From: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
To: buildroot@busybox.net
Subject: [Buildroot] [PATCH 02/15] fs/common.mk: set SELinux file security contexts
Date: Fri, 4 Sep 2020 14:58:57 +0200 [thread overview]
Message-ID: <20200904145857.10506bf6@windsurf.home> (raw)
In-Reply-To: <20200731101040.1723047-3-antoine.tenart@bootlin.com>
Hello,
On Fri, 31 Jul 2020 12:10:27 +0200
Antoine Tenart <antoine.tenart@bootlin.com> wrote:
> +ifeq ($(BR2_PACKAGE_REFPOLICY)$(BR2_PACKAGE_POLICYCOREUTILS),yy)
In fact, BR2_PACKAGE_POLICYCOREUTILS=y is not at all a requirement for
a working SELinux system. While host-policycoreutils is needed to have
the setfiles utility that you use below, having policycoreutils on the
target is not needed. So I've simplified this condition to:
ifeq ($(BR2_PACKAGE_REFPOLICY),y)
> +define ROOTFS_SELINUX
> + $(HOST_DIR)/sbin/setfiles -m -r $(TARGET_DIR) \
> + -c $(TARGET_DIR)/etc/selinux/targeted/policy/policy.$(BR2_PACKAGE_LIBSEPOL_POLICY_VERSION) \
> + $(TARGET_DIR)/etc/selinux/targeted/contexts/files/file_contexts \
> + $(TARGET_DIR)
> +endef
> +ROOTFS_COMMON_DEPENDENCIES += refpolicy host-policycoreutils
While it doesn't hurt, I don't think it makes sense to have "refpolicy"
in the dependencies here. Indeed, all this rootfs creation logic
happens after all packages have been built. Due to the
BR2_PACKAGE_REFPOLICY=y condition above, we know refpolicy is enabled,
and therefore it has already been built prior to the rootfs being
generated.
The ROOTFS_xyz_DEPENDENCIES are mainly useful for dependencies on host
tools that are needed to generate the root filesystem. Which is the
case here with host-policycoreutils. So I've simplified to:
ROOTFS_COMMON_DEPENDENCIES += host-policycoreutils
Applied with those changes. Thanks!
Thomas
--
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
next prev parent reply other threads:[~2020-09-04 12:58 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-31 10:10 [Buildroot] [PATCH 00/15] Improve SELinux support Antoine Tenart
2020-07-31 10:10 ` [Buildroot] [PATCH 01/15] package/e2fsprogs: set xattrs for the root dir as well Antoine Tenart
2020-07-31 10:10 ` [Buildroot] [PATCH 02/15] fs/common.mk: set SELinux file security contexts Antoine Tenart
2020-09-04 12:58 ` Thomas Petazzoni [this message]
2020-07-31 10:10 ` [Buildroot] [PATCH 03/15] fs/common.mk: move down ROOTFS_REPRODUCIBLE for consistency Antoine Tenart
2020-07-31 10:10 ` [Buildroot] [PATCH 04/15] package/refpolicy: smaller monolithic policy Antoine Tenart
2020-07-31 10:10 ` [Buildroot] [PATCH 05/15] package/refpolicy: allow packages to select SELinux modules Antoine Tenart
2020-07-31 10:10 ` [Buildroot] [PATCH 06/15] package/systemd: " Antoine Tenart
2020-07-31 10:10 ` [Buildroot] [PATCH 07/15] package/dbus: select SELinux module Antoine Tenart
2020-07-31 10:10 ` [Buildroot] [PATCH 08/15] package/util-linux: " Antoine Tenart
2020-07-31 10:10 ` [Buildroot] [PATCH 09/15] package/e2fsprogs: " Antoine Tenart
2020-07-31 10:10 ` [Buildroot] [PATCH 10/15] package/refpolicy: allow providing user defined modules Antoine Tenart
2020-09-04 13:05 ` Thomas Petazzoni
2020-09-04 15:00 ` Antoine Tenart
2020-09-04 15:10 ` Thomas Petazzoni
2020-09-04 15:28 ` Antoine Tenart
2020-07-31 10:10 ` [Buildroot] [PATCH 11/15] package/refpolicy: allow selecting additional modules Antoine Tenart
2020-07-31 10:10 ` [Buildroot] [PATCH 12/15] package/refpolicy: allow to provide a custom refpolicy Antoine Tenart
2020-07-31 10:10 ` [Buildroot] [PATCH 13/15] package/refpolicy: allow packages to provide their own SELinux modules Antoine Tenart
2020-07-31 10:10 ` [Buildroot] [PATCH 14/15] package/refpolicy: fix the configure, build and install steps Antoine Tenart
2020-09-04 13:07 ` Thomas Petazzoni
2020-07-31 10:10 ` [Buildroot] [PATCH 15/15] docs/manual: add a section about SELinux Antoine Tenart
2020-07-31 12:15 ` Matthew Weber
2020-07-31 12:52 ` Antoine Tenart
2020-07-31 13:15 ` Thomas Petazzoni
2020-07-31 13:19 ` Matthew Weber
2020-07-31 13:22 ` Antoine Tenart
2020-09-04 13:09 ` Thomas Petazzoni
2020-07-31 17:08 ` [Buildroot] [PATCH 00/15] Improve SELinux support Adam Duskett
2020-07-31 20:48 ` Adam Duskett
2020-08-01 8:12 ` Antoine Tenart
2020-08-01 8:05 ` Antoine Tenart
2020-09-04 12:56 ` Thomas Petazzoni
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200904145857.10506bf6@windsurf.home \
--to=thomas.petazzoni@bootlin.com \
--cc=buildroot@busybox.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox