tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/definitions.mk

18 lines
744 B
Makefile
Raw Normal View History

Add sepolicy definitions.mk and create policy.conf function. Bug: 36899958 Test: Builds 'n' boots. Change-Id: I5836a18f9d0a9a976dda7304045e3b9e1e84565e Merged-In: I5836a18f9d0a9a976dda7304045e3b9e1e84565e (cherry picked from commit c0713e86790583dacbd8545d35ae476ff1f849bb)
2017-07-07 23:59:51 +02:00
# Command to turn collection of policy files into a policy.conf file to be
# processed by checkpolicy
define transform-policy-to-conf
@mkdir -p $(dir $@)
m4: add --fatal-warnings Error out if m4 generates a warning. This will help detect and prevent malformed macros. See 855084960feb9e593a3bca288ab328a34a99ac57 for motivation. Test: policy compiles Test: Policy doesn't compile if 855084960feb9e593a3bca288ab328a34a99ac57 is reverted. Change-Id: Iee6b6273bc2a24b1220861fd662573e76001defc
2018-08-15 18:55:27 +02:00
$(hide) m4 --fatal-warnings $(PRIVATE_ADDITIONAL_M4DEFS) \
Add sepolicy definitions.mk and create policy.conf function. Bug: 36899958 Test: Builds 'n' boots. Change-Id: I5836a18f9d0a9a976dda7304045e3b9e1e84565e Merged-In: I5836a18f9d0a9a976dda7304045e3b9e1e84565e (cherry picked from commit c0713e86790583dacbd8545d35ae476ff1f849bb)
2017-07-07 23:59:51 +02:00
-D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
Use user policy when checking neverallow rules. When building userdebug or eng builds, we still want to build the user policy when checking neverallow rules so that we can catch compile errors. Commit c0713e86 split out a helper function but lost one instance of using user instead of the real variant. This restores that one and adds it to the neverallow check. Bug: 74344625 Test: Added a rule that referred to a type defined only in userdebug and eng and ensure we throw a compile error when building userdebug mode. Change-Id: I1a6ffbb36dbeeb880852f9cbac880f923370c2ae (cherry picked from commit 053cb34130b763d93e2181062ebe1b5f8bf3ad9c)
2018-03-08 00:36:29 +01:00
-D target_build_variant=$(PRIVATE_TARGET_BUILD_VARIANT) \
Add sepolicy definitions.mk and create policy.conf function. Bug: 36899958 Test: Builds 'n' boots. Change-Id: I5836a18f9d0a9a976dda7304045e3b9e1e84565e Merged-In: I5836a18f9d0a9a976dda7304045e3b9e1e84565e (cherry picked from commit c0713e86790583dacbd8545d35ae476ff1f849bb)
2017-07-07 23:59:51 +02:00
-D target_with_dexpreopt=$(WITH_DEXPREOPT) \
-D target_arch=$(PRIVATE_TGT_ARCH) \
-D target_with_asan=$(PRIVATE_TGT_WITH_ASAN) \
Use PRODUCT_SEPOLICY_SPLIT for full Treble. PRODUCT_FULL_TREBLE is being broken up into smaller, more manageable components. Bug: 62019611 Test: manual Change-Id: I9b65f120851d9ea134a0059a417f0282777717fc
2017-11-09 20:24:56 +01:00
-D target_full_treble=$(PRIVATE_SEPOLICY_SPLIT) \
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
-D target_compatible_property=$(PRIVATE_COMPATIBLE_PROPERTY) \
Mechanism to exclude neverallows from *TS. build_test_only is used to denote rules that should not verified as part of compliance testing. Use this macro to exclude neverallow rules which we want to check as part of build, but not CTS. Bug: 80499271 Test: SELinuxNeverallowRulesTest on walleye has no more failure of type "Type or attribute * used in neverallow undefined in policy being checked." Number of failing test cases is reduced by 142. Test: policy.conf used to check neverallows at build-time still retains all neverallow rules. Change-Id: I5f1b383d9096bb5a7b8c0f1bc008b5dd07419580
2018-06-05 23:11:08 +02:00
-D target_exclude_build_test=$(PRIVATE_EXCLUDE_BUILD_TEST) \
Add sepolicy definitions.mk and create policy.conf function. Bug: 36899958 Test: Builds 'n' boots. Change-Id: I5836a18f9d0a9a976dda7304045e3b9e1e84565e Merged-In: I5836a18f9d0a9a976dda7304045e3b9e1e84565e (cherry picked from commit c0713e86790583dacbd8545d35ae476ff1f849bb)
2017-07-07 23:59:51 +02:00
$(PRIVATE_TGT_RECOVERY) \
-s $^ > $@
endef
.KATI_READONLY := transform-policy-to-conf
Reference in a new issue Copy permalink