cd05d74494
Types defined in system_ext/public or product/public can be referenced by vendor side so it is important to make sure functionality is not broken across version bumps. So we are adding the treble sepolicy test cases for system_ext and product sepolicy. Bug: 173571515 Change-Id: Ia45979497029f83b1ae6712d2d26ffab263a7f91 Merged-In: Ia45979497029f83b1ae6712d2d26ffab263a7f91
195 lines
9.6 KiB
Makefile
195 lines
9.6 KiB
Makefile
version := $(version_under_treble_tests)
|
|
|
|
include $(CLEAR_VARS)
|
|
# For Treble builds run tests verifying that processes are properly labeled and
|
|
# permissions granted do not violate the treble model. Also ensure that treble
|
|
# compatibility guarantees are upheld between SELinux version bumps.
|
|
LOCAL_MODULE := treble_sepolicy_tests_$(version)
|
|
LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
|
|
LOCAL_LICENSE_CONDITIONS := notice unencumbered
|
|
LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
|
|
LOCAL_MODULE_CLASS := FAKE
|
|
LOCAL_MODULE_TAGS := optional
|
|
|
|
# BOARD_SYSTEM_EXT_PREBUILT_DIR can be set as system_ext prebuilt dir in sepolicy
|
|
# make file of the system_ext partition.
|
|
SYSTEM_EXT_PREBUILT_POLICY := $(BOARD_SYSTEM_EXT_PREBUILT_DIR)
|
|
# BOARD_PRODUCT_PREBUILT_DIR can be set as product prebuilt dir in sepolicy
|
|
# make file of the product partition.
|
|
PRODUCT_PREBUILT_POLICY := $(BOARD_PRODUCT_PREBUILT_DIR)
|
|
# BOARD_PLAT_PUB_VERSIONED_POLICY - path_to_plat_pub_versioned_of_vendor
|
|
# plat_pub_versioned.cil should be in
|
|
# $(BOARD_PLAT_PUB_VERSIONED_POLICY)/prebuilts/api/$(version) dir.
|
|
# plat_pub_versioned.cil should have platform, system_ext and product sepolicies
|
|
# similar to system/sepolicy/prebuilts/api/$(version/plat_pub_verioned.cil file.
|
|
# In order to enable treble sepolicy tests for platform, system_ext and product
|
|
# sepolicies SYSTEM_EXT_PREBUILT_POLICY , PRODUCT_PREBUILT_POLICY and
|
|
# BOARD_PLAT_PUB_VERSIONED_POLICY should be set.
|
|
IS_TREBLE_TEST_ENABLED_PARTNER := false
|
|
ifeq ($(filter 26.0 27.0 28.0 29.0,$(version)),)
|
|
ifneq (,$(BOARD_PLAT_PUB_VERSIONED_POLICY))
|
|
IS_TREBLE_TEST_ENABLED_PARTNER := true
|
|
endif # (,$(BOARD_PLAT_PUB_VERSIONED_POLICY))
|
|
endif # ($(filter 26.0 27.0 28.0 29.0,$(version)),)
