Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 1 | LOCAL_PATH:= $(call my-dir) |
William Roberts | f0e0a94 | 2012-08-27 15:41:15 -0700 | [diff] [blame] | 2 | |
Dan Cashman | 36ee91d | 2017-07-07 14:59:51 -0700 | [diff] [blame] | 3 | include $(LOCAL_PATH)/definitions.mk |
Jeff Vander Stoep | ecd288f | 2019-02-15 12:18:15 -0800 | [diff] [blame] | 4 | include $(LOCAL_PATH)/policy_version.mk |
Dan Cashman | 36ee91d | 2017-07-07 14:59:51 -0700 | [diff] [blame] | 5 | |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 6 | include $(CLEAR_VARS) |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 7 | |
| 8 | MLS_SENS=1 |
| 9 | MLS_CATS=1024 |
| 10 | |
Stephen Smalley | 8e0ca88 | 2015-04-01 10:14:56 -0400 | [diff] [blame] | 11 | ifdef BOARD_SEPOLICY_UNION |
| 12 | $(warning BOARD_SEPOLICY_UNION is no longer required - all files found in BOARD_SEPOLICY_DIRS are implicitly unioned; please remove from your BoardConfig.mk or other .mk file.) |
| 13 | endif |
Robert Craig | 6b0ff47 | 2014-01-29 13:10:58 -0500 | [diff] [blame] | 14 | |
William Roberts | d218558 | 2015-07-16 11:28:02 -0700 | [diff] [blame] | 15 | ifdef BOARD_SEPOLICY_M4DEFS |
| 16 | LOCAL_ADDITIONAL_M4DEFS := $(addprefix -D, $(BOARD_SEPOLICY_M4DEFS)) |
Dan Cashman | 36ee91d | 2017-07-07 14:59:51 -0700 | [diff] [blame] | 17 | else |
| 18 | LOCAL_ADDITIONAL_M4DEFS := |
William Roberts | d218558 | 2015-07-16 11:28:02 -0700 | [diff] [blame] | 19 | endif |
| 20 | |
dcashman | cc39f63 | 2016-07-22 13:13:11 -0700 | [diff] [blame] | 21 | # sepolicy is now divided into multiple portions: |
| 22 | # public - policy exported on which non-platform policy developers may write |
| 23 | # additional policy. types and attributes are versioned and included in |
| 24 | # delivered non-platform policy, which is to be combined with platform policy. |
| 25 | # private - platform-only policy required for platform functionality but which |
| 26 | # is not exported to vendor policy developers and as such may not be assumed |
| 27 | # to exist. |
Alex Klyubin | 5596172 | 2017-01-30 18:44:59 -0800 | [diff] [blame] | 28 | # vendor - vendor-only policy required for vendor functionality. This policy can |
| 29 | # reference the public policy but cannot reference the private policy. This |
| 30 | # policy is for components which are produced from the core/non-vendor tree and |
| 31 | # placed into a vendor partition. |
dcashman | 0779155 | 2016-12-07 11:27:47 -0800 | [diff] [blame] | 32 | # mapping - This contains policy statements which map the attributes |
dcashman | cc39f63 | 2016-07-22 13:13:11 -0700 | [diff] [blame] | 33 | # exposed in the public policy of previous versions to the concrete types used |
| 34 | # in this policy to ensure that policy targeting attributes from public |
| 35 | # policy from an older platform version continues to work. |
| 36 | |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 37 | # build process for device: |
dcashman | cc39f63 | 2016-07-22 13:13:11 -0700 | [diff] [blame] | 38 | # 1) convert policies to CIL: |
| 39 | # - private + public platform policy to CIL |
| 40 | # - mapping file to CIL (should already be in CIL form) |
| 41 | # - non-platform public policy to CIL |
| 42 | # - non-platform public + private policy to CIL |
| 43 | # 2) attributize policy |
dcashman | cc39f63 | 2016-07-22 13:13:11 -0700 | [diff] [blame] | 44 | # - run script which takes non-platform public and non-platform combined |
