[Buildroot] [PATCH] package/libselinux: Add autorelabel for first boot

[José Pekkarinen]

Currently buildroot ship libselinux without triggering
this option, which often shows inconsistencies between
what the refpolicy defines as a label for a file and
what the actual file has. Triggering an initial relabel
would help activating enforcing state right away without
requiring to enter it once in permissive and tweak the
labels.

Signed-off-by: José Pekkarinen <jose.pekkarinen at unikie.com>
---
 package/libselinux/Config.in     | 5 +++++
 package/libselinux/libselinux.mk | 4 ++++
 2 files changed, 9 insertions(+)

diff --git a/package/libselinux/Config.in b/package/libselinux/Config.in
index 62070c8d59..49eb30bdde 100644
--- a/package/libselinux/Config.in
+++ b/package/libselinux/Config.in
@@ -18,3 +18,8 @@ config BR2_PACKAGE_LIBSELINUX
 
 comment "libselinux needs a toolchain w/ threads, dynamic library"
 	depends on !BR2_TOOLCHAIN_HAS_THREADS || BR2_STATIC_LIBS
+
+config BR2_PACKAGE_LIBSELINUX_AUTORELABEL
+	bool
+	depends on BR2_PACKAGE_LIBSELINUX
+	default y
diff --git a/package/libselinux/libselinux.mk b/package/libselinux/libselinux.mk
index fdd13aa942..de2e7884df 100644
--- a/package/libselinux/libselinux.mk
+++ b/package/libselinux/libselinux.mk
@@ -71,6 +71,10 @@ define LIBSELINUX_INSTALL_TARGET_CMDS
 	$(TARGET_MAKE_ENV) $(MAKE) -C $(@D) \
 		$(LIBSELINUX_MAKE_OPTS) DESTDIR=$(TARGET_DIR) \
 		$(LIBSELINUX_MAKE_INSTALL_TARGETS)
+	ifeq ($(BR2_PACKAGE_LIBSELINUX_AUTORELABEL),y)
+		echo "-F" > $(TARGET_DIR)/.autorelabel
+		mkdir $(TARGET_DIR)/var/lib/selinux
+	fi # autorelabel
 	if ! grep -q "selinuxfs" $(TARGET_DIR)/etc/fstab; then \
 		echo "none /sys/fs/selinux selinuxfs noauto 0 0" >> $(TARGET_DIR)/etc/fstab ; fi
 endef
-- 
2.25.1