diff --git a/Android.bp b/Android.bp index 17853420b..9952a8fd5 100644 --- a/Android.bp +++ b/Android.bp @@ -1,4 +1 @@ -subdirs = [ - "tests", - "build", -] +subdirs = ["tests"] diff --git a/Android.mk b/Android.mk index 0d4d67fb5..6756d4088 100644 --- a/Android.mk +++ b/Android.mk @@ -124,13 +124,6 @@ $(warning Be careful when using the SELINUX_IGNORE_NEVERALLOWS flag. \ NEVERALLOW_ARG := -N endif -# BOARD_SEPOLICY_DIRS was used for vendor sepolicy customization before. -# It has been replaced by BOARD_VENDOR_SEPOLICY_DIRS. BOARD_SEPOLICY_DIRS is -# still allowed for backward compatibility, which will be merged into -# BOARD_VENDOR_SEPOLICY_DIRS. -ifdef BOARD_SEPOLICY_DIRS -BOARD_VENDOR_SEPOLICY_DIRS += $(BOARD_SEPOLICY_DIRS) -endif platform_mapping_file := $(BOARD_SEPOLICY_VERS).cil @@ -144,9 +137,9 @@ define build_policy $(foreach type, $(1), $(foreach file, $(addsuffix /$(type), $(2)), $(sort $(wildcard $(file))))) endef -# Builds paths for all policy files found in BOARD_VENDOR_SEPOLICY_DIRS. +# Builds paths for all policy files found in BOARD_SEPOLICY_DIRS. # $(1): the set of policy name paths to build -build_vendor_policy = $(call build_policy, $(1), $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS)) +build_device_policy = $(call build_policy, $(1), $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS)) # Add a file containing only a newline in-between each policy configuration # 'contexts' file. This will allow OEM policy configuration files without a @@ -216,13 +209,11 @@ ifeq ($(PRODUCT_SEPOLICY_SPLIT),true) LOCAL_REQUIRED_MODULES += \ $(platform_mapping_file) \ 26.0.cil \ - plat_pub_versioned.cil \ - vendor_sepolicy.cil \ + nonplat_sepolicy.cil \ plat_sepolicy.cil \ plat_and_mapping_sepolicy.cil.sha256 \ secilc \ plat_sepolicy_vers.txt \ - vendor_service_contexts \ # Include precompiled policy, unless told otherwise ifneq ($(PRODUCT_PRECOMPILED_SEPOLICY),false) @@ -234,12 +225,11 @@ LOCAL_REQUIRED_MODULES += sepolicy endif LOCAL_REQUIRED_MODULES += \ - build_sepolicy \ - vendor_file_contexts \ - vendor_mac_permissions.xml \ - vendor_property_contexts \ - vendor_seapp_contexts \ - vendor_hwservice_contexts \ + nonplat_file_contexts \ + nonplat_mac_permissions.xml \ + nonplat_property_contexts \ + nonplat_seapp_contexts \ + nonplat_hwservice_contexts \ plat_file_contexts \ plat_mac_permissions.xml \ plat_property_contexts \ @@ -249,6 +239,10 @@ LOCAL_REQUIRED_MODULES += \ searchpolicy \ vndservice_contexts \ +ifneq ($(PRODUCT_SEPOLICY_SPLIT),true) +LOCAL_REQUIRED_MODULES += nonplat_service_contexts +endif + ifneq ($(TARGET_BUILD_VARIANT), user) LOCAL_REQUIRED_MODULES += \ selinux_denial_metadata \ @@ -489,9 +483,7 @@ $(LOCAL_BUILT_MODULE): $(built_plat_cil) $(built_mapping_cil) ################################# include $(CLEAR_VARS) -# plat_pub_versioned.cil - the exported platform policy associated with the version -# that non-platform policy targets. -LOCAL_MODULE := plat_pub_versioned.cil +LOCAL_MODULE := nonplat_sepolicy.cil LOCAL_MODULE_CLASS := ETC LOCAL_MODULE_TAGS := optional LOCAL_PROPRIETARY_MODULE := true @@ -499,62 +491,47 @@ LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux include $(BUILD_SYSTEM)/base_rules.mk +# nonplat_policy.conf - A combination of the non-platform private, vendor and +# the exported platform policy associated with the version the non-platform +# policy targets. This needs attributization and to be combined with the +# platform-provided policy. Like plat_pub_policy.conf, this needs to make use +# of the reqd_policy_mask files from private policy in order to use checkpolicy. +nonplat_policy.conf := $(intermediates)/nonplat_policy.conf +$(nonplat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS) +$(nonplat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS) +$(nonplat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch) +$(nonplat_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) +$(nonplat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) +$(nonplat_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT) +$(nonplat_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY) +$(nonplat_policy.conf): $(call build_policy, $(sepolicy_build_files), \ +$(PLAT_PUBLIC_POLICY) $(REQD_MASK_POLICY) $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS)) + $(transform-policy-to-conf) + $(hide) sed '/dontaudit/d' $@ > $@.dontaudit + +nonplat_policy_raw := $(intermediates)/nonplat_policy_raw.cil +$(nonplat_policy_raw): PRIVATE_POL_CONF := $(nonplat_policy.conf) +$(nonplat_policy_raw): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil) +$(nonplat_policy_raw): $(HOST_OUT_EXECUTABLES)/checkpolicy $(nonplat_policy.conf) \ +$(reqd_policy_mask.cil) + @mkdir -p $(dir $@) + $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $< -C -M -c $(POLICYVERS) -o $@.tmp $(PRIVATE_POL_CONF) + $(hide) grep -Fxv -f $(PRIVATE_REQD_MASK) $@.tmp > $@ + $(LOCAL_BUILT_MODULE) : PRIVATE_VERS := $(BOARD_SEPOLICY_VERS) -$(LOCAL_BUILT_MODULE) : PRIVATE_TGT_POL := $(plat_pub_policy.cil) +$(LOCAL_BUILT_MODULE) : PRIVATE_TGT_POL := $(nonplat_policy_raw) $(LOCAL_BUILT_MODULE) : PRIVATE_DEP_CIL_FILES := $(built_plat_cil) $(built_mapping_cil) -$(LOCAL_BUILT_MODULE) : $(plat_pub_policy.cil) $(HOST_OUT_EXECUTABLES)/version_policy \ - $(HOST_OUT_EXECUTABLES)/secilc $(built_plat_cil) $(built_mapping_cil) +$(LOCAL_BUILT_MODULE) : $(plat_pub_policy.cil) $(nonplat_policy_raw) \ +$(HOST_OUT_EXECUTABLES)/version_policy $(HOST_OUT_EXECUTABLES)/secilc \ +$(built_plat_cil) $(built_mapping_cil) @mkdir -p $(dir $@) $(HOST_OUT_EXECUTABLES)/version_policy -b $< -t $(PRIVATE_TGT_POL) -n $(PRIVATE_VERS) -o $@ $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -N -c $(POLICYVERS) \ $(PRIVATE_DEP_CIL_FILES) $@ -o /dev/null -f /dev/null -built_plat_pub_vers_cil := $(LOCAL_BUILT_MODULE) - -################################# -include $(CLEAR_VARS) - -# vendor_policy.cil - the vendor sepolicy. This needs attributization and to be combined -# with the platform-provided policy. It makes use of the reqd_policy_mask files from private -# policy and the platform public policy files in order to use checkpolicy. -LOCAL_MODULE := vendor_sepolicy.cil -LOCAL_MODULE_CLASS := ETC -LOCAL_MODULE_TAGS := optional -LOCAL_PROPRIETARY_MODULE := true -LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux - -include $(BUILD_SYSTEM)/base_rules.mk - -vendor_policy.conf := $(intermediates)/vendor_policy.conf -$(vendor_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS) -$(vendor_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS) -$(vendor_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch) -$(vendor_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) -$(vendor_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) -$(vendor_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT) -$(vendor_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY) -$(vendor_policy.conf): $(call build_policy, $(sepolicy_build_files), \ -$(PLAT_PUBLIC_POLICY) $(REQD_MASK_POLICY) $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS)) - $(transform-policy-to-conf) - $(hide) sed '/dontaudit/d' $@ > $@.dontaudit - -$(LOCAL_BUILT_MODULE): PRIVATE_POL_CONF := $(vendor_policy.conf) -$(LOCAL_BUILT_MODULE): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil) -$(LOCAL_BUILT_MODULE): PRIVATE_BASE_CIL := $(plat_pub_policy.cil) -$(LOCAL_BUILT_MODULE): PRIVATE_VERS := $(BOARD_SEPOLICY_VERS) -$(LOCAL_BUILT_MODULE): PRIVATE_DEP_CIL_FILES := $(built_plat_cil) $(built_plat_pub_vers_cil) $(built_mapping_cil) -$(LOCAL_BUILT_MODULE): PRIVATE_FILTER_CIL := $(built_plat_pub_vers_cil) -$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/build_sepolicy \ - $(vendor_policy.conf) $(reqd_policy_mask.cil) $(plat_pub_policy.cil) \ - $(built_plat_cil) $(built_plat_pub_vers_cil) $(built_mapping_cil) - @mkdir -p $(dir $@) - $(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) build_cil \ - -i $(PRIVATE_POL_CONF) -m $(PRIVATE_REQD_MASK) -c $(CHECKPOLICY_ASAN_OPTIONS) \ - -b $(PRIVATE_BASE_CIL) -d $(PRIVATE_DEP_CIL_FILES) -f $(PRIVATE_FILTER_CIL) \ - -t $(PRIVATE_VERS) -p $(POLICYVERS) -o $@ - -built_vendor_cil := $(LOCAL_BUILT_MODULE) -vendor_policy.conf := +built_nonplat_cil := $(LOCAL_BUILT_MODULE) +nonplat_policy.conf := +nonplat_policy_raw := ################################# include $(CLEAR_VARS) @@ -567,20 +544,16 @@ LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux include $(BUILD_SYSTEM)/base_rules.mk -all_cil_files := \ - $(built_plat_cil) \ - $(built_mapping_cil) \ - $(built_plat_pub_vers_cil) \ - $(built_vendor_cil) - -$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(all_cil_files) +$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := \ +$(built_plat_cil) $(built_mapping_cil) $(built_nonplat_cil) $(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG) -$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(all_cil_files) $(built_sepolicy_neverallows) +$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc \ +$(built_plat_cil) $(built_mapping_cil) $(built_nonplat_cil) \ +$(built_sepolicy_neverallows) $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) \ $(PRIVATE_CIL_FILES) -o $@ -f /dev/null built_precompiled_sepolicy := $(LOCAL_BUILT_MODULE) -all_cil_files := ################################# # SHA-256 digest of the plat_sepolicy.cil and mapping_sepolicy.cil files against @@ -613,8 +586,7 @@ include $(BUILD_SYSTEM)/base_rules.mk all_cil_files := \ $(built_plat_cil) \ $(built_mapping_cil) \ - $(built_plat_pub_vers_cil) \ - $(built_vendor_cil) + $(built_nonplat_cil) $(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(all_cil_files) $(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG) @@ -658,7 +630,7 @@ $(sepolicy.recovery.