b65824642b
Bug: http://b/135139675
Coverage files are written to /data/misc/trace (governed by the
method_trace_data_file selinux type). Allow all domains to access
(create directories, access files) this directory when native coverage
is enabled (by setting NATIVE_COVERAGE to true) in an userdebug or eng
build.
Also relax neverallow constraints to allow access to
method_trace_data_file for native coverage builds.
Test: Build 32-bit cuttlefish with coverage:
m NATIVE_COVERAGE=true COVERAGE_PATHS="*"
and verify that there are no selinux denials in kernel log and
logcat.
Change-Id: I3fe7c77612854b9de7de7a0ddd5cbf44a2f5c21e
(cherry picked from commit ce9c0c5a5f)
18 lines
838 B
Makefile
18 lines
838 B
Makefile
# Command to turn collection of policy files into a policy.conf file to be
|
|
# processed by checkpolicy
|
|
define transform-policy-to-conf
|
|
@mkdir -p $(dir $@)
|
|
$(hide) $(M4) --fatal-warnings $(PRIVATE_ADDITIONAL_M4DEFS) \
|
|
-D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
|
|
-D target_build_variant=$(PRIVATE_TARGET_BUILD_VARIANT) \
|
|
-D target_with_dexpreopt=$(WITH_DEXPREOPT) \
|
|
-D target_arch=$(PRIVATE_TGT_ARCH) \
|
|
-D target_with_asan=$(PRIVATE_TGT_WITH_ASAN) \
|
|
-D target_with_native_coverage=$(PRIVATE_TGT_WITH_NATIVE_COVERAGE) \
|
|
-D target_full_treble=$(PRIVATE_SEPOLICY_SPLIT) \
|
|
-D target_compatible_property=$(PRIVATE_COMPATIBLE_PROPERTY) \
|
|
-D target_exclude_build_test=$(PRIVATE_EXCLUDE_BUILD_TEST) \
|
|
$(PRIVATE_TGT_RECOVERY) \
|
|
-s $(PRIVATE_POLICY_FILES) > $@
|
|
endef
|
|
.KATI_READONLY := transform-policy-to-conf
|