From 2ea9cbefb8e0923f2f58e7e8022f3e134977a87a Mon Sep 17 00:00:00 2001 From: Scott Murray Date: Mon, 25 Jul 2022 14:23:13 -0400 Subject: Add SELinux feature Add agl-selinux feature to enable SELinux support. Notes: - SELinux is in permissive mode by default for now, and using the targeted policy by default. - The linux-yocto specific bbappend in meta-selinux is masked out in favor of adding a more universal kernel configuration fragment with AGL's own scheme. - SELinux specific recipes and bbappends are added via a meta-selinux dynamic-layers addition in meta-agl-core to keep using meta-selinux optional. This will avoid issues with the Yocto autobuilder testing of meta-agl-core. - To avoid the effectively hard-coded autorelabel on first boot, a bbappend is added to the selinux-autorelabel recipe to remove the flag creation. In the off chance that a build happens on a filesystem without xattr support, the logic in the selinux-image bbclass will still touch the /.autorelabel flag and trigger relabeling. - A systemd unit and script are added with a new systemd-selinux-relabel recipe to handle relabeling of some systemd generated files that do not get handled during root filesystem construction. Some of these can be addressed by some upstream tweaks, but /etc/machine-id will always need special handling unless there is a shift to using read-only or stateless root by default. With this workaround we still avoid doing a full relabel and reboot on first boot, which helps simplify CI. Bug-AGL: SPEC-4332 Signed-off-by: Scott Murray Change-Id: Ibf469e11eb3a67709074cc6794b3d12cd5071a90 Reviewed-on: https://gerrit.automotivelinux.org/gerrit/c/AGL/meta-agl/+/27790 Tested-by: Jenkins Job builder account ci-image-build: Jenkins Job builder account ci-image-boot-test: Jenkins Job builder account Reviewed-by: Jan-Simon Moeller --- templates/feature/agl-selinux/50_bblayers.conf.inc | 5 +++++ templates/feature/agl-selinux/50_local.conf.inc | 2 ++ templates/feature/agl-selinux/README_feature_agl-selinux.md | 9 +++++++++ 3 files changed, 16 insertions(+) create mode 100644 templates/feature/agl-selinux/50_bblayers.conf.inc create mode 100644 templates/feature/agl-selinux/50_local.conf.inc create mode 100644 templates/feature/agl-selinux/README_feature_agl-selinux.md (limited to 'templates/feature') diff --git a/templates/feature/agl-selinux/50_bblayers.conf.inc b/templates/feature/agl-selinux/50_bblayers.conf.inc new file mode 100644 index 000000000..b17e292e9 --- /dev/null +++ b/templates/feature/agl-selinux/50_bblayers.conf.inc @@ -0,0 +1,5 @@ +AGL_META_PYTHON = "${METADIR}/external/meta-openembedded/meta-python" + +BBLAYERS =+ " \ + ${METADIR}/external/meta-selinux \ + " diff --git a/templates/feature/agl-selinux/50_local.conf.inc b/templates/feature/agl-selinux/50_local.conf.inc new file mode 100644 index 000000000..4aaac2d14 --- /dev/null +++ b/templates/feature/agl-selinux/50_local.conf.inc @@ -0,0 +1,2 @@ +#see meta-agl/meta-agl/conf/include/agl-selinux.inc +require conf/include/agl-selinux.inc diff --git a/templates/feature/agl-selinux/README_feature_agl-selinux.md b/templates/feature/agl-selinux/README_feature_agl-selinux.md new file mode 100644 index 000000000..c48ce06b0 --- /dev/null +++ b/templates/feature/agl-selinux/README_feature_agl-selinux.md @@ -0,0 +1,9 @@ +--- +description: Feature agl-selinux +authors: Scott Murray +--- + +### Feature agl-selinux + +Enables building with SELinux enabled, with the default mode +being permissive. -- cgit 1.2.3-korg