This is a guide about how to enable selinux and dm-verity for NXP i.MX Yocto package

1. Environment
	SW: lf-6.18.2, 2026 Q1 release.
	HW: i.MX 93 EVK
2. Build
	2.1 Clone the offcial 6.18.2 BSP
		cd yocto
		repo init -u https://github.com/nxp-imx/imx-manifest -b imx-linux-whinlatter -m imx-6.18.2-1.0.0.xml
		repo sync
		DISTRO=fsl-imx-xwayland MACHINE=imx93evk source imx-setup-release.sh -b build-xwayland-93-6.18.2/
	2.2 Add meta-security-imx-dmverity layer
		cd yocto/source
		git clone https://github.com/nxp-imx/meta-security-imx-dmverity.git
		git switch lf-6.18.y-1.0.0
		cd yocto/build-xwayland-93-6.18.2/
		bitbake-layers add-layer ../sources/meta-security-imx-dmverity/
	2.3 Add selinux and security layers
		bitbake-layers add-layer ../sources/meta-security
		bitbake-layers add-layer ../sources/meta-selinux
	2.4 Apply patches
		2.4.1 meta-imx
			This patch is used to enable Linux kernel support for selinux
			cd yocto/source/meta-imx
			git apply meta-imx-enable-selinux.patch
			mkdir yocto/sources/meta-imx/meta-imx-bsp/recipes-kernel/linux/files/
			cp 0001-enable-selinux-for-6.18.2.patch yocto/sources/meta-imx/meta-imx-bsp/recipes-kernel/linux/files/
		2.4.2 meta-security
			This patch is used to fix the dm-verity generated env file format.
			Sometimes, the /usr/share/misc/dm-verity.env format in initramfs is wrong.
			It contains the [bytes] that veritysetup app cannot recognize.
			cd yocto/source/meta-security
			git apply meta-security-fix-verity-env.patch
		2.4.3 meta-security-imx-dmverity
			This patch is used to add /home in overlayfs, and increase the overlayfs size from 32MB to 128MB.
			cd yocto/source/meta-security-imx-dmverity
			git apply meta-security-imx-dmverity-add-home-and-increase-overlayfs.patch
	2.5 edit local.conf
		There are several config options for image build
		cd yocto/build-xwayland-93-6.18.2/
		vim local.conf
		append below options:
		```
		DISTRO_FEATURES:append = " acl xattr pam selinux"
		PREFERRED_PROVIDER_virtual/refpolicy ?= "refpolicy-mls"

		DISTRO_FEATURES:append = " security"
		INITRAMFS_IMAGE = "dm-verity-image-initramfs"
		DM_VERITY_IMAGE = "imx-image-core"
		DM_VERITY_IMAGE_TYPE = "ext4"
		IMAGE_CLASSES += "dm-verity-img dm-verity-verify-roothash"
		DM_VERITY_SEPARATE_HASH = "1"
		INITRAMFS_IMAGE_BUNDLE = "1"
		IMAGE_BOOT_FILES:append = "${KERNEL_IMAGETYPE}-initramfs-${MACHINE}.bin"
		WKS_FILES = "imx-imx-boot-bootpart-dmverity-hash-overlay.wks.in"
		OVERLAYFS_UUID = "94a69ec6-abb5-41e1-b0b1-bfd15e004d66"
		```
	2.6 build
		bitbake imx-image-core
3. Run
	3.1 Flash image
		flash the tmp/deploy/images/imx93evk/imx-image-core-imx93evk.rootfs.wic.zst
		uuu -b emmc_all imx-image-core-imx93evk.rootfs.wic.zst
	3.2 Edit env in U-Boot
		This is used to:
			Swith the boot kernel image and dtb address.
			Specify the overlayfs UUID.
