Add SELinux feature

Add agl-selinux feature to enable SELinux support.

Notes:
- SELinux is in permissive mode by default for now, and using the
  targeted policy by default.
- The linux-yocto specific bbappend in meta-selinux is masked out in
  favor of adding a more universal kernel configuration fragment with
  AGL's own scheme.
- SELinux specific recipes and bbappends are added via a meta-selinux
  dynamic-layers addition in meta-agl-core to keep using meta-selinux
  optional.  This will avoid issues with the Yocto autobuilder testing
  of meta-agl-core.
- To avoid the effectively hard-coded autorelabel on first boot, a
  bbappend is added to the selinux-autorelabel recipe to remove the
  flag creation.  In the off chance that a build happens on a filesystem
  without xattr support, the logic in the selinux-image bbclass will
  still touch the /.autorelabel flag and trigger relabeling.
- A systemd unit and script are added with a new systemd-selinux-relabel
  recipe to handle relabeling of some systemd generated files that do
  not get handled during root filesystem construction.  Some of these
  can be addressed by some upstream tweaks, but /etc/machine-id will
  always need special handling unless there is a shift to using
  read-only or stateless root by default.  With this workaround we still
  avoid doing a full relabel and reboot on first boot, which helps
  simplify CI.

Bug-AGL: SPEC-4332

Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Change-Id: Ibf469e11eb3a67709074cc6794b3d12cd5071a90
Reviewed-on: https://gerrit.automotivelinux.org/gerrit/c/AGL/meta-agl/+/27790
Tested-by: Jenkins Job builder account
ci-image-build: Jenkins Job builder account
ci-image-boot-test: Jenkins Job builder account
Reviewed-by: Jan-Simon Moeller <jsmoeller@linuxfoundation.org>

3 files changed, 16 insertions, 0 deletions

diff --git a/templates/feature/agl-selinux/50_bblayers.conf.inc b/templates/feature/agl-selinux/50_bblayers.conf.inc
new file mode 100644
index 000000000..b17e292e9
--- /dev/null
+++ b/templates/feature/agl-selinux/50_bblayers.conf.inc
@@ -0,0 +1,5 @@
+AGL_META_PYTHON = "${METADIR}/external/meta-openembedded/meta-python"
+
+BBLAYERS =+ " \
+	${METADIR}/external/meta-selinux \
+	"
diff --git a/templates/feature/agl-selinux/50_local.conf.inc b/templates/feature/agl-selinux/50_local.conf.inc
new file mode 100644
index 000000000..4aaac2d14
--- /dev/null
+++ b/templates/feature/agl-selinux/50_local.conf.inc
@@ -0,0 +1,2 @@
+#see meta-agl/meta-agl/conf/include/agl-selinux.inc
+require conf/include/agl-selinux.inc
diff --git a/templates/feature/agl-selinux/README_feature_agl-selinux.md b/templates/feature/agl-selinux/README_feature_agl-selinux.md
new file mode 100644
index 000000000..c48ce06b0
--- /dev/null
+++ b/templates/feature/agl-selinux/README_feature_agl-selinux.md
@@ -0,0 +1,9 @@
+---
+description: Feature agl-selinux
+authors: Scott Murray <scott.murray@konsulko.com>
+---
+
+### Feature agl-selinux
+
+Enables building with SELinux enabled, with the default mode
+being permissive.