tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/Android.mk

714 lines
28 KiB
Makefile
Raw Normal View History

SE Android policy.
2012-01-04 18:33:27 +01:00
LOCAL_PATH:= $(call my-dir)
Support overrides in seapp_contexts Provides support for overriding seapp_contexts declerations in per device seapp_contexts files. Change-Id: I23a0ffa1d24f1ce57825b168f29a2e885d3e1c51
2012-08-28 00:41:15 +02:00
SE Android policy.
2012-01-04 18:33:27 +01:00
include $(CLEAR_VARS)
# SELinux policy version.
sepolicy: Drop BOARD_SEPOLICY_IGNORE/REPLACE support. With changes I431c1ab22fc53749f623937154b9ec43469d9645 and Ia54aa263f2245c7090f4b9d9703130c19f11bd28, it is no longer legitimate to use BOARD_SEPOLICY_IGNORE or REPLACE with any of the *_contexts files since the CTS requires the AOSP entries to be present in the device files. Further, these changes render BOARD_SEPOLICY_IGNORE unusable for most policy files since all domains and types referenced within any of the AOSP *_contexts entries must be defined in the kernel policy, so you cannot use BOARD_SEPOLICY_IGNORE to exclude any .te file that defines a type referenced in any of those *_contexts files. There does not seem to be a significant need for such a facility, as AOSP policy is small and only domains and types used by most devices should be defined in external/sepolicy. BOARD_SEPOLICY_REPLACE is commonly misused to eliminate neverallow rules from AOSP policy, which will only lead to CTS failures, especially since change Iefe508df265f62efa92f8eb74fc65542d39e3e74 introduced neverallow checking on the entire policy via sepolicy-analyze. The only remaining legitimate function of BOARD_SEPOLICY_REPLACE is to support overriding AOSP .te files with more restrictive rule sets. However, the need for this facility has been significantly reduced by the fact that AOSP policy is now fully confined + enforcing for all domains, and further restrictions beyond AOSP carry a compatibility risk. Builders of custom policies and custom ROMs still have the freedom to apply patches on top of external/sepolicy to tighten rule sets (which are likely more maintainable than maintaining a completely separate copy of the file via BOARD_SEPOLICY_REPLACE) and/or of using their own separate policy build system as exemplified by https://bitbucket.org/quarksecurity/build-policies Change-Id: I2611e983f7cbfa15f9d45ec3ea301e94132b06fa Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-13 15:03:52 +01:00
# Must be <= /sys/fs/selinux/policyvers reported by the Android kernel.
SE Android policy.
2012-01-04 18:33:27 +01:00
# Must be within the compatibility range reported by checkpolicy -V.
Migrate to upstream policy version 30 Grant untrusted_app and isolated_app unpriv_sock_perms, neverallow priv_sock_perms to disallow access to MAC address and ESSID. Change-Id: Idac3b657a153e7d7fdc647ff34b876a325d759b3
2015-12-07 17:30:43 +01:00
POLICYVERS ?= 30
SE Android policy.
2012-01-04 18:33:27 +01:00
MLS_SENS=1
MLS_CATS=1024
sepolicy: Drop BOARD_SEPOLICY_IGNORE/REPLACE support. With changes I431c1ab22fc53749f623937154b9ec43469d9645 and Ia54aa263f2245c7090f4b9d9703130c19f11bd28, it is no longer legitimate to use BOARD_SEPOLICY_IGNORE or REPLACE with any of the *_contexts files since the CTS requires the AOSP entries to be present in the device files. Further, these changes render BOARD_SEPOLICY_IGNORE unusable for most policy files since all domains and types referenced within any of the AOSP *_contexts entries must be defined in the kernel policy, so you cannot use BOARD_SEPOLICY_IGNORE to exclude any .te file that defines a type referenced in any of those *_contexts files. There does not seem to be a significant need for such a facility, as AOSP policy is small and only domains and types used by most devices should be defined in external/sepolicy. BOARD_SEPOLICY_REPLACE is commonly misused to eliminate neverallow rules from AOSP policy, which will only lead to CTS failures, especially since change Iefe508df265f62efa92f8eb74fc65542d39e3e74 introduced neverallow checking on the entire policy via sepolicy-analyze. The only remaining legitimate function of BOARD_SEPOLICY_REPLACE is to support overriding AOSP .te files with more restrictive rule sets. However, the need for this facility has been significantly reduced by the fact that AOSP policy is now fully confined + enforcing for all domains, and further restrictions beyond AOSP carry a compatibility risk. Builders of custom policies and custom ROMs still have the freedom to apply patches on top of external/sepolicy to tighten rule sets (which are likely more maintainable than maintaining a completely separate copy of the file via BOARD_SEPOLICY_REPLACE) and/or of using their own separate policy build system as exemplified by https://bitbucket.org/quarksecurity/build-policies Change-Id: I2611e983f7cbfa15f9d45ec3ea301e94132b06fa Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-13 15:03:52 +01:00
ifdef BOARD_SEPOLICY_REPLACE
$(error BOARD_SEPOLICY_REPLACE is no longer supported; please remove from your BoardConfig.mk or other .mk file.)
endif
ifdef BOARD_SEPOLICY_IGNORE
$(error BOARD_SEPOLICY_IGNORE is no longer supported; please remove from your BoardConfig.mk or other .mk file.)
endif
Add better per-device sepolicy support. This is a rewrite of the existing implementation. Three new variables are now needed to add/modify the exisitng base policy. They are, BOARD_SEPOLICY_REPLACE and BOARD_SEPOLICY_UNION which govern what files are replaced and concatenated, and BOARD_SEPOLICY_DIRS which lists the various directories that will contain the BOARD_SEPOLICY_REPLACE and BOARD_SEPOLICY_UNION policy files. Change-Id: Id33381268cef03245c56bc5242fec7da9b6c6493 Signed-off-by: rpcraig <robertpcraig@gmail.com>
2012-10-18 03:09:52 +02:00
Drop BOARD_SEPOLICY_UNION. As suggested in the comments on https://android-review.googlesource.com/#/c/141560/ drop BOARD_SEPOLICY_UNION and simplify the build_policy logic. Union all files found under BOARD_SEPOLICY_DIRS. Unlike BOARD_SEPOLICY_REPLACE/IGNORE, on which we trigger an error to catch any lingering uses and force updating of the BoardConfig.mk files, we only warn on uses of BOARD_SEPOLICY_UNION to avoid breaking the build until all device BoardConfig*.mk files have been updated, and since they should be harmless - the files will be unioned regardless. Change-Id: I4214893c999c23631f5456cb1b8edd59771ef13b Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-04-01 16:14:56 +02:00
ifdef BOARD_SEPOLICY_UNION
$(warning BOARD_SEPOLICY_UNION is no longer required - all files found in BOARD_SEPOLICY_DIRS are implicitly unioned; please remove from your BoardConfig.mk or other .mk file.)
endif
Android.mk: Add support for BOARD_SEPOLICY_M4DEFS Allow device builders to pass arbitrary m4 definitions during the build via make variable BOARD_SEPOLICY_M4DEFS. This enables OEMs to define their own static policy build conditionals. Change-Id: Ibea1dbb7b8615576c5668e47f16ed0eedfa0b73c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-07-16 20:28:02 +02:00
ifdef BOARD_SEPOLICY_M4DEFS
LOCAL_ADDITIONAL_M4DEFS := $(addprefix -D, $(BOARD_SEPOLICY_M4DEFS))
endif
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
# sepolicy is now divided into multiple portions:
# public - policy exported on which non-platform policy developers may write
# additional policy. types and attributes are versioned and included in
# delivered non-platform policy, which is to be combined with platform policy.
# private - platform-only policy required for platform functionality but which
# is not exported to vendor policy developers and as such may not be assumed
# to exist.
# mapping - TODO. This contains policy statements which map the attributes
# exposed in the public policy of previous versions to the concrete types used
# in this policy to ensure that policy targeting attributes from public
# policy from an older platform version continues to work.
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
# build process for device:
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
# 1) convert policies to CIL:
# - private + public platform policy to CIL
# - mapping file to CIL (should already be in CIL form)
# - non-platform public policy to CIL
# - non-platform public + private policy to CIL
# 2) attributize policy
# - run script which takes non-platform public and non-platform combined
# private + public policy and produces attributized and versioned
# non-platform policy
# 3) combine policy files
# - combine mapping, platform and non-platform policy.
# - compile output binary policy file
PLAT_PUBLIC_POLICY := $(LOCAL_PATH)/public
PLAT_PRIVATE_POLICY := $(LOCAL_PATH)/private
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
REQD_MASK_POLICY := $(LOCAL_PATH)/reqd_mask
# TODO: move to README when doing the README update and finalizing versioning.
# BOARD_SEPOLICY_VERS should contain the platform version identifier
# corresponding to the platform on which the non-platform policy is to be
# based. If unspecified, this will build against the current public platform
# policy in tree.
# BOARD_SEPOLICY_VERS_DIR should contain the public platform policy which
# is associated with the given BOARD_SEPOLICY_VERS. The policy therein will be
# versioned according to the BOARD_SEPOLICY_VERS identifier and included as
# part of the non-platform policy to ensure removal of access in future
# platform policy does not break non-platform policy.
ifndef BOARD_SEPOLICY_VERS
$(warning BOARD_SEPOLICY_VERS not specified, assuming current platform version)
BOARD_SEPOLICY_VERS := current
BOARD_SEPOLICY_VERS_DIR := $(PLAT_PUBLIC_POLICY)
else
ifndef BOARD_SEPOLICY_VERS_DIR
$(error BOARD_SEPOLICY_VERS_DIR not specified for versioned sepolicy.)
endif
endif
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
###########################################################
# Compute policy files to be used in policy build.
# $(1): files to include
# $(2): directories in which to find files
###########################################################
define build_policy
$(foreach type, $(1), $(foreach file, $(addsuffix /$(type), $(2)), $(sort $(wildcard $(file)))))
endef
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: Id79cc6f434c41179d5c0d0d739c4718918b0b1dc Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: I3775eae11bfa5905cad0d02a0bf26c76ac03437c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
# Builds paths for all policy files found in BOARD_SEPOLICY_DIRS.
# $(1): the set of policy name paths to build
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
build_device_policy = $(call build_policy, $(1), $(BOARD_SEPOLICY_DIRS))
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: I3775eae11bfa5905cad0d02a0bf26c76ac03437c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
Ensure newlines are added between context config files When multiple file_contexts, service_contexts and property_contexts are processed by the m4(1) macro processor, they will fail if one or more of the intermediate files final line is not terminated by a newline. This patch adds an intervening file only containing a newline. Change-Id: Ie66b32fe477d08c69e6d6eb1725f658adc384ce4 Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-12-11 11:39:19 +01:00
