linux/meta-selinux.git, branch nanbield

README: update

2023-10-12T14:14:19+00:00

Add how to enable labeling on first boot. Signed-off-by: Yi Zhao Signed-off-by: Joe MacDonald

selinux-autorelabel: enable labeling during build

2023-10-12T14:14:19+00:00

Previously, system using systemd would label selinux contexts on first boot. While system using sysvinit would label during build. Add a variable FIRST_BOOT_RELABEL as a switch to control labeling to make the behavior of sysvinit and systemd consistent. Set FIRST_BOOT_RELABEL to 1 in local.conf to enable labeling on first boot. Signed-off-by: Yi Zhao Signed-off-by: Joe MacDonald

selinux-image.bbclass: refactor bbclass

2023-10-12T14:14:19+00:00

The selinux_set_labels function should run as late as possible. To guarantee that, we append it to IMAGE_PREPROCESS_COMMAND in RecipePreFinalise event handler, this ensures it is the last function in IMAGE_PREPROCESS_COMMAND. After refactoring, system using systemd can also label selinux contexts during build. Signed-off-by: Yi Zhao Signed-off-by: Joe MacDonald

layer.conf: update LAYERSERIES_COMPAT for nanbield

2023-10-12T14:14:19+00:00

oe-core has switched to nanbield in: https://git.openembedded.org/openembedded-core/commit/?id=f212cb12a0db9c9de5afd3cc89b1331d386e55f6 Signed-off-by: Yi Zhao Signed-off-by: Joe MacDonald

refpolicy: upgrade 20221101+git -> 20231002+git

2023-10-12T14:14:19+00:00

* Switch branch to main. * Update to latest git rev. * Drop obsolete and useless patches. * Refresh patches. Signed-off-by: Yi Zhao Signed-off-by: Joe MacDonald

libselinux-python: fix build with musl

2023-09-05T18:36:06+00:00

libselinux-python also requires the patch which provided by [1] to fix build with musl. [1] https://git.yoctoproject.org/meta-selinux/commit/?id=23d8e2d86317170c0a3c155640c71b83329ff726 Signed-off-by: Yi Zhao Signed-off-by: Joe MacDonald

linux-yocto: drop CONFIG_SECURITY_SELINUX_DISABLE

2023-09-05T18:36:06+00:00

CONFIG_SECURITY_SELINUX_DISABLE has been removed since kernel 6.4[1][2]. [1] https://github.com/SELinuxProject/selinux-kernel/wiki/DEPRECATE-runtime-disable [2] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f22f9aaf6c3d92ebd5ad9e67acc03afebaaeb289 Signed-off-by: Yi Zhao Signed-off-by: Joe MacDonald

selinux-python: add python3-distro and binutils to RDEPENDS

2023-09-05T18:36:06+00:00

Add python3-distro and binutils to RDEPENDS for sepolicy to fix runtime error: $ sepolicy -h Traceback (most recent call last): File "/usr/bin/sepolicy", line 690, in gen_manpage_args(subparsers) File "/usr/bin/sepolicy", line 375, in gen_manpage_args man.add_argument("-o", "--os", dest="os", default=get_os_version(), File "/usr/lib/python3.11/site-packages/sepolicy/__init__.py", line 1245, in get_os_version import distro ModuleNotFoundError: No module named 'distro' $ sepolicy generate --init /usr/sbin/sshd /bin/sh: line 1: nm: command not found Signed-off-by: Yi Zhao Signed-off-by: Joe MacDonald

setools: upgrade 4.4.2 -> 4.4.3

2023-08-08T14:34:54+00:00

ChangeLog: https://github.com/SELinuxProject/setools/releases/tag/4.4.3 Signed-off-by: Yi Zhao Signed-off-by: Joe MacDonald

libselinux: fix compilation with musl

2023-07-31T19:08:04+00:00

Signed-off-by: Renato Caldas Signed-off-by: Joe MacDonald