tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/Android.mk

412 lines
14 KiB
Makefile
Raw Normal View History

SE Android policy.
2012-01-04 18:33:27 +01:00
LOCAL_PATH:= $(call my-dir)
Support overrides in seapp_contexts Provides support for overriding seapp_contexts declerations in per device seapp_contexts files. Change-Id: I23a0ffa1d24f1ce57825b168f29a2e885d3e1c51
2012-08-28 00:41:15 +02:00
SE Android policy.
2012-01-04 18:33:27 +01:00
include $(CLEAR_VARS)
# SELinux policy version.
sepolicy: Drop BOARD_SEPOLICY_IGNORE/REPLACE support. With changes I431c1ab22fc53749f623937154b9ec43469d9645 and Ia54aa263f2245c7090f4b9d9703130c19f11bd28, it is no longer legitimate to use BOARD_SEPOLICY_IGNORE or REPLACE with any of the *_contexts files since the CTS requires the AOSP entries to be present in the device files. Further, these changes render BOARD_SEPOLICY_IGNORE unusable for most policy files since all domains and types referenced within any of the AOSP *_contexts entries must be defined in the kernel policy, so you cannot use BOARD_SEPOLICY_IGNORE to exclude any .te file that defines a type referenced in any of those *_contexts files. There does not seem to be a significant need for such a facility, as AOSP policy is small and only domains and types used by most devices should be defined in external/sepolicy. BOARD_SEPOLICY_REPLACE is commonly misused to eliminate neverallow rules from AOSP policy, which will only lead to CTS failures, especially since change Iefe508df265f62efa92f8eb74fc65542d39e3e74 introduced neverallow checking on the entire policy via sepolicy-analyze. The only remaining legitimate function of BOARD_SEPOLICY_REPLACE is to support overriding AOSP .te files with more restrictive rule sets. However, the need for this facility has been significantly reduced by the fact that AOSP policy is now fully confined + enforcing for all domains, and further restrictions beyond AOSP carry a compatibility risk. Builders of custom policies and custom ROMs still have the freedom to apply patches on top of external/sepolicy to tighten rule sets (which are likely more maintainable than maintaining a completely separate copy of the file via BOARD_SEPOLICY_REPLACE) and/or of using their own separate policy build system as exemplified by https://bitbucket.org/quarksecurity/build-policies Change-Id: I2611e983f7cbfa15f9d45ec3ea301e94132b06fa Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-13 15:03:52 +01:00
# Must be <= /sys/fs/selinux/policyvers reported by the Android kernel.
SE Android policy.
2012-01-04 18:33:27 +01:00
# Must be within the compatibility range reported by checkpolicy -V.
Update policy version to enable ioctl whitelisting Bug: 20756547 Bug: 18087110 Change-Id: I9ff76f1cf359e38c19d7b50a5b7236fd673d937e
2015-05-04 20:14:23 +02:00
POLICYVERS ?= 30
SE Android policy.
2012-01-04 18:33:27 +01:00
MLS_SENS=1
MLS_CATS=1024
sepolicy: Drop BOARD_SEPOLICY_IGNORE/REPLACE support. With changes I431c1ab22fc53749f623937154b9ec43469d9645 and Ia54aa263f2245c7090f4b9d9703130c19f11bd28, it is no longer legitimate to use BOARD_SEPOLICY_IGNORE or REPLACE with any of the *_contexts files since the CTS requires the AOSP entries to be present in the device files. Further, these changes render BOARD_SEPOLICY_IGNORE unusable for most policy files since all domains and types referenced within any of the AOSP *_contexts entries must be defined in the kernel policy, so you cannot use BOARD_SEPOLICY_IGNORE to exclude any .te file that defines a type referenced in any of those *_contexts files. There does not seem to be a significant need for such a facility, as AOSP policy is small and only domains and types used by most devices should be defined in external/sepolicy. BOARD_SEPOLICY_REPLACE is commonly misused to eliminate neverallow rules from AOSP policy, which will only lead to CTS failures, especially since change Iefe508df265f62efa92f8eb74fc65542d39e3e74 introduced neverallow checking on the entire policy via sepolicy-analyze. The only remaining legitimate function of BOARD_SEPOLICY_REPLACE is to support overriding AOSP .te files with more restrictive rule sets. However, the need for this facility has been significantly reduced by the fact that AOSP policy is now fully confined + enforcing for all domains, and further restrictions beyond AOSP carry a compatibility risk. Builders of custom policies and custom ROMs still have the freedom to apply patches on top of external/sepolicy to tighten rule sets (which are likely more maintainable than maintaining a completely separate copy of the file via BOARD_SEPOLICY_REPLACE) and/or of using their own separate policy build system as exemplified by https://bitbucket.org/quarksecurity/build-policies Change-Id: I2611e983f7cbfa15f9d45ec3ea301e94132b06fa Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-13 15:03:52 +01:00
ifdef BOARD_SEPOLICY_REPLACE
$(error BOARD_SEPOLICY_REPLACE is no longer supported; please remove from your BoardConfig.mk or other .mk file.)
endif
ifdef BOARD_SEPOLICY_IGNORE
$(error BOARD_SEPOLICY_IGNORE is no longer supported; please remove from your BoardConfig.mk or other .mk file.)
endif
Add better per-device sepolicy support. This is a rewrite of the existing implementation. Three new variables are now needed to add/modify the exisitng base policy. They are, BOARD_SEPOLICY_REPLACE and BOARD_SEPOLICY_UNION which govern what files are replaced and concatenated, and BOARD_SEPOLICY_DIRS which lists the various directories that will contain the BOARD_SEPOLICY_REPLACE and BOARD_SEPOLICY_UNION policy files. Change-Id: Id33381268cef03245c56bc5242fec7da9b6c6493 Signed-off-by: rpcraig <robertpcraig@gmail.com>
2012-10-18 03:09:52 +02:00
Drop BOARD_SEPOLICY_UNION. As suggested in the comments on https://android-review.googlesource.com/#/c/141560/ drop BOARD_SEPOLICY_UNION and simplify the build_policy logic. Union all files found under BOARD_SEPOLICY_DIRS. Unlike BOARD_SEPOLICY_REPLACE/IGNORE, on which we trigger an error to catch any lingering uses and force updating of the BoardConfig.mk files, we only warn on uses of BOARD_SEPOLICY_UNION to avoid breaking the build until all device BoardConfig*.mk files have been updated, and since they should be harmless - the files will be unioned regardless. Change-Id: I4214893c999c23631f5456cb1b8edd59771ef13b Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-04-01 16:14:56 +02:00
ifdef BOARD_SEPOLICY_UNION
$(warning BOARD_SEPOLICY_UNION is no longer required - all files found in BOARD_SEPOLICY_DIRS are implicitly unioned; please remove from your BoardConfig.mk or other .mk file.)
endif
Android.mk: Add support for BOARD_SEPOLICY_M4DEFS Allow device builders to pass arbitrary m4 definitions during the build via make variable BOARD_SEPOLICY_M4DEFS. This enables OEMs to define their own static policy build conditionals. Change-Id: Ibea1dbb7b8615576c5668e47f16ed0eedfa0b73c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-07-16 20:28:02 +02:00
ifdef BOARD_SEPOLICY_M4DEFS
LOCAL_ADDITIONAL_M4DEFS := $(addprefix -D, $(BOARD_SEPOLICY_M4DEFS))
endif
Drop BOARD_SEPOLICY_UNION. As suggested in the comments on https://android-review.googlesource.com/#/c/141560/ drop BOARD_SEPOLICY_UNION and simplify the build_policy logic. Union all files found under BOARD_SEPOLICY_DIRS. Unlike BOARD_SEPOLICY_REPLACE/IGNORE, on which we trigger an error to catch any lingering uses and force updating of the BoardConfig.mk files, we only warn on uses of BOARD_SEPOLICY_UNION to avoid breaking the build until all device BoardConfig*.mk files have been updated, and since they should be harmless - the files will be unioned regardless. Change-Id: I4214893c999c23631f5456cb1b8edd59771ef13b Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-04-01 16:14:56 +02:00
# Builds paths for all policy files found in BOARD_SEPOLICY_DIRS.
Add better per-device sepolicy support. This is a rewrite of the existing implementation. Three new variables are now needed to add/modify the exisitng base policy. They are, BOARD_SEPOLICY_REPLACE and BOARD_SEPOLICY_UNION which govern what files are replaced and concatenated, and BOARD_SEPOLICY_DIRS which lists the various directories that will contain the BOARD_SEPOLICY_REPLACE and BOARD_SEPOLICY_UNION policy files. Change-Id: Id33381268cef03245c56bc5242fec7da9b6c6493 Signed-off-by: rpcraig <robertpcraig@gmail.com>
2012-10-18 03:09:52 +02:00
# $(1): the set of policy name paths to build
Don't assume ordering of $(wildcard ...) There are no guarantees on the order of the results from a call to the wildcard function. In fact, the order usually changes between make 3.81 and make 4.0 (and kati). Instead, sort the results of wildcard in each sepolicy directory, so that directory order is preserved, but content ordering is reliable. Change-Id: I1620f89bbdd2b2902f2e0c40526e893ccf5f7775
2015-08-11 00:40:52 +02:00
build_policy = $(foreach type, $(1), $(foreach file, $(addsuffix /$(type), $(LOCAL_PATH) $(BOARD_SEPOLICY_DIRS)), $(sort $(wildcard $(file)))))
Add support for per-device .te and .fc files.
