tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/treble_sepolicy_tests_for_release.mk

124 lines
6.2 KiB
Makefile
Raw Normal View History

Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
version := $(version_under_treble_tests)
include $(CLEAR_VARS)
# For Treble builds run tests verifying that processes are properly labeled and
# permissions granted do not violate the treble model. Also ensure that treble
# compatibility guarantees are upheld between SELinux version bumps.
LOCAL_MODULE := treble_sepolicy_tests_$(version)
[LSC] Add LOCAL_LICENSE_KINDS to system/sepolicy Added SPDX-license-identifier-Apache-2.0 to: build/Android.bp build/soong/Android.bp tests/Android.bp tools/Android.bp Added SPDX-license-identifier-Apache-2.0 legacy_unencumbered to: Android.bp Android.mk compat.mk contexts_tests.mk mac_permissions.mk seapp_contexts.mk treble_sepolicy_tests_for_release.mk Added legacy_unencumbered to: apex/Android.bp tools/sepolicy-analyze/Android.bp Bug: 68860345 Bug: 151177513 Bug: 151953481 Test: m all Exempt-From-Owner-Approval: janitorial work Change-Id: I1ab286543ef1bdcb494cf74f2b35e35a08225d28
2021-02-04 08:07:40 +01:00
LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
LOCAL_LICENSE_CONDITIONS := notice unencumbered
LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
Test files on intermediates dir, not on /system *_context_test / sepolicy_tests / treble_sepolicy_tests_* / sepolicy_freeze_test files are installed on /system/etc. By being FAKE modules, test files are not installed on target. Additionally, we need to set up dependency from droidcore to selinux_policy to make tests run on normal builds (m). Bug: 133460071 Test: m & see if tests run and no test files on /system/etc Test: m selinux_policy & see if tests run Change-Id: Icacf004d5c1c8ec720c7cedef7bae8aa648cbe49
2019-05-29 18:05:43 +02:00
LOCAL_MODULE_CLASS := FAKE
LOCAL_MODULE_TAGS := optional
Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
include $(BUILD_SYSTEM)/base_rules.mk
# $(version)_plat - the platform policy shipped as part of the $(version) release. This is
# built to enable us to determine the diff between the current policy and the
# $(version) policy, which will be used in tests to make sure that compatibility has
# been maintained by our mapping files.
$(version)_PLAT_PUBLIC_POLICY := $(LOCAL_PATH)/prebuilts/api/$(version)/public
$(version)_PLAT_PRIVATE_POLICY := $(LOCAL_PATH)/prebuilts/api/$(version)/private
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
policy_files := $(call build_policy, $(sepolicy_build_files), $($(version)_PLAT_PUBLIC_POLICY) $($(version)_PLAT_PRIVATE_POLICY))
Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
$(version)_plat_policy.conf := $(intermediates)/$(version)_plat_policy.conf
$($(version)_plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
$($(version)_plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Use user policy for compatibility tests. Use the user policy when running the compatibility tests. Bug: 74344625 Test: Built policy for many devices. Booted one device. Test: Delete some compat rules, verify error on userdebug. Change-Id: Ib2df2dfc06cdf55a839011e9a528e76160a9e436
2018-03-23 20:40:26 +01:00
$($(version)_plat_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := user
Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
$($(version)_plat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
$($(version)_plat_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
In native coverage builds, allow all domains to access /data/misc/trace Bug: http://b/135139675 Coverage files are written to /data/misc/trace (governed by the method_trace_data_file selinux type). Allow all domains to access (create directories, access files) this directory when native coverage is enabled (by setting NATIVE_COVERAGE to true) in an userdebug or eng build. Also relax neverallow constraints to allow access to method_trace_data_file for native coverage builds. Test: Build 32-bit cuttlefish with coverage: m NATIVE_COVERAGE=true COVERAGE_PATHS="*" and verify that there are no selinux denials in kernel log and logcat. Change-Id: I3fe7c77612854b9de7de7a0ddd5cbf44a2f5c21e
2019-06-14 00:05:15 +02:00
$($(version)_plat_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
$($(version)_plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$($(version)_plat_policy.conf): PRIVATE_SEPOLICY_SPLIT := true
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
$($(version)_plat_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
$($(version)_plat_policy.conf): $(policy_files) $(M4)
Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
$(transform-policy-to-conf)
$(hide) sed '/dontaudit/d' $@ > $@.dontaudit
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
policy_files :=
Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
built_$(version)_plat_sepolicy := $(intermediates)/built_$(version)_plat_sepolicy
$(built_$(version)_plat_sepolicy): PRIVATE_ADDITIONAL_CIL_FILES := \
$(call build_policy, technical_debt.cil , $($(version)_PLAT_PRIVATE_POLICY))
$(built_$(version)_plat_sepolicy): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
$(built_$(version)_plat_sepolicy): $($(version)_plat_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
$(HOST_OUT_EXECUTABLES)/secilc \
$(call build_policy, technical_debt.cil, $($(version)_PLAT_PRIVATE_POLICY)) \
$(built_sepolicy_neverallows)
@mkdir -p $(dir $@)
