2012-01-04 18:33:27 +01:00
|
|
|
LOCAL_PATH:= $(call my-dir)
|
2012-08-28 00:41:15 +02:00
|
|
|
|
2017-07-07 23:59:51 +02:00
|
|
|
include $(LOCAL_PATH)/definitions.mk
|
2019-02-15 21:18:15 +01:00
|
|
|
include $(LOCAL_PATH)/policy_version.mk
|
2017-07-07 23:59:51 +02:00
|
|
|
|
2017-03-23 00:20:24 +01:00
|
|
|
include $(CLEAR_VARS)
|
2012-01-04 18:33:27 +01:00
|
|
|
|
|
|
|
|
MLS_SENS=1
|
|
|
|
|
MLS_CATS=1024
|
|
|
|
|
|
2015-04-01 16:14:56 +02:00
|
|
|
ifdef BOARD_SEPOLICY_UNION
|
|
|
|
|
$(warning BOARD_SEPOLICY_UNION is no longer required - all files found in BOARD_SEPOLICY_DIRS are implicitly unioned; please remove from your BoardConfig.mk or other .mk file.)
|
|
|
|
|
endif
|
|
|
|
|
|
2015-07-16 20:28:02 +02:00
|
|
|
ifdef BOARD_SEPOLICY_M4DEFS
|
|
|
|
|
LOCAL_ADDITIONAL_M4DEFS := $(addprefix -D, $(BOARD_SEPOLICY_M4DEFS))
|
2017-07-07 23:59:51 +02:00
|
|
|
else
|
|
|
|
|
LOCAL_ADDITIONAL_M4DEFS :=
|
2015-07-16 20:28:02 +02:00
|
|
|
endif
|
|
|
|
|
|
2016-07-22 22:13:11 +02:00
|
|
|
# sepolicy is now divided into multiple portions:
|
|
|
|
|
# public - policy exported on which non-platform policy developers may write
|
|
|
|
|
# additional policy. types and attributes are versioned and included in
|
|
|
|
|
# delivered non-platform policy, which is to be combined with platform policy.
|
|
|
|
|
# private - platform-only policy required for platform functionality but which
|
|
|
|
|
# is not exported to vendor policy developers and as such may not be assumed
|
|
|
|
|
# to exist.
|
2017-01-31 03:44:59 +01:00
|
|
|
# vendor - vendor-only policy required for vendor functionality. This policy can
|
|
|
|
|
# reference the public policy but cannot reference the private policy. This
|
|
|
|
|
# policy is for components which are produced from the core/non-vendor tree and
|
|
|
|
|
# placed into a vendor partition.
|
2016-12-07 20:27:47 +01:00
|
|
|
# mapping - This contains policy statements which map the attributes
|
2016-07-22 22:13:11 +02:00
|
|
|
# exposed in the public policy of previous versions to the concrete types used
|
|
|
|
|
# in this policy to ensure that policy targeting attributes from public
|
|
|
|
|
# policy from an older platform version continues to work.
|
|
|
|
|
|
2016-10-12 23:58:09 +02:00
|
|
|
# build process for device:
|
2016-07-22 22:13:11 +02:00
|
|
|
# 1) convert policies to CIL:
|
|
|
|
|
# - private + public platform policy to CIL
|
|
|
|
|
# - mapping file to CIL (should already be in CIL form)
|
|
|
|
|
# - non-platform public policy to CIL
|
|
|
|
|
# - non-platform public + private policy to CIL
|
|
|
|
|
# 2) attributize policy
|
|
|
|
|
# - run script which takes non-platform public and non-platform combined
|
|
|
|
|
# private + public policy and produces attributized and versioned
|
|
|
|
|
# non-platform policy
|
|
|
|
|
# 3) combine policy files
|
|
|
|
|
# - combine mapping, platform and non-platform policy.
|
|
|
|
|
# - compile output binary policy file
|
|
|
|
|
|
|
|
|
|
PLAT_PUBLIC_POLICY := $(LOCAL_PATH)/public
|
|
|
|
|
PLAT_PRIVATE_POLICY := $(LOCAL_PATH)/private
|
2017-01-31 03:44:59 +01:00
|
|
|
PLAT_VENDOR_POLICY := $(LOCAL_PATH)/vendor
|
2016-10-12 23:58:09 +02:00
|
|
|
REQD_MASK_POLICY := $(LOCAL_PATH)/reqd_mask
|
2020-07-14 21:28:51 +02:00
|
|
|
|
|
|
|
|
SYSTEM_EXT_PUBLIC_POLICY := $(SYSTEM_EXT_PUBLIC_SEPOLICY_DIRS)
|
|
|
|
|
ifneq (,$(BOARD_PLAT_PUBLIC_SEPOLICY_DIR))
|
2020-10-28 06:01:17 +01:00
|
|
|
# TODO: Disallow BOARD_PLAT_*
|
2020-07-14 21:28:51 +02:00
|
|
|
SYSTEM_EXT_PUBLIC_POLICY += $(BOARD_PLAT_PUBLIC_SEPOLICY_DIR)
|
|
|
|
|
endif
|
|
|
|
|
SYSTEM_EXT_PRIVATE_POLICY := $(SYSTEM_EXT_PRIVATE_SEPOLICY_DIRS)
|
|
|
|
|
ifneq (,$(BOARD_PLAT_PRIVATE_SEPOLICY_DIR))
|
2020-10-28 06:01:17 +01:00
|
|
|
# TODO: Disallow BOARD_PLAT_*
|
2020-07-14 21:28:51 +02:00
|
|
|
SYSTEM_EXT_PRIVATE_POLICY += $(BOARD_PLAT_PRIVATE_SEPOLICY_DIR)
|
|
|
|
|
endif
|
|
|
|
|
|
2019-02-01 20:41:08 +01:00
|
|
|
PRODUCT_PUBLIC_POLICY := $(PRODUCT_PUBLIC_SEPOLICY_DIRS)
|
|
|
|
|
PRODUCT_PRIVATE_POLICY := $(PRODUCT_PRIVATE_SEPOLICY_DIRS)
|
2018-12-14 23:30:56 +01:00
|
|
|
|
2019-08-29 11:12:11 +02:00
|
|
|
ifneq (,$(SYSTEM_EXT_PUBLIC_POLICY)$(SYSTEM_EXT_PRIVATE_POLICY))
|
Allowing system_ext sepolicy to be empty
Some targets just need to extend system_ext context files, e.g.,
file_contexts, service_contexts, etc., without adding any system_ext
policy files, e.g., *.te files.
Currently, this will lead to build errors. This CL allows
system_ext_sepolicy.cil and the system_ext mapping file
to be empty.
It's now also possible to just set BOARD_PLAT_PRIVATE_SEPOLICY_DIR
without setting BOARD_PLAT_PUBLIC_SEPOLICY_DIR.
Bug: 137712473
Bug: 141880898
Test: Only adds system_ext context files without policy files (e.g., *.te),
then `mmma system/sepolicy` can build pass
Change-Id: I72849f2d4aa43e5296cd15c07a8fd058186a6376
2019-10-04 08:34:18 +02:00
|
|
|
HAS_SYSTEM_EXT_SEPOLICY_DIR := true
|
2019-08-29 11:12:11 +02:00
|
|
|
endif
|
|
|
|
|
|
2018-12-14 23:30:56 +01:00
|
|
|
# TODO(b/119305624): Currently if the device doesn't have a product partition,
|
|
|
|
|
# we install product sepolicy into /system/product. We do that because bits of
|
|
|
|
|
# product sepolicy that's still in /system might depend on bits that have moved
|
|
|
|
|
# to /product. Once we finish migrating product sepolicy out of system, change
|
|
|
|
|
# it so that if no product partition is present, product sepolicy artifacts are
|
|
|
|
|
# not built and installed at all.
|
|
|
|
|
ifneq (,$(PRODUCT_PUBLIC_POLICY)$(PRODUCT_PRIVATE_POLICY))
|
2019-10-04 09:36:05 +02:00
|
|
|
HAS_PRODUCT_SEPOLICY_DIR := true
|
2018-12-14 23:30:56 +01:00
|
|
|
endif
|
2016-10-12 23:58:09 +02:00
|
|
|
|
2020-11-09 12:58:58 +01:00
|
|
|
ifneq ($(PLATFORM_SEPOLICY_VERSION),$(BOARD_SEPOLICY_VERS))
|
|
|
|
|
mixed_sepolicy_build := true
|
|
|
|
|
else
|
|
|
|
|
mixed_sepolicy_build :=
|
|
|
|
|
endif
|
|
|
|
|
|
2018-01-04 01:53:24 +01:00
|
|
|
NEVERALLOW_ARG :=
|
|
|
|
|
ifeq ($(SELINUX_IGNORE_NEVERALLOWS),true)
|
|
|
|
|
ifeq ($(TARGET_BUILD_VARIANT),user)
|
|
|
|
|
$(error SELINUX_IGNORE_NEVERALLOWS := true cannot be used in user builds)
|
|
|
|
|
endif
|
|
|
|
|
$(warning Be careful when using the SELINUX_IGNORE_NEVERALLOWS flag. \
|
|
|
|
|
It does not work in user builds and using it will \
|
|
|
|
|
not stop you from failing CTS.)
