tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/Android.mk

1912 lines
73 KiB
Makefile
Raw Normal View History

SE Android policy.
2012-01-04 18:33:27 +01:00
LOCAL_PATH:= $(call my-dir)
Support overrides in seapp_contexts Provides support for overriding seapp_contexts declerations in per device seapp_contexts files. Change-Id: I23a0ffa1d24f1ce57825b168f29a2e885d3e1c51
2012-08-28 00:41:15 +02:00
Add sepolicy definitions.mk and create policy.conf function. Bug: 36899958 Test: Builds 'n' boots. Change-Id: I5836a18f9d0a9a976dda7304045e3b9e1e84565e Merged-In: I5836a18f9d0a9a976dda7304045e3b9e1e84565e (cherry picked from commit c0713e86790583dacbd8545d35ae476ff1f849bb)
2017-07-07 23:59:51 +02:00
include $(LOCAL_PATH)/definitions.mk
Create selinux_policy phony target Moves selinux policy build decisions to system/sepolicy/Android.mk. This is done because the PRODUCT_FULL_TREBLE variable isn't available in embedded.mk and TARGET_SANITIZE isn't available to dependencies of init. Test: Build/boot Bullhead PRODUCT_FULL_TREBLE=false Test: Build/boot Marlin PRODUCT_FULL_TREBLE=true Test: Build Marlin TARGET_SANITIZE=address. Verify asan rules are included in policy output. Bug: 36138508 Change-Id: I20a25ffdfbe2b28e7e0f3e090a4df321e85e1235
2017-03-23 00:20:24 +01:00
include $(CLEAR_VARS)
SE Android policy.
2012-01-04 18:33:27 +01:00
# SELinux policy version.
sepolicy: Drop BOARD_SEPOLICY_IGNORE/REPLACE support. With changes I431c1ab22fc53749f623937154b9ec43469d9645 and Ia54aa263f2245c7090f4b9d9703130c19f11bd28, it is no longer legitimate to use BOARD_SEPOLICY_IGNORE or REPLACE with any of the *_contexts files since the CTS requires the AOSP entries to be present in the device files. Further, these changes render BOARD_SEPOLICY_IGNORE unusable for most policy files since all domains and types referenced within any of the AOSP *_contexts entries must be defined in the kernel policy, so you cannot use BOARD_SEPOLICY_IGNORE to exclude any .te file that defines a type referenced in any of those *_contexts files. There does not seem to be a significant need for such a facility, as AOSP policy is small and only domains and types used by most devices should be defined in external/sepolicy. BOARD_SEPOLICY_REPLACE is commonly misused to eliminate neverallow rules from AOSP policy, which will only lead to CTS failures, especially since change Iefe508df265f62efa92f8eb74fc65542d39e3e74 introduced neverallow checking on the entire policy via sepolicy-analyze. The only remaining legitimate function of BOARD_SEPOLICY_REPLACE is to support overriding AOSP .te files with more restrictive rule sets. However, the need for this facility has been significantly reduced by the fact that AOSP policy is now fully confined + enforcing for all domains, and further restrictions beyond AOSP carry a compatibility risk. Builders of custom policies and custom ROMs still have the freedom to apply patches on top of external/sepolicy to tighten rule sets (which are likely more maintainable than maintaining a completely separate copy of the file via BOARD_SEPOLICY_REPLACE) and/or of using their own separate policy build system as exemplified by https://bitbucket.org/quarksecurity/build-policies Change-Id: I2611e983f7cbfa15f9d45ec3ea301e94132b06fa Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-13 15:03:52 +01:00
# Must be <= /sys/fs/selinux/policyvers reported by the Android kernel.
SE Android policy.
2012-01-04 18:33:27 +01:00
# Must be within the compatibility range reported by checkpolicy -V.
Migrate to upstream policy version 30 Grant untrusted_app and isolated_app unpriv_sock_perms, neverallow priv_sock_perms to disallow access to MAC address and ESSID. Change-Id: Idac3b657a153e7d7fdc647ff34b876a325d759b3
2015-12-07 17:30:43 +01:00
POLICYVERS ?= 30
SE Android policy.
2012-01-04 18:33:27 +01:00
MLS_SENS=1
MLS_CATS=1024
Drop BOARD_SEPOLICY_UNION. As suggested in the comments on https://android-review.googlesource.com/#/c/141560/ drop BOARD_SEPOLICY_UNION and simplify the build_policy logic. Union all files found under BOARD_SEPOLICY_DIRS. Unlike BOARD_SEPOLICY_REPLACE/IGNORE, on which we trigger an error to catch any lingering uses and force updating of the BoardConfig.mk files, we only warn on uses of BOARD_SEPOLICY_UNION to avoid breaking the build until all device BoardConfig*.mk files have been updated, and since they should be harmless - the files will be unioned regardless. Change-Id: I4214893c999c23631f5456cb1b8edd59771ef13b Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-04-01 16:14:56 +02:00
ifdef BOARD_SEPOLICY_UNION
$(warning BOARD_SEPOLICY_UNION is no longer required - all files found in BOARD_SEPOLICY_DIRS are implicitly unioned; please remove from your BoardConfig.mk or other .mk file.)
endif
Android.mk: Add support for BOARD_SEPOLICY_M4DEFS Allow device builders to pass arbitrary m4 definitions during the build via make variable BOARD_SEPOLICY_M4DEFS. This enables OEMs to define their own static policy build conditionals. Change-Id: Ibea1dbb7b8615576c5668e47f16ed0eedfa0b73c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-07-16 20:28:02 +02:00
ifdef BOARD_SEPOLICY_M4DEFS
LOCAL_ADDITIONAL_M4DEFS := $(addprefix -D, $(BOARD_SEPOLICY_M4DEFS))
Add sepolicy definitions.mk and create policy.conf function. Bug: 36899958 Test: Builds 'n' boots. Change-Id: I5836a18f9d0a9a976dda7304045e3b9e1e84565e Merged-In: I5836a18f9d0a9a976dda7304045e3b9e1e84565e (cherry picked from commit c0713e86790583dacbd8545d35ae476ff1f849bb)
2017-07-07 23:59:51 +02:00
else
LOCAL_ADDITIONAL_M4DEFS :=
Android.mk: Add support for BOARD_SEPOLICY_M4DEFS Allow device builders to pass arbitrary m4 definitions during the build via make variable BOARD_SEPOLICY_M4DEFS. This enables OEMs to define their own static policy build conditionals. Change-Id: Ibea1dbb7b8615576c5668e47f16ed0eedfa0b73c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-07-16 20:28:02 +02:00
endif
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
# sepolicy is now divided into multiple portions:
# public - policy exported on which non-platform policy developers may write
# additional policy. types and attributes are versioned and included in
# delivered non-platform policy, which is to be combined with platform policy.
# private - platform-only policy required for platform functionality but which
# is not exported to vendor policy developers and as such may not be assumed
# to exist.
Device-agnostic policy for vendor image Default HAL implementations are built from the platform tree and get placed into the vendor image. The SELinux rules needed for these HAL implementations to operate thus need to reside on the vendor partition. Up to now, the only place to define such rules in the source tree was the system/sepolicy/public directory. These rules are placed into the vendor partition. Unfortunately, they are also placed into the system/root partition, which thus unnecessarily grants these rules to all HAL implementations of the specified service, default/in-process shims or not. This commit adds a new directory, system/sepolicy/vendor, whose rules are concatenated with the device-specific rules at build time. These rules are thus placed into the vendor partition and are not placed into the system/root partition. Test: No change to SELinux policy. Test: Rules placed into vendor directory end up in nonplat* artefacts, but not in plat* artefacts. Bug: 34715716 Change-Id: Iab14aa7a3311ed6d53afff673e5d112428941f1c
2017-01-31 03:44:59 +01:00
# vendor - vendor-only policy required for vendor functionality. This policy can
# reference the public policy but cannot reference the private policy. This
# policy is for components which are produced from the core/non-vendor tree and
# placed into a vendor partition.
Restore checkfc and neverallow checks. Bug: 33388095 Test: Builds and boots. Change-Id: Ief9064a16fc733bed54eb76f509ff5aaf5db4baf
2016-12-07 20:27:47 +01:00
# mapping - This contains policy statements which map the attributes
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
# exposed in the public policy of previous versions to the concrete types used
# in this policy to ensure that policy targeting attributes from public
# policy from an older platform version continues to work.
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
# build process for device:
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
# 1) convert policies to CIL:
# - private + public platform policy to CIL
# - mapping file to CIL (should already be in CIL form)
# - non-platform public policy to CIL
# - non-platform public + private policy to CIL
# 2) attributize policy
# - run script which takes non-platform public and non-platform combined
# private + public policy and produces attributized and versioned
# non-platform policy
# 3) combine policy files
# - combine mapping, platform and non-platform policy.
# - compile output binary policy file
PLAT_PUBLIC_POLICY := $(LOCAL_PATH)/public
PLAT_PRIVATE_POLICY := $(LOCAL_PATH)/private
Device-agnostic policy for vendor image Default HAL implementations are built from the platform tree and get placed into the vendor image. The SELinux rules needed for these HAL implementations to operate thus need to reside on the vendor partition. Up to now, the only place to define such rules in the source tree was the system/sepolicy/public directory. These rules are placed into the vendor partition. Unfortunately, they are also placed into the system/root partition, which thus unnecessarily grants these rules to all HAL implementations of the specified service, default/in-process shims or not. This commit adds a new directory, system/sepolicy/vendor, whose rules are concatenated with the device-specific rules at build time. These rules are thus placed into the vendor partition and are not placed into the system/root partition. Test: No change to SELinux policy. Test: Rules placed into vendor directory end up in nonplat* artefacts, but not in plat* artefacts. Bug: 34715716 Change-Id: Iab14aa7a3311ed6d53afff673e5d112428941f1c
2017-01-31 03:44:59 +01:00
PLAT_VENDOR_POLICY := $(LOCAL_PATH)/vendor
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
REQD_MASK_POLICY := $(LOCAL_PATH)/reqd_mask
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
PRODUCT_PUBLIC_POLICY := $(BOARD_PLAT_PUBLIC_SEPOLICY_DIR)
PRODUCT_PRIVATE_POLICY := $(BOARD_PLAT_PRIVATE_SEPOLICY_DIR)
# TODO(b/119305624): Currently if the device doesn't have a product partition,
# we install product sepolicy into /system/product. We do that because bits of
# product sepolicy that's still in /system might depend on bits that have moved
# to /product. Once we finish migrating product sepolicy out of system, change
# it so that if no product partition is present, product sepolicy artifacts are
# not built and installed at all.
ifneq (,$(PRODUCT_PUBLIC_POLICY)$(PRODUCT_PRIVATE_POLICY))
HAS_PRODUCT_SEPOLICY := true
endif
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
# TODO: move to README when doing the README update and finalizing versioning.
sepolicy_version: change current version to NN.m format The sepolicy version takes SDK_INT.<minor> format. Make sure our 'current' policy version reflects the format and make it '100000.0'. This ensures any vendor.img compiled with this will never work with a production framework image either. Make version_policy replace the '.' in version by '_' so secilc is happy too. This unblocks libvintf from giving out a runtme API to check vendor's sepolicy version. The PLAT_PUBLIC_SEPOLICY_CURRENT_VERSION will eventually be picked up from the build system. Bug: 35217573 Test: Build and boot sailfish. Boot sailfish with sepolicy compilation on device. Signed-off-by: Sandeep Patil <sspatil@google.com> Change-Id: Ic8b6687c4e71227bf9090018999149cd9e11d63b
2017-04-07 23:18:48 +02:00
# BOARD_SEPOLICY_VERS must take the format "NN.m" and contain the sepolicy
# version identifier corresponding to the sepolicy on which the non-platform
# policy is to be based. If unspecified, this will build against the current
# public platform policy in tree
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
ifndef BOARD_SEPOLICY_VERS
$(warning BOARD_SEPOLICY_VERS not specified, assuming current platform version)
sepolicy_version: change current version to NN.m format The sepolicy version takes SDK_INT.<minor> format. Make sure our 'current' policy version reflects the format and make it '100000.0'. This ensures any vendor.img compiled with this will never work with a production framework image either. Make version_policy replace the '.' in version by '_' so secilc is happy too. This unblocks libvintf from giving out a runtme API to check vendor's sepolicy version. The PLAT_PUBLIC_SEPOLICY_CURRENT_VERSION will eventually be picked up from the build system. Bug: 35217573 Test: Build and boot sailfish. Boot sailfish with sepolicy compilation on device. Signed-off-by: Sandeep Patil <sspatil@google.com> Change-Id: Ic8b6687c4e71227bf9090018999149cd9e11d63b
2017-04-07 23:18:48 +02:00
# The default platform policy version.
Add PLATFORM_SEPOLICY_VERSION. Create PLATFORM_SEPOLICY_VERSION, which is a version string to represent the platform sepolicy of the form "NN.m" where "NN" mirrors the PLATFORM_SDK_VERSION and "m" is a policy-based minor version that is incremented with every policy change that requires a new backward-compatible mapping file to be added to allow for future-proofing vendor policy against future platform policy. Bug: 36783775 Test: Device boots when sha256 doesn't match and compilation is forced. Change-Id: I4edb29824f2050a5a6e1bc078c100cf42e45c303
2017-04-08 01:36:23 +02:00
BOARD_SEPOLICY_VERS := $(PLATFORM_SEPOLICY_VERSION)
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
endif
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
NEVERALLOW_ARG :=
ifeq ($(SELINUX_IGNORE_NEVERALLOWS),true)
ifeq ($(TARGET_BUILD_VARIANT),user)
$(error SELINUX_IGNORE_NEVERALLOWS := true cannot be used in user builds)
endif
$(warning Be careful when using the SELINUX_IGNORE_NEVERALLOWS flag. \
It does not work in user builds and using it will \
not stop you from failing CTS.)
NEVERALLOW_ARG := -N
endif
Add /odm/etc/selinux/odm_sepolicy.cil This change adds the support of odm sepolicy customization, which can be configured through the newly added build varaible: - BOARD_ODM_SEPOLICY_DIRS += device/${ODM_NAME}/${BOM_NAME}/sepolicy Also moving precompiled sepolicy to /odm when BOARD_ODM_SEPOLICY_DIRS is set. On a DUT, precompiled sepolicy on /odm will override the one in /vendor. This is intentional because /odm is the hardware customization for /vendor and both should be updated together if desired. Bug: 64240127 Test: boot a device with /odm partition Change-Id: Ia8f81a78c88cbfefb3ff19e2ccd2648da6284d09
2017-11-27 04:41:33 +01:00
# BOARD_SEPOLICY_DIRS was used for vendor/odm sepolicy customization before.
# It has been replaced by BOARD_VENDOR_SEPOLICY_DIRS (mandatory) and
# BOARD_ODM_SEPOLICY_DIRS (optional). BOARD_SEPOLICY_DIRS is still allowed for
# backward compatibility, which will be merged into BOARD_VENDOR_SEPOLICY_DIRS.
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
ifdef BOARD_SEPOLICY_DIRS
BOARD_VENDOR_SEPOLICY_DIRS += $(BOARD_SEPOLICY_DIRS)
endif
Fix build part 2. Always create platform_mapping_file. commit 552fb537129e9b446e79af53216c08d15e69144e fixed an undefined module error by removing the module when not defined (on non-treble devices), but the sepolicy build on non-treble devices was changed to rely on the split treble files, even though the split is not used. Change this so that the file is always present, to allow policy compilation. Test: policy fully builds. Change-Id: Ia0934c739336cea54228bbff8d6644aa3ae501e5
2017-04-12 23:28:34 +02:00
Add /odm/etc/selinux/odm_sepolicy.cil This change adds the support of odm sepolicy customization, which can be configured through the newly added build varaible: - BOARD_ODM_SEPOLICY_DIRS += device/${ODM_NAME}/${BOM_NAME}/sepolicy Also moving precompiled sepolicy to /odm when BOARD_ODM_SEPOLICY_DIRS is set. On a DUT, precompiled sepolicy on /odm will override the one in /vendor. This is intentional because /odm is the hardware customization for /vendor and both should be updated together if desired. Bug: 64240127 Test: boot a device with /odm partition Change-Id: Ia8f81a78c88cbfefb3ff19e2ccd2648da6284d09
2017-11-27 04:41:33 +01:00
ifdef BOARD_ODM_SEPOLICY_DIRS
ifneq ($(PRODUCT_SEPOLICY_SPLIT),true)
$(error PRODUCT_SEPOLICY_SPLIT needs to be true when using BOARD_ODM_SEPOLICY_DIRS)
endif
endif
Fix build part 2. Always create platform_mapping_file. commit 552fb537129e9b446e79af53216c08d15e69144e fixed an undefined module error by removing the module when not defined (on non-treble devices), but the sepolicy build on non-treble devices was changed to rely on the split treble files, even though the split is not used. Change this so that the file is always present, to allow policy compilation. Test: policy fully builds. Change-Id: Ia0934c739336cea54228bbff8d6644aa3ae501e5
2017-04-12 23:28:34 +02:00
platform_mapping_file := $(BOARD_SEPOLICY_VERS).cil
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
###########################################################
# Compute policy files to be used in policy build.
# $(1): files to include
# $(2): directories in which to find files
###########################################################
define build_policy
$(foreach type, $(1), $(foreach file, $(addsuffix /$(type), $(2)), $(sort $(wildcard $(file)))))
endef
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: Id79cc6f434c41179d5c0d0d739c4718918b0b1dc Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
# Builds paths for all policy files found in BOARD_VENDOR_SEPOLICY_DIRS.
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: I3775eae11bfa5905cad0d02a0bf26c76ac03437c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
# $(1): the set of policy name paths to build
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
build_vendor_policy = $(call build_policy, $(1), $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS))
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: I3775eae11bfa5905cad0d02a0bf26c76ac03437c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
Add /odm/etc/selinux/odm_file_contexts Bug: 64240127 Test: normal boot and recovery boot a device Change-Id: I087292fb23d05fc17272778d668ac78a721b2593
2017-11-29 09:14:53 +01:00
# Builds paths for all policy files found in BOARD_ODM_SEPOLICY_DIRS.
build_odm_policy = $(call build_policy, $(1), $(BOARD_ODM_SEPOLICY_DIRS))
Ensure newlines are added between context config files When multiple file_contexts, service_contexts and property_contexts are processed by the m4(1) macro processor, they will fail if one or more of the intermediate files final line is not terminated by a newline. This patch adds an intervening file only containing a newline. Change-Id: Ie66b32fe477d08c69e6d6eb1725f658adc384ce4 Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-12-11 11:39:19 +01:00
# Add a file containing only a newline in-between each policy configuration
# 'contexts' file. This will allow OEM policy configuration files without a
# final newline (0x0A) to be built correctly by the m4(1) macro processor.
# $(1): the set of contexts file names.
# $(2): the file containing only 0x0A.
add_nl = $(foreach entry, $(1), $(subst $(entry), $(entry) $(2), $(entry)))
Generate selinux_policy.xml as part of CTS build. Bug: 16563899 Bug: 14251916 Change-Id: Id3172b73f10186ba361caf6b7333e5d2a0648475
2014-07-26 04:11:52 +02:00
sepolicy_build_files := security_classes \
initial_sids \
access_vectors \
global_macros \
recovery.te: add /data neverallow rules Recovery should never be accessing files from /data. In particular, /data may be encrypted, and the files within /data will be inaccessible to recovery, because recovery doesn't know the decryption key. Enforce write/execute restrictions on recovery. We can't tighten it up further because domain.te contains some /data read-only access rules, which shouldn't apply to recovery but do. Create neverallow_macros, used for storing permission macros useful for neverallow rules. Standardize recovery.te and property_data_file on the new macros. Change-Id: I02346ab924fe2fdb2edc7659cb68c4f8dffa1e88
2014-11-06 00:30:41 +01:00
neverallow_macros \
Generate selinux_policy.xml as part of CTS build. Bug: 16563899 Bug: 14251916 Change-Id: Id3172b73f10186ba361caf6b7333e5d2a0648475
2014-07-26 04:11:52 +02:00
mls_macros \
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
mls_decl \
Generate selinux_policy.xml as part of CTS build. Bug: 16563899 Bug: 14251916 Change-Id: Id3172b73f10186ba361caf6b7333e5d2a0648475
2014-07-26 04:11:52 +02:00
mls \
policy_capabilities \
te_macros \
attributes \
Reduce socket ioctl perms Reduce the socket ioctl commands available to untrusted/isolated apps. Neverallow accessing sensitive information or setting of network parameters. Neverallow access to device private ioctls i.e. device specific customizations as these are a common source of driver bugs. Define common ioctl commands in ioctl_defines. Bug: 26267358 Change-Id: Ic5c0af066e26d4cb2867568f53a3e65c5e3b5a5d
2015-12-22 19:39:34 +01:00
ioctl_defines \
restrict app access to socket ioctls Create a macro of unprivileged ioctls including - All common socket ioctls except MAC address - All wireless extensions ioctls except get/set ESSID - Some commonly used tty ioctls Bug: 21657002 Change-Id: Ib08be9cb70d08c1fa2c8bddbae519e7c2df5293c
2015-06-06 00:28:55 +02:00
ioctl_macros \
Generate selinux_policy.xml as part of CTS build. Bug: 16563899 Bug: 14251916 Change-Id: Id3172b73f10186ba361caf6b7333e5d2a0648475
2014-07-26 04:11:52 +02:00
*.te \
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
roles_decl \
Generate selinux_policy.xml as part of CTS build. Bug: 16563899 Bug: 14251916 Change-Id: Id3172b73f10186ba361caf6b7333e5d2a0648475
2014-07-26 04:11:52 +02:00
roles \
users \
initial_sid_contexts \
fs_use \
genfs_contexts \
port_contexts
Mark all clients of Allocator HAL This change associates all domains which are clients of Allocator HAL with hal_allocator_client and the, required for all HAL client domains, halclientdomain. This enables this commit to remove the now unnecessary hwallocator_use macro because its binder_call(..., hal_allocator_server) is covered by binder_call(hal_allocator_client, hal_allocator_server) added in this commit. Unfortunately apps, except isolated app, are clients of Allocator HAL as well. This makes it hard to use the hal_client_domain(..., hal_allocator) macro because it translates into "typeattribute" which currently does not support being provided with a set of types, such as { appdomain -isolated_app }. As a workaround, hopefully until typeattribute is improved, this commit expresses the necessary association operation in CIL. private/technical_debt.cil introduced by this commit is appended into the platform policy CIL file, thus ensuring that the hack has effect on the final monolithic policy. P. S. This change also removes Allocator HAL access from isolated_app. Isolated app shouldn't have access to this HAL anyway. Test: Google Play Music plays back radios Test: Google Camera records video with sound and that video is then successfully played back with sound Test: YouTube app plays back clips with sound Test: YouTube in Chrome plays back clips with sound Bug: 34170079 Change-Id: Id00bba6fde83e7cf04fb58bc1c353c2f66333f92
2017-03-21 22:28:53 +01:00
# CIL files which contain workarounds for current limitation of human-readable
# module policy language. These files are appended to the CIL files produced
# from module language files.
sepolicy_build_cil_workaround_files := technical_debt.cil
Switch recovery to versioned policy and split into components. And do some clean up: Replace LOCAL_TARGET_ARCH with global arch specifier that won't get clobbered, clean up sepolicy.recovery's eng specification, ensure that build macros are applied across all policy generation, not just plat_policy, and make sure that all private variables are cleared and alphabetized at the end. Bug: 31363362 Bug: 31369363 Test: Boot into recovery and observe no selinux denials. Change-Id: Ibc15b097f6d19acf01f6b22bee0e083b15f4ef75
2016-12-16 00:28:44 +01:00
my_target_arch := $(TARGET_ARCH)
ifneq (,$(filter mips mips64,$(TARGET_ARCH)))
my_target_arch := mips
endif
Specify intermediates dir for sepolicy Policy intermediates are being placed in a seemingly random intermediates directories. Currently: out/target/product/marlin/obj_arm/SHARED_LIBRARIES/libsoftkeymaster_intermediates Instead, place intermediates in the sepolicy_intermediates dir. Test: intermediates now placed in: out/target/product/marlin/obj/ETC/sepolicy_intermediates Test: Marlin builds, no change to sepolicy on device. Bug: 36269118 Change-Id: Ib6e9d9033be4dc8db0cc66cb47d9dc35d38703fe
2017-03-15 21:37:35 +01:00
intermediates := $(TARGET_OUT_INTERMEDIATES)/ETC/sepolicy_intermediates
Grant additional permissions for ASAN builds ASAN builds may require additional permissions to launch processes with ASAN wrappers. In this case, system_server needs permission to execute /system/bin/sh. Create with_asan() macro which can be used exclusively on debug builds. Note this means that ASAN builds with these additional permission will not pass the security portion of CTS - like any other debug build. Addresses: avc: denied { execute } for name="sh" dev="dm-0" ino=571 scontext=u:r:system_server:s0 tcontext=u:object_r:shell_exec:s0 tclass=file Test: lunch aosp_marlin-userdebug; cd system/sepolicy; mm SANITIZE_TARGET=address; Verify permissions granted using with_asan() are granted. Test: lunch aosp_marlin-userdebug; cd system/sepolicy; mm; Verify permissions granted using with_asan() are not granted. Test: lunch aosp_marlin-user; cd system/sepolicy; mm SANITIZE_TARGET=address; Verify permissions granted using with_asan() are not granted. Bug: 36138508 Change-Id: I6e39ada4bacd71687a593023f16b45bc16cd7ef8
2017-03-13 20:22:15 +01:00
with_asan := false
ifneq (,$(filter address,$(SANITIZE_TARGET)))
with_asan := true
endif
Prepare python tests to be run in CTS Bug: 37008075 Test: build, all tests pass. Modify some attributes locally to cause tests to fail (verify that they are actually working). Change-Id: If9f9ece61dff835f38ef9c8a57f5a7baddbae5cd
2017-10-04 18:42:29 +02:00
# Library extension for host-side tests
Fix typo and Mac build FAILED: out/target/product/sailfish/obj/ETC/treble_sepolicy_tests_intermediates/treble_sepolicy_tests Error: library-path out/host/darwin-x86/lib64/libsepolwrap.so does not exist Note, fixing here instead of reverting to avoid reverting changes in CTS. Test: ctate testing on Mac Change-Id: I95f483b152d9bece1a16267cbc49eedb1f902990
2017-10-05 03:15:44 +02:00
ifeq ($(HOST_OS),darwin)
Prepare python tests to be run in CTS Bug: 37008075 Test: build, all tests pass. Modify some attributes locally to cause tests to fail (verify that they are actually working). Change-Id: If9f9ece61dff835f38ef9c8a57f5a7baddbae5cd
2017-10-04 18:42:29 +02:00
SHAREDLIB_EXT=dylib
else
SHAREDLIB_EXT=so
endif
Split selinux_policy module into two. Create one _system and one _nonsystem target, which together contains the same artifacts as before, just split by whether they go on the system partition or not. The product build hierarchy is being refactored to be split by partition, so these targets facilitate inclusion of just the system parts where necessary. Also keep the selinux_policy target around for products that don't need the split. Bug: 80410283 Test: for t in eng userdebug user; do lunch mainline_arm64-${t}; m nothing; done Test: verified walleye /system and /vendor identical before and after, via: Test: /google/data/rw/users/cc/ccross/bin/compare-target-files.sh P6259983 walleye-userdebug "SYSTEM/*" "VENDOR/*" Test: only diffs are in build.prop files (timestamps and the like) Change-Id: I0f5d8a1558a164ce5cfb7d521f34b431855ac260
2018-07-02 15:31:29 +02:00
#################################
Change mapping file name to reflect its platform version. As the platform progresses in the split SELinux world, the platform will need to maintain mapping files back to previous platform versions to maintain backwards compatibility with vendor images which have SELinux policy written based on the older versions. This requires shipping multiple mapping files with the system image so that the right one can be selected. Change the name and location of the mapping file to reflect this. Also add a file to the vendor partition indicating which version is being targeted that the platform can use to determine which mapping file to choose. Bug: 36783775 Test: Force compilation of sepolicy on-device with mapping file changed to new location and name, using the value reported on /vendor. Change-Id: I93ab3e52c2c80c493719dc3825bc731867ea76d4
2017-04-10 21:27:18 +02:00
include $(CLEAR_VARS)
Split selinux_policy module into two. Create one _system and one _nonsystem target, which together contains the same artifacts as before, just split by whether they go on the system partition or not. The product build hierarchy is being refactored to be split by partition, so these targets facilitate inclusion of just the system parts where necessary. Also keep the selinux_policy target around for products that don't need the split. Bug: 80410283 Test: for t in eng userdebug user; do lunch mainline_arm64-${t}; m nothing; done Test: verified walleye /system and /vendor identical before and after, via: Test: /google/data/rw/users/cc/ccross/bin/compare-target-files.sh P6259983 walleye-userdebug "SYSTEM/*" "VENDOR/*" Test: only diffs are in build.prop files (timestamps and the like) Change-Id: I0f5d8a1558a164ce5cfb7d521f34b431855ac260
2018-07-02 15:31:29 +02:00
Change mapping file name to reflect its platform version. As the platform progresses in the split SELinux world, the platform will need to maintain mapping files back to previous platform versions to maintain backwards compatibility with vendor images which have SELinux policy written based on the older versions. This requires shipping multiple mapping files with the system image so that the right one can be selected. Change the name and location of the mapping file to reflect this. Also add a file to the vendor partition indicating which version is being targeted that the platform can use to determine which mapping file to choose. Bug: 36783775 Test: Force compilation of sepolicy on-device with mapping file changed to new location and name, using the value reported on /vendor. Change-Id: I93ab3e52c2c80c493719dc3825bc731867ea76d4
2017-04-10 21:27:18 +02:00
LOCAL_MODULE := selinux_policy
LOCAL_MODULE_TAGS := optional
Always build system and vendor policies (and related artifacts). Part of an effort to remove Treble-specifics from the way be build sepolicy. Bug: 70851112 Test: build and boot bullhead. Change-Id: I236f031e1b017875fb1afcc4f1b201699139516a
2018-05-09 03:52:11 +02:00
LOCAL_REQUIRED_MODULES += \
Split selinux_policy module into two. Create one _system and one _nonsystem target, which together contains the same artifacts as before, just split by whether they go on the system partition or not. The product build hierarchy is being refactored to be split by partition, so these targets facilitate inclusion of just the system parts where necessary. Also keep the selinux_policy target around for products that don't need the split. Bug: 80410283 Test: for t in eng userdebug user; do lunch mainline_arm64-${t}; m nothing; done Test: verified walleye /system and /vendor identical before and after, via: Test: /google/data/rw/users/cc/ccross/bin/compare-target-files.sh P6259983 walleye-userdebug "SYSTEM/*" "VENDOR/*" Test: only diffs are in build.prop files (timestamps and the like) Change-Id: I0f5d8a1558a164ce5cfb7d521f34b431855ac260
2018-07-02 15:31:29 +02:00
selinux_policy_nonsystem \
selinux_policy_system \
Always build system and vendor policies (and related artifacts). Part of an effort to remove Treble-specifics from the way be build sepolicy. Bug: 70851112 Test: build and boot bullhead. Change-Id: I236f031e1b017875fb1afcc4f1b201699139516a
2018-05-09 03:52:11 +02:00
Split selinux_policy module into two. Create one _system and one _nonsystem target, which together contains the same artifacts as before, just split by whether they go on the system partition or not. The product build hierarchy is being refactored to be split by partition, so these targets facilitate inclusion of just the system parts where necessary. Also keep the selinux_policy target around for products that don't need the split. Bug: 80410283 Test: for t in eng userdebug user; do lunch mainline_arm64-${t}; m nothing; done Test: verified walleye /system and /vendor identical before and after, via: Test: /google/data/rw/users/cc/ccross/bin/compare-target-files.sh P6259983 walleye-userdebug "SYSTEM/*" "VENDOR/*" Test: only diffs are in build.prop files (timestamps and the like) Change-Id: I0f5d8a1558a164ce5cfb7d521f34b431855ac260
2018-07-02 15:31:29 +02:00
include $(BUILD_PHONY_PACKAGE)
Always build system and vendor policies (and related artifacts). Part of an effort to remove Treble-specifics from the way be build sepolicy. Bug: 70851112 Test: build and boot bullhead. Change-Id: I236f031e1b017875fb1afcc4f1b201699139516a
2018-05-09 03:52:11 +02:00
Split selinux_policy module into two. Create one _system and one _nonsystem target, which together contains the same artifacts as before, just split by whether they go on the system partition or not. The product build hierarchy is being refactored to be split by partition, so these targets facilitate inclusion of just the system parts where necessary. Also keep the selinux_policy target around for products that don't need the split. Bug: 80410283 Test: for t in eng userdebug user; do lunch mainline_arm64-${t}; m nothing; done Test: verified walleye /system and /vendor identical before and after, via: Test: /google/data/rw/users/cc/ccross/bin/compare-target-files.sh P6259983 walleye-userdebug "SYSTEM/*" "VENDOR/*" Test: only diffs are in build.prop files (timestamps and the like) Change-Id: I0f5d8a1558a164ce5cfb7d521f34b431855ac260
2018-07-02 15:31:29 +02:00
include $(CLEAR_VARS)
LOCAL_MODULE := selinux_policy_system
Always build system and vendor policies (and related artifacts). Part of an effort to remove Treble-specifics from the way be build sepolicy. Bug: 70851112 Test: build and boot bullhead. Change-Id: I236f031e1b017875fb1afcc4f1b201699139516a
2018-05-09 03:52:11 +02:00
# These build targets are not used on non-Treble devices. However, we build these to avoid
# divergence between Treble and non-Treble devices.
Change mapping file name to reflect its platform version. As the platform progresses in the split SELinux world, the platform will need to maintain mapping files back to previous platform versions to maintain backwards compatibility with vendor images which have SELinux policy written based on the older versions. This requires shipping multiple mapping files with the system image so that the right one can be selected. Change the name and location of the mapping file to reflect this. Also add a file to the vendor partition indicating which version is being targeted that the platform can use to determine which mapping file to choose. Bug: 36783775 Test: Force compilation of sepolicy on-device with mapping file changed to new location and name, using the value reported on /vendor. Change-Id: I93ab3e52c2c80c493719dc3825bc731867ea76d4
2017-04-10 21:27:18 +02:00
LOCAL_REQUIRED_MODULES += \
$(platform_mapping_file) \
Use PLATFORM_SEPOLICY_COMPAT_VERSIONS This is a list of sepolicy versions that the framework supports. Test: builds and boots Bug: 67920434 Change-Id: I0f408fa3967214b47a64101760dbbb2542023dcf
2018-02-07 20:13:57 +01:00
$(addsuffix .cil,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS)) \
Change mapping file name to reflect its platform version. As the platform progresses in the split SELinux world, the platform will need to maintain mapping files back to previous platform versions to maintain backwards compatibility with vendor images which have SELinux policy written based on the older versions. This requires shipping multiple mapping files with the system image so that the right one can be selected. Change the name and location of the mapping file to reflect this. Also add a file to the vendor partition indicating which version is being targeted that the platform can use to determine which mapping file to choose. Bug: 36783775 Test: Force compilation of sepolicy on-device with mapping file changed to new location and name, using the value reported on /vendor. Change-Id: I93ab3e52c2c80c493719dc3825bc731867ea76d4
2017-04-10 21:27:18 +02:00
plat_sepolicy.cil \
plat_and_mapping_sepolicy.cil.sha256 \
secilc \
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
Move non-treble devices to split file_contexts This change is primarily to fix CTS which checks file ordering of file_contexts. Having two separate means of loading file_contexts has resulted in ordering variations. Previously the binary file_contexts was preferred since it loaded faster. However with the move to libpcre2, there is no difference in loading time between text and binary file_contexts. This leaves us with build system complexity with no benefit. Thus removing this unnecessary difference between devices. Bug: 38502071 Test: build and boot non-Treble Bullhead, run CTS tests below Test: build and boot Treble Marlin, run CTS tests below Test: cts-tradefed run singleCommand cts --skip-device-info \ --skip-preconditions --skip-connectivity-check --abi arm64-v8a \ --module CtsSecurityHostTestCases \ -t android.security.cts.SELinuxHostTest#testAospFileContexts Test: cts-tradefed run singleCommand cts --skip-device-info \ --skip-preconditions --skip-connectivity-check --abi arm64-v8a \ --module CtsSecurityHostTestCases \ -t android.security.cts.SELinuxHostTest#testValidFileContexts Change-Id: I088b3aeafaaab320f6658feb058a1fb89cbb65e1
2017-06-08 22:24:15 +02:00
LOCAL_REQUIRED_MODULES += \
Using a python script to build sepolicy Current sepolicy CIL files are built by several command-line tools in Android.mk. This change extracts some of the build logic into a python script to relief the effort in Android.mk. The first command is `build_sepolicy build_cil`. It's possible to add more sub-commands under the build_sepolicy script in the future. Bug: 64240127 Test: build bullhead/taimen Change-Id: Ie0ae4fc5256a550c72954cde5d5dd213a22d159a
2018-02-05 10:41:02 +01:00
build_sepolicy \
move build dependencies to sepolicy Some selinux build packages are defined in embedded.mk, others are defined in system/sepolicy/Android.mk. Move all to sepolicy as a dependency of the phony package selinux_policy which is defined in embedded.mk. Test: build Marlin (Treble) and Angler (non-Treble) Merged-In: Ib0443ad3da600447fbb51f2e9f91de04dcf5f9f6 Change-Id: Ib0443ad3da600447fbb51f2e9f91de04dcf5f9f6
2017-08-22 22:29:53 +02:00
plat_file_contexts \
plat_mac_permissions.xml \
plat_property_contexts \
plat_seapp_contexts \
plat_service_contexts \
plat_hwservice_contexts \
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
searchpolicy \
Split selinux_policy module into two. Create one _system and one _nonsystem target, which together contains the same artifacts as before, just split by whether they go on the system partition or not. The product build hierarchy is being refactored to be split by partition, so these targets facilitate inclusion of just the system parts where necessary. Also keep the selinux_policy target around for products that don't need the split. Bug: 80410283 Test: for t in eng userdebug user; do lunch mainline_arm64-${t}; m nothing; done Test: verified walleye /system and /vendor identical before and after, via: Test: /google/data/rw/users/cc/ccross/bin/compare-target-files.sh P6259983 walleye-userdebug "SYSTEM/*" "VENDOR/*" Test: only diffs are in build.prop files (timestamps and the like) Change-Id: I0f5d8a1558a164ce5cfb7d521f34b431855ac260
2018-07-02 15:31:29 +02:00
# This conditional inclusion closely mimics the conditional logic
# inside init/init.cpp for loading SELinux policy from files.
ifneq ($(PRODUCT_SEPOLICY_SPLIT),true)
