From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Sat, 31 Oct 2026 21:39:13 +0100 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1xNFr7-005gTP-1B for lore@lore.pengutronix.de; Sat, 31 Oct 2026 21:39:13 +0100 Received: from [127.0.0.1] (helo=metis.whiteo.stw.pengutronix.de) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xNFr5-0004Fv-Kf; Sat, 31 Oct 2026 21:39:11 +0100 Received: from mx1.white.stw.pengutronix.de ([2a0a:edc0:0:b01:1d::107]) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xNFqP-0001wg-I0 for ptxdist@pengutronix.de; Sat, 31 Oct 2026 21:38:29 +0100 Received: from h4.cmg2.smtp.forpsi.com (h4.cmg2.smtp.forpsi.com [185.129.138.189]) by mx1.white.stw.pengutronix.de (Postfix) with ESMTPS id 6C7CF20294D for ; Sat, 31 Oct 2026 21:38:29 +0100 (CET) ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=pengutronix.de; s=20260414; t=1793479109; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=hNNJlIUZicVrWpcln/hfKyKbnelv5mX9c1z3PCnJyHA=; b=MTm7hj9rMKN3S6kqzIB0BObjna1eWuQCWm8un3g8Iasp0qN+7NpOu+/cbSy+CYHQ0zmw1r hdZwTljlrr9qBzkylG95jIvp4k+ANS2OGAk7rUWjbjyMHHxR8gn7WtUWG7Cs6Jr5G91NCF bzcbUxAD3bwj3Te0+31KteOazT4s+nHU0AzJ4s6s9px6KYslcClCliP1HU3+jDTsjmD9Yi tjggu7s33Dujv+kBOh+FO7VqcdVIuIp00m02nPq4qjc0fig4cYY9h6fZfsshmALcL9JZQb xO/2oGJSetjUVCsc4Vn+OMMza6HrxO1mWgBobJ/DAGGbLtkY0HsFFmTshABwqw== ARC-Authentication-Results: i=1; mx1.white.stw.pengutronix.de; dkim=pass header.d=triops.cz header.s=f2019 header.b=lJrQ6OSk; spf=none (mx1.white.stw.pengutronix.de: domain of oss-lists@triops.cz has no SPF policy when checking 185.129.138.189) smtp.mailfrom=oss-lists@triops.cz; dmarc=none ARC-Seal: i=1; s=20260414; d=pengutronix.de; t=1793479109; a=rsa-sha256; cv=none; b=bzk0f64ruEq/esg+mT0bjTtqzwx623HHtHryaD+G/UB4fj2QNpzUqGHoTwdmLkabHM2q20 y1K2BVuVKGMdCO5kJFvOygKPAiuUrLYI+qowsu3STLCpj2O3DWsJ09MI6GFEc0ZX/rBVvx dX4sm12oev+QgQ4CJUbceI9Bodl7x3XPHyQHlt3YgTeBrhEAsGAgEsvFhxYK+EOuwN6YaS 928mhn7/gi1Bxnzdmy4S6uXOWgBKHRva8wPDPtdsFBvKvC9jcHhHfCoCrd51MPNzH4EH3v CT8rRabbGTmlJ8HE1eNHlp5VYOG75H0vRsHcU/B36PIFrZVSb7xoUWsCOB7drw== Received: from localhost.localdomain ([91.218.190.200]) by cmgsmtp with ESMTPSA id NFqKxUpN38HlqNFqPxK73z; Sat, 31 Oct 2026 21:38:29 +0100 From: Ladislav Michl To: ptxdist@pengutronix.de Date: Sat, 31 Oct 2026 21:38:18 +0100 Message-ID: <20261031203823.357406-18-oss-lists@triops.cz> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261031203823.357406-1-oss-lists@triops.cz> References: <20261031203823.357406-1-oss-lists@triops.cz> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-CMAE-Envelope: MS4xfM0N4Qf9ulSh9lJ49n7dE3i56Za8uRmTlQTJD8mt5dkso7DF4JV/ir3zSm4PuXb+eWVAbxkrPosUEhdkAfAVvyvtqqneidmF/aa6tgRVavr3xewOC7DB LqMTVinCQUOlE94SV7qp2e4EpFOS9L2o0EO3znNS/sQ9fkrPV/c7PN48FiSys3EYTVQiitBqfGMqtyOgp5y+qLYVn6e8qm7/kYc= X-Spamd-Result: default: False [-1.60 / 15.00]; BAYES_HAM(-3.00)[100.00%]; MID_CONTAINS_FROM(1.00)[]; R_MISSING_CHARSET(0.50)[]; R_DKIM_ALLOW(-0.20)[triops.cz:s=f2019]; ONCE_RECEIVED(0.20)[]; MIME_GOOD(-0.10)[text/plain]; RCVD_VIA_SMTP_AUTH(0.00)[]; RCPT_COUNT_ONE(0.00)[1]; RCVD_COUNT_ONE(0.00)[1]; ASN(0.00)[asn:24806, ipnet:185.129.136.0/22, country:CZ]; ARC_NA(0.00)[]; MIME_TRACE(0.00)[0:+]; RCVD_TLS_ALL(0.00)[]; NEURAL_HAM(-0.00)[-0.825]; ARC_SIGNED(0.00)[pengutronix.de:s=20260414:i=1]; FROM_EQ_ENVFROM(0.00)[]; FROM_HAS_DN(0.00)[]; DMARC_NA(0.00)[triops.cz]; R_SPF_NA(0.00)[no