Hi. I'm coming to ask about the problems I met when trying to build and run OpenWRT with SELinux.
I have turned on the following options related to SELinux in menuconfig:
- Base System -> selinux-policy
- Development -> gcc, m4, make
- Global Build Settings -> default SELinux type -> targeted
- Utilities -> libselinux tools -> all the utilities
- Utilities -> selinux-audit2allow, selinux-chcat, selinux-semanage, semodule-utils, setools, secilc, policycoreutils
When I tried to turn on the "Support NSA Security Enhanced Linux" option (located at "Base system"->"Customize busybox options"->"Settings" in menuconfig), the compiling process failed with the following notification:
/home/aurora/iot/openwrt-try2/openwrt/staging_dir/toolchain-x86_64_gcc-8.4.0_musl/lib/gcc/x86_64-openwrt-linux-musl/8.4.0/../../../../x86_64-openwrt-linux-musl/bin/ld: /home/aurora/iot/openwrt-try2/openwrt/tmp/ccV977D8.ltrans0.ltrans.o: in function `setfscreatecon_or_die':
<artificial>:(.text.setfscreatecon_or_die+0x6): undefined reference to `setfscreatecon'
/home/aurora/iot/openwrt-try2/openwrt/staging_dir/toolchain-x86_64_gcc-8.4.0_musl/lib/gcc/x86_64-openwrt-linux-musl/8.4.0/../../../../x86_64-openwrt-linux-musl/bin/ld: /home/aurora/iot/openwrt-try2/openwrt/tmp/ccV977D8.ltrans0.ltrans.o: in function `procps_scan':
<artificial>:(.text.procps_scan+0xd1): undefined reference to `getpidcon'
/home/aurora/iot/openwrt-try2/openwrt/staging_dir/toolchain-x86_64_gcc-8.4.0_musl/lib/gcc/x86_64-openwrt-linux-musl/8.4.0/../../../../x86_64-openwrt-linux-musl/bin/ld: /home/aurora/iot/openwrt-try2/openwrt/tmp/ccV977D8.ltrans0.ltrans.o: in function `update_passwd':
<artificial>:(.text.update_passwd+0x10f): undefined reference to `is_selinux_enabled'
/home/aurora/iot/openwrt-try2/openwrt/staging_dir/toolchain-x86_64_gcc-8.4.0_musl/lib/gcc/x86_64-openwrt-linux-musl/8.4.0/../../../../x86_64-openwrt-linux-musl/bin/ld: <artificial>:(.text.update_passwd+0x122): undefined reference to `getprevcon_raw'
/home/aurora/iot/openwrt-try2/openwrt/staging_dir/toolchain-x86_64_gcc-8.4.0_musl/lib/gcc/x86_64-openwrt-linux-musl/8.4.0/../../../../x86_64-openwrt-linux-musl/bin/ld: <artificial>:(.text.update_passwd+0x174): undefined reference to `string_to_security_class'
/home/aurora/iot/openwrt-try2/openwrt/staging_dir/toolchain-x86_64_gcc-8.4.0_musl/lib/gcc/x86_64-openwrt-linux-musl/8.4.0/../../../../x86_64-openwrt-linux-musl/bin/ld: <artificial>:(.text.update_passwd+0x191): undefined reference to `string_to_av_perm'
/home/aurora/iot/openwrt-try2/openwrt/staging_dir/toolchain-x86_64_gcc-8.4.0_musl/lib/gcc/x86_64-openwrt-linux-musl/8.4.0/../../../../x86_64-openwrt-linux-musl/bin/ld: <artificial>:(.text.update_passwd+0x19d): undefined reference to `selinux_check_passwd_access'
/home/aurora/iot/openwrt-try2/openwrt/staging_dir/toolchain-x86_64_gcc-8.4.0_musl/lib/gcc/x86_64-openwrt-linux-musl/8.4.0/../../../../x86_64-openwrt-linux-musl/bin/ld: <artificial>:(.text.update_passwd+0x22d): undefined reference to `fgetfilecon'
