tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/treble_sepolicy_tests_for_release.mk

129 lines
6.6 KiB
Makefile
Raw Normal View History

Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
version := $(version_under_treble_tests)
include $(CLEAR_VARS)
# For Treble builds run tests verifying that processes are properly labeled and
# permissions granted do not violate the treble model. Also ensure that treble
# compatibility guarantees are upheld between SELinux version bumps.
LOCAL_MODULE := treble_sepolicy_tests_$(version)
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := tests
include $(BUILD_SYSTEM)/base_rules.mk
# $(version)_plat - the platform policy shipped as part of the $(version) release. This is
# built to enable us to determine the diff between the current policy and the
# $(version) policy, which will be used in tests to make sure that compatibility has
# been maintained by our mapping files.
$(version)_PLAT_PUBLIC_POLICY := $(LOCAL_PATH)/prebuilts/api/$(version)/public
$(version)_PLAT_PRIVATE_POLICY := $(LOCAL_PATH)/prebuilts/api/$(version)/private
$(version)_plat_policy.conf := $(intermediates)/$(version)_plat_policy.conf
$($(version)_plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
$($(version)_plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Use user policy for compatibility tests. Use the user policy when running the compatibility tests. Bug: 74344625 Test: Built policy for many devices. Booted one device. Test: Delete some compat rules, verify error on userdebug. Change-Id: Ib2df2dfc06cdf55a839011e9a528e76160a9e436
2018-03-23 20:40:26 +01:00
$($(version)_plat_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := user
Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
$($(version)_plat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
$($(version)_plat_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
$($(version)_plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$($(version)_plat_policy.conf): PRIVATE_SEPOLICY_SPLIT := true
$($(version)_plat_policy.conf): $(call build_policy, $(sepolicy_build_files), \
$($(version)_PLAT_PUBLIC_POLICY) $($(version)_PLAT_PRIVATE_POLICY))
$(transform-policy-to-conf)
$(hide) sed '/dontaudit/d' $@ > $@.dontaudit
built_$(version)_plat_sepolicy := $(intermediates)/built_$(version)_plat_sepolicy
$(built_$(version)_plat_sepolicy): PRIVATE_ADDITIONAL_CIL_FILES := \
$(call build_policy, technical_debt.cil , $($(version)_PLAT_PRIVATE_POLICY))
$(built_$(version)_plat_sepolicy): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
$(built_$(version)_plat_sepolicy): $($(version)_plat_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
$(HOST_OUT_EXECUTABLES)/secilc \
$(call build_policy, technical_debt.cil, $($(version)_PLAT_PRIVATE_POLICY)) \
$(built_sepolicy_neverallows)
@mkdir -p $(dir $@)
$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \
$(POLICYVERS) -o $@ $<
$(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@
$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $@ -o $@ -f /dev/null
$(version)_plat_policy.conf :=
# $(version)_compat - the current plat_sepolicy.cil built with the compatibility file
# targeting the $(version) SELinux release. This ensures that our policy will build
# when used on a device that has non-platform policy targetting the $(version) release.
$(version)_compat := $(intermediates)/$(version)_compat
Only maintain maps between current and previous selinux versions. New maintenance scheme for mapping files: Say, V is the current SELinux platform version, then at any point in time we only maintain (V->V-1) mapping. (V->V-n) map is constructed from top (V->V-n+1) and bottom (V-n+1->V-n) without changes to previously maintained mapping files. Caveats: - 26.0.cil doesn't technically represent 27.0->26.0 map, but rather current->26.0. We'll fully migrate to the scheme with future releases. Bug: 67510052 Test: adding new public type only requires changing the latest compat map Change-Id: Iab5564e887ef2c8004cb493505dd56c6220c61f8
2018-09-30 02:47:10 +02:00
$(version)_mapping.cil := $(call intermediates-dir-for,ETC,$(version).cil)/$(version).cil
$(version)_mapping.ignore.cil := \
$(call intermediates-dir-for,ETC,$(version).ignore.cil)/$(version).ignore.cil
Add mapping files for 28.0.[ignore.]cil Steps taken to produce the mapping files: 1. Add prebuilts/api/28.0/[plat_pub_versioned.cil|vendor_sepolicy.cil] from the /vendor/etc/selinux/[plat_pub_versioned.cil|vendor_sepolicy.cil] files built on pi-dev with lunch target aosp_arm64-eng 2. Add new file private/compat/28.0/28.0.cil by doing the following: - copy /system/etc/selinux/mapping/28.0.cil from pi-dev aosp_arm64-eng device to private/compat/28.0/28.0.cil - remove all attribute declaration statement (typeattribute ...) and sort lines alphabetically - some selinux types were added/renamed/deleted w.r.t 28 sepolicy. Find all such types using treble_sepolicy_tests_28.0 test. - for all these types figure out where to map them by looking at 27.0.[ignore.]cil files and add approprite entries to 28.0.[ignore.]cil. This change also enables treble_sepolicy_tests_28.0 and install 28.0.cil mapping onto the device. Bug: 72458734 Test: m selinux_policy Change-Id: I90e17c0b43af436da4b62c16179c198b5c74002c
2018-07-11 11:30:44 +02:00
$(version)_prebuilts_dir := $(LOCAL_PATH)/prebuilts/api/$(version)
