From 5d06fe0fd1c41e079faa671ca558cfaf799db165 Mon Sep 17 00:00:00 2001
From: Aelin <aelin@postmarketos.org>
Date: Sun, 12 Apr 2026 15:11:02 +0200
Subject: [PATCH] kconfigcheck: Add SELinux category

Part-of: <https://gitlab.postmarketos.org/postmarketOS/pmaports/-/merge_requests/8352>
---
 kconfigcheck.toml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/kconfigcheck.toml b/kconfigcheck.toml
index 8a7bef431..26b9a82be 100644
--- a/kconfigcheck.toml
+++ b/kconfigcheck.toml
@@ -673,6 +673,15 @@ SHADOW_CALL_STACK = "y"
 DEBUG_INFO_BTF = "n" # Conflicts with LTO when Rust is enabled
 DEBUG_INFO_BTF_MODULES = "n" # Conflicts with LTO when Rust is enabled
 
+# SELinux support, separate from hardening to keep it opt-in for now
+["category:selinux".">=0.0.0"."all"]
+DEFAULT_SECURITY_SELINUX = "y"
+AUDIT = "y" # Required by SELinux
+SECURITY_NETWORK = "y" # Required by SELinux
+SECURITY_SELINUX = "y"
+SECURITY_SELINUX_BOOTPARAM = "y"
+LSM = "landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf"
+
 # Wine / Proton support
 ["category:wine".">=6.14.0"."all"]
 NTSYNC = "m"