tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/Android.mk

1814 lines
75 KiB
Makefile
Raw Normal View History

SE Android policy.
2012-01-04 18:33:27 +01:00
LOCAL_PATH:= $(call my-dir)
Support overrides in seapp_contexts Provides support for overriding seapp_contexts declerations in per device seapp_contexts files. Change-Id: I23a0ffa1d24f1ce57825b168f29a2e885d3e1c51
2012-08-28 00:41:15 +02:00
Add sepolicy definitions.mk and create policy.conf function. Bug: 36899958 Test: Builds 'n' boots. Change-Id: I5836a18f9d0a9a976dda7304045e3b9e1e84565e Merged-In: I5836a18f9d0a9a976dda7304045e3b9e1e84565e (cherry picked from commit c0713e86790583dacbd8545d35ae476ff1f849bb)
2017-07-07 23:59:51 +02:00
include $(LOCAL_PATH)/definitions.mk
Android.bp: set sepolicy version for use by init Init needs to be aware of the policy version defined in sepolicy for on-device compilation. Bug: 124499219 Test: build and boot a device. Try both precompiled and on-device compiled policy. Change-Id: Iba861aeb4566405aedcbe3c2bad48e1e50126370
2019-02-15 21:18:15 +01:00
include $(LOCAL_PATH)/policy_version.mk
Add sepolicy definitions.mk and create policy.conf function. Bug: 36899958 Test: Builds 'n' boots. Change-Id: I5836a18f9d0a9a976dda7304045e3b9e1e84565e Merged-In: I5836a18f9d0a9a976dda7304045e3b9e1e84565e (cherry picked from commit c0713e86790583dacbd8545d35ae476ff1f849bb)
2017-07-07 23:59:51 +02:00
Create selinux_policy phony target Moves selinux policy build decisions to system/sepolicy/Android.mk. This is done because the PRODUCT_FULL_TREBLE variable isn't available in embedded.mk and TARGET_SANITIZE isn't available to dependencies of init. Test: Build/boot Bullhead PRODUCT_FULL_TREBLE=false Test: Build/boot Marlin PRODUCT_FULL_TREBLE=true Test: Build Marlin TARGET_SANITIZE=address. Verify asan rules are included in policy output. Bug: 36138508 Change-Id: I20a25ffdfbe2b28e7e0f3e090a4df321e85e1235
2017-03-23 00:20:24 +01:00
include $(CLEAR_VARS)
SE Android policy.
2012-01-04 18:33:27 +01:00
MLS_SENS=1
MLS_CATS=1024
Drop BOARD_SEPOLICY_UNION. As suggested in the comments on https://android-review.googlesource.com/#/c/141560/ drop BOARD_SEPOLICY_UNION and simplify the build_policy logic. Union all files found under BOARD_SEPOLICY_DIRS. Unlike BOARD_SEPOLICY_REPLACE/IGNORE, on which we trigger an error to catch any lingering uses and force updating of the BoardConfig.mk files, we only warn on uses of BOARD_SEPOLICY_UNION to avoid breaking the build until all device BoardConfig*.mk files have been updated, and since they should be harmless - the files will be unioned regardless. Change-Id: I4214893c999c23631f5456cb1b8edd59771ef13b Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-04-01 16:14:56 +02:00
ifdef BOARD_SEPOLICY_UNION
$(warning BOARD_SEPOLICY_UNION is no longer required - all files found in BOARD_SEPOLICY_DIRS are implicitly unioned; please remove from your BoardConfig.mk or other .mk file.)
endif
Android.mk: Add support for BOARD_SEPOLICY_M4DEFS Allow device builders to pass arbitrary m4 definitions during the build via make variable BOARD_SEPOLICY_M4DEFS. This enables OEMs to define their own static policy build conditionals. Change-Id: Ibea1dbb7b8615576c5668e47f16ed0eedfa0b73c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-07-16 20:28:02 +02:00
ifdef BOARD_SEPOLICY_M4DEFS
LOCAL_ADDITIONAL_M4DEFS := $(addprefix -D, $(BOARD_SEPOLICY_M4DEFS))
Add sepolicy definitions.mk and create policy.conf function. Bug: 36899958 Test: Builds 'n' boots. Change-Id: I5836a18f9d0a9a976dda7304045e3b9e1e84565e Merged-In: I5836a18f9d0a9a976dda7304045e3b9e1e84565e (cherry picked from commit c0713e86790583dacbd8545d35ae476ff1f849bb)
2017-07-07 23:59:51 +02:00
else
LOCAL_ADDITIONAL_M4DEFS :=
Android.mk: Add support for BOARD_SEPOLICY_M4DEFS Allow device builders to pass arbitrary m4 definitions during the build via make variable BOARD_SEPOLICY_M4DEFS. This enables OEMs to define their own static policy build conditionals. Change-Id: Ibea1dbb7b8615576c5668e47f16ed0eedfa0b73c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-07-16 20:28:02 +02:00
endif
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
# sepolicy is now divided into multiple portions:
# public - policy exported on which non-platform policy developers may write
# additional policy. types and attributes are versioned and included in
# delivered non-platform policy, which is to be combined with platform policy.
# private - platform-only policy required for platform functionality but which
# is not exported to vendor policy developers and as such may not be assumed
# to exist.
Device-agnostic policy for vendor image Default HAL implementations are built from the platform tree and get placed into the vendor image. The SELinux rules needed for these HAL implementations to operate thus need to reside on the vendor partition. Up to now, the only place to define such rules in the source tree was the system/sepolicy/public directory. These rules are placed into the vendor partition. Unfortunately, they are also placed into the system/root partition, which thus unnecessarily grants these rules to all HAL implementations of the specified service, default/in-process shims or not. This commit adds a new directory, system/sepolicy/vendor, whose rules are concatenated with the device-specific rules at build time. These rules are thus placed into the vendor partition and are not placed into the system/root partition. Test: No change to SELinux policy. Test: Rules placed into vendor directory end up in nonplat* artefacts, but not in plat* artefacts. Bug: 34715716 Change-Id: Iab14aa7a3311ed6d53afff673e5d112428941f1c
2017-01-31 03:44:59 +01:00
# vendor - vendor-only policy required for vendor functionality. This policy can
# reference the public policy but cannot reference the private policy. This
# policy is for components which are produced from the core/non-vendor tree and
# placed into a vendor partition.
Restore checkfc and neverallow checks. Bug: 33388095 Test: Builds and boots. Change-Id: Ief9064a16fc733bed54eb76f509ff5aaf5db4baf
2016-12-07 20:27:47 +01:00
# mapping - This contains policy statements which map the attributes
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
# exposed in the public policy of previous versions to the concrete types used
# in this policy to ensure that policy targeting attributes from public
# policy from an older platform version continues to work.
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
# build process for device:
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
# 1) convert policies to CIL:
# - private + public platform policy to CIL
# - mapping file to CIL (should already be in CIL form)
# - non-platform public policy to CIL
# - non-platform public + private policy to CIL
# 2) attributize policy
# - run script which takes non-platform public and non-platform combined
# private + public policy and produces attributized and versioned
# non-platform policy
# 3) combine policy files
# - combine mapping, platform and non-platform policy.
# - compile output binary policy file
PLAT_PUBLIC_POLICY := $(LOCAL_PATH)/public
PLAT_PRIVATE_POLICY := $(LOCAL_PATH)/private
Device-agnostic policy for vendor image Default HAL implementations are built from the platform tree and get placed into the vendor image. The SELinux rules needed for these HAL implementations to operate thus need to reside on the vendor partition. Up to now, the only place to define such rules in the source tree was the system/sepolicy/public directory. These rules are placed into the vendor partition. Unfortunately, they are also placed into the system/root partition, which thus unnecessarily grants these rules to all HAL implementations of the specified service, default/in-process shims or not. This commit adds a new directory, system/sepolicy/vendor, whose rules are concatenated with the device-specific rules at build time. These rules are thus placed into the vendor partition and are not placed into the system/root partition. Test: No change to SELinux policy. Test: Rules placed into vendor directory end up in nonplat* artefacts, but not in plat* artefacts. Bug: 34715716 Change-Id: Iab14aa7a3311ed6d53afff673e5d112428941f1c
2017-01-31 03:44:59 +01:00
PLAT_VENDOR_POLICY := $(LOCAL_PATH)/vendor
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
REQD_MASK_POLICY := $(LOCAL_PATH)/reqd_mask
Android.mk: Support SYSTEM_EXT* sepolicy The new variable name reflects its actual usage. Keep compatibility with BOARD_PLAT_* because it has been a convention for years. Amend the README to document the new variables. Test: `make selinux_policy` with `SYSTEM_EXT_{PUBLIC,PRIVATE}_SEPOLICY_DIRS` set, observe additions in `$(TARGET_COPY_OUT_SYSTEM_EXT)/etc/selinux` Signed-off-by: Felix <google@ix5.org> Change-Id: If8188feb365eb9e500f2270241fa190a20e9de01
2020-07-14 21:28:51 +02:00
SYSTEM_EXT_PUBLIC_POLICY := $(SYSTEM_EXT_PUBLIC_SEPOLICY_DIRS)
ifneq (,$(BOARD_PLAT_PUBLIC_SEPOLICY_DIR))
Revert "Android.mk: Enforce SYSTEM_EXT_* vars on API >= 31" This reverts commit 6c99a6781cee1bad995919d3156d7c799f59317c. Reason for revert: build breaks on build test Bug: 171847597 Test: None Change-Id: I7d3556aa0f06684b43f80f09e4c8194c6c44336c
2020-10-28 06:01:17 +01:00
# TODO: Disallow BOARD_PLAT_*
Android.mk: Support SYSTEM_EXT* sepolicy The new variable name reflects its actual usage. Keep compatibility with BOARD_PLAT_* because it has been a convention for years. Amend the README to document the new variables. Test: `make selinux_policy` with `SYSTEM_EXT_{PUBLIC,PRIVATE}_SEPOLICY_DIRS` set, observe additions in `$(TARGET_COPY_OUT_SYSTEM_EXT)/etc/selinux` Signed-off-by: Felix <google@ix5.org> Change-Id: If8188feb365eb9e500f2270241fa190a20e9de01
2020-07-14 21:28:51 +02:00
SYSTEM_EXT_PUBLIC_POLICY += $(BOARD_PLAT_PUBLIC_SEPOLICY_DIR)
endif
SYSTEM_EXT_PRIVATE_POLICY := $(SYSTEM_EXT_PRIVATE_SEPOLICY_DIRS)
ifneq (,$(BOARD_PLAT_PRIVATE_SEPOLICY_DIR))
Revert "Android.mk: Enforce SYSTEM_EXT_* vars on API >= 31" This reverts commit 6c99a6781cee1bad995919d3156d7c799f59317c. Reason for revert: build breaks on build test Bug: 171847597 Test: None Change-Id: I7d3556aa0f06684b43f80f09e4c8194c6c44336c
2020-10-28 06:01:17 +01:00
# TODO: Disallow BOARD_PLAT_*
Android.mk: Support SYSTEM_EXT* sepolicy The new variable name reflects its actual usage. Keep compatibility with BOARD_PLAT_* because it has been a convention for years. Amend the README to document the new variables. Test: `make selinux_policy` with `SYSTEM_EXT_{PUBLIC,PRIVATE}_SEPOLICY_DIRS` set, observe additions in `$(TARGET_COPY_OUT_SYSTEM_EXT)/etc/selinux` Signed-off-by: Felix <google@ix5.org> Change-Id: If8188feb365eb9e500f2270241fa190a20e9de01
2020-07-14 21:28:51 +02:00
SYSTEM_EXT_PRIVATE_POLICY += $(BOARD_PLAT_PRIVATE_SEPOLICY_DIR)
endif
Restore P BOARD_PLAT_*_SEPOLICY_DIR behavior BOARD_PLAT_*_SEPOLICY_DIR extends system sepolicy. PRODUCT_PUBLIC_SEPOLICY_DIRS and PRODUCT_PRIVATE_SEPOLICY_DIRS now specify locations of public and private product sepolicy respectively. Bug: 119305624 Test: m selinux_policy Change-Id: I48d491f0dd22020d96ff0243142153871d2d6b2b
2019-02-01 20:41:08 +01:00
PRODUCT_PUBLIC_POLICY := $(PRODUCT_PUBLIC_SEPOLICY_DIRS)
PRODUCT_PRIVATE_POLICY := $(PRODUCT_PRIVATE_SEPOLICY_DIRS)
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
Expand the scope of sepolicy_freeze_test The existing freeze test only covers the policy files in system/sepolicy alone. There's demand from product teams that would like to implement a freeze test for their sepolicy. Instead of letting them fork the freeze test, we believe expanding the scope of the exising one is in the best interest. $FREEZE_TEST_EXTRA_DIRS and $FREEZE_TEST_EXTRA_PREBUILT_DIRS are added. These build variables could be appended like $PRODUCT_PUBLIC_POLICY. The product team are expected to maintain their policy prebuilts. Bug: 166455099 Test: manual Change-Id: I6f350e1e3db2807be4dbfd0ceb34f0d89f94d629
2020-10-08 23:39:42 +02:00
# Extra sepolicy and prebuilts directories for sepolicy_freeze_test
FREEZE_TEST_EXTRA_DIRS := $(SEPOLICY_FREEZE_TEST_EXTRA_DIRS)
FREEZE_TEST_EXTRA_PREBUILT_DIRS := $(SEPOLICY_FREEZE_TEST_EXTRA_PREBUILT_DIRS)
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
ifneq (,$(SYSTEM_EXT_PUBLIC_POLICY)$(SYSTEM_EXT_PRIVATE_POLICY))
Allowing system_ext sepolicy to be empty Some targets just need to extend system_ext context files, e.g., file_contexts, service_contexts, etc., without adding any system_ext policy files, e.g., *.te files. Currently, this will lead to build errors. This CL allows system_ext_sepolicy.cil and the system_ext mapping file to be empty. It's now also possible to just set BOARD_PLAT_PRIVATE_SEPOLICY_DIR without setting BOARD_PLAT_PUBLIC_SEPOLICY_DIR. Bug: 137712473 Bug: 141880898 Test: Only adds system_ext context files without policy files (e.g., *.te), then `mmma system/sepolicy` can build pass Change-Id: I72849f2d4aa43e5296cd15c07a8fd058186a6376
2019-10-04 08:34:18 +02:00
HAS_SYSTEM_EXT_SEPOLICY_DIR := true
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
endif
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
# TODO(b/119305624): Currently if the device doesn't have a product partition,
# we install product sepolicy into /system/product. We do that because bits of
# product sepolicy that's still in /system might depend on bits that have moved
# to /product. Once we finish migrating product sepolicy out of system, change
# it so that if no product partition is present, product sepolicy artifacts are
# not built and installed at all.
ifneq (,$(PRODUCT_PUBLIC_POLICY)$(PRODUCT_PRIVATE_POLICY))
Allowing product sepolicy to be empty Some targets just need to extend product context files, e.g., file_contexts, service_contexts, etc., without adding any product-specific policy files, e.g., *.te files. Or just need to add private product sepolicy without adding public product sepolicy. Currently, this will lead to build errors. This CL allows product_sepolicy.cil and the product mapping file to be empty. It's now also possible to just set PRODUCT_PRIVATE_POLICY without setting PRODUCT_PUBLIC_POLICY. Bug: 131193755 Test: Only adds product private sepolicy, then `mmma system/sepolicy` Change-Id: Ifed5af7413b2a1e20a0628518582615708c8c31a
2019-10-04 09:36:05 +02:00
HAS_PRODUCT_SEPOLICY_DIR := true
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
endif
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
# TODO: move to README when doing the README update and finalizing versioning.
sepolicy_version: change current version to NN.m format The sepolicy version takes SDK_INT.<minor> format. Make sure our 'current' policy version reflects the format and make it '100000.0'. This ensures any vendor.img compiled with this will never work with a production framework image either. Make version_policy replace the '.' in version by '_' so secilc is happy too. This unblocks libvintf from giving out a runtme API to check vendor's sepolicy version. The PLAT_PUBLIC_SEPOLICY_CURRENT_VERSION will eventually be picked up from the build system. Bug: 35217573 Test: Build and boot sailfish. Boot sailfish with sepolicy compilation on device. Signed-off-by: Sandeep Patil <sspatil@google.com> Change-Id: Ic8b6687c4e71227bf9090018999149cd9e11d63b
2017-04-07 23:18:48 +02:00
# BOARD_SEPOLICY_VERS must take the format "NN.m" and contain the sepolicy
# version identifier corresponding to the sepolicy on which the non-platform
# policy is to be based. If unspecified, this will build against the current
# public platform policy in tree
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
ifndef BOARD_SEPOLICY_VERS
sepolicy_version: change current version to NN.m format The sepolicy version takes SDK_INT.<minor> format. Make sure our 'current' policy version reflects the format and make it '100000.0'. This ensures any vendor.img compiled with this will never work with a production framework image either. Make version_policy replace the '.' in version by '_' so secilc is happy too. This unblocks libvintf from giving out a runtme API to check vendor's sepolicy version. The PLAT_PUBLIC_SEPOLICY_CURRENT_VERSION will eventually be picked up from the build system. Bug: 35217573 Test: Build and boot sailfish. Boot sailfish with sepolicy compilation on device. Signed-off-by: Sandeep Patil <sspatil@google.com> Change-Id: Ic8b6687c4e71227bf9090018999149cd9e11d63b
2017-04-07 23:18:48 +02:00
# The default platform policy version.
Add PLATFORM_SEPOLICY_VERSION. Create PLATFORM_SEPOLICY_VERSION, which is a version string to represent the platform sepolicy of the form "NN.m" where "NN" mirrors the PLATFORM_SDK_VERSION and "m" is a policy-based minor version that is incremented with every policy change that requires a new backward-compatible mapping file to be added to allow for future-proofing vendor policy against future platform policy. Bug: 36783775 Test: Device boots when sha256 doesn't match and compilation is forced. Change-Id: I4edb29824f2050a5a6e1bc078c100cf42e45c303
2017-04-08 01:36:23 +02:00
BOARD_SEPOLICY_VERS := $(PLATFORM_SEPOLICY_VERSION)
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
endif
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
NEVERALLOW_ARG :=
ifeq ($(SELINUX_IGNORE_NEVERALLOWS),true)
ifeq ($(TARGET_BUILD_VARIANT),user)
$(error SELINUX_IGNORE_NEVERALLOWS := true cannot be used in user builds)
endif
$(warning Be careful when using the SELINUX_IGNORE_NEVERALLOWS flag. \
It does not work in user builds and using it will \
not stop you from failing CTS.)
NEVERALLOW_ARG := -N
endif
Add /odm/etc/selinux/odm_sepolicy.cil This change adds the support of odm sepolicy customization, which can be configured through the newly added build varaible: - BOARD_ODM_SEPOLICY_DIRS += device/${ODM_NAME}/${BOM_NAME}/sepolicy Also moving precompiled sepolicy to /odm when BOARD_ODM_SEPOLICY_DIRS is set. On a DUT, precompiled sepolicy on /odm will override the one in /vendor. This is intentional because /odm is the hardware customization for /vendor and both should be updated together if desired. Bug: 64240127 Test: boot a device with /odm partition Change-Id: Ia8f81a78c88cbfefb3ff19e2ccd2648da6284d09
2017-11-27 04:41:33 +01:00
# BOARD_SEPOLICY_DIRS was used for vendor/odm sepolicy customization before.
# It has been replaced by BOARD_VENDOR_SEPOLICY_DIRS (mandatory) and
# BOARD_ODM_SEPOLICY_DIRS (optional). BOARD_SEPOLICY_DIRS is still allowed for
# backward compatibility, which will be merged into BOARD_VENDOR_SEPOLICY_DIRS.
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
ifdef BOARD_SEPOLICY_DIRS
BOARD_VENDOR_SEPOLICY_DIRS += $(BOARD_SEPOLICY_DIRS)
endif
Fix build part 2. Always create platform_mapping_file. commit 552fb537129e9b446e79af53216c08d15e69144e fixed an undefined module error by removing the module when not defined (on non-treble devices), but the sepolicy build on non-treble devices was changed to rely on the split treble files, even though the split is not used. Change this so that the file is always present, to allow policy compilation. Test: policy fully builds. Change-Id: Ia0934c739336cea54228bbff8d6644aa3ae501e5
2017-04-12 23:28:34 +02:00
Add /odm/etc/selinux/odm_sepolicy.cil This change adds the support of odm sepolicy customization, which can be configured through the newly added build varaible: - BOARD_ODM_SEPOLICY_DIRS += device/${ODM_NAME}/${BOM_NAME}/sepolicy Also moving precompiled sepolicy to /odm when BOARD_ODM_SEPOLICY_DIRS is set. On a DUT, precompiled sepolicy on /odm will override the one in /vendor. This is intentional because /odm is the hardware customization for /vendor and both should be updated together if desired. Bug: 64240127 Test: boot a device with /odm partition Change-Id: Ia8f81a78c88cbfefb3ff19e2ccd2648da6284d09
2017-11-27 04:41:33 +01:00
ifdef BOARD_ODM_SEPOLICY_DIRS
ifneq ($(PRODUCT_SEPOLICY_SPLIT),true)
$(error PRODUCT_SEPOLICY_SPLIT needs to be true when using BOARD_ODM_SEPOLICY_DIRS)
endif
endif
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
###########################################################
# Compute policy files to be used in policy build.
# $(1): files to include
# $(2): directories in which to find files
###########################################################
define build_policy
$(foreach type, $(1), $(foreach file, $(addsuffix /$(type), $(2)), $(sort $(wildcard $(file)))))
endef
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: Id79cc6f434c41179d5c0d0d739c4718918b0b1dc Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
# Builds paths for all policy files found in BOARD_VENDOR_SEPOLICY_DIRS.
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: I3775eae11bfa5905cad0d02a0bf26c76ac03437c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
# $(1): the set of policy name paths to build
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
build_vendor_policy = $(call build_policy, $(1), $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS))
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: I3775eae11bfa5905cad0d02a0bf26c76ac03437c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
Add /odm/etc/selinux/odm_file_contexts Bug: 64240127 Test: normal boot and recovery boot a device Change-Id: I087292fb23d05fc17272778d668ac78a721b2593
2017-11-29 09:14:53 +01:00
# Builds paths for all policy files found in BOARD_ODM_SEPOLICY_DIRS.
build_odm_policy = $(call build_policy, $(1), $(BOARD_ODM_SEPOLICY_DIRS))
Generate selinux_policy.xml as part of CTS build. Bug: 16563899 Bug: 14251916 Change-Id: Id3172b73f10186ba361caf6b7333e5d2a0648475
2014-07-26 04:11:52 +02:00
sepolicy_build_files := security_classes \
initial_sids \
access_vectors \
global_macros \
recovery.te: add /data neverallow rules Recovery should never be accessing files from /data. In particular, /data may be encrypted, and the files within /data will be inaccessible to recovery, because recovery doesn't know the decryption key. Enforce write/execute restrictions on recovery. We can't tighten it up further because domain.te contains some /data read-only access rules, which shouldn't apply to recovery but do. Create neverallow_macros, used for storing permission macros useful for neverallow rules. Standardize recovery.te and property_data_file on the new macros. Change-Id: I02346ab924fe2fdb2edc7659cb68c4f8dffa1e88
2014-11-06 00:30:41 +01:00
neverallow_macros \
Generate selinux_policy.xml as part of CTS build. Bug: 16563899 Bug: 14251916 Change-Id: Id3172b73f10186ba361caf6b7333e5d2a0648475
2014-07-26 04:11:52 +02:00
mls_macros \
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
mls_decl \
Generate selinux_policy.xml as part of CTS build. Bug: 16563899 Bug: 14251916 Change-Id: Id3172b73f10186ba361caf6b7333e5d2a0648475
2014-07-26 04:11:52 +02:00
mls \
policy_capabilities \
te_macros \
attributes \
Reduce socket ioctl perms Reduce the socket ioctl commands available to untrusted/isolated apps. Neverallow accessing sensitive information or setting of network parameters. Neverallow access to device private ioctls i.e. device specific customizations as these are a common source of driver bugs. Define common ioctl commands in ioctl_defines. Bug: 26267358 Change-Id: Ic5c0af066e26d4cb2867568f53a3e65c5e3b5a5d
2015-12-22 19:39:34 +01:00
ioctl_defines \
restrict app access to socket ioctls Create a macro of unprivileged ioctls including - All common socket ioctls except MAC address - All wireless extensions ioctls except get/set ESSID - Some commonly used tty ioctls Bug: 21657002 Change-Id: Ib08be9cb70d08c1fa2c8bddbae519e7c2df5293c
2015-06-06 00:28:55 +02:00
ioctl_macros \
Generate selinux_policy.xml as part of CTS build. Bug: 16563899 Bug: 14251916 Change-Id: Id3172b73f10186ba361caf6b7333e5d2a0648475
2014-07-26 04:11:52 +02:00
*.te \
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
roles_decl \
Generate selinux_policy.xml as part of CTS build. Bug: 16563899 Bug: 14251916 Change-Id: Id3172b73f10186ba361caf6b7333e5d2a0648475
2014-07-26 04:11:52 +02:00
roles \
users \
initial_sid_contexts \
fs_use \
genfs_contexts \
port_contexts
Only require compat mapping files if they exist. Call build_policy when determing which compat mapping files should be included for a given partition. Bug: 168637766 Test: Built aosp_bonito-userdebug and saw that the compat mapping files in product/etc/sepolicy/mapping were no longer present. Test: Added a test 30.0.cil file to bonito's product private compat directory and saw that it was present at product/etc/sepolicy/mapping. Change-Id: I83cc28a159b24c0a2c0717dae461983250ab6c25
2020-09-22 00:32:16 +02:00
sepolicy_compat_files := $(foreach ver, $(PLATFORM_SEPOLICY_COMPAT_VERSIONS), \
$(addprefix compat/$(ver)/, $(addsuffix .cil, $(ver))))
sepolicy: build error if non-platform classes present Error out if we detect that there is a security_classes or access_vectors file outside of system/sepolicy. Of course, this test can't enforce any requirements, as it's not part of CTS. But it can still serve as an early signal. Fixes: 142153384 Test: add access_vectors to device policy, observe build error Change-Id: Ib94b7f85e184340de8ec7943c8da88a0af3427e8
2019-10-08 01:31:40 +02:00
# Security classes and permissions defined outside of system/sepolicy.
security_class_extension_files := $(call build_policy, security_classes access_vectors, \
$(SYSTEM_EXT_PUBLIC_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY) \
$(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY) \
$(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_ODM_SEPOLICY_DIRS))
ifneq (,$(strip $(security_class_extension_files)))
$(error Only platform SELinux policy may define classes and permissions: $(strip $(security_class_extension_files)))
endif
Allowing system_ext sepolicy to be empty Some targets just need to extend system_ext context files, e.g., file_contexts, service_contexts, etc., without adding any system_ext policy files, e.g., *.te files. Currently, this will lead to build errors. This CL allows system_ext_sepolicy.cil and the system_ext mapping file to be empty. It's now also possible to just set BOARD_PLAT_PRIVATE_SEPOLICY_DIR without setting BOARD_PLAT_PUBLIC_SEPOLICY_DIR. Bug: 137712473 Bug: 141880898 Test: Only adds system_ext context files without policy files (e.g., *.te), then `mmma system/sepolicy` can build pass Change-Id: I72849f2d4aa43e5296cd15c07a8fd058186a6376
2019-10-04 08:34:18 +02:00
ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR
# Checks if there are public system_ext policy files.
policy_files := $(call build_policy, $(sepolicy_build_files), $(SYSTEM_EXT_PUBLIC_POLICY))
ifneq (,$(strip $(policy_files)))
HAS_SYSTEM_EXT_PUBLIC_SEPOLICY := true
endif
# Checks if there are public/private system_ext policy files.
policy_files := $(call build_policy, $(sepolicy_build_files), $(SYSTEM_EXT_PUBLIC_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY))
ifneq (,$(strip $(policy_files)))
HAS_SYSTEM_EXT_SEPOLICY := true
endif
endif # ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR
Allowing product sepolicy to be empty Some targets just need to extend product context files, e.g., file_contexts, service_contexts, etc., without adding any product-specific policy files, e.g., *.te files. Or just need to add private product sepolicy without adding public product sepolicy. Currently, this will lead to build errors. This CL allows product_sepolicy.cil and the product mapping file to be empty. It's now also possible to just set PRODUCT_PRIVATE_POLICY without setting PRODUCT_PUBLIC_POLICY. Bug: 131193755 Test: Only adds product private sepolicy, then `mmma system/sepolicy` Change-Id: Ifed5af7413b2a1e20a0628518582615708c8c31a
2019-10-04 09:36:05 +02:00
ifdef HAS_PRODUCT_SEPOLICY_DIR
# Checks if there are public product policy files.
policy_files := $(call build_policy, $(sepolicy_build_files), $(PRODUCT_PUBLIC_POLICY))
ifneq (,$(strip $(policy_files)))
HAS_PRODUCT_PUBLIC_SEPOLICY := true
endif
# Checks if there are public/private product policy files.
policy_files := $(call build_policy, $(sepolicy_build_files), $(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY))
ifneq (,$(strip $(policy_files)))
HAS_PRODUCT_SEPOLICY := true
endif
endif # ifdef HAS_PRODUCT_SEPOLICY_DIR
Mark all clients of Allocator HAL This change associates all domains which are clients of Allocator HAL with hal_allocator_client and the, required for all HAL client domains, halclientdomain. This enables this commit to remove the now unnecessary hwallocator_use macro because its binder_call(..., hal_allocator_server) is covered by binder_call(hal_allocator_client, hal_allocator_server) added in this commit. Unfortunately apps, except isolated app, are clients of Allocator HAL as well. This makes it hard to use the hal_client_domain(..., hal_allocator) macro because it translates into "typeattribute" which currently does not support being provided with a set of types, such as { appdomain -isolated_app }. As a workaround, hopefully until typeattribute is improved, this commit expresses the necessary association operation in CIL. private/technical_debt.cil introduced by this commit is appended into the platform policy CIL file, thus ensuring that the hack has effect on the final monolithic policy. P. S. This change also removes Allocator HAL access from isolated_app. Isolated app shouldn't have access to this HAL anyway. Test: Google Play Music plays back radios Test: Google Camera records video with sound and that video is then successfully played back with sound Test: YouTube app plays back clips with sound Test: YouTube in Chrome plays back clips with sound Bug: 34170079 Change-Id: Id00bba6fde83e7cf04fb58bc1c353c2f66333f92
2017-03-21 22:28:53 +01:00
# CIL files which contain workarounds for current limitation of human-readable
# module policy language. These files are appended to the CIL files produced
# from module language files.
sepolicy_build_cil_workaround_files := technical_debt.cil
Switch recovery to versioned policy and split into components. And do some clean up: Replace LOCAL_TARGET_ARCH with global arch specifier that won't get clobbered, clean up sepolicy.recovery's eng specification, ensure that build macros are applied across all policy generation, not just plat_policy, and make sure that all private variables are cleared and alphabetized at the end. Bug: 31363362 Bug: 31369363 Test: Boot into recovery and observe no selinux denials. Change-Id: Ibc15b097f6d19acf01f6b22bee0e083b15f4ef75
2016-12-16 00:28:44 +01:00
my_target_arch := $(TARGET_ARCH)
ifneq (,$(filter mips mips64,$(TARGET_ARCH)))
my_target_arch := mips
endif
Specify intermediates dir for sepolicy Policy intermediates are being placed in a seemingly random intermediates directories. Currently: out/target/product/marlin/obj_arm/SHARED_LIBRARIES/libsoftkeymaster_intermediates Instead, place intermediates in the sepolicy_intermediates dir. Test: intermediates now placed in: out/target/product/marlin/obj/ETC/sepolicy_intermediates Test: Marlin builds, no change to sepolicy on device. Bug: 36269118 Change-Id: Ib6e9d9033be4dc8db0cc66cb47d9dc35d38703fe
2017-03-15 21:37:35 +01:00
intermediates := $(TARGET_OUT_INTERMEDIATES)/ETC/sepolicy_intermediates
Grant additional permissions for ASAN builds ASAN builds may require additional permissions to launch processes with ASAN wrappers. In this case, system_server needs permission to execute /system/bin/sh. Create with_asan() macro which can be used exclusively on debug builds. Note this means that ASAN builds with these additional permission will not pass the security portion of CTS - like any other debug build. Addresses: avc: denied { execute } for name="sh" dev="dm-0" ino=571 scontext=u:r:system_server:s0 tcontext=u:object_r:shell_exec:s0 tclass=file Test: lunch aosp_marlin-userdebug; cd system/sepolicy; mm SANITIZE_TARGET=address; Verify permissions granted using with_asan() are granted. Test: lunch aosp_marlin-userdebug; cd system/sepolicy; mm; Verify permissions granted using with_asan() are not granted. Test: lunch aosp_marlin-user; cd system/sepolicy; mm SANITIZE_TARGET=address; Verify permissions granted using with_asan() are not granted. Bug: 36138508 Change-Id: I6e39ada4bacd71687a593023f16b45bc16cd7ef8
2017-03-13 20:22:15 +01:00
with_asan := false
ifneq (,$(filter address,$(SANITIZE_TARGET)))
with_asan := true
endif
In native coverage builds, allow all domains to access /data/misc/trace Bug: http://b/135139675 Coverage files are written to /data/misc/trace (governed by the method_trace_data_file selinux type). Allow all domains to access (create directories, access files) this directory when native coverage is enabled (by setting NATIVE_COVERAGE to true) in an userdebug or eng build. Also relax neverallow constraints to allow access to method_trace_data_file for native coverage builds. Test: Build 32-bit cuttlefish with coverage: m NATIVE_COVERAGE=true COVERAGE_PATHS="*" and verify that there are no selinux denials in kernel log and logcat. Change-Id: I3fe7c77612854b9de7de7a0ddd5cbf44a2f5c21e
2019-06-14 00:05:15 +02:00
with_native_coverage := false
ifeq ($(NATIVE_COVERAGE),true)
with_native_coverage := true
endif
Clang coverage also enables global write to /data/misc/trace. Bug: 143977934 Test: kill -37 <pid>, check for file in /data/misc/trace and no selinux denials Change-Id: I0d61f9ed4cae9b27694434521d6a066b22ae5f6c
2019-12-10 01:37:59 +01:00
ifeq ($(CLANG_COVERAGE),true)
with_native_coverage := true
endif
In native coverage builds, allow all domains to access /data/misc/trace Bug: http://b/135139675 Coverage files are written to /data/misc/trace (governed by the method_trace_data_file selinux type). Allow all domains to access (create directories, access files) this directory when native coverage is enabled (by setting NATIVE_COVERAGE to true) in an userdebug or eng build. Also relax neverallow constraints to allow access to method_trace_data_file for native coverage builds. Test: Build 32-bit cuttlefish with coverage: m NATIVE_COVERAGE=true COVERAGE_PATHS="*" and verify that there are no selinux denials in kernel log and logcat. Change-Id: I3fe7c77612854b9de7de7a0ddd5cbf44a2f5c21e
2019-06-14 00:05:15 +02:00
Add BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW A new sysprop neverallow rules are mandatory only for devices launching with R or later. For devices already launched, neverallow rules can be relaxed with adding following line to BoardConfig.mk: BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true Bug: 131162102 Test: Set PRODUCT_SHIPPING_API_LEVEL := 30 and try building with changing some system_public_prop to system_internal_prop Test: m cts sepolicy_tests Change-Id: Id978b4d81a8683a57304bb639961105e2d91fa9a Merged-In: Id978b4d81a8683a57304bb639961105e2d91fa9a (cherry picked from commit 3be11e7abb8f4fd651295f9ccb0ce087855c1cc0)
2019-09-26 08:14:55 +02:00
treble_sysprop_neverallow := true
ifeq ($(BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW),true)
treble_sysprop_neverallow := false
endif
ifeq ($(PRODUCT_SHIPPING_API_LEVEL),)
#$(warning no product shipping level defined)
else ifneq ($(call math_lt,29,$(PRODUCT_SHIPPING_API_LEVEL)),)
ifneq ($(BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW),)
$(error BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW cannot be set on a device shipping with R or later, and this is tested by CTS.)
endif
endif
Enforce sysprop owner Every property should have an appropriate owner attribute, which can be one of: system_property_type, product_property_type, or vendor_property_type. This will be enforced for devices launching with S or later. Devices launching with R or eariler can relax this by setting following under BoardConfig.mk: BUILD_BROKEN_ENFORCE_SYSPROP_OWNER := true Bug: 131162102 Test: system/sepolicy/tools/build_policies.sh Change-Id: I7914ef1b7463c9ec00812b9720094531fd63f0c7
2020-09-28 06:32:43 +02:00
enforce_sysprop_owner := true
ifeq ($(BUILD_BROKEN_ENFORCE_SYSPROP_OWNER),true)
enforce_sysprop_owner := false
endif
ifeq ($(PRODUCT_SHIPPING_API_LEVEL),)
#$(warning no product shipping level defined)
else ifneq ($(call math_lt,30,$(PRODUCT_SHIPPING_API_LEVEL)),)
ifneq ($(BUILD_BROKEN_ENFORCE_SYSPROP_OWNER),)
$(error BUILD_BROKEN_ENFORCE_SYSPROP_OWNER cannot be set on a device shipping with S or later, and this is tested by CTS.)
