tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Restrict BOARD_PLAT_[PUBLIC|PRIVATE]_SEPOLICY_DIRS to one dir.

Browse source 
These directories were added to allow for partner extensions to the
android framework without needing to add changes to the AOSP global
sepolicy.  There should only ever be one owner of the framework and
corresponding updates, so enforce this restriction to prevent
accidental accrual of policy in the system image.

Bug: 36467375
Test: Add public and private files to policy and verify that they are
added to the appropriate policy files.  Also test that specifying
multiple directories for public or private results in an error.

Change-Id: I397ca4e7d6c8233d1aefb2a23e7b44315052678f
Merged-In: I397ca4e7d6c8233d1aefb2a23e7b44315052678f
(cherry picked from commit 1633da06af)
This commit is contained in:
Dan Cashman 2017-05-23 14:47:16 -07:00 committed by Bowgo Tsai
parent 1b0a71f308
commit 51455fe977
1 changed files with 14 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
Android.mk
View file

@ -80,9 +80,21 @@ endif
# - compile output binary policy file # - compile output binary policy file
PLAT_PUBLIC_POLICY := $(LOCAL_PATH)/public PLAT_PUBLIC_POLICY := $(LOCAL_PATH)/public
PLAT_PUBLIC_POLICY += $(BOARD_PLAT_PUBLIC_SEPOLICY_DIRS) ifneq ( ,$(BOARD_PLAT_PUBLIC_SEPOLICY_DIR))
ifneq (1, $(words $(BOARD_PLAT_PUBLIC_SEPOLICY_DIR)))
$(error BOARD_PLAT_PUBLIC_SEPOLICY_DIR must only contain one directory)
else
PLAT_PUBLIC_POLICY += $(BOARD_PLAT_PUBLIC_SEPOLICY_DIR)
endif
endif
PLAT_PRIVATE_POLICY := $(LOCAL_PATH)/private PLAT_PRIVATE_POLICY := $(LOCAL_PATH)/private
PLAT_PRIVATE_POLICY += $(BOARD_PLAT_PRIVATE_SEPOLICY_DIRS) ifneq ( ,$(BOARD_PLAT_PRIVATE_SEPOLICY_DIR))
ifneq (1, $(words $(BOARD_PLAT_PRIVATE_SEPOLICY_DIR)))
$(error BOARD_PLAT_PRIVATE_SEPOLICY_DIR must only contain one directory)
else
PLAT_PRIVATE_POLICY += $(BOARD_PLAT_PRIVATE_SEPOLICY_DIR)
endif
endif
PLAT_VENDOR_POLICY := $(LOCAL_PATH)/vendor PLAT_VENDOR_POLICY := $(LOCAL_PATH)/vendor
REQD_MASK_POLICY := $(LOCAL_PATH)/reqd_mask REQD_MASK_POLICY := $(LOCAL_PATH)/reqd_mask