|
|
|
|
|
NEVERALLOW_ARG := -N
|
|
|
|
|
endif
|
|
|
|
|
|
2017-11-27 04:41:33 +01:00
|
|
|
# BOARD_SEPOLICY_DIRS was used for vendor/odm sepolicy customization before.
|
|
|
|
|
# It has been replaced by BOARD_VENDOR_SEPOLICY_DIRS (mandatory) and
|
|
|
|
|
# BOARD_ODM_SEPOLICY_DIRS (optional). BOARD_SEPOLICY_DIRS is still allowed for
|
|
|
|
|
# backward compatibility, which will be merged into BOARD_VENDOR_SEPOLICY_DIRS.
|
2018-02-05 10:34:52 +01:00
|
|
|
ifdef BOARD_SEPOLICY_DIRS
|
|
|
|
|
BOARD_VENDOR_SEPOLICY_DIRS += $(BOARD_SEPOLICY_DIRS)
|
|
|
|
|
endif
|
2017-04-12 23:28:34 +02:00
|
|
|
|
2020-11-09 12:58:58 +01:00
|
|
|
# Set default values for these prebuilt directories
|
|
|
|
|
ifeq (,$(BOARD_REQD_MASK_POLICY))
|
|
|
|
|
BOARD_REQD_MASK_POLICY := $(REQD_MASK_POLICY)
|
|
|
|
|
endif
|
|
|
|
|
|
|
|
|
|
ifeq (,$(BOARD_PLAT_VENDOR_POLICY))
|
|
|
|
|
BOARD_PLAT_VENDOR_POLICY := $(PLAT_VENDOR_POLICY)
|
|
|
|
|
endif
|
|
|
|
|
|
|
|
|
|
$(foreach p,SYSTEM_EXT PRODUCT,$(foreach q,PUBLIC PRIVATE,$(eval \
|
|
|
|
|
$(if $(BOARD_$(p)_$(q)_PREBUILT_DIRS),,\
|
|
|
|
|
BOARD_$(p)_$(q)_PREBUILT_DIRS := $($(p)_$(q)_POLICY) \
|
|
|
|
|
) \
|
|
|
|
|
)))
|
|
|
|
|
|
2017-11-27 04:41:33 +01:00
|
|
|
ifdef BOARD_ODM_SEPOLICY_DIRS
|
|
|
|
|
ifneq ($(PRODUCT_SEPOLICY_SPLIT),true)
|
|
|
|
|
$(error PRODUCT_SEPOLICY_SPLIT needs to be true when using BOARD_ODM_SEPOLICY_DIRS)
|
|
|
|
|
endif
|
|
|
|
|
endif
|
|
|
|
|
|
2016-07-22 22:13:11 +02:00
|
|
|
###########################################################
|
|
|
|
|
# Compute policy files to be used in policy build.
|
|
|
|
|
# $(1): files to include
|
|
|
|
|
# $(2): directories in which to find files
|
|
|
|
|
###########################################################
|
|
|
|
|
|
|
|
|
|
define build_policy
|
2021-10-01 00:48:34 +02:00
|
|
|
$(strip $(foreach type, $(1), $(foreach file, $(addsuffix /$(type), $(2)), $(sort $(wildcard $(file))))))
|
2016-07-22 22:13:11 +02:00
|
|
|
endef
|
2016-01-04 21:20:57 +01:00
|
|
|
|
2018-02-05 10:34:52 +01:00
|
|
|
# Builds paths for all policy files found in BOARD_VENDOR_SEPOLICY_DIRS.
|
2016-01-04 21:20:57 +01:00
|
|
|
# $(1): the set of policy name paths to build
|
2021-12-08 14:45:58 +01:00
|
|
|
build_vendor_policy = $(call build_policy, $(1), $(BOARD_PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS))
|
2016-01-04 21:20:57 +01:00
|
|
|
|
2017-11-29 09:14:53 +01:00
|
|
|
# Builds paths for all policy files found in BOARD_ODM_SEPOLICY_DIRS.
|
|
|
|
|
build_odm_policy = $(call build_policy, $(1), $(BOARD_ODM_SEPOLICY_DIRS))
|
|
|
|
|
|
2014-07-26 04:11:52 +02:00
|
|
|
sepolicy_build_files := security_classes \
|
|
|
|
|
initial_sids \
|
|
|
|
|
access_vectors \
|
|
|
|
|
global_macros \
|
2014-11-06 00:30:41 +01:00
|
|
|
neverallow_macros \
|
2014-07-26 04:11:52 +02:00
|
|
|
mls_macros \
|
2016-10-12 23:58:09 +02:00
|
|
|
mls_decl \
|
2014-07-26 04:11:52 +02:00
|
|
|
mls \
|
|
|
|
|
policy_capabilities \
|
|
|
|
|
te_macros \
|
|
|
|
|
attributes \
|
2015-12-22 19:39:34 +01:00
|
|
|
ioctl_defines \
|
2015-06-06 00:28:55 +02:00
|
|
|
ioctl_macros \
|
2014-07-26 04:11:52 +02:00
|
|
|
*.te \
|
2016-10-12 23:58:09 +02:00
|
|
|
roles_decl \
|
2014-07-26 04:11:52 +02:00
|
|
|
roles \
|
|
|
|
|
users \
|
|
|
|
|
initial_sid_contexts \
|
|
|
|
|
fs_use \
|
|
|
|
|
genfs_contexts \
|
|
|
|
|
port_contexts
|
|
|
|
|
|
2020-09-22 00:32:16 +02:00
|
|
|
sepolicy_compat_files := $(foreach ver, $(PLATFORM_SEPOLICY_COMPAT_VERSIONS), \
|
|
|
|
|
$(addprefix compat/$(ver)/, $(addsuffix .cil, $(ver))))
|
|
|
|
|
|
2019-10-08 01:31:40 +02:00
|
|
|
# Security classes and permissions defined outside of system/sepolicy.
|
|
|
|
|
security_class_extension_files := $(call build_policy, security_classes access_vectors, \
|
|
|
|
|
$(SYSTEM_EXT_PUBLIC_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY) \
|
|
|
|
|
$(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY) \
|
|
|
|
|
$(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_ODM_SEPOLICY_DIRS))
|
|
|
|
|
|
|
|
|
|
ifneq (,$(strip $(security_class_extension_files)))
|
|
|
|
|
$(error Only platform SELinux policy may define classes and permissions: $(strip $(security_class_extension_files)))
|
|
|
|
|
endif
|
|
|
|
|
|
Allowing system_ext sepolicy to be empty
Some targets just need to extend system_ext context files, e.g.,
file_contexts, service_contexts, etc., without adding any system_ext
policy files, e.g., *.te files.
Currently, this will lead to build errors. This CL allows
system_ext_sepolicy.cil and the system_ext mapping file
to be empty.
It's now also possible to just set BOARD_PLAT_PRIVATE_SEPOLICY_DIR
without setting BOARD_PLAT_PUBLIC_SEPOLICY_DIR.
Bug: 137712473
Bug: 141880898
Test: Only adds system_ext context files without policy files (e.g., *.te),
then `mmma system/sepolicy` can build pass
Change-Id: I72849f2d4aa43e5296cd15c07a8fd058186a6376
2019-10-04 08:34:18 +02:00
|
|
|
ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR
|
|
|
|
|
# Checks if there are public system_ext policy files.
|
|
|
|
|
policy_files := $(call build_policy, $(sepolicy_build_files), $(SYSTEM_EXT_PUBLIC_POLICY))
|
|
|
|
|
ifneq (,$(strip $(policy_files)))
|
|
|
|
|
HAS_SYSTEM_EXT_PUBLIC_SEPOLICY := true
|
|
|
|
|
endif
|
|
|
|
|
# Checks if there are public/private system_ext policy files.
|
|
|
|
|
policy_files := $(call build_policy, $(sepolicy_build_files), $(SYSTEM_EXT_PUBLIC_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY))
|
|
|
|
|
ifneq (,$(strip $(policy_files)))
|
|
|
|
|
HAS_SYSTEM_EXT_SEPOLICY := true
|
|
|
|
|
endif
|
|
|
|
|
endif # ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR
|
|
|
|
|
|
2019-10-04 09:36:05 +02:00
|
|
|
ifdef HAS_PRODUCT_SEPOLICY_DIR
|
|
|
|
|
# Checks if there are public product policy files.
|
|
|
|
|
policy_files := $(call build_policy, $(sepolicy_build_files), $(PRODUCT_PUBLIC_POLICY))
|
|
|
|
|
ifneq (,$(strip $(policy_files)))
|
|
|
|
|
HAS_PRODUCT_PUBLIC_SEPOLICY := true
|
|
|
|
|
endif
|
|
|
|
|
# Checks if there are public/private product policy files.
|
|
|
|
|
policy_files := $(call build_policy, $(sepolicy_build_files), $(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY))
|
|
|
|
|
ifneq (,$(strip $(policy_files)))
|
|
|
|
|
HAS_PRODUCT_SEPOLICY := true
|
|
|
|
|
endif
|
|
|
|
|
endif # ifdef HAS_PRODUCT_SEPOLICY_DIR
|
|
|
|
|
|
Mark all clients of Allocator HAL
This change associates all domains which are clients of Allocator HAL
with hal_allocator_client and the, required for all HAL client
domains, halclientdomain.
This enables this commit to remove the now unnecessary hwallocator_use
macro because its binder_call(..., hal_allocator_server) is covered by
binder_call(hal_allocator_client, hal_allocator_server) added in this
commit.
Unfortunately apps, except isolated app, are clients of Allocator HAL
as well. This makes it hard to use the hal_client_domain(...,
hal_allocator) macro because it translates into "typeattribute" which
currently does not support being provided with a set of types, such as
{ appdomain -isolated_app }. As a workaround, hopefully until
typeattribute is improved, this commit expresses the necessary
association operation in CIL. private/technical_debt.cil introduced by
this commit is appended into the platform policy CIL file, thus
ensuring that the hack has effect on the final monolithic policy.
P. S. This change also removes Allocator HAL access from isolated_app.
Isolated app shouldn't have access to this HAL anyway.
