6fa8efdf4a
To avoid hard-coded paths in Android.mk rules. Test: m selinux_policy Change-Id: I7b464fa2953e01ccb6fff8daa3e219ae372313c5
191 lines
9.4 KiB
Makefile
191 lines
9.4 KiB
Makefile
version := $(version_under_treble_tests)
|
|
|
|
include $(CLEAR_VARS)
|
|
# For Treble builds run tests verifying that processes are properly labeled and
|
|
# permissions granted do not violate the treble model. Also ensure that treble
|
|
# compatibility guarantees are upheld between SELinux version bumps.
|
|
LOCAL_MODULE := treble_sepolicy_tests_$(version)
|
|
LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
|
|
LOCAL_LICENSE_CONDITIONS := notice unencumbered
|
|
LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
|
|
LOCAL_MODULE_CLASS := FAKE
|
|
LOCAL_MODULE_TAGS := optional
|
|
|
|
# BOARD_SYSTEM_EXT_PREBUILT_DIR can be set as system_ext prebuilt dir in sepolicy
|
|
# make file of the system_ext partition.
|
|
SYSTEM_EXT_PREBUILT_POLICY := $(BOARD_SYSTEM_EXT_PREBUILT_DIR)
|
|
# BOARD_PRODUCT_PREBUILT_DIR can be set as product prebuilt dir in sepolicy
|
|
# make file of the product partition.
|
|
PRODUCT_PREBUILT_POLICY := $(BOARD_PRODUCT_PREBUILT_DIR)
|
|
# BOARD_PLAT_PUB_VERSIONED_POLICY - path_to_plat_pub_versioned_of_vendor
|
|
# plat_pub_versioned.cil should be in
|
|
# $(BOARD_PLAT_PUB_VERSIONED_POLICY)/prebuilts/api/$(version) dir.
|
|
# plat_pub_versioned.cil should have platform, system_ext and product sepolicies
|
|
# similar to system/sepolicy/prebuilts/api/$(version/plat_pub_verioned.cil file.
|
|
# In order to enable treble sepolicy tests for platform, system_ext and product
|
|
# sepolicies SYSTEM_EXT_PREBUILT_POLICY , PRODUCT_PREBUILT_POLICY and
|
|
# BOARD_PLAT_PUB_VERSIONED_POLICY should be set.
|
|
IS_TREBLE_TEST_ENABLED_PARTNER := false
|
|
ifeq ($(filter 26.0 27.0 28.0 29.0,$(version)),)
|
|
ifneq (,$(BOARD_PLAT_PUB_VERSIONED_POLICY))
|
|
IS_TREBLE_TEST_ENABLED_PARTNER := true
|
|
endif # (,$(BOARD_PLAT_PUB_VERSIONED_POLICY))
|
|
endif # ($(filter 26.0 27.0 28.0 29.0,$(version)),)
|
|
|
|
include $(BUILD_SYSTEM)/base_rules.mk
|
|
|
|
# $(version)_plat - the platform policy shipped as part of the $(version) release. This is
|
|
# built to enable us to determine the diff between the current policy and the
|
|
# $(version) policy, which will be used in tests to make sure that compatibility has
|
|
# been maintained by our mapping files.
|
|
$(version)_PLAT_PUBLIC_POLICY := $(LOCAL_PATH)/prebuilts/api/$(version)/public
|
|
$(version)_PLAT_PRIVATE_POLICY := $(LOCAL_PATH)/prebuilts/api/$(version)/private
|
|
ifeq ($(IS_TREBLE_TEST_ENABLED_PARTNER),true)
|
|
ifneq (,$(SYSTEM_EXT_PREBUILT_POLICY))
|
|
$(version)_PLAT_PUBLIC_POLICY += \
|
|
$(SYSTEM_EXT_PREBUILT_POLICY)/prebuilts/api/$(version)/public
|
|
$(version)_PLAT_PRIVATE_POLICY += \
|
|
$(SYSTEM_EXT_PREBUILT_POLICY)/prebuilts/api/$(version)/private
|
|
endif # (,$(SYSTEM_EXT_PREBUILT_POLICY))
|
|
ifneq (,$(PRODUCT_PREBUILT_POLICY))
|
|
$(version)_PLAT_PUBLIC_POLICY += \
|
|
$(PRODUCT_PREBUILT_POLICY)/prebuilts/api/$(version)/public
|
|
$(version)_PLAT_PRIVATE_POLICY += \
|
|
$(PRODUCT_PREBUILT_POLICY)/prebuilts/api/$(version)/private
|
|
endif # (,$(PRODUCT_PREBUILT_POLICY))
|
|
endif # ($(IS_TREBLE_TEST_ENABLED_PARTNER),true)
|
|
policy_files := $(call build_policy, $(sepolicy_build_files), $($(version)_PLAT_PUBLIC_POLICY) $($(version)_PLAT_PRIVATE_POLICY))