endif
endif
Prepare python tests to be run in CTS Bug: 37008075 Test: build, all tests pass. Modify some attributes locally to cause tests to fail (verify that they are actually working). Change-Id: If9f9ece61dff835f38ef9c8a57f5a7baddbae5cd
2017-10-04 18:42:29 +02:00
# Library extension for host-side tests
Fix typo and Mac build FAILED: out/target/product/sailfish/obj/ETC/treble_sepolicy_tests_intermediates/treble_sepolicy_tests Error: library-path out/host/darwin-x86/lib64/libsepolwrap.so does not exist Note, fixing here instead of reverting to avoid reverting changes in CTS. Test: ctate testing on Mac Change-Id: I95f483b152d9bece1a16267cbc49eedb1f902990
2017-10-05 03:15:44 +02:00
ifeq ($(HOST_OS),darwin)
Prepare python tests to be run in CTS Bug: 37008075 Test: build, all tests pass. Modify some attributes locally to cause tests to fail (verify that they are actually working). Change-Id: If9f9ece61dff835f38ef9c8a57f5a7baddbae5cd
2017-10-04 18:42:29 +02:00
SHAREDLIB_EXT=dylib
else
SHAREDLIB_EXT=so
endif
Label APEX files correctly when TARGET_FLATTEN_APEX=true When TARGET_FLATTEN_APEX=true, APEX files are not packaged in *.apex files but flattened to the system partition under /system/apex/<name> directories. There was a bug that those flattened files are not labeled because the per-APEX file_contexts were applied only when building *.apex. Fixing this by converting the file_contexts files so that /system/apex/<name> path is prepended and applying the generated file_contexts file for system.img when TARGET_FLATTEN_APEX=true. Bug: 123314817 Test: TARGET_FLATTEN_APEX=true m ls -alZ /system/apex/*/* shows that the files are correctly labeled Change-Id: Ia82740a1da0083d5bcfd71354a6d374d2a918342
2019-01-24 08:41:47 +01:00
# Convert a file_context file for a non-flattened APEX into a file for
# flattened APEX. /system/apex/<apex_name> path is prepended to the original paths
# $(1): path to the input file_contexts file for non-flattened APEX
Make file_contexts as "android:path" property Till now, file_contexts has been treated differently that other input src files. Now it is tagged as `android:"path"` because it is. Bug: 144732805 Test: m Change-Id: I6b22a8d22417b75c5cb8cd3b2e534d67e958b074
2019-11-20 09:54:34 +01:00
# $(2): path to the flattened APEX
# $(3): path to the generated file_contexts file for flattened APEX
Label APEX files correctly when TARGET_FLATTEN_APEX=true When TARGET_FLATTEN_APEX=true, APEX files are not packaged in *.apex files but flattened to the system partition under /system/apex/<name> directories. There was a bug that those flattened files are not labeled because the per-APEX file_contexts were applied only when building *.apex. Fixing this by converting the file_contexts files so that /system/apex/<name> path is prepended and applying the generated file_contexts file for system.img when TARGET_FLATTEN_APEX=true. Bug: 123314817 Test: TARGET_FLATTEN_APEX=true m ls -alZ /system/apex/*/* shows that the files are correctly labeled Change-Id: Ia82740a1da0083d5bcfd71354a6d374d2a918342
2019-01-24 08:41:47 +01:00
# $(4): variable where $(3) is added to
define build_flattened_apex_file_contexts
$(4) += $(3)
Make file_contexts as "android:path" property Till now, file_contexts has been treated differently that other input src files. Now it is tagged as `android:"path"` because it is. Bug: 144732805 Test: m Change-Id: I6b22a8d22417b75c5cb8cd3b2e534d67e958b074
2019-11-20 09:54:34 +01:00
$(3): PRIVATE_APEX_PATH := $(subst .,\\.,$(2))
Label APEX files correctly when TARGET_FLATTEN_APEX=true When TARGET_FLATTEN_APEX=true, APEX files are not packaged in *.apex files but flattened to the system partition under /system/apex/<name> directories. There was a bug that those flattened files are not labeled because the per-APEX file_contexts were applied only when building *.apex. Fixing this by converting the file_contexts files so that /system/apex/<name> path is prepended and applying the generated file_contexts file for system.img when TARGET_FLATTEN_APEX=true. Bug: 123314817 Test: TARGET_FLATTEN_APEX=true m ls -alZ /system/apex/*/* shows that the files are correctly labeled Change-Id: Ia82740a1da0083d5bcfd71354a6d374d2a918342
2019-01-24 08:41:47 +01:00
$(3): $(1)
$(hide) awk '/object_r/{printf("$$(PRIVATE_APEX_PATH)%s\n",$$$$0)}' $$< > $$@
endef
Split selinux_policy module into two. Create one _system and one _nonsystem target, which together contains the same artifacts as before, just split by whether they go on the system partition or not. The product build hierarchy is being refactored to be split by partition, so these targets facilitate inclusion of just the system parts where necessary. Also keep the selinux_policy target around for products that don't need the split. Bug: 80410283 Test: for t in eng userdebug user; do lunch mainline_arm64-${t}; m nothing; done Test: verified walleye /system and /vendor identical before and after, via: Test: /google/data/rw/users/cc/ccross/bin/compare-target-files.sh P6259983 walleye-userdebug "SYSTEM/*" "VENDOR/*" Test: only diffs are in build.prop files (timestamps and the like) Change-Id: I0f5d8a1558a164ce5cfb7d521f34b431855ac260
2018-07-02 15:31:29 +02:00
#################################
Change mapping file name to reflect its platform version. As the platform progresses in the split SELinux world, the platform will need to maintain mapping files back to previous platform versions to maintain backwards compatibility with vendor images which have SELinux policy written based on the older versions. This requires shipping multiple mapping files with the system image so that the right one can be selected. Change the name and location of the mapping file to reflect this. Also add a file to the vendor partition indicating which version is being targeted that the platform can use to determine which mapping file to choose. Bug: 36783775 Test: Force compilation of sepolicy on-device with mapping file changed to new location and name, using the value reported on /vendor. Change-Id: I93ab3e52c2c80c493719dc3825bc731867ea76d4
2017-04-10 21:27:18 +02:00
include $(CLEAR_VARS)
Split selinux_policy module into two. Create one _system and one _nonsystem target, which together contains the same artifacts as before, just split by whether they go on the system partition or not. The product build hierarchy is being refactored to be split by partition, so these targets facilitate inclusion of just the system parts where necessary. Also keep the selinux_policy target around for products that don't need the split. Bug: 80410283 Test: for t in eng userdebug user; do lunch mainline_arm64-${t}; m nothing; done Test: verified walleye /system and /vendor identical before and after, via: Test: /google/data/rw/users/cc/ccross/bin/compare-target-files.sh P6259983 walleye-userdebug "SYSTEM/*" "VENDOR/*" Test: only diffs are in build.prop files (timestamps and the like) Change-Id: I0f5d8a1558a164ce5cfb7d521f34b431855ac260
2018-07-02 15:31:29 +02:00
Change mapping file name to reflect its platform version. As the platform progresses in the split SELinux world, the platform will need to maintain mapping files back to previous platform versions to maintain backwards compatibility with vendor images which have SELinux policy written based on the older versions. This requires shipping multiple mapping files with the system image so that the right one can be selected. Change the name and location of the mapping file to reflect this. Also add a file to the vendor partition indicating which version is being targeted that the platform can use to determine which mapping file to choose. Bug: 36783775 Test: Force compilation of sepolicy on-device with mapping file changed to new location and name, using the value reported on /vendor. Change-Id: I93ab3e52c2c80c493719dc3825bc731867ea76d4
2017-04-10 21:27:18 +02:00
LOCAL_MODULE := selinux_policy
LOCAL_MODULE_TAGS := optional
Always build system and vendor policies (and related artifacts). Part of an effort to remove Treble-specifics from the way be build sepolicy. Bug: 70851112 Test: build and boot bullhead. Change-Id: I236f031e1b017875fb1afcc4f1b201699139516a
2018-05-09 03:52:11 +02:00
LOCAL_REQUIRED_MODULES += \
Split selinux_policy module into two. Create one _system and one _nonsystem target, which together contains the same artifacts as before, just split by whether they go on the system partition or not. The product build hierarchy is being refactored to be split by partition, so these targets facilitate inclusion of just the system parts where necessary. Also keep the selinux_policy target around for products that don't need the split. Bug: 80410283 Test: for t in eng userdebug user; do lunch mainline_arm64-${t}; m nothing; done Test: verified walleye /system and /vendor identical before and after, via: Test: /google/data/rw/users/cc/ccross/bin/compare-target-files.sh P6259983 walleye-userdebug "SYSTEM/*" "VENDOR/*" Test: only diffs are in build.prop files (timestamps and the like) Change-Id: I0f5d8a1558a164ce5cfb7d521f34b431855ac260
2018-07-02 15:31:29 +02:00
selinux_policy_nonsystem \
selinux_policy_system \
Always build system and vendor policies (and related artifacts). Part of an effort to remove Treble-specifics from the way be build sepolicy. Bug: 70851112 Test: build and boot bullhead. Change-Id: I236f031e1b017875fb1afcc4f1b201699139516a
2018-05-09 03:52:11 +02:00
Split selinux_policy module into two. Create one _system and one _nonsystem target, which together contains the same artifacts as before, just split by whether they go on the system partition or not. The product build hierarchy is being refactored to be split by partition, so these targets facilitate inclusion of just the system parts where necessary. Also keep the selinux_policy target around for products that don't need the split. Bug: 80410283 Test: for t in eng userdebug user; do lunch mainline_arm64-${t}; m nothing; done Test: verified walleye /system and /vendor identical before and after, via: Test: /google/data/rw/users/cc/ccross/bin/compare-target-files.sh P6259983 walleye-userdebug "SYSTEM/*" "VENDOR/*" Test: only diffs are in build.prop files (timestamps and the like) Change-Id: I0f5d8a1558a164ce5cfb7d521f34b431855ac260
2018-07-02 15:31:29 +02:00
include $(BUILD_PHONY_PACKAGE)
Always build system and vendor policies (and related artifacts). Part of an effort to remove Treble-specifics from the way be build sepolicy. Bug: 70851112 Test: build and boot bullhead. Change-Id: I236f031e1b017875fb1afcc4f1b201699139516a
2018-05-09 03:52:11 +02:00
Test files on intermediates dir, not on /system *_context_test / sepolicy_tests / treble_sepolicy_tests_* / sepolicy_freeze_test files are installed on /system/etc. By being FAKE modules, test files are not installed on target. Additionally, we need to set up dependency from droidcore to selinux_policy to make tests run on normal builds (m). Bug: 133460071 Test: m & see if tests run and no test files on /system/etc Test: m selinux_policy & see if tests run Change-Id: Icacf004d5c1c8ec720c7cedef7bae8aa648cbe49
2019-05-29 18:05:43 +02:00
# selinux_policy is a main goal and triggers lots of tests.
# Most tests are FAKE modules, so aren'triggered on normal builds. (e.g. 'm')
# By setting as droidcore's dependency, tests will run on normal builds.
droidcore: selinux_policy
Always build system and vendor policies (and related artifacts). Part of an effort to remove Treble-specifics from the way be build sepolicy. Bug: 70851112 Test: build and boot bullhead. Change-Id: I236f031e1b017875fb1afcc4f1b201699139516a
2018-05-09 03:52:11 +02:00
Split selinux_policy module into two. Create one _system and one _nonsystem target, which together contains the same artifacts as before, just split by whether they go on the system partition or not. The product build hierarchy is being refactored to be split by partition, so these targets facilitate inclusion of just the system parts where necessary. Also keep the selinux_policy target around for products that don't need the split. Bug: 80410283 Test: for t in eng userdebug user; do lunch mainline_arm64-${t}; m nothing; done Test: verified walleye /system and /vendor identical before and after, via: Test: /google/data/rw/users/cc/ccross/bin/compare-target-files.sh P6259983 walleye-userdebug "SYSTEM/*" "VENDOR/*" Test: only diffs are in build.prop files (timestamps and the like) Change-Id: I0f5d8a1558a164ce5cfb7d521f34b431855ac260
2018-07-02 15:31:29 +02:00
include $(CLEAR_VARS)
LOCAL_MODULE := selinux_policy_system
Always build system and vendor policies (and related artifacts). Part of an effort to remove Treble-specifics from the way be build sepolicy. Bug: 70851112 Test: build and boot bullhead. Change-Id: I236f031e1b017875fb1afcc4f1b201699139516a
2018-05-09 03:52:11 +02:00
# These build targets are not used on non-Treble devices. However, we build these to avoid
# divergence between Treble and non-Treble devices.
Change mapping file name to reflect its platform version. As the platform progresses in the split SELinux world, the platform will need to maintain mapping files back to previous platform versions to maintain backwards compatibility with vendor images which have SELinux policy written based on the older versions. This requires shipping multiple mapping files with the system image so that the right one can be selected. Change the name and location of the mapping file to reflect this. Also add a file to the vendor partition indicating which version is being targeted that the platform can use to determine which mapping file to choose. Bug: 36783775 Test: Force compilation of sepolicy on-device with mapping file changed to new location and name, using the value reported on /vendor. Change-Id: I93ab3e52c2c80c493719dc3825bc731867ea76d4
2017-04-10 21:27:18 +02:00
LOCAL_REQUIRED_MODULES += \
Split mapping file into system and product parts Both mapping files need to be included when building sepolicy at boot time. Bug: 119305624 Test: boot taimen Test: "cnd" type is declared in /vendor; "dataservice_app" type is declared in /product. This permission is preserved "allow cnd dataservice_app:binder { transfer call };" Change-Id: I138f34208ea05e170defd2b4ef4700ffa81f9573
2019-01-16 00:16:55 +01:00
plat_mapping_file \
sepolicy: support /system_ext and /product mapping files Install mapping files in SYSTEM_EXT_PRIVATE_POLICY and PRODUCT_PRIVATE_POLICY into /system_ext and /product respectively. Bug: 141084341 Test: boot taimen Test: system mapping files are unchanged Test: create mapping files in device/google/wahoo/sepolicy/ and check that they are correctly expanded and installed. Change-Id: I4d251c957b30a16df71eec47c871e24e5fc773a4
2019-10-11 01:29:40 +02:00
$(addprefix plat_,$(addsuffix .cil,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS))) \
Add mechanism for granting permissions to old vendor images This addresses Treble backwards compat issues introduced in aosp/793958 and aosp/783669. Bug: 122874820 Test: build/flash blueline with pi-dev vendor and generic_ab system images. Test: adb pull /sys/fs/selinux/policy; sesearch policy --allowx -s vendordomain -t dev_type Change-Id: Ic2b304472bb88051e03740dc387834056aba641a
2019-05-02 22:48:44 +02:00
$(addsuffix .compat.cil,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS)) \
Change mapping file name to reflect its platform version. As the platform progresses in the split SELinux world, the platform will need to maintain mapping files back to previous platform versions to maintain backwards compatibility with vendor images which have SELinux policy written based on the older versions. This requires shipping multiple mapping files with the system image so that the right one can be selected. Change the name and location of the mapping file to reflect this. Also add a file to the vendor partition indicating which version is being targeted that the platform can use to determine which mapping file to choose. Bug: 36783775 Test: Force compilation of sepolicy on-device with mapping file changed to new location and name, using the value reported on /vendor. Change-Id: I93ab3e52c2c80c493719dc3825bc731867ea76d4
2017-04-10 21:27:18 +02:00
plat_sepolicy.cil \
Split system and product sepolicy hashes. We need to be able to tell if /system was updated independently /product, and vice versa. Otherwise, the device might accidentally load the precompiled_policy after a /product sepolicy update. Also change the name of the hash file to more closely reflect how its generated. Bug: 119305624 Test: boot aosp_taimen, precompiled policy is loaded Test: If either of these hashes /system/etc/selinux/plat_sepolicy_and_mapping.sha256 /product/etc/selinux/product_sepolicy_and_mapping.sha256 are removed, then init falls back to compiling sepolicy at boot time. Change-Id: I14af81c8d3c5cb85c01592518e22077a8c8c3e5e
2019-01-23 03:07:58 +01:00
plat_sepolicy_and_mapping.sha256 \
Change mapping file name to reflect its platform version. As the platform progresses in the split SELinux world, the platform will need to maintain mapping files back to previous platform versions to maintain backwards compatibility with vendor images which have SELinux policy written based on the older versions. This requires shipping multiple mapping files with the system image so that the right one can be selected. Change the name and location of the mapping file to reflect this. Also add a file to the vendor partition indicating which version is being targeted that the platform can use to determine which mapping file to choose. Bug: 36783775 Test: Force compilation of sepolicy on-device with mapping file changed to new location and name, using the value reported on /vendor. Change-Id: I93ab3e52c2c80c493719dc3825bc731867ea76d4
2017-04-10 21:27:18 +02:00
secilc \
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
Move non-treble devices to split file_contexts This change is primarily to fix CTS which checks file ordering of file_contexts. Having two separate means of loading file_contexts has resulted in ordering variations. Previously the binary file_contexts was preferred since it loaded faster. However with the move to libpcre2, there is no difference in loading time between text and binary file_contexts. This leaves us with build system complexity with no benefit. Thus removing this unnecessary difference between devices. Bug: 38502071 Test: build and boot non-Treble Bullhead, run CTS tests below Test: build and boot Treble Marlin, run CTS tests below Test: cts-tradefed run singleCommand cts --skip-device-info \ --skip-preconditions --skip-connectivity-check --abi arm64-v8a \ --module CtsSecurityHostTestCases \ -t android.security.cts.SELinuxHostTest#testAospFileContexts Test: cts-tradefed run singleCommand cts --skip-device-info \ --skip-preconditions --skip-connectivity-check --abi arm64-v8a \ --module CtsSecurityHostTestCases \ -t android.security.cts.SELinuxHostTest#testValidFileContexts Change-Id: I088b3aeafaaab320f6658feb058a1fb89cbb65e1
2017-06-08 22:24:15 +02:00
LOCAL_REQUIRED_MODULES += \
Using a python script to build sepolicy Current sepolicy CIL files are built by several command-line tools in Android.mk. This change extracts some of the build logic into a python script to relief the effort in Android.mk. The first command is `build_sepolicy build_cil`. It's possible to add more sub-commands under the build_sepolicy script in the future. Bug: 64240127 Test: build bullhead/taimen Change-Id: Ie0ae4fc5256a550c72954cde5d5dd213a22d159a
2018-02-05 10:41:02 +01:00
build_sepolicy \
move build dependencies to sepolicy Some selinux build packages are defined in embedded.mk, others are defined in system/sepolicy/Android.mk. Move all to sepolicy as a dependency of the phony package selinux_policy which is defined in embedded.mk. Test: build Marlin (Treble) and Angler (non-Treble) Merged-In: Ib0443ad3da600447fbb51f2e9f91de04dcf5f9f6 Change-Id: Ib0443ad3da600447fbb51f2e9f91de04dcf5f9f6
2017-08-22 22:29:53 +02:00
plat_file_contexts \
Build contexts files with Soong This is to migrate sepolicy Makefiles into Soong. For the first part, file_contexts, hwservice_contexts, property_contexts, and service_contexts are migrated. Build-time tests for contexts files are still in Makefile; they will also be done with Soong after porting the module sepolicy. The motivation of migrating is based on generating property_contexts dynamically: if we were to amend contexts files at build time in the future, it would be nicer to manage them in Soong. To do that, building contexts files with Soong can be very helpful. Bug: 127949646 Bug: 129377144 Test: 1) Build blueline-userdebug, flash, and boot. Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash, and boot. Test: 3) Build aosp_arm-userdebug. Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
plat_file_contexts_test \
Add libselinux keystore_key backend. We add a new back end for SELinux based keystore2_key namespaces. This patch adds the rump policy and build system infrastructure for installing keystore2_key context files on the target devices. Bug: 158500146 Bug: 159466840 Test: None Change-Id: I423c9e68ad259926e4a315d052dfda97fa502106 Merged-In: I423c9e68ad259926e4a315d052dfda97fa502106
2020-07-25 22:02:29 +02:00
plat_keystore2_key_contexts \
move build dependencies to sepolicy Some selinux build packages are defined in embedded.mk, others are defined in system/sepolicy/Android.mk. Move all to sepolicy as a dependency of the phony package selinux_policy which is defined in embedded.mk. Test: build Marlin (Treble) and Angler (non-Treble) Merged-In: Ib0443ad3da600447fbb51f2e9f91de04dcf5f9f6 Change-Id: Ib0443ad3da600447fbb51f2e9f91de04dcf5f9f6
2017-08-22 22:29:53 +02:00
plat_mac_permissions.xml \
plat_property_contexts \
Build contexts files with Soong This is to migrate sepolicy Makefiles into Soong. For the first part, file_contexts, hwservice_contexts, property_contexts, and service_contexts are migrated. Build-time tests for contexts files are still in Makefile; they will also be done with Soong after porting the module sepolicy. The motivation of migrating is based on generating property_contexts dynamically: if we were to amend contexts files at build time in the future, it would be nicer to manage them in Soong. To do that, building contexts files with Soong can be very helpful. Bug: 127949646 Bug: 129377144 Test: 1) Build blueline-userdebug, flash, and boot. Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash, and boot. Test: 3) Build aosp_arm-userdebug. Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
plat_property_contexts_test \
move build dependencies to sepolicy Some selinux build packages are defined in embedded.mk, others are defined in system/sepolicy/Android.mk. Move all to sepolicy as a dependency of the phony package selinux_policy which is defined in embedded.mk. Test: build Marlin (Treble) and Angler (non-Treble) Merged-In: Ib0443ad3da600447fbb51f2e9f91de04dcf5f9f6 Change-Id: Ib0443ad3da600447fbb51f2e9f91de04dcf5f9f6
2017-08-22 22:29:53 +02:00
plat_seapp_contexts \
plat_service_contexts \
Build contexts files with Soong This is to migrate sepolicy Makefiles into Soong. For the first part, file_contexts, hwservice_contexts, property_contexts, and service_contexts are migrated. Build-time tests for contexts files are still in Makefile; they will also be done with Soong after porting the module sepolicy. The motivation of migrating is based on generating property_contexts dynamically: if we were to amend contexts files at build time in the future, it would be nicer to manage them in Soong. To do that, building contexts files with Soong can be very helpful. Bug: 127949646 Bug: 129377144 Test: 1) Build blueline-userdebug, flash, and boot. Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash, and boot. Test: 3) Build aosp_arm-userdebug. Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
plat_service_contexts_test \
move build dependencies to sepolicy Some selinux build packages are defined in embedded.mk, others are defined in system/sepolicy/Android.mk. Move all to sepolicy as a dependency of the phony package selinux_policy which is defined in embedded.mk. Test: build Marlin (Treble) and Angler (non-Treble) Merged-In: Ib0443ad3da600447fbb51f2e9f91de04dcf5f9f6 Change-Id: Ib0443ad3da600447fbb51f2e9f91de04dcf5f9f6
2017-08-22 22:29:53 +02:00
plat_hwservice_contexts \
Build contexts files with Soong This is to migrate sepolicy Makefiles into Soong. For the first part, file_contexts, hwservice_contexts, property_contexts, and service_contexts are migrated. Build-time tests for contexts files are still in Makefile; they will also be done with Soong after porting the module sepolicy. The motivation of migrating is based on generating property_contexts dynamically: if we were to amend contexts files at build time in the future, it would be nicer to manage them in Soong. To do that, building contexts files with Soong can be very helpful. Bug: 127949646 Bug: 129377144 Test: 1) Build blueline-userdebug, flash, and boot. Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash, and boot. Test: 3) Build aosp_arm-userdebug. Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
plat_hwservice_contexts_test \
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
searchpolicy \
Split selinux_policy module into two. Create one _system and one _nonsystem target, which together contains the same artifacts as before, just split by whether they go on the system partition or not. The product build hierarchy is being refactored to be split by partition, so these targets facilitate inclusion of just the system parts where necessary. Also keep the selinux_policy target around for products that don't need the split. Bug: 80410283 Test: for t in eng userdebug user; do lunch mainline_arm64-${t}; m nothing; done Test: verified walleye /system and /vendor identical before and after, via: Test: /google/data/rw/users/cc/ccross/bin/compare-target-files.sh P6259983 walleye-userdebug "SYSTEM/*" "VENDOR/*" Test: only diffs are in build.prop files (timestamps and the like) Change-Id: I0f5d8a1558a164ce5cfb7d521f34b431855ac260
2018-07-02 15:31:29 +02:00
# This conditional inclusion closely mimics the conditional logic
# inside init/init.cpp for loading SELinux policy from files.
ifneq ($(PRODUCT_SEPOLICY_SPLIT),true)
# The following files are only allowed for non-Treble devices.
LOCAL_REQUIRED_MODULES += \
sepolicy \
vendor_service_contexts \
endif # ($(PRODUCT_SEPOLICY_SPLIT),true)
Move non-treble devices to split file_contexts This change is primarily to fix CTS which checks file ordering of file_contexts. Having two separate means of loading file_contexts has resulted in ordering variations. Previously the binary file_contexts was preferred since it loaded faster. However with the move to libpcre2, there is no difference in loading time between text and binary file_contexts. This leaves us with build system complexity with no benefit. Thus removing this unnecessary difference between devices. Bug: 38502071 Test: build and boot non-Treble Bullhead, run CTS tests below Test: build and boot Treble Marlin, run CTS tests below Test: cts-tradefed run singleCommand cts --skip-device-info \ --skip-preconditions --skip-connectivity-check --abi arm64-v8a \ --module CtsSecurityHostTestCases \ -t android.security.cts.SELinuxHostTest#testAospFileContexts Test: cts-tradefed run singleCommand cts --skip-device-info \ --skip-preconditions --skip-connectivity-check --abi arm64-v8a \ --module CtsSecurityHostTestCases \ -t android.security.cts.SELinuxHostTest#testValidFileContexts Change-Id: I088b3aeafaaab320f6658feb058a1fb89cbb65e1
2017-06-08 22:24:15 +02:00
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
ifneq ($(with_asan),true)
Use SELINUX_IGNORE_NEVERALLOWS flag to disable all tests The intent of this flag is to disable tests during early device bringup so that vendor drops can occur without build breakages. When SELINUX_IGNORE_NEVERALLOWS=true also disable labeling tests sepolicy_tests, and treble_sepolicy_tests. Bug: 73322735 Test: build, verify known tests failures do not cause build breakage. Change-Id: I3e7165938d4e34c066bfa0a20e68b7e02dae4a24
2018-02-14 05:29:55 +01:00
ifneq ($(SELINUX_IGNORE_NEVERALLOWS),true)
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
LOCAL_REQUIRED_MODULES += \
sepolicy_tests \
Add mechanism for granting permissions to old vendor images This addresses Treble backwards compat issues introduced in aosp/793958 and aosp/783669. Bug: 122874820 Test: build/flash blueline with pi-dev vendor and generic_ab system images. Test: adb pull /sys/fs/selinux/policy; sesearch policy --allowx -s vendordomain -t dev_type Change-Id: Ic2b304472bb88051e03740dc387834056aba641a
2019-05-02 22:48:44 +02:00
$(addsuffix _compat_test,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS)) \
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
PRODUCT_SEPOLICY_SPLIT forces Treble tests to run. This is the flag for when sepolicy is split. Also removed other commented-out heuristics around fake-treble. We should aim to remove it entirely instead. Fixes: 141348590 Test: build w/ and without adding binder_in_vendor_violators to a vendor process (and see the expected error there) Change-Id: I29fb335cc5b5d6e117d93038fe458b8c74acf321
2019-09-20 20:16:29 +02:00
ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
LOCAL_REQUIRED_MODULES += \
$(addprefix treble_sepolicy_tests_,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS)) \
endif # PRODUCT_SEPOLICY_SPLIT
endif # SELINUX_IGNORE_NEVERALLOWS
endif # with_asan
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
Split selinux_policy module into two. Create one _system and one _nonsystem target, which together contains the same artifacts as before, just split by whether they go on the system partition or not. The product build hierarchy is being refactored to be split by partition, so these targets facilitate inclusion of just the system parts where necessary. Also keep the selinux_policy target around for products that don't need the split. Bug: 80410283 Test: for t in eng userdebug user; do lunch mainline_arm64-${t}; m nothing; done Test: verified walleye /system and /vendor identical before and after, via: Test: /google/data/rw/users/cc/ccross/bin/compare-target-files.sh P6259983 walleye-userdebug "SYSTEM/*" "VENDOR/*" Test: only diffs are in build.prop files (timestamps and the like) Change-Id: I0f5d8a1558a164ce5cfb7d521f34b431855ac260
2018-07-02 15:31:29 +02:00
ifneq ($(PLATFORM_SEPOLICY_VERSION),$(TOT_SEPOLICY_VERSION))
LOCAL_REQUIRED_MODULES += \
sepolicy_freeze_test \
Expand the scope of sepolicy_freeze_test The existing freeze test only covers the policy files in system/sepolicy alone. There's demand from product teams that would like to implement a freeze test for their sepolicy. Instead of letting them fork the freeze test, we believe expanding the scope of the exising one is in the best interest. $FREEZE_TEST_EXTRA_DIRS and $FREEZE_TEST_EXTRA_PREBUILT_DIRS are added. These build variables could be appended like $PRODUCT_PUBLIC_POLICY. The product team are expected to maintain their policy prebuilts. Bug: 166455099 Test: manual Change-Id: I6f350e1e3db2807be4dbfd0ceb34f0d89f94d629
2020-10-08 23:39:42 +02:00
else
ifneq (,$(FREEZE_TEST_EXTRA_DIRS)$(FREEZE_TEST_EXTRA_PREBUILT_DIRS))
$(error SEPOLICY_FREEZE_TEST_EXTRA_DIRS or SEPOLICY_FREEZE_TEST_EXTRA_PREBUILT_DIRS\
cannot be set before system/sepolicy freezes.)
endif # (,$(FREEZE_TEST_EXTRA_DIRS)$(FREEZE_TEST_EXTRA_PREBUILT_DIRS))
Split selinux_policy module into two. Create one _system and one _nonsystem target, which together contains the same artifacts as before, just split by whether they go on the system partition or not. The product build hierarchy is being refactored to be split by partition, so these targets facilitate inclusion of just the system parts where necessary. Also keep the selinux_policy target around for products that don't need the split. Bug: 80410283 Test: for t in eng userdebug user; do lunch mainline_arm64-${t}; m nothing; done Test: verified walleye /system and /vendor identical before and after, via: Test: /google/data/rw/users/cc/ccross/bin/compare-target-files.sh P6259983 walleye-userdebug "SYSTEM/*" "VENDOR/*" Test: only diffs are in build.prop files (timestamps and the like) Change-Id: I0f5d8a1558a164ce5cfb7d521f34b431855ac260
2018-07-02 15:31:29 +02:00
endif # ($(PLATFORM_SEPOLICY_VERSION),$(TOT_SEPOLICY_VERSION))
include $(BUILD_PHONY_PACKAGE)
#################################
include $(CLEAR_VARS)
Create selinux_policy_* for /product and /system_ext Separate selinux_policy_system_ext and selinux_policy_product from the selinux_policy_nonsystem module. With this CL, selinux_policy_nonsystem will include the files for /vendor and /odm partitions only. It will still include selinux_policy_system_ext and selinux_policy_product as required modules. Bug: 170282998 Test: build and check boot Change-Id: Ie2f646a217ec86ede95caec101622bc530d12cfc
2020-10-07 11:28:47 +02:00
LOCAL_MODULE := selinux_policy_system_ext
Split selinux_policy module into two. Create one _system and one _nonsystem target, which together contains the same artifacts as before, just split by whether they go on the system partition or not. The product build hierarchy is being refactored to be split by partition, so these targets facilitate inclusion of just the system parts where necessary. Also keep the selinux_policy target around for products that don't need the split. Bug: 80410283 Test: for t in eng userdebug user; do lunch mainline_arm64-${t}; m nothing; done Test: verified walleye /system and /vendor identical before and after, via: Test: /google/data/rw/users/cc/ccross/bin/compare-target-files.sh P6259983 walleye-userdebug "SYSTEM/*" "VENDOR/*" Test: only diffs are in build.prop files (timestamps and the like) Change-Id: I0f5d8a1558a164ce5cfb7d521f34b431855ac260
2018-07-02 15:31:29 +02:00
# Include precompiled policy, unless told otherwise.
ifneq ($(PRODUCT_PRECOMPILED_SEPOLICY),false)
Create selinux_policy_* for /product and /system_ext Separate selinux_policy_system_ext and selinux_policy_product from the selinux_policy_nonsystem module. With this CL, selinux_policy_nonsystem will include the files for /vendor and /odm partitions only. It will still include selinux_policy_system_ext and selinux_policy_product as required modules. Bug: 170282998 Test: build and check boot Change-Id: Ie2f646a217ec86ede95caec101622bc530d12cfc
2020-10-07 11:28:47 +02:00
LOCAL_REQUIRED_MODULES += system_ext_sepolicy_and_mapping.sha256
Add /odm/etc/selinux/odm_sepolicy.cil This change adds the support of odm sepolicy customization, which can be configured through the newly added build varaible: - BOARD_ODM_SEPOLICY_DIRS += device/${ODM_NAME}/${BOM_NAME}/sepolicy Also moving precompiled sepolicy to /odm when BOARD_ODM_SEPOLICY_DIRS is set. On a DUT, precompiled sepolicy on /odm will override the one in /vendor. This is intentional because /odm is the hardware customization for /vendor and both should be updated together if desired. Bug: 64240127 Test: boot a device with /odm partition Change-Id: Ia8f81a78c88cbfefb3ff19e2ccd2648da6284d09
2017-11-27 04:41:33 +01:00
endif
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
ifdef HAS_SYSTEM_EXT_SEPOLICY
Allowing system_ext sepolicy to be empty Some targets just need to extend system_ext context files, e.g., file_contexts, service_contexts, etc., without adding any system_ext policy files, e.g., *.te files. Currently, this will lead to build errors. This CL allows system_ext_sepolicy.cil and the system_ext mapping file to be empty. It's now also possible to just set BOARD_PLAT_PRIVATE_SEPOLICY_DIR without setting BOARD_PLAT_PUBLIC_SEPOLICY_DIR. Bug: 137712473 Bug: 141880898 Test: Only adds system_ext context files without policy files (e.g., *.te), then `mmma system/sepolicy` can build pass Change-Id: I72849f2d4aa43e5296cd15c07a8fd058186a6376
2019-10-04 08:34:18 +02:00
LOCAL_REQUIRED_MODULES += system_ext_sepolicy.cil
endif
ifdef HAS_SYSTEM_EXT_PUBLIC_SEPOLICY
sepolicy: support /system_ext and /product mapping files Install mapping files in SYSTEM_EXT_PRIVATE_POLICY and PRODUCT_PRIVATE_POLICY into /system_ext and /product respectively. Bug: 141084341 Test: boot taimen Test: system mapping files are unchanged Test: create mapping files in device/google/wahoo/sepolicy/ and check that they are correctly expanded and installed. Change-Id: I4d251c957b30a16df71eec47c871e24e5fc773a4
2019-10-11 01:29:40 +02:00
LOCAL_REQUIRED_MODULES += \
Only require compat mapping files if they exist. Call build_policy when determing which compat mapping files should be included for a given partition. Bug: 168637766 Test: Built aosp_bonito-userdebug and saw that the compat mapping files in product/etc/sepolicy/mapping were no longer present. Test: Added a test 30.0.cil file to bonito's product private compat directory and saw that it was present at product/etc/sepolicy/mapping. Change-Id: I83cc28a159b24c0a2c0717dae461983250ab6c25
2020-09-22 00:32:16 +02:00
system_ext_mapping_file
system_ext_compat_files := $(call build_policy, $(sepolicy_compat_files), $(SYSTEM_EXT_PRIVATE_POLICY))
LOCAL_REQUIRED_MODULES += $(addprefix system_ext_, $(notdir $(system_ext_compat_files)))
sepolicy: support /system_ext and /product mapping files Install mapping files in SYSTEM_EXT_PRIVATE_POLICY and PRODUCT_PRIVATE_POLICY into /system_ext and /product respectively. Bug: 141084341 Test: boot taimen Test: system mapping files are unchanged Test: create mapping files in device/google/wahoo/sepolicy/ and check that they are correctly expanded and installed. Change-Id: I4d251c957b30a16df71eec47c871e24e5fc773a4
2019-10-11 01:29:40 +02:00
Allowing system_ext sepolicy to be empty Some targets just need to extend system_ext context files, e.g., file_contexts, service_contexts, etc., without adding any system_ext policy files, e.g., *.te files. Currently, this will lead to build errors. This CL allows system_ext_sepolicy.cil and the system_ext mapping file to be empty. It's now also possible to just set BOARD_PLAT_PRIVATE_SEPOLICY_DIR without setting BOARD_PLAT_PUBLIC_SEPOLICY_DIR. Bug: 137712473 Bug: 141880898 Test: Only adds system_ext context files without policy files (e.g., *.te), then `mmma system/sepolicy` can build pass Change-Id: I72849f2d4aa43e5296cd15c07a8fd058186a6376
2019-10-04 08:34:18 +02:00
endif
ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
LOCAL_REQUIRED_MODULES += \
Separate system_ext_file_contexts out of system sepolicy. Bug: 137712473 Test: boot crosshatch Change-Id: I09f63771d08ad18fb41fca801dd587b086be58c7
2019-09-09 16:04:06 +02:00
system_ext_file_contexts \
system_ext_file_contexts_test \
Separate system_ext_hwservice_contexts out of system sepolicy. Bug: 137712473 Test: boot crosshatch Change-Id: Ic5774da74e200b9d7699ac2240a12e7616dc512a
2019-09-09 16:05:10 +02:00
system_ext_hwservice_contexts \
system_ext_hwservice_contexts_test \
Separate system_ext_property_contexts out of system sepolicy. Bug: 137712473 Test: boot crosshatch Change-Id: I27db30edfd9948675793fdfec19081288f8017eb
2019-09-09 12:09:22 +02:00
system_ext_property_contexts \
system_ext_property_contexts_test \
Separate system_ext_seapp_contexts out of system sepolicy. Bug: 137712473 Test: boot crosshatch Change-Id: I2c2acbcf234861feb39834c867a4eb74c506692d
2019-09-09 16:04:30 +02:00
system_ext_seapp_contexts \
Separate system_ext_service_contexts out of system sepolicy. Bug: 137712473 Test: boot crosshatch Change-Id: If483e7a99dc07f082dd0ecd0162a54140a3267de
2019-09-09 16:05:29 +02:00
system_ext_service_contexts \
system_ext_service_contexts_test \
Separate system_ext_mac_permissions.xml out of system sepolicy. Bug: 137712473 Test: boot crosshatch Test: Moving product sepolicy to system_ext and checks the file contents in /system_ext/etc/selinux are identical to previous contents in /product/etc/selinux. Change-Id: I434e7f23a1ae7d01d084335783255330329c44e9
2019-09-09 16:05:49 +02:00
system_ext_mac_permissions.xml \
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
endif
Create selinux_policy_* for /product and /system_ext Separate selinux_policy_system_ext and selinux_policy_product from the selinux_policy_nonsystem module. With this CL, selinux_policy_nonsystem will include the files for /vendor and /odm partitions only. It will still include selinux_policy_system_ext and selinux_policy_product as required modules. Bug: 170282998 Test: build and check boot Change-Id: Ie2f646a217ec86ede95caec101622bc530d12cfc
2020-10-07 11:28:47 +02:00
include $(BUILD_PHONY_PACKAGE)
#################################
include $(CLEAR_VARS)
LOCAL_MODULE := selinux_policy_product
# Include precompiled policy, unless told otherwise.
ifneq ($(PRODUCT_PRECOMPILED_SEPOLICY),false)
LOCAL_REQUIRED_MODULES += product_sepolicy_and_mapping.sha256
endif
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
ifdef HAS_PRODUCT_SEPOLICY
Allowing product sepolicy to be empty Some targets just need to extend product context files, e.g., file_contexts, service_contexts, etc., without adding any product-specific policy files, e.g., *.te files. Or just need to add private product sepolicy without adding public product sepolicy. Currently, this will lead to build errors. This CL allows product_sepolicy.cil and the product mapping file to be empty. It's now also possible to just set PRODUCT_PRIVATE_POLICY without setting PRODUCT_PUBLIC_POLICY. Bug: 131193755 Test: Only adds product private sepolicy, then `mmma system/sepolicy` Change-Id: Ifed5af7413b2a1e20a0628518582615708c8c31a
2019-10-04 09:36:05 +02:00
LOCAL_REQUIRED_MODULES += product_sepolicy.cil
endif
ifdef HAS_PRODUCT_PUBLIC_SEPOLICY
sepolicy: support /system_ext and /product mapping files Install mapping files in SYSTEM_EXT_PRIVATE_POLICY and PRODUCT_PRIVATE_POLICY into /system_ext and /product respectively. Bug: 141084341 Test: boot taimen Test: system mapping files are unchanged Test: create mapping files in device/google/wahoo/sepolicy/ and check that they are correctly expanded and installed. Change-Id: I4d251c957b30a16df71eec47c871e24e5fc773a4
2019-10-11 01:29:40 +02:00
LOCAL_REQUIRED_MODULES += \
Only require compat mapping files if they exist. Call build_policy when determing which compat mapping files should be included for a given partition. Bug: 168637766 Test: Built aosp_bonito-userdebug and saw that the compat mapping files in product/etc/sepolicy/mapping were no longer present. Test: Added a test 30.0.cil file to bonito's product private compat directory and saw that it was present at product/etc/sepolicy/mapping. Change-Id: I83cc28a159b24c0a2c0717dae461983250ab6c25
2020-09-22 00:32:16 +02:00
product_mapping_file
product_compat_files := $(call build_policy, $(sepolicy_compat_files), $(PRODUCT_PRIVATE_POLICY))
LOCAL_REQUIRED_MODULES += $(addprefix product_, $(notdir $(product_compat_files)))
sepolicy: support /system_ext and /product mapping files Install mapping files in SYSTEM_EXT_PRIVATE_POLICY and PRODUCT_PRIVATE_POLICY into /system_ext and /product respectively. Bug: 141084341 Test: boot taimen Test: system mapping files are unchanged Test: create mapping files in device/google/wahoo/sepolicy/ and check that they are correctly expanded and installed. Change-Id: I4d251c957b30a16df71eec47c871e24e5fc773a4
2019-10-11 01:29:40 +02:00
Allowing product sepolicy to be empty Some targets just need to extend product context files, e.g., file_contexts, service_contexts, etc., without adding any product-specific policy files, e.g., *.te files. Or just need to add private product sepolicy without adding public product sepolicy. Currently, this will lead to build errors. This CL allows product_sepolicy.cil and the product mapping file to be empty. It's now also possible to just set PRODUCT_PRIVATE_POLICY without setting PRODUCT_PUBLIC_POLICY. Bug: 131193755 Test: Only adds product private sepolicy, then `mmma system/sepolicy` Change-Id: Ifed5af7413b2a1e20a0628518582615708c8c31a
2019-10-04 09:36:05 +02:00
endif
ifdef HAS_PRODUCT_SEPOLICY_DIR
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
LOCAL_REQUIRED_MODULES += \
Separate product_file_contexts out of system sepolicy. Bug: 119305624 Test: boot blueline Change-Id: I3ecdeab3bb33c3cb5e80dc10ba1079c9853048f8
2018-12-19 04:51:19 +01:00
product_file_contexts \
Build contexts files with Soong This is to migrate sepolicy Makefiles into Soong. For the first part, file_contexts, hwservice_contexts, property_contexts, and service_contexts are migrated. Build-time tests for contexts files are still in Makefile; they will also be done with Soong after porting the module sepolicy. The motivation of migrating is based on generating property_contexts dynamically: if we were to amend contexts files at build time in the future, it would be nicer to manage them in Soong. To do that, building contexts files with Soong can be very helpful. Bug: 127949646 Bug: 129377144 Test: 1) Build blueline-userdebug, flash, and boot. Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash, and boot. Test: 3) Build aosp_arm-userdebug. Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
product_file_contexts_test \
Separate product_hwservice_contexts out of system sepolicy. Bug: 119305624 Test: normal/recovery boot aosp_taimen Change-Id: I1009745686acd51563378dac56e857be0d60e794
2018-12-21 01:13:10 +01:00
product_hwservice_contexts \
Build contexts files with Soong This is to migrate sepolicy Makefiles into Soong. For the first part, file_contexts, hwservice_contexts, property_contexts, and service_contexts are migrated. Build-time tests for contexts files are still in Makefile; they will also be done with Soong after porting the module sepolicy. The motivation of migrating is based on generating property_contexts dynamically: if we were to amend contexts files at build time in the future, it would be nicer to manage them in Soong. To do that, building contexts files with Soong can be very helpful. Bug: 127949646 Bug: 129377144 Test: 1) Build blueline-userdebug, flash, and boot. Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash, and boot. Test: 3) Build aosp_arm-userdebug. Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
product_hwservice_contexts_test \
Separate product_property_contexts out of system sepolicy. Bug: 119305624 Test: normal/recovery boot aosp_taimen Change-Id: Ib7a29a9f8f23dd917cc25c23c7612f9e4ae36ea0
2018-12-21 04:31:42 +01:00
product_property_contexts \
Build contexts files with Soong This is to migrate sepolicy Makefiles into Soong. For the first part, file_contexts, hwservice_contexts, property_contexts, and service_contexts are migrated. Build-time tests for contexts files are still in Makefile; they will also be done with Soong after porting the module sepolicy. The motivation of migrating is based on generating property_contexts dynamically: if we were to amend contexts files at build time in the future, it would be nicer to manage them in Soong. To do that, building contexts files with Soong can be very helpful. Bug: 127949646 Bug: 129377144 Test: 1) Build blueline-userdebug, flash, and boot. Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash, and boot. Test: 3) Build aosp_arm-userdebug. Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
product_property_contexts_test \
Separate product_seapp_contexts out of system sepolicy. Bug: 119305624 Test: normal/recovery boot aosp_taimen Change-Id: Ia8d69be16011db8dd63fa41672449a4ade7302c2
2018-12-21 19:46:45 +01:00
product_seapp_contexts \
Separate product_service_contexts out of system sepolicy. Bug: 119305624 Test: normal/recovery boot aosp_taimen Change-Id: I15aa275fa658b58f5a5d3e651d164f9fcd87c0af
2018-12-21 21:28:14 +01:00
product_service_contexts \
Build contexts files with Soong This is to migrate sepolicy Makefiles into Soong. For the first part, file_contexts, hwservice_contexts, property_contexts, and service_contexts are migrated. Build-time tests for contexts files are still in Makefile; they will also be done with Soong after porting the module sepolicy. The motivation of migrating is based on generating property_contexts dynamically: if we were to amend contexts files at build time in the future, it would be nicer to manage them in Soong. To do that, building contexts files with Soong can be very helpful. Bug: 127949646 Bug: 129377144 Test: 1) Build blueline-userdebug, flash, and boot. Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash, and boot. Test: 3) Build aosp_arm-userdebug. Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
product_service_contexts_test \
Separate product_mac_permissions.xml out of system sepolicy. Bug: 119305624 Test: normal/recovery boot aosp_taimen Change-Id: I46da995886ce421bb87e741d577f659426ff79c4
2018-12-22 01:07:21 +01:00
product_mac_permissions.xml \
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
Move selinux_denial_metadata to /vendor. selinux_denial_metadate is an concatenation of different bug maps on the device, including vendor one. This file is only used for debugging, so we simply move it to /vendor instead of splitting it up. /vendor/etc/selinux/selinux_denial_metadata has vendor_configs_file selinux type, which is logd readable. Bug: 5159394 Test: bug information is still preserved in avc logs, e.g. audit(0.0:248): avc: denied { read } for name="u:object_r:vendor_default_prop:s0" dev="tmpfs" ino=18012 scontext=u:r:platform_app:s0:c512,c768 tcontext=u:object_r:vendor_default_prop:s0 tclass=file permissive=0 b/79617173 app=com.android.systemui Change-Id: Id5eb9abd3bdeed92feb2aca40880903533468d50
2019-01-23 18:47:05 +01:00
endif
Create selinux_policy_* for /product and /system_ext Separate selinux_policy_system_ext and selinux_policy_product from the selinux_policy_nonsystem module. With this CL, selinux_policy_nonsystem will include the files for /vendor and /odm partitions only. It will still include selinux_policy_system_ext and selinux_policy_product as required modules. Bug: 170282998 Test: build and check boot Change-Id: Ie2f646a217ec86ede95caec101622bc530d12cfc
2020-10-07 11:28:47 +02:00
include $(BUILD_PHONY_PACKAGE)
#################################
include $(CLEAR_VARS)
LOCAL_MODULE := selinux_policy_nonsystem
# Include precompiled policy, unless told otherwise.
ifneq ($(PRODUCT_PRECOMPILED_SEPOLICY),false)
LOCAL_REQUIRED_MODULES += \
precompiled_sepolicy \
precompiled_sepolicy.plat_sepolicy_and_mapping.sha256 \
precompiled_sepolicy.system_ext_sepolicy_and_mapping.sha256 \
precompiled_sepolicy.product_sepolicy_and_mapping.sha256 \
endif # ($(PRODUCT_PRECOMPILED_SEPOLICY),false)