Test: Google Play Music plays back radios
Test: Google Camera records video with sound and that video is then
successfully played back with sound
Test: YouTube app plays back clips with sound
Test: YouTube in Chrome plays back clips with sound
Bug: 34170079
Change-Id: Id00bba6fde83e7cf04fb58bc1c353c2f66333f92
2017-03-21 22:28:53 +01:00
|
|
|
# CIL files which contain workarounds for current limitation of human-readable
|
|
|
|
|
# module policy language. These files are appended to the CIL files produced
|
|
|
|
|
# from module language files.
|
|
|
|
|
sepolicy_build_cil_workaround_files := technical_debt.cil
|
|
|
|
|
|
2016-12-16 00:28:44 +01:00
|
|
|
my_target_arch := $(TARGET_ARCH)
|
|
|
|
|
ifneq (,$(filter mips mips64,$(TARGET_ARCH)))
|
|
|
|
|
my_target_arch := mips
|
|
|
|
|
endif
|
|
|
|
|
|
2017-03-15 21:37:35 +01:00
|
|
|
intermediates := $(TARGET_OUT_INTERMEDIATES)/ETC/sepolicy_intermediates
|
|
|
|
|
|
2017-03-13 20:22:15 +01:00
|
|
|
with_asan := false
|
|
|
|
|
ifneq (,$(filter address,$(SANITIZE_TARGET)))
|
|
|
|
|
with_asan := true
|
|
|
|
|
endif
|
|
|
|
|
|
2019-06-14 00:05:15 +02:00
|
|
|
with_native_coverage := false
|
|
|
|
|
ifeq ($(NATIVE_COVERAGE),true)
|
|
|
|
|
with_native_coverage := true
|
|
|
|
|
endif
|
2019-12-10 01:37:59 +01:00
|
|
|
ifeq ($(CLANG_COVERAGE),true)
|
|
|
|
|
with_native_coverage := true
|
|
|
|
|
endif
|
2019-06-14 00:05:15 +02:00
|
|
|
|
2019-09-26 08:14:55 +02:00
|
|
|
treble_sysprop_neverallow := true
|
|
|
|
|
ifeq ($(BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW),true)
|
|
|
|
|
treble_sysprop_neverallow := false
|
|
|
|
|
endif
|
|
|
|
|
|
|
|
|
|
ifeq ($(PRODUCT_SHIPPING_API_LEVEL),)
|
|
|
|
|
#$(warning no product shipping level defined)
|
|
|
|
|
else ifneq ($(call math_lt,29,$(PRODUCT_SHIPPING_API_LEVEL)),)
|
|
|
|
|
ifneq ($(BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW),)
|
|
|
|
|
$(error BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW cannot be set on a device shipping with R or later, and this is tested by CTS.)
|
|
|
|
|
endif
|
|
|
|
|
endif
|
|
|
|
|
|
2020-09-28 06:32:43 +02:00
|
|
|
enforce_sysprop_owner := true
|
|
|
|
|
ifeq ($(BUILD_BROKEN_ENFORCE_SYSPROP_OWNER),true)
|
|
|
|
|
enforce_sysprop_owner := false
|
|
|
|
|
endif
|
|
|
|
|
|
2021-04-27 01:32:17 +02:00
|
|
|
enforce_debugfs_restriction := false
|
|
|
|
|
ifeq ($(PRODUCT_SET_DEBUGFS_RESTRICTIONS),true)
|
|
|
|
|
enforce_debugfs_restriction := true
|
|
|
|
|
endif
|
|
|
|
|
|
2020-09-28 06:32:43 +02:00
|
|
|
ifeq ($(PRODUCT_SHIPPING_API_LEVEL),)
|
|
|
|
|
#$(warning no product shipping level defined)
|
|
|
|
|
else ifneq ($(call math_lt,30,$(PRODUCT_SHIPPING_API_LEVEL)),)
|
|
|
|
|
ifneq ($(BUILD_BROKEN_ENFORCE_SYSPROP_OWNER),)
|
|
|
|
|
$(error BUILD_BROKEN_ENFORCE_SYSPROP_OWNER cannot be set on a device shipping with S or later, and this is tested by CTS.)
|
|
|
|
|
endif
|
|
|
|
|
endif
|
|
|
|
|
|
2017-10-04 18:42:29 +02:00
|
|
|
# Library extension for host-side tests
|
2017-10-05 03:15:44 +02:00
|
|
|
ifeq ($(HOST_OS),darwin)
|
2017-10-04 18:42:29 +02:00
|
|
|
SHAREDLIB_EXT=dylib
|
|
|
|
|
else
|
|
|
|
|
SHAREDLIB_EXT=so
|
|
|
|
|
endif
|
|
|
|
|
|
2019-01-24 08:41:47 +01:00
|
|
|
# Convert a file_context file for a non-flattened APEX into a file for
|
|
|
|
|
# flattened APEX. /system/apex/<apex_name> path is prepended to the original paths
|
|
|
|
|
# $(1): path to the input file_contexts file for non-flattened APEX
|
2019-11-20 09:54:34 +01:00
|
|
|
# $(2): path to the flattened APEX
|
|
|
|
|
# $(3): path to the generated file_contexts file for flattened APEX
|
2019-01-24 08:41:47 +01:00
|
|
|
# $(4): variable where $(3) is added to
|
|
|
|
|
define build_flattened_apex_file_contexts
|
|
|
|
|
$(4) += $(3)
|
2019-11-20 09:54:34 +01:00
|
|
|
$(3): PRIVATE_APEX_PATH := $(subst .,\\.,$(2))
|
2019-01-24 08:41:47 +01:00
|
|
|
$(3): $(1)
|
|
|
|
|
$(hide) awk '/object_r/{printf("$$(PRIVATE_APEX_PATH)%s\n",$$$$0)}' $$< > $$@
|
|
|
|
|
endef
|
|
|
|
|
|
2018-07-02 15:31:29 +02:00
|
|
|
#################################
|
|
|
|
|
|
2017-04-10 21:27:18 +02:00
|
|
|
include $(CLEAR_VARS)
|
2018-07-02 15:31:29 +02:00
|
|
|
|
2017-04-10 21:27:18 +02:00
|
|
|
LOCAL_MODULE := selinux_policy
|
2021-02-04 08:07:40 +01:00
|
|
|
LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
|
|
|
|
|
LOCAL_LICENSE_CONDITIONS := notice unencumbered
|
|
|
|
|
LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
|
2017-04-10 21:27:18 +02:00
|
|
|
LOCAL_MODULE_TAGS := optional
|
2018-05-09 03:52:11 +02:00
|
|
|
LOCAL_REQUIRED_MODULES += \
|
2018-07-02 15:31:29 +02:00
|
|
|
selinux_policy_nonsystem \
|
|
|
|
|
selinux_policy_system \
|
2018-05-09 03:52:11 +02:00
|
|
|
|
2018-07-02 15:31:29 +02:00
|
|
|
include $(BUILD_PHONY_PACKAGE)
|
2018-05-09 03:52:11 +02:00
|
|
|
|
2019-05-29 18:05:43 +02:00
|
|
|
# selinux_policy is a main goal and triggers lots of tests.
|
|
|
|
|
# Most tests are FAKE modules, so aren'triggered on normal builds. (e.g. 'm')
|
|
|
|
|
# By setting as droidcore's dependency, tests will run on normal builds.
|
|
|
|
|
droidcore: selinux_policy
|
2018-05-09 03:52:11 +02:00
|
|
|
|
2018-07-02 15:31:29 +02:00
|
|
|
include $(CLEAR_VARS)
|
|
|
|
|
LOCAL_MODULE := selinux_policy_system
|
2021-02-04 08:07:40 +01:00
|
|
|
LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
|
|
|
|
|
LOCAL_LICENSE_CONDITIONS := notice unencumbered
|
|
|
|
|
LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
|
2018-05-09 03:52:11 +02:00
|
|
|
# These build targets are not used on non-Treble devices. However, we build these to avoid
|
|
|
|
|
# divergence between Treble and non-Treble devices.
|
2017-04-10 21:27:18 +02:00
|
|
|
LOCAL_REQUIRED_MODULES += \
|
2019-01-16 00:16:55 +01:00
|
|
|
plat_mapping_file \
|
2019-10-11 01:29:40 +02:00
|
|
|
$(addprefix plat_,$(addsuffix .cil,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS))) \
|
2019-05-02 22:48:44 +02:00
|
|
|
$(addsuffix .compat.cil,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS)) \
|
2017-04-10 21:27:18 +02:00
|
|
|
plat_sepolicy.cil \
|
|
|
|
|
secilc \
|
2017-09-26 21:58:29 +02:00
|
|
|
|
2020-11-09 12:58:58 +01:00
|
|
|
ifneq ($(PRODUCT_PRECOMPILED_SEPOLICY),false)
|
|
|
|
|
LOCAL_REQUIRED_MODULES += plat_sepolicy_and_mapping.sha256
|
|
|
|
|
endif
|
|
|
|
|
|
2017-06-08 22:24:15 +02:00
|
|
|
LOCAL_REQUIRED_MODULES += \
|
2018-02-05 10:41:02 +01:00
|
|
|
build_sepolicy \
|
2017-08-22 22:29:53 +02:00
|
|
|
plat_file_contexts \
|
Build contexts files with Soong
This is to migrate sepolicy Makefiles into Soong. For the first part,
file_contexts, hwservice_contexts, property_contexts, and
service_contexts are migrated. Build-time tests for contexts files are
still in Makefile; they will also be done with Soong after porting the
module sepolicy.