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEF $(sepolicy.recovery.conf): PRIVATE_TGT_RECOVERY := -D target_recovery=true $(sepolicy.recovery.conf): $(call build_policy, $(sepolicy_build_files), \ $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) \ - $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS)) + $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS)) $(transform-policy-to-conf) $(hide) sed '/dontaudit/d' $@ > $@.dontaudit ifeq ($(SELINUX_IGNORE_NEVERALLOWS),true) @@ -744,7 +716,7 @@ $(file_contexts.local.tmp): $(local_fcfiles_with_nl) @mkdir -p $(dir $@) $(hide) m4 -s $^ > $@ -device_fc_files := $(call build_vendor_policy, file_contexts) +device_fc_files := $(call build_device_policy, file_contexts) device_fcfiles_with_nl := $(call add_nl, $(device_fc_files), $(built_nl)) file_contexts.device.tmp := $(intermediates)/file_contexts.device.tmp @@ -755,8 +727,7 @@ $(file_contexts.device.tmp): $(device_fcfiles_with_nl) file_contexts.device.sorted.tmp := $(intermediates)/file_contexts.device.sorted.tmp $(file_contexts.device.sorted.tmp): PRIVATE_SEPOLICY := $(built_sepolicy) -$(file_contexts.device.sorted.tmp): $(file_contexts.device.tmp) $(built_sepolicy) \ - $(HOST_OUT_EXECUTABLES)/fc_sort $(HOST_OUT_EXECUTABLES)/checkfc +$(file_contexts.device.sorted.tmp): $(file_contexts.device.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/fc_sort $(HOST_OUT_EXECUTABLES)/checkfc @mkdir -p $(dir $@) $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e $(PRIVATE_SEPOLICY) $< $(hide) $(HOST_OUT_EXECUTABLES)/fc_sort $< $@ @@ -837,7 +808,7 @@ local_fcfiles_with_nl := ################################## include $(CLEAR_VARS) -LOCAL_MODULE := vendor_file_contexts +LOCAL_MODULE := nonplat_file_contexts LOCAL_MODULE_CLASS := ETC LOCAL_MODULE_TAGS := optional ifeq ($(PRODUCT_SEPOLICY_SPLIT),true) @@ -848,22 +819,22 @@ endif include $(BUILD_SYSTEM)/base_rules.mk -vendor_fc_files := $(call build_vendor_policy, file_contexts) -vendor_fcfiles_with_nl := $(call add_nl, $(vendor_fc_files), $(built_nl)) +nonplat_fc_files := $(call build_device_policy, file_contexts) +nonplat_fcfiles_with_nl := $(call add_nl, $(nonplat_fc_files), $(built_nl)) -$(LOCAL_BUILT_MODULE): PRIVATE_FC_FILES := $(vendor_fcfiles_with_nl) +$(LOCAL_BUILT_MODULE): PRIVATE_FC_FILES := $(nonplat_fcfiles_with_nl) $(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) $(LOCAL_BUILT_MODULE): PRIVATE_FC_SORT := $(HOST_OUT_EXECUTABLES)/fc_sort $(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/checkfc $(HOST_OUT_EXECUTABLES)/fc_sort \ -$(vendor_fcfiles_with_nl) $(built_sepolicy) +$(nonplat_fcfiles_with_nl) $(built_sepolicy) @mkdir -p $(dir $@) $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_FC_FILES) > $@.tmp $(hide) $< $(PRIVATE_SEPOLICY) $@.tmp $(hide) $(PRIVATE_FC_SORT) $@.tmp $@ -built_vendor_fc := $(LOCAL_BUILT_MODULE) -vendor_fc_files := -vendor_fcfiles_with_nl := +built_nonplat_fc := $(LOCAL_BUILT_MODULE) +nonplat_fc_files := +nonplat_fcfiles_with_nl := ################################## include $(CLEAR_VARS) @@ -881,15 +852,15 @@ $(LOCAL_BUILT_MODULE): $(built_plat_fc) ################################## include $(CLEAR_VARS) -LOCAL_MODULE := vendor_file_contexts.recovery -LOCAL_MODULE_STEM := vendor_file_contexts +LOCAL_MODULE := nonplat_file_contexts.recovery +LOCAL_MODULE_STEM := nonplat_file_contexts LOCAL_MODULE_CLASS := ETC LOCAL_MODULE_TAGS := optional LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT) include $(BUILD_SYSTEM)/base_rules.mk -$(LOCAL_BUILT_MODULE): $(built_vendor_fc) +$(LOCAL_BUILT_MODULE): $(built_nonplat_fc) $(hide) cp -f $< $@ ################################## @@ -918,7 +889,7 @@ plat_sc_files := ################################## include $(CLEAR_VARS) -LOCAL_MODULE := vendor_seapp_contexts +LOCAL_MODULE := nonplat_seapp_contexts LOCAL_MODULE_CLASS := ETC