SPF record]; TO_MATCH_ENVRCPT_ALL(0.00)[]; TO_DN_NONE(0.00)[]; DKIM_TRACE(0.00)[triops.cz:+] X-Rspamd-Action: no action X-Rspamd-Server: mx1 X-Stat-Signature: kgaehxw6x3daxcuwt41x63jf6puoqre9 X-Rspamd-Queue-Id: 6C7CF20294D Subject: [ptxdist] [PATCH v2 17/17] selinux: restore the global option X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.whiteo.stw.pengutronix.de); SAEximRunCond expanded to false From: Ladislav Michl Restore the GLOBAL_SELINUX option in its former glory. As GLOBAL_SELINUX_OPTION has no users, drop it. Signed-off-by: Ladislav Michl --- CHANGES: - v2: wire GLOBAL_SELINUX also into dbus (replacing BROKEN DBUS_SELINUX) and iproute2. rules/at.in | 1 + rules/busybox.in | 1 + rules/casync.in | 1 + rules/connman.in | 1 + rules/core-selinux.in | 1 - rules/coreutils.in | 1 + rules/dbus.in | 6 +----- rules/dbus.make | 2 +- rules/f2fs-tools.in | 1 + rules/gnupg.in | 1 + rules/iproute2.in | 1 + rules/iproute2.make | 3 +++ rules/logrotate.in | 1 + rules/lxc.in | 1 + rules/mtd-utils.in | 1 + rules/openssh.in | 1 + rules/pre/Rules.make | 6 ------ rules/shadow.in | 1 + rules/strongswan.in | 1 + rules/systemd.in | 1 + 20 files changed, 20 insertions(+), 13 deletions(-) diff --git a/rules/at.in b/rules/at.in index 13a1916c6..567324300 100644 --- a/rules/at.in +++ b/rules/at.in @@ -9,6 +9,7 @@ menuconfig AT select ROOTFS_VAR_SPOOL_CRON select BUSYBOX_START_STOP_DAEMON if AT_STARTSCRIPT select BUSYBOX_FEATURE_START_STOP_DAEMON_FANCY if AT_STARTSCRIPT + select LIBSELINUX if GLOBAL_SELINUX help Delayed job execution and batch processing diff --git a/rules/busybox.in b/rules/busybox.in index 6bb60145d..612e21ade 100644 --- a/rules/busybox.in +++ b/rules/busybox.in @@ -10,6 +10,7 @@ menuconfig BUSYBOX select GCCLIBS_GCC_S if !BUSYBOX_STATIC select PAM if GLOBAL_PAM select BUSYBOX_PAM if GLOBAL_PAM + select LIBSELINUX if BUSYBOX_SELINUX select LIBTIRPC if BUSYBOX_NEED_LIBTIRPC select BUSYBOX_INSTALL_NO_USR help diff --git a/rules/casync.in b/rules/casync.in index 2135e84ff..b11b8c5ce 100644 --- a/rules/casync.in +++ b/rules/casync.in @@ -16,6 +16,7 @@ menuconfig CASYNC select UDEV_LIBUDEV if CASYNC_UDEV select XZ if CASYNC_LZMA select ZLIB if CASYNC_ZLIB + select LIBSELINUX if GLOBAL_SELINUX help casync - Content Addressable Data Synchronizer. diff --git a/rules/connman.in b/rules/connman.in index a051e66f7..53738fcf0 100644 --- a/rules/connman.in +++ b/rules/connman.in @@ -14,6 +14,7 @@ menuconfig CONNMAN select WPA_SUPPLICANT_CTRL_IFACE_DBUS if CONNMAN_WIFI select BUSYBOX_START_STOP_DAEMON if CONNMAN_STARTSCRIPT && RUNTIME select ROOTFS_VAR_LIB if RUNTIME + select LIBSELINUX if GLOBAL_SELINUX prompt "connman " help The Connection Manager project provides a daemon for diff --git a/rules/core-selinux.in b/rules/core-selinux.in index 2a5cb87ef..236c77441 100644 --- a/rules/core-selinux.in +++ b/rules/core-selinux.in @@ -5,7 +5,6 @@ config GLOBAL_SELINUX select BUSYBOX_SELINUX if BUSYBOX select BUSYBOX_BUILD_LIBBUSYBOX if BUSYBOX select BUSYBOX_FEATURE_INDIVIDUAL if BUSYBOX - depends on BROKEN prompt "SELinux support" help This will enable SELinux for all packages with optional diff --git a/rules/coreutils.in b/rules/coreutils.in index 504283736..c3aee2786 100644 --- a/rules/coreutils.in +++ b/rules/coreutils.in @@ -8,6 +8,7 @@ menuconfig COREUTILS select GCCLIBS_GCC_S select ATTR if COREUTILS_XATTR select SYSTEMD if COREUTILS_SYSTEMD + select LIBSELINUX if GLOBAL_SELINUX help This package contains the essential basic system utilities. diff --git a/rules/dbus.in b/rules/dbus.in index b205ee62f..d4776a5d1 100644 --- a/rules/dbus.in +++ b/rules/dbus.in @@ -8,6 +8,7 @@ menuconfig DBUS select XORG_LIB_X11 if DBUS_X select MACHINE_ID if RUNTIME select SYSTEMD if DBUS_SYSTEMD + select LIBSELINUX if GLOBAL_SELINUX select LIBC_PTHREAD select LIBC_RT help @@ -27,11 +28,6 @@ menuconfig DBUS if DBUS -config DBUS_SELINUX - prompt "selinux support [BROKEN]" - depends on BROKEN - bool - config DBUS_SYSTEMD bool default INITMETHOD_SYSTEMD diff --git a/rules/dbus.make b/rules/dbus.make index db5b9d0b6..fd0f3fb1e 100644 --- a/rules/dbus.make +++ b/rules/dbus.make @@ -62,7 +62,7 @@ DBUS_CONF_OPT := \ -Dmodular_tests=disabled \ -Dqt_help=disabled \ -Drelocation=disabled \ - -Dselinux=$(call ptx/endis, PTXCONF_DBUS_SELINUX)d \ + -Dselinux=$(call ptx/endis, PTXCONF_GLOBAL_SELINUX)d \ -Dstats=false \ -Dsystemd=$(call ptx/endis, PTXCONF_DBUS_SYSTEMD)d \ -Dsystemd_system_unitdir=/usr/lib/systemd/system \ diff --git a/rules/f2fs-tools.in b/rules/f2fs-tools.in index dbcdb9d96..5d2ba5f41 100644 --- a/rules/f2fs-tools.in +++ b/rules/f2fs-tools.in @@ -5,6 +5,7 @@ config F2FS_TOOLS prompt "f2fs-tools" select LIBUUID select LIBBLKID + select LIBSELINUX if GLOBAL_SELINUX help The f2fs-tools package provides the filesystem utilities for use with the f2fs filesystem (flash-friendly filesystem) diff --git a/rules/gnupg.in b/rules/gnupg.in index 2bad06187..9b731efc0 100644 --- a/rules/gnupg.in +++ b/rules/gnupg.in @@ -15,6 +15,7 @@ menuconfig GNUPG select BZIP2_LIBBZ2 if GNUPG_GPG_BZIP2 # disabling GNUPG_GPG_EDDSA is broken select GNUPG_GPG_EDDSA + select LIBSELINUX if GLOBAL_SELINUX help GnuPG - The GNU Privacy Guard suite of programs diff --git a/rules/iproute2.in b/rules/iproute2.in index 48e44fb3b..03a7bf4a1 100644 --- a/rules/iproute2.in +++ b/rules/iproute2.in @@ -11,6 +11,7 @@ menuconfig IPROUTE2 select LIBC_PTHREAD if IPROUTE2_ARPD select LIBC_RESOLV select LIBMNL if IPROUTE2_DEVLINK || IPROUTE2_DCB + select LIBSELINUX if GLOBAL_SELINUX select PYTHON3 if IPROUTE2_ROUTEL && RUNTIME help Networking and traffic control tools diff --git a/rules/iproute2.make b/rules/iproute2.make index 18222d792..706d31089 100644 --- a/rules/iproute2.make +++ b/rules/iproute2.make @@ -39,6 +39,9 @@ $(STATEDIR)/iproute2.prepare: @echo 'TC_CONFIG_ATM:=n' >> $(IPROUTE2_DIR)/config.mk ifndef PTXCONF_IPROUTE2_ARPD @echo 'HAVE_BERKELEY_DB:=n' >> $(IPROUTE2_DIR)/config.mk +endif +ifndef PTXCONF_GLOBAL_SELINUX + @echo 'HAVE_SELINUX:=n' >> $(IPROUTE2_DIR)/config.mk endif @$(call touch) diff --git a/rules/logrotate.in b/rules/logrotate.in index f3b465b87..9f13695d3 100644 --- a/rules/logrotate.in +++ b/rules/logrotate.in @@ -6,6 +6,7 @@ menuconfig LOGROTATE select LIBPOPT select ACL if LOGROTATE_ACL select