# Add a file containing only a newline in-between each policy configuration
# 'contexts' file. This will allow OEM policy configuration files without a
# final newline (0x0A) to be built correctly by the m4(1) macro processor.
# $(1): the set of contexts file names.
# $(2): the file containing only 0x0A.
add_nl = $(foreach entry, $(1), $(subst $(entry), $(entry) $(2), $(entry)))
Generate selinux_policy.xml as part of CTS build. Bug: 16563899 Bug: 14251916 Change-Id: Id3172b73f10186ba361caf6b7333e5d2a0648475
2014-07-26 04:11:52 +02:00
sepolicy_build_files := security_classes \
initial_sids \
access_vectors \
global_macros \
recovery.te: add /data neverallow rules Recovery should never be accessing files from /data. In particular, /data may be encrypted, and the files within /data will be inaccessible to recovery, because recovery doesn't know the decryption key. Enforce write/execute restrictions on recovery. We can't tighten it up further because domain.te contains some /data read-only access rules, which shouldn't apply to recovery but do. Create neverallow_macros, used for storing permission macros useful for neverallow rules. Standardize recovery.te and property_data_file on the new macros. Change-Id: I02346ab924fe2fdb2edc7659cb68c4f8dffa1e88
2014-11-06 00:30:41 +01:00
neverallow_macros \
Generate selinux_policy.xml as part of CTS build. Bug: 16563899 Bug: 14251916 Change-Id: Id3172b73f10186ba361caf6b7333e5d2a0648475
2014-07-26 04:11:52 +02:00
mls_macros \
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
mls_decl \
Generate selinux_policy.xml as part of CTS build. Bug: 16563899 Bug: 14251916 Change-Id: Id3172b73f10186ba361caf6b7333e5d2a0648475
2014-07-26 04:11:52 +02:00
mls \
policy_capabilities \
te_macros \
attributes \
Reduce socket ioctl perms Reduce the socket ioctl commands available to untrusted/isolated apps. Neverallow accessing sensitive information or setting of network parameters. Neverallow access to device private ioctls i.e. device specific customizations as these are a common source of driver bugs. Define common ioctl commands in ioctl_defines. Bug: 26267358 Change-Id: Ic5c0af066e26d4cb2867568f53a3e65c5e3b5a5d
2015-12-22 19:39:34 +01:00
ioctl_defines \
restrict app access to socket ioctls Create a macro of unprivileged ioctls including - All common socket ioctls except MAC address - All wireless extensions ioctls except get/set ESSID - Some commonly used tty ioctls Bug: 21657002 Change-Id: Ib08be9cb70d08c1fa2c8bddbae519e7c2df5293c
2015-06-06 00:28:55 +02:00
ioctl_macros \
Generate selinux_policy.xml as part of CTS build. Bug: 16563899 Bug: 14251916 Change-Id: Id3172b73f10186ba361caf6b7333e5d2a0648475
2014-07-26 04:11:52 +02:00
*.te \
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
roles_decl \
Generate selinux_policy.xml as part of CTS build. Bug: 16563899 Bug: 14251916 Change-Id: Id3172b73f10186ba361caf6b7333e5d2a0648475
2014-07-26 04:11:52 +02:00
roles \
users \
initial_sid_contexts \
fs_use \
genfs_contexts \
port_contexts
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
##################################
include $(CLEAR_VARS)
Ensure newlines are added between context config files When multiple file_contexts, service_contexts and property_contexts are processed by the m4(1) macro processor, they will fail if one or more of the intermediate files final line is not terminated by a newline. This patch adds an intervening file only containing a newline. Change-Id: Ie66b32fe477d08c69e6d6eb1725f658adc384ce4 Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-12-11 11:39:19 +01:00
LOCAL_MODULE := sectxfile_nl
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
# Create a file containing newline only to add between context config files
include $(BUILD_SYSTEM)/base_rules.mk
sectxfile_nl: fix superfluous dependencies The target sectxfile_nl, which is an auto-generated newline file, has dependencies on itself and the other files. The dependencies should be on the other files and this newline file, not the other way around. Ideally, the *_contexts recipes should have the dependency recorded for their "contexts" files and the newline file. Additionally, recipe dependencies for building the *_contexts files depended on the list of all the contexts files with the newline file in that list, however an additional explicit addition of the newline file was also added in. Remove this, since its in the full list of files. Change-Id: Iac658923f23a8d9263d392c44003b6bda4064646 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-12-14 16:54:28 +01:00
$(LOCAL_BUILT_MODULE):
Ensure newlines are added between context config files When multiple file_contexts, service_contexts and property_contexts are processed by the m4(1) macro processor, they will fail if one or more of the intermediate files final line is not terminated by a newline. This patch adds an intervening file only containing a newline. Change-Id: Ie66b32fe477d08c69e6d6eb1725f658adc384ce4 Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-12-11 11:39:19 +01:00
@mkdir -p $(dir $@)
$(hide) echo > $@
built_nl := $(LOCAL_BUILT_MODULE)
#################################
include $(CLEAR_VARS)
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
LOCAL_MODULE := sepolicy
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Fix ioctl defines for Mips. This patch allows mips to boot in enforcing mode. Change-Id: Ia4676db06adc3ccb20d5f231406cf4ab67317496
2016-07-29 00:49:31 +02:00
LOCAL_TARGET_ARCH := $(TARGET_ARCH)
# Set LOCAL_TARGET_ARCH to mips for mips and mips64.
ifneq (,$(filter mips mips64,$(TARGET_ARCH)))
LOCAL_TARGET_ARCH := mips
endif
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
include $(BUILD_SYSTEM)/base_rules.mk
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
# reqd_policy_mask - a policy.conf file which contains only the bare minimum
# policy necessary to use checkpolicy. This bare-minimum policy needs to be
# present in all policy.conf files, but should not necessarily be exported as
# part of the public policy. The rules generated by reqd_policy_mask will allow
# the compilation of public policy and subsequent removal of CIL policy that
# should not be exported.
reqd_policy_mask.conf := $(intermediates)/reqd_policy_mask.conf
$(reqd_policy_mask.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
$(reqd_policy_mask.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
$(reqd_policy_mask.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(reqd_policy_mask.conf): $(call build_policy, $(sepolicy_build_files), $(REQD_MASK_POLICY))
@mkdir -p $(dir $@)
$(hide) m4 $(PRIVATE_ADDITIONAL_M4DEFS) \
-D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
-D target_build_variant=$(TARGET_BUILD_VARIANT) \
-s $^ > $@
reqd_policy_mask.cil := $(intermediates)/reqd_policy_mask.cil
$(reqd_policy_mask.cil): $(reqd_policy_mask.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy
@mkdir -p $(dir $@)
$(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -C -M -c $(POLICYVERS) -o $@ $<
# plat_pub_policy - policy that will be exported to be a part of non-platform
# policy corresponding to this platform version. This is a limited subset of
# policy that would not compile in checkpolicy on its own. To get around this
# limitation, add only the required files from private policy, which will
# generate CIL policy that will then be filtered out by the reqd_policy_mask.
plat_pub_policy.conf := $(intermediates)/plat_pub_policy.conf
$(plat_pub_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
$(plat_pub_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
$(plat_pub_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(plat_pub_policy.conf): $(call build_policy, $(sepolicy_build_files), \
$(BOARD_SEPOLICY_VERS_DIR) $(REQD_MASK_POLICY))
@mkdir -p $(dir $@)
$(hide) m4 $(PRIVATE_ADDITIONAL_M4DEFS) \
-D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
-D target_build_variant=$(TARGET_BUILD_VARIANT) \
-s $^ > $@
plat_pub_policy.cil := $(intermediates)/plat_pub_policy.cil
$(plat_pub_policy.cil): $(plat_pub_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy
@mkdir -p $(dir $@)
$(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -C -M -c $(POLICYVERS) -o $@ $<
pruned_plat_pub_policy.cil := $(intermediates)/pruned_plat_pub_policy.cil
$(pruned_plat_pub_policy.cil): $(reqd_policy_mask.cil) $(plat_pub_policy.cil)
@mkdir -p $(dir $@)
$(hide) grep -Fxv -f $^ > $@
# plat_policy.conf - A combination of the private and public platform policy
# which will ship with the device. The platform will always reflect the most
# recent platform version and is not currently being attributized.
plat_policy.conf := $(intermediates)/plat_policy.conf
$(plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
$(plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
$(plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(plat_policy.conf): $(call build_policy, $(sepolicy_build_files), \
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY))
@mkdir -p $(dir $@)
$(hide) m4 $(PRIVATE_ADDITIONAL_M4DEFS) \
-D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
-D target_build_variant=$(TARGET_BUILD_VARIANT) \
Add macros for treble and non-treble only policy Test: builds Change-Id: Idd1d90a89a9ecbb2738d6b483af0e8479e87aa15
2016-10-19 22:55:21 +02:00
-D target_build_treble=$(ENABLE_TREBLE) \
Use with_dexpreopt macro for zygote execute permissions. When WITH_DEXPREOPT is set, the zygote does not need to execute dalvikcache_data_file objects. Bug: 32970029 Test: Add policy line inside macro, build with and without WITH_DEXPREOPT. Test: HiKey builds, boots, no zygote denials. Change-Id: I4dace93e8044267232f0f26cfe427fc250d351fb
2016-11-18 14:42:35 +01:00
-D target_with_dexpreopt=$(WITH_DEXPREOPT) \
Add WITH_DEXPREOPT_PIC to 'with_dexpreopt' SELinux macro. |WITH_DEXPREOPT_PIC = false| will still cause code to be loaded from /data. Bug: 32970029 Test: On HiKey and Marlin: Test: Add |WITH_DEXPREOPT_PIC = false|, see SELinux denial. Test: Apply this CL, no SELinux denials. Change-Id: I0a1d39eeb4d7f75d84c1908b879d9ea1ccffba74
2016-11-21 17:54:19 +01:00
-D target_with_dexpreopt_pic=$(WITH_DEXPREOPT_PIC) \
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
-s $^ > $@
$(hide) sed '/dontaudit/d' $@ > $@.dontaudit
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
plat_policy.cil := $(intermediates)/plat_policy.cil
$(plat_policy.cil): $(plat_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy
@mkdir -p $(dir $@)
$(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c $(POLICYVERS) -o $@.tmp $<
