7629e86053
This replaces the following policy files with Android.bp modules: - reqd_policy_mask.cil - plat_sepolicy.cil - system_ext_sepolicy.cil - product_sepolicy.cil - plat_pub_policy.cil - system_ext_pub_policy.cil - pub_policy.cil - general_sepolicy.conf (for CTS) Also microdroid's system policy now uses above. Bug: 33691272 Bug: 178993690 Test: policy files stay same Test: boot normal device and microdroid, see sepolicy works Test: build CtsSecurityHostTestCases Change-Id: I908a33badee04fbbdadc6780aab52e989923ba57
792 lines
20 KiB
Text
792 lines
20 KiB
Text
// Copyright (C) 2018 The Android Open Source Project
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
package {
|
|
default_applicable_licenses: ["system_sepolicy_license"],
|
|
}
|
|
|
|
// Added automatically by a large-scale-change that took the approach of
|
|
// 'apply every license found to every target'. While this makes sure we respect
|
|
// every license restriction, it may not be entirely correct.
|
|
//
|
|
// e.g. GPL in an MIT project might only apply to the contrib/ directory.
|
|
//
|
|
// Please consider splitting the single license below into multiple licenses,
|
|
// taking care not to lose any license_kind information, and overriding the
|
|
// default license using the 'licenses: [...]' property on targets as needed.
|
|
//
|
|
// For unused files, consider creating a 'filegroup' with "//visibility:private"
|
|
// to attach the license to, and including a comment whether the files may be
|
|
// used in the current project.
|
|
// http://go/android-license-faq
|
|
license {
|
|
name: "system_sepolicy_license",
|
|
visibility: [":__subpackages__"],
|
|
license_kinds: [
|
|
"SPDX-license-identifier-Apache-2.0",
|
|
"legacy_unencumbered",
|
|
],
|
|
license_text: [
|
|
"NOTICE",
|
|
],
|
|
}
|
|
|
|
cc_defaults { name: "selinux_policy_version", cflags: ["-DSEPOLICY_VERSION=30"], }
|
|
|
|
se_filegroup {
|
|
name: "26.0.board.compat.map",
|
|
srcs: [
|
|
"compat/26.0/26.0.cil",
|
|
],
|
|
}
|
|
|
|
se_filegroup {
|
|
name: "27.0.board.compat.map",
|
|
srcs: [
|
|
"compat/27.0/27.0.cil",
|
|
],
|
|
}
|
|
|
|
se_filegroup {
|
|
name: "28.0.board.compat.map",
|
|
srcs: [
|
|
"compat/28.0/28.0.cil",
|
|
],
|
|
}
|
|
|
|
se_filegroup {
|
|
name: "29.0.board.compat.map",
|
|
srcs: [
|
|
"compat/29.0/29.0.cil",
|
|
],
|
|
}
|
|
|
|
se_filegroup {
|
|
name: "30.0.board.compat.map",
|
|
srcs: [
|
|
"compat/30.0/30.0.cil",
|
|
],
|
|
}
|
|
|
|
se_filegroup {
|
|
name: "26.0.board.ignore.map",
|
|
srcs: [
|
|
"compat/26.0/26.0.ignore.cil",
|
|
],
|
|
}
|
|
|
|
se_filegroup {
|
|
name: "27.0.board.ignore.map",
|
|
srcs: [
|
|
"compat/27.0/27.0.ignore.cil",
|
|
],
|
|
}
|
|
|
|
se_filegroup {
|
|
name: "28.0.board.ignore.map",
|
|
srcs: [
|
|
"compat/28.0/28.0.ignore.cil",
|
|
],
|
|
}
|
|
|
|
se_filegroup {
|
|
name: "29.0.board.ignore.map",
|
|
srcs: [
|
|
"compat/29.0/29.0.ignore.cil",
|
|
],
|
|
}
|
|
|
|
se_filegroup {
|
|
name: "30.0.board.ignore.map",
|
|
srcs: [
|
|
"compat/30.0/30.0.ignore.cil",
|
|
],
|
|
}
|
|
|
|
se_cil_compat_map {
|
|
name: "plat_26.0.cil",
|
|
stem: "26.0.cil",
