From 47cd396b11ca4b62d4d99902bec1b981760e818a Mon Sep 17 00:00:00 2001 From: rpcraig Date: Wed, 17 Oct 2012 21:09:52 -0400 Subject: [PATCH] Add better per-device sepolicy support. This is a rewrite of the existing implementation. Three new variables are now needed to add/modify the exisitng base policy. They are, BOARD_SEPOLICY_REPLACE and BOARD_SEPOLICY_UNION which govern what files are replaced and concatenated, and BOARD_SEPOLICY_DIRS which lists the various directories that will contain the BOARD_SEPOLICY_REPLACE and BOARD_SEPOLICY_UNION policy files. Change-Id: Id33381268cef03245c56bc5242fec7da9b6c6493 Signed-off-by: rpcraig --- Android.mk | 59 ++++++++++++++++++++++++++++++++++++++++++------------ 1 file changed, 46 insertions(+), 13 deletions(-) diff --git a/Android.mk b/Android.mk index de84ea071..2cc0f22f7 100644 --- a/Android.mk +++ b/Android.mk @@ -12,16 +12,46 @@ POLICYVERS ?= 24 MLS_SENS=1 MLS_CATS=1024 -LOCAL_POLICY_DIRS := $(SRC_TARGET_DIR)/board/$(TARGET_DEVICE)/ device/*/$(TARGET_DEVICE)/ vendor/*/$(TARGET_DEVICE)/ +# Quick edge case error detection for BOARD_SEPOLICY_REPLACE. +# Builds the singular path for each replace file. +sepolicy_replace_paths := +$(foreach pf, $(BOARD_SEPOLICY_REPLACE), \ + $(if $(filter $(pf), $(BOARD_SEPOLICY_UNION)), \ + $(error Ambiguous request for sepolicy $(pf). Appears in both \ + BOARD_SEPOLICY_REPLACE and BOARD_SEPOLICY_UNION), \ + ) \ + $(eval _paths := $(wildcard $(addsuffix /$(pf), $(BOARD_SEPOLICY_DIRS)))) \ + $(eval _occurrences := $(words $(_paths))) \ + $(if $(filter 0,$(_occurrences)), \ + $(error No sepolicy file found for $(pf) in $(BOARD_SEPOLICY_DIRS)), \ + ) \ + $(if $(filter 1, $(_occurrences)), \ + $(eval sepolicy_replace_paths += $(_paths)), \ + $(error Multiple occurrences of replace file $(pf) in $(_paths)) \ + ) \ + $(if $(filter 0, $(words $(wildcard $(addsuffix /$(pf), $(LOCAL_PATH))))), \ + $(error Specified the sepolicy file $(pf) in BOARD_SEPOLICY_REPLACE, \ + but none found in $(LOCAL_PATH)), \ + ) \ +) -LOCAL_POLICY_FC := $(wildcard $(addsuffix sepolicy.fc, $(LOCAL_POLICY_DIRS))) -LOCAL_POLICY_TE := $(wildcard $(addsuffix sepolicy.te, $(LOCAL_POLICY_DIRS))) -LOCAL_POLICY_PC := $(wildcard $(addsuffix sepolicy.pc, $(LOCAL_POLICY_DIRS))) -LOCAL_POLICY_FS_USE := $(wildcard $(addsuffix sepolicy.fs_use, $(LOCAL_POLICY_DIRS))) -LOCAL_POLICY_PORT_CONTEXTS := $(wildcard $(addsuffix sepolicy.port_contexts, $(LOCAL_POLICY_DIRS))) -LOCAL_POLICY_GENFS_CONTEXTS := $(wildcard $(addsuffix sepolicy.genfs_contexts, $(LOCAL_POLICY_DIRS))) -LOCAL_POLICY_INITIAL_SID_CONTEXTS := $(wildcard $(addsuffix sepolicy.initial_sid_contexts, $(LOCAL_POLICY_DIRS))) -LOCAL_POLICY_SC := $(wildcard $(addsuffix seapp_contexts, $(LOCAL_POLICY_DIRS))) +# Builds paths for all requested policy files w.r.t +# both BOARD_SEPOLICY_REPLACE and BOARD_SEPOLICY_UNION +# product variables. +# $(1): the set of policy name paths