tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/treble_sepolicy_tests_for_release.mk

131 lines
6.6 KiB
Makefile
Raw Normal View History

Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
version := $(version_under_treble_tests)
include $(CLEAR_VARS)
# For Treble builds run tests verifying that processes are properly labeled and
# permissions granted do not violate the treble model. Also ensure that treble
# compatibility guarantees are upheld between SELinux version bumps.
LOCAL_MODULE := treble_sepolicy_tests_$(version)
Test files on intermediates dir, not on /system *_context_test / sepolicy_tests / treble_sepolicy_tests_* / sepolicy_freeze_test files are installed on /system/etc. By being FAKE modules, test files are not installed on target. Additionally, we need to set up dependency from droidcore to selinux_policy to make tests run on normal builds (m). Bug: 133460071 Test: m & see if tests run and no test files on /system/etc Test: m selinux_policy & see if tests run Change-Id: Icacf004d5c1c8ec720c7cedef7bae8aa648cbe49
2019-05-29 18:05:43 +02:00
LOCAL_MODULE_CLASS := FAKE
LOCAL_MODULE_TAGS := optional
Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
include $(BUILD_SYSTEM)/base_rules.mk
# $(version)_plat - the platform policy shipped as part of the $(version) release. This is
# built to enable us to determine the diff between the current policy and the
# $(version) policy, which will be used in tests to make sure that compatibility has
# been maintained by our mapping files.
$(version)_PLAT_PUBLIC_POLICY := $(LOCAL_PATH)/prebuilts/api/$(version)/public
$(version)_PLAT_PRIVATE_POLICY := $(LOCAL_PATH)/prebuilts/api/$(version)/private
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
policy_files := $(call build_policy, $(sepolicy_build_files), $($(version)_PLAT_PUBLIC_POLICY) $($(version)_PLAT_PRIVATE_POLICY))
Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
$(version)_plat_policy.conf := $(intermediates)/$(version)_plat_policy.conf
$($(version)_plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
$($(version)_plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Use user policy for compatibility tests. Use the user policy when running the compatibility tests. Bug: 74344625 Test: Built policy for many devices. Booted one device. Test: Delete some compat rules, verify error on userdebug. Change-Id: Ib2df2dfc06cdf55a839011e9a528e76160a9e436
2018-03-23 20:40:26 +01:00
$($(version)_plat_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := user
Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
$($(version)_plat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
$($(version)_plat_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
In native coverage builds, allow all domains to access /data/misc/trace Bug: http://b/135139675 Coverage files are written to /data/misc/trace (governed by the method_trace_data_file selinux type). Allow all domains to access (create directories, access files) this directory when native coverage is enabled (by setting NATIVE_COVERAGE to true) in an userdebug or eng build. Also relax neverallow constraints to allow access to method_trace_data_file for native coverage builds. Test: Build 32-bit cuttlefish with coverage: m NATIVE_COVERAGE=true COVERAGE_PATHS="*" and verify that there are no selinux denials in kernel log and logcat. Change-Id: I3fe7c77612854b9de7de7a0ddd5cbf44a2f5c21e
2019-06-14 00:05:15 +02:00
$($(version)_plat_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
$($(version)_plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$($(version)_plat_policy.conf): PRIVATE_SEPOLICY_SPLIT := true
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
$($(version)_plat_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
$($(version)_plat_policy.conf): $(policy_files) $(M4)
Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
$(transform-policy-to-conf)
$(hide) sed '/dontaudit/d' $@ > $@.dontaudit
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
policy_files :=
Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
built_$(version)_plat_sepolicy := $(intermediates)/built_$(version)_plat_sepolicy
$(built_$(version)_plat_sepolicy): PRIVATE_ADDITIONAL_CIL_FILES := \
$(call build_policy, technical_debt.cil , $($(version)_PLAT_PRIVATE_POLICY))
$(built_$(version)_plat_sepolicy): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
$(built_$(version)_plat_sepolicy): $($(version)_plat_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
$(HOST_OUT_EXECUTABLES)/secilc \
$(call build_policy, technical_debt.cil, $($(version)_PLAT_PRIVATE_POLICY)) \
$(built_sepolicy_neverallows)
@mkdir -p $(dir $@)