|
|
bottom_half: [":26.0.board.compat.map"],
|
|
top_half: "plat_27.0.cil",
|
|
}
|
|
|
|
se_cil_compat_map {
|
|
name: "plat_27.0.cil",
|
|
stem: "27.0.cil",
|
|
bottom_half: [":27.0.board.compat.map"],
|
|
top_half: "plat_28.0.cil",
|
|
}
|
|
|
|
se_cil_compat_map {
|
|
name: "plat_28.0.cil",
|
|
stem: "28.0.cil",
|
|
bottom_half: [":28.0.board.compat.map"],
|
|
top_half: "plat_29.0.cil",
|
|
}
|
|
|
|
se_cil_compat_map {
|
|
name: "plat_29.0.cil",
|
|
stem: "29.0.cil",
|
|
bottom_half: [":29.0.board.compat.map"],
|
|
top_half: "plat_30.0.cil",
|
|
}
|
|
|
|
se_cil_compat_map {
|
|
name: "plat_30.0.cil",
|
|
stem: "30.0.cil",
|
|
bottom_half: [":30.0.board.compat.map"],
|
|
// top_half: "plat_31.0.cil",
|
|
}
|
|
|
|
se_cil_compat_map {
|
|
name: "system_ext_26.0.cil",
|
|
stem: "26.0.cil",
|
|
bottom_half: [":26.0.board.compat.map"],
|
|
top_half: "system_ext_27.0.cil",
|
|
system_ext_specific: true,
|
|
}
|
|
|
|
se_cil_compat_map {
|
|
name: "system_ext_27.0.cil",
|
|
stem: "27.0.cil",
|
|
bottom_half: [":27.0.board.compat.map"],
|
|
top_half: "system_ext_28.0.cil",
|
|
system_ext_specific: true,
|
|
}
|
|
|
|
se_cil_compat_map {
|
|
name: "system_ext_28.0.cil",
|
|
stem: "28.0.cil",
|
|
bottom_half: [":28.0.board.compat.map"],
|
|
top_half: "system_ext_29.0.cil",
|
|
system_ext_specific: true,
|
|
}
|
|
|
|
se_cil_compat_map {
|
|
name: "system_ext_29.0.cil",
|
|
stem: "29.0.cil",
|
|
bottom_half: [":29.0.board.compat.map"],
|
|
top_half: "system_ext_30.0.cil",
|
|
system_ext_specific: true,
|
|
}
|
|
|
|
se_cil_compat_map {
|
|
name: "system_ext_30.0.cil",
|
|
stem: "30.0.cil",
|
|
bottom_half: [":30.0.board.compat.map"],
|
|
// top_half: "system_ext_31.0.cil",
|
|
system_ext_specific: true,
|
|
}
|
|
|
|
se_cil_compat_map {
|
|
name: "product_26.0.cil",
|
|
stem: "26.0.cil",
|
|
bottom_half: [":26.0.board.compat.map"],
|
|
top_half: "product_27.0.cil",
|
|
product_specific: true,
|
|
}
|
|
|
|
se_cil_compat_map {
|
|
name: "product_27.0.cil",
|
|
stem: "27.0.cil",
|
|
bottom_half: [":27.0.board.compat.map"],
|
|
top_half: "product_28.0.cil",
|
|
product_specific: true,
|
|
}
|
|
|
|
se_cil_compat_map {
|
|
name: "product_28.0.cil",
|
|
stem: "28.0.cil",
|
|
bottom_half: [":28.0.board.compat.map"],
|
|
top_half: "product_29.0.cil",
|
|
product_specific: true,
|
|
}
|
|
|
|
se_cil_compat_map {
|
|
name: "product_29.0.cil",
|
|
stem: "29.0.cil",
|
|
bottom_half: [":29.0.board.compat.map"],
|
|
top_half: "product_30.0.cil",
|
|
product_specific: true,
|
|
}
|
|
|
|
se_cil_compat_map {
|
|
name: "product_30.0.cil",
|
|
stem: "30.0.cil",
|
|
bottom_half: [":30.0.board.compat.map"],
|
|
// top_half: "product_31.0.cil",
|
|
product_specific: true,
|
|
}
|
|
|
|
se_cil_compat_map {
|
|
name: "26.0.ignore.cil",
|
|
bottom_half: [":26.0.board.ignore.map"],
|
|
top_half: "27.0.ignore.cil",
|
|
}
|
|
|
|
se_cil_compat_map {
|
|
name: "27.0.ignore.cil",
|
|
bottom_half: [":27.0.board.ignore.map"],
|
|
top_half: "28.0.ignore.cil",
|
|
}
|
|
|
|
se_cil_compat_map {
|
|
name: "28.0.ignore.cil",
|
|
bottom_half: [":28.0.board.ignore.map"],
|
|
top_half: "29.0.ignore.cil",