# The following files are only allowed for non-Treble devices.
LOCAL_REQUIRED_MODULES += \
sepolicy \
vendor_service_contexts \
endif # ($(PRODUCT_SEPOLICY_SPLIT),true)
Move non-treble devices to split file_contexts This change is primarily to fix CTS which checks file ordering of file_contexts. Having two separate means of loading file_contexts has resulted in ordering variations. Previously the binary file_contexts was preferred since it loaded faster. However with the move to libpcre2, there is no difference in loading time between text and binary file_contexts. This leaves us with build system complexity with no benefit. Thus removing this unnecessary difference between devices. Bug: 38502071 Test: build and boot non-Treble Bullhead, run CTS tests below Test: build and boot Treble Marlin, run CTS tests below Test: cts-tradefed run singleCommand cts --skip-device-info \ --skip-preconditions --skip-connectivity-check --abi arm64-v8a \ --module CtsSecurityHostTestCases \ -t android.security.cts.SELinuxHostTest#testAospFileContexts Test: cts-tradefed run singleCommand cts --skip-device-info \ --skip-preconditions --skip-connectivity-check --abi arm64-v8a \ --module CtsSecurityHostTestCases \ -t android.security.cts.SELinuxHostTest#testValidFileContexts Change-Id: I088b3aeafaaab320f6658feb058a1fb89cbb65e1
2017-06-08 22:24:15 +02:00
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
ifneq ($(TARGET_BUILD_VARIANT), user)
LOCAL_REQUIRED_MODULES += \
selinux_denial_metadata \
endif
ifneq ($(with_asan),true)
Use SELINUX_IGNORE_NEVERALLOWS flag to disable all tests The intent of this flag is to disable tests during early device bringup so that vendor drops can occur without build breakages. When SELINUX_IGNORE_NEVERALLOWS=true also disable labeling tests sepolicy_tests, and treble_sepolicy_tests. Bug: 73322735 Test: build, verify known tests failures do not cause build breakage. Change-Id: I3e7165938d4e34c066bfa0a20e68b7e02dae4a24
2018-02-14 05:29:55 +01:00
ifneq ($(SELINUX_IGNORE_NEVERALLOWS),true)
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
LOCAL_REQUIRED_MODULES += \
sepolicy_tests \
Add mapping files for 28.0.[ignore.]cil Steps taken to produce the mapping files: 1. Add prebuilts/api/28.0/[plat_pub_versioned.cil|vendor_sepolicy.cil] from the /vendor/etc/selinux/[plat_pub_versioned.cil|vendor_sepolicy.cil] files built on pi-dev with lunch target aosp_arm64-eng 2. Add new file private/compat/28.0/28.0.cil by doing the following: - copy /system/etc/selinux/mapping/28.0.cil from pi-dev aosp_arm64-eng device to private/compat/28.0/28.0.cil - remove all attribute declaration statement (typeattribute ...) and sort lines alphabetically - some selinux types were added/renamed/deleted w.r.t 28 sepolicy. Find all such types using treble_sepolicy_tests_28.0 test. - for all these types figure out where to map them by looking at 27.0.[ignore.]cil files and add approprite entries to 28.0.[ignore.]cil. This change also enables treble_sepolicy_tests_28.0 and install 28.0.cil mapping onto the device. Bug: 72458734 Test: m selinux_policy Change-Id: I90e17c0b43af436da4b62c16179c198b5c74002c
2018-07-11 11:30:44 +02:00
$(addprefix treble_sepolicy_tests_,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS)) \
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
endif
Use SELINUX_IGNORE_NEVERALLOWS flag to disable all tests The intent of this flag is to disable tests during early device bringup so that vendor drops can occur without build breakages. When SELINUX_IGNORE_NEVERALLOWS=true also disable labeling tests sepolicy_tests, and treble_sepolicy_tests. Bug: 73322735 Test: build, verify known tests failures do not cause build breakage. Change-Id: I3e7165938d4e34c066bfa0a20e68b7e02dae4a24
2018-02-14 05:29:55 +01:00
endif
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
Split selinux_policy module into two. Create one _system and one _nonsystem target, which together contains the same artifacts as before, just split by whether they go on the system partition or not. The product build hierarchy is being refactored to be split by partition, so these targets facilitate inclusion of just the system parts where necessary. Also keep the selinux_policy target around for products that don't need the split. Bug: 80410283 Test: for t in eng userdebug user; do lunch mainline_arm64-${t}; m nothing; done Test: verified walleye /system and /vendor identical before and after, via: Test: /google/data/rw/users/cc/ccross/bin/compare-target-files.sh P6259983 walleye-userdebug "SYSTEM/*" "VENDOR/*" Test: only diffs are in build.prop files (timestamps and the like) Change-Id: I0f5d8a1558a164ce5cfb7d521f34b431855ac260
2018-07-02 15:31:29 +02:00
ifneq ($(PLATFORM_SEPOLICY_VERSION),$(TOT_SEPOLICY_VERSION))
LOCAL_REQUIRED_MODULES += \
sepolicy_freeze_test \
endif # ($(PLATFORM_SEPOLICY_VERSION),$(TOT_SEPOLICY_VERSION))
include $(BUILD_PHONY_PACKAGE)
#################################
include $(CLEAR_VARS)
LOCAL_MODULE := selinux_policy_nonsystem
# Include precompiled policy, unless told otherwise.
ifneq ($(PRODUCT_PRECOMPILED_SEPOLICY),false)
LOCAL_REQUIRED_MODULES += \
precompiled_sepolicy \
precompiled_sepolicy.plat_and_mapping.sha256 \
endif # ($(PRODUCT_PRECOMPILED_SEPOLICY),false)
# These build targets are not used on non-Treble devices. However, we build these to avoid
# divergence between Treble and non-Treble devices.
LOCAL_REQUIRED_MODULES += \
plat_pub_versioned.cil \
vendor_sepolicy.cil \
plat_sepolicy_vers.txt \
LOCAL_REQUIRED_MODULES += \
vendor_file_contexts \
vendor_mac_permissions.xml \
vendor_property_contexts \
vendor_seapp_contexts \
vendor_hwservice_contexts \
vndservice_contexts \
Add /odm/etc/selinux/odm_sepolicy.cil This change adds the support of odm sepolicy customization, which can be configured through the newly added build varaible: - BOARD_ODM_SEPOLICY_DIRS += device/${ODM_NAME}/${BOM_NAME}/sepolicy Also moving precompiled sepolicy to /odm when BOARD_ODM_SEPOLICY_DIRS is set. On a DUT, precompiled sepolicy on /odm will override the one in /vendor. This is intentional because /odm is the hardware customization for /vendor and both should be updated together if desired. Bug: 64240127 Test: boot a device with /odm partition Change-Id: Ia8f81a78c88cbfefb3ff19e2ccd2648da6284d09
2017-11-27 04:41:33 +01:00
ifdef BOARD_ODM_SEPOLICY_DIRS
Add /odm/etc/selinux/odm_file_contexts Bug: 64240127 Test: normal boot and recovery boot a device Change-Id: I087292fb23d05fc17272778d668ac78a721b2593
2017-11-29 09:14:53 +01:00
LOCAL_REQUIRED_MODULES += \
odm_sepolicy.cil \
Add /odm/etc/selinux/odm_seapp_contexts Bug: 64240127 Test: normal boot a device Change-Id: I3626357237cc18a99511f1ebd9dd3ff5a7655963
2017-11-29 09:15:28 +01:00
odm_file_contexts \
Add /odm/etc/selinux/odm_property_contexts Bug: 64240127 Test: normal boot and recovery boot a device Change-Id: Ibd71219f60644e57370c0293decf11d82f1cb35c
2017-11-29 09:15:55 +01:00
odm_seapp_contexts \
Add /odm/etc/selinux/odm_hwservice_contexts Bug: 64240127 Test: normal boot and recovery boot a device Change-Id: I22d29e8476380d19aca1be359e0228ab6bbc3b0f
2017-11-29 09:16:26 +01:00
odm_property_contexts \
Add /odm/etc/selinux/odm_mac_permissions.xml Bug: 64240127 Test: normal boot a device Change-Id: I276ba6bc88eabb0d5562e4e96d3860eedb76aed5
2017-11-29 09:06:15 +01:00
odm_hwservice_contexts \
odm_mac_permissions.xml
Add /odm/etc/selinux/odm_sepolicy.cil This change adds the support of odm sepolicy customization, which can be configured through the newly added build varaible: - BOARD_ODM_SEPOLICY_DIRS += device/${ODM_NAME}/${BOM_NAME}/sepolicy Also moving precompiled sepolicy to /odm when BOARD_ODM_SEPOLICY_DIRS is set. On a DUT, precompiled sepolicy on /odm will override the one in /vendor. This is intentional because /odm is the hardware customization for /vendor and both should be updated together if desired. Bug: 64240127 Test: boot a device with /odm partition Change-Id: Ia8f81a78c88cbfefb3ff19e2ccd2648da6284d09
2017-11-27 04:41:33 +01:00
endif
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
ifdef HAS_PRODUCT_SEPOLICY
LOCAL_REQUIRED_MODULES += \
product_sepolicy.cil \
Separate product_file_contexts out of system sepolicy. Bug: 119305624 Test: boot blueline Change-Id: I3ecdeab3bb33c3cb5e80dc10ba1079c9853048f8
2018-12-19 04:51:19 +01:00
product_file_contexts \
Separate product_hwservice_contexts out of system sepolicy. Bug: 119305624 Test: normal/recovery boot aosp_taimen Change-Id: I1009745686acd51563378dac56e857be0d60e794
2018-12-21 01:13:10 +01:00
product_hwservice_contexts \
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
endif
Change mapping file name to reflect its platform version. As the platform progresses in the split SELinux world, the platform will need to maintain mapping files back to previous platform versions to maintain backwards compatibility with vendor images which have SELinux policy written based on the older versions. This requires shipping multiple mapping files with the system image so that the right one can be selected. Change the name and location of the mapping file to reflect this. Also add a file to the vendor partition indicating which version is being targeted that the platform can use to determine which mapping file to choose. Bug: 36783775 Test: Force compilation of sepolicy on-device with mapping file changed to new location and name, using the value reported on /vendor. Change-Id: I93ab3e52c2c80c493719dc3825bc731867ea76d4
2017-04-10 21:27:18 +02:00
include $(BUILD_PHONY_PACKAGE)
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
#################################
include $(CLEAR_VARS)
LOCAL_MODULE := sepolicy_neverallows
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
include $(BUILD_SYSTEM)/base_rules.mk
# sepolicy_policy.conf - All of the policy for the device. This is only used to
# check neverallow rules.
sepolicy_policy.conf := $(intermediates)/policy.conf
$(sepolicy_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
$(sepolicy_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Use user policy when checking neverallow rules. When building userdebug or eng builds, we still want to build the user policy when checking neverallow rules so that we can catch compile errors. Commit c0713e86 split out a helper function but lost one instance of using user instead of the real variant. This restores that one and adds it to the neverallow check. Bug: 74344625 Test: Added a rule that referred to a type defined only in userdebug and eng and ensure we throw a compile error when building userdebug mode. Change-Id: I1a6ffbb36dbeeb880852f9cbac880f923370c2ae (cherry picked from commit 053cb34130b763d93e2181062ebe1b5f8bf3ad9c)
2018-03-08 00:36:29 +01:00
$(sepolicy_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := user
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
$(sepolicy_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
$(sepolicy_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
$(sepolicy_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(sepolicy_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
$(sepolicy_policy.conf): $(call build_policy, $(sepolicy_build_files), \
Add BOARD_ODM_SEPOLICY_DIRS to neverallow checks. It doesn't seem like any of our (Google's) devices use BOARD_ODM_SEPOLICY_DIRS, but this will be helpful for partners. Also, use BOARD_VENDOR_SEPOLICY_DIRS instead BOARD_SEPOLICY_DIRS for readability. Bug: n/a Test: m selinux_policy Change-Id: I23f64a24d51ccdb8aa616d0fd8a06d70b6efed32
2018-12-13 22:36:10 +01:00
$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) $(PLAT_VENDOR_POLICY) \
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
$(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY) \
Add BOARD_ODM_SEPOLICY_DIRS to neverallow checks. It doesn't seem like any of our (Google's) devices use BOARD_ODM_SEPOLICY_DIRS, but this will be helpful for partners. Also, use BOARD_VENDOR_SEPOLICY_DIRS instead BOARD_SEPOLICY_DIRS for readability. Bug: n/a Test: m selinux_policy Change-Id: I23f64a24d51ccdb8aa616d0fd8a06d70b6efed32
2018-12-13 22:36:10 +01:00
$(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_ODM_SEPOLICY_DIRS))
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
$(transform-policy-to-conf)
Fix building error for multi-line dontaudit statement All the *.conf.dontaudit files are generated from *.conf with the command of 'sed '/dontaudit/d' $@ > $@.dontaudit', but this command can not be applied to multi-line dontaudit statement. Test: Set plat_policy.conf.dontaudit as the input_file parameter of checkpolicy tool, then selinux syntax error will occur during building. Change-Id: I281de923d8a5f0b46256ec7de4df12a1c1d7e061
2018-09-13 08:04:19 +02:00
$(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
Add compile time check for expanded attribute neverallow failure The SELinux policy language supports an expandattribute statement. Similar to the C "inline" declaration, this expands the permissions associated with types, instead of using the attribute directly. Please see https://android.googlesource.com/platform/external/selinux/+/1089665e31a647a5f0ba2eabe8ac6232b384bed9 for more detail on this language option. Expansion of attributes causes consistency problems with CTS. If a neverallow rule exists which refers to an expanded attribute, the CTS neverallow test will fail, because the policy does not have the attribute embedded in it. Examples: * b/119783042 (fixed in 536d3413b84c4340f9d8cea96a3239490784169f) * b/67296580 (fixed in 6f7e8609f9f79877f818b231b8b0b8b906483780) * b/63809360 (fixed in 89f215e6a0985e746f1993ed047c1971201db529) etc... Instead of waiting for the CTS test to fail, modify the Android.mk file so that we do checks similar to CTS. This allows us to fail at compile time instead of waiting for a CTS bug. For example, for b/119783042, instead of the compile succeeding, it will now fail with the following error message: [ 70% 190/268] build out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows FAILED: out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows /bin/bash -c "(ASAN_OPTIONS=detect_leaks=0 out/host/linux-x86/bin/checkpolicy -M -c 30 -o out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/policy.conf ) && (out/host/linux-x86/bin/sepolicy-analyze out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp neverallow -w -f out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/policy_2.conf || ( echo \"\" 1>&2; echo \"sepolicy-analyze failed. This is most likely due to the use\" 1>&2; echo \"of an expanded attribute in a neverallow assertion. Please fix\" 1>&2; echo \"the policy.\" 1>&2; exit 1 ) ) && (touch out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp ) && (mv out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows )" libsepol.report_failure: neverallow violated by allow vold hal_bootctl_default:binder { call }; libsepol.check_assertions: 1 neverallow failures occurred sepolicy-analyze failed. This is most likely due to the use of an expanded attribute in a neverallow assertion. Please fix the policy. 15:44:27 ninja failed with: exit status 1 Test: Revert 536d3413b84c4340f9d8cea96a3239490784169f and verify compile fails as above. Test: Compile succeeds Bug: 119783042 Change-Id: I5df405b337bb744b838dadf53a2234d8ed94bf39
2018-11-27 22:45:47 +01:00
# sepolicy_policy_2.conf - All of the policy for the device. This is only used to
# check neverallow rules using sepolicy-analyze, similar to CTS.
sepolicy_policy_2.conf := $(intermediates)/policy_2.conf
$(sepolicy_policy_2.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
$(sepolicy_policy_2.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
$(sepolicy_policy_2.conf): PRIVATE_TARGET_BUILD_VARIANT := user
$(sepolicy_policy_2.conf): PRIVATE_EXCLUDE_BUILD_TEST := true
$(sepolicy_policy_2.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
$(sepolicy_policy_2.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
$(sepolicy_policy_2.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(sepolicy_policy_2.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
$(sepolicy_policy_2.conf): $(call build_policy, $(sepolicy_build_files), \
Add BOARD_ODM_SEPOLICY_DIRS to neverallow checks. It doesn't seem like any of our (Google's) devices use BOARD_ODM_SEPOLICY_DIRS, but this will be helpful for partners. Also, use BOARD_VENDOR_SEPOLICY_DIRS instead BOARD_SEPOLICY_DIRS for readability. Bug: n/a Test: m selinux_policy Change-Id: I23f64a24d51ccdb8aa616d0fd8a06d70b6efed32
2018-12-13 22:36:10 +01:00
$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) $(PLAT_VENDOR_POLICY) \
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
$(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY) \
Add BOARD_ODM_SEPOLICY_DIRS to neverallow checks. It doesn't seem like any of our (Google's) devices use BOARD_ODM_SEPOLICY_DIRS, but this will be helpful for partners. Also, use BOARD_VENDOR_SEPOLICY_DIRS instead BOARD_SEPOLICY_DIRS for readability. Bug: n/a Test: m selinux_policy Change-Id: I23f64a24d51ccdb8aa616d0fd8a06d70b6efed32
2018-12-13 22:36:10 +01:00
$(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_ODM_SEPOLICY_DIRS))
Add compile time check for expanded attribute neverallow failure The SELinux policy language supports an expandattribute statement. Similar to the C "inline" declaration, this expands the permissions associated with types, instead of using the attribute directly. Please see https://android.googlesource.com/platform/external/selinux/+/1089665e31a647a5f0ba2eabe8ac6232b384bed9 for more detail on this language option. Expansion of attributes causes consistency problems with CTS. If a neverallow rule exists which refers to an expanded attribute, the CTS neverallow test will fail, because the policy does not have the attribute embedded in it. Examples: * b/119783042 (fixed in 536d3413b84c4340f9d8cea96a3239490784169f) * b/67296580 (fixed in 6f7e8609f9f79877f818b231b8b0b8b906483780) * b/63809360 (fixed in 89f215e6a0985e746f1993ed047c1971201db529) etc... Instead of waiting for the CTS test to fail, modify the Android.mk file so that we do checks similar to CTS. This allows us to fail at compile time instead of waiting for a CTS bug. For example, for b/119783042, instead of the compile succeeding, it will now fail with the following error message: [ 70% 190/268] build out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows FAILED: out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows /bin/bash -c "(ASAN_OPTIONS=detect_leaks=0 out/host/linux-x86/bin/checkpolicy -M -c 30 -o out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/policy.conf ) && (out/host/linux-x86/bin/sepolicy-analyze out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp neverallow -w -f out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/policy_2.conf || ( echo \"\" 1>&2; echo \"sepolicy-analyze failed. This is most likely due to the use\" 1>&2; echo \"of an expanded attribute in a neverallow assertion. Please fix\" 1>&2; echo \"the policy.\" 1>&2; exit 1 ) ) && (touch out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp ) && (mv out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows )" libsepol.report_failure: neverallow violated by allow vold hal_bootctl_default:binder { call }; libsepol.check_assertions: 1 neverallow failures occurred sepolicy-analyze failed. This is most likely due to the use of an expanded attribute in a neverallow assertion. Please fix the policy. 15:44:27 ninja failed with: exit status 1 Test: Revert 536d3413b84c4340f9d8cea96a3239490784169f and verify compile fails as above. Test: Compile succeeds Bug: 119783042 Change-Id: I5df405b337bb744b838dadf53a2234d8ed94bf39
2018-11-27 22:45:47 +01:00
$(transform-policy-to-conf)
$(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY_1 := $(sepolicy_policy.conf)
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY_2 := $(sepolicy_policy_2.conf)
$(LOCAL_BUILT_MODULE): $(sepolicy_policy.conf) $(sepolicy_policy_2.conf) \
$(HOST_OUT_EXECUTABLES)/checkpolicy $(HOST_OUT_EXECUTABLES)/sepolicy-analyze
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
ifneq ($(SELINUX_IGNORE_NEVERALLOWS),true)
$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c \
Add compile time check for expanded attribute neverallow failure The SELinux policy language supports an expandattribute statement. Similar to the C "inline" declaration, this expands the permissions associated with types, instead of using the attribute directly. Please see https://android.googlesource.com/platform/external/selinux/+/1089665e31a647a5f0ba2eabe8ac6232b384bed9 for more detail on this language option. Expansion of attributes causes consistency problems with CTS. If a neverallow rule exists which refers to an expanded attribute, the CTS neverallow test will fail, because the policy does not have the attribute embedded in it. Examples: * b/119783042 (fixed in 536d3413b84c4340f9d8cea96a3239490784169f) * b/67296580 (fixed in 6f7e8609f9f79877f818b231b8b0b8b906483780) * b/63809360 (fixed in 89f215e6a0985e746f1993ed047c1971201db529) etc... Instead of waiting for the CTS test to fail, modify the Android.mk file so that we do checks similar to CTS. This allows us to fail at compile time instead of waiting for a CTS bug. For example, for b/119783042, instead of the compile succeeding, it will now fail with the following error message: [ 70% 190/268] build out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows FAILED: out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows /bin/bash -c "(ASAN_OPTIONS=detect_leaks=0 out/host/linux-x86/bin/checkpolicy -M -c 30 -o out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/policy.conf ) && (out/host/linux-x86/bin/sepolicy-analyze out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp neverallow -w -f out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/policy_2.conf || ( echo \"\" 1>&2; echo \"sepolicy-analyze failed. This is most likely due to the use\" 1>&2; echo \"of an expanded attribute in a neverallow assertion. Please fix\" 1>&2; echo \"the policy.\" 1>&2; exit 1 ) ) && (touch out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp ) && (mv out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows )" libsepol.report_failure: neverallow violated by allow vold hal_bootctl_default:binder { call }; libsepol.check_assertions: 1 neverallow failures occurred sepolicy-analyze failed. This is most likely due to the use of an expanded attribute in a neverallow assertion. Please fix the policy. 15:44:27 ninja failed with: exit status 1 Test: Revert 536d3413b84c4340f9d8cea96a3239490784169f and verify compile fails as above. Test: Compile succeeds Bug: 119783042 Change-Id: I5df405b337bb744b838dadf53a2234d8ed94bf39
2018-11-27 22:45:47 +01:00
$(POLICYVERS) -o $@.tmp $(PRIVATE_SEPOLICY_1)
$(hide) $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $@.tmp neverallow -w -f $(PRIVATE_SEPOLICY_2) || \
( echo "" 1>&2; \
echo "sepolicy-analyze failed. This is most likely due to the use" 1>&2; \
echo "of an expanded attribute in a neverallow assertion. Please fix" 1>&2; \
echo "the policy." 1>&2; \
exit 1 )
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
endif # ($(SELINUX_IGNORE_NEVERALLOWS),true)
Add compile time check for expanded attribute neverallow failure The SELinux policy language supports an expandattribute statement. Similar to the C "inline" declaration, this expands the permissions associated with types, instead of using the attribute directly. Please see https://android.googlesource.com/platform/external/selinux/+/1089665e31a647a5f0ba2eabe8ac6232b384bed9 for more detail on this language option. Expansion of attributes causes consistency problems with CTS. If a neverallow rule exists which refers to an expanded attribute, the CTS neverallow test will fail, because the policy does not have the attribute embedded in it. Examples: * b/119783042 (fixed in 536d3413b84c4340f9d8cea96a3239490784169f) * b/67296580 (fixed in 6f7e8609f9f79877f818b231b8b0b8b906483780) * b/63809360 (fixed in 89f215e6a0985e746f1993ed047c1971201db529) etc... Instead of waiting for the CTS test to fail, modify the Android.mk file so that we do checks similar to CTS. This allows us to fail at compile time instead of waiting for a CTS bug. For example, for b/119783042, instead of the compile succeeding, it will now fail with the following error message: [ 70% 190/268] build out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows FAILED: out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows /bin/bash -c "(ASAN_OPTIONS=detect_leaks=0 out/host/linux-x86/bin/checkpolicy -M -c 30 -o out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/policy.conf ) && (out/host/linux-x86/bin/sepolicy-analyze out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp neverallow -w -f out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/policy_2.conf || ( echo \"\" 1>&2; echo \"sepolicy-analyze failed. This is most likely due to the use\" 1>&2; echo \"of an expanded attribute in a neverallow assertion. Please fix\" 1>&2; echo \"the policy.\" 1>&2; exit 1 ) ) && (touch out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp ) && (mv out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows )" libsepol.report_failure: neverallow violated by allow vold hal_bootctl_default:binder { call }; libsepol.check_assertions: 1 neverallow failures occurred sepolicy-analyze failed. This is most likely due to the use of an expanded attribute in a neverallow assertion. Please fix the policy. 15:44:27 ninja failed with: exit status 1 Test: Revert 536d3413b84c4340f9d8cea96a3239490784169f and verify compile fails as above. Test: Compile succeeds Bug: 119783042 Change-Id: I5df405b337bb744b838dadf53a2234d8ed94bf39
2018-11-27 22:45:47 +01:00
$(hide) touch $@.tmp
$(hide) mv $@.tmp $@
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
sepolicy_policy.conf :=
Add compile time check for expanded attribute neverallow failure The SELinux policy language supports an expandattribute statement. Similar to the C "inline" declaration, this expands the permissions associated with types, instead of using the attribute directly. Please see https://android.googlesource.com/platform/external/selinux/+/1089665e31a647a5f0ba2eabe8ac6232b384bed9 for more detail on this language option. Expansion of attributes causes consistency problems with CTS. If a neverallow rule exists which refers to an expanded attribute, the CTS neverallow test will fail, because the policy does not have the attribute embedded in it. Examples: * b/119783042 (fixed in 536d3413b84c4340f9d8cea96a3239490784169f) * b/67296580 (fixed in 6f7e8609f9f79877f818b231b8b0b8b906483780) * b/63809360 (fixed in 89f215e6a0985e746f1993ed047c1971201db529) etc... Instead of waiting for the CTS test to fail, modify the Android.mk file so that we do checks similar to CTS. This allows us to fail at compile time instead of waiting for a CTS bug. For example, for b/119783042, instead of the compile succeeding, it will now fail with the following error message: [ 70% 190/268] build out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows FAILED: out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows /bin/bash -c "(ASAN_OPTIONS=detect_leaks=0 out/host/linux-x86/bin/checkpolicy -M -c 30 -o out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/policy.conf ) && (out/host/linux-x86/bin/sepolicy-analyze out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp neverallow -w -f out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/policy_2.conf || ( echo \"\" 1>&2; echo \"sepolicy-analyze failed. This is most likely due to the use\" 1>&2; echo \"of an expanded attribute in a neverallow assertion. Please fix\" 1>&2; echo \"the policy.\" 1>&2; exit 1 ) ) && (touch out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp ) && (mv out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows.tmp out/target/product/crosshatch/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows )" libsepol.report_failure: neverallow violated by allow vold hal_bootctl_default:binder { call }; libsepol.check_assertions: 1 neverallow failures occurred sepolicy-analyze failed. This is most likely due to the use of an expanded attribute in a neverallow assertion. Please fix the policy. 15:44:27 ninja failed with: exit status 1 Test: Revert 536d3413b84c4340f9d8cea96a3239490784169f and verify compile fails as above. Test: Compile succeeds Bug: 119783042 Change-Id: I5df405b337bb744b838dadf53a2234d8ed94bf39
2018-11-27 22:45:47 +01:00
sepolicy_policy_2.conf :=
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
built_sepolicy_neverallows := $(LOCAL_BUILT_MODULE)
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
##################################
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
# reqd_policy_mask - a policy.conf file which contains only the bare minimum
# policy necessary to use checkpolicy. This bare-minimum policy needs to be
# present in all policy.conf files, but should not necessarily be exported as
# part of the public policy. The rules generated by reqd_policy_mask will allow
# the compilation of public policy and subsequent removal of CIL policy that
# should not be exported.
reqd_policy_mask.conf := $(intermediates)/reqd_policy_mask.conf
$(reqd_policy_mask.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
$(reqd_policy_mask.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Use user policy when checking neverallow rules. When building userdebug or eng builds, we still want to build the user policy when checking neverallow rules so that we can catch compile errors. Commit c0713e86 split out a helper function but lost one instance of using user instead of the real variant. This restores that one and adds it to the neverallow check. Bug: 74344625 Test: Added a rule that referred to a type defined only in userdebug and eng and ensure we throw a compile error when building userdebug mode. Change-Id: I1a6ffbb36dbeeb880852f9cbac880f923370c2ae (cherry picked from commit 053cb34130b763d93e2181062ebe1b5f8bf3ad9c)
2018-03-08 00:36:29 +01:00
$(reqd_policy_mask.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
Switch recovery to versioned policy and split into components. And do some clean up: Replace LOCAL_TARGET_ARCH with global arch specifier that won't get clobbered, clean up sepolicy.recovery's eng specification, ensure that build macros are applied across all policy generation, not just plat_policy, and make sure that all private variables are cleared and alphabetized at the end. Bug: 31363362 Bug: 31369363 Test: Boot into recovery and observe no selinux denials. Change-Id: Ibc15b097f6d19acf01f6b22bee0e083b15f4ef75
2016-12-16 00:28:44 +01:00
$(reqd_policy_mask.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
Grant additional permissions for ASAN builds ASAN builds may require additional permissions to launch processes with ASAN wrappers. In this case, system_server needs permission to execute /system/bin/sh. Create with_asan() macro which can be used exclusively on debug builds. Note this means that ASAN builds with these additional permission will not pass the security portion of CTS - like any other debug build. Addresses: avc: denied { execute } for name="sh" dev="dm-0" ino=571 scontext=u:r:system_server:s0 tcontext=u:object_r:shell_exec:s0 tclass=file Test: lunch aosp_marlin-userdebug; cd system/sepolicy; mm SANITIZE_TARGET=address; Verify permissions granted using with_asan() are granted. Test: lunch aosp_marlin-userdebug; cd system/sepolicy; mm; Verify permissions granted using with_asan() are not granted. Test: lunch aosp_marlin-user; cd system/sepolicy; mm SANITIZE_TARGET=address; Verify permissions granted using with_asan() are not granted. Bug: 36138508 Change-Id: I6e39ada4bacd71687a593023f16b45bc16cd7ef8
2017-03-13 20:22:15 +01:00
$(reqd_policy_mask.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
$(reqd_policy_mask.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Use PRODUCT_SEPOLICY_SPLIT for full Treble. PRODUCT_FULL_TREBLE is being broken up into smaller, more manageable components. Bug: 62019611 Test: manual Change-Id: I9b65f120851d9ea134a0059a417f0282777717fc
2017-11-09 20:24:56 +01:00
$(reqd_policy_mask.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
$(reqd_policy_mask.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
$(reqd_policy_mask.conf): $(call build_policy, $(sepolicy_build_files), $(REQD_MASK_POLICY))
Add sepolicy definitions.mk and create policy.conf function. Bug: 36899958 Test: Builds 'n' boots. Change-Id: I5836a18f9d0a9a976dda7304045e3b9e1e84565e Merged-In: I5836a18f9d0a9a976dda7304045e3b9e1e84565e (cherry picked from commit c0713e86790583dacbd8545d35ae476ff1f849bb)
2017-07-07 23:59:51 +02:00
$(transform-policy-to-conf)
Sepolicy: Disable leak sanitizer for checkpolicy Temporary workaround. Bug: 37755687 Test: ASAN_OPTIONS= SANITIZE_HOST=address m Change-Id: I001a42ea6463a1e137e1f5328755596f986323de
2017-04-28 02:16:13 +02:00
# b/37755687
CHECKPOLICY_ASAN_OPTIONS := ASAN_OPTIONS=detect_leaks=0
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
reqd_policy_mask.cil := $(intermediates)/reqd_policy_mask.cil
$(reqd_policy_mask.cil): $(reqd_policy_mask.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy
@mkdir -p $(dir $@)
Sepolicy: Disable leak sanitizer for checkpolicy Temporary workaround. Bug: 37755687 Test: ASAN_OPTIONS= SANITIZE_HOST=address m Change-Id: I001a42ea6463a1e137e1f5328755596f986323de
2017-04-28 02:16:13 +02:00
$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -C -M -c \
$(POLICYVERS) -o $@ $<
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
reqd_policy_mask.conf :=
##################################
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
# plat_pub_policy - policy that will be exported to be a part of non-platform
# policy corresponding to this platform version. This is a limited subset of
# policy that would not compile in checkpolicy on its own. To get around this
# limitation, add only the required files from private policy, which will
# generate CIL policy that will then be filtered out by the reqd_policy_mask.
plat_pub_policy.conf := $(intermediates)/plat_pub_policy.conf
$(plat_pub_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
$(plat_pub_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Use user policy when checking neverallow rules. When building userdebug or eng builds, we still want to build the user policy when checking neverallow rules so that we can catch compile errors. Commit c0713e86 split out a helper function but lost one instance of using user instead of the real variant. This restores that one and adds it to the neverallow check. Bug: 74344625 Test: Added a rule that referred to a type defined only in userdebug and eng and ensure we throw a compile error when building userdebug mode. Change-Id: I1a6ffbb36dbeeb880852f9cbac880f923370c2ae (cherry picked from commit 053cb34130b763d93e2181062ebe1b5f8bf3ad9c)
2018-03-08 00:36:29 +01:00
$(plat_pub_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
Switch recovery to versioned policy and split into components. And do some clean up: Replace LOCAL_TARGET_ARCH with global arch specifier that won't get clobbered, clean up sepolicy.recovery's eng specification, ensure that build macros are applied across all policy generation, not just plat_policy, and make sure that all private variables are cleared and alphabetized at the end. Bug: 31363362 Bug: 31369363 Test: Boot into recovery and observe no selinux denials. Change-Id: Ibc15b097f6d19acf01f6b22bee0e083b15f4ef75
2016-12-16 00:28:44 +01:00
$(plat_pub_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
Grant additional permissions for ASAN builds ASAN builds may require additional permissions to launch processes with ASAN wrappers. In this case, system_server needs permission to execute /system/bin/sh. Create with_asan() macro which can be used exclusively on debug builds. Note this means that ASAN builds with these additional permission will not pass the security portion of CTS - like any other debug build. Addresses: avc: denied { execute } for name="sh" dev="dm-0" ino=571 scontext=u:r:system_server:s0 tcontext=u:object_r:shell_exec:s0 tclass=file Test: lunch aosp_marlin-userdebug; cd system/sepolicy; mm SANITIZE_TARGET=address; Verify permissions granted using with_asan() are granted. Test: lunch aosp_marlin-userdebug; cd system/sepolicy; mm; Verify permissions granted using with_asan() are not granted. Test: lunch aosp_marlin-user; cd system/sepolicy; mm SANITIZE_TARGET=address; Verify permissions granted using with_asan() are not granted. Bug: 36138508 Change-Id: I6e39ada4bacd71687a593023f16b45bc16cd7ef8
2017-03-13 20:22:15 +01:00
$(plat_pub_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
$(plat_pub_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Use PRODUCT_SEPOLICY_SPLIT for full Treble. PRODUCT_FULL_TREBLE is being broken up into smaller, more manageable components. Bug: 62019611 Test: manual Change-Id: I9b65f120851d9ea134a0059a417f0282777717fc
2017-11-09 20:24:56 +01:00
$(plat_pub_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
$(plat_pub_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
$(plat_pub_policy.conf): $(call build_policy, $(sepolicy_build_files), \
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
$(PLAT_PUBLIC_POLICY) $(PRODUCT_PUBLIC_POLICY) $(REQD_MASK_POLICY))
Add sepolicy definitions.mk and create policy.conf function. Bug: 36899958 Test: Builds 'n' boots. Change-Id: I5836a18f9d0a9a976dda7304045e3b9e1e84565e Merged-In: I5836a18f9d0a9a976dda7304045e3b9e1e84565e (cherry picked from commit c0713e86790583dacbd8545d35ae476ff1f849bb)
2017-07-07 23:59:51 +02:00
$(transform-policy-to-conf)
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
plat_pub_policy.cil := $(intermediates)/plat_pub_policy.cil
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
$(plat_pub_policy.cil): PRIVATE_POL_CONF := $(plat_pub_policy.conf)
$(plat_pub_policy.cil): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil)
Replace "grep -f" with python util. grep can potentially run out of memory on Mac builds for large input files. So we add a python util to handle filtering out files. We will also need this util to filter plat_sepolicy.cil out of product_sepolicy.cil Bug: 119305624 Test: boot aosp_taimen Change-Id: I61cd68f407ea5de43a06bf522a5fc149e5067e8c
2018-12-18 01:35:41 +01:00
$(plat_pub_policy.cil): $(HOST_OUT_EXECUTABLES)/checkpolicy \
$(HOST_OUT_EXECUTABLES)/build_sepolicy $(plat_pub_policy.conf) $(reqd_policy_mask.cil)
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
@mkdir -p $(dir $@)
Replace "grep -f" with python util. grep can potentially run out of memory on Mac builds for large input files. So we add a python util to handle filtering out files. We will also need this util to filter plat_sepolicy.cil out of product_sepolicy.cil Bug: 119305624 Test: boot aosp_taimen Change-Id: I61cd68f407ea5de43a06bf522a5fc149e5067e8c
2018-12-18 01:35:41 +01:00
$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $< -C -M -c $(POLICYVERS) -o $@ $(PRIVATE_POL_CONF)
$(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) filter_out \
-f $(PRIVATE_REQD_MASK) -t $@
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
plat_pub_policy.conf :=
Switch recovery to versioned policy and split into components. And do some clean up: Replace LOCAL_TARGET_ARCH with global arch specifier that won't get clobbered, clean up sepolicy.recovery's eng specification, ensure that build macros are applied across all policy generation, not just plat_policy, and make sure that all private variables are cleared and alphabetized at the end. Bug: 31363362 Bug: 31369363 Test: Boot into recovery and observe no selinux denials. Change-Id: Ibc15b097f6d19acf01f6b22bee0e083b15f4ef75
2016-12-16 00:28:44 +01:00
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
##################################
include $(CLEAR_VARS)
LOCAL_MODULE := sectxfile_nl
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
# Create a file containing newline only to add between context config files
include $(BUILD_SYSTEM)/base_rules.mk
$(LOCAL_BUILT_MODULE):
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
@mkdir -p $(dir $@)
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
$(hide) echo > $@
built_nl := $(LOCAL_BUILT_MODULE)
#################################
include $(CLEAR_VARS)
LOCAL_MODULE := plat_sepolicy.cil
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
Move split sepolicy to correct locations This moves the CIL files comprising the split sepolicy to the directories/partitions based on whether the file is part of platform/system or non-platform/vendor. In particular: * plat_sepolicy.cil is moved to /system/etc/selinux, * nonplat_sepolicy.cil is moved to /vendor/etc/selinux, and * mapping_sepolicy.cil is moved to /vendor/etc/selinux. Test: Device boots, no additional denials. The test is performed both for a device without the CIL files and with the three CIL files. Bug: 31363362 Change-Id: Ia760d7eb32c80ba72f6409da75d99eb5aae71cd9