$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \
$(POLICYVERS) -o $@ $<
$(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@
$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $@ -o $@ -f /dev/null
$(version)_plat_policy.conf :=
# $(version)_compat - the current plat_sepolicy.cil built with the compatibility file
# targeting the $(version) SELinux release. This ensures that our policy will build
# when used on a device that has non-platform policy targetting the $(version) release.
$(version)_compat := $(intermediates)/$(version)_compat
Only maintain maps between current and previous selinux versions. New maintenance scheme for mapping files: Say, V is the current SELinux platform version, then at any point in time we only maintain (V->V-1) mapping. (V->V-n) map is constructed from top (V->V-n+1) and bottom (V-n+1->V-n) without changes to previously maintained mapping files. Caveats: - 26.0.cil doesn't technically represent 27.0->26.0 map, but rather current->26.0. We'll fully migrate to the scheme with future releases. Bug: 67510052 Test: adding new public type only requires changing the latest compat map Change-Id: Iab5564e887ef2c8004cb493505dd56c6220c61f8
2018-09-30 02:47:10 +02:00
$(version)_mapping.cil := $(call intermediates-dir-for,ETC,$(version).cil)/$(version).cil
$(version)_mapping.ignore.cil := \
$(call intermediates-dir-for,ETC,$(version).ignore.cil)/$(version).ignore.cil
Add mapping files for 28.0.[ignore.]cil Steps taken to produce the mapping files: 1. Add prebuilts/api/28.0/[plat_pub_versioned.cil|vendor_sepolicy.cil] from the /vendor/etc/selinux/[plat_pub_versioned.cil|vendor_sepolicy.cil] files built on pi-dev with lunch target aosp_arm64-eng 2. Add new file private/compat/28.0/28.0.cil by doing the following: - copy /system/etc/selinux/mapping/28.0.cil from pi-dev aosp_arm64-eng device to private/compat/28.0/28.0.cil - remove all attribute declaration statement (typeattribute ...) and sort lines alphabetically - some selinux types were added/renamed/deleted w.r.t 28 sepolicy. Find all such types using treble_sepolicy_tests_28.0 test. - for all these types figure out where to map them by looking at 27.0.[ignore.]cil files and add approprite entries to 28.0.[ignore.]cil. This change also enables treble_sepolicy_tests_28.0 and install 28.0.cil mapping onto the device. Bug: 72458734 Test: m selinux_policy Change-Id: I90e17c0b43af436da4b62c16179c198b5c74002c
2018-07-11 11:30:44 +02:00
$(version)_prebuilts_dir := $(LOCAL_PATH)/prebuilts/api/$(version)
# vendor_sepolicy.cil and plat_pub_versioned.cil are the new design to replace
# nonplat_sepolicy.cil.
$(version)_nonplat := $($(version)_prebuilts_dir)/vendor_sepolicy.cil \
$($(version)_prebuilts_dir)/plat_pub_versioned.cil
ifeq (,$(wildcard $($(version)_nonplat)))
$(version)_nonplat := $($(version)_prebuilts_dir)/nonplat_sepolicy.cil
endif
Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
$($(version)_compat): PRIVATE_CIL_FILES := \
$(built_plat_cil) $($(version)_mapping.cil) $($(version)_nonplat)
$($(version)_compat): $(HOST_OUT_EXECUTABLES)/secilc \
$(built_plat_cil) $($(version)_mapping.cil) $($(version)_nonplat)
$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -N -c $(POLICYVERS) \
$(PRIVATE_CIL_FILES) -o $@ -f /dev/null
# $(version)_mapping.combined.cil - a combination of the mapping file used when
# combining the current platform policy with nonplatform policy based on the
# $(version) policy release and also a special ignored file that exists purely for
# these tests.
$(version)_mapping.combined.cil := $(intermediates)/$(version)_mapping.combined.cil
$($(version)_mapping.combined.cil): $($(version)_mapping.cil) $($(version)_mapping.ignore.cil)
mkdir -p $(dir $@)
cat $^ > $@
Test files on intermediates dir, not on /system *_context_test / sepolicy_tests / treble_sepolicy_tests_* / sepolicy_freeze_test files are installed on /system/etc. By being FAKE modules, test files are not installed on target. Additionally, we need to set up dependency from droidcore to selinux_policy to make tests run on normal builds (m). Bug: 133460071 Test: m & see if tests run and no test files on /system/etc Test: m selinux_policy & see if tests run Change-Id: Icacf004d5c1c8ec720c7cedef7bae8aa648cbe49
2019-05-29 18:05:43 +02:00
$(LOCAL_BUILT_MODULE): ALL_FC_ARGS := $(all_fc_args)
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY_OLD := $(built_$(version)_plat_sepolicy)
$(LOCAL_BUILT_MODULE): PRIVATE_COMBINED_MAPPING := $($(version)_mapping.combined.cil)
$(LOCAL_BUILT_MODULE): PRIVATE_PLAT_SEPOLICY := $(built_plat_sepolicy)
$(LOCAL_BUILT_MODULE): PRIVATE_PLAT_PUB_SEPOLICY := $(base_plat_pub_policy.cil)
$(LOCAL_BUILT_MODULE): PRIVATE_FAKE_TREBLE :=
Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
ifeq ($(PRODUCT_FULL_TREBLE_OVERRIDE),true)
Don't check PRODUCT_SHIPPING_API_LEVEL to determine fake treble. Emulator device can not be considered a full treble device even though it has PRODUCT_SHIPPING_API_LEVEL = 28. This is prevents us from merging neverallow rules that implement Treble requirements (aosp/798433). As a temporary workaround, disable the checks on that variable. Bug: 112933807 Bug: 113124961 Bug: 111243627 Test: m selinux_policy Change-Id: I9a29c01dfcbc70e4ba1e4eef233355bc18ec2108
