From patchwork Fri Jul 31 10:10:35 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Antoine Tenart X-Patchwork-Id: 1339377 Return-Path: X-Original-To: incoming-buildroot@patchwork.ozlabs.org Delivered-To: patchwork-incoming-buildroot@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=busybox.net (client-ip=140.211.166.137; helo=fraxinus.osuosl.org; envelope-from=buildroot-bounces@busybox.net; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=bootlin.com Received: from fraxinus.osuosl.org (smtp4.osuosl.org [140.211.166.137]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 4BJ37w0Z7kz9sRN for ; Fri, 31 Jul 2020 20:15:40 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by fraxinus.osuosl.org (Postfix) with ESMTP id 959DA869E4; Fri, 31 Jul 2020 10:15:38 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from fraxinus.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 29ZFHL7NW9vl; Fri, 31 Jul 2020 10:15:37 +0000 (UTC) Received: from ash.osuosl.org (ash.osuosl.org [140.211.166.34]) by fraxinus.osuosl.org (Postfix) with ESMTP id DDE1186AA5; Fri, 31 Jul 2020 10:15:37 +0000 (UTC) X-Original-To: buildroot@lists.busybox.net Delivered-To: buildroot@osuosl.org Received: from silver.osuosl.org (smtp3.osuosl.org [140.211.166.136]) by ash.osuosl.org (Postfix) with ESMTP id BEF501BF2A4 for ; Fri, 31 Jul 2020 10:15:25 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by silver.osuosl.org (Postfix) with ESMTP id 939D82079D for ; Fri, 31 Jul 2020 10:15:25 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from silver.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lWZBJ0z04NtA for ; Fri, 31 Jul 2020 10:15:20 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from relay5-d.mail.gandi.net (relay5-d.mail.gandi.net [217.70.183.197]) by silver.osuosl.org (Postfix) with ESMTPS id 44D9F21541 for ; Fri, 31 Jul 2020 10:15:20 +0000 (UTC) X-Originating-IP: 90.76.143.236 Received: from localhost (lfbn-tou-1-1075-236.w90-76.abo.wanadoo.fr [90.76.143.236]) (Authenticated sender: antoine.tenart@bootlin.com) by relay5-d.mail.gandi.net (Postfix) with ESMTPSA id 4B1111C0004; Fri, 31 Jul 2020 10:15:15 +0000 (UTC) From: Antoine Tenart To: buildroot@buildroot.org Date: Fri, 31 Jul 2020 12:10:35 +0200 Message-Id: <20200731101040.1723047-11-antoine.tenart@bootlin.com> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200731101040.1723047-1-antoine.tenart@bootlin.com> References: <20200731101040.1723047-1-antoine.tenart@bootlin.com> MIME-Version: 1.0 Subject: [Buildroot] [PATCH 10/15] package/refpolicy: allow providing user defined modules X-BeenThere: buildroot@busybox.net X-Mailman-Version: 2.1.29 Precedence: list List-Id: Discussion and development of buildroot List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: matthew.weber@rockwellcollins.com, clshotwe@rockwellcollins.com, thomas.petazzoni@bootlin.com, daniel.riechers@rockwellcollins.com, aduskett@gmail.com Errors-To: buildroot-bounces@busybox.net Sender: "buildroot" Allow users to provide custom SELinux modules to be part of the final policy. A new configuration variable is added, pointing to list of directories containing the custom modules. SELinux modules do require a metadata.xml file to be well integrated in the refpolicy build. If this file isn't provided, it will be automatically created. For now, this option requires the extra modules to be directly into the BR2_REFPOLICY_EXTRA_MODULES directory, and subfolders aren't supported. They may never be, as having subfolders could introduce issues when two different modules have the same name (which isn't supported by the refpolicy). Signed-off-by: Antoine Tenart --- package/refpolicy/Config.in | 10 ++++++++++ package/refpolicy/refpolicy.mk | 23 ++++++++++++++++++++++- 2 files changed, 32 insertions(+), 1 deletion(-) diff --git a/package/refpolicy/Config.in b/package/refpolicy/Config.in index b50b2f09ff79..030b1e93c9bd 100644 --- a/package/refpolicy/Config.in +++ b/package/refpolicy/Config.in @@ -54,6 +54,16 @@ config BR2_PACKAGE_REFPOLICY_POLICY_STATE default "enforcing" if BR2_PACKAGE_REFPOLICY_POLICY_STATE_ENFORCING default "disabled" if BR2_PACKAGE_REFPOLICY_POLICY_STATE_DISABLED +config BR2_REFPOLICY_EXTRA_MODULES_DIRS + string "Extra modules directories" + help + Specify directories containing SELinux modules that will be build + in the SELinux policy. The modules will be automatically enabled in + the policy. + + Each of those directories must contain the SELinux policy .fc, .if + and .te files directly at the top-level, with no sub-directories. + endif comment "refpolicy needs a toolchain w/ threads" diff --git a/package/refpolicy/refpolicy.mk b/package/refpolicy/refpolicy.mk index c29912a53b0b..edbb5a228f55 100644 --- a/package/refpolicy/refpolicy.mk +++ b/package/refpolicy/refpolicy.mk @@ -46,7 +46,26 @@ REFPOLICY_MODULES = \ sysnetwork \ unconfined \ userdomain \ - $(PACKAGES_SELINUX_MODULES) + $(PACKAGES_SELINUX_MODULES) \ + $(foreach d,$(call qstrip,$(REFPOLICY_EXTRA_MODULES)),\ + $(basename $(notdir $(wildcard $(d)/*.te)))) + +# Allow to provide out-of-tree SELinux modules in addition to the ones in the +# refpolicy. +REFPOLICY_EXTRA_MODULES = $(BR2_REFPOLICY_EXTRA_MODULES_DIRS) +$(foreach dir,$(call qstrip,$(BR2_REFPOLICY_EXTRA_MODULES_DIRS)),\ + $(if $(wildcard $(dir)),,\ + $(error BR2_REFPOLICY_EXTRA_MODULES_DIRS contains nonexistent directory $(dir)))) + +define REFPOLICY_COPY_MODULES + mkdir -p $(@D)/policy/modules/buildroot + rsync -au $(addsuffix /*,$(call qstrip,$(REFPOLICY_EXTRA_MODULES))) \ + $(@D)/policy/modules/buildroot/ + if [ ! -f $(@D)/policy/modules/buildroot/metadata.xml ]; then \ + echo "Buildroot extra modules" > \ + $(@D)/policy/modules/buildroot/metadata.xml; \ + fi +endef # In the context of a monolithic policy enabling a piece of the policy as # 'base' or 'module' is equivalent, so we enable them as 'base'. @@ -72,6 +91,8 @@ define REFPOLICY_CONFIGURE_CMDS endef define REFPOLICY_BUILD_CMDS + $(if $(call qstrip,$(REFPOLICY_EXTRA_MODULES)),\ + $(REFPOLICY_COPY_MODULES)) $(REFPOLICY_MAKE) -C $(@D) DESTDIR=$(STAGING_DIR) bare conf $(REFPOLICY_CONFIGURE_MODULES) endef