The motivation of migrating is based on generating property_contexts
dynamically: if we were to amend contexts files at build time in the
future, it would be nicer to manage them in Soong. To do that, building
contexts files with Soong can be very helpful.
Bug: 127949646
Bug: 129377144
Test: 1) Build blueline-userdebug, flash, and boot.
Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash,
and boot.
Test: 3) Build aosp_arm-userdebug.
Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
|
|
|
plat_file_contexts_test \
|
2020-07-25 22:02:29 +02:00
|
|
|
plat_keystore2_key_contexts \
|
2017-08-22 22:29:53 +02:00
|
|
|
plat_mac_permissions.xml \
|
|
|
|
|
plat_property_contexts \
|
Build contexts files with Soong
This is to migrate sepolicy Makefiles into Soong. For the first part,
file_contexts, hwservice_contexts, property_contexts, and
service_contexts are migrated. Build-time tests for contexts files are
still in Makefile; they will also be done with Soong after porting the
module sepolicy.
The motivation of migrating is based on generating property_contexts
dynamically: if we were to amend contexts files at build time in the
future, it would be nicer to manage them in Soong. To do that, building
contexts files with Soong can be very helpful.
Bug: 127949646
Bug: 129377144
Test: 1) Build blueline-userdebug, flash, and boot.
Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash,
and boot.
Test: 3) Build aosp_arm-userdebug.
Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
|
|
|
plat_property_contexts_test \
|
2017-08-22 22:29:53 +02:00
|
|
|
plat_seapp_contexts \
|
|
|
|
|
plat_service_contexts \
|
Build contexts files with Soong
This is to migrate sepolicy Makefiles into Soong. For the first part,
file_contexts, hwservice_contexts, property_contexts, and
service_contexts are migrated. Build-time tests for contexts files are
still in Makefile; they will also be done with Soong after porting the
module sepolicy.
The motivation of migrating is based on generating property_contexts
dynamically: if we were to amend contexts files at build time in the
future, it would be nicer to manage them in Soong. To do that, building
contexts files with Soong can be very helpful.
Bug: 127949646
Bug: 129377144
Test: 1) Build blueline-userdebug, flash, and boot.
Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash,
and boot.
Test: 3) Build aosp_arm-userdebug.
Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
|
|
|
plat_service_contexts_test \
|
2017-08-22 22:29:53 +02:00
|
|
|
plat_hwservice_contexts \
|
Build contexts files with Soong
This is to migrate sepolicy Makefiles into Soong. For the first part,
file_contexts, hwservice_contexts, property_contexts, and
service_contexts are migrated. Build-time tests for contexts files are
still in Makefile; they will also be done with Soong after porting the
module sepolicy.
The motivation of migrating is based on generating property_contexts
dynamically: if we were to amend contexts files at build time in the
future, it would be nicer to manage them in Soong. To do that, building
contexts files with Soong can be very helpful.
Bug: 127949646
Bug: 129377144
Test: 1) Build blueline-userdebug, flash, and boot.
Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash,
and boot.
Test: 3) Build aosp_arm-userdebug.
Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
|
|
|
plat_hwservice_contexts_test \
|
2021-11-08 12:30:04 +01:00
|
|
|
plat_bug_map \
|
2017-09-26 21:58:29 +02:00
|
|
|
searchpolicy \
|
2018-07-02 15:31:29 +02:00
|
|
|
|
|
|
|
|
# This conditional inclusion closely mimics the conditional logic
|
|
|
|
|
# inside init/init.cpp for loading SELinux policy from files.
|
|
|
|
|
ifneq ($(PRODUCT_SEPOLICY_SPLIT),true)
|
|
|
|
|
# The following files are only allowed for non-Treble devices.
|
|
|
|
|
LOCAL_REQUIRED_MODULES += \
|
|
|
|
|
sepolicy \
|
|
|
|
|
|
|
|
|
|
endif # ($(PRODUCT_SEPOLICY_SPLIT),true)
|
2017-06-08 22:24:15 +02:00
|
|
|
|
2017-09-26 21:58:29 +02:00
|
|
|
ifneq ($(with_asan),true)
|
2018-02-14 05:29:55 +01:00
|
|
|
ifneq ($(SELINUX_IGNORE_NEVERALLOWS),true)
|
2017-09-26 21:58:29 +02:00
|
|
|
LOCAL_REQUIRED_MODULES += \
|
2022-01-07 01:15:27 +01:00
|
|
|
sepolicy_compat_test \
|
2017-09-26 21:58:29 +02:00
|
|
|
|
2022-02-25 03:26:16 +01:00
|
|
|
# HACK: sepolicy_test is implemented as genrule
|
|
|
|
|
# genrule modules aren't installable, so LOCAL_REQUIRED_MODULES doesn't work.
|
|
|
|
|
# Instead, use LOCAL_ADDITIONAL_DEPENDENCIES with intermediate output
|
|
|
|
|
LOCAL_ADDITIONAL_DEPENDENCIES += $(call intermediates-dir-for,ETC,sepolicy_test)/sepolicy_test
|
|
|
|
|
|
2019-09-20 20:16:29 +02:00
|
|
|
ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
|
|
|
|
|
LOCAL_REQUIRED_MODULES += \
|
|
|
|
|
$(addprefix treble_sepolicy_tests_,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS)) \
|
|
|
|
|
|
|
|
|
|
endif # PRODUCT_SEPOLICY_SPLIT
|
|
|
|
|
endif # SELINUX_IGNORE_NEVERALLOWS
|
|
|
|
|
endif # with_asan
|
2017-09-26 21:58:29 +02:00
|
|
|
|
2018-07-02 15:31:29 +02:00
|
|
|
ifneq ($(PLATFORM_SEPOLICY_VERSION),$(TOT_SEPOLICY_VERSION))
|
|
|
|
|
LOCAL_REQUIRED_MODULES += \
|
2021-09-15 05:01:05 +02:00
|
|
|
sepolicy_freeze_test
|
2018-07-02 15:31:29 +02:00
|
|
|
endif # ($(PLATFORM_SEPOLICY_VERSION),$(TOT_SEPOLICY_VERSION))
|
|
|
|
|
|
|
|
|
|
include $(BUILD_PHONY_PACKAGE)
|
|
|
|
|
|
|
|
|
|
#################################
|
|
|
|
|
|
|
|
|
|
include $(CLEAR_VARS)
|
|
|
|
|
|
2020-10-07 11:28:47 +02:00
|
|
|
LOCAL_MODULE := selinux_policy_system_ext
|
2021-02-04 08:07:40 +01:00
|
|
|
LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
|
|
|
|
|
LOCAL_LICENSE_CONDITIONS := notice unencumbered
|
|
|
|
|
LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
|
2018-07-02 15:31:29 +02:00
|
|
|
# Include precompiled policy, unless told otherwise.
|
|
|
|
|
ifneq ($(PRODUCT_PRECOMPILED_SEPOLICY),false)
|
2021-04-29 12:45:50 +02:00
|
|
|
ifdef HAS_SYSTEM_EXT_SEPOLICY
|
2020-10-07 11:28:47 +02:00
|
|
|
LOCAL_REQUIRED_MODULES += system_ext_sepolicy_and_mapping.sha256
|
2017-11-27 04:41:33 +01:00
|
|
|
endif
|
2021-04-29 12:45:50 +02:00
|
|
|
endif
|
2018-12-14 23:30:56 +01:00
|
|
|
|
2019-08-29 11:12:11 +02:00
|
|
|
ifdef HAS_SYSTEM_EXT_SEPOLICY
|
Allowing system_ext sepolicy to be empty
Some targets just need to extend system_ext context files, e.g.,
file_contexts, service_contexts, etc., without adding any system_ext
policy files, e.g., *.te files.
Currently, this will lead to build errors. This CL allows
system_ext_sepolicy.cil and the system_ext mapping file
to be empty.
It's now also possible to just set BOARD_PLAT_PRIVATE_SEPOLICY_DIR
without setting BOARD_PLAT_PUBLIC_SEPOLICY_DIR.
Bug: 137712473
Bug: 141880898
Test: Only adds system_ext context files without policy files (e.g., *.te),
then `mmma system/sepolicy` can build pass
Change-Id: I72849f2d4aa43e5296cd15c07a8fd058186a6376
2019-10-04 08:34:18 +02:00
|
|
|
LOCAL_REQUIRED_MODULES += system_ext_sepolicy.cil
|
|
|
|
|
endif
|
|
|
|
|
|
|
|
|
|
ifdef HAS_SYSTEM_EXT_PUBLIC_SEPOLICY
|
2019-10-11 01:29:40 +02:00
|
|
|
LOCAL_REQUIRED_MODULES += \
|
2020-09-22 00:32:16 +02:00
|
|
|
system_ext_mapping_file
|
|
|
|
|
|
|
|
|
|
system_ext_compat_files := $(call build_policy, $(sepolicy_compat_files), $(SYSTEM_EXT_PRIVATE_POLICY))
|
|
|
|
|
|
|
|
|
|
LOCAL_REQUIRED_MODULES += $(addprefix system_ext_, $(notdir $(system_ext_compat_files)))
|
2019-10-11 01:29:40 +02:00
|
|
|
|
Allowing system_ext sepolicy to be empty
Some targets just need to extend system_ext context files, e.g.,
file_contexts, service_contexts, etc., without adding any system_ext
policy files, e.g., *.te files.
Currently, this will lead to build errors. This CL allows
system_ext_sepolicy.cil and the system_ext mapping file
to be empty.
It's now also possible to just set BOARD_PLAT_PRIVATE_SEPOLICY_DIR
without setting BOARD_PLAT_PUBLIC_SEPOLICY_DIR.