|
|
}
|
|
|
|
se_cil_compat_map {
|
|
name: "29.0.ignore.cil",
|
|
bottom_half: [":29.0.board.ignore.map"],
|
|
top_half: "30.0.ignore.cil",
|
|
}
|
|
|
|
se_cil_compat_map {
|
|
name: "30.0.ignore.cil",
|
|
bottom_half: [":30.0.board.ignore.map"],
|
|
// top_half: "31.0.ignore.cil",
|
|
}
|
|
|
|
prebuilt_etc {
|
|
name: "26.0.compat.cil",
|
|
src: "private/compat/26.0/26.0.compat.cil",
|
|
sub_dir: "selinux/mapping",
|
|
}
|
|
|
|
prebuilt_etc {
|
|
name: "27.0.compat.cil",
|
|
src: "private/compat/27.0/27.0.compat.cil",
|
|
sub_dir: "selinux/mapping",
|
|
}
|
|
|
|
prebuilt_etc {
|
|
name: "28.0.compat.cil",
|
|
src: "private/compat/28.0/28.0.compat.cil",
|
|
sub_dir: "selinux/mapping",
|
|
}
|
|
|
|
prebuilt_etc {
|
|
name: "29.0.compat.cil",
|
|
src: "private/compat/29.0/29.0.compat.cil",
|
|
sub_dir: "selinux/mapping",
|
|
}
|
|
|
|
prebuilt_etc {
|
|
name: "30.0.compat.cil",
|
|
src: "private/compat/30.0/30.0.compat.cil",
|
|
sub_dir: "selinux/mapping",
|
|
}
|
|
|
|
se_filegroup {
|
|
name: "file_contexts_files",
|
|
srcs: ["file_contexts"],
|
|
}
|
|
|
|
se_filegroup {
|
|
name: "file_contexts_asan_files",
|
|
srcs: ["file_contexts_asan"],
|
|
}
|
|
|
|
se_filegroup {
|
|
name: "file_contexts_overlayfs_files",
|
|
srcs: ["file_contexts_overlayfs"],
|
|
}
|
|
|
|
se_filegroup {
|
|
name: "hwservice_contexts_files",
|
|
srcs: ["hwservice_contexts"],
|
|
}
|
|
|
|
se_filegroup {
|
|
name: "property_contexts_files",
|
|
srcs: ["property_contexts"],
|
|
}
|
|
|
|
se_filegroup {
|
|
name: "service_contexts_files",
|
|
srcs: ["service_contexts"],
|
|
}
|
|
|
|
se_filegroup {
|
|
name: "keystore2_key_contexts_files",
|
|
srcs: ["keystore2_key_contexts"],
|
|
}
|
|
|
|
file_contexts {
|
|
name: "plat_file_contexts",
|
|
srcs: [":file_contexts_files"],
|
|
product_variables: {
|
|
address_sanitize: {
|
|
srcs: [":file_contexts_asan_files"],
|
|
},
|
|
debuggable: {
|
|
srcs: [":file_contexts_overlayfs_files"],
|
|
},
|
|
},
|
|
|
|
flatten_apex: {
|
|
srcs: ["apex/*-file_contexts"],
|
|
},
|
|
|
|
recovery_available: true,
|
|
}
|
|
|
|
file_contexts {
|
|
name: "vendor_file_contexts",
|
|
srcs: [":file_contexts_files"],
|
|
soc_specific: true,
|
|
recovery_available: true,
|
|
}
|
|
|
|
file_contexts {
|
|
name: "system_ext_file_contexts",
|
|
srcs: [":file_contexts_files"],
|
|
system_ext_specific: true,
|
|
recovery_available: true,
|
|
}
|
|
|
|
file_contexts {
|
|
name: "product_file_contexts",
|
|
srcs: [":file_contexts_files"],
|
|
product_specific: true,
|
|
recovery_available: true,
|
|
}
|
|
|
|
file_contexts {
|
|
name: "odm_file_contexts",
|
|
srcs: [":file_contexts_files"],
|
|
device_specific: true,
|
|
recovery_available: true,
|
|
}
|
|
|
|
hwservice_contexts {
|
|
name: "plat_hwservice_contexts",
|
|
srcs: [":hwservice_contexts_files"],
|
|
}
|
|
|
|
hwservice_contexts {
|
|
name: "system_ext_hwservice_contexts",
|
|
srcs: [":hwservice_contexts_files"],
|
|
system_ext_specific: true,
|
|
}
|
|
|
|
hwservice_contexts {
|
|
name: "product_hwservice_contexts",
|
|
srcs: [":hwservice_contexts_files"],
|
|
product_specific: true,
|
|
}
|
|
|
