blob: 1b903bd752b2a17429d12e9bfb175433897a7536 [file] [log] [blame]
Stephen Smalley2dd4e512012-01-04 12:33:27 -05001LOCAL_PATH:= $(call my-dir)
William Robertsf0e0a942012-08-27 15:41:15 -07002
Stephen Smalley2dd4e512012-01-04 12:33:27 -05003include $(CLEAR_VARS)
4
5# SELinux policy version.
Stephen Smalleyb4f17062015-03-13 10:03:52 -04006# Must be <= /sys/fs/selinux/policyvers reported by the Android kernel.
Stephen Smalley2dd4e512012-01-04 12:33:27 -05007# Must be within the compatibility range reported by checkpolicy -V.
Jeff Vander Stoep64b01c62015-05-04 11:14:23 -07008POLICYVERS ?= 30
Stephen Smalley2dd4e512012-01-04 12:33:27 -05009
10MLS_SENS=1
11MLS_CATS=1024
12
Stephen Smalleyb4f17062015-03-13 10:03:52 -040013ifdef BOARD_SEPOLICY_REPLACE
14$(error BOARD_SEPOLICY_REPLACE is no longer supported; please remove from your BoardConfig.mk or other .mk file.)
15endif
16
17ifdef BOARD_SEPOLICY_IGNORE
18$(error BOARD_SEPOLICY_IGNORE is no longer supported; please remove from your BoardConfig.mk or other .mk file.)
19endif
Stephen Smalley5b340be2012-03-06 11:12:41 -050020
Stephen Smalley8e0ca882015-04-01 10:14:56 -040021ifdef BOARD_SEPOLICY_UNION
22$(warning BOARD_SEPOLICY_UNION is no longer required - all files found in BOARD_SEPOLICY_DIRS are implicitly unioned; please remove from your BoardConfig.mk or other .mk file.)
23endif
Robert Craig6b0ff472014-01-29 13:10:58 -050024
Stephen Smalley8e0ca882015-04-01 10:14:56 -040025# Builds paths for all policy files found in BOARD_SEPOLICY_DIRS.
rpcraig47cd3962012-10-17 21:09:52 -040026# $(1): the set of policy name paths to build
Stephen Smalley8e0ca882015-04-01 10:14:56 -040027build_policy = $(foreach type, $(1), $(wildcard $(addsuffix /$(type), $(LOCAL_PATH) $(BOARD_SEPOLICY_DIRS))))
Stephen Smalley5b340be2012-03-06 11:12:41 -050028
dcashman704741a2014-07-25 19:11:52 -070029sepolicy_build_files := security_classes \
30 initial_sids \
31 access_vectors \
32 global_macros \
Nick Kralevicha17a2662014-11-05 15:30:41 -080033 neverallow_macros \
dcashman704741a2014-07-25 19:11:52 -070034 mls_macros \
35 mls \
36 policy_capabilities \
37 te_macros \
38 attributes \
Jeff Vander Stoepde9b5302015-06-05 15:28:55 -070039 ioctl_macros \
dcashman704741a2014-07-25 19:11:52 -070040 *.te \
41 roles \
42 users \
43 initial_sid_contexts \
44 fs_use \
45 genfs_contexts \
46 port_contexts
47
Ying Wang02fb5f32012-01-17 17:51:09 -080048##################################
49include $(CLEAR_VARS)
Stephen Smalley2dd4e512012-01-04 12:33:27 -050050
Ying Wang02fb5f32012-01-17 17:51:09 -080051LOCAL_MODULE := sepolicy
52LOCAL_MODULE_CLASS := ETC
53LOCAL_MODULE_TAGS := optional
Ying Wang02fb5f32012-01-17 17:51:09 -080054LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Stephen Smalley2dd4e512012-01-04 12:33:27 -050055
Ying Wang02fb5f32012-01-17 17:51:09 -080056include $(BUILD_SYSTEM)/base_rules.mk
Stephen Smalley2dd4e512012-01-04 12:33:27 -050057
Ying Wang02fb5f32012-01-17 17:51:09 -080058sepolicy_policy.conf := $(intermediates)/policy.conf
59$(sepolicy_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
60$(sepolicy_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
dcashman704741a2014-07-25 19:11:52 -070061$(sepolicy_policy.conf) : $(call build_policy, $(sepolicy_build_files))
