Enable audit and other PACKAGECONFIG by DISTRO_FEATURES

Enable audit and other PACKAGECONFIG by DISTRO_FEATURES

[Jörg Sommer]

systemd already enables its PACKAGECONFIG[audit] by filtering the
DISTRO_FEATURES for `audit`. It's useful to extend this feature to more
packages.

[PATCH 1/6] dbus: Enable PACKAGECONFIG[audit] by DISTRO_FEATURES

[Jörg Sommer]

From: Jörg Sommer <joerg.sommer@navimatix.de>

Signed-off-by: Jörg Sommer <joerg.sommer@navimatix.de>
---
 meta/recipes-core/dbus/dbus_1.16.2.bb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-core/dbus/dbus_1.16.2.bb b/meta/recipes-core/dbus/dbus_1.16.2.bb
index 7425bd2364..1fbb6fe509 100644
--- a/meta/recipes-core/dbus/dbus_1.16.2.bb
+++ b/meta/recipes-core/dbus/dbus_1.16.2.bb
@@ -26,7 +26,7 @@ EXTRA_OEMESON = "-Dxml_docs=disabled \
                  -Dsession_socket_dir=/tmp \
                 "
 
-PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'systemd x11', d)} \
+PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'audit systemd x11', d)} \
                    message-bus traditional-activation user-session \
                   ${@bb.utils.contains('PTEST_ENABLED', '1', 'tests', '', d)} \
                   "
-- 
2.53.0

[PATCH 2/6] libpam: Enable PACKAGECONFIG[audit] by DISTRO_FEATURES

[Jörg Sommer]

From: Jörg Sommer <joerg.sommer@navimatix.de>

Signed-off-by: Jörg Sommer <joerg.sommer@navimatix.de>
---
 meta/recipes-extended/pam/libpam_1.7.2.bb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-extended/pam/libpam_1.7.2.bb b/meta/recipes-extended/pam/libpam_1.7.2.bb
index 6955a5f2f6..60cb843f77 100644
--- a/meta/recipes-extended/pam/libpam_1.7.2.bb
+++ b/meta/recipes-extended/pam/libpam_1.7.2.bb
@@ -36,7 +36,7 @@ S = "${UNPACKDIR}/Linux-PAM-${PV}"
 
 inherit meson gettext pkgconfig systemd ptest github-releases
 
-PACKAGECONFIG ??= ""
+PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'audit', d)}"
 PACKAGECONFIG[audit] = "-Daudit=enabled,-Daudit=disabled,audit,"
 PACKAGECONFIG[userdb] = "-Dpam_userdb=enabled -Ddb=gdbm,-Dpam_userdb=disabled,gdbm,"
 PACKAGECONFIG[selinux] = "-Dselinux=enabled,-Dselinux=disabled,libselinux,"
-- 
2.53.0

[PATCH 3/6] rpm: Enable PACKAGECONFIG[acl audit selinux] by DISTRO_FEATURES

[Jörg Sommer]

From: Jörg Sommer <joerg.sommer@navimatix.de>

Signed-off-by: Jörg Sommer <joerg.sommer@navimatix.de>
---
 meta/recipes-devtools/rpm/rpm_4.20.1.bb | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/meta/recipes-devtools/rpm/rpm_4.20.1.bb b/meta/recipes-devtools/rpm/rpm_4.20.1.bb
index ba967ec1fa..17e75c3e14 100644
--- a/meta/recipes-devtools/rpm/rpm_4.20.1.bb
+++ b/meta/recipes-devtools/rpm/rpm_4.20.1.bb
@@ -64,7 +64,10 @@ BBCLASSEXTEND = "native nativesdk"
 # https://github.com/llvm/llvm-project/issues/82541
 TOOLCHAIN = "gcc"
 
-PACKAGECONFIG ??= "archive"
+PACKAGECONFIG ??= "\
+    ${@bb.utils.filter('DISTRO_FEATURES', 'acl audit selinux', d)} \
+    archive \
+"
 
 PACKAGECONFIG[plugins] = "-DENABLE_PLUGINS=ON,-DENABLE_PLUGINS=OFF"
 PACKAGECONFIG[testsuite] = "-DENABLE_TESTSUITE=ON,-DENABLE_TESTSUITE=OFF"
-- 
2.53.0

[PATCH 4/6] cronie: Enable PACKAGECONFIG[audit selinux] by DISTRO_FEATURES

[Jörg Sommer]

From: Jörg Sommer <joerg.sommer@navimatix.de>

Signed-off-by: Jörg Sommer <joerg.sommer@navimatix.de>
---
 meta/recipes-extended/cronie/cronie_1.7.2.bb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-extended/cronie/cronie_1.7.2.bb b/meta/recipes-extended/cronie/cronie_1.7.2.bb
index b250717ab8..50cb895cf8 100644
--- a/meta/recipes-extended/cronie/cronie_1.7.2.bb
+++ b/meta/recipes-extended/cronie/cronie_1.7.2.bb
@@ -31,7 +31,7 @@ SRC_URI[sha256sum] = "f1da374a15ba7605cf378347f96bc8b678d3d7c0765269c8242cfe5b07
 inherit autotools update-rc.d useradd systemd github-releases
 UPSTREAM_CHECK_REGEX = "releases/tag/cronie-(?P<pver>\d+(\.\d+)+)"
 
