81e1f90cd1
Introduce "neverallow" rules for seapp_contexts. A neverallow rule is similar to the existing key-value-pair entries but the line begins with "neverallow". A neverallow violation is detected when all keys, both inputs and outputs are matched. The neverallow rules value parameter (not the key) can contain regular expressions to assist in matching. Neverallow rules are never output to the generated seapp_contexts file. Also, unless -o is specified, checkseapp runs in silent mode and outputs nothing. Specifying - as an argument to -o outputs to stdout. Sample Output: Error: Rule in File "external/sepolicy/seapp_contexts" on line 87: "user=fake domain=system_app type=app_data_file" violates neverallow in File "external/sepolicy/seapp_contexts" on line 57: "user=((?!system).)* domain=system_app" Change-Id: Ia4dcbf02feb774f2e201bb0c5d4ce385274d8b8d Signed-off-by: William Roberts <william.c.roberts@intel.com>
55 lines
1.4 KiB
Makefile
55 lines
1.4 KiB
Makefile
LOCAL_PATH:= $(call my-dir)
|
|
|
|
include $(CLEAR_VARS)
|
|
|
|
LOCAL_MODULE := checkseapp
|
|
LOCAL_MODULE_TAGS := optional
|
|
LOCAL_C_INCLUDES := \
|
|
external/pcre \
|
|
external/selinux/libsepol/include
|
|
LOCAL_CFLAGS := -DLINK_SEPOL_STATIC -Wall -Werror
|
|
LOCAL_SRC_FILES := check_seapp.c
|
|
LOCAL_STATIC_LIBRARIES := libsepol
|
|
LOCAL_WHOLE_STATIC_LIBRARIES := libpcre
|
|
LOCAL_CXX_STL := none
|
|
|
|
include $(BUILD_HOST_EXECUTABLE)
|
|
|
|
###################################
|
|
include $(CLEAR_VARS)
|
|
|
|
LOCAL_MODULE := checkfc
|
|
LOCAL_MODULE_TAGS := optional
|
|
LOCAL_C_INCLUDES := external/selinux/libsepol/include \
|
|
external/libselinux/include
|
|
LOCAL_CFLAGS := -Wall -Werror
|
|
LOCAL_SRC_FILES := checkfc.c
|
|
LOCAL_STATIC_LIBRARIES := libsepol libselinux
|
|
LOCAL_CXX_STL := none
|
|
|
|
include $(BUILD_HOST_EXECUTABLE)
|
|
|
|
##################################
|
|
include $(CLEAR_VARS)
|
|
|
|
LOCAL_MODULE := insertkeys.py
|
|
LOCAL_SRC_FILES := insertkeys.py
|
|
LOCAL_MODULE_CLASS := EXECUTABLES
|
|
LOCAL_IS_HOST_MODULE := true
|
|
LOCAL_MODULE_TAGS := optional
|
|
|
|
include $(BUILD_PREBUILT)
|
|
###################################
|
|
include $(CLEAR_VARS)
|
|
|
|
LOCAL_MODULE := sepolicy-check
|
|
LOCAL_MODULE_TAGS := optional
|
|
LOCAL_C_INCLUDES := external/selinux/libsepol/include
|
|
LOCAL_CFLAGS := -Wall -Werror
|
|
LOCAL_SRC_FILES := sepolicy-check.c
|
|
LOCAL_STATIC_LIBRARIES := libsepol
|
|
LOCAL_CXX_STL := none
|
|
|
|
include $(BUILD_HOST_EXECUTABLE)
|
|
|
|
include $(call all-makefiles-under,$(LOCAL_PATH))
|