Ying Wang02fb5f32012-01-17 17:51:09 -080062 @mkdir -p $(dir $@)
Nick Kralevich623975f2014-01-11 01:31:03 -080063 $(hide) m4 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
64 -D target_build_variant=$(TARGET_BUILD_VARIANT) \
Nick Kralevich623975f2014-01-11 01:31:03 -080065 -s $^ > $@
Robert Craig65d4f442013-03-27 06:30:25 -040066 $(hide) sed '/dontaudit/d' $@ > $@.dontaudit
Stephen Smalley2dd4e512012-01-04 12:33:27 -050067
Stephen Smalley2b826fc2012-01-24 08:46:13 -050068$(LOCAL_BUILT_MODULE) : $(sepolicy_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy
Ying Wang02fb5f32012-01-17 17:51:09 -080069 @mkdir -p $(dir $@)
Ying Wangf4ea5b22012-04-09 15:31:03 -070070 $(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c $(POLICYVERS) -o $@ $<
Robert Craig65d4f442013-03-27 06:30:25 -040071 $(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c $(POLICYVERS) -o $(dir $<)/$(notdir $@).dontaudit $<.dontaudit
Ying Wang02fb5f32012-01-17 17:51:09 -080072
Ying Wangd8b122c2012-10-25 19:01:31 -070073built_sepolicy := $(LOCAL_BUILT_MODULE)
Ying Wang02fb5f32012-01-17 17:51:09 -080074sepolicy_policy.conf :=
Stephen Smalley01a58af2012-10-02 12:46:37 -040075
Stephen Smalleye60723a2014-05-29 16:40:15 -040076##################################
77include $(CLEAR_VARS)
78
79LOCAL_MODULE := sepolicy.recovery
80LOCAL_MODULE_CLASS := ETC
81LOCAL_MODULE_TAGS := eng
82
83include $(BUILD_SYSTEM)/base_rules.mk
84
85sepolicy_policy_recovery.conf := $(intermediates)/policy_recovery.conf
86$(sepolicy_policy_recovery.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
87$(sepolicy_policy_recovery.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
dcashman704741a2014-07-25 19:11:52 -070088$(sepolicy_policy_recovery.conf) : $(call build_policy, $(sepolicy_build_files))
Stephen Smalleye60723a2014-05-29 16:40:15 -040089 @mkdir -p $(dir $@)
90 $(hide) m4 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
91 -D target_build_variant=$(TARGET_BUILD_VARIANT) \
Stephen Smalleye60723a2014-05-29 16:40:15 -040092 -D target_recovery=true \
93 -s $^ > $@
94
95$(LOCAL_BUILT_MODULE) : $(sepolicy_policy_recovery.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy
96 @mkdir -p $(dir $@)
97 $(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c $(POLICYVERS) -o $@ $<
98
99built_sepolicy_recovery := $(LOCAL_BUILT_MODULE)
100sepolicy_policy_recovery.conf :=
101
dcashman704741a2014-07-25 19:11:52 -0700102##################################
103include $(CLEAR_VARS)
104
105LOCAL_MODULE := general_sepolicy.conf
106LOCAL_MODULE_CLASS := ETC
107LOCAL_MODULE_TAGS := tests
108
109include $(BUILD_SYSTEM)/base_rules.mk
110
111exp_sepolicy_build_files :=\
112 $(wildcard $(addprefix $(LOCAL_PATH)/, $(sepolicy_build_files)))
113
114$(LOCAL_BUILT_MODULE): PRIVATE_MLS_SENS := $(MLS_SENS)
115$(LOCAL_BUILT_MODULE): PRIVATE_MLS_CATS := $(MLS_CATS)
116$(LOCAL_BUILT_MODULE): $(exp_sepolicy_build_files)
117 mkdir -p $(dir $@)
118 $(hide) m4 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
119 -D target_build_variant=user \
dcashman704741a2014-07-25 19:11:52 -0700120 -s $^ > $@
121 $(hide) sed '/dontaudit/d' $@ > $@.dontaudit
122
123GENERAL_SEPOLICY_POLICY.CONF = $(LOCAL_BUILT_MODULE)
124
125exp_sepolicy_build_files :=
126
127##################################
