tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/microdroid/Android.bp
Jiyong Park 2fcfc6f190 Use no_full_install: true instead of installable: false 
So far, we have used `instalable: false` to avoid collision with the
other modules that are installed to the same path. A typical example was
<foo> and <foo>.microdroid. The latter is a modified version of the
former for the inclusion of the microdroid image. They however both have
the same instalation path (ex: system/bin) and stem (ex: foo) so that we
can reference them using the same path regardless of whether we are in
Android or microdroid.

However, the use of `installable: false` for the purpose is actually
incorrect, because `installable: false` also means, obviously, "this
module shouldn't be installed". The only reason this incorrect way has
worked is simply because packaging modules (ex: android_filesystem)
didn't respect the property when gathering the modules.

As packaging modules are now fixed to respect `installable: false`, we
need a correct way of avoiding the collision. `no_full_install: true` is
it.

If a module has this property set to true, it is never installed to the
full instal path like out/target/product/<partition>/... It can be
installed only via packaging modules.

Bug: 338160898
Test: m
Change-Id: I267031c68f2157a679a1fceb3ae684bb7580c77c
2024-05-01 21:14:22 +09:00

295 lines
8.3 KiB
Text
Raw Blame History

// Copyright (C) 2021 The Android Open Source Project
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package {
// http://go/android-license-faq
// A large-scale-change added 'default_applicable_licenses' to import
// the below license kinds from "system_sepolicy_license":
// SPDX-license-identifier-Apache-2.0
default_applicable_licenses: ["system_sepolicy_license"],
}
system_policy_files = [
"system/private/security_classes",
"system/private/initial_sids",
"system/private/access_vectors",
"system/public/global_macros",
"system/public/neverallow_macros",
"system/private/mls_macros",
"system/private/mls_decl",
"system/private/mls",
"system/private/policy_capabilities",
"system/public/te_macros",
"system/public/attributes",
"system/private/attributes",
"system/public/ioctl_defines",
"system/public/ioctl_macros",
"system/public/*.te",
"system/private/*.te",
"system/private/roles_decl",
"system/public/roles",
"system/private/users",
"system/private/initial_sid_contexts",
"system/private/fs_use",
"system/private/genfs_contexts",
"system/private/port_contexts",
]
reqd_mask_files = [
"reqd_mask/security_classes",
"reqd_mask/initial_sids",
"reqd_mask/access_vectors",
"reqd_mask/mls_macros",
"reqd_mask/mls_decl",
"reqd_mask/mls",
"reqd_mask/reqd_mask.te",
"reqd_mask/roles_decl",
"reqd_mask/roles",
"reqd_mask/users",
"reqd_mask/initial_sid_contexts",
]
system_public_policy_files = [
"reqd_mask/security_classes",
"reqd_mask/initial_sids",
"reqd_mask/access_vectors",
"system/public/global_macros",
"system/public/neverallow_macros",
"reqd_mask/mls_macros",
"reqd_mask/mls_decl",
"reqd_mask/mls",
"system/public/te_macros",
"system/public/attributes",
"system/public/ioctl_defines",
"system/public/ioctl_macros",
"system/public/*.te",
"reqd_mask/reqd_mask.te",
"reqd_mask/roles_decl",
"reqd_mask/roles",
"system/public/roles",
"reqd_mask/users",
"reqd_mask/initial_sid_contexts",
]
vendor_policy_files = [
"reqd_mask/security_classes",
"reqd_mask/initial_sids",
"reqd_mask/access_vectors",
"system/public/global_macros",
"system/public/neverallow_macros",
"reqd_mask/mls_macros",
"reqd_mask/mls_decl",
"reqd_mask/mls",
"system/public/te_macros",
"system/public/attributes",
"system/public/ioctl_defines",
"system/public/ioctl_macros",
"system/public/*.te",
"reqd_mask/reqd_mask.te",
"vendor/*.te",
"reqd_mask/roles_decl",
"reqd_mask/roles",
"system/public/roles",
"reqd_mask/users",
"reqd_mask/initial_sid_contexts",
]
se_policy_conf {
name: "microdroid_reqd_policy_mask.conf",
srcs: reqd_mask_files,
installable: false,
mls_cats: 1,
}
se_policy_cil {
name: "microdroid_reqd_policy_mask.cil",
src: ":microdroid_reqd_policy_mask.conf",
secilc_check: false,
installable: false,
}
se_policy_conf {
name: "microdroid_plat_sepolicy.conf",
srcs: system_policy_files,
installable: false,
mls_cats: 1,
}
se_policy_cil {
name: "microdroid_plat_sepolicy.cil",