to build +build_policy = $(foreach type, $(1), \ + $(foreach expanded_type, $(notdir $(wildcard $(addsuffix /$(type), $(LOCAL_PATH)))), \ + $(if $(filter $(expanded_type), $(BOARD_SEPOLICY_REPLACE)), \ + $(wildcard $(addsuffix $(expanded_type), $(dir $(sepolicy_replace_paths)))), \ + $(LOCAL_PATH)/$(expanded_type) \ + ) \ + ) \ + $(foreach union_policy, $(wildcard $(addsuffix /$(type), $(BOARD_SEPOLICY_DIRS))), \ + $(if $(filter $(notdir $(union_policy)), $(BOARD_SEPOLICY_UNION)), \ + $(union_policy), \ + ) \ + ) \ +) ################################## include $(CLEAR_VARS) @@ -36,7 +66,7 @@ include $(BUILD_SYSTEM)/base_rules.mk sepolicy_policy.conf := $(intermediates)/policy.conf $(sepolicy_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS) $(sepolicy_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS) -$(sepolicy_policy.conf) : $(wildcard $(addprefix $(LOCAL_PATH)/,security_classes initial_sids access_vectors global_macros mls_macros mls policy_capabilities te_macros attributes *.te) $(LOCAL_POLICY_TE) $(addprefix $(LOCAL_PATH)/, roles users initial_sid_contexts) $(LOCAL_POLICY_INITIAL_SID_CONTEXTS) $(addprefix $(LOCAL_PATH)/,fs_use) $(LOCAL_POLICY_FS_USE) $(addprefix $(LOCAL_PATH)/,genfs_contexts) $(LOCAL_POLICY_GENFS_CONTEXTS) $(addprefix $(LOCAL_PATH)/,port_contexts) $(LOCAL_POLICY_PORT_CONTEXTS)) +$(sepolicy_policy.conf) : $(call build_policy, security_classes initial_sids access_vectors global_macros mls_macros mls policy_capabilities te_macros attributes *.te roles users initial_sid_contexts fs_use genfs_contexts port_contexts) @mkdir -p $(dir $@) $(hide) m4 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) -s $^ > $@ @@ -69,7 +99,7 @@ LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT) include $(BUILD_SYSTEM)/base_rules.mk -ALL_FC_FILES := $(LOCAL_PATH)/file_contexts $(LOCAL_POLICY_FC) +ALL_FC_FILES := $(call build_policy, file_contexts) $(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) $(LOCAL_BUILT_MODULE): $(ALL_FC_FILES) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc @@ -89,7 +119,7 @@ LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT) include $(BUILD_SYSTEM)/base_rules.mk seapp_contexts.tmp := $(intermediates)/seapp_contexts.tmp -$(seapp_contexts.tmp): $(LOCAL_PATH)/seapp_contexts $(LOCAL_POLICY_SC) +$(seapp_contexts.tmp): $(call build_policy, seapp_contexts) @mkdir -p $(dir $@) $(hide) m4 -s $^ > $@ @@ -111,7 +141,7 @@ LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT) include $(BUILD_SYSTEM)/base_rules.mk property_contexts := $(intermediates)/property_contexts -$(property_contexts): $(LOCAL_PATH)/property_contexts $(LOCAL_POLICY_PC) +$(property_contexts): $(call build_policy, property_contexts) @mkdir -p $(dir $@) $(hide) m4 -s $^ > $@ @@ -142,3 +172,6 @@ LOCAL_SRC_FILES := $(LOCAL_MODULE) include $(BUILD_PREBUILT) ################################## + +build_policy := +sepolicy_replace_paths :=