Tri Vo | 1406926 | 2018-01-31 16:22:35 -0800 | [diff] [blame] | 1 | version := $(version_under_treble_tests) |
| 2 | |
| 3 | include $(CLEAR_VARS) |
| 4 | # For Treble builds run tests verifying that processes are properly labeled and |
| 5 | # permissions granted do not violate the treble model. Also ensure that treble |
| 6 | # compatibility guarantees are upheld between SELinux version bumps. |
| 7 | LOCAL_MODULE := treble_sepolicy_tests_$(version) |
| 8 | LOCAL_MODULE_CLASS := ETC |
| 9 | LOCAL_MODULE_TAGS := tests |
| 10 | |
| 11 | include $(BUILD_SYSTEM)/base_rules.mk |
| 12 | |
| 13 | # $(version)_plat - the platform policy shipped as part of the $(version) release. This is |
| 14 | # built to enable us to determine the diff between the current policy and the |
| 15 | # $(version) policy, which will be used in tests to make sure that compatibility has |
| 16 | # been maintained by our mapping files. |
| 17 | $(version)_PLAT_PUBLIC_POLICY := $(LOCAL_PATH)/prebuilts/api/$(version)/public |
| 18 | $(version)_PLAT_PRIVATE_POLICY := $(LOCAL_PATH)/prebuilts/api/$(version)/private |
| 19 | $(version)_plat_policy.conf := $(intermediates)/$(version)_plat_policy.conf |
| 20 | $($(version)_plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS) |
| 21 | $($(version)_plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS) |
Joel Galenson | c148621 | 2018-03-23 12:40:26 -0700 | [diff] [blame] | 22 | $($(version)_plat_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := user |
Tri Vo | 1406926 | 2018-01-31 16:22:35 -0800 | [diff] [blame] | 23 | $($(version)_plat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch) |
| 24 | $($(version)_plat_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) |
Pirama Arumuga Nainar | b658246 | 2019-06-13 15:05:15 -0700 | [diff] [blame] | 25 | $($(version)_plat_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage) |
Tri Vo | 1406926 | 2018-01-31 16:22:35 -0800 | [diff] [blame] | 26 | $($(version)_plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) |
| 27 | $($(version)_plat_policy.conf): PRIVATE_SEPOLICY_SPLIT := true |
| 28 | $($(version)_plat_policy.conf): $(call build_policy, $(sepolicy_build_files), \ |
| 29 | $($(version)_PLAT_PUBLIC_POLICY) $($(version)_PLAT_PRIVATE_POLICY)) |
| 30 | $(transform-policy-to-conf) |
| 31 | $(hide) sed '/dontaudit/d' $@ > $@.dontaudit |
| 32 | |
| 33 | |
| 34 | built_$(version)_plat_sepolicy := $(intermediates)/built_$(version)_plat_sepolicy |
| 35 | $(built_$(version)_plat_sepolicy): PRIVATE_ADDITIONAL_CIL_FILES := \ |
| 36 | $(call build_policy, technical_debt.cil , $($(version)_PLAT_PRIVATE_POLICY)) |
| 37 | $(built_$(version)_plat_sepolicy): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG) |
| 38 | $(built_$(version)_plat_sepolicy): $($(version)_plat_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \ |
| 39 | $(HOST_OUT_EXECUTABLES)/secilc \ |
| 40 | $(call build_policy, technical_debt.cil, $($(version)_PLAT_PRIVATE_POLICY)) \ |
| 41 | $(built_sepolicy_neverallows) |
| 42 | @mkdir -p $(dir $@) |
| 43 | $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \ |
| 44 | $(POLICYVERS) -o $@ $< |
