2012-01-04 18:33:27 +01:00
|
|
|
LOCAL_PATH:= $(call my-dir)
|
2012-08-28 00:41:15 +02:00
|
|
|
|
2017-07-07 23:59:51 +02:00
|
|
|
include $(LOCAL_PATH)/definitions.mk
|
2019-02-15 21:18:15 +01:00
|
|
|
include $(LOCAL_PATH)/policy_version.mk
|
2017-07-07 23:59:51 +02:00
|
|
|
|
2017-03-23 00:20:24 +01:00
|
|
|
include $(CLEAR_VARS)
|
2012-01-04 18:33:27 +01:00
|
|
|
|
|
|
|
|
MLS_SENS=1
|
|
|
|
|
MLS_CATS=1024
|
|
|
|
|
|
2015-04-01 16:14:56 +02:00
|
|
|
ifdef BOARD_SEPOLICY_UNION
|
|
|
|
|
$(warning BOARD_SEPOLICY_UNION is no longer required - all files found in BOARD_SEPOLICY_DIRS are implicitly unioned; please remove from your BoardConfig.mk or other .mk file.)
|
|
|
|
|
endif
|
|
|
|
|
|
2015-07-16 20:28:02 +02:00
|
|
|
ifdef BOARD_SEPOLICY_M4DEFS
|
|
|
|
|
LOCAL_ADDITIONAL_M4DEFS := $(addprefix -D, $(BOARD_SEPOLICY_M4DEFS))
|
2017-07-07 23:59:51 +02:00
|
|
|
else
|
|
|
|
|
LOCAL_ADDITIONAL_M4DEFS :=
|
2015-07-16 20:28:02 +02:00
|
|
|
endif
|
|
|
|
|
|
2016-07-22 22:13:11 +02:00
|
|
|
# sepolicy is now divided into multiple portions:
|
|
|
|
|
# public - policy exported on which non-platform policy developers may write
|
|
|
|
|
# additional policy. types and attributes are versioned and included in
|
|
|
|
|
# delivered non-platform policy, which is to be combined with platform policy.
|
|
|
|
|
# private - platform-only policy required for platform functionality but which
|
|
|
|
|
# is not exported to vendor policy developers and as such may not be assumed
|
|
|
|
|
# to exist.
|
2017-01-31 03:44:59 +01:00
|
|
|
# vendor - vendor-only policy required for vendor functionality. This policy can
|
|
|
|
|
# reference the public policy but cannot reference the private policy. This
|
|
|
|
|
# policy is for components which are produced from the core/non-vendor tree and
|
|
|
|
|
# placed into a vendor partition.
|
2016-12-07 20:27:47 +01:00
|
|
|
# mapping - This contains policy statements which map the attributes
|
2016-07-22 22:13:11 +02:00
|
|
|
# exposed in the public policy of previous versions to the concrete types used
|
|
|
|
|
# in this policy to ensure that policy targeting attributes from public
|
|
|
|
|
# policy from an older platform version continues to work.
|
|
|
|
|
|
2016-10-12 23:58:09 +02:00
|
|
|
# build process for device:
|
2016-07-22 22:13:11 +02:00
|
|
|
# 1) convert policies to CIL:
|
|
|
|
|
# - private + public platform policy to CIL
|
|
|
|
|
# - mapping file to CIL (should already be in CIL form)
|
|
|
|
|
# - non-platform public policy to CIL
|
|
|
|
|
# - non-platform public + private policy to CIL
|
|
|
|
|
# 2) attributize policy
|
|
|
|
|
# - run script which takes non-platform public and non-platform combined
|
|
|
|
|
# private + public policy and produces attributized and versioned
|
|
|
|
|
# non-platform policy
|
|
|
|
|
# 3) combine policy files
|
|
|
|
|
# - combine mapping, platform and non-platform policy.
|
|
|
|
|
# - compile output binary policy file
|
|
|
|
|
|
|
|
|
|
PLAT_PUBLIC_POLICY := $(LOCAL_PATH)/public
|
|
|
|
|
PLAT_PRIVATE_POLICY := $(LOCAL_PATH)/private
|
2017-01-31 03:44:59 +01:00
|
|
|
PLAT_VENDOR_POLICY := $(LOCAL_PATH)/vendor
|
2016-10-12 23:58:09 +02:00
|
|
|
REQD_MASK_POLICY := $(LOCAL_PATH)/reqd_mask
|
2020-07-14 21:28:51 +02:00
|
|
|
|
|
|
|
|
SYSTEM_EXT_PUBLIC_POLICY := $(SYSTEM_EXT_PUBLIC_SEPOLICY_DIRS)
|
|
|
|
|
ifneq (,$(BOARD_PLAT_PUBLIC_SEPOLICY_DIR))
|
2020-10-28 06:01:17 +01:00
|
|
|
# TODO: Disallow BOARD_PLAT_*
|
2020-07-14 21:28:51 +02:00
|
|
|
SYSTEM_EXT_PUBLIC_POLICY += $(BOARD_PLAT_PUBLIC_SEPOLICY_DIR)
|
|
|
|
|
endif
|
|
|
|
|
SYSTEM_EXT_PRIVATE_POLICY := $(SYSTEM_EXT_PRIVATE_SEPOLICY_DIRS)
|
|
|
|
|
ifneq (,$(BOARD_PLAT_PRIVATE_SEPOLICY_DIR))
|
2020-10-28 06:01:17 +01:00
|
|
|
# TODO: Disallow BOARD_PLAT_*
|
2020-07-14 21:28:51 +02:00
|
|
|
SYSTEM_EXT_PRIVATE_POLICY += $(BOARD_PLAT_PRIVATE_SEPOLICY_DIR)
|
|
|
|
|
endif
|
|
|
|
|
|
2019-02-01 20:41:08 +01:00
|
|
|
PRODUCT_PUBLIC_POLICY := $(PRODUCT_PUBLIC_SEPOLICY_DIRS)
|
|
|
|
|
PRODUCT_PRIVATE_POLICY := $(PRODUCT_PRIVATE_SEPOLICY_DIRS)
|
2018-12-14 23:30:56 +01:00
|
|
|
|
2019-08-29 11:12:11 +02:00
|
|
|
ifneq (,$(SYSTEM_EXT_PUBLIC_POLICY)$(SYSTEM_EXT_PRIVATE_POLICY))
|
Allowing system_ext sepolicy to be empty
Some targets just need to extend system_ext context files, e.g.,
file_contexts, service_contexts, etc., without adding any system_ext
policy files, e.g., *.te files.
Currently, this will lead to build errors. This CL allows
system_ext_sepolicy.cil and the system_ext mapping file
to be empty.
It's now also possible to just set BOARD_PLAT_PRIVATE_SEPOLICY_DIR
without setting BOARD_PLAT_PUBLIC_SEPOLICY_DIR.
Bug: 137712473
Bug: 141880898
Test: Only adds system_ext context files without policy files (e.g., *.te),
then `mmma system/sepolicy` can build pass
Change-Id: I72849f2d4aa43e5296cd15c07a8fd058186a6376
2019-10-04 08:34:18 +02:00
|
|
|
HAS_SYSTEM_EXT_SEPOLICY_DIR := true
|
2019-08-29 11:12:11 +02:00
|
|
|
endif
|
|
|
|
|
|
2018-12-14 23:30:56 +01:00
|
|
|
# TODO(b/119305624): Currently if the device doesn't have a product partition,
|
|
|
|
|
# we install product sepolicy into /system/product. We do that because bits of
|
|
|
|
|
# product sepolicy that's still in /system might depend on bits that have moved
|
|
|
|
|
# to /product. Once we finish migrating product sepolicy out of system, change
|
|
|
|
|
# it so that if no product partition is present, product sepolicy artifacts are
|
|
|
|
|
# not built and installed at all.
|
|
|
|
|
ifneq (,$(PRODUCT_PUBLIC_POLICY)$(PRODUCT_PRIVATE_POLICY))
|
2019-10-04 09:36:05 +02:00
|
|
|
HAS_PRODUCT_SEPOLICY_DIR := true
|
2018-12-14 23:30:56 +01:00
|
|
|
endif
|
2016-10-12 23:58:09 +02:00
|
|
|
|
|
|
|
|
# TODO: move to README when doing the README update and finalizing versioning.
|
2017-04-07 23:18:48 +02:00
|
|
|
# BOARD_SEPOLICY_VERS must take the format "NN.m" and contain the sepolicy
|
|
|
|
|
# version identifier corresponding to the sepolicy on which the non-platform
|
|
|
|
|
# policy is to be based. If unspecified, this will build against the current
|
|
|
|
|
# public platform policy in tree
|
2016-10-12 23:58:09 +02:00
|
|
|
ifndef BOARD_SEPOLICY_VERS
|
2017-04-07 23:18:48 +02:00
|
|
|
# The default platform policy version.
|
2017-04-08 01:36:23 +02:00
|
|
|
BOARD_SEPOLICY_VERS := $(PLATFORM_SEPOLICY_VERSION)
|
2016-10-12 23:58:09 +02:00
|
|
|
endif
|
2016-07-22 22:13:11 +02:00
|
|
|
|
2020-11-09 12:58:58 +01:00
|
|
|
# If BOARD_SEPOLICY_VERS is set to a value other than PLATFORM_SEPOLICY_VERSION,
|
|
|
|
|
# policy files of platform (system, system_ext, product) can't be mixed with
|
|
|
|
|
# policy files of vendor (vendor, odm). If it's the case, platform policies and
|
|
|
|
|
# vendor policies are separately built. More specifically,
|
|
|
|
|
#
|
|
|
|
|
# - Platform policy files needed to build vendor policies, such as plat_policy,
|
|
|
|
|
# plat_mapping_cil, plat_pub_policy, reqd_policy_mask, are built from the
|
|
|
|
|
# prebuilts (copy of platform policy files of version BOARD_SEPOLICY_VERS).
|
|
|
|
|
#
|
|
|
|
|
# - sepolicy_neverallows only checks platform policies, and a new module
|
|
|
|
|
# sepolicy_neverallows_vendor checks vendor policies.
|
|
|
|
|
#
|
|
|
|
|
# - neverallow checks are turned off while compiling precompiled_sepolicy module
|
|
|
|
|
# and sepolicy module.
|
|
|
|
|
#
|
|
|
|
|
# - Vendor policies are not checked on the compat test (compat.mk).
|
|
|
|
|
#
|
|
|
|
|
# In such scenario, we can grab platform policy files from the prebuilts/api
|
|
|
|
|
# directory. But we need more than that: prebuilts of system_ext, product,
|
|
|
|
|
# system/sepolicy/reqd_mask, and system/sepolicy/vendor. The following variables
|
|
|
|
|
# are introduced to specify such prebuilts.
|
|
|
|
|
#
|
|
|
|
|
# - BOARD_REQD_MASK_POLICY (prebuilt of system/sepolicy/reqd_mask)
|
|
|
|
|
# - BOARD_PLAT_VENDOR_POLICY (prebuilt of system/sepolicy/vendor)
|
|
|
|
|
# - BOARD_SYSTEM_EXT_PUBLIC_PREBUILT_DIRS (prebuilt of system_ext public)
|
|
|
|
|
# - BOARD_SYSTEM_EXT_PRIVATE_PREBUILT_DIRS (prebuilt of system_ext private)
|
|
|
|
|
# - BOARD_PRODUCT_PUBLIC_PREBUILT_DIRS (prebuilt of product public)
|
|
|
|
|
# - BOARD_PRODUCT_PRIVATE_PREBUILT_DIRS (prebuilt of product private)
|
|
|
|
|
#
|
|
|
|
|
# Vendors are responsible for copying policy files from the old version of the
|
|
|
|
|
# source tree as prebuilts, and for setting BOARD_*_POLICY variables so they can
|
|
|
|
|
# be used to build vendor policies. See prebuilt_policy.mk for more details.
|
|
|
|
|
#
|
|
|
|
|
# To support both mixed build and normal build, platform policy files are
|
|
|
|
|
# indirectly referred by {partition}_{public|private}_policy_$(ver) variables
|
|
|
|
|
# when building vendor policies. See vendor_sepolicy.cil and odm_sepolicy.cil
|
|
|
|
|
# for more details.
|
|
|
|
|
#
|
|
|
|
|
# sepolicy.recovery is also compiled from vendor and plat prebuilt policies.
|
|
|
|
|
ifneq ($(PLATFORM_SEPOLICY_VERSION),$(BOARD_SEPOLICY_VERS))
|
|
|
|
|
mixed_sepolicy_build := true
|
|
|
|
|
else
|
|
|
|
|
mixed_sepolicy_build :=
|
|
|
|
|
endif
|
|
|
|
|
|
2018-01-04 01:53:24 +01:00
|
|
|
NEVERALLOW_ARG :=
|
|
|
|
|
ifeq ($(SELINUX_IGNORE_NEVERALLOWS),true)
|
|
|
|
|
ifeq ($(TARGET_BUILD_VARIANT),user)
|
|
|
|
|
$(error SELINUX_IGNORE_NEVERALLOWS := true cannot be used in user builds)
|
|
|
|
|
endif
|
|
|
|
|
$(warning Be careful when using the SELINUX_IGNORE_NEVERALLOWS flag. \
|
|
|
|
|
It does not work in user builds and using it will \
|
|
|
|
|
not stop you from failing CTS.)
|
|
|
|
|
NEVERALLOW_ARG := -N
|
|
|
|
|
endif
|
|
|
|
|
|
2017-11-27 04:41:33 +01:00
|
|
|
# BOARD_SEPOLICY_DIRS was used for vendor/odm sepolicy customization before.
|
|
|
|
|
# It has been replaced by BOARD_VENDOR_SEPOLICY_DIRS (mandatory) and
|
|
|
|
|
# BOARD_ODM_SEPOLICY_DIRS (optional). BOARD_SEPOLICY_DIRS is still allowed for
|
|
|
|
|
# backward compatibility, which will be merged into BOARD_VENDOR_SEPOLICY_DIRS.
|
2018-02-05 10:34:52 +01:00
|
|
|
ifdef BOARD_SEPOLICY_DIRS
|
|
|
|
|
BOARD_VENDOR_SEPOLICY_DIRS += $(BOARD_SEPOLICY_DIRS)
|
|
|
|
|
endif
|
2017-04-12 23:28:34 +02:00
|
|
|
|
2020-11-09 12:58:58 +01:00
|
|
|
# Set default values for these prebuilt directories
|
|
|
|
|
ifeq (,$(BOARD_REQD_MASK_POLICY))
|
|
|
|
|
BOARD_REQD_MASK_POLICY := $(REQD_MASK_POLICY)
|
|
|
|
|
endif
|
|
|
|
|
|
|
|
|
|
ifeq (,$(BOARD_PLAT_VENDOR_POLICY))
|
|
|
|
|
BOARD_PLAT_VENDOR_POLICY := $(PLAT_VENDOR_POLICY)
|
|
|
|
|
endif
|
|
|
|
|
|
|
|
|
|
$(foreach p,SYSTEM_EXT PRODUCT,$(foreach q,PUBLIC PRIVATE,$(eval \
|
|
|
|
|
$(if $(BOARD_$(p)_$(q)_PREBUILT_DIRS),,\
|
|
|
|
|
BOARD_$(p)_$(q)_PREBUILT_DIRS := $($(p)_$(q)_POLICY) \
|
|
|
|
|
) \
|
|
|
|
|
)))
|
|
|
|
|
|
2017-11-27 04:41:33 +01:00
|
|
|
ifdef BOARD_ODM_SEPOLICY_DIRS
|
|
|
|
|
ifneq ($(PRODUCT_SEPOLICY_SPLIT),true)
|
|
|
|
|
$(error PRODUCT_SEPOLICY_SPLIT needs to be true when using BOARD_ODM_SEPOLICY_DIRS)
|
|
|
|
|
endif
|
|
|
|
|
endif
|
|
|
|
|
|
2016-07-22 22:13:11 +02:00
|
|
|
###########################################################
|
|
|
|
|
# Compute policy files to be used in policy build.
|
|
|
|
|
# $(1): files to include
|
|
|
|
|
# $(2): directories in which to find files
|
|
|
|
|
###########################################################
|
|
|
|
|
|
|
|
|
|
define build_policy
|
2021-10-01 00:48:34 +02:00
|
|
|
$(strip $(foreach type, $(1), $(foreach file, $(addsuffix /$(type), $(2)), $(sort $(wildcard $(file))))))
|
2016-07-22 22:13:11 +02:00
|
|
|
endef
|
2016-01-04 21:20:57 +01:00
|
|
|
|
2018-02-05 10:34:52 +01:00
|
|
|
# Builds paths for all policy files found in BOARD_VENDOR_SEPOLICY_DIRS.
|
2016-01-04 21:20:57 +01:00
|
|
|
# $(1): the set of policy name paths to build
|
2018-02-05 10:34:52 +01:00
|
|
|
build_vendor_policy = $(call build_policy, $(1), $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS))