ROOTFS_VAR_LIB if RUNTIME + select LIBSELINUX if GLOBAL_SELINUX help The logrotate utility is designed to simplify the administration of log files on a system which generates a lot diff --git a/rules/lxc.in b/rules/lxc.in index e8dc765e6..3a06c8724 100644 --- a/rules/lxc.in +++ b/rules/lxc.in @@ -13,6 +13,7 @@ menuconfig LXC select IPTABLES_IPV4 if LXC_SYSTEMD_UNIT select IPTABLES_IPV6 if LXC_SYSTEMD_UNIT select IPTABLES_INSTALL_TOOLS if LXC_SYSTEMD_UNIT + select LIBSELINUX if GLOBAL_SELINUX help LXC is a userspace interface for the Linux kernel containment features. Through a powerful API and simple tools, it lets diff --git a/rules/mtd-utils.in b/rules/mtd-utils.in index d3143e2d5..265279f72 100644 --- a/rules/mtd-utils.in +++ b/rules/mtd-utils.in @@ -8,6 +8,7 @@ menuconfig MTD_UTILS select ZLIB select LIBUUID if MTD_UTILS_UBIFS select LIBLZO if MTD_UTILS_USE_LIBLZO + select LIBSELINUX if GLOBAL_SELINUX help Memory Technology Device Utilities diff --git a/rules/openssh.in b/rules/openssh.in index afbd19675..e73b3343e 100644 --- a/rules/openssh.in +++ b/rules/openssh.in @@ -9,6 +9,7 @@ menuconfig OPENSSH select RC_ONCE if OPENSSH_SSHD_GENKEYS && RUNTIME select BUSYBOX_START_STOP_DAEMON if OPENSSH_SSHD_STARTSCRIPT select OPENSSH_KEYGEN if OPENSSH_SSHD_GENKEYS + select LIBSELINUX if GLOBAL_SELINUX prompt "openssh " help secure shell client/server, an rlogin/rsh/rcp replacement diff --git a/rules/pre/Rules.make b/rules/pre/Rules.make index fd5ddfe55..89b4e9c02 100644 --- a/rules/pre/Rules.make +++ b/rules/pre/Rules.make @@ -296,12 +296,6 @@ else GLOBAL_PAM_OPTION := --disable-pam endif -ifdef PTXCONF_GLOBAL_SELINUX -GLOBAL_SELINUX_OPTION := --enable-selinux -else -GLOBAL_SELINUX_OPTION := --disable-selinux -endif - # ---------------------------------------------------------------------------- # HOST stuff # ---------------------------------------------------------------------------- diff --git a/rules/shadow.in b/rules/shadow.in index b3979ebd3..3313d3771 100644 --- a/rules/shadow.in +++ b/rules/shadow.in @@ -7,6 +7,7 @@ menuconfig SHADOW depends on (!BUSYBOX_ADDUSER && !BUSYBOX_ADDGROUP && !BUSYBOX_LOGIN && !BUSYBOX_PASSWD && !BUSYBOX_SU) || ALLYES select LIBC_CRYPT select PAM if GLOBAL_PAM + select LIBSELINUX if GLOBAL_SELINUX prompt "shadow " help Password and account management tool suite with support diff --git a/rules/strongswan.in b/rules/strongswan.in index dca4cac99..78ddbd526 100644 --- a/rules/strongswan.in +++ b/rules/strongswan.in @@ -7,6 +7,7 @@ menuconfig STRONGSWAN select LIBCURL if STRONGSWAN_LIBCURL select OPENSSL if STRONGSWAN_OPENSSL select SYSTEMD if STRONGSWAN_SYSTEMD_UNIT + select LIBSELINUX if GLOBAL_SELINUX help strongSwan is a complete IPsec implementation. Please keep in mind to configure the kernel accordingly to fulfill diff --git a/rules/systemd.in b/rules/systemd.in index cfe4d40b5..cc1fda27e 100644 --- a/rules/systemd.in +++ b/rules/systemd.in @@ -35,6 +35,7 @@ config SYSTEMD select LZ4 if SYSTEMD_LZ4 select ZSTD if SYSTEMD_ZSTD select PCRE2 if SYSTEMD_PCRE2 + select LIBSELINUX if GLOBAL_SELINUX select LIBMICROHTTPD if SYSTEMD_MICROHTTPD select LIBSECCOMP if SYSTEMD_SECCOMP select IPTABLES if SYSTEMD_IPMASQUERADE -- 2.47.3