# vendor_sepolicy.cil and plat_pub_versioned.cil are the new design to replace
# nonplat_sepolicy.cil.
$(version)_nonplat := $($(version)_prebuilts_dir)/vendor_sepolicy.cil \
$($(version)_prebuilts_dir)/plat_pub_versioned.cil
ifeq (,$(wildcard $($(version)_nonplat)))
$(version)_nonplat := $($(version)_prebuilts_dir)/nonplat_sepolicy.cil
endif
Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
$($(version)_compat): PRIVATE_CIL_FILES := \
$(built_plat_cil) $($(version)_mapping.cil) $($(version)_nonplat)
$($(version)_compat): $(HOST_OUT_EXECUTABLES)/secilc \
$(built_plat_cil) $($(version)_mapping.cil) $($(version)_nonplat)
$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -N -c $(POLICYVERS) \
$(PRIVATE_CIL_FILES) -o $@ -f /dev/null
# $(version)_mapping.combined.cil - a combination of the mapping file used when
# combining the current platform policy with nonplatform policy based on the
# $(version) policy release and also a special ignored file that exists purely for
# these tests.
$(version)_mapping.combined.cil := $(intermediates)/$(version)_mapping.combined.cil
$($(version)_mapping.combined.cil): $($(version)_mapping.cil) $($(version)_mapping.ignore.cil)
mkdir -p $(dir $@)
cat $^ > $@
treble_sepolicy_tests_$(version) := $(intermediates)/treble_sepolicy_tests_$(version)
$(treble_sepolicy_tests_$(version)): ALL_FC_ARGS := $(all_fc_args)
$(treble_sepolicy_tests_$(version)): PRIVATE_SEPOLICY := $(built_sepolicy)
$(treble_sepolicy_tests_$(version)): PRIVATE_SEPOLICY_OLD := $(built_$(version)_plat_sepolicy)
$(treble_sepolicy_tests_$(version)): PRIVATE_COMBINED_MAPPING := $($(version)_mapping.combined.cil)
$(treble_sepolicy_tests_$(version)): PRIVATE_PLAT_SEPOLICY := $(built_plat_sepolicy)
Don't require private types in mapping file. Private types are not visible to vendor/odm policy, so we don't need mapping entries for them. We build platform-only public policy .cil file and give it as input to treble_sepolicy_tests. Using this public policy the test can now figure out if the newly added type in public or private. Bug: 116344577 Test: adding public type triggers mapping test failure, adding private type does not. Change-Id: I421f335e37274b24aa73109e260653d7b73788b5
2018-09-29 02:21:08 +02:00
$(treble_sepolicy_tests_$(version)): PRIVATE_PLAT_PUB_SEPOLICY := $(base_plat_pub_policy.cil)
Apply '--fake-treble' flag to the intended devices (for the build-time tests) treble_sepolicy_tests applies tests to the SEPolicy for devices which implement the SEPolicy split introduced in Android O. For devices which turn this on and also implement all of the other requirements which together compose PRODUCT_FULL_TREBLE, these tests help ensure that the backwards compatibility which this feature adds is possible. When this test was originally written, devices which specified PRODUCT_FULL_TREBLE_OVERRIDE were only those devices with a PRODUCT_SHIPPING_API_LEVEL of < 26. This allowed them to update to use these features but maintain some legacy behaviors. For these devices, to achieve the same backwards compatibility guarantees, much other/extra work would have to be done (if it is possible at all). Since that time, a new category of devices take advantage of PRODUCT_FULL_TREBLE_OVERRIDE. These devices must either not define a PRODUCT_SHIPPING_API_LEVEL or they apply this flag even though it is not required to be applied. For these cases, the full test suite not being run has caused problems because these failures aren't discoverred until later (when compliance tests are run). Fixes: 112933807 Test: treble_sepolicy_tests on marlin, walleye, and 'some other device' (mma here runs this with the correct parameters) Change-Id: I04c42d3cb86cda3c82f285919b40ba94e1332daa
2018-09-08 01:01:38 +02:00
$(treble_sepolicy_tests_$(version)): PRIVATE_FAKE_TREBLE :=
Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
ifeq ($(PRODUCT_FULL_TREBLE_OVERRIDE),true)
Don't check PRODUCT_SHIPPING_API_LEVEL to determine fake treble. Emulator device can not be considered a full treble device even though it has PRODUCT_SHIPPING_API_LEVEL = 28. This is prevents us from merging neverallow rules that implement Treble requirements (aosp/798433). As a temporary workaround, disable the checks on that variable. Bug: 112933807 Bug: 113124961 Bug: 111243627 Test: m selinux_policy Change-Id: I9a29c01dfcbc70e4ba1e4eef233355bc18ec2108
