bc2e241bce
Following commit 0dcb5513ef
("package/refpolicy: remove dependency on policycoreutils"), we have a
build failure on some configurations:
Makefile:571: *** libselinux is in the dependency chain of busybox that has added it to its _DEPENDENCIES variable without selecting it or depending on it from Config.in. Stop.
This is because refpolicy selects the busybox SELinux support when
Busybox is enabled, which it turns selects libselinux, but we no
longer pay attention to the libselinux dependencies while doing this.
Since it's quite weird to have refpolicy mess with Busybox SELinux
support, this commit changes the logic to have Busybox automatically
enable its SELinux support as soon as SELinux support is enabled,
while still allowing it to be disabled.
Fixes:
http://autobuild.buildroot.net/results/5d8fda7c488a03c14942d87467d501acd633d24a/
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
61 lines
2 KiB
Plaintext
61 lines
2 KiB
Plaintext
config BR2_PACKAGE_REFPOLICY
|
|
bool "refpolicy"
|
|
depends on BR2_TOOLCHAIN_HAS_THREADS # libsepol
|
|
# Even though libsepol is not necessary for building, we get
|
|
# the policy version from libsepol, so we select it, and treat
|
|
# it like a runtime dependency.
|
|
select BR2_PACKAGE_LIBSEPOL
|
|
help
|
|
The SELinux Reference Policy project (refpolicy) is a
|
|
complete SELinux policy that can be used as the system
|
|
policy for a variety of systems and used as the basis for
|
|
creating other policies. Reference Policy was originally
|
|
based on the NSA example policy, but aims to accomplish many
|
|
additional goals.
|
|
|
|
The current refpolicy does not fully support Buildroot and
|
|
needs modifications to work with the default system file
|
|
layout. These changes should be added as patches to the
|
|
refpolicy that modify a single SELinux policy.
|
|
|
|
The refpolicy works for the most part in permissive
|
|
mode. Only the basic set of utilities are enabled in the
|
|
example policy config and some of the pathing in the
|
|
policies is not correct. Individual policies would need to
|
|
be tweaked to get everything functioning properly.
|
|
|
|
https://github.com/TresysTechnology/refpolicy
|
|
|
|
if BR2_PACKAGE_REFPOLICY
|
|
|
|
choice
|
|
prompt "SELinux default state"
|
|
default BR2_PACKAGE_REFPOLICY_POLICY_STATE_PERMISSIVE
|
|
|
|
config BR2_PACKAGE_REFPOLICY_POLICY_STATE_ENFORCING
|
|
bool "Enforcing"
|
|
help
|
|
SELinux security policy is enforced
|
|
|
|
config BR2_PACKAGE_REFPOLICY_POLICY_STATE_PERMISSIVE
|
|
bool "Permissive"
|
|
help
|
|
SELinux prints warnings instead of enforcing
|
|
|
|
config BR2_PACKAGE_REFPOLICY_POLICY_STATE_DISABLED
|
|
bool "Disabled"
|
|
help
|
|
No SELinux policy is loaded
|
|
endchoice
|
|
|
|
config BR2_PACKAGE_REFPOLICY_POLICY_STATE
|
|
string
|
|
default "permissive" if BR2_PACKAGE_REFPOLICY_POLICY_STATE_PERMISSIVE
|
|
default "enforcing" if BR2_PACKAGE_REFPOLICY_POLICY_STATE_ENFORCING
|
|
default "disabled" if BR2_PACKAGE_REFPOLICY_POLICY_STATE_DISABLED
|
|
|
|
endif
|
|
|
|
comment "refpolicy needs a toolchain w/ threads"
|
|
depends on !BR2_TOOLCHAIN_HAS_THREADS
|