tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/compat.mk

57 lines
1.5 KiB
Makefile
Raw Normal View History

Add mechanism for granting permissions to old vendor images This addresses Treble backwards compat issues introduced in aosp/793958 and aosp/783669. Bug: 122874820 Test: build/flash blueline with pi-dev vendor and generic_ab system images. Test: adb pull /sys/fs/selinux/policy; sesearch policy --allowx -s vendordomain -t dev_type Change-Id: Ic2b304472bb88051e03740dc387834056aba641a
2019-05-02 22:48:44 +02:00
version := $(version_under_treble_tests)
include $(CLEAR_VARS)
#################################
# build this target to ensure the compat permissions files all build against the current policy
#
LOCAL_MODULE := $(version)_compat_test
[LSC] Add LOCAL_LICENSE_KINDS to system/sepolicy Added SPDX-license-identifier-Apache-2.0 to: build/Android.bp build/soong/Android.bp tests/Android.bp tools/Android.bp Added SPDX-license-identifier-Apache-2.0 legacy_unencumbered to: Android.bp Android.mk compat.mk contexts_tests.mk mac_permissions.mk seapp_contexts.mk treble_sepolicy_tests_for_release.mk Added legacy_unencumbered to: apex/Android.bp tools/sepolicy-analyze/Android.bp Bug: 68860345 Bug: 151177513 Bug: 151953481 Test: m all Exempt-From-Owner-Approval: janitorial work Change-Id: I1ab286543ef1bdcb494cf74f2b35e35a08225d28
2021-02-04 08:07:40 +01:00
LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
LOCAL_LICENSE_CONDITIONS := notice unencumbered
LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
Add mechanism for granting permissions to old vendor images This addresses Treble backwards compat issues introduced in aosp/793958 and aosp/783669. Bug: 122874820 Test: build/flash blueline with pi-dev vendor and generic_ab system images. Test: adb pull /sys/fs/selinux/policy; sesearch policy --allowx -s vendordomain -t dev_type Change-Id: Ic2b304472bb88051e03740dc387834056aba641a
2019-05-02 22:48:44 +02:00
LOCAL_REQUIRED_MODULES := $(version).compat.cil
Test files on intermediates dir, not on /system *_context_test / sepolicy_tests / treble_sepolicy_tests_* / sepolicy_freeze_test files are installed on /system/etc. By being FAKE modules, test files are not installed on target. Additionally, we need to set up dependency from droidcore to selinux_policy to make tests run on normal builds (m). Bug: 133460071 Test: m & see if tests run and no test files on /system/etc Test: m selinux_policy & see if tests run Change-Id: Icacf004d5c1c8ec720c7cedef7bae8aa648cbe49
2019-05-29 18:05:43 +02:00
LOCAL_MODULE_CLASS := FAKE
LOCAL_MODULE_TAGS := optional
include $(BUILD_SYSTEM)/base_rules.mk
Add mechanism for granting permissions to old vendor images This addresses Treble backwards compat issues introduced in aosp/793958 and aosp/783669. Bug: 122874820 Test: build/flash blueline with pi-dev vendor and generic_ab system images. Test: adb pull /sys/fs/selinux/policy; sesearch policy --allowx -s vendordomain -t dev_type Change-Id: Ic2b304472bb88051e03740dc387834056aba641a
2019-05-02 22:48:44 +02:00
all_cil_files := \
$(built_plat_cil) \
$(built_plat_mapping_cil) \
$(built_pub_vers_cil) \
$(ALL_MODULES.$(version).compat.cil.BUILT) \
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
ifdef HAS_SYSTEM_EXT_SEPOLICY
Allowing system_ext sepolicy to be empty Some targets just need to extend system_ext context files, e.g., file_contexts, service_contexts, etc., without adding any system_ext policy files, e.g., *.te files. Currently, this will lead to build errors. This CL allows system_ext_sepolicy.cil and the system_ext mapping file to be empty. It's now also possible to just set BOARD_PLAT_PRIVATE_SEPOLICY_DIR without setting BOARD_PLAT_PUBLIC_SEPOLICY_DIR. Bug: 137712473 Bug: 141880898 Test: Only adds system_ext context files without policy files (e.g., *.te), then `mmma system/sepolicy` can build pass Change-Id: I72849f2d4aa43e5296cd15c07a8fd058186a6376