Stephen Smalley01a58af2012-10-02 12:46:37 -0400128include $(CLEAR_VARS)
129
Ying Wang02fb5f32012-01-17 17:51:09 -0800130LOCAL_MODULE := file_contexts
Ying Wang02fb5f32012-01-17 17:51:09 -0800131LOCAL_MODULE_CLASS := ETC
132LOCAL_MODULE_TAGS := optional
133LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
134
Stephen Smalley5b340be2012-03-06 11:12:41 -0500135include $(BUILD_SYSTEM)/base_rules.mk
Ying Wang02fb5f32012-01-17 17:51:09 -0800136
rpcraig47cd3962012-10-17 21:09:52 -0400137ALL_FC_FILES := $(call build_policy, file_contexts)
Stephen Smalley01a58af2012-10-02 12:46:37 -0400138
Ying Wangd8b122c2012-10-25 19:01:31 -0700139$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
140$(LOCAL_BUILT_MODULE): $(ALL_FC_FILES) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc
Stephen Smalley5b340be2012-03-06 11:12:41 -0500141 @mkdir -p $(dir $@)
Stephen Smalley01a58af2012-10-02 12:46:37 -0400142 $(hide) m4 -s $(ALL_FC_FILES) > $@
Ying Wangd8b122c2012-10-25 19:01:31 -0700143 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc $(PRIVATE_SEPOLICY) $@
Stephen Smalley5b340be2012-03-06 11:12:41 -0500144
Robert Craig8b7545b2014-03-20 09:35:08 -0400145built_fc := $(LOCAL_BUILT_MODULE)
William Roberts171a0622012-08-16 10:55:05 -0700146
Ying Wang02fb5f32012-01-17 17:51:09 -0800147##################################
148include $(CLEAR_VARS)
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400149
150LOCAL_MODULE := general_file_contexts
151LOCAL_MODULE_CLASS := ETC
152LOCAL_MODULE_TAGS := tests
153
154include $(BUILD_SYSTEM)/base_rules.mk
155
156$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
157$(LOCAL_BUILT_MODULE) : $(addprefix $(LOCAL_PATH)/, file_contexts) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc
158 @mkdir -p $(dir $@)
159 $(hide) m4 -s $< > $@
160 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc $(PRIVATE_SEPOLICY) $@
161
162GENERAL_FILE_CONTEXTS := $(LOCAL_BUILT_MODULE)
163
164##################################
165include $(CLEAR_VARS)
Ying Wang02fb5f32012-01-17 17:51:09 -0800166LOCAL_MODULE := seapp_contexts
Ying Wang02fb5f32012-01-17 17:51:09 -0800167LOCAL_MODULE_CLASS := ETC
168LOCAL_MODULE_TAGS := optional
169LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
170
William Roberts171a0622012-08-16 10:55:05 -0700171include $(BUILD_SYSTEM)/base_rules.mk
Ying Wang02fb5f32012-01-17 17:51:09 -0800172
William Roberts98ed3922012-09-05 11:19:07 -0700173seapp_contexts.tmp := $(intermediates)/seapp_contexts.tmp
rpcraig47cd3962012-10-17 21:09:52 -0400174$(seapp_contexts.tmp): $(call build_policy, seapp_contexts)
William Roberts171a0622012-08-16 10:55:05 -0700175 @mkdir -p $(dir $@)
176 $(hide) m4 -s $^ > $@
177
Ying Wangd8b122c2012-10-25 19:01:31 -0700178$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
179$(LOCAL_BUILT_MODULE) : $(seapp_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkseapp
William Robertsf0e0a942012-08-27 15:41:15 -0700180 @mkdir -p $(dir $@)
Ying Wangd8b122c2012-10-25 19:01:31 -0700181 $(HOST_OUT_EXECUTABLES)/checkseapp -p $(PRIVATE_SEPOLICY) -o $@ $<
Ying Wang02fb5f32012-01-17 17:51:09 -0800182
Robert Craig8b7545b2014-03-20 09:35:08 -0400183built_sc := $(LOCAL_BUILT_MODULE)
William Roberts98ed3922012-09-05 11:19:07 -0700184seapp_contexts.tmp :=
Robert Craig8b7545b2014-03-20 09:35:08 -0400185