| 45 | # private + public policy and produces attributized and versioned |
| 46 | # non-platform policy |
| 47 | # 3) combine policy files |
| 48 | # - combine mapping, platform and non-platform policy. |
| 49 | # - compile output binary policy file |
| 50 | |
| 51 | PLAT_PUBLIC_POLICY := $(LOCAL_PATH)/public |
| 52 | PLAT_PRIVATE_POLICY := $(LOCAL_PATH)/private |
Alex Klyubin | 5596172 | 2017-01-30 18:44:59 -0800 | [diff] [blame] | 53 | PLAT_VENDOR_POLICY := $(LOCAL_PATH)/vendor |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 54 | REQD_MASK_POLICY := $(LOCAL_PATH)/reqd_mask |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 55 | SYSTEM_EXT_PUBLIC_POLICY := $(BOARD_PLAT_PUBLIC_SEPOLICY_DIR) |
| 56 | SYSTEM_EXT_PRIVATE_POLICY := $(BOARD_PLAT_PRIVATE_SEPOLICY_DIR) |
Tri Vo | 9918f28 | 2019-02-01 11:41:08 -0800 | [diff] [blame] | 57 | PRODUCT_PUBLIC_POLICY := $(PRODUCT_PUBLIC_SEPOLICY_DIRS) |
| 58 | PRODUCT_PRIVATE_POLICY := $(PRODUCT_PRIVATE_SEPOLICY_DIRS) |
Tri Vo | 75887dd | 2018-12-14 14:30:56 -0800 | [diff] [blame] | 59 | |
Yiming Jing | 43e188a | 2020-10-14 20:37:13 +0000 | [diff] [blame] | 60 | # Extra sepolicy and prebuilts directories for sepolicy_freeze_test |
| 61 | FREEZE_TEST_EXTRA_DIRS := $(SEPOLICY_FREEZE_TEST_EXTRA_DIRS) |
| 62 | FREEZE_TEST_EXTRA_PREBUILT_DIRS := $(SEPOLICY_FREEZE_TEST_EXTRA_PREBUILT_DIRS) |
| 63 | |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 64 | ifneq (,$(SYSTEM_EXT_PUBLIC_POLICY)$(SYSTEM_EXT_PRIVATE_POLICY)) |
Bowgo Tsai | ac38125 | 2019-10-04 14:34:18 +0800 | [diff] [blame] | 65 | HAS_SYSTEM_EXT_SEPOLICY_DIR := true |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 66 | endif |
| 67 | |
Tri Vo | 75887dd | 2018-12-14 14:30:56 -0800 | [diff] [blame] | 68 | # TODO(b/119305624): Currently if the device doesn't have a product partition, |
| 69 | # we install product sepolicy into /system/product. We do that because bits of |
| 70 | # product sepolicy that's still in /system might depend on bits that have moved |
| 71 | # to /product. Once we finish migrating product sepolicy out of system, change |
| 72 | # it so that if no product partition is present, product sepolicy artifacts are |
| 73 | # not built and installed at all. |
| 74 | ifneq (,$(PRODUCT_PUBLIC_POLICY)$(PRODUCT_PRIVATE_POLICY)) |
Bowgo Tsai | 7c4150c | 2019-10-04 15:36:05 +0800 | [diff] [blame] | 75 | HAS_PRODUCT_SEPOLICY_DIR := true |
Tri Vo | 75887dd | 2018-12-14 14:30:56 -0800 | [diff] [blame] | 76 | endif |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 77 | |
| 78 | # TODO: move to README when doing the README update and finalizing versioning. |
Sandeep Patil | 42f9598 | 2017-04-07 14:18:48 -0700 | [diff] [blame] | 79 | # BOARD_SEPOLICY_VERS must take the format "NN.m" and contain the sepolicy |
| 80 | # version identifier corresponding to the sepolicy on which the non-platform |
| 81 | # policy is to be based. If unspecified, this will build against the current |
| 82 | # public platform policy in tree |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 83 | ifndef BOARD_SEPOLICY_VERS |
Sandeep Patil | 42f9598 | 2017-04-07 14:18:48 -0700 | [diff] [blame] | 84 | # The default platform policy version. |
Dan Cashman | 6f14f6b | 2017-04-07 16:36:23 -0700 | [diff] [blame] | 85 | BOARD_SEPOLICY_VERS := $(PLATFORM_SEPOLICY_VERSION) |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 86 | endif |
dcashman | cc39f63 | 2016-07-22 13:13:11 -0700 | [diff] [blame] | 87 | |