2019-10-04 08:34:18 +02:00
all_cil_files += $(built_system_ext_cil)
endif
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
Allowing system_ext sepolicy to be empty Some targets just need to extend system_ext context files, e.g., file_contexts, service_contexts, etc., without adding any system_ext policy files, e.g., *.te files. Currently, this will lead to build errors. This CL allows system_ext_sepolicy.cil and the system_ext mapping file to be empty. It's now also possible to just set BOARD_PLAT_PRIVATE_SEPOLICY_DIR without setting BOARD_PLAT_PUBLIC_SEPOLICY_DIR. Bug: 137712473 Bug: 141880898 Test: Only adds system_ext context files without policy files (e.g., *.te), then `mmma system/sepolicy` can build pass Change-Id: I72849f2d4aa43e5296cd15c07a8fd058186a6376
2019-10-04 08:34:18 +02:00
ifdef HAS_SYSTEM_EXT_PUBLIC_SEPOLICY
all_cil_files += $(built_system_ext_mapping_cil)
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
endif
Add mechanism for granting permissions to old vendor images This addresses Treble backwards compat issues introduced in aosp/793958 and aosp/783669. Bug: 122874820 Test: build/flash blueline with pi-dev vendor and generic_ab system images. Test: adb pull /sys/fs/selinux/policy; sesearch policy --allowx -s vendordomain -t dev_type Change-Id: Ic2b304472bb88051e03740dc387834056aba641a
2019-05-02 22:48:44 +02:00
ifdef HAS_PRODUCT_SEPOLICY
Allowing product sepolicy to be empty Some targets just need to extend product context files, e.g., file_contexts, service_contexts, etc., without adding any product-specific policy files, e.g., *.te files. Or just need to add private product sepolicy without adding public product sepolicy. Currently, this will lead to build errors. This CL allows product_sepolicy.cil and the product mapping file to be empty. It's now also possible to just set PRODUCT_PRIVATE_POLICY without setting PRODUCT_PUBLIC_POLICY. Bug: 131193755 Test: Only adds product private sepolicy, then `mmma system/sepolicy` Change-Id: Ifed5af7413b2a1e20a0628518582615708c8c31a
2019-10-04 09:36:05 +02:00
all_cil_files += $(built_product_cil)
endif
Add mechanism for granting permissions to old vendor images This addresses Treble backwards compat issues introduced in aosp/793958 and aosp/783669. Bug: 122874820 Test: build/flash blueline with pi-dev vendor and generic_ab system images. Test: adb pull /sys/fs/selinux/policy; sesearch policy --allowx -s vendordomain -t dev_type Change-Id: Ic2b304472bb88051e03740dc387834056aba641a
2019-05-02 22:48:44 +02:00
Allowing product sepolicy to be empty Some targets just need to extend product context files, e.g., file_contexts, service_contexts, etc., without adding any product-specific policy files, e.g., *.te files. Or just need to add private product sepolicy without adding public product sepolicy. Currently, this will lead to build errors. This CL allows product_sepolicy.cil and the product mapping file to be empty. It's now also possible to just set PRODUCT_PRIVATE_POLICY without setting PRODUCT_PUBLIC_POLICY. Bug: 131193755 Test: Only adds product private sepolicy, then `mmma system/sepolicy` Change-Id: Ifed5af7413b2a1e20a0628518582615708c8c31a
2019-10-04 09:36:05 +02:00
ifdef HAS_PRODUCT_PUBLIC_SEPOLICY
all_cil_files += $(built_product_mapping_cil)
Add mechanism for granting permissions to old vendor images This addresses Treble backwards compat issues introduced in aosp/793958 and aosp/783669. Bug: 122874820 Test: build/flash blueline with pi-dev vendor and generic_ab system images. Test: adb pull /sys/fs/selinux/policy; sesearch policy --allowx -s vendordomain -t dev_type Change-Id: Ic2b304472bb88051e03740dc387834056aba641a