2017-03-02 21:39:25 +01:00
LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
include $(BUILD_SYSTEM)/base_rules.mk
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
# plat_policy.conf - A combination of the private and public platform policy
# which will ship with the device. The platform will always reflect the most
# recent platform version and is not currently being attributized.
plat_policy.conf := $(intermediates)/plat_policy.conf
$(plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
$(plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Use user policy when checking neverallow rules. When building userdebug or eng builds, we still want to build the user policy when checking neverallow rules so that we can catch compile errors. Commit c0713e86 split out a helper function but lost one instance of using user instead of the real variant. This restores that one and adds it to the neverallow check. Bug: 74344625 Test: Added a rule that referred to a type defined only in userdebug and eng and ensure we throw a compile error when building userdebug mode. Change-Id: I1a6ffbb36dbeeb880852f9cbac880f923370c2ae (cherry picked from commit 053cb34130b763d93e2181062ebe1b5f8bf3ad9c)
2018-03-08 00:36:29 +01:00
$(plat_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
Switch recovery to versioned policy and split into components. And do some clean up: Replace LOCAL_TARGET_ARCH with global arch specifier that won't get clobbered, clean up sepolicy.recovery's eng specification, ensure that build macros are applied across all policy generation, not just plat_policy, and make sure that all private variables are cleared and alphabetized at the end. Bug: 31363362 Bug: 31369363 Test: Boot into recovery and observe no selinux denials. Change-Id: Ibc15b097f6d19acf01f6b22bee0e083b15f4ef75
2016-12-16 00:28:44 +01:00
$(plat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
Grant additional permissions for ASAN builds ASAN builds may require additional permissions to launch processes with ASAN wrappers. In this case, system_server needs permission to execute /system/bin/sh. Create with_asan() macro which can be used exclusively on debug builds. Note this means that ASAN builds with these additional permission will not pass the security portion of CTS - like any other debug build. Addresses: avc: denied { execute } for name="sh" dev="dm-0" ino=571 scontext=u:r:system_server:s0 tcontext=u:object_r:shell_exec:s0 tclass=file Test: lunch aosp_marlin-userdebug; cd system/sepolicy; mm SANITIZE_TARGET=address; Verify permissions granted using with_asan() are granted. Test: lunch aosp_marlin-userdebug; cd system/sepolicy; mm; Verify permissions granted using with_asan() are not granted. Test: lunch aosp_marlin-user; cd system/sepolicy; mm SANITIZE_TARGET=address; Verify permissions granted using with_asan() are not granted. Bug: 36138508 Change-Id: I6e39ada4bacd71687a593023f16b45bc16cd7ef8
2017-03-13 20:22:15 +01:00
$(plat_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
$(plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Use PRODUCT_SEPOLICY_SPLIT for full Treble. PRODUCT_FULL_TREBLE is being broken up into smaller, more manageable components. Bug: 62019611 Test: manual Change-Id: I9b65f120851d9ea134a0059a417f0282777717fc
2017-11-09 20:24:56 +01:00
$(plat_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
$(plat_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
$(plat_policy.conf): $(call build_policy, $(sepolicy_build_files), \
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY))
Add sepolicy definitions.mk and create policy.conf function. Bug: 36899958 Test: Builds 'n' boots. Change-Id: I5836a18f9d0a9a976dda7304045e3b9e1e84565e Merged-In: I5836a18f9d0a9a976dda7304045e3b9e1e84565e (cherry picked from commit c0713e86790583dacbd8545d35ae476ff1f849bb)
2017-07-07 23:59:51 +02:00
$(transform-policy-to-conf)
Fix building error for multi-line dontaudit statement All the *.conf.dontaudit files are generated from *.conf with the command of 'sed '/dontaudit/d' $@ > $@.dontaudit', but this command can not be applied to multi-line dontaudit statement. Test: Set plat_policy.conf.dontaudit as the input_file parameter of checkpolicy tool, then selinux syntax error will occur during building. Change-Id: I281de923d8a5f0b46256ec7de4df12a1c1d7e061
2018-09-13 08:04:19 +02:00
$(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
Retain neverallow rules in CIL files Fixes issue where attributes used exlusively in neverallow rules were removed from policy. For on-device compile use the -N flag to skip neverallow tests. Policy size increases: vendor/etc/selinux/nonplat_sepolicy.cil 547849 -> 635637 vendor/etc/selinux/precompiled_sepolicy 440248 -> 441076 system/etc/selinux/plat_sepolicy.cil 567664 -> 745230 For a total increase in system/vendor: 266182. Boot time changes: Pixel uses precompiled policy so boot time is not impacted. When forcing on-device compile on Marlin selinux policy compile time increases 510-520 ms -> 550-560 ms. Bug: 37357742 Test: Build and boot Marlin. Test: Verify both precompiled and on-device compile work. Change-Id: Ib3cb53d376a96e34f55ac27d651a6ce2fabf6ba7
2017-04-22 00:57:07 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_ADDITIONAL_CIL_FILES := \
Mark all clients of Allocator HAL This change associates all domains which are clients of Allocator HAL with hal_allocator_client and the, required for all HAL client domains, halclientdomain. This enables this commit to remove the now unnecessary hwallocator_use macro because its binder_call(..., hal_allocator_server) is covered by binder_call(hal_allocator_client, hal_allocator_server) added in this commit. Unfortunately apps, except isolated app, are clients of Allocator HAL as well. This makes it hard to use the hal_client_domain(..., hal_allocator) macro because it translates into "typeattribute" which currently does not support being provided with a set of types, such as { appdomain -isolated_app }. As a workaround, hopefully until typeattribute is improved, this commit expresses the necessary association operation in CIL. private/technical_debt.cil introduced by this commit is appended into the platform policy CIL file, thus ensuring that the hack has effect on the final monolithic policy. P. S. This change also removes Allocator HAL access from isolated_app. Isolated app shouldn't have access to this HAL anyway. Test: Google Play Music plays back radios Test: Google Camera records video with sound and that video is then successfully played back with sound Test: YouTube app plays back clips with sound Test: YouTube in Chrome plays back clips with sound Bug: 34170079 Change-Id: Id00bba6fde83e7cf04fb58bc1c353c2f66333f92
2017-03-21 22:28:53 +01:00
$(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY))
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
Retain neverallow rules in CIL files Fixes issue where attributes used exlusively in neverallow rules were removed from policy. For on-device compile use the -N flag to skip neverallow tests. Policy size increases: vendor/etc/selinux/nonplat_sepolicy.cil 547849 -> 635637 vendor/etc/selinux/precompiled_sepolicy 440248 -> 441076 system/etc/selinux/plat_sepolicy.cil 567664 -> 745230 For a total increase in system/vendor: 266182. Boot time changes: Pixel uses precompiled policy so boot time is not impacted. When forcing on-device compile on Marlin selinux policy compile time increases 510-520 ms -> 550-560 ms. Bug: 37357742 Test: Build and boot Marlin. Test: Verify both precompiled and on-device compile work. Change-Id: Ib3cb53d376a96e34f55ac27d651a6ce2fabf6ba7
2017-04-22 00:57:07 +02:00
$(LOCAL_BUILT_MODULE): $(plat_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
$(HOST_OUT_EXECUTABLES)/secilc \
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
$(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY)) \
$(built_sepolicy_neverallows)
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
@mkdir -p $(dir $@)
Sepolicy: Disable leak sanitizer for checkpolicy Temporary workaround. Bug: 37755687 Test: ASAN_OPTIONS= SANITIZE_HOST=address m Change-Id: I001a42ea6463a1e137e1f5328755596f986323de
2017-04-28 02:16:13 +02:00
$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \
use tmpfile during build During the build process, use a temporary file until we've determined that every step of the build process has completed. Failure to do this may cause subsequent invocations of the make command to improperly assume that this step ran to completion when it didn't. Test: code compiles. Change-Id: I9a28e653e33b61446a87278975789376769bcc6a
2018-11-26 23:29:06 +01:00
$(POLICYVERS) -o $@.tmp $<
$(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@.tmp
$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $@.tmp -o /dev/null -f /dev/null
$(hide) mv $@.tmp $@
Test CIL policy when building it Prior to this commit, there was a bug in generated CIL where it wouldn't compile using secilc. The reason was that the build script was stripping out all lines containing "neverallow" from CIL files, accidentally removing lines which were not neverallow statements, such as lmx lines referencing app_neverallows.te. The commit fixes the build script's CIL neverallow filter to filter out only neverallow* statements, as originally intended. Moreover, to catch non-compiling CIL policy earlier in the future, this commit runs secilc on the policy at build time. In particular, it tests that platform policy compiles on its own and that nonplatform + platform + mappig policy compiles as well. Test: CIL policy builds and compiles on-device using secilc Bug: 31363362 Change-Id: I769aeb3d8c913a5599f1a2195c69460ece7f6465
2017-02-25 23:47:53 +01:00
built_plat_cil := $(LOCAL_BUILT_MODULE)
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
plat_policy.conf :=
#################################
include $(CLEAR_VARS)
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
ifdef HAS_PRODUCT_SEPOLICY
LOCAL_MODULE := product_sepolicy.cil
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_OUT_PRODUCT)/etc/selinux
include $(BUILD_SYSTEM)/base_rules.mk
# product_policy.conf - A combination of the private and public product policy
# which will ship with the device. Product policy is not attributized.
product_policy.conf := $(intermediates)/product_policy.conf
$(product_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
$(product_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
$(product_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
$(product_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
$(product_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
$(product_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(product_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
$(product_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
$(product_policy.conf): $(call build_policy, $(sepolicy_build_files), \
$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) \
$(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY))
$(transform-policy-to-conf)
$(hide) sed '/dontaudit/d' $@ > $@.dontaudit
$(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
$(LOCAL_BUILT_MODULE): PRIVATE_PLAT_CIL := $(built_plat_cil)
$(LOCAL_BUILT_MODULE): $(product_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
$(HOST_OUT_EXECUTABLES)/build_sepolicy $(HOST_OUT_EXECUTABLES)/secilc $(built_plat_cil)
@mkdir -p $(dir $@)
$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \
$(POLICYVERS) -o $@ $<
$(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) filter_out \
-f $(PRIVATE_PLAT_CIL) -t $@
# Line markers (denoted by ;;) are malformed after above cmd. They are only
# used for debugging, so we remove them.
sepolicy: fix mac build sed "-i" flag on Mac has different syntax than on Linux. Replace use of sed with grep. A simple fix like this should suffice for this case, but ideally, we should maintain our own utils instead of using tools on the host machine. Fixes: 121235932 Test: m selinux_policy Change-Id: I46c3bdb90bf7de48d2c942b15a65ce82ae3041c5
2018-12-19 21:22:05 +01:00
$(hide) grep -v ';;' $@ > $@.tmp
$(hide) mv $@.tmp $@
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
# Combine plat_sepolicy.cil and product_sepolicy.cil to make sure that the
# latter doesn't accidentally depend on vendor/odm policies.
$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) \
$(PRIVATE_NEVERALLOW_ARG) $(PRIVATE_PLAT_CIL) $@ -o /dev/null -f /dev/null
built_product_cil := $(LOCAL_BUILT_MODULE)
product_policy.conf :=
endif # ifdef HAS_PRODUCT_SEPOLICY
#################################
include $(CLEAR_VARS)
Change mapping file name to reflect its platform version. As the platform progresses in the split SELinux world, the platform will need to maintain mapping files back to previous platform versions to maintain backwards compatibility with vendor images which have SELinux policy written based on the older versions. This requires shipping multiple mapping files with the system image so that the right one can be selected. Change the name and location of the mapping file to reflect this. Also add a file to the vendor partition indicating which version is being targeted that the platform can use to determine which mapping file to choose. Bug: 36783775 Test: Force compilation of sepolicy on-device with mapping file changed to new location and name, using the value reported on /vendor. Change-Id: I93ab3e52c2c80c493719dc3825bc731867ea76d4
2017-04-10 21:27:18 +02:00
LOCAL_MODULE := plat_sepolicy_vers.txt
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
Change mapping file name to reflect its platform version. As the platform progresses in the split SELinux world, the platform will need to maintain mapping files back to previous platform versions to maintain backwards compatibility with vendor images which have SELinux policy written based on the older versions. This requires shipping multiple mapping files with the system image so that the right one can be selected. Change the name and location of the mapping file to reflect this. Also add a file to the vendor partition indicating which version is being targeted that the platform can use to determine which mapping file to choose. Bug: 36783775 Test: Force compilation of sepolicy on-device with mapping file changed to new location and name, using the value reported on /vendor. Change-Id: I93ab3e52c2c80c493719dc3825bc731867ea76d4
2017-04-10 21:27:18 +02:00
LOCAL_PROPRIETARY_MODULE := true
LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
include $(BUILD_SYSTEM)/base_rules.mk
$(LOCAL_BUILT_MODULE) : PRIVATE_PLAT_SEPOL_VERS := $(BOARD_SEPOLICY_VERS)
$(LOCAL_BUILT_MODULE) :
mkdir -p $(dir $@)
echo $(PRIVATE_PLAT_SEPOL_VERS) > $@
#################################
include $(CLEAR_VARS)
LOCAL_MODULE := $(platform_mapping_file)
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux/mapping
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
include $(BUILD_SYSTEM)/base_rules.mk
Add BOARD_PLAT_[PUBLIC|PRIVATE]_SEPOLICY_DIRS Add new build variables for partner customization (additions) to platform sepolicy. This allows partners to add their own policy without having to touch the AOSP sepolicy directories and potentially disrupting compatibility with an AOSP system image. Bug: 36467375 Test: Add public and private files to sailfish policy and verify that they are added to the appropriate policy files, but that the policy is otherwise identical. Also add private/mapping/*.cil files in both locations and change the BOARD_SEPOLICY_VERS to trigger use of prebuilt mapping files and verify that they are appropriately combined and built in policy. Change-Id: I38efe2248520804a123603bb050bba75563fe45c Merged-In: I38efe2248520804a123603bb050bba75563fe45c (cherry picked from commit f893700c73f2e4e13385f11edcacf563f59b63c5)
2017-05-08 23:26:52 +02:00
current_mapping.cil := $(intermediates)/mapping/$(PLATFORM_SEPOLICY_VERSION).cil
ifeq ($(BOARD_SEPOLICY_VERS), $(PLATFORM_SEPOLICY_VERSION))
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
# auto-generate the mapping file for current platform policy, since it needs to
# track platform policy development
Add PLATFORM_SEPOLICY_VERSION. Create PLATFORM_SEPOLICY_VERSION, which is a version string to represent the platform sepolicy of the form "NN.m" where "NN" mirrors the PLATFORM_SDK_VERSION and "m" is a policy-based minor version that is incremented with every policy change that requires a new backward-compatible mapping file to be added to allow for future-proofing vendor policy against future platform policy. Bug: 36783775 Test: Device boots when sha256 doesn't match and compilation is forced. Change-Id: I4edb29824f2050a5a6e1bc078c100cf42e45c303
2017-04-08 01:36:23 +02:00
$(current_mapping.cil) : PRIVATE_VERS := $(PLATFORM_SEPOLICY_VERSION)
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
$(current_mapping.cil) : $(plat_pub_policy.cil) $(HOST_OUT_EXECUTABLES)/version_policy
@mkdir -p $(dir $@)
$(hide) $(HOST_OUT_EXECUTABLES)/version_policy -b $< -m -n $(PRIVATE_VERS) -o $@
Add BOARD_PLAT_[PUBLIC|PRIVATE]_SEPOLICY_DIRS Add new build variables for partner customization (additions) to platform sepolicy. This allows partners to add their own policy without having to touch the AOSP sepolicy directories and potentially disrupting compatibility with an AOSP system image. Bug: 36467375 Test: Add public and private files to sailfish policy and verify that they are added to the appropriate policy files, but that the policy is otherwise identical. Also add private/mapping/*.cil files in both locations and change the BOARD_SEPOLICY_VERS to trigger use of prebuilt mapping files and verify that they are appropriately combined and built in policy. Change-Id: I38efe2248520804a123603bb050bba75563fe45c Merged-In: I38efe2248520804a123603bb050bba75563fe45c (cherry picked from commit f893700c73f2e4e13385f11edcacf563f59b63c5)
2017-05-08 23:26:52 +02:00
else # ifeq ($(BOARD_SEPOLICY_VERS), $(PLATFORM_SEPOLICY_VERSION))
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
# TODO(b/119305624): Move product-specific sepolicy out of mapping files.
Fix mapping file build. Location of mapping files has changed from private/mapping/V.v.cil to private/compat/V.v/V.v.cil Change the build rule for current_mapping.cil to reflect that. Test: Build current mapping file with BOARD_SEPOLICY_VERS := 27.0 and make sure that $OUT/obj/ETC/27.0.cil_intermediates/27.0.cil is not empty Change-Id: I996a717e1c659265cb067da5d621d71ff3b3b63b
2018-03-21 02:06:37 +01:00
prebuilt_mapping_files := $(wildcard \
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
$(addsuffix /compat/$(BOARD_SEPOLICY_VERS)/$(BOARD_SEPOLICY_VERS).cil, \
$(PLAT_PRIVATE_POLICY) $(PRODUCT_PRIVATE_POLICY)))
Add BOARD_PLAT_[PUBLIC|PRIVATE]_SEPOLICY_DIRS Add new build variables for partner customization (additions) to platform sepolicy. This allows partners to add their own policy without having to touch the AOSP sepolicy directories and potentially disrupting compatibility with an AOSP system image. Bug: 36467375 Test: Add public and private files to sailfish policy and verify that they are added to the appropriate policy files, but that the policy is otherwise identical. Also add private/mapping/*.cil files in both locations and change the BOARD_SEPOLICY_VERS to trigger use of prebuilt mapping files and verify that they are appropriately combined and built in policy. Change-Id: I38efe2248520804a123603bb050bba75563fe45c Merged-In: I38efe2248520804a123603bb050bba75563fe45c (cherry picked from commit f893700c73f2e4e13385f11edcacf563f59b63c5)
2017-05-08 23:26:52 +02:00
$(current_mapping.cil) : $(prebuilt_mapping_files)
@mkdir -p $(dir $@)
cat $^ > $@
sepolicy_version: change current version to NN.m format The sepolicy version takes SDK_INT.<minor> format. Make sure our 'current' policy version reflects the format and make it '100000.0'. This ensures any vendor.img compiled with this will never work with a production framework image either. Make version_policy replace the '.' in version by '_' so secilc is happy too. This unblocks libvintf from giving out a runtme API to check vendor's sepolicy version. The PLAT_PUBLIC_SEPOLICY_CURRENT_VERSION will eventually be picked up from the build system. Bug: 35217573 Test: Build and boot sailfish. Boot sailfish with sepolicy compilation on device. Signed-off-by: Sandeep Patil <sspatil@google.com> Change-Id: Ic8b6687c4e71227bf9090018999149cd9e11d63b
2017-04-07 23:18:48 +02:00
Add BOARD_PLAT_[PUBLIC|PRIVATE]_SEPOLICY_DIRS Add new build variables for partner customization (additions) to platform sepolicy. This allows partners to add their own policy without having to touch the AOSP sepolicy directories and potentially disrupting compatibility with an AOSP system image. Bug: 36467375 Test: Add public and private files to sailfish policy and verify that they are added to the appropriate policy files, but that the policy is otherwise identical. Also add private/mapping/*.cil files in both locations and change the BOARD_SEPOLICY_VERS to trigger use of prebuilt mapping files and verify that they are appropriately combined and built in policy. Change-Id: I38efe2248520804a123603bb050bba75563fe45c Merged-In: I38efe2248520804a123603bb050bba75563fe45c (cherry picked from commit f893700c73f2e4e13385f11edcacf563f59b63c5)
2017-05-08 23:26:52 +02:00
prebuilt_mapping_files :=
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
endif
Add BOARD_PLAT_[PUBLIC|PRIVATE]_SEPOLICY_DIRS Add new build variables for partner customization (additions) to platform sepolicy. This allows partners to add their own policy without having to touch the AOSP sepolicy directories and potentially disrupting compatibility with an AOSP system image. Bug: 36467375 Test: Add public and private files to sailfish policy and verify that they are added to the appropriate policy files, but that the policy is otherwise identical. Also add private/mapping/*.cil files in both locations and change the BOARD_SEPOLICY_VERS to trigger use of prebuilt mapping files and verify that they are appropriately combined and built in policy. Change-Id: I38efe2248520804a123603bb050bba75563fe45c Merged-In: I38efe2248520804a123603bb050bba75563fe45c (cherry picked from commit f893700c73f2e4e13385f11edcacf563f59b63c5)
2017-05-08 23:26:52 +02:00
$(LOCAL_BUILT_MODULE): $(current_mapping.cil) $(ACP)
Retain neverallow rules in CIL files Fixes issue where attributes used exlusively in neverallow rules were removed from policy. For on-device compile use the -N flag to skip neverallow tests. Policy size increases: vendor/etc/selinux/nonplat_sepolicy.cil 547849 -> 635637 vendor/etc/selinux/precompiled_sepolicy 440248 -> 441076 system/etc/selinux/plat_sepolicy.cil 567664 -> 745230 For a total increase in system/vendor: 266182. Boot time changes: Pixel uses precompiled policy so boot time is not impacted. When forcing on-device compile on Marlin selinux policy compile time increases 510-520 ms -> 550-560 ms. Bug: 37357742 Test: Build and boot Marlin. Test: Verify both precompiled and on-device compile work. Change-Id: Ib3cb53d376a96e34f55ac27d651a6ce2fabf6ba7
2017-04-22 00:57:07 +02:00
$(hide) $(ACP) $< $@
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
Test CIL policy when building it Prior to this commit, there was a bug in generated CIL where it wouldn't compile using secilc. The reason was that the build script was stripping out all lines containing "neverallow" from CIL files, accidentally removing lines which were not neverallow statements, such as lmx lines referencing app_neverallows.te. The commit fixes the build script's CIL neverallow filter to filter out only neverallow* statements, as originally intended. Moreover, to catch non-compiling CIL policy earlier in the future, this commit runs secilc on the policy at build time. In particular, it tests that platform policy compiles on its own and that nonplatform + platform + mappig policy compiles as well. Test: CIL policy builds and compiles on-device using secilc Bug: 31363362 Change-Id: I769aeb3d8c913a5599f1a2195c69460ece7f6465
2017-02-25 23:47:53 +01:00
built_mapping_cil := $(LOCAL_BUILT_MODULE)
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
current_mapping.cil :=
#################################
include $(CLEAR_VARS)
Move mapping_sepolicy.cil to /system partition. This is a necessary first step to finalizing the SELinux policy build process. The mapping_sepolicy.cil file is required to provide backward compatibility with the indicated vendor-targeted version. This still needs to be extended to provide N mapping files and corresponding SHA256 outputs, one for each of the N previous platform versions with which we're backward-compatible. Bug: 36783775 Test: boot device with matching sha256 and non-matching and verify that device boots and uses either precompiled or compiled policy as needed. Also verify that mapping_sepolicy.cil has moved. Change-Id: I5692fb87c7ec0f3ae9ca611f76847ccff9182375
2017-04-04 23:27:41 +02:00
LOCAL_MODULE := plat_and_mapping_sepolicy.cil.sha256
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH = $(TARGET_OUT)/etc/selinux
include $(BUILD_SYSTEM)/base_rules.mk
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
$(LOCAL_BUILT_MODULE): $(built_plat_cil) $(built_mapping_cil) $(built_product_cil)
Move mapping_sepolicy.cil to /system partition. This is a necessary first step to finalizing the SELinux policy build process. The mapping_sepolicy.cil file is required to provide backward compatibility with the indicated vendor-targeted version. This still needs to be extended to provide N mapping files and corresponding SHA256 outputs, one for each of the N previous platform versions with which we're backward-compatible. Bug: 36783775 Test: boot device with matching sha256 and non-matching and verify that device boots and uses either precompiled or compiled policy as needed. Also verify that mapping_sepolicy.cil has moved. Change-Id: I5692fb87c7ec0f3ae9ca611f76847ccff9182375
2017-04-04 23:27:41 +02:00
cat $^ | sha256sum | cut -d' ' -f1 > $@
#################################
include $(CLEAR_VARS)
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
# plat_pub_versioned.cil - the exported platform policy associated with the version
# that non-platform policy targets.
LOCAL_MODULE := plat_pub_versioned.cil
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
Move split sepolicy to correct locations This moves the CIL files comprising the split sepolicy to the directories/partitions based on whether the file is part of platform/system or non-platform/vendor. In particular: * plat_sepolicy.cil is moved to /system/etc/selinux, * nonplat_sepolicy.cil is moved to /vendor/etc/selinux, and * mapping_sepolicy.cil is moved to /vendor/etc/selinux. Test: Device boots, no additional denials. The test is performed both for a device without the CIL files and with the three CIL files. Bug: 31363362 Change-Id: Ia760d7eb32c80ba72f6409da75d99eb5aae71cd9
2017-03-02 21:39:25 +01:00
LOCAL_PROPRIETARY_MODULE := true
LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
include $(BUILD_SYSTEM)/base_rules.mk
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
$(LOCAL_BUILT_MODULE) : PRIVATE_VERS := $(BOARD_SEPOLICY_VERS)
$(LOCAL_BUILT_MODULE) : PRIVATE_TGT_POL := $(plat_pub_policy.cil)
$(LOCAL_BUILT_MODULE) : PRIVATE_DEP_CIL_FILES := $(built_plat_cil) $(built_mapping_cil)
$(LOCAL_BUILT_MODULE) : $(plat_pub_policy.cil) $(HOST_OUT_EXECUTABLES)/version_policy \
$(HOST_OUT_EXECUTABLES)/secilc $(built_plat_cil) $(built_mapping_cil)
@mkdir -p $(dir $@)
$(HOST_OUT_EXECUTABLES)/version_policy -b $< -t $(PRIVATE_TGT_POL) -n $(PRIVATE_VERS) -o $@
$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -N -c $(POLICYVERS) \
$(PRIVATE_DEP_CIL_FILES) $@ -o /dev/null -f /dev/null
built_plat_pub_vers_cil := $(LOCAL_BUILT_MODULE)
#################################
include $(CLEAR_VARS)
# vendor_policy.cil - the vendor sepolicy. This needs attributization and to be combined
# with the platform-provided policy. It makes use of the reqd_policy_mask files from private
# policy and the platform public policy files in order to use checkpolicy.
LOCAL_MODULE := vendor_sepolicy.cil
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_PROPRIETARY_MODULE := true
LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
include $(BUILD_SYSTEM)/base_rules.mk
vendor_policy.conf := $(intermediates)/vendor_policy.conf
$(vendor_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
$(vendor_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Use user policy when checking neverallow rules. When building userdebug or eng builds, we still want to build the user policy when checking neverallow rules so that we can catch compile errors. Commit c0713e86 split out a helper function but lost one instance of using user instead of the real variant. This restores that one and adds it to the neverallow check. Bug: 74344625 Test: Added a rule that referred to a type defined only in userdebug and eng and ensure we throw a compile error when building userdebug mode. Change-Id: I1a6ffbb36dbeeb880852f9cbac880f923370c2ae (cherry picked from commit 053cb34130b763d93e2181062ebe1b5f8bf3ad9c)
2018-03-08 00:36:29 +01:00
$(vendor_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
$(vendor_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
$(vendor_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
$(vendor_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(vendor_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
$(vendor_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
$(vendor_policy.conf): $(call build_policy, $(sepolicy_build_files), \
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
$(PLAT_PUBLIC_POLICY) $(PRODUCT_PUBLIC_POLICY) $(REQD_MASK_POLICY) $(PLAT_VENDOR_POLICY) \
$(BOARD_VENDOR_SEPOLICY_DIRS))
Add sepolicy definitions.mk and create policy.conf function. Bug: 36899958 Test: Builds 'n' boots. Change-Id: I5836a18f9d0a9a976dda7304045e3b9e1e84565e Merged-In: I5836a18f9d0a9a976dda7304045e3b9e1e84565e (cherry picked from commit c0713e86790583dacbd8545d35ae476ff1f849bb)
2017-07-07 23:59:51 +02:00
$(transform-policy-to-conf)
Fix building error for multi-line dontaudit statement All the *.conf.dontaudit files are generated from *.conf with the command of 'sed '/dontaudit/d' $@ > $@.dontaudit', but this command can not be applied to multi-line dontaudit statement. Test: Set plat_policy.conf.dontaudit as the input_file parameter of checkpolicy tool, then selinux syntax error will occur during building. Change-Id: I281de923d8a5f0b46256ec7de4df12a1c1d7e061
2018-09-13 08:04:19 +02:00
$(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
Using a python script to build sepolicy Current sepolicy CIL files are built by several command-line tools in Android.mk. This change extracts some of the build logic into a python script to relief the effort in Android.mk. The first command is `build_sepolicy build_cil`. It's possible to add more sub-commands under the build_sepolicy script in the future. Bug: 64240127 Test: build bullhead/taimen Change-Id: Ie0ae4fc5256a550c72954cde5d5dd213a22d159a
2018-02-05 10:41:02 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_POL_CONF := $(vendor_policy.conf)
$(LOCAL_BUILT_MODULE): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil)
$(LOCAL_BUILT_MODULE): PRIVATE_BASE_CIL := $(plat_pub_policy.cil)
$(LOCAL_BUILT_MODULE): PRIVATE_VERS := $(BOARD_SEPOLICY_VERS)
$(LOCAL_BUILT_MODULE): PRIVATE_DEP_CIL_FILES := $(built_plat_cil) $(built_plat_pub_vers_cil) $(built_mapping_cil)
$(LOCAL_BUILT_MODULE): PRIVATE_FILTER_CIL := $(built_plat_pub_vers_cil)
$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/build_sepolicy \
$(vendor_policy.conf) $(reqd_policy_mask.cil) $(plat_pub_policy.cil) \
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
$(built_plat_cil) $(built_plat_pub_vers_cil) $(built_mapping_cil)
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
@mkdir -p $(dir $@)
Using a python script to build sepolicy Current sepolicy CIL files are built by several command-line tools in Android.mk. This change extracts some of the build logic into a python script to relief the effort in Android.mk. The first command is `build_sepolicy build_cil`. It's possible to add more sub-commands under the build_sepolicy script in the future. Bug: 64240127 Test: build bullhead/taimen Change-Id: Ie0ae4fc5256a550c72954cde5d5dd213a22d159a
2018-02-05 10:41:02 +01:00
$(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) build_cil \
-i $(PRIVATE_POL_CONF) -m $(PRIVATE_REQD_MASK) -c $(CHECKPOLICY_ASAN_OPTIONS) \
-b $(PRIVATE_BASE_CIL) -d $(PRIVATE_DEP_CIL_FILES) -f $(PRIVATE_FILTER_CIL) \
-t $(PRIVATE_VERS) -p $(POLICYVERS) -o $@
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
built_vendor_cil := $(LOCAL_BUILT_MODULE)
vendor_policy.conf :=
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
Precompiled kernel policy for on-device use This adds build targets for outputing precompiled kernel policy usable on devices with policy split between system and vendor partitions. On such devices, precompiled policy must reside on the vendor partition. Because such devices support updating these partitions independently of each other, the precompiled policy must reference the system partition's policy against which it was compiled. This enables init to establish whether the precompiled policy is valid for the current combination of system and vendor partitions. The referencing is performed by both the system and vendor partitions including the SHA-256 digest of the system partition's policy (plat_sepolicy.cil). Only the when the digest is the same on both partitions can the precompiled policy be used. Test: plat_sepolicy.cil.sha256 contains exactly the hex form of the SHA-256 digest of plat_sepolicy.cil Test: plat_sepolicy.cil.sha256 is identical precompiled_sepolicy.plat.sha256. Bug: 31363362 Change-Id: I9771e1aa751e25bba6e2face37d68e0ae43b33a3
2017-03-07 23:05:57 +01:00
#################################
include $(CLEAR_VARS)
Android.mk: conditional compilation of odm_sepolicy.cil Do not attempt to build odm_sepolicy.cil if BOARD_ODM_SEPOLICY_DIRS is not defined. Attempting to do so will create an empty file, which causes build problems when https://github.com/SELinuxProject/selinux/pull/100/commits/0c6ea1e812fbe75aef03ced077d4f4cd26d982fc is applied. Test: "cd system/sepolicy && mma -j55" succeeds Test: "make checkbuild" succeeds Change-Id: Iefc458bddff3d08e5fcb86f8be3cad16d7e36e73
2018-09-25 20:03:48 +02:00
ifdef BOARD_ODM_SEPOLICY_DIRS
Add /odm/etc/selinux/odm_sepolicy.cil This change adds the support of odm sepolicy customization, which can be configured through the newly added build varaible: - BOARD_ODM_SEPOLICY_DIRS += device/${ODM_NAME}/${BOM_NAME}/sepolicy Also moving precompiled sepolicy to /odm when BOARD_ODM_SEPOLICY_DIRS is set. On a DUT, precompiled sepolicy on /odm will override the one in /vendor. This is intentional because /odm is the hardware customization for /vendor and both should be updated together if desired. Bug: 64240127 Test: boot a device with /odm partition Change-Id: Ia8f81a78c88cbfefb3ff19e2ccd2648da6284d09
2017-11-27 04:41:33 +01:00
# odm_policy.cil - the odm sepolicy. This needs attributization and to be combined
# with the platform-provided policy. It makes use of the reqd_policy_mask files from private
# policy and the platform public policy files in order to use checkpolicy.
LOCAL_MODULE := odm_sepolicy.cil
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_PROPRIETARY_MODULE := true
LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux
include $(BUILD_SYSTEM)/base_rules.mk
odm_policy.conf := $(intermediates)/odm_policy.conf
$(odm_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
$(odm_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
$(odm_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
$(odm_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
$(odm_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
$(odm_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(odm_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
$(odm_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
$(odm_policy.conf): $(call build_policy, $(sepolicy_build_files), \
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
$(PLAT_PUBLIC_POLICY) $(PRODUCT_PUBLIC_POLICY) $(REQD_MASK_POLICY) $(PLAT_VENDOR_POLICY) \
Add /odm/etc/selinux/odm_sepolicy.cil This change adds the support of odm sepolicy customization, which can be configured through the newly added build varaible: - BOARD_ODM_SEPOLICY_DIRS += device/${ODM_NAME}/${BOM_NAME}/sepolicy Also moving precompiled sepolicy to /odm when BOARD_ODM_SEPOLICY_DIRS is set. On a DUT, precompiled sepolicy on /odm will override the one in /vendor. This is intentional because /odm is the hardware customization for /vendor and both should be updated together if desired. Bug: 64240127 Test: boot a device with /odm partition Change-Id: Ia8f81a78c88cbfefb3ff19e2ccd2648da6284d09
2017-11-27 04:41:33 +01:00
$(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_ODM_SEPOLICY_DIRS))
$(transform-policy-to-conf)
Fix building error for multi-line dontaudit statement All the *.conf.dontaudit files are generated from *.conf with the command of 'sed '/dontaudit/d' $@ > $@.dontaudit', but this command can not be applied to multi-line dontaudit statement. Test: Set plat_policy.conf.dontaudit as the input_file parameter of checkpolicy tool, then selinux syntax error will occur during building. Change-Id: I281de923d8a5f0b46256ec7de4df12a1c1d7e061
2018-09-13 08:04:19 +02:00
$(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
Add /odm/etc/selinux/odm_sepolicy.cil This change adds the support of odm sepolicy customization, which can be configured through the newly added build varaible: - BOARD_ODM_SEPOLICY_DIRS += device/${ODM_NAME}/${BOM_NAME}/sepolicy Also moving precompiled sepolicy to /odm when BOARD_ODM_SEPOLICY_DIRS is set. On a DUT, precompiled sepolicy on /odm will override the one in /vendor. This is intentional because /odm is the hardware customization for /vendor and both should be updated together if desired. Bug: 64240127 Test: boot a device with /odm partition Change-Id: Ia8f81a78c88cbfefb3ff19e2ccd2648da6284d09
2017-11-27 04:41:33 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_POL_CONF := $(odm_policy.conf)
$(LOCAL_BUILT_MODULE): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil)
$(LOCAL_BUILT_MODULE): PRIVATE_BASE_CIL := $(plat_pub_policy.cil)
$(LOCAL_BUILT_MODULE): PRIVATE_VERS := $(BOARD_SEPOLICY_VERS)
$(LOCAL_BUILT_MODULE): PRIVATE_DEP_CIL_FILES := $(built_plat_cil) $(built_plat_pub_vers_cil) \
$(built_mapping_cil) $(built_vendor_cil)
$(LOCAL_BUILT_MODULE) : PRIVATE_FILTER_CIL_FILES := $(built_plat_pub_vers_cil) $(built_vendor_cil)
$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/build_sepolicy \
$(odm_policy.conf) $(reqd_policy_mask.cil) $(plat_pub_policy.cil) \
$(built_plat_cil) $(built_plat_pub_vers_cil) $(built_mapping_cil) $(built_vendor_cil)
@mkdir -p $(dir $@)
$(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) build_cil \
-i $(PRIVATE_POL_CONF) -m $(PRIVATE_REQD_MASK) -c $(CHECKPOLICY_ASAN_OPTIONS) \
-b $(PRIVATE_BASE_CIL) -d $(PRIVATE_DEP_CIL_FILES) -f $(PRIVATE_FILTER_CIL_FILES) \
-t $(PRIVATE_VERS) -p $(POLICYVERS) -o $@
built_odm_cil := $(LOCAL_BUILT_MODULE)
odm_policy.conf :=
odm_policy_raw :=
Android.mk: conditional compilation of odm_sepolicy.cil Do not attempt to build odm_sepolicy.cil if BOARD_ODM_SEPOLICY_DIRS is not defined. Attempting to do so will create an empty file, which causes build problems when https://github.com/SELinuxProject/selinux/pull/100/commits/0c6ea1e812fbe75aef03ced077d4f4cd26d982fc is applied. Test: "cd system/sepolicy && mma -j55" succeeds Test: "make checkbuild" succeeds Change-Id: Iefc458bddff3d08e5fcb86f8be3cad16d7e36e73
2018-09-25 20:03:48 +02:00
endif
Add /odm/etc/selinux/odm_sepolicy.cil This change adds the support of odm sepolicy customization, which can be configured through the newly added build varaible: - BOARD_ODM_SEPOLICY_DIRS += device/${ODM_NAME}/${BOM_NAME}/sepolicy Also moving precompiled sepolicy to /odm when BOARD_ODM_SEPOLICY_DIRS is set. On a DUT, precompiled sepolicy on /odm will override the one in /vendor. This is intentional because /odm is the hardware customization for /vendor and both should be updated together if desired. Bug: 64240127 Test: boot a device with /odm partition Change-Id: Ia8f81a78c88cbfefb3ff19e2ccd2648da6284d09
2017-11-27 04:41:33 +01:00
#################################
include $(CLEAR_VARS)
Precompiled kernel policy for on-device use This adds build targets for outputing precompiled kernel policy usable on devices with policy split between system and vendor partitions. On such devices, precompiled policy must reside on the vendor partition. Because such devices support updating these partitions independently of each other, the precompiled policy must reference the system partition's policy against which it was compiled. This enables init to establish whether the precompiled policy is valid for the current combination of system and vendor partitions. The referencing is performed by both the system and vendor partitions including the SHA-256 digest of the system partition's policy (plat_sepolicy.cil). Only the when the digest is the same on both partitions can the precompiled policy be used. Test: plat_sepolicy.cil.sha256 contains exactly the hex form of the SHA-256 digest of plat_sepolicy.cil Test: plat_sepolicy.cil.sha256 is identical precompiled_sepolicy.plat.sha256. Bug: 31363362 Change-Id: I9771e1aa751e25bba6e2face37d68e0ae43b33a3
2017-03-07 23:05:57 +01:00
LOCAL_MODULE := precompiled_sepolicy
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_PROPRIETARY_MODULE := true
Add /odm/etc/selinux/odm_sepolicy.cil This change adds the support of odm sepolicy customization, which can be configured through the newly added build varaible: - BOARD_ODM_SEPOLICY_DIRS += device/${ODM_NAME}/${BOM_NAME}/sepolicy Also moving precompiled sepolicy to /odm when BOARD_ODM_SEPOLICY_DIRS is set. On a DUT, precompiled sepolicy on /odm will override the one in /vendor. This is intentional because /odm is the hardware customization for /vendor and both should be updated together if desired. Bug: 64240127 Test: boot a device with /odm partition Change-Id: Ia8f81a78c88cbfefb3ff19e2ccd2648da6284d09
2017-11-27 04:41:33 +01:00
ifeq ($(BOARD_USES_ODMIMAGE),true)
LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux
else
Precompiled kernel policy for on-device use This adds build targets for outputing precompiled kernel policy usable on devices with policy split between system and vendor partitions. On such devices, precompiled policy must reside on the vendor partition. Because such devices support updating these partitions independently of each other, the precompiled policy must reference the system partition's policy against which it was compiled. This enables init to establish whether the precompiled policy is valid for the current combination of system and vendor partitions. The referencing is performed by both the system and vendor partitions including the SHA-256 digest of the system partition's policy (plat_sepolicy.cil). Only the when the digest is the same on both partitions can the precompiled policy be used. Test: plat_sepolicy.cil.sha256 contains exactly the hex form of the SHA-256 digest of plat_sepolicy.cil Test: plat_sepolicy.cil.sha256 is identical precompiled_sepolicy.plat.sha256. Bug: 31363362 Change-Id: I9771e1aa751e25bba6e2face37d68e0ae43b33a3
2017-03-07 23:05:57 +01:00
LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
Add /odm/etc/selinux/odm_sepolicy.cil This change adds the support of odm sepolicy customization, which can be configured through the newly added build varaible: - BOARD_ODM_SEPOLICY_DIRS += device/${ODM_NAME}/${BOM_NAME}/sepolicy Also moving precompiled sepolicy to /odm when BOARD_ODM_SEPOLICY_DIRS is set. On a DUT, precompiled sepolicy on /odm will override the one in /vendor. This is intentional because /odm is the hardware customization for /vendor and both should be updated together if desired. Bug: 64240127 Test: boot a device with /odm partition Change-Id: Ia8f81a78c88cbfefb3ff19e2ccd2648da6284d09
2017-11-27 04:41:33 +01:00
endif
Precompiled kernel policy for on-device use This adds build targets for outputing precompiled kernel policy usable on devices with policy split between system and vendor partitions. On such devices, precompiled policy must reside on the vendor partition. Because such devices support updating these partitions independently of each other, the precompiled policy must reference the system partition's policy against which it was compiled. This enables init to establish whether the precompiled policy is valid for the current combination of system and vendor partitions. The referencing is performed by both the system and vendor partitions including the SHA-256 digest of the system partition's policy (plat_sepolicy.cil). Only the when the digest is the same on both partitions can the precompiled policy be used. Test: plat_sepolicy.cil.sha256 contains exactly the hex form of the SHA-256 digest of plat_sepolicy.cil Test: plat_sepolicy.cil.sha256 is identical precompiled_sepolicy.plat.sha256. Bug: 31363362 Change-Id: I9771e1aa751e25bba6e2face37d68e0ae43b33a3
2017-03-07 23:05:57 +01:00
include $(BUILD_SYSTEM)/base_rules.mk
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
all_cil_files := \
$(built_plat_cil) \
$(built_mapping_cil) \
$(built_plat_pub_vers_cil) \
$(built_vendor_cil)
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
ifdef HAS_PRODUCT_SEPOLICY
all_cil_files += $(built_product_cil)
endif
Add /odm/etc/selinux/odm_sepolicy.cil This change adds the support of odm sepolicy customization, which can be configured through the newly added build varaible: - BOARD_ODM_SEPOLICY_DIRS += device/${ODM_NAME}/${BOM_NAME}/sepolicy Also moving precompiled sepolicy to /odm when BOARD_ODM_SEPOLICY_DIRS is set. On a DUT, precompiled sepolicy on /odm will override the one in /vendor. This is intentional because /odm is the hardware customization for /vendor and both should be updated together if desired. Bug: 64240127 Test: boot a device with /odm partition Change-Id: Ia8f81a78c88cbfefb3ff19e2ccd2648da6284d09
2017-11-27 04:41:33 +01:00
ifdef BOARD_ODM_SEPOLICY_DIRS
all_cil_files += $(built_odm_cil)
endif
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(all_cil_files)
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(all_cil_files) $(built_sepolicy_neverallows)
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) \
Precompiled kernel policy for on-device use This adds build targets for outputing precompiled kernel policy usable on devices with policy split between system and vendor partitions. On such devices, precompiled policy must reside on the vendor partition. Because such devices support updating these partitions independently of each other, the precompiled policy must reference the system partition's policy against which it was compiled. This enables init to establish whether the precompiled policy is valid for the current combination of system and vendor partitions. The referencing is performed by both the system and vendor partitions including the SHA-256 digest of the system partition's policy (plat_sepolicy.cil). Only the when the digest is the same on both partitions can the precompiled policy be used. Test: plat_sepolicy.cil.sha256 contains exactly the hex form of the SHA-256 digest of plat_sepolicy.cil Test: plat_sepolicy.cil.sha256 is identical precompiled_sepolicy.plat.sha256. Bug: 31363362 Change-Id: I9771e1aa751e25bba6e2face37d68e0ae43b33a3
2017-03-07 23:05:57 +01:00
$(PRIVATE_CIL_FILES) -o $@ -f /dev/null
built_precompiled_sepolicy := $(LOCAL_BUILT_MODULE)
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
all_cil_files :=
Precompiled kernel policy for on-device use This adds build targets for outputing precompiled kernel policy usable on devices with policy split between system and vendor partitions. On such devices, precompiled policy must reside on the vendor partition. Because such devices support updating these partitions independently of each other, the precompiled policy must reference the system partition's policy against which it was compiled. This enables init to establish whether the precompiled policy is valid for the current combination of system and vendor partitions. The referencing is performed by both the system and vendor partitions including the SHA-256 digest of the system partition's policy (plat_sepolicy.cil). Only the when the digest is the same on both partitions can the precompiled policy be used. Test: plat_sepolicy.cil.sha256 contains exactly the hex form of the SHA-256 digest of plat_sepolicy.cil Test: plat_sepolicy.cil.sha256 is identical precompiled_sepolicy.plat.sha256. Bug: 31363362 Change-Id: I9771e1aa751e25bba6e2face37d68e0ae43b33a3
2017-03-07 23:05:57 +01:00
#################################
Move mapping_sepolicy.cil to /system partition. This is a necessary first step to finalizing the SELinux policy build process. The mapping_sepolicy.cil file is required to provide backward compatibility with the indicated vendor-targeted version. This still needs to be extended to provide N mapping files and corresponding SHA256 outputs, one for each of the N previous platform versions with which we're backward-compatible. Bug: 36783775 Test: boot device with matching sha256 and non-matching and verify that device boots and uses either precompiled or compiled policy as needed. Also verify that mapping_sepolicy.cil has moved. Change-Id: I5692fb87c7ec0f3ae9ca611f76847ccff9182375