# These build targets are not used on non-Treble devices. However, we build these to avoid
# divergence between Treble and non-Treble devices.
LOCAL_REQUIRED_MODULES += \
plat_pub_versioned.cil \
vendor_sepolicy.cil \
plat_sepolicy_vers.txt \
LOCAL_REQUIRED_MODULES += \
vendor_file_contexts \
vendor_file_contexts_test \
vendor_mac_permissions.xml \
vendor_property_contexts \
vendor_property_contexts_test \
vendor_seapp_contexts \
vendor_service_contexts \
vendor_hwservice_contexts \
vendor_hwservice_contexts_test \
vndservice_contexts \
ifdef BOARD_ODM_SEPOLICY_DIRS
LOCAL_REQUIRED_MODULES += \
odm_sepolicy.cil \
odm_file_contexts \
odm_file_contexts_test \
odm_seapp_contexts \
odm_property_contexts \
odm_property_contexts_test \
odm_hwservice_contexts \
odm_hwservice_contexts_test \
odm_mac_permissions.xml
endif
LOCAL_REQUIRED_MODULES += selinux_policy_system_ext
LOCAL_REQUIRED_MODULES += selinux_policy_product
Move selinux_denial_metadata to /vendor. selinux_denial_metadate is an concatenation of different bug maps on the device, including vendor one. This file is only used for debugging, so we simply move it to /vendor instead of splitting it up. /vendor/etc/selinux/selinux_denial_metadata has vendor_configs_file selinux type, which is logd readable. Bug: 5159394 Test: bug information is still preserved in avc logs, e.g. audit(0.0:248): avc: denied { read } for name="u:object_r:vendor_default_prop:s0" dev="tmpfs" ino=18012 scontext=u:r:platform_app:s0:c512,c768 tcontext=u:object_r:vendor_default_prop:s0 tclass=file permissive=0 b/79617173 app=com.android.systemui Change-Id: Id5eb9abd3bdeed92feb2aca40880903533468d50
2019-01-23 18:47:05 +01:00
LOCAL_REQUIRED_MODULES += \
selinux_denial_metadata \
Adding userdebug_plat_sepolicy.cil The userdebug sepolicy will be installed into debug ramdisk. When the ramdisk is used, the device must be unlocked and init will load this userdebug version of platform sepolicy to allow adb root. Bug: 126493225 Test: 'make' and checks that the userdebug sepolicy is in debug ramdisk Change-Id: I9df514054a86d63449b3ebfd1afdee2aee649418
2019-04-19 16:03:33 +02:00
# Builds an addtional userdebug sepolicy into the debug ramdisk.
LOCAL_REQUIRED_MODULES += \
userdebug_plat_sepolicy.cil \
Change mapping file name to reflect its platform version. As the platform progresses in the split SELinux world, the platform will need to maintain mapping files back to previous platform versions to maintain backwards compatibility with vendor images which have SELinux policy written based on the older versions. This requires shipping multiple mapping files with the system image so that the right one can be selected. Change the name and location of the mapping file to reflect this. Also add a file to the vendor partition indicating which version is being targeted that the platform can use to determine which mapping file to choose. Bug: 36783775 Test: Force compilation of sepolicy on-device with mapping file changed to new location and name, using the value reported on /vendor. Change-Id: I93ab3e52c2c80c493719dc3825bc731867ea76d4
2017-04-10 21:27:18 +02:00
include $(BUILD_PHONY_PACKAGE)
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
#################################
include $(CLEAR_VARS)
LOCAL_MODULE := sepolicy_neverallows
Test files on intermediates dir, not on /system *_context_test / sepolicy_tests / treble_sepolicy_tests_* / sepolicy_freeze_test files are installed on /system/etc. By being FAKE modules, test files are not installed on target. Additionally, we need to set up dependency from droidcore to selinux_policy to make tests run on normal builds (m). Bug: 133460071 Test: m & see if tests run and no test files on /system/etc Test: m selinux_policy & see if tests run Change-Id: Icacf004d5c1c8ec720c7cedef7bae8aa648cbe49
2019-05-29 18:05:43 +02:00
LOCAL_MODULE_CLASS := FAKE
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
LOCAL_MODULE_TAGS := optional
include $(BUILD_SYSTEM)/base_rules.mk
# sepolicy_policy.conf - All of the policy for the device. This is only used to
# check neverallow rules.
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
policy_files := $(call build_policy, $(sepolicy_build_files), \
$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) $(PLAT_VENDOR_POLICY) \
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
$(SYSTEM_EXT_PUBLIC_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY) \
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
$(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY) \
$(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_ODM_SEPOLICY_DIRS))
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
sepolicy_policy.conf := $(intermediates)/policy.conf
$(sepolicy_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
$(sepolicy_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Use user policy when checking neverallow rules. When building userdebug or eng builds, we still want to build the user policy when checking neverallow rules so that we can catch compile errors. Commit c0713e86 split out a helper function but lost one instance of using user instead of the real variant. This restores that one and adds it to the neverallow check. Bug: 74344625 Test: Added a rule that referred to a type defined only in userdebug and eng and ensure we throw a compile error when building userdebug mode. Change-Id: I1a6ffbb36dbeeb880852f9cbac880f923370c2ae (cherry picked from commit 053cb34130b763d93e2181062ebe1b5f8bf3ad9c)
2018-03-08 00:36:29 +01:00
$(sepolicy_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := user
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
$(sepolicy_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
$(sepolicy_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
In native coverage builds, allow all domains to access /data/misc/trace Bug: http://b/135139675 Coverage files are written to /data/misc/trace (governed by the method_trace_data_file selinux type). Allow all domains to access (create directories, access files) this directory when native coverage is enabled (by setting NATIVE_COVERAGE to true) in an userdebug or eng build. Also relax neverallow constraints to allow access to method_trace_data_file for native coverage builds. Test: Build 32-bit cuttlefish with coverage: m NATIVE_COVERAGE=true COVERAGE_PATHS="*" and verify that there are no selinux denials in kernel log and logcat. Change-Id: I3fe7c77612854b9de7de7a0ddd5cbf44a2f5c21e
2019-06-14 00:05:15 +02:00
$(sepolicy_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
$(sepolicy_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(sepolicy_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
$(sepolicy_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
$(sepolicy_policy.conf): $(policy_files) $(M4)
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
$(transform-policy-to-conf)
Fix building error for multi-line dontaudit statement All the *.conf.dontaudit files are generated from *.conf with the command of 'sed '/dontaudit/d' $@ > $@.dontaudit', but this command can not be applied to multi-line dontaudit statement. Test: Set plat_policy.conf.dontaudit as the input_file parameter of checkpolicy tool, then selinux syntax error will occur during building. Change-Id: I281de923d8a5f0b46256ec7de4df12a1c1d7e061
2018-09-13 08:04:19 +02:00
$(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
Add compile time check for expanded attribute neverallow failure The SELinux policy language supports an expandattribute statement. Similar to the C "inline" declaration, this expands the permissions associated with types, instead of using the attribute directly. Please see https://android.googlesource.com/platform/external/selinux/+/1089665e31a647a5f0ba2eabe8ac6232b384bed9 for more detail on this language option. Expansion of attributes causes consistency problems with CTS. If a neverallow rule exists which refers to an expanded attribute, the CTS neverallow test will fail, because the policy does not have the attribute embedded in it. Examples: * b/119783042 (fixed in 536d3413b84c4340f9d8cea96a3239490784169f) * b/67296580 (fixed in 6f7e8609f9f79877f818b231b8b0b8b906483780) * b/63809360 (fixed in 89f215e6a0985e746f1993ed047c1971201db529) etc... Instead of waiting for the CTS test to fail, modify the Android.mk file so that we do checks similar to CTS. This allows us to fail at compile time instead of waiting for a CTS bug. For example, for b/119783042, instead of the compile succeeding, it will now fail with the following error message: [ 70% 190/268] build out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows FAILED: out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows /bin/bash -c "(ASAN_OPTIONS=detect_leaks=0 out/host/linux-x86/bin/checkpolicy -M -c 30 -o out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/policy.conf ) && (out/host/linux-x86/bin/sepolicy-analyze out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp neverallow -w -f out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/policy_2.conf || ( echo \"\" 1>&2; echo \"sepolicy-analyze failed. This is most likely due to the use\" 1>&2; echo \"of an expanded attribute in a neverallow assertion. Please fix\" 1>&2; echo \"the policy.\" 1>&2; exit 1 ) ) && (touch out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp ) && (mv out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows )" libsepol.report_failure: neverallow violated by allow vold hal_bootctl_default:binder { call }; libsepol.check_assertions: 1 neverallow failures occurred sepolicy-analyze failed. This is most likely due to the use of an expanded attribute in a neverallow assertion. Please fix the policy. 15:44:27 ninja failed with: exit status 1 Test: Revert 536d3413b84c4340f9d8cea96a3239490784169f and verify compile fails as above. Test: Compile succeeds Bug: 119783042 Change-Id: I5df405b337bb744b838dadf53a2234d8ed94bf39
2018-11-27 22:45:47 +01:00
# sepolicy_policy_2.conf - All of the policy for the device. This is only used to
# check neverallow rules using sepolicy-analyze, similar to CTS.
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
policy_files := $(call build_policy, $(sepolicy_build_files), \
$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) $(PLAT_VENDOR_POLICY) \
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
$(SYSTEM_EXT_PUBLIC_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY) \
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
$(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY) \
$(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_ODM_SEPOLICY_DIRS))
Add compile time check for expanded attribute neverallow failure The SELinux policy language supports an expandattribute statement. Similar to the C "inline" declaration, this expands the permissions associated with types, instead of using the attribute directly. Please see https://android.googlesource.com/platform/external/selinux/+/1089665e31a647a5f0ba2eabe8ac6232b384bed9 for more detail on this language option. Expansion of attributes causes consistency problems with CTS. If a neverallow rule exists which refers to an expanded attribute, the CTS neverallow test will fail, because the policy does not have the attribute embedded in it. Examples: * b/119783042 (fixed in 536d3413b84c4340f9d8cea96a3239490784169f) * b/67296580 (fixed in 6f7e8609f9f79877f818b231b8b0b8b906483780) * b/63809360 (fixed in 89f215e6a0985e746f1993ed047c1971201db529) etc... Instead of waiting for the CTS test to fail, modify the Android.mk file so that we do checks similar to CTS. This allows us to fail at compile time instead of waiting for a CTS bug. For example, for b/119783042, instead of the compile succeeding, it will now fail with the following error message: [ 70% 190/268] build out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows FAILED: out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows /bin/bash -c "(ASAN_OPTIONS=detect_leaks=0 out/host/linux-x86/bin/checkpolicy -M -c 30 -o out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/policy.conf ) && (out/host/linux-x86/bin/sepolicy-analyze out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp neverallow -w -f out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/policy_2.conf || ( echo \"\" 1>&2; echo \"sepolicy-analyze failed. This is most likely due to the use\" 1>&2; echo \"of an expanded attribute in a neverallow assertion. Please fix\" 1>&2; echo \"the policy.\" 1>&2; exit 1 ) ) && (touch out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp ) && (mv out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows )" libsepol.report_failure: neverallow violated by allow vold hal_bootctl_default:binder { call }; libsepol.check_assertions: 1 neverallow failures occurred sepolicy-analyze failed. This is most likely due to the use of an expanded attribute in a neverallow assertion. Please fix the policy. 15:44:27 ninja failed with: exit status 1 Test: Revert 536d3413b84c4340f9d8cea96a3239490784169f and verify compile fails as above. Test: Compile succeeds Bug: 119783042 Change-Id: I5df405b337bb744b838dadf53a2234d8ed94bf39
2018-11-27 22:45:47 +01:00
sepolicy_policy_2.conf := $(intermediates)/policy_2.conf
$(sepolicy_policy_2.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
$(sepolicy_policy_2.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
$(sepolicy_policy_2.conf): PRIVATE_TARGET_BUILD_VARIANT := user
$(sepolicy_policy_2.conf): PRIVATE_EXCLUDE_BUILD_TEST := true
$(sepolicy_policy_2.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
$(sepolicy_policy_2.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
In native coverage builds, allow all domains to access /data/misc/trace Bug: http://b/135139675 Coverage files are written to /data/misc/trace (governed by the method_trace_data_file selinux type). Allow all domains to access (create directories, access files) this directory when native coverage is enabled (by setting NATIVE_COVERAGE to true) in an userdebug or eng build. Also relax neverallow constraints to allow access to method_trace_data_file for native coverage builds. Test: Build 32-bit cuttlefish with coverage: m NATIVE_COVERAGE=true COVERAGE_PATHS="*" and verify that there are no selinux denials in kernel log and logcat. Change-Id: I3fe7c77612854b9de7de7a0ddd5cbf44a2f5c21e
2019-06-14 00:05:15 +02:00
$(sepolicy_policy_2.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
Add compile time check for expanded attribute neverallow failure The SELinux policy language supports an expandattribute statement. Similar to the C "inline" declaration, this expands the permissions associated with types, instead of using the attribute directly. Please see https://android.googlesource.com/platform/external/selinux/+/1089665e31a647a5f0ba2eabe8ac6232b384bed9 for more detail on this language option. Expansion of attributes causes consistency problems with CTS. If a neverallow rule exists which refers to an expanded attribute, the CTS neverallow test will fail, because the policy does not have the attribute embedded in it. Examples: * b/119783042 (fixed in 536d3413b84c4340f9d8cea96a3239490784169f) * b/67296580 (fixed in 6f7e8609f9f79877f818b231b8b0b8b906483780) * b/63809360 (fixed in 89f215e6a0985e746f1993ed047c1971201db529) etc... Instead of waiting for the CTS test to fail, modify the Android.mk file so that we do checks similar to CTS. This allows us to fail at compile time instead of waiting for a CTS bug. For example, for b/119783042, instead of the compile succeeding, it will now fail with the following error message: [ 70% 190/268] build out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows FAILED: out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows /bin/bash -c "(ASAN_OPTIONS=detect_leaks=0 out/host/linux-x86/bin/checkpolicy -M -c 30 -o out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/policy.conf ) && (out/host/linux-x86/bin/sepolicy-analyze out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp neverallow -w -f out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/policy_2.conf || ( echo \"\" 1>&2; echo \"sepolicy-analyze failed. This is most likely due to the use\" 1>&2; echo \"of an expanded attribute in a neverallow assertion. Please fix\" 1>&2; echo \"the policy.\" 1>&2; exit 1 ) ) && (touch out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp ) && (mv out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows )" libsepol.report_failure: neverallow violated by allow vold hal_bootctl_default:binder { call }; libsepol.check_assertions: 1 neverallow failures occurred sepolicy-analyze failed. This is most likely due to the use of an expanded attribute in a neverallow assertion. Please fix the policy. 15:44:27 ninja failed with: exit status 1 Test: Revert 536d3413b84c4340f9d8cea96a3239490784169f and verify compile fails as above. Test: Compile succeeds Bug: 119783042 Change-Id: I5df405b337bb744b838dadf53a2234d8ed94bf39
2018-11-27 22:45:47 +01:00
$(sepolicy_policy_2.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(sepolicy_policy_2.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
$(sepolicy_policy_2.conf): PRIVATE_POLICY_FILES := $(policy_files)
$(sepolicy_policy_2.conf): $(policy_files) $(M4)
Add compile time check for expanded attribute neverallow failure The SELinux policy language supports an expandattribute statement. Similar to the C "inline" declaration, this expands the permissions associated with types, instead of using the attribute directly. Please see https://android.googlesource.com/platform/external/selinux/+/1089665e31a647a5f0ba2eabe8ac6232b384bed9 for more detail on this language option. Expansion of attributes causes consistency problems with CTS. If a neverallow rule exists which refers to an expanded attribute, the CTS neverallow test will fail, because the policy does not have the attribute embedded in it. Examples: * b/119783042 (fixed in 536d3413b84c4340f9d8cea96a3239490784169f) * b/67296580 (fixed in 6f7e8609f9f79877f818b231b8b0b8b906483780) * b/63809360 (fixed in 89f215e6a0985e746f1993ed047c1971201db529) etc... Instead of waiting for the CTS test to fail, modify the Android.mk file so that we do checks similar to CTS. This allows us to fail at compile time instead of waiting for a CTS bug. For example, for b/119783042, instead of the compile succeeding, it will now fail with the following error message: [ 70% 190/268] build out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows FAILED: out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows /bin/bash -c "(ASAN_OPTIONS=detect_leaks=0 out/host/linux-x86/bin/checkpolicy -M -c 30 -o out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/policy.conf ) && (out/host/linux-x86/bin/sepolicy-analyze out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp neverallow -w -f out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/policy_2.conf || ( echo \"\" 1>&2; echo \"sepolicy-analyze failed. This is most likely due to the use\" 1>&2; echo \"of an expanded attribute in a neverallow assertion. Please fix\" 1>&2; echo \"the policy.\" 1>&2; exit 1 ) ) && (touch out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp ) && (mv out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows )" libsepol.report_failure: neverallow violated by allow vold hal_bootctl_default:binder { call }; libsepol.check_assertions: 1 neverallow failures occurred sepolicy-analyze failed. This is most likely due to the use of an expanded attribute in a neverallow assertion. Please fix the policy. 15:44:27 ninja failed with: exit status 1 Test: Revert 536d3413b84c4340f9d8cea96a3239490784169f and verify compile fails as above. Test: Compile succeeds Bug: 119783042 Change-Id: I5df405b337bb744b838dadf53a2234d8ed94bf39
2018-11-27 22:45:47 +01:00
$(transform-policy-to-conf)
$(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY_1 := $(sepolicy_policy.conf)
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY_2 := $(sepolicy_policy_2.conf)
$(LOCAL_BUILT_MODULE): $(sepolicy_policy.conf) $(sepolicy_policy_2.conf) \
$(HOST_OUT_EXECUTABLES)/checkpolicy $(HOST_OUT_EXECUTABLES)/sepolicy-analyze
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
ifneq ($(SELINUX_IGNORE_NEVERALLOWS),true)
$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c \
Add compile time check for expanded attribute neverallow failure The SELinux policy language supports an expandattribute statement. Similar to the C "inline" declaration, this expands the permissions associated with types, instead of using the attribute directly. Please see https://android.googlesource.com/platform/external/selinux/+/1089665e31a647a5f0ba2eabe8ac6232b384bed9 for more detail on this language option. Expansion of attributes causes consistency problems with CTS. If a neverallow rule exists which refers to an expanded attribute, the CTS neverallow test will fail, because the policy does not have the attribute embedded in it. Examples: * b/119783042 (fixed in 536d3413b84c4340f9d8cea96a3239490784169f) * b/67296580 (fixed in 6f7e8609f9f79877f818b231b8b0b8b906483780) * b/63809360 (fixed in 89f215e6a0985e746f1993ed047c1971201db529) etc... Instead of waiting for the CTS test to fail, modify the Android.mk file so that we do checks similar to CTS. This allows us to fail at compile time instead of waiting for a CTS bug. For example, for b/119783042, instead of the compile succeeding, it will now fail with the following error message: [ 70% 190/268] build out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows FAILED: out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows /bin/bash -c "(ASAN_OPTIONS=detect_leaks=0 out/host/linux-x86/bin/checkpolicy -M -c 30 -o out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/policy.conf ) && (out/host/linux-x86/bin/sepolicy-analyze out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp neverallow -w -f out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/policy_2.conf || ( echo \"\" 1>&2; echo \"sepolicy-analyze failed. This is most likely due to the use\" 1>&2; echo \"of an expanded attribute in a neverallow assertion. Please fix\" 1>&2; echo \"the policy.\" 1>&2; exit 1 ) ) && (touch out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp ) && (mv out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows )" libsepol.report_failure: neverallow violated by allow vold hal_bootctl_default:binder { call }; libsepol.check_assertions: 1 neverallow failures occurred sepolicy-analyze failed. This is most likely due to the use of an expanded attribute in a neverallow assertion. Please fix the policy. 15:44:27 ninja failed with: exit status 1 Test: Revert 536d3413b84c4340f9d8cea96a3239490784169f and verify compile fails as above. Test: Compile succeeds Bug: 119783042 Change-Id: I5df405b337bb744b838dadf53a2234d8ed94bf39
2018-11-27 22:45:47 +01:00
$(POLICYVERS) -o $@.tmp $(PRIVATE_SEPOLICY_1)
$(hide) $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $@.tmp neverallow -w -f $(PRIVATE_SEPOLICY_2) || \
( echo "" 1>&2; \
echo "sepolicy-analyze failed. This is most likely due to the use" 1>&2; \
echo "of an expanded attribute in a neverallow assertion. Please fix" 1>&2; \
echo "the policy." 1>&2; \
exit 1 )
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
endif # ($(SELINUX_IGNORE_NEVERALLOWS),true)
Add compile time check for expanded attribute neverallow failure The SELinux policy language supports an expandattribute statement. Similar to the C "inline" declaration, this expands the permissions associated with types, instead of using the attribute directly. Please see https://android.googlesource.com/platform/external/selinux/+/1089665e31a647a5f0ba2eabe8ac6232b384bed9 for more detail on this language option. Expansion of attributes causes consistency problems with CTS. If a neverallow rule exists which refers to an expanded attribute, the CTS neverallow test will fail, because the policy does not have the attribute embedded in it. Examples: * b/119783042 (fixed in 536d3413b84c4340f9d8cea96a3239490784169f) * b/67296580 (fixed in 6f7e8609f9f79877f818b231b8b0b8b906483780) * b/63809360 (fixed in 89f215e6a0985e746f1993ed047c1971201db529) etc... Instead of waiting for the CTS test to fail, modify the Android.mk file so that we do checks similar to CTS. This allows us to fail at compile time instead of waiting for a CTS bug. For example, for b/119783042, instead of the compile succeeding, it will now fail with the following error message: [ 70% 190/268] build out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows FAILED: out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows /bin/bash -c "(ASAN_OPTIONS=detect_leaks=0 out/host/linux-x86/bin/checkpolicy -M -c 30 -o out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/policy.conf ) && (out/host/linux-x86/bin/sepolicy-analyze out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp neverallow -w -f out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/policy_2.conf || ( echo \"\" 1>&2; echo \"sepolicy-analyze failed. This is most likely due to the use\" 1>&2; echo \"of an expanded attribute in a neverallow assertion. Please fix\" 1>&2; echo \"the policy.\" 1>&2; exit 1 ) ) && (touch out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp ) && (mv out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows )" libsepol.report_failure: neverallow violated by allow vold hal_bootctl_default:binder { call }; libsepol.check_assertions: 1 neverallow failures occurred sepolicy-analyze failed. This is most likely due to the use of an expanded attribute in a neverallow assertion. Please fix the policy. 15:44:27 ninja failed with: exit status 1 Test: Revert 536d3413b84c4340f9d8cea96a3239490784169f and verify compile fails as above. Test: Compile succeeds Bug: 119783042 Change-Id: I5df405b337bb744b838dadf53a2234d8ed94bf39
2018-11-27 22:45:47 +01:00
$(hide) touch $@.tmp
$(hide) mv $@.tmp $@
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
sepolicy_policy.conf :=
Add compile time check for expanded attribute neverallow failure The SELinux policy language supports an expandattribute statement. Similar to the C "inline" declaration, this expands the permissions associated with types, instead of using the attribute directly. Please see https://android.googlesource.com/platform/external/selinux/+/1089665e31a647a5f0ba2eabe8ac6232b384bed9 for more detail on this language option. Expansion of attributes causes consistency problems with CTS. If a neverallow rule exists which refers to an expanded attribute, the CTS neverallow test will fail, because the policy does not have the attribute embedded in it. Examples: * b/119783042 (fixed in 536d3413b84c4340f9d8cea96a3239490784169f) * b/67296580 (fixed in 6f7e8609f9f79877f818b231b8b0b8b906483780) * b/63809360 (fixed in 89f215e6a0985e746f1993ed047c1971201db529) etc... Instead of waiting for the CTS test to fail, modify the Android.mk file so that we do checks similar to CTS. This allows us to fail at compile time instead of waiting for a CTS bug. For example, for b/119783042, instead of the compile succeeding, it will now fail with the following error message: [ 70% 190/268] build out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows FAILED: out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows /bin/bash -c "(ASAN_OPTIONS=detect_leaks=0 out/host/linux-x86/bin/checkpolicy -M -c 30 -o out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/policy.conf ) && (out/host/linux-x86/bin/sepolicy-analyze out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp neverallow -w -f out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/policy_2.conf || ( echo \"\" 1>&2; echo \"sepolicy-analyze failed. This is most likely due to the use\" 1>&2; echo \"of an expanded attribute in a neverallow assertion. Please fix\" 1>&2; echo \"the policy.\" 1>&2; exit 1 ) ) && (touch out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp ) && (mv out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows )" libsepol.report_failure: neverallow violated by allow vold hal_bootctl_default:binder { call }; libsepol.check_assertions: 1 neverallow failures occurred sepolicy-analyze failed. This is most likely due to the use of an expanded attribute in a neverallow assertion. Please fix the policy. 15:44:27 ninja failed with: exit status 1 Test: Revert 536d3413b84c4340f9d8cea96a3239490784169f and verify compile fails as above. Test: Compile succeeds Bug: 119783042 Change-Id: I5df405b337bb744b838dadf53a2234d8ed94bf39
2018-11-27 22:45:47 +01:00
sepolicy_policy_2.conf :=
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
built_sepolicy_neverallows := $(LOCAL_BUILT_MODULE)
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
##################################
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
# reqd_policy_mask - a policy.conf file which contains only the bare minimum
# policy necessary to use checkpolicy. This bare-minimum policy needs to be
# present in all policy.conf files, but should not necessarily be exported as
# part of the public policy. The rules generated by reqd_policy_mask will allow
# the compilation of public policy and subsequent removal of CIL policy that
# should not be exported.
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
policy_files := $(call build_policy, $(sepolicy_build_files), $(REQD_MASK_POLICY))
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
reqd_policy_mask.conf := $(intermediates)/reqd_policy_mask.conf
$(reqd_policy_mask.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
$(reqd_policy_mask.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Use user policy when checking neverallow rules. When building userdebug or eng builds, we still want to build the user policy when checking neverallow rules so that we can catch compile errors. Commit c0713e86 split out a helper function but lost one instance of using user instead of the real variant. This restores that one and adds it to the neverallow check. Bug: 74344625 Test: Added a rule that referred to a type defined only in userdebug and eng and ensure we throw a compile error when building userdebug mode. Change-Id: I1a6ffbb36dbeeb880852f9cbac880f923370c2ae (cherry picked from commit 053cb34130b763d93e2181062ebe1b5f8bf3ad9c)
2018-03-08 00:36:29 +01:00
$(reqd_policy_mask.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
Switch recovery to versioned policy and split into components. And do some clean up: Replace LOCAL_TARGET_ARCH with global arch specifier that won't get clobbered, clean up sepolicy.recovery's eng specification, ensure that build macros are applied across all policy generation, not just plat_policy, and make sure that all private variables are cleared and alphabetized at the end. Bug: 31363362 Bug: 31369363 Test: Boot into recovery and observe no selinux denials. Change-Id: Ibc15b097f6d19acf01f6b22bee0e083b15f4ef75
2016-12-16 00:28:44 +01:00
$(reqd_policy_mask.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
Grant additional permissions for ASAN builds ASAN builds may require additional permissions to launch processes with ASAN wrappers. In this case, system_server needs permission to execute /system/bin/sh. Create with_asan() macro which can be used exclusively on debug builds. Note this means that ASAN builds with these additional permission will not pass the security portion of CTS - like any other debug build. Addresses: avc: denied { execute } for name="sh" dev="dm-0" ino=571 scontext=u:r:system_server:s0 tcontext=u:object_r:shell_exec:s0 tclass=file Test: lunch aosp_marlin-userdebug; cd system/sepolicy; mm SANITIZE_TARGET=address; Verify permissions granted using with_asan() are granted. Test: lunch aosp_marlin-userdebug; cd system/sepolicy; mm; Verify permissions granted using with_asan() are not granted. Test: lunch aosp_marlin-user; cd system/sepolicy; mm SANITIZE_TARGET=address; Verify permissions granted using with_asan() are not granted. Bug: 36138508 Change-Id: I6e39ada4bacd71687a593023f16b45bc16cd7ef8
2017-03-13 20:22:15 +01:00
$(reqd_policy_mask.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
In native coverage builds, allow all domains to access /data/misc/trace Bug: http://b/135139675 Coverage files are written to /data/misc/trace (governed by the method_trace_data_file selinux type). Allow all domains to access (create directories, access files) this directory when native coverage is enabled (by setting NATIVE_COVERAGE to true) in an userdebug or eng build. Also relax neverallow constraints to allow access to method_trace_data_file for native coverage builds. Test: Build 32-bit cuttlefish with coverage: m NATIVE_COVERAGE=true COVERAGE_PATHS="*" and verify that there are no selinux denials in kernel log and logcat. Change-Id: I3fe7c77612854b9de7de7a0ddd5cbf44a2f5c21e
2019-06-14 00:05:15 +02:00
$(reqd_policy_mask.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
$(reqd_policy_mask.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Use PRODUCT_SEPOLICY_SPLIT for full Treble. PRODUCT_FULL_TREBLE is being broken up into smaller, more manageable components. Bug: 62019611 Test: manual Change-Id: I9b65f120851d9ea134a0059a417f0282777717fc
2017-11-09 20:24:56 +01:00
$(reqd_policy_mask.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
$(reqd_policy_mask.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
Add BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW A new sysprop neverallow rules are mandatory only for devices launching with R or later. For devices already launched, neverallow rules can be relaxed with adding following line to BoardConfig.mk: BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true Bug: 131162102 Test: Set PRODUCT_SHIPPING_API_LEVEL := 30 and try building with changing some system_public_prop to system_internal_prop Test: m cts sepolicy_tests Change-Id: Id978b4d81a8683a57304bb639961105e2d91fa9a Merged-In: Id978b4d81a8683a57304bb639961105e2d91fa9a (cherry picked from commit 3be11e7abb8f4fd651295f9ccb0ce087855c1cc0)
2019-09-26 08:14:55 +02:00
$(reqd_policy_mask.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow)
Enforce sysprop owner Every property should have an appropriate owner attribute, which can be one of: system_property_type, product_property_type, or vendor_property_type. This will be enforced for devices launching with S or later. Devices launching with R or eariler can relax this by setting following under BoardConfig.mk: BUILD_BROKEN_ENFORCE_SYSPROP_OWNER := true Bug: 131162102 Test: system/sepolicy/tools/build_policies.sh Change-Id: I7914ef1b7463c9ec00812b9720094531fd63f0c7
2020-09-28 06:32:43 +02:00
$(reqd_policy_mask.conf): PRIVATE_ENFORCE_SYSPROP_OWNER := $(enforce_sysprop_owner)
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
$(reqd_policy_mask.conf): PRIVATE_POLICY_FILES := $(policy_files)
$(reqd_policy_mask.conf): $(policy_files) $(M4)
Add sepolicy definitions.mk and create policy.conf function. Bug: 36899958 Test: Builds 'n' boots. Change-Id: I5836a18f9d0a9a976dda7304045e3b9e1e84565e Merged-In: I5836a18f9d0a9a976dda7304045e3b9e1e84565e (cherry picked from commit c0713e86790583dacbd8545d35ae476ff1f849bb)
2017-07-07 23:59:51 +02:00
$(transform-policy-to-conf)
Sepolicy: Disable leak sanitizer for checkpolicy Temporary workaround. Bug: 37755687 Test: ASAN_OPTIONS= SANITIZE_HOST=address m Change-Id: I001a42ea6463a1e137e1f5328755596f986323de
2017-04-28 02:16:13 +02:00
# b/37755687
CHECKPOLICY_ASAN_OPTIONS := ASAN_OPTIONS=detect_leaks=0
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
reqd_policy_mask.cil := $(intermediates)/reqd_policy_mask.cil
$(reqd_policy_mask.cil): $(reqd_policy_mask.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy
@mkdir -p $(dir $@)
Sepolicy: Disable leak sanitizer for checkpolicy Temporary workaround. Bug: 37755687 Test: ASAN_OPTIONS= SANITIZE_HOST=address m Change-Id: I001a42ea6463a1e137e1f5328755596f986323de
2017-04-28 02:16:13 +02:00
$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -C -M -c \
$(POLICYVERS) -o $@ $<
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
reqd_policy_mask.conf :=
##################################
Rename plat_pub_policy -> pub_policy Public policy that is available to vendor (and odm) sepolicy is a combination of system and product public sepolicy. Since "plat_" prefix implies a pure system sepolicy component, drop "plat_" prefix from "plat_pub_policy" to be consistent with naming in this file. Bug: 119305624 Test: m selinux_policy Change-Id: Iaf094702556ce97371fa1c58c01d707103d7f7d6