2019-05-02 22:48:44 +02:00
endif
Support building mixed versions of sepolicy Now newer system policy and older vendor policy can be built together by setting following variables: - BOARD_SEPOLICY_VERS - BOARD_REQD_MASK_POLICY (copy of older system/sepolicy/reqd_mask) - BOARD_PLAT_VENDOR_POLICY (copy of older system/sepolicy/vendor) - BOARD_(SYSTEM_EXT|PRODUCT)_(PUBLIC|PRIVATE)_PREBUILT_DIRS (copy of older system_ext and product policies) Bug: 168159977 Test: try normal build and mixed build Test: boot and check selinux denials Change-Id: Ie239580433ffd293fa6891cd665fb5ef83c0a14f
2020-11-09 12:58:58 +01:00
ifneq ($(mixed_sepolicy_build),true)
all_cil_files += $(built_vendor_cil)
Add mechanism for granting permissions to old vendor images This addresses Treble backwards compat issues introduced in aosp/793958 and aosp/783669. Bug: 122874820 Test: build/flash blueline with pi-dev vendor and generic_ab system images. Test: adb pull /sys/fs/selinux/policy; sesearch policy --allowx -s vendordomain -t dev_type Change-Id: Ic2b304472bb88051e03740dc387834056aba641a
2019-05-02 22:48:44 +02:00
ifdef BOARD_ODM_SEPOLICY_DIRS
all_cil_files += $(built_odm_cil)
endif
Support building mixed versions of sepolicy Now newer system policy and older vendor policy can be built together by setting following variables: - BOARD_SEPOLICY_VERS - BOARD_REQD_MASK_POLICY (copy of older system/sepolicy/reqd_mask) - BOARD_PLAT_VENDOR_POLICY (copy of older system/sepolicy/vendor) - BOARD_(SYSTEM_EXT|PRODUCT)_(PUBLIC|PRIVATE)_PREBUILT_DIRS (copy of older system_ext and product policies) Bug: 168159977 Test: try normal build and mixed build Test: boot and check selinux denials Change-Id: Ie239580433ffd293fa6891cd665fb5ef83c0a14f
2020-11-09 12:58:58 +01:00
endif # ifneq ($(mixed_sepolicy_build),true)
Test files on intermediates dir, not on /system *_context_test / sepolicy_tests / treble_sepolicy_tests_* / sepolicy_freeze_test files are installed on /system/etc. By being FAKE modules, test files are not installed on target. Additionally, we need to set up dependency from droidcore to selinux_policy to make tests run on normal builds (m). Bug: 133460071 Test: m & see if tests run and no test files on /system/etc Test: m selinux_policy & see if tests run Change-Id: Icacf004d5c1c8ec720c7cedef7bae8aa648cbe49
2019-05-29 18:05:43 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(all_cil_files)
$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $(all_cil_files)
Add mechanism for granting permissions to old vendor images This addresses Treble backwards compat issues introduced in aosp/793958 and aosp/783669. Bug: 122874820 Test: build/flash blueline with pi-dev vendor and generic_ab system images. Test: adb pull /sys/fs/selinux/policy; sesearch policy --allowx -s vendordomain -t dev_type Change-Id: Ic2b304472bb88051e03740dc387834056aba641a
2019-05-02 22:48:44 +02:00
@mkdir -p $(dir $@)
Place compat tests in intermediates dir, not on /system Fixes: 132249401 Test: build aosp_blueline. Verify these tests are not in /system/etc/ Test: Verify that syntax error 27.0.compat.cil results in a broken build. Change-Id: I3382fcec4ba1ca3f639d7d892c7da8515b22812b
2019-05-17 21:39:41 +02:00
$(hide) $< -m -N -M true -G -c $(POLICYVERS) $(PRIVATE_CIL_FILES) -o $@ -f /dev/null
Add mechanism for granting permissions to old vendor images This addresses Treble backwards compat issues introduced in aosp/793958 and aosp/783669. Bug: 122874820 Test: build/flash blueline with pi-dev vendor and generic_ab system images. Test: adb pull /sys/fs/selinux/policy; sesearch policy --allowx -s vendordomain -t dev_type Change-Id: Ic2b304472bb88051e03740dc387834056aba641a
2019-05-02 22:48:44 +02:00
all_cil_files :=
version :=
version_under_treble_tests :=
Reference in a new issue Copy permalink