|
|
$(version)_plat_policy.conf := $(intermediates)/$(version)_plat_policy.conf
|
|
$($(version)_plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
|
|
$($(version)_plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
|
|
$($(version)_plat_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := user
|
|
$($(version)_plat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
|
|
$($(version)_plat_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
|
|
$($(version)_plat_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
|
|
$($(version)_plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
|
|
$($(version)_plat_policy.conf): PRIVATE_SEPOLICY_SPLIT := true
|
|
$($(version)_plat_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
|
|
$($(version)_plat_policy.conf): $(policy_files) $(M4)
|
|
$(transform-policy-to-conf)
|
|
$(hide) sed '/dontaudit/d' $@ > $@.dontaudit
|
|
|
|
policy_files :=
|
|
|
|
built_$(version)_plat_sepolicy := $(intermediates)/built_$(version)_plat_sepolicy
|
|
$(built_$(version)_plat_sepolicy): PRIVATE_ADDITIONAL_CIL_FILES := \
|
|
$(call build_policy, technical_debt.cil , $($(version)_PLAT_PRIVATE_POLICY))
|
|
$(built_$(version)_plat_sepolicy): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
|
|
$(built_$(version)_plat_sepolicy): $($(version)_plat_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
|
|
$(HOST_OUT_EXECUTABLES)/secilc \
|
|
$(call build_policy, technical_debt.cil, $($(version)_PLAT_PRIVATE_POLICY)) \
|
|
$(built_sepolicy_neverallows)
|
|
@mkdir -p $(dir $@)
|
|
$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \
|
|
$(POLICYVERS) -o $@ $<
|
|
$(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@
|
|
$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $@ -o $@ -f /dev/null
|
|
|
|
$(version)_plat_policy.conf :=
|
|
|
|
# $(version)_compat - the current plat_sepolicy.cil built with the compatibility file
|
|
# targeting the $(version) SELinux release. This ensures that our policy will build
|
|
# when used on a device that has non-platform policy targetting the $(version) release.
|
|
$(version)_compat := $(intermediates)/$(version)_compat
|
|
$(version)_mapping.cil := $(call intermediates-dir-for,ETC,plat_$(version).cil)/plat_$(version).cil
|
|
$(version)_mapping.ignore.cil := \
|
|
$(call intermediates-dir-for,ETC,$(version).ignore.cil)/$(version).ignore.cil
|
|
$(version)_prebuilts_dir := $(LOCAL_PATH)/prebuilts/api/$(version)
|
|
ifeq ($(IS_TREBLE_TEST_ENABLED_PARTNER),true)
|
|
ifneq (,$(SYSTEM_EXT_PREBUILT_POLICY))
|
|
$(version)_mapping.cil += \
|
|
$(call intermediates-dir-for,ETC,system_ext_$(version).cil)/system_ext_$(version).cil
|
|
$(version)_mapping.ignore.cil += \
|
|
$(call intermediates-dir-for,ETC,system_ext_$(version).ignore.cil)/system_ext_$(version).ignore.cil
|
|
endif # (,$(SYSTEM_EXT_PREBUILT_POLICY))
|
|
ifneq (,$(PRODUCT_PREBUILT_POLICY))
|
|
$(version)_mapping.cil += \
|
|
$(call intermediates-dir-for,ETC,product_$(version).cil)/product_$(version).cil
|
|
$(version)_mapping.ignore.cil += \
|
|
$(call intermediates-dir-for,ETC,product_$(version).ignore.cil)/product_$(version).ignore.cil
|
|
endif # (,$(PRODUCT_PREBUILT_POLICY))
|
|
$(version)_prebuilts_dir := $(BOARD_PLAT_PUB_VERSIONED_POLICY)/prebuilts/api/$(version)
|
|
endif #($(IS_TREBLE_TEST_ENABLED_PARTNER),true)