2012-03-06 17:12:41 +01:00
Generate selinux_policy.xml as part of CTS build. Bug: 16563899 Bug: 14251916 Change-Id: Id3172b73f10186ba361caf6b7333e5d2a0648475
2014-07-26 04:11:52 +02:00
sepolicy_build_files := security_classes \
initial_sids \
access_vectors \
global_macros \
recovery.te: add /data neverallow rules Recovery should never be accessing files from /data. In particular, /data may be encrypted, and the files within /data will be inaccessible to recovery, because recovery doesn't know the decryption key. Enforce write/execute restrictions on recovery. We can't tighten it up further because domain.te contains some /data read-only access rules, which shouldn't apply to recovery but do. Create neverallow_macros, used for storing permission macros useful for neverallow rules. Standardize recovery.te and property_data_file on the new macros. Change-Id: I02346ab924fe2fdb2edc7659cb68c4f8dffa1e88
2014-11-06 00:30:41 +01:00
neverallow_macros \
Generate selinux_policy.xml as part of CTS build. Bug: 16563899 Bug: 14251916 Change-Id: Id3172b73f10186ba361caf6b7333e5d2a0648475
2014-07-26 04:11:52 +02:00
mls_macros \
mls \
policy_capabilities \
te_macros \
attributes \
restrict app access to socket ioctls Create a macro of unprivileged ioctls including - All common socket ioctls except MAC address - All wireless extensions ioctls except get/set ESSID - Some commonly used tty ioctls Bug: 21657002 Change-Id: Ib08be9cb70d08c1fa2c8bddbae519e7c2df5293c
2015-06-06 00:28:55 +02:00
ioctl_macros \
Generate selinux_policy.xml as part of CTS build. Bug: 16563899 Bug: 14251916 Change-Id: Id3172b73f10186ba361caf6b7333e5d2a0648475
2014-07-26 04:11:52 +02:00
*.te \
roles \
users \
initial_sid_contexts \
fs_use \
genfs_contexts \
port_contexts
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
##################################
include $(CLEAR_VARS)
LOCAL_MODULE := sepolicy
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
include $(BUILD_SYSTEM)/base_rules.mk
sepolicy_policy.conf := $(intermediates)/policy.conf
$(sepolicy_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
$(sepolicy_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Android.mk: Add support for BOARD_SEPOLICY_M4DEFS Allow device builders to pass arbitrary m4 definitions during the build via make variable BOARD_SEPOLICY_M4DEFS. This enables OEMs to define their own static policy build conditionals. Change-Id: Ibea1dbb7b8615576c5668e47f16ed0eedfa0b73c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-07-16 20:28:02 +02:00
$(sepolicy_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
correct colon usage on make targets Change-Id: If944d8bd1e324f6500920ee3c5d44611ec7f8af9 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-27 16:22:34 +02:00
$(sepolicy_policy.conf): $(call build_policy, $(sepolicy_build_files))
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
@mkdir -p $(dir $@)
Android.mk: Add support for BOARD_SEPOLICY_M4DEFS Allow device builders to pass arbitrary m4 definitions during the build via make variable BOARD_SEPOLICY_M4DEFS. This enables OEMs to define their own static policy build conditionals. Change-Id: Ibea1dbb7b8615576c5668e47f16ed0eedfa0b73c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-07-16 20:28:02 +02:00
$(hide) m4 $(PRIVATE_ADDITIONAL_M4DEFS) \
-D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
Support forcing permissive domains to unconfined. Permissive domains are only intended for development. When a device launches, we want to ensure that all permissive domains are in, at a minimum, unconfined+enforcing. Add FORCE_PERMISSIVE_TO_UNCONFINED to Android.mk. During development, this flag is false, and permissive domains are allowed. When SELinux new feature development has been frozen immediately before release, this flag will be flipped to true. Any previously permissive domains will move into unconfined+enforcing. This will ensure that all SELinux domains have at least a minimal level of protection. Unconditionally enable this flag for all user builds. Change-Id: I1632f0da0022c80170d8eb57c82499ac13fd7858
2014-01-11 10:31:03 +01:00
-D target_build_variant=$(TARGET_BUILD_VARIANT) \
-s $^ > $@
Various policy updates. Assortment of policy changes include: * Bluetooth domain to talk to init and procfs. * New device node domains. * Allow zygote to talk to its executable. * Update system domain access to new device node domains. * Create a post-process sepolicy with dontaudits removed. * Allow rild to use the tty device. Change-Id: Ibb96b590d0035b8f6d1606cd5e4393c174d10ffb Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2013-03-27 11:30:25 +01:00
$(hide) sed '/dontaudit/d' $@ > $@.dontaudit
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
correct colon usage on make targets Change-Id: If944d8bd1e324f6500920ee3c5d44611ec7f8af9 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-27 16:22:34 +02:00
$(LOCAL_BUILT_MODULE): $(sepolicy_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
@mkdir -p $(dir $@)
Use the checkpolicy built from source. Change-Id: I22f49db3d59b50ed8975d8c1146bb9c322adbf7e
2012-04-10 00:31:03 +02:00
$(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c $(POLICYVERS) -o $@ $<
Various policy updates. Assortment of policy changes include: * Bluetooth domain to talk to init and procfs. * New device node domains. * Allow zygote to talk to its executable. * Update system domain access to new device node domains. * Create a post-process sepolicy with dontaudits removed. * Allow rild to use the tty device. Change-Id: Ibb96b590d0035b8f6d1606cd5e4393c174d10ffb Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2013-03-27 11:30:25 +01:00
$(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c $(POLICYVERS) -o $(dir $<)/$(notdir $@).dontaudit $<.dontaudit
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
Use file target as dependency. "sepolicy" is a phony target defined by the build system. If you use it as dependency of a file target, you'll get unnecessary rebuild. Change-Id: I3a948ebbaff6a146050eb86a3d04cdc050f7c001
2012-10-26 04:01:31 +02:00
built_sepolicy := $(LOCAL_BUILT_MODULE)
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
sepolicy_policy.conf :=
Add a checkfc utility to check file_contexts validity and invoke it. Change-Id: I4b12dc3dcb432edbdf95dd3bc97f809912ce86d1 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2012-10-02 18:46:37 +02:00
Create a separate recovery policy. Create a separate recovery policy and only include the recovery domain allow rules in it. Change-Id: I444107f9821eabf4164ba07a44d03bd71e719989 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-05-29 22:40:15 +02:00
##################################
include $(CLEAR_VARS)
LOCAL_MODULE := sepolicy.recovery
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := eng
include $(BUILD_SYSTEM)/base_rules.mk
sepolicy_policy_recovery.conf := $(intermediates)/policy_recovery.conf
$(sepolicy_policy_recovery.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
$(sepolicy_policy_recovery.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Android.mk: Add support for BOARD_SEPOLICY_M4DEFS Allow device builders to pass arbitrary m4 definitions during the build via make variable BOARD_SEPOLICY_M4DEFS. This enables OEMs to define their own static policy build conditionals. Change-Id: Ibea1dbb7b8615576c5668e47f16ed0eedfa0b73c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-07-16 20:28:02 +02:00
$(sepolicy_policy_recovery.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
correct colon usage on make targets Change-Id: If944d8bd1e324f6500920ee3c5d44611ec7f8af9 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-27 16:22:34 +02:00
$(sepolicy_policy_recovery.conf): $(call build_policy, $(sepolicy_build_files))
Create a separate recovery policy. Create a separate recovery policy and only include the recovery domain allow rules in it. Change-Id: I444107f9821eabf4164ba07a44d03bd71e719989 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-05-29 22:40:15 +02:00
@mkdir -p $(dir $@)