Bug: 137712473
Bug: 141880898
Test: Only adds system_ext context files without policy files (e.g., *.te),
then `mmma system/sepolicy` can build pass
Change-Id: I72849f2d4aa43e5296cd15c07a8fd058186a6376
2019-10-04 08:34:18 +02:00
|
|
|
endif
|
|
|
|
|
|
|
|
|
|
ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR
|
2019-08-29 11:12:11 +02:00
|
|
|
LOCAL_REQUIRED_MODULES += \
|
2019-09-09 16:04:06 +02:00
|
|
|
system_ext_file_contexts \
|
|
|
|
|
system_ext_file_contexts_test \
|
2019-09-09 16:05:10 +02:00
|
|
|
system_ext_hwservice_contexts \
|
|
|
|
|
system_ext_hwservice_contexts_test \
|
2019-09-09 12:09:22 +02:00
|
|
|
system_ext_property_contexts \
|
|
|
|
|
system_ext_property_contexts_test \
|
2019-09-09 16:04:30 +02:00
|
|
|
system_ext_seapp_contexts \
|
2019-09-09 16:05:29 +02:00
|
|
|
system_ext_service_contexts \
|
|
|
|
|
system_ext_service_contexts_test \
|
2019-09-09 16:05:49 +02:00
|
|
|
system_ext_mac_permissions.xml \
|
2021-11-08 12:30:04 +01:00
|
|
|
system_ext_bug_map \
|
2021-04-12 20:49:29 +02:00
|
|
|
$(addprefix system_ext_,$(addsuffix .compat.cil,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS))) \
|
2019-08-29 11:12:11 +02:00
|
|
|
|
|
|
|
|
endif
|
|
|
|
|
|
2020-10-07 11:28:47 +02:00
|
|
|
include $(BUILD_PHONY_PACKAGE)
|
|
|
|
|
|
|
|
|
|
#################################
|
|
|
|
|
|
|
|
|
|
include $(CLEAR_VARS)
|
|
|
|
|
|
|
|
|
|
LOCAL_MODULE := selinux_policy_product
|
2021-02-04 08:07:40 +01:00
|
|
|
LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
|
|
|
|
|
LOCAL_LICENSE_CONDITIONS := notice unencumbered
|
|
|
|
|
LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
|
2020-10-07 11:28:47 +02:00
|
|
|
# Include precompiled policy, unless told otherwise.
|
|
|
|
|
ifneq ($(PRODUCT_PRECOMPILED_SEPOLICY),false)
|
2021-04-29 12:45:50 +02:00
|
|
|
ifdef HAS_PRODUCT_SEPOLICY
|
2020-10-07 11:28:47 +02:00
|
|
|
LOCAL_REQUIRED_MODULES += product_sepolicy_and_mapping.sha256
|
|
|
|
|
endif
|
2021-04-29 12:45:50 +02:00
|
|
|
endif
|
2020-10-07 11:28:47 +02:00
|
|
|
|
2018-12-14 23:30:56 +01:00
|
|
|
ifdef HAS_PRODUCT_SEPOLICY
|
2019-10-04 09:36:05 +02:00
|
|
|
LOCAL_REQUIRED_MODULES += product_sepolicy.cil
|
|
|
|
|
endif
|
|
|
|
|
|
|
|
|
|
ifdef HAS_PRODUCT_PUBLIC_SEPOLICY
|
2019-10-11 01:29:40 +02:00
|
|
|
LOCAL_REQUIRED_MODULES += \
|
2020-09-22 00:32:16 +02:00
|
|
|
product_mapping_file
|
|
|
|
|
|
|
|
|
|
product_compat_files := $(call build_policy, $(sepolicy_compat_files), $(PRODUCT_PRIVATE_POLICY))
|
|
|
|
|
|
|
|
|
|
LOCAL_REQUIRED_MODULES += $(addprefix product_, $(notdir $(product_compat_files)))
|
2019-10-11 01:29:40 +02:00
|
|
|
|
2019-10-04 09:36:05 +02:00
|
|
|
endif
|
|
|
|
|
|
|
|
|
|
ifdef HAS_PRODUCT_SEPOLICY_DIR
|
2018-12-14 23:30:56 +01:00
|
|
|
LOCAL_REQUIRED_MODULES += \
|
2018-12-19 04:51:19 +01:00
|
|
|
product_file_contexts \
|
Build contexts files with Soong
This is to migrate sepolicy Makefiles into Soong. For the first part,
file_contexts, hwservice_contexts, property_contexts, and
service_contexts are migrated. Build-time tests for contexts files are
still in Makefile; they will also be done with Soong after porting the
module sepolicy.
The motivation of migrating is based on generating property_contexts
dynamically: if we were to amend contexts files at build time in the
future, it would be nicer to manage them in Soong. To do that, building
contexts files with Soong can be very helpful.
Bug: 127949646
Bug: 129377144
Test: 1) Build blueline-userdebug, flash, and boot.
Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash,
and boot.
Test: 3) Build aosp_arm-userdebug.
Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
|
|
|
product_file_contexts_test \
|
2018-12-21 01:13:10 +01:00
|
|
|
product_hwservice_contexts \
|
Build contexts files with Soong
This is to migrate sepolicy Makefiles into Soong. For the first part,
file_contexts, hwservice_contexts, property_contexts, and
service_contexts are migrated. Build-time tests for contexts files are
still in Makefile; they will also be done with Soong after porting the
module sepolicy.
The motivation of migrating is based on generating property_contexts
dynamically: if we were to amend contexts files at build time in the
future, it would be nicer to manage them in Soong. To do that, building
contexts files with Soong can be very helpful.
Bug: 127949646
Bug: 129377144
Test: 1) Build blueline-userdebug, flash, and boot.
Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash,
and boot.
Test: 3) Build aosp_arm-userdebug.
Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
|
|
|
product_hwservice_contexts_test \
|
2018-12-21 04:31:42 +01:00
|
|
|
product_property_contexts \
|
Build contexts files with Soong
This is to migrate sepolicy Makefiles into Soong. For the first part,
file_contexts, hwservice_contexts, property_contexts, and
service_contexts are migrated. Build-time tests for contexts files are
still in Makefile; they will also be done with Soong after porting the
module sepolicy.
The motivation of migrating is based on generating property_contexts
dynamically: if we were to amend contexts files at build time in the
future, it would be nicer to manage them in Soong. To do that, building
contexts files with Soong can be very helpful.
Bug: 127949646
Bug: 129377144
Test: 1) Build blueline-userdebug, flash, and boot.
Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash,
and boot.
Test: 3) Build aosp_arm-userdebug.
Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
|
|
|
product_property_contexts_test \
|
2018-12-21 19:46:45 +01:00
|
|
|
product_seapp_contexts \
|
2018-12-21 21:28:14 +01:00
|
|
|
product_service_contexts \
|
Build contexts files with Soong
This is to migrate sepolicy Makefiles into Soong. For the first part,
file_contexts, hwservice_contexts, property_contexts, and
service_contexts are migrated. Build-time tests for contexts files are
still in Makefile; they will also be done with Soong after porting the
module sepolicy.
The motivation of migrating is based on generating property_contexts
dynamically: if we were to amend contexts files at build time in the
future, it would be nicer to manage them in Soong. To do that, building
contexts files with Soong can be very helpful.
Bug: 127949646
Bug: 129377144
Test: 1) Build blueline-userdebug, flash, and boot.
Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash,
and boot.
Test: 3) Build aosp_arm-userdebug.
Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
|
|
|
product_service_contexts_test \
|
2018-12-22 01:07:21 +01:00
|
|
|
product_mac_permissions.xml \
|
2018-12-14 23:30:56 +01:00
|
|
|
|
2019-01-23 18:47:05 +01:00
|
|
|
endif
|
|
|
|
|
|
2020-10-07 11:28:47 +02:00
|
|
|
include $(BUILD_PHONY_PACKAGE)
|
|
|
|
|
|
|
|
|
|
#################################
|
|
|
|
|
|
|
|
|
|
include $(CLEAR_VARS)
|
|
|
|
|
|
|
|
|
|
LOCAL_MODULE := selinux_policy_nonsystem
|
2021-02-04 08:07:40 +01:00
|
|
|
LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
|
|
|
|
|
LOCAL_LICENSE_CONDITIONS := notice unencumbered
|
|
|
|
|
LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
|
2020-10-07 11:28:47 +02:00
|
|
|
# Include precompiled policy, unless told otherwise.
|
|
|
|
|
ifneq ($(PRODUCT_PRECOMPILED_SEPOLICY),false)
|
|
|
|
|
LOCAL_REQUIRED_MODULES += \
|
|
|
|
|
precompiled_sepolicy \
|
2021-04-29 12:45:50 +02:00
|
|
|
precompiled_sepolicy.plat_sepolicy_and_mapping.sha256
|
|
|
|
|
|
|
|
|
|
ifdef HAS_SYSTEM_EXT_SEPOLICY
|
|
|
|
|
LOCAL_REQUIRED_MODULES += precompiled_sepolicy.system_ext_sepolicy_and_mapping.sha256
|
|
|
|
|
endif
|
|
|
|
|
|
|
|
|
|
ifdef HAS_PRODUCT_SEPOLICY
|
|
|
|
|
LOCAL_REQUIRED_MODULES += precompiled_sepolicy.product_sepolicy_and_mapping.sha256
|
|
|
|
|
endif
|
2020-10-07 11:28:47 +02:00
|
|
|
|
2022-01-28 13:41:20 +01:00
|
|
|
LOCAL_REQUIRED_MODULES += precompiled_sepolicy.apex_sepolicy.sha256
|
2020-10-07 11:28:47 +02:00
|
|
|
endif # ($(PRODUCT_PRECOMPILED_SEPOLICY),false)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# These build targets are not used on non-Treble devices. However, we build these to avoid
