2012-01-04 18:33:27 +01:00
|
|
|
LOCAL_PATH:= $(call my-dir)
|
2012-08-28 00:41:15 +02:00
|
|
|
|
2017-03-23 00:20:24 +01:00
|
|
|
include $(CLEAR_VARS)
|
2012-01-04 18:33:27 +01:00
|
|
|
|
2015-04-01 16:14:56 +02:00
|
|
|
ifdef BOARD_SEPOLICY_UNION
|
|
|
|
|
$(warning BOARD_SEPOLICY_UNION is no longer required - all files found in BOARD_SEPOLICY_DIRS are implicitly unioned; please remove from your BoardConfig.mk or other .mk file.)
|
|
|
|
|
endif
|
|
|
|
|
|
2015-07-16 20:28:02 +02:00
|
|
|
ifdef BOARD_SEPOLICY_M4DEFS
|
|
|
|
|
LOCAL_ADDITIONAL_M4DEFS := $(addprefix -D, $(BOARD_SEPOLICY_M4DEFS))
|
2017-07-07 23:59:51 +02:00
|
|
|
else
|
|
|
|
|
LOCAL_ADDITIONAL_M4DEFS :=
|
2015-07-16 20:28:02 +02:00
|
|
|
endif
|
|
|
|
|
|
2016-07-22 22:13:11 +02:00
|
|
|
# sepolicy is now divided into multiple portions:
|
|
|
|
|
# public - policy exported on which non-platform policy developers may write
|
|
|
|
|
# additional policy. types and attributes are versioned and included in
|
|
|
|
|
# delivered non-platform policy, which is to be combined with platform policy.
|
|
|
|
|
# private - platform-only policy required for platform functionality but which
|
|
|
|
|
# is not exported to vendor policy developers and as such may not be assumed
|
|
|
|
|
# to exist.
|
2017-01-31 03:44:59 +01:00
|
|
|
# vendor - vendor-only policy required for vendor functionality. This policy can
|
|
|
|
|
# reference the public policy but cannot reference the private policy. This
|
|
|
|
|
# policy is for components which are produced from the core/non-vendor tree and
|
|
|
|
|
# placed into a vendor partition.
|
2016-12-07 20:27:47 +01:00
|
|
|
# mapping - This contains policy statements which map the attributes
|
2016-07-22 22:13:11 +02:00
|
|
|
# exposed in the public policy of previous versions to the concrete types used
|
|
|
|
|
# in this policy to ensure that policy targeting attributes from public
|
|
|
|
|
# policy from an older platform version continues to work.
|
|
|
|
|
|
2016-10-12 23:58:09 +02:00
|
|
|
# build process for device:
|
2016-07-22 22:13:11 +02:00
|
|
|
# 1) convert policies to CIL:
|
|
|
|
|
# - private + public platform policy to CIL
|
|
|
|
|
# - mapping file to CIL (should already be in CIL form)
|
|
|
|
|
# - non-platform public policy to CIL
|
|
|
|
|
# - non-platform public + private policy to CIL
|
|
|
|
|
# 2) attributize policy
|
|
|
|
|
# - run script which takes non-platform public and non-platform combined
|
|
|
|
|
# private + public policy and produces attributized and versioned
|
|
|
|
|
# non-platform policy
|
|
|
|
|
# 3) combine policy files
|
|
|
|
|
# - combine mapping, platform and non-platform policy.
|
|
|
|
|
# - compile output binary policy file
|
|
|
|
|
|
|
|
|
|
PLAT_PUBLIC_POLICY := $(LOCAL_PATH)/public
|
|
|
|
|
PLAT_PRIVATE_POLICY := $(LOCAL_PATH)/private
|
2017-01-31 03:44:59 +01:00
|
|
|
PLAT_VENDOR_POLICY := $(LOCAL_PATH)/vendor
|
2016-10-12 23:58:09 +02:00
|
|
|
REQD_MASK_POLICY := $(LOCAL_PATH)/reqd_mask
|
2020-07-14 21:28:51 +02:00
|
|
|
|
|
|
|
|
SYSTEM_EXT_PUBLIC_POLICY := $(SYSTEM_EXT_PUBLIC_SEPOLICY_DIRS)
|
|
|
|
|
SYSTEM_EXT_PRIVATE_POLICY := $(SYSTEM_EXT_PRIVATE_SEPOLICY_DIRS)
|
|
|
|
|
|
2019-02-01 20:41:08 +01:00
|
|
|
PRODUCT_PUBLIC_POLICY := $(PRODUCT_PUBLIC_SEPOLICY_DIRS)
|
|
|
|
|
PRODUCT_PRIVATE_POLICY := $(PRODUCT_PRIVATE_SEPOLICY_DIRS)
|
2018-12-14 23:30:56 +01:00
|
|
|
|
2019-08-29 11:12:11 +02:00
|
|
|
ifneq (,$(SYSTEM_EXT_PUBLIC_POLICY)$(SYSTEM_EXT_PRIVATE_POLICY))
|
Allowing system_ext sepolicy to be empty
Some targets just need to extend system_ext context files, e.g.,
file_contexts, service_contexts, etc., without adding any system_ext
policy files, e.g., *.te files.
Currently, this will lead to build errors. This CL allows
system_ext_sepolicy.cil and the system_ext mapping file
to be empty.
It's now also possible to just set BOARD_PLAT_PRIVATE_SEPOLICY_DIR
without setting BOARD_PLAT_PUBLIC_SEPOLICY_DIR.
Bug: 137712473
Bug: 141880898
Test: Only adds system_ext context files without policy files (e.g., *.te),
then `mmma system/sepolicy` can build pass
Change-Id: I72849f2d4aa43e5296cd15c07a8fd058186a6376
2019-10-04 08:34:18 +02:00
|
|
|
HAS_SYSTEM_EXT_SEPOLICY_DIR := true
|
2019-08-29 11:12:11 +02:00
|
|
|
endif
|
|
|
|
|
|
2018-12-14 23:30:56 +01:00
|
|
|
# TODO(b/119305624): Currently if the device doesn't have a product partition,
|
|
|
|
|
# we install product sepolicy into /system/product. We do that because bits of
|
|
|
|
|
# product sepolicy that's still in /system might depend on bits that have moved
|
|
|
|
|
# to /product. Once we finish migrating product sepolicy out of system, change
|
|
|
|
|
# it so that if no product partition is present, product sepolicy artifacts are
|
|
|
|
|
# not built and installed at all.
|
|
|
|
|
ifneq (,$(PRODUCT_PUBLIC_POLICY)$(PRODUCT_PRIVATE_POLICY))
|
2019-10-04 09:36:05 +02:00
|
|
|
HAS_PRODUCT_SEPOLICY_DIR := true
|
2018-12-14 23:30:56 +01:00
|
|
|
endif
|
2016-10-12 23:58:09 +02:00
|
|
|
|
2018-01-04 01:53:24 +01:00
|
|
|
ifeq ($(SELINUX_IGNORE_NEVERALLOWS),true)
|
|
|
|
|
ifeq ($(TARGET_BUILD_VARIANT),user)
|
|
|
|
|
$(error SELINUX_IGNORE_NEVERALLOWS := true cannot be used in user builds)
|
|
|
|
|
endif
|
|
|
|
|
$(warning Be careful when using the SELINUX_IGNORE_NEVERALLOWS flag. \
|
|
|
|
|
It does not work in user builds and using it will \
|
|
|
|
|
not stop you from failing CTS.)
