[PATCH] Makefile: fix security_%config configurator targets

[PATCH] Makefile: fix security_%config configurator targets

[Ahmad Fatoum]

The security_%config targets documented in
Documentation/user/security-policies.rst are broken in three ways:

The sync with Linux v6.17 dropped the exclusion of security_%config
from the config-build classification, so the goals are now dispatched
to scripts/kconfig:

  make[2]: *** No rule to make target 'security_olddefconfig'.  Stop.

The same sync removed $(barebox-alldirs), which collect-policies used
to derive its directory list from. With the list empty, the configurator
only ever sees policy-list files left behind by a previous build.
Collect from $(build-dir) instead; scripts/Makefile.policy recurses
through subdir-y from the top-level Kbuild.

This makes the standalone mode of scripts/Makefile.policy run for the
first time, revealing that it includes scripts/Kbuild.include relative
to the current directory and sets $(src) relative to the objtree, both
of which break out-of-tree builds. Set them up as Makefile.clean does.

Fixes: 48d0d0cc28ed ("kbuild: sync with Linux v6.17")
Fixes: e8f15886952c ("kbuild: make collect-policies lightweight with standalone Makefile.policy")
Assisted-by: Claude:fable-5.1
Reported-by: Stefan Kerkmann <s.kerkmann@pengutronix.de>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 Makefile                | 5 +++--
 scripts/Makefile.policy | 7 +++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/Makefile b/Makefile
index 94c34918e0c0..79253470a1fb 100644
--- a/Makefile
+++ b/Makefile
@@ -272,7 +272,8 @@ endif
 need-compiler := $(may-sync-config)
 
 ifeq ($(KBUILD_EXTMOD),)
-    ifneq ($(filter %config,$(MAKECMDGOALS)),)
+    # security_%config targets configure security policies, not .config
+    ifneq ($(filter-out security_%,$(filter %config,$(MAKECMDGOALS))),)
         config-build := 1
         ifneq ($(words $(MAKECMDGOALS)),1)
             mixed-build := 1
@@ -1340,7 +1341,7 @@ targets += include/generated/sconfig_names.h
 
 KPOLICY = $(shell find $(objtree)/ -name policy-list -exec cat {} \;)
 
-collect-dirs    := $(addprefix _policy_collect_,$(barebox-alldirs))
+collect-dirs    := $(addprefix _policy_collect_,$(build-dir))
 
 PHONY += _policy_collect_clean $(collect-dirs) collect-policies
 _policy_collect_clean:
diff --git a/scripts/Makefile.policy b/scripts/Makefile.policy
index fe60eaf989ec..025739c7bf28 100644
--- a/scripts/Makefile.policy
+++ b/scripts/Makefile.policy
@@ -7,21 +7,20 @@
 ifndef build
 # Standalone mode — collect policies without building
 
-src := $(obj)
+src := $(srcroot)/$(obj)
 
 PHONY := __collect
 __collect:
 
 policy-y :=
 
-include scripts/Kbuild.include
+include $(srctree)/scripts/Kbuild.include
 
 # Include Kconfig output so CONFIG_* symbols (e.g. CONFIG_SECURITY_POLICY_PATH)
 # are available when security/Makefile computes external-policy.
 -include include/config/auto.conf
 
-kbuild-dir := $(if $(filter /%,$(src)),$(src),$(srctree)/$(src))
-include $(if $(wildcard $(kbuild-dir)/Kbuild), $(kbuild-dir)/Kbuild, $(kbuild-dir)/Makefile)
+include $(kbuild-file)
 
 __subdir-y	:= $(patsubst %/,%,$(filter %/, $(obj-y)))
 subdir-y	+= $(__subdir-y)
-- 
2.47.3

Re: [PATCH] Makefile: fix security_%config configurator targets

[Sascha Hauer]

On Thu, 03 Sep 2026 14:09:00 +0200, Ahmad Fatoum wrote:
> The security_%config targets documented in
> Documentation/user/security-policies.rst are broken in three ways:
> 
> The sync with Linux v6.17 dropped the exclusion of security_%config
> from the config-build classification, so the goals are now dispatched
> to scripts/kconfig:
> 
> [...]

Applied, thanks!

[1/1] Makefile: fix security_%config configurator targets
      https://git.pengutronix.de/cgit/barebox/commit/?id=94f3ad5f8cac (link may not be stable)

Best regards,
-- 
Sascha Hauer <s.hauer@pengutronix.de>