| 45 | $(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@ |
| 46 | $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $@ -o $@ -f /dev/null |
| 47 | |
| 48 | $(version)_plat_policy.conf := |
| 49 | |
| 50 | |
| 51 | # $(version)_compat - the current plat_sepolicy.cil built with the compatibility file |
| 52 | # targeting the $(version) SELinux release. This ensures that our policy will build |
| 53 | # when used on a device that has non-platform policy targetting the $(version) release. |
| 54 | $(version)_compat := $(intermediates)/$(version)_compat |
Tri Vo | 438684b | 2018-09-29 17:47:10 -0700 | [diff] [blame] | 55 | $(version)_mapping.cil := $(call intermediates-dir-for,ETC,$(version).cil)/$(version).cil |
| 56 | $(version)_mapping.ignore.cil := \ |
| 57 | $(call intermediates-dir-for,ETC,$(version).ignore.cil)/$(version).ignore.cil |
Jae Shin | 1fa9634 | 2018-07-11 18:30:44 +0900 | [diff] [blame] | 58 | $(version)_prebuilts_dir := $(LOCAL_PATH)/prebuilts/api/$(version) |
| 59 | |
| 60 | # vendor_sepolicy.cil and plat_pub_versioned.cil are the new design to replace |
| 61 | # nonplat_sepolicy.cil. |
| 62 | $(version)_nonplat := $($(version)_prebuilts_dir)/vendor_sepolicy.cil \ |
| 63 | $($(version)_prebuilts_dir)/plat_pub_versioned.cil |
| 64 | ifeq (,$(wildcard $($(version)_nonplat))) |
| 65 | $(version)_nonplat := $($(version)_prebuilts_dir)/nonplat_sepolicy.cil |
| 66 | endif |
| 67 | |
Tri Vo | 1406926 | 2018-01-31 16:22:35 -0800 | [diff] [blame] | 68 | $($(version)_compat): PRIVATE_CIL_FILES := \ |
| 69 | $(built_plat_cil) $($(version)_mapping.cil) $($(version)_nonplat) |
| 70 | $($(version)_compat): $(HOST_OUT_EXECUTABLES)/secilc \ |
| 71 | $(built_plat_cil) $($(version)_mapping.cil) $($(version)_nonplat) |
| 72 | $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -N -c $(POLICYVERS) \ |
| 73 | $(PRIVATE_CIL_FILES) -o $@ -f /dev/null |
| 74 | |
| 75 | # $(version)_mapping.combined.cil - a combination of the mapping file used when |
| 76 | # combining the current platform policy with nonplatform policy based on the |
| 77 | # $(version) policy release and also a special ignored file that exists purely for |
| 78 | # these tests. |
| 79 | $(version)_mapping.combined.cil := $(intermediates)/$(version)_mapping.combined.cil |
| 80 | $($(version)_mapping.combined.cil): $($(version)_mapping.cil) $($(version)_mapping.ignore.cil) |
| 81 | mkdir -p $(dir $@) |
| 82 | cat $^ > $@ |
| 83 | |
| 84 | treble_sepolicy_tests_$(version) := $(intermediates)/treble_sepolicy_tests_$(version) |
| 85 | $(treble_sepolicy_tests_$(version)): ALL_FC_ARGS := $(all_fc_args) |
| 86 | $(treble_sepolicy_tests_$(version)): PRIVATE_SEPOLICY := $(built_sepolicy) |
| 87 | $(treble_sepolicy_tests_$(version)): PRIVATE_SEPOLICY_OLD := $(built_$(version)_plat_sepolicy) |
| 88 | $(treble_sepolicy_tests_$(version)): PRIVATE_COMBINED_MAPPING := $($(version)_mapping.combined.cil) |
| 89 | $(treble_sepolicy_tests_$(version)): PRIVATE_PLAT_SEPOLICY := $(built_plat_sepolicy) |
Tri Vo | e3f4f77 | 2018-09-28 17:21:08 -0700 | [diff] [blame] | 90 | $(treble_sepolicy_tests_$(version)): PRIVATE_PLAT_PUB_SEPOLICY := $(base_plat_pub_policy.cil) |