2019-01-15 22:31:03 +01:00
# pub_policy - policy that will be exported to be a part of non-platform
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
# policy corresponding to this platform version. This is a limited subset of
# policy that would not compile in checkpolicy on its own. To get around this
# limitation, add only the required files from private policy, which will
# generate CIL policy that will then be filtered out by the reqd_policy_mask.
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
#
# There are three pub_policy.cil files below:
# - pub_policy.cil: exported 'product', 'system_ext' and 'system' policy.
# - system_ext_pub_policy.cil: exported 'system_ext' and 'system' policy.
# - plat_pub_policy.cil: exported 'system' policy.
#
# Those above files will in turn be used to generate the following versioned cil files:
# - product_mapping_file: the versioned, exported 'product' policy in product partition.
# - system_ext_mapping_file: the versioned, exported 'system_ext' policy in system_ext partition.
# - plat_mapping_file: the versioned, exported 'system' policy in system partition.
# - plat_pub_versioned.cil: the versioned, exported 'product', 'system_ext' and 'system'
# policy in vendor partition.
#
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
policy_files := $(call build_policy, $(sepolicy_build_files), \
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
$(PLAT_PUBLIC_POLICY) $(SYSTEM_EXT_PUBLIC_POLICY) $(PRODUCT_PUBLIC_POLICY) $(REQD_MASK_POLICY))
Rename plat_pub_policy -> pub_policy Public policy that is available to vendor (and odm) sepolicy is a combination of system and product public sepolicy. Since "plat_" prefix implies a pure system sepolicy component, drop "plat_" prefix from "plat_pub_policy" to be consistent with naming in this file. Bug: 119305624 Test: m selinux_policy Change-Id: Iaf094702556ce97371fa1c58c01d707103d7f7d6
2019-01-15 22:31:03 +01:00
pub_policy.conf := $(intermediates)/pub_policy.conf
$(pub_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
$(pub_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
$(pub_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
$(pub_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
$(pub_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
In native coverage builds, allow all domains to access /data/misc/trace Bug: http://b/135139675 Coverage files are written to /data/misc/trace (governed by the method_trace_data_file selinux type). Allow all domains to access (create directories, access files) this directory when native coverage is enabled (by setting NATIVE_COVERAGE to true) in an userdebug or eng build. Also relax neverallow constraints to allow access to method_trace_data_file for native coverage builds. Test: Build 32-bit cuttlefish with coverage: m NATIVE_COVERAGE=true COVERAGE_PATHS="*" and verify that there are no selinux denials in kernel log and logcat. Change-Id: I3fe7c77612854b9de7de7a0ddd5cbf44a2f5c21e
2019-06-14 00:05:15 +02:00
$(pub_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
Rename plat_pub_policy -> pub_policy Public policy that is available to vendor (and odm) sepolicy is a combination of system and product public sepolicy. Since "plat_" prefix implies a pure system sepolicy component, drop "plat_" prefix from "plat_pub_policy" to be consistent with naming in this file. Bug: 119305624 Test: m selinux_policy Change-Id: Iaf094702556ce97371fa1c58c01d707103d7f7d6
2019-01-15 22:31:03 +01:00
$(pub_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(pub_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
$(pub_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
Add BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW A new sysprop neverallow rules are mandatory only for devices launching with R or later. For devices already launched, neverallow rules can be relaxed with adding following line to BoardConfig.mk: BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true Bug: 131162102 Test: Set PRODUCT_SHIPPING_API_LEVEL := 30 and try building with changing some system_public_prop to system_internal_prop Test: m cts sepolicy_tests Change-Id: Id978b4d81a8683a57304bb639961105e2d91fa9a Merged-In: Id978b4d81a8683a57304bb639961105e2d91fa9a (cherry picked from commit 3be11e7abb8f4fd651295f9ccb0ce087855c1cc0)
2019-09-26 08:14:55 +02:00
$(pub_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow)
Enforce sysprop owner Every property should have an appropriate owner attribute, which can be one of: system_property_type, product_property_type, or vendor_property_type. This will be enforced for devices launching with S or later. Devices launching with R or eariler can relax this by setting following under BoardConfig.mk: BUILD_BROKEN_ENFORCE_SYSPROP_OWNER := true Bug: 131162102 Test: system/sepolicy/tools/build_policies.sh Change-Id: I7914ef1b7463c9ec00812b9720094531fd63f0c7
2020-09-28 06:32:43 +02:00
$(pub_policy.conf): PRIVATE_ENFORCE_SYSPROP_OWNER := $(enforce_sysprop_owner)
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
$(pub_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
$(pub_policy.conf): $(policy_files) $(M4)
Add sepolicy definitions.mk and create policy.conf function. Bug: 36899958 Test: Builds 'n' boots. Change-Id: I5836a18f9d0a9a976dda7304045e3b9e1e84565e Merged-In: I5836a18f9d0a9a976dda7304045e3b9e1e84565e (cherry picked from commit c0713e86790583dacbd8545d35ae476ff1f849bb)
2017-07-07 23:59:51 +02:00
$(transform-policy-to-conf)
Rename plat_pub_policy -> pub_policy Public policy that is available to vendor (and odm) sepolicy is a combination of system and product public sepolicy. Since "plat_" prefix implies a pure system sepolicy component, drop "plat_" prefix from "plat_pub_policy" to be consistent with naming in this file. Bug: 119305624 Test: m selinux_policy Change-Id: Iaf094702556ce97371fa1c58c01d707103d7f7d6
2019-01-15 22:31:03 +01:00
pub_policy.cil := $(intermediates)/pub_policy.cil
$(pub_policy.cil): PRIVATE_POL_CONF := $(pub_policy.conf)
$(pub_policy.cil): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil)
$(pub_policy.cil): $(HOST_OUT_EXECUTABLES)/checkpolicy \
$(HOST_OUT_EXECUTABLES)/build_sepolicy $(pub_policy.conf) $(reqd_policy_mask.cil)
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
@mkdir -p $(dir $@)
Replace "grep -f" with python util. grep can potentially run out of memory on Mac builds for large input files. So we add a python util to handle filtering out files. We will also need this util to filter plat_sepolicy.cil out of product_sepolicy.cil Bug: 119305624 Test: boot aosp_taimen Change-Id: I61cd68f407ea5de43a06bf522a5fc149e5067e8c
2018-12-18 01:35:41 +01:00
$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $< -C -M -c $(POLICYVERS) -o $@ $(PRIVATE_POL_CONF)
$(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) filter_out \
-f $(PRIVATE_REQD_MASK) -t $@
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
Rename plat_pub_policy -> pub_policy Public policy that is available to vendor (and odm) sepolicy is a combination of system and product public sepolicy. Since "plat_" prefix implies a pure system sepolicy component, drop "plat_" prefix from "plat_pub_policy" to be consistent with naming in this file. Bug: 119305624 Test: m selinux_policy Change-Id: Iaf094702556ce97371fa1c58c01d707103d7f7d6
2019-01-15 22:31:03 +01:00
pub_policy.conf :=
Switch recovery to versioned policy and split into components. And do some clean up: Replace LOCAL_TARGET_ARCH with global arch specifier that won't get clobbered, clean up sepolicy.recovery's eng specification, ensure that build macros are applied across all policy generation, not just plat_policy, and make sure that all private variables are cleared and alphabetized at the end. Bug: 31363362 Bug: 31369363 Test: Boot into recovery and observe no selinux denials. Change-Id: Ibc15b097f6d19acf01f6b22bee0e083b15f4ef75
2016-12-16 00:28:44 +01:00
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
##################################
policy_files := $(call build_policy, $(sepolicy_build_files), \
$(PLAT_PUBLIC_POLICY) $(SYSTEM_EXT_PUBLIC_POLICY) $(REQD_MASK_POLICY))
system_ext_pub_policy.conf := $(intermediates)/system_ext_pub_policy.conf
$(system_ext_pub_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
$(system_ext_pub_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
$(system_ext_pub_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
$(system_ext_pub_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
$(system_ext_pub_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
$(system_ext_pub_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
$(system_ext_pub_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(system_ext_pub_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
$(system_ext_pub_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
Fix treble sysprop neverallow rules on system_ext Bug: 131162102 Bug: 142684203 Test: m sepolicy_tests Change-Id: Ib21adee404a1ee7d57bc9ff54f3ae1831cdf3b81
2019-10-16 04:46:50 +02:00
$(system_ext_pub_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow)
Enforce sysprop owner Every property should have an appropriate owner attribute, which can be one of: system_property_type, product_property_type, or vendor_property_type. This will be enforced for devices launching with S or later. Devices launching with R or eariler can relax this by setting following under BoardConfig.mk: BUILD_BROKEN_ENFORCE_SYSPROP_OWNER := true Bug: 131162102 Test: system/sepolicy/tools/build_policies.sh Change-Id: I7914ef1b7463c9ec00812b9720094531fd63f0c7
2020-09-28 06:32:43 +02:00
$(system_ext_pub_policy.conf): PRIVATE_ENFORCE_SYSPROP_OWNER := $(enforce_sysprop_owner)
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
$(system_ext_pub_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
$(system_ext_pub_policy.conf): $(policy_files) $(M4)
$(transform-policy-to-conf)
system_ext_pub_policy.cil := $(intermediates)/system_ext_pub_policy.cil
$(system_ext_pub_policy.cil): PRIVATE_POL_CONF := $(system_ext_pub_policy.conf)
$(system_ext_pub_policy.cil): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil)
$(system_ext_pub_policy.cil): $(HOST_OUT_EXECUTABLES)/checkpolicy \
$(HOST_OUT_EXECUTABLES)/build_sepolicy $(system_ext_pub_policy.conf) $(reqd_policy_mask.cil)
@mkdir -p $(dir $@)
$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $< -C -M -c $(POLICYVERS) -o $@ $(PRIVATE_POL_CONF)
$(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) filter_out \
-f $(PRIVATE_REQD_MASK) -t $@
system_ext_pub_policy.conf :=
Split mapping file into system and product parts Both mapping files need to be included when building sepolicy at boot time. Bug: 119305624 Test: boot taimen Test: "cnd" type is declared in /vendor; "dataservice_app" type is declared in /product. This permission is preserved "allow cnd dataservice_app:binder { transfer call };" Change-Id: I138f34208ea05e170defd2b4ef4700ffa81f9573
2019-01-16 00:16:55 +01:00
##################################
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
policy_files := $(call build_policy, $(sepolicy_build_files), \
$(PLAT_PUBLIC_POLICY) $(REQD_MASK_POLICY))
Split mapping file into system and product parts Both mapping files need to be included when building sepolicy at boot time. Bug: 119305624 Test: boot taimen Test: "cnd" type is declared in /vendor; "dataservice_app" type is declared in /product. This permission is preserved "allow cnd dataservice_app:binder { transfer call };" Change-Id: I138f34208ea05e170defd2b4ef4700ffa81f9573
2019-01-16 00:16:55 +01:00
plat_pub_policy.conf := $(intermediates)/plat_pub_policy.conf
$(plat_pub_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
$(plat_pub_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
$(plat_pub_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
$(plat_pub_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
$(plat_pub_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
In native coverage builds, allow all domains to access /data/misc/trace Bug: http://b/135139675 Coverage files are written to /data/misc/trace (governed by the method_trace_data_file selinux type). Allow all domains to access (create directories, access files) this directory when native coverage is enabled (by setting NATIVE_COVERAGE to true) in an userdebug or eng build. Also relax neverallow constraints to allow access to method_trace_data_file for native coverage builds. Test: Build 32-bit cuttlefish with coverage: m NATIVE_COVERAGE=true COVERAGE_PATHS="*" and verify that there are no selinux denials in kernel log and logcat. Change-Id: I3fe7c77612854b9de7de7a0ddd5cbf44a2f5c21e
2019-06-14 00:05:15 +02:00
$(plat_pub_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
Split mapping file into system and product parts Both mapping files need to be included when building sepolicy at boot time. Bug: 119305624 Test: boot taimen Test: "cnd" type is declared in /vendor; "dataservice_app" type is declared in /product. This permission is preserved "allow cnd dataservice_app:binder { transfer call };" Change-Id: I138f34208ea05e170defd2b4ef4700ffa81f9573
2019-01-16 00:16:55 +01:00
$(plat_pub_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(plat_pub_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
$(plat_pub_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
Add BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW A new sysprop neverallow rules are mandatory only for devices launching with R or later. For devices already launched, neverallow rules can be relaxed with adding following line to BoardConfig.mk: BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true Bug: 131162102 Test: Set PRODUCT_SHIPPING_API_LEVEL := 30 and try building with changing some system_public_prop to system_internal_prop Test: m cts sepolicy_tests Change-Id: Id978b4d81a8683a57304bb639961105e2d91fa9a Merged-In: Id978b4d81a8683a57304bb639961105e2d91fa9a (cherry picked from commit 3be11e7abb8f4fd651295f9ccb0ce087855c1cc0)
2019-09-26 08:14:55 +02:00
$(plat_pub_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow)
Enforce sysprop owner Every property should have an appropriate owner attribute, which can be one of: system_property_type, product_property_type, or vendor_property_type. This will be enforced for devices launching with S or later. Devices launching with R or eariler can relax this by setting following under BoardConfig.mk: BUILD_BROKEN_ENFORCE_SYSPROP_OWNER := true Bug: 131162102 Test: system/sepolicy/tools/build_policies.sh Change-Id: I7914ef1b7463c9ec00812b9720094531fd63f0c7
2020-09-28 06:32:43 +02:00
$(plat_pub_policy.conf): PRIVATE_ENFORCE_SYSPROP_OWNER := $(enforce_sysprop_owner)
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
$(plat_pub_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
$(plat_pub_policy.conf): $(policy_files) $(M4)
Split mapping file into system and product parts Both mapping files need to be included when building sepolicy at boot time. Bug: 119305624 Test: boot taimen Test: "cnd" type is declared in /vendor; "dataservice_app" type is declared in /product. This permission is preserved "allow cnd dataservice_app:binder { transfer call };" Change-Id: I138f34208ea05e170defd2b4ef4700ffa81f9573
2019-01-16 00:16:55 +01:00
$(transform-policy-to-conf)
plat_pub_policy.cil := $(intermediates)/plat_pub_policy.cil
$(plat_pub_policy.cil): PRIVATE_POL_CONF := $(plat_pub_policy.conf)
$(plat_pub_policy.cil): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil)
$(plat_pub_policy.cil): $(HOST_OUT_EXECUTABLES)/checkpolicy \
$(HOST_OUT_EXECUTABLES)/build_sepolicy $(plat_pub_policy.conf) $(reqd_policy_mask.cil)
@mkdir -p $(dir $@)
$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $< -C -M -c $(POLICYVERS) -o $@ $(PRIVATE_POL_CONF)
$(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) filter_out \
-f $(PRIVATE_REQD_MASK) -t $@
plat_pub_policy.conf :=
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
#################################
include $(CLEAR_VARS)
LOCAL_MODULE := plat_sepolicy.cil
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
Move split sepolicy to correct locations This moves the CIL files comprising the split sepolicy to the directories/partitions based on whether the file is part of platform/system or non-platform/vendor. In particular: * plat_sepolicy.cil is moved to /system/etc/selinux, * nonplat_sepolicy.cil is moved to /vendor/etc/selinux, and * mapping_sepolicy.cil is moved to /vendor/etc/selinux. Test: Device boots, no additional denials. The test is performed both for a device without the CIL files and with the three CIL files. Bug: 31363362 Change-Id: Ia760d7eb32c80ba72f6409da75d99eb5aae71cd9
2017-03-02 21:39:25 +01:00
LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
include $(BUILD_SYSTEM)/base_rules.mk
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
# plat_policy.conf - A combination of the private and public platform policy
# which will ship with the device. The platform will always reflect the most
# recent platform version and is not currently being attributized.
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
policy_files := $(call build_policy, $(sepolicy_build_files), \
$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY))
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
plat_policy.conf := $(intermediates)/plat_policy.conf
$(plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
$(plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Use user policy when checking neverallow rules. When building userdebug or eng builds, we still want to build the user policy when checking neverallow rules so that we can catch compile errors. Commit c0713e86 split out a helper function but lost one instance of using user instead of the real variant. This restores that one and adds it to the neverallow check. Bug: 74344625 Test: Added a rule that referred to a type defined only in userdebug and eng and ensure we throw a compile error when building userdebug mode. Change-Id: I1a6ffbb36dbeeb880852f9cbac880f923370c2ae (cherry picked from commit 053cb34130b763d93e2181062ebe1b5f8bf3ad9c)
2018-03-08 00:36:29 +01:00
$(plat_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
Switch recovery to versioned policy and split into components. And do some clean up: Replace LOCAL_TARGET_ARCH with global arch specifier that won't get clobbered, clean up sepolicy.recovery's eng specification, ensure that build macros are applied across all policy generation, not just plat_policy, and make sure that all private variables are cleared and alphabetized at the end. Bug: 31363362 Bug: 31369363 Test: Boot into recovery and observe no selinux denials. Change-Id: Ibc15b097f6d19acf01f6b22bee0e083b15f4ef75
2016-12-16 00:28:44 +01:00
$(plat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
Grant additional permissions for ASAN builds ASAN builds may require additional permissions to launch processes with ASAN wrappers. In this case, system_server needs permission to execute /system/bin/sh. Create with_asan() macro which can be used exclusively on debug builds. Note this means that ASAN builds with these additional permission will not pass the security portion of CTS - like any other debug build. Addresses: avc: denied { execute } for name="sh" dev="dm-0" ino=571 scontext=u:r:system_server:s0 tcontext=u:object_r:shell_exec:s0 tclass=file Test: lunch aosp_marlin-userdebug; cd system/sepolicy; mm SANITIZE_TARGET=address; Verify permissions granted using with_asan() are granted. Test: lunch aosp_marlin-userdebug; cd system/sepolicy; mm; Verify permissions granted using with_asan() are not granted. Test: lunch aosp_marlin-user; cd system/sepolicy; mm SANITIZE_TARGET=address; Verify permissions granted using with_asan() are not granted. Bug: 36138508 Change-Id: I6e39ada4bacd71687a593023f16b45bc16cd7ef8
2017-03-13 20:22:15 +01:00
$(plat_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
In native coverage builds, allow all domains to access /data/misc/trace Bug: http://b/135139675 Coverage files are written to /data/misc/trace (governed by the method_trace_data_file selinux type). Allow all domains to access (create directories, access files) this directory when native coverage is enabled (by setting NATIVE_COVERAGE to true) in an userdebug or eng build. Also relax neverallow constraints to allow access to method_trace_data_file for native coverage builds. Test: Build 32-bit cuttlefish with coverage: m NATIVE_COVERAGE=true COVERAGE_PATHS="*" and verify that there are no selinux denials in kernel log and logcat. Change-Id: I3fe7c77612854b9de7de7a0ddd5cbf44a2f5c21e
2019-06-14 00:05:15 +02:00
$(plat_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
$(plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Use PRODUCT_SEPOLICY_SPLIT for full Treble. PRODUCT_FULL_TREBLE is being broken up into smaller, more manageable components. Bug: 62019611 Test: manual Change-Id: I9b65f120851d9ea134a0059a417f0282777717fc
2017-11-09 20:24:56 +01:00
$(plat_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
$(plat_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
Add BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW A new sysprop neverallow rules are mandatory only for devices launching with R or later. For devices already launched, neverallow rules can be relaxed with adding following line to BoardConfig.mk: BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true Bug: 131162102 Test: Set PRODUCT_SHIPPING_API_LEVEL := 30 and try building with changing some system_public_prop to system_internal_prop Test: m cts sepolicy_tests Change-Id: Id978b4d81a8683a57304bb639961105e2d91fa9a Merged-In: Id978b4d81a8683a57304bb639961105e2d91fa9a (cherry picked from commit 3be11e7abb8f4fd651295f9ccb0ce087855c1cc0)
2019-09-26 08:14:55 +02:00
$(plat_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow)
Enforce sysprop owner Every property should have an appropriate owner attribute, which can be one of: system_property_type, product_property_type, or vendor_property_type. This will be enforced for devices launching with S or later. Devices launching with R or eariler can relax this by setting following under BoardConfig.mk: BUILD_BROKEN_ENFORCE_SYSPROP_OWNER := true Bug: 131162102 Test: system/sepolicy/tools/build_policies.sh Change-Id: I7914ef1b7463c9ec00812b9720094531fd63f0c7
2020-09-28 06:32:43 +02:00
$(plat_policy.conf): PRIVATE_ENFORCE_SYSPROP_OWNER := $(enforce_sysprop_owner)
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
$(plat_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
$(plat_policy.conf): $(policy_files) $(M4)
Add sepolicy definitions.mk and create policy.conf function. Bug: 36899958 Test: Builds 'n' boots. Change-Id: I5836a18f9d0a9a976dda7304045e3b9e1e84565e Merged-In: I5836a18f9d0a9a976dda7304045e3b9e1e84565e (cherry picked from commit c0713e86790583dacbd8545d35ae476ff1f849bb)
2017-07-07 23:59:51 +02:00
$(transform-policy-to-conf)
Fix building error for multi-line dontaudit statement All the *.conf.dontaudit files are generated from *.conf with the command of 'sed '/dontaudit/d' $@ > $@.dontaudit', but this command can not be applied to multi-line dontaudit statement. Test: Set plat_policy.conf.dontaudit as the input_file parameter of checkpolicy tool, then selinux syntax error will occur during building. Change-Id: I281de923d8a5f0b46256ec7de4df12a1c1d7e061
2018-09-13 08:04:19 +02:00
$(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
Retain neverallow rules in CIL files Fixes issue where attributes used exlusively in neverallow rules were removed from policy. For on-device compile use the -N flag to skip neverallow tests. Policy size increases: vendor/etc/selinux/nonplat_sepolicy.cil 547849 -> 635637 vendor/etc/selinux/precompiled_sepolicy 440248 -> 441076 system/etc/selinux/plat_sepolicy.cil 567664 -> 745230 For a total increase in system/vendor: 266182. Boot time changes: Pixel uses precompiled policy so boot time is not impacted. When forcing on-device compile on Marlin selinux policy compile time increases 510-520 ms -> 550-560 ms. Bug: 37357742 Test: Build and boot Marlin. Test: Verify both precompiled and on-device compile work. Change-Id: Ib3cb53d376a96e34f55ac27d651a6ce2fabf6ba7
2017-04-22 00:57:07 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_ADDITIONAL_CIL_FILES := \
Mark all clients of Allocator HAL This change associates all domains which are clients of Allocator HAL with hal_allocator_client and the, required for all HAL client domains, halclientdomain. This enables this commit to remove the now unnecessary hwallocator_use macro because its binder_call(..., hal_allocator_server) is covered by binder_call(hal_allocator_client, hal_allocator_server) added in this commit. Unfortunately apps, except isolated app, are clients of Allocator HAL as well. This makes it hard to use the hal_client_domain(..., hal_allocator) macro because it translates into "typeattribute" which currently does not support being provided with a set of types, such as { appdomain -isolated_app }. As a workaround, hopefully until typeattribute is improved, this commit expresses the necessary association operation in CIL. private/technical_debt.cil introduced by this commit is appended into the platform policy CIL file, thus ensuring that the hack has effect on the final monolithic policy. P. S. This change also removes Allocator HAL access from isolated_app. Isolated app shouldn't have access to this HAL anyway. Test: Google Play Music plays back radios Test: Google Camera records video with sound and that video is then successfully played back with sound Test: YouTube app plays back clips with sound Test: YouTube in Chrome plays back clips with sound Bug: 34170079 Change-Id: Id00bba6fde83e7cf04fb58bc1c353c2f66333f92
2017-03-21 22:28:53 +01:00
$(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY))
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
Retain neverallow rules in CIL files Fixes issue where attributes used exlusively in neverallow rules were removed from policy. For on-device compile use the -N flag to skip neverallow tests. Policy size increases: vendor/etc/selinux/nonplat_sepolicy.cil 547849 -> 635637 vendor/etc/selinux/precompiled_sepolicy 440248 -> 441076 system/etc/selinux/plat_sepolicy.cil 567664 -> 745230 For a total increase in system/vendor: 266182. Boot time changes: Pixel uses precompiled policy so boot time is not impacted. When forcing on-device compile on Marlin selinux policy compile time increases 510-520 ms -> 550-560 ms. Bug: 37357742 Test: Build and boot Marlin. Test: Verify both precompiled and on-device compile work. Change-Id: Ib3cb53d376a96e34f55ac27d651a6ce2fabf6ba7
2017-04-22 00:57:07 +02:00
$(LOCAL_BUILT_MODULE): $(plat_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
$(HOST_OUT_EXECUTABLES)/secilc \
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
$(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY)) \
$(built_sepolicy_neverallows)
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
@mkdir -p $(dir $@)
Sepolicy: Disable leak sanitizer for checkpolicy Temporary workaround. Bug: 37755687 Test: ASAN_OPTIONS= SANITIZE_HOST=address m Change-Id: I001a42ea6463a1e137e1f5328755596f986323de
2017-04-28 02:16:13 +02:00
$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \
use tmpfile during build During the build process, use a temporary file until we've determined that every step of the build process has completed. Failure to do this may cause subsequent invocations of the make command to improperly assume that this step ran to completion when it didn't. Test: code compiles. Change-Id: I9a28e653e33b61446a87278975789376769bcc6a
2018-11-26 23:29:06 +01:00
$(POLICYVERS) -o $@.tmp $<
$(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@.tmp
$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $@.tmp -o /dev/null -f /dev/null
$(hide) mv $@.tmp $@
Test CIL policy when building it Prior to this commit, there was a bug in generated CIL where it wouldn't compile using secilc. The reason was that the build script was stripping out all lines containing "neverallow" from CIL files, accidentally removing lines which were not neverallow statements, such as lmx lines referencing app_neverallows.te. The commit fixes the build script's CIL neverallow filter to filter out only neverallow* statements, as originally intended. Moreover, to catch non-compiling CIL policy earlier in the future, this commit runs secilc on the policy at build time. In particular, it tests that platform policy compiles on its own and that nonplatform + platform + mappig policy compiles as well. Test: CIL policy builds and compiles on-device using secilc Bug: 31363362 Change-Id: I769aeb3d8c913a5599f1a2195c69460ece7f6465
2017-02-25 23:47:53 +01:00
built_plat_cil := $(LOCAL_BUILT_MODULE)
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
plat_policy.conf :=
#################################
include $(CLEAR_VARS)
Adding userdebug_plat_sepolicy.cil The userdebug sepolicy will be installed into debug ramdisk. When the ramdisk is used, the device must be unlocked and init will load this userdebug version of platform sepolicy to allow adb root. Bug: 126493225 Test: 'make' and checks that the userdebug sepolicy is in debug ramdisk Change-Id: I9df514054a86d63449b3ebfd1afdee2aee649418
2019-04-19 16:03:33 +02:00
LOCAL_MODULE := userdebug_plat_sepolicy.cil
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_DEBUG_RAMDISK_OUT)
include $(BUILD_SYSTEM)/base_rules.mk
# userdebug_plat_policy.conf - the userdebug version plat_sepolicy.cil
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
policy_files := $(call build_policy, $(sepolicy_build_files), \
$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY))
Adding userdebug_plat_sepolicy.cil The userdebug sepolicy will be installed into debug ramdisk. When the ramdisk is used, the device must be unlocked and init will load this userdebug version of platform sepolicy to allow adb root. Bug: 126493225 Test: 'make' and checks that the userdebug sepolicy is in debug ramdisk Change-Id: I9df514054a86d63449b3ebfd1afdee2aee649418
2019-04-19 16:03:33 +02:00
userdebug_plat_policy.conf := $(intermediates)/userdebug_plat_policy.conf
$(userdebug_plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
$(userdebug_plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
$(userdebug_plat_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := userdebug
$(userdebug_plat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
$(userdebug_plat_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
In native coverage builds, allow all domains to access /data/misc/trace Bug: http://b/135139675 Coverage files are written to /data/misc/trace (governed by the method_trace_data_file selinux type). Allow all domains to access (create directories, access files) this directory when native coverage is enabled (by setting NATIVE_COVERAGE to true) in an userdebug or eng build. Also relax neverallow constraints to allow access to method_trace_data_file for native coverage builds. Test: Build 32-bit cuttlefish with coverage: m NATIVE_COVERAGE=true COVERAGE_PATHS="*" and verify that there are no selinux denials in kernel log and logcat. Change-Id: I3fe7c77612854b9de7de7a0ddd5cbf44a2f5c21e
2019-06-14 00:05:15 +02:00
$(userdebug_plat_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
Adding userdebug_plat_sepolicy.cil The userdebug sepolicy will be installed into debug ramdisk. When the ramdisk is used, the device must be unlocked and init will load this userdebug version of platform sepolicy to allow adb root. Bug: 126493225 Test: 'make' and checks that the userdebug sepolicy is in debug ramdisk Change-Id: I9df514054a86d63449b3ebfd1afdee2aee649418
2019-04-19 16:03:33 +02:00
$(userdebug_plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(userdebug_plat_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
$(userdebug_plat_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
Add BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW A new sysprop neverallow rules are mandatory only for devices launching with R or later. For devices already launched, neverallow rules can be relaxed with adding following line to BoardConfig.mk: BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true Bug: 131162102 Test: Set PRODUCT_SHIPPING_API_LEVEL := 30 and try building with changing some system_public_prop to system_internal_prop Test: m cts sepolicy_tests Change-Id: Id978b4d81a8683a57304bb639961105e2d91fa9a Merged-In: Id978b4d81a8683a57304bb639961105e2d91fa9a (cherry picked from commit 3be11e7abb8f4fd651295f9ccb0ce087855c1cc0)
2019-09-26 08:14:55 +02:00
$(userdebug_plat_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow)
Enforce sysprop owner Every property should have an appropriate owner attribute, which can be one of: system_property_type, product_property_type, or vendor_property_type. This will be enforced for devices launching with S or later. Devices launching with R or eariler can relax this by setting following under BoardConfig.mk: BUILD_BROKEN_ENFORCE_SYSPROP_OWNER := true Bug: 131162102 Test: system/sepolicy/tools/build_policies.sh Change-Id: I7914ef1b7463c9ec00812b9720094531fd63f0c7
2020-09-28 06:32:43 +02:00
$(userdebug_plat_policy.conf): PRIVATE_ENFORCE_SYSPROP_OWNER := $(enforce_sysprop_owner)
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
$(userdebug_plat_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
$(userdebug_plat_policy.conf): $(policy_files) $(M4)
Adding userdebug_plat_sepolicy.cil The userdebug sepolicy will be installed into debug ramdisk. When the ramdisk is used, the device must be unlocked and init will load this userdebug version of platform sepolicy to allow adb root. Bug: 126493225 Test: 'make' and checks that the userdebug sepolicy is in debug ramdisk Change-Id: I9df514054a86d63449b3ebfd1afdee2aee649418
2019-04-19 16:03:33 +02:00
$(transform-policy-to-conf)
$(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
$(LOCAL_BUILT_MODULE): PRIVATE_ADDITIONAL_CIL_FILES := \
$(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY))
$(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
$(LOCAL_BUILT_MODULE): $(userdebug_plat_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
$(HOST_OUT_EXECUTABLES)/secilc \
$(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY)) \
$(built_sepolicy_neverallows)
@mkdir -p $(dir $@)
$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \
$(POLICYVERS) -o $@.tmp $<
$(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@.tmp
$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $@.tmp -o /dev/null -f /dev/null
$(hide) mv $@.tmp $@
userdebug_plat_policy.conf :=
#################################
include $(CLEAR_VARS)
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
ifdef HAS_SYSTEM_EXT_SEPOLICY
LOCAL_MODULE := system_ext_sepolicy.cil
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_OUT_SYSTEM_EXT)/etc/selinux
include $(BUILD_SYSTEM)/base_rules.mk
# system_ext_policy.conf - A combination of the private and public system_ext policy
# which will ship with the device. System_ext policy is not attributized.
policy_files := $(call build_policy, $(sepolicy_build_files), \
$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) \
$(SYSTEM_EXT_PUBLIC_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY))
system_ext_policy.conf := $(intermediates)/system_ext_policy.conf
$(system_ext_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
$(system_ext_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
$(system_ext_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
$(system_ext_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
$(system_ext_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
$(system_ext_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
$(system_ext_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(system_ext_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
$(system_ext_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
Fix treble sysprop neverallow rules on system_ext Bug: 131162102 Bug: 142684203 Test: m sepolicy_tests Change-Id: Ib21adee404a1ee7d57bc9ff54f3ae1831cdf3b81
2019-10-16 04:46:50 +02:00
$(system_ext_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow)
Enforce sysprop owner Every property should have an appropriate owner attribute, which can be one of: system_property_type, product_property_type, or vendor_property_type. This will be enforced for devices launching with S or later. Devices launching with R or eariler can relax this by setting following under BoardConfig.mk: BUILD_BROKEN_ENFORCE_SYSPROP_OWNER := true Bug: 131162102 Test: system/sepolicy/tools/build_policies.sh Change-Id: I7914ef1b7463c9ec00812b9720094531fd63f0c7
2020-09-28 06:32:43 +02:00
$(system_ext_policy.conf): PRIVATE_ENFORCE_SYSPROP_OWNER := $(enforce_sysprop_owner)
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
$(system_ext_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
$(system_ext_policy.conf): $(policy_files) $(M4)
$(transform-policy-to-conf)
$(hide) sed '/dontaudit/d' $@ > $@.dontaudit
$(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
$(LOCAL_BUILT_MODULE): PRIVATE_PLAT_CIL := $(built_plat_cil)
$(LOCAL_BUILT_MODULE): $(system_ext_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
$(HOST_OUT_EXECUTABLES)/build_sepolicy $(HOST_OUT_EXECUTABLES)/secilc $(built_plat_cil)
@mkdir -p $(dir $@)
$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \
$(POLICYVERS) -o $@ $<
$(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) filter_out \
-f $(PRIVATE_PLAT_CIL) -t $@
# Line markers (denoted by ;;) are malformed after above cmd. They are only
# used for debugging, so we remove them.
$(hide) grep -v ';;' $@ > $@.tmp
$(hide) mv $@.tmp $@
# Combine plat_sepolicy.cil and system_ext_sepolicy.cil to make sure that the
# latter doesn't accidentally depend on vendor/odm policies.
$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) \
$(PRIVATE_NEVERALLOW_ARG) $(PRIVATE_PLAT_CIL) $@ -o /dev/null -f /dev/null
built_system_ext_cil := $(LOCAL_BUILT_MODULE)
system_ext_policy.conf :=
endif # ifdef HAS_SYSTEM_EXT_SEPOLICY
#################################
include $(CLEAR_VARS)
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
ifdef HAS_PRODUCT_SEPOLICY
LOCAL_MODULE := product_sepolicy.cil
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_OUT_PRODUCT)/etc/selinux
include $(BUILD_SYSTEM)/base_rules.mk
# product_policy.conf - A combination of the private and public product policy
# which will ship with the device. Product policy is not attributized.
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
policy_files := $(call build_policy, $(sepolicy_build_files), \
$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) \
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
$(SYSTEM_EXT_PUBLIC_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY) \
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
$(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY))
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
product_policy.conf := $(intermediates)/product_policy.conf
$(product_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
$(product_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
$(product_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
$(product_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
$(product_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
In native coverage builds, allow all domains to access /data/misc/trace Bug: http://b/135139675 Coverage files are written to /data/misc/trace (governed by the method_trace_data_file selinux type). Allow all domains to access (create directories, access files) this directory when native coverage is enabled (by setting NATIVE_COVERAGE to true) in an userdebug or eng build. Also relax neverallow constraints to allow access to method_trace_data_file for native coverage builds. Test: Build 32-bit cuttlefish with coverage: m NATIVE_COVERAGE=true COVERAGE_PATHS="*" and verify that there are no selinux denials in kernel log and logcat. Change-Id: I3fe7c77612854b9de7de7a0ddd5cbf44a2f5c21e
2019-06-14 00:05:15 +02:00
$(product_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
$(product_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(product_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
$(product_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
Add BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW A new sysprop neverallow rules are mandatory only for devices launching with R or later. For devices already launched, neverallow rules can be relaxed with adding following line to BoardConfig.mk: BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true Bug: 131162102 Test: Set PRODUCT_SHIPPING_API_LEVEL := 30 and try building with changing some system_public_prop to system_internal_prop Test: m cts sepolicy_tests Change-Id: Id978b4d81a8683a57304bb639961105e2d91fa9a Merged-In: Id978b4d81a8683a57304bb639961105e2d91fa9a (cherry picked from commit 3be11e7abb8f4fd651295f9ccb0ce087855c1cc0)
2019-09-26 08:14:55 +02:00
$(product_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow)
Enforce sysprop owner Every property should have an appropriate owner attribute, which can be one of: system_property_type, product_property_type, or vendor_property_type. This will be enforced for devices launching with S or later. Devices launching with R or eariler can relax this by setting following under BoardConfig.mk: BUILD_BROKEN_ENFORCE_SYSPROP_OWNER := true Bug: 131162102 Test: system/sepolicy/tools/build_policies.sh Change-Id: I7914ef1b7463c9ec00812b9720094531fd63f0c7
2020-09-28 06:32:43 +02:00
$(product_policy.conf): PRIVATE_ENFORCE_SYSPROP_OWNER := $(enforce_sysprop_owner)
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
$(product_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
$(product_policy.conf): $(policy_files) $(M4)
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
$(transform-policy-to-conf)
$(hide) sed '/dontaudit/d' $@ > $@.dontaudit
$(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_PLAT_CIL_FILES := $(built_plat_cil) $(built_system_ext_cil)
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
$(LOCAL_BUILT_MODULE): $(product_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
$(HOST_OUT_EXECUTABLES)/build_sepolicy $(HOST_OUT_EXECUTABLES)/secilc \
$(built_plat_cil) $(built_system_ext_cil)
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
@mkdir -p $(dir $@)
$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \
$(POLICYVERS) -o $@ $<
$(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) filter_out \
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
-f $(PRIVATE_PLAT_CIL_FILES) -t $@
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
# Line markers (denoted by ;;) are malformed after above cmd. They are only
# used for debugging, so we remove them.
sepolicy: fix mac build sed "-i" flag on Mac has different syntax than on Linux. Replace use of sed with grep. A simple fix like this should suffice for this case, but ideally, we should maintain our own utils instead of using tools on the host machine. Fixes: 121235932 Test: m selinux_policy Change-Id: I46c3bdb90bf7de48d2c942b15a65ce82ae3041c5
2018-12-19 21:22:05 +01:00
$(hide) grep -v ';;' $@ > $@.tmp
$(hide) mv $@.tmp $@
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
# Combine plat_sepolicy.cil, system_ext_sepolicy.cil and product_sepolicy.cil to
# make sure that the latter doesn't accidentally depend on vendor/odm policies.
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) \
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
$(PRIVATE_NEVERALLOW_ARG) $(PRIVATE_PLAT_CIL_FILES) $@ -o /dev/null -f /dev/null
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
built_product_cil := $(LOCAL_BUILT_MODULE)
product_policy.conf :=
endif # ifdef HAS_PRODUCT_SEPOLICY
#################################
include $(CLEAR_VARS)
Change mapping file name to reflect its platform version. As the platform progresses in the split SELinux world, the platform will need to maintain mapping files back to previous platform versions to maintain backwards compatibility with vendor images which have SELinux policy written based on the older versions. This requires shipping multiple mapping files with the system image so that the right one can be selected. Change the name and location of the mapping file to reflect this. Also add a file to the vendor partition indicating which version is being targeted that the platform can use to determine which mapping file to choose. Bug: 36783775 Test: Force compilation of sepolicy on-device with mapping file changed to new location and name, using the value reported on /vendor. Change-Id: I93ab3e52c2c80c493719dc3825bc731867ea76d4
2017-04-10 21:27:18 +02:00
LOCAL_MODULE := plat_sepolicy_vers.txt
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
Change mapping file name to reflect its platform version. As the platform progresses in the split SELinux world, the platform will need to maintain mapping files back to previous platform versions to maintain backwards compatibility with vendor images which have SELinux policy written based on the older versions. This requires shipping multiple mapping files with the system image so that the right one can be selected. Change the name and location of the mapping file to reflect this. Also add a file to the vendor partition indicating which version is being targeted that the platform can use to determine which mapping file to choose. Bug: 36783775 Test: Force compilation of sepolicy on-device with mapping file changed to new location and name, using the value reported on /vendor. Change-Id: I93ab3e52c2c80c493719dc3825bc731867ea76d4
2017-04-10 21:27:18 +02:00
LOCAL_PROPRIETARY_MODULE := true
LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
include $(BUILD_SYSTEM)/base_rules.mk
$(LOCAL_BUILT_MODULE) : PRIVATE_PLAT_SEPOL_VERS := $(BOARD_SEPOLICY_VERS)
$(LOCAL_BUILT_MODULE) :
mkdir -p $(dir $@)
echo $(PRIVATE_PLAT_SEPOL_VERS) > $@
#################################
include $(CLEAR_VARS)
Split mapping file into system and product parts Both mapping files need to be included when building sepolicy at boot time. Bug: 119305624 Test: boot taimen Test: "cnd" type is declared in /vendor; "dataservice_app" type is declared in /product. This permission is preserved "allow cnd dataservice_app:binder { transfer call };" Change-Id: I138f34208ea05e170defd2b4ef4700ffa81f9573
2019-01-16 00:16:55 +01:00
LOCAL_MODULE := plat_mapping_file
LOCAL_MODULE_STEM := $(PLATFORM_SEPOLICY_VERSION).cil
Change mapping file name to reflect its platform version. As the platform progresses in the split SELinux world, the platform will need to maintain mapping files back to previous platform versions to maintain backwards compatibility with vendor images which have SELinux policy written based on the older versions. This requires shipping multiple mapping files with the system image so that the right one can be selected. Change the name and location of the mapping file to reflect this. Also add a file to the vendor partition indicating which version is being targeted that the platform can use to determine which mapping file to choose. Bug: 36783775 Test: Force compilation of sepolicy on-device with mapping file changed to new location and name, using the value reported on /vendor. Change-Id: I93ab3e52c2c80c493719dc3825bc731867ea76d4
2017-04-10 21:27:18 +02:00
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux/mapping
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
include $(BUILD_SYSTEM)/base_rules.mk
# auto-generate the mapping file for current platform policy, since it needs to
# track platform policy development
Remove obsolete mapping build rules. Mapping files for previous releases are unconditionally packaged on the device. No need to account for case when BOARD_SEPOLICY_VERS and PLATFORM_SEPOLICY_VERSION are different. Bug: 119305624 Test: m selinux_policy Change-Id: I36c3c43f96870d9a71adf91c8fb8926587c5a50e
2019-01-15 02:25:17 +01:00
$(LOCAL_BUILT_MODULE) : PRIVATE_VERS := $(PLATFORM_SEPOLICY_VERSION)
Split mapping file into system and product parts Both mapping files need to be included when building sepolicy at boot time. Bug: 119305624 Test: boot taimen Test: "cnd" type is declared in /vendor; "dataservice_app" type is declared in /product. This permission is preserved "allow cnd dataservice_app:binder { transfer call };" Change-Id: I138f34208ea05e170defd2b4ef4700ffa81f9573
2019-01-16 00:16:55 +01:00
$(LOCAL_BUILT_MODULE) : $(plat_pub_policy.cil) $(HOST_OUT_EXECUTABLES)/version_policy
@mkdir -p $(dir $@)
$(hide) $(HOST_OUT_EXECUTABLES)/version_policy -b $< -m -n $(PRIVATE_VERS) -o $@
built_plat_mapping_cil := $(LOCAL_BUILT_MODULE)
#################################
include $(CLEAR_VARS)
Allowing system_ext sepolicy to be empty Some targets just need to extend system_ext context files, e.g., file_contexts, service_contexts, etc., without adding any system_ext policy files, e.g., *.te files. Currently, this will lead to build errors. This CL allows system_ext_sepolicy.cil and the system_ext mapping file to be empty. It's now also possible to just set BOARD_PLAT_PRIVATE_SEPOLICY_DIR without setting BOARD_PLAT_PUBLIC_SEPOLICY_DIR. Bug: 137712473 Bug: 141880898 Test: Only adds system_ext context files without policy files (e.g., *.te), then `mmma system/sepolicy` can build pass Change-Id: I72849f2d4aa43e5296cd15c07a8fd058186a6376
2019-10-04 08:34:18 +02:00
ifdef HAS_SYSTEM_EXT_PUBLIC_SEPOLICY
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
LOCAL_MODULE := system_ext_mapping_file
LOCAL_MODULE_STEM := $(PLATFORM_SEPOLICY_VERSION).cil
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_OUT_SYSTEM_EXT)/etc/selinux/mapping
include $(BUILD_SYSTEM)/base_rules.mk
$(LOCAL_BUILT_MODULE) : PRIVATE_VERS := $(PLATFORM_SEPOLICY_VERSION)
$(LOCAL_BUILT_MODULE) : PRIVATE_PLAT_MAPPING_CIL := $(built_plat_mapping_cil)
$(LOCAL_BUILT_MODULE) : $(system_ext_pub_policy.cil) $(HOST_OUT_EXECUTABLES)/version_policy \
$(built_plat_mapping_cil)
@mkdir -p $(dir $@)
