tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/definitions.mk

39 lines
1.5 KiB
Makefile
Raw Normal View History

Add sepolicy definitions.mk and create policy.conf function. Bug: 36899958 Test: Builds 'n' boots. Change-Id: I5836a18f9d0a9a976dda7304045e3b9e1e84565e Merged-In: I5836a18f9d0a9a976dda7304045e3b9e1e84565e (cherry picked from commit c0713e86790583dacbd8545d35ae476ff1f849bb)
2017-07-07 23:59:51 +02:00
# Command to turn collection of policy files into a policy.conf file to be
# processed by checkpolicy
define transform-policy-to-conf
@mkdir -p $(dir $@)
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
$(hide) $(M4) --fatal-warnings $(PRIVATE_ADDITIONAL_M4DEFS) \
Add sepolicy definitions.mk and create policy.conf function. Bug: 36899958 Test: Builds 'n' boots. Change-Id: I5836a18f9d0a9a976dda7304045e3b9e1e84565e Merged-In: I5836a18f9d0a9a976dda7304045e3b9e1e84565e (cherry picked from commit c0713e86790583dacbd8545d35ae476ff1f849bb)
2017-07-07 23:59:51 +02:00
-D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
Use user policy when checking neverallow rules. When building userdebug or eng builds, we still want to build the user policy when checking neverallow rules so that we can catch compile errors. Commit c0713e86 split out a helper function but lost one instance of using user instead of the real variant. This restores that one and adds it to the neverallow check. Bug: 74344625 Test: Added a rule that referred to a type defined only in userdebug and eng and ensure we throw a compile error when building userdebug mode. Change-Id: I1a6ffbb36dbeeb880852f9cbac880f923370c2ae (cherry picked from commit 053cb34130b763d93e2181062ebe1b5f8bf3ad9c)
2018-03-08 00:36:29 +01:00
-D target_build_variant=$(PRIVATE_TARGET_BUILD_VARIANT) \
Add sepolicy definitions.mk and create policy.conf function. Bug: 36899958 Test: Builds 'n' boots. Change-Id: I5836a18f9d0a9a976dda7304045e3b9e1e84565e Merged-In: I5836a18f9d0a9a976dda7304045e3b9e1e84565e (cherry picked from commit c0713e86790583dacbd8545d35ae476ff1f849bb)
2017-07-07 23:59:51 +02:00
-D target_with_dexpreopt=$(WITH_DEXPREOPT) \
-D target_arch=$(PRIVATE_TGT_ARCH) \
-D target_with_asan=$(PRIVATE_TGT_WITH_ASAN) \
In native coverage builds, allow all domains to access /data/misc/trace Bug: http://b/135139675 Coverage files are written to /data/misc/trace (governed by the method_trace_data_file selinux type). Allow all domains to access (create directories, access files) this directory when native coverage is enabled (by setting NATIVE_COVERAGE to true) in an userdebug or eng build. Also relax neverallow constraints to allow access to method_trace_data_file for native coverage builds. Test: Build 32-bit cuttlefish with coverage: m NATIVE_COVERAGE=true COVERAGE_PATHS="*" and verify that there are no selinux denials in kernel log and logcat. Change-Id: I3fe7c77612854b9de7de7a0ddd5cbf44a2f5c21e
2019-06-14 00:05:15 +02:00
-D target_with_native_coverage=$(PRIVATE_TGT_WITH_NATIVE_COVERAGE) \
Use PRODUCT_SEPOLICY_SPLIT for full Treble. PRODUCT_FULL_TREBLE is being broken up into smaller, more manageable components. Bug: 62019611 Test: manual Change-Id: I9b65f120851d9ea134a0059a417f0282777717fc
2017-11-09 20:24:56 +01:00
-D target_full_treble=$(PRIVATE_SEPOLICY_SPLIT) \
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
-D target_compatible_property=$(PRIVATE_COMPATIBLE_PROPERTY) \
Add BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW A new sysprop neverallow rules are mandatory only for devices launching with R or later. For devices already launched, neverallow rules can be relaxed with adding following line to BoardConfig.mk: BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true Bug: 131162102 Test: Set PRODUCT_SHIPPING_API_LEVEL := 30 and try building with changing some system_public_prop to system_internal_prop Test: m cts sepolicy_tests Change-Id: Id978b4d81a8683a57304bb639961105e2d91fa9a Merged-In: Id978b4d81a8683a57304bb639961105e2d91fa9a (cherry picked from commit 3be11e7abb8f4fd651295f9ccb0ce087855c1cc0)
