2017-05-20 22:41:41 +02:00
|
|
|
config BR2_PACKAGE_REFPOLICY
|
|
|
|
|
bool "refpolicy"
|
|
|
|
|
depends on BR2_TOOLCHAIN_HAS_THREADS # policycoreutils
|
|
|
|
|
depends on BR2_PACKAGE_AUDIT_ARCH_SUPPORTS # policycoreutils
|
|
|
|
|
depends on !BR2_STATIC_LIBS # policycoreutils
|
|
|
|
|
select BR2_PACKAGE_POLICYCOREUTILS
|
|
|
|
|
select BR2_PACKAGE_BUSYBOX_SELINUX if BR2_PACKAGE_BUSYBOX
|
|
|
|
|
help
|
|
|
|
|
The SELinux Reference Policy project (refpolicy) is a
|
|
|
|
|
complete SELinux policy that can be used as the system
|
|
|
|
|
policy for a variety of systems and used as the basis for
|
|
|
|
|
creating other policies. Reference Policy was originally
|
|
|
|
|
based on the NSA example policy, but aims to accomplish many
|
|
|
|
|
additional goals.
|
|
|
|
|
|
|
|
|
|
The current refpolicy does not fully support Buildroot and
|
|
|
|
|
needs modifications to work with the default system file
|
|
|
|
|
layout. These changes should be added as patches to the
|
|
|
|
|
refpolicy that modify a single SELinux policy.
|
|
|
|
|
|
|
|
|
|
The refpolicy works for the most part in permissive
|
|
|
|
|
mode. Only the basic set of utilities are enabled in the
|
|
|
|
|
example policy config and some of the pathing in the
|
|
|
|
|
policies is not correct. Individual policies would need to
|
|
|
|
|
be tweaked to get everything functioning properly.
|
|
|
|
|
|
|
|
|
|
https://github.com/TresysTechnology/refpolicy
|
|
|
|
|
|
2019-09-22 11:06:36 +02:00
|
|
|
comment "refpolicy needs a toolchain w/ threads, dynamic library"
|
2017-05-20 22:41:41 +02:00
|
|
|
depends on BR2_PACKAGE_AUDIT_ARCH_SUPPORTS
|
2019-09-22 11:06:36 +02:00
|
|
|
depends on BR2_STATIC_LIBS || !BR2_TOOLCHAIN_HAS_THREADS
|
2017-05-20 22:41:42 +02:00
|
|
|
|
|
|
|
|
if BR2_PACKAGE_REFPOLICY
|
|
|
|
|
|
|
|
|
|
config BR2_PACKAGE_REFPOLICY_POLICY_VERSION
|
|
|
|
|
string "Policy version"
|
|
|
|
|
default "30"
|
|
|
|
|
|
2017-05-20 22:41:43 +02:00
|
|
|
choice
|
|
|
|
|
prompt "SELinux default state"
|
|
|
|
|
default BR2_PACKAGE_REFPOLICY_POLICY_STATE_PERMISSIVE
|
|
|
|
|
|
|
|
|
|
config BR2_PACKAGE_REFPOLICY_POLICY_STATE_ENFORCING
|
|
|
|
|
bool "Enforcing"
|
|
|
|
|
help
|
|
|
|
|
SELinux security policy is enforced
|
|
|
|
|
|
|
|
|
|
config BR2_PACKAGE_REFPOLICY_POLICY_STATE_PERMISSIVE
|
|
|
|
|
bool "Permissive"
|
|
|
|
|
help
|
|
|
|
|
SELinux prints warnings instead of enforcing
|
|
|
|
|
|
|
|
|
|
config BR2_PACKAGE_REFPOLICY_POLICY_STATE_DISABLED
|
|
|
|
|
bool "Disabled"
|
|
|
|
|
help
|
|
|
|
|
No SELinux policy is loaded
|
|
|
|
|
endchoice
|
|
|
|
|
|
|
|
|
|
config BR2_PACKAGE_REFPOLICY_POLICY_STATE
|
|
|
|
|
string
|
|
|
|
|
default "permissive" if BR2_PACKAGE_REFPOLICY_POLICY_STATE_PERMISSIVE
|
|
|
|
|
default "enforcing" if BR2_PACKAGE_REFPOLICY_POLICY_STATE_ENFORCING
|
|
|
|
|
default "disabled" if BR2_PACKAGE_REFPOLICY_POLICY_STATE_DISABLED
|
|
|
|
|
|
2017-05-20 22:41:42 +02:00
|
|
|
endif
|