Joel Galenson | 5988b56 | 2018-01-03 16:53:24 -0800 | [diff] [blame] | 88 | NEVERALLOW_ARG := |
| 89 | ifeq ($(SELINUX_IGNORE_NEVERALLOWS),true) |
| 90 | ifeq ($(TARGET_BUILD_VARIANT),user) |
| 91 | $(error SELINUX_IGNORE_NEVERALLOWS := true cannot be used in user builds) |
| 92 | endif |
| 93 | $(warning Be careful when using the SELINUX_IGNORE_NEVERALLOWS flag. \ |
| 94 | It does not work in user builds and using it will \ |
| 95 | not stop you from failing CTS.) |
| 96 | NEVERALLOW_ARG := -N |
| 97 | endif |
| 98 | |
Bowgo Tsai | 45457e3 | 2017-11-27 11:41:33 +0800 | [diff] [blame] | 99 | # BOARD_SEPOLICY_DIRS was used for vendor/odm sepolicy customization before. |
| 100 | # It has been replaced by BOARD_VENDOR_SEPOLICY_DIRS (mandatory) and |
| 101 | # BOARD_ODM_SEPOLICY_DIRS (optional). BOARD_SEPOLICY_DIRS is still allowed for |
| 102 | # backward compatibility, which will be merged into BOARD_VENDOR_SEPOLICY_DIRS. |
Bowgo Tsai | afbcf21 | 2018-02-05 17:34:52 +0800 | [diff] [blame] | 103 | ifdef BOARD_SEPOLICY_DIRS |
| 104 | BOARD_VENDOR_SEPOLICY_DIRS += $(BOARD_SEPOLICY_DIRS) |
| 105 | endif |
Dan Cashman | 4d24a77 | 2017-04-12 14:28:34 -0700 | [diff] [blame] | 106 | |
Bowgo Tsai | 45457e3 | 2017-11-27 11:41:33 +0800 | [diff] [blame] | 107 | ifdef BOARD_ODM_SEPOLICY_DIRS |
| 108 | ifneq ($(PRODUCT_SEPOLICY_SPLIT),true) |
| 109 | $(error PRODUCT_SEPOLICY_SPLIT needs to be true when using BOARD_ODM_SEPOLICY_DIRS) |
| 110 | endif |
| 111 | endif |
| 112 | |
dcashman | cc39f63 | 2016-07-22 13:13:11 -0700 | [diff] [blame] | 113 | ########################################################### |
| 114 | # Compute policy files to be used in policy build. |
| 115 | # $(1): files to include |
| 116 | # $(2): directories in which to find files |
| 117 | ########################################################### |
| 118 | |
| 119 | define build_policy |
| 120 | $(foreach type, $(1), $(foreach file, $(addsuffix /$(type), $(2)), $(sort $(wildcard $(file))))) |
| 121 | endef |
William Roberts | 29d1468 | 2016-01-04 12:20:57 -0800 | [diff] [blame] | 122 | |
Bowgo Tsai | afbcf21 | 2018-02-05 17:34:52 +0800 | [diff] [blame] | 123 | # Builds paths for all policy files found in BOARD_VENDOR_SEPOLICY_DIRS. |
William Roberts | 49693f1 | 2016-01-04 12:20:57 -0800 | [diff] [blame] | 124 | # $(1): the set of policy name paths to build |
Bowgo Tsai | afbcf21 | 2018-02-05 17:34:52 +0800 | [diff] [blame] | 125 | build_vendor_policy = $(call build_policy, $(1), $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS)) |
William Roberts | 49693f1 | 2016-01-04 12:20:57 -0800 | [diff] [blame] | 126 | |
Bowgo Tsai | bae1517 | 2017-11-29 16:14:53 +0800 | [diff] [blame] | 127 | # Builds paths for all policy files found in BOARD_ODM_SEPOLICY_DIRS. |
| 128 | build_odm_policy = $(call build_policy, $(1), $(BOARD_ODM_SEPOLICY_DIRS)) |
| 129 | |
dcashman | 704741a | 2014-07-25 19:11:52 -0700 | [diff] [blame] | 130 | sepolicy_build_files := security_classes \ |
| 131 | initial_sids \ |
| 132 | access_vectors \ |
| 133 | global_macros \ |
Nick Kralevich | a17a266 | 2014-11-05 15:30:41 -0800 | [diff] [blame] | 134 | neverallow_macros \ |
dcashman | 704741a | 2014-07-25 19:11:52 -0700 | [diff] [blame] | 135 | mls_macros \ |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 136 | mls_decl \ |
dcashman | 704741a | 2014-07-25 19:11:52 -0700 | [diff] [blame] | 137 | mls \ |
| 138 | policy_capabilities \ |