LOCAL_MODULE_TAGS := optional ifeq ($(PRODUCT_SEPOLICY_SPLIT),true) @@ -929,19 +900,19 @@ endif include $(BUILD_SYSTEM)/base_rules.mk -vendor_sc_files := $(call build_policy, seapp_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY)) +nonplat_sc_files := $(call build_policy, seapp_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY)) plat_sc_neverallow_files := $(call build_policy, seapp_contexts, $(PLAT_PRIVATE_POLICY)) $(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) -$(LOCAL_BUILT_MODULE): PRIVATE_SC_FILES := $(vendor_sc_files) +$(LOCAL_BUILT_MODULE): PRIVATE_SC_FILES := $(nonplat_sc_files) $(LOCAL_BUILT_MODULE): PRIVATE_SC_NEVERALLOW_FILES := $(plat_sc_neverallow_files) -$(LOCAL_BUILT_MODULE): $(built_sepolicy) $(vendor_sc_files) $(HOST_OUT_EXECUTABLES)/checkseapp $(plat_sc_neverallow_files) +$(LOCAL_BUILT_MODULE): $(built_sepolicy) $(nonplat_sc_files) $(HOST_OUT_EXECUTABLES)/checkseapp $(plat_sc_neverallow_files) @mkdir -p $(dir $@) $(hide) grep -ihe '^neverallow' $(PRIVATE_SC_NEVERALLOW_FILES) > $@.tmp $(hide) $(HOST_OUT_EXECUTABLES)/checkseapp -p $(PRIVATE_SEPOLICY) -o $@ $(PRIVATE_SC_FILES) $@.tmp -built_vendor_sc := $(LOCAL_BUILT_MODULE) -vendor_sc_files := +built_nonplat_sc := $(LOCAL_BUILT_MODULE) +nonplat_sc_files := ################################## include $(CLEAR_VARS) @@ -994,7 +965,7 @@ plat_property_contexts.tmp := ################################## include $(CLEAR_VARS) -LOCAL_MODULE := vendor_property_contexts +LOCAL_MODULE := nonplat_property_contexts LOCAL_MODULE_CLASS := ETC LOCAL_MODULE_TAGS := optional @@ -1006,24 +977,24 @@ endif include $(BUILD_SYSTEM)/base_rules.mk -vendor_pcfiles := $(call build_policy, property_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY)) +nonplat_pcfiles := $(call build_policy, property_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY)) -vendor_property_contexts.tmp := $(intermediates)/vendor_property_contexts.tmp -$(vendor_property_contexts.tmp): PRIVATE_PC_FILES := $(vendor_pcfiles) -$(vendor_property_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) -$(vendor_property_contexts.tmp): $(vendor_pcfiles) +nonplat_property_contexts.tmp := $(intermediates)/nonplat_property_contexts.tmp +$(nonplat_property_contexts.tmp): PRIVATE_PC_FILES := $(nonplat_pcfiles) +$(nonplat_property_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) +$(nonplat_property_contexts.tmp): $(nonplat_pcfiles) @mkdir -p $(dir $@) $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_PC_FILES) > $@ -$(LOCAL_BUILT_MODULE): $(vendor_property_contexts.tmp) $(HOST_OUT_EXECUTABLES)/property_info_checker +$(LOCAL_BUILT_MODULE): $(nonplat_property_contexts.tmp) $(HOST_OUT_EXECUTABLES)/property_info_checker @mkdir -p $(dir $@) $(hide) cp -f $< $@ $(hide) $(HOST_OUT_EXECUTABLES)/property_info_checker $@ -built_vendor_pc := $(LOCAL_BUILT_MODULE) -vendor_pcfiles := -vendor_property_contexts.tmp := +built_nonplat_pc := $(LOCAL_BUILT_MODULE) +nonplat_pcfiles := +nonplat_property_contexts.tmp := ################################## include $(CLEAR_VARS) @@ -1041,15 +1012,15 @@ $(LOCAL_BUILT_MODULE): $(built_plat_pc) ################################## include $(CLEAR_VARS) -LOCAL_MODULE := vendor_property_contexts.recovery -LOCAL_MODULE_STEM := vendor_property_contexts +LOCAL_MODULE := nonplat_property_contexts.recovery +LOCAL_MODULE_STEM := nonplat_property_contexts LOCAL_MODULE_CLASS := ETC LOCAL_MODULE_TAGS := optional LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT) include $(BUILD_SYSTEM)/base_rules.mk -$(LOCAL_BUILT_MODULE): $(built_vendor_pc) +$(LOCAL_BUILT_MODULE): $(built_nonplat_pc) $(hide) cp -f $< $@ ################################## @@ -1091,31 +1062,31 @@ ifneq ($(PRODUCT_SEPOLICY_SPLIT),true) include $(CLEAR_VARS) -LOCAL_MODULE := vendor_service_contexts +LOCAL_MODULE := nonplat_service_contexts LOCAL_MODULE_CLASS := ETC LOCAL_MODULE_TAGS := optional LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT) include $(BUILD_SYSTEM)/base_rules.mk -vendor_svcfiles := $(call build_policy, service_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY)) +nonplat_svcfiles := $(call build_policy, service_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY)) -vendor_service_contexts.tmp := $(intermediates)/vendor_service_contexts.tmp -$(vendor_service_contexts.tmp): PRIVATE_SVC_FILES := $(vendor_svcfiles) -$(vendor_service_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) -$(vendor_service_contexts.tmp): $(vendor_svcfiles) +nonplat_service_contexts.tmp := $(intermediates)/nonplat_service_contexts.tmp +$(nonplat_service_contexts.tmp): PRIVATE_SVC_FILES := $(nonplat_svcfiles) +$(nonplat_service_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) +$(nonplat_service_contexts.tmp): $(nonplat_svcfiles) @mkdir -p $(dir $@) $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@ $(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) -$(LOCAL_BUILT_MODULE): $(vendor_service_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP) +$(LOCAL_BUILT_MODULE): $(nonplat_service_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP) @mkdir -p $(dir $@) sed -e 's/#.