$(hide) grep -v neverallow $@.tmp > $@
# nonplat_policy.conf - A combination of the non-platform private and the
# exported platform policy associated with the version the non-platform policy
# targets. This needs attributization and to be combined with the
# platform-provided policy. Like plat_pub_policy.conf, this needs to make use
# of the reqd_policy_mask files from private policy in order to use checkpolicy.
nonplat_policy.conf := $(intermediates)/nonplat_policy.conf
$(nonplat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
$(nonplat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
$(nonplat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(nonplat_policy.conf): $(call build_policy, $(sepolicy_build_files), \
$(BOARD_SEPOLICY_VERS_DIR) $(REQD_MASK_POLICY) $(BOARD_SEPOLICY_DIRS))
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
@mkdir -p $(dir $@)
Android.mk: Add support for BOARD_SEPOLICY_M4DEFS Allow device builders to pass arbitrary m4 definitions during the build via make variable BOARD_SEPOLICY_M4DEFS. This enables OEMs to define their own static policy build conditionals. Change-Id: Ibea1dbb7b8615576c5668e47f16ed0eedfa0b73c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-07-16 20:28:02 +02:00
$(hide) m4 $(PRIVATE_ADDITIONAL_M4DEFS) \
-D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
Support forcing permissive domains to unconfined. Permissive domains are only intended for development. When a device launches, we want to ensure that all permissive domains are in, at a minimum, unconfined+enforcing. Add FORCE_PERMISSIVE_TO_UNCONFINED to Android.mk. During development, this flag is false, and permissive domains are allowed. When SELinux new feature development has been frozen immediately before release, this flag will be flipped to true. Any previously permissive domains will move into unconfined+enforcing. This will ensure that all SELinux domains have at least a minimal level of protection. Unconditionally enable this flag for all user builds. Change-Id: I1632f0da0022c80170d8eb57c82499ac13fd7858
2014-01-11 10:31:03 +01:00
-D target_build_variant=$(TARGET_BUILD_VARIANT) \
Add macros for treble and non-treble only policy Test: builds Change-Id: Idd1d90a89a9ecbb2738d6b483af0e8479e87aa15
2016-10-19 22:55:21 +02:00
-D target_build_treble=$(ENABLE_TREBLE) \
Use with_dexpreopt macro for zygote execute permissions. When WITH_DEXPREOPT is set, the zygote does not need to execute dalvikcache_data_file objects. Bug: 32970029 Test: Add policy line inside macro, build with and without WITH_DEXPREOPT. Test: HiKey builds, boots, no zygote denials. Change-Id: I4dace93e8044267232f0f26cfe427fc250d351fb
2016-11-18 14:42:35 +01:00
-D target_with_dexpreopt=$(WITH_DEXPREOPT) \
Add WITH_DEXPREOPT_PIC to 'with_dexpreopt' SELinux macro. |WITH_DEXPREOPT_PIC = false| will still cause code to be loaded from /data. Bug: 32970029 Test: On HiKey and Marlin: Test: Add |WITH_DEXPREOPT_PIC = false|, see SELinux denial. Test: Apply this CL, no SELinux denials. Change-Id: I0a1d39eeb4d7f75d84c1908b879d9ea1ccffba74
2016-11-21 17:54:19 +01:00
-D target_with_dexpreopt_pic=$(WITH_DEXPREOPT_PIC) \
Fix ioctl defines for Mips. This patch allows mips to boot in enforcing mode. Change-Id: Ia4676db06adc3ccb20d5f231406cf4ab67317496
2016-07-29 00:49:31 +02:00
-D target_arch=$(LOCAL_TARGET_ARCH) \
Support forcing permissive domains to unconfined. Permissive domains are only intended for development. When a device launches, we want to ensure that all permissive domains are in, at a minimum, unconfined+enforcing. Add FORCE_PERMISSIVE_TO_UNCONFINED to Android.mk. During development, this flag is false, and permissive domains are allowed. When SELinux new feature development has been frozen immediately before release, this flag will be flipped to true. Any previously permissive domains will move into unconfined+enforcing. This will ensure that all SELinux domains have at least a minimal level of protection. Unconditionally enable this flag for all user builds. Change-Id: I1632f0da0022c80170d8eb57c82499ac13fd7858
2014-01-11 10:31:03 +01:00
-s $^ > $@
Various policy updates. Assortment of policy changes include: * Bluetooth domain to talk to init and procfs. * New device node domains. * Allow zygote to talk to its executable. * Update system domain access to new device node domains. * Create a post-process sepolicy with dontaudits removed. * Allow rild to use the tty device. Change-Id: Ibb96b590d0035b8f6d1606cd5e4393c174d10ffb Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2013-03-27 11:30:25 +01:00
$(hide) sed '/dontaudit/d' $@ > $@.dontaudit
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
nonplat_policy.cil := $(intermediates)/nonplat_policy.cil
$(nonplat_policy.cil): $(nonplat_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
@mkdir -p $(dir $@)
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
$(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -C -M -c $(POLICYVERS) -o $@ $<
pruned_nonplat_policy.cil := $(intermediates)/pruned_nonplat_policy.cil
$(pruned_nonplat_policy.cil): $(reqd_policy_mask.cil) $(nonplat_policy.cil)
@mkdir -p $(dir $@)
$(hide) grep -Fxv -f $^ | grep -v neverallow > $@
vers_nonplat_policy.cil := $(intermediates)/vers_nonplat_policy.cil
$(vers_nonplat_policy.cil) : PRIVATE_VERS := $(BOARD_SEPOLICY_VERS)
$(vers_nonplat_policy.cil) : PRIVATE_TGT_POL := $(pruned_nonplat_policy.cil)
$(vers_nonplat_policy.cil) : $(pruned_plat_pub_policy.cil) $(pruned_nonplat_policy.cil) \
$(HOST_OUT_EXECUTABLES)/version_policy
@mkdir -p $(dir $@)
$(HOST_OUT_EXECUTABLES)/version_policy -b $< -t $(PRIVATE_TGT_POL) -n $(PRIVATE_VERS) -o $@
# auto-generate the mapping file for current platform policy, since it needs to
# track platform policy development
current_mapping.cil := $(intermediates)/mapping/current.cil
$(current_mapping.cil) : PRIVATE_VERS := $(BOARD_SEPOLICY_VERS)
$(current_mapping.cil) : $(pruned_plat_pub_policy.cil) $(HOST_OUT_EXECUTABLES)/version_policy
@mkdir -p $(dir $@)
$(hide) $(HOST_OUT_EXECUTABLES)/version_policy -b $< -m -n $(PRIVATE_VERS) -o $@
ifeq ($(BOARD_SEPOLICY_VERS), current)
mapping.cil := $(current_mapping.cil)
else
mapping.cil := $(addsuffix /$(BOARD_SEPOLICY_VERS).cil, $(PLAT_PRIVATE_POLICY)/mapping)
endif
all_cil_files := \
$(plat_policy.cil) \
$(vers_nonplat_policy.cil) \
$(mapping.cil)
$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(all_cil_files)
$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $(all_cil_files)
@mkdir -p $(dir $@)
$(hide) $< -M true -c $(POLICYVERS) $(PRIVATE_CIL_FILES) -o $@.tmp
Don't allow permissive SELinux domains on user builds. It's a CTS requirement that all SELinux domains be in enforcing mode. Add the same assertion to the build system when targeting user builds. In particular, this avoids a situation where device integrity checking is enabled on user builds, but permissive denials are being generated, causing the device to unexpectedly reboot into safe mode. A developer wanting to put an SELinux domain into permissive mode for userdebug/eng purposes can write the following in their policy: userdebug_or_eng(` permissive foo; ') Bug: 26902605 Bug: 27313768 Change-Id: Ic0971d9e96a28f2a98f9d56a547661d24fb81a21
2016-02-27 05:06:52 +01:00
$(hide) $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $@.tmp permissive > $@.permissivedomains
$(hide) if [ "$(TARGET_BUILD_VARIANT)" = "user" -a -s $@.permissivedomains ]; then \
echo "==========" 1>&2; \
echo "ERROR: permissive domains not allowed in user builds" 1>&2; \
echo "List of invalid domains:" 1>&2; \
cat $@.permissivedomains 1>&2; \
exit 1; \
fi
$(hide) mv $@.tmp $@
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
Use file target as dependency. "sepolicy" is a phony target defined by the build system. If you use it as dependency of a file target, you'll get unnecessary rebuild. Change-Id: I3a948ebbaff6a146050eb86a3d04cdc050f7c001
2012-10-26 04:01:31 +02:00
built_sepolicy := $(LOCAL_BUILT_MODULE)
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
reqd_policy_mask.conf :=
reqd_policy_mask.cil :=
plat_pub_policy.conf :=
plat_pub_policy.cil :=
pruned_plat_pub_policy.cil :=
plat_policy.conf :=
plat_policy.cil :=
nonplat_policy.conf :=
nonplat_policy.cil :=
pruned_nonplat_policy.cil :=
vers_nonplat_policy.cil :=
current_mapping.cil :=
mapping.cil :=
all_cil_files :=
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
sepolicy_policy.conf :=
Add a checkfc utility to check file_contexts validity and invoke it. Change-Id: I4b12dc3dcb432edbdf95dd3bc97f809912ce86d1 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2012-10-02 18:46:37 +02:00
Create a separate recovery policy. Create a separate recovery policy and only include the recovery domain allow rules in it. Change-Id: I444107f9821eabf4164ba07a44d03bd71e719989 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-05-29 22:40:15 +02:00
##################################
include $(CLEAR_VARS)
LOCAL_MODULE := sepolicy.recovery
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := eng
include $(BUILD_SYSTEM)/base_rules.mk
sepolicy_policy_recovery.conf := $(intermediates)/policy_recovery.conf
$(sepolicy_policy_recovery.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
$(sepolicy_policy_recovery.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Android.mk: Add support for BOARD_SEPOLICY_M4DEFS Allow device builders to pass arbitrary m4 definitions during the build via make variable BOARD_SEPOLICY_M4DEFS. This enables OEMs to define their own static policy build conditionals. Change-Id: Ibea1dbb7b8615576c5668e47f16ed0eedfa0b73c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-07-16 20:28:02 +02:00
$(sepolicy_policy_recovery.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
$(sepolicy_policy_recovery.conf): $(call build_policy, $(sepolicy_build_files), \
$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) $(BOARD_SEPOLICY_DIRS))
Create a separate recovery policy. Create a separate recovery policy and only include the recovery domain allow rules in it. Change-Id: I444107f9821eabf4164ba07a44d03bd71e719989 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-05-29 22:40:15 +02:00
@mkdir -p $(dir $@)
Android.mk: Add support for BOARD_SEPOLICY_M4DEFS Allow device builders to pass arbitrary m4 definitions during the build via make variable BOARD_SEPOLICY_M4DEFS. This enables OEMs to define their own static policy build conditionals. Change-Id: Ibea1dbb7b8615576c5668e47f16ed0eedfa0b73c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-07-16 20:28:02 +02:00
$(hide) m4 $(PRIVATE_ADDITIONAL_M4DEFS) \
-D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
Create a separate recovery policy. Create a separate recovery policy and only include the recovery domain allow rules in it. Change-Id: I444107f9821eabf4164ba07a44d03bd71e719989 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-05-29 22:40:15 +02:00
-D target_build_variant=$(TARGET_BUILD_VARIANT) \
Add macros for treble and non-treble only policy Test: builds Change-Id: Idd1d90a89a9ecbb2738d6b483af0e8479e87aa15
2016-10-19 22:55:21 +02:00
-D target_build_treble=$(ENABLE_TREBLE) \
Use with_dexpreopt macro for zygote execute permissions. When WITH_DEXPREOPT is set, the zygote does not need to execute dalvikcache_data_file objects. Bug: 32970029 Test: Add policy line inside macro, build with and without WITH_DEXPREOPT. Test: HiKey builds, boots, no zygote denials. Change-Id: I4dace93e8044267232f0f26cfe427fc250d351fb
2016-11-18 14:42:35 +01:00
-D target_with_dexpreopt=$(WITH_DEXPREOPT) \
Add WITH_DEXPREOPT_PIC to 'with_dexpreopt' SELinux macro. |WITH_DEXPREOPT_PIC = false| will still cause code to be loaded from /data. Bug: 32970029 Test: On HiKey and Marlin: Test: Add |WITH_DEXPREOPT_PIC = false|, see SELinux denial. Test: Apply this CL, no SELinux denials. Change-Id: I0a1d39eeb4d7f75d84c1908b879d9ea1ccffba74
2016-11-21 17:54:19 +01:00