2018-10-31 22:18:15 +01:00
# TODO(b/113124961): account for PRODUCT_SHIPPING_API_LEVEL when determining
# fake treble status once emulator is no longer fake treble.
#ifdef PRODUCT_SHIPPING_API_LEVEL
Apply '--fake-treble' flag to the intended devices (for the build-time tests) treble_sepolicy_tests applies tests to the SEPolicy for devices which implement the SEPolicy split introduced in Android O. For devices which turn this on and also implement all of the other requirements which together compose PRODUCT_FULL_TREBLE, these tests help ensure that the backwards compatibility which this feature adds is possible. When this test was originally written, devices which specified PRODUCT_FULL_TREBLE_OVERRIDE were only those devices with a PRODUCT_SHIPPING_API_LEVEL of < 26. This allowed them to update to use these features but maintain some legacy behaviors. For these devices, to achieve the same backwards compatibility guarantees, much other/extra work would have to be done (if it is possible at all). Since that time, a new category of devices take advantage of PRODUCT_FULL_TREBLE_OVERRIDE. These devices must either not define a PRODUCT_SHIPPING_API_LEVEL or they apply this flag even though it is not required to be applied. For these cases, the full test suite not being run has caused problems because these failures aren't discoverred until later (when compliance tests are run). Fixes: 112933807 Test: treble_sepolicy_tests on marlin, walleye, and 'some other device' (mma here runs this with the correct parameters) Change-Id: I04c42d3cb86cda3c82f285919b40ba94e1332daa
2018-09-08 01:01:38 +02:00
# These requirements were originally added in Android Oreo. Devices
# launching after this should not distinguish between
# PRODUCT_FULL_TREBLE and PRODUCT_FULL_TREBLE_OVERRIDE since this could
# lead to release problems where they think they pass this test but
# fail it when it actually gets runned for compliance.
Don't check PRODUCT_SHIPPING_API_LEVEL to determine fake treble. Emulator device can not be considered a full treble device even though it has PRODUCT_SHIPPING_API_LEVEL = 28. This is prevents us from merging neverallow rules that implement Treble requirements (aosp/798433). As a temporary workaround, disable the checks on that variable. Bug: 112933807 Bug: 113124961 Bug: 111243627 Test: m selinux_policy Change-Id: I9a29c01dfcbc70e4ba1e4eef233355bc18ec2108
2018-10-31 22:18:15 +01:00
#ifeq ($(call math_gt_or_eq,$(PRODUCT_SHIPPING_API_LEVEL),26),)
Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
$(treble_sepolicy_tests_$(version)): PRIVATE_FAKE_TREBLE := --fake-treble
Don't check PRODUCT_SHIPPING_API_LEVEL to determine fake treble. Emulator device can not be considered a full treble device even though it has PRODUCT_SHIPPING_API_LEVEL = 28. This is prevents us from merging neverallow rules that implement Treble requirements (aosp/798433). As a temporary workaround, disable the checks on that variable. Bug: 112933807 Bug: 113124961 Bug: 111243627 Test: m selinux_policy Change-Id: I9a29c01dfcbc70e4ba1e4eef233355bc18ec2108
2018-10-31 22:18:15 +01:00
#endif # if PRODUCT_SHIPPING_API_LEVEL < 26 (Android Oreo)
#endif # PRODUCT_SHIPPING_API_LEVEL defined
Apply '--fake-treble' flag to the intended devices (for the build-time tests) treble_sepolicy_tests applies tests to the SEPolicy for devices which implement the SEPolicy split introduced in Android O. For devices which turn this on and also implement all of the other requirements which together compose PRODUCT_FULL_TREBLE, these tests help ensure that the backwards compatibility which this feature adds is possible. When this test was originally written, devices which specified PRODUCT_FULL_TREBLE_OVERRIDE were only those devices with a PRODUCT_SHIPPING_API_LEVEL of < 26. This allowed them to update to use these features but maintain some legacy behaviors. For these devices, to achieve the same backwards compatibility guarantees, much