-PACKAGECONFIG ?= "${@bb.utils.filter('DISTRO_FEATURES', 'pam', d)}"
+PACKAGECONFIG ?= "${@bb.utils.filter('DISTRO_FEATURES', 'audit pam selinux', d)}"
 
 PACKAGECONFIG[audit] = "--with-audit,--without-audit,audit,"
 PACKAGECONFIG[pam] = "--with-pam,--without-pam,libpam,${PAM_DEPS}"
-- 
2.53.0

[PATCH 5/6] shadow: Enable PACKAGECONFIG[acl audit selinux] by DISTRO_FEATURES

[Jörg Sommer]

From: Jörg Sommer <joerg.sommer@navimatix.de>

Signed-off-by: Jörg Sommer <joerg.sommer@navimatix.de>
---
 meta/recipes-extended/shadow/shadow_4.19.4.bb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-extended/shadow/shadow_4.19.4.bb b/meta/recipes-extended/shadow/shadow_4.19.4.bb
index f70d1ca5f3..d9ff20c22c 100644
--- a/meta/recipes-extended/shadow/shadow_4.19.4.bb
+++ b/meta/recipes-extended/shadow/shadow_4.19.4.bb
@@ -70,7 +70,7 @@ PAM_PLUGINS = "libpam-runtime \
                pam-plugin-shells \
                pam-plugin-rootok"
 
-PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'pam', d)} \
+PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'acl audit pam selinux', d)} \
                    ${@bb.utils.contains('DISTRO_FEATURES', 'xattr', 'attr', '', d)}"
 PACKAGECONFIG:class-native ??= "${@bb.utils.contains('DISTRO_FEATURES', 'xattr', 'attr', '', d)} libbsd"
 PACKAGECONFIG:class-nativesdk = ""
-- 
2.53.0

[PATCH 6/6] sudo: Enable PACKAGECONFIG[audit selinux] by DISTRO_FEATURES

[Jörg Sommer]

From: Jörg Sommer <joerg.sommer@navimatix.de>

Signed-off-by: Jörg Sommer <joerg.sommer@navimatix.de>
---
 meta/recipes-extended/sudo/sudo.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-extended/sudo/sudo.inc b/meta/recipes-extended/sudo/sudo.inc
index a23de1fcf7..1fe0447e53 100644
--- a/meta/recipes-extended/sudo/sudo.inc
+++ b/meta/recipes-extended/sudo/sudo.inc
@@ -19,7 +19,7 @@ LIC_FILES_CHKSUM = "file://LICENSE.md;md5=2841c822e587db145364ca95e9be2ffa \
 
 inherit autotools
 
-PACKAGECONFIG ??= ""
+PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'audit selinux', d)}"
 PACKAGECONFIG[zlib] = "--enable-zlib,--disable-zlib,zlib"
 PACKAGECONFIG[pam-wheel] = ",,,pam-plugin-wheel"
 PACKAGECONFIG[audit] = "--with-linux-audit,--without-linux-audit,audit"
-- 
2.53.0

Re: [OE-core] Enable audit and other PACKAGECONFIG by DISTRO_FEATURES

[Antonin Godard]

Hi,

On Tue Jul 14, 2026 at 4:41 PM CEST, Jörg Sommer via lists.openembedded.org wrote:
> systemd already enables its PACKAGECONFIG[audit] by filtering the
> DISTRO_FEATURES for `audit`. It's useful to extend this feature to more
> packages.

Side-question, if we officially support the audit distro feature, wouldn't it be
relevant to also maintain the audit recipe in OE-Core? It is currently
provided by meta-oe.

Antonin

Re: [OE-core] Enable audit and other PACKAGECONFIG by DISTRO_FEATURES

[Jörg Sommer]

[-- Attachment #1: Type: text/plain, Size: 802 bytes --]

Antonin Godard schrieb am Do 16. Jul, 11:21 (+0200):
> On Tue Jul 14, 2026 at 4:41 PM CEST, Jörg Sommer via lists.openembedded.org wrote:
> > systemd already enables its PACKAGECONFIG[audit] by filtering the
> > DISTRO_FEATURES for `audit`. It's useful to extend this feature to more
> > packages.
> 
> Side-question, if we officially support the audit distro feature, wouldn't it be
> relevant to also maintain the audit recipe in OE-Core? It is currently
> provided by meta-oe.

I don't know. But it sounds sensible. Can someone else give a yes or no?