Android.mk: Add support for BOARD_SEPOLICY_M4DEFS Allow device builders to pass arbitrary m4 definitions during the build via make variable BOARD_SEPOLICY_M4DEFS. This enables OEMs to define their own static policy build conditionals. Change-Id: Ibea1dbb7b8615576c5668e47f16ed0eedfa0b73c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-07-16 20:28:02 +02:00
$(hide) m4 $(PRIVATE_ADDITIONAL_M4DEFS) \
-D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
Create a separate recovery policy. Create a separate recovery policy and only include the recovery domain allow rules in it. Change-Id: I444107f9821eabf4164ba07a44d03bd71e719989 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-05-29 22:40:15 +02:00
-D target_build_variant=$(TARGET_BUILD_VARIANT) \
-D target_recovery=true \
-s $^ > $@
correct colon usage on make targets Change-Id: If944d8bd1e324f6500920ee3c5d44611ec7f8af9 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-27 16:22:34 +02:00
$(LOCAL_BUILT_MODULE): $(sepolicy_policy_recovery.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy
Create a separate recovery policy. Create a separate recovery policy and only include the recovery domain allow rules in it. Change-Id: I444107f9821eabf4164ba07a44d03bd71e719989 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-05-29 22:40:15 +02:00
@mkdir -p $(dir $@)
$(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c $(POLICYVERS) -o $@ $<
built_sepolicy_recovery := $(LOCAL_BUILT_MODULE)
sepolicy_policy_recovery.conf :=
Generate selinux_policy.xml as part of CTS build. Bug: 16563899 Bug: 14251916 Change-Id: Id3172b73f10186ba361caf6b7333e5d2a0648475
2014-07-26 04:11:52 +02:00
##################################
include $(CLEAR_VARS)
LOCAL_MODULE := general_sepolicy.conf
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := tests
include $(BUILD_SYSTEM)/base_rules.mk
exp_sepolicy_build_files :=\
Don't assume ordering of $(wildcard ...) There are no guarantees on the order of the results from a call to the wildcard function. In fact, the order usually changes between make 3.81 and make 4.0 (and kati). Instead, sort the results of wildcard in each sepolicy directory, so that directory order is preserved, but content ordering is reliable. Change-Id: I1620f89bbdd2b2902f2e0c40526e893ccf5f7775
2015-08-11 00:40:52 +02:00
$(foreach file, $(addprefix $(LOCAL_PATH)/, $(sepolicy_build_files)), $(sort $(wildcard $(file))))
Generate selinux_policy.xml as part of CTS build. Bug: 16563899 Bug: 14251916 Change-Id: Id3172b73f10186ba361caf6b7333e5d2a0648475
2014-07-26 04:11:52 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_MLS_SENS := $(MLS_SENS)
$(LOCAL_BUILT_MODULE): PRIVATE_MLS_CATS := $(MLS_CATS)
$(LOCAL_BUILT_MODULE): $(exp_sepolicy_build_files)
mkdir -p $(dir $@)
$(hide) m4 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
-D target_build_variant=user \
-s $^ > $@
$(hide) sed '/dontaudit/d' $@ > $@.dontaudit
use a general sepolicy when building general targets Change-Id: Ie800ebf9d8e68680ec377e8c51f7cd7717f3c755 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-30 01:31:23 +02:00
built_general_sepolicy.conf := $(LOCAL_BUILT_MODULE)
Generate selinux_policy.xml as part of CTS build. Bug: 16563899 Bug: 14251916 Change-Id: Id3172b73f10186ba361caf6b7333e5d2a0648475
2014-07-26 04:11:52 +02:00
exp_sepolicy_build_files :=
##################################
Add a checkfc utility to check file_contexts validity and invoke it. Change-Id: I4b12dc3dcb432edbdf95dd3bc97f809912ce86d1 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2012-10-02 18:46:37 +02:00
include $(CLEAR_VARS)
use a general sepolicy when building general targets Change-Id: Ie800ebf9d8e68680ec377e8c51f7cd7717f3c755 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-30 01:31:23 +02:00
LOCAL_MODULE := sepolicy.general
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := tests
include $(BUILD_SYSTEM)/base_rules.mk
$(LOCAL_BUILT_MODULE): PRIVATE_BUILT_SEPOLICY.CONF := $(built_general_sepolicy.conf)
$(LOCAL_BUILT_MODULE): $(built_general_sepolicy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy
@mkdir -p $(dir $@)
$(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c $(POLICYVERS) -o $@ $(PRIVATE_BUILT_SEPOLICY.CONF)
built_general_sepolicy := $(LOCAL_BUILT_MODULE)
##################################
include $(CLEAR_VARS)
Update Android.mk to support file_contexts.bin This change supports external/libselinux changes to implement PCRE formatted binary file_contexts and general_file_contexts.bin files. The $(intermediates) directory will contain the original text file (that is no longer used on the device) with a .tmp extension as well as the .bin file to aid analysis. A CleanSpec.mk file is added to remove the old file_contexts file. Change-Id: I75a781100082c23536f70ce3603f7de42408b5ba Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-08-06 18:43:52 +02:00
LOCAL_MODULE := file_contexts.bin
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Add support for per-device .te and .fc files.
2012-03-06 17:12:41 +01:00
include $(BUILD_SYSTEM)/base_rules.mk
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
Correct local variables for file_contexts_asan Lowercase local variables and clear them to be consistent with other recipes and prevent polluting Make's global name space with set variables. Change-Id: If455cd4f33d5babbea985867a711e8a10c21a00f Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-29 20:16:18 +02:00
all_fc_files := file_contexts
asan: update condition to work with multiple SANITIZE_TARGET values. The goal is to enable SANITIZE_TARGET='address coverage', which will be used by LLVMFuzzer. Bug: 22850550 Change-Id: I953649186a7fae9b2495159237521f264d1de3b6
2015-09-18 21:05:51 +02:00
ifneq ($(filter address,$(SANITIZE_TARGET)),)
Correct local variables for file_contexts_asan Lowercase local variables and clear them to be consistent with other recipes and prevent polluting Make's global name space with set variables. Change-Id: If455cd4f33d5babbea985867a711e8a10c21a00f Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-29 20:16:18 +02:00
all_fc_files := $(all_fc_files) file_contexts_asan
Extend sepolicy for SANITIZE_TARGET. SANITIZE_TARGET adds shared libraries in /data/lib. Bug: 21785137 Change-Id: I8ac3d059d88d57d24ed762ffc6202a4ce5a42333
2015-06-13 02:18:20 +02:00
endif
Correct local variables for file_contexts_asan Lowercase local variables and clear them to be consistent with other recipes and prevent polluting Make's global name space with set variables. Change-Id: If455cd4f33d5babbea985867a711e8a10c21a00f Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-29 20:16:18 +02:00
all_fc_files := $(call build_policy, $(all_fc_files))
Add a checkfc utility to check file_contexts validity and invoke it. Change-Id: I4b12dc3dcb432edbdf95dd3bc97f809912ce86d1 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2012-10-02 18:46:37 +02:00
Update Android.mk to support file_contexts.bin This change supports external/libselinux changes to implement PCRE formatted binary file_contexts and general_file_contexts.bin files. The $(intermediates) directory will contain the original text file (that is no longer used on the device) with a .tmp extension as well as the .bin file to aid analysis. A CleanSpec.mk file is added to remove the old file_contexts file. Change-Id: I75a781100082c23536f70ce3603f7de42408b5ba Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-08-06 18:43:52 +02:00
file_contexts.tmp := $(intermediates)/file_contexts.tmp
$(file_contexts.tmp): PRIVATE_FC_FILES := $(all_fc_files)
$(file_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
file_contexts: don't delete intermediate on failure Currently, if an error is detected in a file_contexts file, the intermediate file_context.tmp file is removed, thus making debugging of build issues problematic. Instead, employ checkfc tool during the compilation recipe so the m4 concatenated intermediate is preserved on failure. Change-Id: Ic827385d3bc3434b6c2a9bba5313cd42b5f15599 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-25 19:18:44 +02:00
$(file_contexts.tmp): $(all_fc_files)
Add support for per-device .te and .fc files.