|
|
|
|
|
endif
|
|
|
|
|
|
2017-11-27 04:41:33 +01:00
|
|
|
# BOARD_SEPOLICY_DIRS was used for vendor/odm sepolicy customization before.
|
|
|
|
|
# It has been replaced by BOARD_VENDOR_SEPOLICY_DIRS (mandatory) and
|
|
|
|
|
# BOARD_ODM_SEPOLICY_DIRS (optional). BOARD_SEPOLICY_DIRS is still allowed for
|
|
|
|
|
# backward compatibility, which will be merged into BOARD_VENDOR_SEPOLICY_DIRS.
|
2018-02-05 10:34:52 +01:00
|
|
|
ifdef BOARD_SEPOLICY_DIRS
|
|
|
|
|
BOARD_VENDOR_SEPOLICY_DIRS += $(BOARD_SEPOLICY_DIRS)
|
|
|
|
|
endif
|
2017-04-12 23:28:34 +02:00
|
|
|
|
2016-07-22 22:13:11 +02:00
|
|
|
###########################################################
|
|
|
|
|
# Compute policy files to be used in policy build.
|
|
|
|
|
# $(1): files to include
|
|
|
|
|
# $(2): directories in which to find files
|
|
|
|
|
###########################################################
|
|
|
|
|
|
|
|
|
|
define build_policy
|
2021-10-01 00:48:34 +02:00
|
|
|
$(strip $(foreach type, $(1), $(foreach file, $(addsuffix /$(type), $(2)), $(sort $(wildcard $(file))))))
|
2016-07-22 22:13:11 +02:00
|
|
|
endef
|
2016-01-04 21:20:57 +01:00
|
|
|
|
2014-07-26 04:11:52 +02:00
|
|
|
sepolicy_build_files := security_classes \
|
|
|
|
|
initial_sids \
|
|
|
|
|
access_vectors \
|
|
|
|
|
global_macros \
|
2014-11-06 00:30:41 +01:00
|
|
|
neverallow_macros \
|
2014-07-26 04:11:52 +02:00
|
|
|
mls_macros \
|
2016-10-12 23:58:09 +02:00
|
|
|
mls_decl \
|
2014-07-26 04:11:52 +02:00
|
|
|
mls \
|
|
|
|
|
policy_capabilities \
|
|
|
|
|
te_macros \
|
|
|
|
|
attributes \
|
2015-12-22 19:39:34 +01:00
|
|
|
ioctl_defines \
|
2015-06-06 00:28:55 +02:00
|
|
|
ioctl_macros \
|
2014-07-26 04:11:52 +02:00
|
|
|
*.te \
|
2016-10-12 23:58:09 +02:00
|
|
|
roles_decl \
|
2014-07-26 04:11:52 +02:00
|
|
|
roles \
|
|
|
|
|
users \
|
|
|
|
|
initial_sid_contexts \
|
|
|
|
|
fs_use \
|
|
|
|
|
genfs_contexts \
|
|
|
|
|
port_contexts
|
|
|
|
|
|
2020-09-22 00:32:16 +02:00
|
|
|
sepolicy_compat_files := $(foreach ver, $(PLATFORM_SEPOLICY_COMPAT_VERSIONS), \
|
|
|
|
|
$(addprefix compat/$(ver)/, $(addsuffix .cil, $(ver))))
|
|
|
|
|
|
2019-10-08 01:31:40 +02:00
|
|
|
# Security classes and permissions defined outside of system/sepolicy.
|
|
|
|
|
security_class_extension_files := $(call build_policy, security_classes access_vectors, \
|
|
|
|
|
$(SYSTEM_EXT_PUBLIC_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY) \
|
|
|
|
|
$(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY) \
|
|
|
|
|
$(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_ODM_SEPOLICY_DIRS))
|
|
|
|
|
|
|
|
|
|
ifneq (,$(strip $(security_class_extension_files)))
|
|
|
|
|
$(error Only platform SELinux policy may define classes and permissions: $(strip $(security_class_extension_files)))
|
|
|
|
|
endif
|
|
|
|
|
|
Allowing system_ext sepolicy to be empty
Some targets just need to extend system_ext context files, e.g.,
file_contexts, service_contexts, etc., without adding any system_ext
policy files, e.g., *.te files.
Currently, this will lead to build errors. This CL allows
system_ext_sepolicy.cil and the system_ext mapping file
to be empty.
It's now also possible to just set BOARD_PLAT_PRIVATE_SEPOLICY_DIR
without setting BOARD_PLAT_PUBLIC_SEPOLICY_DIR.
Bug: 137712473
Bug: 141880898
Test: Only adds system_ext context files without policy files (e.g., *.te),
then `mmma system/sepolicy` can build pass
Change-Id: I72849f2d4aa43e5296cd15c07a8fd058186a6376
2019-10-04 08:34:18 +02:00
|
|
|
ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR
|
|
|
|
|
# Checks if there are public system_ext policy files.
|
|
|
|
|
policy_files := $(call build_policy, $(sepolicy_build_files), $(SYSTEM_EXT_PUBLIC_POLICY))
|
|
|
|
|
ifneq (,$(strip $(policy_files)))
|
|
|
|
|
HAS_SYSTEM_EXT_PUBLIC_SEPOLICY := true
|
|
|
|
|
endif
|
|
|
|
|
# Checks if there are public/private system_ext policy files.
|
|
|
|
|
policy_files := $(call build_policy, $(sepolicy_build_files), $(SYSTEM_EXT_PUBLIC_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY))
|
|
|
|
|
ifneq (,$(strip $(policy_files)))
|
|
|
|
|
HAS_SYSTEM_EXT_SEPOLICY := true
|
|
|
|
|
endif
|
|
|
|
|
endif # ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR
|
|
|
|
|
|
2019-10-04 09:36:05 +02:00
|
|
|
ifdef HAS_PRODUCT_SEPOLICY_DIR
|
|
|
|
|
# Checks if there are public product policy files.
|
|
|
|
|
policy_files := $(call build_policy, $(sepolicy_build_files), $(PRODUCT_PUBLIC_POLICY))
|
|
|
|
|
ifneq (,$(strip $(policy_files)))
|
|
|
|
|
HAS_PRODUCT_PUBLIC_SEPOLICY := true
|
|
|
|
|
endif
|
|
|
|
|
# Checks if there are public/private product policy files.
|
|
|
|
|
policy_files := $(call build_policy, $(sepolicy_build_files), $(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY))
|
|
|
|
|
ifneq (,$(strip $(policy_files)))
|
|
|
|
|
HAS_PRODUCT_SEPOLICY := true
|
|
|
|
|
endif
|
|
|
|
|
endif # ifdef HAS_PRODUCT_SEPOLICY_DIR
|
|
|
|
|
|
2017-03-13 20:22:15 +01:00
|
|
|
with_asan := false
|
|
|
|
|
ifneq (,$(filter address,$(SANITIZE_TARGET)))
|
|
|
|
|
with_asan := true
|
|
|
|
|
endif
|
|
|
|
|
|
2023-08-23 04:07:40 +02:00
|
|
|
ifeq ($(PRODUCT_SHIPPING_API_LEVEL),)
|
|
|
|
|
#$(warning no product shipping level defined)
|
|
|
|
|
else ifneq ($(call math_lt,29,$(PRODUCT_SHIPPING_API_LEVEL)),)
|
|
|
|
|
ifneq ($(BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW),)
|
|
|
|
|
$(error BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW cannot be set on a device shipping with R or later, and this is tested by CTS.)
