platform_system_sepolicy/tools
Thiébaud Weksteen 9a924ba875 Add checkfc mode to validate file_contexts against test data
A new mode for checkfc is introduced (-t) which takes a file_contexts
and a test data file. Each line in the test data file contains a path
and the expected type. checkfc loads the file_contexts and repeatedly
calls selabel_lookup(3) to verify that the computed type is as expected.

This mode can be used to confirm that any modification to file_contexts
or its build process is benign.

A test data file (plat_file_contexts_test) is added. This file was
manually created based on private/file_contexts. Each static path was
copied as-is. Each regular expression was expanded into a couple of
entries. For instance, /dev/adf[0-9]* generated /dev/adf, /dev/adf0 and
/dev/adf123.

libselinux keeps track of which specification is being hit when using
selabel_lookup. When calling selabel_stats(3), the file backend will
output a warning if a specification has not been used. This can be
leveraged to ensure that each rule is at least hit once. This property
will be leveraged in a follow-up change (by running the test as part of
the build process), to ensure that the plat_file_contexts_test file
remains up-to-date (that is, when an entry is added to
private/file_contexts, the build will fail unless a test is also added
to plat_file_contexts_test to exercice the specification/regular
expression).

Test: m checkfc && checkfc -t ./private/file_contexts ./tests/plat_file_contexts_test
Bug: 299839280
Change-Id: Ibf56859a16bd17e1f878ce7b0570b2aead79c7e0
2023-10-17 15:43:06 +11:00
..
sepolicy-analyze [LSC] Add LOCAL_LICENSE_KINDS to system/sepolicy 2021-02-05 01:28:24 -08:00
Android.bp sepolicy : Recommend fuzzers for new services 2022-09-13 18:18:46 +00:00
build_policies.sh Reduce the number of parallel compiles. 2019-03-04 14:04:49 -08:00
check_seapp.c Merge "Revert^3 "Start tracking vendor seapp coredomain violations"" into main 2023-09-18 05:06:32 +00:00
checkfc.c Add checkfc mode to validate file_contexts against test data 2023-10-17 15:43:06 +11:00
finalize-sdk-rel.sh Fix sepolicy finalization build error 2023-10-11 22:58:45 +09:00
fuzzer_bindings_check.py sepolicy: updating error message for fuzzer bindings 2022-09-28 19:38:31 +00:00
insertkeys.py Migrate insertkeys.py to Python3 2021-12-06 13:46:23 +11:00
policy_version_check.sh Build prebuilt policy with Soong 2023-09-07 16:32:30 +09:00
post_process_mac_perms Remove errant newline from generated policy file. 2014-04-01 11:22:53 -04:00
README sepolicy : Recommend fuzzers for new services 2022-09-13 18:18:46 +00:00
seamendc.c seamendc: prefetch binary policy in memory before parsing 2022-07-28 14:25:03 +00:00
sepolicy-check.c Add sepolicy-analyze tool. 2013-10-31 15:12:32 -04:00
sepolicy_cleanup_check.sh Add code to check for unescaped periods in file_contexts. 2018-10-06 13:39:38 -07:00
sepolicy_generate_compat.py Skip building compat files if REL 2023-08-23 08:41:44 +00:00
version_policy.c Revert^2 "Use cil_write_build_ast" 2021-10-27 04:50:56 +00:00
whitespace.sh Block files without trailing newlines 2016-12-12 08:18:01 -08:00

This directory contains a number of tools related to policy, some of
which are used in building and validating the policy and others are
available for help in auditing and analyzing policy.  The tools are
described further below.

build_policies.sh
   A tool to build SELinux policy for multiple targets in parallel.
   This is useful for quickly testing a new test or neverallow rule
   on multiple targets.

   Usage:
   ./build_policies.sh ~/android/master ~/tmp/build_policies
   ./build_policies.sh ~/android/master ~/tmp/build_policies sailfish-eng walleye-eng

checkfc
   A utility for checking the validity of a file_contexts or a
   property_contexts configuration file.  Used as part of the policy
   build to validate both files.  Requires the sepolicy file as an
   argument in order to check the validity of the security contexts
   in the file_contexts or property_contexts file.

   Usage1:
   checkfc sepolicy file_contexts
   checkfc -p sepolicy property_contexts

   Also used to compare two file_contexts or file_contexts.bin files.
   Displays one of subset, equal, superset, or incomparable.

   Usage2:
   checkfc -c file_contexts1 file_contexts2

   Example:
   $ checkfc -c out/target/product/shamu/system/etc/general_file_contexts out/target/product/shamu/root/file_contexts.bin
   subset

checkseapp
    A utility for merging together the main seapp_contexts
    configuration and the device-specific one, and simultaneously
    checking the validity of the configurations. Used as part of the
    policy build process to merge and validate the configuration.

    Usage:
    checkseapp -p sepolicy input_seapp_contexts0 [input_seapp_contexts1...] -o seapp_contexts

insertkeys.py
    A helper script for mapping tags in the signature stanzas of
    mac_permissions.xml to public keys found in pem files.  This
    script is described further in the top-level sepolicy/README.

post_process_mac_perms
    A tool to help modify an existing mac_permissions.xml with additional app
    certs not already found in that policy. This becomes useful when a directory
    containing apps is searched and the certs from those apps are added to the
    policy not already explicitly listed.

    Usage:
    post_process_mac_perms [-h] -s SEINFO -d DIR -f POLICY

      -s SEINFO, --seinfo SEINFO  seinfo tag for each generated stanza
      -d DIR, --dir DIR           Directory to search for apks
      -f POLICY, --file POLICY    mac_permissions.xml policy file

sepolicy-check
    A tool for auditing a sepolicy file for any allow rule that grants
    a given permission.

    Usage:
    sepolicy-check -s <domain> -t <type> -c <class> -p <permission> -P out/target/product/<board>/root/sepolicy

sepolicy-analyze
    A tool for performing various kinds of analysis on a sepolicy
    file.

fuzzer_bindings_check
    Tool to check if fuzzer is added for new services. it is used by fuzzer_bindings_test soong module internally.
    Error will be generated if there is no fuzzer binding present for service added in service_contexts in
    system/sepolicy/soong/build/service_fuzzer_bindings.go

    Usage:
    fuzzer_bindings_check.py -s [SRCs...] -b /path/to/binding.json

    -s [SRCs...]                         list of service_contexts files. Tool will check if there is fuzzer for every service
                                         in the context file.
    -b /path/to/binding.json             Path to json file containing "service":[fuzzers...] bindings.