docs/manual/integration-selinux-support.adoc

// -*- mode:doc; -*-
// vim: set syntax=asciidoc:

[[selinux]]
=== Using SELinux in Buildroot

https://selinuxproject.org[SELinux] is a Linux kernel security module
enforcing access control policies. In addition to the traditional file
permissions and access control lists, +SELinux+ allows to write rules
for users or processes to access specific functions of resources
(files, sockets...).

_SELinux_ has three modes of operation:

* _Disabled_: the policy is not applied
* _Permissive_: the policy is applied, and non-authorized actions are
  simply logged. This mode is often used for troubleshooting SELinux
  issues.
* _Enforcing_: the policy is applied, and non-authorized actions are
  denied

In Buildroot the mode of operation is controlled by the
+BR2_PACKAGE_REFPOLICY_POLICY_STATE_*+ configuration options. The
Linux kernel also has various configuration options that affect how
+SELinux+ is enabled (see +security/selinux/Kconfig+ in the Linux
kernel sources).

By default in Buildroot the +SELinux+ policy is provided by the
upstream https://github.com/SELinuxProject/refpolicy[refpolicy]
project, enabled with +BR2_PACKAGE_REFPOLICY+.

[[enabling-selinux]]
==== Enabling SELinux support

To have proper support for +SELinux+ in a Buildroot generated system,
the following configuration options must be enabled:

* +BR2_PACKAGE_LIBSELINUX+
* +BR2_PACKAGE_REFPOLICY+

In addition, your filesystem image format must support extended
attributes.

[[selinux-policy-tweaking]]
==== SELinux policy tweaking

The +SELinux refpolicy+ contains modules that can be enabled or
disabled when being built. Each module provide a number of +SELinux+
rules. In Buildroot the non-base modules are disabled by default and
several ways to enable such modules are provided:

- Packages can enable a list of +SELinux+ modules within the +refpolicy+ using
  the +<packagename>_SELINUX_MODULES+ variable.
- Packages can provide additional +SELinux+ modules by putting them (.fc, .if
  and .te files) in +package/<packagename>/selinux/+.
- Extra +SELinux+ modules can be added in directories pointed by the
  +BR2_REFPOLICY_EXTRA_MODULES_DIRS+ configuration option.
- Additional modules in the +refpolicy+ can be enabled if listed in the
  +BR2_REFPOLICY_EXTRA_MODULES_DEPENDENCIES+ configuration option.

Buildroot also allows to completely override the +refpolicy+. This
allows to provide a full custom policy designed specifically for a
given system. When going this way, all of the above mechanisms are
disabled: no extra +SElinux+ module is added to the policy, and all
the available modules within the custom policy are enabled and built
into the final binary policy. The custom policy must be a fork of the
official https://github.com/SELinuxProject/refpolicy[refpolicy].

In order to fully override the +refpolicy+ the following configuration
variables have to be set:

- +BR2_PACKAGE_REFPOLICY_CUSTOM_GIT+
- +BR2_PACKAGE_REFPOLICY_CUSTOM_REPO_URL+
- +BR2_PACKAGE_REFPOLICY_CUSTOM_REPO_VERSION+