|
|
|
|
|
endif
|
|
|
|
|
endif
|
|
|
|
|
|
|
|
|
|
ifeq ($(PRODUCT_SHIPPING_API_LEVEL),)
|
2020-09-28 06:32:43 +02:00
|
|
|
#$(warning no product shipping level defined)
|
2023-08-23 04:07:40 +02:00
|
|
|
else ifneq ($(call math_lt,30,$(PRODUCT_SHIPPING_API_LEVEL)),)
|
|
|
|
|
ifneq ($(BUILD_BROKEN_ENFORCE_SYSPROP_OWNER),)
|
2020-09-28 06:32:43 +02:00
|
|
|
$(error BUILD_BROKEN_ENFORCE_SYSPROP_OWNER cannot be set on a device shipping with S or later, and this is tested by CTS.)
|
|
|
|
|
endif
|
|
|
|
|
endif
|
|
|
|
|
|
2018-07-02 15:31:29 +02:00
|
|
|
#################################
|
|
|
|
|
|
2017-04-10 21:27:18 +02:00
|
|
|
include $(CLEAR_VARS)
|
2018-07-02 15:31:29 +02:00
|
|
|
|
2017-04-10 21:27:18 +02:00
|
|
|
LOCAL_MODULE := selinux_policy
|
2021-02-04 08:07:40 +01:00
|
|
|
LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
|
|
|
|
|
LOCAL_LICENSE_CONDITIONS := notice unencumbered
|
|
|
|
|
LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
|
2017-04-10 21:27:18 +02:00
|
|
|
LOCAL_MODULE_TAGS := optional
|
2018-05-09 03:52:11 +02:00
|
|
|
LOCAL_REQUIRED_MODULES += \
|
2018-07-02 15:31:29 +02:00
|
|
|
selinux_policy_nonsystem \
|
|
|
|
|
selinux_policy_system \
|
2018-05-09 03:52:11 +02:00
|
|
|
|
2018-07-02 15:31:29 +02:00
|
|
|
include $(BUILD_PHONY_PACKAGE)
|
2018-05-09 03:52:11 +02:00
|
|
|
|
2019-05-29 18:05:43 +02:00
|
|
|
# selinux_policy is a main goal and triggers lots of tests.
|
|
|
|
|
# Most tests are FAKE modules, so aren'triggered on normal builds. (e.g. 'm')
|
|
|
|
|
# By setting as droidcore's dependency, tests will run on normal builds.
|
|
|
|
|
droidcore: selinux_policy
|
2018-05-09 03:52:11 +02:00
|
|
|
|
2018-07-02 15:31:29 +02:00
|
|
|
include $(CLEAR_VARS)
|
|
|
|
|
LOCAL_MODULE := selinux_policy_system
|
2021-02-04 08:07:40 +01:00
|
|
|
LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
|
|
|
|
|
LOCAL_LICENSE_CONDITIONS := notice unencumbered
|
|
|
|
|
LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
|
2018-05-09 03:52:11 +02:00
|
|
|
# These build targets are not used on non-Treble devices. However, we build these to avoid
|
|
|
|
|
# divergence between Treble and non-Treble devices.
|
2017-04-10 21:27:18 +02:00
|
|
|
LOCAL_REQUIRED_MODULES += \
|
2019-01-16 00:16:55 +01:00
|
|
|
plat_mapping_file \
|
2019-10-11 01:29:40 +02:00
|
|
|
$(addprefix plat_,$(addsuffix .cil,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS))) \
|
2019-05-02 22:48:44 +02:00
|
|
|
$(addsuffix .compat.cil,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS)) \
|
2017-04-10 21:27:18 +02:00
|
|
|
plat_sepolicy.cil \
|
|
|
|
|
secilc \
|
2017-09-26 21:58:29 +02:00
|
|
|
|
2024-02-13 03:19:24 +01:00
|
|
|
# HACK to support vendor blobs using 1000000.0
|
|
|
|
|
# TODO(b/314010177): remove after new ToT (202404) fully propagates
|
|
|
|
|
ifneq (true,$(BOARD_API_LEVEL_FROZEN))
|
|
|
|
|
LOCAL_REQUIRED_MODULES += plat_mapping_file_1000000.0
|
|
|
|
|
endif
|
|
|
|
|
|
2020-11-09 12:58:58 +01:00
|
|
|
ifneq ($(PRODUCT_PRECOMPILED_SEPOLICY),false)
|
|
|
|
|
LOCAL_REQUIRED_MODULES += plat_sepolicy_and_mapping.sha256
|
|
|
|
|
endif
|
|
|
|
|
|
2017-06-08 22:24:15 +02:00
|
|
|
LOCAL_REQUIRED_MODULES += \
|
2018-02-05 10:41:02 +01:00
|
|
|
build_sepolicy \
|
2017-08-22 22:29:53 +02:00
|
|
|
plat_file_contexts \
|
Build contexts files with Soong
This is to migrate sepolicy Makefiles into Soong. For the first part,
file_contexts, hwservice_contexts, property_contexts, and
service_contexts are migrated. Build-time tests for contexts files are
still in Makefile; they will also be done with Soong after porting the
module sepolicy.
The motivation of migrating is based on generating property_contexts
dynamically: if we were to amend contexts files at build time in the
future, it would be nicer to manage them in Soong. To do that, building
contexts files with Soong can be very helpful.
Bug: 127949646
Bug: 129377144
Test: 1) Build blueline-userdebug, flash, and boot.
Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash,
and boot.
Test: 3) Build aosp_arm-userdebug.
Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
|
|
|
plat_file_contexts_test \
|
2020-07-25 22:02:29 +02:00
|
|
|
plat_keystore2_key_contexts \
|
2017-08-22 22:29:53 +02:00
|
|
|
plat_mac_permissions.xml \
|
|
|
|
|
plat_property_contexts \
|
Build contexts files with Soong
This is to migrate sepolicy Makefiles into Soong. For the first part,
file_contexts, hwservice_contexts, property_contexts, and
service_contexts are migrated. Build-time tests for contexts files are
still in Makefile; they will also be done with Soong after porting the
module sepolicy.