-D target_with_dexpreopt_pic=$(WITH_DEXPREOPT_PIC) \
Create a separate recovery policy. Create a separate recovery policy and only include the recovery domain allow rules in it. Change-Id: I444107f9821eabf4164ba07a44d03bd71e719989 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-05-29 22:40:15 +02:00
-D target_recovery=true \
-s $^ > $@
Don't allow permissive SELinux domains on user builds. It's a CTS requirement that all SELinux domains be in enforcing mode. Add the same assertion to the build system when targeting user builds. In particular, this avoids a situation where device integrity checking is enabled on user builds, but permissive denials are being generated, causing the device to unexpectedly reboot into safe mode. A developer wanting to put an SELinux domain into permissive mode for userdebug/eng purposes can write the following in their policy: userdebug_or_eng(` permissive foo; ') Bug: 26902605 Bug: 27313768 Change-Id: Ic0971d9e96a28f2a98f9d56a547661d24fb81a21
2016-02-27 05:06:52 +01:00
$(LOCAL_BUILT_MODULE): $(sepolicy_policy_recovery.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy $(HOST_OUT_EXECUTABLES)/sepolicy-analyze
Create a separate recovery policy. Create a separate recovery policy and only include the recovery domain allow rules in it. Change-Id: I444107f9821eabf4164ba07a44d03bd71e719989 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-05-29 22:40:15 +02:00
@mkdir -p $(dir $@)
suppress unnecessary makefile output checkpolicy spits out a bunch of unnecessary lines during normal operation, which bloat the logs and hide other more important warnings. Suppress the normal output. SELinux compile time errors are printed to stderr, and are uneffected by this change. Change-Id: I07f2cbe8afcd14abf1c025355a169b5214ed5c6e
2016-03-01 01:59:33 +01:00
$(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c $(POLICYVERS) -o $@.tmp $< > /dev/null
Don't allow permissive SELinux domains on user builds. It's a CTS requirement that all SELinux domains be in enforcing mode. Add the same assertion to the build system when targeting user builds. In particular, this avoids a situation where device integrity checking is enabled on user builds, but permissive denials are being generated, causing the device to unexpectedly reboot into safe mode. A developer wanting to put an SELinux domain into permissive mode for userdebug/eng purposes can write the following in their policy: userdebug_or_eng(` permissive foo; ') Bug: 26902605 Bug: 27313768 Change-Id: Ic0971d9e96a28f2a98f9d56a547661d24fb81a21
2016-02-27 05:06:52 +01:00
$(hide) $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $@.tmp permissive > $@.permissivedomains
$(hide) if [ "$(TARGET_BUILD_VARIANT)" = "user" -a -s $@.permissivedomains ]; then \
echo "==========" 1>&2; \
echo "ERROR: permissive domains not allowed in user builds" 1>&2; \
echo "List of invalid domains:" 1>&2; \
cat $@.permissivedomains 1>&2; \
exit 1; \
fi
$(hide) mv $@.tmp $@
Create a separate recovery policy. Create a separate recovery policy and only include the recovery domain allow rules in it. Change-Id: I444107f9821eabf4164ba07a44d03bd71e719989 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-05-29 22:40:15 +02:00
built_sepolicy_recovery := $(LOCAL_BUILT_MODULE)
sepolicy_policy_recovery.conf :=
Generate selinux_policy.xml as part of CTS build. Bug: 16563899 Bug: 14251916 Change-Id: Id3172b73f10186ba361caf6b7333e5d2a0648475
2014-07-26 04:11:52 +02:00
##################################
include $(CLEAR_VARS)
LOCAL_MODULE := general_sepolicy.conf
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := tests
include $(BUILD_SYSTEM)/base_rules.mk
$(LOCAL_BUILT_MODULE): PRIVATE_MLS_SENS := $(MLS_SENS)
$(LOCAL_BUILT_MODULE): PRIVATE_MLS_CATS := $(MLS_CATS)
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
$(LOCAL_BUILT_MODULE): $(call build_policy, $(sepolicy_build_files), \
$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY))
Generate selinux_policy.xml as part of CTS build. Bug: 16563899 Bug: 14251916 Change-Id: Id3172b73f10186ba361caf6b7333e5d2a0648475
2014-07-26 04:11:52 +02:00
mkdir -p $(dir $@)
$(hide) m4 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
-D target_build_variant=user \
Add macros for treble and non-treble only policy Test: builds Change-Id: Idd1d90a89a9ecbb2738d6b483af0e8479e87aa15
2016-10-19 22:55:21 +02:00
-D target_build_treble=$(ENABLE_TREBLE) \
Use with_dexpreopt macro for zygote execute permissions. When WITH_DEXPREOPT is set, the zygote does not need to execute dalvikcache_data_file objects. Bug: 32970029 Test: Add policy line inside macro, build with and without WITH_DEXPREOPT. Test: HiKey builds, boots, no zygote denials. Change-Id: I4dace93e8044267232f0f26cfe427fc250d351fb
2016-11-18 14:42:35 +01:00
-D target_with_dexpreopt=$(WITH_DEXPREOPT) \
Add WITH_DEXPREOPT_PIC to 'with_dexpreopt' SELinux macro. |WITH_DEXPREOPT_PIC = false| will still cause code to be loaded from /data. Bug: 32970029 Test: On HiKey and Marlin: Test: Add |WITH_DEXPREOPT_PIC = false|, see SELinux denial. Test: Apply this CL, no SELinux denials. Change-Id: I0a1d39eeb4d7f75d84c1908b879d9ea1ccffba74
2016-11-21 17:54:19 +01:00
-D target_with_dexpreopt_pic=$(WITH_DEXPREOPT_PIC) \
Generate selinux_policy.xml as part of CTS build. Bug: 16563899 Bug: 14251916 Change-Id: Id3172b73f10186ba361caf6b7333e5d2a0648475
2014-07-26 04:11:52 +02:00
-s $^ > $@
$(hide) sed '/dontaudit/d' $@ > $@.dontaudit
use a general sepolicy when building general targets Change-Id: Ie800ebf9d8e68680ec377e8c51f7cd7717f3c755 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-30 01:31:23 +02:00
built_general_sepolicy.conf := $(LOCAL_BUILT_MODULE)
Generate selinux_policy.xml as part of CTS build. Bug: 16563899 Bug: 14251916 Change-Id: Id3172b73f10186ba361caf6b7333e5d2a0648475
2014-07-26 04:11:52 +02:00
exp_sepolicy_build_files :=
##################################
Add a checkfc utility to check file_contexts validity and invoke it. Change-Id: I4b12dc3dcb432edbdf95dd3bc97f809912ce86d1 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2012-10-02 18:46:37 +02:00
include $(CLEAR_VARS)
use a general sepolicy when building general targets Change-Id: Ie800ebf9d8e68680ec377e8c51f7cd7717f3c755 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-30 01:31:23 +02:00
LOCAL_MODULE := sepolicy.general
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := tests
include $(BUILD_SYSTEM)/base_rules.mk
$(LOCAL_BUILT_MODULE): PRIVATE_BUILT_SEPOLICY.CONF := $(built_general_sepolicy.conf)
$(LOCAL_BUILT_MODULE): $(built_general_sepolicy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy
@mkdir -p $(dir $@)
suppress unnecessary makefile output checkpolicy spits out a bunch of unnecessary lines during normal operation, which bloat the logs and hide other more important warnings. Suppress the normal output. SELinux compile time errors are printed to stderr, and are uneffected by this change. Change-Id: I07f2cbe8afcd14abf1c025355a169b5214ed5c6e
2016-03-01 01:59:33 +01:00
$(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c $(POLICYVERS) -o $@ $(PRIVATE_BUILT_SEPOLICY.CONF) > /dev/null
use a general sepolicy when building general targets Change-Id: Ie800ebf9d8e68680ec377e8c51f7cd7717f3c755 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-30 01:31:23 +02:00
built_general_sepolicy := $(LOCAL_BUILT_MODULE)
##################################
include $(CLEAR_VARS)
Update Android.mk to support file_contexts.bin This change supports external/libselinux changes to implement PCRE formatted binary file_contexts and general_file_contexts.bin files. The $(intermediates) directory will contain the original text file (that is no longer used on the device) with a .tmp extension as well as the .bin file to aid analysis. A CleanSpec.mk file is added to remove the old file_contexts file. Change-Id: I75a781100082c23536f70ce3603f7de42408b5ba Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-08-06 18:43:52 +02:00
LOCAL_MODULE := file_contexts.bin
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Add support for per-device .te and .fc files.
2012-03-06 17:12:41 +01:00
include $(BUILD_SYSTEM)/base_rules.mk
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: I3775eae11bfa5905cad0d02a0bf26c76ac03437c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
# The file_contexts.bin is built in the following way:
# 1. Collect all file_contexts files in THIS repository and process them with
# m4 into a tmp file called file_contexts.local.tmp.
# 2. Collect all device specific file_contexts files and process them with m4
# into a tmp file called file_contexts.device.tmp.
# 3. Run checkfc -e (allow no device fc entries ie empty) and fc_sort on
# file_contexts.device.tmp and output to file_contexts.device.sorted.tmp.
# 4. Concatenate file_contexts.local.tmp and file_contexts.device.tmp into
# file_contexts.concat.tmp.
# 5. Run checkfc and sefcontext_compile on file_contexts.concat.tmp to produce
# file_contexts.bin.
#
# Note: That a newline file is placed between each file_context file found to
# ensure a proper build when an fc file is missing an ending newline.
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
local_fc_files := $(PLAT_PRIVATE_POLICY)/file_contexts
asan: update condition to work with multiple SANITIZE_TARGET values. The goal is to enable SANITIZE_TARGET='address coverage', which will be used by LLVMFuzzer. Bug: 22850550 Change-Id: I953649186a7fae9b2495159237521f264d1de3b6
2015-09-18 21:05:51 +02:00
ifneq ($(filter address,$(SANITIZE_TARGET)),)
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
local_fc_files := $(local_fc_files) $(PLAT_PRIVATE_POLICY)/file_contexts_asan
Extend sepolicy for SANITIZE_TARGET. SANITIZE_TARGET adds shared libraries in /data/lib. Bug: 21785137 Change-Id: I8ac3d059d88d57d24ed762ffc6202a4ce5a42333
2015-06-13 02:18:20 +02:00
endif
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: I3775eae11bfa5905cad0d02a0bf26c76ac03437c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
local_fcfiles_with_nl := $(call add_nl, $(local_fc_files), $(built_nl))
file_contexts.local.tmp := $(intermediates)/file_contexts.local.tmp
$(file_contexts.local.tmp): $(local_fcfiles_with_nl)
@mkdir -p $(dir $@)
$(hide) m4 -s $^ > $@
device_fc_files := $(call build_device_policy, file_contexts)
device_fcfiles_with_nl := $(call add_nl, $(device_fc_files), $(built_nl))
file_contexts.device.tmp := $(intermediates)/file_contexts.device.tmp
$(file_contexts.device.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(file_contexts.device.tmp): $(device_fcfiles_with_nl)
@mkdir -p $(dir $@)
$(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@
file_contexts.device.sorted.tmp := $(intermediates)/file_contexts.device.sorted.tmp
$(file_contexts.device.sorted.tmp): PRIVATE_SEPOLICY := $(built_sepolicy)
$(file_contexts.device.sorted.tmp): $(file_contexts.device.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/fc_sort $(HOST_OUT_EXECUTABLES)/checkfc
@mkdir -p $(dir $@)
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
# TODO: fix with attributized types $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e $(PRIVATE_SEPOLICY) $<
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: I3775eae11bfa5905cad0d02a0bf26c76ac03437c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
$(hide) $(HOST_OUT_EXECUTABLES)/fc_sort $< $@
Add a checkfc utility to check file_contexts validity and invoke it. Change-Id: I4b12dc3dcb432edbdf95dd3bc97f809912ce86d1 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2012-10-02 18:46:37 +02:00
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: I3775eae11bfa5905cad0d02a0bf26c76ac03437c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
file_contexts.concat.tmp := $(intermediates)/file_contexts.concat.tmp
$(file_contexts.concat.tmp): $(file_contexts.local.tmp) $(file_contexts.device.sorted.tmp)
Add support for per-device .te and .fc files.
