[Buildroot] [PATCH 0/9] package/libselinux: kernel munging fixups

[Buildroot] [PATCH 0/9] package/libselinux: kernel munging fixups

[aduskett at gmail.com]

From: Adam Duskett <Aduskett@gmail.com>

There are currently two issues with our current kernel munging implimentation
for libselinux:

1) As of kernel 5.1, CONFIG_SECURITY_SELINUX no longer enables SELinux.
   Instead, the kernel now has the new option CONFIG_LSM, which is a
   comma-separated list of linux-security modules in which the kernel enables
   in order.

  The first patch sets CONFIG_LSM to "selinux" to fix SELinux not starting on
  kernels >= 5.1.

2) Many filesystems need SELinux support explicitly enabled in the kernel for
   SELinux to work correctly. The subsequent patches check the config options
   BR2_TARGET_ROOTFS_${FS_NAME} and then set the necessary kernel options to
   enable SELinux support for the given enabled filesystems.

  However, I have chosen not to go so far as to enable the filesystem itself in
  the kernel, as this seems to not be the standard practice in Buildroot.

  It would also greatly complicate the logic, as ext2 has to be enabled for a
  user to select ext4 support. If a user were to select ext4, then the
  libselinux package would enable ext2 and ext4, which may not be desirable.

With these patches, if a user selects the libselinux and refpolicy packages,
then they will get a system that boots with selinux running, which is a
massive improvement over what happens now.


Adam Duskett (9):
  package/libselinux: set the config_lsm kernel config option to selinux
  package/libselinux: enable kernel selinux support for erofs images
  package/libselinux: enable kernel selinux support for ext2 images
  package/libselinux: enable kernel selinux support for ext3 images
  package/libselinux: enable kernel selinux support for ext4 images
  package/libselinux: enable kernel selinux support for f2fs images
  package/libselinux: enable kernel selinux support for jffs2 images
  package/libselinux: enable kernel selinux support for squashfs images
  package/libselinux: enable kernel selinux support for ubifs images

 package/libselinux/libselinux.mk | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

-- 
2.26.2

[Buildroot] [PATCH 1/9] package/libselinux: set the config_lsm kernel config option to selinux

[aduskett at gmail.com]

From: Adam Duskett <Aduskett@gmail.com>

Currently, the libselinux package sets the CONFIG_DEFAULT_SECURITY_SELINUX
kernel option. However, as of kernels >= 5.1, this option is superseded in
favor of the CONFIG_LSM option, a comma-separated list of LSMs the kernel
should initialize in order.

As the previous behavior of this package sets the kernel's default and only
LSM to initialize to SELinux, it is safe to set this string to just selinux.
If the user wants additional LSM's, they may do so with a custom kernel config.

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
---
 package/libselinux/libselinux.mk | 1 +
 1 file changed, 1 insertion(+)

diff --git a/package/libselinux/libselinux.mk b/package/libselinux/libselinux.mk
index f7397141d5..521dbaaba8 100644
--- a/package/libselinux/libselinux.mk
+++ b/package/libselinux/libselinux.mk
@@ -111,6 +111,7 @@ define LIBSELINUX_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SECURITY)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SECURITY_NETWORK)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SECURITY_SELINUX)
+	$(call KCONFIG_SET_OPT,CONFIG_LSM,"selinux")
 endef
 
 $(eval $(generic-package))
-- 
2.26.2

[Buildroot] [PATCH 2/9] package/libselinux: enable kernel selinux support for erofs images

[aduskett at gmail.com]

From: Adam Duskett <Aduskett@gmail.com>

If BR2_TARGET_ROOTFS_EROFS is selected, enable the following kernel options:
  - CONFIG_EROFS_FS_XATTR
  - CONFIG_EROFS_FS_SECURITY

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
---
 package/libselinux/libselinux.mk | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/package/libselinux/libselinux.mk b/package/libselinux/libselinux.mk
index 521dbaaba8..b8f9c3b55a 100644
--- a/package/libselinux/libselinux.mk
+++ b/package/libselinux/libselinux.mk
@@ -112,6 +112,9 @@ define LIBSELINUX_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SECURITY_NETWORK)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SECURITY_SELINUX)
 	$(call KCONFIG_SET_OPT,CONFIG_LSM,"selinux")
+	$(if $(BR2_TARGET_ROOTFS_EROFS),
+		$(call KCONFIG_ENABLE_OPT,CONFIG_EROFS_FS_XATTR)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_EROFS_FS_SECURITY))
 endef
 
 $(eval $(generic-package))
-- 
2.26.2

[Buildroot] [PATCH 3/9] package/libselinux: enable kernel selinux support for ext2 images

[aduskett at gmail.com]

From: Adam Duskett <Aduskett@gmail.com>

If BR2_TARGET_ROOTFS_EXT2 is selected, enable the following kernel options:
  - CONFIG_EXT2_FS_XATTR
  - CONFIG_EXT2_FS_SECURITY