The motivation of migrating is based on generating property_contexts
dynamically: if we were to amend contexts files at build time in the
future, it would be nicer to manage them in Soong. To do that, building
contexts files with Soong can be very helpful.
Bug: 127949646
Bug: 129377144
Test: 1) Build blueline-userdebug, flash, and boot.
Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash,
and boot.
Test: 3) Build aosp_arm-userdebug.
Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
|
|
|
plat_property_contexts_test \
|
2017-08-22 22:29:53 +02:00
|
|
|
plat_seapp_contexts \
|
|
|
|
|
plat_service_contexts \
|
Build contexts files with Soong
This is to migrate sepolicy Makefiles into Soong. For the first part,
file_contexts, hwservice_contexts, property_contexts, and
service_contexts are migrated. Build-time tests for contexts files are
still in Makefile; they will also be done with Soong after porting the
module sepolicy.
The motivation of migrating is based on generating property_contexts
dynamically: if we were to amend contexts files at build time in the
future, it would be nicer to manage them in Soong. To do that, building
contexts files with Soong can be very helpful.
Bug: 127949646
Bug: 129377144
Test: 1) Build blueline-userdebug, flash, and boot.
Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash,
and boot.
Test: 3) Build aosp_arm-userdebug.
Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
|
|
|
plat_service_contexts_test \
|
2017-08-22 22:29:53 +02:00
|
|
|
plat_hwservice_contexts \
|
Build contexts files with Soong
This is to migrate sepolicy Makefiles into Soong. For the first part,
file_contexts, hwservice_contexts, property_contexts, and
service_contexts are migrated. Build-time tests for contexts files are
still in Makefile; they will also be done with Soong after porting the
module sepolicy.
The motivation of migrating is based on generating property_contexts
dynamically: if we were to amend contexts files at build time in the
future, it would be nicer to manage them in Soong. To do that, building
contexts files with Soong can be very helpful.
Bug: 127949646
Bug: 129377144
Test: 1) Build blueline-userdebug, flash, and boot.
Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash,
and boot.
Test: 3) Build aosp_arm-userdebug.
Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
|
|
|
plat_hwservice_contexts_test \
|
2022-09-13 01:20:53 +02:00
|
|
|
fuzzer_bindings_test \
|
2021-11-08 12:30:04 +01:00
|
|
|
plat_bug_map \
|
2017-09-26 21:58:29 +02:00
|
|
|
searchpolicy \
|
2018-07-02 15:31:29 +02:00
|
|
|
|
2017-09-26 21:58:29 +02:00
|
|
|
ifneq ($(with_asan),true)
|
2018-02-14 05:29:55 +01:00
|
|
|
ifneq ($(SELINUX_IGNORE_NEVERALLOWS),true)
|
2017-09-26 21:58:29 +02:00
|
|
|
LOCAL_REQUIRED_MODULES += \
|
2022-01-07 01:15:27 +01:00
|
|
|
sepolicy_compat_test \
|
2017-09-26 21:58:29 +02:00
|
|
|
|
2022-02-25 03:26:16 +01:00
|
|
|
# HACK: sepolicy_test is implemented as genrule
|
|
|
|
|
# genrule modules aren't installable, so LOCAL_REQUIRED_MODULES doesn't work.
|
|
|
|
|
# Instead, use LOCAL_ADDITIONAL_DEPENDENCIES with intermediate output
|
|
|
|
|
LOCAL_ADDITIONAL_DEPENDENCIES += $(call intermediates-dir-for,ETC,sepolicy_test)/sepolicy_test
|
2023-09-27 10:39:07 +02:00
|
|
|
LOCAL_ADDITIONAL_DEPENDENCIES += $(call intermediates-dir-for,ETC,sepolicy_dev_type_test)/sepolicy_dev_type_test
|
2022-02-25 03:26:16 +01:00
|
|
|
|
2019-09-20 20:16:29 +02:00
|
|
|
LOCAL_REQUIRED_MODULES += \
|
|
|
|
|
$(addprefix treble_sepolicy_tests_,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS)) \
|
|
|
|
|
|
|
|
|
|
endif # SELINUX_IGNORE_NEVERALLOWS
|
|
|
|
|
endif # with_asan
|
2017-09-26 21:58:29 +02:00
|
|
|
|
2024-02-13 03:19:24 +01:00
|
|
|
ifeq ($(BOARD_API_LEVEL_FROZEN),true)
|
2018-07-02 15:31:29 +02:00
|
|
|
LOCAL_REQUIRED_MODULES += \
|
2023-09-08 04:54:11 +02:00
|
|
|
se_freeze_test
|
2024-02-13 03:19:24 +01:00
|
|
|
endif
|
2018-07-02 15:31:29 +02:00
|
|
|
|
|
|
|
|
include $(BUILD_PHONY_PACKAGE)
|
|
|
|
|
|
|
|
|
|
#################################
|
|
|
|
|
|
|
|
|
|
include $(CLEAR_VARS)
|
|
|
|
|
|
2020-10-07 11:28:47 +02:00
|
|
|
LOCAL_MODULE := selinux_policy_system_ext
|
2021-02-04 08:07:40 +01:00
|
|
|
LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
|
|
|
|
|
LOCAL_LICENSE_CONDITIONS := notice unencumbered
|
|
|
|
|
LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
|
2018-07-02 15:31:29 +02:00
|
|
|
# Include precompiled policy, unless told otherwise.
|
|
|
|
|
ifneq ($(PRODUCT_PRECOMPILED_SEPOLICY),false)
|
2021-04-29 12:45:50 +02:00
|
|
|
ifdef HAS_SYSTEM_EXT_SEPOLICY
|
2020-10-07 11:28:47 +02:00
|
|
|
LOCAL_REQUIRED_MODULES += system_ext_sepolicy_and_mapping.sha256
|
2017-11-27 04:41:33 +01:00
|
|
|
endif
|
2021-04-29 12:45:50 +02:00
|
|
|
endif
|
2018-12-14 23:30:56 +01:00
|
|
|
|
2019-08-29 11:12:11 +02:00
|
|
|
ifdef HAS_SYSTEM_EXT_SEPOLICY
|
Allowing system_ext sepolicy to be empty
Some targets just need to extend system_ext context files, e.g.,
file_contexts, service_contexts, etc., without adding any system_ext
policy files, e.g., *.te files.
Currently, this will lead to build errors. This CL allows
system_ext_sepolicy.cil and the system_ext mapping file
to be empty.
It's now also possible to just set BOARD_PLAT_PRIVATE_SEPOLICY_DIR
without setting BOARD_PLAT_PUBLIC_SEPOLICY_DIR.
