1*4882a593Smuzhiyunconfig BR2_PACKAGE_REFPOLICY 2*4882a593Smuzhiyun bool "refpolicy" 3*4882a593Smuzhiyun depends on BR2_TOOLCHAIN_HAS_THREADS # libsepol 4*4882a593Smuzhiyun # Even though libsepol is not necessary for building, we get 5*4882a593Smuzhiyun # the policy version from libsepol, so we select it, and treat 6*4882a593Smuzhiyun # it like a runtime dependency. 7*4882a593Smuzhiyun select BR2_PACKAGE_LIBSEPOL 8*4882a593Smuzhiyun help 9*4882a593Smuzhiyun The SELinux Reference Policy project (refpolicy) is a 10*4882a593Smuzhiyun complete SELinux policy that can be used as the system 11*4882a593Smuzhiyun policy for a variety of systems and used as the basis for 12*4882a593Smuzhiyun creating other policies. Reference Policy was originally 13*4882a593Smuzhiyun based on the NSA example policy, but aims to accomplish many 14*4882a593Smuzhiyun additional goals. 15*4882a593Smuzhiyun 16*4882a593Smuzhiyun The current refpolicy does not fully support Buildroot and 17*4882a593Smuzhiyun needs modifications to work with the default system file 18*4882a593Smuzhiyun layout. These changes should be added as patches to the 19*4882a593Smuzhiyun refpolicy that modify a single SELinux policy. 20*4882a593Smuzhiyun 21*4882a593Smuzhiyun The refpolicy works for the most part in permissive 22*4882a593Smuzhiyun mode. Only the basic set of utilities are enabled in the 23*4882a593Smuzhiyun example policy config and some of the pathing in the 24*4882a593Smuzhiyun policies is not correct. Individual policies would need to 25*4882a593Smuzhiyun be tweaked to get everything functioning properly. 26*4882a593Smuzhiyun 27*4882a593Smuzhiyun https://github.com/TresysTechnology/refpolicy 28*4882a593Smuzhiyun 29*4882a593Smuzhiyunif BR2_PACKAGE_REFPOLICY 30*4882a593Smuzhiyun 31*4882a593Smuzhiyunchoice 32*4882a593Smuzhiyun prompt "Refpolicy version" 33*4882a593Smuzhiyun default BR2_PACKAGE_REFPOLICY_UPSTREAM_VERSION 34*4882a593Smuzhiyun 35*4882a593Smuzhiyunconfig BR2_PACKAGE_REFPOLICY_UPSTREAM_VERSION 36*4882a593Smuzhiyun bool "Upstream version" 37*4882a593Smuzhiyun help 38*4882a593Smuzhiyun Use the refpolicy as provided by Buildroot. 39*4882a593Smuzhiyun 40*4882a593Smuzhiyunconfig BR2_PACKAGE_REFPOLICY_CUSTOM_GIT 41*4882a593Smuzhiyun bool "Custom git repository" 42*4882a593Smuzhiyun help 43*4882a593Smuzhiyun Allows to get the refpolicy from a custom git repository. 44*4882a593Smuzhiyun 45*4882a593Smuzhiyun The custom refpolicy must define the full policy explicitly, 46*4882a593Smuzhiyun and must be a fork of the original refpolicy, to have the 47*4882a593Smuzhiyun same build system. When this is selected, only the custom 48*4882a593Smuzhiyun policy definition are taken into account and all the modules 49*4882a593Smuzhiyun of the policy are built into the binary policy. 