*$$//' -e '/^$$/d' $< > $@ $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -s $(PRIVATE_SEPOLICY) $@ -built_vendor_svc := $(LOCAL_BUILT_MODULE) -vendor_svcfiles := -vendor_service_contexts.tmp := +built_nonplat_svc := $(LOCAL_BUILT_MODULE) +nonplat_svcfiles := +nonplat_service_contexts.tmp := endif @@ -1154,7 +1125,7 @@ plat_hwservice_contexts.tmp := ################################## include $(CLEAR_VARS) -LOCAL_MODULE := vendor_hwservice_contexts +LOCAL_MODULE := nonplat_hwservice_contexts LOCAL_MODULE_CLASS := ETC LOCAL_MODULE_TAGS := optional ifeq ($(PRODUCT_SEPOLICY_SPLIT),true) @@ -1165,24 +1136,23 @@ endif include $(BUILD_SYSTEM)/base_rules.mk -vendor_hwsvcfiles := $(call build_policy, hwservice_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY)) +nonplat_hwsvcfiles := $(call build_policy, hwservice_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY)) -vendor_hwservice_contexts.tmp := $(intermediates)/vendor_hwservice_contexts.tmp -$(vendor_hwservice_contexts.tmp): PRIVATE_SVC_FILES := $(vendor_hwsvcfiles) -$(vendor_hwservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) -$(vendor_hwservice_contexts.tmp): $(vendor_hwsvcfiles) +nonplat_hwservice_contexts.tmp := $(intermediates)/nonplat_hwservice_contexts.tmp +$(nonplat_hwservice_contexts.tmp): PRIVATE_SVC_FILES := $(nonplat_hwsvcfiles) +$(nonplat_hwservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) +$(nonplat_hwservice_contexts.tmp): $(nonplat_hwsvcfiles) @mkdir -p $(dir $@) $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@ $(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) -$(LOCAL_BUILT_MODULE): $(vendor_hwservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP) +$(LOCAL_BUILT_MODULE): $(nonplat_hwservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP) @mkdir -p $(dir $@) sed -e 's/#.*$$//' -e '/^$$/d' $< > $@ $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e -l $(PRIVATE_SEPOLICY) $@ -vendor_hwsvcfiles := -vendor_hwservice_contexts.tmp := - +nonplat_hwsvcfiles := +nonplat_hwservice_contexts.tmp := ################################## include $(CLEAR_VARS) @@ -1198,7 +1168,7 @@ endif include $(BUILD_SYSTEM)/base_rules.mk -vnd_svcfiles := $(call build_policy, vndservice_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY)) +vnd_svcfiles := $(call build_policy, vndservice_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY)) vndservice_contexts.tmp := $(intermediates)/vndservice_contexts.tmp $(vndservice_contexts.tmp): PRIVATE_SVC_FILES := $(vnd_svcfiles) @@ -1252,7 +1222,7 @@ plat_mac_perms_keys.tmp := ################################## include $(CLEAR_VARS) -LOCAL_MODULE := vendor_mac_permissions.xml +LOCAL_MODULE := nonplat_mac_permissions.xml LOCAL_MODULE_CLASS := ETC LOCAL_MODULE_TAGS := optional LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux @@ -1260,22 +1230,22 @@ LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux include $(BUILD_SYSTEM)/base_rules.mk # Build keys.conf -vendor_mac_perms_keys.tmp := $(intermediates)/vendor_keys.tmp -$(vendor_mac_perms_keys.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) -$(vendor_mac_perms_keys.tmp): $(call build_policy, keys.conf, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY)) +nonplat_mac_perms_keys.tmp := $(intermediates)/nonplat_keys.tmp +$(nonplat_mac_perms_keys.