|
|
|
|
# vendor_sepolicy.cil and plat_pub_versioned.cil are the new design to replace
|
|
# nonplat_sepolicy.cil.
|
|
$(version)_vendor := $($(version)_prebuilts_dir)/vendor_sepolicy.cil \
|
|
$($(version)_prebuilts_dir)/plat_pub_versioned.cil
|
|
|
|
cil_files := $(built_plat_cil)
|
|
ifeq ($(IS_TREBLE_TEST_ENABLED_PARTNER),true)
|
|
ifneq (,$(SYSTEM_EXT_PREBUILT_POLICY)
|
|
cil_files += $(built_system_ext_cil)
|
|
endif # (,$(SYSTEM_EXT_PREBUILT_POLICY)
|
|
ifneq (,$(PRODUCT_PREBUILT_POLICY)
|
|
cil_files += $(built_product_cil)
|
|
endif # (,$(PRODUCT_PREBUILT_POLICY)
|
|
endif # ($(IS_TREBLE_TEST_ENABLED_PARTNER),true)
|
|
cil_files += $($(version)_mapping.cil) $($(version)_vendor)
|
|
$($(version)_compat): PRIVATE_CIL_FILES := $(cil_files)
|
|
$($(version)_compat): $(HOST_OUT_EXECUTABLES)/secilc $(cil_files)
|
|
$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -N -c $(POLICYVERS) \
|
|
$(PRIVATE_CIL_FILES) -o $@ -f /dev/null
|
|
|
|
# $(version)_mapping.combined.cil - a combination of the mapping file used when
|
|
# combining the current platform policy with nonplatform policy based on the
|
|
# $(version) policy release and also a special ignored file that exists purely for
|
|
# these tests.
|
|
$(version)_mapping.combined.cil := $(intermediates)/$(version)_mapping.combined.cil
|
|
$($(version)_mapping.combined.cil): $($(version)_mapping.cil) $($(version)_mapping.ignore.cil)
|
|
mkdir -p $(dir $@)
|
|
cat $^ > $@
|
|
|
|
ifeq ($(IS_TREBLE_TEST_ENABLED_PARTNER),true)
|
|
built_sepolicy_files := $(built_product_sepolicy)
|
|
public_cil_files := $(base_product_pub_policy.cil)
|
|
else
|
|
built_sepolicy_files := $(built_plat_sepolicy)
|
|
public_cil_files := $(base_plat_pub_policy.cil)
|
|
endif # ($(IS_TREBLE_TEST_ENABLED_PARTNER),true)
|
|
$(LOCAL_BUILT_MODULE): ALL_FC_ARGS := $(all_fc_args)
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY_OLD := $(built_$(version)_plat_sepolicy)
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_COMBINED_MAPPING := $($(version)_mapping.combined.cil)
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_PLAT_SEPOLICY := $(built_sepolicy_files)
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_PLAT_PUB_SEPOLICY := $(public_cil_files)
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_FAKE_TREBLE :=
|
|
ifeq ($(PRODUCT_FULL_TREBLE_OVERRIDE),true)
|
|
# TODO(b/113124961): remove fake-treble
|
|
$(LOCAL_BUILT_MODULE): PRIVATE_FAKE_TREBLE := --fake-treble
|
|
endif # PRODUCT_FULL_TREBLE_OVERRIDE = true
|
|
$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/treble_sepolicy_tests \
|
|
$(all_fc_files) $(built_sepolicy) \
|
|
$(built_sepolicy_files) \
|
|
$(public_cil_files) \
|
|
$(built_$(version)_plat_sepolicy) $($(version)_compat) $($(version)_mapping.combined.cil)
|
|
@mkdir -p $(dir $@)
|
|
$(hide) $(HOST_OUT_EXECUTABLES)/treble_sepolicy_tests $(ALL_FC_ARGS) \
|
|
-b $(PRIVATE_PLAT_SEPOLICY) -m $(PRIVATE_COMBINED_MAPPING) \
|
|
-o $(PRIVATE_SEPOLICY_OLD) -p $(PRIVATE_SEPOLICY) \
|
|
-u $(PRIVATE_PLAT_PUB_SEPOLICY) \
|
|
$(PRIVATE_FAKE_TREBLE)
|
|
$(hide) touch $@
|
|
|
|
$(version)_SYSTEM_EXT_PUBLIC_POLICY :=
|
|
$(version)_SYSTEM_EXT_PRIVATE_POLICY :=
|
|
$(version)_PRODUCT_PUBLIC_POLICY :=
|
|
$(version)_PRODUCT_PRIVATE_POLICY :=
|
|
$(version)_PLAT_PUBLIC_POLICY :=
|
|
$(version)_PLAT_PRIVATE_POLICY :=
|
|
built_sepolicy_files :=
|
|
public_cil_files :=
|
|
cil_files :=
|
|
$(version)_compat :=
|
|
$(version)_mapping.cil :=
|
|
$(version)_mapping.combined.cil :=
|
|
$(version)_mapping.ignore.cil :=
|
|
$(version)_vendor :=
|
|
$(version)_prebuilts_dir :=
|
|
built_$(version)_plat_sepolicy :=
|
|
version :=
|
|
version_under_treble_tests :=
|