Bug: 137712473
Bug: 141880898
Test: Only adds system_ext context files without policy files (e.g., *.te),
then `mmma system/sepolicy` can build pass
Change-Id: I72849f2d4aa43e5296cd15c07a8fd058186a6376
2019-10-04 08:34:18 +02:00
|
|
|
LOCAL_REQUIRED_MODULES += system_ext_sepolicy.cil
|
|
|
|
|
endif
|
|
|
|
|
|
|
|
|
|
ifdef HAS_SYSTEM_EXT_PUBLIC_SEPOLICY
|
2019-10-11 01:29:40 +02:00
|
|
|
LOCAL_REQUIRED_MODULES += \
|
2020-09-22 00:32:16 +02:00
|
|
|
system_ext_mapping_file
|
|
|
|
|
|
2024-02-13 03:19:24 +01:00
|
|
|
# HACK to support vendor blobs using 1000000.0
|
|
|
|
|
# TODO(b/314010177): remove after new ToT (202404) fully propagates
|
|
|
|
|
ifneq (true,$(BOARD_API_LEVEL_FROZEN))
|
|
|
|
|
LOCAL_REQUIRED_MODULES += system_ext_mapping_file_1000000.0
|
|
|
|
|
endif
|
|
|
|
|
|
2020-09-22 00:32:16 +02:00
|
|
|
system_ext_compat_files := $(call build_policy, $(sepolicy_compat_files), $(SYSTEM_EXT_PRIVATE_POLICY))
|
|
|
|
|
|
|
|
|
|
LOCAL_REQUIRED_MODULES += $(addprefix system_ext_, $(notdir $(system_ext_compat_files)))
|
2019-10-11 01:29:40 +02:00
|
|
|
|
Allowing system_ext sepolicy to be empty
Some targets just need to extend system_ext context files, e.g.,
file_contexts, service_contexts, etc., without adding any system_ext
policy files, e.g., *.te files.
Currently, this will lead to build errors. This CL allows
system_ext_sepolicy.cil and the system_ext mapping file
to be empty.
It's now also possible to just set BOARD_PLAT_PRIVATE_SEPOLICY_DIR
without setting BOARD_PLAT_PUBLIC_SEPOLICY_DIR.
Bug: 137712473
Bug: 141880898
Test: Only adds system_ext context files without policy files (e.g., *.te),
then `mmma system/sepolicy` can build pass
Change-Id: I72849f2d4aa43e5296cd15c07a8fd058186a6376
2019-10-04 08:34:18 +02:00
|
|
|
endif
|
|
|
|
|
|
|
|
|
|
ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR
|
2019-08-29 11:12:11 +02:00
|
|
|
LOCAL_REQUIRED_MODULES += \
|
2019-09-09 16:04:06 +02:00
|
|
|
system_ext_file_contexts \
|
|
|
|
|
system_ext_file_contexts_test \
|
2019-09-09 16:05:10 +02:00
|
|
|
system_ext_hwservice_contexts \
|
|
|
|
|
system_ext_hwservice_contexts_test \
|
2019-09-09 12:09:22 +02:00
|
|
|
system_ext_property_contexts \
|
|
|
|
|
system_ext_property_contexts_test \
|
2019-09-09 16:04:30 +02:00
|
|
|
system_ext_seapp_contexts \
|
2019-09-09 16:05:29 +02:00
|
|
|
system_ext_service_contexts \
|
|
|
|
|
system_ext_service_contexts_test \
|
2019-09-09 16:05:49 +02:00
|
|
|
system_ext_mac_permissions.xml \
|
2021-11-08 12:30:04 +01:00
|
|
|
system_ext_bug_map \
|
2021-04-12 20:49:29 +02:00
|
|
|
$(addprefix system_ext_,$(addsuffix .compat.cil,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS))) \
|
2019-08-29 11:12:11 +02:00
|
|
|
|
|
|
|
|
endif
|
|
|
|
|
|
2020-10-07 11:28:47 +02:00
|
|
|
include $(BUILD_PHONY_PACKAGE)
|
|
|
|
|
|
|
|
|
|
#################################
|
|
|
|
|
|
|
|
|
|
include $(CLEAR_VARS)
|
|
|
|
|
|
|
|
|
|
LOCAL_MODULE := selinux_policy_product
|
2021-02-04 08:07:40 +01:00
|
|
|
LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
|
|
|
|
|
LOCAL_LICENSE_CONDITIONS := notice unencumbered
|
|
|
|
|
LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
|
2020-10-07 11:28:47 +02:00
|
|
|
# Include precompiled policy, unless told otherwise.
|
|
|
|
|
ifneq ($(PRODUCT_PRECOMPILED_SEPOLICY),false)
|
2021-04-29 12:45:50 +02:00
|
|
|
ifdef HAS_PRODUCT_SEPOLICY
|
2020-10-07 11:28:47 +02:00
|
|
|
LOCAL_REQUIRED_MODULES += product_sepolicy_and_mapping.sha256
|
|
|
|
|
endif
|
2021-04-29 12:45:50 +02:00
|
|
|
endif
|
2020-10-07 11:28:47 +02:00
|
|
|
|
2018-12-14 23:30:56 +01:00
|
|
|
ifdef HAS_PRODUCT_SEPOLICY
|
2019-10-04 09:36:05 +02:00
|
|
|
LOCAL_REQUIRED_MODULES += product_sepolicy.cil
|
|
|
|
|
endif
|
|
|
|
|
|
|
|
|
|
ifdef HAS_PRODUCT_PUBLIC_SEPOLICY
|
2019-10-11 01:29:40 +02:00
|
|
|
LOCAL_REQUIRED_MODULES += \
|
2020-09-22 00:32:16 +02:00
|
|
|
product_mapping_file
|
|
|
|
|
|
2024-02-13 03:19:24 +01:00
|
|
|
# HACK to support vendor blobs using 1000000.0
|
|
|
|
|
# TODO(b/314010177): remove after new ToT (202404) fully propagates
|
|
|
|
|
ifneq (true,$(BOARD_API_LEVEL_FROZEN))
|
|
|
|
|
LOCAL_REQUIRED_MODULES += product_mapping_file_1000000.0
|
|
|
|
|
endif
|
|
|
|
|
|
2020-09-22 00:32:16 +02:00
|
|
|
product_compat_files := $(call build_policy, $(sepolicy_compat_files), $(PRODUCT_PRIVATE_POLICY))
|
|
|
|
|
|
|
|
|
|
LOCAL_REQUIRED_MODULES += $(addprefix product_, $(notdir $(product_compat_files)))
|
2019-10-11 01:29:40 +02:00
|
|
|
|
2019-10-04 09:36:05 +02:00
|
|
|
endif
|
|
|
|
|
|
|
|
|
|
ifdef HAS_PRODUCT_SEPOLICY_DIR
|
2018-12-14 23:30:56 +01:00
|
|
|
LOCAL_REQUIRED_MODULES += \
|
2018-12-19 04:51:19 +01:00
|
|
|
product_file_contexts \
|
Build contexts files with Soong
This is to migrate sepolicy Makefiles into Soong. For the first part,
file_contexts, hwservice_contexts, property_contexts, and
service_contexts are migrated. Build-time tests for contexts files are
still in Makefile; they will also be done with Soong after porting the
module sepolicy.
The motivation of migrating is based on generating property_contexts
dynamically: if we were to amend contexts files at build time in the
future, it would be nicer to manage them in Soong. To do that, building
contexts files with Soong can be very helpful.
