diff mbox series

[meta-selinux,2/2] selinux/refpolicy: introduce POLICY_VERSION variable

Message ID 20260917042544.3894019-2-chenqi_hycx@cetc.com.cn
State New
Headers show
Series [meta-selinux,1/2] refpolicy_common.inc: default to deny for UNK_PERMS | expand

Commit Message

Chen Qi Sept. 17, 2026, 4:25 a.m. UTC 
From: Chen Qi <chenqi_hycx@cetc.com.cn>

Introduce POLICY_VERSION which is used by refpolicy and semanage.
Previously, the recipes are just hardcoding '35'. Let's introduce
a new variable to put things in a common place and allow for user
configuration.

Signed-off-by: Chen Qi <chenqi_hycx@cetc.com.cn>
---
 conf/selinux_refpolicy_common.inc               | 2 ++
 recipes-security/refpolicy/refpolicy_common.inc | 4 +++-
 recipes-security/selinux/libsemanage_3.10.bb    | 2 +-
 recipes-security/selinux/selinux_common.inc     | 2 ++
 4 files changed, 8 insertions(+), 2 deletions(-)
 create mode 100644 conf/selinux_refpolicy_common.inc
diff mbox series

Patch

diff --git a/conf/selinux_refpolicy_common.inc b/conf/selinux_refpolicy_common.inc
new file mode 100644
index 0000000..2b0226a
--- /dev/null
+++ b/conf/selinux_refpolicy_common.inc
@@ -0,0 +1,2 @@ 
+# policy version used by refpolicy and semanage
+POLICY_VERSION ?= "35"
diff --git a/recipes-security/refpolicy/refpolicy_common.inc b/recipes-security/refpolicy/refpolicy_common.inc
index 8787797..544769c 100644
--- a/recipes-security/refpolicy/refpolicy_common.inc
+++ b/recipes-security/refpolicy/refpolicy_common.inc
@@ -77,6 +77,8 @@  SRC_URI += " \
 
 S = "${UNPACKDIR}/refpolicy"
 
+require conf/selinux_refpolicy_common.inc
+
 CONFFILES:${PN} = "${sysconfdir}/selinux/config"
 
 POLICY_STORE_ROOT ?= "${localstatedir}/lib/selinux"
@@ -208,7 +210,7 @@  path = ${STAGING_DIR_NATIVE}${sbindir_native}/sefcontext_compile
 args = \$@
 [end]
 
-policy-version = 35
+policy-version = ${POLICY_VERSION}
 store-root = "${POLICY_STORE_ROOT}"
 EOF
 
diff --git a/recipes-security/selinux/libsemanage_3.10.bb b/recipes-security/selinux/libsemanage_3.10.bb
index 4a18fae..d499b19 100644
--- a/recipes-security/selinux/libsemanage_3.10.bb
+++ b/recipes-security/selinux/libsemanage_3.10.bb
@@ -52,7 +52,7 @@  do_install:append() {
 
     if [ -f "${conf_file}" ]; then
         # Update "policy-version" for semanage.conf
-        sed -i 's/^#\s*\(policy-version\s*=\).*$/\1 35/' \
+        sed -i 's/^#\s*\(policy-version\s*=\).*$/\1 ${POLICY_VERSION}/' \
             ${D}/etc/selinux/semanage.conf
 
         # Update "store-root" for semanage.conf
diff --git a/recipes-security/selinux/selinux_common.inc b/recipes-security/selinux/selinux_common.inc
index aaf0b90..6932fea 100644
--- a/recipes-security/selinux/selinux_common.inc
+++ b/recipes-security/selinux/selinux_common.inc
@@ -3,6 +3,8 @@  HOMEPAGE = "https://github.com/SELinuxProject"
 SRC_URI = "git://github.com/SELinuxProject/selinux.git;branch=main;protocol=https"
 SRCREV = "ca10fc4204ed60540d41d2499127c18ad0643f9e"
 
+require conf/selinux_refpolicy_common.inc
+
 S = "${UNPACKDIR}/${BP}/${BPN}"
 
 UPSTREAM_CHECK_GITTAGREGEX = "(?P<pver>\d+(\.\d+)+)"