| 139 | te_macros \ |
| 140 | attributes \ |
Jeff Vander Stoep | cbaa2b7 | 2015-12-22 10:39:34 -0800 | [diff] [blame] | 141 | ioctl_defines \ |
Jeff Vander Stoep | de9b530 | 2015-06-05 15:28:55 -0700 | [diff] [blame] | 142 | ioctl_macros \ |
dcashman | 704741a | 2014-07-25 19:11:52 -0700 | [diff] [blame] | 143 | *.te \ |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 144 | roles_decl \ |
dcashman | 704741a | 2014-07-25 19:11:52 -0700 | [diff] [blame] | 145 | roles \ |
| 146 | users \ |
| 147 | initial_sid_contexts \ |
| 148 | fs_use \ |
| 149 | genfs_contexts \ |
| 150 | port_contexts |
| 151 | |
Tri Vo | 71f1239 | 2019-10-07 16:31:40 -0700 | [diff] [blame] | 152 | # Security classes and permissions defined outside of system/sepolicy. |
| 153 | security_class_extension_files := $(call build_policy, security_classes access_vectors, \ |
| 154 | $(SYSTEM_EXT_PUBLIC_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY) \ |
| 155 | $(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY) \ |
| 156 | $(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_ODM_SEPOLICY_DIRS)) |
| 157 | |
| 158 | ifneq (,$(strip $(security_class_extension_files))) |
| 159 | $(error Only platform SELinux policy may define classes and permissions: $(strip $(security_class_extension_files))) |
| 160 | endif |
| 161 | |
Bowgo Tsai | ac38125 | 2019-10-04 14:34:18 +0800 | [diff] [blame] | 162 | ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR |
| 163 | # Checks if there are public system_ext policy files. |
| 164 | policy_files := $(call build_policy, $(sepolicy_build_files), $(SYSTEM_EXT_PUBLIC_POLICY)) |
| 165 | ifneq (,$(strip $(policy_files))) |
| 166 | HAS_SYSTEM_EXT_PUBLIC_SEPOLICY := true |
| 167 | endif |
| 168 | # Checks if there are public/private system_ext policy files. |
| 169 | policy_files := $(call build_policy, $(sepolicy_build_files), $(SYSTEM_EXT_PUBLIC_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY)) |
| 170 | ifneq (,$(strip $(policy_files))) |
| 171 | HAS_SYSTEM_EXT_SEPOLICY := true |
| 172 | endif |
| 173 | endif # ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR |
| 174 | |
Bowgo Tsai | 7c4150c | 2019-10-04 15:36:05 +0800 | [diff] [blame] | 175 | ifdef HAS_PRODUCT_SEPOLICY_DIR |
| 176 | # Checks if there are public product policy files. |
| 177 | policy_files := $(call build_policy, $(sepolicy_build_files), $(PRODUCT_PUBLIC_POLICY)) |
| 178 | ifneq (,$(strip $(policy_files))) |
| 179 | HAS_PRODUCT_PUBLIC_SEPOLICY := true |
| 180 | endif |
| 181 | # Checks if there are public/private product policy files. |
| 182 | policy_files := $(call build_policy, $(sepolicy_build_files), $(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY)) |
| 183 | ifneq (,$(strip $(policy_files))) |
| 184 | HAS_PRODUCT_SEPOLICY := true |
| 185 | endif |
| 186 | endif # ifdef HAS_PRODUCT_SEPOLICY_DIR |
| 187 | |
Alex Klyubin | 7cda44f | 2017-03-21 14:28:53 -0700 | [diff] [blame] | 188 | # CIL files which contain workarounds for current limitation of human-readable |
| 189 | # module policy language. These files are appended to the CIL files produced |
| 190 | # from module language files. |
| 191 | sepolicy_build_cil_workaround_files := technical_debt.cil |
| 192 | |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 193 | my_target_arch := $(TARGET_ARCH) |
| 194 | ifneq (,$(filter mips mips64,$(TARGET_ARCH))) |
| 195 | my_target_arch := mips |
| 196 | endif |