2017-04-04 23:27:41 +02:00
# SHA-256 digest of the plat_sepolicy.cil and mapping_sepolicy.cil files against
# which precompiled_policy was built.
Precompiled kernel policy for on-device use This adds build targets for outputing precompiled kernel policy usable on devices with policy split between system and vendor partitions. On such devices, precompiled policy must reside on the vendor partition. Because such devices support updating these partitions independently of each other, the precompiled policy must reference the system partition's policy against which it was compiled. This enables init to establish whether the precompiled policy is valid for the current combination of system and vendor partitions. The referencing is performed by both the system and vendor partitions including the SHA-256 digest of the system partition's policy (plat_sepolicy.cil). Only the when the digest is the same on both partitions can the precompiled policy be used. Test: plat_sepolicy.cil.sha256 contains exactly the hex form of the SHA-256 digest of plat_sepolicy.cil Test: plat_sepolicy.cil.sha256 is identical precompiled_sepolicy.plat.sha256. Bug: 31363362 Change-Id: I9771e1aa751e25bba6e2face37d68e0ae43b33a3
2017-03-07 23:05:57 +01:00
#################################
include $(CLEAR_VARS)
Move mapping_sepolicy.cil to /system partition. This is a necessary first step to finalizing the SELinux policy build process. The mapping_sepolicy.cil file is required to provide backward compatibility with the indicated vendor-targeted version. This still needs to be extended to provide N mapping files and corresponding SHA256 outputs, one for each of the N previous platform versions with which we're backward-compatible. Bug: 36783775 Test: boot device with matching sha256 and non-matching and verify that device boots and uses either precompiled or compiled policy as needed. Also verify that mapping_sepolicy.cil has moved. Change-Id: I5692fb87c7ec0f3ae9ca611f76847ccff9182375
2017-04-04 23:27:41 +02:00
LOCAL_MODULE := precompiled_sepolicy.plat_and_mapping.sha256
Precompiled kernel policy for on-device use This adds build targets for outputing precompiled kernel policy usable on devices with policy split between system and vendor partitions. On such devices, precompiled policy must reside on the vendor partition. Because such devices support updating these partitions independently of each other, the precompiled policy must reference the system partition's policy against which it was compiled. This enables init to establish whether the precompiled policy is valid for the current combination of system and vendor partitions. The referencing is performed by both the system and vendor partitions including the SHA-256 digest of the system partition's policy (plat_sepolicy.cil). Only the when the digest is the same on both partitions can the precompiled policy be used. Test: plat_sepolicy.cil.sha256 contains exactly the hex form of the SHA-256 digest of plat_sepolicy.cil Test: plat_sepolicy.cil.sha256 is identical precompiled_sepolicy.plat.sha256. Bug: 31363362 Change-Id: I9771e1aa751e25bba6e2face37d68e0ae43b33a3
2017-03-07 23:05:57 +01:00
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_PROPRIETARY_MODULE := true
Add /odm/etc/selinux/odm_sepolicy.cil This change adds the support of odm sepolicy customization, which can be configured through the newly added build varaible: - BOARD_ODM_SEPOLICY_DIRS += device/${ODM_NAME}/${BOM_NAME}/sepolicy Also moving precompiled sepolicy to /odm when BOARD_ODM_SEPOLICY_DIRS is set. On a DUT, precompiled sepolicy on /odm will override the one in /vendor. This is intentional because /odm is the hardware customization for /vendor and both should be updated together if desired. Bug: 64240127 Test: boot a device with /odm partition Change-Id: Ia8f81a78c88cbfefb3ff19e2ccd2648da6284d09
2017-11-27 04:41:33 +01:00
ifeq ($(BOARD_USES_ODMIMAGE),true)
LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux
else
Precompiled kernel policy for on-device use This adds build targets for outputing precompiled kernel policy usable on devices with policy split between system and vendor partitions. On such devices, precompiled policy must reside on the vendor partition. Because such devices support updating these partitions independently of each other, the precompiled policy must reference the system partition's policy against which it was compiled. This enables init to establish whether the precompiled policy is valid for the current combination of system and vendor partitions. The referencing is performed by both the system and vendor partitions including the SHA-256 digest of the system partition's policy (plat_sepolicy.cil). Only the when the digest is the same on both partitions can the precompiled policy be used. Test: plat_sepolicy.cil.sha256 contains exactly the hex form of the SHA-256 digest of plat_sepolicy.cil Test: plat_sepolicy.cil.sha256 is identical precompiled_sepolicy.plat.sha256. Bug: 31363362 Change-Id: I9771e1aa751e25bba6e2face37d68e0ae43b33a3
2017-03-07 23:05:57 +01:00
LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
Add /odm/etc/selinux/odm_sepolicy.cil This change adds the support of odm sepolicy customization, which can be configured through the newly added build varaible: - BOARD_ODM_SEPOLICY_DIRS += device/${ODM_NAME}/${BOM_NAME}/sepolicy Also moving precompiled sepolicy to /odm when BOARD_ODM_SEPOLICY_DIRS is set. On a DUT, precompiled sepolicy on /odm will override the one in /vendor. This is intentional because /odm is the hardware customization for /vendor and both should be updated together if desired. Bug: 64240127 Test: boot a device with /odm partition Change-Id: Ia8f81a78c88cbfefb3ff19e2ccd2648da6284d09
2017-11-27 04:41:33 +01:00
endif
Precompiled kernel policy for on-device use This adds build targets for outputing precompiled kernel policy usable on devices with policy split between system and vendor partitions. On such devices, precompiled policy must reside on the vendor partition. Because such devices support updating these partitions independently of each other, the precompiled policy must reference the system partition's policy against which it was compiled. This enables init to establish whether the precompiled policy is valid for the current combination of system and vendor partitions. The referencing is performed by both the system and vendor partitions including the SHA-256 digest of the system partition's policy (plat_sepolicy.cil). Only the when the digest is the same on both partitions can the precompiled policy be used. Test: plat_sepolicy.cil.sha256 contains exactly the hex form of the SHA-256 digest of plat_sepolicy.cil Test: plat_sepolicy.cil.sha256 is identical precompiled_sepolicy.plat.sha256. Bug: 31363362 Change-Id: I9771e1aa751e25bba6e2face37d68e0ae43b33a3
2017-03-07 23:05:57 +01:00
include $(BUILD_SYSTEM)/base_rules.mk
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(built_plat_cil) $(built_mapping_cil) $(built_product_cil)
Move mapping_sepolicy.cil to /system partition. This is a necessary first step to finalizing the SELinux policy build process. The mapping_sepolicy.cil file is required to provide backward compatibility with the indicated vendor-targeted version. This still needs to be extended to provide N mapping files and corresponding SHA256 outputs, one for each of the N previous platform versions with which we're backward-compatible. Bug: 36783775 Test: boot device with matching sha256 and non-matching and verify that device boots and uses either precompiled or compiled policy as needed. Also verify that mapping_sepolicy.cil has moved. Change-Id: I5692fb87c7ec0f3ae9ca611f76847ccff9182375
2017-04-04 23:27:41 +02:00
$(LOCAL_BUILT_MODULE): $(built_precompiled_sepolicy) $(built_plat_cil) $(built_mapping_cil)
cat $(PRIVATE_CIL_FILES) | sha256sum | cut -d' ' -f1 > $@
Precompiled kernel policy for on-device use This adds build targets for outputing precompiled kernel policy usable on devices with policy split between system and vendor partitions. On such devices, precompiled policy must reside on the vendor partition. Because such devices support updating these partitions independently of each other, the precompiled policy must reference the system partition's policy against which it was compiled. This enables init to establish whether the precompiled policy is valid for the current combination of system and vendor partitions. The referencing is performed by both the system and vendor partitions including the SHA-256 digest of the system partition's policy (plat_sepolicy.cil). Only the when the digest is the same on both partitions can the precompiled policy be used. Test: plat_sepolicy.cil.sha256 contains exactly the hex form of the SHA-256 digest of plat_sepolicy.cil Test: plat_sepolicy.cil.sha256 is identical precompiled_sepolicy.plat.sha256. Bug: 31363362 Change-Id: I9771e1aa751e25bba6e2face37d68e0ae43b33a3
2017-03-07 23:05:57 +01:00
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
#################################
include $(CLEAR_VARS)
Switch recovery to versioned policy and split into components. And do some clean up: Replace LOCAL_TARGET_ARCH with global arch specifier that won't get clobbered, clean up sepolicy.recovery's eng specification, ensure that build macros are applied across all policy generation, not just plat_policy, and make sure that all private variables are cleared and alphabetized at the end. Bug: 31363362 Bug: 31369363 Test: Boot into recovery and observe no selinux denials. Change-Id: Ibc15b097f6d19acf01f6b22bee0e083b15f4ef75
2016-12-16 00:28:44 +01:00
# build this target so that we can still perform neverallow checks
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
LOCAL_MODULE := sepolicy
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
Revert "Move sepolicy and recovery from on-device tree and add dependency." This reverts commit cf5c6ecb93931ca5853b9954979d785d259453ce. Change-Id: Ie86a6ac20ab5a1611efc0e167c0430eb9df9482e
2016-12-17 01:53:26 +01:00
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
include $(BUILD_SYSTEM)/base_rules.mk
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
all_cil_files := \
Retain neverallow rules in CIL files Fixes issue where attributes used exlusively in neverallow rules were removed from policy. For on-device compile use the -N flag to skip neverallow tests. Policy size increases: vendor/etc/selinux/nonplat_sepolicy.cil 547849 -> 635637 vendor/etc/selinux/precompiled_sepolicy 440248 -> 441076 system/etc/selinux/plat_sepolicy.cil 567664 -> 745230 For a total increase in system/vendor: 266182. Boot time changes: Pixel uses precompiled policy so boot time is not impacted. When forcing on-device compile on Marlin selinux policy compile time increases 510-520 ms -> 550-560 ms. Bug: 37357742 Test: Build and boot Marlin. Test: Verify both precompiled and on-device compile work. Change-Id: Ib3cb53d376a96e34f55ac27d651a6ce2fabf6ba7
2017-04-22 00:57:07 +02:00
$(built_plat_cil) \
$(built_mapping_cil) \
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
$(built_plat_pub_vers_cil) \
$(built_vendor_cil)
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
ifdef HAS_PRODUCT_SEPOLICY
all_cil_files += $(built_product_cil)
endif
Add /odm/etc/selinux/odm_sepolicy.cil This change adds the support of odm sepolicy customization, which can be configured through the newly added build varaible: - BOARD_ODM_SEPOLICY_DIRS += device/${ODM_NAME}/${BOM_NAME}/sepolicy Also moving precompiled sepolicy to /odm when BOARD_ODM_SEPOLICY_DIRS is set. On a DUT, precompiled sepolicy on /odm will override the one in /vendor. This is intentional because /odm is the hardware customization for /vendor and both should be updated together if desired. Bug: 64240127 Test: boot a device with /odm partition Change-Id: Ia8f81a78c88cbfefb3ff19e2ccd2648da6284d09
2017-11-27 04:41:33 +01:00
ifdef BOARD_ODM_SEPOLICY_DIRS
all_cil_files += $(built_odm_cil)
endif
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(all_cil_files)
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $(all_cil_files) \
$(built_sepolicy_neverallows)
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
@mkdir -p $(dir $@)
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
$(hide) $< -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $(PRIVATE_CIL_FILES) -o $@.tmp -f /dev/null
Don't allow permissive SELinux domains on user builds. It's a CTS requirement that all SELinux domains be in enforcing mode. Add the same assertion to the build system when targeting user builds. In particular, this avoids a situation where device integrity checking is enabled on user builds, but permissive denials are being generated, causing the device to unexpectedly reboot into safe mode. A developer wanting to put an SELinux domain into permissive mode for userdebug/eng purposes can write the following in their policy: userdebug_or_eng(` permissive foo; ') Bug: 26902605 Bug: 27313768 Change-Id: Ic0971d9e96a28f2a98f9d56a547661d24fb81a21
2016-02-27 05:06:52 +01:00
$(hide) $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $@.tmp permissive > $@.permissivedomains
$(hide) if [ "$(TARGET_BUILD_VARIANT)" = "user" -a -s $@.permissivedomains ]; then \
echo "==========" 1>&2; \
echo "ERROR: permissive domains not allowed in user builds" 1>&2; \
echo "List of invalid domains:" 1>&2; \
cat $@.permissivedomains 1>&2; \
exit 1; \
fi
$(hide) mv $@.tmp $@
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
Use file target as dependency. "sepolicy" is a phony target defined by the build system. If you use it as dependency of a file target, you'll get unnecessary rebuild. Change-Id: I3a948ebbaff6a146050eb86a3d04cdc050f7c001
2012-10-26 04:01:31 +02:00
built_sepolicy := $(LOCAL_BUILT_MODULE)
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
all_cil_files :=
Add a checkfc utility to check file_contexts validity and invoke it. Change-Id: I4b12dc3dcb432edbdf95dd3bc97f809912ce86d1 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2012-10-02 18:46:37 +02:00
Remove unnecessary recovery-related targets Recovery should always use monolithic policy. Thus, we don't need split policy files *.recovery.cil. This commit removes these targets and rolls up the relevant parts of the targets into "sepolicy.recovery" which is the target which produces monolithic policy for recovery. Test: make clean && make sepolicy.recovery, then confirm that repolicy.recovery is identical to the one produced prior to this change. Test: Clean build, flash, device boots up fine, no new denials. Device also boots into recovery just fine, no denials. Bug: 31363362 Change-Id: I7f698abe1f17308f2f03f5ed1b727a8b071e94c7
2017-03-10 18:36:07 +01:00
#################################
include $(CLEAR_VARS)
# keep concrete sepolicy for neverallow checks
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
# If SELINUX_IGNORE_NEVERALLOWS is set, we use sed to remove the neverallow lines before compiling.
Remove unnecessary recovery-related targets Recovery should always use monolithic policy. Thus, we don't need split policy files *.recovery.cil. This commit removes these targets and rolls up the relevant parts of the targets into "sepolicy.recovery" which is the target which produces monolithic policy for recovery. Test: make clean && make sepolicy.recovery, then confirm that repolicy.recovery is identical to the one produced prior to this change. Test: Clean build, flash, device boots up fine, no new denials. Device also boots into recovery just fine, no denials. Bug: 31363362 Change-Id: I7f698abe1f17308f2f03f5ed1b727a8b071e94c7
2017-03-10 18:36:07 +01:00
LOCAL_MODULE := sepolicy.recovery
Targets for artifacts needed by recovery This ensures that SELinux policy artifact needed by recovery at runtime have targets in this build script. This is to make recoveryimage/bootimage targets depend on these artifacts explicitly, which reduces the element of surprise. Moreover, this enables us to move non-recovery artifacts around without affecting recovery artifacts. Test: Clean build, flash, device boots just fine, no new denials. Reboot to recovery, recovery boots just fine, no denials. This was tested on bullhead (non A/B device) and sailfish (A/B device). Bug: 33642277 Change-Id: I3c494d9d7fec5c4f487d38964e572757fcf67f57
2017-03-10 21:44:16 +01:00
LOCAL_MODULE_STEM := sepolicy
Remove unnecessary recovery-related targets Recovery should always use monolithic policy. Thus, we don't need split policy files *.recovery.cil. This commit removes these targets and rolls up the relevant parts of the targets into "sepolicy.recovery" which is the target which produces monolithic policy for recovery. Test: make clean && make sepolicy.recovery, then confirm that repolicy.recovery is identical to the one produced prior to this change. Test: Clean build, flash, device boots up fine, no new denials. Device also boots into recovery just fine, no denials. Bug: 31363362 Change-Id: I7f698abe1f17308f2f03f5ed1b727a8b071e94c7
2017-03-10 18:36:07 +01:00
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
Targets for artifacts needed by recovery This ensures that SELinux policy artifact needed by recovery at runtime have targets in this build script. This is to make recoveryimage/bootimage targets depend on these artifacts explicitly, which reduces the element of surprise. Moreover, this enables us to move non-recovery artifacts around without affecting recovery artifacts. Test: Clean build, flash, device boots just fine, no new denials. Reboot to recovery, recovery boots just fine, no denials. This was tested on bullhead (non A/B device) and sailfish (A/B device). Bug: 33642277 Change-Id: I3c494d9d7fec5c4f487d38964e572757fcf67f57
2017-03-10 21:44:16 +01:00
LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
Remove unnecessary recovery-related targets Recovery should always use monolithic policy. Thus, we don't need split policy files *.recovery.cil. This commit removes these targets and rolls up the relevant parts of the targets into "sepolicy.recovery" which is the target which produces monolithic policy for recovery. Test: make clean && make sepolicy.recovery, then confirm that repolicy.recovery is identical to the one produced prior to this change. Test: Clean build, flash, device boots up fine, no new denials. Device also boots into recovery just fine, no denials. Bug: 31363362 Change-Id: I7f698abe1f17308f2f03f5ed1b727a8b071e94c7
2017-03-10 18:36:07 +01:00
include $(BUILD_SYSTEM)/base_rules.mk
Change recovery to static platform-only compilation. Recovery is not meant to be versioned in the treble model, but rather provided as part of the platform/framework component and self-sufficient. Simplify its compilation by removing the attribute versioning steps, but maintain device-specific policy, which is currently required for full functionality. Bug: 37240781 Bug: 36783775 Test: recovery boots and is able to select commands. Also tried: reboot system, boot to bootloader, factory reset, sideload, view logs, run graphics test, and power off. Change-Id: I637819844d9a8ea5b315404f4abd03e8f923303a
2017-04-11 16:38:48 +02:00
sepolicy.recovery.conf := $(intermediates)/sepolicy.recovery.conf
$(sepolicy.recovery.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
$(sepolicy.recovery.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Use user policy when checking neverallow rules. When building userdebug or eng builds, we still want to build the user policy when checking neverallow rules so that we can catch compile errors. Commit c0713e86 split out a helper function but lost one instance of using user instead of the real variant. This restores that one and adds it to the neverallow check. Bug: 74344625 Test: Added a rule that referred to a type defined only in userdebug and eng and ensure we throw a compile error when building userdebug mode. Change-Id: I1a6ffbb36dbeeb880852f9cbac880f923370c2ae (cherry picked from commit 053cb34130b763d93e2181062ebe1b5f8bf3ad9c)
2018-03-08 00:36:29 +01:00
$(sepolicy.recovery.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
Change recovery to static platform-only compilation. Recovery is not meant to be versioned in the treble model, but rather provided as part of the platform/framework component and self-sufficient. Simplify its compilation by removing the attribute versioning steps, but maintain device-specific policy, which is currently required for full functionality. Bug: 37240781 Bug: 36783775 Test: recovery boots and is able to select commands. Also tried: reboot system, boot to bootloader, factory reset, sideload, view logs, run graphics test, and power off. Change-Id: I637819844d9a8ea5b315404f4abd03e8f923303a
2017-04-11 16:38:48 +02:00
$(sepolicy.recovery.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
$(sepolicy.recovery.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
$(sepolicy.recovery.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Add sepolicy definitions.mk and create policy.conf function. Bug: 36899958 Test: Builds 'n' boots. Change-Id: I5836a18f9d0a9a976dda7304045e3b9e1e84565e Merged-In: I5836a18f9d0a9a976dda7304045e3b9e1e84565e (cherry picked from commit c0713e86790583dacbd8545d35ae476ff1f849bb)
2017-07-07 23:59:51 +02:00
$(sepolicy.recovery.conf): PRIVATE_TGT_RECOVERY := -D target_recovery=true
Change recovery to static platform-only compilation. Recovery is not meant to be versioned in the treble model, but rather provided as part of the platform/framework component and self-sufficient. Simplify its compilation by removing the attribute versioning steps, but maintain device-specific policy, which is currently required for full functionality. Bug: 37240781 Bug: 36783775 Test: recovery boots and is able to select commands. Also tried: reboot system, boot to bootloader, factory reset, sideload, view logs, run graphics test, and power off. Change-Id: I637819844d9a8ea5b315404f4abd03e8f923303a
2017-04-11 16:38:48 +02:00
$(sepolicy.recovery.conf): $(call build_policy, $(sepolicy_build_files), \
$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) \
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
$(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY) \
Add /odm/etc/selinux/odm_sepolicy.cil This change adds the support of odm sepolicy customization, which can be configured through the newly added build varaible: - BOARD_ODM_SEPOLICY_DIRS += device/${ODM_NAME}/${BOM_NAME}/sepolicy Also moving precompiled sepolicy to /odm when BOARD_ODM_SEPOLICY_DIRS is set. On a DUT, precompiled sepolicy on /odm will override the one in /vendor. This is intentional because /odm is the hardware customization for /vendor and both should be updated together if desired. Bug: 64240127 Test: boot a device with /odm partition Change-Id: Ia8f81a78c88cbfefb3ff19e2ccd2648da6284d09
2017-11-27 04:41:33 +01:00
$(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) \
$(BOARD_ODM_SEPOLICY_DIRS))
Add sepolicy definitions.mk and create policy.conf function. Bug: 36899958 Test: Builds 'n' boots. Change-Id: I5836a18f9d0a9a976dda7304045e3b9e1e84565e Merged-In: I5836a18f9d0a9a976dda7304045e3b9e1e84565e (cherry picked from commit c0713e86790583dacbd8545d35ae476ff1f849bb)
2017-07-07 23:59:51 +02:00
$(transform-policy-to-conf)
Fix building error for multi-line dontaudit statement All the *.conf.dontaudit files are generated from *.conf with the command of 'sed '/dontaudit/d' $@ > $@.dontaudit', but this command can not be applied to multi-line dontaudit statement. Test: Set plat_policy.conf.dontaudit as the input_file parameter of checkpolicy tool, then selinux syntax error will occur during building. Change-Id: I281de923d8a5f0b46256ec7de4df12a1c1d7e061
2018-09-13 08:04:19 +02:00
$(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
ifeq ($(SELINUX_IGNORE_NEVERALLOWS),true)
$(hide) sed -z 's/\n\s*neverallow[^;]*;/\n/g' $@ > $@.neverallow
$(hide) mv $@.neverallow $@
endif
Switch recovery to versioned policy and split into components. And do some clean up: Replace LOCAL_TARGET_ARCH with global arch specifier that won't get clobbered, clean up sepolicy.recovery's eng specification, ensure that build macros are applied across all policy generation, not just plat_policy, and make sure that all private variables are cleared and alphabetized at the end. Bug: 31363362 Bug: 31369363 Test: Boot into recovery and observe no selinux denials. Change-Id: Ibc15b097f6d19acf01f6b22bee0e083b15f4ef75
2016-12-16 00:28:44 +01:00
Change recovery to static platform-only compilation. Recovery is not meant to be versioned in the treble model, but rather provided as part of the platform/framework component and self-sufficient. Simplify its compilation by removing the attribute versioning steps, but maintain device-specific policy, which is currently required for full functionality. Bug: 37240781 Bug: 36783775 Test: recovery boots and is able to select commands. Also tried: reboot system, boot to bootloader, factory reset, sideload, view logs, run graphics test, and power off. Change-Id: I637819844d9a8ea5b315404f4abd03e8f923303a
2017-04-11 16:38:48 +02:00
$(LOCAL_BUILT_MODULE): $(sepolicy.recovery.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
$(HOST_OUT_EXECUTABLES)/sepolicy-analyze
Switch recovery to versioned policy and split into components. And do some clean up: Replace LOCAL_TARGET_ARCH with global arch specifier that won't get clobbered, clean up sepolicy.recovery's eng specification, ensure that build macros are applied across all policy generation, not just plat_policy, and make sure that all private variables are cleared and alphabetized at the end. Bug: 31363362 Bug: 31369363 Test: Boot into recovery and observe no selinux denials. Change-Id: Ibc15b097f6d19acf01f6b22bee0e083b15f4ef75
2016-12-16 00:28:44 +01:00
@mkdir -p $(dir $@)
Sepolicy: Disable leak sanitizer for checkpolicy Temporary workaround. Bug: 37755687 Test: ASAN_OPTIONS= SANITIZE_HOST=address m Change-Id: I001a42ea6463a1e137e1f5328755596f986323de
2017-04-28 02:16:13 +02:00
$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c \
$(POLICYVERS) -o $@.tmp $<
Don't allow permissive SELinux domains on user builds. It's a CTS requirement that all SELinux domains be in enforcing mode. Add the same assertion to the build system when targeting user builds. In particular, this avoids a situation where device integrity checking is enabled on user builds, but permissive denials are being generated, causing the device to unexpectedly reboot into safe mode. A developer wanting to put an SELinux domain into permissive mode for userdebug/eng purposes can write the following in their policy: userdebug_or_eng(` permissive foo; ') Bug: 26902605 Bug: 27313768 Change-Id: Ic0971d9e96a28f2a98f9d56a547661d24fb81a21
2016-02-27 05:06:52 +01:00
$(hide) $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $@.tmp permissive > $@.permissivedomains
$(hide) if [ "$(TARGET_BUILD_VARIANT)" = "user" -a -s $@.permissivedomains ]; then \
echo "==========" 1>&2; \
echo "ERROR: permissive domains not allowed in user builds" 1>&2; \
echo "List of invalid domains:" 1>&2; \
cat $@.permissivedomains 1>&2; \
exit 1; \
fi
$(hide) mv $@.tmp $@
Create a separate recovery policy. Create a separate recovery policy and only include the recovery domain allow rules in it. Change-Id: I444107f9821eabf4164ba07a44d03bd71e719989 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-05-29 22:40:15 +02:00
Change recovery to static platform-only compilation. Recovery is not meant to be versioned in the treble model, but rather provided as part of the platform/framework component and self-sufficient. Simplify its compilation by removing the attribute versioning steps, but maintain device-specific policy, which is currently required for full functionality. Bug: 37240781 Bug: 36783775 Test: recovery boots and is able to select commands. Also tried: reboot system, boot to bootloader, factory reset, sideload, view logs, run graphics test, and power off. Change-Id: I637819844d9a8ea5b315404f4abd03e8f923303a
2017-04-11 16:38:48 +02:00
sepolicy.recovery.conf :=
Create a separate recovery policy. Create a separate recovery policy and only include the recovery domain allow rules in it. Change-Id: I444107f9821eabf4164ba07a44d03bd71e719989 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-05-29 22:40:15 +02:00
Preserve treble-only flag for CTS neverallows CTS includes general_sepolicy.conf built from this project. CTS then tests this file's neverallow rules against the policy of the device under test. Prior to this commit, neverallow rules which must be enforced only for Treble devices we not included into general_sepolicy.conf. As a result, these rules were not enforced for Treble devices. This commit fixes the issue as follows. Because CTS includes only one policy, the policy now contains also the rules which are only for Treble devices. To enable CTS to distinguish rules needed for all devices from rules needed only on Treble devices, the latter rules are contained in sections delimited with BEGIN_TREBLE_ONLY and END_TREBLE_ONLY comments. This commit also removes the unnecessary sepolicy.general target. This target is not used anywhere and is causing trouble because it is verifying neverallows of the policy meant to be used by CTS. This policy can no longer be verified with checkpolicy without conditionally including or excluding Treble-only neverallows. Test: mmm system/sepolicy Test: Device boots -- no new denials Bug: 37082262 Change-Id: I15172a7efd9374543ba521e17aead1bdda7451bf
2017-04-06 23:45:50 +02:00
##################################
# SELinux policy embedded into CTS.
# CTS checks neverallow rules of this policy against the policy of the device under test.
Generate selinux_policy.xml as part of CTS build. Bug: 16563899 Bug: 14251916 Change-Id: Id3172b73f10186ba361caf6b7333e5d2a0648475
2014-07-26 04:11:52 +02:00
##################################
include $(CLEAR_VARS)
LOCAL_MODULE := general_sepolicy.conf
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := tests
include $(BUILD_SYSTEM)/base_rules.mk
$(LOCAL_BUILT_MODULE): PRIVATE_MLS_SENS := $(MLS_SENS)
$(LOCAL_BUILT_MODULE): PRIVATE_MLS_CATS := $(MLS_CATS)
Use user policy when checking neverallow rules. When building userdebug or eng builds, we still want to build the user policy when checking neverallow rules so that we can catch compile errors. Commit c0713e86 split out a helper function but lost one instance of using user instead of the real variant. This restores that one and adds it to the neverallow check. Bug: 74344625 Test: Added a rule that referred to a type defined only in userdebug and eng and ensure we throw a compile error when building userdebug mode. Change-Id: I1a6ffbb36dbeeb880852f9cbac880f923370c2ae (cherry picked from commit 053cb34130b763d93e2181062ebe1b5f8bf3ad9c)
2018-03-08 00:36:29 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_TARGET_BUILD_VARIANT := user
Switch recovery to versioned policy and split into components. And do some clean up: Replace LOCAL_TARGET_ARCH with global arch specifier that won't get clobbered, clean up sepolicy.recovery's eng specification, ensure that build macros are applied across all policy generation, not just plat_policy, and make sure that all private variables are cleared and alphabetized at the end. Bug: 31363362 Bug: 31369363 Test: Boot into recovery and observe no selinux denials. Change-Id: Ibc15b097f6d19acf01f6b22bee0e083b15f4ef75
2016-12-16 00:28:44 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_TGT_ARCH := $(my_target_arch)
Add sepolicy definitions.mk and create policy.conf function. Bug: 36899958 Test: Builds 'n' boots. Change-Id: I5836a18f9d0a9a976dda7304045e3b9e1e84565e Merged-In: I5836a18f9d0a9a976dda7304045e3b9e1e84565e (cherry picked from commit c0713e86790583dacbd8545d35ae476ff1f849bb)
2017-07-07 23:59:51 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_WITH_ASAN := false
Use PRODUCT_SEPOLICY_SPLIT for full Treble. PRODUCT_FULL_TREBLE is being broken up into smaller, more manageable components. Bug: 62019611 Test: manual Change-Id: I9b65f120851d9ea134a0059a417f0282777717fc
2017-11-09 20:24:56 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY_SPLIT := cts
Add tests for compatible property (1/2) The feature of compatible property has its own neverallow rules and it is enforced on devices launchig with Android P. This CL changes hal_nfc to hal_nfc_server in neverallow rules because sepolicy-analyze doesn't recognize it. Additionally one more neverallow rule is added to restrict reading nfc_prop. Bug: 72013705 Bug: 72678352 Test: 'run cts -m CtsSecurityHostTestCases' on walleye with ro.product.first_api_level=28 Change-Id: I753cc81f7ca0e4ad6a2434b2a047052678f57671
2018-01-30 09:23:58 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_COMPATIBLE_PROPERTY := cts
Mechanism to exclude neverallows from *TS. build_test_only is used to denote rules that should not verified as part of compliance testing. Use this macro to exclude neverallow rules which we want to check as part of build, but not CTS. Bug: 80499271 Test: SELinuxNeverallowRulesTest on walleye has no more failure of type "Type or attribute * used in neverallow undefined in policy being checked." Number of failing test cases is reduced by 142. Test: policy.conf used to check neverallows at build-time still retains all neverallow rules. Change-Id: I5f1b383d9096bb5a7b8c0f1bc008b5dd07419580
2018-06-05 23:11:08 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_EXCLUDE_BUILD_TEST := true
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
$(LOCAL_BUILT_MODULE): $(call build_policy, $(sepolicy_build_files), \
$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY))
Add sepolicy definitions.mk and create policy.conf function. Bug: 36899958 Test: Builds 'n' boots. Change-Id: I5836a18f9d0a9a976dda7304045e3b9e1e84565e Merged-In: I5836a18f9d0a9a976dda7304045e3b9e1e84565e (cherry picked from commit c0713e86790583dacbd8545d35ae476ff1f849bb)
2017-07-07 23:59:51 +02:00
$(transform-policy-to-conf)
Fix building error for multi-line dontaudit statement All the *.conf.dontaudit files are generated from *.conf with the command of 'sed '/dontaudit/d' $@ > $@.dontaudit', but this command can not be applied to multi-line dontaudit statement. Test: Set plat_policy.conf.dontaudit as the input_file parameter of checkpolicy tool, then selinux syntax error will occur during building. Change-Id: I281de923d8a5f0b46256ec7de4df12a1c1d7e061
2018-09-13 08:04:19 +02:00
$(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
Generate selinux_policy.xml as part of CTS build. Bug: 16563899 Bug: 14251916 Change-Id: Id3172b73f10186ba361caf6b7333e5d2a0648475
2014-07-26 04:11:52 +02:00
use a general sepolicy when building general targets Change-Id: Ie800ebf9d8e68680ec377e8c51f7cd7717f3c755 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-30 01:31:23 +02:00
##################################
Split file_contexts for on-device compilation. Simulate platform and non-platform split by compiling two different file_contexts files and loading them together on-device. Leave the existing file_contexts.bin in place until we're ready to build images based on the new files. Bug: 31363362 Test: Builds and boots without additional denials. Change-Id: I7248f876e2230cee3b3cbf386422063da1e3dde0 Bring back file_contexts.bin. Change-Id: Ifec2c363579151080fdec48e8bc46bbbc8c97674 Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-12-12 18:29:04 +01:00
# TODO - remove this. Keep around until we get the filesystem creation stuff taken care of.
#
use a general sepolicy when building general targets Change-Id: Ie800ebf9d8e68680ec377e8c51f7cd7717f3c755 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-30 01:31:23 +02:00
include $(CLEAR_VARS)
Update Android.mk to support file_contexts.bin This change supports external/libselinux changes to implement PCRE formatted binary file_contexts and general_file_contexts.bin files. The $(intermediates) directory will contain the original text file (that is no longer used on the device) with a .tmp extension as well as the .bin file to aid analysis. A CleanSpec.mk file is added to remove the old file_contexts file. Change-Id: I75a781100082c23536f70ce3603f7de42408b5ba Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-08-06 18:43:52 +02:00
LOCAL_MODULE := file_contexts.bin
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Add support for per-device .te and .fc files.