2012-03-06 17:12:41 +01:00
@mkdir -p $(dir $@)
Android.mk: Add support for BOARD_SEPOLICY_M4DEFS Allow device builders to pass arbitrary m4 definitions during the build via make variable BOARD_SEPOLICY_M4DEFS. This enables OEMs to define their own static policy build conditionals. Change-Id: Ibea1dbb7b8615576c5668e47f16ed0eedfa0b73c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-07-16 20:28:02 +02:00
$(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_FC_FILES) > $@
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
file_contexts: don't delete intermediate on failure Currently, if an error is detected in a file_contexts file, the intermediate file_context.tmp file is removed, thus making debugging of build issues problematic. Instead, employ checkfc tool during the compilation recipe so the m4 concatenated intermediate is preserved on failure. Change-Id: Ic827385d3bc3434b6c2a9bba5313cd42b5f15599 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-25 19:18:44 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
$(LOCAL_BUILT_MODULE): $(file_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/sefcontext_compile $(HOST_OUT_EXECUTABLES)/checkfc
Update Android.mk to support file_contexts.bin This change supports external/libselinux changes to implement PCRE formatted binary file_contexts and general_file_contexts.bin files. The $(intermediates) directory will contain the original text file (that is no longer used on the device) with a .tmp extension as well as the .bin file to aid analysis. A CleanSpec.mk file is added to remove the old file_contexts file. Change-Id: I75a781100082c23536f70ce3603f7de42408b5ba Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-08-06 18:43:52 +02:00
@mkdir -p $(dir $@)
file_contexts: don't delete intermediate on failure Currently, if an error is detected in a file_contexts file, the intermediate file_context.tmp file is removed, thus making debugging of build issues problematic. Instead, employ checkfc tool during the compilation recipe so the m4 concatenated intermediate is preserved on failure. Change-Id: Ic827385d3bc3434b6c2a9bba5313cd42b5f15599 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-25 19:18:44 +02:00
$(hide) $(HOST_OUT_EXECUTABLES)/checkfc $(PRIVATE_SEPOLICY) $<
Update Android.mk to support file_contexts.bin This change supports external/libselinux changes to implement PCRE formatted binary file_contexts and general_file_contexts.bin files. The $(intermediates) directory will contain the original text file (that is no longer used on the device) with a .tmp extension as well as the .bin file to aid analysis. A CleanSpec.mk file is added to remove the old file_contexts file. Change-Id: I75a781100082c23536f70ce3603f7de42408b5ba Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-08-06 18:43:52 +02:00
$(hide) $(HOST_OUT_EXECUTABLES)/sefcontext_compile -o $@ $<
Build the selinux_version file. The selinux_version file is used to perform policy versioning checks by libselinux and SELinuxMMAC. When loading policy a check is first performed to determine if the policy out in /data/security/current should be used to override the base policy shipped with the device. The selinux_version file is used to make that choice. The contents of the file simply contains the BUILD_FINGERPRINT that the policy was built against. A simple string comparison is then performed by libselinux and SELinuxMMAC. Change-Id: I69d9d071743cfd46bb247c98f94a193396f8ebbd Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-03-20 14:35:08 +01:00
built_fc := $(LOCAL_BUILT_MODULE)
Correct local variables for file_contexts_asan Lowercase local variables and clear them to be consistent with other recipes and prevent polluting Make's global name space with set variables. Change-Id: If455cd4f33d5babbea985867a711e8a10c21a00f Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-29 20:16:18 +02:00
all_fc_files :=
Update Android.mk to support file_contexts.bin This change supports external/libselinux changes to implement PCRE formatted binary file_contexts and general_file_contexts.bin files. The $(intermediates) directory will contain the original text file (that is no longer used on the device) with a .tmp extension as well as the .bin file to aid analysis. A CleanSpec.mk file is added to remove the old file_contexts file. Change-Id: I75a781100082c23536f70ce3603f7de42408b5ba Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-08-06 18:43:52 +02:00
file_contexts.tmp :=
per device seapp_context support
2012-08-16 19:55:05 +02:00
Generate general versions of the other contexts files for tests. Generate general forms of the remaining *_contexts files with only the device-independent entries for use in CTS testing. Change-Id: I2bf0e41db8a73c26754cedd92cbc3783ff03d6b5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 22:45:03 +01:00
##################################
include $(CLEAR_VARS)
Update Android.mk to support file_contexts.bin This change supports external/libselinux changes to implement PCRE formatted binary file_contexts and general_file_contexts.bin files. The $(intermediates) directory will contain the original text file (that is no longer used on the device) with a .tmp extension as well as the .bin file to aid analysis. A CleanSpec.mk file is added to remove the old file_contexts file. Change-Id: I75a781100082c23536f70ce3603f7de42408b5ba Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-08-06 18:43:52 +02:00
LOCAL_MODULE := general_file_contexts.bin
Generate general versions of the other contexts files for tests. Generate general forms of the remaining *_contexts files with only the device-independent entries for use in CTS testing. Change-Id: I2bf0e41db8a73c26754cedd92cbc3783ff03d6b5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 22:45:03 +01:00
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := tests
include $(BUILD_SYSTEM)/base_rules.mk
Update Android.mk to support file_contexts.bin This change supports external/libselinux changes to implement PCRE formatted binary file_contexts and general_file_contexts.bin files. The $(intermediates) directory will contain the original text file (that is no longer used on the device) with a .tmp extension as well as the .bin file to aid analysis. A CleanSpec.mk file is added to remove the old file_contexts file. Change-Id: I75a781100082c23536f70ce3603f7de42408b5ba Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-08-06 18:43:52 +02:00
general_file_contexts.tmp := $(intermediates)/general_file_contexts.tmp
file_contexts: don't delete intermediate on failure Currently, if an error is detected in a file_contexts file, the intermediate file_context.tmp file is removed, thus making debugging of build issues problematic. Instead, employ checkfc tool during the compilation recipe so the m4 concatenated intermediate is preserved on failure. Change-Id: Ic827385d3bc3434b6c2a9bba5313cd42b5f15599 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-25 19:18:44 +02:00
$(general_file_contexts.tmp): $(addprefix $(LOCAL_PATH)/, file_contexts)
Generate general versions of the other contexts files for tests. Generate general forms of the remaining *_contexts files with only the device-independent entries for use in CTS testing. Change-Id: I2bf0e41db8a73c26754cedd92cbc3783ff03d6b5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 22:45:03 +01:00
@mkdir -p $(dir $@)
$(hide) m4 -s $< > $@
file_contexts: don't delete intermediate on failure Currently, if an error is detected in a file_contexts file, the intermediate file_context.tmp file is removed, thus making debugging of build issues problematic. Instead, employ checkfc tool during the compilation recipe so the m4 concatenated intermediate is preserved on failure. Change-Id: Ic827385d3bc3434b6c2a9bba5313cd42b5f15599 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-25 19:18:44 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_general_sepolicy)
$(LOCAL_BUILT_MODULE): $(general_file_contexts.tmp) $(built_general_sepolicy) $(HOST_OUT_EXECUTABLES)/sefcontext_compile $(HOST_OUT_EXECUTABLES)/checkfc
Update Android.mk to support file_contexts.bin This change supports external/libselinux changes to implement PCRE formatted binary file_contexts and general_file_contexts.bin files. The $(intermediates) directory will contain the original text file (that is no longer used on the device) with a .tmp extension as well as the .bin file to aid analysis. A CleanSpec.mk file is added to remove the old file_contexts file. Change-Id: I75a781100082c23536f70ce3603f7de42408b5ba Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-08-06 18:43:52 +02:00
@mkdir -p $(dir $@)
file_contexts: don't delete intermediate on failure Currently, if an error is detected in a file_contexts file, the intermediate file_context.tmp file is removed, thus making debugging of build issues problematic. Instead, employ checkfc tool during the compilation recipe so the m4 concatenated intermediate is preserved on failure. Change-Id: Ic827385d3bc3434b6c2a9bba5313cd42b5f15599 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-25 19:18:44 +02:00
$(hide) $(HOST_OUT_EXECUTABLES)/checkfc $(PRIVATE_SEPOLICY) $<
Update Android.mk to support file_contexts.bin This change supports external/libselinux changes to implement PCRE formatted binary file_contexts and general_file_contexts.bin files. The $(intermediates) directory will contain the original text file (that is no longer used on the device) with a .tmp extension as well as the .bin file to aid analysis. A CleanSpec.mk file is added to remove the old file_contexts file. Change-Id: I75a781100082c23536f70ce3603f7de42408b5ba Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-08-06 18:43:52 +02:00
$(hide) $(HOST_OUT_EXECUTABLES)/sefcontext_compile -o $@ $<
general_file_contexts.tmp :=
Generate general versions of the other contexts files for tests. Generate general forms of the remaining *_contexts files with only the device-independent entries for use in CTS testing. Change-Id: I2bf0e41db8a73c26754cedd92cbc3783ff03d6b5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 22:45:03 +01:00
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
##################################
include $(CLEAR_VARS)
LOCAL_MODULE := seapp_contexts
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
per device seapp_context support
2012-08-16 19:55:05 +02:00
include $(BUILD_SYSTEM)/base_rules.mk
check_seapp: add support for "neverallow" checks Introduce "neverallow" rules for seapp_contexts. A neverallow rule is similar to the existing key-value-pair entries but the line begins with "neverallow". A neverallow violation is detected when all keys, both inputs and outputs are matched. The neverallow rules value parameter (not the key) can contain regular expressions to assist in matching. Neverallow rules are never output to the generated seapp_contexts file. Also, unless -o is specified, checkseapp runs in silent mode and outputs nothing. Specifying - as an argument to -o outputs to stdout. Sample Output: Error: Rule in File "external/sepolicy/seapp_contexts" on line 87: "user=fake domain=system_app type=app_data_file" violates neverallow in File "external/sepolicy/seapp_contexts" on line 57: "user=((?!system).)* domain=system_app" Change-Id: Ia4dcbf02feb774f2e201bb0c5d4ce385274d8b8d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-04 06:57:47 +02:00
all_sc_files := $(call build_policy, seapp_contexts)
per device seapp_context support
2012-08-16 19:55:05 +02:00
Use file target as dependency. "sepolicy" is a phony target defined by the build system. If you use it as dependency of a file target, you'll get unnecessary rebuild. Change-Id: I3a948ebbaff6a146050eb86a3d04cdc050f7c001
2012-10-26 04:01:31 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
check_seapp: add support for "neverallow" checks Introduce "neverallow" rules for seapp_contexts. A neverallow rule is similar to the existing key-value-pair entries but the line begins with "neverallow". A neverallow violation is detected when all keys, both inputs and outputs are matched. The neverallow rules value parameter (not the key) can contain regular expressions to assist in matching. Neverallow rules are never output to the generated seapp_contexts file. Also, unless -o is specified, checkseapp runs in silent mode and outputs nothing. Specifying - as an argument to -o outputs to stdout. Sample Output: Error: Rule in File "external/sepolicy/seapp_contexts" on line 87: "user=fake domain=system_app type=app_data_file" violates neverallow in File "external/sepolicy/seapp_contexts" on line 57: "user=((?!system).)* domain=system_app" Change-Id: Ia4dcbf02feb774f2e201bb0c5d4ce385274d8b8d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-04 06:57:47 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_SC_FILES := $(all_sc_files)
$(LOCAL_BUILT_MODULE): $(built_sepolicy) $(all_sc_files) $(HOST_OUT_EXECUTABLES)/checkseapp
Support overrides in seapp_contexts Provides support for overriding seapp_contexts declerations in per device seapp_contexts files. Change-Id: I23a0ffa1d24f1ce57825b168f29a2e885d3e1c51
2012-08-28 00:41:15 +02:00
@mkdir -p $(dir $@)
hide checkseapp command invocation Change-Id: I040904b69b98c49d60546f024f5ace5b7c6f7d5e Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-30 22:53:51 +02:00
$(hide) $(HOST_OUT_EXECUTABLES)/checkseapp -p $(PRIVATE_SEPOLICY) -o $@ $(PRIVATE_SC_FILES)
Rewrite Android.mk.