# Generate system_ext mapping file as mapping file of 'system' (plat) and 'system_ext'
# sepolicy minus plat_mapping_file.
$(hide) $(HOST_OUT_EXECUTABLES)/version_policy -b $< -m -n $(PRIVATE_VERS) -o $@
$(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) filter_out \
-f $(PRIVATE_PLAT_MAPPING_CIL) -t $@
built_system_ext_mapping_cil := $(LOCAL_BUILT_MODULE)
Allowing system_ext sepolicy to be empty Some targets just need to extend system_ext context files, e.g., file_contexts, service_contexts, etc., without adding any system_ext policy files, e.g., *.te files. Currently, this will lead to build errors. This CL allows system_ext_sepolicy.cil and the system_ext mapping file to be empty. It's now also possible to just set BOARD_PLAT_PRIVATE_SEPOLICY_DIR without setting BOARD_PLAT_PUBLIC_SEPOLICY_DIR. Bug: 137712473 Bug: 141880898 Test: Only adds system_ext context files without policy files (e.g., *.te), then `mmma system/sepolicy` can build pass Change-Id: I72849f2d4aa43e5296cd15c07a8fd058186a6376
2019-10-04 08:34:18 +02:00
endif # ifdef HAS_SYSTEM_EXT_PUBLIC_SEPOLICY
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
#################################
include $(CLEAR_VARS)
Allowing product sepolicy to be empty Some targets just need to extend product context files, e.g., file_contexts, service_contexts, etc., without adding any product-specific policy files, e.g., *.te files. Or just need to add private product sepolicy without adding public product sepolicy. Currently, this will lead to build errors. This CL allows product_sepolicy.cil and the product mapping file to be empty. It's now also possible to just set PRODUCT_PRIVATE_POLICY without setting PRODUCT_PUBLIC_POLICY. Bug: 131193755 Test: Only adds product private sepolicy, then `mmma system/sepolicy` Change-Id: Ifed5af7413b2a1e20a0628518582615708c8c31a
2019-10-04 09:36:05 +02:00
ifdef HAS_PRODUCT_PUBLIC_SEPOLICY
Split mapping file into system and product parts Both mapping files need to be included when building sepolicy at boot time. Bug: 119305624 Test: boot taimen Test: "cnd" type is declared in /vendor; "dataservice_app" type is declared in /product. This permission is preserved "allow cnd dataservice_app:binder { transfer call };" Change-Id: I138f34208ea05e170defd2b4ef4700ffa81f9573
2019-01-16 00:16:55 +01:00
LOCAL_MODULE := product_mapping_file
LOCAL_MODULE_STEM := $(PLATFORM_SEPOLICY_VERSION).cil
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_OUT_PRODUCT)/etc/selinux/mapping
include $(BUILD_SYSTEM)/base_rules.mk
$(LOCAL_BUILT_MODULE) : PRIVATE_VERS := $(PLATFORM_SEPOLICY_VERSION)
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
$(LOCAL_BUILT_MODULE) : PRIVATE_FILTER_CIL_FILES := $(built_plat_mapping_cil) $(built_system_ext_mapping_cil)
Split mapping file into system and product parts Both mapping files need to be included when building sepolicy at boot time. Bug: 119305624 Test: boot taimen Test: "cnd" type is declared in /vendor; "dataservice_app" type is declared in /product. This permission is preserved "allow cnd dataservice_app:binder { transfer call };" Change-Id: I138f34208ea05e170defd2b4ef4700ffa81f9573
2019-01-16 00:16:55 +01:00
$(LOCAL_BUILT_MODULE) : $(pub_policy.cil) $(HOST_OUT_EXECUTABLES)/version_policy \
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
$(built_plat_mapping_cil) $(built_system_ext_mapping_cil)
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
@mkdir -p $(dir $@)
Split mapping file into system and product parts Both mapping files need to be included when building sepolicy at boot time. Bug: 119305624 Test: boot taimen Test: "cnd" type is declared in /vendor; "dataservice_app" type is declared in /product. This permission is preserved "allow cnd dataservice_app:binder { transfer call };" Change-Id: I138f34208ea05e170defd2b4ef4700ffa81f9573
2019-01-16 00:16:55 +01:00
# Generate product mapping file as mapping file of all public sepolicy minus
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
# plat_mapping_file and system_ext_mapping_file.
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
$(hide) $(HOST_OUT_EXECUTABLES)/version_policy -b $< -m -n $(PRIVATE_VERS) -o $@
Split mapping file into system and product parts Both mapping files need to be included when building sepolicy at boot time. Bug: 119305624 Test: boot taimen Test: "cnd" type is declared in /vendor; "dataservice_app" type is declared in /product. This permission is preserved "allow cnd dataservice_app:binder { transfer call };" Change-Id: I138f34208ea05e170defd2b4ef4700ffa81f9573
2019-01-16 00:16:55 +01:00
$(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) filter_out \
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
-f $(PRIVATE_FILTER_CIL_FILES) -t $@
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
Split mapping file into system and product parts Both mapping files need to be included when building sepolicy at boot time. Bug: 119305624 Test: boot taimen Test: "cnd" type is declared in /vendor; "dataservice_app" type is declared in /product. This permission is preserved "allow cnd dataservice_app:binder { transfer call };" Change-Id: I138f34208ea05e170defd2b4ef4700ffa81f9573
2019-01-16 00:16:55 +01:00
built_product_mapping_cil := $(LOCAL_BUILT_MODULE)
Allowing product sepolicy to be empty Some targets just need to extend product context files, e.g., file_contexts, service_contexts, etc., without adding any product-specific policy files, e.g., *.te files. Or just need to add private product sepolicy without adding public product sepolicy. Currently, this will lead to build errors. This CL allows product_sepolicy.cil and the product mapping file to be empty. It's now also possible to just set PRODUCT_PRIVATE_POLICY without setting PRODUCT_PUBLIC_POLICY. Bug: 131193755 Test: Only adds product private sepolicy, then `mmma system/sepolicy` Change-Id: Ifed5af7413b2a1e20a0628518582615708c8c31a
2019-10-04 09:36:05 +02:00
endif # ifdef HAS_PRODUCT_PUBLIC_SEPOLICY
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
#################################
include $(CLEAR_VARS)
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
# plat_pub_versioned.cil - the exported platform policy associated with the version
# that non-platform policy targets.
LOCAL_MODULE := plat_pub_versioned.cil
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
Move split sepolicy to correct locations This moves the CIL files comprising the split sepolicy to the directories/partitions based on whether the file is part of platform/system or non-platform/vendor. In particular: * plat_sepolicy.cil is moved to /system/etc/selinux, * nonplat_sepolicy.cil is moved to /vendor/etc/selinux, and * mapping_sepolicy.cil is moved to /vendor/etc/selinux. Test: Device boots, no additional denials. The test is performed both for a device without the CIL files and with the three CIL files. Bug: 31363362 Change-Id: Ia760d7eb32c80ba72f6409da75d99eb5aae71cd9
2017-03-02 21:39:25 +01:00
LOCAL_PROPRIETARY_MODULE := true
LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
include $(BUILD_SYSTEM)/base_rules.mk
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
$(LOCAL_BUILT_MODULE) : PRIVATE_VERS := $(BOARD_SEPOLICY_VERS)
Rename plat_pub_policy -> pub_policy Public policy that is available to vendor (and odm) sepolicy is a combination of system and product public sepolicy. Since "plat_" prefix implies a pure system sepolicy component, drop "plat_" prefix from "plat_pub_policy" to be consistent with naming in this file. Bug: 119305624 Test: m selinux_policy Change-Id: Iaf094702556ce97371fa1c58c01d707103d7f7d6
2019-01-15 22:31:03 +01:00
$(LOCAL_BUILT_MODULE) : PRIVATE_TGT_POL := $(pub_policy.cil)
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
$(LOCAL_BUILT_MODULE) : PRIVATE_DEP_CIL_FILES := $(built_plat_cil) $(built_system_ext_cil) \
$(built_product_cil) $(built_plat_mapping_cil) $(built_system_ext_mapping_cil) \
$(built_product_mapping_cil)
Rename plat_pub_policy -> pub_policy Public policy that is available to vendor (and odm) sepolicy is a combination of system and product public sepolicy. Since "plat_" prefix implies a pure system sepolicy component, drop "plat_" prefix from "plat_pub_policy" to be consistent with naming in this file. Bug: 119305624 Test: m selinux_policy Change-Id: Iaf094702556ce97371fa1c58c01d707103d7f7d6
2019-01-15 22:31:03 +01:00
$(LOCAL_BUILT_MODULE) : $(pub_policy.cil) $(HOST_OUT_EXECUTABLES)/version_policy \
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
$(HOST_OUT_EXECUTABLES)/secilc $(built_plat_cil) $(built_system_ext_cil) $(built_product_cil) \
$(built_plat_mapping_cil) $(built_system_ext_mapping_cil) $(built_product_mapping_cil)
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
@mkdir -p $(dir $@)
$(HOST_OUT_EXECUTABLES)/version_policy -b $< -t $(PRIVATE_TGT_POL) -n $(PRIVATE_VERS) -o $@
$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -N -c $(POLICYVERS) \
$(PRIVATE_DEP_CIL_FILES) $@ -o /dev/null -f /dev/null
Rename plat_pub_policy -> pub_policy Public policy that is available to vendor (and odm) sepolicy is a combination of system and product public sepolicy. Since "plat_" prefix implies a pure system sepolicy component, drop "plat_" prefix from "plat_pub_policy" to be consistent with naming in this file. Bug: 119305624 Test: m selinux_policy Change-Id: Iaf094702556ce97371fa1c58c01d707103d7f7d6
2019-01-15 22:31:03 +01:00
built_pub_vers_cil := $(LOCAL_BUILT_MODULE)
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
#################################
include $(CLEAR_VARS)
# vendor_policy.cil - the vendor sepolicy. This needs attributization and to be combined
# with the platform-provided policy. It makes use of the reqd_policy_mask files from private
# policy and the platform public policy files in order to use checkpolicy.
LOCAL_MODULE := vendor_sepolicy.cil
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_PROPRIETARY_MODULE := true
LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
include $(BUILD_SYSTEM)/base_rules.mk
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
policy_files := $(call build_policy, $(sepolicy_build_files), \
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
$(PLAT_PUBLIC_POLICY) $(SYSTEM_EXT_PUBLIC_POLICY) $(PRODUCT_PUBLIC_POLICY) \
$(REQD_MASK_POLICY) $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS))
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
vendor_policy.conf := $(intermediates)/vendor_policy.conf
$(vendor_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
$(vendor_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Use user policy when checking neverallow rules. When building userdebug or eng builds, we still want to build the user policy when checking neverallow rules so that we can catch compile errors. Commit c0713e86 split out a helper function but lost one instance of using user instead of the real variant. This restores that one and adds it to the neverallow check. Bug: 74344625 Test: Added a rule that referred to a type defined only in userdebug and eng and ensure we throw a compile error when building userdebug mode. Change-Id: I1a6ffbb36dbeeb880852f9cbac880f923370c2ae (cherry picked from commit 053cb34130b763d93e2181062ebe1b5f8bf3ad9c)
2018-03-08 00:36:29 +01:00
$(vendor_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
$(vendor_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
$(vendor_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
In native coverage builds, allow all domains to access /data/misc/trace Bug: http://b/135139675 Coverage files are written to /data/misc/trace (governed by the method_trace_data_file selinux type). Allow all domains to access (create directories, access files) this directory when native coverage is enabled (by setting NATIVE_COVERAGE to true) in an userdebug or eng build. Also relax neverallow constraints to allow access to method_trace_data_file for native coverage builds. Test: Build 32-bit cuttlefish with coverage: m NATIVE_COVERAGE=true COVERAGE_PATHS="*" and verify that there are no selinux denials in kernel log and logcat. Change-Id: I3fe7c77612854b9de7de7a0ddd5cbf44a2f5c21e
2019-06-14 00:05:15 +02:00
$(vendor_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
$(vendor_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(vendor_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
$(vendor_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
Add BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW A new sysprop neverallow rules are mandatory only for devices launching with R or later. For devices already launched, neverallow rules can be relaxed with adding following line to BoardConfig.mk: BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true Bug: 131162102 Test: Set PRODUCT_SHIPPING_API_LEVEL := 30 and try building with changing some system_public_prop to system_internal_prop Test: m cts sepolicy_tests Change-Id: Id978b4d81a8683a57304bb639961105e2d91fa9a Merged-In: Id978b4d81a8683a57304bb639961105e2d91fa9a (cherry picked from commit 3be11e7abb8f4fd651295f9ccb0ce087855c1cc0)
2019-09-26 08:14:55 +02:00
$(vendor_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow)
Enforce sysprop owner Every property should have an appropriate owner attribute, which can be one of: system_property_type, product_property_type, or vendor_property_type. This will be enforced for devices launching with S or later. Devices launching with R or eariler can relax this by setting following under BoardConfig.mk: BUILD_BROKEN_ENFORCE_SYSPROP_OWNER := true Bug: 131162102 Test: system/sepolicy/tools/build_policies.sh Change-Id: I7914ef1b7463c9ec00812b9720094531fd63f0c7
2020-09-28 06:32:43 +02:00
$(vendor_policy.conf): PRIVATE_ENFORCE_SYSPROP_OWNER := $(enforce_sysprop_owner)
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
$(vendor_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
$(vendor_policy.conf): $(policy_files) $(M4)
Add sepolicy definitions.mk and create policy.conf function. Bug: 36899958 Test: Builds 'n' boots. Change-Id: I5836a18f9d0a9a976dda7304045e3b9e1e84565e Merged-In: I5836a18f9d0a9a976dda7304045e3b9e1e84565e (cherry picked from commit c0713e86790583dacbd8545d35ae476ff1f849bb)
2017-07-07 23:59:51 +02:00
$(transform-policy-to-conf)
Fix building error for multi-line dontaudit statement All the *.conf.dontaudit files are generated from *.conf with the command of 'sed '/dontaudit/d' $@ > $@.dontaudit', but this command can not be applied to multi-line dontaudit statement. Test: Set plat_policy.conf.dontaudit as the input_file parameter of checkpolicy tool, then selinux syntax error will occur during building. Change-Id: I281de923d8a5f0b46256ec7de4df12a1c1d7e061
2018-09-13 08:04:19 +02:00
$(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
Using a python script to build sepolicy Current sepolicy CIL files are built by several command-line tools in Android.mk. This change extracts some of the build logic into a python script to relief the effort in Android.mk. The first command is `build_sepolicy build_cil`. It's possible to add more sub-commands under the build_sepolicy script in the future. Bug: 64240127 Test: build bullhead/taimen Change-Id: Ie0ae4fc5256a550c72954cde5d5dd213a22d159a
2018-02-05 10:41:02 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_POL_CONF := $(vendor_policy.conf)
$(LOCAL_BUILT_MODULE): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil)
Rename plat_pub_policy -> pub_policy Public policy that is available to vendor (and odm) sepolicy is a combination of system and product public sepolicy. Since "plat_" prefix implies a pure system sepolicy component, drop "plat_" prefix from "plat_pub_policy" to be consistent with naming in this file. Bug: 119305624 Test: m selinux_policy Change-Id: Iaf094702556ce97371fa1c58c01d707103d7f7d6
2019-01-15 22:31:03 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_BASE_CIL := $(pub_policy.cil)
Using a python script to build sepolicy Current sepolicy CIL files are built by several command-line tools in Android.mk. This change extracts some of the build logic into a python script to relief the effort in Android.mk. The first command is `build_sepolicy build_cil`. It's possible to add more sub-commands under the build_sepolicy script in the future. Bug: 64240127 Test: build bullhead/taimen Change-Id: Ie0ae4fc5256a550c72954cde5d5dd213a22d159a
2018-02-05 10:41:02 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_VERS := $(BOARD_SEPOLICY_VERS)
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_DEP_CIL_FILES := $(built_plat_cil) $(built_system_ext_cil) \
$(built_product_cil) $(built_pub_vers_cil) $(built_plat_mapping_cil) \
$(built_system_ext_mapping_cil) $(built_product_mapping_cil)
Rename plat_pub_policy -> pub_policy Public policy that is available to vendor (and odm) sepolicy is a combination of system and product public sepolicy. Since "plat_" prefix implies a pure system sepolicy component, drop "plat_" prefix from "plat_pub_policy" to be consistent with naming in this file. Bug: 119305624 Test: m selinux_policy Change-Id: Iaf094702556ce97371fa1c58c01d707103d7f7d6
2019-01-15 22:31:03 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_FILTER_CIL := $(built_pub_vers_cil)
Using a python script to build sepolicy Current sepolicy CIL files are built by several command-line tools in Android.mk. This change extracts some of the build logic into a python script to relief the effort in Android.mk. The first command is `build_sepolicy build_cil`. It's possible to add more sub-commands under the build_sepolicy script in the future. Bug: 64240127 Test: build bullhead/taimen Change-Id: Ie0ae4fc5256a550c72954cde5d5dd213a22d159a
2018-02-05 10:41:02 +01:00
$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/build_sepolicy \
Rename plat_pub_policy -> pub_policy Public policy that is available to vendor (and odm) sepolicy is a combination of system and product public sepolicy. Since "plat_" prefix implies a pure system sepolicy component, drop "plat_" prefix from "plat_pub_policy" to be consistent with naming in this file. Bug: 119305624 Test: m selinux_policy Change-Id: Iaf094702556ce97371fa1c58c01d707103d7f7d6
2019-01-15 22:31:03 +01:00
$(vendor_policy.conf) $(reqd_policy_mask.cil) $(pub_policy.cil) \
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
$(built_plat_cil) $(built_system_ext_cil) $(built_product_cil) \
$(built_pub_vers_cil) $(built_plat_mapping_cil) $(built_system_ext_mapping_cil) \
$(built_product_mapping_cil)
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
@mkdir -p $(dir $@)
Using a python script to build sepolicy Current sepolicy CIL files are built by several command-line tools in Android.mk. This change extracts some of the build logic into a python script to relief the effort in Android.mk. The first command is `build_sepolicy build_cil`. It's possible to add more sub-commands under the build_sepolicy script in the future. Bug: 64240127 Test: build bullhead/taimen Change-Id: Ie0ae4fc5256a550c72954cde5d5dd213a22d159a
2018-02-05 10:41:02 +01:00
$(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) build_cil \
-i $(PRIVATE_POL_CONF) -m $(PRIVATE_REQD_MASK) -c $(CHECKPOLICY_ASAN_OPTIONS) \
-b $(PRIVATE_BASE_CIL) -d $(PRIVATE_DEP_CIL_FILES) -f $(PRIVATE_FILTER_CIL) \
-t $(PRIVATE_VERS) -p $(POLICYVERS) -o $@
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
built_vendor_cil := $(LOCAL_BUILT_MODULE)
vendor_policy.conf :=
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
Precompiled kernel policy for on-device use This adds build targets for outputing precompiled kernel policy usable on devices with policy split between system and vendor partitions. On such devices, precompiled policy must reside on the vendor partition. Because such devices support updating these partitions independently of each other, the precompiled policy must reference the system partition's policy against which it was compiled. This enables init to establish whether the precompiled policy is valid for the current combination of system and vendor partitions. The referencing is performed by both the system and vendor partitions including the SHA-256 digest of the system partition's policy (plat_sepolicy.cil). Only the when the digest is the same on both partitions can the precompiled policy be used. Test: plat_sepolicy.cil.sha256 contains exactly the hex form of the SHA-256 digest of plat_sepolicy.cil Test: plat_sepolicy.cil.sha256 is identical precompiled_sepolicy.plat.sha256. Bug: 31363362 Change-Id: I9771e1aa751e25bba6e2face37d68e0ae43b33a3
2017-03-07 23:05:57 +01:00
#################################
include $(CLEAR_VARS)
Android.mk: conditional compilation of odm_sepolicy.cil Do not attempt to build odm_sepolicy.cil if BOARD_ODM_SEPOLICY_DIRS is not defined. Attempting to do so will create an empty file, which causes build problems when https://github.com/SELinuxProject/selinux/pull/100/commits/0c6ea1e812fbe75aef03ced077d4f4cd26d982fc is applied. Test: "cd system/sepolicy && mma -j55" succeeds Test: "make checkbuild" succeeds Change-Id: Iefc458bddff3d08e5fcb86f8be3cad16d7e36e73
2018-09-25 20:03:48 +02:00
ifdef BOARD_ODM_SEPOLICY_DIRS
Add /odm/etc/selinux/odm_sepolicy.cil This change adds the support of odm sepolicy customization, which can be configured through the newly added build varaible: - BOARD_ODM_SEPOLICY_DIRS += device/${ODM_NAME}/${BOM_NAME}/sepolicy Also moving precompiled sepolicy to /odm when BOARD_ODM_SEPOLICY_DIRS is set. On a DUT, precompiled sepolicy on /odm will override the one in /vendor. This is intentional because /odm is the hardware customization for /vendor and both should be updated together if desired. Bug: 64240127 Test: boot a device with /odm partition Change-Id: Ia8f81a78c88cbfefb3ff19e2ccd2648da6284d09
2017-11-27 04:41:33 +01:00
# odm_policy.cil - the odm sepolicy. This needs attributization and to be combined
# with the platform-provided policy. It makes use of the reqd_policy_mask files from private
# policy and the platform public policy files in order to use checkpolicy.
LOCAL_MODULE := odm_sepolicy.cil
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_PROPRIETARY_MODULE := true
LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux
include $(BUILD_SYSTEM)/base_rules.mk
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
policy_files := $(call build_policy, $(sepolicy_build_files), \
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
$(PLAT_PUBLIC_POLICY) $(SYSTEM_EXT_PUBLIC_POLICY) $(PRODUCT_PUBLIC_POLICY) \
$(REQD_MASK_POLICY) $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_ODM_SEPOLICY_DIRS))
Add /odm/etc/selinux/odm_sepolicy.cil This change adds the support of odm sepolicy customization, which can be configured through the newly added build varaible: - BOARD_ODM_SEPOLICY_DIRS += device/${ODM_NAME}/${BOM_NAME}/sepolicy Also moving precompiled sepolicy to /odm when BOARD_ODM_SEPOLICY_DIRS is set. On a DUT, precompiled sepolicy on /odm will override the one in /vendor. This is intentional because /odm is the hardware customization for /vendor and both should be updated together if desired. Bug: 64240127 Test: boot a device with /odm partition Change-Id: Ia8f81a78c88cbfefb3ff19e2ccd2648da6284d09
2017-11-27 04:41:33 +01:00
odm_policy.conf := $(intermediates)/odm_policy.conf
$(odm_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
$(odm_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
$(odm_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
$(odm_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
$(odm_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
In native coverage builds, allow all domains to access /data/misc/trace Bug: http://b/135139675 Coverage files are written to /data/misc/trace (governed by the method_trace_data_file selinux type). Allow all domains to access (create directories, access files) this directory when native coverage is enabled (by setting NATIVE_COVERAGE to true) in an userdebug or eng build. Also relax neverallow constraints to allow access to method_trace_data_file for native coverage builds. Test: Build 32-bit cuttlefish with coverage: m NATIVE_COVERAGE=true COVERAGE_PATHS="*" and verify that there are no selinux denials in kernel log and logcat. Change-Id: I3fe7c77612854b9de7de7a0ddd5cbf44a2f5c21e
2019-06-14 00:05:15 +02:00
$(odm_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
Add /odm/etc/selinux/odm_sepolicy.cil This change adds the support of odm sepolicy customization, which can be configured through the newly added build varaible: - BOARD_ODM_SEPOLICY_DIRS += device/${ODM_NAME}/${BOM_NAME}/sepolicy Also moving precompiled sepolicy to /odm when BOARD_ODM_SEPOLICY_DIRS is set. On a DUT, precompiled sepolicy on /odm will override the one in /vendor. This is intentional because /odm is the hardware customization for /vendor and both should be updated together if desired. Bug: 64240127 Test: boot a device with /odm partition Change-Id: Ia8f81a78c88cbfefb3ff19e2ccd2648da6284d09
2017-11-27 04:41:33 +01:00
$(odm_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(odm_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
$(odm_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
Add BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW A new sysprop neverallow rules are mandatory only for devices launching with R or later. For devices already launched, neverallow rules can be relaxed with adding following line to BoardConfig.mk: BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true Bug: 131162102 Test: Set PRODUCT_SHIPPING_API_LEVEL := 30 and try building with changing some system_public_prop to system_internal_prop Test: m cts sepolicy_tests Change-Id: Id978b4d81a8683a57304bb639961105e2d91fa9a Merged-In: Id978b4d81a8683a57304bb639961105e2d91fa9a (cherry picked from commit 3be11e7abb8f4fd651295f9ccb0ce087855c1cc0)
2019-09-26 08:14:55 +02:00
$(odm_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow)
Enforce sysprop owner Every property should have an appropriate owner attribute, which can be one of: system_property_type, product_property_type, or vendor_property_type. This will be enforced for devices launching with S or later. Devices launching with R or eariler can relax this by setting following under BoardConfig.mk: BUILD_BROKEN_ENFORCE_SYSPROP_OWNER := true Bug: 131162102 Test: system/sepolicy/tools/build_policies.sh Change-Id: I7914ef1b7463c9ec00812b9720094531fd63f0c7
2020-09-28 06:32:43 +02:00
$(odm_policy.conf): PRIVATE_ENFORCE_SYSPROP_OWNER := $(enforce_sysprop_owner)
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
$(odm_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
$(odm_policy.conf): $(policy_files) $(M4)
Add /odm/etc/selinux/odm_sepolicy.cil This change adds the support of odm sepolicy customization, which can be configured through the newly added build varaible: - BOARD_ODM_SEPOLICY_DIRS += device/${ODM_NAME}/${BOM_NAME}/sepolicy Also moving precompiled sepolicy to /odm when BOARD_ODM_SEPOLICY_DIRS is set. On a DUT, precompiled sepolicy on /odm will override the one in /vendor. This is intentional because /odm is the hardware customization for /vendor and both should be updated together if desired. Bug: 64240127 Test: boot a device with /odm partition Change-Id: Ia8f81a78c88cbfefb3ff19e2ccd2648da6284d09
2017-11-27 04:41:33 +01:00
$(transform-policy-to-conf)
Fix building error for multi-line dontaudit statement All the *.conf.dontaudit files are generated from *.conf with the command of 'sed '/dontaudit/d' $@ > $@.dontaudit', but this command can not be applied to multi-line dontaudit statement. Test: Set plat_policy.conf.dontaudit as the input_file parameter of checkpolicy tool, then selinux syntax error will occur during building. Change-Id: I281de923d8a5f0b46256ec7de4df12a1c1d7e061
2018-09-13 08:04:19 +02:00
$(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
Add /odm/etc/selinux/odm_sepolicy.cil This change adds the support of odm sepolicy customization, which can be configured through the newly added build varaible: - BOARD_ODM_SEPOLICY_DIRS += device/${ODM_NAME}/${BOM_NAME}/sepolicy Also moving precompiled sepolicy to /odm when BOARD_ODM_SEPOLICY_DIRS is set. On a DUT, precompiled sepolicy on /odm will override the one in /vendor. This is intentional because /odm is the hardware customization for /vendor and both should be updated together if desired. Bug: 64240127 Test: boot a device with /odm partition Change-Id: Ia8f81a78c88cbfefb3ff19e2ccd2648da6284d09
2017-11-27 04:41:33 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_POL_CONF := $(odm_policy.conf)
$(LOCAL_BUILT_MODULE): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil)
Rename plat_pub_policy -> pub_policy Public policy that is available to vendor (and odm) sepolicy is a combination of system and product public sepolicy. Since "plat_" prefix implies a pure system sepolicy component, drop "plat_" prefix from "plat_pub_policy" to be consistent with naming in this file. Bug: 119305624 Test: m selinux_policy Change-Id: Iaf094702556ce97371fa1c58c01d707103d7f7d6
2019-01-15 22:31:03 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_BASE_CIL := $(pub_policy.cil)
Add /odm/etc/selinux/odm_sepolicy.cil This change adds the support of odm sepolicy customization, which can be configured through the newly added build varaible: - BOARD_ODM_SEPOLICY_DIRS += device/${ODM_NAME}/${BOM_NAME}/sepolicy Also moving precompiled sepolicy to /odm when BOARD_ODM_SEPOLICY_DIRS is set. On a DUT, precompiled sepolicy on /odm will override the one in /vendor. This is intentional because /odm is the hardware customization for /vendor and both should be updated together if desired. Bug: 64240127 Test: boot a device with /odm partition Change-Id: Ia8f81a78c88cbfefb3ff19e2ccd2648da6284d09
2017-11-27 04:41:33 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_VERS := $(BOARD_SEPOLICY_VERS)
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_DEP_CIL_FILES := $(built_plat_cil) $(built_system_ext_cil) \
$(built_product_cil) $(built_pub_vers_cil) $(built_plat_mapping_cil) \
$(built_system_ext_mapping_cil) $(built_product_mapping_cil) $(built_vendor_cil)
Rename plat_pub_policy -> pub_policy Public policy that is available to vendor (and odm) sepolicy is a combination of system and product public sepolicy. Since "plat_" prefix implies a pure system sepolicy component, drop "plat_" prefix from "plat_pub_policy" to be consistent with naming in this file. Bug: 119305624 Test: m selinux_policy Change-Id: Iaf094702556ce97371fa1c58c01d707103d7f7d6
2019-01-15 22:31:03 +01:00
$(LOCAL_BUILT_MODULE) : PRIVATE_FILTER_CIL_FILES := $(built_pub_vers_cil) $(built_vendor_cil)
Add /odm/etc/selinux/odm_sepolicy.cil This change adds the support of odm sepolicy customization, which can be configured through the newly added build varaible: - BOARD_ODM_SEPOLICY_DIRS += device/${ODM_NAME}/${BOM_NAME}/sepolicy Also moving precompiled sepolicy to /odm when BOARD_ODM_SEPOLICY_DIRS is set. On a DUT, precompiled sepolicy on /odm will override the one in /vendor. This is intentional because /odm is the hardware customization for /vendor and both should be updated together if desired. Bug: 64240127 Test: boot a device with /odm partition Change-Id: Ia8f81a78c88cbfefb3ff19e2ccd2648da6284d09
2017-11-27 04:41:33 +01:00
$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/build_sepolicy \
Rename plat_pub_policy -> pub_policy Public policy that is available to vendor (and odm) sepolicy is a combination of system and product public sepolicy. Since "plat_" prefix implies a pure system sepolicy component, drop "plat_" prefix from "plat_pub_policy" to be consistent with naming in this file. Bug: 119305624 Test: m selinux_policy Change-Id: Iaf094702556ce97371fa1c58c01d707103d7f7d6
2019-01-15 22:31:03 +01:00
$(odm_policy.conf) $(reqd_policy_mask.cil) $(pub_policy.cil) \
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
$(built_plat_cil) $(built_system_ext_cil) $(built_product_cil) $(built_pub_vers_cil) \
$(built_plat_mapping_cil) $(built_system_ext_mapping_cil) $(built_product_mapping_cil) \
$(built_vendor_cil)
Add /odm/etc/selinux/odm_sepolicy.cil This change adds the support of odm sepolicy customization, which can be configured through the newly added build varaible: - BOARD_ODM_SEPOLICY_DIRS += device/${ODM_NAME}/${BOM_NAME}/sepolicy Also moving precompiled sepolicy to /odm when BOARD_ODM_SEPOLICY_DIRS is set. On a DUT, precompiled sepolicy on /odm will override the one in /vendor. This is intentional because /odm is the hardware customization for /vendor and both should be updated together if desired. Bug: 64240127 Test: boot a device with /odm partition Change-Id: Ia8f81a78c88cbfefb3ff19e2ccd2648da6284d09
2017-11-27 04:41:33 +01:00
@mkdir -p $(dir $@)
$(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) build_cil \
-i $(PRIVATE_POL_CONF) -m $(PRIVATE_REQD_MASK) -c $(CHECKPOLICY_ASAN_OPTIONS) \
-b $(PRIVATE_BASE_CIL) -d $(PRIVATE_DEP_CIL_FILES) -f $(PRIVATE_FILTER_CIL_FILES) \
-t $(PRIVATE_VERS) -p $(POLICYVERS) -o $@
built_odm_cil := $(LOCAL_BUILT_MODULE)
odm_policy.conf :=
odm_policy_raw :=
Android.mk: conditional compilation of odm_sepolicy.cil Do not attempt to build odm_sepolicy.cil if BOARD_ODM_SEPOLICY_DIRS is not defined. Attempting to do so will create an empty file, which causes build problems when https://github.com/SELinuxProject/selinux/pull/100/commits/0c6ea1e812fbe75aef03ced077d4f4cd26d982fc is applied. Test: "cd system/sepolicy && mma -j55" succeeds Test: "make checkbuild" succeeds Change-Id: Iefc458bddff3d08e5fcb86f8be3cad16d7e36e73
2018-09-25 20:03:48 +02:00
endif
Add /odm/etc/selinux/odm_sepolicy.cil This change adds the support of odm sepolicy customization, which can be configured through the newly added build varaible: - BOARD_ODM_SEPOLICY_DIRS += device/${ODM_NAME}/${BOM_NAME}/sepolicy Also moving precompiled sepolicy to /odm when BOARD_ODM_SEPOLICY_DIRS is set. On a DUT, precompiled sepolicy on /odm will override the one in /vendor. This is intentional because /odm is the hardware customization for /vendor and both should be updated together if desired. Bug: 64240127 Test: boot a device with /odm partition Change-Id: Ia8f81a78c88cbfefb3ff19e2ccd2648da6284d09
2017-11-27 04:41:33 +01:00
#################################
include $(CLEAR_VARS)
Precompiled kernel policy for on-device use This adds build targets for outputing precompiled kernel policy usable on devices with policy split between system and vendor partitions. On such devices, precompiled policy must reside on the vendor partition. Because such devices support updating these partitions independently of each other, the precompiled policy must reference the system partition's policy against which it was compiled. This enables init to establish whether the precompiled policy is valid for the current combination of system and vendor partitions. The referencing is performed by both the system and vendor partitions including the SHA-256 digest of the system partition's policy (plat_sepolicy.cil). Only the when the digest is the same on both partitions can the precompiled policy be used. Test: plat_sepolicy.cil.sha256 contains exactly the hex form of the SHA-256 digest of plat_sepolicy.cil Test: plat_sepolicy.cil.sha256 is identical precompiled_sepolicy.plat.sha256. Bug: 31363362 Change-Id: I9771e1aa751e25bba6e2face37d68e0ae43b33a3
2017-03-07 23:05:57 +01:00
LOCAL_MODULE := precompiled_sepolicy
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_PROPRIETARY_MODULE := true
Add /odm/etc/selinux/odm_sepolicy.cil This change adds the support of odm sepolicy customization, which can be configured through the newly added build varaible: - BOARD_ODM_SEPOLICY_DIRS += device/${ODM_NAME}/${BOM_NAME}/sepolicy Also moving precompiled sepolicy to /odm when BOARD_ODM_SEPOLICY_DIRS is set. On a DUT, precompiled sepolicy on /odm will override the one in /vendor. This is intentional because /odm is the hardware customization for /vendor and both should be updated together if desired. Bug: 64240127 Test: boot a device with /odm partition Change-Id: Ia8f81a78c88cbfefb3ff19e2ccd2648da6284d09
2017-11-27 04:41:33 +01:00
ifeq ($(BOARD_USES_ODMIMAGE),true)
LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux
else
Precompiled kernel policy for on-device use This adds build targets for outputing precompiled kernel policy usable on devices with policy split between system and vendor partitions. On such devices, precompiled policy must reside on the vendor partition. Because such devices support updating these partitions independently of each other, the precompiled policy must reference the system partition's policy against which it was compiled. This enables init to establish whether the precompiled policy is valid for the current combination of system and vendor partitions. The referencing is performed by both the system and vendor partitions including the SHA-256 digest of the system partition's policy (plat_sepolicy.cil). Only the when the digest is the same on both partitions can the precompiled policy be used. Test: plat_sepolicy.cil.sha256 contains exactly the hex form of the SHA-256 digest of plat_sepolicy.cil Test: plat_sepolicy.cil.sha256 is identical precompiled_sepolicy.plat.sha256. Bug: 31363362 Change-Id: I9771e1aa751e25bba6e2face37d68e0ae43b33a3
2017-03-07 23:05:57 +01:00
LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
Add /odm/etc/selinux/odm_sepolicy.cil This change adds the support of odm sepolicy customization, which can be configured through the newly added build varaible: - BOARD_ODM_SEPOLICY_DIRS += device/${ODM_NAME}/${BOM_NAME}/sepolicy Also moving precompiled sepolicy to /odm when BOARD_ODM_SEPOLICY_DIRS is set. On a DUT, precompiled sepolicy on /odm will override the one in /vendor. This is intentional because /odm is the hardware customization for /vendor and both should be updated together if desired. Bug: 64240127 Test: boot a device with /odm partition Change-Id: Ia8f81a78c88cbfefb3ff19e2ccd2648da6284d09
2017-11-27 04:41:33 +01:00
endif
Precompiled kernel policy for on-device use This adds build targets for outputing precompiled kernel policy usable on devices with policy split between system and vendor partitions. On such devices, precompiled policy must reside on the vendor partition. Because such devices support updating these partitions independently of each other, the precompiled policy must reference the system partition's policy against which it was compiled. This enables init to establish whether the precompiled policy is valid for the current combination of system and vendor partitions. The referencing is performed by both the system and vendor partitions including the SHA-256 digest of the system partition's policy (plat_sepolicy.cil). Only the when the digest is the same on both partitions can the precompiled policy be used. Test: plat_sepolicy.cil.sha256 contains exactly the hex form of the SHA-256 digest of plat_sepolicy.cil Test: plat_sepolicy.cil.sha256 is identical precompiled_sepolicy.plat.sha256. Bug: 31363362 Change-Id: I9771e1aa751e25bba6e2face37d68e0ae43b33a3
2017-03-07 23:05:57 +01:00
include $(BUILD_SYSTEM)/base_rules.mk
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
all_cil_files := \
$(built_plat_cil) \
Split mapping file into system and product parts Both mapping files need to be included when building sepolicy at boot time. Bug: 119305624 Test: boot taimen Test: "cnd" type is declared in /vendor; "dataservice_app" type is declared in /product. This permission is preserved "allow cnd dataservice_app:binder { transfer call };" Change-Id: I138f34208ea05e170defd2b4ef4700ffa81f9573
2019-01-16 00:16:55 +01:00
$(built_plat_mapping_cil) \
Rename plat_pub_policy -> pub_policy Public policy that is available to vendor (and odm) sepolicy is a combination of system and product public sepolicy. Since "plat_" prefix implies a pure system sepolicy component, drop "plat_" prefix from "plat_pub_policy" to be consistent with naming in this file. Bug: 119305624 Test: m selinux_policy Change-Id: Iaf094702556ce97371fa1c58c01d707103d7f7d6
2019-01-15 22:31:03 +01:00
$(built_pub_vers_cil) \
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
$(built_vendor_cil)
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
ifdef HAS_SYSTEM_EXT_SEPOLICY
Allowing system_ext sepolicy to be empty Some targets just need to extend system_ext context files, e.g., file_contexts, service_contexts, etc., without adding any system_ext policy files, e.g., *.te files. Currently, this will lead to build errors. This CL allows system_ext_sepolicy.cil and the system_ext mapping file to be empty. It's now also possible to just set BOARD_PLAT_PRIVATE_SEPOLICY_DIR without setting BOARD_PLAT_PUBLIC_SEPOLICY_DIR. Bug: 137712473 Bug: 141880898 Test: Only adds system_ext context files without policy files (e.g., *.te), then `mmma system/sepolicy` can build pass Change-Id: I72849f2d4aa43e5296cd15c07a8fd058186a6376
2019-10-04 08:34:18 +02:00
all_cil_files += $(built_system_ext_cil)
endif
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
Allowing system_ext sepolicy to be empty Some targets just need to extend system_ext context files, e.g., file_contexts, service_contexts, etc., without adding any system_ext policy files, e.g., *.te files. Currently, this will lead to build errors. This CL allows system_ext_sepolicy.cil and the system_ext mapping file to be empty. It's now also possible to just set BOARD_PLAT_PRIVATE_SEPOLICY_DIR without setting BOARD_PLAT_PUBLIC_SEPOLICY_DIR. Bug: 137712473 Bug: 141880898 Test: Only adds system_ext context files without policy files (e.g., *.te), then `mmma system/sepolicy` can build pass Change-Id: I72849f2d4aa43e5296cd15c07a8fd058186a6376
2019-10-04 08:34:18 +02:00
ifdef HAS_SYSTEM_EXT_PUBLIC_SEPOLICY
all_cil_files += $(built_system_ext_mapping_cil)
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
endif
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
ifdef HAS_PRODUCT_SEPOLICY
Allowing product sepolicy to be empty Some targets just need to extend product context files, e.g., file_contexts, service_contexts, etc., without adding any product-specific policy files, e.g., *.te files. Or just need to add private product sepolicy without adding public product sepolicy. Currently, this will lead to build errors. This CL allows product_sepolicy.cil and the product mapping file to be empty. It's now also possible to just set PRODUCT_PRIVATE_POLICY without setting PRODUCT_PUBLIC_POLICY. Bug: 131193755 Test: Only adds product private sepolicy, then `mmma system/sepolicy` Change-Id: Ifed5af7413b2a1e20a0628518582615708c8c31a
2019-10-04 09:36:05 +02:00
all_cil_files += $(built_product_cil)
endif
Split mapping file into system and product parts Both mapping files need to be included when building sepolicy at boot time. Bug: 119305624 Test: boot taimen Test: "cnd" type is declared in /vendor; "dataservice_app" type is declared in /product. This permission is preserved "allow cnd dataservice_app:binder { transfer call };" Change-Id: I138f34208ea05e170defd2b4ef4700ffa81f9573
2019-01-16 00:16:55 +01:00
Allowing product sepolicy to be empty Some targets just need to extend product context files, e.g., file_contexts, service_contexts, etc., without adding any product-specific policy files, e.g., *.te files. Or just need to add private product sepolicy without adding public product sepolicy. Currently, this will lead to build errors. This CL allows product_sepolicy.cil and the product mapping file to be empty. It's now also possible to just set PRODUCT_PRIVATE_POLICY without setting PRODUCT_PUBLIC_POLICY. Bug: 131193755 Test: Only adds product private sepolicy, then `mmma system/sepolicy` Change-Id: Ifed5af7413b2a1e20a0628518582615708c8c31a
2019-10-04 09:36:05 +02:00
ifdef HAS_PRODUCT_PUBLIC_SEPOLICY
all_cil_files += $(built_product_mapping_cil)
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
endif
Add /odm/etc/selinux/odm_sepolicy.cil This change adds the support of odm sepolicy customization, which can be configured through the newly added build varaible: - BOARD_ODM_SEPOLICY_DIRS += device/${ODM_NAME}/${BOM_NAME}/sepolicy Also moving precompiled sepolicy to /odm when BOARD_ODM_SEPOLICY_DIRS is set. On a DUT, precompiled sepolicy on /odm will override the one in /vendor. This is intentional because /odm is the hardware customization for /vendor and both should be updated together if desired. Bug: 64240127 Test: boot a device with /odm partition Change-Id: Ia8f81a78c88cbfefb3ff19e2ccd2648da6284d09
2017-11-27 04:41:33 +01:00
ifdef BOARD_ODM_SEPOLICY_DIRS
all_cil_files += $(built_odm_cil)
endif
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(all_cil_files)
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(all_cil_files) $(built_sepolicy_neverallows)
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) \
Precompiled kernel policy for on-device use This adds build targets for outputing precompiled kernel policy usable on devices with policy split between system and vendor partitions. On such devices, precompiled policy must reside on the vendor partition. Because such devices support updating these partitions independently of each other, the precompiled policy must reference the system partition's policy against which it was compiled. This enables init to establish whether the precompiled policy is valid for the current combination of system and vendor partitions. The referencing is performed by both the system and vendor partitions including the SHA-256 digest of the system partition's policy (plat_sepolicy.cil). Only the when the digest is the same on both partitions can the precompiled policy be used. Test: plat_sepolicy.cil.sha256 contains exactly the hex form of the SHA-256 digest of plat_sepolicy.cil Test: plat_sepolicy.cil.sha256 is identical precompiled_sepolicy.plat.sha256. Bug: 31363362 Change-Id: I9771e1aa751e25bba6e2face37d68e0ae43b33a3
2017-03-07 23:05:57 +01:00
$(PRIVATE_CIL_FILES) -o $@ -f /dev/null
built_precompiled_sepolicy := $(LOCAL_BUILT_MODULE)
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
all_cil_files :=
Precompiled kernel policy for on-device use This adds build targets for outputing precompiled kernel policy usable on devices with policy split between system and vendor partitions. On such devices, precompiled policy must reside on the vendor partition. Because such devices support updating these partitions independently of each other, the precompiled policy must reference the system partition's policy against which it was compiled. This enables init to establish whether the precompiled policy is valid for the current combination of system and vendor partitions. The referencing is performed by both the system and vendor partitions including the SHA-256 digest of the system partition's policy (plat_sepolicy.cil). Only the when the digest is the same on both partitions can the precompiled policy be used. Test: plat_sepolicy.cil.sha256 contains exactly the hex form of the SHA-256 digest of plat_sepolicy.cil Test: plat_sepolicy.cil.sha256 is identical precompiled_sepolicy.plat.sha256. Bug: 31363362 Change-Id: I9771e1aa751e25bba6e2face37d68e0ae43b33a3
2017-03-07 23:05:57 +01:00
#################################
Split system and product sepolicy hashes. We need to be able to tell if /system was updated independently /product, and vice versa. Otherwise, the device might accidentally load the precompiled_policy after a /product sepolicy update. Also change the name of the hash file to more closely reflect how its generated. Bug: 119305624 Test: boot aosp_taimen, precompiled policy is loaded Test: If either of these hashes /system/etc/selinux/plat_sepolicy_and_mapping.sha256 /product/etc/selinux/product_sepolicy_and_mapping.sha256 are removed, then init falls back to compiling sepolicy at boot time. Change-Id: I14af81c8d3c5cb85c01592518e22077a8c8c3e5e
2019-01-23 03:07:58 +01:00
# Precompiled sepolicy is loaded if and only if:
# - plat_sepolicy_and_mapping.sha256 equals
# precompiled_sepolicy.plat_sepolicy_and_mapping.sha256
# AND
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
# - system_ext_sepolicy_and_mapping.sha256 equals
# precompiled_sepolicy.system_ext_sepolicy_and_mapping.sha256
# AND
Split system and product sepolicy hashes. We need to be able to tell if /system was updated independently /product, and vice versa. Otherwise, the device might accidentally load the precompiled_policy after a /product sepolicy update. Also change the name of the hash file to more closely reflect how its generated. Bug: 119305624 Test: boot aosp_taimen, precompiled policy is loaded Test: If either of these hashes /system/etc/selinux/plat_sepolicy_and_mapping.sha256 /product/etc/selinux/product_sepolicy_and_mapping.sha256 are removed, then init falls back to compiling sepolicy at boot time. Change-Id: I14af81c8d3c5cb85c01592518e22077a8c8c3e5e
