linux/meta-selinux.git/recipes-security, branch master

refpolicy: update to latest git rev

2026-06-06T14:26:06+00:00

* fbae93917 btrfs (#1144) * da94ce004 dmesg: allow dmesg_t access to init script stream sockets * 78f8b23d4 fapolicyd: fix issue with tmpfs_t write * 319ac618d fsadm (#1129) * 7d1dc1f06 systemd: allow tmpfiles to handle auditd_log_t * d30582816 systemd: allow tmpfiles to relabel various unlabeled objects * 01f6bb2bc systemd: allow tmpfiles to setrlimit * d156ca9a6 sshd: guard dbus calls with optional_policy * 6b7da9b01 sudo: guard auth_use_pam_systemd call * cd06b5f4b authlogin: guard auth_use_pam_systemd->dbus_system_bus_client calls with optional_policy * 586caeace Add SELinux policy support for Userspace Resource Manager (URM) (#1097) * 4e360aab8 tor_pluggable_transports2 (#1133) * 444f9a669 apt_dpkg_strict (#1131) * 2cc5c825b corecommands: label /usr/share/pam/security/namespace.init as bin_t * 6aeb605e8 authlogin: allow pam_domain to read /usr/share/pam * d97274873 systemd: resolved has a systemd-networkd hook * fac3aba88 systemd: allow resolved access to /etc/localtime * a57ca559e authlogin: systemd reads /proc/sys/kernel/random/boot_id via nss * f6e4064fe Add boolean user_ptrace to allow user domains to strace themselves * d25098a7d incus: Update module to reflect new incus selinux support * 73be75170 selinux: Add selinux_read_fs interface * a75373c3b incus: Allow setting of per instance oom_score_adj * a8ff7c56b incus: Add incus_entry_type interface * e4684de6d incus: Fix start of virtual networking in incus >=6.15 * 4b38f2f05 virt: Add virt_relabel_images interface * 3b11df9e2 container: Add container_write_all_container_state interface * 0dbad021c qemu: Update incus support * 69141a369 qemu: Add qemu_manage_image_symlinks interface * 373d1ee9f qemu: Add qemu_write_state interface * 6ef6df8b0 qemu: Add qemu_getattr interface * 5684dae89 selinux: allow ModemManager to send DBus messages to initrc_t. * a7d4c1333 libvirt_leasesh: Added read and search permission on kernel sysctls * 75079752d systemd-coredum: Added sepolicy permission to read namespace file * e0fd56a58 refpolicy: Addressing denial seen on alsa to allow write on event dev node * 694c913f8 tee_supplicant: Add necessary SELinux policy for qtee_supplicant * eb28c5a1b su: use auth_use_pam * e396a31e2 systemd: allow user systemd-tmpfiles to setfscreate * 26f457f50 systemd: allow systemd-userwork to speak to systemd-machined * 8762d07ad systemd: allow systemd-nsresourced to interact w/ bpf * 0b7c88000 kernel: treat /efi similarly to /boot * 99d522a1d snmpd: snmpd doesn't seem to need dac_override capability * 192fe63a2 gpg: adapt to Gentoo's app-alternatives/gpg * ebafd639e selinux: allow seatd to use unallocated TTYs * cea89176e https://picasa.google.com/ * 8d49a23bd matrixd: gatekeep postgresql calls in an optional policy block * 169f725b3 newrole_t, run_init_t: call auth_run_pam() * ffadd83c7 ping: allow execution and PTY access * e15ac27e0 devices: Add label for /dev/isst_interface * d4084b9fa Add new kernel security class memfd_file and new kernel permissions * 928e3bcbb Add new policy cababilities * 559688316 userdomain: kernel_dontaudit_request_load_module for all users * 0e76a2a30 Add op-tee based tee supplicant policy Signed-off-by: Yi Zhao

libselinux-python: remove all RECORD files

2026-05-09T06:37:45+00:00

In order to support reproducible builds[1], we delete the RECORD file for selinux-python recipe, please refer the details in the patch comments for the selinux-python recipes. Here we do the same behavior to keep the solution consistency. [1] https://reproducible-builds.org/ Signed-off-by: Zhixiong Chi Signed-off-by: Yi Zhao

