[PATCH] README.md: clarify minimum supported kernel and policy versions

[PATCH] README.md: clarify minimum supported kernel and policy versions

[Stephen Smalley]

Clarify the minimum supported kernel and policy versions.

The Linux v3.0 kernel requirement is only for libselinux and anything
that uses libselinux to access selinuxfs. The policy build toolchain
does not link with libselinux or have any other runtime dependencies
on a particular Linux kernel version or even on Linux at all.

Note the libsepol version in which kernel policy version 24 was first
introduced, and also note the first userspace release tag that
included the relevant libsepol versions. At that time, the release
tags were date-based rather than version-based and the versions were
updated more frequently than just once per release, so userspace
release 20090403 was the first to include both libsepol version
updates.

Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
---
 README.md | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/README.md b/README.md
index f256912c..bfd32b89 100644
--- a/README.md
+++ b/README.md
@@ -25,18 +25,28 @@ for more information.
 
 Minimum Supported Kernel Version
 --------------------------------
-Linux v3.0 (for /sys/fs/selinux mount point directory)
+Linux v3.0 (for /sys/fs/selinux mount point directory) for libselinux
+and anything that uses libselinux to access selinuxfs.
+
+Note that the policy build toolchain (e.g. libsepol, checkpolicy,
+checkmodule, secilc, semodule_package/expand/link) does not link with
+libselinux or have any other runtime dependencies on a particular
+Linux kernel version. The policy build toolchain has in the past
+successfully been built and run on non-Linux platforms as well
+(e.g. macOS), although this is not officially supported.
 
 Minimum Supported Policy Version
 --------------------------------
 Kernel policy version 24 (boundary) for the SELinux and Xen
-targets. Support for this policy version first shipped in Linux
-v2.6.28 and Xen 4.0.0. libsepol dropped support for kernel policy
-versions older than 24 starting with libsepol 3.12.
+targets. Support for this policy version first shipped in libsepol
+2.0.34 (userspace release 20090403), Linux v2.6.28, and Xen
+4.0.0. libsepol dropped support for kernel policy versions older than
+24 starting with libsepol 3.12.
 
 Modular policy version 10 (boundary alias). Support for this modular
-policy version first shipped in libsepol 2.0.35. libsepol dropped
-support for modular policies older than 10 starting with libsepol 3.12
+policy version first shipped in libsepol 2.0.35 (userspace release
+20090403). libsepol dropped support for modular policies older than 10
+starting with libsepol 3.12
 
 Installation
 ------------
-- 
2.55.0

Re: [PATCH] README.md: clarify minimum supported kernel and policy versions

[Petr Lautrbach]

Stephen Smalley <stephen.smalley.work@gmail.com> writes:

> Clarify the minimum supported kernel and policy versions.
>
> The Linux v3.0 kernel requirement is only for libselinux and anything
> that uses libselinux to access selinuxfs. The policy build toolchain
> does not link with libselinux or have any other runtime dependencies
> on a particular Linux kernel version or even on Linux at all.
>
> Note the libsepol version in which kernel policy version 24 was first
> introduced, and also note the first userspace release tag that
> included the relevant libsepol versions. At that time, the release
> tags were date-based rather than version-based and the versions were
> updated more frequently than just once per release, so userspace
> release 20090403 was the first to include both libsepol version
> updates.
>
> Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>

Acked-by: Petr Lautrbach <lautrbach@redhat.com>

> ---
>  README.md | 22 ++++++++++++++++------
>  1 file changed, 16 insertions(+), 6 deletions(-)
>
> diff --git a/README.md b/README.md
> index f256912c..bfd32b89 100644
> --- a/README.md
> +++ b/README.md
> @@ -25,18 +25,28 @@ for more information.
>  
>  Minimum Supported Kernel Version
>  --------------------------------
> -Linux v3.0 (for /sys/fs/selinux mount point directory)
> +Linux v3.0 (for /sys/fs/selinux mount point directory) for libselinux
> +and anything that uses libselinux to access selinuxfs.
> +
> +Note that the policy build toolchain (e.g. libsepol, checkpolicy,
> +checkmodule, secilc, semodule_package/expand/link) does not link with
> +libselinux or have any other runtime dependencies on a particular
> +Linux kernel version. The policy build toolchain has in the past
> +successfully been built and run on non-Linux platforms as well
> +(e.g. macOS), although this is not officially supported.
>  
>  Minimum Supported Policy Version
>  --------------------------------
>  Kernel policy version 24 (boundary) for the SELinux and Xen
> -targets. Support for this policy version first shipped in Linux
> -v2.6.28 and Xen 4.0.0. libsepol dropped support for kernel policy
> -versions older than 24 starting with libsepol 3.12.
> +targets. Support for this policy version first shipped in libsepol
> +2.0.34 (userspace release 20090403), Linux v2.6.28, and Xen
> +4.0.0. libsepol dropped support for kernel policy versions older than
> +24 starting with libsepol 3.12.
>  
>  Modular policy version 10 (boundary alias). Support for this modular
> -policy version first shipped in libsepol 2.0.35. libsepol dropped
> -support for modular policies older than 10 starting with libsepol 3.12
> +policy version first shipped in libsepol 2.0.35 (userspace release
> +20090403). libsepol dropped support for modular policies older than 10
> +starting with libsepol 3.12
>  
>  Installation
>  ------------
> -- 
> 2.55.0

Re: [PATCH] README.md: clarify minimum supported kernel and policy versions

[Stephen Smalley]

On Thu, Aug 13, 2026 at 6:03 AM Petr Lautrbach <plautrba@redhat.com> wrote:
>
> Stephen Smalley <stephen.smalley.work@gmail.com> writes:
>
> > Clarify the minimum supported kernel and policy versions.
> >
> > The Linux v3.0 kernel requirement is only for libselinux and anything
> > that uses libselinux to access selinuxfs. The policy build toolchain
> > does not link with libselinux or have any other runtime dependencies
> > on a particular Linux kernel version or even on Linux at all.
> >
> > Note the libsepol version in which kernel policy version 24 was first
> > introduced, and also note the first userspace release tag that
> > included the relevant libsepol versions. At that time, the release
> > tags were date-based rather than version-based and the versions were
> > updated more frequently than just once per release, so userspace
> > release 20090403 was the first to include both libsepol version
> > updates.
> >
> > Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
>
> Acked-by: Petr Lautrbach <lautrbach@redhat.com>

Thanks, merged.