diff mbox series

[meta-selinux] refpolicy: allow configuring policy booleans

Message ID 20260826045540.1390035-1-wenwfu@qti.qualcomm.com
State New
Headers show
Series [meta-selinux] refpolicy: allow configuring policy booleans | expand

Commit Message

Wenwen Fu Aug. 26, 2026, 4:55 a.m. UTC 
Changing boolean or tunable defaults currently requires layers to patch
refpolicy sources. This does not scale when a distribution maintains
several policy-specific settings.

Add POLICY_BOOLEANS as a space-separated list of name=value settings.
Apply the settings after generating booleans.conf and fail the build for
invalid entries or names not provided by the selected policy.

Document the new variable in the layer README.

Signed-off-by: Wenwen Fu <wenwfu@qti.qualcomm.com>
---
 README                                        | 12 ++++++
 .../refpolicy/refpolicy_common.inc            | 37 +++++++++++++++++++
 2 files changed, 49 insertions(+)
diff mbox series

Patch

diff --git a/README b/README
index ae011f3..4a13669 100644
--- a/README
+++ b/README
@@ -47,6 +47,18 @@  to be tailored for your environment.
 e.g. PREFERRED_PROVIDER_virtual/refpolicy ?= "refpolicy-mls"
 
 
+Configuring policy booleans and tunables
+----------------------------------------
+Policy boolean and tunable defaults can be changed at build time with the
+POLICY_BOOLEANS variable.  Entries use a space-separated name=value format,
+and values must be either true or false.  For example:
+
+POLICY_BOOLEANS = "secure_mode=true allow_execmem=false"
+
+The refpolicy build fails if an entry has an invalid format or names a boolean
+or tunable that is not provided by the selected policy.
+
+
 Using different init manager
 ----------------------------
 By default selinux enabled images coming up with "sysvinit" as init manager,
diff --git a/recipes-security/refpolicy/refpolicy_common.inc b/recipes-security/refpolicy/refpolicy_common.inc
index d241343..f9a55bc 100644
--- a/recipes-security/refpolicy/refpolicy_common.inc
+++ b/recipes-security/refpolicy/refpolicy_common.inc
@@ -117,6 +117,10 @@  POLICY_MLS_SENS ?= "16"
 POLICY_MLS_CATS ?= "1024"
 POLICY_MCS_CATS ?= "1024"
 
+# Space-separated policy boolean/tunable settings in name=value format.
+# Values must be either true or false.
+POLICY_BOOLEANS ?= ""
+
 EXTRA_OEMAKE = "NAME=${POLICY_NAME} \
     TYPE=${POLICY_TYPE} \
     DISTRO=${POLICY_DISTRO} \
@@ -153,11 +157,44 @@  disable_policy_modules() {
     done
 }
 
+set_policy_booleans() {
+    for setting in ${POLICY_BOOLEANS}; do
+        name="${setting%%=*}"
+        value="${setting#*=}"
+
+        if [ "${name}" = "${setting}" ]; then
+            bbfatal "Invalid POLICY_BOOLEANS entry: ${setting}"
+        fi
+
+        case "${name}" in
+            ""|*[!A-Za-z0-9_]*)
+                bbfatal "Invalid policy boolean name: ${name}"
+                ;;
+        esac
+
+        case "${value}" in
+            true|false) ;;
+            *)
+                bbfatal "Invalid value for ${name}: ${value}"
+                ;;
+        esac
+
+        if ! grep -q "^${name}[[:space:]]*=" \
+                "${S}/policy/booleans.conf"; then
+            bbfatal "Unknown policy boolean or tunable: ${name}"
+        fi
+
+        sed -i "s/^\(${name}[[:space:]]*=[[:space:]]*\).*/\1${value}/" \
+            "${S}/policy/booleans.conf"
+    done
+}
+
 do_compile() {
     if [ -f "${WORKDIR}/modules.conf" ] ; then
         cp -f ${WORKDIR}/modules.conf ${S}/policy/modules.conf
     fi
     oe_runmake conf
+    set_policy_booleans
     disable_policy_modules
     oe_runmake policy
 }