			Use permissive mode in the first boot.
		u-boot=> editenv image
		edit: Image-initramfs-imx93evk.bin
		u-boot=> editenv mmcargs
		edit: setenv bootargs ${jh_clk} ${mcore_clk} console=${console} root=${mmcroot} rootrw=UUID="94a69ec6-abb5-41e1-b0b1-bfd15e004d66" enforcing=0
		u-boot=> editenv fdt_addr_r
		edit: 0x87000000
		u-boot=> saveenv
		Saving Environment to MMC... Writing to MMC(0)... OK
		u-boot=> boot
	3.3 Check status
		In boot log:
			[    3.389349] Run /init as init process
			[    3.440465] mmc2: new UHS-I speed SDR104 SDIO card at address 0001
			Starting systemd-udevd version 257.8
			[    4.500434] device-mapper: verity: sha256 using "sha256-lib"
			[    4.637222] EXT4-fs (dm-0): write access unavailable, skipping orphan cleanup
			[    4.644520] EXT4-fs (dm-0): mounted filesystem 2b1bbb96-6bc7-44ca-8200-303b64988a1b ro without journal. Quota mode: none.
			[    4.692459] EXT4-fs (mmcblk0p4): mounted filesystem 94a69ec6-abb5-41e1-b0b1-bfd15e004d66 r/w with ordered data mode. Quota mode: none.
			[    5.041145] SELinux:  Permission watch_mountns in class file not defined in policy.
			[    5.048860] SELinux:  Permission watch_mountns in class dir not defined in policy.
			[    5.056440] SELinux:  Permission watch_mountns in class lnk_file not defined in policy.
			[    5.064441] SELinux:  Permission watch_mountns in class chr_file not defined in policy.
			[    5.072438] SELinux:  Permission watch_mountns in class blk_file not defined in policy.
			[    5.080431] SELinux:  Permission watch_mountns in class sock_file not defined in policy.
			[    5.088519] SELinux:  Permission watch_mountns in class fifo_file not defined in policy.
			[    5.096765] SELinux:  Permission watch_mountns in class anon_inode not defined in policy.
			[    5.104935] SELinux:  Permission allowed in class io_uring not defined in policy.
			[    5.112418] SELinux: the above unknown classes and permissions will be allowed
			[    5.127155] SELinux:  policy capability network_peer_controls=1
			[    5.133131] SELinux:  policy capability open_perms=1
			[    5.138101] SELinux:  policy capability extended_socket_class=1
			[    5.144015] SELinux:  policy capability always_check_network=0
			[    5.149846] SELinux:  policy capability cgroup_seclabel=1
			[    5.155267] SELinux:  policy capability nnp_nosuid_transition=1
			[    5.161206] SELinux:  policy capability genfs_seclabel_symlinks=0
			[    5.167302] SELinux:  policy capability ioctl_skip_cloexec=0
			[    5.172971] SELinux:  policy capability userspace_initial_context=0
			[    5.179228] SELinux:  policy capability netlink_xperm=0
			[    5.184442] SELinux:  policy capability netif_wildcard=0
			[    5.189745] SELinux:  policy capability genfs_seclabel_wildcard=0
			[    5.195833] SELinux:  policy capability functionfs_seclabel=0
			[    5.254033] audit: type=1403 audit(4.932:2): auid=4294967295 ses=4294967295 lsm=selinux res=1
			[    5.270833] systemd[1]: Successfully loaded SELinux policy in 308.031ms.