2018-10-31 22:18:15 +01:00
# TODO(b/113124961): account for PRODUCT_SHIPPING_API_LEVEL when determining
# fake treble status once emulator is no longer fake treble.
#ifdef PRODUCT_SHIPPING_API_LEVEL
Apply '--fake-treble' flag to the intended devices (for the build-time tests) treble_sepolicy_tests applies tests to the SEPolicy for devices which implement the SEPolicy split introduced in Android O. For devices which turn this on and also implement all of the other requirements which together compose PRODUCT_FULL_TREBLE, these tests help ensure that the backwards compatibility which this feature adds is possible. When this test was originally written, devices which specified PRODUCT_FULL_TREBLE_OVERRIDE were only those devices with a PRODUCT_SHIPPING_API_LEVEL of < 26. This allowed them to update to use these features but maintain some legacy behaviors. For these devices, to achieve the same backwards compatibility guarantees, much other/extra work would have to be done (if it is possible at all). Since that time, a new category of devices take advantage of PRODUCT_FULL_TREBLE_OVERRIDE. These devices must either not define a PRODUCT_SHIPPING_API_LEVEL or they apply this flag even though it is not required to be applied. For these cases, the full test suite not being run has caused problems because these failures aren't discoverred until later (when compliance tests are run). Fixes: 112933807 Test: treble_sepolicy_tests on marlin, walleye, and 'some other device' (mma here runs this with the correct parameters) Change-Id: I04c42d3cb86cda3c82f285919b40ba94e1332daa
2018-09-08 01:01:38 +02:00
# These requirements were originally added in Android Oreo. Devices
# launching after this should not distinguish between
# PRODUCT_FULL_TREBLE and PRODUCT_FULL_TREBLE_OVERRIDE since this could
# lead to release problems where they think they pass this test but
# fail it when it actually gets runned for compliance.
Don't check PRODUCT_SHIPPING_API_LEVEL to determine fake treble. Emulator device can not be considered a full treble device even though it has PRODUCT_SHIPPING_API_LEVEL = 28. This is prevents us from merging neverallow rules that implement Treble requirements (aosp/798433). As a temporary workaround, disable the checks on that variable. Bug: 112933807 Bug: 113124961 Bug: 111243627 Test: m selinux_policy Change-Id: I9a29c01dfcbc70e4ba1e4eef233355bc18ec2108
2018-10-31 22:18:15 +01:00
#ifeq ($(call math_gt_or_eq,$(PRODUCT_SHIPPING_API_LEVEL),26),)
Test files on intermediates dir, not on /system *_context_test / sepolicy_tests / treble_sepolicy_tests_* / sepolicy_freeze_test files are installed on /system/etc. By being FAKE modules, test files are not installed on target. Additionally, we need to set up dependency from droidcore to selinux_policy to make tests run on normal builds (m). Bug: 133460071 Test: m & see if tests run and no test files on /system/etc Test: m selinux_policy & see if tests run Change-Id: Icacf004d5c1c8ec720c7cedef7bae8aa648cbe49
2019-05-29 18:05:43 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_FAKE_TREBLE := --fake-treble
Don't check PRODUCT_SHIPPING_API_LEVEL to determine fake treble. Emulator device can not be considered a full treble device even though it has PRODUCT_SHIPPING_API_LEVEL = 28. This is prevents us from merging neverallow rules that implement Treble requirements (aosp/798433). As a temporary workaround, disable the checks on that variable. Bug: 112933807 Bug: 113124961 Bug: 111243627 Test: m selinux_policy Change-Id: I9a29c01dfcbc70e4ba1e4eef233355bc18ec2108
2018-10-31 22:18:15 +01:00
#endif # if PRODUCT_SHIPPING_API_LEVEL < 26 (Android Oreo)
#endif # PRODUCT_SHIPPING_API_LEVEL defined
Apply '--fake-treble' flag to the intended devices (for the build-time tests) treble_sepolicy_tests applies tests to the SEPolicy for devices which implement the SEPolicy split introduced in Android O. For devices which turn this on and also implement all of the other requirements which together compose PRODUCT_FULL_TREBLE, these tests help ensure that the backwards compatibility which this feature adds is possible. When this test was originally written, devices which specified PRODUCT_FULL_TREBLE_OVERRIDE were only those devices with a PRODUCT_SHIPPING_API_LEVEL of < 26. This allowed them to update to use these features but maintain some legacy behaviors. For these devices, to achieve the same backwards compatibility guarantees, much other/extra work would have to be done (if it is possible at all). Since that time, a new category of devices take advantage of PRODUCT_FULL_TREBLE_OVERRIDE. These devices must either not define a PRODUCT_SHIPPING_API_LEVEL or they apply this flag even though it is not required to be applied. For these cases, the full test suite not being run has caused problems because these failures aren't discoverred until later (when compliance tests are run). Fixes: 112933807 Test: treble_sepolicy_tests on marlin, walleye, and 'some other device' (mma here runs this with the correct parameters) Change-Id: I04c42d3cb86cda3c82f285919b40ba94e1332daa