|
2016-01-04 21:20:57 +01:00
|
|
|
|
2017-11-29 09:14:53 +01:00
|
|
|
# Builds paths for all policy files found in BOARD_ODM_SEPOLICY_DIRS.
|
|
|
|
|
build_odm_policy = $(call build_policy, $(1), $(BOARD_ODM_SEPOLICY_DIRS))
|
|
|
|
|
|
2014-07-26 04:11:52 +02:00
|
|
|
sepolicy_build_files := security_classes \
|
|
|
|
|
initial_sids \
|
|
|
|
|
access_vectors \
|
|
|
|
|
global_macros \
|
2014-11-06 00:30:41 +01:00
|
|
|
neverallow_macros \
|
2014-07-26 04:11:52 +02:00
|
|
|
mls_macros \
|
2016-10-12 23:58:09 +02:00
|
|
|
mls_decl \
|
2014-07-26 04:11:52 +02:00
|
|
|
mls \
|
|
|
|
|
policy_capabilities \
|
|
|
|
|
te_macros \
|
|
|
|
|
attributes \
|
2015-12-22 19:39:34 +01:00
|
|
|
ioctl_defines \
|
2015-06-06 00:28:55 +02:00
|
|
|
ioctl_macros \
|
2014-07-26 04:11:52 +02:00
|
|
|
*.te \
|
2016-10-12 23:58:09 +02:00
|
|
|
roles_decl \
|
2014-07-26 04:11:52 +02:00
|
|
|
roles \
|
|
|
|
|
users \
|
|
|
|
|
initial_sid_contexts \
|
|
|
|
|
fs_use \
|
|
|
|
|
genfs_contexts \
|
|
|
|
|
port_contexts
|
|
|
|
|
|
2020-09-22 00:32:16 +02:00
|
|
|
sepolicy_compat_files := $(foreach ver, $(PLATFORM_SEPOLICY_COMPAT_VERSIONS), \
|
|
|
|
|
$(addprefix compat/$(ver)/, $(addsuffix .cil, $(ver))))
|
|
|
|
|
|
2019-10-08 01:31:40 +02:00
|
|
|
# Security classes and permissions defined outside of system/sepolicy.
|
|
|
|
|
security_class_extension_files := $(call build_policy, security_classes access_vectors, \
|
|
|
|
|
$(SYSTEM_EXT_PUBLIC_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY) \
|
|
|
|
|
$(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY) \
|
|
|
|
|
$(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_ODM_SEPOLICY_DIRS))
|
|
|
|
|
|
|
|
|
|
ifneq (,$(strip $(security_class_extension_files)))
|
|
|
|
|
$(error Only platform SELinux policy may define classes and permissions: $(strip $(security_class_extension_files)))
|
|
|
|
|
endif
|
|
|
|
|
|
Allowing system_ext sepolicy to be empty
Some targets just need to extend system_ext context files, e.g.,
file_contexts, service_contexts, etc., without adding any system_ext
policy files, e.g., *.te files.
Currently, this will lead to build errors. This CL allows
system_ext_sepolicy.cil and the system_ext mapping file
to be empty.
It's now also possible to just set BOARD_PLAT_PRIVATE_SEPOLICY_DIR
without setting BOARD_PLAT_PUBLIC_SEPOLICY_DIR.
Bug: 137712473
Bug: 141880898
Test: Only adds system_ext context files without policy files (e.g., *.te),
then `mmma system/sepolicy` can build pass
Change-Id: I72849f2d4aa43e5296cd15c07a8fd058186a6376
2019-10-04 08:34:18 +02:00
|
|
|
ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR
|
|
|
|
|
# Checks if there are public system_ext policy files.
|
|
|
|
|
policy_files := $(call build_policy, $(sepolicy_build_files), $(SYSTEM_EXT_PUBLIC_POLICY))
|
|
|
|
|
ifneq (,$(strip $(policy_files)))
|
|
|
|
|
HAS_SYSTEM_EXT_PUBLIC_SEPOLICY := true
|
|
|
|
|
endif
|
|
|
|
|
# Checks if there are public/private system_ext policy files.
|
|
|
|
|
policy_files := $(call build_policy, $(sepolicy_build_files), $(SYSTEM_EXT_PUBLIC_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY))
|
|
|
|
|
ifneq (,$(strip $(policy_files)))
|
|
|
|
|
HAS_SYSTEM_EXT_SEPOLICY := true
|
|
|
|
|
endif
|
|
|
|
|
endif # ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR
|
|
|
|
|
|
2019-10-04 09:36:05 +02:00
|
|
|
ifdef HAS_PRODUCT_SEPOLICY_DIR
|
|
|
|
|
# Checks if there are public product policy files.
|
|
|
|
|
policy_files := $(call build_policy, $(sepolicy_build_files), $(PRODUCT_PUBLIC_POLICY))
|
|
|
|
|
ifneq (,$(strip $(policy_files)))
|
|
|
|
|
HAS_PRODUCT_PUBLIC_SEPOLICY := true
|
|
|
|
|
endif
|
|
|
|
|
# Checks if there are public/private product policy files.
|
|
|
|
|
policy_files := $(call build_policy, $(sepolicy_build_files), $(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY))
|
|
|
|
|
ifneq (,$(strip $(policy_files)))
|
|
|
|
|
HAS_PRODUCT_SEPOLICY := true
|
|
|
|
|
endif
|
|
|
|
|
endif # ifdef HAS_PRODUCT_SEPOLICY_DIR
|
|
|
|
|
|
Mark all clients of Allocator HAL
This change associates all domains which are clients of Allocator HAL
with hal_allocator_client and the, required for all HAL client
domains, halclientdomain.
This enables this commit to remove the now unnecessary hwallocator_use
macro because its binder_call(..., hal_allocator_server) is covered by
binder_call(hal_allocator_client, hal_allocator_server) added in this
commit.
Unfortunately apps, except isolated app, are clients of Allocator HAL
as well. This makes it hard to use the hal_client_domain(...,
hal_allocator) macro because it translates into "typeattribute" which
currently does not support being provided with a set of types, such as
{ appdomain -isolated_app }. As a workaround, hopefully until
typeattribute is improved, this commit expresses the necessary
association operation in CIL. private/technical_debt.cil introduced by
this commit is appended into the platform policy CIL file, thus
ensuring that the hack has effect on the final monolithic policy.
P. S. This change also removes Allocator HAL access from isolated_app.
Isolated app shouldn't have access to this HAL anyway.
Test: Google Play Music plays back radios
Test: Google Camera records video with sound and that video is then
successfully played back with sound
Test: YouTube app plays back clips with sound
Test: YouTube in Chrome plays back clips with sound
Bug: 34170079
Change-Id: Id00bba6fde83e7cf04fb58bc1c353c2f66333f92
2017-03-21 22:28:53 +01:00
|
|
|
# CIL files which contain workarounds for current limitation of human-readable
|
|
|
|
|
# module policy language. These files are appended to the CIL files produced
|
|
|
|
|
# from module language files.
|
|
|
|
|
sepolicy_build_cil_workaround_files := technical_debt.cil
|
|
|
|
|
|
2016-12-16 00:28:44 +01:00
|
|
|
my_target_arch := $(TARGET_ARCH)
|
|
|
|
|
ifneq (,$(filter mips mips64,$(TARGET_ARCH)))
|
|
|
|
|
my_target_arch := mips
|
|
|
|
|
endif
|
|
|
|
|
|
2017-03-15 21:37:35 +01:00
|
|
|
intermediates := $(TARGET_OUT_INTERMEDIATES)/ETC/sepolicy_intermediates
|
|
|
|
|
|
2017-03-13 20:22:15 +01:00
|
|
|
with_asan := false
|
|
|
|
|
ifneq (,$(filter address,$(SANITIZE_TARGET)))
|
|
|
|
|
with_asan := true
|
|
|
|
|
endif
|
|
|
|
|
|
2019-06-14 00:05:15 +02:00
|
|
|
with_native_coverage := false
|
|
|
|
|
ifeq ($(NATIVE_COVERAGE),true)
|
|
|
|
|
with_native_coverage := true
|
|
|
|
|
endif
|
2019-12-10 01:37:59 +01:00
|
|
|
ifeq ($(CLANG_COVERAGE),true)
|
|
|
|
|
with_native_coverage := true
|
|
|
|
|
endif
|
2019-06-14 00:05:15 +02:00
|
|
|
|
2019-09-26 08:14:55 +02:00
|
|
|
treble_sysprop_neverallow := true
|
|
|
|
|
ifeq ($(BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW),true)
|
|
|
|
|
treble_sysprop_neverallow := false
|
|
|
|
|
endif
|
|
|
|
|
|
|
|
|
|
ifeq ($(PRODUCT_SHIPPING_API_LEVEL),)
|
|
|
|
|
#$(warning no product shipping level defined)
|
|
|
|
|
else ifneq ($(call math_lt,29,$(PRODUCT_SHIPPING_API_LEVEL)),)
|
|
|
|
|
ifneq ($(BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW),)
|
|
|
|
|
$(error BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW cannot be set on a device shipping with R or later, and this is tested by CTS.)
|
|
|
|
|
endif
|
|
|
|
|
endif
|
|
|
|
|
|
2020-09-28 06:32:43 +02:00
|
|
|
enforce_sysprop_owner := true
|
|
|
|
|
ifeq ($(BUILD_BROKEN_ENFORCE_SYSPROP_OWNER),true)
|
|
|
|
|
enforce_sysprop_owner := false
|
|
|
|
|
endif
|
|
|
|
|
|
2021-04-27 01:32:17 +02:00
|
|
|
enforce_debugfs_restriction := false
|
|
|
|
|
ifeq ($(PRODUCT_SET_DEBUGFS_RESTRICTIONS),true)
|
|
|
|
|
enforce_debugfs_restriction := true
|
|
|
|
|
endif
|
|
|
|
|
|
2020-09-28 06:32:43 +02:00
|
|
|
ifeq ($(PRODUCT_SHIPPING_API_LEVEL),)
|
|
|
|
|
#$(warning no product shipping level defined)
|
|
|
|
|
else ifneq ($(call math_lt,30,$(PRODUCT_SHIPPING_API_LEVEL)),)
|
|
|
|
|
ifneq ($(BUILD_BROKEN_ENFORCE_SYSPROP_OWNER),)
|
|
|
|
|
$(error BUILD_BROKEN_ENFORCE_SYSPROP_OWNER cannot be set on a device shipping with S or later, and this is tested by CTS.)
|
|
|
|
|
endif
|
|
|
|
|
endif
|
|
|
|
|
|
2017-10-04 18:42:29 +02:00
|
|
|
# Library extension for host-side tests
|
2017-10-05 03:15:44 +02:00
|
|
|
ifeq ($(HOST_OS),darwin)
|
2017-10-04 18:42:29 +02:00
|
|
|
SHAREDLIB_EXT=dylib
|
|
|
|
|
else
|
|
|
|
|
SHAREDLIB_EXT=so
|
|
|
|
|
endif
|
|
|
|
|
|
2019-01-24 08:41:47 +01:00
|
|
|
# Convert a file_context file for a non-flattened APEX into a file for
|
|
|
|
|
# flattened APEX. /system/apex/<apex_name> path is prepended to the original paths
|
|
|
|
|
# $(1): path to the input file_contexts file for non-flattened APEX
|
2019-11-20 09:54:34 +01:00
|
|
|
# $(2): path to the flattened APEX
|
|
|
|
|
# $(3): path to the generated file_contexts file for flattened APEX
|
2019-01-24 08:41:47 +01:00
|
|
|
# $(4): variable where $(3) is added to
|
|
|
|
|
define build_flattened_apex_file_contexts
|
|
|
|
|
$(4) += $(3)
|
2019-11-20 09:54:34 +01:00
|
|
|
$(3): PRIVATE_APEX_PATH := $(subst .,\\.,$(2))
|
2019-01-24 08:41:47 +01:00
|
|
|
$(3): $(1)
|
|
|
|
|
$(hide) awk '/object_r/{printf("$$(PRIVATE_APEX_PATH)%s\n",$$$$0)}' $$< > $$@
|
|
|
|
|
endef
|
|
|
|
|
|
2018-07-02 15:31:29 +02:00
|
|
|
#################################
|
|
|
|
|
|
2017-04-10 21:27:18 +02:00
|
|
|
include $(CLEAR_VARS)
|
2018-07-02 15:31:29 +02:00
|
|
|
|
2017-04-10 21:27:18 +02:00
|
|
|
LOCAL_MODULE := selinux_policy
|
2021-02-04 08:07:40 +01:00
|
|
|
LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
|
|
|
|
|
LOCAL_LICENSE_CONDITIONS := notice unencumbered
|
|
|
|
|
LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
|
2017-04-10 21:27:18 +02:00
|
|
|
LOCAL_MODULE_TAGS := optional
|
2018-05-09 03:52:11 +02:00
|
|
|
LOCAL_REQUIRED_MODULES += \
|
2018-07-02 15:31:29 +02:00
|
|
|
selinux_policy_nonsystem \
|
|
|
|
|
selinux_policy_system \
|
2018-05-09 03:52:11 +02:00
|
|
|
|
2018-07-02 15:31:29 +02:00
|
|
|
include $(BUILD_PHONY_PACKAGE)
|
2018-05-09 03:52:11 +02:00
|
|
|
|
2019-05-29 18:05:43 +02:00
|
|
|
# selinux_policy is a main goal and triggers lots of tests.
|
|
|
|
|
# Most tests are FAKE modules, so aren'triggered on normal builds. (e.g. 'm')
|
|
|
|
|
# By setting as droidcore's dependency, tests will run on normal builds.
|
|
|
|
|
droidcore: selinux_policy
|
2018-05-09 03:52:11 +02:00
|
|
|
|
2018-07-02 15:31:29 +02:00
|
|
|
include $(CLEAR_VARS)
|
|
|
|
|
LOCAL_MODULE := selinux_policy_system
|
2021-02-04 08:07:40 +01:00
|
|
|
LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
|
|
|
|
|
LOCAL_LICENSE_CONDITIONS := notice unencumbered
|
|
|
|
|
LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
|
2018-05-09 03:52:11 +02:00
|
|
|
# These build targets are not used on non-Treble devices. However, we build these to avoid
|
|
|
|
|
# divergence between Treble and non-Treble devices.
|
2017-04-10 21:27:18 +02:00
|
|
|
LOCAL_REQUIRED_MODULES += \
|
2019-01-16 00:16:55 +01:00
|
|
|
plat_mapping_file \
|
2019-10-11 01:29:40 +02:00
|
|
|
$(addprefix plat_,$(addsuffix .cil,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS))) \
|
2019-05-02 22:48:44 +02:00
|
|
|
$(addsuffix .compat.cil,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS)) \
|
2017-04-10 21:27:18 +02:00
|
|
|
plat_sepolicy.cil \
|
|
|
|
|
secilc \
|
2017-09-26 21:58:29 +02:00
|
|
|
|
2020-11-09 12:58:58 +01:00
|
|
|
ifneq ($(PRODUCT_PRECOMPILED_SEPOLICY),false)
|
|
|
|
|
LOCAL_REQUIRED_MODULES += plat_sepolicy_and_mapping.sha256
|
|
|
|
|
endif
|
|
|
|
|
|
2017-06-08 22:24:15 +02:00
|
|
|
LOCAL_REQUIRED_MODULES += \
|
2018-02-05 10:41:02 +01:00
|
|
|
build_sepolicy \
|
2017-08-22 22:29:53 +02:00
|
|
|
plat_file_contexts \
|
Build contexts files with Soong
This is to migrate sepolicy Makefiles into Soong. For the first part,
file_contexts, hwservice_contexts, property_contexts, and
service_contexts are migrated. Build-time tests for contexts files are
still in Makefile; they will also be done with Soong after porting the
module sepolicy.
The motivation of migrating is based on generating property_contexts
dynamically: if we were to amend contexts files at build time in the
future, it would be nicer to manage them in Soong. To do that, building
contexts files with Soong can be very helpful.
Bug: 127949646
Bug: 129377144
Test: 1) Build blueline-userdebug, flash, and boot.
Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash,
and boot.
Test: 3) Build aosp_arm-userdebug.
Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
|
|
|
plat_file_contexts_test \
|
2020-07-25 22:02:29 +02:00
|
|
|
plat_keystore2_key_contexts \
|
2017-08-22 22:29:53 +02:00
|
|
|
plat_mac_permissions.xml \
|
|
|
|
|
plat_property_contexts \
|
Build contexts files with Soong
This is to migrate sepolicy Makefiles into Soong. For the first part,
file_contexts, hwservice_contexts, property_contexts, and
service_contexts are migrated. Build-time tests for contexts files are
still in Makefile; they will also be done with Soong after porting the
module sepolicy.
The motivation of migrating is based on generating property_contexts
dynamically: if we were to amend contexts files at build time in the
future, it would be nicer to manage them in Soong. To do that, building
contexts files with Soong can be very helpful.
Bug: 127949646
Bug: 129377144
Test: 1) Build blueline-userdebug, flash, and boot.
Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash,
and boot.
Test: 3) Build aosp_arm-userdebug.
Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
|
|
|
plat_property_contexts_test \
|
2017-08-22 22:29:53 +02:00
|
|
|
plat_seapp_contexts \
|
|
|
|
|
plat_service_contexts \
|
Build contexts files with Soong
This is to migrate sepolicy Makefiles into Soong. For the first part,
file_contexts, hwservice_contexts, property_contexts, and
service_contexts are migrated. Build-time tests for contexts files are
still in Makefile; they will also be done with Soong after porting the
module sepolicy.
The motivation of migrating is based on generating property_contexts
dynamically: if we were to amend contexts files at build time in the
future, it would be nicer to manage them in Soong. To do that, building
contexts files with Soong can be very helpful.
Bug: 127949646
Bug: 129377144
Test: 1) Build blueline-userdebug, flash, and boot.
Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash,
and boot.
Test: 3) Build aosp_arm-userdebug.
Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
|
|
|
plat_service_contexts_test \
|
2017-08-22 22:29:53 +02:00
|
|
|
plat_hwservice_contexts \
|
Build contexts files with Soong
This is to migrate sepolicy Makefiles into Soong. For the first part,
file_contexts, hwservice_contexts, property_contexts, and
service_contexts are migrated. Build-time tests for contexts files are
still in Makefile; they will also be done with Soong after porting the
module sepolicy.
The motivation of migrating is based on generating property_contexts
dynamically: if we were to amend contexts files at build time in the
future, it would be nicer to manage them in Soong. To do that, building
contexts files with Soong can be very helpful.
Bug: 127949646
Bug: 129377144
Test: 1) Build blueline-userdebug, flash, and boot.
Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash,
and boot.
Test: 3) Build aosp_arm-userdebug.
Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
|
|
|
plat_hwservice_contexts_test \
|
2017-09-26 21:58:29 +02:00
|
|
|
searchpolicy \
|
2018-07-02 15:31:29 +02:00
|
|
|
|
|
|
|
|
# This conditional inclusion closely mimics the conditional logic
|
|
|
|
|
# inside init/init.cpp for loading SELinux policy from files.
|
|
|
|
|
ifneq ($(PRODUCT_SEPOLICY_SPLIT),true)
|
|
|
|
|
# The following files are only allowed for non-Treble devices.
|
|
|
|
|
LOCAL_REQUIRED_MODULES += \
|
|
|
|
|
sepolicy \
|
|
|
|
|
vendor_service_contexts \
|
|
|
|
|
|
|
|
|
|
endif # ($(PRODUCT_SEPOLICY_SPLIT),true)
|
2017-06-08 22:24:15 +02:00
|
|
|
|
2017-09-26 21:58:29 +02:00
|
|
|
ifneq ($(with_asan),true)
|
2018-02-14 05:29:55 +01:00
|
|
|
ifneq ($(SELINUX_IGNORE_NEVERALLOWS),true)
|
2017-09-26 21:58:29 +02:00
|
|
|
LOCAL_REQUIRED_MODULES += \
|
|
|
|
|
sepolicy_tests \
|
2019-05-02 22:48:44 +02:00
|
|
|
$(addsuffix _compat_test,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS)) \
|
2017-09-26 21:58:29 +02:00
|
|
|
|
2019-09-20 20:16:29 +02:00
|
|
|
ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
|
|
|
|
|
LOCAL_REQUIRED_MODULES += \
|
|
|
|
|
$(addprefix treble_sepolicy_tests_,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS)) \
|
|
|
|
|
|
|
|
|
|
endif # PRODUCT_SEPOLICY_SPLIT
|
|
|
|
|
endif # SELINUX_IGNORE_NEVERALLOWS
|
|
|
|
|
endif # with_asan
|
2017-09-26 21:58:29 +02:00
|
|
|
|
2018-07-02 15:31:29 +02:00
|
|
|
ifneq ($(PLATFORM_SEPOLICY_VERSION),$(TOT_SEPOLICY_VERSION))
|
|
|
|
|
LOCAL_REQUIRED_MODULES += \
|
2021-09-15 05:01:05 +02:00
|
|
|
sepolicy_freeze_test
|
2018-07-02 15:31:29 +02:00
|
|
|
endif # ($(PLATFORM_SEPOLICY_VERSION),$(TOT_SEPOLICY_VERSION))
|
|
|
|
|
|
|
|
|
|
include $(BUILD_PHONY_PACKAGE)
|
|
|
|
|
|
|
|
|
|
#################################
|
|
|
|
|
|
|
|
|
|
include $(CLEAR_VARS)
|
|
|
|
|
|
2020-10-07 11:28:47 +02:00
|
|
|
LOCAL_MODULE := selinux_policy_system_ext
|
2021-02-04 08:07:40 +01:00
|
|
|
LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
|
|
|
|
|
LOCAL_LICENSE_CONDITIONS := notice unencumbered
|
|
|
|
|
LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
|
2018-07-02 15:31:29 +02:00
|
|
|
# Include precompiled policy, unless told otherwise.
|
|
|
|
|
ifneq ($(PRODUCT_PRECOMPILED_SEPOLICY),false)
|
2021-04-29 12:45:50 +02:00
|
|
|
ifdef HAS_SYSTEM_EXT_SEPOLICY
|
2020-10-07 11:28:47 +02:00
|
|
|
LOCAL_REQUIRED_MODULES += system_ext_sepolicy_and_mapping.sha256
|
2017-11-27 04:41:33 +01:00
|
|
|
endif
|
2021-04-29 12:45:50 +02:00
|
|
|
endif
|
2018-12-14 23:30:56 +01:00
|
|
|
|
2019-08-29 11:12:11 +02:00
|
|
|
ifdef HAS_SYSTEM_EXT_SEPOLICY
|
Allowing system_ext sepolicy to be empty
Some targets just need to extend system_ext context files, e.g.,
file_contexts, service_contexts, etc., without adding any system_ext
policy files, e.g., *.te files.
Currently, this will lead to build errors. This CL allows
system_ext_sepolicy.cil and the system_ext mapping file
to be empty.
It's now also possible to just set BOARD_PLAT_PRIVATE_SEPOLICY_DIR
without setting BOARD_PLAT_PUBLIC_SEPOLICY_DIR.
Bug: 137712473
Bug: 141880898
Test: Only adds system_ext context files without policy files (e.g., *.te),
then `mmma system/sepolicy` can build pass
Change-Id: I72849f2d4aa43e5296cd15c07a8fd058186a6376
2019-10-04 08:34:18 +02:00
|
|
|
LOCAL_REQUIRED_MODULES += system_ext_sepolicy.cil
|
|
|
|
|
endif
|
|
|
|
|
|
|
|
|
|
ifdef HAS_SYSTEM_EXT_PUBLIC_SEPOLICY
|
2019-10-11 01:29:40 +02:00
|
|
|
LOCAL_REQUIRED_MODULES += \
|
2020-09-22 00:32:16 +02:00
|
|
|
system_ext_mapping_file
|
|
|
|
|
|
|
|
|
|
system_ext_compat_files := $(call build_policy, $(sepolicy_compat_files), $(SYSTEM_EXT_PRIVATE_POLICY))
|
|
|
|
|
|
|
|
|
|
LOCAL_REQUIRED_MODULES += $(addprefix system_ext_, $(notdir $(system_ext_compat_files)))
|
2019-10-11 01:29:40 +02:00
|
|
|
|
Allowing system_ext sepolicy to be empty
Some targets just need to extend system_ext context files, e.g.,
file_contexts, service_contexts, etc., without adding any system_ext
policy files, e.g., *.te files.
Currently, this will lead to build errors. This CL allows
system_ext_sepolicy.cil and the system_ext mapping file
to be empty.
It's now also possible to just set BOARD_PLAT_PRIVATE_SEPOLICY_DIR
without setting BOARD_PLAT_PUBLIC_SEPOLICY_DIR.
Bug: 137712473
Bug: 141880898
Test: Only adds system_ext context files without policy files (e.g., *.te),
then `mmma system/sepolicy` can build pass
Change-Id: I72849f2d4aa43e5296cd15c07a8fd058186a6376
2019-10-04 08:34:18 +02:00
|
|
|
endif
|
|
|
|
|
|
|
|
|
|
ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR
|
2019-08-29 11:12:11 +02:00
|
|
|
LOCAL_REQUIRED_MODULES += \
|
2019-09-09 16:04:06 +02:00
|
|
|
system_ext_file_contexts \
|
|
|
|
|
system_ext_file_contexts_test \
|
2019-09-09 16:05:10 +02:00
|
|
|
system_ext_hwservice_contexts \
|
|
|
|
|
system_ext_hwservice_contexts_test \
|
2019-09-09 12:09:22 +02:00
|
|
|
system_ext_property_contexts \
|
|
|
|
|
system_ext_property_contexts_test \
|
2019-09-09 16:04:30 +02:00
|
|
|
system_ext_seapp_contexts \
|
2019-09-09 16:05:29 +02:00
|
|
|
system_ext_service_contexts \
|
|
|
|
|
system_ext_service_contexts_test \
|
2019-09-09 16:05:49 +02:00
|
|
|
system_ext_mac_permissions.xml \
|
2021-04-12 20:49:29 +02:00
|
|
|
$(addprefix system_ext_,$(addsuffix .compat.cil,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS))) \
|
2019-08-29 11:12:11 +02:00
|
|
|
|
|
|
|
|
endif
|
|
|
|
|
|
2020-10-07 11:28:47 +02:00
|
|
|
include $(BUILD_PHONY_PACKAGE)
|
|
|
|
|
|
|
|
|
|
#################################
|
|
|
|
|
|
|
|
|
|
include $(CLEAR_VARS)
|
|
|
|
|
|
|
|
|
|
LOCAL_MODULE := selinux_policy_product
|
2021-02-04 08:07:40 +01:00
|
|
|
LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
|
|
|
|
|
LOCAL_LICENSE_CONDITIONS := notice unencumbered
|
|
|
|
|
LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
|
2020-10-07 11:28:47 +02:00
|
|
|
# Include precompiled policy, unless told otherwise.
|
|
|
|
|
ifneq ($(PRODUCT_PRECOMPILED_SEPOLICY),false)
|
2021-04-29 12:45:50 +02:00
|
|
|
ifdef HAS_PRODUCT_SEPOLICY
|
2020-10-07 11:28:47 +02:00
|
|
|
LOCAL_REQUIRED_MODULES += product_sepolicy_and_mapping.sha256
|
|
|
|
|
endif
|
2021-04-29 12:45:50 +02:00
|
|
|
endif
|
2020-10-07 11:28:47 +02:00
|
|
|
|
2018-12-14 23:30:56 +01:00
|
|
|
ifdef HAS_PRODUCT_SEPOLICY
|
2019-10-04 09:36:05 +02:00
|
|
|
LOCAL_REQUIRED_MODULES += product_sepolicy.cil
|
|
|
|
|
endif
|
|
|
|
|
|
|
|
|
|
ifdef HAS_PRODUCT_PUBLIC_SEPOLICY
|
2019-10-11 01:29:40 +02:00
|
|
|
LOCAL_REQUIRED_MODULES += \
|
2020-09-22 00:32:16 +02:00
|
|
|
product_mapping_file
|
|
|
|
|
|
|
|
|
|
product_compat_files := $(call build_policy, $(sepolicy_compat_files), $(PRODUCT_PRIVATE_POLICY))
|
|
|
|
|
|
|
|
|
|
LOCAL_REQUIRED_MODULES += $(addprefix product_, $(notdir $(product_compat_files)))
|
2019-10-11 01:29:40 +02:00
|
|
|
|
2019-10-04 09:36:05 +02:00
|
|
|
endif
|
|
|
|
|
|
|
|
|
|
ifdef HAS_PRODUCT_SEPOLICY_DIR
|
2018-12-14 23:30:56 +01:00
|
|
|
LOCAL_REQUIRED_MODULES += \
|
2018-12-19 04:51:19 +01:00
|
|
|
product_file_contexts \
|
Build contexts files with Soong
This is to migrate sepolicy Makefiles into Soong. For the first part,
file_contexts, hwservice_contexts, property_contexts, and
service_contexts are migrated. Build-time tests for contexts files are
still in Makefile; they will also be done with Soong after porting the
module sepolicy.
The motivation of migrating is based on generating property_contexts
dynamically: if we were to amend contexts files at build time in the
future, it would be nicer to manage them in Soong. To do that, building
contexts files with Soong can be very helpful.
Bug: 127949646
Bug: 129377144
Test: 1) Build blueline-userdebug, flash, and boot.
Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash,
and boot.
Test: 3) Build aosp_arm-userdebug.
Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
|
|
|
product_file_contexts_test \
|
2018-12-21 01:13:10 +01:00
|
|
|
product_hwservice_contexts \
|
Build contexts files with Soong
This is to migrate sepolicy Makefiles into Soong. For the first part,
file_contexts, hwservice_contexts, property_contexts, and
service_contexts are migrated. Build-time tests for contexts files are
still in Makefile; they will also be done with Soong after porting the
module sepolicy.
The motivation of migrating is based on generating property_contexts
dynamically: if we were to amend contexts files at build time in the
future, it would be nicer to manage them in Soong. To do that, building
contexts files with Soong can be very helpful.
Bug: 127949646
Bug: 129377144
Test: 1) Build blueline-userdebug, flash, and boot.
Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash,
and boot.
Test: 3) Build aosp_arm-userdebug.
Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
|
|
|
product_hwservice_contexts_test \
|
2018-12-21 04:31:42 +01:00
|
|
|
product_property_contexts \
|
Build contexts files with Soong
This is to migrate sepolicy Makefiles into Soong. For the first part,
file_contexts, hwservice_contexts, property_contexts, and
service_contexts are migrated. Build-time tests for contexts files are
still in Makefile; they will also be done with Soong after porting the
module sepolicy.
The motivation of migrating is based on generating property_contexts
dynamically: if we were to amend contexts files at build time in the
future, it would be nicer to manage them in Soong. To do that, building
contexts files with Soong can be very helpful.
Bug: 127949646
Bug: 129377144
Test: 1) Build blueline-userdebug, flash, and boot.
Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash,
and boot.
Test: 3) Build aosp_arm-userdebug.
Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
|
|
|
product_property_contexts_test \
|
2018-12-21 19:46:45 +01:00
|
|
|
product_seapp_contexts \
|
2018-12-21 21:28:14 +01:00
|
|
|
product_service_contexts \
|
Build contexts files with Soong
This is to migrate sepolicy Makefiles into Soong. For the first part,
file_contexts, hwservice_contexts, property_contexts, and
service_contexts are migrated. Build-time tests for contexts files are
still in Makefile; they will also be done with Soong after porting the
module sepolicy.
The motivation of migrating is based on generating property_contexts
dynamically: if we were to amend contexts files at build time in the
future, it would be nicer to manage them in Soong. To do that, building
contexts files with Soong can be very helpful.
Bug: 127949646
Bug: 129377144
Test: 1) Build blueline-userdebug, flash, and boot.
Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash,
and boot.
Test: 3) Build aosp_arm-userdebug.
Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
|
|
|
product_service_contexts_test \
|
2018-12-22 01:07:21 +01:00
|
|
|
product_mac_permissions.xml \
|
2018-12-14 23:30:56 +01:00
|
|
|
|
2019-01-23 18:47:05 +01:00
|
|
|
endif
|
|
|
|
|
|
2020-10-07 11:28:47 +02:00
|
|
|
include $(BUILD_PHONY_PACKAGE)
|
|
|
|
|
|
|
|
|
|
#################################
|
|
|
|
|
|
|
|
|
|
include $(CLEAR_VARS)
|
|
|
|
|
|
|
|
|
|
LOCAL_MODULE := selinux_policy_nonsystem
|
2021-02-04 08:07:40 +01:00
|
|
|
LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
|
|
|
|
|
LOCAL_LICENSE_CONDITIONS := notice unencumbered
|
|
|
|
|
LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
|
2020-10-07 11:28:47 +02:00
|
|
|
# Include precompiled policy, unless told otherwise.
|
|
|
|
|
ifneq ($(PRODUCT_PRECOMPILED_SEPOLICY),false)
|
|
|
|
|
LOCAL_REQUIRED_MODULES += \
|
|
|
|
|
precompiled_sepolicy \
|
2021-04-29 12:45:50 +02:00
|
|
|
precompiled_sepolicy.plat_sepolicy_and_mapping.sha256
|
|
|
|
|
|
|
|
|
|
ifdef HAS_SYSTEM_EXT_SEPOLICY
|
|
|
|
|
LOCAL_REQUIRED_MODULES += precompiled_sepolicy.system_ext_sepolicy_and_mapping.sha256
|
|
|
|
|
endif
|
|
|
|
|
|
|
|
|
|
ifdef HAS_PRODUCT_SEPOLICY
|
|
|
|
|
LOCAL_REQUIRED_MODULES += precompiled_sepolicy.product_sepolicy_and_mapping.sha256
|
|
|
|
|
endif
|
2020-10-07 11:28:47 +02:00
|
|
|
|
|
|
|
|
endif # ($(PRODUCT_PRECOMPILED_SEPOLICY),false)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# These build targets are not used on non-Treble devices. However, we build these to avoid
|
|
|
|
|
# divergence between Treble and non-Treble devices.
|
|
|
|
|
LOCAL_REQUIRED_MODULES += \
|
|
|
|
|
plat_pub_versioned.cil \
|
|
|
|
|
vendor_sepolicy.cil \
|
|
|
|
|
plat_sepolicy_vers.txt \
|
|
|
|
|
|
|
|
|
|
LOCAL_REQUIRED_MODULES += \
|
|
|
|
|
vendor_file_contexts \
|
|
|
|
|
vendor_file_contexts_test \
|
|
|
|
|
vendor_mac_permissions.xml \
|
|
|
|
|
vendor_property_contexts \
|
|
|
|
|
vendor_property_contexts_test \
|
|
|
|
|
vendor_seapp_contexts \
|
|
|
|
|
vendor_service_contexts \
|
|
|
|
|
vendor_hwservice_contexts \
|
|
|
|
|
vendor_hwservice_contexts_test \
|
|
|
|
|
vndservice_contexts \
|
|
|
|
|
|
|
|
|
|
ifdef BOARD_ODM_SEPOLICY_DIRS
|
|
|
|
|
LOCAL_REQUIRED_MODULES += \
|
|
|
|
|
odm_sepolicy.cil \
|
|
|
|
|
odm_file_contexts \
|
|
|
|
|
odm_file_contexts_test \
|
|
|
|
|
odm_seapp_contexts \
|
|
|
|
|
odm_property_contexts \
|
|
|
|
|
odm_property_contexts_test \
|
|
|
|
|
odm_hwservice_contexts \
|
|
|
|
|
odm_hwservice_contexts_test \
|
|
|
|
|
odm_mac_permissions.xml
|
|
|
|
|
endif
|
|
|
|
|
|
|
|
|
|
LOCAL_REQUIRED_MODULES += selinux_policy_system_ext
|
|
|
|
|
LOCAL_REQUIRED_MODULES += selinux_policy_product
|
|
|
|
|
|
2019-01-23 18:47:05 +01:00
|
|
|
LOCAL_REQUIRED_MODULES += \
|
|
|
|
|
selinux_denial_metadata \
|
|
|
|
|
|
2019-04-19 16:03:33 +02:00
|
|
|
# Builds an addtional userdebug sepolicy into the debug ramdisk.
|
|
|
|
|
LOCAL_REQUIRED_MODULES += \
|
|
|
|
|
userdebug_plat_sepolicy.cil \
|
|
|
|
|
|
2017-04-10 21:27:18 +02:00
|
|
|
include $(BUILD_PHONY_PACKAGE)
|
|
|
|
|
|
2020-11-09 12:58:58 +01:00
|
|
|
#################################
|
|
|
|
|
|
|
|
|
|
ifeq ($(mixed_sepolicy_build),true)
|
|
|
|
|
include $(LOCAL_PATH)/prebuilt_policy.mk
|
|
|
|
|
else
|
|
|
|
|
reqd_policy_$(PLATFORM_SEPOLICY_VERSION) := $(REQD_MASK_POLICY)
|
|
|
|
|
plat_public_policy_$(PLATFORM_SEPOLICY_VERSION) := $(LOCAL_PATH)/public
|
|
|
|
|
plat_private_policy_$(PLATFORM_SEPOLICY_VERSION) := $(LOCAL_PATH)/private
|
|
|
|
|
system_ext_public_policy_$(PLATFORM_SEPOLICY_VERSION) := $(SYSTEM_EXT_PUBLIC_POLICY)
|
|
|
|
|
system_ext_private_policy_$(PLATFORM_SEPOLICY_VERSION) := $(SYSTEM_EXT_PRIVATE_POLICY)
|
|
|
|
|
product_public_policy_$(PLATFORM_SEPOLICY_VERSION) := $(PRODUCT_PUBLIC_POLICY)
|
|
|
|
|
product_private_policy_$(PLATFORM_SEPOLICY_VERSION) := $(PRODUCT_PRIVATE_POLICY)
|
|
|
|
|
endif
|
|
|
|
|
|
2018-01-04 01:53:24 +01:00
|
|
|
#################################
|
|
|
|
|
include $(CLEAR_VARS)
|
|
|
|
|
|
|
|
|
|
LOCAL_MODULE := sepolicy_neverallows
|
2021-02-04 08:07:40 +01:00
|
|
|
LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
|
|
|
|
|
LOCAL_LICENSE_CONDITIONS := notice unencumbered
|
|
|
|
|
LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
|
2019-05-29 18:05:43 +02:00
|
|
|
LOCAL_MODULE_CLASS := FAKE
|
2018-01-04 01:53:24 +01:00
|
|
|
LOCAL_MODULE_TAGS := optional
|
|
|
|
|
|
|
|
|
|
include $(BUILD_SYSTEM)/base_rules.mk
|
|
|
|
|
|
|
|
|
|
# sepolicy_policy.conf - All of the policy for the device. This is only used to
|
|
|
|
|
# check neverallow rules.
|
2020-11-09 12:58:58 +01:00
|
|
|
# In a mixed build target, vendor policies are checked separately, on the module
|
|
|
|
|
# sepolicy_neverallows_vendor.
|
|
|
|
|
|
|
|
|
|
all_plat_policy := $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) $(PLAT_VENDOR_POLICY) \
|
2019-08-29 11:12:11 +02:00
|
|
|
$(SYSTEM_EXT_PUBLIC_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY) \
|
2020-11-09 12:58:58 +01:00
|
|
|
$(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY)
|
|
|
|
|
ifeq ($(mixed_sepolicy_build),true)
|
|
|
|
|
policy_files := $(call build_policy, $(sepolicy_build_files), $(all_plat_policy))
|
|
|
|
|
else
|
|
|
|
|
policy_files := $(call build_policy, $(sepolicy_build_files), \
|
|
|
|
|
$(all_plat_policy) $(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_ODM_SEPOLICY_DIRS))
|
|
|
|
|
endif
|
|
|
|
|
|
2018-01-04 01:53:24 +01:00
|
|
|
sepolicy_policy.conf := $(intermediates)/policy.conf
|
|
|
|
|
$(sepolicy_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
|
|
|
|
|
$(sepolicy_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
|
2018-03-08 00:36:29 +01:00
|
|
|
$(sepolicy_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := user
|
2018-01-04 01:53:24 +01:00
|
|
|
$(sepolicy_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
|
|
|
|
|
$(sepolicy_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
|
2019-06-14 00:05:15 +02:00
|
|
|
$(sepolicy_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
|
2018-01-04 01:53:24 +01:00
|
|
|
$(sepolicy_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
|
|
|
|
|
$(sepolicy_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
|
2021-04-27 01:32:17 +02:00
|
|
|
$(sepolicy_policy.conf): PRIVATE_ENFORCE_DEBUGFS_RESTRICTION := $(enforce_debugfs_restriction)
|
2019-06-19 19:52:50 +02:00
|
|
|
$(sepolicy_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
|
|
|
|
|
$(sepolicy_policy.conf): $(policy_files) $(M4)
|
2018-01-04 01:53:24 +01:00
|
|
|
$(transform-policy-to-conf)
|
2018-09-13 08:04:19 +02:00
|
|
|
$(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
|
2018-01-04 01:53:24 +01:00
|
|
|
|
2018-11-27 22:45:47 +01:00
|
|
|
# sepolicy_policy_2.conf - All of the policy for the device. This is only used to
|
|
|
|
|
# check neverallow rules using sepolicy-analyze, similar to CTS.
|
|
|
|
|
sepolicy_policy_2.conf := $(intermediates)/policy_2.conf
|
|
|
|
|
$(sepolicy_policy_2.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
|
|
|
|
|
$(sepolicy_policy_2.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
|
|
|
|
|
$(sepolicy_policy_2.conf): PRIVATE_TARGET_BUILD_VARIANT := user
|
|
|
|
|
$(sepolicy_policy_2.conf): PRIVATE_EXCLUDE_BUILD_TEST := true
|
|
|
|
|
$(sepolicy_policy_2.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
|
|
|
|
|
$(sepolicy_policy_2.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
|
2019-06-14 00:05:15 +02:00
|
|
|
$(sepolicy_policy_2.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
|
2018-11-27 22:45:47 +01:00
|
|
|
$(sepolicy_policy_2.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
|
|
|
|
|
$(sepolicy_policy_2.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
|
2021-04-27 01:32:17 +02:00
|
|
|
$(sepolicy_policy_2.conf): PRIVATE_ENFORCE_DEBUGFS_RESTRICTION := $(enforce_debugfs_restriction)
|
2019-06-19 19:52:50 +02:00
|
|
|
$(sepolicy_policy_2.conf): PRIVATE_POLICY_FILES := $(policy_files)
|
|
|
|
|
$(sepolicy_policy_2.conf): $(policy_files) $(M4)
|
2018-11-27 22:45:47 +01:00
|
|
|
$(transform-policy-to-conf)
|
|
|
|
|
$(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
|
|
|
|
|
|
|
|
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY_1 := $(sepolicy_policy.conf)
|
|
|
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY_2 := $(sepolicy_policy_2.conf)
|
|
|
|
|
$(LOCAL_BUILT_MODULE): $(sepolicy_policy.conf) $(sepolicy_policy_2.conf) \
|
|
|
|
|
$(HOST_OUT_EXECUTABLES)/checkpolicy $(HOST_OUT_EXECUTABLES)/sepolicy-analyze
|
2018-01-04 01:53:24 +01:00
|
|
|
ifneq ($(SELINUX_IGNORE_NEVERALLOWS),true)
|
|
|
|
|
$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c \
|
2018-11-27 22:45:47 +01:00
|
|
|
$(POLICYVERS) -o $@.tmp $(PRIVATE_SEPOLICY_1)
|
|
|
|
|
$(hide) $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $@.tmp neverallow -w -f $(PRIVATE_SEPOLICY_2) || \
|
|
|
|
|
( echo "" 1>&2; \
|
|
|
|
|
echo "sepolicy-analyze failed. This is most likely due to the use" 1>&2; \
|
|
|
|
|
echo "of an expanded attribute in a neverallow assertion. Please fix" 1>&2; \
|
|
|
|
|
echo "the policy." 1>&2; \
|
|
|
|
|
exit 1 )
|
2018-01-04 01:53:24 +01:00
|
|
|
endif # ($(SELINUX_IGNORE_NEVERALLOWS),true)
|
2018-11-27 22:45:47 +01:00
|
|
|
$(hide) touch $@.tmp
|
|
|
|
|
$(hide) mv $@.tmp $@
|
2018-01-04 01:53:24 +01:00
|
|
|
|
|
|
|
|
sepolicy_policy.conf :=
|
2018-11-27 22:45:47 +01:00
|
|
|
sepolicy_policy_2.conf :=
|
2018-01-04 01:53:24 +01:00
|
|
|
built_sepolicy_neverallows := $(LOCAL_BUILT_MODULE)
|
|
|
|
|
|
2020-11-09 12:58:58 +01:00
|
|
|
#################################
|
|
|
|
|
# sepolicy_neverallows_vendor: neverallow check module for vendors in a mixed build target
|
|
|
|
|
ifeq ($(mixed_sepolicy_build),true)
|
|
|
|
|
include $(CLEAR_VARS)
|
|
|
|
|
|
|
|
|
|
LOCAL_MODULE := sepolicy_neverallows_vendor
|
2021-02-04 08:07:40 +01:00
|
|
|
LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
|
|
|
|
|
LOCAL_LICENSE_CONDITIONS := notice unencumbered
|
|
|
|
|
LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
|
2020-11-09 12:58:58 +01:00
|
|
|
LOCAL_MODULE_CLASS := FAKE
|
|
|
|
|
LOCAL_MODULE_TAGS := optional
|
|
|
|
|
|
|
|
|
|
include $(BUILD_SYSTEM)/base_rules.mk
|
|
|
|
|
|
|
|
|
|
# Check neverallow with prebuilt policy files
|
|
|
|
|
policy_files := $(call build_policy, $(sepolicy_build_files), \
|
|
|
|
|
$(plat_public_policy_$(BOARD_SEPOLICY_VERS)) $(plat_private_policy_$(BOARD_SEPOLICY_VERS)) \
|
|
|
|
|
$(system_ext_public_policy_$(BOARD_SEPOLICY_VERS)) $(system_ext_private_policy_$(BOARD_SEPOLICY_VERS)) \
|
|
|
|
|
$(product_public_policy_$(BOARD_SEPOLICY_VERS)) $(product_private_policy_$(BOARD_SEPOLICY_VERS)) \
|
|
|
|
|
$(BOARD_PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_ODM_SEPOLICY_DIRS))
|
|
|
|
|
|
|
|
|
|
# sepolicy_policy.conf - All of the policy for the device. This is only used to
|
|
|
|
|
# check neverallow rules.
|
|
|
|
|
sepolicy_policy.conf := $(intermediates)/policy_vendor.conf
|
|
|
|
|
$(sepolicy_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
|
|
|
|
|
$(sepolicy_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
|
|
|
|
|
$(sepolicy_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := user
|
|
|
|
|
$(sepolicy_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
|
|
|
|
|
$(sepolicy_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
|
|
|
|
|
$(sepolicy_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
|
|
|
|
|
$(sepolicy_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
|
|
|
|
|
$(sepolicy_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
|
2021-04-27 01:32:17 +02:00
|
|
|
$(sepolicy_policy.conf): PRIVATE_ENFORCE_DEBUGFS_RESTRICTION := $(enforce_debugfs_restriction)
|
2020-11-09 12:58:58 +01:00
|
|
|
$(sepolicy_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
|
|
|
|
|
$(sepolicy_policy.conf): $(policy_files) $(M4)
|
|
|
|
|
$(transform-policy-to-conf)
|
|
|
|
|
$(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
|
|
|
|
|
|
|
|
|
|
# sepolicy_policy_2.conf - All of the policy for the device. This is only used to
|
|
|
|
|
# check neverallow rules using sepolicy-analyze, similar to CTS.
|
|
|
|
|
sepolicy_policy_2.conf := $(intermediates)/policy_vendor_2.conf
|
|
|
|
|
$(sepolicy_policy_2.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
|
|
|
|
|
$(sepolicy_policy_2.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
|
|
|
|
|
$(sepolicy_policy_2.conf): PRIVATE_TARGET_BUILD_VARIANT := user
|
|
|
|
|
$(sepolicy_policy_2.conf): PRIVATE_EXCLUDE_BUILD_TEST := true
|
|
|
|
|
$(sepolicy_policy_2.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
|
|
|
|
|
$(sepolicy_policy_2.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
|
|
|
|
|
$(sepolicy_policy_2.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
|
|
|
|
|
$(sepolicy_policy_2.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
|
|
|
|
|
$(sepolicy_policy_2.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
|
2021-04-27 01:32:17 +02:00
|
|
|
$(sepolicy_policy_2.conf): PRIVATE_ENFORCE_DEBUGFS_RESTRICTION := $(enforce_debugfs_restriction)
|
2020-11-09 12:58:58 +01:00
|
|
|
$(sepolicy_policy_2.conf): PRIVATE_POLICY_FILES := $(policy_files)
|
|
|
|
|
$(sepolicy_policy_2.conf): $(policy_files) $(M4)
|
|
|
|
|
$(transform-policy-to-conf)
|
|
|
|
|
$(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
|
|
|
|
|
|
|
|
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY_1 := $(sepolicy_policy.conf)
|
|
|
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY_2 := $(sepolicy_policy_2.conf)
|
|
|
|
|
$(LOCAL_BUILT_MODULE): $(sepolicy_policy.conf) $(sepolicy_policy_2.conf) \
|
|
|
|
|
$(HOST_OUT_EXECUTABLES)/checkpolicy $(HOST_OUT_EXECUTABLES)/sepolicy-analyze
|
|
|
|
|
ifneq ($(SELINUX_IGNORE_NEVERALLOWS),true)
|
|
|
|
|
$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c \
|
|
|
|
|
$(POLICYVERS) -o $@.tmp $(PRIVATE_SEPOLICY_1)
|
|
|
|
|
$(hide) $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $@.tmp neverallow -w -f $(PRIVATE_SEPOLICY_2) || \
|
|
|
|
|
( echo "" 1>&2; \
|
|
|
|
|
echo "sepolicy-analyze failed. This is most likely due to the use" 1>&2; \
|
|
|
|
|
echo "of an expanded attribute in a neverallow assertion. Please fix" 1>&2; \
|
|
|
|
|
echo "the policy." 1>&2; \
|
|
|
|
|
exit 1 )
|
|
|
|
|
endif # ($(SELINUX_IGNORE_NEVERALLOWS),true)
|
|
|
|
|
$(hide) touch $@.tmp
|
|
|
|
|
$(hide) mv $@.tmp $@
|
|
|
|
|
|
|
|
|
|
sepolicy_policy.conf :=
|
|
|
|
|
sepolicy_policy_2.conf :=
|
|
|
|
|
built_sepolicy_neverallows += $(LOCAL_BUILT_MODULE)
|
|
|
|
|
|
|
|
|
|
endif # ifeq ($(mixed_sepolicy_build),true)