2012-03-06 17:12:41 +01:00
@mkdir -p $(dir $@)
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: I3775eae11bfa5905cad0d02a0bf26c76ac03437c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
$(hide) m4 -s $^ > $@
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
file_contexts: don't delete intermediate on failure Currently, if an error is detected in a file_contexts file, the intermediate file_context.tmp file is removed, thus making debugging of build issues problematic. Instead, employ checkfc tool during the compilation recipe so the m4 concatenated intermediate is preserved on failure. Change-Id: Ic827385d3bc3434b6c2a9bba5313cd42b5f15599 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-25 19:18:44 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: I3775eae11bfa5905cad0d02a0bf26c76ac03437c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
$(LOCAL_BUILT_MODULE): $(file_contexts.concat.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/sefcontext_compile $(HOST_OUT_EXECUTABLES)/checkfc
Update Android.mk to support file_contexts.bin This change supports external/libselinux changes to implement PCRE formatted binary file_contexts and general_file_contexts.bin files. The $(intermediates) directory will contain the original text file (that is no longer used on the device) with a .tmp extension as well as the .bin file to aid analysis. A CleanSpec.mk file is added to remove the old file_contexts file. Change-Id: I75a781100082c23536f70ce3603f7de42408b5ba Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-08-06 18:43:52 +02:00
@mkdir -p $(dir $@)
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
# TODO: fix with attributized types $(hide) $(HOST_OUT_EXECUTABLES)/checkfc $(PRIVATE_SEPOLICY) $<
Update Android.mk to support file_contexts.bin This change supports external/libselinux changes to implement PCRE formatted binary file_contexts and general_file_contexts.bin files. The $(intermediates) directory will contain the original text file (that is no longer used on the device) with a .tmp extension as well as the .bin file to aid analysis. A CleanSpec.mk file is added to remove the old file_contexts file. Change-Id: I75a781100082c23536f70ce3603f7de42408b5ba Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-08-06 18:43:52 +02:00
$(hide) $(HOST_OUT_EXECUTABLES)/sefcontext_compile -o $@ $<
Build the selinux_version file. The selinux_version file is used to perform policy versioning checks by libselinux and SELinuxMMAC. When loading policy a check is first performed to determine if the policy out in /data/security/current should be used to override the base policy shipped with the device. The selinux_version file is used to make that choice. The contents of the file simply contains the BUILD_FINGERPRINT that the policy was built against. A simple string comparison is then performed by libselinux and SELinuxMMAC. Change-Id: I69d9d071743cfd46bb247c98f94a193396f8ebbd Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-03-20 14:35:08 +01:00
built_fc := $(LOCAL_BUILT_MODULE)
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: I3775eae11bfa5905cad0d02a0bf26c76ac03437c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
local_fc_files :=
local_fcfiles_with_nl :=
device_fc_files :=
device_fcfiles_with_nl :=
file_contexts.concat.tmp :=
file_contexts.device.sorted.tmp :=
file_contexts.device.tmp :=
file_contexts.local.tmp :=
per device seapp_context support
2012-08-16 19:55:05 +02:00
Generate general versions of the other contexts files for tests. Generate general forms of the remaining *_contexts files with only the device-independent entries for use in CTS testing. Change-Id: I2bf0e41db8a73c26754cedd92cbc3783ff03d6b5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 22:45:03 +01:00
##################################
include $(CLEAR_VARS)
Update Android.mk to support file_contexts.bin This change supports external/libselinux changes to implement PCRE formatted binary file_contexts and general_file_contexts.bin files. The $(intermediates) directory will contain the original text file (that is no longer used on the device) with a .tmp extension as well as the .bin file to aid analysis. A CleanSpec.mk file is added to remove the old file_contexts file. Change-Id: I75a781100082c23536f70ce3603f7de42408b5ba Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-08-06 18:43:52 +02:00
LOCAL_MODULE := general_file_contexts.bin
Generate general versions of the other contexts files for tests. Generate general forms of the remaining *_contexts files with only the device-independent entries for use in CTS testing. Change-Id: I2bf0e41db8a73c26754cedd92cbc3783ff03d6b5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 22:45:03 +01:00
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := tests
include $(BUILD_SYSTEM)/base_rules.mk
Update Android.mk to support file_contexts.bin This change supports external/libselinux changes to implement PCRE formatted binary file_contexts and general_file_contexts.bin files. The $(intermediates) directory will contain the original text file (that is no longer used on the device) with a .tmp extension as well as the .bin file to aid analysis. A CleanSpec.mk file is added to remove the old file_contexts file. Change-Id: I75a781100082c23536f70ce3603f7de42408b5ba Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-08-06 18:43:52 +02:00
general_file_contexts.tmp := $(intermediates)/general_file_contexts.tmp
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
$(general_file_contexts.tmp): $(addprefix $(PLAT_PRIVATE_POLICY)/, file_contexts)
Generate general versions of the other contexts files for tests. Generate general forms of the remaining *_contexts files with only the device-independent entries for use in CTS testing. Change-Id: I2bf0e41db8a73c26754cedd92cbc3783ff03d6b5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 22:45:03 +01:00
@mkdir -p $(dir $@)
$(hide) m4 -s $< > $@
file_contexts: don't delete intermediate on failure Currently, if an error is detected in a file_contexts file, the intermediate file_context.tmp file is removed, thus making debugging of build issues problematic. Instead, employ checkfc tool during the compilation recipe so the m4 concatenated intermediate is preserved on failure. Change-Id: Ic827385d3bc3434b6c2a9bba5313cd42b5f15599 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-25 19:18:44 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_general_sepolicy)
$(LOCAL_BUILT_MODULE): $(general_file_contexts.tmp) $(built_general_sepolicy) $(HOST_OUT_EXECUTABLES)/sefcontext_compile $(HOST_OUT_EXECUTABLES)/checkfc
Update Android.mk to support file_contexts.bin This change supports external/libselinux changes to implement PCRE formatted binary file_contexts and general_file_contexts.bin files. The $(intermediates) directory will contain the original text file (that is no longer used on the device) with a .tmp extension as well as the .bin file to aid analysis. A CleanSpec.mk file is added to remove the old file_contexts file. Change-Id: I75a781100082c23536f70ce3603f7de42408b5ba Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-08-06 18:43:52 +02:00
@mkdir -p $(dir $@)
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
# TODO: fix with attributized types $(hide) $(HOST_OUT_EXECUTABLES)/checkfc $(PRIVATE_SEPOLICY) $<
Update Android.mk to support file_contexts.bin This change supports external/libselinux changes to implement PCRE formatted binary file_contexts and general_file_contexts.bin files. The $(intermediates) directory will contain the original text file (that is no longer used on the device) with a .tmp extension as well as the .bin file to aid analysis. A CleanSpec.mk file is added to remove the old file_contexts file. Change-Id: I75a781100082c23536f70ce3603f7de42408b5ba Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-08-06 18:43:52 +02:00
$(hide) $(HOST_OUT_EXECUTABLES)/sefcontext_compile -o $@ $<
general_file_contexts.tmp :=
Generate general versions of the other contexts files for tests. Generate general forms of the remaining *_contexts files with only the device-independent entries for use in CTS testing. Change-Id: I2bf0e41db8a73c26754cedd92cbc3783ff03d6b5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 22:45:03 +01:00
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
##################################
include $(CLEAR_VARS)
LOCAL_MODULE := seapp_contexts
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
per device seapp_context support
2012-08-16 19:55:05 +02:00
include $(BUILD_SYSTEM)/base_rules.mk
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
all_sc_files := $(call build_policy, seapp_contexts, $(PLAT_PRIVATE_POLICY) $(BOARD_SEPOLICY_DIRS))
per device seapp_context support
2012-08-16 19:55:05 +02:00
Use file target as dependency. "sepolicy" is a phony target defined by the build system. If you use it as dependency of a file target, you'll get unnecessary rebuild. Change-Id: I3a948ebbaff6a146050eb86a3d04cdc050f7c001
2012-10-26 04:01:31 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
check_seapp: add support for "neverallow" checks Introduce "neverallow" rules for seapp_contexts. A neverallow rule is similar to the existing key-value-pair entries but the line begins with "neverallow". A neverallow violation is detected when all keys, both inputs and outputs are matched. The neverallow rules value parameter (not the key) can contain regular expressions to assist in matching. Neverallow rules are never output to the generated seapp_contexts file. Also, unless -o is specified, checkseapp runs in silent mode and outputs nothing. Specifying - as an argument to -o outputs to stdout. Sample Output: Error: Rule in File "external/sepolicy/seapp_contexts" on line 87: "user=fake domain=system_app type=app_data_file" violates neverallow in File "external/sepolicy/seapp_contexts" on line 57: "user=((?!system).)* domain=system_app" Change-Id: Ia4dcbf02feb774f2e201bb0c5d4ce385274d8b8d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-04 06:57:47 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_SC_FILES := $(all_sc_files)
$(LOCAL_BUILT_MODULE): $(built_sepolicy) $(all_sc_files) $(HOST_OUT_EXECUTABLES)/checkseapp
Support overrides in seapp_contexts Provides support for overriding seapp_contexts declerations in per device seapp_contexts files. Change-Id: I23a0ffa1d24f1ce57825b168f29a2e885d3e1c51
2012-08-28 00:41:15 +02:00
@mkdir -p $(dir $@)
hide checkseapp command invocation Change-Id: I040904b69b98c49d60546f024f5ace5b7c6f7d5e Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-30 22:53:51 +02:00
$(hide) $(HOST_OUT_EXECUTABLES)/checkseapp -p $(PRIVATE_SEPOLICY) -o $@ $(PRIVATE_SC_FILES)
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
Build the selinux_version file. The selinux_version file is used to perform policy versioning checks by libselinux and SELinuxMMAC. When loading policy a check is first performed to determine if the policy out in /data/security/current should be used to override the base policy shipped with the device. The selinux_version file is used to make that choice. The contents of the file simply contains the BUILD_FINGERPRINT that the policy was built against. A simple string comparison is then performed by libselinux and SELinuxMMAC. Change-Id: I69d9d071743cfd46bb247c98f94a193396f8ebbd Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-03-20 14:35:08 +01:00
built_sc := $(LOCAL_BUILT_MODULE)
check_seapp: add support for "neverallow" checks Introduce "neverallow" rules for seapp_contexts. A neverallow rule is similar to the existing key-value-pair entries but the line begins with "neverallow". A neverallow violation is detected when all keys, both inputs and outputs are matched. The neverallow rules value parameter (not the key) can contain regular expressions to assist in matching. Neverallow rules are never output to the generated seapp_contexts file. Also, unless -o is specified, checkseapp runs in silent mode and outputs nothing. Specifying - as an argument to -o outputs to stdout. Sample Output: Error: Rule in File "external/sepolicy/seapp_contexts" on line 87: "user=fake domain=system_app type=app_data_file" violates neverallow in File "external/sepolicy/seapp_contexts" on line 57: "user=((?!system).)* domain=system_app" Change-Id: Ia4dcbf02feb774f2e201bb0c5d4ce385274d8b8d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-04 06:57:47 +02:00
all_sc_files :=
Build the selinux_version file. The selinux_version file is used to perform policy versioning checks by libselinux and SELinuxMMAC. When loading policy a check is first performed to determine if the policy out in /data/security/current should be used to override the base policy shipped with the device. The selinux_version file is used to make that choice. The contents of the file simply contains the BUILD_FINGERPRINT that the policy was built against. A simple string comparison is then performed by libselinux and SELinuxMMAC. Change-Id: I69d9d071743cfd46bb247c98f94a193396f8ebbd Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-03-20 14:35:08 +01:00
Generate a general_seapp_contexts file for tests. Generate a general_seapp_contexts file with only the device-independent entries, similar to general_sepolicy.conf. This is for use by CTS tests to compare with the prefix of device seapp_contexts. Change-Id: If8d1456afff5347adff7157411c6a160484e0b39 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 20:46:36 +01:00
##################################
include $(CLEAR_VARS)
LOCAL_MODULE := general_seapp_contexts
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := tests
include $(BUILD_SYSTEM)/base_rules.mk
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
all_sc_files := $(addprefix $(PLAT_PRIVATE_POLICY)/, seapp_contexts)
Generate a general_seapp_contexts file for tests. Generate a general_seapp_contexts file with only the device-independent entries, similar to general_sepolicy.conf. This is for use by CTS tests to compare with the prefix of device seapp_contexts. Change-Id: If8d1456afff5347adff7157411c6a160484e0b39 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 20:46:36 +01:00
use a general sepolicy when building general targets Change-Id: Ie800ebf9d8e68680ec377e8c51f7cd7717f3c755 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-30 01:31:23 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_general_sepolicy)