other/extra work would have to be done (if it is possible at all). Since that time, a new category of devices take advantage of PRODUCT_FULL_TREBLE_OVERRIDE. These devices must either not define a PRODUCT_SHIPPING_API_LEVEL or they apply this flag even though it is not required to be applied. For these cases, the full test suite not being run has caused problems because these failures aren't discoverred until later (when compliance tests are run). Fixes: 112933807 Test: treble_sepolicy_tests on marlin, walleye, and 'some other device' (mma here runs this with the correct parameters) Change-Id: I04c42d3cb86cda3c82f285919b40ba94e1332daa
2018-09-08 01:01:38 +02:00
endif # PRODUCT_FULL_TREBLE_OVERRIDE = true
Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
$(treble_sepolicy_tests_$(version)): $(HOST_OUT_EXECUTABLES)/treble_sepolicy_tests \
$(all_fc_files) $(built_sepolicy) $(built_plat_sepolicy) \
Don't require private types in mapping file. Private types are not visible to vendor/odm policy, so we don't need mapping entries for them. We build platform-only public policy .cil file and give it as input to treble_sepolicy_tests. Using this public policy the test can now figure out if the newly added type in public or private. Bug: 116344577 Test: adding public type triggers mapping test failure, adding private type does not. Change-Id: I421f335e37274b24aa73109e260653d7b73788b5
2018-09-29 02:21:08 +02:00
$(base_plat_pub_policy.cil) \
Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
$(built_$(version)_plat_sepolicy) $($(version)_compat) $($(version)_mapping.combined.cil)
@mkdir -p $(dir $@)
$(hide) $(HOST_OUT_EXECUTABLES)/treble_sepolicy_tests -l \
$(HOST_OUT)/lib64/libsepolwrap.$(SHAREDLIB_EXT) $(ALL_FC_ARGS) \
-b $(PRIVATE_PLAT_SEPOLICY) -m $(PRIVATE_COMBINED_MAPPING) \
-o $(PRIVATE_SEPOLICY_OLD) -p $(PRIVATE_SEPOLICY) \
Don't require private types in mapping file. Private types are not visible to vendor/odm policy, so we don't need mapping entries for them. We build platform-only public policy .cil file and give it as input to treble_sepolicy_tests. Using this public policy the test can now figure out if the newly added type in public or private. Bug: 116344577 Test: adding public type triggers mapping test failure, adding private type does not. Change-Id: I421f335e37274b24aa73109e260653d7b73788b5
2018-09-29 02:21:08 +02:00
-u $(PRIVATE_PLAT_PUB_SEPOLICY) \
Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
$(PRIVATE_FAKE_TREBLE)
$(hide) touch $@
$(version)_PLAT_PUBLIC_POLICY :=
$(version)_PLAT_PRIVATE_POLICY :=
$(version)_compat :=
$(version)_mapping.cil :=
$(version)_mapping.combined.cil :=
$(version)_mapping.ignore.cil :=
$(version)_nonplat :=
Add mapping files for 28.0.[ignore.]cil Steps taken to produce the mapping files: 1. Add prebuilts/api/28.0/[plat_pub_versioned.cil|vendor_sepolicy.cil] from the /vendor/etc/selinux/[plat_pub_versioned.cil|vendor_sepolicy.cil] files built on pi-dev with lunch target aosp_arm64-eng 2. Add new file private/compat/28.0/28.0.cil by doing the following: - copy /system/etc/selinux/mapping/28.0.cil from pi-dev aosp_arm64-eng device to private/compat/28.0/28.0.cil - remove all attribute declaration statement (typeattribute ...) and sort lines alphabetically - some selinux types were added/renamed/deleted w.r.t 28 sepolicy. Find all such types using treble_sepolicy_tests_28.0 test. - for all these types figure out where to map them by looking at 27.0.[ignore.]cil files and add approprite entries to 28.0.[ignore.]cil. This change also enables treble_sepolicy_tests_28.0 and install 28.0.cil mapping onto the device. Bug: 72458734 Test: m selinux_policy Change-Id: I90e17c0b43af436da4b62c16179c198b5c74002c
2018-07-11 11:30:44 +02:00
$(version)_prebuilts_dir :=
Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
built_$(version)_plat_sepolicy :=
version :=
version_under_treble_tests :=
Reference in a new issue Copy permalink