2012-01-18 02:51:09 +01:00
Build the selinux_version file. The selinux_version file is used to perform policy versioning checks by libselinux and SELinuxMMAC. When loading policy a check is first performed to determine if the policy out in /data/security/current should be used to override the base policy shipped with the device. The selinux_version file is used to make that choice. The contents of the file simply contains the BUILD_FINGERPRINT that the policy was built against. A simple string comparison is then performed by libselinux and SELinuxMMAC. Change-Id: I69d9d071743cfd46bb247c98f94a193396f8ebbd Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-03-20 14:35:08 +01:00
built_sc := $(LOCAL_BUILT_MODULE)
check_seapp: add support for "neverallow" checks Introduce "neverallow" rules for seapp_contexts. A neverallow rule is similar to the existing key-value-pair entries but the line begins with "neverallow". A neverallow violation is detected when all keys, both inputs and outputs are matched. The neverallow rules value parameter (not the key) can contain regular expressions to assist in matching. Neverallow rules are never output to the generated seapp_contexts file. Also, unless -o is specified, checkseapp runs in silent mode and outputs nothing. Specifying - as an argument to -o outputs to stdout. Sample Output: Error: Rule in File "external/sepolicy/seapp_contexts" on line 87: "user=fake domain=system_app type=app_data_file" violates neverallow in File "external/sepolicy/seapp_contexts" on line 57: "user=((?!system).)* domain=system_app" Change-Id: Ia4dcbf02feb774f2e201bb0c5d4ce385274d8b8d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-04 06:57:47 +02:00
all_sc_files :=
Build the selinux_version file. The selinux_version file is used to perform policy versioning checks by libselinux and SELinuxMMAC. When loading policy a check is first performed to determine if the policy out in /data/security/current should be used to override the base policy shipped with the device. The selinux_version file is used to make that choice. The contents of the file simply contains the BUILD_FINGERPRINT that the policy was built against. A simple string comparison is then performed by libselinux and SELinuxMMAC. Change-Id: I69d9d071743cfd46bb247c98f94a193396f8ebbd Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-03-20 14:35:08 +01:00
Generate a general_seapp_contexts file for tests. Generate a general_seapp_contexts file with only the device-independent entries, similar to general_sepolicy.conf. This is for use by CTS tests to compare with the prefix of device seapp_contexts. Change-Id: If8d1456afff5347adff7157411c6a160484e0b39 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 20:46:36 +01:00
##################################
include $(CLEAR_VARS)
LOCAL_MODULE := general_seapp_contexts
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := tests
include $(BUILD_SYSTEM)/base_rules.mk
check_seapp: add support for "neverallow" checks Introduce "neverallow" rules for seapp_contexts. A neverallow rule is similar to the existing key-value-pair entries but the line begins with "neverallow". A neverallow violation is detected when all keys, both inputs and outputs are matched. The neverallow rules value parameter (not the key) can contain regular expressions to assist in matching. Neverallow rules are never output to the generated seapp_contexts file. Also, unless -o is specified, checkseapp runs in silent mode and outputs nothing. Specifying - as an argument to -o outputs to stdout. Sample Output: Error: Rule in File "external/sepolicy/seapp_contexts" on line 87: "user=fake domain=system_app type=app_data_file" violates neverallow in File "external/sepolicy/seapp_contexts" on line 57: "user=((?!system).)* domain=system_app" Change-Id: Ia4dcbf02feb774f2e201bb0c5d4ce385274d8b8d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-04 06:57:47 +02:00
all_sc_files := $(addprefix $(LOCAL_PATH)/, seapp_contexts)
Generate a general_seapp_contexts file for tests. Generate a general_seapp_contexts file with only the device-independent entries, similar to general_sepolicy.conf. This is for use by CTS tests to compare with the prefix of device seapp_contexts. Change-Id: If8d1456afff5347adff7157411c6a160484e0b39 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 20:46:36 +01:00
use a general sepolicy when building general targets Change-Id: Ie800ebf9d8e68680ec377e8c51f7cd7717f3c755 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-30 01:31:23 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_general_sepolicy)
check_seapp: add support for "neverallow" checks Introduce "neverallow" rules for seapp_contexts. A neverallow rule is similar to the existing key-value-pair entries but the line begins with "neverallow". A neverallow violation is detected when all keys, both inputs and outputs are matched. The neverallow rules value parameter (not the key) can contain regular expressions to assist in matching. Neverallow rules are never output to the generated seapp_contexts file. Also, unless -o is specified, checkseapp runs in silent mode and outputs nothing. Specifying - as an argument to -o outputs to stdout. Sample Output: Error: Rule in File "external/sepolicy/seapp_contexts" on line 87: "user=fake domain=system_app type=app_data_file" violates neverallow in File "external/sepolicy/seapp_contexts" on line 57: "user=((?!system).)* domain=system_app" Change-Id: Ia4dcbf02feb774f2e201bb0c5d4ce385274d8b8d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-04 06:57:47 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_SC_FILE := $(all_sc_files)
use a general sepolicy when building general targets Change-Id: Ie800ebf9d8e68680ec377e8c51f7cd7717f3c755 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-30 01:31:23 +02:00
$(LOCAL_BUILT_MODULE): $(built_general_sepolicy) $(all_sc_files) $(HOST_OUT_EXECUTABLES)/checkseapp
Generate a general_seapp_contexts file for tests. Generate a general_seapp_contexts file with only the device-independent entries, similar to general_sepolicy.conf. This is for use by CTS tests to compare with the prefix of device seapp_contexts. Change-Id: If8d1456afff5347adff7157411c6a160484e0b39 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 20:46:36 +01:00
@mkdir -p $(dir $@)
hide checkseapp command invocation Change-Id: I040904b69b98c49d60546f024f5ace5b7c6f7d5e Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-30 22:53:51 +02:00
$(hide) $(HOST_OUT_EXECUTABLES)/checkseapp -p $(PRIVATE_SEPOLICY) -o $@ $(PRIVATE_SC_FILE)
Generate a general_seapp_contexts file for tests. Generate a general_seapp_contexts file with only the device-independent entries, similar to general_sepolicy.conf. This is for use by CTS tests to compare with the prefix of device seapp_contexts. Change-Id: If8d1456afff5347adff7157411c6a160484e0b39 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 20:46:36 +01:00
check_seapp: add support for "neverallow" checks Introduce "neverallow" rules for seapp_contexts. A neverallow rule is similar to the existing key-value-pair entries but the line begins with "neverallow". A neverallow violation is detected when all keys, both inputs and outputs are matched. The neverallow rules value parameter (not the key) can contain regular expressions to assist in matching. Neverallow rules are never output to the generated seapp_contexts file. Also, unless -o is specified, checkseapp runs in silent mode and outputs nothing. Specifying - as an argument to -o outputs to stdout. Sample Output: Error: Rule in File "external/sepolicy/seapp_contexts" on line 87: "user=fake domain=system_app type=app_data_file" violates neverallow in File "external/sepolicy/seapp_contexts" on line 57: "user=((?!system).)* domain=system_app" Change-Id: Ia4dcbf02feb774f2e201bb0c5d4ce385274d8b8d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-04 06:57:47 +02:00
all_sc_files :=
Generate a general_seapp_contexts file for tests. Generate a general_seapp_contexts file with only the device-independent entries, similar to general_sepolicy.conf. This is for use by CTS tests to compare with the prefix of device seapp_contexts. Change-Id: If8d1456afff5347adff7157411c6a160484e0b39 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 20:46:36 +01:00
Introduce seapp_neverallow test Produce a list of neverallow assertions from seapp_contexts into a separate file, general_seapp_context_neverallows, to be used during CTS neverallow checking. Change-Id: I171ed43cf4ae4961f66d5d8f56695345493f1261 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-25 20:59:30 +02:00
##################################
include $(CLEAR_VARS)
LOCAL_MODULE := general_seapp_neverallows
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := tests
include $(BUILD_SYSTEM)/base_rules.mk