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) +$(nonplat_mac_perms_keys.tmp): $(call build_policy, keys.conf, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY)) @mkdir -p $(dir $@) $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@ -all_vendor_mac_perms_files := $(call build_policy, mac_permissions.xml, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY)) +all_nonplat_mac_perms_files := $(call build_policy, mac_permissions.xml, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY)) -$(LOCAL_BUILT_MODULE): PRIVATE_MAC_PERMS_FILES := $(all_vendor_mac_perms_files) -$(LOCAL_BUILT_MODULE): $(vendor_mac_perms_keys.tmp) $(HOST_OUT_EXECUTABLES)/insertkeys.py \ -$(all_vendor_mac_perms_files) +$(LOCAL_BUILT_MODULE): PRIVATE_MAC_PERMS_FILES := $(all_nonplat_mac_perms_files) +$(LOCAL_BUILT_MODULE): $(nonplat_mac_perms_keys.tmp) $(HOST_OUT_EXECUTABLES)/insertkeys.py \ +$(all_nonplat_mac_perms_files) @mkdir -p $(dir $@) $(hide) $(HOST_OUT_EXECUTABLES)/insertkeys.py -t $(TARGET_BUILD_VARIANT) -c $(TOP) $< -o $@ $(PRIVATE_MAC_PERMS_FILES) -vendor_mac_perms_keys.tmp := -all_vendor_mac_perms_files := +nonplat_mac_perms_keys.tmp := +all_nonplat_mac_perms_files := ################################# include $(CLEAR_VARS) @@ -1285,16 +1255,15 @@ LOCAL_MODULE_TAGS := tests include $(BUILD_SYSTEM)/base_rules.mk -all_fc_files := $(built_plat_fc) $(built_vendor_fc) -all_fc_args := $(foreach file, $(all_fc_files), -f $(file)) - sepolicy_tests := $(intermediates)/sepolicy_tests -$(sepolicy_tests): ALL_FC_ARGS := $(all_fc_args) +$(sepolicy_tests): PRIVATE_PLAT_FC := $(built_plat_fc) +$(sepolicy_tests): PRIVATE_NONPLAT_FC := $(built_nonplat_fc) $(sepolicy_tests): PRIVATE_SEPOLICY := $(built_sepolicy) -$(sepolicy_tests): $(HOST_OUT_EXECUTABLES)/sepolicy_tests $(all_fc_files) $(built_sepolicy) +$(sepolicy_tests): $(HOST_OUT_EXECUTABLES)/sepolicy_tests \ +$(built_plat_fc) $(built_nonplat_fc) $(built_sepolicy) @mkdir -p $(dir $@) $(hide) $(HOST_OUT_EXECUTABLES)/sepolicy_tests -l $(HOST_OUT)/lib64/libsepolwrap.$(SHAREDLIB_EXT) \ - $(ALL_FC_ARGS) -p $(PRIVATE_SEPOLICY) + -f $(PRIVATE_PLAT_FC) -f $(PRIVATE_NONPLAT_FC) -p $(PRIVATE_SEPOLICY) $(hide) touch $@ ################################## @@ -1399,11 +1368,9 @@ $(built_sepolicy_neverallows) $(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@ $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $@ -o $@ -f /dev/null -all_fc_files := $(built_plat_fc) $(built_vendor_fc) -all_fc_args := $(foreach file, $(all_fc_files), -f $(file)) - treble_sepolicy_tests := $(intermediates)/treble_sepolicy_tests -$(treble_sepolicy_tests): ALL_FC_ARGS := $(all_fc_args) +$(treble_sepolicy_tests): PRIVATE_PLAT_FC := $(built_plat_fc) +$(treble_sepolicy_tests): PRIVATE_NONPLAT_FC := $(built_nonplat_fc) $(treble_sepolicy_tests): PRIVATE_SEPOLICY := $(built_sepolicy) $(treble_sepolicy_tests): PRIVATE_SEPOLICY_OLD := $(built_26.0_plat_sepolicy) $(treble_sepolicy_tests): PRIVATE_COMBINED_MAPPING := $(26.0_mapping.combined.cil) @@ -1414,11 +1381,12 @@ else $(treble_sepolicy_tests): PRIVATE_FAKE_TREBLE := endif $(treble_sepolicy_tests): $(HOST_OUT_EXECUTABLES)/treble_sepolicy_tests \ - $(all_fc_files) $(built_sepolicy) $(built_plat_sepolicy) \ - $(built_26.0_plat_sepolicy) $(26.0_compat) $(26.0_mapping.combined.cil) +$(built_plat_fc) $(built_nonplat_fc) $(built_sepolicy) $(built_plat_sepolicy) \ +$(built_26.0_plat_sepolicy) $(26.0_compat) $(26.0_mapping.combined.cil) @mkdir -p $(dir $@) $(hide) $(HOST_OUT_EXECUTABLES)/treble_sepolicy_tests -l \ - $(HOST_OUT)/lib64/libsepolwrap.$(SHAREDLIB_EXT) $(ALL_FC_ARGS) \ + $(HOST_OUT)/lib64/libsepolwrap.$(SHAREDLIB_EXT) \ + -f $(PRIVATE_PLAT_FC) -f $(PRIVATE_NONPLAT_FC) \ -b $(PRIVATE_PLAT_SEPOLICY) -m $(PRIVATE_COMBINED_MAPPING) \ -o $(PRIVATE_SEPOLICY_OLD) -p $(PRIVATE_SEPOLICY) \ $(PRIVATE_FAKE_TREBLE) @@ -1441,24 +1409,23 @@ endif # ($(PRODUCT_SEPOLICY_SPLIT),true) ################################# add_nl := -build_vendor_policy := +build_device_policy := build_policy := built_plat_fc := -built_vendor_fc := +built_nonplat_fc := built_nl := built_plat_cil := -built_plat_pub_vers_cil := built_mapping_cil := built_plat_pc := -built_vendor_cil := -built_vendor_pc := -built_vendor_sc := +built_nonplat_cil := +built_nonplat_pc := +built_nonplat_sc := built_plat_sc := built_precompiled_sepolicy := built_sepolicy := built_sepolicy_neverallows := built_plat_svc := -built_vendor_svc := +built_nonplat_svc := mapping_policy := my_target_arch := plat_pub_policy.cil := diff --git a/CleanSpec.mk b/CleanSpec.mk index 3a302bb6c..d1e65e11a 100644 --- a/CleanSpec.mk +++ b/CleanSpec.mk @@ -83,3 +83,22 @@ $(call add-clean-step, rm -rf $(TARGET_OUT_VENDOR)/etc/selinux/nonplat_property_ $(call add-clean-step, rm -rf $(TARGET_OUT_VENDOR)/etc/selinux/nonplat_seapp_contexts) $(call add-clean-step, rm -rf $(PRODUCT_OUT)/recovery/root/nonplat_file_contexts) $(call add-clean-step, rm -rf $(PRODUCT_OUT)/recovery/root/nonplat_property_contexts) +# For non-Treble devices. +$(call add-clean-step, rm -rf $(PRODUCT_OUT)/root/nonplat_file_contexts) +$(call add-clean-step, rm -rf $(PRODUCT_OUT)/root/nonplat_hwservice_contexts) +$(call