$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \
$(POLICYVERS) -o $@ $<
$(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@
$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $@ -o $@ -f /dev/null
$(version)_plat_policy.conf :=
# $(version)_compat - the current plat_sepolicy.cil built with the compatibility file
# targeting the $(version) SELinux release. This ensures that our policy will build
# when used on a device that has non-platform policy targetting the $(version) release.
$(version)_compat := $(intermediates)/$(version)_compat
sepolicy: support /system_ext and /product mapping files Install mapping files in SYSTEM_EXT_PRIVATE_POLICY and PRODUCT_PRIVATE_POLICY into /system_ext and /product respectively. Bug: 141084341 Test: boot taimen Test: system mapping files are unchanged Test: create mapping files in device/google/wahoo/sepolicy/ and check that they are correctly expanded and installed. Change-Id: I4d251c957b30a16df71eec47c871e24e5fc773a4
2019-10-11 01:29:40 +02:00
$(version)_mapping.cil := $(call intermediates-dir-for,ETC,plat_$(version).cil)/plat_$(version).cil
Only maintain maps between current and previous selinux versions. New maintenance scheme for mapping files: Say, V is the current SELinux platform version, then at any point in time we only maintain (V->V-1) mapping. (V->V-n) map is constructed from top (V->V-n+1) and bottom (V-n+1->V-n) without changes to previously maintained mapping files. Caveats: - 26.0.cil doesn't technically represent 27.0->26.0 map, but rather current->26.0. We'll fully migrate to the scheme with future releases. Bug: 67510052 Test: adding new public type only requires changing the latest compat map Change-Id: Iab5564e887ef2c8004cb493505dd56c6220c61f8
2018-09-30 02:47:10 +02:00
$(version)_mapping.ignore.cil := \
$(call intermediates-dir-for,ETC,$(version).ignore.cil)/$(version).ignore.cil
Add mapping files for 28.0.[ignore.]cil Steps taken to produce the mapping files: 1. Add prebuilts/api/28.0/[plat_pub_versioned.cil|vendor_sepolicy.cil] from the /vendor/etc/selinux/[plat_pub_versioned.cil|vendor_sepolicy.cil] files built on pi-dev with lunch target aosp_arm64-eng 2. Add new file private/compat/28.0/28.0.cil by doing the following: - copy /system/etc/selinux/mapping/28.0.cil from pi-dev aosp_arm64-eng device to private/compat/28.0/28.0.cil - remove all attribute declaration statement (typeattribute ...) and sort lines alphabetically - some selinux types were added/renamed/deleted w.r.t 28 sepolicy. Find all such types using treble_sepolicy_tests_28.0 test. - for all these types figure out where to map them by looking at 27.0.[ignore.]cil files and add approprite entries to 28.0.[ignore.]cil. This change also enables treble_sepolicy_tests_28.0 and install 28.0.cil mapping onto the device. Bug: 72458734 Test: m selinux_policy Change-Id: I90e17c0b43af436da4b62c16179c198b5c74002c
2018-07-11 11:30:44 +02:00
$(version)_prebuilts_dir := $(LOCAL_PATH)/prebuilts/api/$(version)