-- 
Navimatix GmbH           T: 03641 - 327 99 0
Tatzendpromenade 2       F: 03641 - 526 306
07745 Jena               www.navimatix.de

Geschäftsführer: Steffen Späthe, Jan Rommeley
Registergericht: Amtsgericht Jena, HRB 501480

[-- Attachment #2: smime.p7s --]
[-- Type: application/pkcs7-signature, Size: 6684 bytes --]

Re: [PATCH 3/6] rpm: Enable PACKAGECONFIG[acl audit selinux] by DISTRO_FEATURES

[Dmitry Baryshkov]

On Tue, Jul 14, 2026 at 04:41:39PM +0200, Jörg Sommer wrote:
> From: Jörg Sommer <joerg.sommer@navimatix.de>
> 
> Signed-off-by: Jörg Sommer <joerg.sommer@navimatix.de>
> ---
>  meta/recipes-devtools/rpm/rpm_4.20.1.bb | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/meta/recipes-devtools/rpm/rpm_4.20.1.bb b/meta/recipes-devtools/rpm/rpm_4.20.1.bb
> index ba967ec1fa..17e75c3e14 100644
> --- a/meta/recipes-devtools/rpm/rpm_4.20.1.bb
> +++ b/meta/recipes-devtools/rpm/rpm_4.20.1.bb
> @@ -64,7 +64,10 @@ BBCLASSEXTEND = "native nativesdk"
>  # https://github.com/llvm/llvm-project/issues/82541
>  TOOLCHAIN = "gcc"
>  
> -PACKAGECONFIG ??= "archive"
> +PACKAGECONFIG ??= "\
> +    ${@bb.utils.filter('DISTRO_FEATURES', 'acl audit selinux', d)} \

This broke SDK builds for SELinux-enabled distros since nativesdk-rpm
depends on nativesdk-libselinux, but it is not there by default. [1]
should fix the issue, if it gets accepted.

[1] https://lore.kernel.org/r/20260804114749.625810-1-dmitry.baryshkov@oss.qualcomm.com/

Otherwise, we'd need to drop this patch. 

> +    archive \
> +"
>  
>  PACKAGECONFIG[plugins] = "-DENABLE_PLUGINS=ON,-DENABLE_PLUGINS=OFF"
>  PACKAGECONFIG[testsuite] = "-DENABLE_TESTSUITE=ON,-DENABLE_TESTSUITE=OFF"
> -- 
> 2.53.0
> 
> 

-- 
With best wishes
Dmitry

Re: [PATCH 3/6] rpm: Enable PACKAGECONFIG[acl audit selinux] by DISTRO_FEATURES

[Jörg Sommer]

[-- Attachment #1: Type: text/plain, Size: 1677 bytes --]

Dmitry Baryshkov schrieb am Di 04. Aug, 15:24 (+0300):
> On Tue, Jul 14, 2026 at 04:41:39PM +0200, Jörg Sommer wrote:
> > From: Jörg Sommer <joerg.sommer@navimatix.de>
> >
> > Signed-off-by: Jörg Sommer <joerg.sommer@navimatix.de>
> > ---
> >  meta/recipes-devtools/rpm/rpm_4.20.1.bb | 5 ++++-
> >  1 file changed, 4 insertions(+), 1 deletion(-)
> >
> > diff --git a/meta/recipes-devtools/rpm/rpm_4.20.1.bb b/meta/recipes-devtools/rpm/rpm_4.20.1.bb
> > index ba967ec1fa..17e75c3e14 100644
> > --- a/meta/recipes-devtools/rpm/rpm_4.20.1.bb
> > +++ b/meta/recipes-devtools/rpm/rpm_4.20.1.bb
> > @@ -64,7 +64,10 @@ BBCLASSEXTEND = "native nativesdk"
> >  # https://github.com/llvm/llvm-project/issues/82541
> >  TOOLCHAIN = "gcc"
> >
> > -PACKAGECONFIG ??= "archive"
> > +PACKAGECONFIG ??= "\
> > +    ${@bb.utils.filter('DISTRO_FEATURES', 'acl audit selinux', d)} \
> 
> This broke SDK builds for SELinux-enabled distros since nativesdk-rpm
> depends on nativesdk-libselinux, but it is not there by default. [1]
> should fix the issue, if it gets accepted.
> 
> [1] https://lore.kernel.org/r/20260804114749.625810-1-dmitry.baryshkov@oss.qualcomm.com/
> 
> Otherwise, we'd need to drop this patch.

Or we could drop only selinux from the list. But this leaves the question
what someone should do when she enables rpm with selinux and wants an SDK.
So, hopfully your patch gets accepted.


Best regards, Jörg

-- 
Navimatix GmbH           T: 03641 - 327 99 0
Tatzendpromenade 2       F: 03641 - 526 306
07745 Jena               www.navimatix.de

Geschäftsführer: Steffen Späthe, Jan Rommeley
Registergericht: Amtsgericht Jena, HRB 501480

[-- Attachment #2: smime.p7s --]
[-- Type: application/pkcs7-signature, Size: 6684 bytes --]