Re: [yocto-patches] [meta-selinux][PATCH] Enable SELinux support in native packages

["Uwe Kleine-König" <u.kleine-koenig@baylibre.com>]

[-- Attachment #1: Type: text/plain, Size: 2126 bytes --]

Hello Hiago,

On Wed, Mar 25, 2026 at 09:28:19AM -0300, Hiago De Franco wrote:
> I would like to add something to the discussion that I just found
> yesterday.
> 
> By enabling the native patckages to have SELinux by default, GPG 
> breaks if secureboot is also being used. See the error below:
> 
> ERROR: linux-yocto-6.6.129+git-r0 do_sign: Failed to import gpg key
> (user-keys/boot_keys/BOOT-GPG-PRIVKEY-BOOT-SecureCore): gpg: importing
> secret keys not allowed
> gpg: Total number processed: 1
> gpg:       secret keys read: 1
> 
> This happens becaus of [0]. I had to specifically disable SELinux for
> the GPG native package.

This is ridiculous. What about

diff --git a/g10/import.c b/g10/import.c
index ba62d2322c93..44b113d77222 100644
--- a/g10/import.c
+++ b/g10/import.c
@@ -3235,21 +3235,21 @@ import_secret_one (ctrl_t ctrl, kbnode_t keyblock,
      cipher algorithm (only checks the primary key, though).  */
   if (ski->algo > 110)
     {
       if (!for_migration)
         log_error (_("key %s: secret key with invalid cipher %d"
                      " - skipped\n"), keystr_from_pk (pk), ski->algo);
       release_kbnode (keyblock);
       return 0;
     }
 
-#ifdef ENABLE_SELINUX_HACKS
+#ifdef I_WANT_A_BROKEN_GNUPG
   if (1)
     {
       /* We don't allow importing secret keys because that may be used
          to put a secret key into the keyring and the user might later
          be tricked into signing stuff with that key.  */
       log_error (_("importing secret keys not allowed\n"));
       release_kbnode (keyblock);
       return 0;
     }
 #endif

instead? Or does someone understand why it's considered easier to trick
the user into bad stuff with SELINUX enabled?

> So, in this case, if we would to like to proceed with this patch, v2
> would be a better option to prevent such errors.

Well, it only prevents the error if the yocto build doesn't have

	DISTRO_FEATURES_FILTER_NATIVE:append = " selinux"

in local.conf which is recommended in the docs with v2. So I (still)
don't consider v2 better.

Best regards
Uwe

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]