check_seapp: add support for "neverallow" checks Introduce "neverallow" rules for seapp_contexts. A neverallow rule is similar to the existing key-value-pair entries but the line begins with "neverallow". A neverallow violation is detected when all keys, both inputs and outputs are matched. The neverallow rules value parameter (not the key) can contain regular expressions to assist in matching. Neverallow rules are never output to the generated seapp_contexts file. Also, unless -o is specified, checkseapp runs in silent mode and outputs nothing. Specifying - as an argument to -o outputs to stdout. Sample Output: Error: Rule in File "external/sepolicy/seapp_contexts" on line 87: "user=fake domain=system_app type=app_data_file" violates neverallow in File "external/sepolicy/seapp_contexts" on line 57: "user=((?!system).)* domain=system_app" Change-Id: Ia4dcbf02feb774f2e201bb0c5d4ce385274d8b8d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-04 06:57:47 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_SC_FILE := $(all_sc_files)
use a general sepolicy when building general targets Change-Id: Ie800ebf9d8e68680ec377e8c51f7cd7717f3c755 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-30 01:31:23 +02:00
$(LOCAL_BUILT_MODULE): $(built_general_sepolicy) $(all_sc_files) $(HOST_OUT_EXECUTABLES)/checkseapp
Generate a general_seapp_contexts file for tests. Generate a general_seapp_contexts file with only the device-independent entries, similar to general_sepolicy.conf. This is for use by CTS tests to compare with the prefix of device seapp_contexts. Change-Id: If8d1456afff5347adff7157411c6a160484e0b39 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 20:46:36 +01:00
@mkdir -p $(dir $@)
hide checkseapp command invocation Change-Id: I040904b69b98c49d60546f024f5ace5b7c6f7d5e Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-30 22:53:51 +02:00
$(hide) $(HOST_OUT_EXECUTABLES)/checkseapp -p $(PRIVATE_SEPOLICY) -o $@ $(PRIVATE_SC_FILE)
Generate a general_seapp_contexts file for tests. Generate a general_seapp_contexts file with only the device-independent entries, similar to general_sepolicy.conf. This is for use by CTS tests to compare with the prefix of device seapp_contexts. Change-Id: If8d1456afff5347adff7157411c6a160484e0b39 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 20:46:36 +01:00
check_seapp: add support for "neverallow" checks Introduce "neverallow" rules for seapp_contexts. A neverallow rule is similar to the existing key-value-pair entries but the line begins with "neverallow". A neverallow violation is detected when all keys, both inputs and outputs are matched. The neverallow rules value parameter (not the key) can contain regular expressions to assist in matching. Neverallow rules are never output to the generated seapp_contexts file. Also, unless -o is specified, checkseapp runs in silent mode and outputs nothing. Specifying - as an argument to -o outputs to stdout. Sample Output: Error: Rule in File "external/sepolicy/seapp_contexts" on line 87: "user=fake domain=system_app type=app_data_file" violates neverallow in File "external/sepolicy/seapp_contexts" on line 57: "user=((?!system).)* domain=system_app" Change-Id: Ia4dcbf02feb774f2e201bb0c5d4ce385274d8b8d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-04 06:57:47 +02:00
all_sc_files :=
Generate a general_seapp_contexts file for tests. Generate a general_seapp_contexts file with only the device-independent entries, similar to general_sepolicy.conf. This is for use by CTS tests to compare with the prefix of device seapp_contexts. Change-Id: If8d1456afff5347adff7157411c6a160484e0b39 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 20:46:36 +01:00
Introduce seapp_neverallow test Produce a list of neverallow assertions from seapp_contexts into a separate file, general_seapp_context_neverallows, to be used during CTS neverallow checking. Change-Id: I171ed43cf4ae4961f66d5d8f56695345493f1261 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-25 20:59:30 +02:00
##################################
include $(CLEAR_VARS)
LOCAL_MODULE := general_seapp_neverallows
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := tests
include $(BUILD_SYSTEM)/base_rules.mk
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
$(LOCAL_BUILT_MODULE): $(addprefix $(PLAT_PRIVATE_POLICY)/, seapp_contexts)
Introduce seapp_neverallow test Produce a list of neverallow assertions from seapp_contexts into a separate file, general_seapp_context_neverallows, to be used during CTS neverallow checking. Change-Id: I171ed43cf4ae4961f66d5d8f56695345493f1261 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-25 20:59:30 +02:00
@mkdir -p $(dir $@)
- $(hide) grep -ie '^neverallow' $< > $@
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
##################################
include $(CLEAR_VARS)
LOCAL_MODULE := property_contexts
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
include $(BUILD_SYSTEM)/base_rules.mk
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
all_pc_files := $(call build_policy, property_contexts, $(PLAT_PRIVATE_POLICY) $(BOARD_SEPOLICY_DIRS))
Ensure newlines are added between context config files When multiple file_contexts, service_contexts and property_contexts are processed by the m4(1) macro processor, they will fail if one or more of the intermediate files final line is not terminated by a newline. This patch adds an intervening file only containing a newline. Change-Id: Ie66b32fe477d08c69e6d6eb1725f658adc384ce4 Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-12-11 11:39:19 +01:00
all_pcfiles_with_nl := $(call add_nl, $(all_pc_files), $(built_nl))
Android.mk: drop polluting variables Some of the ALL_*_FILES variables remained that were used in a way that could not be cleared. Move them to lower case variants and use a build recipe PRIVATE_*_FILES variable. This avoids polluting the global namespace. Change-Id: I83748dab48141af7d3f10ad27fc9319eaf90b970 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-07-30 20:44:26 +02:00
property_contexts: don't delete intermediate on failure When property_contexts fails to build, the file is deleted leaving only the error message for debugging. Build property_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ia86eb0480c9493ceab36fed779b2fe6ab85d2b3d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 22:52:37 +02:00
property_contexts.tmp := $(intermediates)/property_contexts.tmp
Ensure newlines are added between context config files When multiple file_contexts, service_contexts and property_contexts are processed by the m4(1) macro processor, they will fail if one or more of the intermediate files final line is not terminated by a newline. This patch adds an intervening file only containing a newline. Change-Id: Ie66b32fe477d08c69e6d6eb1725f658adc384ce4 Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-12-11 11:39:19 +01:00
$(property_contexts.tmp): PRIVATE_PC_FILES := $(all_pcfiles_with_nl)
property_contexts: don't delete intermediate on failure When property_contexts fails to build, the file is deleted leaving only the error message for debugging. Build property_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ia86eb0480c9493ceab36fed779b2fe6ab85d2b3d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 22:52:37 +02:00
$(property_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Android.mk: clean dependencies and clear variables Dependencies being built with newline files in between were also including the list of files without the newlines, thus make would have to process 3n-1 files instead of 2n-1 where n is the number of files to process. Additionally the *_with_nl variables were not being cleared out and polluting Make's global name-space. Change-Id: I76ea1a3dfae994b32991730aea7e4308da52a583 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-12-29 00:26:20 +01:00
$(property_contexts.tmp): $(all_pcfiles_with_nl)
property_contexts: don't delete intermediate on failure When property_contexts fails to build, the file is deleted leaving only the error message for debugging. Build property_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ia86eb0480c9493ceab36fed779b2fe6ab85d2b3d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 22:52:37 +02:00
@mkdir -p $(dir $@)
$(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_PC_FILES) > $@
property_contexts checks added to checkfc. Change-Id: If361ea93fabd343728196eed2663fd572ecaa70b Signed-off-by: Robert Craig <rpcraig@tycho.ncsc.mil>
2013-01-23 20:04:50 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
property_contexts: strip blank lines and comments Strip whitespace and comments from property_context files to reduce size. On an aosp_x86_64 build it saves 851 bytes. However, on builds with more synclines and comments, further space savings can be realized. Change-Id: I43caf1deaab53d4753c835918898c8982f477ef0 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-04-06 20:40:08 +02:00
$(LOCAL_BUILT_MODULE): $(property_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
@mkdir -p $(dir $@)
property_contexts: strip blank lines and comments Strip whitespace and comments from property_context files to reduce size. On an aosp_x86_64 build it saves 851 bytes. However, on builds with more synclines and comments, further space savings can be realized. Change-Id: I43caf1deaab53d4753c835918898c8982f477ef0 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-04-06 20:40:08 +02:00
$(hide) sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
# TODO: fix with attributized types $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -p $(PRIVATE_SEPOLICY) $@
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
Build the selinux_version file. The selinux_version file is used to perform policy versioning checks by libselinux and SELinuxMMAC. When loading policy a check is first performed to determine if the policy out in /data/security/current should be used to override the base policy shipped with the device. The selinux_version file is used to make that choice. The contents of the file simply contains the BUILD_FINGERPRINT that the policy was built against. A simple string comparison is then performed by libselinux and SELinuxMMAC. Change-Id: I69d9d071743cfd46bb247c98f94a193396f8ebbd Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-03-20 14:35:08 +01:00
built_pc := $(LOCAL_BUILT_MODULE)
Android.mk: drop polluting variables Some of the ALL_*_FILES variables remained that were used in a way that could not be cleared. Move them to lower case variants and use a build recipe PRIVATE_*_FILES variable. This avoids polluting the global namespace. Change-Id: I83748dab48141af7d3f10ad27fc9319eaf90b970 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-07-30 20:44:26 +02:00
all_pc_files :=
Android.mk: clean dependencies and clear variables Dependencies being built with newline files in between were also including the list of files without the newlines, thus make would have to process 3n-1 files instead of 2n-1 where n is the number of files to process. Additionally the *_with_nl variables were not being cleared out and polluting Make's global name-space. Change-Id: I76ea1a3dfae994b32991730aea7e4308da52a583 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-12-29 00:26:20 +01:00
all_pcfiles_with_nl :=
property_contexts: don't delete intermediate on failure When property_contexts fails to build, the file is deleted leaving only the error message for debugging. Build property_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ia86eb0480c9493ceab36fed779b2fe6ab85d2b3d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 22:52:37 +02:00
property_contexts.tmp :=
Build the selinux_version file. The selinux_version file is used to perform policy versioning checks by libselinux and SELinuxMMAC. When loading policy a check is first performed to determine if the policy out in /data/security/current should be used to override the base policy shipped with the device. The selinux_version file is used to make that choice. The contents of the file simply contains the BUILD_FINGERPRINT that the policy was built against. A simple string comparison is then performed by libselinux and SELinuxMMAC. Change-Id: I69d9d071743cfd46bb247c98f94a193396f8ebbd Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-03-20 14:35:08 +01:00
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
##################################
include $(CLEAR_VARS)
Generate general versions of the other contexts files for tests. Generate general forms of the remaining *_contexts files with only the device-independent entries for use in CTS testing. Change-Id: I2bf0e41db8a73c26754cedd92cbc3783ff03d6b5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 22:45:03 +01:00
LOCAL_MODULE := general_property_contexts
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := tests
Fix rules for general_property_contexts. Failed to include base_rules.mk, so this target was not being built. Change-Id: I2414fa6c3e3e37c74f63c205e3694d1a811c956e Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-13 14:36:57 +01:00
include $(BUILD_SYSTEM)/base_rules.mk
property_contexts: don't delete intermediate on failure When property_contexts fails to build, the file is deleted leaving only the error message for debugging. Build property_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ia86eb0480c9493ceab36fed779b2fe6ab85d2b3d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 22:52:37 +02:00
general_property_contexts.tmp := $(intermediates)/general_property_contexts.tmp
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
$(general_property_contexts.tmp): $(addprefix $(PLAT_PRIVATE_POLICY)/, property_contexts)
property_contexts: don't delete intermediate on failure When property_contexts fails to build, the file is deleted leaving only the error message for debugging. Build property_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: I431d6f4494fa119c1873eab0e77f0eed3fb5754e Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 22:52:37 +02:00
@mkdir -p $(dir $@)
Revert "property_contexts: don't delete intermediate on failure" This reverts commit 7f81b337bc600251b37de2dfa70c47781a2f2d3c. Change-Id: I79834d0ef3adbf2eed53b07d17160876e2a999c6
2015-10-01 23:25:09 +02:00
$(hide) m4 -s $< > $@
property_contexts: don't delete intermediate on failure When property_contexts fails to build, the file is deleted leaving only the error message for debugging. Build property_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: I431d6f4494fa119c1873eab0e77f0eed3fb5754e Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 22:52:37 +02:00