| 197 | |
Jeff Vander Stoep | d2053bd | 2017-03-15 13:37:35 -0700 | [diff] [blame] | 198 | intermediates := $(TARGET_OUT_INTERMEDIATES)/ETC/sepolicy_intermediates |
| 199 | |
Jeff Vander Stoep | 7443484 | 2017-03-13 12:22:15 -0700 | [diff] [blame] | 200 | with_asan := false |
| 201 | ifneq (,$(filter address,$(SANITIZE_TARGET))) |
| 202 | with_asan := true |
| 203 | endif |
| 204 | |
Pirama Arumuga Nainar | ce9c0c5 | 2019-06-13 15:05:15 -0700 | [diff] [blame] | 205 | with_native_coverage := false |
| 206 | ifeq ($(NATIVE_COVERAGE),true) |
| 207 | with_native_coverage := true |
| 208 | endif |
Oliver Nguyen | fad5f81 | 2019-12-09 16:37:59 -0800 | [diff] [blame] | 209 | ifeq ($(CLANG_COVERAGE),true) |
| 210 | with_native_coverage := true |
| 211 | endif |
Pirama Arumuga Nainar | ce9c0c5 | 2019-06-13 15:05:15 -0700 | [diff] [blame] | 212 | |
Inseob Kim | ed59c22 | 2019-09-26 15:14:55 +0900 | [diff] [blame] | 213 | treble_sysprop_neverallow := true |
| 214 | ifeq ($(BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW),true) |
| 215 | treble_sysprop_neverallow := false |
| 216 | endif |
| 217 | |
| 218 | ifeq ($(PRODUCT_SHIPPING_API_LEVEL),) |
| 219 | #$(warning no product shipping level defined) |
| 220 | else ifneq ($(call math_lt,29,$(PRODUCT_SHIPPING_API_LEVEL)),) |
| 221 | ifneq ($(BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW),) |
| 222 | $(error BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW cannot be set on a device shipping with R or later, and this is tested by CTS.) |
| 223 | endif |
| 224 | endif |
| 225 | |
Jeff Vander Stoep | 3ca843a | 2017-10-04 09:42:29 -0700 | [diff] [blame] | 226 | # Library extension for host-side tests |
Jeff Vander Stoep | e06e4c1 | 2017-10-04 18:15:44 -0700 | [diff] [blame] | 227 | ifeq ($(HOST_OS),darwin) |
Jeff Vander Stoep | 3ca843a | 2017-10-04 09:42:29 -0700 | [diff] [blame] | 228 | SHAREDLIB_EXT=dylib |
| 229 | else |
| 230 | SHAREDLIB_EXT=so |
| 231 | endif |
| 232 | |
Jiyong Park | e7fab18 | 2019-01-24 16:41:47 +0900 | [diff] [blame] | 233 | # Convert a file_context file for a non-flattened APEX into a file for |
| 234 | # flattened APEX. /system/apex/<apex_name> path is prepended to the original paths |
| 235 | # $(1): path to the input file_contexts file for non-flattened APEX |
Jooyung Han | a932474 | 2019-11-20 17:54:34 +0900 | [diff] [blame] | 236 | # $(2): path to the flattened APEX |
| 237 | # $(3): path to the generated file_contexts file for flattened APEX |
Jiyong Park | e7fab18 | 2019-01-24 16:41:47 +0900 | [diff] [blame] | 238 | # $(4): variable where $(3) is added to |
| 239 | define build_flattened_apex_file_contexts |
| 240 | $(4) += $(3) |
Jooyung Han | a932474 | 2019-11-20 17:54:34 +0900 | [diff] [blame] | 241 | $(3): PRIVATE_APEX_PATH := $(subst .,\\.,$(2)) |
Jiyong Park | e7fab18 | 2019-01-24 16:41:47 +0900 | [diff] [blame] | 242 | $(3): $(1) |
| 243 | $(hide) awk '/object_r/{printf("$$(PRIVATE_APEX_PATH)%s\n",$$$$0)}' $$< > $$@ |
| 244 | endef |
| 245 | |
Anton Hansson | 8cfe1e6 | 2018-07-02 14:31:29 +0100 | [diff] [blame] | 246 | ################################# |
| 247 | |
Dan Cashman | 4f9a648 | 2017-04-10 12:27:18 -0700 | [diff] [blame] | 248 | include $(CLEAR_VARS) |
Anton Hansson | 8cfe1e6 | 2018-07-02 14:31:29 +0100 | [diff] [blame] | 249 | |
Dan Cashman | 4f9a648 | 2017-04-10 12:27:18 -0700 | [diff] [blame] | 250 | LOCAL_MODULE := selinux_policy |
| 251 | LOCAL_MODULE_TAGS := optional |