Ying Wang02fb5f32012-01-17 17:51:09 -0800186##################################
Stephen Smalley124720a2012-04-04 10:11:16 -0400187include $(CLEAR_VARS)
Stephen Smalley37712872015-03-12 15:46:36 -0400188LOCAL_MODULE := general_seapp_contexts
189LOCAL_MODULE_CLASS := ETC
190LOCAL_MODULE_TAGS := tests
191
192include $(BUILD_SYSTEM)/base_rules.mk
193
194general_seapp_contexts.tmp := $(intermediates)/general_seapp_contexts.tmp
195$(general_seapp_contexts.tmp): $(addprefix $(LOCAL_PATH)/, seapp_contexts)
196 @mkdir -p $(dir $@)
197 $(hide) m4 -s $^ > $@
198
199$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
200$(LOCAL_BUILT_MODULE) : $(general_seapp_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkseapp
201 @mkdir -p $(dir $@)
202 $(HOST_OUT_EXECUTABLES)/checkseapp -p $(PRIVATE_SEPOLICY) -o $@ $<
203
204GENERAL_SEAPP_CONTEXTS := $(LOCAL_BUILT_MODULE)
205general_seapp_contexts.tmp :=
206
207##################################
208include $(CLEAR_VARS)
Stephen Smalley124720a2012-04-04 10:11:16 -0400209
210LOCAL_MODULE := property_contexts
211LOCAL_MODULE_CLASS := ETC
212LOCAL_MODULE_TAGS := optional
213LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
214
215include $(BUILD_SYSTEM)/base_rules.mk
216
Robert Craigd98d26e2013-01-23 14:04:50 -0500217ALL_PC_FILES := $(call build_policy, property_contexts)
218
219$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
220$(LOCAL_BUILT_MODULE): $(ALL_PC_FILES) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc
Stephen Smalley124720a2012-04-04 10:11:16 -0400221 @mkdir -p $(dir $@)
Robert Craigd98d26e2013-01-23 14:04:50 -0500222 $(hide) m4 -s $(ALL_PC_FILES) > $@
223 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -p $(PRIVATE_SEPOLICY) $@
Stephen Smalley124720a2012-04-04 10:11:16 -0400224
Robert Craig8b7545b2014-03-20 09:35:08 -0400225built_pc := $(LOCAL_BUILT_MODULE)
226
Stephen Smalley124720a2012-04-04 10:11:16 -0400227##################################
Riley Spahnf90c41f2014-06-05 15:52:02 -0700228include $(CLEAR_VARS)
229
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400230LOCAL_MODULE := general_property_contexts
231LOCAL_MODULE_CLASS := ETC
232LOCAL_MODULE_TAGS := tests
233
Stephen Smalleyc9361732015-03-13 09:36:57 -0400234include $(BUILD_SYSTEM)/base_rules.mk
235
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400236$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
237$(LOCAL_BUILT_MODULE) : $(addprefix $(LOCAL_PATH)/, property_contexts) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc
238 @mkdir -p $(dir $@)
239 $(hide) m4 -s $< > $@
240 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -p $(PRIVATE_SEPOLICY) $@
241
242GENERAL_PROPERTY_CONTEXTS := $(LOCAL_BUILT_MODULE)
243
244##################################
245include $(CLEAR_VARS)
246
Riley Spahnf90c41f2014-06-05 15:52:02 -0700247LOCAL_MODULE := service_contexts
248LOCAL_MODULE_CLASS := ETC
249LOCAL_MODULE_TAGS := optional
250LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
251
252include $(BUILD_SYSTEM)/base_rules.mk
253
254ALL_SVC_FILES := $(call build_policy, service_contexts)
255
256$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
257$(LOCAL_BUILT_MODULE): $(ALL_SVC_FILES) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc
258 @mkdir -p $(dir $@)
259 $(hide) m4 -s $(ALL_SVC_FILES) > $@