|
|
|
|
|
# divergence between Treble and non-Treble devices.
|
|
|
|
|
LOCAL_REQUIRED_MODULES += \
|
|
|
|
|
plat_pub_versioned.cil \
|
|
|
|
|
vendor_sepolicy.cil \
|
|
|
|
|
plat_sepolicy_vers.txt \
|
|
|
|
|
|
|
|
|
|
LOCAL_REQUIRED_MODULES += \
|
|
|
|
|
vendor_file_contexts \
|
|
|
|
|
vendor_file_contexts_test \
|
|
|
|
|
vendor_mac_permissions.xml \
|
|
|
|
|
vendor_property_contexts \
|
|
|
|
|
vendor_property_contexts_test \
|
|
|
|
|
vendor_seapp_contexts \
|
|
|
|
|
vendor_service_contexts \
|
2022-02-16 03:26:11 +01:00
|
|
|
vendor_service_contexts_test \
|
2020-10-07 11:28:47 +02:00
|
|
|
vendor_hwservice_contexts \
|
|
|
|
|
vendor_hwservice_contexts_test \
|
2021-11-08 12:30:04 +01:00
|
|
|
vendor_bug_map \
|
2020-10-07 11:28:47 +02:00
|
|
|
vndservice_contexts \
|
|
|
|
|
|
|
|
|
|
ifdef BOARD_ODM_SEPOLICY_DIRS
|
|
|
|
|
LOCAL_REQUIRED_MODULES += \
|
|
|
|
|
odm_sepolicy.cil \
|
|
|
|
|
odm_file_contexts \
|
|
|
|
|
odm_file_contexts_test \
|
|
|
|
|
odm_seapp_contexts \
|
|
|
|
|
odm_property_contexts \
|
|
|
|
|
odm_property_contexts_test \
|
|
|
|
|
odm_hwservice_contexts \
|
|
|
|
|
odm_hwservice_contexts_test \
|
|
|
|
|
odm_mac_permissions.xml
|
|
|
|
|
endif
|
|
|
|
|
|
|
|
|
|
LOCAL_REQUIRED_MODULES += selinux_policy_system_ext
|
|
|
|
|
LOCAL_REQUIRED_MODULES += selinux_policy_product
|
|
|
|
|
|
2019-04-19 16:03:33 +02:00
|
|
|
# Builds an addtional userdebug sepolicy into the debug ramdisk.
|
|
|
|
|
LOCAL_REQUIRED_MODULES += \
|
|
|
|
|
userdebug_plat_sepolicy.cil \
|
|
|
|
|
|
2017-04-10 21:27:18 +02:00
|
|
|
include $(BUILD_PHONY_PACKAGE)
|
|
|
|
|
|
2012-01-18 02:51:09 +01:00
|
|
|
##################################
|
2021-12-16 11:00:03 +01:00
|
|
|
# Policy files are now built with Android.bp. Grab them from intermediate.
|
|
|
|
|
# See Android.bp for details of policy files.
|
2021-03-19 08:04:51 +01:00
|
|
|
#
|
2021-03-22 02:26:13 +01:00
|
|
|
built_plat_cil := $(call intermediates-dir-for,ETC,plat_sepolicy.cil)/plat_sepolicy.cil
|
2021-03-19 08:04:51 +01:00
|
|
|
|
2021-03-22 02:26:13 +01:00
|
|
|
ifdef HAS_SYSTEM_EXT_SEPOLICY
|
|
|
|
|
built_system_ext_cil := $(call intermediates-dir-for,ETC,system_ext_sepolicy.cil)/system_ext_sepolicy.cil
|
|
|
|
|
endif # ifdef HAS_SYSTEM_EXT_SEPOLICY
|
2021-03-19 08:04:51 +01:00
|
|
|
|
2021-03-22 02:26:13 +01:00
|
|
|
ifdef HAS_PRODUCT_SEPOLICY
|
|
|
|
|
built_product_cil := $(call intermediates-dir-for,ETC,product_sepolicy.cil)/product_sepolicy.cil
|
|
|
|
|
endif # ifdef HAS_PRODUCT_SEPOLICY
|
2021-03-19 08:04:51 +01:00
|
|
|
|
2021-12-21 12:42:35 +01:00
|
|
|
built_sepolicy := $(call intermediates-dir-for,ETC,precompiled_sepolicy)/precompiled_sepolicy
|
2021-12-29 05:53:38 +01:00
|
|
|
built_sepolicy_neverallows := $(call intermediates-dir-for,ETC,sepolicy_neverallows)/sepolicy_neverallows
|
|
|
|
|
built_sepolicy_neverallows += $(call intermediates-dir-for,ETC,sepolicy_neverallows_vendor)/sepolicy_neverallows_vendor
|
2012-10-02 18:46:37 +02:00
|
|
|
|
2021-12-24 04:56:09 +01:00
|
|
|
#################################
|
|
|
|
|
# sepolicy is also built with Android.bp.
|
|
|
|
|
# This module is to keep compatibility with monolithic sepolicy devices.
|
|
|
|
|
include $(CLEAR_VARS)
|
|
|
|
|
|
|
|
|
|
LOCAL_MODULE := sepolicy
|
|
|
|
|
LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
|
|
|
|
|
LOCAL_LICENSE_CONDITIONS := notice unencumbered
|
|
|
|
|
LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
|
|
|
|
|
LOCAL_MODULE_CLASS := ETC
|
|
|
|
|
LOCAL_MODULE_TAGS := optional
|
|
|
|
|
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
|
|
|
|
|
|
|
|
|
|
include $(BUILD_SYSTEM)/base_rules.mk
|
|
|
|
|
|
|
|
|
|
$(LOCAL_BUILT_MODULE): $(built_sepolicy)
|
|
|
|
|
$(copy-file-to-target)
|
|
|
|
|
|
2015-06-30 01:31:23 +02:00
|
|
|
##################################
|
2016-12-12 18:29:04 +01:00
|
|
|
# TODO - remove this. Keep around until we get the filesystem creation stuff taken care of.
|
|
|
|
|
#
|
2015-06-30 01:31:23 +02:00
|
|
|
include $(CLEAR_VARS)
|
|
|
|
|
|
2015-08-06 18:43:52 +02:00
|
|
|
LOCAL_MODULE := file_contexts.bin
|
2021-02-04 08:07:40 +01:00
|
|
|
LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
|
|
|
|
|
LOCAL_LICENSE_CONDITIONS := notice unencumbered
|
|
|
|
|
LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
|
2012-01-18 02:51:09 +01:00
|
|
|
LOCAL_MODULE_CLASS := ETC
|
|
|
|
|
LOCAL_MODULE_TAGS := optional
|
|
|
|
|
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
|
|
|
|
|
|
2012-03-06 17:12:41 +01:00
|
|
|
include $(BUILD_SYSTEM)/base_rules.mk
|
2012-01-18 02:51:09 +01:00
|
|
|
|
2016-01-04 21:20:57 +01:00
|
|
|
# The file_contexts.bin is built in the following way:
|
|
|
|
|
# 1. Collect all file_contexts files in THIS repository and process them with
|
|
|
|
|
# m4 into a tmp file called file_contexts.local.tmp.
|
2020-09-23 12:16:10 +02:00
|
|
|
# 2. Collect all file_contexts files from LOCAL_FILE_CONTEXTS of installed
|
|
|
|
|
# modules with m4 with a tmp file called file_contexts.modules.tmp.
|
|
|
|
|
# 3. Collect all device specific file_contexts files and process them with m4
|
2016-01-04 21:20:57 +01:00
|
|
|
# into a tmp file called file_contexts.device.tmp.
|
2020-09-23 12:16:10 +02:00
|
|
|
# 4. Run checkfc -e (allow no device fc entries ie empty) and fc_sort on
|
2016-01-04 21:20:57 +01:00
|
|
|
# file_contexts.device.tmp and output to file_contexts.device.sorted.tmp.
|
2020-09-23 12:16:10 +02:00
|
|
|
# 5. Concatenate file_contexts.local.tmp, file_contexts.modules.tmp and
|
2020-11-09 12:58:58 +01:00
|
|
|
# file_contexts.device.sorted.tmp into file_contexts.concat.tmp.
|
2020-09-23 12:16:10 +02:00
|
|
|
# 6. Run checkfc and sefcontext_compile on file_contexts.concat.tmp to produce
|
2016-01-04 21:20:57 +01:00
|
|
|
# file_contexts.bin.
|
|
|
|
|
#
|
|
|
|
|
# Note: That a newline file is placed between each file_context file found to
|
|
|
|
|
# ensure a proper build when an fc file is missing an ending newline.
|
|
|
|
|
|
2017-05-08 23:26:52 +02:00
|
|
|
local_fc_files := $(call build_policy, file_contexts, $(PLAT_PRIVATE_POLICY))
|
|
|
|
|
|
Allowing system_ext sepolicy to be empty
Some targets just need to extend system_ext context files, e.g.,
file_contexts, service_contexts, etc., without adding any system_ext
policy files, e.g., *.te files.
Currently, this will lead to build errors. This CL allows
system_ext_sepolicy.cil and the system_ext mapping file
to be empty.
It's now also possible to just set BOARD_PLAT_PRIVATE_SEPOLICY_DIR
without setting BOARD_PLAT_PUBLIC_SEPOLICY_DIR.
