1*4882a593Smuzhiyun// -*- mode:doc; -*- 2*4882a593Smuzhiyun// vim: set syntax=asciidoc: 3*4882a593Smuzhiyun 4*4882a593Smuzhiyun[[selinux]] 5*4882a593Smuzhiyun== Using SELinux in Buildroot 6*4882a593Smuzhiyun 7*4882a593Smuzhiyunhttps://selinuxproject.org[SELinux] is a Linux kernel security module 8*4882a593Smuzhiyunenforcing access control policies. In addition to the traditional file 9*4882a593Smuzhiyunpermissions and access control lists, +SELinux+ allows to write rules 10*4882a593Smuzhiyunfor users or processes to access specific functions of resources 11*4882a593Smuzhiyun(files, sockets...). 12*4882a593Smuzhiyun 13*4882a593Smuzhiyun_SELinux_ has three modes of operation: 14*4882a593Smuzhiyun 15*4882a593Smuzhiyun* _Disabled_: the policy is not applied 16*4882a593Smuzhiyun* _Permissive_: the policy is applied, and non-authorized actions are 17*4882a593Smuzhiyun simply logged. This mode is often used for troubleshooting SELinux 18*4882a593Smuzhiyun issues. 19*4882a593Smuzhiyun* _Enforcing_: the policy is applied, and non-authorized actions are 20*4882a593Smuzhiyun denied 21*4882a593Smuzhiyun 22*4882a593SmuzhiyunIn Buildroot the mode of operation is controlled by the 23*4882a593Smuzhiyun+BR2_PACKAGE_REFPOLICY_POLICY_STATE_*+ configuration options. The 24*4882a593SmuzhiyunLinux kernel also has various configuration options that affect how 25*4882a593Smuzhiyun+SELinux+ is enabled (see +security/selinux/Kconfig+ in the Linux 26*4882a593Smuzhiyunkernel sources). 27*4882a593Smuzhiyun 28*4882a593SmuzhiyunBy default in Buildroot the +SELinux+ policy is provided by the 29*4882a593Smuzhiyunupstream https://github.com/SELinuxProject/refpolicy[refpolicy] 30*4882a593Smuzhiyunproject, enabled with +BR2_PACKAGE_REFPOLICY+. 31*4882a593Smuzhiyun 32*4882a593Smuzhiyun[[enabling-selinux]] 33*4882a593Smuzhiyun=== Enabling SELinux support 34*4882a593Smuzhiyun 35*4882a593SmuzhiyunTo have proper support for +SELinux+ in a Buildroot generated system, 36*4882a593Smuzhiyunthe following configuration options must be enabled: 37*4882a593Smuzhiyun 38*4882a593Smuzhiyun* +BR2_PACKAGE_LIBSELINUX+ 39*4882a593Smuzhiyun* +BR2_PACKAGE_REFPOLICY+ 40*4882a593Smuzhiyun 41*4882a593SmuzhiyunIn addition, your filesystem image format must support extended 42*4882a593Smuzhiyunattributes. 43*4882a593Smuzhiyun 44*4882a593Smuzhiyun[[selinux-policy-tweaking]] 45*4882a593Smuzhiyun=== SELinux policy tweaking 46*4882a593Smuzhiyun 47*4882a593SmuzhiyunThe +SELinux refpolicy+ contains modules that can be enabled or 48*4882a593Smuzhiyundisabled when being built. Each module provide a number of +SELinux+ 49*4882a593Smuzhiyunrules. In Buildroot the non-base modules are disabled by default and 50*4882a593Smuzhiyunseveral ways to enable such modules are provided: 51*4882a593Smuzhiyun 52*4882a593Smuzhiyun- Packages can enable a list of +SELinux+ modules within the +refpolicy+ using 53*4882a593Smuzhiyun the +<packagename>_SELINUX_MODULES+ variable. 54*4882a593Smuzhiyun- Packages can provide additional +SELinux+ modules by putting them (.fc, .if 55*4882a593Smuzhiyun and .te files) in +package/<packagename>/selinux/+. 56*4882a593Smuzhiyun- Extra +SELinux+ modules can be added in directories pointed by the 57*4882a593Smuzhiyun +BR2_REFPOLICY_EXTRA_MODULES_DIRS+ configuration option. 58*4882a593Smuzhiyun- Additional modules in the +refpolicy+ can be enabled if listed in the 59*4882a593Smuzhiyun +BR2_REFPOLICY_EXTRA_MODULES_DEPENDENCIES+ configuration option. 60*4882a593Smuzhiyun 61*4882a593SmuzhiyunBuildroot also allows to completely override the +refpolicy+. This 62*4882a593Smuzhiyunallows to provide a full custom policy designed specifically for a 63*4882a593Smuzhiyungiven system. When going this way, all of the above mechanisms are 64*4882a593Smuzhiyundisabled: no extra +SElinux+ module is added to the policy, and all 65*4882a593Smuzhiyunthe available modules within the custom policy are enabled and built 66*4882a593Smuzhiyuninto the final binary policy. The custom policy must be a fork of the 67*4882a593Smuzhiyunofficial https://github.com/SELinuxProject/refpolicy[refpolicy]. 68*4882a593Smuzhiyun 69*4882a593SmuzhiyunIn order to fully override the +refpolicy+ the following configuration 70*4882a593Smuzhiyunvariables have to be set: 71*4882a593Smuzhiyun 72*4882a593Smuzhiyun- +BR2_PACKAGE_REFPOLICY_CUSTOM_GIT+ 73*4882a593Smuzhiyun- +BR2_PACKAGE_REFPOLICY_CUSTOM_REPO_URL+ 74*4882a593Smuzhiyun- +BR2_PACKAGE_REFPOLICY_CUSTOM_REPO_VERSION+ 75