|
hwservice_contexts {
|
|
name: "vendor_hwservice_contexts",
|
|
srcs: [":hwservice_contexts_files"],
|
|
reqd_mask: true,
|
|
soc_specific: true,
|
|
}
|
|
|
|
hwservice_contexts {
|
|
name: "odm_hwservice_contexts",
|
|
srcs: [":hwservice_contexts_files"],
|
|
device_specific: true,
|
|
}
|
|
|
|
property_contexts {
|
|
name: "plat_property_contexts",
|
|
srcs: [":property_contexts_files"],
|
|
recovery_available: true,
|
|
}
|
|
|
|
property_contexts {
|
|
name: "system_ext_property_contexts",
|
|
srcs: [":property_contexts_files"],
|
|
system_ext_specific: true,
|
|
recovery_available: true,
|
|
}
|
|
|
|
property_contexts {
|
|
name: "product_property_contexts",
|
|
srcs: [":property_contexts_files"],
|
|
product_specific: true,
|
|
recovery_available: true,
|
|
}
|
|
|
|
property_contexts {
|
|
name: "vendor_property_contexts",
|
|
srcs: [":property_contexts_files"],
|
|
reqd_mask: true,
|
|
soc_specific: true,
|
|
recovery_available: true,
|
|
}
|
|
|
|
property_contexts {
|
|
name: "odm_property_contexts",
|
|
srcs: [":property_contexts_files"],
|
|
device_specific: true,
|
|
recovery_available: true,
|
|
}
|
|
|
|
service_contexts {
|
|
name: "plat_service_contexts",
|
|
srcs: [":service_contexts_files"],
|
|
}
|
|
|
|
service_contexts {
|
|
name: "system_ext_service_contexts",
|
|
srcs: [":service_contexts_files"],
|
|
system_ext_specific: true,
|
|
}
|
|
|
|
service_contexts {
|
|
name: "product_service_contexts",
|
|
srcs: [":service_contexts_files"],
|
|
product_specific: true,
|
|
}
|
|
|
|
service_contexts {
|
|
name: "vendor_service_contexts",
|
|
srcs: [":service_contexts_files"],
|
|
reqd_mask: true,
|
|
soc_specific: true,
|
|
}
|
|
|
|
keystore2_key_contexts {
|
|
name: "plat_keystore2_key_contexts",
|
|
srcs: [":keystore2_key_contexts_files"],
|
|
}
|
|
|
|
keystore2_key_contexts {
|
|
name: "system_keystore2_key_contexts",
|
|
srcs: [":keystore2_key_contexts_files"],
|
|
system_ext_specific: true,
|
|
}
|
|
|
|
keystore2_key_contexts {
|
|
name: "product_keystore2_key_contexts",
|
|
srcs: [":keystore2_key_contexts_files"],
|
|
product_specific: true,
|
|
}
|
|
|
|
keystore2_key_contexts {
|
|
name: "vendor_keystore2_key_contexts",
|
|
srcs: [":keystore2_key_contexts_files"],
|
|
reqd_mask: true,
|
|
soc_specific: true,
|
|
}
|
|
|
|
// For vts_treble_sys_prop_test
|
|
filegroup {
|
|
name: "private_property_contexts",
|
|
srcs: ["private/property_contexts"],
|
|
visibility: [
|
|
"//test/vts-testcase/security/system_property",
|
|
],
|
|
}
|
|
|
|
se_build_files {
|
|
name: "se_build_files",
|
|
srcs: [
|
|
"security_classes",
|
|
"initial_sids",
|
|
"access_vectors",
|
|
"global_macros",
|
|
"neverallow_macros",
|
|
"mls_macros",
|
|
"mls_decl",
|
|
"mls",
|
|
"policy_capabilities",
|
|
"te_macros",
|
|
"attributes",
|
|
"ioctl_defines",
|
|
"ioctl_macros",
|
|
"*.te",
|
|
"roles_decl",
|
|
"roles",
|
|
"users",
|
|
"initial_sid_contexts",
|
|
"fs_use",
|
|
"genfs_contexts",
|
|
"port_contexts",
|
|
],
|
|
}
|
|
|
|
// reqd_policy_mask - a policy.conf file which contains only the bare minimum
|
|
// policy necessary to use checkpolicy.