2018-09-08 01:01:38 +02:00
endif # PRODUCT_FULL_TREBLE_OVERRIDE = true
Test files on intermediates dir, not on /system *_context_test / sepolicy_tests / treble_sepolicy_tests_* / sepolicy_freeze_test files are installed on /system/etc. By being FAKE modules, test files are not installed on target. Additionally, we need to set up dependency from droidcore to selinux_policy to make tests run on normal builds (m). Bug: 133460071 Test: m & see if tests run and no test files on /system/etc Test: m selinux_policy & see if tests run Change-Id: Icacf004d5c1c8ec720c7cedef7bae8aa648cbe49
2019-05-29 18:05:43 +02:00
$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/treble_sepolicy_tests \
Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
$(all_fc_files) $(built_sepolicy) $(built_plat_sepolicy) \
Don't require private types in mapping file. Private types are not visible to vendor/odm policy, so we don't need mapping entries for them. We build platform-only public policy .cil file and give it as input to treble_sepolicy_tests. Using this public policy the test can now figure out if the newly added type in public or private. Bug: 116344577 Test: adding public type triggers mapping test failure, adding private type does not. Change-Id: I421f335e37274b24aa73109e260653d7b73788b5
2018-09-29 02:21:08 +02:00
$(base_plat_pub_policy.cil) \
Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
$(built_$(version)_plat_sepolicy) $($(version)_compat) $($(version)_mapping.combined.cil)
@mkdir -p $(dir $@)
$(hide) $(HOST_OUT_EXECUTABLES)/treble_sepolicy_tests -l \
$(HOST_OUT)/lib64/libsepolwrap.$(SHAREDLIB_EXT) $(ALL_FC_ARGS) \
-b $(PRIVATE_PLAT_SEPOLICY) -m $(PRIVATE_COMBINED_MAPPING) \
-o $(PRIVATE_SEPOLICY_OLD) -p $(PRIVATE_SEPOLICY) \
Don't require private types in mapping file. Private types are not visible to vendor/odm policy, so we don't need mapping entries for them. We build platform-only public policy .cil file and give it as input to treble_sepolicy_tests. Using this public policy the test can now figure out if the newly added type in public or private. Bug: 116344577 Test: adding public type triggers mapping test failure, adding private type does not. Change-Id: I421f335e37274b24aa73109e260653d7b73788b5
2018-09-29 02:21:08 +02:00
-u $(PRIVATE_PLAT_PUB_SEPOLICY) \
Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
$(PRIVATE_FAKE_TREBLE)
$(hide) touch $@
$(version)_PLAT_PUBLIC_POLICY :=
$(version)_PLAT_PRIVATE_POLICY :=
$(version)_compat :=
$(version)_mapping.cil :=
$(version)_mapping.combined.cil :=
$(version)_mapping.ignore.cil :=
$(version)_nonplat :=
Add mapping files for 28.0.[ignore.]cil Steps taken to produce the mapping files: 1. Add prebuilts/api/28.0/[plat_pub_versioned.cil|vendor_sepolicy.cil] from the /vendor/etc/selinux/[plat_pub_versioned.cil|vendor_sepolicy.cil] files built on pi-dev with lunch target aosp_arm64-eng 2. Add new file private/compat/28.0/28.0.cil by doing the following: - copy /system/etc/selinux/mapping/28.0.cil from pi-dev aosp_arm64-eng device to private/compat/28.0/28.0.cil - remove all attribute declaration statement (typeattribute ...) and sort lines alphabetically - some selinux types were added/renamed/deleted w.r.t 28 sepolicy. Find all such types using treble_sepolicy_tests_28.0 test. - for all these types figure out where to map them by looking at 27.0.[ignore.]cil files and add approprite entries to 28.0.[ignore.]cil. This change also enables treble_sepolicy_tests_28.0 and install 28.0.cil mapping onto the device. Bug: 72458734 Test: m selinux_policy Change-Id: I90e17c0b43af436da4b62c16179c198b5c74002c
2018-07-11 11:30:44 +02:00
$(version)_prebuilts_dir :=
Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
built_$(version)_plat_sepolicy :=
version :=
version_under_treble_tests :=
Reference in a new issue Copy permalink