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
---
 package/libselinux/libselinux.mk | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/package/libselinux/libselinux.mk b/package/libselinux/libselinux.mk
index b8f9c3b55a..77efe2d8e0 100644
--- a/package/libselinux/libselinux.mk
+++ b/package/libselinux/libselinux.mk
@@ -115,6 +115,9 @@ define LIBSELINUX_LINUX_CONFIG_FIXUPS
 	$(if $(BR2_TARGET_ROOTFS_EROFS),
 		$(call KCONFIG_ENABLE_OPT,CONFIG_EROFS_FS_XATTR)
 		$(call KCONFIG_ENABLE_OPT,CONFIG_EROFS_FS_SECURITY))
+	$(if $(BR2_TARGET_ROOTFS_EXT2),
+		$(call KCONFIG_ENABLE_OPT,CONFIG_EXT2_FS_XATTR)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_EXT2_FS_SECURITY))
 endef
 
 $(eval $(generic-package))
-- 
2.26.2

[Buildroot] [PATCH 4/9] package/libselinux: enable kernel selinux support for ext3 images

[aduskett at gmail.com]

From: Adam Duskett <Aduskett@gmail.com>

If BR2_TARGET_ROOTFS_EXT2_3 is selected, enable the following kernel options:
  - CONFIG_EXT3_FS_SECURITY

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
---
 package/libselinux/libselinux.mk | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/package/libselinux/libselinux.mk b/package/libselinux/libselinux.mk
index 77efe2d8e0..525f4fe9a2 100644
--- a/package/libselinux/libselinux.mk
+++ b/package/libselinux/libselinux.mk
@@ -118,6 +118,8 @@ define LIBSELINUX_LINUX_CONFIG_FIXUPS
 	$(if $(BR2_TARGET_ROOTFS_EXT2),
 		$(call KCONFIG_ENABLE_OPT,CONFIG_EXT2_FS_XATTR)
 		$(call KCONFIG_ENABLE_OPT,CONFIG_EXT2_FS_SECURITY))
+	$(if $(BR2_TARGET_ROOTFS_EXT2_3),
+		$(call KCONFIG_ENABLE_OPT,CONFIG_EXT3_FS_SECURITY))
 endef
 
 $(eval $(generic-package))
-- 
2.26.2

[Buildroot] [PATCH 5/9] package/libselinux: enable kernel selinux support for ext4 images

[aduskett at gmail.com]

From: Adam Duskett <Aduskett@gmail.com>

If BR2_TARGET_ROOTFS_EXT2_4 is selected, enable the following kernel options:
  - CONFIG_EXT4_FS_SECURITY

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
---
 package/libselinux/libselinux.mk | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/package/libselinux/libselinux.mk b/package/libselinux/libselinux.mk
index 525f4fe9a2..44d9ec3657 100644
--- a/package/libselinux/libselinux.mk
+++ b/package/libselinux/libselinux.mk
@@ -120,6 +120,8 @@ define LIBSELINUX_LINUX_CONFIG_FIXUPS
 		$(call KCONFIG_ENABLE_OPT,CONFIG_EXT2_FS_SECURITY))
 	$(if $(BR2_TARGET_ROOTFS_EXT2_3),
 		$(call KCONFIG_ENABLE_OPT,CONFIG_EXT3_FS_SECURITY))
+	$(if $(BR2_TARGET_ROOTFS_EXT2_4),
+		$(call KCONFIG_ENABLE_OPT,CONFIG_EXT4_FS_SECURITY))
 endef
 
 $(eval $(generic-package))
-- 
2.26.2

[Buildroot] [PATCH 6/9] package/libselinux: enable kernel selinux support for f2fs images

[aduskett at gmail.com]

From: Adam Duskett <Aduskett@gmail.com>

If BR2_TARGET_ROOTFS_F2FS is selected, enable the following kernel options:
  - CONFIG_F2FS_FS_XATTR
  - CONFIG_F2FS_FS_SECURITY

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
---
 package/libselinux/libselinux.mk | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/package/libselinux/libselinux.mk b/package/libselinux/libselinux.mk
index 44d9ec3657..c16dcdf1d0 100644
--- a/package/libselinux/libselinux.mk
+++ b/package/libselinux/libselinux.mk
@@ -122,6 +122,9 @@ define LIBSELINUX_LINUX_CONFIG_FIXUPS
 		$(call KCONFIG_ENABLE_OPT,CONFIG_EXT3_FS_SECURITY))
 	$(if $(BR2_TARGET_ROOTFS_EXT2_4),
 		$(call KCONFIG_ENABLE_OPT,CONFIG_EXT4_FS_SECURITY))
+	$(if $(BR2_TARGET_ROOTFS_F2FS),
+		$(call KCONFIG_ENABLE_OPT,CONFIG_F2FS_FS_XATTR)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_F2FS_FS_SECURITY))
 endef
 