Bug: 137712473
Bug: 141880898
Test: Only adds system_ext context files without policy files (e.g., *.te),
then `mmma system/sepolicy` can build pass
Change-Id: I72849f2d4aa43e5296cd15c07a8fd058186a6376
2019-10-04 08:34:18 +02:00
|
|
|
ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR
|
2019-09-09 16:04:06 +02:00
|
|
|
local_fc_files += $(call build_policy, file_contexts, $(SYSTEM_EXT_PRIVATE_POLICY))
|
|
|
|
|
endif
|
|
|
|
|
|
2019-10-04 09:36:05 +02:00
|
|
|
ifdef HAS_PRODUCT_SEPOLICY_DIR
|
2018-12-14 23:30:56 +01:00
|
|
|
local_fc_files += $(call build_policy, file_contexts, $(PRODUCT_PRIVATE_POLICY))
|
|
|
|
|
endif
|
|
|
|
|
|
2015-09-18 21:05:51 +02:00
|
|
|
ifneq ($(filter address,$(SANITIZE_TARGET)),)
|
2018-06-13 17:02:29 +02:00
|
|
|
local_fc_files += $(wildcard $(addsuffix /file_contexts_asan, $(PLAT_PRIVATE_POLICY)))
|
|
|
|
|
endif
|
|
|
|
|
ifneq (,$(filter userdebug eng,$(TARGET_BUILD_VARIANT)))
|
|
|
|
|
local_fc_files += $(wildcard $(addsuffix /file_contexts_overlayfs, $(PLAT_PRIVATE_POLICY)))
|
2015-06-13 02:18:20 +02:00
|
|
|
endif
|
2019-11-20 09:54:34 +01:00
|
|
|
|
2016-01-04 21:20:57 +01:00
|
|
|
file_contexts.local.tmp := $(intermediates)/file_contexts.local.tmp
|
2020-09-23 12:16:10 +02:00
|
|
|
$(call merge-fc-files,$(local_fc_files),$(file_contexts.local.tmp))
|
|
|
|
|
|
|
|
|
|
# The rule for file_contexts.modules.tmp is defined in build/make/core/Makefile.
|
|
|
|
|
# it gathers LOCAL_FILE_CONTEXTS from product_MODULES
|
|
|
|
|
file_contexts.modules.tmp := $(intermediates)/file_contexts.modules.tmp
|
2016-01-04 21:20:57 +01:00
|
|
|
|
2018-02-05 10:34:52 +01:00
|
|
|
device_fc_files := $(call build_vendor_policy, file_contexts)
|
2017-11-29 09:14:53 +01:00
|
|
|
|
|
|
|
|
ifdef BOARD_ODM_SEPOLICY_DIRS
|
|
|
|
|
device_fc_files += $(call build_odm_policy, file_contexts)
|
|
|
|
|
endif
|
|
|
|
|
|
2016-01-04 21:20:57 +01:00
|
|
|
file_contexts.device.tmp := $(intermediates)/file_contexts.device.tmp
|
|
|
|
|
$(file_contexts.device.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
|
2019-06-19 19:52:50 +02:00
|
|
|
$(file_contexts.device.tmp): PRIVATE_DEVICE_FC_FILES := $(device_fc_files)
|
|
|
|
|
$(file_contexts.device.tmp): $(device_fc_files) $(M4)
|
2016-01-04 21:20:57 +01:00
|
|
|
@mkdir -p $(dir $@)
|
2019-06-19 19:52:50 +02:00
|
|
|
$(hide) $(M4) --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_DEVICE_FC_FILES) > $@
|
2016-01-04 21:20:57 +01:00
|
|
|
|
|
|
|
|
file_contexts.device.sorted.tmp := $(intermediates)/file_contexts.device.sorted.tmp
|
|
|
|
|
$(file_contexts.device.sorted.tmp): PRIVATE_SEPOLICY := $(built_sepolicy)
|
2018-02-05 10:34:52 +01:00
|
|
|
$(file_contexts.device.sorted.tmp): $(file_contexts.device.tmp) $(built_sepolicy) \
|
|
|
|
|
$(HOST_OUT_EXECUTABLES)/fc_sort $(HOST_OUT_EXECUTABLES)/checkfc
|
2016-01-04 21:20:57 +01:00
|
|
|
@mkdir -p $(dir $@)
|
2016-12-07 20:27:47 +01:00
|
|
|
$(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e $(PRIVATE_SEPOLICY) $<
|
2019-04-11 01:53:17 +02:00
|
|
|
$(hide) $(HOST_OUT_EXECUTABLES)/fc_sort -i $< -o $@
|
2012-10-02 18:46:37 +02:00
|
|
|
|
2016-01-04 21:20:57 +01:00
|
|
|
file_contexts.concat.tmp := $(intermediates)/file_contexts.concat.tmp
|
2020-09-23 12:16:10 +02:00
|
|
|
$(call merge-fc-files,\
|
|
|
|
|
$(file_contexts.local.tmp) $(file_contexts.modules.tmp) $(file_contexts.device.sorted.tmp),\
|
|
|
|
|
$(file_contexts.concat.tmp))
|
2012-01-18 02:51:09 +01:00
|
|
|
|
2015-09-25 19:18:44 +02:00
|
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
|
2016-01-04 21:20:57 +01:00
|
|
|
$(LOCAL_BUILT_MODULE): $(file_contexts.concat.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/sefcontext_compile $(HOST_OUT_EXECUTABLES)/checkfc
|
2015-08-06 18:43:52 +02:00
|
|
|
@mkdir -p $(dir $@)
|
2016-12-07 20:27:47 +01:00
|
|
|
$(hide) $(HOST_OUT_EXECUTABLES)/checkfc $(PRIVATE_SEPOLICY) $<
|
2015-08-06 18:43:52 +02:00
|
|
|
$(hide) $(HOST_OUT_EXECUTABLES)/sefcontext_compile -o $@ $<
|
|
|
|
|
|
2014-03-20 14:35:08 +01:00
|
|
|
built_fc := $(LOCAL_BUILT_MODULE)
|
2016-01-04 21:20:57 +01:00
|
|
|
local_fc_files :=
|
|
|
|
|
local_fcfiles_with_nl :=
|
|
|
|
|
device_fc_files :=
|
|
|
|
|
device_fcfiles_with_nl :=
|
|
|
|
|
file_contexts.concat.tmp :=
|
|
|
|
|
file_contexts.device.sorted.tmp :=
|
|
|
|
|
file_contexts.device.tmp :=
|
|
|
|
|
file_contexts.local.tmp :=
|
2020-09-23 12:16:10 +02:00
|
|
|
file_contexts.modules.tmp :=
|
2012-08-16 19:55:05 +02:00
|
|
|
|
2017-04-08 01:14:43 +02:00
|
|
|
##################################
|
|
|
|
|
include $(CLEAR_VARS)
|
|
|
|
|
|
2017-04-01 02:29:53 +02:00
|
|
|
LOCAL_MODULE := vndservice_contexts
|
2021-02-04 08:07:40 +01:00
|
|
|
LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
|
|
|
|
|
LOCAL_LICENSE_CONDITIONS := notice unencumbered
|
|
|
|
|
LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
|
2017-04-01 02:29:53 +02:00
|
|
|
LOCAL_MODULE_CLASS := ETC
|
|
|
|
|
LOCAL_MODULE_TAGS := optional
|
|
|
|
|
LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
|
|
|
|
|
|
|
|
|
|
include $(BUILD_SYSTEM)/base_rules.mk
|
|
|
|
|
|
2021-12-08 14:45:58 +01:00
|
|
|
vnd_svcfiles := $(call build_policy, vndservice_contexts, $(BOARD_PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_REQD_MASK_POLICY))
|
2017-04-01 02:29:53 +02:00
|
|
|
|
|
|
|
|
vndservice_contexts.tmp := $(intermediates)/vndservice_contexts.tmp
|
|
|
|
|
$(vndservice_contexts.tmp): PRIVATE_SVC_FILES := $(vnd_svcfiles)
|
|
|
|
|
$(vndservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
|
2019-06-19 19:52:50 +02:00
|
|
|
$(vndservice_contexts.tmp): $(vnd_svcfiles) $(M4)
|
2017-04-01 02:29:53 +02:00
|
|
|
@mkdir -p $(dir $@)
|
2019-06-19 19:52:50 +02:00
|
|
|
$(hide) $(M4) --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
|
2017-04-01 02:29:53 +02:00
|
|
|
|
|
|
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
|
|
|
|
|
$(LOCAL_BUILT_MODULE): $(vndservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
|
|
|
|
|
@mkdir -p $(dir $@)
|
|
|
|
|
sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
|
2017-04-07 19:08:55 +02:00
|
|
|
$(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e -v $(PRIVATE_SEPOLICY) $@
|
2017-04-01 02:29:53 +02:00
|
|
|
|
|
|
|
|
vnd_svcfiles :=
|
|
|
|
|
vndservice_contexts.tmp :=
|
2018-12-22 01:07:21 +01:00
|
|
|
|
|
|
|
|
##################################
|
2019-01-08 01:43:31 +01:00
|
|
|
include $(LOCAL_PATH)/mac_permissions.mk
|
2017-11-29 09:06:15 +01:00
|
|
|
|
Build contexts files with Soong
This is to migrate sepolicy Makefiles into Soong. For the first part,
file_contexts, hwservice_contexts, property_contexts, and
service_contexts are migrated. Build-time tests for contexts files are
still in Makefile; they will also be done with Soong after porting the
module sepolicy.
The motivation of migrating is based on generating property_contexts
dynamically: if we were to amend contexts files at build time in the
future, it would be nicer to manage them in Soong. To do that, building
contexts files with Soong can be very helpful.
Bug: 127949646
Bug: 129377144
Test: 1) Build blueline-userdebug, flash, and boot.
Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash,
and boot.
Test: 3) Build aosp_arm-userdebug.
Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
|
|
|
all_fc_files := $(TARGET_OUT)/etc/selinux/plat_file_contexts
|
|
|
|
|
all_fc_files += $(TARGET_OUT_VENDOR)/etc/selinux/vendor_file_contexts
|
Allowing system_ext sepolicy to be empty
Some targets just need to extend system_ext context files, e.g.,
file_contexts, service_contexts, etc., without adding any system_ext
policy files, e.g., *.te files.
Currently, this will lead to build errors. This CL allows
system_ext_sepolicy.cil and the system_ext mapping file
to be empty.
It's now also possible to just set BOARD_PLAT_PRIVATE_SEPOLICY_DIR
without setting BOARD_PLAT_PUBLIC_SEPOLICY_DIR.
Bug: 137712473
Bug: 141880898
Test: Only adds system_ext context files without policy files (e.g., *.te),
then `mmma system/sepolicy` can build pass
Change-Id: I72849f2d4aa43e5296cd15c07a8fd058186a6376
2019-10-04 08:34:18 +02:00
|
|
|
ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR
|
2019-09-09 16:04:06 +02:00
|
|
|
all_fc_files += $(TARGET_OUT_SYSTEM_EXT)/etc/selinux/system_ext_file_contexts
|
|
|
|
|
endif
|
2019-10-04 09:36:05 +02:00
|
|
|
ifdef HAS_PRODUCT_SEPOLICY_DIR
|
Build contexts files with Soong
This is to migrate sepolicy Makefiles into Soong. For the first part,
file_contexts, hwservice_contexts, property_contexts, and
service_contexts are migrated. Build-time tests for contexts files are
still in Makefile; they will also be done with Soong after porting the
module sepolicy.
The motivation of migrating is based on generating property_contexts
dynamically: if we were to amend contexts files at build time in the
future, it would be nicer to manage them in Soong. To do that, building
contexts files with Soong can be very helpful.
Bug: 127949646
Bug: 129377144
Test: 1) Build blueline-userdebug, flash, and boot.
Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash,
and boot.
Test: 3) Build aosp_arm-userdebug.
Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
|
|
|
all_fc_files += $(TARGET_OUT_PRODUCT)/etc/selinux/product_file_contexts
|
2018-12-19 04:51:19 +01:00
|
|
|
endif
|
2017-11-29 09:14:53 +01:00
|
|
|
ifdef BOARD_ODM_SEPOLICY_DIRS
|
Build contexts files with Soong
This is to migrate sepolicy Makefiles into Soong. For the first part,
file_contexts, hwservice_contexts, property_contexts, and
service_contexts are migrated. Build-time tests for contexts files are
still in Makefile; they will also be done with Soong after porting the
module sepolicy.
The motivation of migrating is based on generating property_contexts
dynamically: if we were to amend contexts files at build time in the
future, it would be nicer to manage them in Soong. To do that, building
contexts files with Soong can be very helpful.
Bug: 127949646
Bug: 129377144
Test: 1) Build blueline-userdebug, flash, and boot.
Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash,
and boot.
Test: 3) Build aosp_arm-userdebug.
Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
|
|
|
all_fc_files += $(TARGET_OUT_ODM)/etc/selinux/odm_file_contexts
|
2017-11-29 09:14:53 +01:00
|
|
|
endif
|
2018-02-05 10:34:52 +01:00
|
|
|
all_fc_args := $(foreach file, $(all_fc_files), -f $(file))
|
|
|
|
|
|
2014-03-20 14:35:08 +01:00
|
|
|
##################################
|
2021-09-27 15:43:01 +02:00
|
|
|
# Tests for Treble compatibility of current platform policy and vendor policy of
|
|
|
|
|
# given release version.
|
|
|
|
|
ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
|
2021-03-22 11:25:09 +01:00
|
|
|
|
2021-09-27 15:43:01 +02:00
|
|
|
built_plat_sepolicy := $(call intermediates-dir-for,ETC,base_plat_sepolicy)/base_plat_sepolicy
|
|
|
|
|
built_system_ext_sepolicy := $(call intermediates-dir-for,ETC,base_system_ext_sepolicy)/base_system_ext_sepolicy
|
|
|
|
|
built_product_sepolicy := $(call intermediates-dir-for,ETC,base_product_sepolicy)/base_product_sepolicy
|
2021-03-22 11:25:09 +01:00
|
|
|
|
2021-09-27 15:43:01 +02:00
|
|
|
base_plat_pub_policy.cil := $(call intermediates-dir-for,ETC,base_plat_pub_policy.cil)/base_plat_pub_policy.cil
|
|
|
|
|
base_system_ext_pub_polcy.cil := $(call intermediates-dir-for,ETC,base_system_ext_pub_polcy.cil)/base_system_ext_pub_polcy.cil
|
|
|
|
|
base_product_pub_policy.cil := $(call intermediates-dir-for,ETC,base_product_pub_policy.cil)/base_product_pub_policy.cil
|
2021-03-22 11:25:09 +01:00
|
|
|
|
2021-12-10 10:34:41 +01:00
|
|
|
$(foreach v,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS), \
|
|
|
|
|
$(eval version_under_treble_tests := $(v)) \
|
|
|
|
|
$(eval include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk) \
|
|
|
|
|
)
|
2019-09-20 20:16:29 +02:00
|
|
|
endif # PRODUCT_SEPOLICY_SPLIT
|
2018-07-11 11:30:44 +02:00
|
|
|
|
2021-09-27 15:43:01 +02:00
|
|
|
built_plat_sepolicy :=
|
|
|
|
|
built_system_ext_sepolicy :=
|
|
|
|
|
built_product_sepolicy :=
|
|
|
|
|
base_plat_pub_policy.cil :=
|
|
|
|
|
base_system_ext_pub_polcy.cil :=
|
|
|
|
|
base_product_pub_policy.cil :=
|
Build contexts files with Soong
This is to migrate sepolicy Makefiles into Soong. For the first part,
file_contexts, hwservice_contexts, property_contexts, and
service_contexts are migrated. Build-time tests for contexts files are
still in Makefile; they will also be done with Soong after porting the
module sepolicy.
The motivation of migrating is based on generating property_contexts
dynamically: if we were to amend contexts files at build time in the
future, it would be nicer to manage them in Soong. To do that, building
contexts files with Soong can be very helpful.
Bug: 127949646
Bug: 129377144
Test: 1) Build blueline-userdebug, flash, and boot.
Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash,
and boot.
Test: 3) Build aosp_arm-userdebug.
Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
|
|
|
all_fc_files :=
|
|
|
|
|
all_fc_args :=
|
2017-09-26 21:58:29 +02:00
|
|
|
|
2018-03-15 19:38:08 +01:00
|
|
|
#################################
|
|
|
|
|
|
2012-10-18 03:09:52 +02:00
|
|
|
|
2018-02-05 10:34:52 +01:00
|
|
|
build_vendor_policy :=
|
2017-11-29 09:14:53 +01:00
|
|
|
build_odm_policy :=
|
2016-12-16 00:28:44 +01:00
|
|
|
build_policy :=
|
2017-02-25 23:47:53 +01:00
|
|
|
built_plat_cil :=
|
2019-08-29 11:12:11 +02:00
|
|
|
built_system_ext_cil :=
|
|
|
|
|
built_product_cil :=
|
2016-12-16 00:28:44 +01:00
|
|
|
built_sepolicy :=
|
2018-01-04 01:53:24 +01:00
|
|
|
built_sepolicy_neverallows :=
|
2016-12-28 00:10:48 +01:00
|
|
|
built_plat_svc :=
|
2018-02-05 10:34:52 +01:00
|
|
|
built_vendor_svc :=
|
2019-09-26 08:14:55 +02:00
|
|
|
treble_sysprop_neverallow :=
|
2020-09-28 06:32:43 +02:00
|
|
|
enforce_sysprop_owner :=
|
2021-04-27 01:32:17 +02:00
|
|
|
enforce_debugfs_restriction :=
|
2016-12-16 00:28:44 +01:00
|
|
|
my_target_arch :=
|
|
|
|
|
sepolicy_build_files :=
|
Mark all clients of Allocator HAL
This change associates all domains which are clients of Allocator HAL
with hal_allocator_client and the, required for all HAL client
domains, halclientdomain.
This enables this commit to remove the now unnecessary hwallocator_use
macro because its binder_call(..., hal_allocator_server) is covered by
binder_call(hal_allocator_client, hal_allocator_server) added in this
commit.
Unfortunately apps, except isolated app, are clients of Allocator HAL
as well. This makes it hard to use the hal_client_domain(...,
hal_allocator) macro because it translates into "typeattribute" which
currently does not support being provided with a set of types, such as
{ appdomain -isolated_app }. As a workaround, hopefully until
typeattribute is improved, this commit expresses the necessary
association operation in CIL. private/technical_debt.cil introduced by
this commit is appended into the platform policy CIL file, thus
ensuring that the hack has effect on the final monolithic policy.
P. S. This change also removes Allocator HAL access from isolated_app.
Isolated app shouldn't have access to this HAL anyway.
Test: Google Play Music plays back radios
Test: Google Camera records video with sound and that video is then
successfully played back with sound
Test: YouTube app plays back clips with sound
Test: YouTube in Chrome plays back clips with sound
Bug: 34170079
Change-Id: Id00bba6fde83e7cf04fb58bc1c353c2f66333f92
2017-03-21 22:28:53 +01:00
|
|
|
sepolicy_build_cil_workaround_files :=
|
2017-03-13 20:22:15 +01:00
|
|
|
with_asan :=
|
2012-11-01 19:33:04 +01:00
|
|
|
|
|
|
|
|
include $(call all-makefiles-under,$(LOCAL_PATH))
|