|
|
|
|
|
|
2012-01-18 02:51:09 +01:00
|
|
|
##################################
|
2021-03-22 02:26:13 +01:00
|
|
|
# plat policy files are now built with Android.bp. Grab them from intermediate.
|
|
|
|
|
# See Android.bp for details of plat policy files.
|
2021-03-19 08:04:51 +01:00
|
|
|
#
|
2021-03-22 02:26:13 +01:00
|
|
|
reqd_policy_mask.cil := $(call intermediates-dir-for,ETC,reqd_policy_mask.cil)/reqd_policy_mask.cil
|
|
|
|
|
reqd_policy_mask_$(PLATFORM_SEPOLICY_VERSION).cil := $(reqd_policy_mask.cil)
|
2021-03-19 08:04:51 +01:00
|
|
|
|
2021-03-22 02:26:13 +01:00
|
|
|
pub_policy.cil := $(call intermediates-dir-for,ETC,pub_policy.cil)/pub_policy.cil
|
2020-11-09 12:58:58 +01:00
|
|
|
pub_policy_$(PLATFORM_SEPOLICY_VERSION).cil := $(pub_policy.cil)
|
|
|
|
|
|
2021-03-22 02:26:13 +01:00
|
|
|
system_ext_pub_policy.cil := $(call intermediates-dir-for,ETC,system_ext_pub_policy.cil)/system_ext_pub_policy.cil
|
2020-11-09 12:58:58 +01:00
|
|
|
system_ext_pub_policy_$(PLATFORM_SEPOLICY_VERSION).cil := $(system_ext_pub_policy.cil)
|
|
|
|
|
|
2021-03-22 02:26:13 +01:00
|
|
|
plat_pub_policy.cil := $(call intermediates-dir-for,ETC,plat_pub_policy.cil)/plat_pub_policy.cil
|
2020-11-09 12:58:58 +01:00
|
|
|
plat_pub_policy_$(PLATFORM_SEPOLICY_VERSION).cil := $(plat_pub_policy.cil)
|
|
|
|
|
|
2021-03-22 02:26:13 +01:00
|
|
|
built_plat_cil := $(call intermediates-dir-for,ETC,plat_sepolicy.cil)/plat_sepolicy.cil
|
|
|
|
|
built_plat_cil_$(PLATFORM_SEPOLICY_VERSION) := $(built_plat_cil)
|
2021-03-25 07:37:34 +01:00
|
|
|
built_plat_mapping_cil := $(call intermediates-dir-for,ETC,plat_mapping_file)/plat_mapping_file
|
|
|
|
|
built_plat_mapping_cil_$(PLATFORM_SEPOLICY_VERSION) := $(built_plat_mapping_cil)
|
2021-03-19 08:04:51 +01:00
|
|
|
|
2021-03-22 02:26:13 +01:00
|
|
|
ifdef HAS_SYSTEM_EXT_SEPOLICY
|
|
|
|
|
built_system_ext_cil := $(call intermediates-dir-for,ETC,system_ext_sepolicy.cil)/system_ext_sepolicy.cil
|
|
|
|
|
built_system_ext_cil_$(PLATFORM_SEPOLICY_VERSION) := $(built_system_ext_cil)
|
2021-03-25 07:37:34 +01:00
|
|
|
built_system_ext_mapping_cil := $(call intermediates-dir-for,ETC,system_ext_mapping_file)/system_ext_mapping_file
|
|
|
|
|
built_system_ext_mapping_cil_$(PLATFORM_SEPOLICY_VERSION) := $(built_system_ext_mapping_cil)
|
2021-03-22 02:26:13 +01:00
|
|
|
endif # ifdef HAS_SYSTEM_EXT_SEPOLICY
|
2021-03-19 08:04:51 +01:00
|
|
|
|
2021-03-22 02:26:13 +01:00
|
|
|
ifdef HAS_PRODUCT_SEPOLICY
|
|
|
|
|
built_product_cil := $(call intermediates-dir-for,ETC,product_sepolicy.cil)/product_sepolicy.cil
|
|
|
|
|
built_product_cil_$(PLATFORM_SEPOLICY_VERSION) := $(built_product_cil)
|
2021-03-25 07:37:34 +01:00
|
|
|
built_product_mapping_cil := $(call intermediates-dir-for,ETC,product_mapping_file)/product_mapping_file
|
|
|
|
|
built_product_mapping_cil_$(PLATFORM_SEPOLICY_VERSION) := $(built_product_mapping_cil)
|
2021-03-22 02:26:13 +01:00
|
|
|
endif # ifdef HAS_PRODUCT_SEPOLICY
|
2021-03-19 08:04:51 +01:00
|
|
|
|
2021-03-25 07:37:34 +01:00
|
|
|
built_pub_vers_cil := $(call intermediates-dir-for,ETC,plat_pub_versioned.cil)/plat_pub_versioned.cil
|
|
|
|
|
built_pub_vers_cil_$(PLATFORM_SEPOLICY_VERSION) := $(built_pub_vers_cil)
|
|
|
|
|
|
2021-03-22 02:26:13 +01:00
|
|
|
# b/37755687
|
|
|
|
|
CHECKPOLICY_ASAN_OPTIONS := ASAN_OPTIONS=detect_leaks=0
|
2016-11-28 16:20:28 +01:00
|
|
|
|
|
|
|
|
#################################
|
|
|
|
|
include $(CLEAR_VARS)
|
|
|
|
|
|
2018-02-05 10:34:52 +01:00
|
|
|
# vendor_policy.cil - the vendor sepolicy. This needs attributization and to be combined
|
|
|
|
|
# with the platform-provided policy. It makes use of the reqd_policy_mask files from private
|
|
|
|
|
# policy and the platform public policy files in order to use checkpolicy.
|
|
|
|
|
LOCAL_MODULE := vendor_sepolicy.cil
|
2021-02-04 08:07:40 +01:00
|
|
|
LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
|
|
|
|
|
LOCAL_LICENSE_CONDITIONS := notice unencumbered
|
|
|
|
|
LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
|
2018-02-05 10:34:52 +01:00
|
|
|
LOCAL_MODULE_CLASS := ETC
|
|
|
|
|
LOCAL_MODULE_TAGS := optional
|
|
|
|
|
LOCAL_PROPRIETARY_MODULE := true
|
|
|
|
|
LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
|
|
|
|
|
|
|
|
|
|
include $(BUILD_SYSTEM)/base_rules.mk
|
|
|
|
|
|
2020-11-09 12:58:58 +01:00
|
|
|
# Use either prebuilt policy files or current policy files, depending on BOARD_SEPOLICY_VERS
|
2019-06-19 19:52:50 +02:00
|
|
|
policy_files := $(call build_policy, $(sepolicy_build_files), \
|
2020-11-09 12:58:58 +01:00
|
|
|
$(plat_public_policy_$(BOARD_SEPOLICY_VERS)) $(system_ext_public_policy_$(BOARD_SEPOLICY_VERS)) \
|
|
|
|
|
$(product_public_policy_$(BOARD_SEPOLICY_VERS)) $(reqd_policy_$(BOARD_SEPOLICY_VERS)) \
|
|
|
|
|
$(BOARD_PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS))
|
2018-02-05 10:34:52 +01:00
|
|
|
vendor_policy.conf := $(intermediates)/vendor_policy.conf
|
|
|
|
|
$(vendor_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
|
|
|
|
|
$(vendor_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
|
2018-03-08 00:36:29 +01:00
|
|
|
$(vendor_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
|
2018-02-05 10:34:52 +01:00
|
|
|
$(vendor_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
|
|
|
|
|
$(vendor_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
|
2019-06-14 00:05:15 +02:00
|
|
|
$(vendor_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
|
2018-02-05 10:34:52 +01:00
|
|
|
$(vendor_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
|
|
|
|
|
$(vendor_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
|
|
|
|
|
$(vendor_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
|
2019-09-26 08:14:55 +02:00
|
|
|
$(vendor_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow)
|
2020-09-28 06:32:43 +02:00
|
|
|
$(vendor_policy.conf): PRIVATE_ENFORCE_SYSPROP_OWNER := $(enforce_sysprop_owner)
|
2021-04-27 01:32:17 +02:00
|
|
|
$(vendor_policy.conf): PRIVATE_ENFORCE_DEBUGFS_RESTRICTION := $(enforce_debugfs_restriction)
|
2019-06-19 19:52:50 +02:00
|
|
|
$(vendor_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
|
|
|
|
|
$(vendor_policy.conf): $(policy_files) $(M4)
|
2017-07-07 23:59:51 +02:00
|
|
|
$(transform-policy-to-conf)
|
2018-09-13 08:04:19 +02:00
|
|
|
$(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
|
2012-01-18 02:51:09 +01:00
|
|
|
|
2018-02-05 10:41:02 +01:00
|
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_POL_CONF := $(vendor_policy.conf)
|
2020-11-09 12:58:58 +01:00
|
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_REQD_MASK := $(reqd_policy_mask_$(BOARD_SEPOLICY_VERS).cil)
|
|
|
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_BASE_CIL := $(pub_policy_$(BOARD_SEPOLICY_VERS).cil)
|
2018-02-05 10:41:02 +01:00
|
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_VERS := $(BOARD_SEPOLICY_VERS)
|
2020-11-09 12:58:58 +01:00
|
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_DEP_CIL_FILES := $(built_plat_cil_$(BOARD_SEPOLICY_VERS)) \
|
|
|
|
|
$(built_system_ext_cil_$(BOARD_SEPOLICY_VERS)) $(built_product_cil_$(BOARD_SEPOLICY_VERS)) \
|
|
|
|
|
$(built_pub_vers_cil_$(BOARD_SEPOLICY_VERS)) $(built_plat_mapping_cil_$(BOARD_SEPOLICY_VERS)) \
|
|
|
|
|
$(built_system_ext_mapping_cil_$(BOARD_SEPOLICY_VERS)) $(built_product_mapping_cil_$(BOARD_SEPOLICY_VERS))
|
|
|
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_FILTER_CIL := $(built_pub_vers_cil_$(BOARD_SEPOLICY_VERS))
|
2018-02-05 10:41:02 +01:00
|
|
|
$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/build_sepolicy \
|
2020-11-09 12:58:58 +01:00
|
|
|
$(vendor_policy.conf) $(reqd_policy_mask_$(BOARD_SEPOLICY_VERS).cil) \
|
|
|
|
|
$(pub_policy_$(BOARD_SEPOLICY_VERS).cil) $(built_plat_cil_$(BOARD_SEPOLICY_VERS)) \
|
|
|
|
|
$(built_system_ext_cil_$(BOARD_SEPOLICY_VERS)) $(built_product_cil_$(BOARD_SEPOLICY_VERS)) \
|
|
|
|
|
$(built_pub_vers_cil_$(BOARD_SEPOLICY_VERS)) $(built_plat_mapping_cil_$(BOARD_SEPOLICY_VERS)) \
|
|
|
|
|
$(built_system_ext_mapping_cil_$(BOARD_SEPOLICY_VERS)) $(built_product_mapping_cil_$(BOARD_SEPOLICY_VERS))
|
2016-10-12 23:58:09 +02:00
|
|
|
@mkdir -p $(dir $@)
|
2018-02-05 10:41:02 +01:00
|
|
|
$(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) build_cil \
|
|
|
|
|
-i $(PRIVATE_POL_CONF) -m $(PRIVATE_REQD_MASK) -c $(CHECKPOLICY_ASAN_OPTIONS) \
|
|
|
|
|
-b $(PRIVATE_BASE_CIL) -d $(PRIVATE_DEP_CIL_FILES) -f $(PRIVATE_FILTER_CIL) \
|
|
|
|
|
-t $(PRIVATE_VERS) -p $(POLICYVERS) -o $@
|
2016-10-12 23:58:09 +02:00
|
|
|
|
2018-02-05 10:34:52 +01:00
|
|
|
built_vendor_cil := $(LOCAL_BUILT_MODULE)
|
|
|
|
|
vendor_policy.conf :=
|
2016-11-28 16:20:28 +01:00
|
|
|
|
2017-03-07 23:05:57 +01:00
|
|
|
#################################
|
|
|
|
|
include $(CLEAR_VARS)
|
|
|
|
|
|
2018-09-25 20:03:48 +02:00
|
|
|
ifdef BOARD_ODM_SEPOLICY_DIRS
|
2017-11-27 04:41:33 +01:00
|
|
|
# odm_policy.cil - the odm sepolicy. This needs attributization and to be combined
|
|
|
|
|
# with the platform-provided policy. It makes use of the reqd_policy_mask files from private
|
|
|
|
|
# policy and the platform public policy files in order to use checkpolicy.
|
|
|
|
|
LOCAL_MODULE := odm_sepolicy.cil
|
2021-02-04 08:07:40 +01:00
|
|
|
LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
|
|
|
|
|
LOCAL_LICENSE_CONDITIONS := notice unencumbered
|
|
|
|
|
LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
|
2017-11-27 04:41:33 +01:00
|
|
|
LOCAL_MODULE_CLASS := ETC
|
|
|
|
|
LOCAL_MODULE_TAGS := optional
|
|
|
|
|
LOCAL_PROPRIETARY_MODULE := true
|
|
|
|
|
LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux
|
|
|
|
|
|
|
|
|
|
include $(BUILD_SYSTEM)/base_rules.mk
|
|
|
|
|
|
2020-11-09 12:58:58 +01:00
|
|
|
# Use either prebuilt policy files or current policy files, depending on BOARD_SEPOLICY_VERS
|
2019-06-19 19:52:50 +02:00
|
|
|
policy_files := $(call build_policy, $(sepolicy_build_files), \
|
2020-11-09 12:58:58 +01:00
|
|
|
$(plat_public_policy_$(BOARD_SEPOLICY_VERS)) $(system_ext_public_policy_$(BOARD_SEPOLICY_VERS)) \
|
|
|
|
|
$(product_public_policy_$(BOARD_SEPOLICY_VERS)) $(reqd_policy_$(BOARD_SEPOLICY_VERS)) \
|
|
|
|
|
$(BOARD_PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_ODM_SEPOLICY_DIRS))
|
2017-11-27 04:41:33 +01:00
|
|
|
odm_policy.conf := $(intermediates)/odm_policy.conf
|
|
|
|
|
$(odm_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
|
|
|
|
|
$(odm_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
|
|
|
|
|
$(odm_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
|
|
|
|
|
$(odm_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
|
|
|
|
|
$(odm_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
|
2019-06-14 00:05:15 +02:00
|
|
|
$(odm_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
|
2017-11-27 04:41:33 +01:00
|
|
|
$(odm_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
|
|
|
|
|
$(odm_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
|
|
|
|
|
$(odm_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
|
2019-09-26 08:14:55 +02:00
|
|
|
$(odm_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow)
|
2021-04-27 01:32:17 +02:00
|
|
|
$(odm_policy.conf): PRIVATE_ENFORCE_DEBUGFS_RESTRICTION := $(enforce_debugfs_restriction)
|
2020-09-28 06:32:43 +02:00
|
|
|
$(odm_policy.conf): PRIVATE_ENFORCE_SYSPROP_OWNER := $(enforce_sysprop_owner)
|
2019-06-19 19:52:50 +02:00
|
|
|
$(odm_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
|
|
|
|
|
$(odm_policy.conf): $(policy_files) $(M4)
|
2017-11-27 04:41:33 +01:00
|
|
|
$(transform-policy-to-conf)
|
2018-09-13 08:04:19 +02:00
|
|
|
$(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
|
2017-11-27 04:41:33 +01:00
|
|
|
|
|
|
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_POL_CONF := $(odm_policy.conf)
|
2020-11-09 12:58:58 +01:00
|
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_REQD_MASK := $(reqd_policy_mask_$(BOARD_SEPOLICY_VERS).cil)
|
|
|
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_BASE_CIL := $(pub_policy_$(BOARD_SEPOLICY_VERS).cil)
|
2017-11-27 04:41:33 +01:00
|
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_VERS := $(BOARD_SEPOLICY_VERS)
|
2020-11-09 12:58:58 +01:00
|
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_DEP_CIL_FILES := $(built_plat_cil_$(BOARD_SEPOLICY_VERS)) \
|
|
|
|
|
$(built_system_ext_cil_$(BOARD_SEPOLICY_VERS)) $(built_product_cil_$(BOARD_SEPOLICY_VERS)) \
|
|
|
|
|
$(built_pub_vers_cil_$(BOARD_SEPOLICY_VERS)) $(built_plat_mapping_cil_$(BOARD_SEPOLICY_VERS)) \
|
|
|
|
|
$(built_system_ext_mapping_cil_$(BOARD_SEPOLICY_VERS)) $(built_product_mapping_cil_$(BOARD_SEPOLICY_VERS)) \
|
|
|
|
|
$(built_vendor_cil)
|
|
|
|
|
$(LOCAL_BUILT_MODULE) : PRIVATE_FILTER_CIL_FILES := $(built_pub_vers_cil_$(BOARD_SEPOLICY_VERS)) $(built_vendor_cil)
|
2017-11-27 04:41:33 +01:00
|
|
|
$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/build_sepolicy \
|
2020-11-09 12:58:58 +01:00
|
|
|
$(odm_policy.conf) $(reqd_policy_mask_$(BOARD_SEPOLICY_VERS).cil) \
|
|
|
|
|
$(pub_policy_$(BOARD_SEPOLICY_VERS).cil) $(built_plat_cil_$(BOARD_SEPOLICY_VERS)) \
|
|
|
|
|
$(built_system_ext_cil_$(BOARD_SEPOLICY_VERS)) $(built_product_cil_$(BOARD_SEPOLICY_VERS)) \
|
|
|
|
|
$(built_pub_vers_cil_$(BOARD_SEPOLICY_VERS)) $(built_plat_mapping_cil_$(BOARD_SEPOLICY_VERS)) \
|
|
|
|
|
$(built_system_ext_mapping_cil_$(BOARD_SEPOLICY_VERS)) $(built_product_mapping_cil_$(BOARD_SEPOLICY_VERS)) \
|
2019-08-29 11:12:11 +02:00
|
|
|
$(built_vendor_cil)
|
2017-11-27 04:41:33 +01:00
|
|
|
@mkdir -p $(dir $@)
|
|
|
|
|
$(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) build_cil \
|
|
|
|
|
-i $(PRIVATE_POL_CONF) -m $(PRIVATE_REQD_MASK) -c $(CHECKPOLICY_ASAN_OPTIONS) \
|
|
|
|
|
-b $(PRIVATE_BASE_CIL) -d $(PRIVATE_DEP_CIL_FILES) -f $(PRIVATE_FILTER_CIL_FILES) \
|
|
|
|
|
-t $(PRIVATE_VERS) -p $(POLICYVERS) -o $@
|
|
|
|
|
|
|
|
|
|
built_odm_cil := $(LOCAL_BUILT_MODULE)
|
|
|
|
|
odm_policy.conf :=
|
|
|
|
|
odm_policy_raw :=
|
2018-09-25 20:03:48 +02:00
|
|
|
endif
|
2017-11-27 04:41:33 +01:00
|
|
|
|
|
|
|
|
#################################
|
|
|
|
|
include $(CLEAR_VARS)
|
|
|
|
|
|
2017-03-07 23:05:57 +01:00
|
|
|
LOCAL_MODULE := precompiled_sepolicy
|
2021-02-04 08:07:40 +01:00
|
|
|
LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
|
|
|
|
|
LOCAL_LICENSE_CONDITIONS := notice unencumbered
|
|
|
|
|
LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
|
2017-03-07 23:05:57 +01:00
|
|
|
LOCAL_MODULE_CLASS := ETC
|
|
|
|
|
LOCAL_MODULE_TAGS := optional
|
|
|
|
|
LOCAL_PROPRIETARY_MODULE := true
|
2017-11-27 04:41:33 +01:00
|
|
|
|
|
|
|
|
ifeq ($(BOARD_USES_ODMIMAGE),true)
|
|
|
|
|
LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux
|
|
|
|
|
else
|
2017-03-07 23:05:57 +01:00
|
|
|
LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
|
2017-11-27 04:41:33 +01:00
|
|
|
endif
|
2017-03-07 23:05:57 +01:00
|
|
|
|
|
|
|
|
include $(BUILD_SYSTEM)/base_rules.mk
|
|
|
|
|
|
2018-02-05 10:34:52 +01:00
|
|
|
all_cil_files := \
|
|
|
|
|
$(built_plat_cil) \
|
2020-11-09 12:58:58 +01:00
|
|
|
$(TARGET_OUT)/etc/selinux/mapping/$(BOARD_SEPOLICY_VERS).cil \
|
|
|
|
|
$(built_pub_vers_cil_$(BOARD_SEPOLICY_VERS)) \
|
2018-02-05 10:34:52 +01:00
|
|
|
$(built_vendor_cil)
|
|
|
|
|
|
2019-08-29 11:12:11 +02:00
|
|
|
ifdef HAS_SYSTEM_EXT_SEPOLICY
|
Allowing system_ext sepolicy to be empty
Some targets just need to extend system_ext context files, e.g.,
file_contexts, service_contexts, etc., without adding any system_ext
policy files, e.g., *.te files.
