linux/meta-selinux.git/classes, branch scarthgap

selinux-image: Preserve SELinux contexts in tarballs

2026-03-17T14:09:59+00:00

Tarball images were created without SELinux context information, causing loss of security labels during extraction while working with features like:ostree. This breaks SELinux policy enforcement and requires relabeling after deployment, adding runtime overhead. Append "--selinux" to IMAGE_CMD_TAR to include SELinux file contexts when generating tarball images. This ensures security labels are preserved across image creation and deployment. Signed-off-by: Sasi Kumar Maddineni Signed-off-by: Yi Zhao (cherry picked from commit 9a913243ffaf26e06f151c3c293b62e28ec549f1) Signed-off-by: Hiago De Franco Signed-off-by: Yi Zhao

selinux-image.bbclass: refactor bbclass

2023-10-12T14:14:19+00:00

The selinux_set_labels function should run as late as possible. To guarantee that, we append it to IMAGE_PREPROCESS_COMMAND in RecipePreFinalise event handler, this ensures it is the last function in IMAGE_PREPROCESS_COMMAND. After refactoring, system using systemd can also label selinux contexts during build. Signed-off-by: Yi Zhao Signed-off-by: Joe MacDonald

classes: drop redundant classes

2021-08-30T01:34:22+00:00

There are some redundant classes: enable-selinux.bbclass, with-selinux.bbclass, meson-enable-selinux.bbclass, meson-selinux.bbclass, enable-audit.bbclass, with-audit.bbclass. These classes only add PACKAGEOCNFIG[selinux]/[audit] to recipes. But currently most recipes have added PACKAGECONFIG[selinux]/[audit] in their bb files. We don't need these anymore. Only keep enable-selinux.class and enable-audit.class to append PACKAGECONFIG[selinux]/[audit] for recipes. Signed-off-by: Yi Zhao Signed-off-by: Joe MacDonald

meta-selinux: convert to new override syntax

2021-08-04T20:18:39+00:00

This is the result of automated script conversion: poky/scripts/contrib/convert-overrides.py meta-selinux Converting the metadata to use ":" as the override character instead of "_". Signed-off-by: Yi Zhao Signed-off-by: Joe MacDonald

selinux.bbclass: remove True option in getVar()

2020-04-03T12:39:07+00:00

The getVar() defaults to expanding by default, thus remove the True option from all getVar() calls. Signed-off-by: Yi Zhao Signed-off-by: Joe MacDonald

glib-2.0: fix configure error for meson build

2019-06-16T03:11:05+00:00

In glib 2.60.x, it turns selinux into a meson feature. We should use '-Dselinux=enabled/disabled' rather than '-Dselinux=true/false' to enable/disable the feature. Add meso-enable-selinux.bbclass for this change and inherit it in glib-2.0 bbappend to fix the configure error. Signed-off-by: Yi Zhao Signed-off-by: Joe MacDonald

selinux-image.bbclass: using append instead of += for IMAGE_PREPROCESS_COMMAND

2019-04-14T21:08:54+00:00

Fix AVC denied error when booting: type=AVC msg=audit(1548055920.478:86): avc: denied { execute } for pid=366 comm="audispd" path="/lib/ld-2.28.so" dev="vda" ino=7545 scontext=system_u:system_r:audisp_t:s15:c0.c1023 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file permissive=1 type=AVC msg=audit(1548055920.478:87): avc: denied { open } for pid=366 comm="audispd" path="/lib/libc-2.28.so" dev="vda" ino=7558 scontext=system_u:system_r:audisp_t:s15:c0.c1023 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file permissive=1 When using "+=" for IMAGE_PREPROCESS_COMMAND, the selinux_set_labels process would run before prelink process to set the security labels for the files. But the label for /lib/libc-2.28.so and /lib/ld-2.28.so would be changed after run prelink process. Use "_append" to make sure the selinux_set_labels process run after prelink process. Signed-off-by: Yi Zhao Signed-off-by: Joe MacDonald

meson-selinux.bbclass: add for meson build system

2019-03-25T08:43:53+00:00

Add meson-selinux.bbclass for meson build system. It used '-Dselinux=true/false' to enable/disable 'selinux' rather than --enable-selinux or --with-selinux. Inherit meson-selinux for glib-2.0 to fix configure failure. Signed-off-by: Kai Kang Signed-off-by: Joe MacDonald

selinux-image: fix labeling on non-seclabel mounts

2018-08-13T15:20:32+00:00

Use -m to prevent non-seclabel mounts from being excluded from labeling. After the following commit setfiles will no longer label files on a mount other than / if it doesn't have seclabel listed in /proc/mounts: https://github.com/SELinuxProject/selinux/commit/f2e77865e144ab2e1313aa78d99b969f8f48695e#diff-2de9aefdd8fc5bc6a8740533e5d1cc2e Signed-off-by: George McCollister Signed-off-by: Joe MacDonald

enable-audit.bbclass: remove implement of packageconfig audit

2018-05-08T14:30:56+00:00

enable-audit.bbclass is only used by systemd. And systemd has adapted to use build tool meson and implement PACKAGECONFIG audit in recipe file of systemd in oe-core. So remove implement of PACKAGECONFIG audit from enable-audit.bbclass. Signed-off-by: Kai Kang Signed-off-by: Joe MacDonald