50*4882a593Smuzhiyun 51*4882a593Smuzhiyunendchoice 52*4882a593Smuzhiyun 53*4882a593Smuzhiyunif BR2_PACKAGE_REFPOLICY_CUSTOM_GIT 54*4882a593Smuzhiyun 55*4882a593Smuzhiyunconfig BR2_PACKAGE_REFPOLICY_CUSTOM_REPO_URL 56*4882a593Smuzhiyun string "URL of custom repository" 57*4882a593Smuzhiyun 58*4882a593Smuzhiyunconfig BR2_PACKAGE_REFPOLICY_CUSTOM_REPO_VERSION 59*4882a593Smuzhiyun string "Custom repository version" 60*4882a593Smuzhiyun help 61*4882a593Smuzhiyun Revision to use in the typical format used by Git. 62*4882a593Smuzhiyun E.g. a sha id, tag, branch... 63*4882a593Smuzhiyun 64*4882a593Smuzhiyunendif 65*4882a593Smuzhiyun 66*4882a593Smuzhiyunchoice 67*4882a593Smuzhiyun prompt "SELinux default state" 68*4882a593Smuzhiyun default BR2_PACKAGE_REFPOLICY_POLICY_STATE_PERMISSIVE 69*4882a593Smuzhiyun 70*4882a593Smuzhiyunconfig BR2_PACKAGE_REFPOLICY_POLICY_STATE_ENFORCING 71*4882a593Smuzhiyun bool "Enforcing" 72*4882a593Smuzhiyun help 73*4882a593Smuzhiyun SELinux security policy is enforced 74*4882a593Smuzhiyun 75*4882a593Smuzhiyunconfig BR2_PACKAGE_REFPOLICY_POLICY_STATE_PERMISSIVE 76*4882a593Smuzhiyun bool "Permissive" 77*4882a593Smuzhiyun help 78*4882a593Smuzhiyun SELinux prints warnings instead of enforcing 79*4882a593Smuzhiyun 80*4882a593Smuzhiyunconfig BR2_PACKAGE_REFPOLICY_POLICY_STATE_DISABLED 81*4882a593Smuzhiyun bool "Disabled" 82*4882a593Smuzhiyun help 83*4882a593Smuzhiyun No SELinux policy is loaded 84*4882a593Smuzhiyunendchoice 85*4882a593Smuzhiyun 86*4882a593Smuzhiyunconfig BR2_PACKAGE_REFPOLICY_POLICY_STATE 87*4882a593Smuzhiyun string 88*4882a593Smuzhiyun default "permissive" if BR2_PACKAGE_REFPOLICY_POLICY_STATE_PERMISSIVE 89*4882a593Smuzhiyun default "enforcing" if BR2_PACKAGE_REFPOLICY_POLICY_STATE_ENFORCING 90*4882a593Smuzhiyun default "disabled" if BR2_PACKAGE_REFPOLICY_POLICY_STATE_DISABLED 91*4882a593Smuzhiyun 92*4882a593Smuzhiyunif BR2_PACKAGE_REFPOLICY_UPSTREAM_VERSION 93*4882a593Smuzhiyun 94*4882a593Smuzhiyunconfig BR2_REFPOLICY_EXTRA_MODULES_DIRS 95*4882a593Smuzhiyun string "Extra modules directories" 96*4882a593Smuzhiyun help 97*4882a593Smuzhiyun Specify a space-separated list of directories containing 98*4882a593Smuzhiyun SELinux modules that will be built into the SELinux 99*4882a593Smuzhiyun policy. The modules will be automatically enabled in the 100*4882a593Smuzhiyun policy. 101*4882a593Smuzhiyun 102*4882a593Smuzhiyun Each of those directories must contain the SELinux policy 103*4882a593Smuzhiyun .fc, .if and .te files directly at the top-level, with no 104*4882a593Smuzhiyun sub-directories. Also, you cannot have several modules with 105*4882a593Smuzhiyun the same name in different directories. 106*4882a593Smuzhiyun 107*4882a593Smuzhiyunconfig BR2_REFPOLICY_EXTRA_MODULES 108*4882a593Smuzhiyun string "Extra modules to enable" 109*4882a593Smuzhiyun help 110*4882a593Smuzhiyun List of extra SELinux modules to enable in the refpolicy. 111*4882a593Smuzhiyun 112*4882a593Smuzhiyunendif 113*4882a593Smuzhiyun 114*4882a593Smuzhiyunendif 115*4882a593Smuzhiyun 116*4882a593Smuzhiyuncomment "refpolicy needs a toolchain w/ threads" 117*4882a593Smuzhiyun depends on !BR2_TOOLCHAIN_HAS_THREADS 118