Currently, this will lead to build errors. This CL allows
system_ext_sepolicy.cil and the system_ext mapping file
to be empty.
It's now also possible to just set BOARD_PLAT_PRIVATE_SEPOLICY_DIR
without setting BOARD_PLAT_PUBLIC_SEPOLICY_DIR.
Bug: 137712473
Bug: 141880898
Test: Only adds system_ext context files without policy files (e.g., *.te),
then `mmma system/sepolicy` can build pass
Change-Id: I72849f2d4aa43e5296cd15c07a8fd058186a6376
2019-10-04 08:34:18 +02:00
|
|
|
all_cil_files += $(built_system_ext_cil)
|
|
|
|
|
endif
|
2019-08-29 11:12:11 +02:00
|
|
|
|
Allowing system_ext sepolicy to be empty
Some targets just need to extend system_ext context files, e.g.,
file_contexts, service_contexts, etc., without adding any system_ext
policy files, e.g., *.te files.
Currently, this will lead to build errors. This CL allows
system_ext_sepolicy.cil and the system_ext mapping file
to be empty.
It's now also possible to just set BOARD_PLAT_PRIVATE_SEPOLICY_DIR
without setting BOARD_PLAT_PUBLIC_SEPOLICY_DIR.
Bug: 137712473
Bug: 141880898
Test: Only adds system_ext context files without policy files (e.g., *.te),
then `mmma system/sepolicy` can build pass
Change-Id: I72849f2d4aa43e5296cd15c07a8fd058186a6376
2019-10-04 08:34:18 +02:00
|
|
|
ifdef HAS_SYSTEM_EXT_PUBLIC_SEPOLICY
|
2020-11-09 12:58:58 +01:00
|
|
|
all_cil_files += $(TARGET_OUT_SYSTEM_EXT)/etc/selinux/mapping/$(BOARD_SEPOLICY_VERS).cil
|
2019-08-29 11:12:11 +02:00
|
|
|
endif
|
|
|
|
|
|
2018-12-14 23:30:56 +01:00
|
|
|
ifdef HAS_PRODUCT_SEPOLICY
|
2019-10-04 09:36:05 +02:00
|
|
|
all_cil_files += $(built_product_cil)
|
|
|
|
|
endif
|
2019-01-16 00:16:55 +01:00
|
|
|
|
2019-10-04 09:36:05 +02:00
|
|
|
ifdef HAS_PRODUCT_PUBLIC_SEPOLICY
|
2020-11-09 12:58:58 +01:00
|
|
|
all_cil_files += $(TARGET_OUT_PRODUCT)/etc/selinux/mapping/$(BOARD_SEPOLICY_VERS).cil
|
2018-12-14 23:30:56 +01:00
|
|
|
endif
|
|
|
|
|
|
2017-11-27 04:41:33 +01:00
|
|
|
ifdef BOARD_ODM_SEPOLICY_DIRS
|
|
|
|
|
all_cil_files += $(built_odm_cil)
|
|
|
|
|
endif
|
|
|
|
|
|
2018-02-05 10:34:52 +01:00
|
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(all_cil_files)
|
2020-11-09 12:58:58 +01:00
|
|
|
# Neverallow checks are skipped in a mixed build target.
|
|
|
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(if $(filter $(PLATFORM_SEPOLICY_VERSION),$(BOARD_SEPOLICY_VERS)),$(NEVERALLOW_ARG),-N)
|
2018-02-05 10:34:52 +01:00
|
|
|
$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(all_cil_files) $(built_sepolicy_neverallows)
|
2018-01-04 01:53:24 +01:00
|
|
|
$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) \
|
2017-03-07 23:05:57 +01:00
|
|
|
$(PRIVATE_CIL_FILES) -o $@ -f /dev/null
|
|
|
|
|
|
|
|
|
|
built_precompiled_sepolicy := $(LOCAL_BUILT_MODULE)
|
2018-02-05 10:34:52 +01:00
|
|
|
all_cil_files :=
|
2017-03-07 23:05:57 +01:00
|
|
|
|
|
|
|
|
#################################
|
2019-01-23 03:07:58 +01:00
|
|
|
# Precompiled sepolicy is loaded if and only if:
|
|
|
|
|
# - plat_sepolicy_and_mapping.sha256 equals
|
|
|
|
|
# precompiled_sepolicy.plat_sepolicy_and_mapping.sha256
|
|
|
|
|
# AND
|
2019-08-29 11:12:11 +02:00
|
|
|
# - system_ext_sepolicy_and_mapping.sha256 equals
|
|
|
|
|
# precompiled_sepolicy.system_ext_sepolicy_and_mapping.sha256
|
|
|
|
|
# AND
|
2019-01-23 03:07:58 +01:00
|
|
|
# - product_sepolicy_and_mapping.sha256 equals
|
|
|
|
|
# precompiled_sepolicy.product_sepolicy_and_mapping.sha256
|
|
|
|
|
# See system/core/init/selinux.cpp for details.
|
|
|
|
|
#################################
|
|
|
|
|
|
2016-11-28 16:20:28 +01:00
|
|
|
#################################
|
|
|
|
|
include $(CLEAR_VARS)
|
2016-12-16 00:28:44 +01:00
|
|
|
# build this target so that we can still perform neverallow checks
|
2016-11-28 16:20:28 +01:00
|
|
|
|
|
|
|
|
LOCAL_MODULE := sepolicy
|
2021-02-04 08:07:40 +01:00
|
|
|
LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
|
|
|
|
|
LOCAL_LICENSE_CONDITIONS := notice unencumbered
|
|
|
|
|
LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
|
2016-11-28 16:20:28 +01:00
|
|
|
LOCAL_MODULE_CLASS := ETC
|
|
|
|
|
LOCAL_MODULE_TAGS := optional
|
2016-12-17 01:53:26 +01:00
|
|
|
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
|
2016-10-12 23:58:09 +02:00
|
|
|
|
2016-11-28 16:20:28 +01:00
|
|
|
include $(BUILD_SYSTEM)/base_rules.mk
|
|
|
|
|
|
2016-10-12 23:58:09 +02:00
|
|
|
all_cil_files := \
|
2017-04-22 00:57:07 +02:00
|
|
|
$(built_plat_cil) \
|
2020-11-09 12:58:58 +01:00
|
|
|
$(TARGET_OUT)/etc/selinux/mapping/$(BOARD_SEPOLICY_VERS).cil \
|
|
|
|
|
$(built_pub_vers_cil_$(BOARD_SEPOLICY_VERS)) \
|
2018-02-05 10:34:52 +01:00
|
|
|
$(built_vendor_cil)
|
2016-10-12 23:58:09 +02:00
|
|
|
|
2019-08-29 11:12:11 +02:00
|
|
|
ifdef HAS_SYSTEM_EXT_SEPOLICY
|
Allowing system_ext sepolicy to be empty
Some targets just need to extend system_ext context files, e.g.,
file_contexts, service_contexts, etc., without adding any system_ext
policy files, e.g., *.te files.
Currently, this will lead to build errors. This CL allows
system_ext_sepolicy.cil and the system_ext mapping file
to be empty.
It's now also possible to just set BOARD_PLAT_PRIVATE_SEPOLICY_DIR
without setting BOARD_PLAT_PUBLIC_SEPOLICY_DIR.
Bug: 137712473
Bug: 141880898
Test: Only adds system_ext context files without policy files (e.g., *.te),
then `mmma system/sepolicy` can build pass
Change-Id: I72849f2d4aa43e5296cd15c07a8fd058186a6376
2019-10-04 08:34:18 +02:00
|
|
|
all_cil_files += $(built_system_ext_cil)
|
|
|
|
|
endif
|
2019-08-29 11:12:11 +02:00
|
|
|
|
Allowing system_ext sepolicy to be empty
Some targets just need to extend system_ext context files, e.g.,
file_contexts, service_contexts, etc., without adding any system_ext
policy files, e.g., *.te files.
Currently, this will lead to build errors. This CL allows
system_ext_sepolicy.cil and the system_ext mapping file
to be empty.
It's now also possible to just set BOARD_PLAT_PRIVATE_SEPOLICY_DIR
without setting BOARD_PLAT_PUBLIC_SEPOLICY_DIR.
Bug: 137712473
Bug: 141880898
Test: Only adds system_ext context files without policy files (e.g., *.te),
then `mmma system/sepolicy` can build pass
Change-Id: I72849f2d4aa43e5296cd15c07a8fd058186a6376
2019-10-04 08:34:18 +02:00
|
|
|
ifdef HAS_SYSTEM_EXT_PUBLIC_SEPOLICY
|
2020-11-09 12:58:58 +01:00
|
|
|
all_cil_files += $(TARGET_OUT_SYSTEM_EXT)/etc/selinux/mapping/$(BOARD_SEPOLICY_VERS).cil
|
2019-08-29 11:12:11 +02:00
|
|
|
endif
|
|
|
|
|
|
2018-12-14 23:30:56 +01:00
|
|
|
ifdef HAS_PRODUCT_SEPOLICY
|
2019-10-04 09:36:05 +02:00
|
|
|
all_cil_files += $(built_product_cil)
|
|
|
|
|
endif
|
2019-01-16 00:16:55 +01:00
|
|
|
|
2019-10-04 09:36:05 +02:00
|
|
|
ifdef HAS_PRODUCT_PUBLIC_SEPOLICY
|
2020-11-09 12:58:58 +01:00
|
|
|
all_cil_files += $(TARGET_OUT_PRODUCT)/etc/selinux/mapping/$(BOARD_SEPOLICY_VERS).cil
|
2018-12-14 23:30:56 +01:00
|
|
|
endif
|
|
|
|
|
|
2017-11-27 04:41:33 +01:00
|
|
|
ifdef BOARD_ODM_SEPOLICY_DIRS
|
|
|
|
|
all_cil_files += $(built_odm_cil)
|
|
|
|
|
endif
|
|
|
|
|
|
2016-10-12 23:58:09 +02:00
|
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(all_cil_files)
|
2020-11-09 12:58:58 +01:00
|
|
|
# Neverallow checks are skipped in a mixed build target.
|
|
|
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(if $(filter $(PLATFORM_SEPOLICY_VERSION),$(BOARD_SEPOLICY_VERS)),$(NEVERALLOW_ARG),-N)
|
2018-01-04 01:53:24 +01:00
|
|
|
$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $(all_cil_files) \
|
|
|
|
|
$(built_sepolicy_neverallows)
|
2016-10-12 23:58:09 +02:00
|
|
|
@mkdir -p $(dir $@)
|
2018-01-04 01:53:24 +01:00
|
|
|
$(hide) $< -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $(PRIVATE_CIL_FILES) -o $@.tmp -f /dev/null
|
2016-02-27 05:06:52 +01:00
|
|
|
$(hide) $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $@.tmp permissive > $@.permissivedomains
|
|
|
|
|
$(hide) if [ "$(TARGET_BUILD_VARIANT)" = "user" -a -s $@.permissivedomains ]; then \
|
|
|
|
|
echo "==========" 1>&2; \
|
|
|
|
|
echo "ERROR: permissive domains not allowed in user builds" 1>&2; \
|
|
|
|
|
echo "List of invalid domains:" 1>&2; \
|
|
|
|
|
cat $@.permissivedomains 1>&2; \
|
|
|
|
|
exit 1; \
|
|
|
|
|
fi
|
|
|
|
|
$(hide) mv $@.tmp $@
|
2012-01-18 02:51:09 +01:00
|
|
|
|
2012-10-26 04:01:31 +02:00
|
|
|
built_sepolicy := $(LOCAL_BUILT_MODULE)
|
2016-10-12 23:58:09 +02:00
|
|
|
all_cil_files :=
|
2012-10-02 18:46:37 +02:00
|
|
|
|
2017-03-10 18:36:07 +01:00
|
|
|
#################################
|
|
|
|
|
include $(CLEAR_VARS)