# vendor_sepolicy.cil and plat_pub_versioned.cil are the new design to replace
# nonplat_sepolicy.cil.
$(version)_nonplat := $($(version)_prebuilts_dir)/vendor_sepolicy.cil \
$($(version)_prebuilts_dir)/plat_pub_versioned.cil
ifeq (,$(wildcard $($(version)_nonplat)))
$(version)_nonplat := $($(version)_prebuilts_dir)/nonplat_sepolicy.cil
endif
Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
$($(version)_compat): PRIVATE_CIL_FILES := \
$(built_plat_cil) $($(version)_mapping.cil) $($(version)_nonplat)
$($(version)_compat): $(HOST_OUT_EXECUTABLES)/secilc \
$(built_plat_cil) $($(version)_mapping.cil) $($(version)_nonplat)
$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -N -c $(POLICYVERS) \
$(PRIVATE_CIL_FILES) -o $@ -f /dev/null
# $(version)_mapping.combined.cil - a combination of the mapping file used when
# combining the current platform policy with nonplatform policy based on the
# $(version) policy release and also a special ignored file that exists purely for
# these tests.
$(version)_mapping.combined.cil := $(intermediates)/$(version)_mapping.combined.cil
$($(version)_mapping.combined.cil): $($(version)_mapping.cil) $($(version)_mapping.ignore.cil)
mkdir -p $(dir $@)
cat $^ > $@
Test files on intermediates dir, not on /system *_context_test / sepolicy_tests / treble_sepolicy_tests_* / sepolicy_freeze_test files are installed on /system/etc. By being FAKE modules, test files are not installed on target. Additionally, we need to set up dependency from droidcore to selinux_policy to make tests run on normal builds (m). Bug: 133460071 Test: m & see if tests run and no test files on /system/etc Test: m selinux_policy & see if tests run Change-Id: Icacf004d5c1c8ec720c7cedef7bae8aa648cbe49
2019-05-29 18:05:43 +02:00
$(LOCAL_BUILT_MODULE): ALL_FC_ARGS := $(all_fc_args)
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY_OLD := $(built_$(version)_plat_sepolicy)
$(LOCAL_BUILT_MODULE): PRIVATE_COMBINED_MAPPING := $($(version)_mapping.combined.cil)
$(LOCAL_BUILT_MODULE): PRIVATE_PLAT_SEPOLICY := $(built_plat_sepolicy)
$(LOCAL_BUILT_MODULE): PRIVATE_PLAT_PUB_SEPOLICY := $(base_plat_pub_policy.cil)
$(LOCAL_BUILT_MODULE): PRIVATE_FAKE_TREBLE :=
Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
ifeq ($(PRODUCT_FULL_TREBLE_OVERRIDE),true)
PRODUCT_SEPOLICY_SPLIT forces Treble tests to run. This is the flag for when sepolicy is split. Also removed other commented-out heuristics around fake-treble. We should aim to remove it entirely instead. Fixes: 141348590 Test: build w/ and without adding binder_in_vendor_violators to a vendor process (and see the expected error there) Change-Id: I29fb335cc5b5d6e117d93038fe458b8c74acf321
2019-09-20 20:16:29 +02:00
# TODO(b/113124961): remove fake-treble
Test files on intermediates dir, not on /system *_context_test / sepolicy_tests / treble_sepolicy_tests_* / sepolicy_freeze_test files are installed on /system/etc. By being FAKE modules, test files are not installed on target. Additionally, we need to set up dependency from droidcore to selinux_policy to make tests run on normal builds (m). Bug: 133460071 Test: m & see if tests run and no test files on /system/etc Test: m selinux_policy & see if tests run Change-Id: Icacf004d5c1c8ec720c7cedef7bae8aa648cbe49
2019-05-29 18:05:43 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_FAKE_TREBLE := --fake-treble
Apply '--fake-treble' flag to the intended devices (for the build-time tests) treble_sepolicy_tests applies tests to the SEPolicy for devices which implement the SEPolicy split introduced in Android O. For devices which turn this on and also implement all of the other requirements which together compose PRODUCT_FULL_TREBLE, these tests help ensure that the backwards compatibility which this feature adds is possible. When this test was originally written, devices which specified PRODUCT_FULL_TREBLE_OVERRIDE were only those devices with a PRODUCT_SHIPPING_API_LEVEL of < 26. This allowed them to update to use these features but maintain some legacy behaviors. For these devices, to achieve the same backwards compatibility guarantees, much other/extra work would have to be done (if it is possible at all). Since that time, a new category of devices take advantage of PRODUCT_FULL_TREBLE_OVERRIDE. These devices must either not define a PRODUCT_SHIPPING_API_LEVEL or they apply this flag even though it is not required to be applied. For these cases, the full test suite not being run has caused problems because these failures aren't discoverred until later (when compliance tests are run). Fixes: 112933807 Test: treble_sepolicy_tests on marlin, walleye, and 'some other device' (mma here runs this with the correct parameters) Change-Id: I04c42d3cb86cda3c82f285919b40ba94e1332daa