Bug: 127949646
Bug: 129377144
Test: 1) Build blueline-userdebug, flash, and boot.
Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash,
and boot.
Test: 3) Build aosp_arm-userdebug.
Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
|
|
|
product_file_contexts_test \
|
2018-12-21 01:13:10 +01:00
|
|
|
product_hwservice_contexts \
|
Build contexts files with Soong
This is to migrate sepolicy Makefiles into Soong. For the first part,
file_contexts, hwservice_contexts, property_contexts, and
service_contexts are migrated. Build-time tests for contexts files are
still in Makefile; they will also be done with Soong after porting the
module sepolicy.
The motivation of migrating is based on generating property_contexts
dynamically: if we were to amend contexts files at build time in the
future, it would be nicer to manage them in Soong. To do that, building
contexts files with Soong can be very helpful.
Bug: 127949646
Bug: 129377144
Test: 1) Build blueline-userdebug, flash, and boot.
Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash,
and boot.
Test: 3) Build aosp_arm-userdebug.
Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
|
|
|
product_hwservice_contexts_test \
|
2018-12-21 04:31:42 +01:00
|
|
|
product_property_contexts \
|
Build contexts files with Soong
This is to migrate sepolicy Makefiles into Soong. For the first part,
file_contexts, hwservice_contexts, property_contexts, and
service_contexts are migrated. Build-time tests for contexts files are
still in Makefile; they will also be done with Soong after porting the
module sepolicy.
The motivation of migrating is based on generating property_contexts
dynamically: if we were to amend contexts files at build time in the
future, it would be nicer to manage them in Soong. To do that, building
contexts files with Soong can be very helpful.
Bug: 127949646
Bug: 129377144
Test: 1) Build blueline-userdebug, flash, and boot.
Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash,
and boot.
Test: 3) Build aosp_arm-userdebug.
Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
|
|
|
product_property_contexts_test \
|
2018-12-21 19:46:45 +01:00
|
|
|
product_seapp_contexts \
|
2018-12-21 21:28:14 +01:00
|
|
|
product_service_contexts \
|
Build contexts files with Soong
This is to migrate sepolicy Makefiles into Soong. For the first part,
file_contexts, hwservice_contexts, property_contexts, and
service_contexts are migrated. Build-time tests for contexts files are
still in Makefile; they will also be done with Soong after porting the
module sepolicy.
The motivation of migrating is based on generating property_contexts
dynamically: if we were to amend contexts files at build time in the
future, it would be nicer to manage them in Soong. To do that, building
contexts files with Soong can be very helpful.
Bug: 127949646
Bug: 129377144
Test: 1) Build blueline-userdebug, flash, and boot.
Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash,
and boot.
Test: 3) Build aosp_arm-userdebug.
Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
|
|
|
product_service_contexts_test \
|
2018-12-22 01:07:21 +01:00
|
|
|
product_mac_permissions.xml \
|
2018-12-14 23:30:56 +01:00
|
|
|
|
2019-01-23 18:47:05 +01:00
|
|
|
endif
|
|
|
|
|
|
2020-10-07 11:28:47 +02:00
|
|
|
include $(BUILD_PHONY_PACKAGE)
|
|
|
|
|
|
|
|
|
|
#################################
|
|
|
|
|
|
|
|
|
|
include $(CLEAR_VARS)
|
|
|
|
|
|
|
|
|
|
LOCAL_MODULE := selinux_policy_nonsystem
|
2021-02-04 08:07:40 +01:00
|
|
|
LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
|
|
|
|
|
LOCAL_LICENSE_CONDITIONS := notice unencumbered
|
|
|
|
|
LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
|
2020-10-07 11:28:47 +02:00
|
|
|
# Include precompiled policy, unless told otherwise.
|
|
|
|
|
ifneq ($(PRODUCT_PRECOMPILED_SEPOLICY),false)
|
|
|
|
|
LOCAL_REQUIRED_MODULES += \
|
|
|
|
|
precompiled_sepolicy \
|
2021-04-29 12:45:50 +02:00
|
|
|
precompiled_sepolicy.plat_sepolicy_and_mapping.sha256
|
|
|
|
|
|
|
|
|
|
ifdef HAS_SYSTEM_EXT_SEPOLICY
|
|
|
|
|
LOCAL_REQUIRED_MODULES += precompiled_sepolicy.system_ext_sepolicy_and_mapping.sha256
|
|
|
|
|
endif
|
|
|
|
|
|
|
|
|
|
ifdef HAS_PRODUCT_SEPOLICY
|
|
|
|
|
LOCAL_REQUIRED_MODULES += precompiled_sepolicy.product_sepolicy_and_mapping.sha256
|
|
|
|
|
endif
|
2020-10-07 11:28:47 +02:00
|
|
|
|
|
|
|
|
endif # ($(PRODUCT_PRECOMPILED_SEPOLICY),false)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# These build targets are not used on non-Treble devices. However, we build these to avoid