property_contexts: don't delete intermediate on failure When property_contexts fails to build, the file is deleted leaving only the error message for debugging. Build property_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ia86eb0480c9493ceab36fed779b2fe6ab85d2b3d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 22:52:37 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_general_sepolicy)
$(LOCAL_BUILT_MODULE): $(general_property_contexts.tmp) $(built_general_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
@mkdir -p $(dir $@)
property_contexts: strip blank lines and comments Strip whitespace and comments from property_context files to reduce size. On an aosp_x86_64 build it saves 851 bytes. However, on builds with more synclines and comments, further space savings can be realized. Change-Id: I43caf1deaab53d4753c835918898c8982f477ef0 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-04-06 20:40:08 +02:00
$(hide) sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
# TODO: fix with attributized types $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -p $(PRIVATE_SEPOLICY) $@
property_contexts: don't delete intermediate on failure When property_contexts fails to build, the file is deleted leaving only the error message for debugging. Build property_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ia86eb0480c9493ceab36fed779b2fe6ab85d2b3d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 22:52:37 +02:00
general_property_contexts.tmp :=
Generate general versions of the other contexts files for tests. Generate general forms of the remaining *_contexts files with only the device-independent entries for use in CTS testing. Change-Id: I2bf0e41db8a73c26754cedd92cbc3783ff03d6b5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 22:45:03 +01:00
##################################
include $(CLEAR_VARS)
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
LOCAL_MODULE := service_contexts
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
include $(BUILD_SYSTEM)/base_rules.mk
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
all_svc_files := $(call build_policy, service_contexts, $(PLAT_PRIVATE_POLICY) $(BOARD_SEPOLICY_DIRS))
Ensure newlines are added between context config files When multiple file_contexts, service_contexts and property_contexts are processed by the m4(1) macro processor, they will fail if one or more of the intermediate files final line is not terminated by a newline. This patch adds an intervening file only containing a newline. Change-Id: Ie66b32fe477d08c69e6d6eb1725f658adc384ce4 Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-12-11 11:39:19 +01:00
all_svcfiles_with_nl := $(call add_nl, $(all_svc_files), $(built_nl))
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
service_contexts: don't delete intermediate on failure When service_contexts fails to build, the file is deleted leaving only the error message for debugging. Build service_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ib9dcbf21d0a28700d500cf0ea4e412b009758d5d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 23:17:38 +02:00
service_contexts.tmp := $(intermediates)/service_contexts.tmp
Ensure newlines are added between context config files When multiple file_contexts, service_contexts and property_contexts are processed by the m4(1) macro processor, they will fail if one or more of the intermediate files final line is not terminated by a newline. This patch adds an intervening file only containing a newline. Change-Id: Ie66b32fe477d08c69e6d6eb1725f658adc384ce4 Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-12-11 11:39:19 +01:00
$(service_contexts.tmp): PRIVATE_SVC_FILES := $(all_svcfiles_with_nl)
service_contexts: don't delete intermediate on failure When service_contexts fails to build, the file is deleted leaving only the error message for debugging. Build service_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ib9dcbf21d0a28700d500cf0ea4e412b009758d5d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 23:17:38 +02:00
$(service_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Android.mk: clean dependencies and clear variables Dependencies being built with newline files in between were also including the list of files without the newlines, thus make would have to process 3n-1 files instead of 2n-1 where n is the number of files to process. Additionally the *_with_nl variables were not being cleared out and polluting Make's global name-space. Change-Id: I76ea1a3dfae994b32991730aea7e4308da52a583 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-12-29 00:26:20 +01:00
$(service_contexts.tmp): $(all_svcfiles_with_nl)
service_contexts: don't delete intermediate on failure When service_contexts fails to build, the file is deleted leaving only the error message for debugging. Build service_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ib9c9247d36e6a6406b4df84d10e982921c07d492 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 23:17:38 +02:00
@mkdir -p $(dir $@)
Revert "service_contexts: don't delete intermediate on failure" This reverts commit f6ee7a521942036ef7f5c0f6bc74520509934141. Change-Id: I4f1396e6e4aeecd1109f9c24494c6e82645c0663
2015-10-01 23:22:16 +02:00
$(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
service_contexts: don't delete intermediate on failure When service_contexts fails to build, the file is deleted leaving only the error message for debugging. Build service_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ib9dcbf21d0a28700d500cf0ea4e412b009758d5d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 23:17:38 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
$(LOCAL_BUILT_MODULE): $(service_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
@mkdir -p $(dir $@)
service_contexts: strip blank lines and comments Strip whitespace and comments from service_context files to reduce size. On an aosp_x86_64 build it saves 36 bytes. However, on builds with more synclines and comments, further space savings can be realized. Change-Id: I3cb4effad1d1b404bf53605a3793e3070cb95651 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-04-06 20:53:04 +02:00
sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
# TODO: fix with attributized types$(hide) $(HOST_OUT_EXECUTABLES)/checkfc -s $(PRIVATE_SEPOLICY) $@
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
built_svc := $(LOCAL_BUILT_MODULE)
Android.mk: drop polluting variables Some of the ALL_*_FILES variables remained that were used in a way that could not be cleared. Move them to lower case variants and use a build recipe PRIVATE_*_FILES variable. This avoids polluting the global namespace. Change-Id: I83748dab48141af7d3f10ad27fc9319eaf90b970 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-07-30 20:44:26 +02:00
all_svc_files :=
Android.mk: clean dependencies and clear variables Dependencies being built with newline files in between were also including the list of files without the newlines, thus make would have to process 3n-1 files instead of 2n-1 where n is the number of files to process. Additionally the *_with_nl variables were not being cleared out and polluting Make's global name-space. Change-Id: I76ea1a3dfae994b32991730aea7e4308da52a583 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-12-29 00:26:20 +01:00
all_svcfiles_with_nl :=
service_contexts: don't delete intermediate on failure When service_contexts fails to build, the file is deleted leaving only the error message for debugging. Build service_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ib9dcbf21d0a28700d500cf0ea4e412b009758d5d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 23:17:38 +02:00
service_contexts.tmp :=
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
Add mac_permissions.xml file. This was moved from external/mac-policy.git
2012-07-30 15:33:03 +02:00
##################################
include $(CLEAR_VARS)
Generate general versions of the other contexts files for tests. Generate general forms of the remaining *_contexts files with only the device-independent entries for use in CTS testing. Change-Id: I2bf0e41db8a73c26754cedd92cbc3783ff03d6b5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 22:45:03 +01:00
LOCAL_MODULE := general_service_contexts
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := tests
include $(BUILD_SYSTEM)/base_rules.mk
service_contexts: don't delete intermediate on failure When service_contexts fails to build, the file is deleted leaving only the error message for debugging. Build service_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ib9dcbf21d0a28700d500cf0ea4e412b009758d5d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 23:17:38 +02:00
general_service_contexts.tmp := $(intermediates)/general_service_contexts.tmp
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
$(general_service_contexts.tmp): $(addprefix $(PLAT_PRIVATE_POLICY)/, service_contexts)
service_contexts: don't delete intermediate on failure When service_contexts fails to build, the file is deleted leaving only the error message for debugging. Build service_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ib9c9247d36e6a6406b4df84d10e982921c07d492 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 23:17:38 +02:00
@mkdir -p $(dir $@)
Revert "service_contexts: don't delete intermediate on failure" This reverts commit f6ee7a521942036ef7f5c0f6bc74520509934141. Change-Id: I4f1396e6e4aeecd1109f9c24494c6e82645c0663
2015-10-01 23:22:16 +02:00
$(hide) m4 -s $< > $@
service_contexts: don't delete intermediate on failure When service_contexts fails to build, the file is deleted leaving only the error message for debugging. Build service_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ib9c9247d36e6a6406b4df84d10e982921c07d492 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 23:17:38 +02:00
service_contexts: don't delete intermediate on failure When service_contexts fails to build, the file is deleted leaving only the error message for debugging. Build service_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ib9dcbf21d0a28700d500cf0ea4e412b009758d5d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 23:17:38 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_general_sepolicy)
$(LOCAL_BUILT_MODULE): $(general_service_contexts.tmp) $(built_general_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
@mkdir -p $(dir $@)
service_contexts: strip blank lines and comments Strip whitespace and comments from service_context files to reduce size. On an aosp_x86_64 build it saves 36 bytes. However, on builds with more synclines and comments, further space savings can be realized. Change-Id: I3cb4effad1d1b404bf53605a3793e3070cb95651 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-04-06 20:53:04 +02:00
sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
# TODO: fix with attributized types $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -s $(PRIVATE_SEPOLICY) $@
service_contexts: don't delete intermediate on failure When service_contexts fails to build, the file is deleted leaving only the error message for debugging. Build service_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ib9dcbf21d0a28700d500cf0ea4e412b009758d5d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 23:17:38 +02:00
general_service_contexts.tmp :=
Generate general versions of the other contexts files for tests. Generate general forms of the remaining *_contexts files with only the device-independent entries for use in CTS testing. Change-Id: I2bf0e41db8a73c26754cedd92cbc3783ff03d6b5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 22:45:03 +01:00
##################################
include $(CLEAR_VARS)
Expand insertkeys.py script to allow union of files. Allow script to union mac_permissions.xml files specified using the BOARD_SEPOLICY_DIRS and BOARD_SEPOLICY_UNION constructs. Change-Id: I4fc65fd1ab4c612f25e966f030247e54a270b614 Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2013-03-27 13:35:39 +01:00
LOCAL_MODULE := mac_permissions.xml
Add mac_permissions.xml file. This was moved from external/mac-policy.git
2012-07-30 15:33:03 +02:00
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_OUT_ETC)/security
Replaceable mac_permission.xml support Support overriding ma_permissions.xml in BOARD_SEPOLICY_REPLACE Change-Id: If0bca8bf29bc431a291b6d7b20de132e68cd6a79
2012-11-30 23:59:09 +01:00
include $(BUILD_SYSTEM)/base_rules.mk
Add mac_permissions.xml file. This was moved from external/mac-policy.git
2012-07-30 15:33:03 +02:00
Revert "Revert "Dynamic insertion of pubkey to mac_permissions.xml"" This reverts commit 1446e714af0b0c358b5ecf37c5d704c96c72cf7c Hidden dependency has been resolved. Change-Id: Ia535c0b9468ea5f705dff9813186a7fa8bab84ae
2013-03-26 19:19:12 +01:00
# Build keys.conf
mac_perms_keys.tmp := $(intermediates)/keys.tmp
Android.mk: Add support for BOARD_SEPOLICY_M4DEFS Allow device builders to pass arbitrary m4 definitions during the build via make variable BOARD_SEPOLICY_M4DEFS. This enables OEMs to define their own static policy build conditionals. Change-Id: Ibea1dbb7b8615576c5668e47f16ed0eedfa0b73c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-07-16 20:28:02 +02:00
$(mac_perms_keys.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
$(mac_perms_keys.tmp): $(call build_policy, keys.conf, $(PLAT_PRIVATE_POLICY) $(BOARD_SEPOLICY_DIRS))
Revert "Revert "Dynamic insertion of pubkey to mac_permissions.xml"" This reverts commit 1446e714af0b0c358b5ecf37c5d704c96c72cf7c Hidden dependency has been resolved. Change-Id: Ia535c0b9468ea5f705dff9813186a7fa8bab84ae
2013-03-26 19:19:12 +01:00
@mkdir -p $(dir $@)
Android.mk: Add support for BOARD_SEPOLICY_M4DEFS Allow device builders to pass arbitrary m4 definitions during the build via make variable BOARD_SEPOLICY_M4DEFS. This enables OEMs to define their own static policy build conditionals. Change-Id: Ibea1dbb7b8615576c5668e47f16ed0eedfa0b73c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-07-16 20:28:02 +02:00
$(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@
Revert "Revert "Dynamic insertion of pubkey to mac_permissions.xml"" This reverts commit 1446e714af0b0c358b5ecf37c5d704c96c72cf7c Hidden dependency has been resolved. Change-Id: Ia535c0b9468ea5f705dff9813186a7fa8bab84ae
2013-03-26 19:19:12 +01:00
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
all_mac_perms_files := $(call build_policy, $(LOCAL_MODULE), $(PLAT_PRIVATE_POLICY) $(BOARD_SEPOLICY_DIRS))
Add mac_permissions.xml file. This was moved from external/mac-policy.git
2012-07-30 15:33:03 +02:00
Add keys to prerequisites of mac_permissions.xml Bug: 27954979 Change-Id: Ia0403e2dc2726523a41742e23beff29b47274392