|
|
//
|
|
// This bare-minimum policy needs to be present in all policy.conf files, but
|
|
// should not necessarily be exported as part of the public policy.
|
|
//
|
|
// The rules generated by reqd_policy_mask will allow the compilation of public
|
|
// policy and subsequent removal of CIL policy that should not be exported.
|
|
se_policy_conf {
|
|
name: "reqd_policy_mask.conf",
|
|
srcs: [":se_build_files{.reqd_mask}"],
|
|
installable: false,
|
|
}
|
|
|
|
se_policy_cil {
|
|
name: "reqd_policy_mask.cil",
|
|
src: ":reqd_policy_mask.conf",
|
|
secilc_check: false,
|
|
installable: false,
|
|
}
|
|
|
|
// pub_policy - policy that will be exported to be a part of non-platform
|
|
// policy corresponding to this platform version.
|
|
//
|
|
// This is a limited subset of policy that would not compile in checkpolicy on
|
|
// its own.
|
|
//
|
|
// To get around this limitation, add only the required files from private
|
|
// policy, which will generate CIL policy that will then be filtered out by the
|
|
// reqd_policy_mask.
|
|
//
|
|
// There are three pub_policy.cil files below:
|
|
// - pub_policy.cil: exported 'product', 'system_ext' and 'system' policy.
|
|
// - system_ext_pub_policy.cil: exported 'system_ext' and 'system' policy.
|
|
// - plat_pub_policy.cil: exported 'system' policy.
|
|
//
|
|
// Those above files will in turn be used to generate the following versioned cil files:
|
|
// - product_mapping_file: the versioned, exported 'product' policy in product partition.
|
|
// - system_ext_mapping_file: the versioned, exported 'system_ext' policy in system_ext partition.
|
|
// - plat_mapping_file: the versioned, exported 'system' policy in system partition.
|
|
// - plat_pub_versioned.cil: the versioned, exported 'product', 'system_ext' and 'system' policy
|
|
// in vendor partition.
|
|
//
|
|
se_policy_conf {
|
|
name: "pub_policy.conf",
|
|
srcs: [":se_build_files{.product_public}"], // product_ includes system and system_ext
|
|
installable: false,
|
|
}
|
|
|
|
se_policy_cil {
|
|
name: "pub_policy.cil",
|
|
src: ":pub_policy.conf",
|
|
filter_out: [":reqd_policy_mask.cil"],
|
|
secilc_check: false,
|
|
installable: false,
|
|
}
|
|
|
|
se_policy_conf {
|
|
name: "system_ext_pub_policy.conf",
|
|
srcs: [":se_build_files{.system_ext_public}"], // system_ext_public includes system
|
|
installable: false,
|
|
}
|
|
|
|
se_policy_cil {
|
|
name: "system_ext_pub_policy.cil",
|
|
src: ":system_ext_pub_policy.conf",
|
|
filter_out: [":reqd_policy_mask.cil"],
|
|
secilc_check: false,
|
|
installable: false,
|
|
}
|
|
|
|
se_policy_conf {
|
|
name: "plat_pub_policy.conf",
|
|
srcs: [":se_build_files{.plat_public}"],
|
|
installable: false,
|
|
}
|
|
|
|
se_policy_cil {
|
|
name: "plat_pub_policy.cil",
|
|
src: ":plat_pub_policy.conf",
|
|
filter_out: [":reqd_policy_mask.cil"],
|
|
secilc_check: false,
|
|
installable: false,
|
|
}
|
|
|
|
// plat_policy.conf - A combination of the private and public platform policy
|
|
// which will ship with the device.