|
|
|
|
|
# divergence between Treble and non-Treble devices.
|
|
|
|
|
LOCAL_REQUIRED_MODULES += \
|
|
|
|
|
plat_pub_versioned.cil \
|
|
|
|
|
vendor_sepolicy.cil \
|
|
|
|
|
plat_sepolicy_vers.txt \
|
|
|
|
|
|
|
|
|
|
LOCAL_REQUIRED_MODULES += \
|
|
|
|
|
vendor_file_contexts \
|
|
|
|
|
vendor_file_contexts_test \
|
|
|
|
|
vendor_mac_permissions.xml \
|
|
|
|
|
vendor_property_contexts \
|
|
|
|
|
vendor_property_contexts_test \
|
|
|
|
|
vendor_seapp_contexts \
|
|
|
|
|
vendor_service_contexts \
|
2022-02-16 03:26:11 +01:00
|
|
|
vendor_service_contexts_test \
|
2020-10-07 11:28:47 +02:00
|
|
|
vendor_hwservice_contexts \
|
|
|
|
|
vendor_hwservice_contexts_test \
|
2021-11-08 12:30:04 +01:00
|
|
|
vendor_bug_map \
|
2020-10-07 11:28:47 +02:00
|
|
|
vndservice_contexts \
|
2022-02-25 03:45:41 +01:00
|
|
|
vndservice_contexts_test \
|
2020-10-07 11:28:47 +02:00
|
|
|
|
|
|
|
|
ifdef BOARD_ODM_SEPOLICY_DIRS
|
|
|
|
|
LOCAL_REQUIRED_MODULES += \
|
|
|
|
|
odm_sepolicy.cil \
|
|
|
|
|
odm_file_contexts \
|
|
|
|
|
odm_file_contexts_test \
|
|
|
|
|
odm_seapp_contexts \
|
|
|
|
|
odm_property_contexts \
|
|
|
|
|
odm_property_contexts_test \
|
2022-10-24 13:41:45 +02:00
|
|
|
odm_service_contexts \
|
|
|
|
|
odm_service_contexts_test \
|
2020-10-07 11:28:47 +02:00
|
|
|
odm_hwservice_contexts \
|
|
|
|
|
odm_hwservice_contexts_test \
|
|
|
|
|
odm_mac_permissions.xml
|
|
|
|
|
endif
|
|
|
|
|
|
|
|
|
|
LOCAL_REQUIRED_MODULES += selinux_policy_system_ext
|
|
|
|
|
LOCAL_REQUIRED_MODULES += selinux_policy_product
|
|
|
|
|
|
2019-04-19 16:03:33 +02:00
|
|
|
# Builds an addtional userdebug sepolicy into the debug ramdisk.
|
|
|
|
|
LOCAL_REQUIRED_MODULES += \
|
|
|
|
|
userdebug_plat_sepolicy.cil \
|
|
|
|
|
|
2017-04-10 21:27:18 +02:00
|
|
|
include $(BUILD_PHONY_PACKAGE)
|
|
|
|
|
|
2012-01-18 02:51:09 +01:00
|
|
|
##################################
|
2021-12-16 11:00:03 +01:00
|
|
|
# Policy files are now built with Android.bp. Grab them from intermediate.
|
|
|
|
|
# See Android.bp for details of policy files.
|
2021-03-19 08:04:51 +01:00
|
|
|
#
|
2021-12-21 12:42:35 +01:00
|
|
|
built_sepolicy := $(call intermediates-dir-for,ETC,precompiled_sepolicy)/precompiled_sepolicy
|
2021-12-29 05:53:38 +01:00
|
|
|
built_sepolicy_neverallows := $(call intermediates-dir-for,ETC,sepolicy_neverallows)/sepolicy_neverallows
|
2012-10-02 18:46:37 +02:00
|
|
|
|
2015-06-30 01:31:23 +02:00
|
|
|
##################################
|
2016-12-12 18:29:04 +01:00
|
|
|
# TODO - remove this. Keep around until we get the filesystem creation stuff taken care of.
|
|
|
|
|
#
|
2015-06-30 01:31:23 +02:00
|
|
|
include $(CLEAR_VARS)
|
|
|
|
|
|
2015-08-06 18:43:52 +02:00
|
|
|
LOCAL_MODULE := file_contexts.bin
|
2021-02-04 08:07:40 +01:00
|
|
|
LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
|
|
|
|
|
LOCAL_LICENSE_CONDITIONS := notice unencumbered
|
|
|
|
|
LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
|
2012-01-18 02:51:09 +01:00
|
|
|
LOCAL_MODULE_CLASS := ETC
|
|
|
|
|
LOCAL_MODULE_TAGS := optional
|
|
|
|
|
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
|
|
|
|
|
|
2012-03-06 17:12:41 +01:00
|
|
|
include $(BUILD_SYSTEM)/base_rules.mk
|
2012-01-18 02:51:09 +01:00
|
|
|
|
2016-01-04 21:20:57 +01:00
|
|
|
# The file_contexts.bin is built in the following way:
|
|
|
|
|
# 1. Collect all file_contexts files in THIS repository and process them with
|
|
|
|
|
# m4 into a tmp file called file_contexts.local.tmp.
|
2024-01-18 04:33:36 +01:00
|
|
|
# 2. Collect all device specific file_contexts files and process them with m4
|
2016-01-04 21:20:57 +01:00
|
|
|
# into a tmp file called file_contexts.device.tmp.
|
2024-01-18 04:33:36 +01:00
|
|
|
# 3. Run checkfc -e (allow no device fc entries ie empty) and fc_sort on
|
2016-01-04 21:20:57 +01:00
|
|
|
# file_contexts.device.tmp and output to file_contexts.device.sorted.tmp.
|
2024-01-18 04:33:36 +01:00
|
|
|
# 4. Concatenate file_contexts.local.tmp and file_contexts.device.sorted.tmp
|
|
|
|
|
# into file_contexts.concat.tmp.
|
|
|
|
|
# 5. Run checkfc and sefcontext_compile on file_contexts.concat.tmp to produce
|
2016-01-04 21:20:57 +01:00
|
|
|
# file_contexts.bin.
|
|
|
|
|
#
|
|
|
|
|
# Note: That a newline file is placed between each file_context file found to
|
|
|
|
|
# ensure a proper build when an fc file is missing an ending newline.
|
|
|
|
|
|
2023-11-03 07:02:30 +01:00
|
|
|
local_fc_files := $(call intermediates-dir-for,ETC,plat_file_contexts)/plat_file_contexts
|
2017-05-08 23:26:52 +02:00
|
|
|
|
Allowing system_ext sepolicy to be empty
Some targets just need to extend system_ext context files, e.g.,
file_contexts, service_contexts, etc., without adding any system_ext
policy files, e.g., *.te files.
Currently, this will lead to build errors. This CL allows
system_ext_sepolicy.cil and the system_ext mapping file
to be empty.
It's now also possible to just set BOARD_PLAT_PRIVATE_SEPOLICY_DIR
without setting BOARD_PLAT_PUBLIC_SEPOLICY_DIR.
Bug: 137712473
Bug: 141880898
Test: Only adds system_ext context files without policy files (e.g., *.te),
then `mmma system/sepolicy` can build pass
Change-Id: I72849f2d4aa43e5296cd15c07a8fd058186a6376
2019-10-04 08:34:18 +02:00
|
|
|
ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR
|
2023-11-03 07:02:30 +01:00
|
|
|
local_fc_files += $(call intermediates-dir-for,ETC,system_ext_file_contexts)/system_ext_file_contexts
|
2019-09-09 16:04:06 +02:00
|
|
|
endif
|
|
|
|
|
|
2019-10-04 09:36:05 +02:00
|
|
|
ifdef HAS_PRODUCT_SEPOLICY_DIR
|
2023-11-03 07:02:30 +01:00
|
|
|
local_fc_files += $(call intermediates-dir-for,ETC,product_file_contexts)/product_file_contexts