 $(eval $(generic-package))
-- 
2.26.2

[Buildroot] [PATCH 7/9] package/libselinux: enable kernel selinux support for jffs2 images

[aduskett at gmail.com]

From: Adam Duskett <Aduskett@gmail.com>

If BR2_TARGET_ROOTFS_JFFS2 is selected, enable the following kernel options:
  - CONFIG_JFS_SECURITY

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
---
 package/libselinux/libselinux.mk | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/package/libselinux/libselinux.mk b/package/libselinux/libselinux.mk
index c16dcdf1d0..3dee922214 100644
--- a/package/libselinux/libselinux.mk
+++ b/package/libselinux/libselinux.mk
@@ -125,6 +125,8 @@ define LIBSELINUX_LINUX_CONFIG_FIXUPS
 	$(if $(BR2_TARGET_ROOTFS_F2FS),
 		$(call KCONFIG_ENABLE_OPT,CONFIG_F2FS_FS_XATTR)
 		$(call KCONFIG_ENABLE_OPT,CONFIG_F2FS_FS_SECURITY))
+	$(if $(BR2_TARGET_ROOTFS_JFFS2),
+		$(call KCONFIG_ENABLE_OPT,CONFIG_JFS_SECURITY))
 endef
 
 $(eval $(generic-package))
-- 
2.26.2

[Buildroot] [PATCH 8/9] package/libselinux: enable kernel selinux support for squashfs images

[aduskett at gmail.com]

From: Adam Duskett <Aduskett@gmail.com>

If BR2_TARGET_ROOTFS_SQUASHFS is selected, enable the following kernel options:
  - CONFIG_SQUASHFS_XATTR

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
---
 package/libselinux/libselinux.mk | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/package/libselinux/libselinux.mk b/package/libselinux/libselinux.mk
index 3dee922214..f2c2922122 100644
--- a/package/libselinux/libselinux.mk
+++ b/package/libselinux/libselinux.mk
@@ -127,6 +127,8 @@ define LIBSELINUX_LINUX_CONFIG_FIXUPS
 		$(call KCONFIG_ENABLE_OPT,CONFIG_F2FS_FS_SECURITY))
 	$(if $(BR2_TARGET_ROOTFS_JFFS2),
 		$(call KCONFIG_ENABLE_OPT,CONFIG_JFS_SECURITY))
+	$(if $(BR2_TARGET_ROOTFS_SQUASHFS),
+		$(call KCONFIG_ENABLE_OPT,CONFIG_SQUASHFS_XATTR))
 endef
 
 $(eval $(generic-package))
-- 
2.26.2

[Buildroot] [PATCH 9/9] package/libselinux: enable kernel selinux support for ubifs images

[aduskett at gmail.com]

From: Adam Duskett <Aduskett@gmail.com>

If BR2_TARGET_ROOTFS_UBIFS is selected, enable the following kernel options:
  - CONFIG_UBIFS_FS_XATTR
  - CONFIG_UBIFS_FS_SECURITY

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
---
 package/libselinux/libselinux.mk | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/package/libselinux/libselinux.mk b/package/libselinux/libselinux.mk
index f2c2922122..c96b5a4431 100644
--- a/package/libselinux/libselinux.mk
+++ b/package/libselinux/libselinux.mk
@@ -129,6 +129,9 @@ define LIBSELINUX_LINUX_CONFIG_FIXUPS
 		$(call KCONFIG_ENABLE_OPT,CONFIG_JFS_SECURITY))
 	$(if $(BR2_TARGET_ROOTFS_SQUASHFS),
 		$(call KCONFIG_ENABLE_OPT,CONFIG_SQUASHFS_XATTR))
+	$(if $(BR2_TARGET_ROOTFS_UBIFS),
+		$(call KCONFIG_ENABLE_OPT,CONFIG_UBIFS_FS_XATTR)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_UBIFS_FS_SECURITY))
 endef
 
 $(eval $(generic-package))
-- 
2.26.2

[Buildroot] [PATCH 0/9] package/libselinux: kernel munging fixups

[Thomas Petazzoni]

Hello,

On Fri, 31 Jul 2020 13:40:51 -0700
aduskett at gmail.com wrote:

> Adam Duskett (9):
>   package/libselinux: set the config_lsm kernel config option to selinux
>   package/libselinux: enable kernel selinux support for erofs images
>   package/libselinux: enable kernel selinux support for ext2 images
>   package/libselinux: enable kernel selinux support for ext3 images
>   package/libselinux: enable kernel selinux support for ext4 images
>   package/libselinux: enable kernel selinux support for f2fs images
>   package/libselinux: enable kernel selinux support for jffs2 images
>   package/libselinux: enable kernel selinux support for squashfs images
>   package/libselinux: enable kernel selinux support for ubifs images

I don't see those patches anymore in patchwork, I'm not sure why. Did
you change their status?

Anyway, I've applied the entire series. Thanks!

Thomas
-- 
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com