2019-01-23 03:07:58 +01:00
# - product_sepolicy_and_mapping.sha256 equals
# precompiled_sepolicy.product_sepolicy_and_mapping.sha256
# See system/core/init/selinux.cpp for details.
#################################
include $(CLEAR_VARS)
LOCAL_MODULE := plat_sepolicy_and_mapping.sha256
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH = $(TARGET_OUT)/etc/selinux
include $(BUILD_SYSTEM)/base_rules.mk
$(LOCAL_BUILT_MODULE): $(built_plat_cil) $(built_plat_mapping_cil)
cat $^ | sha256sum | cut -d' ' -f1 > $@
#################################
include $(CLEAR_VARS)
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
LOCAL_MODULE := system_ext_sepolicy_and_mapping.sha256
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH = $(TARGET_OUT_SYSTEM_EXT)/etc/selinux
include $(BUILD_SYSTEM)/base_rules.mk
$(LOCAL_BUILT_MODULE): $(built_system_ext_cil) $(built_system_ext_mapping_cil)
cat $^ | sha256sum | cut -d' ' -f1 > $@
#################################
include $(CLEAR_VARS)
Split system and product sepolicy hashes. We need to be able to tell if /system was updated independently /product, and vice versa. Otherwise, the device might accidentally load the precompiled_policy after a /product sepolicy update. Also change the name of the hash file to more closely reflect how its generated. Bug: 119305624 Test: boot aosp_taimen, precompiled policy is loaded Test: If either of these hashes /system/etc/selinux/plat_sepolicy_and_mapping.sha256 /product/etc/selinux/product_sepolicy_and_mapping.sha256 are removed, then init falls back to compiling sepolicy at boot time. Change-Id: I14af81c8d3c5cb85c01592518e22077a8c8c3e5e
2019-01-23 03:07:58 +01:00
LOCAL_MODULE := product_sepolicy_and_mapping.sha256
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH = $(TARGET_OUT_PRODUCT)/etc/selinux
include $(BUILD_SYSTEM)/base_rules.mk
$(LOCAL_BUILT_MODULE): $(built_product_cil) $(built_product_mapping_cil)
cat $^ | sha256sum | cut -d' ' -f1 > $@
#################################
# SHA-256 digest of the plat_sepolicy.cil and plat_mapping_file against
Move mapping_sepolicy.cil to /system partition. This is a necessary first step to finalizing the SELinux policy build process. The mapping_sepolicy.cil file is required to provide backward compatibility with the indicated vendor-targeted version. This still needs to be extended to provide N mapping files and corresponding SHA256 outputs, one for each of the N previous platform versions with which we're backward-compatible. Bug: 36783775 Test: boot device with matching sha256 and non-matching and verify that device boots and uses either precompiled or compiled policy as needed. Also verify that mapping_sepolicy.cil has moved. Change-Id: I5692fb87c7ec0f3ae9ca611f76847ccff9182375
2017-04-04 23:27:41 +02:00
# which precompiled_policy was built.
Precompiled kernel policy for on-device use This adds build targets for outputing precompiled kernel policy usable on devices with policy split between system and vendor partitions. On such devices, precompiled policy must reside on the vendor partition. Because such devices support updating these partitions independently of each other, the precompiled policy must reference the system partition's policy against which it was compiled. This enables init to establish whether the precompiled policy is valid for the current combination of system and vendor partitions. The referencing is performed by both the system and vendor partitions including the SHA-256 digest of the system partition's policy (plat_sepolicy.cil). Only the when the digest is the same on both partitions can the precompiled policy be used. Test: plat_sepolicy.cil.sha256 contains exactly the hex form of the SHA-256 digest of plat_sepolicy.cil Test: plat_sepolicy.cil.sha256 is identical precompiled_sepolicy.plat.sha256. Bug: 31363362 Change-Id: I9771e1aa751e25bba6e2face37d68e0ae43b33a3
2017-03-07 23:05:57 +01:00
#################################
include $(CLEAR_VARS)
Split system and product sepolicy hashes. We need to be able to tell if /system was updated independently /product, and vice versa. Otherwise, the device might accidentally load the precompiled_policy after a /product sepolicy update. Also change the name of the hash file to more closely reflect how its generated. Bug: 119305624 Test: boot aosp_taimen, precompiled policy is loaded Test: If either of these hashes /system/etc/selinux/plat_sepolicy_and_mapping.sha256 /product/etc/selinux/product_sepolicy_and_mapping.sha256 are removed, then init falls back to compiling sepolicy at boot time. Change-Id: I14af81c8d3c5cb85c01592518e22077a8c8c3e5e
2019-01-23 03:07:58 +01:00
LOCAL_MODULE := precompiled_sepolicy.plat_sepolicy_and_mapping.sha256
Precompiled kernel policy for on-device use This adds build targets for outputing precompiled kernel policy usable on devices with policy split between system and vendor partitions. On such devices, precompiled policy must reside on the vendor partition. Because such devices support updating these partitions independently of each other, the precompiled policy must reference the system partition's policy against which it was compiled. This enables init to establish whether the precompiled policy is valid for the current combination of system and vendor partitions. The referencing is performed by both the system and vendor partitions including the SHA-256 digest of the system partition's policy (plat_sepolicy.cil). Only the when the digest is the same on both partitions can the precompiled policy be used. Test: plat_sepolicy.cil.sha256 contains exactly the hex form of the SHA-256 digest of plat_sepolicy.cil Test: plat_sepolicy.cil.sha256 is identical precompiled_sepolicy.plat.sha256. Bug: 31363362 Change-Id: I9771e1aa751e25bba6e2face37d68e0ae43b33a3
2017-03-07 23:05:57 +01:00
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
Add /odm/etc/selinux/odm_sepolicy.cil This change adds the support of odm sepolicy customization, which can be configured through the newly added build varaible: - BOARD_ODM_SEPOLICY_DIRS += device/${ODM_NAME}/${BOM_NAME}/sepolicy Also moving precompiled sepolicy to /odm when BOARD_ODM_SEPOLICY_DIRS is set. On a DUT, precompiled sepolicy on /odm will override the one in /vendor. This is intentional because /odm is the hardware customization for /vendor and both should be updated together if desired. Bug: 64240127 Test: boot a device with /odm partition Change-Id: Ia8f81a78c88cbfefb3ff19e2ccd2648da6284d09
2017-11-27 04:41:33 +01:00
ifeq ($(BOARD_USES_ODMIMAGE),true)
LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux
else
Precompiled kernel policy for on-device use This adds build targets for outputing precompiled kernel policy usable on devices with policy split between system and vendor partitions. On such devices, precompiled policy must reside on the vendor partition. Because such devices support updating these partitions independently of each other, the precompiled policy must reference the system partition's policy against which it was compiled. This enables init to establish whether the precompiled policy is valid for the current combination of system and vendor partitions. The referencing is performed by both the system and vendor partitions including the SHA-256 digest of the system partition's policy (plat_sepolicy.cil). Only the when the digest is the same on both partitions can the precompiled policy be used. Test: plat_sepolicy.cil.sha256 contains exactly the hex form of the SHA-256 digest of plat_sepolicy.cil Test: plat_sepolicy.cil.sha256 is identical precompiled_sepolicy.plat.sha256. Bug: 31363362 Change-Id: I9771e1aa751e25bba6e2face37d68e0ae43b33a3
2017-03-07 23:05:57 +01:00
LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
Add /odm/etc/selinux/odm_sepolicy.cil This change adds the support of odm sepolicy customization, which can be configured through the newly added build varaible: - BOARD_ODM_SEPOLICY_DIRS += device/${ODM_NAME}/${BOM_NAME}/sepolicy Also moving precompiled sepolicy to /odm when BOARD_ODM_SEPOLICY_DIRS is set. On a DUT, precompiled sepolicy on /odm will override the one in /vendor. This is intentional because /odm is the hardware customization for /vendor and both should be updated together if desired. Bug: 64240127 Test: boot a device with /odm partition Change-Id: Ia8f81a78c88cbfefb3ff19e2ccd2648da6284d09
2017-11-27 04:41:33 +01:00
endif
Precompiled kernel policy for on-device use This adds build targets for outputing precompiled kernel policy usable on devices with policy split between system and vendor partitions. On such devices, precompiled policy must reside on the vendor partition. Because such devices support updating these partitions independently of each other, the precompiled policy must reference the system partition's policy against which it was compiled. This enables init to establish whether the precompiled policy is valid for the current combination of system and vendor partitions. The referencing is performed by both the system and vendor partitions including the SHA-256 digest of the system partition's policy (plat_sepolicy.cil). Only the when the digest is the same on both partitions can the precompiled policy be used. Test: plat_sepolicy.cil.sha256 contains exactly the hex form of the SHA-256 digest of plat_sepolicy.cil Test: plat_sepolicy.cil.sha256 is identical precompiled_sepolicy.plat.sha256. Bug: 31363362 Change-Id: I9771e1aa751e25bba6e2face37d68e0ae43b33a3
2017-03-07 23:05:57 +01:00
include $(BUILD_SYSTEM)/base_rules.mk
Split system and product sepolicy hashes. We need to be able to tell if /system was updated independently /product, and vice versa. Otherwise, the device might accidentally load the precompiled_policy after a /product sepolicy update. Also change the name of the hash file to more closely reflect how its generated. Bug: 119305624 Test: boot aosp_taimen, precompiled policy is loaded Test: If either of these hashes /system/etc/selinux/plat_sepolicy_and_mapping.sha256 /product/etc/selinux/product_sepolicy_and_mapping.sha256 are removed, then init falls back to compiling sepolicy at boot time. Change-Id: I14af81c8d3c5cb85c01592518e22077a8c8c3e5e
2019-01-23 03:07:58 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(built_plat_cil) $(built_plat_mapping_cil)
$(LOCAL_BUILT_MODULE): $(built_precompiled_sepolicy) $(built_plat_cil) $(built_plat_mapping_cil)
cat $(PRIVATE_CIL_FILES) | sha256sum | cut -d' ' -f1 > $@
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
#################################
# SHA-256 digest of the system_ext_sepolicy.cil and system_ext_mapping_file against
# which precompiled_policy was built.
#################################
include $(CLEAR_VARS)
LOCAL_MODULE := precompiled_sepolicy.system_ext_sepolicy_and_mapping.sha256
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
ifeq ($(BOARD_USES_ODMIMAGE),true)
LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux
else
LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
endif
include $(BUILD_SYSTEM)/base_rules.mk
$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(built_system_ext_cil) $(built_system_ext_mapping_cil)
$(LOCAL_BUILT_MODULE): $(built_precompiled_sepolicy) $(built_system_ext_cil) $(built_system_ext_mapping_cil)
cat $(PRIVATE_CIL_FILES) | sha256sum | cut -d' ' -f1 > $@
Split system and product sepolicy hashes. We need to be able to tell if /system was updated independently /product, and vice versa. Otherwise, the device might accidentally load the precompiled_policy after a /product sepolicy update. Also change the name of the hash file to more closely reflect how its generated. Bug: 119305624 Test: boot aosp_taimen, precompiled policy is loaded Test: If either of these hashes /system/etc/selinux/plat_sepolicy_and_mapping.sha256 /product/etc/selinux/product_sepolicy_and_mapping.sha256 are removed, then init falls back to compiling sepolicy at boot time. Change-Id: I14af81c8d3c5cb85c01592518e22077a8c8c3e5e
2019-01-23 03:07:58 +01:00
#################################
# SHA-256 digest of the product_sepolicy.cil and product_mapping_file against
# which precompiled_policy was built.
#################################
include $(CLEAR_VARS)
LOCAL_MODULE := precompiled_sepolicy.product_sepolicy_and_mapping.sha256
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
ifeq ($(BOARD_USES_ODMIMAGE),true)
LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux
else
LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
endif
include $(BUILD_SYSTEM)/base_rules.mk
$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(built_product_cil) $(built_product_mapping_cil)
$(LOCAL_BUILT_MODULE): $(built_precompiled_sepolicy) $(built_product_cil) $(built_product_mapping_cil)
Move mapping_sepolicy.cil to /system partition. This is a necessary first step to finalizing the SELinux policy build process. The mapping_sepolicy.cil file is required to provide backward compatibility with the indicated vendor-targeted version. This still needs to be extended to provide N mapping files and corresponding SHA256 outputs, one for each of the N previous platform versions with which we're backward-compatible. Bug: 36783775 Test: boot device with matching sha256 and non-matching and verify that device boots and uses either precompiled or compiled policy as needed. Also verify that mapping_sepolicy.cil has moved. Change-Id: I5692fb87c7ec0f3ae9ca611f76847ccff9182375
2017-04-04 23:27:41 +02:00
cat $(PRIVATE_CIL_FILES) | sha256sum | cut -d' ' -f1 > $@
Precompiled kernel policy for on-device use This adds build targets for outputing precompiled kernel policy usable on devices with policy split between system and vendor partitions. On such devices, precompiled policy must reside on the vendor partition. Because such devices support updating these partitions independently of each other, the precompiled policy must reference the system partition's policy against which it was compiled. This enables init to establish whether the precompiled policy is valid for the current combination of system and vendor partitions. The referencing is performed by both the system and vendor partitions including the SHA-256 digest of the system partition's policy (plat_sepolicy.cil). Only the when the digest is the same on both partitions can the precompiled policy be used. Test: plat_sepolicy.cil.sha256 contains exactly the hex form of the SHA-256 digest of plat_sepolicy.cil Test: plat_sepolicy.cil.sha256 is identical precompiled_sepolicy.plat.sha256. Bug: 31363362 Change-Id: I9771e1aa751e25bba6e2face37d68e0ae43b33a3
2017-03-07 23:05:57 +01:00
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
#################################
include $(CLEAR_VARS)
Switch recovery to versioned policy and split into components. And do some clean up: Replace LOCAL_TARGET_ARCH with global arch specifier that won't get clobbered, clean up sepolicy.recovery's eng specification, ensure that build macros are applied across all policy generation, not just plat_policy, and make sure that all private variables are cleared and alphabetized at the end. Bug: 31363362 Bug: 31369363 Test: Boot into recovery and observe no selinux denials. Change-Id: Ibc15b097f6d19acf01f6b22bee0e083b15f4ef75
2016-12-16 00:28:44 +01:00
# build this target so that we can still perform neverallow checks
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
LOCAL_MODULE := sepolicy
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
Revert "Move sepolicy and recovery from on-device tree and add dependency." This reverts commit cf5c6ecb93931ca5853b9954979d785d259453ce. Change-Id: Ie86a6ac20ab5a1611efc0e167c0430eb9df9482e
2016-12-17 01:53:26 +01:00
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
include $(BUILD_SYSTEM)/base_rules.mk
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
all_cil_files := \
Retain neverallow rules in CIL files Fixes issue where attributes used exlusively in neverallow rules were removed from policy. For on-device compile use the -N flag to skip neverallow tests. Policy size increases: vendor/etc/selinux/nonplat_sepolicy.cil 547849 -> 635637 vendor/etc/selinux/precompiled_sepolicy 440248 -> 441076 system/etc/selinux/plat_sepolicy.cil 567664 -> 745230 For a total increase in system/vendor: 266182. Boot time changes: Pixel uses precompiled policy so boot time is not impacted. When forcing on-device compile on Marlin selinux policy compile time increases 510-520 ms -> 550-560 ms. Bug: 37357742 Test: Build and boot Marlin. Test: Verify both precompiled and on-device compile work. Change-Id: Ib3cb53d376a96e34f55ac27d651a6ce2fabf6ba7
2017-04-22 00:57:07 +02:00
$(built_plat_cil) \
Split mapping file into system and product parts Both mapping files need to be included when building sepolicy at boot time. Bug: 119305624 Test: boot taimen Test: "cnd" type is declared in /vendor; "dataservice_app" type is declared in /product. This permission is preserved "allow cnd dataservice_app:binder { transfer call };" Change-Id: I138f34208ea05e170defd2b4ef4700ffa81f9573
2019-01-16 00:16:55 +01:00
$(built_plat_mapping_cil) \
Rename plat_pub_policy -> pub_policy Public policy that is available to vendor (and odm) sepolicy is a combination of system and product public sepolicy. Since "plat_" prefix implies a pure system sepolicy component, drop "plat_" prefix from "plat_pub_policy" to be consistent with naming in this file. Bug: 119305624 Test: m selinux_policy Change-Id: Iaf094702556ce97371fa1c58c01d707103d7f7d6
2019-01-15 22:31:03 +01:00
$(built_pub_vers_cil) \
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
$(built_vendor_cil)
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
ifdef HAS_SYSTEM_EXT_SEPOLICY
Allowing system_ext sepolicy to be empty Some targets just need to extend system_ext context files, e.g., file_contexts, service_contexts, etc., without adding any system_ext policy files, e.g., *.te files. Currently, this will lead to build errors. This CL allows system_ext_sepolicy.cil and the system_ext mapping file to be empty. It's now also possible to just set BOARD_PLAT_PRIVATE_SEPOLICY_DIR without setting BOARD_PLAT_PUBLIC_SEPOLICY_DIR. Bug: 137712473 Bug: 141880898 Test: Only adds system_ext context files without policy files (e.g., *.te), then `mmma system/sepolicy` can build pass Change-Id: I72849f2d4aa43e5296cd15c07a8fd058186a6376
2019-10-04 08:34:18 +02:00
all_cil_files += $(built_system_ext_cil)
endif
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
Allowing system_ext sepolicy to be empty Some targets just need to extend system_ext context files, e.g., file_contexts, service_contexts, etc., without adding any system_ext policy files, e.g., *.te files. Currently, this will lead to build errors. This CL allows system_ext_sepolicy.cil and the system_ext mapping file to be empty. It's now also possible to just set BOARD_PLAT_PRIVATE_SEPOLICY_DIR without setting BOARD_PLAT_PUBLIC_SEPOLICY_DIR. Bug: 137712473 Bug: 141880898 Test: Only adds system_ext context files without policy files (e.g., *.te), then `mmma system/sepolicy` can build pass Change-Id: I72849f2d4aa43e5296cd15c07a8fd058186a6376
2019-10-04 08:34:18 +02:00
ifdef HAS_SYSTEM_EXT_PUBLIC_SEPOLICY
all_cil_files += $(built_system_ext_mapping_cil)
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
endif
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
ifdef HAS_PRODUCT_SEPOLICY
Allowing product sepolicy to be empty Some targets just need to extend product context files, e.g., file_contexts, service_contexts, etc., without adding any product-specific policy files, e.g., *.te files. Or just need to add private product sepolicy without adding public product sepolicy. Currently, this will lead to build errors. This CL allows product_sepolicy.cil and the product mapping file to be empty. It's now also possible to just set PRODUCT_PRIVATE_POLICY without setting PRODUCT_PUBLIC_POLICY. Bug: 131193755 Test: Only adds product private sepolicy, then `mmma system/sepolicy` Change-Id: Ifed5af7413b2a1e20a0628518582615708c8c31a
2019-10-04 09:36:05 +02:00
all_cil_files += $(built_product_cil)
endif
Split mapping file into system and product parts Both mapping files need to be included when building sepolicy at boot time. Bug: 119305624 Test: boot taimen Test: "cnd" type is declared in /vendor; "dataservice_app" type is declared in /product. This permission is preserved "allow cnd dataservice_app:binder { transfer call };" Change-Id: I138f34208ea05e170defd2b4ef4700ffa81f9573
2019-01-16 00:16:55 +01:00
Allowing product sepolicy to be empty Some targets just need to extend product context files, e.g., file_contexts, service_contexts, etc., without adding any product-specific policy files, e.g., *.te files. Or just need to add private product sepolicy without adding public product sepolicy. Currently, this will lead to build errors. This CL allows product_sepolicy.cil and the product mapping file to be empty. It's now also possible to just set PRODUCT_PRIVATE_POLICY without setting PRODUCT_PUBLIC_POLICY. Bug: 131193755 Test: Only adds product private sepolicy, then `mmma system/sepolicy` Change-Id: Ifed5af7413b2a1e20a0628518582615708c8c31a
2019-10-04 09:36:05 +02:00
ifdef HAS_PRODUCT_PUBLIC_SEPOLICY
all_cil_files += $(built_product_mapping_cil)
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
endif
Add /odm/etc/selinux/odm_sepolicy.cil This change adds the support of odm sepolicy customization, which can be configured through the newly added build varaible: - BOARD_ODM_SEPOLICY_DIRS += device/${ODM_NAME}/${BOM_NAME}/sepolicy Also moving precompiled sepolicy to /odm when BOARD_ODM_SEPOLICY_DIRS is set. On a DUT, precompiled sepolicy on /odm will override the one in /vendor. This is intentional because /odm is the hardware customization for /vendor and both should be updated together if desired. Bug: 64240127 Test: boot a device with /odm partition Change-Id: Ia8f81a78c88cbfefb3ff19e2ccd2648da6284d09
2017-11-27 04:41:33 +01:00
ifdef BOARD_ODM_SEPOLICY_DIRS
all_cil_files += $(built_odm_cil)
endif
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(all_cil_files)
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $(all_cil_files) \
$(built_sepolicy_neverallows)
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
@mkdir -p $(dir $@)
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
$(hide) $< -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $(PRIVATE_CIL_FILES) -o $@.tmp -f /dev/null
Don't allow permissive SELinux domains on user builds. It's a CTS requirement that all SELinux domains be in enforcing mode. Add the same assertion to the build system when targeting user builds. In particular, this avoids a situation where device integrity checking is enabled on user builds, but permissive denials are being generated, causing the device to unexpectedly reboot into safe mode. A developer wanting to put an SELinux domain into permissive mode for userdebug/eng purposes can write the following in their policy: userdebug_or_eng(` permissive foo; ') Bug: 26902605 Bug: 27313768 Change-Id: Ic0971d9e96a28f2a98f9d56a547661d24fb81a21
2016-02-27 05:06:52 +01:00
$(hide) $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $@.tmp permissive > $@.permissivedomains
$(hide) if [ "$(TARGET_BUILD_VARIANT)" = "user" -a -s $@.permissivedomains ]; then \
echo "==========" 1>&2; \
echo "ERROR: permissive domains not allowed in user builds" 1>&2; \
echo "List of invalid domains:" 1>&2; \
cat $@.permissivedomains 1>&2; \
exit 1; \
fi
$(hide) mv $@.tmp $@
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
Use file target as dependency. "sepolicy" is a phony target defined by the build system. If you use it as dependency of a file target, you'll get unnecessary rebuild. Change-Id: I3a948ebbaff6a146050eb86a3d04cdc050f7c001
2012-10-26 04:01:31 +02:00
built_sepolicy := $(LOCAL_BUILT_MODULE)
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
all_cil_files :=
Add a checkfc utility to check file_contexts validity and invoke it. Change-Id: I4b12dc3dcb432edbdf95dd3bc97f809912ce86d1 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2012-10-02 18:46:37 +02:00
Remove unnecessary recovery-related targets Recovery should always use monolithic policy. Thus, we don't need split policy files *.recovery.cil. This commit removes these targets and rolls up the relevant parts of the targets into "sepolicy.recovery" which is the target which produces monolithic policy for recovery. Test: make clean && make sepolicy.recovery, then confirm that repolicy.recovery is identical to the one produced prior to this change. Test: Clean build, flash, device boots up fine, no new denials. Device also boots into recovery just fine, no denials. Bug: 31363362 Change-Id: I7f698abe1f17308f2f03f5ed1b727a8b071e94c7
2017-03-10 18:36:07 +01:00
#################################
include $(CLEAR_VARS)
# keep concrete sepolicy for neverallow checks
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
# If SELINUX_IGNORE_NEVERALLOWS is set, we use sed to remove the neverallow lines before compiling.
Remove unnecessary recovery-related targets Recovery should always use monolithic policy. Thus, we don't need split policy files *.recovery.cil. This commit removes these targets and rolls up the relevant parts of the targets into "sepolicy.recovery" which is the target which produces monolithic policy for recovery. Test: make clean && make sepolicy.recovery, then confirm that repolicy.recovery is identical to the one produced prior to this change. Test: Clean build, flash, device boots up fine, no new denials. Device also boots into recovery just fine, no denials. Bug: 31363362 Change-Id: I7f698abe1f17308f2f03f5ed1b727a8b071e94c7
2017-03-10 18:36:07 +01:00
LOCAL_MODULE := sepolicy.recovery
Targets for artifacts needed by recovery This ensures that SELinux policy artifact needed by recovery at runtime have targets in this build script. This is to make recoveryimage/bootimage targets depend on these artifacts explicitly, which reduces the element of surprise. Moreover, this enables us to move non-recovery artifacts around without affecting recovery artifacts. Test: Clean build, flash, device boots just fine, no new denials. Reboot to recovery, recovery boots just fine, no denials. This was tested on bullhead (non A/B device) and sailfish (A/B device). Bug: 33642277 Change-Id: I3c494d9d7fec5c4f487d38964e572757fcf67f57
2017-03-10 21:44:16 +01:00
LOCAL_MODULE_STEM := sepolicy
Remove unnecessary recovery-related targets Recovery should always use monolithic policy. Thus, we don't need split policy files *.recovery.cil. This commit removes these targets and rolls up the relevant parts of the targets into "sepolicy.recovery" which is the target which produces monolithic policy for recovery. Test: make clean && make sepolicy.recovery, then confirm that repolicy.recovery is identical to the one produced prior to this change. Test: Clean build, flash, device boots up fine, no new denials. Device also boots into recovery just fine, no denials. Bug: 31363362 Change-Id: I7f698abe1f17308f2f03f5ed1b727a8b071e94c7
2017-03-10 18:36:07 +01:00
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
Targets for artifacts needed by recovery This ensures that SELinux policy artifact needed by recovery at runtime have targets in this build script. This is to make recoveryimage/bootimage targets depend on these artifacts explicitly, which reduces the element of surprise. Moreover, this enables us to move non-recovery artifacts around without affecting recovery artifacts. Test: Clean build, flash, device boots just fine, no new denials. Reboot to recovery, recovery boots just fine, no denials. This was tested on bullhead (non A/B device) and sailfish (A/B device). Bug: 33642277 Change-Id: I3c494d9d7fec5c4f487d38964e572757fcf67f57
2017-03-10 21:44:16 +01:00
LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
Remove unnecessary recovery-related targets Recovery should always use monolithic policy. Thus, we don't need split policy files *.recovery.cil. This commit removes these targets and rolls up the relevant parts of the targets into "sepolicy.recovery" which is the target which produces monolithic policy for recovery. Test: make clean && make sepolicy.recovery, then confirm that repolicy.recovery is identical to the one produced prior to this change. Test: Clean build, flash, device boots up fine, no new denials. Device also boots into recovery just fine, no denials. Bug: 31363362 Change-Id: I7f698abe1f17308f2f03f5ed1b727a8b071e94c7
2017-03-10 18:36:07 +01:00
include $(BUILD_SYSTEM)/base_rules.mk
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
policy_files := $(call build_policy, $(sepolicy_build_files), \
$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) \
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
$(SYSTEM_EXT_PUBLIC_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY) \
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
$(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY) \
$(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) \
$(BOARD_ODM_SEPOLICY_DIRS))
Change recovery to static platform-only compilation. Recovery is not meant to be versioned in the treble model, but rather provided as part of the platform/framework component and self-sufficient. Simplify its compilation by removing the attribute versioning steps, but maintain device-specific policy, which is currently required for full functionality. Bug: 37240781 Bug: 36783775 Test: recovery boots and is able to select commands. Also tried: reboot system, boot to bootloader, factory reset, sideload, view logs, run graphics test, and power off. Change-Id: I637819844d9a8ea5b315404f4abd03e8f923303a
2017-04-11 16:38:48 +02:00
sepolicy.recovery.conf := $(intermediates)/sepolicy.recovery.conf
$(sepolicy.recovery.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
$(sepolicy.recovery.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Use user policy when checking neverallow rules. When building userdebug or eng builds, we still want to build the user policy when checking neverallow rules so that we can catch compile errors. Commit c0713e86 split out a helper function but lost one instance of using user instead of the real variant. This restores that one and adds it to the neverallow check. Bug: 74344625 Test: Added a rule that referred to a type defined only in userdebug and eng and ensure we throw a compile error when building userdebug mode. Change-Id: I1a6ffbb36dbeeb880852f9cbac880f923370c2ae (cherry picked from commit 053cb34130b763d93e2181062ebe1b5f8bf3ad9c)
2018-03-08 00:36:29 +01:00
$(sepolicy.recovery.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
Change recovery to static platform-only compilation. Recovery is not meant to be versioned in the treble model, but rather provided as part of the platform/framework component and self-sufficient. Simplify its compilation by removing the attribute versioning steps, but maintain device-specific policy, which is currently required for full functionality. Bug: 37240781 Bug: 36783775 Test: recovery boots and is able to select commands. Also tried: reboot system, boot to bootloader, factory reset, sideload, view logs, run graphics test, and power off. Change-Id: I637819844d9a8ea5b315404f4abd03e8f923303a
2017-04-11 16:38:48 +02:00
$(sepolicy.recovery.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
$(sepolicy.recovery.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
In native coverage builds, allow all domains to access /data/misc/trace Bug: http://b/135139675 Coverage files are written to /data/misc/trace (governed by the method_trace_data_file selinux type). Allow all domains to access (create directories, access files) this directory when native coverage is enabled (by setting NATIVE_COVERAGE to true) in an userdebug or eng build. Also relax neverallow constraints to allow access to method_trace_data_file for native coverage builds. Test: Build 32-bit cuttlefish with coverage: m NATIVE_COVERAGE=true COVERAGE_PATHS="*" and verify that there are no selinux denials in kernel log and logcat. Change-Id: I3fe7c77612854b9de7de7a0ddd5cbf44a2f5c21e
2019-06-14 00:05:15 +02:00
$(sepolicy.recovery.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
Change recovery to static platform-only compilation. Recovery is not meant to be versioned in the treble model, but rather provided as part of the platform/framework component and self-sufficient. Simplify its compilation by removing the attribute versioning steps, but maintain device-specific policy, which is currently required for full functionality. Bug: 37240781 Bug: 36783775 Test: recovery boots and is able to select commands. Also tried: reboot system, boot to bootloader, factory reset, sideload, view logs, run graphics test, and power off. Change-Id: I637819844d9a8ea5b315404f4abd03e8f923303a
2017-04-11 16:38:48 +02:00
$(sepolicy.recovery.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Add sepolicy definitions.mk and create policy.conf function. Bug: 36899958 Test: Builds 'n' boots. Change-Id: I5836a18f9d0a9a976dda7304045e3b9e1e84565e Merged-In: I5836a18f9d0a9a976dda7304045e3b9e1e84565e (cherry picked from commit c0713e86790583dacbd8545d35ae476ff1f849bb)
2017-07-07 23:59:51 +02:00
$(sepolicy.recovery.conf): PRIVATE_TGT_RECOVERY := -D target_recovery=true
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
$(sepolicy.recovery.conf): PRIVATE_POLICY_FILES := $(policy_files)
$(sepolicy.recovery.conf): $(policy_files) $(M4)
Add sepolicy definitions.mk and create policy.conf function. Bug: 36899958 Test: Builds 'n' boots. Change-Id: I5836a18f9d0a9a976dda7304045e3b9e1e84565e Merged-In: I5836a18f9d0a9a976dda7304045e3b9e1e84565e (cherry picked from commit c0713e86790583dacbd8545d35ae476ff1f849bb)
2017-07-07 23:59:51 +02:00
$(transform-policy-to-conf)
Fix building error for multi-line dontaudit statement All the *.conf.dontaudit files are generated from *.conf with the command of 'sed '/dontaudit/d' $@ > $@.dontaudit', but this command can not be applied to multi-line dontaudit statement. Test: Set plat_policy.conf.dontaudit as the input_file parameter of checkpolicy tool, then selinux syntax error will occur during building. Change-Id: I281de923d8a5f0b46256ec7de4df12a1c1d7e061
2018-09-13 08:04:19 +02:00
$(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
ifeq ($(SELINUX_IGNORE_NEVERALLOWS),true)
$(hide) sed -z 's/\n\s*neverallow[^;]*;/\n/g' $@ > $@.neverallow
$(hide) mv $@.neverallow $@
endif
Switch recovery to versioned policy and split into components. And do some clean up: Replace LOCAL_TARGET_ARCH with global arch specifier that won't get clobbered, clean up sepolicy.recovery's eng specification, ensure that build macros are applied across all policy generation, not just plat_policy, and make sure that all private variables are cleared and alphabetized at the end. Bug: 31363362 Bug: 31369363 Test: Boot into recovery and observe no selinux denials. Change-Id: Ibc15b097f6d19acf01f6b22bee0e083b15f4ef75
2016-12-16 00:28:44 +01:00
Change recovery to static platform-only compilation. Recovery is not meant to be versioned in the treble model, but rather provided as part of the platform/framework component and self-sufficient. Simplify its compilation by removing the attribute versioning steps, but maintain device-specific policy, which is currently required for full functionality. Bug: 37240781 Bug: 36783775 Test: recovery boots and is able to select commands. Also tried: reboot system, boot to bootloader, factory reset, sideload, view logs, run graphics test, and power off. Change-Id: I637819844d9a8ea5b315404f4abd03e8f923303a
2017-04-11 16:38:48 +02:00
$(LOCAL_BUILT_MODULE): $(sepolicy.recovery.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
$(HOST_OUT_EXECUTABLES)/sepolicy-analyze
Switch recovery to versioned policy and split into components. And do some clean up: Replace LOCAL_TARGET_ARCH with global arch specifier that won't get clobbered, clean up sepolicy.recovery's eng specification, ensure that build macros are applied across all policy generation, not just plat_policy, and make sure that all private variables are cleared and alphabetized at the end. Bug: 31363362 Bug: 31369363 Test: Boot into recovery and observe no selinux denials. Change-Id: Ibc15b097f6d19acf01f6b22bee0e083b15f4ef75
2016-12-16 00:28:44 +01:00
@mkdir -p $(dir $@)
Sepolicy: Disable leak sanitizer for checkpolicy Temporary workaround. Bug: 37755687 Test: ASAN_OPTIONS= SANITIZE_HOST=address m Change-Id: I001a42ea6463a1e137e1f5328755596f986323de
2017-04-28 02:16:13 +02:00
$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c \
$(POLICYVERS) -o $@.tmp $<
Don't allow permissive SELinux domains on user builds. It's a CTS requirement that all SELinux domains be in enforcing mode. Add the same assertion to the build system when targeting user builds. In particular, this avoids a situation where device integrity checking is enabled on user builds, but permissive denials are being generated, causing the device to unexpectedly reboot into safe mode. A developer wanting to put an SELinux domain into permissive mode for userdebug/eng purposes can write the following in their policy: userdebug_or_eng(` permissive foo; ') Bug: 26902605 Bug: 27313768 Change-Id: Ic0971d9e96a28f2a98f9d56a547661d24fb81a21
2016-02-27 05:06:52 +01:00
$(hide) $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $@.tmp permissive > $@.permissivedomains
$(hide) if [ "$(TARGET_BUILD_VARIANT)" = "user" -a -s $@.permissivedomains ]; then \
echo "==========" 1>&2; \
echo "ERROR: permissive domains not allowed in user builds" 1>&2; \
echo "List of invalid domains:" 1>&2; \
cat $@.permissivedomains 1>&2; \
exit 1; \
fi
$(hide) mv $@.tmp $@
Create a separate recovery policy. Create a separate recovery policy and only include the recovery domain allow rules in it. Change-Id: I444107f9821eabf4164ba07a44d03bd71e719989 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-05-29 22:40:15 +02:00
Change recovery to static platform-only compilation. Recovery is not meant to be versioned in the treble model, but rather provided as part of the platform/framework component and self-sufficient. Simplify its compilation by removing the attribute versioning steps, but maintain device-specific policy, which is currently required for full functionality. Bug: 37240781 Bug: 36783775 Test: recovery boots and is able to select commands. Also tried: reboot system, boot to bootloader, factory reset, sideload, view logs, run graphics test, and power off. Change-Id: I637819844d9a8ea5b315404f4abd03e8f923303a
2017-04-11 16:38:48 +02:00
sepolicy.recovery.conf :=
Create a separate recovery policy. Create a separate recovery policy and only include the recovery domain allow rules in it. Change-Id: I444107f9821eabf4164ba07a44d03bd71e719989 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-05-29 22:40:15 +02:00
Preserve treble-only flag for CTS neverallows CTS includes general_sepolicy.conf built from this project. CTS then tests this file's neverallow rules against the policy of the device under test. Prior to this commit, neverallow rules which must be enforced only for Treble devices we not included into general_sepolicy.conf. As a result, these rules were not enforced for Treble devices. This commit fixes the issue as follows. Because CTS includes only one policy, the policy now contains also the rules which are only for Treble devices. To enable CTS to distinguish rules needed for all devices from rules needed only on Treble devices, the latter rules are contained in sections delimited with BEGIN_TREBLE_ONLY and END_TREBLE_ONLY comments. This commit also removes the unnecessary sepolicy.general target. This target is not used anywhere and is causing trouble because it is verifying neverallows of the policy meant to be used by CTS. This policy can no longer be verified with checkpolicy without conditionally including or excluding Treble-only neverallows. Test: mmm system/sepolicy Test: Device boots -- no new denials Bug: 37082262 Change-Id: I15172a7efd9374543ba521e17aead1bdda7451bf