|
|
|
|
|
|
|
|
|
|
# keep concrete sepolicy for neverallow checks
|
2018-01-04 01:53:24 +01:00
|
|
|
# If SELINUX_IGNORE_NEVERALLOWS is set, we use sed to remove the neverallow lines before compiling.
|
2017-03-10 18:36:07 +01:00
|
|
|
|
|
|
|
|
LOCAL_MODULE := sepolicy.recovery
|
2021-02-04 08:07:40 +01:00
|
|
|
LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
|
|
|
|
|
LOCAL_LICENSE_CONDITIONS := notice unencumbered
|
|
|
|
|
LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
|
2017-03-10 21:44:16 +01:00
|
|
|
LOCAL_MODULE_STEM := sepolicy
|
2017-03-10 18:36:07 +01:00
|
|
|
LOCAL_MODULE_CLASS := ETC
|
|
|
|
|
LOCAL_MODULE_TAGS := optional
|
2017-03-10 21:44:16 +01:00
|
|
|
LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
|
2017-03-10 18:36:07 +01:00
|
|
|
|
|
|
|
|
include $(BUILD_SYSTEM)/base_rules.mk
|
|
|
|
|
|
2020-11-09 12:58:58 +01:00
|
|
|
# We use vendor version's policy files because recovery partition is vendor-owned.
|
2019-06-19 19:52:50 +02:00
|
|
|
policy_files := $(call build_policy, $(sepolicy_build_files), \
|
2020-11-09 12:58:58 +01:00
|
|
|
$(plat_public_policy_$(BOARD_SEPOLICY_VERS)) $(plat_private_policy_$(BOARD_SEPOLICY_VERS)) \
|
|
|
|
|
$(system_ext_public_policy_$(BOARD_SEPOLICY_VERS)) $(system_ext_private_policy_$(BOARD_SEPOLICY_VERS)) \
|
|
|
|
|
$(product_public_policy_$(BOARD_SEPOLICY_VERS)) $(product_private_policy_$(BOARD_SEPOLICY_VERS)) \
|
|
|
|
|
$(BOARD_PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_ODM_SEPOLICY_DIRS))
|
2017-04-11 16:38:48 +02:00
|
|
|
sepolicy.recovery.conf := $(intermediates)/sepolicy.recovery.conf
|
|
|
|
|
$(sepolicy.recovery.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
|
|
|
|
|
$(sepolicy.recovery.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
|
2018-03-08 00:36:29 +01:00
|
|
|
$(sepolicy.recovery.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
|
2017-04-11 16:38:48 +02:00
|
|
|
$(sepolicy.recovery.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
|
|
|
|
|
$(sepolicy.recovery.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
|
2019-06-14 00:05:15 +02:00
|
|
|
$(sepolicy.recovery.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
|
2017-04-11 16:38:48 +02:00
|
|
|
$(sepolicy.recovery.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
|
2017-07-07 23:59:51 +02:00
|
|
|
$(sepolicy.recovery.conf): PRIVATE_TGT_RECOVERY := -D target_recovery=true
|
2021-04-27 01:32:17 +02:00
|
|
|
$(sepolicy.recovery.conf): PRIVATE_ENFORCE_DEBUGFS_RESTRICTION := $(enforce_debugfs_restriction)
|
2019-06-19 19:52:50 +02:00
|
|
|
$(sepolicy.recovery.conf): PRIVATE_POLICY_FILES := $(policy_files)
|
|
|
|
|
$(sepolicy.recovery.conf): $(policy_files) $(M4)
|
2017-07-07 23:59:51 +02:00
|
|
|
$(transform-policy-to-conf)
|
2018-09-13 08:04:19 +02:00
|
|
|
$(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
|
|
|
|
|
|
2018-01-04 01:53:24 +01:00
|
|
|
ifeq ($(SELINUX_IGNORE_NEVERALLOWS),true)
|
|
|
|
|
$(hide) sed -z 's/\n\s*neverallow[^;]*;/\n/g' $@ > $@.neverallow
|
|
|
|
|
$(hide) mv $@.neverallow $@
|
|
|
|
|
endif
|
2016-12-16 00:28:44 +01:00
|
|
|
|
2017-04-11 16:38:48 +02:00
|
|
|
$(LOCAL_BUILT_MODULE): $(sepolicy.recovery.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
|
|
|
|
|
$(HOST_OUT_EXECUTABLES)/sepolicy-analyze
|
2016-12-16 00:28:44 +01:00
|
|
|
@mkdir -p $(dir $@)
|
2017-04-28 02:16:13 +02:00
|
|
|
$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c \
|
|
|
|
|
$(POLICYVERS) -o $@.tmp $<
|
2016-02-27 05:06:52 +01:00
|
|
|
$(hide) $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $@.tmp permissive > $@.permissivedomains
|
|
|
|
|
$(hide) if [ "$(TARGET_BUILD_VARIANT)" = "user" -a -s $@.permissivedomains ]; then \
|
|
|
|
|
echo "==========" 1>&2; \
|
|
|
|
|
echo "ERROR: permissive domains not allowed in user builds" 1>&2; \
|
|
|
|
|
echo "List of invalid domains:" 1>&2; \
|
|
|
|
|
cat $@.permissivedomains 1>&2; \
|
|
|
|
|
exit 1; \
|
|
|
|
|
fi
|
|
|
|
|
$(hide) mv $@.tmp $@
|
2014-05-29 22:40:15 +02:00
|
|
|
|
2017-04-11 16:38:48 +02:00
|
|
|
sepolicy.recovery.conf :=
|
2014-05-29 22:40:15 +02:00
|
|
|
|
2015-06-30 01:31:23 +02:00
|
|
|
##################################
|
2016-12-12 18:29:04 +01:00
|
|
|
# TODO - remove this. Keep around until we get the filesystem creation stuff taken care of.
|
|
|
|
|
#
|
2015-06-30 01:31:23 +02:00
|
|
|
include $(CLEAR_VARS)
|
|
|
|
|
|
2015-08-06 18:43:52 +02:00
|
|
|
LOCAL_MODULE := file_contexts.bin
|
2021-02-04 08:07:40 +01:00
|
|
|
LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
|
|
|
|
|
LOCAL_LICENSE_CONDITIONS := notice unencumbered
|
|
|
|
|
LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
|
2012-01-18 02:51:09 +01:00
|
|
|
LOCAL_MODULE_CLASS := ETC
|
|
|
|
|
LOCAL_MODULE_TAGS := optional
|
|
|
|
|
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
|
|
|
|
|
|
2012-03-06 17:12:41 +01:00
|
|
|
include $(BUILD_SYSTEM)/base_rules.mk
|
2012-01-18 02:51:09 +01:00
|
|
|
|
2016-01-04 21:20:57 +01:00
|
|
|
# The file_contexts.bin is built in the following way:
|
|
|
|
|
# 1. Collect all file_contexts files in THIS repository and process them with
|
|
|
|
|
# m4 into a tmp file called file_contexts.local.tmp.
|
2020-09-23 12:16:10 +02:00
|
|
|
# 2. Collect all file_contexts files from LOCAL_FILE_CONTEXTS of installed
|
|
|
|
|
# modules with m4 with a tmp file called file_contexts.modules.tmp.
|
|
|
|
|
# 3. Collect all device specific file_contexts files and process them with m4
|
2016-01-04 21:20:57 +01:00
|
|
|
# into a tmp file called file_contexts.device.tmp.
|
2020-09-23 12:16:10 +02:00
|
|
|
# 4. Run checkfc -e (allow no device fc entries ie empty) and fc_sort on
|
2016-01-04 21:20:57 +01:00
|
|
|
# file_contexts.device.tmp and output to file_contexts.device.sorted.tmp.
|
2020-09-23 12:16:10 +02:00
|
|
|
# 5. Concatenate file_contexts.local.tmp, file_contexts.modules.tmp and
|
2020-11-09 12:58:58 +01:00
|
|
|
# file_contexts.device.sorted.tmp into file_contexts.concat.tmp.
|
2020-09-23 12:16:10 +02:00
|
|
|
# 6. Run checkfc and sefcontext_compile on file_contexts.concat.tmp to produce
|
2016-01-04 21:20:57 +01:00
|
|
|
# file_contexts.bin.
|
|
|
|
|
#
|
|
|
|
|
# Note: That a newline file is placed between each file_context file found to
|
|
|
|
|
# ensure a proper build when an fc file is missing an ending newline.
|
|
|
|
|
|
2017-05-08 23:26:52 +02:00
|
|
|
local_fc_files := $(call build_policy, file_contexts, $(PLAT_PRIVATE_POLICY))
|
|
|
|
|
|
Allowing system_ext sepolicy to be empty
Some targets just need to extend system_ext context files, e.g.,
file_contexts, service_contexts, etc., without adding any system_ext
policy files, e.g., *.te files.
Currently, this will lead to build errors. This CL allows
system_ext_sepolicy.cil and the system_ext mapping file
to be empty.
It's now also possible to just set BOARD_PLAT_PRIVATE_SEPOLICY_DIR
without setting BOARD_PLAT_PUBLIC_SEPOLICY_DIR.
Bug: 137712473
Bug: 141880898
Test: Only adds system_ext context files without policy files (e.g., *.te),
then `mmma system/sepolicy` can build pass
Change-Id: I72849f2d4aa43e5296cd15c07a8fd058186a6376
2019-10-04 08:34:18 +02:00
|
|
|
ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR
|
2019-09-09 16:04:06 +02:00
|
|
|
local_fc_files += $(call build_policy, file_contexts, $(SYSTEM_EXT_PRIVATE_POLICY))
|
|
|
|
|
endif
|
|
|
|
|
|
2019-10-04 09:36:05 +02:00
|
|
|
ifdef HAS_PRODUCT_SEPOLICY_DIR
|
2018-12-14 23:30:56 +01:00
|
|
|
local_fc_files += $(call build_policy, file_contexts, $(PRODUCT_PRIVATE_POLICY))
|
|
|
|
|
endif
|
|
|
|
|
|
2015-09-18 21:05:51 +02:00
|
|
|
ifneq ($(filter address,$(SANITIZE_TARGET)),)
|
2018-06-13 17:02:29 +02:00
|
|
|
local_fc_files += $(wildcard $(addsuffix /file_contexts_asan, $(PLAT_PRIVATE_POLICY)))
|
|
|
|
|
endif
|
|
|
|
|
ifneq (,$(filter userdebug eng,$(TARGET_BUILD_VARIANT)))
|
|
|
|
|
local_fc_files += $(wildcard $(addsuffix /file_contexts_overlayfs, $(PLAT_PRIVATE_POLICY)))
|
2015-06-13 02:18:20 +02:00
|
|
|
endif
|
2019-11-20 09:54:34 +01:00
|
|
|
|
2016-01-04 21:20:57 +01:00
|
|
|
file_contexts.local.tmp := $(intermediates)/file_contexts.local.tmp
|
2020-09-23 12:16:10 +02:00
|
|
|
$(call merge-fc-files,$(local_fc_files),$(file_contexts.local.tmp))
|
|
|
|
|
|
|
|
|
|
# The rule for file_contexts.modules.tmp is defined in build/make/core/Makefile.
|
|
|
|
|
# it gathers LOCAL_FILE_CONTEXTS from product_MODULES
|
|
|
|
|
file_contexts.modules.tmp := $(intermediates)/file_contexts.modules.tmp
|
2016-01-04 21:20:57 +01:00
|
|
|
|
2018-02-05 10:34:52 +01:00
|
|
|
device_fc_files := $(call build_vendor_policy, file_contexts)
|
2017-11-29 09:14:53 +01:00
|
|
|
|
|
|
|
|
ifdef BOARD_ODM_SEPOLICY_DIRS
|
|
|
|
|
device_fc_files += $(call build_odm_policy, file_contexts)
|
|
|
|
|
endif
|
|
|
|
|
|
2016-01-04 21:20:57 +01:00
|
|
|
file_contexts.device.tmp := $(intermediates)/file_contexts.device.tmp
|
|
|
|
|
$(file_contexts.device.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
|
2019-06-19 19:52:50 +02:00
|
|
|
$(file_contexts.device.tmp): PRIVATE_DEVICE_FC_FILES := $(device_fc_files)
|
|
|
|
|
$(file_contexts.device.tmp): $(device_fc_files) $(M4)
|
2016-01-04 21:20:57 +01:00
|
|
|
@mkdir -p $(dir $@)
|
2019-06-19 19:52:50 +02:00
|
|
|
$(hide) $(M4) --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_DEVICE_FC_FILES) > $@
|
2016-01-04 21:20:57 +01:00
|
|
|
|
|
|
|
|
file_contexts.device.sorted.tmp := $(intermediates)/file_contexts.device.sorted.tmp
|
|
|
|
|
$(file_contexts.device.sorted.tmp): PRIVATE_SEPOLICY := $(built_sepolicy)
|
2018-02-05 10:34:52 +01:00
|
|
|
$(file_contexts.device.sorted.tmp): $(file_contexts.device.tmp) $(built_sepolicy) \
|
|
|
|
|
$(HOST_OUT_EXECUTABLES)/fc_sort $(HOST_OUT_EXECUTABLES)/checkfc
|
2016-01-04 21:20:57 +01:00
|
|
|
@mkdir -p $(dir $@)
|
2016-12-07 20:27:47 +01:00
|
|
|
$(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e $(PRIVATE_SEPOLICY) $<
|
2019-04-11 01:53:17 +02:00
|
|
|
$(hide) $(HOST_OUT_EXECUTABLES)/fc_sort -i $< -o $@
|
2012-10-02 18:46:37 +02:00
|
|
|
|
2016-01-04 21:20:57 +01:00
|
|
|
file_contexts.concat.tmp := $(intermediates)/file_contexts.concat.tmp
|
2020-09-23 12:16:10 +02:00
|
|
|
$(call merge-fc-files,\
|
|
|
|
|
$(file_contexts.local.tmp) $(file_contexts.modules.tmp) $(file_contexts.device.sorted.tmp),\
|
|
|
|
|
$(file_contexts.concat.tmp))
|
2012-01-18 02:51:09 +01:00
|
|
|
|
2015-09-25 19:18:44 +02:00
|
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
|
2016-01-04 21:20:57 +01:00
|
|
|
$(LOCAL_BUILT_MODULE): $(file_contexts.concat.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/sefcontext_compile $(HOST_OUT_EXECUTABLES)/checkfc
|
2015-08-06 18:43:52 +02:00
|
|
|
@mkdir -p $(dir $@)
|
2016-12-07 20:27:47 +01:00
|
|
|
$(hide) $(HOST_OUT_EXECUTABLES)/checkfc $(PRIVATE_SEPOLICY) $<
|
2015-08-06 18:43:52 +02:00
|
|
|
$(hide) $(HOST_OUT_EXECUTABLES)/sefcontext_compile -o $@ $<
|
|
|
|
|
|
2014-03-20 14:35:08 +01:00
|
|
|
built_fc := $(LOCAL_BUILT_MODULE)
|
2016-01-04 21:20:57 +01:00
|
|
|
local_fc_files :=
|
|
|
|
|
local_fcfiles_with_nl :=
|
|
|
|
|
device_fc_files :=
|
|
|
|
|
device_fcfiles_with_nl :=
|
|
|
|
|
file_contexts.concat.tmp :=
|
|
|
|
|
file_contexts.device.sorted.tmp :=
|
|
|
|
|
file_contexts.device.tmp :=
|
|
|
|
|
file_contexts.local.tmp :=
|
2020-09-23 12:16:10 +02:00
|
|
|
file_contexts.modules.tmp :=
|
2012-08-16 19:55:05 +02:00
|
|
|
|
2017-09-26 21:58:29 +02:00
|
|
|
##################################
|
|
|
|
|
include $(CLEAR_VARS)
|
|
|
|
|
|
|
|
|
|
LOCAL_MODULE := selinux_denial_metadata
|
2021-02-04 08:07:40 +01:00
|
|
|
LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
|
|
|
|
|
LOCAL_LICENSE_CONDITIONS := notice unencumbered
|
|
|
|
|
LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
|
2017-09-26 21:58:29 +02:00
|
|
|
LOCAL_MODULE_CLASS := ETC
|
2019-01-23 18:47:05 +01:00
|
|
|
LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
|
2017-09-26 21:58:29 +02:00
|
|
|
|
|
|
|
|
include $(BUILD_SYSTEM)/base_rules.mk
|
|
|
|
|
|
2019-06-07 02:09:29 +02:00
|
|
|
bug_files := $(call build_policy, bug_map, $(LOCAL_PATH) $(PLAT_PRIVATE_POLICY) $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(PLAT_PUBLIC_POLICY))
|
2017-09-26 21:58:29 +02:00
|
|
|
|
|
|
|
|
$(LOCAL_BUILT_MODULE) : $(bug_files)
|
|
|
|
|
@mkdir -p $(dir $@)
|
|
|
|
|
cat $^ > $@
|
|
|
|
|
|
|
|
|
|
bug_files :=
|
2017-03-10 21:44:16 +01:00
|
|
|
|
|
|
|
|
##################################
|
2019-01-08 01:43:31 +01:00
|
|
|
include $(LOCAL_PATH)/seapp_contexts.mk
|
2014-06-06 00:52:02 +02:00
|
|
|
|
2018-12-21 21:28:14 +01:00
|
|
|
##################################
|
Build contexts files with Soong
This is to migrate sepolicy Makefiles into Soong. For the first part,
file_contexts, hwservice_contexts, property_contexts, and
service_contexts are migrated. Build-time tests for contexts files are
still in Makefile; they will also be done with Soong after porting the
module sepolicy.
The motivation of migrating is based on generating property_contexts
dynamically: if we were to amend contexts files at build time in the
future, it would be nicer to manage them in Soong. To do that, building
contexts files with Soong can be very helpful.
Bug: 127949646
Bug: 129377144
Test: 1) Build blueline-userdebug, flash, and boot.
Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash,
and boot.
Test: 3) Build aosp_arm-userdebug.
Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
|
|
|
include $(LOCAL_PATH)/contexts_tests.mk
|
2017-04-08 01:14:43 +02:00
|
|
|
|
|
|
|
|
##################################
|
|
|
|
|
include $(CLEAR_VARS)
|
|
|
|
|
|
2017-04-01 02:29:53 +02:00
|
|
|
LOCAL_MODULE := vndservice_contexts
|
2021-02-04 08:07:40 +01:00
|
|
|
LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
|
|
|
|
|
LOCAL_LICENSE_CONDITIONS := notice unencumbered
|
|
|
|
|
LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
|
2017-04-01 02:29:53 +02:00
|
|
|
LOCAL_MODULE_CLASS := ETC
|
|
|
|
|
LOCAL_MODULE_TAGS := optional
|
|
|
|
|
LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
|
|
|
|
|
|
|
|
|
|
include $(BUILD_SYSTEM)/base_rules.mk
|
|
|
|
|
|
2018-02-05 10:34:52 +01:00
|
|
|
vnd_svcfiles := $(call build_policy, vndservice_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
|
2017-04-01 02:29:53 +02:00
|
|
|
|
|
|
|
|
vndservice_contexts.tmp := $(intermediates)/vndservice_contexts.tmp
|
|
|
|
|
$(vndservice_contexts.tmp): PRIVATE_SVC_FILES := $(vnd_svcfiles)
|
|
|
|
|
$(vndservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
|
2019-06-19 19:52:50 +02:00
|
|
|
$(vndservice_contexts.tmp): $(vnd_svcfiles) $(M4)
|
2017-04-01 02:29:53 +02:00
|
|
|
@mkdir -p $(dir $@)
|
2019-06-19 19:52:50 +02:00
|
|
|
$(hide) $(M4) --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
|
2017-04-01 02:29:53 +02:00
|
|
|
|
|
|
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
|
|
|
|
|
$(LOCAL_BUILT_MODULE): $(vndservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
|
|
|
|
|
@mkdir -p $(dir $@)
|
|
|
|
|
sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
|
2017-04-07 19:08:55 +02:00
|
|
|
$(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e -v $(PRIVATE_SEPOLICY) $@
|
2017-04-01 02:29:53 +02:00
|
|
|
|
|
|
|
|
vnd_svcfiles :=
|
|
|
|
|
vndservice_contexts.tmp :=
|
2018-12-22 01:07:21 +01:00
|
|
|
|
|
|
|
|
##################################
|
2019-01-08 01:43:31 +01:00
|
|
|
include $(LOCAL_PATH)/mac_permissions.mk
|
2017-11-29 09:06:15 +01:00
|
|
|
|
2017-09-26 21:58:29 +02:00
|
|
|
#################################
|
|
|
|
|
include $(CLEAR_VARS)
|
|
|
|
|
LOCAL_MODULE := sepolicy_tests
|
2021-02-04 08:07:40 +01:00
|
|
|
LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
|
|
|
|
|
LOCAL_LICENSE_CONDITIONS := notice unencumbered
|
|
|
|
|
LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
|
2019-05-29 18:05:43 +02:00
|
|
|
LOCAL_MODULE_CLASS := FAKE
|
|
|
|
|
LOCAL_MODULE_TAGS := optional
|
2017-09-26 21:58:29 +02:00
|
|
|
|
|
|
|
|
include $(BUILD_SYSTEM)/base_rules.mk
|
|
|
|
|
|
Build contexts files with Soong
This is to migrate sepolicy Makefiles into Soong. For the first part,
file_contexts, hwservice_contexts, property_contexts, and
service_contexts are migrated. Build-time tests for contexts files are
still in Makefile; they will also be done with Soong after porting the
module sepolicy.
The motivation of migrating is based on generating property_contexts
dynamically: if we were to amend contexts files at build time in the
future, it would be nicer to manage them in Soong. To do that, building
contexts files with Soong can be very helpful.
Bug: 127949646
Bug: 129377144
Test: 1) Build blueline-userdebug, flash, and boot.
Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash,
and boot.
Test: 3) Build aosp_arm-userdebug.
Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
|
|
|
all_fc_files := $(TARGET_OUT)/etc/selinux/plat_file_contexts
|
|
|
|
|
all_fc_files += $(TARGET_OUT_VENDOR)/etc/selinux/vendor_file_contexts
|
Allowing system_ext sepolicy to be empty
Some targets just need to extend system_ext context files, e.g.,
file_contexts, service_contexts, etc., without adding any system_ext
policy files, e.g., *.te files.
Currently, this will lead to build errors. This CL allows
system_ext_sepolicy.cil and the system_ext mapping file
to be empty.
It's now also possible to just set BOARD_PLAT_PRIVATE_SEPOLICY_DIR
without setting BOARD_PLAT_PUBLIC_SEPOLICY_DIR.
Bug: 137712473
Bug: 141880898
Test: Only adds system_ext context files without policy files (e.g., *.te),
then `mmma system/sepolicy` can build pass
Change-Id: I72849f2d4aa43e5296cd15c07a8fd058186a6376
2019-10-04 08:34:18 +02:00
|
|
|
ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR
|
2019-09-09 16:04:06 +02:00
|
|
|
all_fc_files += $(TARGET_OUT_SYSTEM_EXT)/etc/selinux/system_ext_file_contexts
|
|
|
|
|
endif
|
2019-10-04 09:36:05 +02:00
|
|
|
ifdef HAS_PRODUCT_SEPOLICY_DIR
|
Build contexts files with Soong
This is to migrate sepolicy Makefiles into Soong. For the first part,
file_contexts, hwservice_contexts, property_contexts, and
service_contexts are migrated. Build-time tests for contexts files are
still in Makefile; they will also be done with Soong after porting the
module sepolicy.
The motivation of migrating is based on generating property_contexts
dynamically: if we were to amend contexts files at build time in the
future, it would be nicer to manage them in Soong. To do that, building
contexts files with Soong can be very helpful.
Bug: 127949646
Bug: 129377144
Test: 1) Build blueline-userdebug, flash, and boot.
Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash,
and boot.
Test: 3) Build aosp_arm-userdebug.
Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
|
|
|
all_fc_files += $(TARGET_OUT_PRODUCT)/etc/selinux/product_file_contexts
|
2018-12-19 04:51:19 +01:00
|
|
|
endif
|
2017-11-29 09:14:53 +01:00
|
|
|
ifdef BOARD_ODM_SEPOLICY_DIRS
|
Build contexts files with Soong
This is to migrate sepolicy Makefiles into Soong. For the first part,
file_contexts, hwservice_contexts, property_contexts, and
service_contexts are migrated. Build-time tests for contexts files are
still in Makefile; they will also be done with Soong after porting the
module sepolicy.
The motivation of migrating is based on generating property_contexts
dynamically: if we were to amend contexts files at build time in the
future, it would be nicer to manage them in Soong. To do that, building
contexts files with Soong can be very helpful.
Bug: 127949646
Bug: 129377144
Test: 1) Build blueline-userdebug, flash, and boot.
Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash,
and boot.
Test: 3) Build aosp_arm-userdebug.
Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
|
|
|
all_fc_files += $(TARGET_OUT_ODM)/etc/selinux/odm_file_contexts
|
2017-11-29 09:14:53 +01:00
|
|
|
endif
|
2018-02-05 10:34:52 +01:00
|
|
|
all_fc_args := $(foreach file, $(all_fc_files), -f $(file))
|
|
|
|
|
|
2019-05-29 18:05:43 +02:00
|
|
|
$(LOCAL_BUILT_MODULE): ALL_FC_ARGS := $(all_fc_args)
|
|
|
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
|
|
|
|
|
$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/sepolicy_tests $(all_fc_files) $(built_sepolicy)
|
2017-09-26 21:58:29 +02:00
|
|
|
@mkdir -p $(dir $@)
|
2017-10-04 18:42:29 +02:00
|
|
|
$(hide) $(HOST_OUT_EXECUTABLES)/sepolicy_tests -l $(HOST_OUT)/lib64/libsepolwrap.$(SHAREDLIB_EXT) \
|
2018-02-05 10:34:52 +01:00
|
|
|
$(ALL_FC_ARGS) -p $(PRIVATE_SEPOLICY)
|
2017-09-26 21:58:29 +02:00
|
|
|
$(hide) touch $@
|
|
|
|
|
|
2014-03-20 14:35:08 +01:00
|
|
|
##################################
|
2021-09-27 15:43:01 +02:00
|
|
|
# Tests for Treble compatibility of current platform policy and vendor policy of
|
|
|
|
|
# given release version.
|
|
|
|
|
ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
|
2021-03-22 11:25:09 +01:00
|
|
|
|
2021-09-27 15:43:01 +02:00
|
|
|
built_plat_sepolicy := $(call intermediates-dir-for,ETC,base_plat_sepolicy)/base_plat_sepolicy
|
|
|
|
|
built_system_ext_sepolicy := $(call intermediates-dir-for,ETC,base_system_ext_sepolicy)/base_system_ext_sepolicy
|
|
|
|
|
built_product_sepolicy := $(call intermediates-dir-for,ETC,base_product_sepolicy)/base_product_sepolicy
|
2021-03-22 11:25:09 +01:00
|
|
|
|
2021-09-27 15:43:01 +02:00
|
|
|
base_plat_pub_policy.cil := $(call intermediates-dir-for,ETC,base_plat_pub_policy.cil)/base_plat_pub_policy.cil
|
|
|
|
|
base_system_ext_pub_polcy.cil := $(call intermediates-dir-for,ETC,base_system_ext_pub_polcy.cil)/base_system_ext_pub_polcy.cil
|
|
|
|
|
base_product_pub_policy.cil := $(call intermediates-dir-for,ETC,base_product_pub_policy.cil)/base_product_pub_policy.cil
|
2021-03-22 11:25:09 +01:00
|
|
|
|
2018-02-01 01:22:35 +01:00
|
|
|
version_under_treble_tests := 26.0
|
|
|
|
|
include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk
|
2018-02-01 01:50:28 +01:00
|
|
|
version_under_treble_tests := 27.0
|
|
|
|
|
include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk
|
2018-07-11 11:30:44 +02:00
|
|
|
version_under_treble_tests := 28.0
|
|
|
|
|
include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk
|
2019-06-02 02:04:13 +02:00
|
|
|
version_under_treble_tests := 29.0
|
|
|
|
|
include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk
|
2020-05-07 13:19:05 +02:00
|
|
|
version_under_treble_tests := 30.0
|
|
|
|
|
include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk
|
2021-06-15 14:05:39 +02:00
|
|
|
version_under_treble_tests := 31.0
|
|
|
|
|
include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk
|
2019-09-20 20:16:29 +02:00
|
|
|
endif # PRODUCT_SEPOLICY_SPLIT
|
2018-07-11 11:30:44 +02:00
|
|
|
|
2019-05-02 22:48:44 +02:00
|
|
|
version_under_treble_tests := 26.0
|
|
|
|
|
include $(LOCAL_PATH)/compat.mk
|
|
|
|
|
version_under_treble_tests := 27.0
|
|
|
|
|
include $(LOCAL_PATH)/compat.mk
|
|
|
|
|
version_under_treble_tests := 28.0
|
|
|
|
|
include $(LOCAL_PATH)/compat.mk
|
2019-06-02 02:04:13 +02:00
|
|
|
version_under_treble_tests := 29.0
|
|
|
|
|
include $(LOCAL_PATH)/compat.mk
|
2020-05-07 13:19:05 +02:00
|
|
|
version_under_treble_tests := 30.0
|
|
|
|
|
include $(LOCAL_PATH)/compat.mk
|
2021-06-15 14:05:39 +02:00
|
|
|
version_under_treble_tests := 31.0
|
|
|
|
|
include $(LOCAL_PATH)/compat.mk
|
2019-05-02 22:48:44 +02:00
|
|
|
|
2021-09-27 15:43:01 +02:00
|
|
|
built_plat_sepolicy :=
|
|
|
|
|
built_system_ext_sepolicy :=
|
|
|
|
|
built_product_sepolicy :=
|
|
|
|
|
base_plat_pub_policy.cil :=
|
|
|
|
|
base_system_ext_pub_polcy.cil :=
|
|
|
|
|
base_product_pub_policy.cil :=
|
Build contexts files with Soong
This is to migrate sepolicy Makefiles into Soong. For the first part,
file_contexts, hwservice_contexts, property_contexts, and
service_contexts are migrated. Build-time tests for contexts files are
still in Makefile; they will also be done with Soong after porting the
module sepolicy.
The motivation of migrating is based on generating property_contexts
dynamically: if we were to amend contexts files at build time in the
future, it would be nicer to manage them in Soong. To do that, building
contexts files with Soong can be very helpful.
Bug: 127949646
Bug: 129377144
Test: 1) Build blueline-userdebug, flash, and boot.
Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash,
and boot.
Test: 3) Build aosp_arm-userdebug.
Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
|
|
|
all_fc_files :=
|
|
|
|
|
all_fc_args :=
|
2017-09-26 21:58:29 +02:00
|
|
|
|
2018-03-15 19:38:08 +01:00
|
|
|
#################################
|
|
|
|
|
|
2012-10-18 03:09:52 +02:00
|
|
|
|
2018-02-05 10:34:52 +01:00
|
|
|
build_vendor_policy :=
|
2017-11-29 09:14:53 +01:00
|
|
|
build_odm_policy :=
|
2016-12-16 00:28:44 +01:00
|
|
|
build_policy :=
|
2017-02-25 23:47:53 +01:00
|
|
|
built_plat_cil :=
|
2019-08-29 11:12:11 +02:00
|
|
|
built_system_ext_cil :=
|
|
|
|
|
built_product_cil :=
|
2019-01-15 22:31:03 +01:00
|
|
|
built_pub_vers_cil :=
|
2019-01-16 00:16:55 +01:00
|
|
|
built_plat_mapping_cil :=
|
2019-08-29 11:12:11 +02:00
|
|
|
built_system_ext_mapping_cil :=
|
2019-01-16 00:16:55 +01:00
|
|
|
built_product_mapping_cil :=
|
2018-02-05 10:34:52 +01:00
|
|
|
built_vendor_cil :=
|
2017-11-27 04:41:33 +01:00
|
|
|
built_odm_cil :=
|
2017-03-07 23:05:57 +01:00
|
|
|
built_precompiled_sepolicy :=
|
2016-12-16 00:28:44 +01:00
|
|
|
built_sepolicy :=
|
2018-01-04 01:53:24 +01:00
|
|
|
built_sepolicy_neverallows :=
|
2016-12-28 00:10:48 +01:00
|
|
|
built_plat_svc :=
|
2018-02-05 10:34:52 +01:00
|
|
|
built_vendor_svc :=
|
2019-09-26 08:14:55 +02:00
|
|
|
treble_sysprop_neverallow :=
|
2020-09-28 06:32:43 +02:00
|
|
|
enforce_sysprop_owner :=
|
2021-04-27 01:32:17 +02:00
|
|
|
enforce_debugfs_restriction :=
|
2017-04-22 00:57:07 +02:00
|
|
|
mapping_policy :=
|
2016-12-16 00:28:44 +01:00
|
|
|
my_target_arch :=
|
2019-01-15 22:31:03 +01:00
|
|
|
pub_policy.cil :=
|
2019-08-29 11:12:11 +02:00
|
|
|
system_ext_pub_policy.cil :=
|
|
|
|
|
plat_pub_policy.cil :=
|
2016-11-28 16:20:28 +01:00
|
|
|
reqd_policy_mask.cil :=
|
2016-12-16 00:28:44 +01:00
|
|
|
sepolicy_build_files :=
|
Mark all clients of Allocator HAL
This change associates all domains which are clients of Allocator HAL
with hal_allocator_client and the, required for all HAL client
domains, halclientdomain.
This enables this commit to remove the now unnecessary hwallocator_use
macro because its binder_call(..., hal_allocator_server) is covered by
binder_call(hal_allocator_client, hal_allocator_server) added in this
commit.
Unfortunately apps, except isolated app, are clients of Allocator HAL
as well. This makes it hard to use the hal_client_domain(...,
hal_allocator) macro because it translates into "typeattribute" which
currently does not support being provided with a set of types, such as
{ appdomain -isolated_app }. As a workaround, hopefully until
typeattribute is improved, this commit expresses the necessary
association operation in CIL. private/technical_debt.cil introduced by
this commit is appended into the platform policy CIL file, thus
ensuring that the hack has effect on the final monolithic policy.
P. S. This change also removes Allocator HAL access from isolated_app.
Isolated app shouldn't have access to this HAL anyway.
Test: Google Play Music plays back radios
Test: Google Camera records video with sound and that video is then
successfully played back with sound
Test: YouTube app plays back clips with sound
Test: YouTube in Chrome plays back clips with sound
Bug: 34170079
Change-Id: Id00bba6fde83e7cf04fb58bc1c353c2f66333f92
2017-03-21 22:28:53 +01:00
|
|
|
sepolicy_build_cil_workaround_files :=
|
2017-03-13 20:22:15 +01:00
|
|
|
with_asan :=
|
2012-11-01 19:33:04 +01:00
|
|
|
|
|
|
|
|
include $(call all-makefiles-under,$(LOCAL_PATH))
|