|
|
|
|
include $(BUILD_SYSTEM)/base_rules.mk
|
|
|
|
# $(version)_plat - the platform policy shipped as part of the $(version) release. This is
|
|
# built to enable us to determine the diff between the current policy and the
|
|
# $(version) policy, which will be used in tests to make sure that compatibility has
|
|
# been maintained by our mapping files.
|
|
$(version)_PLAT_PUBLIC_POLICY := $(LOCAL_PATH)/prebuilts/api/$(version)/public
|
|
$(version)_PLAT_PRIVATE_POLICY := $(LOCAL_PATH)/prebuilts/api/$(version)/private
|
|
ifeq ($(IS_TREBLE_TEST_ENABLED_PARTNER),true)
|
|
ifneq (,$(SYSTEM_EXT_PREBUILT_POLICY))
|
|
$(version)_PLAT_PUBLIC_POLICY += \
|
|
$(SYSTEM_EXT_PREBUILT_POLICY)/prebuilts/api/$(version)/public
|
|
$(version)_PLAT_PRIVATE_POLICY += \
|
|
$(SYSTEM_EXT_PREBUILT_POLICY)/prebuilts/api/$(version)/private
|
|
endif # (,$(SYSTEM_EXT_PREBUILT_POLICY))
|
|
ifneq (,$(PRODUCT_PREBUILT_POLICY))
|
|
$(version)_PLAT_PUBLIC_POLICY += \
|
|
$(PRODUCT_PREBUILT_POLICY)/prebuilts/api/$(version)/public
|
|
$(version)_PLAT_PRIVATE_POLICY += \
|
|
$(PRODUCT_PREBUILT_POLICY)/prebuilts/api/$(version)/private
|
|
endif # (,$(PRODUCT_PREBUILT_POLICY))
|
|
endif # ($(IS_TREBLE_TEST_ENABLED_PARTNER),true)
|
|
policy_files := $(call build_policy, $(sepolicy_build_files), $($(version)_PLAT_PUBLIC_POLICY) $($(version)_PLAT_PRIVATE_POLICY))
|
|
$(version)_plat_policy.conf := $(intermediates)/$(version)_plat_policy.conf
|
|
$($(version)_plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
|
|
$($(version)_plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
|
|
$($(version)_plat_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := user
|
|
$($(version)_plat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
|
|
$($(version)_plat_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
|
|
$($(version)_plat_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
|
|
$($(version)_plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
|
|
$($(version)_plat_policy.conf): PRIVATE_SEPOLICY_SPLIT := true
|
|
$($(version)_plat_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
|
|
$($(version)_plat_policy.conf): $(policy_files) $(M4)
|
|
$(transform-policy-to-conf)
|
|
$(hide) sed '/dontaudit/d' $@ > $@.dontaudit
|
|
|
|
policy_files :=
|
|
|
|
built_$(version)_plat_sepolicy := $(intermediates)/built_$(version)_plat_sepolicy
|
|
$(built_$(version)_plat_sepolicy): PRIVATE_ADDITIONAL_CIL_FILES := \
|
|
$(call build_policy, technical_debt.cil , $($(version)_PLAT_PRIVATE_POLICY))
|
|
$(built_$(version)_plat_sepolicy): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
|
|
$(built_$(version)_plat_sepolicy): $($(version)_plat_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
|
|
$(HOST_OUT_EXECUTABLES)/secilc \
|
|
$(call build_policy, technical_debt.cil, $($(version)_PLAT_PRIVATE_POLICY)) \
|
|
$(built_sepolicy_neverallows)
|
|
@mkdir -p $(dir $@)
|
|
$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \
|
|
$(POLICYVERS) -o $@ $<
|
|
$(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@
|
|
$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $@ -o $@ -f /dev/null
|
|
|
|
$(version)_plat_policy.conf :=
|
|
|
|
# $(version)_compat - the current plat_sepolicy.cil built with the compatibility file
|
|
# targeting the $(version) SELinux release. This ensures that our policy will build
|
|
# when used on a device that has non-platform policy targetting the $(version) release.
|
|
$(version)_compat := $(intermediates)/$(version)_compat
|
|
$(version)_mapping.cil := $(call intermediates-dir-for,ETC,plat_$(version).cil)/plat_$(version).cil
|
|
$(version)_mapping.ignore.cil := \
|
|
$(call intermediates-dir-for,ETC,$(version).ignore.cil)/$(version).ignore.cil
|
|
$(version)_prebuilts_dir := $(LOCAL_PATH)/prebuilts/api/$(version)
|
|
ifeq ($(IS_TREBLE_TEST_ENABLED_PARTNER),true)
|
|
ifneq (,$(SYSTEM_EXT_PREBUILT_POLICY))
|
|
$(version)_mapping.cil += \
|
|
$(call intermediates-dir-for,ETC,system_ext_$(version).cil)/system_ext_$(version).cil
|
|
$(version)_mapping.ignore.cil += \
|
|
$(call intermediates-dir-for,ETC,system_ext_$(version).ignore.cil)/system_ext_$(version).ignore.cil
|
|
endif # (,$(SYSTEM_EXT_PREBUILT_POLICY))
|
|
ifneq (,$(PRODUCT_PREBUILT_POLICY))
|
|
$(version)_mapping.cil += \
|
|
$(call intermediates-dir-for,ETC,product_$(version).cil)/product_$(version).cil
|
|
$(version)_mapping.ignore.cil += \
|
|
$(call intermediates-dir-for,ETC,product_$(version).ignore.cil)/product_$(version).ignore.cil
|
|
endif # (,$(PRODUCT_PREBUILT_POLICY))
|
|
$(version)_prebuilts_dir := $(BOARD_PLAT_PUB_VERSIONED_POLICY)/prebuilts/api/$(version)
|
|
endif #($(IS_TREBLE_TEST_ENABLED_PARTNER),true)