2017-04-06 23:45:50 +02:00
##################################
# SELinux policy embedded into CTS.
# CTS checks neverallow rules of this policy against the policy of the device under test.
Generate selinux_policy.xml as part of CTS build. Bug: 16563899 Bug: 14251916 Change-Id: Id3172b73f10186ba361caf6b7333e5d2a0648475
2014-07-26 04:11:52 +02:00
##################################
include $(CLEAR_VARS)
LOCAL_MODULE := general_sepolicy.conf
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := tests
include $(BUILD_SYSTEM)/base_rules.mk
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
policy_files := $(call build_policy, $(sepolicy_build_files), \
$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY))
Generate selinux_policy.xml as part of CTS build. Bug: 16563899 Bug: 14251916 Change-Id: Id3172b73f10186ba361caf6b7333e5d2a0648475
2014-07-26 04:11:52 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_MLS_SENS := $(MLS_SENS)
$(LOCAL_BUILT_MODULE): PRIVATE_MLS_CATS := $(MLS_CATS)
Use user policy when checking neverallow rules. When building userdebug or eng builds, we still want to build the user policy when checking neverallow rules so that we can catch compile errors. Commit c0713e86 split out a helper function but lost one instance of using user instead of the real variant. This restores that one and adds it to the neverallow check. Bug: 74344625 Test: Added a rule that referred to a type defined only in userdebug and eng and ensure we throw a compile error when building userdebug mode. Change-Id: I1a6ffbb36dbeeb880852f9cbac880f923370c2ae (cherry picked from commit 053cb34130b763d93e2181062ebe1b5f8bf3ad9c)
2018-03-08 00:36:29 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_TARGET_BUILD_VARIANT := user
Switch recovery to versioned policy and split into components. And do some clean up: Replace LOCAL_TARGET_ARCH with global arch specifier that won't get clobbered, clean up sepolicy.recovery's eng specification, ensure that build macros are applied across all policy generation, not just plat_policy, and make sure that all private variables are cleared and alphabetized at the end. Bug: 31363362 Bug: 31369363 Test: Boot into recovery and observe no selinux denials. Change-Id: Ibc15b097f6d19acf01f6b22bee0e083b15f4ef75
2016-12-16 00:28:44 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_TGT_ARCH := $(my_target_arch)
Add sepolicy definitions.mk and create policy.conf function. Bug: 36899958 Test: Builds 'n' boots. Change-Id: I5836a18f9d0a9a976dda7304045e3b9e1e84565e Merged-In: I5836a18f9d0a9a976dda7304045e3b9e1e84565e (cherry picked from commit c0713e86790583dacbd8545d35ae476ff1f849bb)
2017-07-07 23:59:51 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_WITH_ASAN := false
Use PRODUCT_SEPOLICY_SPLIT for full Treble. PRODUCT_FULL_TREBLE is being broken up into smaller, more manageable components. Bug: 62019611 Test: manual Change-Id: I9b65f120851d9ea134a0059a417f0282777717fc
2017-11-09 20:24:56 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY_SPLIT := cts
Add tests for compatible property (1/2) The feature of compatible property has its own neverallow rules and it is enforced on devices launchig with Android P. This CL changes hal_nfc to hal_nfc_server in neverallow rules because sepolicy-analyze doesn't recognize it. Additionally one more neverallow rule is added to restrict reading nfc_prop. Bug: 72013705 Bug: 72678352 Test: 'run cts -m CtsSecurityHostTestCases' on walleye with ro.product.first_api_level=28 Change-Id: I753cc81f7ca0e4ad6a2434b2a047052678f57671
2018-01-30 09:23:58 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_COMPATIBLE_PROPERTY := cts
Add BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW A new sysprop neverallow rules are mandatory only for devices launching with R or later. For devices already launched, neverallow rules can be relaxed with adding following line to BoardConfig.mk: BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true Bug: 131162102 Test: Set PRODUCT_SHIPPING_API_LEVEL := 30 and try building with changing some system_public_prop to system_internal_prop Test: m cts sepolicy_tests Change-Id: Id978b4d81a8683a57304bb639961105e2d91fa9a Merged-In: Id978b4d81a8683a57304bb639961105e2d91fa9a (cherry picked from commit 3be11e7abb8f4fd651295f9ccb0ce087855c1cc0)
2019-09-26 08:14:55 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := cts
Enforce sysprop owner Every property should have an appropriate owner attribute, which can be one of: system_property_type, product_property_type, or vendor_property_type. This will be enforced for devices launching with S or later. Devices launching with R or eariler can relax this by setting following under BoardConfig.mk: BUILD_BROKEN_ENFORCE_SYSPROP_OWNER := true Bug: 131162102 Test: system/sepolicy/tools/build_policies.sh Change-Id: I7914ef1b7463c9ec00812b9720094531fd63f0c7
2020-09-28 06:32:43 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_ENFORCE_SYSPROP_OWNER := cts
Mechanism to exclude neverallows from *TS. build_test_only is used to denote rules that should not verified as part of compliance testing. Use this macro to exclude neverallow rules which we want to check as part of build, but not CTS. Bug: 80499271 Test: SELinuxNeverallowRulesTest on walleye has no more failure of type "Type or attribute * used in neverallow undefined in policy being checked." Number of failing test cases is reduced by 142. Test: policy.conf used to check neverallows at build-time still retains all neverallow rules. Change-Id: I5f1b383d9096bb5a7b8c0f1bc008b5dd07419580
2018-06-05 23:11:08 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_EXCLUDE_BUILD_TEST := true
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_POLICY_FILES := $(policy_files)
$(LOCAL_BUILT_MODULE): $(policy_files) $(M4)
Add sepolicy definitions.mk and create policy.conf function. Bug: 36899958 Test: Builds 'n' boots. Change-Id: I5836a18f9d0a9a976dda7304045e3b9e1e84565e Merged-In: I5836a18f9d0a9a976dda7304045e3b9e1e84565e (cherry picked from commit c0713e86790583dacbd8545d35ae476ff1f849bb)
2017-07-07 23:59:51 +02:00
$(transform-policy-to-conf)
Fix building error for multi-line dontaudit statement All the *.conf.dontaudit files are generated from *.conf with the command of 'sed '/dontaudit/d' $@ > $@.dontaudit', but this command can not be applied to multi-line dontaudit statement. Test: Set plat_policy.conf.dontaudit as the input_file parameter of checkpolicy tool, then selinux syntax error will occur during building. Change-Id: I281de923d8a5f0b46256ec7de4df12a1c1d7e061
2018-09-13 08:04:19 +02:00
$(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
Generate selinux_policy.xml as part of CTS build. Bug: 16563899 Bug: 14251916 Change-Id: Id3172b73f10186ba361caf6b7333e5d2a0648475
2014-07-26 04:11:52 +02:00
use a general sepolicy when building general targets Change-Id: Ie800ebf9d8e68680ec377e8c51f7cd7717f3c755 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-30 01:31:23 +02:00
##################################
Split file_contexts for on-device compilation. Simulate platform and non-platform split by compiling two different file_contexts files and loading them together on-device. Leave the existing file_contexts.bin in place until we're ready to build images based on the new files. Bug: 31363362 Test: Builds and boots without additional denials. Change-Id: I7248f876e2230cee3b3cbf386422063da1e3dde0 Bring back file_contexts.bin. Change-Id: Ifec2c363579151080fdec48e8bc46bbbc8c97674 Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-12-12 18:29:04 +01:00
# TODO - remove this. Keep around until we get the filesystem creation stuff taken care of.
#
use a general sepolicy when building general targets Change-Id: Ie800ebf9d8e68680ec377e8c51f7cd7717f3c755 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-30 01:31:23 +02:00
include $(CLEAR_VARS)
Update Android.mk to support file_contexts.bin This change supports external/libselinux changes to implement PCRE formatted binary file_contexts and general_file_contexts.bin files. The $(intermediates) directory will contain the original text file (that is no longer used on the device) with a .tmp extension as well as the .bin file to aid analysis. A CleanSpec.mk file is added to remove the old file_contexts file. Change-Id: I75a781100082c23536f70ce3603f7de42408b5ba Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-08-06 18:43:52 +02:00
LOCAL_MODULE := file_contexts.bin
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Add support for per-device .te and .fc files.
2012-03-06 17:12:41 +01:00
include $(BUILD_SYSTEM)/base_rules.mk
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: I3775eae11bfa5905cad0d02a0bf26c76ac03437c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
# The file_contexts.bin is built in the following way:
# 1. Collect all file_contexts files in THIS repository and process them with
# m4 into a tmp file called file_contexts.local.tmp.
Use file_contexts files for flattened APEXes Previously, soong emitted APEX_FILE_CONTEXTS_INFOS make var which lists "all" APEXes and file_contexts.bin used all of them regardless whether an APEX is installed or not. This doesn't work when there's a vendor specific APEX which uses vendor specific labels. Other lunch target may fail to build due to "unknown label" which is introduced by the vendor APEX which is fact not supposed to be installed. Now build/make/core/Makefile creates file_contexts.modules.tmp which is a collection of file_contexts for flattend apexes which are to be intalled. Bug: 166518492 Test: m file_contexts.bin check contents of file_contexts.concat.tmp Change-Id: I00c6b87bdc75fc1e04e6f8ecddae6f18762d888a
2020-09-23 12:16:10 +02:00
# 2. Collect all file_contexts files from LOCAL_FILE_CONTEXTS of installed
# modules with m4 with a tmp file called file_contexts.modules.tmp.
# 3. Collect all device specific file_contexts files and process them with m4
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: I3775eae11bfa5905cad0d02a0bf26c76ac03437c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
# into a tmp file called file_contexts.device.tmp.
Use file_contexts files for flattened APEXes Previously, soong emitted APEX_FILE_CONTEXTS_INFOS make var which lists "all" APEXes and file_contexts.bin used all of them regardless whether an APEX is installed or not. This doesn't work when there's a vendor specific APEX which uses vendor specific labels. Other lunch target may fail to build due to "unknown label" which is introduced by the vendor APEX which is fact not supposed to be installed. Now build/make/core/Makefile creates file_contexts.modules.tmp which is a collection of file_contexts for flattend apexes which are to be intalled. Bug: 166518492 Test: m file_contexts.bin check contents of file_contexts.concat.tmp Change-Id: I00c6b87bdc75fc1e04e6f8ecddae6f18762d888a
2020-09-23 12:16:10 +02:00
# 4. Run checkfc -e (allow no device fc entries ie empty) and fc_sort on
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: I3775eae11bfa5905cad0d02a0bf26c76ac03437c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
# file_contexts.device.tmp and output to file_contexts.device.sorted.tmp.
Use file_contexts files for flattened APEXes Previously, soong emitted APEX_FILE_CONTEXTS_INFOS make var which lists "all" APEXes and file_contexts.bin used all of them regardless whether an APEX is installed or not. This doesn't work when there's a vendor specific APEX which uses vendor specific labels. Other lunch target may fail to build due to "unknown label" which is introduced by the vendor APEX which is fact not supposed to be installed. Now build/make/core/Makefile creates file_contexts.modules.tmp which is a collection of file_contexts for flattend apexes which are to be intalled. Bug: 166518492 Test: m file_contexts.bin check contents of file_contexts.concat.tmp Change-Id: I00c6b87bdc75fc1e04e6f8ecddae6f18762d888a
2020-09-23 12:16:10 +02:00
# 5. Concatenate file_contexts.local.tmp, file_contexts.modules.tmp and
# file_contexts.device.tmp into file_contexts.concat.tmp.
# 6. Run checkfc and sefcontext_compile on file_contexts.concat.tmp to produce
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: I3775eae11bfa5905cad0d02a0bf26c76ac03437c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
# file_contexts.bin.
#
# Note: That a newline file is placed between each file_context file found to
# ensure a proper build when an fc file is missing an ending newline.
Add BOARD_PLAT_[PUBLIC|PRIVATE]_SEPOLICY_DIRS Add new build variables for partner customization (additions) to platform sepolicy. This allows partners to add their own policy without having to touch the AOSP sepolicy directories and potentially disrupting compatibility with an AOSP system image. Bug: 36467375 Test: Add public and private files to sailfish policy and verify that they are added to the appropriate policy files, but that the policy is otherwise identical. Also add private/mapping/*.cil files in both locations and change the BOARD_SEPOLICY_VERS to trigger use of prebuilt mapping files and verify that they are appropriately combined and built in policy. Change-Id: I38efe2248520804a123603bb050bba75563fe45c Merged-In: I38efe2248520804a123603bb050bba75563fe45c (cherry picked from commit f893700c73f2e4e13385f11edcacf563f59b63c5)
2017-05-08 23:26:52 +02:00
local_fc_files := $(call build_policy, file_contexts, $(PLAT_PRIVATE_POLICY))
Allowing system_ext sepolicy to be empty Some targets just need to extend system_ext context files, e.g., file_contexts, service_contexts, etc., without adding any system_ext policy files, e.g., *.te files. Currently, this will lead to build errors. This CL allows system_ext_sepolicy.cil and the system_ext mapping file to be empty. It's now also possible to just set BOARD_PLAT_PRIVATE_SEPOLICY_DIR without setting BOARD_PLAT_PUBLIC_SEPOLICY_DIR. Bug: 137712473 Bug: 141880898 Test: Only adds system_ext context files without policy files (e.g., *.te), then `mmma system/sepolicy` can build pass Change-Id: I72849f2d4aa43e5296cd15c07a8fd058186a6376
2019-10-04 08:34:18 +02:00
ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR
Separate system_ext_file_contexts out of system sepolicy. Bug: 137712473 Test: boot crosshatch Change-Id: I09f63771d08ad18fb41fca801dd587b086be58c7
2019-09-09 16:04:06 +02:00
local_fc_files += $(call build_policy, file_contexts, $(SYSTEM_EXT_PRIVATE_POLICY))
endif
Allowing product sepolicy to be empty Some targets just need to extend product context files, e.g., file_contexts, service_contexts, etc., without adding any product-specific policy files, e.g., *.te files. Or just need to add private product sepolicy without adding public product sepolicy. Currently, this will lead to build errors. This CL allows product_sepolicy.cil and the product mapping file to be empty. It's now also possible to just set PRODUCT_PRIVATE_POLICY without setting PRODUCT_PUBLIC_POLICY. Bug: 131193755 Test: Only adds product private sepolicy, then `mmma system/sepolicy` Change-Id: Ifed5af7413b2a1e20a0628518582615708c8c31a
2019-10-04 09:36:05 +02:00
ifdef HAS_PRODUCT_SEPOLICY_DIR
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
local_fc_files += $(call build_policy, file_contexts, $(PRODUCT_PRIVATE_POLICY))
endif
asan: update condition to work with multiple SANITIZE_TARGET values. The goal is to enable SANITIZE_TARGET='address coverage', which will be used by LLVMFuzzer. Bug: 22850550 Change-Id: I953649186a7fae9b2495159237521f264d1de3b6
2015-09-18 21:05:51 +02:00
ifneq ($(filter address,$(SANITIZE_TARGET)),)
fs_mgr: add overlayfs handling for squashfs system filesystems /cache/overlay directory in support of overlayfs mounts on userdebug and eng devices. Overlayfs in turn can be capable of supporting adb remount for read-only or restricted-storage filesystems like squashfs or right-sized (zero free space) system partitions respectively. Test: compile Bug: 109821005 Bug: 110985612 Change-Id: I3ece03886db7cc97f864497cf93ec6c6c39bccd1
2018-06-13 17:02:29 +02:00
local_fc_files += $(wildcard $(addsuffix /file_contexts_asan, $(PLAT_PRIVATE_POLICY)))
endif
ifneq (,$(filter userdebug eng,$(TARGET_BUILD_VARIANT)))
local_fc_files += $(wildcard $(addsuffix /file_contexts_overlayfs, $(PLAT_PRIVATE_POLICY)))
Extend sepolicy for SANITIZE_TARGET. SANITIZE_TARGET adds shared libraries in /data/lib. Bug: 21785137 Change-Id: I8ac3d059d88d57d24ed762ffc6202a4ce5a42333
2015-06-13 02:18:20 +02:00
endif
Make file_contexts as "android:path" property Till now, file_contexts has been treated differently that other input src files. Now it is tagged as `android:"path"` because it is. Bug: 144732805 Test: m Change-Id: I6b22a8d22417b75c5cb8cd3b2e534d67e958b074
2019-11-20 09:54:34 +01:00
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: I3775eae11bfa5905cad0d02a0bf26c76ac03437c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
file_contexts.local.tmp := $(intermediates)/file_contexts.local.tmp
Use file_contexts files for flattened APEXes Previously, soong emitted APEX_FILE_CONTEXTS_INFOS make var which lists "all" APEXes and file_contexts.bin used all of them regardless whether an APEX is installed or not. This doesn't work when there's a vendor specific APEX which uses vendor specific labels. Other lunch target may fail to build due to "unknown label" which is introduced by the vendor APEX which is fact not supposed to be installed. Now build/make/core/Makefile creates file_contexts.modules.tmp which is a collection of file_contexts for flattend apexes which are to be intalled. Bug: 166518492 Test: m file_contexts.bin check contents of file_contexts.concat.tmp Change-Id: I00c6b87bdc75fc1e04e6f8ecddae6f18762d888a
2020-09-23 12:16:10 +02:00
$(call merge-fc-files,$(local_fc_files),$(file_contexts.local.tmp))
# The rule for file_contexts.modules.tmp is defined in build/make/core/Makefile.
# it gathers LOCAL_FILE_CONTEXTS from product_MODULES
file_contexts.modules.tmp := $(intermediates)/file_contexts.modules.tmp
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: I3775eae11bfa5905cad0d02a0bf26c76ac03437c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
device_fc_files := $(call build_vendor_policy, file_contexts)
Add /odm/etc/selinux/odm_file_contexts Bug: 64240127 Test: normal boot and recovery boot a device Change-Id: I087292fb23d05fc17272778d668ac78a721b2593
2017-11-29 09:14:53 +01:00
ifdef BOARD_ODM_SEPOLICY_DIRS
device_fc_files += $(call build_odm_policy, file_contexts)
endif
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: I3775eae11bfa5905cad0d02a0bf26c76ac03437c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
file_contexts.device.tmp := $(intermediates)/file_contexts.device.tmp
$(file_contexts.device.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
$(file_contexts.device.tmp): PRIVATE_DEVICE_FC_FILES := $(device_fc_files)
$(file_contexts.device.tmp): $(device_fc_files) $(M4)
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: I3775eae11bfa5905cad0d02a0bf26c76ac03437c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
@mkdir -p $(dir $@)
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
$(hide) $(M4) --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_DEVICE_FC_FILES) > $@
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: I3775eae11bfa5905cad0d02a0bf26c76ac03437c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
file_contexts.device.sorted.tmp := $(intermediates)/file_contexts.device.sorted.tmp
$(file_contexts.device.sorted.tmp): PRIVATE_SEPOLICY := $(built_sepolicy)
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
$(file_contexts.device.sorted.tmp): $(file_contexts.device.tmp) $(built_sepolicy) \
$(HOST_OUT_EXECUTABLES)/fc_sort $(HOST_OUT_EXECUTABLES)/checkfc
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: I3775eae11bfa5905cad0d02a0bf26c76ac03437c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
@mkdir -p $(dir $@)
Restore checkfc and neverallow checks. Bug: 33388095 Test: Builds and boots. Change-Id: Ief9064a16fc733bed54eb76f509ff5aaf5db4baf
2016-12-07 20:27:47 +01:00
$(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e $(PRIVATE_SEPOLICY) $<
fc_sort: delete c version, migrate to python version Test: build aosp_blueline-userdebug, run build-time tests Change-Id: I9c466cd718602e6068ee31abd6de7dbab84f4949
2019-04-11 01:53:17 +02:00
$(hide) $(HOST_OUT_EXECUTABLES)/fc_sort -i $< -o $@
Add a checkfc utility to check file_contexts validity and invoke it. Change-Id: I4b12dc3dcb432edbdf95dd3bc97f809912ce86d1 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2012-10-02 18:46:37 +02:00
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: I3775eae11bfa5905cad0d02a0bf26c76ac03437c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
file_contexts.concat.tmp := $(intermediates)/file_contexts.concat.tmp
Use file_contexts files for flattened APEXes Previously, soong emitted APEX_FILE_CONTEXTS_INFOS make var which lists "all" APEXes and file_contexts.bin used all of them regardless whether an APEX is installed or not. This doesn't work when there's a vendor specific APEX which uses vendor specific labels. Other lunch target may fail to build due to "unknown label" which is introduced by the vendor APEX which is fact not supposed to be installed. Now build/make/core/Makefile creates file_contexts.modules.tmp which is a collection of file_contexts for flattend apexes which are to be intalled. Bug: 166518492 Test: m file_contexts.bin check contents of file_contexts.concat.tmp Change-Id: I00c6b87bdc75fc1e04e6f8ecddae6f18762d888a
2020-09-23 12:16:10 +02:00
$(call merge-fc-files,\
$(file_contexts.local.tmp) $(file_contexts.modules.tmp) $(file_contexts.device.sorted.tmp),\
$(file_contexts.concat.tmp))
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
file_contexts: don't delete intermediate on failure Currently, if an error is detected in a file_contexts file, the intermediate file_context.tmp file is removed, thus making debugging of build issues problematic. Instead, employ checkfc tool during the compilation recipe so the m4 concatenated intermediate is preserved on failure. Change-Id: Ic827385d3bc3434b6c2a9bba5313cd42b5f15599 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-25 19:18:44 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: I3775eae11bfa5905cad0d02a0bf26c76ac03437c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
$(LOCAL_BUILT_MODULE): $(file_contexts.concat.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/sefcontext_compile $(HOST_OUT_EXECUTABLES)/checkfc
Update Android.mk to support file_contexts.bin This change supports external/libselinux changes to implement PCRE formatted binary file_contexts and general_file_contexts.bin files. The $(intermediates) directory will contain the original text file (that is no longer used on the device) with a .tmp extension as well as the .bin file to aid analysis. A CleanSpec.mk file is added to remove the old file_contexts file. Change-Id: I75a781100082c23536f70ce3603f7de42408b5ba Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-08-06 18:43:52 +02:00
@mkdir -p $(dir $@)
Restore checkfc and neverallow checks. Bug: 33388095 Test: Builds and boots. Change-Id: Ief9064a16fc733bed54eb76f509ff5aaf5db4baf
2016-12-07 20:27:47 +01:00
$(hide) $(HOST_OUT_EXECUTABLES)/checkfc $(PRIVATE_SEPOLICY) $<
Update Android.mk to support file_contexts.bin This change supports external/libselinux changes to implement PCRE formatted binary file_contexts and general_file_contexts.bin files. The $(intermediates) directory will contain the original text file (that is no longer used on the device) with a .tmp extension as well as the .bin file to aid analysis. A CleanSpec.mk file is added to remove the old file_contexts file. Change-Id: I75a781100082c23536f70ce3603f7de42408b5ba Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-08-06 18:43:52 +02:00
$(hide) $(HOST_OUT_EXECUTABLES)/sefcontext_compile -o $@ $<
Build the selinux_version file. The selinux_version file is used to perform policy versioning checks by libselinux and SELinuxMMAC. When loading policy a check is first performed to determine if the policy out in /data/security/current should be used to override the base policy shipped with the device. The selinux_version file is used to make that choice. The contents of the file simply contains the BUILD_FINGERPRINT that the policy was built against. A simple string comparison is then performed by libselinux and SELinuxMMAC. Change-Id: I69d9d071743cfd46bb247c98f94a193396f8ebbd Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-03-20 14:35:08 +01:00
built_fc := $(LOCAL_BUILT_MODULE)
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: I3775eae11bfa5905cad0d02a0bf26c76ac03437c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
local_fc_files :=
local_fcfiles_with_nl :=
device_fc_files :=
device_fcfiles_with_nl :=
file_contexts.concat.tmp :=
file_contexts.device.sorted.tmp :=
file_contexts.device.tmp :=
file_contexts.local.tmp :=
Use file_contexts files for flattened APEXes Previously, soong emitted APEX_FILE_CONTEXTS_INFOS make var which lists "all" APEXes and file_contexts.bin used all of them regardless whether an APEX is installed or not. This doesn't work when there's a vendor specific APEX which uses vendor specific labels. Other lunch target may fail to build due to "unknown label" which is introduced by the vendor APEX which is fact not supposed to be installed. Now build/make/core/Makefile creates file_contexts.modules.tmp which is a collection of file_contexts for flattend apexes which are to be intalled. Bug: 166518492 Test: m file_contexts.bin check contents of file_contexts.concat.tmp Change-Id: I00c6b87bdc75fc1e04e6f8ecddae6f18762d888a
2020-09-23 12:16:10 +02:00
file_contexts.modules.tmp :=
per device seapp_context support
2012-08-16 19:55:05 +02:00
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
##################################
include $(CLEAR_VARS)
LOCAL_MODULE := selinux_denial_metadata
LOCAL_MODULE_CLASS := ETC
Move selinux_denial_metadata to /vendor. selinux_denial_metadate is an concatenation of different bug maps on the device, including vendor one. This file is only used for debugging, so we simply move it to /vendor instead of splitting it up. /vendor/etc/selinux/selinux_denial_metadata has vendor_configs_file selinux type, which is logd readable. Bug: 5159394 Test: bug information is still preserved in avc logs, e.g. audit(0.0:248): avc: denied { read } for name="u:object_r:vendor_default_prop:s0" dev="tmpfs" ino=18012 scontext=u:r:platform_app:s0:c512,c768 tcontext=u:object_r:vendor_default_prop:s0 tclass=file permissive=0 b/79617173 app=com.android.systemui Change-Id: Id5eb9abd3bdeed92feb2aca40880903533468d50
2019-01-23 18:47:05 +01:00
LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
include $(BUILD_SYSTEM)/base_rules.mk
Use BOARD_VENDOR_SEPOLICY_DIRS instead of BOARD_SEPOLICY_DIRS bug_map is not picked up correctly when BOARD_VENDOR_SEPOLICY_DIRS is used. And BOARD_SEPOLICY_DIRS is deprecated. Test: m selinux_policy Change-Id: I1dcc6ac6f7b6d0f41f29d5894bef81f3fbf841e6
2019-06-07 02:09:29 +02:00
bug_files := $(call build_policy, bug_map, $(LOCAL_PATH) $(PLAT_PRIVATE_POLICY) $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(PLAT_PUBLIC_POLICY))
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
$(LOCAL_BUILT_MODULE) : $(bug_files)
@mkdir -p $(dir $@)
cat $^ > $@
bug_files :=
Targets for artifacts needed by recovery This ensures that SELinux policy artifact needed by recovery at runtime have targets in this build script. This is to make recoveryimage/bootimage targets depend on these artifacts explicitly, which reduces the element of surprise. Moreover, this enables us to move non-recovery artifacts around without affecting recovery artifacts. Test: Clean build, flash, device boots just fine, no new denials. Reboot to recovery, recovery boots just fine, no denials. This was tested on bullhead (non A/B device) and sailfish (A/B device). Bug: 33642277 Change-Id: I3c494d9d7fec5c4f487d38964e572757fcf67f57
2017-03-10 21:44:16 +01:00
##################################
sepolicy: refactor Android.mk system/sepolicy/Android.mk has become too large (~2k lines) and hard to navigate. This patch reorganizes build rules for convenience. No functional changes are made. Test: m selinux_policy Change-Id: I9a022b223b2387a4475da6d8209d561bfea228fb
2019-01-08 01:43:31 +01:00
include $(LOCAL_PATH)/seapp_contexts.mk
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
Separate product_service_contexts out of system sepolicy. Bug: 119305624 Test: normal/recovery boot aosp_taimen Change-Id: I15aa275fa658b58f5a5d3e651d164f9fcd87c0af
2018-12-21 21:28:14 +01:00
##################################
Build contexts files with Soong This is to migrate sepolicy Makefiles into Soong. For the first part, file_contexts, hwservice_contexts, property_contexts, and service_contexts are migrated. Build-time tests for contexts files are still in Makefile; they will also be done with Soong after porting the module sepolicy. The motivation of migrating is based on generating property_contexts dynamically: if we were to amend contexts files at build time in the future, it would be nicer to manage them in Soong. To do that, building contexts files with Soong can be very helpful. Bug: 127949646 Bug: 129377144 Test: 1) Build blueline-userdebug, flash, and boot. Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash, and boot. Test: 3) Build aosp_arm-userdebug. Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
include $(LOCAL_PATH)/contexts_tests.mk
Add hwservice_contexts and support for querying it. hwservicemanager can check hwservice_contexts files both from the framework and vendor partitions. Initially, have a wildcard '*' in hwservice_contexts that maps to a label that can be added/found from domain. This needs to be removed when the proper policy is in place. Also, grant su/shell access to hwservicemanager list operations, so tools like 'lshal' continue to work. Bug: 34454312 Test: Marlin boots Change-Id: I3a02d97a82458692b528d85c1b8e78b6f82ea1bc
2017-04-08 01:14:43 +02:00
##################################
include $(CLEAR_VARS)
Add target for vndservice_contexts. So we can limit vndservicemanager access to just vndservice_contexts. Bug: 36052864 Test: servicemanager,vndservicemanager work Change-Id: I7b132d4f616ba1edd0daf7be750d4b7174c4e188
2017-04-01 02:29:53 +02:00
LOCAL_MODULE := vndservice_contexts
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
include $(BUILD_SYSTEM)/base_rules.mk
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
vnd_svcfiles := $(call build_policy, vndservice_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
Add target for vndservice_contexts. So we can limit vndservicemanager access to just vndservice_contexts. Bug: 36052864 Test: servicemanager,vndservicemanager work Change-Id: I7b132d4f616ba1edd0daf7be750d4b7174c4e188
2017-04-01 02:29:53 +02:00
vndservice_contexts.tmp := $(intermediates)/vndservice_contexts.tmp
$(vndservice_contexts.tmp): PRIVATE_SVC_FILES := $(vnd_svcfiles)
$(vndservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
$(vndservice_contexts.tmp): $(vnd_svcfiles) $(M4)
Add target for vndservice_contexts. So we can limit vndservicemanager access to just vndservice_contexts. Bug: 36052864 Test: servicemanager,vndservicemanager work Change-Id: I7b132d4f616ba1edd0daf7be750d4b7174c4e188
2017-04-01 02:29:53 +02:00
@mkdir -p $(dir $@)
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
$(hide) $(M4) --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
Add target for vndservice_contexts. So we can limit vndservicemanager access to just vndservice_contexts. Bug: 36052864 Test: servicemanager,vndservicemanager work Change-Id: I7b132d4f616ba1edd0daf7be750d4b7174c4e188
2017-04-01 02:29:53 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
$(LOCAL_BUILT_MODULE): $(vndservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
@mkdir -p $(dir $@)
sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
Fix checkfc options order. darwin's getopt() doesn't like putting arguments in the wrong order. Test: Mac/Linux builds Change-Id: If632e9077c1b5714f91c5adaa04afb4963d9b0f5
2017-04-07 19:08:55 +02:00
$(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e -v $(PRIVATE_SEPOLICY) $@
Add target for vndservice_contexts. So we can limit vndservicemanager access to just vndservice_contexts. Bug: 36052864 Test: servicemanager,vndservicemanager work Change-Id: I7b132d4f616ba1edd0daf7be750d4b7174c4e188
2017-04-01 02:29:53 +02:00
vnd_svcfiles :=
vndservice_contexts.tmp :=
Separate product_mac_permissions.xml out of system sepolicy. Bug: 119305624 Test: normal/recovery boot aosp_taimen Change-Id: I46da995886ce421bb87e741d577f659426ff79c4
2018-12-22 01:07:21 +01:00
##################################
sepolicy: refactor Android.mk system/sepolicy/Android.mk has become too large (~2k lines) and hard to navigate. This patch reorganizes build rules for convenience. No functional changes are made. Test: m selinux_policy Change-Id: I9a022b223b2387a4475da6d8209d561bfea228fb
2019-01-08 01:43:31 +01:00
include $(LOCAL_PATH)/mac_permissions.mk
Add /odm/etc/selinux/odm_mac_permissions.xml Bug: 64240127 Test: normal boot a device Change-Id: I276ba6bc88eabb0d5562e4e96d3860eedb76aed5
2017-11-29 09:06:15 +01:00
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
#################################
include $(CLEAR_VARS)
LOCAL_MODULE := sepolicy_tests
Test files on intermediates dir, not on /system *_context_test / sepolicy_tests / treble_sepolicy_tests_* / sepolicy_freeze_test files are installed on /system/etc. By being FAKE modules, test files are not installed on target. Additionally, we need to set up dependency from droidcore to selinux_policy to make tests run on normal builds (m). Bug: 133460071 Test: m & see if tests run and no test files on /system/etc Test: m selinux_policy & see if tests run Change-Id: Icacf004d5c1c8ec720c7cedef7bae8aa648cbe49
2019-05-29 18:05:43 +02:00
LOCAL_MODULE_CLASS := FAKE
LOCAL_MODULE_TAGS := optional
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
include $(BUILD_SYSTEM)/base_rules.mk
Build contexts files with Soong This is to migrate sepolicy Makefiles into Soong. For the first part, file_contexts, hwservice_contexts, property_contexts, and service_contexts are migrated. Build-time tests for contexts files are still in Makefile; they will also be done with Soong after porting the module sepolicy. The motivation of migrating is based on generating property_contexts dynamically: if we were to amend contexts files at build time in the future, it would be nicer to manage them in Soong. To do that, building contexts files with Soong can be very helpful. Bug: 127949646 Bug: 129377144 Test: 1) Build blueline-userdebug, flash, and boot. Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash, and boot. Test: 3) Build aosp_arm-userdebug. Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
all_fc_files := $(TARGET_OUT)/etc/selinux/plat_file_contexts
all_fc_files += $(TARGET_OUT_VENDOR)/etc/selinux/vendor_file_contexts
Allowing system_ext sepolicy to be empty Some targets just need to extend system_ext context files, e.g., file_contexts, service_contexts, etc., without adding any system_ext policy files, e.g., *.te files. Currently, this will lead to build errors. This CL allows system_ext_sepolicy.cil and the system_ext mapping file to be empty. It's now also possible to just set BOARD_PLAT_PRIVATE_SEPOLICY_DIR without setting BOARD_PLAT_PUBLIC_SEPOLICY_DIR. Bug: 137712473 Bug: 141880898 Test: Only adds system_ext context files without policy files (e.g., *.te), then `mmma system/sepolicy` can build pass Change-Id: I72849f2d4aa43e5296cd15c07a8fd058186a6376
2019-10-04 08:34:18 +02:00
ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR
Separate system_ext_file_contexts out of system sepolicy. Bug: 137712473 Test: boot crosshatch Change-Id: I09f63771d08ad18fb41fca801dd587b086be58c7
2019-09-09 16:04:06 +02:00
all_fc_files += $(TARGET_OUT_SYSTEM_EXT)/etc/selinux/system_ext_file_contexts
endif
Allowing product sepolicy to be empty Some targets just need to extend product context files, e.g., file_contexts, service_contexts, etc., without adding any product-specific policy files, e.g., *.te files. Or just need to add private product sepolicy without adding public product sepolicy. Currently, this will lead to build errors. This CL allows product_sepolicy.cil and the product mapping file to be empty. It's now also possible to just set PRODUCT_PRIVATE_POLICY without setting PRODUCT_PUBLIC_POLICY. Bug: 131193755 Test: Only adds product private sepolicy, then `mmma system/sepolicy` Change-Id: Ifed5af7413b2a1e20a0628518582615708c8c31a
2019-10-04 09:36:05 +02:00
ifdef HAS_PRODUCT_SEPOLICY_DIR
Build contexts files with Soong This is to migrate sepolicy Makefiles into Soong. For the first part, file_contexts, hwservice_contexts, property_contexts, and service_contexts are migrated. Build-time tests for contexts files are still in Makefile; they will also be done with Soong after porting the module sepolicy. The motivation of migrating is based on generating property_contexts dynamically: if we were to amend contexts files at build time in the future, it would be nicer to manage them in Soong. To do that, building contexts files with Soong can be very helpful. Bug: 127949646 Bug: 129377144 Test: 1) Build blueline-userdebug, flash, and boot. Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash, and boot. Test: 3) Build aosp_arm-userdebug. Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
all_fc_files += $(TARGET_OUT_PRODUCT)/etc/selinux/product_file_contexts
Separate product_file_contexts out of system sepolicy. Bug: 119305624 Test: boot blueline Change-Id: I3ecdeab3bb33c3cb5e80dc10ba1079c9853048f8
2018-12-19 04:51:19 +01:00
endif
Add /odm/etc/selinux/odm_file_contexts Bug: 64240127 Test: normal boot and recovery boot a device Change-Id: I087292fb23d05fc17272778d668ac78a721b2593
2017-11-29 09:14:53 +01:00
ifdef BOARD_ODM_SEPOLICY_DIRS
Build contexts files with Soong This is to migrate sepolicy Makefiles into Soong. For the first part, file_contexts, hwservice_contexts, property_contexts, and service_contexts are migrated. Build-time tests for contexts files are still in Makefile; they will also be done with Soong after porting the module sepolicy. The motivation of migrating is based on generating property_contexts dynamically: if we were to amend contexts files at build time in the future, it would be nicer to manage them in Soong. To do that, building contexts files with Soong can be very helpful. Bug: 127949646 Bug: 129377144 Test: 1) Build blueline-userdebug, flash, and boot. Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash, and boot. Test: 3) Build aosp_arm-userdebug. Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
all_fc_files += $(TARGET_OUT_ODM)/etc/selinux/odm_file_contexts
Add /odm/etc/selinux/odm_file_contexts Bug: 64240127 Test: normal boot and recovery boot a device Change-Id: I087292fb23d05fc17272778d668ac78a721b2593
2017-11-29 09:14:53 +01:00
endif
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
all_fc_args := $(foreach file, $(all_fc_files), -f $(file))
Test files on intermediates dir, not on /system *_context_test / sepolicy_tests / treble_sepolicy_tests_* / sepolicy_freeze_test files are installed on /system/etc. By being FAKE modules, test files are not installed on target. Additionally, we need to set up dependency from droidcore to selinux_policy to make tests run on normal builds (m). Bug: 133460071 Test: m & see if tests run and no test files on /system/etc Test: m selinux_policy & see if tests run Change-Id: Icacf004d5c1c8ec720c7cedef7bae8aa648cbe49
2019-05-29 18:05:43 +02:00
$(LOCAL_BUILT_MODULE): ALL_FC_ARGS := $(all_fc_args)
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/sepolicy_tests $(all_fc_files) $(built_sepolicy)
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
@mkdir -p $(dir $@)
Prepare python tests to be run in CTS Bug: 37008075 Test: build, all tests pass. Modify some attributes locally to cause tests to fail (verify that they are actually working). Change-Id: If9f9ece61dff835f38ef9c8a57f5a7baddbae5cd
2017-10-04 18:42:29 +02:00
$(hide) $(HOST_OUT_EXECUTABLES)/sepolicy_tests -l $(HOST_OUT)/lib64/libsepolwrap.$(SHAREDLIB_EXT) \
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
$(ALL_FC_ARGS) -p $(PRIVATE_SEPOLICY)
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
$(hide) touch $@
Build the selinux_version file. The selinux_version file is used to perform policy versioning checks by libselinux and SELinuxMMAC. When loading policy a check is first performed to determine if the policy out in /data/security/current should be used to override the base policy shipped with the device. The selinux_version file is used to make that choice. The contents of the file simply contains the BUILD_FINGERPRINT that the policy was built against. A simple string comparison is then performed by libselinux and SELinuxMMAC. Change-Id: I69d9d071743cfd46bb247c98f94a193396f8ebbd Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-03-20 14:35:08 +01:00
##################################
Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
intermediates := $(call intermediates-dir-for,ETC,built_plat_sepolicy,,,,)