$(LOCAL_BUILT_MODULE): $(addprefix $(LOCAL_PATH)/, seapp_contexts)
@mkdir -p $(dir $@)
- $(hide) grep -ie '^neverallow' $< > $@
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
##################################
include $(CLEAR_VARS)
LOCAL_MODULE := property_contexts
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
include $(BUILD_SYSTEM)/base_rules.mk
Android.mk: drop polluting variables Some of the ALL_*_FILES variables remained that were used in a way that could not be cleared. Move them to lower case variants and use a build recipe PRIVATE_*_FILES variable. This avoids polluting the global namespace. Change-Id: I83748dab48141af7d3f10ad27fc9319eaf90b970 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-07-30 20:44:26 +02:00
all_pc_files := $(call build_policy, property_contexts)
property_contexts: don't delete intermediate on failure When property_contexts fails to build, the file is deleted leaving only the error message for debugging. Build property_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ia86eb0480c9493ceab36fed779b2fe6ab85d2b3d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 22:52:37 +02:00
property_contexts.tmp := $(intermediates)/property_contexts.tmp
$(property_contexts.tmp): PRIVATE_PC_FILES := $(all_pc_files)
$(property_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(property_contexts.tmp): $(all_pc_files)
@mkdir -p $(dir $@)
$(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_PC_FILES) > $@
property_contexts checks added to checkfc. Change-Id: If361ea93fabd343728196eed2663fd572ecaa70b Signed-off-by: Robert Craig <rpcraig@tycho.ncsc.mil>
2013-01-23 20:04:50 +01:00
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
property_contexts: don't delete intermediate on failure When property_contexts fails to build, the file is deleted leaving only the error message for debugging. Build property_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ia86eb0480c9493ceab36fed779b2fe6ab85d2b3d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 22:52:37 +02:00
$(LOCAL_BUILT_MODULE): $(property_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
@mkdir -p $(dir $@)
property_contexts: don't delete intermediate on failure When property_contexts fails to build, the file is deleted leaving only the error message for debugging. Build property_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ia86eb0480c9493ceab36fed779b2fe6ab85d2b3d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 22:52:37 +02:00
$(hide) $(ACP) $< $@
$(hide) $(HOST_OUT_EXECUTABLES)/checkfc -p $(PRIVATE_SEPOLICY) $<
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
Build the selinux_version file. The selinux_version file is used to perform policy versioning checks by libselinux and SELinuxMMAC. When loading policy a check is first performed to determine if the policy out in /data/security/current should be used to override the base policy shipped with the device. The selinux_version file is used to make that choice. The contents of the file simply contains the BUILD_FINGERPRINT that the policy was built against. A simple string comparison is then performed by libselinux and SELinuxMMAC. Change-Id: I69d9d071743cfd46bb247c98f94a193396f8ebbd Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-03-20 14:35:08 +01:00
built_pc := $(LOCAL_BUILT_MODULE)
Android.mk: drop polluting variables Some of the ALL_*_FILES variables remained that were used in a way that could not be cleared. Move them to lower case variants and use a build recipe PRIVATE_*_FILES variable. This avoids polluting the global namespace. Change-Id: I83748dab48141af7d3f10ad27fc9319eaf90b970 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-07-30 20:44:26 +02:00
all_pc_files :=
property_contexts: don't delete intermediate on failure When property_contexts fails to build, the file is deleted leaving only the error message for debugging. Build property_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ia86eb0480c9493ceab36fed779b2fe6ab85d2b3d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 22:52:37 +02:00
property_contexts.tmp :=
Build the selinux_version file. The selinux_version file is used to perform policy versioning checks by libselinux and SELinuxMMAC. When loading policy a check is first performed to determine if the policy out in /data/security/current should be used to override the base policy shipped with the device. The selinux_version file is used to make that choice. The contents of the file simply contains the BUILD_FINGERPRINT that the policy was built against. A simple string comparison is then performed by libselinux and SELinuxMMAC. Change-Id: I69d9d071743cfd46bb247c98f94a193396f8ebbd Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-03-20 14:35:08 +01:00
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
##################################
include $(CLEAR_VARS)
Generate general versions of the other contexts files for tests. Generate general forms of the remaining *_contexts files with only the device-independent entries for use in CTS testing. Change-Id: I2bf0e41db8a73c26754cedd92cbc3783ff03d6b5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 22:45:03 +01:00
LOCAL_MODULE := general_property_contexts
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := tests
Fix rules for general_property_contexts. Failed to include base_rules.mk, so this target was not being built. Change-Id: I2414fa6c3e3e37c74f63c205e3694d1a811c956e Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-13 14:36:57 +01:00
include $(BUILD_SYSTEM)/base_rules.mk
property_contexts: don't delete intermediate on failure When property_contexts fails to build, the file is deleted leaving only the error message for debugging. Build property_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ia86eb0480c9493ceab36fed779b2fe6ab85d2b3d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 22:52:37 +02:00
general_property_contexts.tmp := $(intermediates)/general_property_contexts.tmp
$(general_property_contexts.tmp): $(addprefix $(LOCAL_PATH)/, property_contexts)
property_contexts: don't delete intermediate on failure When property_contexts fails to build, the file is deleted leaving only the error message for debugging. Build property_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: I431d6f4494fa119c1873eab0e77f0eed3fb5754e Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 22:52:37 +02:00
@mkdir -p $(dir $@)
Revert "property_contexts: don't delete intermediate on failure" This reverts commit 7f81b337bc600251b37de2dfa70c47781a2f2d3c. Change-Id: I79834d0ef3adbf2eed53b07d17160876e2a999c6
2015-10-01 23:25:09 +02:00
$(hide) m4 -s $< > $@
property_contexts: don't delete intermediate on failure When property_contexts fails to build, the file is deleted leaving only the error message for debugging. Build property_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: I431d6f4494fa119c1873eab0e77f0eed3fb5754e Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 22:52:37 +02:00
property_contexts: don't delete intermediate on failure When property_contexts fails to build, the file is deleted leaving only the error message for debugging. Build property_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ia86eb0480c9493ceab36fed779b2fe6ab85d2b3d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 22:52:37 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_general_sepolicy)
$(LOCAL_BUILT_MODULE): $(general_property_contexts.tmp) $(built_general_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
@mkdir -p $(dir $@)
$(hide) $(ACP) $< $@
$(hide) $(HOST_OUT_EXECUTABLES)/checkfc -p $(PRIVATE_SEPOLICY) $<
general_property_contexts.tmp :=
Generate general versions of the other contexts files for tests. Generate general forms of the remaining *_contexts files with only the device-independent entries for use in CTS testing. Change-Id: I2bf0e41db8a73c26754cedd92cbc3783ff03d6b5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 22:45:03 +01:00
##################################
include $(CLEAR_VARS)
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
LOCAL_MODULE := service_contexts
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
include $(BUILD_SYSTEM)/base_rules.mk
Android.mk: drop polluting variables Some of the ALL_*_FILES variables remained that were used in a way that could not be cleared. Move them to lower case variants and use a build recipe PRIVATE_*_FILES variable. This avoids polluting the global namespace. Change-Id: I83748dab48141af7d3f10ad27fc9319eaf90b970 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-07-30 20:44:26 +02:00
all_svc_files := $(call build_policy, service_contexts)
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