2018-09-08 01:01:38 +02:00
endif # PRODUCT_FULL_TREBLE_OVERRIDE = true
Test files on intermediates dir, not on /system *_context_test / sepolicy_tests / treble_sepolicy_tests_* / sepolicy_freeze_test files are installed on /system/etc. By being FAKE modules, test files are not installed on target. Additionally, we need to set up dependency from droidcore to selinux_policy to make tests run on normal builds (m). Bug: 133460071 Test: m & see if tests run and no test files on /system/etc Test: m selinux_policy & see if tests run Change-Id: Icacf004d5c1c8ec720c7cedef7bae8aa648cbe49
2019-05-29 18:05:43 +02:00
$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/treble_sepolicy_tests \
Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
$(all_fc_files) $(built_sepolicy) $(built_plat_sepolicy) \
Don't require private types in mapping file. Private types are not visible to vendor/odm policy, so we don't need mapping entries for them. We build platform-only public policy .cil file and give it as input to treble_sepolicy_tests. Using this public policy the test can now figure out if the newly added type in public or private. Bug: 116344577 Test: adding public type triggers mapping test failure, adding private type does not. Change-Id: I421f335e37274b24aa73109e260653d7b73788b5
2018-09-29 02:21:08 +02:00
$(base_plat_pub_policy.cil) \
Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
$(built_$(version)_plat_sepolicy) $($(version)_compat) $($(version)_mapping.combined.cil)
@mkdir -p $(dir $@)
$(hide) $(HOST_OUT_EXECUTABLES)/treble_sepolicy_tests -l \
$(HOST_OUT)/lib64/libsepolwrap.$(SHAREDLIB_EXT) $(ALL_FC_ARGS) \
-b $(PRIVATE_PLAT_SEPOLICY) -m $(PRIVATE_COMBINED_MAPPING) \
-o $(PRIVATE_SEPOLICY_OLD) -p $(PRIVATE_SEPOLICY) \
Don't require private types in mapping file. Private types are not visible to vendor/odm policy, so we don't need mapping entries for them. We build platform-only public policy .cil file and give it as input to treble_sepolicy_tests. Using this public policy the test can now figure out if the newly added type in public or private. Bug: 116344577 Test: adding public type triggers mapping test failure, adding private type does not. Change-Id: I421f335e37274b24aa73109e260653d7b73788b5
2018-09-29 02:21:08 +02:00
-u $(PRIVATE_PLAT_PUB_SEPOLICY) \
Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
$(PRIVATE_FAKE_TREBLE)
$(hide) touch $@
$(version)_PLAT_PUBLIC_POLICY :=
$(version)_PLAT_PRIVATE_POLICY :=
$(version)_compat :=
$(version)_mapping.cil :=
$(version)_mapping.combined.cil :=
$(version)_mapping.ignore.cil :=
$(version)_nonplat :=
Add mapping files for 28.0.[ignore.]cil Steps taken to produce the mapping files: 1. Add prebuilts/api/28.0/[plat_pub_versioned.cil|vendor_sepolicy.cil] from the /vendor/etc/selinux/[plat_pub_versioned.cil|vendor_sepolicy.cil] files built on pi-dev with lunch target aosp_arm64-eng 2. Add new file private/compat/28.0/28.0.cil by doing the following: - copy /system/etc/selinux/mapping/28.0.cil from pi-dev aosp_arm64-eng device to private/compat/28.0/28.0.cil - remove all attribute declaration statement (typeattribute ...) and sort lines alphabetically - some selinux types were added/renamed/deleted w.r.t 28 sepolicy. Find all such types using treble_sepolicy_tests_28.0 test. - for all these types figure out where to map them by looking at 27.0.[ignore.]cil files and add approprite entries to 28.0.[ignore.]cil. This change also enables treble_sepolicy_tests_28.0 and install 28.0.cil mapping onto the device. Bug: 72458734 Test: m selinux_policy Change-Id: I90e17c0b43af436da4b62c16179c198b5c74002c
2018-07-11 11:30:44 +02:00
$(version)_prebuilts_dir :=
Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
built_$(version)_plat_sepolicy :=
version :=
version_under_treble_tests :=
Reference in a new issue Copy permalink