Add leading whitespace to DISTRO_FEATURES_append in oe-selinux.conf

The lack of leading whitespace was causing two values in the
DISTRO_FEATURES variable to be combined. This was causing 'sysvinit'
from DISTRO_FEATURES_BACKFILL and 'pam' (from oe-selinux) to be
combined into 'sysvinitpam' thus dropping both from the
DISTRO_FEATURES.

Signed-off-by: Philip Tricca <flihp@twobit.us>
Signed-off-by: Joe MacDonald <joe@deserted.net>
Stage SELinux config file in the sysroot.

This is needed to build policy modules outside of the refpolicy.
Policy module build systems need to determine the name of the policy
that will be in effect on the target host. This allows them to
locate the policy headers that will be under
$sysroot/usr/share/selinux/$name/include. Given that there *could*
be more than one policy installed in the sysroot we can't assume
that the policy installed there is the only policy to build against.

Signed-off-by: Philip Tricca <flihp@twobit.us>
Signed-off-by: Joe MacDonald <joe@deserted.net>
documentation: update guidance for runqemu

Testing SELinux on QEMU occasionally results in OOM conditions during a
relabel from time to time.  Update the documentation to warn about this
and suggest a way to avoid the situation.

Signed-off-by: Joe MacDonald <joe@deserted.net>
Add util-linux-agetty to core-image-selinux IMAGE_INSTALL.

Currently logins to core-image-selinux images through a getty (serial)
fail. This is caused by the use of the busybox getty. SELinux depends
on executable files and their labels to transition between types.
The symlink to busybox is not sufficient to cause the getty processes
to transition to the right SELinux context. Using a getty binary
like the one provided by util-linux fixes this.

Signed-off-by: Philip Tricca <flihp@twobit.us>
Signed-off-by: Joe MacDonald <joe@deserted.net>
Install policy headers and include them in the refpolicy dev package.

To do this we call the 'install-headers' make target at the end of
do_install. We then add the interface 'include' directory to the
dev package leaving only the policy modules in the main policy
package. This allows projects that ship their own SELinux policy
(not in the refpolicy) to build the refpolicy headers / interface
files by using the Makefile supplied by refpolicy.

Signed-off-by: Philip Tricca <flihp@twobit.us>
Add recipe to build example policy module.
Break policycoreutils out into separate packages for the various utilities.

The driver beind this is to no longer force all of these utilities
on to images that want to have an SELinux policy. With this patch
in place it will be possible to create an image with the minimal
set of tools necessary to load a policy.

Signed-off-by: Philip Tricca <flihp@twobit.us>
Remove runtime dependence on policycoreutils from the reference policy.

The only thing refpol should depend on at runtime are the things
necessary to load the policy.  If init is patched then we only need
the config.  It may be necessary to include policycoreutil-loadpolicy
as well in the absence of a patched init.
Add image and packagegroup for minimal SELinux install.
Prefer the 3.8 kernel till the 3.10 recipe is ported over from master-next.
Add runtime dependency on SELinux utilities needed by the init script.
Check for the availability of 'secon' and 'setenforce' in the selinux-init.sh script.

This is for consistency and to aid in debugging.