2012-03-06 17:12:41 +01:00
include $(BUILD_SYSTEM)/base_rules.mk
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: I3775eae11bfa5905cad0d02a0bf26c76ac03437c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
# The file_contexts.bin is built in the following way:
# 1. Collect all file_contexts files in THIS repository and process them with
# m4 into a tmp file called file_contexts.local.tmp.
# 2. Collect all device specific file_contexts files and process them with m4
# into a tmp file called file_contexts.device.tmp.
# 3. Run checkfc -e (allow no device fc entries ie empty) and fc_sort on
# file_contexts.device.tmp and output to file_contexts.device.sorted.tmp.
# 4. Concatenate file_contexts.local.tmp and file_contexts.device.tmp into
# file_contexts.concat.tmp.
# 5. Run checkfc and sefcontext_compile on file_contexts.concat.tmp to produce
# file_contexts.bin.
#
# Note: That a newline file is placed between each file_context file found to
# ensure a proper build when an fc file is missing an ending newline.
Add BOARD_PLAT_[PUBLIC|PRIVATE]_SEPOLICY_DIRS Add new build variables for partner customization (additions) to platform sepolicy. This allows partners to add their own policy without having to touch the AOSP sepolicy directories and potentially disrupting compatibility with an AOSP system image. Bug: 36467375 Test: Add public and private files to sailfish policy and verify that they are added to the appropriate policy files, but that the policy is otherwise identical. Also add private/mapping/*.cil files in both locations and change the BOARD_SEPOLICY_VERS to trigger use of prebuilt mapping files and verify that they are appropriately combined and built in policy. Change-Id: I38efe2248520804a123603bb050bba75563fe45c Merged-In: I38efe2248520804a123603bb050bba75563fe45c (cherry picked from commit f893700c73f2e4e13385f11edcacf563f59b63c5)
2017-05-08 23:26:52 +02:00
local_fc_files := $(call build_policy, file_contexts, $(PLAT_PRIVATE_POLICY))
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
ifdef HAS_PRODUCT_SEPOLICY
local_fc_files += $(call build_policy, file_contexts, $(PRODUCT_PRIVATE_POLICY))
endif
asan: update condition to work with multiple SANITIZE_TARGET values. The goal is to enable SANITIZE_TARGET='address coverage', which will be used by LLVMFuzzer. Bug: 22850550 Change-Id: I953649186a7fae9b2495159237521f264d1de3b6
2015-09-18 21:05:51 +02:00
ifneq ($(filter address,$(SANITIZE_TARGET)),)
fs_mgr: add overlayfs handling for squashfs system filesystems /cache/overlay directory in support of overlayfs mounts on userdebug and eng devices. Overlayfs in turn can be capable of supporting adb remount for read-only or restricted-storage filesystems like squashfs or right-sized (zero free space) system partitions respectively. Test: compile Bug: 109821005 Bug: 110985612 Change-Id: I3ece03886db7cc97f864497cf93ec6c6c39bccd1
2018-06-13 17:02:29 +02:00
local_fc_files += $(wildcard $(addsuffix /file_contexts_asan, $(PLAT_PRIVATE_POLICY)))
endif
ifneq (,$(filter userdebug eng,$(TARGET_BUILD_VARIANT)))
local_fc_files += $(wildcard $(addsuffix /file_contexts_overlayfs, $(PLAT_PRIVATE_POLICY)))
Extend sepolicy for SANITIZE_TARGET. SANITIZE_TARGET adds shared libraries in /data/lib. Bug: 21785137 Change-Id: I8ac3d059d88d57d24ed762ffc6202a4ce5a42333
2015-06-13 02:18:20 +02:00
endif
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: I3775eae11bfa5905cad0d02a0bf26c76ac03437c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
local_fcfiles_with_nl := $(call add_nl, $(local_fc_files), $(built_nl))
file_contexts.local.tmp := $(intermediates)/file_contexts.local.tmp
$(file_contexts.local.tmp): $(local_fcfiles_with_nl)
@mkdir -p $(dir $@)
m4: add --fatal-warnings Error out if m4 generates a warning. This will help detect and prevent malformed macros. See 855084960feb9e593a3bca288ab328a34a99ac57 for motivation. Test: policy compiles Test: Policy doesn't compile if 855084960feb9e593a3bca288ab328a34a99ac57 is reverted. Change-Id: Iee6b6273bc2a24b1220861fd662573e76001defc
2018-08-15 18:55:27 +02:00
$(hide) m4 --fatal-warnings -s $^ > $@
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: I3775eae11bfa5905cad0d02a0bf26c76ac03437c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
device_fc_files := $(call build_vendor_policy, file_contexts)
Add /odm/etc/selinux/odm_file_contexts Bug: 64240127 Test: normal boot and recovery boot a device Change-Id: I087292fb23d05fc17272778d668ac78a721b2593
2017-11-29 09:14:53 +01:00
ifdef BOARD_ODM_SEPOLICY_DIRS
device_fc_files += $(call build_odm_policy, file_contexts)
endif
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: I3775eae11bfa5905cad0d02a0bf26c76ac03437c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
device_fcfiles_with_nl := $(call add_nl, $(device_fc_files), $(built_nl))
file_contexts.device.tmp := $(intermediates)/file_contexts.device.tmp
$(file_contexts.device.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(file_contexts.device.tmp): $(device_fcfiles_with_nl)
@mkdir -p $(dir $@)
m4: add --fatal-warnings Error out if m4 generates a warning. This will help detect and prevent malformed macros. See 855084960feb9e593a3bca288ab328a34a99ac57 for motivation. Test: policy compiles Test: Policy doesn't compile if 855084960feb9e593a3bca288ab328a34a99ac57 is reverted. Change-Id: Iee6b6273bc2a24b1220861fd662573e76001defc
2018-08-15 18:55:27 +02:00
$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: I3775eae11bfa5905cad0d02a0bf26c76ac03437c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
file_contexts.device.sorted.tmp := $(intermediates)/file_contexts.device.sorted.tmp
$(file_contexts.device.sorted.tmp): PRIVATE_SEPOLICY := $(built_sepolicy)
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
$(file_contexts.device.sorted.tmp): $(file_contexts.device.tmp) $(built_sepolicy) \
$(HOST_OUT_EXECUTABLES)/fc_sort $(HOST_OUT_EXECUTABLES)/checkfc
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: I3775eae11bfa5905cad0d02a0bf26c76ac03437c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
@mkdir -p $(dir $@)
Restore checkfc and neverallow checks. Bug: 33388095 Test: Builds and boots. Change-Id: Ief9064a16fc733bed54eb76f509ff5aaf5db4baf
2016-12-07 20:27:47 +01:00
$(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e $(PRIVATE_SEPOLICY) $<
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: I3775eae11bfa5905cad0d02a0bf26c76ac03437c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
$(hide) $(HOST_OUT_EXECUTABLES)/fc_sort $< $@
Add a checkfc utility to check file_contexts validity and invoke it. Change-Id: I4b12dc3dcb432edbdf95dd3bc97f809912ce86d1 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2012-10-02 18:46:37 +02:00
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: I3775eae11bfa5905cad0d02a0bf26c76ac03437c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
file_contexts.concat.tmp := $(intermediates)/file_contexts.concat.tmp
$(file_contexts.concat.tmp): $(file_contexts.local.tmp) $(file_contexts.device.sorted.tmp)
Add support for per-device .te and .fc files.
2012-03-06 17:12:41 +01:00
@mkdir -p $(dir $@)
m4: add --fatal-warnings Error out if m4 generates a warning. This will help detect and prevent malformed macros. See 855084960feb9e593a3bca288ab328a34a99ac57 for motivation. Test: policy compiles Test: Policy doesn't compile if 855084960feb9e593a3bca288ab328a34a99ac57 is reverted. Change-Id: Iee6b6273bc2a24b1220861fd662573e76001defc
2018-08-15 18:55:27 +02:00
$(hide) m4 --fatal-warnings -s $^ > $@
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
file_contexts: don't delete intermediate on failure Currently, if an error is detected in a file_contexts file, the intermediate file_context.tmp file is removed, thus making debugging of build issues problematic. Instead, employ checkfc tool during the compilation recipe so the m4 concatenated intermediate is preserved on failure. Change-Id: Ic827385d3bc3434b6c2a9bba5313cd42b5f15599 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-25 19:18:44 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: I3775eae11bfa5905cad0d02a0bf26c76ac03437c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
$(LOCAL_BUILT_MODULE): $(file_contexts.concat.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/sefcontext_compile $(HOST_OUT_EXECUTABLES)/checkfc
Update Android.mk to support file_contexts.bin This change supports external/libselinux changes to implement PCRE formatted binary file_contexts and general_file_contexts.bin files. The $(intermediates) directory will contain the original text file (that is no longer used on the device) with a .tmp extension as well as the .bin file to aid analysis. A CleanSpec.mk file is added to remove the old file_contexts file. Change-Id: I75a781100082c23536f70ce3603f7de42408b5ba Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-08-06 18:43:52 +02:00
@mkdir -p $(dir $@)
Restore checkfc and neverallow checks. Bug: 33388095 Test: Builds and boots. Change-Id: Ief9064a16fc733bed54eb76f509ff5aaf5db4baf
2016-12-07 20:27:47 +01:00
$(hide) $(HOST_OUT_EXECUTABLES)/checkfc $(PRIVATE_SEPOLICY) $<
Update Android.mk to support file_contexts.bin This change supports external/libselinux changes to implement PCRE formatted binary file_contexts and general_file_contexts.bin files. The $(intermediates) directory will contain the original text file (that is no longer used on the device) with a .tmp extension as well as the .bin file to aid analysis. A CleanSpec.mk file is added to remove the old file_contexts file. Change-Id: I75a781100082c23536f70ce3603f7de42408b5ba Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-08-06 18:43:52 +02:00
$(hide) $(HOST_OUT_EXECUTABLES)/sefcontext_compile -o $@ $<
Build the selinux_version file. The selinux_version file is used to perform policy versioning checks by libselinux and SELinuxMMAC. When loading policy a check is first performed to determine if the policy out in /data/security/current should be used to override the base policy shipped with the device. The selinux_version file is used to make that choice. The contents of the file simply contains the BUILD_FINGERPRINT that the policy was built against. A simple string comparison is then performed by libselinux and SELinuxMMAC. Change-Id: I69d9d071743cfd46bb247c98f94a193396f8ebbd Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-03-20 14:35:08 +01:00
built_fc := $(LOCAL_BUILT_MODULE)
fc_sort: initial commit Ordering matters in fc files; the last match wins. In builds where many BOARD_SEPOLICY_DIRS are set, the order of that list becomes increasingly important in order to maintain a cohesive built file_contexts. To correct this, we sort the device specific file_contexts entries with the upstream fc_sort tool. Change-Id: I3775eae11bfa5905cad0d02a0bf26c76ac03437c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-01-04 21:20:57 +01:00
local_fc_files :=
local_fcfiles_with_nl :=
device_fc_files :=
device_fcfiles_with_nl :=
file_contexts.concat.tmp :=
file_contexts.device.sorted.tmp :=
file_contexts.device.tmp :=
file_contexts.local.tmp :=
per device seapp_context support
2012-08-16 19:55:05 +02:00
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
##################################
ifneq ($(TARGET_BUILD_VARIANT), user)
include $(CLEAR_VARS)
LOCAL_MODULE := selinux_denial_metadata
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
include $(BUILD_SYSTEM)/base_rules.mk
bug_files := $(call build_policy, bug_map, $(LOCAL_PATH) $(PLAT_PRIVATE_POLICY) $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(PLAT_PUBLIC_POLICY))
$(LOCAL_BUILT_MODULE) : $(bug_files)
@mkdir -p $(dir $@)
cat $^ > $@
bug_files :=
endif
Generate general versions of the other contexts files for tests. Generate general forms of the remaining *_contexts files with only the device-independent entries for use in CTS testing. Change-Id: I2bf0e41db8a73c26754cedd92cbc3783ff03d6b5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 22:45:03 +01:00
##################################
include $(CLEAR_VARS)
Split file_contexts for on-device compilation. Simulate platform and non-platform split by compiling two different file_contexts files and loading them together on-device. Leave the existing file_contexts.bin in place until we're ready to build images based on the new files. Bug: 31363362 Test: Builds and boots without additional denials. Change-Id: I7248f876e2230cee3b3cbf386422063da1e3dde0 Bring back file_contexts.bin. Change-Id: Ifec2c363579151080fdec48e8bc46bbbc8c97674 Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-12-12 18:29:04 +01:00
LOCAL_MODULE := plat_file_contexts
Generate general versions of the other contexts files for tests. Generate general forms of the remaining *_contexts files with only the device-independent entries for use in CTS testing. Change-Id: I2bf0e41db8a73c26754cedd92cbc3783ff03d6b5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 22:45:03 +01:00
LOCAL_MODULE_CLASS := ETC
Split file_contexts for on-device compilation. Simulate platform and non-platform split by compiling two different file_contexts files and loading them together on-device. Leave the existing file_contexts.bin in place until we're ready to build images based on the new files. Bug: 31363362 Test: Builds and boots without additional denials. Change-Id: I7248f876e2230cee3b3cbf386422063da1e3dde0 Bring back file_contexts.bin. Change-Id: Ifec2c363579151080fdec48e8bc46bbbc8c97674 Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-12-12 18:29:04 +01:00
LOCAL_MODULE_TAGS := optional
Use PRODUCT_SEPOLICY_SPLIT for full Treble. PRODUCT_FULL_TREBLE is being broken up into smaller, more manageable components. Bug: 62019611 Test: manual Change-Id: I9b65f120851d9ea134a0059a417f0282777717fc
2017-11-09 20:24:56 +01:00
ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Move split file_contexts to /system and /vendor Build file_contexts.bin on legacy builds. Test: Marlin and Bullhead build and boot with no new denials. Test: Marlin and Bullhead recovery boots with no new denials. Test: Bullhead boots with file_contexts.bin in / Test: Marlin boot with /system/etc/selinux/plat_file_contexts and /vendor/etc/selinux/nonplat_file_contexts. Bug: 36002414 Change-Id: Ide8498b3c86234d2f93bb22a7514d132c33067d6
2017-03-08 23:12:54 +01:00
LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
Move non-treble devices to split file_contexts This change is primarily to fix CTS which checks file ordering of file_contexts. Having two separate means of loading file_contexts has resulted in ordering variations. Previously the binary file_contexts was preferred since it loaded faster. However with the move to libpcre2, there is no difference in loading time between text and binary file_contexts. This leaves us with build system complexity with no benefit. Thus removing this unnecessary difference between devices. Bug: 38502071 Test: build and boot non-Treble Bullhead, run CTS tests below Test: build and boot Treble Marlin, run CTS tests below Test: cts-tradefed run singleCommand cts --skip-device-info \ --skip-preconditions --skip-connectivity-check --abi arm64-v8a \ --module CtsSecurityHostTestCases \ -t android.security.cts.SELinuxHostTest#testAospFileContexts Test: cts-tradefed run singleCommand cts --skip-device-info \ --skip-preconditions --skip-connectivity-check --abi arm64-v8a \ --module CtsSecurityHostTestCases \ -t android.security.cts.SELinuxHostTest#testValidFileContexts Change-Id: I088b3aeafaaab320f6658feb058a1fb89cbb65e1
2017-06-08 22:24:15 +02:00
else
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
endif
Generate general versions of the other contexts files for tests. Generate general forms of the remaining *_contexts files with only the device-independent entries for use in CTS testing. Change-Id: I2bf0e41db8a73c26754cedd92cbc3783ff03d6b5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 22:45:03 +01:00
include $(BUILD_SYSTEM)/base_rules.mk
Separate product_hwservice_contexts out of system sepolicy. Bug: 119305624 Test: normal/recovery boot aosp_taimen Change-Id: I1009745686acd51563378dac56e857be0d60e794
2018-12-21 01:13:10 +01:00
local_fc_files := $(call build_policy, file_contexts, $(PLAT_PRIVATE_POLICY))
Split file_contexts for on-device compilation. Simulate platform and non-platform split by compiling two different file_contexts files and loading them together on-device. Leave the existing file_contexts.bin in place until we're ready to build images based on the new files. Bug: 31363362 Test: Builds and boots without additional denials. Change-Id: I7248f876e2230cee3b3cbf386422063da1e3dde0 Bring back file_contexts.bin. Change-Id: Ifec2c363579151080fdec48e8bc46bbbc8c97674 Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-12-12 18:29:04 +01:00
ifneq ($(filter address,$(SANITIZE_TARGET)),)
Add BOARD_PLAT_[PUBLIC|PRIVATE]_SEPOLICY_DIRS Add new build variables for partner customization (additions) to platform sepolicy. This allows partners to add their own policy without having to touch the AOSP sepolicy directories and potentially disrupting compatibility with an AOSP system image. Bug: 36467375 Test: Add public and private files to sailfish policy and verify that they are added to the appropriate policy files, but that the policy is otherwise identical. Also add private/mapping/*.cil files in both locations and change the BOARD_SEPOLICY_VERS to trigger use of prebuilt mapping files and verify that they are appropriately combined and built in policy. Change-Id: I38efe2248520804a123603bb050bba75563fe45c Merged-In: I38efe2248520804a123603bb050bba75563fe45c (cherry picked from commit f893700c73f2e4e13385f11edcacf563f59b63c5)
2017-05-08 23:26:52 +02:00
local_fc_files += $(wildcard $(addsuffix /file_contexts_asan, $(PLAT_PRIVATE_POLICY)))
Split file_contexts for on-device compilation. Simulate platform and non-platform split by compiling two different file_contexts files and loading them together on-device. Leave the existing file_contexts.bin in place until we're ready to build images based on the new files. Bug: 31363362 Test: Builds and boots without additional denials. Change-Id: I7248f876e2230cee3b3cbf386422063da1e3dde0 Bring back file_contexts.bin. Change-Id: Ifec2c363579151080fdec48e8bc46bbbc8c97674 Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-12-12 18:29:04 +01:00
endif
fs_mgr: add overlayfs handling for squashfs system filesystems /cache/overlay directory in support of overlayfs mounts on userdebug and eng devices. Overlayfs in turn can be capable of supporting adb remount for read-only or restricted-storage filesystems like squashfs or right-sized (zero free space) system partitions respectively. Test: compile Bug: 109821005 Bug: 110985612 Change-Id: I3ece03886db7cc97f864497cf93ec6c6c39bccd1
2018-06-13 17:02:29 +02:00
ifneq (,$(filter userdebug eng,$(TARGET_BUILD_VARIANT)))
local_fc_files += $(wildcard $(addsuffix /file_contexts_overlayfs, $(PLAT_PRIVATE_POLICY)))
endif
Fix bugs in *_file_contexts targets This fixes the following issues introduced in commit d225b6979db89959c272b4351fb05363a7a18ea7: * plat_file_contexts was empty because the target was referencing system/sepolicy/private/file_contexts via a misspelled variable name. * plat_file_contexts wasn't marked as dirty and thus wasn't rebuilt when system/sepolicy/private/file_contexts changed. This is because the file_contexts dependency was referenced via a misspelled variable name. * plat_file_contexts wasn't sorted (as opposed to other similar targets, such as nonplat_file_contexts and file_contexts.bin). This may lead to unnecessary non-determinism. * nonplat_file_contexts wasn't marked dirty and thus wasn't rebuilt when device-specific file_contexts file(s) changed. This is because the file_contexts files were referenced via a misspelled variable name. Test: "make plat_file_contexts" produces a non-empty file containing mappings from system/sepolicy/private/file_contexts Test: "make plat_file_contexts" updates output when system/sepolicy/private/file_contexts changes Test: "make plat_file_contexts" produces output which is sorted accroding to rules in fc_sort Test: "make nonplat_file_contexts" updates output when device/lge/bullhead/sepolicy/file_contexts changes (tested on aosp_bullhead-eng) Bug: 31363362 Change-Id: I540555651103f02c96cf958bb93618f600e47a75
2017-01-20 04:58:34 +01:00
local_fcfiles_with_nl := $(call add_nl, $(local_fc_files), $(built_nl))
Split file_contexts for on-device compilation. Simulate platform and non-platform split by compiling two different file_contexts files and loading them together on-device. Leave the existing file_contexts.bin in place until we're ready to build images based on the new files. Bug: 31363362 Test: Builds and boots without additional denials. Change-Id: I7248f876e2230cee3b3cbf386422063da1e3dde0 Bring back file_contexts.bin. Change-Id: Ifec2c363579151080fdec48e8bc46bbbc8c97674 Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-12-12 18:29:04 +01:00
Fix bugs in *_file_contexts targets This fixes the following issues introduced in commit d225b6979db89959c272b4351fb05363a7a18ea7: * plat_file_contexts was empty because the target was referencing system/sepolicy/private/file_contexts via a misspelled variable name. * plat_file_contexts wasn't marked as dirty and thus wasn't rebuilt when system/sepolicy/private/file_contexts changed. This is because the file_contexts dependency was referenced via a misspelled variable name. * plat_file_contexts wasn't sorted (as opposed to other similar targets, such as nonplat_file_contexts and file_contexts.bin). This may lead to unnecessary non-determinism. * nonplat_file_contexts wasn't marked dirty and thus wasn't rebuilt when device-specific file_contexts file(s) changed. This is because the file_contexts files were referenced via a misspelled variable name. Test: "make plat_file_contexts" produces a non-empty file containing mappings from system/sepolicy/private/file_contexts Test: "make plat_file_contexts" updates output when system/sepolicy/private/file_contexts changes Test: "make plat_file_contexts" produces output which is sorted accroding to rules in fc_sort Test: "make nonplat_file_contexts" updates output when device/lge/bullhead/sepolicy/file_contexts changes (tested on aosp_bullhead-eng) Bug: 31363362 Change-Id: I540555651103f02c96cf958bb93618f600e47a75
2017-01-20 04:58:34 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_FC_FILES := $(local_fcfiles_with_nl)
Split file_contexts for on-device compilation. Simulate platform and non-platform split by compiling two different file_contexts files and loading them together on-device. Leave the existing file_contexts.bin in place until we're ready to build images based on the new files. Bug: 31363362 Test: Builds and boots without additional denials. Change-Id: I7248f876e2230cee3b3cbf386422063da1e3dde0 Bring back file_contexts.bin. Change-Id: Ifec2c363579151080fdec48e8bc46bbbc8c97674 Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-12-12 18:29:04 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Fix bugs in *_file_contexts targets This fixes the following issues introduced in commit d225b6979db89959c272b4351fb05363a7a18ea7: * plat_file_contexts was empty because the target was referencing system/sepolicy/private/file_contexts via a misspelled variable name. * plat_file_contexts wasn't marked as dirty and thus wasn't rebuilt when system/sepolicy/private/file_contexts changed. This is because the file_contexts dependency was referenced via a misspelled variable name. * plat_file_contexts wasn't sorted (as opposed to other similar targets, such as nonplat_file_contexts and file_contexts.bin). This may lead to unnecessary non-determinism. * nonplat_file_contexts wasn't marked dirty and thus wasn't rebuilt when device-specific file_contexts file(s) changed. This is because the file_contexts files were referenced via a misspelled variable name. Test: "make plat_file_contexts" produces a non-empty file containing mappings from system/sepolicy/private/file_contexts Test: "make plat_file_contexts" updates output when system/sepolicy/private/file_contexts changes Test: "make plat_file_contexts" produces output which is sorted accroding to rules in fc_sort Test: "make nonplat_file_contexts" updates output when device/lge/bullhead/sepolicy/file_contexts changes (tested on aosp_bullhead-eng) Bug: 31363362 Change-Id: I540555651103f02c96cf958bb93618f600e47a75
2017-01-20 04:58:34 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_FC_SORT := $(HOST_OUT_EXECUTABLES)/fc_sort
$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/checkfc $(HOST_OUT_EXECUTABLES)/fc_sort \
$(local_fcfiles_with_nl) $(built_sepolicy)
Generate general versions of the other contexts files for tests. Generate general forms of the remaining *_contexts files with only the device-independent entries for use in CTS testing. Change-Id: I2bf0e41db8a73c26754cedd92cbc3783ff03d6b5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 22:45:03 +01:00
@mkdir -p $(dir $@)
m4: add --fatal-warnings Error out if m4 generates a warning. This will help detect and prevent malformed macros. See 855084960feb9e593a3bca288ab328a34a99ac57 for motivation. Test: policy compiles Test: Policy doesn't compile if 855084960feb9e593a3bca288ab328a34a99ac57 is reverted. Change-Id: Iee6b6273bc2a24b1220861fd662573e76001defc
2018-08-15 18:55:27 +02:00
$(hide) m4 --fatal-warnings -s $(PRIVATE_FC_FILES) > $@.tmp
Fix bugs in *_file_contexts targets This fixes the following issues introduced in commit d225b6979db89959c272b4351fb05363a7a18ea7: * plat_file_contexts was empty because the target was referencing system/sepolicy/private/file_contexts via a misspelled variable name. * plat_file_contexts wasn't marked as dirty and thus wasn't rebuilt when system/sepolicy/private/file_contexts changed. This is because the file_contexts dependency was referenced via a misspelled variable name. * plat_file_contexts wasn't sorted (as opposed to other similar targets, such as nonplat_file_contexts and file_contexts.bin). This may lead to unnecessary non-determinism. * nonplat_file_contexts wasn't marked dirty and thus wasn't rebuilt when device-specific file_contexts file(s) changed. This is because the file_contexts files were referenced via a misspelled variable name. Test: "make plat_file_contexts" produces a non-empty file containing mappings from system/sepolicy/private/file_contexts Test: "make plat_file_contexts" updates output when system/sepolicy/private/file_contexts changes Test: "make plat_file_contexts" produces output which is sorted accroding to rules in fc_sort Test: "make nonplat_file_contexts" updates output when device/lge/bullhead/sepolicy/file_contexts changes (tested on aosp_bullhead-eng) Bug: 31363362 Change-Id: I540555651103f02c96cf958bb93618f600e47a75
2017-01-20 04:58:34 +01:00
$(hide) $< $(PRIVATE_SEPOLICY) $@.tmp
$(hide) $(PRIVATE_FC_SORT) $@.tmp $@
Generate general versions of the other contexts files for tests. Generate general forms of the remaining *_contexts files with only the device-independent entries for use in CTS testing. Change-Id: I2bf0e41db8a73c26754cedd92cbc3783ff03d6b5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 22:45:03 +01:00
Split file_contexts for on-device compilation. Simulate platform and non-platform split by compiling two different file_contexts files and loading them together on-device. Leave the existing file_contexts.bin in place until we're ready to build images based on the new files. Bug: 31363362 Test: Builds and boots without additional denials. Change-Id: I7248f876e2230cee3b3cbf386422063da1e3dde0 Bring back file_contexts.bin. Change-Id: Ifec2c363579151080fdec48e8bc46bbbc8c97674 Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-12-12 18:29:04 +01:00
built_plat_fc := $(LOCAL_BUILT_MODULE)
local_fc_files :=
Fix bugs in *_file_contexts targets This fixes the following issues introduced in commit d225b6979db89959c272b4351fb05363a7a18ea7: * plat_file_contexts was empty because the target was referencing system/sepolicy/private/file_contexts via a misspelled variable name. * plat_file_contexts wasn't marked as dirty and thus wasn't rebuilt when system/sepolicy/private/file_contexts changed. This is because the file_contexts dependency was referenced via a misspelled variable name. * plat_file_contexts wasn't sorted (as opposed to other similar targets, such as nonplat_file_contexts and file_contexts.bin). This may lead to unnecessary non-determinism. * nonplat_file_contexts wasn't marked dirty and thus wasn't rebuilt when device-specific file_contexts file(s) changed. This is because the file_contexts files were referenced via a misspelled variable name. Test: "make plat_file_contexts" produces a non-empty file containing mappings from system/sepolicy/private/file_contexts Test: "make plat_file_contexts" updates output when system/sepolicy/private/file_contexts changes Test: "make plat_file_contexts" produces output which is sorted accroding to rules in fc_sort Test: "make nonplat_file_contexts" updates output when device/lge/bullhead/sepolicy/file_contexts changes (tested on aosp_bullhead-eng) Bug: 31363362 Change-Id: I540555651103f02c96cf958bb93618f600e47a75
2017-01-20 04:58:34 +01:00
local_fcfiles_with_nl :=
Split file_contexts for on-device compilation. Simulate platform and non-platform split by compiling two different file_contexts files and loading them together on-device. Leave the existing file_contexts.bin in place until we're ready to build images based on the new files. Bug: 31363362 Test: Builds and boots without additional denials. Change-Id: I7248f876e2230cee3b3cbf386422063da1e3dde0 Bring back file_contexts.bin. Change-Id: Ifec2c363579151080fdec48e8bc46bbbc8c97674 Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-12-12 18:29:04 +01:00
##################################
include $(CLEAR_VARS)
Separate product_file_contexts out of system sepolicy. Bug: 119305624 Test: boot blueline Change-Id: I3ecdeab3bb33c3cb5e80dc10ba1079c9853048f8
2018-12-19 04:51:19 +01:00
LOCAL_MODULE := product_file_contexts
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_OUT_PRODUCT)/etc/selinux
include $(BUILD_SYSTEM)/base_rules.mk
product_fc_files := $(call build_policy, file_contexts, $(PRODUCT_PRIVATE_POLICY))
product_fcfiles_with_nl := $(call add_nl, $(product_fc_files), $(built_nl))
$(LOCAL_BUILT_MODULE): PRIVATE_FC_FILES := $(product_fcfiles_with_nl)
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
$(LOCAL_BUILT_MODULE): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(LOCAL_BUILT_MODULE): PRIVATE_FC_SORT := $(HOST_OUT_EXECUTABLES)/fc_sort
$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/checkfc $(HOST_OUT_EXECUTABLES)/fc_sort \
$(product_fcfiles_with_nl) $(built_sepolicy)
@mkdir -p $(dir $@)
$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_FC_FILES) > $@.tmp
$(hide) $< $(PRIVATE_SEPOLICY) $@.tmp
$(hide) $(PRIVATE_FC_SORT) $@.tmp $@
built_product_fc := $(LOCAL_BUILT_MODULE)
product_fc_files :=
product_fcfiles_with_nl :=
##################################
include $(CLEAR_VARS)
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
LOCAL_MODULE := vendor_file_contexts
Split file_contexts for on-device compilation. Simulate platform and non-platform split by compiling two different file_contexts files and loading them together on-device. Leave the existing file_contexts.bin in place until we're ready to build images based on the new files. Bug: 31363362 Test: Builds and boots without additional denials. Change-Id: I7248f876e2230cee3b3cbf386422063da1e3dde0 Bring back file_contexts.bin. Change-Id: Ifec2c363579151080fdec48e8bc46bbbc8c97674 Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-12-12 18:29:04 +01:00
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
Use PRODUCT_SEPOLICY_SPLIT for full Treble. PRODUCT_FULL_TREBLE is being broken up into smaller, more manageable components. Bug: 62019611 Test: manual Change-Id: I9b65f120851d9ea134a0059a417f0282777717fc
2017-11-09 20:24:56 +01:00
ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Move split file_contexts to /system and /vendor Build file_contexts.bin on legacy builds. Test: Marlin and Bullhead build and boot with no new denials. Test: Marlin and Bullhead recovery boots with no new denials. Test: Bullhead boots with file_contexts.bin in / Test: Marlin boot with /system/etc/selinux/plat_file_contexts and /vendor/etc/selinux/nonplat_file_contexts. Bug: 36002414 Change-Id: Ide8498b3c86234d2f93bb22a7514d132c33067d6
2017-03-08 23:12:54 +01:00
LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
Move non-treble devices to split file_contexts This change is primarily to fix CTS which checks file ordering of file_contexts. Having two separate means of loading file_contexts has resulted in ordering variations. Previously the binary file_contexts was preferred since it loaded faster. However with the move to libpcre2, there is no difference in loading time between text and binary file_contexts. This leaves us with build system complexity with no benefit. Thus removing this unnecessary difference between devices. Bug: 38502071 Test: build and boot non-Treble Bullhead, run CTS tests below Test: build and boot Treble Marlin, run CTS tests below Test: cts-tradefed run singleCommand cts --skip-device-info \ --skip-preconditions --skip-connectivity-check --abi arm64-v8a \ --module CtsSecurityHostTestCases \ -t android.security.cts.SELinuxHostTest#testAospFileContexts Test: cts-tradefed run singleCommand cts --skip-device-info \ --skip-preconditions --skip-connectivity-check --abi arm64-v8a \ --module CtsSecurityHostTestCases \ -t android.security.cts.SELinuxHostTest#testValidFileContexts Change-Id: I088b3aeafaaab320f6658feb058a1fb89cbb65e1
2017-06-08 22:24:15 +02:00
else
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
endif
Split file_contexts for on-device compilation. Simulate platform and non-platform split by compiling two different file_contexts files and loading them together on-device. Leave the existing file_contexts.bin in place until we're ready to build images based on the new files. Bug: 31363362 Test: Builds and boots without additional denials. Change-Id: I7248f876e2230cee3b3cbf386422063da1e3dde0 Bring back file_contexts.bin. Change-Id: Ifec2c363579151080fdec48e8bc46bbbc8c97674 Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-12-12 18:29:04 +01:00
include $(BUILD_SYSTEM)/base_rules.mk
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
vendor_fc_files := $(call build_vendor_policy, file_contexts)
vendor_fcfiles_with_nl := $(call add_nl, $(vendor_fc_files), $(built_nl))
Split file_contexts for on-device compilation. Simulate platform and non-platform split by compiling two different file_contexts files and loading them together on-device. Leave the existing file_contexts.bin in place until we're ready to build images based on the new files. Bug: 31363362 Test: Builds and boots without additional denials. Change-Id: I7248f876e2230cee3b3cbf386422063da1e3dde0 Bring back file_contexts.bin. Change-Id: Ifec2c363579151080fdec48e8bc46bbbc8c97674 Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-12-12 18:29:04 +01:00
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_FC_FILES := $(vendor_fcfiles_with_nl)
Split file_contexts for on-device compilation. Simulate platform and non-platform split by compiling two different file_contexts files and loading them together on-device. Leave the existing file_contexts.bin in place until we're ready to build images based on the new files. Bug: 31363362 Test: Builds and boots without additional denials. Change-Id: I7248f876e2230cee3b3cbf386422063da1e3dde0 Bring back file_contexts.bin. Change-Id: Ifec2c363579151080fdec48e8bc46bbbc8c97674 Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-12-12 18:29:04 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Use LOCAL_ADDITIONAL_M4DEFS for file_contexts Pass LOCAL_ADDITIONAL_M4DEFS to m4 when building vendor_file_contexts and odm_file_contexts. The build command attempts to use PRIVATE_ADDITIONAL_M4DEFS - but this is not set in the target-specific variables. This allows using custom M4 macros when building non-platform file_contexts. Change-Id: I5fa8d9ec91f1a97bee1dd735ba85af93eef91252
2018-11-08 03:03:31 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Split file_contexts for on-device compilation. Simulate platform and non-platform split by compiling two different file_contexts files and loading them together on-device. Leave the existing file_contexts.bin in place until we're ready to build images based on the new files. Bug: 31363362 Test: Builds and boots without additional denials. Change-Id: I7248f876e2230cee3b3cbf386422063da1e3dde0 Bring back file_contexts.bin. Change-Id: Ifec2c363579151080fdec48e8bc46bbbc8c97674 Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-12-12 18:29:04 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_FC_SORT := $(HOST_OUT_EXECUTABLES)/fc_sort
$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/checkfc $(HOST_OUT_EXECUTABLES)/fc_sort \
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
$(vendor_fcfiles_with_nl) $(built_sepolicy)
Update Android.mk to support file_contexts.bin This change supports external/libselinux changes to implement PCRE formatted binary file_contexts and general_file_contexts.bin files. The $(intermediates) directory will contain the original text file (that is no longer used on the device) with a .tmp extension as well as the .bin file to aid analysis. A CleanSpec.mk file is added to remove the old file_contexts file. Change-Id: I75a781100082c23536f70ce3603f7de42408b5ba Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-08-06 18:43:52 +02:00
@mkdir -p $(dir $@)
m4: add --fatal-warnings Error out if m4 generates a warning. This will help detect and prevent malformed macros. See 855084960feb9e593a3bca288ab328a34a99ac57 for motivation. Test: policy compiles Test: Policy doesn't compile if 855084960feb9e593a3bca288ab328a34a99ac57 is reverted. Change-Id: Iee6b6273bc2a24b1220861fd662573e76001defc
2018-08-15 18:55:27 +02:00
$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_FC_FILES) > $@.tmp
Split file_contexts for on-device compilation. Simulate platform and non-platform split by compiling two different file_contexts files and loading them together on-device. Leave the existing file_contexts.bin in place until we're ready to build images based on the new files. Bug: 31363362 Test: Builds and boots without additional denials. Change-Id: I7248f876e2230cee3b3cbf386422063da1e3dde0 Bring back file_contexts.bin. Change-Id: Ifec2c363579151080fdec48e8bc46bbbc8c97674 Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-12-12 18:29:04 +01:00
$(hide) $< $(PRIVATE_SEPOLICY) $@.tmp
$(hide) $(PRIVATE_FC_SORT) $@.tmp $@
Update Android.mk to support file_contexts.bin This change supports external/libselinux changes to implement PCRE formatted binary file_contexts and general_file_contexts.bin files. The $(intermediates) directory will contain the original text file (that is no longer used on the device) with a .tmp extension as well as the .bin file to aid analysis. A CleanSpec.mk file is added to remove the old file_contexts file. Change-Id: I75a781100082c23536f70ce3603f7de42408b5ba Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-08-06 18:43:52 +02:00
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
built_vendor_fc := $(LOCAL_BUILT_MODULE)
vendor_fc_files :=
vendor_fcfiles_with_nl :=
Generate general versions of the other contexts files for tests. Generate general forms of the remaining *_contexts files with only the device-independent entries for use in CTS testing. Change-Id: I2bf0e41db8a73c26754cedd92cbc3783ff03d6b5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 22:45:03 +01:00
Build split file_contexts for recovery [ 7.674739] selinux: selinux_android_file_context: Error getting file context handle (No such file or directory) Bug: 62564629 Test: build and flash marlin. Successfully switch between regular and recovery modes Change-Id: I0f871f8842d95322c844fb7b13ad1b4b42578e35
2017-06-13 17:24:17 +02:00
##################################
include $(CLEAR_VARS)
Add /odm/etc/selinux/odm_file_contexts Bug: 64240127 Test: normal boot and recovery boot a device Change-Id: I087292fb23d05fc17272778d668ac78a721b2593
2017-11-29 09:14:53 +01:00
LOCAL_MODULE := odm_file_contexts
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux
include $(BUILD_SYSTEM)/base_rules.mk
odm_fc_files := $(call build_odm_policy, file_contexts)
odm_fcfiles_with_nl := $(call add_nl, $(odm_fc_files), $(built_nl))
$(LOCAL_BUILT_MODULE): PRIVATE_FC_FILES := $(odm_fcfiles_with_nl)
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Use LOCAL_ADDITIONAL_M4DEFS for file_contexts Pass LOCAL_ADDITIONAL_M4DEFS to m4 when building vendor_file_contexts and odm_file_contexts. The build command attempts to use PRIVATE_ADDITIONAL_M4DEFS - but this is not set in the target-specific variables. This allows using custom M4 macros when building non-platform file_contexts. Change-Id: I5fa8d9ec91f1a97bee1dd735ba85af93eef91252
2018-11-08 03:03:31 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Add /odm/etc/selinux/odm_file_contexts Bug: 64240127 Test: normal boot and recovery boot a device Change-Id: I087292fb23d05fc17272778d668ac78a721b2593
2017-11-29 09:14:53 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_FC_SORT := $(HOST_OUT_EXECUTABLES)/fc_sort
$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/checkfc $(HOST_OUT_EXECUTABLES)/fc_sort \
$(odm_fcfiles_with_nl) $(built_sepolicy)
@mkdir -p $(dir $@)
m4: add --fatal-warnings Error out if m4 generates a warning. This will help detect and prevent malformed macros. See 855084960feb9e593a3bca288ab328a34a99ac57 for motivation. Test: policy compiles Test: Policy doesn't compile if 855084960feb9e593a3bca288ab328a34a99ac57 is reverted. Change-Id: Iee6b6273bc2a24b1220861fd662573e76001defc
2018-08-15 18:55:27 +02:00
$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_FC_FILES) > $@.tmp
Add /odm/etc/selinux/odm_file_contexts Bug: 64240127 Test: normal boot and recovery boot a device Change-Id: I087292fb23d05fc17272778d668ac78a721b2593
2017-11-29 09:14:53 +01:00
$(hide) $< $(PRIVATE_SEPOLICY) $@.tmp
$(hide) $(PRIVATE_FC_SORT) $@.tmp $@
built_odm_fc := $(LOCAL_BUILT_MODULE)
odm_fc_files :=
odm_fcfiles_with_nl :=
##################################
include $(CLEAR_VARS)
Build split file_contexts for recovery [ 7.674739] selinux: selinux_android_file_context: Error getting file context handle (No such file or directory) Bug: 62564629 Test: build and flash marlin. Successfully switch between regular and recovery modes Change-Id: I0f871f8842d95322c844fb7b13ad1b4b42578e35
2017-06-13 17:24:17 +02:00
LOCAL_MODULE := plat_file_contexts.recovery
LOCAL_MODULE_STEM := plat_file_contexts
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
include $(BUILD_SYSTEM)/base_rules.mk
$(LOCAL_BUILT_MODULE): $(built_plat_fc)
$(hide) cp -f $< $@
Separate product_file_contexts out of system sepolicy. Bug: 119305624 Test: boot blueline Change-Id: I3ecdeab3bb33c3cb5e80dc10ba1079c9853048f8
2018-12-19 04:51:19 +01:00
##################################
include $(CLEAR_VARS)
LOCAL_MODULE := product_file_contexts.recovery
LOCAL_MODULE_STEM := product_file_contexts
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
include $(BUILD_SYSTEM)/base_rules.mk
$(LOCAL_BUILT_MODULE): $(built_product_fc)
$(hide) cp -f $< $@
Build split file_contexts for recovery [ 7.674739] selinux: selinux_android_file_context: Error getting file context handle (No such file or directory) Bug: 62564629 Test: build and flash marlin. Successfully switch between regular and recovery modes Change-Id: I0f871f8842d95322c844fb7b13ad1b4b42578e35
2017-06-13 17:24:17 +02:00
##################################
include $(CLEAR_VARS)
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
LOCAL_MODULE := vendor_file_contexts.recovery
LOCAL_MODULE_STEM := vendor_file_contexts
Build split file_contexts for recovery [ 7.674739] selinux: selinux_android_file_context: Error getting file context handle (No such file or directory) Bug: 62564629 Test: build and flash marlin. Successfully switch between regular and recovery modes Change-Id: I0f871f8842d95322c844fb7b13ad1b4b42578e35
2017-06-13 17:24:17 +02:00
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
include $(BUILD_SYSTEM)/base_rules.mk
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
$(LOCAL_BUILT_MODULE): $(built_vendor_fc)
Build split file_contexts for recovery [ 7.674739] selinux: selinux_android_file_context: Error getting file context handle (No such file or directory) Bug: 62564629 Test: build and flash marlin. Successfully switch between regular and recovery modes Change-Id: I0f871f8842d95322c844fb7b13ad1b4b42578e35
2017-06-13 17:24:17 +02:00
$(hide) cp -f $< $@
Add /odm/etc/selinux/odm_file_contexts Bug: 64240127 Test: normal boot and recovery boot a device Change-Id: I087292fb23d05fc17272778d668ac78a721b2593
2017-11-29 09:14:53 +01:00
##################################
include $(CLEAR_VARS)
LOCAL_MODULE := odm_file_contexts.recovery
LOCAL_MODULE_STEM := odm_file_contexts
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
include $(BUILD_SYSTEM)/base_rules.mk
$(LOCAL_BUILT_MODULE): $(built_odm_fc)
$(hide) cp -f $< $@
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
##################################
include $(CLEAR_VARS)
Split seapp_contexts into plat and nonplat components. Bug: 33746381 Test: Device boots with no extra denials. Change-Id: I2f0da92367851142e0d7df4afec8861ceaed9d3e
2016-12-22 16:15:18 +01:00
LOCAL_MODULE := plat_seapp_contexts