		In console:
			Check the status:
				imx93evk login: root
				root@imx93evk:~#
				root@imx93evk:~# sestatus
				SELinux status:                 enabled
				SELinuxfs mount:                /sys/fs/selinux
				SELinux root directory:         /etc/selinux
				Loaded policy name:             mls
				Current mode:                   permissive
				Mode from config file:          enforcing
				Policy MLS status:              enabled
				Policy deny_unknown status:     allowed
				Memory protection checking:     actual (secure)
				Max kernel policy version:      35
				root@imx93evk:~# df -h
				Filesystem          Size  Used Avail Use% Mounted on
				/dev/mapper/rootfs  1.8G  1.4G  271M  84% /
				overlay             119M  2.1M  108M   2% /root
				overlay             119M  2.1M  108M   2% /etc
				overlay             119M  2.1M  108M   2% /var
				overlay             119M  2.1M  108M   2% /home
				devtmpfs            686M     0  686M   0% /dev
				tmpfs               970M     0  970M   0% /dev/shm
				tmpfs               388M  9.0M  379M   3% /run
				tmpfs               970M   12K  970M   1% /tmp
				tmpfs               1.0M     0  1.0M   0% /run/credentials/systemd-journald.service
				tmpfs               970M  260K  970M   1% /var/volatile
				overlay             970M  260K  970M   1% /srv
				tmpfs               1.0M     0  1.0M   0% /run/credentials/systemd-resolved.service
				/dev/mmcblk0p4      119M  2.1M  108M   2% /run/media/data-mmcblk0p4
				/dev/mmcblk0p1      308M  228M   81M  74% /run/media/boot-mmcblk0p1
				tmpfs               1.0M     0  1.0M   0% /run/credentials/systemd-networkd.service
				tmpfs               194M   16K  194M   1% /run/user/0
				tmpfs               1.0M     0  1.0M   0% /run/credentials/serial-getty@ttyLP0.service
				tmpfs               1.0M     0  1.0M   0% /run/credentials/getty@tty1.service
				root@imx93evk:~# mount | grep overlay
				overlay on /root type overlay (rw,relatime,seclabel,lowerdir=/dev/rootfs/root,upperdir=/dev/overlay/root,workdir=/dev/overlay/work/root,uuid=on)
				overlay on /etc type overlay (rw,relatime,seclabel,lowerdir=/dev/rootfs/etc,upperdir=/dev/overlay/etc,workdir=/dev/overlay/work/etc,uuid=on)
				overlay on /var type overlay (rw,relatime,seclabel,lowerdir=/dev/rootfs/var,upperdir=/dev/overlay/var,workdir=/dev/overlay/work/var,uuid=on)
				overlay on /home type overlay (rw,relatime,seclabel,lowerdir=/dev/rootfs/home,upperdir=/dev/overlay/home,workdir=/dev/overlay/work/home,uuid=on)
				overlay on /srv type overlay (rw,relatime,rootcontext=system_u:object_r:var_t:s0,seclabel,lowerdir=/srv,upperdir=/var/volatile/srv,workdir=/var/volatile/.srv-work,uuid=on)
				root@imx93evk:~# id -Z
				root:sysadm_r:sysadm_t:s0-s15:c0.c1023
				root@imx93evk:~# ls -Z /usr/bin/ls
				system_u:object_r:bin_t:s0 /usr/bin/ls
				root@imx93evk:~# semanage login -l

				Login Name           SELinux User         MLS/MCS Range        Service

				__default__          user_u               s0-s0                *
				root                 root                 s0-s15:c0.c1023      *
				root@imx93evk:~# semanage user -l

								Labeling   MLS/       MLS/
				SELinux User    Prefix     MCS Level  MCS Range                      SELinux Roles

				guest_u         user       s0         s0                             guest_r
				root            sysadm     s0         s0-s15:c0.c1023                auditadm_r secadm_r staff_r sysadm_r system_r
				staff_u         staff      s0         s0-s15:c0.c1023                auditadm_r secadm_r staff_r sysadm_r
				sysadm_u        sysadm     s0         s0-s15:c0.c1023                sysadm_r
				system_u        user       s0         s0-s15:c0.c1023                system_r
				unconfined_u    user       s0         s0-s15:c0.c1023                system_r unconfined_r
