linux/meta-selinux.git, branch scarthgap

libselinux-python: fix do_install line continuation

2026-05-11T01:21:45+00:00

Backport fix from master commit f7306d7af4425553684a860df6f6d0ee66efba31 to add missing line continuation backslash after PREFIX=${prefix} in do_install(). Signed-off-by: Rong Fu Signed-off-by: Yi Zhao

refpolicy_common: enable PARALLEL_MAKE

2026-05-09T06:25:19+00:00

Using parallel make threads speeds up the build. This line was added in https://git.yoctoproject.org/meta-selinux/commit/?id=1139c40cb687deefddc31c5fbc8ab61f3d50402f in 2012. The parallel build of refpolicy was fixed in 2014 in commit "Fix parallel build of the policy": https://github.com/SELinuxProject/refpolicy/commit/c1c11fa2f8ca03d47adaf31bca4b257459448c19 I've tested a build of core-image-full-cmdline with yocto master branch as well as a custom image and it seems to work without issues. Signed-off-by: Etienne Cordonnier Signed-off-by: Yi Zhao

refpolicy: Add support to configure policy store root

2026-03-17T14:10:12+00:00

By default, policy modules(*.pp) are stored in /var directory. Features like: ostree remove files in folders like /var variable data directory while build time. Added support for custom policy store. We can now configure path to custom policy store to variable `POLICY_STORE_ROOT`. Signed-off-by: Sasi Kumar Maddineni Signed-off-by: Yi Zhao (cherry picked from commit 8572e130415dfa9fb48aec6ae1758e10dab7b1e7) Signed-off-by: Hiago De Franco Signed-off-by: Yi Zhao

selinux-image: Preserve SELinux contexts in tarballs

2026-03-17T14:09:59+00:00

Tarball images were created without SELinux context information, causing loss of security labels during extraction while working with features like:ostree. This breaks SELinux policy enforcement and requires relabeling after deployment, adding runtime overhead. Append "--selinux" to IMAGE_CMD_TAR to include SELinux file contexts when generating tarball images. This ensures security labels are preserved across image creation and deployment. Signed-off-by: Sasi Kumar Maddineni Signed-off-by: Yi Zhao (cherry picked from commit 9a913243ffaf26e06f151c3c293b62e28ec549f1) Signed-off-by: Hiago De Franco Signed-off-by: Yi Zhao

shadow: remove dependency on pam-plugin-lastlog

2026-01-23T12:48:22+00:00

From: https://git.openembedded.org/openembedded-core/commit/?h=scarthgap&id=04f3c3e335bf5e7c3a12ccc97fda9a8c214135d0 This item has been deprecated in pam 1.5.3 and is no longer built by default: https://github.com/linux-pam/linux-pam/blob/master/NEWS Signed-off-by: Alexander Kanavin Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie Signed-off-by: Clayton Casciato Signed-off-by: Yi Zhao

initscripts: fix incompatibility with read-only-rootfs

2025-11-14T13:02:23+00:00

When the read-only-rootfs feature (in IMAGE_FEATURES) is enabled, the populate-volatile.sh script runs at build time. This compensates for the fact that certain essential directories and files cannot be created at runtime, since the root filesystem is read-only. This is handled in oe-core's rootfs-postcommands.bbclass, in read_only_rootfs_hook. However, initscripts-1.0_selinux.inc appends some shell code to populate-volatile.sh considering it will be run in the target, not on the host machine. So, if one uses both read-only-rootfs and selinux (in DISTRO_FEATURES), the recursive call to restorecon is run in the host machine, since populate-volatile.sh is called in build time. This leads to errors such as: | NOTE: Executing read_only_rootfs_hook ... | DEBUG: Executing shell function read_only_rootfs_hook | /sbin/restorecon: Could not read /var/lib/AccountsService/users: Permission denied. | /sbin/restorecon: Could not read /var/lib/NetworkManager: Permission denied. | /sbin/restorecon: Could not read /var/lib/bluetooth: Permission denied. | /sbin/restorecon: Could not read /var/lib/chrony: Permission denied. As a matter of fact, this scenario is a fair reminder not to call bitbake with sudo. This change makes sure the append is only performed if the read-only-rootfs feature is not used. Signed-off-by: João Marcos Costa Signed-off-by: Yi Zhao

refpolicy: files - add files_delete_var_chr_files interface

2025-10-24T06:39:22+00:00

Signed-off-by: Clayton Casciato Signed-off-by: Yi Zhao

refpolicy: systemd - allow systemd_logind_t unconfined_t:fd use

2025-10-23T16:03:29+00:00

Signed-off-by: Clayton Casciato Signed-off-by: Yi Zhao

refpolicy: dbus - allow system_dbusd_t unconfined_t:fd use

2025-10-23T07:30:26+00:00

Signed-off-by: Clayton Casciato Signed-off-by: Yi Zhao

refpolicy: ssh - allow sshd_t userdomain:key search

2025-10-23T02:11:19+00:00

Signed-off-by: Clayton Casciato Signed-off-by: Yi Zhao