/home/aurora/iot/openwrt-try2/openwrt/staging_dir/toolchain-x86_64_gcc-8.4.0_musl/lib/gcc/x86_64-openwrt-linux-musl/8.4.0/../../../../x86_64-openwrt-linux-musl/bin/ld: <artificial>:(.text.update_passwd+0x263): undefined reference to `freecon'
/home/aurora/iot/openwrt-try2/openwrt/staging_dir/toolchain-x86_64_gcc-8.4.0_musl/lib/gcc/x86_64-openwrt-linux-musl/8.4.0/../../../../x86_64-openwrt-linux-musl/bin/ld: /home/aurora/iot/openwrt-try2/openwrt/tmp/ccV977D8.ltrans0.ltrans.o: in function `copy_file':
<artificial>:(.text.copy_file+0xde): undefined reference to `is_selinux_enabled'
/home/aurora/iot/openwrt-try2/openwrt/staging_dir/toolchain-x86_64_gcc-8.4.0_musl/lib/gcc/x86_64-openwrt-linux-musl/8.4.0/../../../../x86_64-openwrt-linux-musl/bin/ld: <artificial>:(.text.copy_file+0xf0): undefined reference to `lgetfilecon'
/home/aurora/iot/openwrt-try2/openwrt/staging_dir/toolchain-x86_64_gcc-8.4.0_musl/lib/gcc/x86_64-openwrt-linux-musl/8.4.0/../../../../x86_64-openwrt-linux-musl/bin/ld: <artificial>:(.text.copy_file+0xff): undefined reference to `setfscreatecon'
/home/aurora/iot/openwrt-try2/openwrt/staging_dir/toolchain-x86_64_gcc-8.4.0_musl/lib/gcc/x86_64-openwrt-linux-musl/8.4.0/../../../../x86_64-openwrt-linux-musl/bin/ld: <artificial>:(.text.copy_file+0x491): undefined reference to `is_selinux_enabled'
/home/aurora/iot/openwrt-try2/openwrt/staging_dir/toolchain-x86_64_gcc-8.4.0_musl/lib/gcc/x86_64-openwrt-linux-musl/8.4.0/../../../../x86_64-openwrt-linux-musl/bin/ld: <artificial>:(.text.copy_file+0x4a0): undefined reference to `getfscreatecon'
/home/aurora/iot/openwrt-try2/openwrt/staging_dir/toolchain-x86_64_gcc-8.4.0_musl/lib/gcc/x86_64-openwrt-linux-musl/8.4.0/../../../../x86_64-openwrt-linux-musl/bin/ld: <artificial>:(.text.copy_file+0x4c6): undefined reference to `setfilecon'
/home/aurora/iot/openwrt-try2/openwrt/staging_dir/toolchain-x86_64_gcc-8.4.0_musl/lib/gcc/x86_64-openwrt-linux-musl/8.4.0/../../../../x86_64-openwrt-linux-musl/bin/ld: <artificial>:(.text.copy_file+0x4e9): undefined reference to `freecon'
/home/aurora/iot/openwrt-try2/openwrt/staging_dir/toolchain-x86_64_gcc-8.4.0_musl/lib/gcc/x86_64-openwrt-linux-musl/8.4.0/../../../../x86_64-openwrt-linux-musl/bin/ld: <artificial>:(.text.copy_file+0x4f7): undefined reference to `freecon'
/home/aurora/iot/openwrt-try2/openwrt/staging_dir/toolchain-x86_64_gcc-8.4.0_musl/lib/gcc/x86_64-openwrt-linux-musl/8.4.0/../../../../x86_64-openwrt-linux-musl/bin/ld: /home/aurora/iot/openwrt-try2/openwrt/tmp/ccV977D8.ltrans2.ltrans.o: in function `my_stat':
<artificial>:(.text.my_stat+0x4c): undefined reference to `getfilecon'
/home/aurora/iot/openwrt-try2/openwrt/staging_dir/toolchain-x86_64_gcc-8.4.0_musl/lib/gcc/x86_64-openwrt-linux-musl/8.4.0/../../../../x86_64-openwrt-linux-musl/bin/ld: <artificial>:(.text.my_stat+0x78): undefined reference to `lgetfilecon'
/home/aurora/iot/openwrt-try2/openwrt/staging_dir/toolchain-x86_64_gcc-8.4.0_musl/lib/gcc/x86_64-openwrt-linux-musl/8.4.0/../../../../x86_64-openwrt-linux-musl/bin/ld: /home/aurora/iot/openwrt-try2/openwrt/tmp/ccV977D8.ltrans2.ltrans.o: in function `display_single':