2016-05-13 09:04:58 +02:00
# Should be synced with keys.conf.
all_keys := platform media shared testkey
all_keys := $(all_keys:%=$(dir $(DEFAULT_SYSTEM_DEV_CERTIFICATE))/%.x509.pem)
Android.mk: drop polluting variables Some of the ALL_*_FILES variables remained that were used in a way that could not be cleared. Move them to lower case variants and use a build recipe PRIVATE_*_FILES variable. This avoids polluting the global namespace. Change-Id: I83748dab48141af7d3f10ad27fc9319eaf90b970 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-07-30 20:44:26 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_MAC_PERMS_FILES := $(all_mac_perms_files)
Add keys to prerequisites of mac_permissions.xml Bug: 27954979 Change-Id: Ia0403e2dc2726523a41742e23beff29b47274392
2016-05-13 09:04:58 +02:00
$(LOCAL_BUILT_MODULE): $(mac_perms_keys.tmp) $(HOST_OUT_EXECUTABLES)/insertkeys.py $(all_mac_perms_files) $(all_keys)
Revert "Revert "Dynamic insertion of pubkey to mac_permissions.xml"" This reverts commit 1446e714af0b0c358b5ecf37c5d704c96c72cf7c Hidden dependency has been resolved. Change-Id: Ia535c0b9468ea5f705dff9813186a7fa8bab84ae
2013-03-26 19:19:12 +01:00
@mkdir -p $(dir $@)
Make DEFAULT_SYSTEM_DEV_CERTIFICATE available in keys.conf In 9af6f1bd59ee2fb0622db8ff25c4806c5527a0b3, the -d option was dropped from insertkeys.py. This was done to allow an Android distribution to replace the default version of keys.conf distributed in external/sepolicy/keys.conf. keys.conf was modified to reference the publicly known test keys in build/target/product/security. Unfortunately, this broke Google's build of Android. Instead of incorporating our keys directory, we were using the default AOSP keys. As a result, apps were getting assigned to the wrong SELinux domain. (see "Steps to reproduce" below) This change continues to allow others to replace keys.conf, but makes DEFAULT_SYSTEM_DEV_CERTIFICATE available as an environment variable in case the customized version wants to make reference to it. This change also modifies the stock version of keys.conf to use DEFAULT_SYSTEM_DEV_CERTIFICATE, which should be appropriate for most Android distributions. It doesn't make any sense to force each OEM to have a copy of this file. Steps to reproduce. 1) Compile and boot Android. 2) Run the following command: "adb shell ps -Z | grep process.media" Expected: $ adb shell ps -Z | grep process.media u:r:media_app:s0 u0_a5 1332 202 android.process.media Actual: $ adb shell ps -Z | grep process.media u:r:untrusted_app:s0 u0_a5 3617 187 android.process.media Bug: 11327304 Change-Id: Ica24fb25c5f9c0e2f4d181718c757cf372467822
2013-10-25 21:25:36 +02:00
$(hide) DEFAULT_SYSTEM_DEV_CERTIFICATE="$(dir $(DEFAULT_SYSTEM_DEV_CERTIFICATE))" \
Android.mk: drop polluting variables Some of the ALL_*_FILES variables remained that were used in a way that could not be cleared. Move them to lower case variants and use a build recipe PRIVATE_*_FILES variable. This avoids polluting the global namespace. Change-Id: I83748dab48141af7d3f10ad27fc9319eaf90b970 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-07-30 20:44:26 +02:00
$(HOST_OUT_EXECUTABLES)/insertkeys.py -t $(TARGET_BUILD_VARIANT) -c $(TOP) $< -o $@ $(PRIVATE_MAC_PERMS_FILES)
Revert "Revert "Dynamic insertion of pubkey to mac_permissions.xml"" This reverts commit 1446e714af0b0c358b5ecf37c5d704c96c72cf7c Hidden dependency has been resolved. Change-Id: Ia535c0b9468ea5f705dff9813186a7fa8bab84ae
2013-03-26 19:19:12 +01:00
Expand insertkeys.py script to allow union of files. Allow script to union mac_permissions.xml files specified using the BOARD_SEPOLICY_DIRS and BOARD_SEPOLICY_UNION constructs. Change-Id: I4fc65fd1ab4c612f25e966f030247e54a270b614 Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2013-03-27 13:35:39 +01:00
mac_perms_keys.tmp :=
Android.mk: drop polluting variables Some of the ALL_*_FILES variables remained that were used in a way that could not be cleared. Move them to lower case variants and use a build recipe PRIVATE_*_FILES variable. This avoids polluting the global namespace. Change-Id: I83748dab48141af7d3f10ad27fc9319eaf90b970 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-07-30 20:44:26 +02:00
all_mac_perms_files :=
Add selinux network script to policy Signed-off-by: Joshua Brindle <jbrindle@tresys.com>
2012-06-20 17:58:01 +02:00
##################################
Build the selinux_version file. The selinux_version file is used to perform policy versioning checks by libselinux and SELinuxMMAC. When loading policy a check is first performed to determine if the policy out in /data/security/current should be used to override the base policy shipped with the device. The selinux_version file is used to make that choice. The contents of the file simply contains the BUILD_FINGERPRINT that the policy was built against. A simple string comparison is then performed by libselinux and SELinuxMMAC. Change-Id: I69d9d071743cfd46bb247c98f94a193396f8ebbd Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-03-20 14:35:08 +01:00
include $(CLEAR_VARS)
LOCAL_MODULE := selinux_version
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
include $(BUILD_SYSTEM)/base_rules.mk
correct colon usage on make targets Change-Id: If944d8bd1e324f6500920ee3c5d44611ec7f8af9 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-27 16:22:34 +02:00
$(LOCAL_BUILT_MODULE): $(built_sepolicy) $(built_pc) $(built_fc) $(built_sc) $(built_svc)
Build the selinux_version file. The selinux_version file is used to perform policy versioning checks by libselinux and SELinuxMMAC. When loading policy a check is first performed to determine if the policy out in /data/security/current should be used to override the base policy shipped with the device. The selinux_version file is used to make that choice. The contents of the file simply contains the BUILD_FINGERPRINT that the policy was built against. A simple string comparison is then performed by libselinux and SELinuxMMAC. Change-Id: I69d9d071743cfd46bb247c98f94a193396f8ebbd Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-03-20 14:35:08 +01:00
@mkdir -p $(dir $@)
Use build fingerprint from file Improve incremental ninja builds by keeping the command line the same across builds. Change-Id: Iedbaa40c9f816f91afc8f073a9ed7f9ffd5d9a53
2015-07-17 22:08:41 +02:00
$(hide) echo -n $(BUILD_FINGERPRINT_FROM_FILE) > $@
Build the selinux_version file. The selinux_version file is used to perform policy versioning checks by libselinux and SELinuxMMAC. When loading policy a check is first performed to determine if the policy out in /data/security/current should be used to override the base policy shipped with the device. The selinux_version file is used to make that choice. The contents of the file simply contains the BUILD_FINGERPRINT that the policy was built against. A simple string comparison is then performed by libselinux and SELinuxMMAC. Change-Id: I69d9d071743cfd46bb247c98f94a193396f8ebbd Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-03-20 14:35:08 +01:00
##################################
Add better per-device sepolicy support. This is a rewrite of the existing implementation. Three new variables are now needed to add/modify the exisitng base policy. They are, BOARD_SEPOLICY_REPLACE and BOARD_SEPOLICY_UNION which govern what files are replaced and concatenated, and BOARD_SEPOLICY_DIRS which lists the various directories that will contain the BOARD_SEPOLICY_REPLACE and BOARD_SEPOLICY_UNION policy files. Change-Id: Id33381268cef03245c56bc5242fec7da9b6c6493 Signed-off-by: rpcraig <robertpcraig@gmail.com>
2012-10-18 03:09:52 +02:00
build_policy :=
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: I3775eae11bfa5905cad0d02a0bf26c76ac03437c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
build_device_policy :=
Generate selinux_policy.xml as part of CTS build. Bug: 16563899 Bug: 14251916 Change-Id: Id3172b73f10186ba361caf6b7333e5d2a0648475
2014-07-26 04:11:52 +02:00
sepolicy_build_files :=
Build the selinux_version file. The selinux_version file is used to perform policy versioning checks by libselinux and SELinuxMMAC. When loading policy a check is first performed to determine if the policy out in /data/security/current should be used to override the base policy shipped with the device. The selinux_version file is used to make that choice. The contents of the file simply contains the BUILD_FINGERPRINT that the policy was built against. A simple string comparison is then performed by libselinux and SELinuxMMAC. Change-Id: I69d9d071743cfd46bb247c98f94a193396f8ebbd Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-03-20 14:35:08 +01:00
built_sepolicy :=
Android.mk: cleanse all set but not unset variables Discovered by diffing the set of "set variables" with the set of "cleared variables". Script: mydir=$(mktemp -d) grep -E '(^[a-z].)[a-z0-9_\.]*\s*:?=.' Android.mk | cut -d' ' -f 1-1 | sort | uniq > $mydir/set_vars grep -E '(^[a-z].)[a-z0-9_\.]*\s*:?=$' Android.mk | cut -d' ' -f1-1 | sort | uniq > $mydir/unset_vars diff $mydir/set_vars $mydir/unset_vars rm -rf $mydir Change-Id: Ib50abac6b417a1bcc1894d9a7bafdbdca371006a Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-12-29 01:19:54 +01:00
built_sepolicy_recovery :=
Build the selinux_version file. The selinux_version file is used to perform policy versioning checks by libselinux and SELinuxMMAC. When loading policy a check is first performed to determine if the policy out in /data/security/current should be used to override the base policy shipped with the device. The selinux_version file is used to make that choice. The contents of the file simply contains the BUILD_FINGERPRINT that the policy was built against. A simple string comparison is then performed by libselinux and SELinuxMMAC. Change-Id: I69d9d071743cfd46bb247c98f94a193396f8ebbd Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-03-20 14:35:08 +01:00
built_sc :=
built_fc :=
built_pc :=
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
built_svc :=
use a general sepolicy when building general targets Change-Id: Ie800ebf9d8e68680ec377e8c51f7cd7717f3c755 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-30 01:31:23 +02:00
built_general_sepolicy :=
built_general_sepolicy.conf :=
Ensure newlines are added between context config files When multiple file_contexts, service_contexts and property_contexts are processed by the m4(1) macro processor, they will fail if one or more of the intermediate files final line is not terminated by a newline. This patch adds an intervening file only containing a newline. Change-Id: Ie66b32fe477d08c69e6d6eb1725f658adc384ce4 Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-12-11 11:39:19 +01:00
built_nl :=
Android.mk: cleanse all set but not unset variables Discovered by diffing the set of "set variables" with the set of "cleared variables". Script: mydir=$(mktemp -d) grep -E '(^[a-z].)[a-z0-9_\.]*\s*:?=.' Android.mk | cut -d' ' -f 1-1 | sort | uniq > $mydir/set_vars grep -E '(^[a-z].)[a-z0-9_\.]*\s*:?=$' Android.mk | cut -d' ' -f1-1 | sort | uniq > $mydir/unset_vars diff $mydir/set_vars $mydir/unset_vars rm -rf $mydir Change-Id: Ib50abac6b417a1bcc1894d9a7bafdbdca371006a Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-12-29 01:19:54 +01:00
add_nl :=
Moved Android policy tools to tools directory Change-Id: I57b0dd9f8071eae492020f410c87f465ba820711
2012-11-01 19:33:04 +01:00
include $(call all-makefiles-under,$(LOCAL_PATH))
Reference in a new issue Copy permalink