Tri Vo | 1406926 | 2018-01-31 16:22:35 -0800 | [diff] [blame] | 91 | $(treble_sepolicy_tests_$(version)): PRIVATE_FAKE_TREBLE := |
Steven Moreland | c7670e5 | 2018-09-07 16:01:38 -0700 | [diff] [blame] | 92 | ifeq ($(PRODUCT_FULL_TREBLE_OVERRIDE),true) |
Tri Vo | 0d23383 | 2018-10-31 14:18:15 -0700 | [diff] [blame] | 93 | # TODO(b/113124961): account for PRODUCT_SHIPPING_API_LEVEL when determining |
| 94 | # fake treble status once emulator is no longer fake treble. |
| 95 | #ifdef PRODUCT_SHIPPING_API_LEVEL |
Steven Moreland | c7670e5 | 2018-09-07 16:01:38 -0700 | [diff] [blame] | 96 | # These requirements were originally added in Android Oreo. Devices |
| 97 | # launching after this should not distinguish between |
| 98 | # PRODUCT_FULL_TREBLE and PRODUCT_FULL_TREBLE_OVERRIDE since this could |
| 99 | # lead to release problems where they think they pass this test but |
| 100 | # fail it when it actually gets runned for compliance. |
Tri Vo | 0d23383 | 2018-10-31 14:18:15 -0700 | [diff] [blame] | 101 | #ifeq ($(call math_gt_or_eq,$(PRODUCT_SHIPPING_API_LEVEL),26),) |
Steven Moreland | c7670e5 | 2018-09-07 16:01:38 -0700 | [diff] [blame] | 102 | $(treble_sepolicy_tests_$(version)): PRIVATE_FAKE_TREBLE := --fake-treble |
Tri Vo | 0d23383 | 2018-10-31 14:18:15 -0700 | [diff] [blame] | 103 | #endif # if PRODUCT_SHIPPING_API_LEVEL < 26 (Android Oreo) |
| 104 | #endif # PRODUCT_SHIPPING_API_LEVEL defined |
Steven Moreland | c7670e5 | 2018-09-07 16:01:38 -0700 | [diff] [blame] | 105 | endif # PRODUCT_FULL_TREBLE_OVERRIDE = true |
Tri Vo | 1406926 | 2018-01-31 16:22:35 -0800 | [diff] [blame] | 106 | $(treble_sepolicy_tests_$(version)): $(HOST_OUT_EXECUTABLES)/treble_sepolicy_tests \ |
| 107 | $(all_fc_files) $(built_sepolicy) $(built_plat_sepolicy) \ |
Tri Vo | e3f4f77 | 2018-09-28 17:21:08 -0700 | [diff] [blame] | 108 | $(base_plat_pub_policy.cil) \ |
Tri Vo | 1406926 | 2018-01-31 16:22:35 -0800 | [diff] [blame] | 109 | $(built_$(version)_plat_sepolicy) $($(version)_compat) $($(version)_mapping.combined.cil) |
| 110 | @mkdir -p $(dir $@) |
| 111 | $(hide) $(HOST_OUT_EXECUTABLES)/treble_sepolicy_tests -l \ |
| 112 | $(HOST_OUT)/lib64/libsepolwrap.$(SHAREDLIB_EXT) $(ALL_FC_ARGS) \ |
| 113 | -b $(PRIVATE_PLAT_SEPOLICY) -m $(PRIVATE_COMBINED_MAPPING) \ |
| 114 | -o $(PRIVATE_SEPOLICY_OLD) -p $(PRIVATE_SEPOLICY) \ |
Tri Vo | e3f4f77 | 2018-09-28 17:21:08 -0700 | [diff] [blame] | 115 | -u $(PRIVATE_PLAT_PUB_SEPOLICY) \ |
Tri Vo | 1406926 | 2018-01-31 16:22:35 -0800 | [diff] [blame] | 116 | $(PRIVATE_FAKE_TREBLE) |
| 117 | $(hide) touch $@ |
| 118 | |
| 119 | $(version)_PLAT_PUBLIC_POLICY := |
| 120 | $(version)_PLAT_PRIVATE_POLICY := |
| 121 | $(version)_compat := |
| 122 | $(version)_mapping.cil := |
| 123 | $(version)_mapping.combined.cil := |
| 124 | $(version)_mapping.ignore.cil := |
| 125 | $(version)_nonplat := |
Jae Shin | 1fa9634 | 2018-07-11 18:30:44 +0900 | [diff] [blame] | 126 | $(version)_prebuilts_dir := |
Tri Vo | 1406926 | 2018-01-31 16:22:35 -0800 | [diff] [blame] | 127 | built_$(version)_plat_sepolicy := |
| 128 | version := |
| 129 | version_under_treble_tests := |