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
# plat_sepolicy - the current platform policy only, built into a policy binary.
# TODO - this currently excludes partner extensions, but support should be added
# to enable partners to add their own compatibility mapping
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
policy_files := $(call build_policy, $(sepolicy_build_files), \
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY))
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
base_plat_policy.conf := $(intermediates)/base_plat_policy.conf
$(base_plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
$(base_plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Use user policy for compatibility tests. Use the user policy when running the compatibility tests. Bug: 74344625 Test: Built policy for many devices. Booted one device. Test: Delete some compat rules, verify error on userdebug. Change-Id: Ib2df2dfc06cdf55a839011e9a528e76160a9e436
2018-03-23 20:40:26 +01:00
$(base_plat_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := user
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
$(base_plat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
$(base_plat_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
$(base_plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Use PRODUCT_SEPOLICY_SPLIT for full Treble. PRODUCT_FULL_TREBLE is being broken up into smaller, more manageable components. Bug: 62019611 Test: manual Change-Id: I9b65f120851d9ea134a0059a417f0282777717fc
2017-11-09 20:24:56 +01:00
$(base_plat_policy.conf): PRIVATE_SEPOLICY_SPLIT := true
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
$(base_plat_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
Add BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW A new sysprop neverallow rules are mandatory only for devices launching with R or later. For devices already launched, neverallow rules can be relaxed with adding following line to BoardConfig.mk: BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true Bug: 131162102 Test: Set PRODUCT_SHIPPING_API_LEVEL := 30 and try building with changing some system_public_prop to system_internal_prop Test: m cts sepolicy_tests Change-Id: Id978b4d81a8683a57304bb639961105e2d91fa9a Merged-In: Id978b4d81a8683a57304bb639961105e2d91fa9a (cherry picked from commit 3be11e7abb8f4fd651295f9ccb0ce087855c1cc0)
2019-09-26 08:14:55 +02:00
$(base_plat_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow)
Enforce sysprop owner Every property should have an appropriate owner attribute, which can be one of: system_property_type, product_property_type, or vendor_property_type. This will be enforced for devices launching with S or later. Devices launching with R or eariler can relax this by setting following under BoardConfig.mk: BUILD_BROKEN_ENFORCE_SYSPROP_OWNER := true Bug: 131162102 Test: system/sepolicy/tools/build_policies.sh Change-Id: I7914ef1b7463c9ec00812b9720094531fd63f0c7
2020-09-28 06:32:43 +02:00
$(base_plat_policy.conf): PRIVATE_ENFORCE_SYSPROP_OWNER := $(enforce_sysprop_owner)
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
$(base_plat_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
$(base_plat_policy.conf): $(policy_files) $(M4)
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
$(transform-policy-to-conf)
Fix building error for multi-line dontaudit statement All the *.conf.dontaudit files are generated from *.conf with the command of 'sed '/dontaudit/d' $@ > $@.dontaudit', but this command can not be applied to multi-line dontaudit statement. Test: Set plat_policy.conf.dontaudit as the input_file parameter of checkpolicy tool, then selinux syntax error will occur during building. Change-Id: I281de923d8a5f0b46256ec7de4df12a1c1d7e061
2018-09-13 08:04:19 +02:00
$(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
built_plat_sepolicy := $(intermediates)/built_plat_sepolicy
$(built_plat_sepolicy): PRIVATE_ADDITIONAL_CIL_FILES := \
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
$(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY))
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
$(built_plat_sepolicy): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
$(built_plat_sepolicy): $(base_plat_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
$(HOST_OUT_EXECUTABLES)/secilc \
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
$(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY)) \
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
$(built_sepolicy_neverallows)
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
@mkdir -p $(dir $@)
$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \
$(POLICYVERS) -o $@ $<
$(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $@ -o $@ -f /dev/null
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
policy_files := $(call build_policy, $(sepolicy_build_files), \
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
$(PLAT_PUBLIC_POLICY) $(REQD_MASK_POLICY))
Don't require private types in mapping file. Private types are not visible to vendor/odm policy, so we don't need mapping entries for them. We build platform-only public policy .cil file and give it as input to treble_sepolicy_tests. Using this public policy the test can now figure out if the newly added type in public or private. Bug: 116344577 Test: adding public type triggers mapping test failure, adding private type does not. Change-Id: I421f335e37274b24aa73109e260653d7b73788b5
2018-09-29 02:21:08 +02:00
base_plat_pub_policy.conf := $(intermediates)/base_plat_pub_policy.conf
$(base_plat_pub_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
$(base_plat_pub_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
$(base_plat_pub_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := user
$(base_plat_pub_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
$(base_plat_pub_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
$(base_plat_pub_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(base_plat_pub_policy.conf): PRIVATE_SEPOLICY_SPLIT := true
$(base_plat_pub_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
Add BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW A new sysprop neverallow rules are mandatory only for devices launching with R or later. For devices already launched, neverallow rules can be relaxed with adding following line to BoardConfig.mk: BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true Bug: 131162102 Test: Set PRODUCT_SHIPPING_API_LEVEL := 30 and try building with changing some system_public_prop to system_internal_prop Test: m cts sepolicy_tests Change-Id: Id978b4d81a8683a57304bb639961105e2d91fa9a Merged-In: Id978b4d81a8683a57304bb639961105e2d91fa9a (cherry picked from commit 3be11e7abb8f4fd651295f9ccb0ce087855c1cc0)
2019-09-26 08:14:55 +02:00
$(base_plat_pub_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow)
Enforce sysprop owner Every property should have an appropriate owner attribute, which can be one of: system_property_type, product_property_type, or vendor_property_type. This will be enforced for devices launching with S or later. Devices launching with R or eariler can relax this by setting following under BoardConfig.mk: BUILD_BROKEN_ENFORCE_SYSPROP_OWNER := true Bug: 131162102 Test: system/sepolicy/tools/build_policies.sh Change-Id: I7914ef1b7463c9ec00812b9720094531fd63f0c7
2020-09-28 06:32:43 +02:00
$(base_plat_pub_policy.conf): PRIVATE_ENFORCE_SYSPROP_OWNER := $(enforce_sysprop_owner)
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
$(base_plat_pub_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
$(base_plat_pub_policy.conf): $(policy_files) $(M4)
Don't require private types in mapping file. Private types are not visible to vendor/odm policy, so we don't need mapping entries for them. We build platform-only public policy .cil file and give it as input to treble_sepolicy_tests. Using this public policy the test can now figure out if the newly added type in public or private. Bug: 116344577 Test: adding public type triggers mapping test failure, adding private type does not. Change-Id: I421f335e37274b24aa73109e260653d7b73788b5
2018-09-29 02:21:08 +02:00
$(transform-policy-to-conf)
base_plat_pub_policy.cil := $(intermediates)/base_plat_pub_policy.cil
$(base_plat_pub_policy.cil): PRIVATE_POL_CONF := $(base_plat_pub_policy.conf)
$(base_plat_pub_policy.cil): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil)
Replace "grep -f" with python util. grep can potentially run out of memory on Mac builds for large input files. So we add a python util to handle filtering out files. We will also need this util to filter plat_sepolicy.cil out of product_sepolicy.cil Bug: 119305624 Test: boot aosp_taimen Change-Id: I61cd68f407ea5de43a06bf522a5fc149e5067e8c
2018-12-18 01:35:41 +01:00
$(base_plat_pub_policy.cil): $(HOST_OUT_EXECUTABLES)/checkpolicy \
$(HOST_OUT_EXECUTABLES)/build_sepolicy $(base_plat_pub_policy.conf) $(reqd_policy_mask.cil)
Don't require private types in mapping file. Private types are not visible to vendor/odm policy, so we don't need mapping entries for them. We build platform-only public policy .cil file and give it as input to treble_sepolicy_tests. Using this public policy the test can now figure out if the newly added type in public or private. Bug: 116344577 Test: adding public type triggers mapping test failure, adding private type does not. Change-Id: I421f335e37274b24aa73109e260653d7b73788b5
2018-09-29 02:21:08 +02:00
@mkdir -p $(dir $@)
Replace "grep -f" with python util. grep can potentially run out of memory on Mac builds for large input files. So we add a python util to handle filtering out files. We will also need this util to filter plat_sepolicy.cil out of product_sepolicy.cil Bug: 119305624 Test: boot aosp_taimen Change-Id: I61cd68f407ea5de43a06bf522a5fc149e5067e8c
2018-12-18 01:35:41 +01:00
$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $< -C -M -c $(POLICYVERS) -o $@ $(PRIVATE_POL_CONF)
$(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) filter_out \
-f $(PRIVATE_REQD_MASK) -t $@
Don't require private types in mapping file. Private types are not visible to vendor/odm policy, so we don't need mapping entries for them. We build platform-only public policy .cil file and give it as input to treble_sepolicy_tests. Using this public policy the test can now figure out if the newly added type in public or private. Bug: 116344577 Test: adding public type triggers mapping test failure, adding private type does not. Change-Id: I421f335e37274b24aa73109e260653d7b73788b5
2018-09-29 02:21:08 +02:00
PRODUCT_SEPOLICY_SPLIT forces Treble tests to run. This is the flag for when sepolicy is split. Also removed other commented-out heuristics around fake-treble. We should aim to remove it entirely instead. Fixes: 141348590 Test: build w/ and without adding binder_in_vendor_violators to a vendor process (and see the expected error there) Change-Id: I29fb335cc5b5d6e117d93038fe458b8c74acf321
2019-09-20 20:16:29 +02:00
ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
# Tests for Treble compatibility of current platform policy and vendor policy of
# given release version.
version_under_treble_tests := 26.0
include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk
Enable treble_sepolicy_tests against 27.0 release. Bug: 69390067 Test: build sepolicy Change-Id: I4fc7438e4f825281d93a2849be9d2db819bea4ca
2018-02-01 01:50:28 +01:00
version_under_treble_tests := 27.0
include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk
Add mapping files for 28.0.[ignore.]cil Steps taken to produce the mapping files: 1. Add prebuilts/api/28.0/[plat_pub_versioned.cil|vendor_sepolicy.cil] from the /vendor/etc/selinux/[plat_pub_versioned.cil|vendor_sepolicy.cil] files built on pi-dev with lunch target aosp_arm64-eng 2. Add new file private/compat/28.0/28.0.cil by doing the following: - copy /system/etc/selinux/mapping/28.0.cil from pi-dev aosp_arm64-eng device to private/compat/28.0/28.0.cil - remove all attribute declaration statement (typeattribute ...) and sort lines alphabetically - some selinux types were added/renamed/deleted w.r.t 28 sepolicy. Find all such types using treble_sepolicy_tests_28.0 test. - for all these types figure out where to map them by looking at 27.0.[ignore.]cil files and add approprite entries to 28.0.[ignore.]cil. This change also enables treble_sepolicy_tests_28.0 and install 28.0.cil mapping onto the device. Bug: 72458734 Test: m selinux_policy Change-Id: I90e17c0b43af436da4b62c16179c198b5c74002c
2018-07-11 11:30:44 +02:00
version_under_treble_tests := 28.0
include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk
Reland "Add 29.0 mapping files" Steps taken to produce the mapping files: 1. Add prebuilts/api/29.0/[plat_pub_versioned.cil|vendor_sepolicy.cil] plat_pub_versioned.cil contains all public attributes and types from Q Leave vendor_sepolicy.cil is empty. 2. Add new file private/compat/29.0/29.0.cil by doing the following: - copy /system/etc/selinux/mapping/29.0.cil from pi-dev aosp_arm64-eng device to private/compat/29.0/29.0.cil - remove all attribute declaration statement (typeattribute ...) and sort lines alphabetically - some selinux types were added/renamed/deleted w.r.t 29 sepolicy. Find all such types using treble_sepolicy_tests_29.0 test. - for all these types figure out where to map them by looking at 28.0.[ignore.]cil files and add approprite entries to 29.0.[ignore.]cil. This change also enables treble_sepolicy_tests_29.0 and installs 29.0.cil mapping file onto the device. Bug: 133155528 Bug: 133196056 Test: m treble_sepolicy_tests_29.0 Test: m 29.0_compat_test Test: m selinux_policy Change-Id: I9e83e9bf118c8b8f8fcf84d5c0dcb6eb588e0d55
2019-06-02 02:04:13 +02:00
version_under_treble_tests := 29.0
include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk
Add 30.0 mapping files Steps taken to produce the mapping files: 1. Add prebuilts/api/30.0/plat_pub_versioned.cil from the /vendor/etc/selinux/plat_pub_versioned.cil file built on rvc-dev with lunch target aosp_arm64-eng. Add prebuilts/api/30.0/vendor_sepolicy.cil as an empty file. 2. Add new file private/compat/30.0/30.0.cil by doing the following: - copy /system/etc/selinux/mapping/30.0.cil from rvc-dev aosp_arm64-eng device to private/compat/30.0/30.0.cil - remove all attribute declaration statement (typeattribute ...) and sort lines alphabetically - some selinux types were added/renamed/deleted w.r.t 30 sepolicy. Find all such types using treble_sepolicy_tests_30.0 test. - for all these types figure out where to map them by looking at 29.0.[ignore.]cil files and add approprite entries to 30.0.[ignore.]cil. This change also enables treble_sepolicy_tests_30.0 and installs 30.0.cil mapping file onto the device. Bug: 153661471 Test: m treble_sepolicy_tests_30.0 Test: m 30.0_compat_test Test: m selinux_policy Change-Id: I6dfae41fbd5f245119ede540d2c321688d6e7929
2020-05-07 13:19:05 +02:00
version_under_treble_tests := 30.0
include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk
PRODUCT_SEPOLICY_SPLIT forces Treble tests to run. This is the flag for when sepolicy is split. Also removed other commented-out heuristics around fake-treble. We should aim to remove it entirely instead. Fixes: 141348590 Test: build w/ and without adding binder_in_vendor_violators to a vendor process (and see the expected error there) Change-Id: I29fb335cc5b5d6e117d93038fe458b8c74acf321
2019-09-20 20:16:29 +02:00
endif # PRODUCT_SEPOLICY_SPLIT
Add mapping files for 28.0.[ignore.]cil Steps taken to produce the mapping files: 1. Add prebuilts/api/28.0/[plat_pub_versioned.cil|vendor_sepolicy.cil] from the /vendor/etc/selinux/[plat_pub_versioned.cil|vendor_sepolicy.cil] files built on pi-dev with lunch target aosp_arm64-eng 2. Add new file private/compat/28.0/28.0.cil by doing the following: - copy /system/etc/selinux/mapping/28.0.cil from pi-dev aosp_arm64-eng device to private/compat/28.0/28.0.cil - remove all attribute declaration statement (typeattribute ...) and sort lines alphabetically - some selinux types were added/renamed/deleted w.r.t 28 sepolicy. Find all such types using treble_sepolicy_tests_28.0 test. - for all these types figure out where to map them by looking at 27.0.[ignore.]cil files and add approprite entries to 28.0.[ignore.]cil. This change also enables treble_sepolicy_tests_28.0 and install 28.0.cil mapping onto the device. Bug: 72458734 Test: m selinux_policy Change-Id: I90e17c0b43af436da4b62c16179c198b5c74002c
2018-07-11 11:30:44 +02:00
Add mechanism for granting permissions to old vendor images This addresses Treble backwards compat issues introduced in aosp/793958 and aosp/783669. Bug: 122874820 Test: build/flash blueline with pi-dev vendor and generic_ab system images. Test: adb pull /sys/fs/selinux/policy; sesearch policy --allowx -s vendordomain -t dev_type Change-Id: Ic2b304472bb88051e03740dc387834056aba641a
2019-05-02 22:48:44 +02:00
version_under_treble_tests := 26.0
include $(LOCAL_PATH)/compat.mk
version_under_treble_tests := 27.0
include $(LOCAL_PATH)/compat.mk
version_under_treble_tests := 28.0
include $(LOCAL_PATH)/compat.mk
Reland "Add 29.0 mapping files" Steps taken to produce the mapping files: 1. Add prebuilts/api/29.0/[plat_pub_versioned.cil|vendor_sepolicy.cil] plat_pub_versioned.cil contains all public attributes and types from Q Leave vendor_sepolicy.cil is empty. 2. Add new file private/compat/29.0/29.0.cil by doing the following: - copy /system/etc/selinux/mapping/29.0.cil from pi-dev aosp_arm64-eng device to private/compat/29.0/29.0.cil - remove all attribute declaration statement (typeattribute ...) and sort lines alphabetically - some selinux types were added/renamed/deleted w.r.t 29 sepolicy. Find all such types using treble_sepolicy_tests_29.0 test. - for all these types figure out where to map them by looking at 28.0.[ignore.]cil files and add approprite entries to 29.0.[ignore.]cil. This change also enables treble_sepolicy_tests_29.0 and installs 29.0.cil mapping file onto the device. Bug: 133155528 Bug: 133196056 Test: m treble_sepolicy_tests_29.0 Test: m 29.0_compat_test Test: m selinux_policy Change-Id: I9e83e9bf118c8b8f8fcf84d5c0dcb6eb588e0d55
2019-06-02 02:04:13 +02:00
version_under_treble_tests := 29.0
include $(LOCAL_PATH)/compat.mk
Add 30.0 mapping files Steps taken to produce the mapping files: 1. Add prebuilts/api/30.0/plat_pub_versioned.cil from the /vendor/etc/selinux/plat_pub_versioned.cil file built on rvc-dev with lunch target aosp_arm64-eng. Add prebuilts/api/30.0/vendor_sepolicy.cil as an empty file. 2. Add new file private/compat/30.0/30.0.cil by doing the following: - copy /system/etc/selinux/mapping/30.0.cil from rvc-dev aosp_arm64-eng device to private/compat/30.0/30.0.cil - remove all attribute declaration statement (typeattribute ...) and sort lines alphabetically - some selinux types were added/renamed/deleted w.r.t 30 sepolicy. Find all such types using treble_sepolicy_tests_30.0 test. - for all these types figure out where to map them by looking at 29.0.[ignore.]cil files and add approprite entries to 30.0.[ignore.]cil. This change also enables treble_sepolicy_tests_30.0 and installs 30.0.cil mapping file onto the device. Bug: 153661471 Test: m treble_sepolicy_tests_30.0 Test: m 30.0_compat_test Test: m selinux_policy Change-Id: I6dfae41fbd5f245119ede540d2c321688d6e7929
2020-05-07 13:19:05 +02:00
version_under_treble_tests := 30.0
include $(LOCAL_PATH)/compat.mk
Add mechanism for granting permissions to old vendor images This addresses Treble backwards compat issues introduced in aosp/793958 and aosp/783669. Bug: 122874820 Test: build/flash blueline with pi-dev vendor and generic_ab system images. Test: adb pull /sys/fs/selinux/policy; sesearch policy --allowx -s vendordomain -t dev_type Change-Id: Ic2b304472bb88051e03740dc387834056aba641a
2019-05-02 22:48:44 +02:00
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
base_plat_policy.conf :=
Don't require private types in mapping file. Private types are not visible to vendor/odm policy, so we don't need mapping entries for them. We build platform-only public policy .cil file and give it as input to treble_sepolicy_tests. Using this public policy the test can now figure out if the newly added type in public or private. Bug: 116344577 Test: adding public type triggers mapping test failure, adding private type does not. Change-Id: I421f335e37274b24aa73109e260653d7b73788b5
2018-09-29 02:21:08 +02:00
base_plat_pub_policy.conf :=
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
plat_sepolicy :=
Build contexts files with Soong This is to migrate sepolicy Makefiles into Soong. For the first part, file_contexts, hwservice_contexts, property_contexts, and service_contexts are migrated. Build-time tests for contexts files are still in Makefile; they will also be done with Soong after porting the module sepolicy. The motivation of migrating is based on generating property_contexts dynamically: if we were to amend contexts files at build time in the future, it would be nicer to manage them in Soong. To do that, building contexts files with Soong can be very helpful. Bug: 127949646 Bug: 129377144 Test: 1) Build blueline-userdebug, flash, and boot. Test: 2) Build blueline-userdebug with TARGET_FLATTEN_APEX=true, flash, and boot. Test: 3) Build aosp_arm-userdebug. Change-Id: I576f6f20686f6f2121204f76657274696d652121
2019-04-15 13:10:46 +02:00
all_fc_files :=
all_fc_args :=
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
Run Treble sepolicy tests at build time Bug: 37008075 Test: build policy on Marlin Change-Id: I53748f94c5df66fa17a53e7d0bed1be6b8603544 (cherry picked from commit e1ddc6df75d61dd8dc9a1ea00e1da60389f55556)
2017-06-01 00:36:07 +02:00
#################################
Test frozen sepolicy has not diverged from prebuilts. This will test that system/sepolicy/{public/, private/} are identical to prebuilts if PLATFORM_SEPOLICY_VERSION is not 10000.0. Bug: 74622750 Test: build policy Test: correctly catches divergence from prebuilts for frozen policies Change-Id: I2fa14b672544a021c2d42ad5968dfbac21b72f6a
2018-03-15 19:38:08 +01:00
include $(CLEAR_VARS)
LOCAL_MODULE := sepolicy_freeze_test
Test files on intermediates dir, not on /system *_context_test / sepolicy_tests / treble_sepolicy_tests_* / sepolicy_freeze_test files are installed on /system/etc. By being FAKE modules, test files are not installed on target. Additionally, we need to set up dependency from droidcore to selinux_policy to make tests run on normal builds (m). Bug: 133460071 Test: m & see if tests run and no test files on /system/etc Test: m selinux_policy & see if tests run Change-Id: Icacf004d5c1c8ec720c7cedef7bae8aa648cbe49
2019-05-29 18:05:43 +02:00
LOCAL_MODULE_CLASS := FAKE
LOCAL_MODULE_TAGS := optional
Test frozen sepolicy has not diverged from prebuilts. This will test that system/sepolicy/{public/, private/} are identical to prebuilts if PLATFORM_SEPOLICY_VERSION is not 10000.0. Bug: 74622750 Test: build policy Test: correctly catches divergence from prebuilts for frozen policies Change-Id: I2fa14b672544a021c2d42ad5968dfbac21b72f6a
2018-03-15 19:38:08 +01:00
include $(BUILD_SYSTEM)/base_rules.mk
Expand the scope of sepolicy_freeze_test The existing freeze test only covers the policy files in system/sepolicy alone. There's demand from product teams that would like to implement a freeze test for their sepolicy. Instead of letting them fork the freeze test, we believe expanding the scope of the exising one is in the best interest. $FREEZE_TEST_EXTRA_DIRS and $FREEZE_TEST_EXTRA_PREBUILT_DIRS are added. These build variables could be appended like $PRODUCT_PUBLIC_POLICY. The product team are expected to maintain their policy prebuilts. Bug: 166455099 Test: manual Change-Id: I6f350e1e3db2807be4dbfd0ceb34f0d89f94d629
2020-10-08 23:39:42 +02:00
define ziplist
$(if $(and $1,$2), "$(firstword $1) $(firstword $2)"\
$(call ziplist,$(wordlist 2,$(words $1),$1),$(wordlist 2,$(words $2),$2)))
endef
Test frozen sepolicy has not diverged from prebuilts. This will test that system/sepolicy/{public/, private/} are identical to prebuilts if PLATFORM_SEPOLICY_VERSION is not 10000.0. Bug: 74622750 Test: build policy Test: correctly catches divergence from prebuilts for frozen policies Change-Id: I2fa14b672544a021c2d42ad5968dfbac21b72f6a
2018-03-15 19:38:08 +01:00
base_plat_public := $(LOCAL_PATH)/public
base_plat_private := $(LOCAL_PATH)/private
base_plat_public_prebuilt := \
$(LOCAL_PATH)/prebuilts/api/$(PLATFORM_SEPOLICY_VERSION)/public
base_plat_private_prebuilt := \
$(LOCAL_PATH)/prebuilts/api/$(PLATFORM_SEPOLICY_VERSION)/private
all_frozen_files := $(call build_policy,$(sepolicy_build_files), \
$(base_plat_public) $(base_plat_private) $(base_plat_public_prebuilt) $(base_plat_private_prebuilt))
$(LOCAL_BUILT_MODULE): PRIVATE_BASE_PLAT_PUBLIC := $(base_plat_public)
$(LOCAL_BUILT_MODULE): PRIVATE_BASE_PLAT_PRIVATE := $(base_plat_private)
$(LOCAL_BUILT_MODULE): PRIVATE_BASE_PLAT_PUBLIC_PREBUILT := $(base_plat_public_prebuilt)
$(LOCAL_BUILT_MODULE): PRIVATE_BASE_PLAT_PRIVATE_PREBUILT := $(base_plat_private_prebuilt)
Expand the scope of sepolicy_freeze_test The existing freeze test only covers the policy files in system/sepolicy alone. There's demand from product teams that would like to implement a freeze test for their sepolicy. Instead of letting them fork the freeze test, we believe expanding the scope of the exising one is in the best interest. $FREEZE_TEST_EXTRA_DIRS and $FREEZE_TEST_EXTRA_PREBUILT_DIRS are added. These build variables could be appended like $PRODUCT_PUBLIC_POLICY. The product team are expected to maintain their policy prebuilts. Bug: 166455099 Test: manual Change-Id: I6f350e1e3db2807be4dbfd0ceb34f0d89f94d629
2020-10-08 23:39:42 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_EXTRA := $(sort $(FREEZE_TEST_EXTRA_DIRS))
$(LOCAL_BUILT_MODULE): PRIVATE_EXTRA_PREBUILT := $(sort $(FREEZE_TEST_EXTRA_PREBUILT_DIRS))
Test frozen sepolicy has not diverged from prebuilts. This will test that system/sepolicy/{public/, private/} are identical to prebuilts if PLATFORM_SEPOLICY_VERSION is not 10000.0. Bug: 74622750 Test: build policy Test: correctly catches divergence from prebuilts for frozen policies Change-Id: I2fa14b672544a021c2d42ad5968dfbac21b72f6a
2018-03-15 19:38:08 +01:00
$(LOCAL_BUILT_MODULE): $(all_frozen_files)
ifneq ($(PLATFORM_SEPOLICY_VERSION),$(TOT_SEPOLICY_VERSION))
Exclude bug_map from the sepolicy_freeze_test. The bug_map file is only used whitelisting known test failures. It needs to change fairly often to fix new failures and it doesn't affect users, so it shouldn't matter if it diverges from prebuilts. Test: Enable this test and build with and without different bug_maps. Change-Id: I9176a6c7e9f7852a0cd7802fd121b1e86b216b22
2018-05-22 18:22:41 +02:00
@diff -rq -x bug_map $(PRIVATE_BASE_PLAT_PUBLIC_PREBUILT) $(PRIVATE_BASE_PLAT_PUBLIC)
@diff -rq -x bug_map $(PRIVATE_BASE_PLAT_PRIVATE_PREBUILT) $(PRIVATE_BASE_PLAT_PRIVATE)
Expand the scope of sepolicy_freeze_test The existing freeze test only covers the policy files in system/sepolicy alone. There's demand from product teams that would like to implement a freeze test for their sepolicy. Instead of letting them fork the freeze test, we believe expanding the scope of the exising one is in the best interest. $FREEZE_TEST_EXTRA_DIRS and $FREEZE_TEST_EXTRA_PREBUILT_DIRS are added. These build variables could be appended like $PRODUCT_PUBLIC_POLICY. The product team are expected to maintain their policy prebuilts. Bug: 166455099 Test: manual Change-Id: I6f350e1e3db2807be4dbfd0ceb34f0d89f94d629
2020-10-08 23:39:42 +02:00
ifneq (,$(FREEZE_TEST_EXTRA_DIRS)$(FREEZE_TEST_EXTRA_PREBUILT_DIRS))
@for pair in $(call ziplist, $(PRIVATE_EXTRA_PREBUILT), $(PRIVATE_EXTRA)); \
do diff -rq -x bug_map $$pair; done
endif # (,$(FREEZE_TEST_EXTRA_DIRS)$(FREEZE_TEST_EXTRA_PREBUILT_DIRS))
Test frozen sepolicy has not diverged from prebuilts. This will test that system/sepolicy/{public/, private/} are identical to prebuilts if PLATFORM_SEPOLICY_VERSION is not 10000.0. Bug: 74622750 Test: build policy Test: correctly catches divergence from prebuilts for frozen policies Change-Id: I2fa14b672544a021c2d42ad5968dfbac21b72f6a
2018-03-15 19:38:08 +01:00
endif # ($(PLATFORM_SEPOLICY_VERSION),$(TOT_SEPOLICY_VERSION))
$(hide) touch $@
base_plat_public :=
base_plat_private :=
base_plat_public_prebuilt :=
base_plat_private_prebuilt :=
all_frozen_files :=
#################################
Add better per-device sepolicy support. This is a rewrite of the existing implementation. Three new variables are now needed to add/modify the exisitng base policy. They are, BOARD_SEPOLICY_REPLACE and BOARD_SEPOLICY_UNION which govern what files are replaced and concatenated, and BOARD_SEPOLICY_DIRS which lists the various directories that will contain the BOARD_SEPOLICY_REPLACE and BOARD_SEPOLICY_UNION policy files. Change-Id: Id33381268cef03245c56bc5242fec7da9b6c6493 Signed-off-by: rpcraig <robertpcraig@gmail.com>
2012-10-18 03:09:52 +02:00
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
build_vendor_policy :=
Add /odm/etc/selinux/odm_file_contexts Bug: 64240127 Test: normal boot and recovery boot a device Change-Id: I087292fb23d05fc17272778d668ac78a721b2593
2017-11-29 09:14:53 +01:00
build_odm_policy :=
Switch recovery to versioned policy and split into components. And do some clean up: Replace LOCAL_TARGET_ARCH with global arch specifier that won't get clobbered, clean up sepolicy.recovery's eng specification, ensure that build macros are applied across all policy generation, not just plat_policy, and make sure that all private variables are cleared and alphabetized at the end. Bug: 31363362 Bug: 31369363 Test: Boot into recovery and observe no selinux denials. Change-Id: Ibc15b097f6d19acf01f6b22bee0e083b15f4ef75
2016-12-16 00:28:44 +01:00
build_policy :=
Test CIL policy when building it Prior to this commit, there was a bug in generated CIL where it wouldn't compile using secilc. The reason was that the build script was stripping out all lines containing "neverallow" from CIL files, accidentally removing lines which were not neverallow statements, such as lmx lines referencing app_neverallows.te. The commit fixes the build script's CIL neverallow filter to filter out only neverallow* statements, as originally intended. Moreover, to catch non-compiling CIL policy earlier in the future, this commit runs secilc on the policy at build time. In particular, it tests that platform policy compiles on its own and that nonplatform + platform + mappig policy compiles as well. Test: CIL policy builds and compiles on-device using secilc Bug: 31363362 Change-Id: I769aeb3d8c913a5599f1a2195c69460ece7f6465
2017-02-25 23:47:53 +01:00
built_plat_cil :=
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
built_system_ext_cil :=
built_product_cil :=
Rename plat_pub_policy -> pub_policy Public policy that is available to vendor (and odm) sepolicy is a combination of system and product public sepolicy. Since "plat_" prefix implies a pure system sepolicy component, drop "plat_" prefix from "plat_pub_policy" to be consistent with naming in this file. Bug: 119305624 Test: m selinux_policy Change-Id: Iaf094702556ce97371fa1c58c01d707103d7f7d6
2019-01-15 22:31:03 +01:00
built_pub_vers_cil :=
Split mapping file into system and product parts Both mapping files need to be included when building sepolicy at boot time. Bug: 119305624 Test: boot taimen Test: "cnd" type is declared in /vendor; "dataservice_app" type is declared in /product. This permission is preserved "allow cnd dataservice_app:binder { transfer call };" Change-Id: I138f34208ea05e170defd2b4ef4700ffa81f9573
2019-01-16 00:16:55 +01:00
built_plat_mapping_cil :=
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
built_system_ext_mapping_cil :=
Split mapping file into system and product parts Both mapping files need to be included when building sepolicy at boot time. Bug: 119305624 Test: boot taimen Test: "cnd" type is declared in /vendor; "dataservice_app" type is declared in /product. This permission is preserved "allow cnd dataservice_app:binder { transfer call };" Change-Id: I138f34208ea05e170defd2b4ef4700ffa81f9573
2019-01-16 00:16:55 +01:00
built_product_mapping_cil :=
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
built_vendor_cil :=
Add /odm/etc/selinux/odm_sepolicy.cil This change adds the support of odm sepolicy customization, which can be configured through the newly added build varaible: - BOARD_ODM_SEPOLICY_DIRS += device/${ODM_NAME}/${BOM_NAME}/sepolicy Also moving precompiled sepolicy to /odm when BOARD_ODM_SEPOLICY_DIRS is set. On a DUT, precompiled sepolicy on /odm will override the one in /vendor. This is intentional because /odm is the hardware customization for /vendor and both should be updated together if desired. Bug: 64240127 Test: boot a device with /odm partition Change-Id: Ia8f81a78c88cbfefb3ff19e2ccd2648da6284d09
2017-11-27 04:41:33 +01:00
built_odm_cil :=
Precompiled kernel policy for on-device use This adds build targets for outputing precompiled kernel policy usable on devices with policy split between system and vendor partitions. On such devices, precompiled policy must reside on the vendor partition. Because such devices support updating these partitions independently of each other, the precompiled policy must reference the system partition's policy against which it was compiled. This enables init to establish whether the precompiled policy is valid for the current combination of system and vendor partitions. The referencing is performed by both the system and vendor partitions including the SHA-256 digest of the system partition's policy (plat_sepolicy.cil). Only the when the digest is the same on both partitions can the precompiled policy be used. Test: plat_sepolicy.cil.sha256 contains exactly the hex form of the SHA-256 digest of plat_sepolicy.cil Test: plat_sepolicy.cil.sha256 is identical precompiled_sepolicy.plat.sha256. Bug: 31363362 Change-Id: I9771e1aa751e25bba6e2face37d68e0ae43b33a3
2017-03-07 23:05:57 +01:00
built_precompiled_sepolicy :=
Switch recovery to versioned policy and split into components. And do some clean up: Replace LOCAL_TARGET_ARCH with global arch specifier that won't get clobbered, clean up sepolicy.recovery's eng specification, ensure that build macros are applied across all policy generation, not just plat_policy, and make sure that all private variables are cleared and alphabetized at the end. Bug: 31363362 Bug: 31369363 Test: Boot into recovery and observe no selinux denials. Change-Id: Ibc15b097f6d19acf01f6b22bee0e083b15f4ef75
2016-12-16 00:28:44 +01:00
built_sepolicy :=
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
built_sepolicy_neverallows :=
service_context: split into platform and non-platform components. Bug: 33746484 Test: Successfully boot with original service and property contexts. Successfully boot with split serivce and property contexts. Change-Id: Ide67d37d85273c60b9e387e72fbeb87be6da306a Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-12-28 00:10:48 +01:00
built_plat_svc :=
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
built_vendor_svc :=
Use user policy for compatibility tests. Use the user policy when running the compatibility tests. Bug: 74344625 Test: Built policy for many devices. Booted one device. Test: Delete some compat rules, verify error on userdebug. Change-Id: Ib2df2dfc06cdf55a839011e9a528e76160a9e436
2018-03-23 20:40:26 +01:00
built_plat_sepolicy :=
Add BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW A new sysprop neverallow rules are mandatory only for devices launching with R or later. For devices already launched, neverallow rules can be relaxed with adding following line to BoardConfig.mk: BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true Bug: 131162102 Test: Set PRODUCT_SHIPPING_API_LEVEL := 30 and try building with changing some system_public_prop to system_internal_prop Test: m cts sepolicy_tests Change-Id: Id978b4d81a8683a57304bb639961105e2d91fa9a Merged-In: Id978b4d81a8683a57304bb639961105e2d91fa9a (cherry picked from commit 3be11e7abb8f4fd651295f9ccb0ce087855c1cc0)
2019-09-26 08:14:55 +02:00
treble_sysprop_neverallow :=
Enforce sysprop owner Every property should have an appropriate owner attribute, which can be one of: system_property_type, product_property_type, or vendor_property_type. This will be enforced for devices launching with S or later. Devices launching with R or eariler can relax this by setting following under BoardConfig.mk: BUILD_BROKEN_ENFORCE_SYSPROP_OWNER := true Bug: 131162102 Test: system/sepolicy/tools/build_policies.sh Change-Id: I7914ef1b7463c9ec00812b9720094531fd63f0c7
2020-09-28 06:32:43 +02:00
enforce_sysprop_owner :=
Retain neverallow rules in CIL files Fixes issue where attributes used exlusively in neverallow rules were removed from policy. For on-device compile use the -N flag to skip neverallow tests. Policy size increases: vendor/etc/selinux/nonplat_sepolicy.cil 547849 -> 635637 vendor/etc/selinux/precompiled_sepolicy 440248 -> 441076 system/etc/selinux/plat_sepolicy.cil 567664 -> 745230 For a total increase in system/vendor: 266182. Boot time changes: Pixel uses precompiled policy so boot time is not impacted. When forcing on-device compile on Marlin selinux policy compile time increases 510-520 ms -> 550-560 ms. Bug: 37357742 Test: Build and boot Marlin. Test: Verify both precompiled and on-device compile work. Change-Id: Ib3cb53d376a96e34f55ac27d651a6ce2fabf6ba7
2017-04-22 00:57:07 +02:00
mapping_policy :=
Switch recovery to versioned policy and split into components. And do some clean up: Replace LOCAL_TARGET_ARCH with global arch specifier that won't get clobbered, clean up sepolicy.recovery's eng specification, ensure that build macros are applied across all policy generation, not just plat_policy, and make sure that all private variables are cleared and alphabetized at the end. Bug: 31363362 Bug: 31369363 Test: Boot into recovery and observe no selinux denials. Change-Id: Ibc15b097f6d19acf01f6b22bee0e083b15f4ef75
2016-12-16 00:28:44 +01:00
my_target_arch :=
Rename plat_pub_policy -> pub_policy Public policy that is available to vendor (and odm) sepolicy is a combination of system and product public sepolicy. Since "plat_" prefix implies a pure system sepolicy component, drop "plat_" prefix from "plat_pub_policy" to be consistent with naming in this file. Bug: 119305624 Test: m selinux_policy Change-Id: Iaf094702556ce97371fa1c58c01d707103d7f7d6
2019-01-15 22:31:03 +01:00
pub_policy.cil :=
Separate system_ext_sepolicy.cil out of system sepolicy Currently system sepolicy can be extended via: - BOARD_PLAT_PUBLIC_SEPOLICY_DIR - BOARD_PLAT_PRIVATE_SEPOLICY_DIR To support having a single shared core system sepolicy, those customization should be moved to the newly added system_ext partition. System-ext-specific sepolicy files will be installed into /system_ext/etc/selinux/*. system_ext_sepolicy.cil is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), the init will merge this file with the rest of the sepolicy at runtime. Bug: 137712473 Test: boot aosp_crosshatch with system_ext_sepolicy.cil Test: boot aosp_crosshatch without system_ext_sepolicy.cil Change-Id: I53984e8a973eff15de0653916203020dbabe9c03
2019-08-29 11:12:11 +02:00
system_ext_pub_policy.cil :=
plat_pub_policy.cil :=
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
reqd_policy_mask.cil :=
Switch recovery to versioned policy and split into components. And do some clean up: Replace LOCAL_TARGET_ARCH with global arch specifier that won't get clobbered, clean up sepolicy.recovery's eng specification, ensure that build macros are applied across all policy generation, not just plat_policy, and make sure that all private variables are cleared and alphabetized at the end. Bug: 31363362 Bug: 31369363 Test: Boot into recovery and observe no selinux denials. Change-Id: Ibc15b097f6d19acf01f6b22bee0e083b15f4ef75
2016-12-16 00:28:44 +01:00
sepolicy_build_files :=
Mark all clients of Allocator HAL This change associates all domains which are clients of Allocator HAL with hal_allocator_client and the, required for all HAL client domains, halclientdomain. This enables this commit to remove the now unnecessary hwallocator_use macro because its binder_call(..., hal_allocator_server) is covered by binder_call(hal_allocator_client, hal_allocator_server) added in this commit. Unfortunately apps, except isolated app, are clients of Allocator HAL as well. This makes it hard to use the hal_client_domain(..., hal_allocator) macro because it translates into "typeattribute" which currently does not support being provided with a set of types, such as { appdomain -isolated_app }. As a workaround, hopefully until typeattribute is improved, this commit expresses the necessary association operation in CIL. private/technical_debt.cil introduced by this commit is appended into the platform policy CIL file, thus ensuring that the hack has effect on the final monolithic policy. P. S. This change also removes Allocator HAL access from isolated_app. Isolated app shouldn't have access to this HAL anyway. Test: Google Play Music plays back radios Test: Google Camera records video with sound and that video is then successfully played back with sound Test: YouTube app plays back clips with sound Test: YouTube in Chrome plays back clips with sound Bug: 34170079 Change-Id: Id00bba6fde83e7cf04fb58bc1c353c2f66333f92
2017-03-21 22:28:53 +01:00
sepolicy_build_cil_workaround_files :=
Grant additional permissions for ASAN builds ASAN builds may require additional permissions to launch processes with ASAN wrappers. In this case, system_server needs permission to execute /system/bin/sh. Create with_asan() macro which can be used exclusively on debug builds. Note this means that ASAN builds with these additional permission will not pass the security portion of CTS - like any other debug build. Addresses: avc: denied { execute } for name="sh" dev="dm-0" ino=571 scontext=u:r:system_server:s0 tcontext=u:object_r:shell_exec:s0 tclass=file Test: lunch aosp_marlin-userdebug; cd system/sepolicy; mm SANITIZE_TARGET=address; Verify permissions granted using with_asan() are granted. Test: lunch aosp_marlin-userdebug; cd system/sepolicy; mm; Verify permissions granted using with_asan() are not granted. Test: lunch aosp_marlin-user; cd system/sepolicy; mm SANITIZE_TARGET=address; Verify permissions granted using with_asan() are not granted. Bug: 36138508 Change-Id: I6e39ada4bacd71687a593023f16b45bc16cd7ef8
2017-03-13 20:22:15 +01:00
with_asan :=
Moved Android policy tools to tools directory Change-Id: I57b0dd9f8071eae492020f410c87f465ba820711
2012-11-01 19:33:04 +01:00
include $(call all-makefiles-under,$(LOCAL_PATH))
Reference in a new issue Copy permalink