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
Use PRODUCT_SEPOLICY_SPLIT for full Treble. PRODUCT_FULL_TREBLE is being broken up into smaller, more manageable components. Bug: 62019611 Test: manual Change-Id: I9b65f120851d9ea134a0059a417f0282777717fc
2017-11-09 20:24:56 +01:00
ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Move service and seapp contexts to /system and /vendor Test: Build and boot Marlin and Bullhead. Test: Contexts split between /system and /vendor on Marlin. Remains stored in / on Bullhead. Bug: 36002816 Bug: 36002427 Change-Id: I922bcbc0cc2c08e312cf942ee261951edfa8d4e2
2017-03-09 07:28:03 +01:00
LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
else
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Move service and seapp contexts to /system and /vendor Test: Build and boot Marlin and Bullhead. Test: Contexts split between /system and /vendor on Marlin. Remains stored in / on Bullhead. Bug: 36002816 Bug: 36002427 Change-Id: I922bcbc0cc2c08e312cf942ee261951edfa8d4e2
2017-03-09 07:28:03 +01:00
endif
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
per device seapp_context support
2012-08-16 19:55:05 +02:00
include $(BUILD_SYSTEM)/base_rules.mk
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
# TODO(b/119305624): Move product-specific sepolicy out of plat_seapp_contexts
plat_sc_files := $(call build_policy, seapp_contexts, $(PLAT_PRIVATE_POLICY) $(PRODUCT_PRIVATE_POLICY))
per device seapp_context support
2012-08-16 19:55:05 +02:00
Use file target as dependency. "sepolicy" is a phony target defined by the build system. If you use it as dependency of a file target, you'll get unnecessary rebuild. Change-Id: I3a948ebbaff6a146050eb86a3d04cdc050f7c001
2012-10-26 04:01:31 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Split seapp_contexts into plat and nonplat components. Bug: 33746381 Test: Device boots with no extra denials. Change-Id: I2f0da92367851142e0d7df4afec8861ceaed9d3e
2016-12-22 16:15:18 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_SC_FILES := $(plat_sc_files)
$(LOCAL_BUILT_MODULE): $(built_sepolicy) $(plat_sc_files) $(HOST_OUT_EXECUTABLES)/checkseapp
Support overrides in seapp_contexts Provides support for overriding seapp_contexts declerations in per device seapp_contexts files. Change-Id: I23a0ffa1d24f1ce57825b168f29a2e885d3e1c51
2012-08-28 00:41:15 +02:00
@mkdir -p $(dir $@)
hide checkseapp command invocation Change-Id: I040904b69b98c49d60546f024f5ace5b7c6f7d5e Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-30 22:53:51 +02:00
$(hide) $(HOST_OUT_EXECUTABLES)/checkseapp -p $(PRIVATE_SEPOLICY) -o $@ $(PRIVATE_SC_FILES)
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
Split seapp_contexts into plat and nonplat components. Bug: 33746381 Test: Device boots with no extra denials. Change-Id: I2f0da92367851142e0d7df4afec8861ceaed9d3e
2016-12-22 16:15:18 +01:00
built_plat_sc := $(LOCAL_BUILT_MODULE)
plat_sc_files :=
Build the selinux_version file. The selinux_version file is used to perform policy versioning checks by libselinux and SELinuxMMAC. When loading policy a check is first performed to determine if the policy out in /data/security/current should be used to override the base policy shipped with the device. The selinux_version file is used to make that choice. The contents of the file simply contains the BUILD_FINGERPRINT that the policy was built against. A simple string comparison is then performed by libselinux and SELinuxMMAC. Change-Id: I69d9d071743cfd46bb247c98f94a193396f8ebbd Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-03-20 14:35:08 +01:00
Generate a general_seapp_contexts file for tests. Generate a general_seapp_contexts file with only the device-independent entries, similar to general_sepolicy.conf. This is for use by CTS tests to compare with the prefix of device seapp_contexts. Change-Id: If8d1456afff5347adff7157411c6a160484e0b39 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 20:46:36 +01:00
##################################
include $(CLEAR_VARS)
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
LOCAL_MODULE := vendor_seapp_contexts
Generate a general_seapp_contexts file for tests. Generate a general_seapp_contexts file with only the device-independent entries, similar to general_sepolicy.conf. This is for use by CTS tests to compare with the prefix of device seapp_contexts. Change-Id: If8d1456afff5347adff7157411c6a160484e0b39 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 20:46:36 +01:00
LOCAL_MODULE_CLASS := ETC
Split seapp_contexts into plat and nonplat components. Bug: 33746381 Test: Device boots with no extra denials. Change-Id: I2f0da92367851142e0d7df4afec8861ceaed9d3e
2016-12-22 16:15:18 +01:00
LOCAL_MODULE_TAGS := optional
Use PRODUCT_SEPOLICY_SPLIT for full Treble. PRODUCT_FULL_TREBLE is being broken up into smaller, more manageable components. Bug: 62019611 Test: manual Change-Id: I9b65f120851d9ea134a0059a417f0282777717fc
2017-11-09 20:24:56 +01:00
ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Move service and seapp contexts to /system and /vendor Test: Build and boot Marlin and Bullhead. Test: Contexts split between /system and /vendor on Marlin. Remains stored in / on Bullhead. Bug: 36002816 Bug: 36002427 Change-Id: I922bcbc0cc2c08e312cf942ee261951edfa8d4e2
2017-03-09 07:28:03 +01:00
LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
else
Split seapp_contexts into plat and nonplat components. Bug: 33746381 Test: Device boots with no extra denials. Change-Id: I2f0da92367851142e0d7df4afec8861ceaed9d3e
2016-12-22 16:15:18 +01:00
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Move service and seapp contexts to /system and /vendor Test: Build and boot Marlin and Bullhead. Test: Contexts split between /system and /vendor on Marlin. Remains stored in / on Bullhead. Bug: 36002816 Bug: 36002427 Change-Id: I922bcbc0cc2c08e312cf942ee261951edfa8d4e2
2017-03-09 07:28:03 +01:00
endif
Generate a general_seapp_contexts file for tests. Generate a general_seapp_contexts file with only the device-independent entries, similar to general_sepolicy.conf. This is for use by CTS tests to compare with the prefix of device seapp_contexts. Change-Id: If8d1456afff5347adff7157411c6a160484e0b39 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 20:46:36 +01:00
include $(BUILD_SYSTEM)/base_rules.mk
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
vendor_sc_files := $(call build_policy, seapp_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
plat_sc_neverallow_files := $(call build_policy, seapp_contexts, $(PLAT_PRIVATE_POLICY) $(PRODUCT_PRIVATE_POLICY))
Generate a general_seapp_contexts file for tests. Generate a general_seapp_contexts file with only the device-independent entries, similar to general_sepolicy.conf. This is for use by CTS tests to compare with the prefix of device seapp_contexts. Change-Id: If8d1456afff5347adff7157411c6a160484e0b39 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 20:46:36 +01:00
Split seapp_contexts into plat and nonplat components. Bug: 33746381 Test: Device boots with no extra denials. Change-Id: I2f0da92367851142e0d7df4afec8861ceaed9d3e
2016-12-22 16:15:18 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_SC_FILES := $(vendor_sc_files)
assert plat neverallows on nonplat seapp_contexts With the plat/nonplat policy split, nonplat_seapp_contexts should still be checked against the plat_seapp_contexts_neverallows during build time to ensure no violations occur. Test: stock aosp_marlin builds. Test: name=foo.bar seinfo=default fails (as expected) in nonplat policy Test: name=foo.bar seinfo="" fails (as expected) in nonplat policy Bug: 36002816 Change-Id: I95b2c695b23e2bdf420575d631e85391e93fc869
2017-03-07 07:53:09 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_SC_NEVERALLOW_FILES := $(plat_sc_neverallow_files)
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
$(LOCAL_BUILT_MODULE): $(built_sepolicy) $(vendor_sc_files) $(HOST_OUT_EXECUTABLES)/checkseapp $(plat_sc_neverallow_files)
Generate a general_seapp_contexts file for tests. Generate a general_seapp_contexts file with only the device-independent entries, similar to general_sepolicy.conf. This is for use by CTS tests to compare with the prefix of device seapp_contexts. Change-Id: If8d1456afff5347adff7157411c6a160484e0b39 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 20:46:36 +01:00
@mkdir -p $(dir $@)
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
$(hide) grep -ihe '^neverallow' $(PRIVATE_SC_NEVERALLOW_FILES) > $@.tmp
Fix build under GitC client. Test: build Bug: 36229129 Change-Id: I0654ce44f344729b0bb1f8716afa151e134fdc6a
2017-03-15 00:51:13 +01:00
$(hide) $(HOST_OUT_EXECUTABLES)/checkseapp -p $(PRIVATE_SEPOLICY) -o $@ $(PRIVATE_SC_FILES) $@.tmp
Generate a general_seapp_contexts file for tests. Generate a general_seapp_contexts file with only the device-independent entries, similar to general_sepolicy.conf. This is for use by CTS tests to compare with the prefix of device seapp_contexts. Change-Id: If8d1456afff5347adff7157411c6a160484e0b39 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 20:46:36 +01:00
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
built_vendor_sc := $(LOCAL_BUILT_MODULE)
vendor_sc_files :=
Generate a general_seapp_contexts file for tests. Generate a general_seapp_contexts file with only the device-independent entries, similar to general_sepolicy.conf. This is for use by CTS tests to compare with the prefix of device seapp_contexts. Change-Id: If8d1456afff5347adff7157411c6a160484e0b39 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 20:46:36 +01:00
Add /odm/etc/selinux/odm_seapp_contexts Bug: 64240127 Test: normal boot a device Change-Id: I3626357237cc18a99511f1ebd9dd3ff5a7655963
2017-11-29 09:15:28 +01:00
##################################
include $(CLEAR_VARS)
LOCAL_MODULE := odm_seapp_contexts
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux
include $(BUILD_SYSTEM)/base_rules.mk
odm_sc_files := $(call build_policy, seapp_contexts, $(BOARD_ODM_SEPOLICY_DIRS))
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
plat_sc_neverallow_files := $(call build_policy, seapp_contexts, $(PLAT_PRIVATE_POLICY) $(PRODUCT_PRIVATE_POLICY))
Add /odm/etc/selinux/odm_seapp_contexts Bug: 64240127 Test: normal boot a device Change-Id: I3626357237cc18a99511f1ebd9dd3ff5a7655963
2017-11-29 09:15:28 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
$(LOCAL_BUILT_MODULE): PRIVATE_SC_FILES := $(odm_sc_files)
$(LOCAL_BUILT_MODULE): PRIVATE_SC_NEVERALLOW_FILES := $(plat_sc_neverallow_files)
$(LOCAL_BUILT_MODULE): $(built_sepolicy) $(odm_sc_files) $(HOST_OUT_EXECUTABLES)/checkseapp $(plat_sc_neverallow_files)
@mkdir -p $(dir $@)
$(hide) grep -ihe '^neverallow' $(PRIVATE_SC_NEVERALLOW_FILES) > $@.tmp
$(hide) $(HOST_OUT_EXECUTABLES)/checkseapp -p $(PRIVATE_SEPOLICY) -o $@ $(PRIVATE_SC_FILES) $@.tmp
built_odm_sc := $(LOCAL_BUILT_MODULE)
odm_sc_files :=
Introduce seapp_neverallow test Produce a list of neverallow assertions from seapp_contexts into a separate file, general_seapp_context_neverallows, to be used during CTS neverallow checking. Change-Id: I171ed43cf4ae4961f66d5d8f56695345493f1261 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-25 20:59:30 +02:00
##################################
include $(CLEAR_VARS)
Split seapp_contexts into plat and nonplat components. Bug: 33746381 Test: Device boots with no extra denials. Change-Id: I2f0da92367851142e0d7df4afec8861ceaed9d3e
2016-12-22 16:15:18 +01:00
LOCAL_MODULE := plat_seapp_neverallows
Introduce seapp_neverallow test Produce a list of neverallow assertions from seapp_contexts into a separate file, general_seapp_context_neverallows, to be used during CTS neverallow checking. Change-Id: I171ed43cf4ae4961f66d5d8f56695345493f1261 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-25 20:59:30 +02:00
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := tests
include $(BUILD_SYSTEM)/base_rules.mk
assert plat neverallows on nonplat seapp_contexts With the plat/nonplat policy split, nonplat_seapp_contexts should still be checked against the plat_seapp_contexts_neverallows during build time to ensure no violations occur. Test: stock aosp_marlin builds. Test: name=foo.bar seinfo=default fails (as expected) in nonplat policy Test: name=foo.bar seinfo="" fails (as expected) in nonplat policy Bug: 36002816 Change-Id: I95b2c695b23e2bdf420575d631e85391e93fc869
2017-03-07 07:53:09 +01:00
$(LOCAL_BUILT_MODULE): $(plat_sc_neverallow_files)
Introduce seapp_neverallow test Produce a list of neverallow assertions from seapp_contexts into a separate file, general_seapp_context_neverallows, to be used during CTS neverallow checking. Change-Id: I171ed43cf4ae4961f66d5d8f56695345493f1261 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-25 20:59:30 +02:00
@mkdir -p $(dir $@)
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
- $(hide) grep -ihe '^neverallow' $< > $@
Introduce seapp_neverallow test Produce a list of neverallow assertions from seapp_contexts into a separate file, general_seapp_context_neverallows, to be used during CTS neverallow checking. Change-Id: I171ed43cf4ae4961f66d5d8f56695345493f1261 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-25 20:59:30 +02:00
assert plat neverallows on nonplat seapp_contexts With the plat/nonplat policy split, nonplat_seapp_contexts should still be checked against the plat_seapp_contexts_neverallows during build time to ensure no violations occur. Test: stock aosp_marlin builds. Test: name=foo.bar seinfo=default fails (as expected) in nonplat policy Test: name=foo.bar seinfo="" fails (as expected) in nonplat policy Bug: 36002816 Change-Id: I95b2c695b23e2bdf420575d631e85391e93fc869
2017-03-07 07:53:09 +01:00
plat_sc_neverallow_files :=
Introduce seapp_neverallow test Produce a list of neverallow assertions from seapp_contexts into a separate file, general_seapp_context_neverallows, to be used during CTS neverallow checking. Change-Id: I171ed43cf4ae4961f66d5d8f56695345493f1261 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-25 20:59:30 +02:00
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
##################################
include $(CLEAR_VARS)
property_context: split into platform and non-platform components. Bug: 33746484 Test: Successfully boot with original service and property contexts. Successfully boot with split serivce and property contexts. Change-Id: I87f95292b5860283efb2081b2223e607a52fed04 Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-12-28 01:08:44 +01:00
LOCAL_MODULE := plat_property_contexts
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
Correct location of property_contexts for TREBLE devices This makes the build system, for TREBLE devices only, place plat_property_contexts under /system/etc/selinux and nonplat_property_contexts under /vendor/etc/selinux. For other devices these files are placed under /, same as before. This change was previously reverted because it affected the location of property_contexts in recovery. Now that we have separate tagets for recovery (see ec78c377c006040d14d92f5b1a1a52da779f20aa), this change no longer affects is recovery. Test: *_property_contexts in correct locations when PRODUCT_FULL_TREBLE is set to true and when it is set to false. Test: cts-tradefed run singleCommand cts --skip-device-info \ --skip-preconditions --skip-connectivity-check \ --abi arm64-v8a --module CtsSecurityHostTestCases \ -t android.security.cts.SELinuxHostTest#testAospPropertyContexts This test was performed on bullhead (non A/B device) and sailfish (A/B device). Test: Clean build, flash, device boots with no additional denials. Rebooting to recovery, recovery boots fine with no denials. This test was performed on bullhead (non A/B device) and sailfish (A/B device). Bug: 36002573 (cherry picked from commit 4cb628a3be61efbd2abf8e92d38710d76ef828f3) Change-Id: I0b145c58669fb31bc39d57f36eef1190425a8328
2017-03-08 22:10:05 +01:00
Use PRODUCT_SEPOLICY_SPLIT for full Treble. PRODUCT_FULL_TREBLE is being broken up into smaller, more manageable components. Bug: 62019611 Test: manual Change-Id: I9b65f120851d9ea134a0059a417f0282777717fc
2017-11-09 20:24:56 +01:00
ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Correct location of property_contexts for TREBLE devices This makes the build system, for TREBLE devices only, place plat_property_contexts under /system/etc/selinux and nonplat_property_contexts under /vendor/etc/selinux. For other devices these files are placed under /, same as before. This change was previously reverted because it affected the location of property_contexts in recovery. Now that we have separate tagets for recovery (see ec78c377c006040d14d92f5b1a1a52da779f20aa), this change no longer affects is recovery. Test: *_property_contexts in correct locations when PRODUCT_FULL_TREBLE is set to true and when it is set to false. Test: cts-tradefed run singleCommand cts --skip-device-info \ --skip-preconditions --skip-connectivity-check \ --abi arm64-v8a --module CtsSecurityHostTestCases \ -t android.security.cts.SELinuxHostTest#testAospPropertyContexts This test was performed on bullhead (non A/B device) and sailfish (A/B device). Test: Clean build, flash, device boots with no additional denials. Rebooting to recovery, recovery boots fine with no denials. This test was performed on bullhead (non A/B device) and sailfish (A/B device). Bug: 36002573 (cherry picked from commit 4cb628a3be61efbd2abf8e92d38710d76ef828f3) Change-Id: I0b145c58669fb31bc39d57f36eef1190425a8328
2017-03-08 22:10:05 +01:00
LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
else
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Correct location of property_contexts for TREBLE devices This makes the build system, for TREBLE devices only, place plat_property_contexts under /system/etc/selinux and nonplat_property_contexts under /vendor/etc/selinux. For other devices these files are placed under /, same as before. This change was previously reverted because it affected the location of property_contexts in recovery. Now that we have separate tagets for recovery (see ec78c377c006040d14d92f5b1a1a52da779f20aa), this change no longer affects is recovery. Test: *_property_contexts in correct locations when PRODUCT_FULL_TREBLE is set to true and when it is set to false. Test: cts-tradefed run singleCommand cts --skip-device-info \ --skip-preconditions --skip-connectivity-check \ --abi arm64-v8a --module CtsSecurityHostTestCases \ -t android.security.cts.SELinuxHostTest#testAospPropertyContexts This test was performed on bullhead (non A/B device) and sailfish (A/B device). Test: Clean build, flash, device boots with no additional denials. Rebooting to recovery, recovery boots fine with no denials. This test was performed on bullhead (non A/B device) and sailfish (A/B device). Bug: 36002573 (cherry picked from commit 4cb628a3be61efbd2abf8e92d38710d76ef828f3) Change-Id: I0b145c58669fb31bc39d57f36eef1190425a8328
2017-03-08 22:10:05 +01:00
endif
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
include $(BUILD_SYSTEM)/base_rules.mk
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
# TODO(b/119305624): Move product-specific sepolicy out of plat_property_contexts.
plat_pcfiles := $(call build_policy, property_contexts, $(PLAT_PRIVATE_POLICY) $(PRODUCT_PRIVATE_POLICY))
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
ifeq ($(PRODUCT_COMPATIBLE_PROPERTY),true)
plat_pcfiles += $(LOCAL_PATH)/public/property_contexts
endif
Android.mk: drop polluting variables Some of the ALL_*_FILES variables remained that were used in a way that could not be cleared. Move them to lower case variants and use a build recipe PRIVATE_*_FILES variable. This avoids polluting the global namespace. Change-Id: I83748dab48141af7d3f10ad27fc9319eaf90b970 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-07-30 20:44:26 +02:00
property_context: split into platform and non-platform components. Bug: 33746484 Test: Successfully boot with original service and property contexts. Successfully boot with split serivce and property contexts. Change-Id: I87f95292b5860283efb2081b2223e607a52fed04 Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-12-28 01:08:44 +01:00
plat_property_contexts.tmp := $(intermediates)/plat_property_contexts.tmp
$(plat_property_contexts.tmp): PRIVATE_PC_FILES := $(plat_pcfiles)
$(plat_property_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(plat_property_contexts.tmp): $(plat_pcfiles)
property_contexts: don't delete intermediate on failure When property_contexts fails to build, the file is deleted leaving only the error message for debugging. Build property_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ia86eb0480c9493ceab36fed779b2fe6ab85d2b3d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 22:52:37 +02:00
@mkdir -p $(dir $@)
m4: add --fatal-warnings Error out if m4 generates a warning. This will help detect and prevent malformed macros. See 855084960feb9e593a3bca288ab328a34a99ac57 for motivation. Test: policy compiles Test: Policy doesn't compile if 855084960feb9e593a3bca288ab328a34a99ac57 is reverted. Change-Id: Iee6b6273bc2a24b1220861fd662573e76001defc
2018-08-15 18:55:27 +02:00
$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_PC_FILES) > $@
Verify the SELabels used in property_contexts Verify that the SELabels used in property_contexts correspond to a real type in the SEPolicy and that this type has the property_type attribute. Additionally add a check that vendor property_context files do not duplicate entries in plat property_contexts, and a similar check that odm property_contexts doesn't duplicate either plat or vendor property_contexts. Bug: 74078792 Test: Build property_contexts on bullhead successfully Test: See failure when using a faulty SELabel in property_contexts Test: See failure when duplicating label in vendor and plat property_contexts Change-Id: I4d2338dab68f1c5a8ed110aa7821f0677f61bafb
2018-03-23 22:15:23 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
$(LOCAL_BUILT_MODULE): $(plat_property_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/property_info_checker
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
@mkdir -p $(dir $@)
Use property_info_checker instead of checkfc and fc_sort for properties 1) fc_sort is not needed as there is no reason to sort system properties, so this is removed and replaced with a simply copy 2) Use the new property_info_checker instead of checkfc for validating property information. This supports exact match properties and will be extended to verify property schemas in the future. Bug: 36001741 Test: verify bullhead's property contexts correct Test: verify faulty property contexts result in failures Change-Id: Id9bbf401f385206e6907449a510e3111424ce59e
2018-01-04 18:46:48 +01:00
$(hide) cp -f $< $@
Verify the SELabels used in property_contexts Verify that the SELabels used in property_contexts correspond to a real type in the SEPolicy and that this type has the property_type attribute. Additionally add a check that vendor property_context files do not duplicate entries in plat property_contexts, and a similar check that odm property_contexts doesn't duplicate either plat or vendor property_contexts. Bug: 74078792 Test: Build property_contexts on bullhead successfully Test: See failure when using a faulty SELabel in property_contexts Test: See failure when duplicating label in vendor and plat property_contexts Change-Id: I4d2338dab68f1c5a8ed110aa7821f0677f61bafb
2018-03-23 22:15:23 +01:00
$(hide) $(HOST_OUT_EXECUTABLES)/property_info_checker $(PRIVATE_SEPOLICY) $@
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
property_context: split into platform and non-platform components. Bug: 33746484 Test: Successfully boot with original service and property contexts. Successfully boot with split serivce and property contexts. Change-Id: I87f95292b5860283efb2081b2223e607a52fed04 Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-12-28 01:08:44 +01:00
built_plat_pc := $(LOCAL_BUILT_MODULE)
plat_pcfiles :=
plat_property_contexts.tmp :=
Build the selinux_version file. The selinux_version file is used to perform policy versioning checks by libselinux and SELinuxMMAC. When loading policy a check is first performed to determine if the policy out in /data/security/current should be used to override the base policy shipped with the device. The selinux_version file is used to make that choice. The contents of the file simply contains the BUILD_FINGERPRINT that the policy was built against. A simple string comparison is then performed by libselinux and SELinuxMMAC. Change-Id: I69d9d071743cfd46bb247c98f94a193396f8ebbd Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-03-20 14:35:08 +01:00
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
##################################
include $(CLEAR_VARS)
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
LOCAL_MODULE := vendor_property_contexts
Generate general versions of the other contexts files for tests. Generate general forms of the remaining *_contexts files with only the device-independent entries for use in CTS testing. Change-Id: I2bf0e41db8a73c26754cedd92cbc3783ff03d6b5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 22:45:03 +01:00
LOCAL_MODULE_CLASS := ETC
property_context: split into platform and non-platform components. Bug: 33746484 Test: Successfully boot with original service and property contexts. Successfully boot with split serivce and property contexts. Change-Id: I87f95292b5860283efb2081b2223e607a52fed04 Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-12-28 01:08:44 +01:00
LOCAL_MODULE_TAGS := optional
Correct location of property_contexts for TREBLE devices This makes the build system, for TREBLE devices only, place plat_property_contexts under /system/etc/selinux and nonplat_property_contexts under /vendor/etc/selinux. For other devices these files are placed under /, same as before. This change was previously reverted because it affected the location of property_contexts in recovery. Now that we have separate tagets for recovery (see ec78c377c006040d14d92f5b1a1a52da779f20aa), this change no longer affects is recovery. Test: *_property_contexts in correct locations when PRODUCT_FULL_TREBLE is set to true and when it is set to false. Test: cts-tradefed run singleCommand cts --skip-device-info \ --skip-preconditions --skip-connectivity-check \ --abi arm64-v8a --module CtsSecurityHostTestCases \ -t android.security.cts.SELinuxHostTest#testAospPropertyContexts This test was performed on bullhead (non A/B device) and sailfish (A/B device). Test: Clean build, flash, device boots with no additional denials. Rebooting to recovery, recovery boots fine with no denials. This test was performed on bullhead (non A/B device) and sailfish (A/B device). Bug: 36002573 (cherry picked from commit 4cb628a3be61efbd2abf8e92d38710d76ef828f3) Change-Id: I0b145c58669fb31bc39d57f36eef1190425a8328
2017-03-08 22:10:05 +01:00
Use PRODUCT_SEPOLICY_SPLIT for full Treble. PRODUCT_FULL_TREBLE is being broken up into smaller, more manageable components. Bug: 62019611 Test: manual Change-Id: I9b65f120851d9ea134a0059a417f0282777717fc
2017-11-09 20:24:56 +01:00
ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Correct location of property_contexts for TREBLE devices This makes the build system, for TREBLE devices only, place plat_property_contexts under /system/etc/selinux and nonplat_property_contexts under /vendor/etc/selinux. For other devices these files are placed under /, same as before. This change was previously reverted because it affected the location of property_contexts in recovery. Now that we have separate tagets for recovery (see ec78c377c006040d14d92f5b1a1a52da779f20aa), this change no longer affects is recovery. Test: *_property_contexts in correct locations when PRODUCT_FULL_TREBLE is set to true and when it is set to false. Test: cts-tradefed run singleCommand cts --skip-device-info \ --skip-preconditions --skip-connectivity-check \ --abi arm64-v8a --module CtsSecurityHostTestCases \ -t android.security.cts.SELinuxHostTest#testAospPropertyContexts This test was performed on bullhead (non A/B device) and sailfish (A/B device). Test: Clean build, flash, device boots with no additional denials. Rebooting to recovery, recovery boots fine with no denials. This test was performed on bullhead (non A/B device) and sailfish (A/B device). Bug: 36002573 (cherry picked from commit 4cb628a3be61efbd2abf8e92d38710d76ef828f3) Change-Id: I0b145c58669fb31bc39d57f36eef1190425a8328
2017-03-08 22:10:05 +01:00
LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
else
property_context: split into platform and non-platform components. Bug: 33746484 Test: Successfully boot with original service and property contexts. Successfully boot with split serivce and property contexts. Change-Id: I87f95292b5860283efb2081b2223e607a52fed04 Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-12-28 01:08:44 +01:00
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Correct location of property_contexts for TREBLE devices This makes the build system, for TREBLE devices only, place plat_property_contexts under /system/etc/selinux and nonplat_property_contexts under /vendor/etc/selinux. For other devices these files are placed under /, same as before. This change was previously reverted because it affected the location of property_contexts in recovery. Now that we have separate tagets for recovery (see ec78c377c006040d14d92f5b1a1a52da779f20aa), this change no longer affects is recovery. Test: *_property_contexts in correct locations when PRODUCT_FULL_TREBLE is set to true and when it is set to false. Test: cts-tradefed run singleCommand cts --skip-device-info \ --skip-preconditions --skip-connectivity-check \ --abi arm64-v8a --module CtsSecurityHostTestCases \ -t android.security.cts.SELinuxHostTest#testAospPropertyContexts This test was performed on bullhead (non A/B device) and sailfish (A/B device). Test: Clean build, flash, device boots with no additional denials. Rebooting to recovery, recovery boots fine with no denials. This test was performed on bullhead (non A/B device) and sailfish (A/B device). Bug: 36002573 (cherry picked from commit 4cb628a3be61efbd2abf8e92d38710d76ef828f3) Change-Id: I0b145c58669fb31bc39d57f36eef1190425a8328
2017-03-08 22:10:05 +01:00
endif
Generate general versions of the other contexts files for tests. Generate general forms of the remaining *_contexts files with only the device-independent entries for use in CTS testing. Change-Id: I2bf0e41db8a73c26754cedd92cbc3783ff03d6b5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 22:45:03 +01:00
Fix rules for general_property_contexts. Failed to include base_rules.mk, so this target was not being built. Change-Id: I2414fa6c3e3e37c74f63c205e3694d1a811c956e Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-13 14:36:57 +01:00
include $(BUILD_SYSTEM)/base_rules.mk
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
vendor_pcfiles := $(call build_policy, property_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
property_context: split into platform and non-platform components. Bug: 33746484 Test: Successfully boot with original service and property contexts. Successfully boot with split serivce and property contexts. Change-Id: I87f95292b5860283efb2081b2223e607a52fed04 Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-12-28 01:08:44 +01:00
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
vendor_property_contexts.tmp := $(intermediates)/vendor_property_contexts.tmp
$(vendor_property_contexts.tmp): PRIVATE_PC_FILES := $(vendor_pcfiles)
$(vendor_property_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(vendor_property_contexts.tmp): $(vendor_pcfiles)
property_contexts: don't delete intermediate on failure When property_contexts fails to build, the file is deleted leaving only the error message for debugging. Build property_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: I431d6f4494fa119c1873eab0e77f0eed3fb5754e Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 22:52:37 +02:00
@mkdir -p $(dir $@)
m4: add --fatal-warnings Error out if m4 generates a warning. This will help detect and prevent malformed macros. See 855084960feb9e593a3bca288ab328a34a99ac57 for motivation. Test: policy compiles Test: Policy doesn't compile if 855084960feb9e593a3bca288ab328a34a99ac57 is reverted. Change-Id: Iee6b6273bc2a24b1220861fd662573e76001defc
2018-08-15 18:55:27 +02:00
$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_PC_FILES) > $@
property_contexts: don't delete intermediate on failure When property_contexts fails to build, the file is deleted leaving only the error message for debugging. Build property_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: I431d6f4494fa119c1873eab0e77f0eed3fb5754e Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 22:52:37 +02:00
Verify the SELabels used in property_contexts Verify that the SELabels used in property_contexts correspond to a real type in the SEPolicy and that this type has the property_type attribute. Additionally add a check that vendor property_context files do not duplicate entries in plat property_contexts, and a similar check that odm property_contexts doesn't duplicate either plat or vendor property_contexts. Bug: 74078792 Test: Build property_contexts on bullhead successfully Test: See failure when using a faulty SELabel in property_contexts Test: See failure when duplicating label in vendor and plat property_contexts Change-Id: I4d2338dab68f1c5a8ed110aa7821f0677f61bafb
2018-03-23 22:15:23 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
$(LOCAL_BUILT_MODULE): PRIVATE_BUILT_PLAT_PC := $(built_plat_pc)
$(LOCAL_BUILT_MODULE): $(vendor_property_contexts.tmp) $(built_sepolicy) $(built_plat_pc) $(HOST_OUT_EXECUTABLES)/property_info_checker
property_contexts: don't delete intermediate on failure When property_contexts fails to build, the file is deleted leaving only the error message for debugging. Build property_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ia86eb0480c9493ceab36fed779b2fe6ab85d2b3d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 22:52:37 +02:00
@mkdir -p $(dir $@)
Use property_info_checker instead of checkfc and fc_sort for properties 1) fc_sort is not needed as there is no reason to sort system properties, so this is removed and replaced with a simply copy 2) Use the new property_info_checker instead of checkfc for validating property information. This supports exact match properties and will be extended to verify property schemas in the future. Bug: 36001741 Test: verify bullhead's property contexts correct Test: verify faulty property contexts result in failures Change-Id: Id9bbf401f385206e6907449a510e3111424ce59e
2018-01-04 18:46:48 +01:00
$(hide) cp -f $< $@
Verify the SELabels used in property_contexts Verify that the SELabels used in property_contexts correspond to a real type in the SEPolicy and that this type has the property_type attribute. Additionally add a check that vendor property_context files do not duplicate entries in plat property_contexts, and a similar check that odm property_contexts doesn't duplicate either plat or vendor property_contexts. Bug: 74078792 Test: Build property_contexts on bullhead successfully Test: See failure when using a faulty SELabel in property_contexts Test: See failure when duplicating label in vendor and plat property_contexts Change-Id: I4d2338dab68f1c5a8ed110aa7821f0677f61bafb
2018-03-23 22:15:23 +01:00
$(hide) $(HOST_OUT_EXECUTABLES)/property_info_checker $(PRIVATE_SEPOLICY) $(PRIVATE_BUILT_PLAT_PC) $@
property_contexts: don't delete intermediate on failure When property_contexts fails to build, the file is deleted leaving only the error message for debugging. Build property_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ia86eb0480c9493ceab36fed779b2fe6ab85d2b3d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 22:52:37 +02:00
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
built_vendor_pc := $(LOCAL_BUILT_MODULE)
vendor_pcfiles :=
vendor_property_contexts.tmp :=
Generate general versions of the other contexts files for tests. Generate general forms of the remaining *_contexts files with only the device-independent entries for use in CTS testing. Change-Id: I2bf0e41db8a73c26754cedd92cbc3783ff03d6b5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 22:45:03 +01:00
Add /odm/etc/selinux/odm_property_contexts Bug: 64240127 Test: normal boot and recovery boot a device Change-Id: Ibd71219f60644e57370c0293decf11d82f1cb35c
2017-11-29 09:15:55 +01:00
##################################
include $(CLEAR_VARS)
LOCAL_MODULE := odm_property_contexts
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux
include $(BUILD_SYSTEM)/base_rules.mk
odm_pcfiles := $(call build_policy, property_contexts, $(BOARD_ODM_SEPOLICY_DIRS))
odm_property_contexts.tmp := $(intermediates)/odm_property_contexts.tmp
$(odm_property_contexts.tmp): PRIVATE_PC_FILES := $(odm_pcfiles)
$(odm_property_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(odm_property_contexts.tmp): $(odm_pcfiles)
@mkdir -p $(dir $@)
m4: add --fatal-warnings Error out if m4 generates a warning. This will help detect and prevent malformed macros. See 855084960feb9e593a3bca288ab328a34a99ac57 for motivation. Test: policy compiles Test: Policy doesn't compile if 855084960feb9e593a3bca288ab328a34a99ac57 is reverted. Change-Id: Iee6b6273bc2a24b1220861fd662573e76001defc
2018-08-15 18:55:27 +02:00
$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_PC_FILES) > $@
Add /odm/etc/selinux/odm_property_contexts Bug: 64240127 Test: normal boot and recovery boot a device Change-Id: Ibd71219f60644e57370c0293decf11d82f1cb35c
2017-11-29 09:15:55 +01:00
Verify the SELabels used in property_contexts Verify that the SELabels used in property_contexts correspond to a real type in the SEPolicy and that this type has the property_type attribute. Additionally add a check that vendor property_context files do not duplicate entries in plat property_contexts, and a similar check that odm property_contexts doesn't duplicate either plat or vendor property_contexts. Bug: 74078792 Test: Build property_contexts on bullhead successfully Test: See failure when using a faulty SELabel in property_contexts Test: See failure when duplicating label in vendor and plat property_contexts Change-Id: I4d2338dab68f1c5a8ed110aa7821f0677f61bafb
2018-03-23 22:15:23 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
$(LOCAL_BUILT_MODULE): PRIVATE_BUILT_PLAT_PC := $(built_plat_pc)
$(LOCAL_BUILT_MODULE): PRIVATE_BUILT_VENDOR_PC := $(built_vendor_pc)
$(LOCAL_BUILT_MODULE): $(odm_property_contexts.tmp) $(built_sepolicy) $(built_plat_pc) $(built_vendor_pc) $(HOST_OUT_EXECUTABLES)/property_info_checker
Add /odm/etc/selinux/odm_property_contexts Bug: 64240127 Test: normal boot and recovery boot a device Change-Id: Ibd71219f60644e57370c0293decf11d82f1cb35c
2017-11-29 09:15:55 +01:00
@mkdir -p $(dir $@)
$(hide) cp -f $< $@
Verify the SELabels used in property_contexts Verify that the SELabels used in property_contexts correspond to a real type in the SEPolicy and that this type has the property_type attribute. Additionally add a check that vendor property_context files do not duplicate entries in plat property_contexts, and a similar check that odm property_contexts doesn't duplicate either plat or vendor property_contexts. Bug: 74078792 Test: Build property_contexts on bullhead successfully Test: See failure when using a faulty SELabel in property_contexts Test: See failure when duplicating label in vendor and plat property_contexts Change-Id: I4d2338dab68f1c5a8ed110aa7821f0677f61bafb
2018-03-23 22:15:23 +01:00
$(hide) $(HOST_OUT_EXECUTABLES)/property_info_checker $(PRIVATE_SEPOLICY) $(PRIVATE_BUILT_PLAT_PC) $(PRIVATE_BUILT_VENDOR_PC) $@
Add /odm/etc/selinux/odm_property_contexts Bug: 64240127 Test: normal boot and recovery boot a device Change-Id: Ibd71219f60644e57370c0293decf11d82f1cb35c
2017-11-29 09:15:55 +01:00
built_odm_pc := $(LOCAL_BUILT_MODULE)
odm_pcfiles :=
odm_property_contexts.tmp :=
Generate general versions of the other contexts files for tests. Generate general forms of the remaining *_contexts files with only the device-independent entries for use in CTS testing. Change-Id: I2bf0e41db8a73c26754cedd92cbc3783ff03d6b5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 22:45:03 +01:00
##################################
include $(CLEAR_VARS)
Targets for artifacts needed by recovery This ensures that SELinux policy artifact needed by recovery at runtime have targets in this build script. This is to make recoveryimage/bootimage targets depend on these artifacts explicitly, which reduces the element of surprise. Moreover, this enables us to move non-recovery artifacts around without affecting recovery artifacts. Test: Clean build, flash, device boots just fine, no new denials. Reboot to recovery, recovery boots just fine, no denials. This was tested on bullhead (non A/B device) and sailfish (A/B device). Bug: 33642277 Change-Id: I3c494d9d7fec5c4f487d38964e572757fcf67f57
2017-03-10 21:44:16 +01:00
LOCAL_MODULE := plat_property_contexts.recovery
LOCAL_MODULE_STEM := plat_property_contexts
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
include $(BUILD_SYSTEM)/base_rules.mk
$(LOCAL_BUILT_MODULE): $(built_plat_pc)
$(hide) cp -f $< $@
##################################
include $(CLEAR_VARS)
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
LOCAL_MODULE := vendor_property_contexts.recovery
LOCAL_MODULE_STEM := vendor_property_contexts
Targets for artifacts needed by recovery This ensures that SELinux policy artifact needed by recovery at runtime have targets in this build script. This is to make recoveryimage/bootimage targets depend on these artifacts explicitly, which reduces the element of surprise. Moreover, this enables us to move non-recovery artifacts around without affecting recovery artifacts. Test: Clean build, flash, device boots just fine, no new denials. Reboot to recovery, recovery boots just fine, no denials. This was tested on bullhead (non A/B device) and sailfish (A/B device). Bug: 33642277 Change-Id: I3c494d9d7fec5c4f487d38964e572757fcf67f57
2017-03-10 21:44:16 +01:00
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
include $(BUILD_SYSTEM)/base_rules.mk
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
$(LOCAL_BUILT_MODULE): $(built_vendor_pc)
Targets for artifacts needed by recovery This ensures that SELinux policy artifact needed by recovery at runtime have targets in this build script. This is to make recoveryimage/bootimage targets depend on these artifacts explicitly, which reduces the element of surprise. Moreover, this enables us to move non-recovery artifacts around without affecting recovery artifacts. Test: Clean build, flash, device boots just fine, no new denials. Reboot to recovery, recovery boots just fine, no denials. This was tested on bullhead (non A/B device) and sailfish (A/B device). Bug: 33642277 Change-Id: I3c494d9d7fec5c4f487d38964e572757fcf67f57
2017-03-10 21:44:16 +01:00
$(hide) cp -f $< $@
Add /odm/etc/selinux/odm_property_contexts Bug: 64240127 Test: normal boot and recovery boot a device Change-Id: Ibd71219f60644e57370c0293decf11d82f1cb35c
2017-11-29 09:15:55 +01:00
##################################
include $(CLEAR_VARS)
LOCAL_MODULE := odm_property_contexts.recovery
LOCAL_MODULE_STEM := odm_property_contexts
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
include $(BUILD_SYSTEM)/base_rules.mk
$(LOCAL_BUILT_MODULE): $(built_odm_pc)
$(hide) cp -f $< $@
Targets for artifacts needed by recovery This ensures that SELinux policy artifact needed by recovery at runtime have targets in this build script. This is to make recoveryimage/bootimage targets depend on these artifacts explicitly, which reduces the element of surprise. Moreover, this enables us to move non-recovery artifacts around without affecting recovery artifacts. Test: Clean build, flash, device boots just fine, no new denials. Reboot to recovery, recovery boots just fine, no denials. This was tested on bullhead (non A/B device) and sailfish (A/B device). Bug: 33642277 Change-Id: I3c494d9d7fec5c4f487d38964e572757fcf67f57
2017-03-10 21:44:16 +01:00
##################################
include $(CLEAR_VARS)
service_context: split into platform and non-platform components. Bug: 33746484 Test: Successfully boot with original service and property contexts. Successfully boot with split serivce and property contexts. Change-Id: Ide67d37d85273c60b9e387e72fbeb87be6da306a Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-12-28 00:10:48 +01:00
LOCAL_MODULE := plat_service_contexts
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
Use PRODUCT_SEPOLICY_SPLIT for full Treble. PRODUCT_FULL_TREBLE is being broken up into smaller, more manageable components. Bug: 62019611 Test: manual Change-Id: I9b65f120851d9ea134a0059a417f0282777717fc
2017-11-09 20:24:56 +01:00
ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Move service and seapp contexts to /system and /vendor Test: Build and boot Marlin and Bullhead. Test: Contexts split between /system and /vendor on Marlin. Remains stored in / on Bullhead. Bug: 36002816 Bug: 36002427 Change-Id: I922bcbc0cc2c08e312cf942ee261951edfa8d4e2
2017-03-09 07:28:03 +01:00
LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
else
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Move service and seapp contexts to /system and /vendor Test: Build and boot Marlin and Bullhead. Test: Contexts split between /system and /vendor on Marlin. Remains stored in / on Bullhead. Bug: 36002816 Bug: 36002427 Change-Id: I922bcbc0cc2c08e312cf942ee261951edfa8d4e2