|
2015-06-13 02:18:20 +02:00
|
|
|
endif
|
2019-11-20 09:54:34 +01:00
|
|
|
|
2023-09-06 07:39:49 +02:00
|
|
|
###########################################################
|
|
|
|
|
## Collect file_contexts files into a single tmp file with m4
|
|
|
|
|
##
|
|
|
|
|
## $(1): list of file_contexts files
|
|
|
|
|
## $(2): filename into which file_contexts files are merged
|
|
|
|
|
###########################################################
|
|
|
|
|
|
|
|
|
|
define _merge-fc-files
|
|
|
|
|
$(2): $(1) $(M4)
|
|
|
|
|
$(hide) mkdir -p $$(dir $$@)
|
|
|
|
|
$(hide) $(M4) --fatal-warnings -s $(1) > $$@
|
|
|
|
|
endef
|
|
|
|
|
|
|
|
|
|
define merge-fc-files
|
|
|
|
|
$(eval $(call _merge-fc-files,$(1),$(2)))
|
|
|
|
|
endef
|
|
|
|
|
|
2016-01-04 21:20:57 +01:00
|
|
|
file_contexts.local.tmp := $(intermediates)/file_contexts.local.tmp
|
2020-09-23 12:16:10 +02:00
|
|
|
$(call merge-fc-files,$(local_fc_files),$(file_contexts.local.tmp))
|
|
|
|
|
|
2023-11-03 07:02:30 +01:00
|
|
|
device_fc_files += $(call intermediates-dir-for,ETC,vendor_file_contexts)/vendor_file_contexts
|
2017-11-29 09:14:53 +01:00
|
|
|
|
|
|
|
|
ifdef BOARD_ODM_SEPOLICY_DIRS
|
2023-11-03 07:02:30 +01:00
|
|
|
device_fc_files += $(call intermediates-dir-for,ETC,odm_file_contexts)/odm_file_contexts
|
2017-11-29 09:14:53 +01:00
|
|
|
endif
|
|
|
|
|
|
2016-01-04 21:20:57 +01:00
|
|
|
file_contexts.device.tmp := $(intermediates)/file_contexts.device.tmp
|
|
|
|
|
$(file_contexts.device.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
|
2019-06-19 19:52:50 +02:00
|
|
|
$(file_contexts.device.tmp): PRIVATE_DEVICE_FC_FILES := $(device_fc_files)
|
|
|
|
|
$(file_contexts.device.tmp): $(device_fc_files) $(M4)
|
2016-01-04 21:20:57 +01:00
|
|
|
@mkdir -p $(dir $@)
|
2019-06-19 19:52:50 +02:00
|
|
|
$(hide) $(M4) --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_DEVICE_FC_FILES) > $@
|
2016-01-04 21:20:57 +01:00
|
|
|
|
|
|
|
|
file_contexts.device.sorted.tmp := $(intermediates)/file_contexts.device.sorted.tmp
|
|
|
|
|
$(file_contexts.device.sorted.tmp): PRIVATE_SEPOLICY := $(built_sepolicy)
|
2018-02-05 10:34:52 +01:00
|
|
|
$(file_contexts.device.sorted.tmp): $(file_contexts.device.tmp) $(built_sepolicy) \
|
|
|
|
|
$(HOST_OUT_EXECUTABLES)/fc_sort $(HOST_OUT_EXECUTABLES)/checkfc
|
2016-01-04 21:20:57 +01:00
|
|
|
@mkdir -p $(dir $@)
|
2016-12-07 20:27:47 +01:00
|
|
|
$(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e $(PRIVATE_SEPOLICY) $<
|
2019-04-11 01:53:17 +02:00
|
|
|
$(hide) $(HOST_OUT_EXECUTABLES)/fc_sort -i $< -o $@
|
2012-10-02 18:46:37 +02:00
|
|
|
|
2016-01-04 21:20:57 +01:00
|
|
|
file_contexts.concat.tmp := $(intermediates)/file_contexts.concat.tmp
|
2020-09-23 12:16:10 +02:00
|
|
|
$(call merge-fc-files,\
|
2024-01-18 04:33:36 +01:00
|
|
|
$(file_contexts.local.tmp) $(file_contexts.device.sorted.tmp),$(file_contexts.concat.tmp))
|
2012-01-18 02:51:09 +01:00
|
|
|
|
2015-09-25 19:18:44 +02:00
|
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
|
2016-01-04 21:20:57 +01:00
|
|
|
$(LOCAL_BUILT_MODULE): $(file_contexts.concat.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/sefcontext_compile $(HOST_OUT_EXECUTABLES)/checkfc
|
2015-08-06 18:43:52 +02:00
|
|
|
@mkdir -p $(dir $@)
|
2016-12-07 20:27:47 +01:00
|
|
|
$(hide) $(HOST_OUT_EXECUTABLES)/checkfc $(PRIVATE_SEPOLICY) $<
|
2015-08-06 18:43:52 +02:00
|
|
|
$(hide) $(HOST_OUT_EXECUTABLES)/sefcontext_compile -o $@ $<
|
|
|
|
|
|
2016-01-04 21:20:57 +01:00
|
|
|
local_fc_files :=
|
|
|
|
|
device_fc_files :=
|
|
|
|
|
file_contexts.concat.tmp :=
|
|
|
|
|
file_contexts.device.sorted.tmp :=
|
|
|
|
|
file_contexts.device.tmp :=
|
|
|
|
|
file_contexts.local.tmp :=
|
2012-08-16 19:55:05 +02:00
|
|
|
|
2014-03-20 14:35:08 +01:00
|
|
|
##################################
|
2021-09-27 15:43:01 +02:00
|
|
|
# Tests for Treble compatibility of current platform policy and vendor policy of
|
|
|
|
|
# given release version.
|
2021-03-22 11:25:09 +01:00
|
|
|
|
2023-09-08 03:44:49 +02:00
|
|
|
ver := $(PLATFORM_SEPOLICY_VERSION)
|
|
|
|
|
ifneq ($(wildcard $(LOCAL_PATH)/prebuilts/api/$(PLATFORM_SEPOLICY_VERSION)),)
|
|
|
|
|
# If PLATFORM_SEPOLICY_VERSION is already frozen, use prebuilts for compat test
|
|
|
|
|
base_plat_pub_policy.cil := $(call intermediates-dir-for,ETC,$(ver)_plat_pub_policy.cil)/$(ver)_plat_pub_policy.cil
|
|
|
|
|
base_product_pub_policy.cil := $(call intermediates-dir-for,ETC,$(ver)_product_pub_policy.cil)/$(ver)_product_pub_policy.cil
|
|
|
|
|
else
|
|
|
|
|
# If not, use ToT for compat test
|
|
|
|
|
base_plat_pub_policy.cil := $(call intermediates-dir-for,ETC,base_plat_pub_policy.cil)/base_plat_pub_policy.cil
|
|
|
|
|
base_product_pub_policy.cil := $(call intermediates-dir-for,ETC,base_product_pub_policy.cil)/base_product_pub_policy.cil
|
|
|
|
|
endif
|
|
|
|
|
ver :=
|
2021-03-22 11:25:09 +01:00
|
|
|
|
2021-12-10 10:34:41 +01:00
|
|
|
$(foreach v,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS), \
|
|
|
|
|
$(eval version_under_treble_tests := $(v)) \
|
|
|
|
|
$(eval include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk) \
|
|
|
|
|
)
|
2018-07-11 11:30:44 +02:00
|
|
|
|
2021-09-27 15:43:01 +02:00
|
|
|
base_plat_pub_policy.cil :=
|
|
|
|
|
base_product_pub_policy.cil :=
|
2017-09-26 21:58:29 +02:00
|
|
|
|
2018-03-15 19:38:08 +01:00
|
|
|
#################################
|
|
|
|
|
|
2012-10-18 03:09:52 +02:00
|
|
|
|
2016-12-16 00:28:44 +01:00
|
|
|
build_policy :=
|
|
|
|
|
built_sepolicy :=
|
2018-01-04 01:53:24 +01:00
|
|
|
built_sepolicy_neverallows :=
|
2016-12-16 00:28:44 +01:00
|
|
|
sepolicy_build_files :=
|
2017-03-13 20:22:15 +01:00
|
|
|
with_asan :=
|