|
|
//
|
|
// The platform will always reflect the most recent platform version and is not
|
|
// currently being attributized.
|
|
se_policy_conf {
|
|
name: "plat_sepolicy.conf",
|
|
srcs: [":se_build_files{.plat}"],
|
|
installable: false,
|
|
}
|
|
|
|
se_policy_cil {
|
|
name: "plat_sepolicy.cil",
|
|
src: ":plat_sepolicy.conf",
|
|
additional_cil_files: ["private/technical_debt.cil"],
|
|
}
|
|
|
|
// system_ext_policy.conf - A combination of the private and public system_ext
|
|
// policy which will ship with the device. System_ext policy is not attributized
|
|
se_policy_conf {
|
|
name: "system_ext_sepolicy.conf",
|
|
srcs: [":se_build_files{.system_ext}"],
|
|
installable: false,
|
|
}
|
|
|
|
se_policy_cil {
|
|
name: "system_ext_sepolicy.cil",
|
|
src: ":system_ext_sepolicy.conf",
|
|
system_ext_specific: true,
|
|
filter_out: [":plat_sepolicy.cil"],
|
|
remove_line_marker: true,
|
|
}
|
|
|
|
// product_policy.conf - A combination of the private and public product policy
|
|
// which will ship with the device. Product policy is not attributized
|
|
se_policy_conf {
|
|
name: "product_sepolicy.conf",
|
|
srcs: [":se_build_files{.product}"],
|
|
installable: false,
|
|
}
|
|
|
|
se_policy_cil {
|
|
name: "product_sepolicy.cil",
|
|
src: ":product_sepolicy.conf",
|
|
product_specific: true,
|
|
filter_out: [":plat_sepolicy.cil", ":system_ext_sepolicy.cil"],
|
|
remove_line_marker: true,
|
|
}
|
|
|
|
//////////////////////////////////
|
|
// SELinux policy embedded into CTS.
|
|
// CTS checks neverallow rules of this policy against the policy of the device under test.
|
|
//////////////////////////////////
|
|
se_policy_conf {
|
|
name: "general_sepolicy.conf",
|
|
srcs: [":se_build_files{.plat}"],
|
|
build_variant: "user",
|
|
cts: true,
|
|
exclude_build_test: true,
|
|
}
|
|
|
|
//////////////////////////////////
|
|
// modules for microdroid
|
|
// TODO(b/178993690): migrate Android.mk to Android.bp and remove below
|
|
//////////////////////////////////
|
|
genrule {
|
|
name: "microdroid_plat_mapping_file_gen",
|
|
srcs: [":plat_pub_policy.cil", ":reqd_policy_mask.cil"],
|
|
tools: ["build_sepolicy", "version_policy"],
|
|
out: ["10000.0.cil"],
|
|
cmd: "$(location build_sepolicy) filter_out -f $(location :reqd_policy_mask.cil) -t $(location :plat_pub_policy.cil)" +
|
|
"&& $(location version_policy) -b $(location :plat_pub_policy.cil) -m -n 10000.0 -o $(out)",
|
|
visibility: ["//visibility:private"],
|
|
}
|
|
|
|
prebuilt_etc {
|
|
name: "microdroid_plat_mapping_file",
|
|
src: ":microdroid_plat_mapping_file_gen",
|
|
filename: "10000.0.cil",
|
|
relative_install_path: "selinux/mapping",
|
|
installable: false,
|
|
}
|
|
|
|
// Normally plat_pub_versioned.cil is built from pub_policy.cil (including system_ext and product).
|
|
// But microdroid only has system, so its plat_pub_versioned.cil uses plat_pub_policy.cil.
