[Buildroot] [PATCH v2] package/libselinux: Add autorelabel for first boot

José Pekkarinen jose.pekkarinen at unikie.com
Thu Aug 19 09:29:04 UTC 2021


Currently buildroot ship libselinux without triggering
this option, which often shows inconsistencies between
what the refpolicy defines as a label for a file and
what the actual file has. Triggering an initial relabel
would help activating enforcing state right away without
requiring to enter it once in permissive and tweak the
labels.

Signed-off-by: José Pekkarinen <jose.pekkarinen at unikie.com>
---
[ v1 -> v2 ] Fix if statement in libselinux recipe

 package/libselinux/Config.in     | 7 +++++++
 package/libselinux/libselinux.mk | 3 +++
 2 files changed, 10 insertions(+)

diff --git a/package/libselinux/Config.in b/package/libselinux/Config.in
index 62070c8d59..df8bd7ffd0 100644
--- a/package/libselinux/Config.in
+++ b/package/libselinux/Config.in
@@ -18,3 +18,10 @@ config BR2_PACKAGE_LIBSELINUX
 
 comment "libselinux needs a toolchain w/ threads, dynamic library"
 	depends on !BR2_TOOLCHAIN_HAS_THREADS || BR2_STATIC_LIBS
+
+config BR2_PACKAGE_LIBSELINUX_AUTORELABEL
+	bool
+	depends on BR2_PACKAGE_LIBSELINUX
+	depends on BR2_PACKAGE_FINDUTILS
+	depends on BR2_PACKAGE_GREP
+	default y
diff --git a/package/libselinux/libselinux.mk b/package/libselinux/libselinux.mk
index fdd13aa942..adf4b3d6f6 100644
--- a/package/libselinux/libselinux.mk
+++ b/package/libselinux/libselinux.mk
@@ -71,6 +71,9 @@ define LIBSELINUX_INSTALL_TARGET_CMDS
 	$(TARGET_MAKE_ENV) $(MAKE) -C $(@D) \
 		$(LIBSELINUX_MAKE_OPTS) DESTDIR=$(TARGET_DIR) \
 		$(LIBSELINUX_MAKE_INSTALL_TARGETS)
+	$(if $(BR2_PACKAGE_LIBSELINUX_AUTORELABEL),
+		echo "-F" > $(TARGET_DIR)/.autorelabel
+		mkdir $(TARGET_DIR)/var/lib/selinux)
 	if ! grep -q "selinuxfs" $(TARGET_DIR)/etc/fstab; then \
 		echo "none /sys/fs/selinux selinuxfs noauto 0 0" >> $(TARGET_DIR)/etc/fstab ; fi
 endef
-- 
2.25.1



More information about the buildroot mailing list