add-clean-step, rm -rf $(PRODUCT_OUT)/root/nonplat_property_contexts) +$(call add-clean-step, rm -rf $(PRODUCT_OUT)/root/nonplat_seapp_contexts) + +$(call add-clean-step, rm -rf $(TARGET_OUT_VENDOR)/etc/selinux/vendor_sepolicy.cil) +$(call add-clean-step, rm -rf $(TARGET_OUT_VENDOR)/etc/selinux/vendor_file_contexts) +$(call add-clean-step, rm -rf $(TARGET_OUT_VENDOR)/etc/selinux/vendor_hwservice_contexts) +$(call add-clean-step, rm -rf $(TARGET_OUT_VENDOR)/etc/selinux/vendor_mac_permissions.xml) +$(call add-clean-step, rm -rf $(TARGET_OUT_VENDOR)/etc/selinux/vendor_property_contexts) +$(call add-clean-step, rm -rf $(TARGET_OUT_VENDOR)/etc/selinux/vendor_seapp_contexts) +$(call add-clean-step, rm -rf $(PRODUCT_OUT)/recovery/root/vendor_file_contexts) +$(call add-clean-step, rm -rf $(PRODUCT_OUT)/recovery/root/vendor_property_contexts) +# For non-Treble devices. +$(call add-clean-step, rm -rf $(PRODUCT_OUT)/root/vendor_file_contexts) +$(call add-clean-step, rm -rf $(PRODUCT_OUT)/root/vendor_hwservice_contexts) +$(call add-clean-step, rm -rf $(PRODUCT_OUT)/root/vendor_property_contexts) +$(call add-clean-step, rm -rf $(PRODUCT_OUT)/root/vendor_seapp_contexts) diff --git a/build/Android.bp b/build/Android.bp deleted file mode 100644 index d3f1fc36b..000000000 --- a/build/Android.bp +++ /dev/null @@ -1,34 +0,0 @@ -// Copyright (C) 2018 The Android Open Source Project -// -// Licensed under the Apache License, Version 2.0 (the "License"); -// you may not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, software -// distributed under the License is distributed on an "AS IS" BASIS, -// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -// See the License for the specific language governing permissions and -// limitations under the License. - -python_binary_host { - name: "build_sepolicy", - srcs: [ - "build_sepolicy.py", - "file_utils.py", - ], - required: [ - "checkpolicy", - "secilc", - "version_policy", - ], - version: { - py2: { - enabled: true, - }, - py3: { - enabled: false, - }, - }, -} diff --git a/build/build_sepolicy.py b/build/build_sepolicy.py deleted file mode 100644 index ff2ff075d..000000000 --- a/build/build_sepolicy.py +++ /dev/null @@ -1,140 +0,0 @@ -# Copyright 2018 - The Android Open Source Project -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -"""Command-line tool to build SEPolicy files.""" - -import argparse -import os -import subprocess -import sys - -import file_utils - - -# All supported commands in this module. -# For each command, need to add two functions. Take 'build_cil' for example: -# - setup_build_cil() -# - Sets up command parsers and sets default function to do_build_cil(). -# - do_build_cil() -_SUPPORTED_COMMANDS = ('build_cil',) - - -def run_host_command(args, **kwargs): - """Runs a host command and prints output.""" - if kwargs.get('shell'): - command_log = args - else: - command_log = ' '.join(args) # For args as a sequence. - - try: - subprocess.check_call(args, **kwargs) - except subprocess.CalledProcessError as err: - sys.stderr.write( - 'build_sepolicy - failed to run command: {!r} (ret:{})\n'.format( - command_log, err.returncode)) - sys.exit(err.returncode) - - -def do_build_cil(args): - """Builds a sepolicy CIL (Common Intermediate Language) file. - - This functions invokes some host utils (e.g., secilc, checkpolicy, - version_sepolicy) to generate a .cil file. - - Args: - args: the parsed command arguments. - """ - # Determines the raw CIL file name. - input_file_name = os.path.splitext(args.input_policy_conf)[0] - raw_cil_file = input_file_name + '_raw.cil' - # Builds the raw CIL. - file_utils.make_parent_dirs(raw_cil_file) - checkpolicy_cmd = [args.checkpolicy_env] - checkpolicy_cmd += [os.path.join(args.android_host_path, 'checkpolicy'), - '-C', '-M', '-c', args.policy_vers, - '-o', raw_cil_file, args.input_policy_conf] - # Using shell=True to setup args.checkpolicy_env variables. - run_host_command(' '.join(checkpolicy_cmd), shell=True) - file_utils.filter_out([args.reqd_mask], raw_cil_file) - - # Builds the output CIL by versioning the above raw CIL. - output_file = args.output_cil - if output_file is None: - output_file = input_file_name + '.cil' - file_utils.make_parent_dirs(output_file) - - run_host_command([os.path.join(args.android_host_path, 'version_policy'), - '-b', args.base_policy, '-t', raw_cil_file, - '-n', args.treble_sepolicy_vers, '-o', output_file]) - if args.filter_out_files: - file_utils.filter_out(args.filter_out_files, output_file) - - # Tests that the output file can be