diff --git a/README b/README
index ae011f3..4a13669 100644
--- a/README
+++ b/README
@@ -47,6 +47,18 @@ to be tailored for your environment.
 e.g. PREFERRED_PROVIDER_virtual/refpolicy ?= "refpolicy-mls"
 
 
+Configuring policy booleans and tunables
+----------------------------------------
+Policy boolean and tunable defaults can be changed at build time with the
+POLICY_BOOLEANS variable.  Entries use a space-separated name=value format,
+and values must be either true or false.  For example:
+
+POLICY_BOOLEANS = "secure_mode=true allow_execmem=false"
+
+The refpolicy build fails if an entry has an invalid format or names a boolean
+or tunable that is not provided by the selected policy.
+
+
 Using different init manager
 ----------------------------
 By default selinux enabled images coming up with "sysvinit" as init manager,
diff --git a/recipes-security/refpolicy/refpolicy_common.inc b/recipes-security/refpolicy/refpolicy_common.inc
index d241343..f9a55bc 100644
--- a/recipes-security/refpolicy/refpolicy_common.inc
+++ b/recipes-security/refpolicy/refpolicy_common.inc
@@ -117,6 +117,10 @@ POLICY_MLS_SENS ?= "16"
 POLICY_MLS_CATS ?= "1024"
 POLICY_MCS_CATS ?= "1024"
 
+# Space-separated policy boolean/tunable settings in name=value format.
+# Values must be either true or false.
+POLICY_BOOLEANS ?= ""
+
 EXTRA_OEMAKE = "NAME=${POLICY_NAME} \
     TYPE=${POLICY_TYPE} \
     DISTRO=${POLICY_DISTRO} \
@@ -153,11 +157,44 @@ disable_policy_modules() {
     done
 }
 
+set_policy_booleans() {
+    for setting in ${POLICY_BOOLEANS}; do
+        name="${setting%%=*}"
+        value="${setting#*=}"
+
+        if [ "${name}" = "${setting}" ]; then
+            bbfatal "Invalid POLICY_BOOLEANS entry: ${setting}"
+        fi
+
+        case "${name}" in
+            ""|*[!A-Za-z0-9_]*)
+                bbfatal "Invalid policy boolean name: ${name}"
+                ;;
+        esac
+
+        case "${value}" in
+            true|false) ;;
+            *)
+                bbfatal "Invalid value for ${name}: ${value}"
+                ;;
+        esac
+
+        if ! grep -q "^${name}[[:space:]]*=" \
+                "${S}/policy/booleans.conf"; then
+            bbfatal "Unknown policy boolean or tunable: ${name}"
+        fi
+
+        sed -i "s/^\(${name}[[:space:]]*=[[:space:]]*\).*/\1${value}/" \
+            "${S}/policy/booleans.conf"
+    done
+}
+
 do_compile() {
     if [ -f "${WORKDIR}/modules.conf" ] ; then
         cp -f ${WORKDIR}/modules.conf ${S}/policy/modules.conf
     fi
     oe_runmake conf
+    set_policy_booleans
     disable_policy_modules
     oe_runmake policy
 }