service_contexts: don't delete intermediate on failure When service_contexts fails to build, the file is deleted leaving only the error message for debugging. Build service_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ib9dcbf21d0a28700d500cf0ea4e412b009758d5d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 23:17:38 +02:00
service_contexts.tmp := $(intermediates)/service_contexts.tmp
$(service_contexts.tmp): PRIVATE_SVC_FILES := $(all_svc_files)
$(service_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(service_contexts.tmp): $(all_svc_files)
service_contexts: don't delete intermediate on failure When service_contexts fails to build, the file is deleted leaving only the error message for debugging. Build service_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ib9c9247d36e6a6406b4df84d10e982921c07d492 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 23:17:38 +02:00
@mkdir -p $(dir $@)
Revert "service_contexts: don't delete intermediate on failure" This reverts commit f6ee7a521942036ef7f5c0f6bc74520509934141. Change-Id: I4f1396e6e4aeecd1109f9c24494c6e82645c0663
2015-10-01 23:22:16 +02:00
$(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
service_contexts: don't delete intermediate on failure When service_contexts fails to build, the file is deleted leaving only the error message for debugging. Build service_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ib9dcbf21d0a28700d500cf0ea4e412b009758d5d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 23:17:38 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
$(LOCAL_BUILT_MODULE): $(service_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
@mkdir -p $(dir $@)
$(hide) $(HOST_OUT_EXECUTABLES)/checkfc -p $(PRIVATE_SEPOLICY) $<
$(hide) $(ACP) $< $@
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
built_svc := $(LOCAL_BUILT_MODULE)
Android.mk: drop polluting variables Some of the ALL_*_FILES variables remained that were used in a way that could not be cleared. Move them to lower case variants and use a build recipe PRIVATE_*_FILES variable. This avoids polluting the global namespace. Change-Id: I83748dab48141af7d3f10ad27fc9319eaf90b970 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-07-30 20:44:26 +02:00
all_svc_files :=
service_contexts: don't delete intermediate on failure When service_contexts fails to build, the file is deleted leaving only the error message for debugging. Build service_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ib9dcbf21d0a28700d500cf0ea4e412b009758d5d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 23:17:38 +02:00
service_contexts.tmp :=
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
Add mac_permissions.xml file. This was moved from external/mac-policy.git
2012-07-30 15:33:03 +02:00
##################################
include $(CLEAR_VARS)
Generate general versions of the other contexts files for tests. Generate general forms of the remaining *_contexts files with only the device-independent entries for use in CTS testing. Change-Id: I2bf0e41db8a73c26754cedd92cbc3783ff03d6b5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 22:45:03 +01:00
LOCAL_MODULE := general_service_contexts
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := tests
include $(BUILD_SYSTEM)/base_rules.mk
service_contexts: don't delete intermediate on failure When service_contexts fails to build, the file is deleted leaving only the error message for debugging. Build service_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ib9dcbf21d0a28700d500cf0ea4e412b009758d5d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 23:17:38 +02:00
general_service_contexts.tmp := $(intermediates)/general_service_contexts.tmp
$(general_service_contexts.tmp): $(addprefix $(LOCAL_PATH)/, service_contexts)
service_contexts: don't delete intermediate on failure When service_contexts fails to build, the file is deleted leaving only the error message for debugging. Build service_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ib9c9247d36e6a6406b4df84d10e982921c07d492 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 23:17:38 +02:00
@mkdir -p $(dir $@)
Revert "service_contexts: don't delete intermediate on failure" This reverts commit f6ee7a521942036ef7f5c0f6bc74520509934141. Change-Id: I4f1396e6e4aeecd1109f9c24494c6e82645c0663
2015-10-01 23:22:16 +02:00
$(hide) m4 -s $< > $@
service_contexts: don't delete intermediate on failure When service_contexts fails to build, the file is deleted leaving only the error message for debugging. Build service_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ib9c9247d36e6a6406b4df84d10e982921c07d492 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 23:17:38 +02:00
service_contexts: don't delete intermediate on failure When service_contexts fails to build, the file is deleted leaving only the error message for debugging. Build service_contexts and general variant as a temporary intermediate before running checkfc. Change-Id: Ib9dcbf21d0a28700d500cf0ea4e412b009758d5d Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-09-29 23:17:38 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_general_sepolicy)
$(LOCAL_BUILT_MODULE): $(general_service_contexts.tmp) $(built_general_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
@mkdir -p $(dir $@)
$(hide) $(HOST_OUT_EXECUTABLES)/checkfc -p $(PRIVATE_SEPOLICY) $<
$(hide) $(ACP) $< $@
general_service_contexts.tmp :=
Generate general versions of the other contexts files for tests. Generate general forms of the remaining *_contexts files with only the device-independent entries for use in CTS testing. Change-Id: I2bf0e41db8a73c26754cedd92cbc3783ff03d6b5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-12 22:45:03 +01:00
##################################
include $(CLEAR_VARS)
Expand insertkeys.py script to allow union of files. Allow script to union mac_permissions.xml files specified using the BOARD_SEPOLICY_DIRS and BOARD_SEPOLICY_UNION constructs. Change-Id: I4fc65fd1ab4c612f25e966f030247e54a270b614 Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2013-03-27 13:35:39 +01:00
LOCAL_MODULE := mac_permissions.xml
Add mac_permissions.xml file. This was moved from external/mac-policy.git
2012-07-30 15:33:03 +02:00
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_OUT_ETC)/security
Replaceable mac_permission.xml support Support overriding ma_permissions.xml in BOARD_SEPOLICY_REPLACE Change-Id: If0bca8bf29bc431a291b6d7b20de132e68cd6a79
2012-11-30 23:59:09 +01:00
include $(BUILD_SYSTEM)/base_rules.mk
Add mac_permissions.xml file. This was moved from external/mac-policy.git
2012-07-30 15:33:03 +02:00
Revert "Revert "Dynamic insertion of pubkey to mac_permissions.xml"" This reverts commit 1446e714af0b0c358b5ecf37c5d704c96c72cf7c Hidden dependency has been resolved. Change-Id: Ia535c0b9468ea5f705dff9813186a7fa8bab84ae
2013-03-26 19:19:12 +01:00
# Build keys.conf
mac_perms_keys.tmp := $(intermediates)/keys.tmp
Android.mk: Add support for BOARD_SEPOLICY_M4DEFS Allow device builders to pass arbitrary m4 definitions during the build via make variable BOARD_SEPOLICY_M4DEFS. This enables OEMs to define their own static policy build conditionals. Change-Id: Ibea1dbb7b8615576c5668e47f16ed0eedfa0b73c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-07-16 20:28:02 +02:00
$(mac_perms_keys.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
correct colon usage on make targets Change-Id: If944d8bd1e324f6500920ee3c5d44611ec7f8af9 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-27 16:22:34 +02:00
$(mac_perms_keys.tmp): $(call build_policy, keys.conf)
Revert "Revert "Dynamic insertion of pubkey to mac_permissions.xml"" This reverts commit 1446e714af0b0c358b5ecf37c5d704c96c72cf7c Hidden dependency has been resolved. Change-Id: Ia535c0b9468ea5f705dff9813186a7fa8bab84ae
2013-03-26 19:19:12 +01:00
@mkdir -p $(dir $@)
Android.mk: Add support for BOARD_SEPOLICY_M4DEFS Allow device builders to pass arbitrary m4 definitions during the build via make variable BOARD_SEPOLICY_M4DEFS. This enables OEMs to define their own static policy build conditionals. Change-Id: Ibea1dbb7b8615576c5668e47f16ed0eedfa0b73c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-07-16 20:28:02 +02:00
$(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@
Revert "Revert "Dynamic insertion of pubkey to mac_permissions.xml"" This reverts commit 1446e714af0b0c358b5ecf37c5d704c96c72cf7c Hidden dependency has been resolved. Change-Id: Ia535c0b9468ea5f705dff9813186a7fa8bab84ae
2013-03-26 19:19:12 +01:00
Android.mk: drop polluting variables Some of the ALL_*_FILES variables remained that were used in a way that could not be cleared. Move them to lower case variants and use a build recipe PRIVATE_*_FILES variable. This avoids polluting the global namespace. Change-Id: I83748dab48141af7d3f10ad27fc9319eaf90b970 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-07-30 20:44:26 +02:00
all_mac_perms_files := $(call build_policy, $(LOCAL_MODULE))