2017-03-09 07:28:03 +01:00
endif
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
include $(BUILD_SYSTEM)/base_rules.mk
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
# TODO(b/119305624): Move product-specific sepolicy out of plat_service_contexts.
plat_svcfiles := $(call build_policy, service_contexts, $(PLAT_PRIVATE_POLICY) $(PRODUCT_PRIVATE_POLICY))
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
service_context: split into platform and non-platform components. Bug: 33746484 Test: Successfully boot with original service and property contexts. Successfully boot with split serivce and property contexts. Change-Id: Ide67d37d85273c60b9e387e72fbeb87be6da306a Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-12-28 00:10:48 +01:00
plat_service_contexts.tmp := $(intermediates)/plat_service_contexts.tmp
$(plat_service_contexts.tmp): PRIVATE_SVC_FILES := $(plat_svcfiles)
$(plat_service_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(plat_service_contexts.tmp): $(plat_svcfiles)
service_contexts: don't delete intermediate on failure When service_contexts fails to build, the file is deleted leaving only the error message for debugging. Build service_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ib9c9247d36e6a6406b4df84d10e982921c07d492 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 23:17:38 +02:00
@mkdir -p $(dir $@)
m4: add --fatal-warnings Error out if m4 generates a warning. This will help detect and prevent malformed macros. See 855084960feb9e593a3bca288ab328a34a99ac57 for motivation. Test: policy compiles Test: Policy doesn't compile if 855084960feb9e593a3bca288ab328a34a99ac57 is reverted. Change-Id: Iee6b6273bc2a24b1220861fd662573e76001defc
2018-08-15 18:55:27 +02:00
$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
service_contexts: don't delete intermediate on failure When service_contexts fails to build, the file is deleted leaving only the error message for debugging. Build service_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ib9dcbf21d0a28700d500cf0ea4e412b009758d5d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 23:17:38 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
service_context: split into platform and non-platform components. Bug: 33746484 Test: Successfully boot with original service and property contexts. Successfully boot with split serivce and property contexts. Change-Id: Ide67d37d85273c60b9e387e72fbeb87be6da306a Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-12-28 00:10:48 +01:00
$(LOCAL_BUILT_MODULE): $(plat_service_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
service_contexts: don't delete intermediate on failure When service_contexts fails to build, the file is deleted leaving only the error message for debugging. Build service_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ib9dcbf21d0a28700d500cf0ea4e412b009758d5d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 23:17:38 +02:00
@mkdir -p $(dir $@)
service_contexts: strip blank lines and comments Strip whitespace and comments from service_context files to reduce size. On an aosp_x86_64 build it saves 36 bytes. However, on builds with more synclines and comments, further space savings can be realized. Change-Id: I3cb4effad1d1b404bf53605a3793e3070cb95651 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-04-06 20:53:04 +02:00
sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
Restore checkfc and neverallow checks. Bug: 33388095 Test: Builds and boots. Change-Id: Ief9064a16fc733bed54eb76f509ff5aaf5db4baf
2016-12-07 20:27:47 +01:00
$(HOST_OUT_EXECUTABLES)/checkfc -s $(PRIVATE_SEPOLICY) $@
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
service_context: split into platform and non-platform components. Bug: 33746484 Test: Successfully boot with original service and property contexts. Successfully boot with split serivce and property contexts. Change-Id: Ide67d37d85273c60b9e387e72fbeb87be6da306a Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-12-28 00:10:48 +01:00
built_plat_svc := $(LOCAL_BUILT_MODULE)
plat_svcfiles :=
plat_service_contexts.tmp :=
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
Add mac_permissions.xml file. This was moved from external/mac-policy.git
2012-07-30 15:33:03 +02:00
##################################
Don't create nonplat_service_contexts on full_treble devices On full Treble devices, servicemanager should only host services served from processes on /system; nonplat_service_contexts should not be created at all in this case. Bug: 36866029 Test: Build marlin and make sure nonplat_service_contexts is not created. Change-Id: Id02c314abbb98fc69884198779488c52231d22c3 Merged-In: Id02c314abbb98fc69884198779488c52231d22c3
2017-09-05 15:51:52 +02:00
# nonplat_service_contexts is only allowed on non-full-treble devices
Use PRODUCT_SEPOLICY_SPLIT for full Treble. PRODUCT_FULL_TREBLE is being broken up into smaller, more manageable components. Bug: 62019611 Test: manual Change-Id: I9b65f120851d9ea134a0059a417f0282777717fc
2017-11-09 20:24:56 +01:00
ifneq ($(PRODUCT_SEPOLICY_SPLIT),true)
Don't create nonplat_service_contexts on full_treble devices On full Treble devices, servicemanager should only host services served from processes on /system; nonplat_service_contexts should not be created at all in this case. Bug: 36866029 Test: Build marlin and make sure nonplat_service_contexts is not created. Change-Id: Id02c314abbb98fc69884198779488c52231d22c3 Merged-In: Id02c314abbb98fc69884198779488c52231d22c3
2017-09-05 15:51:52 +02:00
Add mac_permissions.xml file. This was moved from external/mac-policy.git
2012-07-30 15:33:03 +02:00
include $(CLEAR_VARS)
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
LOCAL_MODULE := vendor_service_contexts
Generate general versions of the other contexts files for tests. Generate general forms of the remaining *_contexts files with only the device-independent entries for use in CTS testing. Change-Id: I2bf0e41db8a73c26754cedd92cbc3783ff03d6b5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 22:45:03 +01:00
LOCAL_MODULE_CLASS := ETC
service_context: split into platform and non-platform components. Bug: 33746484 Test: Successfully boot with original service and property contexts. Successfully boot with split serivce and property contexts. Change-Id: Ide67d37d85273c60b9e387e72fbeb87be6da306a Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-12-28 00:10:48 +01:00
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Generate general versions of the other contexts files for tests. Generate general forms of the remaining *_contexts files with only the device-independent entries for use in CTS testing. Change-Id: I2bf0e41db8a73c26754cedd92cbc3783ff03d6b5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 22:45:03 +01:00
include $(BUILD_SYSTEM)/base_rules.mk
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
vendor_svcfiles := $(call build_policy, service_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
service_context: split into platform and non-platform components. Bug: 33746484 Test: Successfully boot with original service and property contexts. Successfully boot with split serivce and property contexts. Change-Id: Ide67d37d85273c60b9e387e72fbeb87be6da306a Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-12-28 00:10:48 +01:00
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
vendor_service_contexts.tmp := $(intermediates)/vendor_service_contexts.tmp
$(vendor_service_contexts.tmp): PRIVATE_SVC_FILES := $(vendor_svcfiles)
$(vendor_service_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(vendor_service_contexts.tmp): $(vendor_svcfiles)
service_contexts: don't delete intermediate on failure When service_contexts fails to build, the file is deleted leaving only the error message for debugging. Build service_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ib9c9247d36e6a6406b4df84d10e982921c07d492 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 23:17:38 +02:00
@mkdir -p $(dir $@)
m4: add --fatal-warnings Error out if m4 generates a warning. This will help detect and prevent malformed macros. See 855084960feb9e593a3bca288ab328a34a99ac57 for motivation. Test: policy compiles Test: Policy doesn't compile if 855084960feb9e593a3bca288ab328a34a99ac57 is reverted. Change-Id: Iee6b6273bc2a24b1220861fd662573e76001defc
2018-08-15 18:55:27 +02:00
$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
service_contexts: don't delete intermediate on failure When service_contexts fails to build, the file is deleted leaving only the error message for debugging. Build service_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ib9c9247d36e6a6406b4df84d10e982921c07d492 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 23:17:38 +02:00
service_context: split into platform and non-platform components. Bug: 33746484 Test: Successfully boot with original service and property contexts. Successfully boot with split serivce and property contexts. Change-Id: Ide67d37d85273c60b9e387e72fbeb87be6da306a Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-12-28 00:10:48 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
$(LOCAL_BUILT_MODULE): $(vendor_service_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
service_contexts: don't delete intermediate on failure When service_contexts fails to build, the file is deleted leaving only the error message for debugging. Build service_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ib9dcbf21d0a28700d500cf0ea4e412b009758d5d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 23:17:38 +02:00
@mkdir -p $(dir $@)
service_contexts: strip blank lines and comments Strip whitespace and comments from service_context files to reduce size. On an aosp_x86_64 build it saves 36 bytes. However, on builds with more synclines and comments, further space savings can be realized. Change-Id: I3cb4effad1d1b404bf53605a3793e3070cb95651 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-04-06 20:53:04 +02:00
sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
Restore checkfc and neverallow checks. Bug: 33388095 Test: Builds and boots. Change-Id: Ief9064a16fc733bed54eb76f509ff5aaf5db4baf
2016-12-07 20:27:47 +01:00
$(hide) $(HOST_OUT_EXECUTABLES)/checkfc -s $(PRIVATE_SEPOLICY) $@
service_contexts: don't delete intermediate on failure When service_contexts fails to build, the file is deleted leaving only the error message for debugging. Build service_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ib9dcbf21d0a28700d500cf0ea4e412b009758d5d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 23:17:38 +02:00
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
built_vendor_svc := $(LOCAL_BUILT_MODULE)
vendor_svcfiles :=
vendor_service_contexts.tmp :=
Generate general versions of the other contexts files for tests. Generate general forms of the remaining *_contexts files with only the device-independent entries for use in CTS testing. Change-Id: I2bf0e41db8a73c26754cedd92cbc3783ff03d6b5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 22:45:03 +01:00
Don't create nonplat_service_contexts on full_treble devices On full Treble devices, servicemanager should only host services served from processes on /system; nonplat_service_contexts should not be created at all in this case. Bug: 36866029 Test: Build marlin and make sure nonplat_service_contexts is not created. Change-Id: Id02c314abbb98fc69884198779488c52231d22c3 Merged-In: Id02c314abbb98fc69884198779488c52231d22c3
2017-09-05 15:51:52 +02:00
endif
Generate general versions of the other contexts files for tests. Generate general forms of the remaining *_contexts files with only the device-independent entries for use in CTS testing. Change-Id: I2bf0e41db8a73c26754cedd92cbc3783ff03d6b5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 22:45:03 +01:00
##################################
include $(CLEAR_VARS)
Add hwservice_contexts and support for querying it. hwservicemanager can check hwservice_contexts files both from the framework and vendor partitions. Initially, have a wildcard '*' in hwservice_contexts that maps to a label that can be added/found from domain. This needs to be removed when the proper policy is in place. Also, grant su/shell access to hwservicemanager list operations, so tools like 'lshal' continue to work. Bug: 34454312 Test: Marlin boots Change-Id: I3a02d97a82458692b528d85c1b8e78b6f82ea1bc
2017-04-08 01:14:43 +02:00
LOCAL_MODULE := plat_hwservice_contexts
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
Use PRODUCT_SEPOLICY_SPLIT for full Treble. PRODUCT_FULL_TREBLE is being broken up into smaller, more manageable components. Bug: 62019611 Test: manual Change-Id: I9b65f120851d9ea134a0059a417f0282777717fc
2017-11-09 20:24:56 +01:00
ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Add hwservice_contexts and support for querying it. hwservicemanager can check hwservice_contexts files both from the framework and vendor partitions. Initially, have a wildcard '*' in hwservice_contexts that maps to a label that can be added/found from domain. This needs to be removed when the proper policy is in place. Also, grant su/shell access to hwservicemanager list operations, so tools like 'lshal' continue to work. Bug: 34454312 Test: Marlin boots Change-Id: I3a02d97a82458692b528d85c1b8e78b6f82ea1bc
2017-04-08 01:14:43 +02:00
LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
else
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
endif
include $(BUILD_SYSTEM)/base_rules.mk
Separate product_hwservice_contexts out of system sepolicy. Bug: 119305624 Test: normal/recovery boot aosp_taimen Change-Id: I1009745686acd51563378dac56e857be0d60e794
2018-12-21 01:13:10 +01:00
plat_hwsvcfiles := $(call build_policy, hwservice_contexts, $(PLAT_PRIVATE_POLICY))
Add hwservice_contexts and support for querying it. hwservicemanager can check hwservice_contexts files both from the framework and vendor partitions. Initially, have a wildcard '*' in hwservice_contexts that maps to a label that can be added/found from domain. This needs to be removed when the proper policy is in place. Also, grant su/shell access to hwservicemanager list operations, so tools like 'lshal' continue to work. Bug: 34454312 Test: Marlin boots Change-Id: I3a02d97a82458692b528d85c1b8e78b6f82ea1bc
2017-04-08 01:14:43 +02:00
plat_hwservice_contexts.tmp := $(intermediates)/plat_hwservice_contexts.tmp
$(plat_hwservice_contexts.tmp): PRIVATE_SVC_FILES := $(plat_hwsvcfiles)
$(plat_hwservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(plat_hwservice_contexts.tmp): $(plat_hwsvcfiles)
@mkdir -p $(dir $@)
m4: add --fatal-warnings Error out if m4 generates a warning. This will help detect and prevent malformed macros. See 855084960feb9e593a3bca288ab328a34a99ac57 for motivation. Test: policy compiles Test: Policy doesn't compile if 855084960feb9e593a3bca288ab328a34a99ac57 is reverted. Change-Id: Iee6b6273bc2a24b1220861fd662573e76001defc
2018-08-15 18:55:27 +02:00
$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
Add hwservice_contexts and support for querying it. hwservicemanager can check hwservice_contexts files both from the framework and vendor partitions. Initially, have a wildcard '*' in hwservice_contexts that maps to a label that can be added/found from domain. This needs to be removed when the proper policy is in place. Also, grant su/shell access to hwservicemanager list operations, so tools like 'lshal' continue to work. Bug: 34454312 Test: Marlin boots Change-Id: I3a02d97a82458692b528d85c1b8e78b6f82ea1bc
2017-04-08 01:14:43 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
$(LOCAL_BUILT_MODULE): $(plat_hwservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
@mkdir -p $(dir $@)
sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
$(HOST_OUT_EXECUTABLES)/checkfc -e -l $(PRIVATE_SEPOLICY) $@
plat_hwsvcfiles :=
plat_hwservice_contexts.tmp :=
##################################
include $(CLEAR_VARS)
Separate product_hwservice_contexts out of system sepolicy. Bug: 119305624 Test: normal/recovery boot aosp_taimen Change-Id: I1009745686acd51563378dac56e857be0d60e794
2018-12-21 01:13:10 +01:00
LOCAL_MODULE := product_hwservice_contexts
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_OUT_PRODUCT)/etc/selinux
include $(BUILD_SYSTEM)/base_rules.mk
product_hwsvcfiles := $(call build_policy, hwservice_contexts, $(PRODUCT_PRIVATE_POLICY))
product_hwservice_contexts.tmp := $(intermediates)/product_hwservice_contexts.tmp
$(product_hwservice_contexts.tmp): PRIVATE_SVC_FILES := $(product_hwsvcfiles)
$(product_hwservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(product_hwservice_contexts.tmp): $(product_hwsvcfiles)
@mkdir -p $(dir $@)
$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
$(LOCAL_BUILT_MODULE): $(product_hwservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc
@mkdir -p $(dir $@)
sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
$(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e -l $(PRIVATE_SEPOLICY) $@
product_hwsvcfiles :=
product_hwservice_contexts.tmp :=
##################################
include $(CLEAR_VARS)
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
LOCAL_MODULE := vendor_hwservice_contexts
Add hwservice_contexts and support for querying it. hwservicemanager can check hwservice_contexts files both from the framework and vendor partitions. Initially, have a wildcard '*' in hwservice_contexts that maps to a label that can be added/found from domain. This needs to be removed when the proper policy is in place. Also, grant su/shell access to hwservicemanager list operations, so tools like 'lshal' continue to work. Bug: 34454312 Test: Marlin boots Change-Id: I3a02d97a82458692b528d85c1b8e78b6f82ea1bc
2017-04-08 01:14:43 +02:00
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
Use PRODUCT_SEPOLICY_SPLIT for full Treble. PRODUCT_FULL_TREBLE is being broken up into smaller, more manageable components. Bug: 62019611 Test: manual Change-Id: I9b65f120851d9ea134a0059a417f0282777717fc
2017-11-09 20:24:56 +01:00
ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Add hwservice_contexts and support for querying it. hwservicemanager can check hwservice_contexts files both from the framework and vendor partitions. Initially, have a wildcard '*' in hwservice_contexts that maps to a label that can be added/found from domain. This needs to be removed when the proper policy is in place. Also, grant su/shell access to hwservicemanager list operations, so tools like 'lshal' continue to work. Bug: 34454312 Test: Marlin boots Change-Id: I3a02d97a82458692b528d85c1b8e78b6f82ea1bc
2017-04-08 01:14:43 +02:00
LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
else
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
endif
include $(BUILD_SYSTEM)/base_rules.mk
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
vendor_hwsvcfiles := $(call build_policy, hwservice_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
Add hwservice_contexts and support for querying it. hwservicemanager can check hwservice_contexts files both from the framework and vendor partitions. Initially, have a wildcard '*' in hwservice_contexts that maps to a label that can be added/found from domain. This needs to be removed when the proper policy is in place. Also, grant su/shell access to hwservicemanager list operations, so tools like 'lshal' continue to work. Bug: 34454312 Test: Marlin boots Change-Id: I3a02d97a82458692b528d85c1b8e78b6f82ea1bc
2017-04-08 01:14:43 +02:00
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
vendor_hwservice_contexts.tmp := $(intermediates)/vendor_hwservice_contexts.tmp
$(vendor_hwservice_contexts.tmp): PRIVATE_SVC_FILES := $(vendor_hwsvcfiles)
$(vendor_hwservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(vendor_hwservice_contexts.tmp): $(vendor_hwsvcfiles)
Add hwservice_contexts and support for querying it. hwservicemanager can check hwservice_contexts files both from the framework and vendor partitions. Initially, have a wildcard '*' in hwservice_contexts that maps to a label that can be added/found from domain. This needs to be removed when the proper policy is in place. Also, grant su/shell access to hwservicemanager list operations, so tools like 'lshal' continue to work. Bug: 34454312 Test: Marlin boots Change-Id: I3a02d97a82458692b528d85c1b8e78b6f82ea1bc
2017-04-08 01:14:43 +02:00
@mkdir -p $(dir $@)
m4: add --fatal-warnings Error out if m4 generates a warning. This will help detect and prevent malformed macros. See 855084960feb9e593a3bca288ab328a34a99ac57 for motivation. Test: policy compiles Test: Policy doesn't compile if 855084960feb9e593a3bca288ab328a34a99ac57 is reverted. Change-Id: Iee6b6273bc2a24b1220861fd662573e76001defc
2018-08-15 18:55:27 +02:00
$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
Add hwservice_contexts and support for querying it. hwservicemanager can check hwservice_contexts files both from the framework and vendor partitions. Initially, have a wildcard '*' in hwservice_contexts that maps to a label that can be added/found from domain. This needs to be removed when the proper policy is in place. Also, grant su/shell access to hwservicemanager list operations, so tools like 'lshal' continue to work. Bug: 34454312 Test: Marlin boots Change-Id: I3a02d97a82458692b528d85c1b8e78b6f82ea1bc
2017-04-08 01:14:43 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
$(LOCAL_BUILT_MODULE): $(vendor_hwservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
Add hwservice_contexts and support for querying it. hwservicemanager can check hwservice_contexts files both from the framework and vendor partitions. Initially, have a wildcard '*' in hwservice_contexts that maps to a label that can be added/found from domain. This needs to be removed when the proper policy is in place. Also, grant su/shell access to hwservicemanager list operations, so tools like 'lshal' continue to work. Bug: 34454312 Test: Marlin boots Change-Id: I3a02d97a82458692b528d85c1b8e78b6f82ea1bc
2017-04-08 01:14:43 +02:00
@mkdir -p $(dir $@)
sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
$(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e -l $(PRIVATE_SEPOLICY) $@
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
vendor_hwsvcfiles :=
vendor_hwservice_contexts.tmp :=
Add /odm/etc/selinux/odm_hwservice_contexts Bug: 64240127 Test: normal boot and recovery boot a device Change-Id: I22d29e8476380d19aca1be359e0228ab6bbc3b0f
2017-11-29 09:16:26 +01:00
##################################
include $(CLEAR_VARS)
LOCAL_MODULE := odm_hwservice_contexts
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux
include $(BUILD_SYSTEM)/base_rules.mk
odm_hwsvcfiles := $(call build_policy, hwservice_contexts, $(BOARD_ODM_SEPOLICY_DIRS))
odm_hwservice_contexts.tmp := $(intermediates)/odm_hwservice_contexts.tmp
$(odm_hwservice_contexts.tmp): PRIVATE_SVC_FILES := $(odm_hwsvcfiles)
$(odm_hwservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(odm_hwservice_contexts.tmp): $(odm_hwsvcfiles)
@mkdir -p $(dir $@)
m4: add --fatal-warnings Error out if m4 generates a warning. This will help detect and prevent malformed macros. See 855084960feb9e593a3bca288ab328a34a99ac57 for motivation. Test: policy compiles Test: Policy doesn't compile if 855084960feb9e593a3bca288ab328a34a99ac57 is reverted. Change-Id: Iee6b6273bc2a24b1220861fd662573e76001defc
2018-08-15 18:55:27 +02:00
$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
Add /odm/etc/selinux/odm_hwservice_contexts Bug: 64240127 Test: normal boot and recovery boot a device Change-Id: I22d29e8476380d19aca1be359e0228ab6bbc3b0f
2017-11-29 09:16:26 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
$(LOCAL_BUILT_MODULE): $(odm_hwservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
@mkdir -p $(dir $@)
sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
$(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e -l $(PRIVATE_SEPOLICY) $@
odm_hwsvcfiles :=
odm_hwservice_contexts.tmp :=
Add hwservice_contexts and support for querying it. hwservicemanager can check hwservice_contexts files both from the framework and vendor partitions. Initially, have a wildcard '*' in hwservice_contexts that maps to a label that can be added/found from domain. This needs to be removed when the proper policy is in place. Also, grant su/shell access to hwservicemanager list operations, so tools like 'lshal' continue to work. Bug: 34454312 Test: Marlin boots Change-Id: I3a02d97a82458692b528d85c1b8e78b6f82ea1bc
2017-04-08 01:14:43 +02:00
##################################
include $(CLEAR_VARS)
Add target for vndservice_contexts. So we can limit vndservicemanager access to just vndservice_contexts. Bug: 36052864 Test: servicemanager,vndservicemanager work Change-Id: I7b132d4f616ba1edd0daf7be750d4b7174c4e188
2017-04-01 02:29:53 +02:00
LOCAL_MODULE := vndservice_contexts
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
Use PRODUCT_SEPOLICY_SPLIT for full Treble. PRODUCT_FULL_TREBLE is being broken up into smaller, more manageable components. Bug: 62019611 Test: manual Change-Id: I9b65f120851d9ea134a0059a417f0282777717fc
2017-11-09 20:24:56 +01:00
ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Add target for vndservice_contexts. So we can limit vndservicemanager access to just vndservice_contexts. Bug: 36052864 Test: servicemanager,vndservicemanager work Change-Id: I7b132d4f616ba1edd0daf7be750d4b7174c4e188
2017-04-01 02:29:53 +02:00
LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
else
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
endif
include $(BUILD_SYSTEM)/base_rules.mk
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
vnd_svcfiles := $(call build_policy, vndservice_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
Add target for vndservice_contexts. So we can limit vndservicemanager access to just vndservice_contexts. Bug: 36052864 Test: servicemanager,vndservicemanager work Change-Id: I7b132d4f616ba1edd0daf7be750d4b7174c4e188
2017-04-01 02:29:53 +02:00
vndservice_contexts.tmp := $(intermediates)/vndservice_contexts.tmp
$(vndservice_contexts.tmp): PRIVATE_SVC_FILES := $(vnd_svcfiles)
$(vndservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(vndservice_contexts.tmp): $(vnd_svcfiles)
@mkdir -p $(dir $@)
m4: add --fatal-warnings Error out if m4 generates a warning. This will help detect and prevent malformed macros. See 855084960feb9e593a3bca288ab328a34a99ac57 for motivation. Test: policy compiles Test: Policy doesn't compile if 855084960feb9e593a3bca288ab328a34a99ac57 is reverted. Change-Id: Iee6b6273bc2a24b1220861fd662573e76001defc
2018-08-15 18:55:27 +02:00
$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
Add target for vndservice_contexts. So we can limit vndservicemanager access to just vndservice_contexts. Bug: 36052864 Test: servicemanager,vndservicemanager work Change-Id: I7b132d4f616ba1edd0daf7be750d4b7174c4e188
2017-04-01 02:29:53 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
$(LOCAL_BUILT_MODULE): $(vndservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
@mkdir -p $(dir $@)
sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
Fix checkfc options order. darwin's getopt() doesn't like putting arguments in the wrong order. Test: Mac/Linux builds Change-Id: If632e9077c1b5714f91c5adaa04afb4963d9b0f5
2017-04-07 19:08:55 +02:00
$(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e -v $(PRIVATE_SEPOLICY) $@
Add target for vndservice_contexts. So we can limit vndservicemanager access to just vndservice_contexts. Bug: 36052864 Test: servicemanager,vndservicemanager work Change-Id: I7b132d4f616ba1edd0daf7be750d4b7174c4e188
2017-04-01 02:29:53 +02:00
vnd_svcfiles :=
vndservice_contexts.tmp :=
##################################
include $(CLEAR_VARS)
Split mac_permissions.xml into plat and non-plat components. Bug: 31363362 Test: Bullhead and Sailfish both build and boot w/out new denials. Change-Id: If6a451ddaab8c9b78a618c49b116a7ed766d0710
2016-12-14 22:47:55 +01:00
LOCAL_MODULE := plat_mac_permissions.xml
Add mac_permissions.xml file. This was moved from external/mac-policy.git
2012-07-30 15:33:03 +02:00
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
Split mac_permissions.xml to /system and /vendor Test: Build and boot Marlin Test: See the following in the logs: 01-01 02:10:28.756 1345 1345 D SELinuxMMAC: Using policy file /system/etc/selinux/plat_mac_permissions.xml 01-01 02:10:28.787 1345 1345 D SELinuxMMAC: Using policy file /vendor/etc/selinux/nonplat_mac_permissions.xml Bug: 36003167 Change-Id: If17490a2a5d94bfea1fa6d282282d45d67e207e9
2017-03-11 00:51:23 +01:00
LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
Add mac_permissions.xml file. This was moved from external/mac-policy.git
2012-07-30 15:33:03 +02:00
Replaceable mac_permission.xml support Support overriding ma_permissions.xml in BOARD_SEPOLICY_REPLACE Change-Id: If0bca8bf29bc431a291b6d7b20de132e68cd6a79
2012-11-30 23:59:09 +01:00
include $(BUILD_SYSTEM)/base_rules.mk
Add mac_permissions.xml file. This was moved from external/mac-policy.git
2012-07-30 15:33:03 +02:00
Revert "Revert "Dynamic insertion of pubkey to mac_permissions.xml"" This reverts commit 1446e714af0b0c358b5ecf37c5d704c96c72cf7c Hidden dependency has been resolved. Change-Id: Ia535c0b9468ea5f705dff9813186a7fa8bab84ae
2013-03-26 19:19:12 +01:00
# Build keys.conf
Split mac_permissions.xml into plat and non-plat components. Bug: 31363362 Test: Bullhead and Sailfish both build and boot w/out new denials. Change-Id: If6a451ddaab8c9b78a618c49b116a7ed766d0710
2016-12-14 22:47:55 +01:00
plat_mac_perms_keys.tmp := $(intermediates)/plat_keys.tmp
$(plat_mac_perms_keys.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
$(plat_mac_perms_keys.tmp): $(call build_policy, keys.conf, $(PLAT_PRIVATE_POLICY) $(PRODUCT_PRIVATE_POLICY))
Revert "Revert "Dynamic insertion of pubkey to mac_permissions.xml"" This reverts commit 1446e714af0b0c358b5ecf37c5d704c96c72cf7c Hidden dependency has been resolved. Change-Id: Ia535c0b9468ea5f705dff9813186a7fa8bab84ae
2013-03-26 19:19:12 +01:00
@mkdir -p $(dir $@)
m4: add --fatal-warnings Error out if m4 generates a warning. This will help detect and prevent malformed macros. See 855084960feb9e593a3bca288ab328a34a99ac57 for motivation. Test: policy compiles Test: Policy doesn't compile if 855084960feb9e593a3bca288ab328a34a99ac57 is reverted. Change-Id: Iee6b6273bc2a24b1220861fd662573e76001defc
2018-08-15 18:55:27 +02:00
$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@
Revert "Revert "Dynamic insertion of pubkey to mac_permissions.xml"" This reverts commit 1446e714af0b0c358b5ecf37c5d704c96c72cf7c Hidden dependency has been resolved. Change-Id: Ia535c0b9468ea5f705dff9813186a7fa8bab84ae
2013-03-26 19:19:12 +01:00
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
# TODO(b/119305624): Move product-specific sepolicy out of plat_mac_permissions.
all_plat_mac_perms_files := $(call build_policy, mac_permissions.xml, $(PLAT_PRIVATE_POLICY) $(PRODUCT_PRIVATE_POLICY))
Add mac_permissions.xml file. This was moved from external/mac-policy.git
2012-07-30 15:33:03 +02:00
Add keys to prerequisites of mac_permissions.xml Bug: 27954979 Change-Id: Ia0403e2dc2726523a41742e23beff29b47274392
