diff mbox series

[meta-selinux] conf/fragments/enable.conf: add fragment to turn on SELinux

Message ID 20261112010257.2716698-1-chenqi_hycx@cetc.com.cn
State New
Headers show
Series [meta-selinux] conf/fragments/enable.conf: add fragment to turn on SELinux | expand

Commit Message

Chen Qi Nov. 12, 2026, 1:02 a.m. UTC 
From: Chen Qi <chenqi_hycx@cetc.com.cn>

Add a fragment for easier use of SELinux in Yocto.

Enable it with 'bitbake-config-build enable-fragment selinux/enable' or
OE_FRAGMENTS += "selinux/enable".

It sets the selinux/pam/xattr distro features, pulls the SELinux kernel
features, defaults to refpolicy-mcs, labels the rootfs at image build
time, and installs policycoreutils and auditd.

Assisted-by: Codewhale:deepseek-v4-flash
Signed-off-by: Chen Qi <chenqi_hycx@cetc.com.cn>
---
 conf/fragments/enable.conf | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100644 conf/fragments/enable.conf
diff mbox series

Patch

diff --git a/conf/fragments/enable.conf b/conf/fragments/enable.conf
new file mode 100644
index 0000000..12abc74
--- /dev/null
+++ b/conf/fragments/enable.conf
@@ -0,0 +1,22 @@ 
+BB_CONF_FRAGMENT_SUMMARY = "Enable SELinux support in the image"
+BB_CONF_FRAGMENT_DESCRIPTION = "Add the selinux DISTRO_FEATURE together with pam and \
+xattr, pull in the SELinux kernel features and a reference policy, and install \
+policycoreutils (for sestatus, setenforce, ...) plus auditd for logging denials. \
+The policy defaults to refpolicy-mcs; set PREFERRED_PROVIDER_virtual/refpolicy to \
+use another one. auditd is provided by meta-oe (openembedded-layer), so that layer \
+needs to be in bblayers.conf too."
+
+DISTRO_FEATURES:append = " pam xattr selinux"
+
+KERNEL_FEATURES:append = " cgl/features/selinux/selinux.scc cgl/features/selinux/selinux-dev.scc"
+
+PREFERRED_PROVIDER_virtual/refpolicy ?= "refpolicy-mcs"
+
+# Label the rootfs at image build time instead of relabelling on first boot.
+IMAGE_CLASSES:append = " selinux-image"
+FIRST_BOOT_RELABEL ?= "0"
+
+IMAGE_INSTALL:append = " packagegroup-core-selinux auditd policycoreutils"
+
+# Use a standalone syslog rather than busybox-syslog.
+VIRTUAL-RUNTIME_base-utils-syslog ?= "sysklogd"