|
|
genrule {
|
|
name: "microdroid_plat_pub_versioned.cil_gen",
|
|
srcs: [":plat_pub_policy.cil"],
|
|
tools: ["version_policy"],
|
|
out: ["plat_pub_versioned.cil"],
|
|
cmd: "$(location version_policy) " +
|
|
"-b $(location :plat_pub_policy.cil) " +
|
|
"-t $(location :plat_pub_policy.cil) " +
|
|
"-n 10000.0 " +
|
|
"-o $(out)",
|
|
visibility: ["//visibility:private"],
|
|
}
|
|
|
|
prebuilt_etc {
|
|
name: "microdroid_plat_pub_versioned.cil",
|
|
src: ":microdroid_plat_pub_versioned.cil_gen",
|
|
filename: "plat_pub_versioned.cil",
|
|
relative_install_path: "selinux",
|
|
installable: false,
|
|
}
|
|
|
|
filegroup {
|
|
name: "microdroid_vendor_sepolicy_build_files",
|
|
srcs: [
|
|
"reqd_mask/security_classes",
|
|
"reqd_mask/initial_sids",
|
|
"reqd_mask/access_vectors",
|
|
"public/global_macros",
|
|
"public/neverallow_macros",
|
|
"reqd_mask/mls_macros",
|
|
"reqd_mask/mls_decl",
|
|
"reqd_mask/mls",
|
|
"public/te_macros",
|
|
"public/attributes",
|
|
"public/ioctl_defines",
|
|
"public/ioctl_macros",
|
|
"public/*.te",
|
|
"reqd_mask/*.te",
|
|
"vendor/*.te",
|
|
"reqd_mask/roles_decl",
|
|
"public/roles",
|
|
"reqd_mask/roles",
|
|
"reqd_mask/users",
|
|
"reqd_mask/initial_sid_contexts",
|
|
],
|
|
}
|
|
|
|
// These variables are based on aosp_cf_x86_64_only_phone-userdebug. Other than target_arch,
|
|
// these configurations should be fine to test microdroid on normal devices with full treble.
|
|
// The exception is target_arch. But as target_arch is meaningful only on mips, and as we are not
|
|
// running microdroid on mips for now, we skip assigning target_arch here. After cil files are fully
|
|
// migrated into Soong, these will have correct values.
|
|
policy_to_conf_flags = "$(location m4) --fatal-warnings " +
|
|
"-D mls_num_sens=1 -D mls_num_cats=1024 " +
|
|
"-D target_build_variant=userdebug " +
|
|
"-D target_with_asan=false " +
|
|
"-D target_with_native_coverage=false " +
|
|
"-D target_full_treble=true " +
|
|
"-D target_compatible_property=true " +
|
|
"-D target_treble_sysprop_neverallow=true " +
|
|
"-D target_enforce_sysprop_owner=true "
|
|
|
|
genrule {
|
|
name: "microdroid_vendor_sepolicy.cil_gen",
|
|
srcs: [
|
|
":microdroid_vendor_sepolicy_build_files",
|
|
":microdroid_plat_pub_versioned.cil_gen",
|
|
":pub_policy.cil",
|
|
":reqd_policy_mask.cil",
|
|
],
|
|
tools: [
|
|
"m4",
|
|
"build_sepolicy",
|
|
"checkpolicy",
|
|
"secilc",
|
|
"version_policy",
|
|
],
|
|
out: ["vendor_sepolicy.cil"],
|
|
cmd: policy_to_conf_flags + " -s $(locations :microdroid_vendor_sepolicy_build_files) > $(out).conf && " +
|
|
"$(location build_sepolicy) " +
|
|
"--android_host_path $$(dirname $(location build_sepolicy)) " +
|
|
"build_cil " +
|
|
"--input_policy_conf $(out).conf " +
|
|
"--checkpolicy_env ASAN_OPTIONS=detect_leaks=0 " +
|
|
"--base_policy $(location :pub_policy.cil) " +
|
|
"--filter_out_files $(location :microdroid_plat_pub_versioned.cil_gen) " +
|
|
"--reqd_mask $(location :reqd_policy_mask.cil) " +
|
|
"--treble_sepolicy_vers 10000.0 " +
|
|
"--policy_vers 30 " +
|
|
"--output_cil $(out)",
|
|
visibility: ["//visibility:private"],
|
|
}
|
|
|
|
prebuilt_etc {
|
|
name: "microdroid_vendor_sepolicy.cil",
|
|
src: ":microdroid_vendor_sepolicy.cil_gen",
|
|
filename: "vendor_sepolicy.cil",
|
|
relative_install_path: "selinux",
|
|
installable: false,
|
|
}
|