260 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -p $(PRIVATE_SEPOLICY) $@
261
262built_svc := $(LOCAL_BUILT_MODULE)
263
264##################################
rpcraigb19665c2012-07-30 09:33:03 -0400265include $(CLEAR_VARS)
266
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400267LOCAL_MODULE := general_service_contexts
268LOCAL_MODULE_CLASS := ETC
269LOCAL_MODULE_TAGS := tests
270
271include $(BUILD_SYSTEM)/base_rules.mk
272
273$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
274$(LOCAL_BUILT_MODULE) : $(addprefix $(LOCAL_PATH)/, service_contexts) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc
275 @mkdir -p $(dir $@)
276 $(hide) m4 -s $< > $@
277 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -p $(PRIVATE_SEPOLICY) $@
278
279GENERAL_SERVICE_CONTEXTS := $(LOCAL_BUILT_MODULE)
280
281##################################
282include $(CLEAR_VARS)
283
Robert Craig7f2392e2013-03-27 08:35:39 -0400284LOCAL_MODULE := mac_permissions.xml
rpcraigb19665c2012-07-30 09:33:03 -0400285LOCAL_MODULE_CLASS := ETC
286LOCAL_MODULE_TAGS := optional
287LOCAL_MODULE_PATH := $(TARGET_OUT_ETC)/security
288
William Roberts2c8a55d2012-11-30 14:59:09 -0800289include $(BUILD_SYSTEM)/base_rules.mk
rpcraigb19665c2012-07-30 09:33:03 -0400290
Geremy Condracd4104e2013-03-26 18:19:12 +0000291# Build keys.conf
292mac_perms_keys.tmp := $(intermediates)/keys.tmp
293$(mac_perms_keys.tmp) : $(call build_policy, keys.conf)
294 @mkdir -p $(dir $@)
295 $(hide) m4 -s $^ > $@
296
Robert Craig7f2392e2013-03-27 08:35:39 -0400297ALL_MAC_PERMS_FILES := $(call build_policy, $(LOCAL_MODULE))
rpcraigb19665c2012-07-30 09:33:03 -0400298
Robert Craig7f2392e2013-03-27 08:35:39 -0400299$(LOCAL_BUILT_MODULE) : $(mac_perms_keys.tmp) $(HOST_OUT_EXECUTABLES)/insertkeys.py $(ALL_MAC_PERMS_FILES)
Geremy Condracd4104e2013-03-26 18:19:12 +0000300 @mkdir -p $(dir $@)
Nick Kralevichc3c90522013-10-25 12:25:36 -0700301 $(hide) DEFAULT_SYSTEM_DEV_CERTIFICATE="$(dir $(DEFAULT_SYSTEM_DEV_CERTIFICATE))" \
302 $(HOST_OUT_EXECUTABLES)/insertkeys.py -t $(TARGET_BUILD_VARIANT) -c $(TOP) $< -o $@ $(ALL_MAC_PERMS_FILES)
Geremy Condracd4104e2013-03-26 18:19:12 +0000303
Robert Craig7f2392e2013-03-27 08:35:39 -0400304mac_perms_keys.tmp :=
rpcraigb19665c2012-07-30 09:33:03 -0400305##################################
Robert Craig8b7545b2014-03-20 09:35:08 -0400306include $(CLEAR_VARS)
307
308LOCAL_MODULE := selinux_version
309LOCAL_MODULE_CLASS := ETC
310LOCAL_MODULE_TAGS := optional
311LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
312
313include $(BUILD_SYSTEM)/base_rules.mk
Riley Spahnf90c41f2014-06-05 15:52:02 -0700314$(LOCAL_BUILT_MODULE) : $(built_sepolicy) $(built_pc) $(built_fc) $(built_sc) $(built_svc)
Robert Craig8b7545b2014-03-20 09:35:08 -0400315 @mkdir -p $(dir $@)
316 $(hide) echo -n $(BUILD_FINGERPRINT) > $@
317
318##################################
rpcraig47cd3962012-10-17 21:09:52 -0400319
320build_policy :=
dcashman704741a2014-07-25 19:11:52 -0700321sepolicy_build_files :=
Robert Craig8b7545b2014-03-20 09:35:08 -0400322built_sepolicy :=
323built_sc :=
324built_fc :=
325built_pc :=
Riley Spahnf90c41f2014-06-05 15:52:02 -0700326built_svc :=
Alice Chucdfb06f2012-11-01 11:33:04 -0700327
328include $(call all-makefiles-under,$(LOCAL_PATH))