selinux-python: remove all RECORD files

2026-05-09T06:37:20+00:00

Python modules install metadata into a .dist-info directory, one of which is RECORD, which contains the files that were installed and their checksum[1]. This is typically used by pip to validate the install, or to know what files to remove when the module is uninstalled. This is slightly problematic when we need to do patching of installed .py files in do_install(), as the RECORD file has already been written at that point. However, the RECORD files only really have a use outside of a system- managed environment, which our python packages are. We already have commands to verify and remove modules (opkg, dpkg, rpm) and the RECORD file existing simply allows people to 'sudo pip' and alter the package- managed directories outside of the package manager. This is not a good idea, and some other distros remove the RECORD file to stop this possibility: - Debian[2] - Fedora[3] - Gentoo[4] [1] https://peps.python.org/pep-0491/#the-dist-info-directory [2] https://salsa.debian.org/python-team/tools/dh-python/-/blob/master/dhpython/fs.py?ref_type=heads#L185 [3] https://src.fedoraproject.org/rpms/pyproject-rpm-macros/blob/rawhide/f/macros.pyproject#_105 [4] https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=73c49f3c00415dee99407dabba8d3b22895c9d25 Signed-off-by: Zhixiong Chi Signed-off-by: Yi Zhao

libselinux-python: fix do_install line continuation and variable typo

2026-04-20T06:15:44+00:00

Add missing line continuation backslash after PREFIX=${prefix} in do_install(). Fix variable name typo: rename 'dicect_url_json' to 'direct_url_json'. Signed-off-by: Rong Fu Signed-off-by: Yi Zhao

refpolicy_common: enable PARALLEL_MAKE

2026-04-16T08:42:27+00:00

Using parallel make threads speeds up the build. This line was added in https://git.yoctoproject.org/meta-selinux/commit/?id=1139c40cb687deefddc31c5fbc8ab61f3d50402f in 2012. The parallel build of refpolicy was fixed in 2014 in commit "Fix parallel build of the policy": https://github.com/SELinuxProject/refpolicy/commit/c1c11fa2f8ca03d47adaf31bca4b257459448c19 I've tested a build of core-image-full-cmdline with yocto master branch as well as a custom image and it seems to work without issues. Signed-off-by: Etienne Cordonnier Signed-off-by: Yi Zhao

libsemanage: disable LTO to fix buildpaths QA failure

2026-04-09T10:45:02+00:00

Fat LTO objects in the static library embed original source paths in .gnu.lto_* IR sections. Unlike DWARF output, these sections are not affected by -ffile-prefix-map, causing TMPDIR references to survive into the installed libsepol-staticdev package. Signed-off-by: Thomas Perrot Signed-off-by: Yi Zhao

libselinux: disable LTO to fix buildpaths QA failure

2026-04-09T10:44:44+00:00

Fat LTO objects in the static library embed original source paths in .gnu.lto_* IR sections. Unlike DWARF output, these sections are not affected by -ffile-prefix-map, causing TMPDIR references to survive into the installed libselinux-staticdev package. Signed-off-by: Thomas Perrot Signed-off-by: Yi Zhao

libsepol: disable LTO to fix buildpaths QA failure

2026-04-09T10:44:15+00:00

refpolicy: update to latest git rev

2026-04-03T11:27:02+00:00

* 9ff571c79 refpolicy: donotaudit rsyslogd for net_admin capability on self * aa350841e refpolicy: Added policy for modprob to read blacklist-video.conf lnk_file * eef80d415 refpolicy: Added policy for systemd_user_runtime_dir_t to read tmp_t directory * 2a85bb850 refpolicy: Added policy for rpcbind * bd3c6e00e refpolicy: Added dontaudit on docker_t to manage /usr directory * 2aad2d57f kernel: add kernel_read_transparent_hugepage_sysfs interface * aacef5aae varnishd: update fcontexts for vinyl-cache rename * e393fdc3c virt: label libvirt hook scripts with dedicated exec type Signed-off-by: Yi Zhao

refpolicy: upgrade to 20260312

2026-03-18T15:26:12+00:00

* ab1fbc994 systemd: allow systemd-sysusers to send audit messages * b30600233 systemd: use systemd_stream_connect_userdb() for user runtime client * cf596dfcf systemd: support LogNamespace * 113205a65 sechecker.ini: Add net_admin to kmod_t. * 89379c0b2 kmod: add net_admin capability to kmod_t * 1efb8ead4 tee_supplicant: Introduce SELinux domain for tee_supplicant * 0e00aeb25 Define security policy for DSP FastRPC daemons * cdc9ae133 chronyd: Add urandom access for chronyc UTI_GetRandomBytesUrandom. * 1ffcf999e devices: Rename FastRPC interfaces to follow dev_ naming convention Signed-off-by: Yi Zhao