merged with the given CILs. - if args.dependent_cils: - merge_cmd = [os.path.join(args.android_host_path, 'secilc'), - '-m', '-M', 'true', '-G', '-N', '-c', args.policy_vers] - merge_cmd += args.dependent_cils # the give CILs to merge - merge_cmd += [output_file, '-o', '/dev/null', '-f', '/dev/null'] - run_host_command(merge_cmd) - - -def setup_build_cil(subparsers): - """Sets up command args for 'build_cil' command.""" - - # Required arguments. - parser = subparsers.add_parser('build_cil', help='build CIL files') - parser.add_argument('-i', '--input_policy_conf', required=True, - help='source policy.conf') - parser.add_argument('-m', '--reqd_mask', required=True, - help='the bare minimum policy.conf to use checkpolicy') - parser.add_argument('-b', '--base_policy', required=True, - help='base policy for versioning') - parser.add_argument('-t', '--treble_sepolicy_vers', required=True, - help='the version number to use for Treble-OTA') - parser.add_argument('-p', '--policy_vers', required=True, - help='SELinux policy version') - - # Optional arguments. - parser.add_argument('-c', '--checkpolicy_env', - help='environment variables passed to checkpolicy') - parser.add_argument('-f', '--filter_out_files', nargs='+', - help='the pattern files to filter out the output cil') - parser.add_argument('-d', '--dependent_cils', nargs='+', - help=('check the output file can be merged with ' - 'the dependent cil files')) - parser.add_argument('-o', '--output_cil', help='the output cil file') - - # The function that performs the actual works. - parser.set_defaults(func=do_build_cil) - - -def run(argv): - """Sets up command parser and execuates sub-command.""" - parser = argparse.ArgumentParser() - - # Adds top-level arguments. - parser.add_argument('-a', '--android_host_path', default='', - help='a path to host out executables') - - # Adds subparsers for each COMMAND. - subparsers = parser.add_subparsers(title='COMMAND') - for command in _SUPPORTED_COMMANDS: - globals()['setup_' + command](subparsers) - - args = parser.parse_args(argv[1:]) - args.func(args) - - -if __name__ == '__main__': - run(sys.argv) diff --git a/build/file_utils.py b/build/file_utils.py deleted file mode 100644 index 1559a9b9d..000000000 --- a/build/file_utils.py +++ /dev/null @@ -1,49 +0,0 @@ -# Copyright 2018 - The Android Open Source Project -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -"""File-related utilities.""" - - -import os -import shutil -import tempfile - - -def make_parent_dirs(file_path): - """Creates parent directories for the file_path.""" - if os.path.exists(file_path): - return - - parent_dir = os.path.dirname(file_path) - if parent_dir and not os.path.exists(parent_dir): - os.makedirs(parent_dir) - - -def filter_out(pattern_files, input_file): - """"Removes lines in input_file that match any line in pattern_files.""" - - # Prepares patterns. - patterns = [] - for f in pattern_files: - patterns.extend(open(f).readlines()) - - # Copy lines that are not in the pattern. - tmp_output = tempfile.NamedTemporaryFile() - with open(input_file, 'r') as in_file: - tmp_output.writelines(line for line in in_file.readlines() - if line not in patterns) - tmp_output.flush() - - # Replaces the input_file. - shutil.copyfile(tmp_output.name, input_file) diff --git a/private/file_contexts b/private/file_contexts index 25d0d9d70..1840c8dc9 100644 --- a/private/file_contexts +++ b/private/file_contexts @@ -46,20 +46,14 @@ /plat_sepolicy\.cil u:object_r:sepolicy_file:s0 /plat_property_contexts u:object_r:property_contexts_file:s0 /nonplat_property_contexts u:object_r:property_contexts_file:s0 -/vendor_property_contexts u:object_r:property_contexts_file:s0 /seapp_contexts u:object_r:seapp_contexts_file:s0 /nonplat_seapp_contexts u:object_r:seapp_contexts_file:s0 -/vendor_seapp_contexts u:object_r:seapp_contexts_file:s0 /plat_seapp_contexts u:object_r:seapp_contexts_file:s0 /sepolicy u:object_r:sepolicy_file:s0 /plat_service_contexts u:object_r:service_contexts_file:s0 /plat_hwservice_contexts u:object_r:hwservice_contexts_file:s0 /nonplat_service_contexts u:object_r:nonplat_service_contexts_file:s0 -# Use nonplat_service_contexts_file to allow servicemanager to read it -# on non full-treble devices. -/vendor_service_contexts u:object_r:nonplat_service_contexts_file:s0 /nonplat_hwservice_contexts u:object_r:hwservice_contexts_file:s0 -/vendor_hwservice_contexts u:object_r:hwservice_contexts_file:s0 /vndservice_contexts u:object_r:vndservice_contexts_file:s0 ##########################