selinux-support.txt 2.9 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374
  1. // -*- mode:doc; -*-
  2. // vim: set syntax=asciidoc:
  3. [[selinux]]
  4. == Using SELinux in Buildroot
  5. https://selinuxproject.org[SELinux] is a Linux kernel security module
  6. enforcing access control policies. In addition to the traditional file
  7. permissions and access control lists, +SELinux+ allows to write rules
  8. for users or processes to access specific functions of resources
  9. (files, sockets...).
  10. _SELinux_ has three modes of operation:
  11. * _Disabled_: the policy is not applied
  12. * _Permissive_: the policy is applied, and non-authorized actions are
  13. simply logged. This mode is often used for troubleshooting SELinux
  14. issues.
  15. * _Enforcing_: the policy is applied, and non-authorized actions are
  16. denied
  17. In Buildroot the mode of operation is controlled by the
  18. +BR2_PACKAGE_REFPOLICY_POLICY_STATE_*+ configuration options. The
  19. Linux kernel also has various configuration options that affect how
  20. +SELinux+ is enabled (see +security/selinux/Kconfig+ in the Linux
  21. kernel sources).
  22. By default in Buildroot the +SELinux+ policy is provided by the
  23. upstream https://github.com/SELinuxProject/refpolicy[refpolicy]
  24. project, enabled with +BR2_PACKAGE_REFPOLICY+.
  25. [[enabling-selinux]]
  26. === Enabling SELinux support
  27. To have proper support for +SELinux+ in a Buildroot generated system,
  28. the following configuration options must be enabled:
  29. * +BR2_PACKAGE_LIBSELINUX+
  30. * +BR2_PACKAGE_REFPOLICY+
  31. In addition, your filesystem image format must support extended
  32. attributes.
  33. [[selinux-policy-tweaking]]
  34. === SELinux policy tweaking
  35. The +SELinux refpolicy+ contains modules that can be enabled or
  36. disabled when being built. Each module provide a number of +SELinux+
  37. rules. In Buildroot the non-base modules are disabled by default and
  38. several ways to enable such modules are provided:
  39. - Packages can enable a list of +SELinux+ modules within the +refpolicy+ using
  40. the +<packagename>_SELINUX_MODULES+ variable.
  41. - Packages can provide additional +SELinux+ modules by putting them (.fc, .if
  42. and .te files) in +package/<packagename>/selinux/+.
  43. - Extra +SELinux+ modules can be added in directories pointed by the
  44. +BR2_REFPOLICY_EXTRA_MODULES_DIRS+ configuration option.
  45. - Additional modules in the +refpolicy+ can be enabled if listed in the
  46. +BR2_REFPOLICY_EXTRA_MODULES_DEPENDENCIES+ configuration option.
  47. Buildroot also allows to completely override the +refpolicy+. This
  48. allows to provide a full custom policy designed specifically for a
  49. given system. When going this way, all of the above mechanisms are
  50. disabled: no extra +SElinux+ module is added to the policy, and all
  51. the available modules within the custom policy are enabled and built
  52. into the final binary policy. The custom policy must be a fork of the
  53. official https://github.com/SELinuxProject/refpolicy[refpolicy].
  54. In order to fully override the +refpolicy+ the following configuration
  55. variables have to be set:
  56. - +BR2_PACKAGE_REFPOLICY_CUSTOM_GIT+
  57. - +BR2_PACKAGE_REFPOLICY_CUSTOM_REPO_URL+
  58. - +BR2_PACKAGE_REFPOLICY_CUSTOM_REPO_VERSION+