2016-05-13 09:04:58 +02:00
# Should be synced with keys.conf.
Split mac_permissions.xml into plat and non-plat components. Bug: 31363362 Test: Bullhead and Sailfish both build and boot w/out new denials. Change-Id: If6a451ddaab8c9b78a618c49b116a7ed766d0710
2016-12-14 22:47:55 +01:00
all_plat_keys := platform media shared testkey
all_plat_keys := $(all_keys:%=$(dir $(DEFAULT_SYSTEM_DEV_CERTIFICATE))/%.x509.pem)
Add keys to prerequisites of mac_permissions.xml Bug: 27954979 Change-Id: Ia0403e2dc2726523a41742e23beff29b47274392
2016-05-13 09:04:58 +02:00
Split mac_permissions.xml into plat and non-plat components. Bug: 31363362 Test: Bullhead and Sailfish both build and boot w/out new denials. Change-Id: If6a451ddaab8c9b78a618c49b116a7ed766d0710
2016-12-14 22:47:55 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_MAC_PERMS_FILES := $(all_plat_mac_perms_files)
$(LOCAL_BUILT_MODULE): $(plat_mac_perms_keys.tmp) $(HOST_OUT_EXECUTABLES)/insertkeys.py \
$(all_plat_mac_perms_files) $(all_plat_keys)
Revert "Revert "Dynamic insertion of pubkey to mac_permissions.xml"" This reverts commit 1446e714af0b0c358b5ecf37c5d704c96c72cf7c Hidden dependency has been resolved. Change-Id: Ia535c0b9468ea5f705dff9813186a7fa8bab84ae
2013-03-26 19:19:12 +01:00
@mkdir -p $(dir $@)
Make DEFAULT_SYSTEM_DEV_CERTIFICATE available in keys.conf In 9af6f1bd59ee2fb0622db8ff25c4806c5527a0b3, the -d option was dropped from insertkeys.py. This was done to allow an Android distribution to replace the default version of keys.conf distributed in external/sepolicy/keys.conf. keys.conf was modified to reference the publicly known test keys in build/target/product/security. Unfortunately, this broke Google's build of Android. Instead of incorporating our keys directory, we were using the default AOSP keys. As a result, apps were getting assigned to the wrong SELinux domain. (see "Steps to reproduce" below) This change continues to allow others to replace keys.conf, but makes DEFAULT_SYSTEM_DEV_CERTIFICATE available as an environment variable in case the customized version wants to make reference to it. This change also modifies the stock version of keys.conf to use DEFAULT_SYSTEM_DEV_CERTIFICATE, which should be appropriate for most Android distributions. It doesn't make any sense to force each OEM to have a copy of this file. Steps to reproduce. 1) Compile and boot Android. 2) Run the following command: "adb shell ps -Z | grep process.media" Expected: $ adb shell ps -Z | grep process.media u:r:media_app:s0 u0_a5 1332 202 android.process.media Actual: $ adb shell ps -Z | grep process.media u:r:untrusted_app:s0 u0_a5 3617 187 android.process.media Bug: 11327304 Change-Id: Ica24fb25c5f9c0e2f4d181718c757cf372467822
2013-10-25 21:25:36 +02:00
$(hide) DEFAULT_SYSTEM_DEV_CERTIFICATE="$(dir $(DEFAULT_SYSTEM_DEV_CERTIFICATE))" \
Android.mk: drop polluting variables Some of the ALL_*_FILES variables remained that were used in a way that could not be cleared. Move them to lower case variants and use a build recipe PRIVATE_*_FILES variable. This avoids polluting the global namespace. Change-Id: I83748dab48141af7d3f10ad27fc9319eaf90b970 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-07-30 20:44:26 +02:00
$(HOST_OUT_EXECUTABLES)/insertkeys.py -t $(TARGET_BUILD_VARIANT) -c $(TOP) $< -o $@ $(PRIVATE_MAC_PERMS_FILES)
Revert "Revert "Dynamic insertion of pubkey to mac_permissions.xml"" This reverts commit 1446e714af0b0c358b5ecf37c5d704c96c72cf7c Hidden dependency has been resolved. Change-Id: Ia535c0b9468ea5f705dff9813186a7fa8bab84ae
2013-03-26 19:19:12 +01:00
Android.mk: drop polluting variables Some of the ALL_*_FILES variables remained that were used in a way that could not be cleared. Move them to lower case variants and use a build recipe PRIVATE_*_FILES variable. This avoids polluting the global namespace. Change-Id: I83748dab48141af7d3f10ad27fc9319eaf90b970 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-07-30 20:44:26 +02:00
all_mac_perms_files :=
Split mac_permissions.xml into plat and non-plat components. Bug: 31363362 Test: Bullhead and Sailfish both build and boot w/out new denials. Change-Id: If6a451ddaab8c9b78a618c49b116a7ed766d0710
2016-12-14 22:47:55 +01:00
all_plat_keys :=
plat_mac_perms_keys.tmp :=
##################################
include $(CLEAR_VARS)
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
LOCAL_MODULE := vendor_mac_permissions.xml
Split mac_permissions.xml into plat and non-plat components. Bug: 31363362 Test: Bullhead and Sailfish both build and boot w/out new denials. Change-Id: If6a451ddaab8c9b78a618c49b116a7ed766d0710
2016-12-14 22:47:55 +01:00
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
Split mac_permissions.xml to /system and /vendor Test: Build and boot Marlin Test: See the following in the logs: 01-01 02:10:28.756 1345 1345 D SELinuxMMAC: Using policy file /system/etc/selinux/plat_mac_permissions.xml 01-01 02:10:28.787 1345 1345 D SELinuxMMAC: Using policy file /vendor/etc/selinux/nonplat_mac_permissions.xml Bug: 36003167 Change-Id: If17490a2a5d94bfea1fa6d282282d45d67e207e9
2017-03-11 00:51:23 +01:00
LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
Split mac_permissions.xml into plat and non-plat components. Bug: 31363362 Test: Bullhead and Sailfish both build and boot w/out new denials. Change-Id: If6a451ddaab8c9b78a618c49b116a7ed766d0710
2016-12-14 22:47:55 +01:00
include $(BUILD_SYSTEM)/base_rules.mk
# Build keys.conf
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
vendor_mac_perms_keys.tmp := $(intermediates)/vendor_keys.tmp
$(vendor_mac_perms_keys.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(vendor_mac_perms_keys.tmp): $(call build_policy, keys.conf, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
Split mac_permissions.xml into plat and non-plat components. Bug: 31363362 Test: Bullhead and Sailfish both build and boot w/out new denials. Change-Id: If6a451ddaab8c9b78a618c49b116a7ed766d0710
2016-12-14 22:47:55 +01:00
@mkdir -p $(dir $@)
m4: add --fatal-warnings Error out if m4 generates a warning. This will help detect and prevent malformed macros. See 855084960feb9e593a3bca288ab328a34a99ac57 for motivation. Test: policy compiles Test: Policy doesn't compile if 855084960feb9e593a3bca288ab328a34a99ac57 is reverted. Change-Id: Iee6b6273bc2a24b1220861fd662573e76001defc
2018-08-15 18:55:27 +02:00
$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@
Split mac_permissions.xml into plat and non-plat components. Bug: 31363362 Test: Bullhead and Sailfish both build and boot w/out new denials. Change-Id: If6a451ddaab8c9b78a618c49b116a7ed766d0710
2016-12-14 22:47:55 +01:00
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
all_vendor_mac_perms_files := $(call build_policy, mac_permissions.xml, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
Split mac_permissions.xml into plat and non-plat components. Bug: 31363362 Test: Bullhead and Sailfish both build and boot w/out new denials. Change-Id: If6a451ddaab8c9b78a618c49b116a7ed766d0710
2016-12-14 22:47:55 +01:00
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_MAC_PERMS_FILES := $(all_vendor_mac_perms_files)
$(LOCAL_BUILT_MODULE): $(vendor_mac_perms_keys.tmp) $(HOST_OUT_EXECUTABLES)/insertkeys.py \
$(all_vendor_mac_perms_files)
Split mac_permissions.xml into plat and non-plat components. Bug: 31363362 Test: Bullhead and Sailfish both build and boot w/out new denials. Change-Id: If6a451ddaab8c9b78a618c49b116a7ed766d0710
2016-12-14 22:47:55 +01:00
@mkdir -p $(dir $@)
$(hide) $(HOST_OUT_EXECUTABLES)/insertkeys.py -t $(TARGET_BUILD_VARIANT) -c $(TOP) $< -o $@ $(PRIVATE_MAC_PERMS_FILES)
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
vendor_mac_perms_keys.tmp :=
all_vendor_mac_perms_files :=
Android.mk: drop polluting variables Some of the ALL_*_FILES variables remained that were used in a way that could not be cleared. Move them to lower case variants and use a build recipe PRIVATE_*_FILES variable. This avoids polluting the global namespace. Change-Id: I83748dab48141af7d3f10ad27fc9319eaf90b970 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-07-30 20:44:26 +02:00
Add /odm/etc/selinux/odm_mac_permissions.xml Bug: 64240127 Test: normal boot a device Change-Id: I276ba6bc88eabb0d5562e4e96d3860eedb76aed5
2017-11-29 09:06:15 +01:00
##################################
include $(CLEAR_VARS)
LOCAL_MODULE := odm_mac_permissions.xml
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux
include $(BUILD_SYSTEM)/base_rules.mk
# Build keys.conf
odm_mac_perms_keys.tmp := $(intermediates)/odm_keys.tmp
$(odm_mac_perms_keys.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(odm_mac_perms_keys.tmp): $(call build_policy, keys.conf, $(BOARD_ODM_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
@mkdir -p $(dir $@)
m4: add --fatal-warnings Error out if m4 generates a warning. This will help detect and prevent malformed macros. See 855084960feb9e593a3bca288ab328a34a99ac57 for motivation. Test: policy compiles Test: Policy doesn't compile if 855084960feb9e593a3bca288ab328a34a99ac57 is reverted. Change-Id: Iee6b6273bc2a24b1220861fd662573e76001defc
2018-08-15 18:55:27 +02:00
$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@
Add /odm/etc/selinux/odm_mac_permissions.xml Bug: 64240127 Test: normal boot a device Change-Id: I276ba6bc88eabb0d5562e4e96d3860eedb76aed5
2017-11-29 09:06:15 +01:00
all_odm_mac_perms_files := $(call build_policy, mac_permissions.xml, $(BOARD_ODM_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
$(LOCAL_BUILT_MODULE): PRIVATE_MAC_PERMS_FILES := $(all_odm_mac_perms_files)
$(LOCAL_BUILT_MODULE): $(odm_mac_perms_keys.tmp) $(HOST_OUT_EXECUTABLES)/insertkeys.py \
$(all_odm_mac_perms_files)
@mkdir -p $(dir $@)
$(hide) $(HOST_OUT_EXECUTABLES)/insertkeys.py -t $(TARGET_BUILD_VARIANT) -c $(TOP) $< -o $@ $(PRIVATE_MAC_PERMS_FILES)
odm_mac_perms_keys.tmp :=
all_odm_mac_perms_files :=
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
#################################
include $(CLEAR_VARS)
LOCAL_MODULE := sepolicy_tests
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := tests
include $(BUILD_SYSTEM)/base_rules.mk
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
all_fc_files := $(built_plat_fc) $(built_vendor_fc)
Separate product_file_contexts out of system sepolicy. Bug: 119305624 Test: boot blueline Change-Id: I3ecdeab3bb33c3cb5e80dc10ba1079c9853048f8
2018-12-19 04:51:19 +01:00
ifdef HAS_PRODUCT_SEPOLICY
all_fc_args += $(built_product_fc)
endif
Add /odm/etc/selinux/odm_file_contexts Bug: 64240127 Test: normal boot and recovery boot a device Change-Id: I087292fb23d05fc17272778d668ac78a721b2593
2017-11-29 09:14:53 +01:00
ifdef BOARD_ODM_SEPOLICY_DIRS
all_fc_files += $(built_odm_fc)
endif
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
all_fc_args := $(foreach file, $(all_fc_files), -f $(file))
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
sepolicy_tests := $(intermediates)/sepolicy_tests
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
$(sepolicy_tests): ALL_FC_ARGS := $(all_fc_args)
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
$(sepolicy_tests): PRIVATE_SEPOLICY := $(built_sepolicy)
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
$(sepolicy_tests): $(HOST_OUT_EXECUTABLES)/sepolicy_tests $(all_fc_files) $(built_sepolicy)
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
@mkdir -p $(dir $@)
Prepare python tests to be run in CTS Bug: 37008075 Test: build, all tests pass. Modify some attributes locally to cause tests to fail (verify that they are actually working). Change-Id: If9f9ece61dff835f38ef9c8a57f5a7baddbae5cd
2017-10-04 18:42:29 +02:00
$(hide) $(HOST_OUT_EXECUTABLES)/sepolicy_tests -l $(HOST_OUT)/lib64/libsepolwrap.$(SHAREDLIB_EXT) \
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
$(ALL_FC_ARGS) -p $(PRIVATE_SEPOLICY)
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
$(hide) touch $@
Build the selinux_version file. The selinux_version file is used to perform policy versioning checks by libselinux and SELinuxMMAC. When loading policy a check is first performed to determine if the policy out in /data/security/current should be used to override the base policy shipped with the device. The selinux_version file is used to make that choice. The contents of the file simply contains the BUILD_FINGERPRINT that the policy was built against. A simple string comparison is then performed by libselinux and SELinuxMMAC. Change-Id: I69d9d071743cfd46bb247c98f94a193396f8ebbd Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-03-20 14:35:08 +01:00
##################################
Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
intermediates := $(call intermediates-dir-for,ETC,built_plat_sepolicy,,,,)
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
# plat_sepolicy - the current platform policy only, built into a policy binary.
# TODO - this currently excludes partner extensions, but support should be added
# to enable partners to add their own compatibility mapping
Separate product_sepolicy.cil out of system sepolicy Product-specific sepolicy will be installed into /product/etc/selinux/*. This change separates out /product/etc/selinux/product_sepolicy.cil out of system sepolicy. This file is merged into precompiled_sepolicy at build-time. In case precompiled_sepolicy can't be used (e.g. system-only-ota), init wll merge this file with the rest of the sepolicy at runtime. I left TODOs to separate other product-specific SELinux artifacts out of system. Bug: 119305624 Test: boot aosp_taimen with product_sepolicy.cil Test: build selinux_policy for aosp_arm64; no product_sepolicy.cil produced Change-Id: Idb84a1c8ceb2de78f1460d954497c53fed08935f
2018-12-14 23:30:56 +01:00
BASE_PLAT_PUBLIC_POLICY := $(PLAT_PUBLIC_POLICY)
BASE_PLAT_PRIVATE_POLICY := $(PLAT_PRIVATE_POLICY)
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
base_plat_policy.conf := $(intermediates)/base_plat_policy.conf
$(base_plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
$(base_plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Use user policy for compatibility tests. Use the user policy when running the compatibility tests. Bug: 74344625 Test: Built policy for many devices. Booted one device. Test: Delete some compat rules, verify error on userdebug. Change-Id: Ib2df2dfc06cdf55a839011e9a528e76160a9e436
2018-03-23 20:40:26 +01:00
$(base_plat_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := user
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
$(base_plat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
$(base_plat_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
$(base_plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Use PRODUCT_SEPOLICY_SPLIT for full Treble. PRODUCT_FULL_TREBLE is being broken up into smaller, more manageable components. Bug: 62019611 Test: manual Change-Id: I9b65f120851d9ea134a0059a417f0282777717fc
2017-11-09 20:24:56 +01:00
$(base_plat_policy.conf): PRIVATE_SEPOLICY_SPLIT := true
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
$(base_plat_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
$(base_plat_policy.conf): $(call build_policy, $(sepolicy_build_files), \
$(BASE_PLAT_PUBLIC_POLICY) $(BASE_PLAT_PRIVATE_POLICY))
$(transform-policy-to-conf)
Fix building error for multi-line dontaudit statement All the *.conf.dontaudit files are generated from *.conf with the command of 'sed '/dontaudit/d' $@ > $@.dontaudit', but this command can not be applied to multi-line dontaudit statement. Test: Set plat_policy.conf.dontaudit as the input_file parameter of checkpolicy tool, then selinux syntax error will occur during building. Change-Id: I281de923d8a5f0b46256ec7de4df12a1c1d7e061
2018-09-13 08:04:19 +02:00
$(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
built_plat_sepolicy := $(intermediates)/built_plat_sepolicy
$(built_plat_sepolicy): PRIVATE_ADDITIONAL_CIL_FILES := \
$(call build_policy, $(sepolicy_build_cil_workaround_files), $(BASE_PLAT_PRIVATE_POLICY))
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
$(built_plat_sepolicy): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
$(built_plat_sepolicy): $(base_plat_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
$(HOST_OUT_EXECUTABLES)/secilc \
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
$(call build_policy, $(sepolicy_build_cil_workaround_files), $(BASE_PLAT_PRIVATE_POLICY)) \
$(built_sepolicy_neverallows)
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
@mkdir -p $(dir $@)
$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \
$(POLICYVERS) -o $@ $<
$(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $@ -o $@ -f /dev/null
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
Don't require private types in mapping file. Private types are not visible to vendor/odm policy, so we don't need mapping entries for them. We build platform-only public policy .cil file and give it as input to treble_sepolicy_tests. Using this public policy the test can now figure out if the newly added type in public or private. Bug: 116344577 Test: adding public type triggers mapping test failure, adding private type does not. Change-Id: I421f335e37274b24aa73109e260653d7b73788b5
2018-09-29 02:21:08 +02:00
base_plat_pub_policy.conf := $(intermediates)/base_plat_pub_policy.conf
$(base_plat_pub_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
$(base_plat_pub_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
$(base_plat_pub_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := user
$(base_plat_pub_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
$(base_plat_pub_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
$(base_plat_pub_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(base_plat_pub_policy.conf): PRIVATE_SEPOLICY_SPLIT := true
$(base_plat_pub_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
$(base_plat_pub_policy.conf): $(call build_policy, $(sepolicy_build_files), \
$(BASE_PLAT_PUBLIC_POLICY) $(REQD_MASK_POLICY))
$(transform-policy-to-conf)
base_plat_pub_policy.cil := $(intermediates)/base_plat_pub_policy.cil
$(base_plat_pub_policy.cil): PRIVATE_POL_CONF := $(base_plat_pub_policy.conf)
$(base_plat_pub_policy.cil): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil)
Replace "grep -f" with python util. grep can potentially run out of memory on Mac builds for large input files. So we add a python util to handle filtering out files. We will also need this util to filter plat_sepolicy.cil out of product_sepolicy.cil Bug: 119305624 Test: boot aosp_taimen Change-Id: I61cd68f407ea5de43a06bf522a5fc149e5067e8c
2018-12-18 01:35:41 +01:00
$(base_plat_pub_policy.cil): $(HOST_OUT_EXECUTABLES)/checkpolicy \
$(HOST_OUT_EXECUTABLES)/build_sepolicy $(base_plat_pub_policy.conf) $(reqd_policy_mask.cil)
Don't require private types in mapping file. Private types are not visible to vendor/odm policy, so we don't need mapping entries for them. We build platform-only public policy .cil file and give it as input to treble_sepolicy_tests. Using this public policy the test can now figure out if the newly added type in public or private. Bug: 116344577 Test: adding public type triggers mapping test failure, adding private type does not. Change-Id: I421f335e37274b24aa73109e260653d7b73788b5
2018-09-29 02:21:08 +02:00
@mkdir -p $(dir $@)
Replace "grep -f" with python util. grep can potentially run out of memory on Mac builds for large input files. So we add a python util to handle filtering out files. We will also need this util to filter plat_sepolicy.cil out of product_sepolicy.cil Bug: 119305624 Test: boot aosp_taimen Change-Id: I61cd68f407ea5de43a06bf522a5fc149e5067e8c
2018-12-18 01:35:41 +01:00
$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $< -C -M -c $(POLICYVERS) -o $@ $(PRIVATE_POL_CONF)
$(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) filter_out \
-f $(PRIVATE_REQD_MASK) -t $@
Don't require private types in mapping file. Private types are not visible to vendor/odm policy, so we don't need mapping entries for them. We build platform-only public policy .cil file and give it as input to treble_sepolicy_tests. Using this public policy the test can now figure out if the newly added type in public or private. Bug: 116344577 Test: adding public type triggers mapping test failure, adding private type does not. Change-Id: I421f335e37274b24aa73109e260653d7b73788b5
2018-09-29 02:21:08 +02:00
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
all_fc_files := $(built_plat_fc) $(built_vendor_fc)
Separate product_file_contexts out of system sepolicy. Bug: 119305624 Test: boot blueline Change-Id: I3ecdeab3bb33c3cb5e80dc10ba1079c9853048f8
2018-12-19 04:51:19 +01:00
ifdef HAS_PRODUCT_SEPOLICY
all_fc_files += $(built_product_fc)
endif
Add /odm/etc/selinux/odm_file_contexts Bug: 64240127 Test: normal boot and recovery boot a device Change-Id: I087292fb23d05fc17272778d668ac78a721b2593
2017-11-29 09:14:53 +01:00
ifdef BOARD_ODM_SEPOLICY_DIRS
all_fc_files += $(built_odm_fc)
endif
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
all_fc_args := $(foreach file, $(all_fc_files), -f $(file))
Refactor build rule for treble sepolicy tests. Bug: 69390067 Test: policy builds Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32
2018-02-01 01:22:35 +01:00
# Tests for Treble compatibility of current platform policy and vendor policy of
# given release version.
version_under_treble_tests := 26.0
include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
Enable treble_sepolicy_tests against 27.0 release. Bug: 69390067 Test: build sepolicy Change-Id: I4fc7438e4f825281d93a2849be9d2db819bea4ca
2018-02-01 01:50:28 +01:00
version_under_treble_tests := 27.0
include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk
Add mapping files for 28.0.[ignore.]cil Steps taken to produce the mapping files: 1. Add prebuilts/api/28.0/[plat_pub_versioned.cil|vendor_sepolicy.cil] from the /vendor/etc/selinux/[plat_pub_versioned.cil|vendor_sepolicy.cil] files built on pi-dev with lunch target aosp_arm64-eng 2. Add new file private/compat/28.0/28.0.cil by doing the following: - copy /system/etc/selinux/mapping/28.0.cil from pi-dev aosp_arm64-eng device to private/compat/28.0/28.0.cil - remove all attribute declaration statement (typeattribute ...) and sort lines alphabetically - some selinux types were added/renamed/deleted w.r.t 28 sepolicy. Find all such types using treble_sepolicy_tests_28.0 test. - for all these types figure out where to map them by looking at 27.0.[ignore.]cil files and add approprite entries to 28.0.[ignore.]cil. This change also enables treble_sepolicy_tests_28.0 and install 28.0.cil mapping onto the device. Bug: 72458734 Test: m selinux_policy Change-Id: I90e17c0b43af436da4b62c16179c198b5c74002c
2018-07-11 11:30:44 +02:00
version_under_treble_tests := 28.0
include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
BASE_PLAT_PUBLIC_POLICY :=
BASE_PLAT_PRIVATE_POLICY :=
base_plat_policy.conf :=
Don't require private types in mapping file. Private types are not visible to vendor/odm policy, so we don't need mapping entries for them. We build platform-only public policy .cil file and give it as input to treble_sepolicy_tests. Using this public policy the test can now figure out if the newly added type in public or private. Bug: 116344577 Test: adding public type triggers mapping test failure, adding private type does not. Change-Id: I421f335e37274b24aa73109e260653d7b73788b5
2018-09-29 02:21:08 +02:00
base_plat_pub_policy.conf :=
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
plat_sepolicy :=
Run Treble sepolicy tests at build time Bug: 37008075 Test: build policy on Marlin Change-Id: I53748f94c5df66fa17a53e7d0bed1be6b8603544 (cherry picked from commit e1ddc6df75d61dd8dc9a1ea00e1da60389f55556)
2017-06-01 00:36:07 +02:00
#################################
Test frozen sepolicy has not diverged from prebuilts. This will test that system/sepolicy/{public/, private/} are identical to prebuilts if PLATFORM_SEPOLICY_VERSION is not 10000.0. Bug: 74622750 Test: build policy Test: correctly catches divergence from prebuilts for frozen policies Change-Id: I2fa14b672544a021c2d42ad5968dfbac21b72f6a
2018-03-15 19:38:08 +01:00
include $(CLEAR_VARS)
LOCAL_MODULE := sepolicy_freeze_test
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := tests
include $(BUILD_SYSTEM)/base_rules.mk
base_plat_public := $(LOCAL_PATH)/public
base_plat_private := $(LOCAL_PATH)/private
base_plat_public_prebuilt := \
$(LOCAL_PATH)/prebuilts/api/$(PLATFORM_SEPOLICY_VERSION)/public
base_plat_private_prebuilt := \
$(LOCAL_PATH)/prebuilts/api/$(PLATFORM_SEPOLICY_VERSION)/private
all_frozen_files := $(call build_policy,$(sepolicy_build_files), \
$(base_plat_public) $(base_plat_private) $(base_plat_public_prebuilt) $(base_plat_private_prebuilt))
$(LOCAL_BUILT_MODULE): PRIVATE_BASE_PLAT_PUBLIC := $(base_plat_public)
$(LOCAL_BUILT_MODULE): PRIVATE_BASE_PLAT_PRIVATE := $(base_plat_private)
$(LOCAL_BUILT_MODULE): PRIVATE_BASE_PLAT_PUBLIC_PREBUILT := $(base_plat_public_prebuilt)
$(LOCAL_BUILT_MODULE): PRIVATE_BASE_PLAT_PRIVATE_PREBUILT := $(base_plat_private_prebuilt)
$(LOCAL_BUILT_MODULE): $(all_frozen_files)
ifneq ($(PLATFORM_SEPOLICY_VERSION),$(TOT_SEPOLICY_VERSION))
Exclude bug_map from the sepolicy_freeze_test. The bug_map file is only used whitelisting known test failures. It needs to change fairly often to fix new failures and it doesn't affect users, so it shouldn't matter if it diverges from prebuilts. Test: Enable this test and build with and without different bug_maps. Change-Id: I9176a6c7e9f7852a0cd7802fd121b1e86b216b22
2018-05-22 18:22:41 +02:00
@diff -rq -x bug_map $(PRIVATE_BASE_PLAT_PUBLIC_PREBUILT) $(PRIVATE_BASE_PLAT_PUBLIC)
@diff -rq -x bug_map $(PRIVATE_BASE_PLAT_PRIVATE_PREBUILT) $(PRIVATE_BASE_PLAT_PRIVATE)
Test frozen sepolicy has not diverged from prebuilts. This will test that system/sepolicy/{public/, private/} are identical to prebuilts if PLATFORM_SEPOLICY_VERSION is not 10000.0. Bug: 74622750 Test: build policy Test: correctly catches divergence from prebuilts for frozen policies Change-Id: I2fa14b672544a021c2d42ad5968dfbac21b72f6a
2018-03-15 19:38:08 +01:00
endif # ($(PLATFORM_SEPOLICY_VERSION),$(TOT_SEPOLICY_VERSION))
$(hide) touch $@
base_plat_public :=
base_plat_private :=
base_plat_public_prebuilt :=
base_plat_private_prebuilt :=
all_frozen_files :=
#################################
Add better per-device sepolicy support. This is a rewrite of the existing implementation. Three new variables are now needed to add/modify the exisitng base policy. They are, BOARD_SEPOLICY_REPLACE and BOARD_SEPOLICY_UNION which govern what files are replaced and concatenated, and BOARD_SEPOLICY_DIRS which lists the various directories that will contain the BOARD_SEPOLICY_REPLACE and BOARD_SEPOLICY_UNION policy files. Change-Id: Id33381268cef03245c56bc5242fec7da9b6c6493 Signed-off-by: rpcraig <robertpcraig@gmail.com>
2012-10-18 03:09:52 +02:00
Switch recovery to versioned policy and split into components. And do some clean up: Replace LOCAL_TARGET_ARCH with global arch specifier that won't get clobbered, clean up sepolicy.recovery's eng specification, ensure that build macros are applied across all policy generation, not just plat_policy, and make sure that all private variables are cleared and alphabetized at the end. Bug: 31363362 Bug: 31369363 Test: Boot into recovery and observe no selinux denials. Change-Id: Ibc15b097f6d19acf01f6b22bee0e083b15f4ef75
2016-12-16 00:28:44 +01:00
add_nl :=
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
build_vendor_policy :=
Add /odm/etc/selinux/odm_file_contexts Bug: 64240127 Test: normal boot and recovery boot a device Change-Id: I087292fb23d05fc17272778d668ac78a721b2593
2017-11-29 09:14:53 +01:00
build_odm_policy :=
Switch recovery to versioned policy and split into components. And do some clean up: Replace LOCAL_TARGET_ARCH with global arch specifier that won't get clobbered, clean up sepolicy.recovery's eng specification, ensure that build macros are applied across all policy generation, not just plat_policy, and make sure that all private variables are cleared and alphabetized at the end. Bug: 31363362 Bug: 31369363 Test: Boot into recovery and observe no selinux denials. Change-Id: Ibc15b097f6d19acf01f6b22bee0e083b15f4ef75
2016-12-16 00:28:44 +01:00
build_policy :=
Split file_contexts for on-device compilation. Simulate platform and non-platform split by compiling two different file_contexts files and loading them together on-device. Leave the existing file_contexts.bin in place until we're ready to build images based on the new files. Bug: 31363362 Test: Builds and boots without additional denials. Change-Id: I7248f876e2230cee3b3cbf386422063da1e3dde0 Bring back file_contexts.bin. Change-Id: Ifec2c363579151080fdec48e8bc46bbbc8c97674 Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-12-12 18:29:04 +01:00
built_plat_fc :=
Separate product_file_contexts out of system sepolicy. Bug: 119305624 Test: boot blueline Change-Id: I3ecdeab3bb33c3cb5e80dc10ba1079c9853048f8
2018-12-19 04:51:19 +01:00
built_product_fc :=
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
built_vendor_fc :=
Add /odm/etc/selinux/odm_file_contexts Bug: 64240127 Test: normal boot and recovery boot a device Change-Id: I087292fb23d05fc17272778d668ac78a721b2593
2017-11-29 09:14:53 +01:00
built_odm_fc :=
Ensure newlines are added between context config files When multiple file_contexts, service_contexts and property_contexts are processed by the m4(1) macro processor, they will fail if one or more of the intermediate files final line is not terminated by a newline. This patch adds an intervening file only containing a newline. Change-Id: Ie66b32fe477d08c69e6d6eb1725f658adc384ce4 Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-12-11 11:39:19 +01:00
built_nl :=
Test CIL policy when building it Prior to this commit, there was a bug in generated CIL where it wouldn't compile using secilc. The reason was that the build script was stripping out all lines containing "neverallow" from CIL files, accidentally removing lines which were not neverallow statements, such as lmx lines referencing app_neverallows.te. The commit fixes the build script's CIL neverallow filter to filter out only neverallow* statements, as originally intended. Moreover, to catch non-compiling CIL policy earlier in the future, this commit runs secilc on the policy at build time. In particular, it tests that platform policy compiles on its own and that nonplatform + platform + mappig policy compiles as well. Test: CIL policy builds and compiles on-device using secilc Bug: 31363362 Change-Id: I769aeb3d8c913a5599f1a2195c69460ece7f6465
2017-02-25 23:47:53 +01:00
built_plat_cil :=
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
built_plat_pub_vers_cil :=
Test CIL policy when building it Prior to this commit, there was a bug in generated CIL where it wouldn't compile using secilc. The reason was that the build script was stripping out all lines containing "neverallow" from CIL files, accidentally removing lines which were not neverallow statements, such as lmx lines referencing app_neverallows.te. The commit fixes the build script's CIL neverallow filter to filter out only neverallow* statements, as originally intended. Moreover, to catch non-compiling CIL policy earlier in the future, this commit runs secilc on the policy at build time. In particular, it tests that platform policy compiles on its own and that nonplatform + platform + mappig policy compiles as well. Test: CIL policy builds and compiles on-device using secilc Bug: 31363362 Change-Id: I769aeb3d8c913a5599f1a2195c69460ece7f6465
2017-02-25 23:47:53 +01:00
built_mapping_cil :=
property_context: split into platform and non-platform components. Bug: 33746484 Test: Successfully boot with original service and property contexts. Successfully boot with split serivce and property contexts. Change-Id: I87f95292b5860283efb2081b2223e607a52fed04 Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-12-28 01:08:44 +01:00
built_plat_pc :=
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
built_vendor_cil :=
built_vendor_pc :=
built_vendor_sc :=
Add /odm/etc/selinux/odm_sepolicy.cil This change adds the support of odm sepolicy customization, which can be configured through the newly added build varaible: - BOARD_ODM_SEPOLICY_DIRS += device/${ODM_NAME}/${BOM_NAME}/sepolicy Also moving precompiled sepolicy to /odm when BOARD_ODM_SEPOLICY_DIRS is set. On a DUT, precompiled sepolicy on /odm will override the one in /vendor. This is intentional because /odm is the hardware customization for /vendor and both should be updated together if desired. Bug: 64240127 Test: boot a device with /odm partition Change-Id: Ia8f81a78c88cbfefb3ff19e2ccd2648da6284d09
2017-11-27 04:41:33 +01:00
built_odm_cil :=
Add /odm/etc/selinux/odm_property_contexts Bug: 64240127 Test: normal boot and recovery boot a device Change-Id: Ibd71219f60644e57370c0293decf11d82f1cb35c
2017-11-29 09:15:55 +01:00
built_odm_pc :=
Add /odm/etc/selinux/odm_seapp_contexts Bug: 64240127 Test: normal boot a device Change-Id: I3626357237cc18a99511f1ebd9dd3ff5a7655963
2017-11-29 09:15:28 +01:00
built_odm_sc :=
Split seapp_contexts into plat and nonplat components. Bug: 33746381 Test: Device boots with no extra denials. Change-Id: I2f0da92367851142e0d7df4afec8861ceaed9d3e
2016-12-22 16:15:18 +01:00
built_plat_sc :=
Precompiled kernel policy for on-device use This adds build targets for outputing precompiled kernel policy usable on devices with policy split between system and vendor partitions. On such devices, precompiled policy must reside on the vendor partition. Because such devices support updating these partitions independently of each other, the precompiled policy must reference the system partition's policy against which it was compiled. This enables init to establish whether the precompiled policy is valid for the current combination of system and vendor partitions. The referencing is performed by both the system and vendor partitions including the SHA-256 digest of the system partition's policy (plat_sepolicy.cil). Only the when the digest is the same on both partitions can the precompiled policy be used. Test: plat_sepolicy.cil.sha256 contains exactly the hex form of the SHA-256 digest of plat_sepolicy.cil Test: plat_sepolicy.cil.sha256 is identical precompiled_sepolicy.plat.sha256. Bug: 31363362 Change-Id: I9771e1aa751e25bba6e2face37d68e0ae43b33a3
2017-03-07 23:05:57 +01:00
built_precompiled_sepolicy :=
Switch recovery to versioned policy and split into components. And do some clean up: Replace LOCAL_TARGET_ARCH with global arch specifier that won't get clobbered, clean up sepolicy.recovery's eng specification, ensure that build macros are applied across all policy generation, not just plat_policy, and make sure that all private variables are cleared and alphabetized at the end. Bug: 31363362 Bug: 31369363 Test: Boot into recovery and observe no selinux denials. Change-Id: Ibc15b097f6d19acf01f6b22bee0e083b15f4ef75
2016-12-16 00:28:44 +01:00
built_sepolicy :=
Improve neverallow error messages and allow disabling them on userdebug builds. This patch adds a flag that can be used to ignore neverallow rules. By adding SELINUX_IGNORE_NEVERALLOWS := true into the BoardConfig.mk file, neverallow violations will be ignored silently. This flag can only be enabled on userdebug and eng builds. Users of this flag should be very careful. Since it does not work on user builds, it must be disabled to pass CTS, and enabling it for too long could hide issues that need to be addressed. As a happy side effect, this patch should also improve the error messages when violating a neverallow rules. Specifically, the file and line number should be correct. Bug: 70950899 Bug: 33960443 Test: Built walleye-{user,eng} with and without this new option and a neverallow violation. Built policy for all targets. Change-Id: Id0d65123cdd230d6b90faa6bb460d544054bb906
2018-01-04 01:53:24 +01:00
built_sepolicy_neverallows :=
service_context: split into platform and non-platform components. Bug: 33746484 Test: Successfully boot with original service and property contexts. Successfully boot with split serivce and property contexts. Change-Id: Ide67d37d85273c60b9e387e72fbeb87be6da306a Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-12-28 00:10:48 +01:00
built_plat_svc :=
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
built_vendor_svc :=
Use user policy for compatibility tests. Use the user policy when running the compatibility tests. Bug: 74344625 Test: Built policy for many devices. Booted one device. Test: Delete some compat rules, verify error on userdebug. Change-Id: Ib2df2dfc06cdf55a839011e9a528e76160a9e436
2018-03-23 20:40:26 +01:00
built_plat_sepolicy :=
Retain neverallow rules in CIL files Fixes issue where attributes used exlusively in neverallow rules were removed from policy. For on-device compile use the -N flag to skip neverallow tests. Policy size increases: vendor/etc/selinux/nonplat_sepolicy.cil 547849 -> 635637 vendor/etc/selinux/precompiled_sepolicy 440248 -> 441076 system/etc/selinux/plat_sepolicy.cil 567664 -> 745230 For a total increase in system/vendor: 266182. Boot time changes: Pixel uses precompiled policy so boot time is not impacted. When forcing on-device compile on Marlin selinux policy compile time increases 510-520 ms -> 550-560 ms. Bug: 37357742 Test: Build and boot Marlin. Test: Verify both precompiled and on-device compile work. Change-Id: Ib3cb53d376a96e34f55ac27d651a6ce2fabf6ba7
2017-04-22 00:57:07 +02:00
mapping_policy :=
Switch recovery to versioned policy and split into components. And do some clean up: Replace LOCAL_TARGET_ARCH with global arch specifier that won't get clobbered, clean up sepolicy.recovery's eng specification, ensure that build macros are applied across all policy generation, not just plat_policy, and make sure that all private variables are cleared and alphabetized at the end. Bug: 31363362 Bug: 31369363 Test: Boot into recovery and observe no selinux denials. Change-Id: Ibc15b097f6d19acf01f6b22bee0e083b15f4ef75
2016-12-16 00:28:44 +01:00
my_target_arch :=
Split policy for on-device compilation. Simulate platform and non-platform split by sending the split files to the device to be compiled by init. Bug: 31363362 Test: Policy builds on-device and boots. sediff shows no difference. Change-Id: I9627d1c66ca37786d97a049666278a4992ad7579
2016-11-28 16:20:28 +01:00
plat_pub_policy.cil :=
reqd_policy_mask.cil :=
Switch recovery to versioned policy and split into components. And do some clean up: Replace LOCAL_TARGET_ARCH with global arch specifier that won't get clobbered, clean up sepolicy.recovery's eng specification, ensure that build macros are applied across all policy generation, not just plat_policy, and make sure that all private variables are cleared and alphabetized at the end. Bug: 31363362 Bug: 31369363 Test: Boot into recovery and observe no selinux denials. Change-Id: Ibc15b097f6d19acf01f6b22bee0e083b15f4ef75
2016-12-16 00:28:44 +01:00
sepolicy_build_files :=
Mark all clients of Allocator HAL This change associates all domains which are clients of Allocator HAL with hal_allocator_client and the, required for all HAL client domains, halclientdomain. This enables this commit to remove the now unnecessary hwallocator_use macro because its binder_call(..., hal_allocator_server) is covered by binder_call(hal_allocator_client, hal_allocator_server) added in this commit. Unfortunately apps, except isolated app, are clients of Allocator HAL as well. This makes it hard to use the hal_client_domain(..., hal_allocator) macro because it translates into "typeattribute" which currently does not support being provided with a set of types, such as { appdomain -isolated_app }. As a workaround, hopefully until typeattribute is improved, this commit expresses the necessary association operation in CIL. private/technical_debt.cil introduced by this commit is appended into the platform policy CIL file, thus ensuring that the hack has effect on the final monolithic policy. P. S. This change also removes Allocator HAL access from isolated_app. Isolated app shouldn't have access to this HAL anyway. Test: Google Play Music plays back radios Test: Google Camera records video with sound and that video is then successfully played back with sound Test: YouTube app plays back clips with sound Test: YouTube in Chrome plays back clips with sound Bug: 34170079 Change-Id: Id00bba6fde83e7cf04fb58bc1c353c2f66333f92
2017-03-21 22:28:53 +01:00
sepolicy_build_cil_workaround_files :=
Grant additional permissions for ASAN builds ASAN builds may require additional permissions to launch processes with ASAN wrappers. In this case, system_server needs permission to execute /system/bin/sh. Create with_asan() macro which can be used exclusively on debug builds. Note this means that ASAN builds with these additional permission will not pass the security portion of CTS - like any other debug build. Addresses: avc: denied { execute } for name="sh" dev="dm-0" ino=571 scontext=u:r:system_server:s0 tcontext=u:object_r:shell_exec:s0 tclass=file Test: lunch aosp_marlin-userdebug; cd system/sepolicy; mm SANITIZE_TARGET=address; Verify permissions granted using with_asan() are granted. Test: lunch aosp_marlin-userdebug; cd system/sepolicy; mm; Verify permissions granted using with_asan() are not granted. Test: lunch aosp_marlin-user; cd system/sepolicy; mm SANITIZE_TARGET=address; Verify permissions granted using with_asan() are not granted. Bug: 36138508 Change-Id: I6e39ada4bacd71687a593023f16b45bc16cd7ef8
2017-03-13 20:22:15 +01:00
with_asan :=
Moved Android policy tools to tools directory Change-Id: I57b0dd9f8071eae492020f410c87f465ba820711
2012-11-01 19:33:04 +01:00
include $(call all-makefiles-under,$(LOCAL_PATH))
Reference in a new issue Copy permalink