<artificial>:(.text.display_single+0x17a): undefined reference to `freecon'
/home/aurora/iot/openwrt-try2/openwrt/staging_dir/toolchain-x86_64_gcc-8.4.0_musl/lib/gcc/x86_64-openwrt-linux-musl/8.4.0/../../../../x86_64-openwrt-linux-musl/bin/ld: /home/aurora/iot/openwrt-try2/openwrt/tmp/ccV977D8.ltrans2.ltrans.o: in function `ls_main':
<artificial>:(.text.ls_main+0x7a): undefined reference to `is_selinux_enabled'
...
collect2: error: ld returned 1 exit status
Note: if build needs additional libraries, put them in CONFIG_EXTRA_LDLIBS.
Example: CONFIG_EXTRA_LDLIBS="pthread dl tirpc audit pam"
make[4]: *** [Makefile:718: busybox_unstripped] Error 1
make[4]: Leaving directory '/home/aurora/iot/openwrt-try2/openwrt/build_dir/target-x86_64_musl/busybox-default/busybox-1.33.0'
make[3]: *** [Makefile:160: /home/aurora/iot/openwrt-try2/openwrt/build_dir/target-x86_64_musl/busybox-default/busybox-1.33.0/.built] Error 2
make[3]: Leaving directory '/home/aurora/iot/openwrt-try2/openwrt/package/utils/busybox'
time: package/utils/busybox/default/compile#21.77#3.04#5.13
ERROR: package/utils/busybox failed to build (build variant: default).
make[2]: *** [package/Makefile:114: package/utils/busybox/compile] Error 1
make[2]: Leaving directory '/home/aurora/iot/openwrt-try2/openwrt'
make[1]: *** [package/Makefile:108: /home/aurora/iot/openwrt-try2/openwrt/staging_dir/target-x86_64_musl/stamp/.package_compile] Error 2
make[1]: Leaving directory '/home/aurora/iot/openwrt-try2/openwrt'
make: *** [/home/aurora/iot/openwrt-try2/openwrt/include/toplevel.mk:230: world] Error 2
Then I tried to turn off the "Support NSA Security Enhanced Linux" option, successfully built the OpenWRT. I compiled a Busybox statically with the "Support NSA Security Enhanced Linux" option outside the OpenWRT building process seperately, then I replaced the BusyBox in the OpenWRT with the seperately built one.
Through such compilation process, the SELinux component cannot work functionally in OpenWRT. When I tried to execute:
semanage login -l
The output was:
ValueError: SELinux policy is not managed or store cannot be accessed.
Edit the context of a file with:
semanage fcontext -a -t tmp_fs file1
The output:
ValueError: SELinux policy is not managed or store cannot be accessed.
Tried to load the SELinux policy again with:
load_policy
The log was:
...
Permission bpf in cap_userns not defined in policy.
the above unknown classes and permissions will be denied.
Converting 23 SID table entries...
policy capability network_peer_controls=1
...
audit: type=1403 audit(1618283426.064:7): audit=4294967295 ses=4294967295 lsm=selinux res=1
Apparently, some components related to SELinux are missing in the OpenWRT. And I am aware that such BusyBox replacement is not the most appropriate way to build OpenWRT with SELinux. But the normal build option cannot proceed.
Could you please give me some advice about compiling OpenWRT with SELinux? Was there any libraries or components missed in the building process described above? Thank you!