|
|
|
|
# vendor_sepolicy.cil and plat_pub_versioned.cil are the new design to replace
|
|
# nonplat_sepolicy.cil.
|
|
$(version)_nonplat := $($(version)_prebuilts_dir)/vendor_sepolicy.cil \
|
|
$($(version)_prebuilts_dir)/plat_pub_versioned.cil
|
|
ifeq (,$(wildcard $($(version)_nonplat)))
|
|
$(version)_nonplat := $($(version)_prebuilts_dir)/nonplat_sepolicy.cil
|
|
endif
|
|
|
|
cil_files := $(built_plat_cil)
|
|
ifeq ($(IS_TREBLE_TEST_ENABLED_PARTNER),true)
|
|
ifneq (,$(SYSTEM_EXT_PREBUILT_POLICY)
|
|
cil_files += $(built_system_ext_cil)
|
|
endif # (,$(SYSTEM_EXT_PREBUILT_POLICY)
|
|
ifneq (,$(PRODUCT_PREBUILT_POLICY)
|
|
cil_files += $(built_product_cil)
|
|
endif # (,$(PRODUCT_PREBUILT_POLICY)
|
|
endif # ($(IS_TREBLE_TEST_ENABLED_PARTNER),true)
|
|
cil_files += $($(version)_mapping.cil) $($(version)_nonplat)
|
|
$($(version)_compat): PRIVATE_CIL_FILES := $(cil_files)
|
|
$($(version)_compat): $(HOST_OUT_EXECUTABLES)/secilc $(cil_files)
|
|
$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -N -c $(POLICYVERS) \
|
|
$(PRIVATE_CIL_FILES) -o $@ -f /dev/null
|
|
|
|
# $(version)_mapping.combined.cil - a combination of the mapping file used when
|
|
# combining the current platform policy with nonplatform policy based on the
|
|
# $(version) policy release and also a special ignored file that exists purely for
|
|
# these tests.
|
|
$(version)_mapping.combined.cil := $(intermediates)/$(version)_mapping.combined.cil
|
|
$($(version)_mapping.combined.cil): $($(version)_mapping.cil) $($(version)_mapping.ignore.cil)
|
|
mkdir -p $(dir $@)
|
|
cat $^ > $@
|
|
|
|
ifeq ($(IS_TREBLE_TEST_ENABLED_PARTNER),true)
|
|
built_sepolicy_files := $(built_product_sepolicy)
|
|
public_cil_files := $(base_product_pub_policy.cil)
|
|
else
|
|
built_sepolicy_files := $(built_plat_sepolicy)
|
|
public_cil_files := $(base_plat_pub_policy.cil)
|
|
endif # ($(IS_TREBLE_TEST_ENABLED_PARTNER),true)
|
|
$(LOCAL_BUILT_MODULE): ALL_FC_ARGS := $(all_fc_args)
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY_OLD := $(built_$(version)_plat_sepolicy)
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_COMBINED_MAPPING := $($(version)_mapping.combined.cil)
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_PLAT_SEPOLICY := $(built_sepolicy_files)
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_PLAT_PUB_SEPOLICY := $(public_cil_files)
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_FAKE_TREBLE :=
|
|
ifeq ($(PRODUCT_FULL_TREBLE_OVERRIDE),true)
|
|
# TODO(b/113124961): remove fake-treble
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_FAKE_TREBLE := --fake-treble
|
|
endif # PRODUCT_FULL_TREBLE_OVERRIDE = true
|
|
$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/treble_sepolicy_tests \
|
|
$(all_fc_files) $(built_sepolicy) \
|
|
$(built_sepolicy_files) \
|
|
$(public_cil_files) \
|
|
$(built_$(version)_plat_sepolicy) $($(version)_compat) $($(version)_mapping.combined.cil)
|
|
@mkdir -p $(dir $@)
|
|
$(hide) $(HOST_OUT_EXECUTABLES)/treble_sepolicy_tests -l \
|
|
$(HOST_OUT)/lib64/libsepolwrap.$(SHAREDLIB_EXT) $(ALL_FC_ARGS) \
|
|
-b $(PRIVATE_PLAT_SEPOLICY) -m $(PRIVATE_COMBINED_MAPPING) \
|
|
-o $(PRIVATE_SEPOLICY_OLD) -p $(PRIVATE_SEPOLICY) \
|
|
-u $(PRIVATE_PLAT_PUB_SEPOLICY) \
|
|
$(PRIVATE_FAKE_TREBLE)
|
|
$(hide) touch $@
|
|
|
|
$(version)_SYSTEM_EXT_PUBLIC_POLICY :=
|
|
$(version)_SYSTEM_EXT_PRIVATE_POLICY :=
|
|
$(version)_PRODUCT_PUBLIC_POLICY :=
|
|
$(version)_PRODUCT_PRIVATE_POLICY :=
|
|
$(version)_PLAT_PUBLIC_POLICY :=
|
|
$(version)_PLAT_PRIVATE_POLICY :=
|
|
built_sepolicy_files :=
|
|
public_cil_files :=
|
|
cil_files :=
|
|
$(version)_compat :=
|
|
$(version)_mapping.cil :=
|
|
$(version)_mapping.combined.cil :=
|
|
$(version)_mapping.ignore.cil :=
|
|
$(version)_nonplat :=
|
|
$(version)_prebuilts_dir :=
|
|
built_$(version)_plat_sepolicy :=
|
|
version :=
|
|
version_under_treble_tests :=
|