				user_u          user       s0         s0                             user_r
				xdm             user       s0         s0                             system_r xdm_r
				xguest_u        user       s0         s0                             xguest_r
			The overlayfs is not labeled and we need to fix it:
				root@imx93evk:~# ls -Z /etc/ld.so.cache
					system_u:object_r:unlabeled_t:s0 /etc/ld.so.cache
				root@imx93evk:~# restorecon -RF /etc
				root@imx93evk:~# restorecon -RF /root
				root@imx93evk:~# restorecon -RF /home
				root@imx93evk:~# restorecon -RF /var
				root@imx93evk:~#
				root@imx93evk:~# ls -Z /etc/ld.so.cache
				system_u:object_r:ld_so_cache_t:s0 /etc/ld.so.cache
				root@imx93evk:~# reboot
	3.4 Reboot
		3.4.1 Switch to enforcing mode
			u-boot=> editenv mmcargs
			edit: setenv bootargs ${jh_clk} ${mcore_clk} console=${console} root=${mmcroot} rootrw=UUID="94a69ec6-abb5-41e1-b0b1-bfd15e004d66" enforcing=1
			u-boot=> saveenv
			Saving Environment to MMC... Writing to MMC(0)... OK
			u-boot=> boot
		3.4.2 Check status
			root@imx93evk:~# sestatus
			SELinux status:                 enabled
			SELinuxfs mount:                /sys/fs/selinux
			SELinux root directory:         /etc/selinux
			Loaded policy name:             mls
			Current mode:                   enforcing
			Mode from config file:          enforcing
			Policy MLS status:              enabled
			Policy deny_unknown status:     allowed
			Memory protection checking:     actual (secure)
			Max kernel policy version:      35
			root@imx93evk:~# df -h
			Filesystem          Size  Used Avail Use% Mounted on
			/dev/mapper/rootfs  1.8G  1.4G  271M  84% /
			overlay             119M  2.3M  108M   3% /root
			overlay             119M  2.3M  108M   3% /etc
			overlay             119M  2.3M  108M   3% /var
			overlay             119M  2.3M  108M   3% /home
			devtmpfs            686M     0  686M   0% /dev
			tmpfs               970M     0  970M   0% /dev/shm
			tmpfs               388M  9.0M  379M   3% /run
			tmpfs               970M     0  970M   0% /tmp
			tmpfs               1.0M     0  1.0M   0% /run/credentials/systemd-journald.service
			tmpfs               970M   80K  970M   1% /var/volatile
			tmpfs               1.0M     0  1.0M   0% /run/credentials/systemd-resolved.service
			overlay             970M   80K  970M   1% /srv
			tmpfs               1.0M     0  1.0M   0% /run/credentials/systemd-networkd.service
			/dev/mmcblk0p4      119M  2.3M  108M   3% /run/media/data-mmcblk0p4
			tmpfs               194M   12K  194M   1% /run/user/0
			/dev/mmcblk0p1      308M  228M   81M  74% /run/media/boot-mmcblk0p1
			tmpfs               1.0M     0  1.0M   0% /run/credentials/getty@tty1.service
			tmpfs               1.0M     0  1.0M   0% /run/credentials/serial-getty@ttyLP0.service
			root@imx93evk:~# mount | grep overlay
			overlay on /root type overlay (rw,relatime,seclabel,lowerdir=/dev/rootfs/root,upperdir=/dev/overlay/root,workdir=/dev/overlay/work/root)
			overlay on /etc type overlay (rw,relatime,seclabel,lowerdir=/dev/rootfs/etc,upperdir=/dev/overlay/etc,workdir=/dev/overlay/work/etc)
			overlay on /var type overlay (rw,relatime,seclabel,lowerdir=/dev/rootfs/var,upperdir=/dev/overlay/var,workdir=/dev/overlay/work/var)
			overlay on /home type overlay (rw,relatime,seclabel,lowerdir=/dev/rootfs/home,upperdir=/dev/overlay/home,workdir=/dev/overlay/work/home)
			overlay on /srv type overlay (ro,relatime,rootcontext=system_u:object_r:var_t:s0,seclabel,lowerdir=/srv,upperdir=/var/volatile/srv,workdir=/var/volatile/.srv-work,uuid=null)
			root@imx93evk:~# ls -Z /etc/ld.so.cache
			system_u:object_r:ld_so_cache_t:s0 /etc/ld.so.cache
			root@imx93evk:~# id -Z
			root:sysadm_r:sysadm_t:s0-s15:c0.c1023