it the default explicitly.
-SMACK_KERNEL_SRC_URI_yes += "file://smack.cfg"
-
-# When added, set Smack as the default LSM.
-SMACK_DEFAULT_SECURITY_CFG = "file://smack-default-lsm.cfg"
-# Add it by default, can be overridden by changing this variable here.
-SMACK_DEFAULT_SECURITY ??= "${SMACK_DEFAULT_SECURITY_CFG}"
-SMACK_KERNEL_SRC_URI_yes += " ${SMACK_DEFAULT_SECURITY}"
-
-# add audit.cfg
-SMACK_KERNEL_SRC_URI_yes += " file://audit.cfg"
-
-
-SRC_URI_append_with-lsm-smack = "${SMACK_KERNEL_SRC_URI_${IS_KERNEL_RECIPE}}"
+# Enable SMACK as default LSM, can be overridden by changing this
+# variable to e.g. "".
+#
+# NOTE:
+# We use a different fragment for kernels older than 5.x that predate
+# the switch to using CONFIG_LSM instead of CONFIG_DEFAULT_SECURITY.
+# For simplicity, logic to handle the change being made in 5.1 instead
+# of 5.0 has been omitted; in practice this should not be a problem
+# since no current BSPs have been seen that use 5.0.x.  If a BSP
+# kernel recipe does not set LINUX_VERSION, the kernel being 5.x or
+# newer is assumed as the default behavior.
+LINUX_VERSION_MAJOR = "${@(d.getVar('LINUX_VERSION') or "5.x").split('.')[0]}"
+SMACK_DEFAULT_SUFFIX = "${@'' if int(d.getVar('LINUX_VERSION_MAJOR') or 0) >= 5 else '-old'}"
+SMACK_DEFAULT_SECURITY ??= "smack-default-lsm${SMACK_DEFAULT_SUFFIX}.cfg"
+AGL_KCONFIG_FRAGMENTS += "${SMACK_DEFAULT_SECURITY}"
 
+# Enable audit support
+AGL_KCONFIG_FRAGMENTS += "audit.cfg"