NetCube-Systems-Austria/kumquat-buildroot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

package/refpolicy: allow packages to select SELinux modules

Browse Source 
Add support for packages to enable SELinux modules already supported by
the refpolicy, but not selected by default in its policy.

With this commit, packages will be able to do something like:

SYSTEMD_SELINUX_MODULES = systemd udev

to enable additional SELinux modules.

Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
This commit is contained in:
Antoine Tenart 2020-07-31 12:10:30 +02:00 committed by Thomas Petazzoni
parent 11a7a0af2a
commit 0228f521d6
2 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
package/pkg-generic.mk
View File

@ -1089,6 +1089,10 @@ TARGET_FINALIZE_HOOKS += $$($(2)_TARGET_FINALIZE_HOOKS)
ROOTFS_PRE_CMD_HOOKS += $$($(2)_ROOTFS_PRE_CMD_HOOKS)
KEEP_PYTHON_PY_FILES += $$($(2)_KEEP_PY_FILES)
ifneq ($$($(2)_SELINUX_MODULES),)
PACKAGES_SELINUX_MODULES += $$($(2)_SELINUX_MODULES)
endif
ifeq ($$($(2)_SITE_METHOD),svn)
DL_TOOLS_DEPENDENCIES += svn
else ifeq ($$($(2)_SITE_METHOD),git)

5
package/refpolicy/refpolicy.mk
View File

@ -45,13 +45,14 @@ REFPOLICY_MODULES = \
sysadm \
sysnetwork \
unconfined \
userdomain
userdomain \
$(PACKAGES_SELINUX_MODULES)
# In the context of a monolithic policy enabling a piece of the policy as
# 'base' or 'module' is equivalent, so we enable them as 'base'.
define REFPOLICY_CONFIGURE_MODULES
$(SED) "s/ = module/ = no/g" $(@D)/policy/modules.conf
$(foreach m,$(REFPOLICY_MODULES),
$(foreach m,$(sort $(REFPOLICY_MODULES)),
$(SED) "/^$(m) =/c\$(m) = base" $(@D)/policy/modules.conf
)
endef