tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/Android.mk

125 lines
4.1 KiB
Makefile
Raw Normal View History

Do not build if HAVE_SELINUX=false.
2012-02-02 19:28:28 +01:00
ifeq ($(HAVE_SELINUX),true)
SE Android policy.
2012-01-04 18:33:27 +01:00
LOCAL_PATH:= $(call my-dir)
include $(CLEAR_VARS)
# SELinux policy version.
# Must be <= /selinux/policyvers reported by the Android kernel.
# Must be within the compatibility range reported by checkpolicy -V.
POLICYVERS := 24
MLS_SENS=1
MLS_CATS=1024
Add support for per-device .te and .fc files.
2012-03-06 17:12:41 +01:00
LOCAL_POLICY_DIRS := $(SRC_TARGET_DIR)/board/$(TARGET_DEVICE)/ device/*/$(TARGET_DEVICE)/ vendor/*/$(TARGET_DEVICE)/
Limit per-device policy files to a well-defined sepolicy prefix. Avoid any future collisions with the use of .fc or .te suffixes in the per-device directories. If we want multiple file support, add a separate subdirectory for sepolicy files.
2012-03-06 19:27:39 +01:00
LOCAL_POLICY_FC := $(wildcard $(addsuffix sepolicy.fc, $(LOCAL_POLICY_DIRS)))
LOCAL_POLICY_TE := $(wildcard $(addsuffix sepolicy.te, $(LOCAL_POLICY_DIRS)))
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
LOCAL_POLICY_PC := $(wildcard $(addsuffix sepolicy.pc, $(LOCAL_POLICY_DIRS)))
Support for ocontexts per device. ocontexts was split up into 4 files: 1.fs_use 2.genfs_contexts 3.initial_sid_contexts 4.port_contexts Each file has their respective declerations in them. Devices, in their respective device directory, can now specify sepolicy.fs_use, sepolicy.genfs_contexts, sepolicy.port_contexts, and sepolicy.initial_sid_contexts. These declerations will be added right behind their respective sepolicy counterparts in the concatenated configuration file.
2012-07-12 01:46:38 +02:00
LOCAL_POLICY_FS_USE := $(wildcard $(addsuffix sepolicy.fs_use, $(LOCAL_POLICY_DIRS)))
LOCAL_POLICY_PORT_CONTEXTS := $(wildcard $(addsuffix sepolicy.port_contexts, $(LOCAL_POLICY_DIRS)))
LOCAL_POLICY_GENFS_CONTEXTS := $(wildcard $(addsuffix sepolicy.genfs_contexts, $(LOCAL_POLICY_DIRS)))
LOCAL_POLICY_INITIAL_SID_CONTEXTS := $(wildcard $(addsuffix sepolicy.initial_sid_contexts, $(LOCAL_POLICY_DIRS)))
per device seapp_context support
2012-08-16 19:55:05 +02:00
LOCAL_POLICY_SC := $(wildcard $(addsuffix seapp_contexts, $(LOCAL_POLICY_DIRS)))
Add support for per-device .te and .fc files.
2012-03-06 17:12:41 +01:00
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
##################################
include $(CLEAR_VARS)
LOCAL_MODULE := sepolicy
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_SUFFIX := .$(POLICYVERS)
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
include $(BUILD_SYSTEM)/base_rules.mk
sepolicy_policy.conf := $(intermediates)/policy.conf
$(sepolicy_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
$(sepolicy_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Support for ocontexts per device. ocontexts was split up into 4 files: 1.fs_use 2.genfs_contexts 3.initial_sid_contexts 4.port_contexts Each file has their respective declerations in them. Devices, in their respective device directory, can now specify sepolicy.fs_use, sepolicy.genfs_contexts, sepolicy.port_contexts, and sepolicy.initial_sid_contexts. These declerations will be added right behind their respective sepolicy counterparts in the concatenated configuration file.