2019-09-26 08:14:55 +02:00
-D target_treble_sysprop_neverallow=$(PRIVATE_TREBLE_SYSPROP_NEVERALLOW) \
Enforce sysprop owner Every property should have an appropriate owner attribute, which can be one of: system_property_type, product_property_type, or vendor_property_type. This will be enforced for devices launching with S or later. Devices launching with R or eariler can relax this by setting following under BoardConfig.mk: BUILD_BROKEN_ENFORCE_SYSPROP_OWNER := true Bug: 131162102 Test: system/sepolicy/tools/build_policies.sh Change-Id: I7914ef1b7463c9ec00812b9720094531fd63f0c7
2020-09-28 06:32:43 +02:00
-D target_enforce_sysprop_owner=$(PRIVATE_ENFORCE_SYSPROP_OWNER) \
Mechanism to exclude neverallows from *TS. build_test_only is used to denote rules that should not verified as part of compliance testing. Use this macro to exclude neverallow rules which we want to check as part of build, but not CTS. Bug: 80499271 Test: SELinuxNeverallowRulesTest on walleye has no more failure of type "Type or attribute * used in neverallow undefined in policy being checked." Number of failing test cases is reduced by 142. Test: policy.conf used to check neverallows at build-time still retains all neverallow rules. Change-Id: I5f1b383d9096bb5a7b8c0f1bc008b5dd07419580
2018-06-05 23:11:08 +02:00
-D target_exclude_build_test=$(PRIVATE_EXCLUDE_BUILD_TEST) \
sepolicy: Allow system_server to use execmem in emulator builds with software rendering. In emulator builds without OpenGL passthrough, we use software rendering via SwiftShader, which requires JIT support. Therefore, we need to allow system_server to use execmem so that it can run JITed code. These builds are never shipped to users. Bug: 142352330 Change-Id: I4d55b5a1b4ebae2fc8198ef66107c22bde41ad7e
2019-10-16 03:10:38 +02:00
-D target_requires_insecure_execmem_for_swiftshader=$(PRODUCT_REQUIRES_INSECURE_EXECMEM_FOR_SWIFTSHADER) \
Add sepolicy definitions.mk and create policy.conf function. Bug: 36899958 Test: Builds 'n' boots. Change-Id: I5836a18f9d0a9a976dda7304045e3b9e1e84565e Merged-In: I5836a18f9d0a9a976dda7304045e3b9e1e84565e (cherry picked from commit c0713e86790583dacbd8545d35ae476ff1f849bb)
2017-07-07 23:59:51 +02:00
$(PRIVATE_TGT_RECOVERY) \
Use prebuilt m4 instead of system m4 Bug: 117561006 Test: treehugger Change-Id: Id794aed10fdffef10490561d2cfeb2a92801b331
2019-06-19 19:52:50 +02:00
-s $(PRIVATE_POLICY_FILES) > $@
Add sepolicy definitions.mk and create policy.conf function. Bug: 36899958 Test: Builds 'n' boots. Change-Id: I5836a18f9d0a9a976dda7304045e3b9e1e84565e Merged-In: I5836a18f9d0a9a976dda7304045e3b9e1e84565e (cherry picked from commit c0713e86790583dacbd8545d35ae476ff1f849bb)
2017-07-07 23:59:51 +02:00
endef
.KATI_READONLY := transform-policy-to-conf
Use file_contexts files for flattened APEXes Previously, soong emitted APEX_FILE_CONTEXTS_INFOS make var which lists "all" APEXes and file_contexts.bin used all of them regardless whether an APEX is installed or not. This doesn't work when there's a vendor specific APEX which uses vendor specific labels. Other lunch target may fail to build due to "unknown label" which is introduced by the vendor APEX which is fact not supposed to be installed. Now build/make/core/Makefile creates file_contexts.modules.tmp which is a collection of file_contexts for flattend apexes which are to be intalled. Bug: 166518492 Test: m file_contexts.bin check contents of file_contexts.concat.tmp Change-Id: I00c6b87bdc75fc1e04e6f8ecddae6f18762d888a
2020-09-23 12:16:10 +02:00
###########################################################
## Collect file_contexts files into a single tmp file with m4
##
## $(1): list of file_contexts files
## $(2): filename into which file_contexts files are merged
###########################################################
define _merge-fc-files
$(2): $(1) $(M4)
$(hide) mkdir -p $$(dir $$@)
$(hide) $(M4) --fatal-warnings -s $(1) > $$@
endef
define merge-fc-files
$(eval $(call _merge-fc-files,$(1),$(2)))
endef
Reference in a new issue Copy permalink