stem: "plat_sepolicy.cil",
src: ":microdroid_plat_sepolicy.conf",
installable: false,
}
se_policy_conf {
name: "microdroid_plat_pub_policy.conf",
srcs: system_public_policy_files,
installable: false,
mls_cats: 1,
}
se_policy_cil {
name: "microdroid_plat_pub_policy.cil",
src: ":microdroid_plat_pub_policy.conf",
filter_out: [":microdroid_reqd_policy_mask.cil"],
secilc_check: false,
installable: false,
}
se_versioned_policy {
name: "microdroid_plat_mapping_file",
base: ":microdroid_plat_pub_policy.cil",
mapping: true,
version: "current",
relative_install_path: "mapping", // install to /system/etc/selinux/mapping
installable: false,
}
se_versioned_policy {
name: "microdroid_plat_pub_versioned.cil",
stem: "plat_pub_versioned.cil",
base: ":microdroid_plat_pub_policy.cil",
target_policy: ":microdroid_plat_pub_policy.cil",
version: "current",
dependent_cils: [
":microdroid_plat_sepolicy.cil",
":microdroid_plat_mapping_file",
],
installable: false,
}
se_policy_conf {
name: "microdroid_vendor_sepolicy.conf",
srcs: vendor_policy_files,
installable: false,
mls_cats: 1,
}
se_policy_cil {
name: "microdroid_vendor_sepolicy.cil.raw",
src: ":microdroid_vendor_sepolicy.conf",
filter_out: [":microdroid_reqd_policy_mask.cil"],
secilc_check: false, // will be done in se_versioned_policy module
installable: false,
}
se_versioned_policy {
name: "microdroid_vendor_sepolicy.cil",
stem: "vendor_sepolicy.cil",
base: ":microdroid_plat_pub_policy.cil",
target_policy: ":microdroid_vendor_sepolicy.cil.raw",
version: "current", // microdroid is bundled to system
dependent_cils: [
":microdroid_plat_sepolicy.cil",
":microdroid_plat_pub_versioned.cil",
":microdroid_plat_mapping_file",
],
filter_out: [":microdroid_plat_pub_versioned.cil"],
installable: false,
}
sepolicy_vers {
name: "microdroid_plat_sepolicy_vers.txt",
version: "platform",
stem: "plat_sepolicy_vers.txt",
installable: false,
}
// sepolicy sha256 for vendor
genrule {
name: "microdroid_plat_sepolicy_and_mapping.sha256_gen",
srcs: [
":microdroid_plat_sepolicy.cil",
":microdroid_plat_mapping_file",
],
out: ["microdroid_plat_sepolicy_and_mapping.sha256"],
cmd: "cat $(in) | sha256sum | cut -d' ' -f1 > $(out)",
}
prebuilt_etc {
name: "microdroid_plat_sepolicy_and_mapping.sha256",
src: ":microdroid_plat_sepolicy_and_mapping.sha256_gen",
filename: "plat_sepolicy_and_mapping.sha256",
relative_install_path: "selinux",
installable: false,
}
prebuilt_etc {
name: "microdroid_precompiled_sepolicy.plat_sepolicy_and_mapping.sha256",
src: ":microdroid_plat_sepolicy_and_mapping.sha256_gen",
filename: "precompiled_sepolicy.plat_sepolicy_and_mapping.sha256",
relative_install_path: "selinux",
installable: false,
}
se_policy_binary {
name: "microdroid_precompiled_sepolicy",
stem: "microdroid_precompiled_sepolicy",
srcs: [
":microdroid_plat_sepolicy.cil",
":microdroid_plat_mapping_file",
":microdroid_plat_pub_versioned.cil",
":microdroid_vendor_sepolicy.cil",
],
no_full_install: true,
// b/259729287. In Microdroid, su is allowed to be in permissive mode.
// This is to support fully debuggable VMs on user builds. This is safe
// because we don't start adbd at all on non-debuggable VMs.
permissive_domains_on_user_builds: ["su"],
}
genrule {
name: "microdroid_file_contexts.gen",
srcs: ["system/private/file_contexts"],
tools: ["fc_sort"],
out: ["file_contexts"],
cmd: "sed -e 's/#.*$$//' -e '/^$$/d' $(in) > $(out).tmp && " +
"$(location fc_sort) -i $(out).tmp -o $(out)",
}
prebuilt_etc {
name: "microdroid_file_contexts",
filename: "plat_file_contexts",
src: ":microdroid_file_contexts.gen",
relative_install_path: "selinux",
no_full_install: true,
}
genrule {
name: "microdroid_vendor_file_contexts.gen",
srcs: ["vendor/file_contexts"],
tools: ["fc_sort"],
out: ["file_contexts"],
cmd: "sed -e 's/#.*$$//' -e '/^$$/d' $(in) > $(out).tmp && " +
"$(location fc_sort) -i $(out).tmp -o $(out)",
}
prebuilt_etc {
name: "microdroid_property_contexts",
filename: "plat_property_contexts",
src: "system/private/property_contexts",
relative_install_path: "selinux",
no_full_install: true,
}
// For CTS
se_policy_conf {
name: "microdroid_general_sepolicy.conf",
srcs: system_policy_files,
exclude_build_test: true,
installable: false,
mls_cats: 1,
}
Reference in a new issue View git blame Copy permalink