2012-07-12 01:46:38 +02:00
$(sepolicy_policy.conf) : $(wildcard $(addprefix $(LOCAL_PATH)/,security_classes initial_sids access_vectors global_macros mls_macros mls policy_capabilities te_macros attributes *.te) $(LOCAL_POLICY_TE) $(addprefix $(LOCAL_PATH)/, roles users initial_sid_contexts) $(LOCAL_POLICY_INITIAL_SID_CONTEXTS) $(addprefix $(LOCAL_PATH)/,fs_use) $(LOCAL_POLICY_FS_USE) $(addprefix $(LOCAL_PATH)/,genfs_contexts) $(LOCAL_POLICY_GENFS_CONTEXTS) $(addprefix $(LOCAL_PATH)/,port_contexts) $(LOCAL_POLICY_PORT_CONTEXTS))
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
@mkdir -p $(dir $@)
$(hide) m4 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) -s $^ > $@
Add a dependency on checkpolicy.
2012-01-24 14:46:13 +01:00
$(LOCAL_BUILT_MODULE) : $(sepolicy_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
@mkdir -p $(dir $@)
Use the checkpolicy built from source. Change-Id: I22f49db3d59b50ed8975d8c1146bb9c322adbf7e
2012-04-10 00:31:03 +02:00
$(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c $(POLICYVERS) -o $@ $<
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
sepolicy_policy.conf :=
##################################
include $(CLEAR_VARS)
LOCAL_MODULE := file_contexts
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Add support for per-device .te and .fc files.
2012-03-06 17:12:41 +01:00
include $(BUILD_SYSTEM)/base_rules.mk
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
Add support for per-device .te and .fc files.
2012-03-06 17:12:41 +01:00
file_contexts := $(intermediates)/file_contexts
$(file_contexts): $(LOCAL_PATH)/file_contexts $(LOCAL_POLICY_FC)
@mkdir -p $(dir $@)
Apply m4 to file_contexts and property_contexts to support includes.
2012-05-18 14:24:25 +02:00
$(hide) m4 -s $^ > $@
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
Add support for per-device .te and .fc files.
2012-03-06 17:12:41 +01:00
file_contexts :=
per device seapp_context support
2012-08-16 19:55:05 +02:00
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
##################################
include $(CLEAR_VARS)
LOCAL_MODULE := seapp_contexts
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
per device seapp_context support
2012-08-16 19:55:05 +02:00
include $(BUILD_SYSTEM)/base_rules.mk
seapp_contexts := $(intermediates)/seapp_contexts
$(seapp_contexts): $(LOCAL_PATH)/seapp_contexts $(LOCAL_POLICY_SC)
@mkdir -p $(dir $@)
$(hide) m4 -s $^ > $@
seapp_contexts :=
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
##################################
include $(CLEAR_VARS)
LOCAL_MODULE := property_contexts
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
include $(BUILD_SYSTEM)/base_rules.mk
property_contexts := $(intermediates)/property_contexts
$(property_contexts): $(LOCAL_PATH)/property_contexts $(LOCAL_POLICY_PC)
@mkdir -p $(dir $@)
Apply m4 to file_contexts and property_contexts to support includes.
2012-05-18 14:24:25 +02:00
$(hide) m4 -s $^ > $@
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
property_contexts :=
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
##################################
Do not build if HAVE_SELINUX=false.
2012-02-02 19:28:28 +01:00
Add selinux network script to policy Signed-off-by: Joshua Brindle <jbrindle@tresys.com>
2012-06-20 17:58:01 +02:00
##################################
include $(CLEAR_VARS)
LOCAL_MODULE := selinux-network.sh
LOCAL_SRC_FILES := $(LOCAL_MODULE)
LOCAL_MODULE_CLASS := EXECUTABLES
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_OUT_EXECUTABLES)
include $(BUILD_PREBUILT)
Add mac_permissions.xml file. This was moved from external/mac-policy.git
2012-07-30 15:33:03 +02:00
##################################
include $(CLEAR_VARS)
LOCAL_MODULE := mac_permissions.xml
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_OUT_ETC)/security
LOCAL_SRC_FILES := $(LOCAL_MODULE)
include $(BUILD_PREBUILT)
Add selinux network script to policy Signed-off-by: Joshua Brindle <jbrindle@tresys.com>
2012-06-20 17:58:01 +02:00
##################################
Do not build if HAVE_SELINUX=false.
2012-02-02 19:28:28 +01:00
endif #ifeq ($(HAVE_SELINUX),true)
Reference in a new issue Copy permalink