Add mac_permissions.xml file. This was moved from external/mac-policy.git
2012-07-30 15:33:03 +02:00
Android.mk: drop polluting variables Some of the ALL_*_FILES variables remained that were used in a way that could not be cleared. Move them to lower case variants and use a build recipe PRIVATE_*_FILES variable. This avoids polluting the global namespace. Change-Id: I83748dab48141af7d3f10ad27fc9319eaf90b970 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-07-30 20:44:26 +02:00
$(LOCAL_BUILT_MODULE): PRIVATE_MAC_PERMS_FILES := $(all_mac_perms_files)
$(LOCAL_BUILT_MODULE): $(mac_perms_keys.tmp) $(HOST_OUT_EXECUTABLES)/insertkeys.py $(all_mac_perms_files)
Revert "Revert "Dynamic insertion of pubkey to mac_permissions.xml"" This reverts commit 1446e714af0b0c358b5ecf37c5d704c96c72cf7c Hidden dependency has been resolved. Change-Id: Ia535c0b9468ea5f705dff9813186a7fa8bab84ae
2013-03-26 19:19:12 +01:00
@mkdir -p $(dir $@)
Make DEFAULT_SYSTEM_DEV_CERTIFICATE available in keys.conf In 9af6f1bd59ee2fb0622db8ff25c4806c5527a0b3, the -d option was dropped from insertkeys.py. This was done to allow an Android distribution to replace the default version of keys.conf distributed in external/sepolicy/keys.conf. keys.conf was modified to reference the publicly known test keys in build/target/product/security. Unfortunately, this broke Google's build of Android. Instead of incorporating our keys directory, we were using the default AOSP keys. As a result, apps were getting assigned to the wrong SELinux domain. (see "Steps to reproduce" below) This change continues to allow others to replace keys.conf, but makes DEFAULT_SYSTEM_DEV_CERTIFICATE available as an environment variable in case the customized version wants to make reference to it. This change also modifies the stock version of keys.conf to use DEFAULT_SYSTEM_DEV_CERTIFICATE, which should be appropriate for most Android distributions. It doesn't make any sense to force each OEM to have a copy of this file. Steps to reproduce. 1) Compile and boot Android. 2) Run the following command: "adb shell ps -Z | grep process.media" Expected: $ adb shell ps -Z | grep process.media u:r:media_app:s0 u0_a5 1332 202 android.process.media Actual: $ adb shell ps -Z | grep process.media u:r:untrusted_app:s0 u0_a5 3617 187 android.process.media Bug: 11327304 Change-Id: Ica24fb25c5f9c0e2f4d181718c757cf372467822
2013-10-25 21:25:36 +02:00
$(hide) DEFAULT_SYSTEM_DEV_CERTIFICATE="$(dir $(DEFAULT_SYSTEM_DEV_CERTIFICATE))" \
Android.mk: drop polluting variables Some of the ALL_*_FILES variables remained that were used in a way that could not be cleared. Move them to lower case variants and use a build recipe PRIVATE_*_FILES variable. This avoids polluting the global namespace. Change-Id: I83748dab48141af7d3f10ad27fc9319eaf90b970 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-07-30 20:44:26 +02:00
$(HOST_OUT_EXECUTABLES)/insertkeys.py -t $(TARGET_BUILD_VARIANT) -c $(TOP) $< -o $@ $(PRIVATE_MAC_PERMS_FILES)
Revert "Revert "Dynamic insertion of pubkey to mac_permissions.xml"" This reverts commit 1446e714af0b0c358b5ecf37c5d704c96c72cf7c Hidden dependency has been resolved. Change-Id: Ia535c0b9468ea5f705dff9813186a7fa8bab84ae
2013-03-26 19:19:12 +01:00
Expand insertkeys.py script to allow union of files. Allow script to union mac_permissions.xml files specified using the BOARD_SEPOLICY_DIRS and BOARD_SEPOLICY_UNION constructs. Change-Id: I4fc65fd1ab4c612f25e966f030247e54a270b614 Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2013-03-27 13:35:39 +01:00
mac_perms_keys.tmp :=
Android.mk: drop polluting variables Some of the ALL_*_FILES variables remained that were used in a way that could not be cleared. Move them to lower case variants and use a build recipe PRIVATE_*_FILES variable. This avoids polluting the global namespace. Change-Id: I83748dab48141af7d3f10ad27fc9319eaf90b970 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-07-30 20:44:26 +02:00
all_mac_perms_files :=
Add selinux network script to policy Signed-off-by: Joshua Brindle <jbrindle@tresys.com>
2012-06-20 17:58:01 +02:00
##################################
Build the selinux_version file. The selinux_version file is used to perform policy versioning checks by libselinux and SELinuxMMAC. When loading policy a check is first performed to determine if the policy out in /data/security/current should be used to override the base policy shipped with the device. The selinux_version file is used to make that choice. The contents of the file simply contains the BUILD_FINGERPRINT that the policy was built against. A simple string comparison is then performed by libselinux and SELinuxMMAC. Change-Id: I69d9d071743cfd46bb247c98f94a193396f8ebbd Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-03-20 14:35:08 +01:00
include $(CLEAR_VARS)
LOCAL_MODULE := selinux_version
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
include $(BUILD_SYSTEM)/base_rules.mk
correct colon usage on make targets Change-Id: If944d8bd1e324f6500920ee3c5d44611ec7f8af9 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-27 16:22:34 +02:00
$(LOCAL_BUILT_MODULE): $(built_sepolicy) $(built_pc) $(built_fc) $(built_sc) $(built_svc)
Build the selinux_version file. The selinux_version file is used to perform policy versioning checks by libselinux and SELinuxMMAC. When loading policy a check is first performed to determine if the policy out in /data/security/current should be used to override the base policy shipped with the device. The selinux_version file is used to make that choice. The contents of the file simply contains the BUILD_FINGERPRINT that the policy was built against. A simple string comparison is then performed by libselinux and SELinuxMMAC. Change-Id: I69d9d071743cfd46bb247c98f94a193396f8ebbd Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-03-20 14:35:08 +01:00
@mkdir -p $(dir $@)
Use build fingerprint from file Improve incremental ninja builds by keeping the command line the same across builds. Change-Id: Iedbaa40c9f816f91afc8f073a9ed7f9ffd5d9a53
2015-07-17 22:08:41 +02:00
$(hide) echo -n $(BUILD_FINGERPRINT_FROM_FILE) > $@
Build the selinux_version file. The selinux_version file is used to perform policy versioning checks by libselinux and SELinuxMMAC. When loading policy a check is first performed to determine if the policy out in /data/security/current should be used to override the base policy shipped with the device. The selinux_version file is used to make that choice. The contents of the file simply contains the BUILD_FINGERPRINT that the policy was built against. A simple string comparison is then performed by libselinux and SELinuxMMAC. Change-Id: I69d9d071743cfd46bb247c98f94a193396f8ebbd Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-03-20 14:35:08 +01:00
##################################
Add better per-device sepolicy support. This is a rewrite of the existing implementation. Three new variables are now needed to add/modify the exisitng base policy. They are, BOARD_SEPOLICY_REPLACE and BOARD_SEPOLICY_UNION which govern what files are replaced and concatenated, and BOARD_SEPOLICY_DIRS which lists the various directories that will contain the BOARD_SEPOLICY_REPLACE and BOARD_SEPOLICY_UNION policy files. Change-Id: Id33381268cef03245c56bc5242fec7da9b6c6493 Signed-off-by: rpcraig <robertpcraig@gmail.com>
2012-10-18 03:09:52 +02:00
build_policy :=
Generate selinux_policy.xml as part of CTS build. Bug: 16563899 Bug: 14251916 Change-Id: Id3172b73f10186ba361caf6b7333e5d2a0648475
2014-07-26 04:11:52 +02:00
sepolicy_build_files :=
Build the selinux_version file. The selinux_version file is used to perform policy versioning checks by libselinux and SELinuxMMAC. When loading policy a check is first performed to determine if the policy out in /data/security/current should be used to override the base policy shipped with the device. The selinux_version file is used to make that choice. The contents of the file simply contains the BUILD_FINGERPRINT that the policy was built against. A simple string comparison is then performed by libselinux and SELinuxMMAC. Change-Id: I69d9d071743cfd46bb247c98f94a193396f8ebbd Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-03-20 14:35:08 +01:00
built_sepolicy :=
built_sc :=
built_fc :=
built_pc :=
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
built_svc :=
use a general sepolicy when building general targets Change-Id: Ie800ebf9d8e68680ec377e8c51f7cd7717f3c755 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-06-30 01:31:23 +02:00
built_general_sepolicy :=
built_general_sepolicy.conf :=
Moved Android policy tools to tools directory Change-Id: I57b0dd9f8071eae492020f410c87f465ba820711
2012-11-01 19:33:04 +01:00
include $(call all-makefiles-under,$(LOCAL_PATH))
Reference in a new issue Copy permalink