Tri Vo | 1f4a28b | 2018-05-08 18:52:11 -0700 | [diff] [blame] | 252 | LOCAL_REQUIRED_MODULES += \ |
Anton Hansson | 8cfe1e6 | 2018-07-02 14:31:29 +0100 | [diff] [blame] | 253 | selinux_policy_nonsystem \ |
| 254 | selinux_policy_system \ |
Tri Vo | 1f4a28b | 2018-05-08 18:52:11 -0700 | [diff] [blame] | 255 | |
Anton Hansson | 8cfe1e6 | 2018-07-02 14:31:29 +0100 | [diff] [blame] | 256 | include $(BUILD_PHONY_PACKAGE) |
Tri Vo | 1f4a28b | 2018-05-08 18:52:11 -0700 | [diff] [blame] | 257 | |
Jooyung Han | 749cf93 | 2019-05-30 01:05:43 +0900 | [diff] [blame] | 258 | # selinux_policy is a main goal and triggers lots of tests. |
| 259 | # Most tests are FAKE modules, so aren'triggered on normal builds. (e.g. 'm') |
| 260 | # By setting as droidcore's dependency, tests will run on normal builds. |
| 261 | droidcore: selinux_policy |
Tri Vo | 1f4a28b | 2018-05-08 18:52:11 -0700 | [diff] [blame] | 262 | |
Anton Hansson | 8cfe1e6 | 2018-07-02 14:31:29 +0100 | [diff] [blame] | 263 | include $(CLEAR_VARS) |
| 264 | LOCAL_MODULE := selinux_policy_system |
Tri Vo | 1f4a28b | 2018-05-08 18:52:11 -0700 | [diff] [blame] | 265 | # These build targets are not used on non-Treble devices. However, we build these to avoid |
| 266 | # divergence between Treble and non-Treble devices. |
Dan Cashman | 4f9a648 | 2017-04-10 12:27:18 -0700 | [diff] [blame] | 267 | LOCAL_REQUIRED_MODULES += \ |
Tri Vo | 937e664 | 2019-01-15 15:16:55 -0800 | [diff] [blame] | 268 | plat_mapping_file \ |
Tri Vo | 6117855 | 2019-10-10 16:29:40 -0700 | [diff] [blame] | 269 | $(addprefix plat_,$(addsuffix .cil,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS))) \ |
Jeff Vander Stoep | 564e292 | 2019-05-02 13:48:44 -0700 | [diff] [blame] | 270 | $(addsuffix .compat.cil,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS)) \ |
Dan Cashman | 4f9a648 | 2017-04-10 12:27:18 -0700 | [diff] [blame] | 271 | plat_sepolicy.cil \ |
Tri Vo | 1824e25 | 2019-01-22 18:07:58 -0800 | [diff] [blame] | 272 | plat_sepolicy_and_mapping.sha256 \ |
Dan Cashman | 4f9a648 | 2017-04-10 12:27:18 -0700 | [diff] [blame] | 273 | secilc \ |
Dan Cashman | 91d398d | 2017-09-26 12:58:29 -0700 | [diff] [blame] | 274 | |
Jeff Vander Stoep | 7a68c5a | 2017-06-08 13:24:15 -0700 | [diff] [blame] | 275 | LOCAL_REQUIRED_MODULES += \ |
Bowgo Tsai | 741a70a | 2018-02-05 17:41:02 +0800 | [diff] [blame] | 276 | build_sepolicy \ |
Jeff Vander Stoep | 13fb5ed | 2017-08-22 13:29:53 -0700 | [diff] [blame] | 277 | plat_file_contexts \ |
Inseob Kim | b554e59 | 2019-04-15 20:10:46 +0900 | [diff] [blame] | 278 | plat_file_contexts_test \ |
Jeff Vander Stoep | 13fb5ed | 2017-08-22 13:29:53 -0700 | [diff] [blame] | 279 | plat_mac_permissions.xml \ |
| 280 | plat_property_contexts \ |
Inseob Kim | b554e59 | 2019-04-15 20:10:46 +0900 | [diff] [blame] | 281 | plat_property_contexts_test \ |
Jeff Vander Stoep | 13fb5ed | 2017-08-22 13:29:53 -0700 | [diff] [blame] | 282 | plat_seapp_contexts \ |
| 283 | plat_service_contexts \ |
Inseob Kim | b554e59 | 2019-04-15 20:10:46 +0900 | [diff] [blame] | 284 | plat_service_contexts_test \ |
Jeff Vander Stoep | 13fb5ed | 2017-08-22 13:29:53 -0700 | [diff] [blame] | 285 | plat_hwservice_contexts \ |
Inseob Kim | b554e59 | 2019-04-15 20:10:46 +0900 | [diff] [blame] | 286 | plat_hwservice_contexts_test \ |
Dan Cashman | 91d398d | 2017-09-26 12:58:29 -0700 | [diff] [blame] | 287 | searchpolicy \ |
Anton Hansson | 8cfe1e6 | 2018-07-02 14:31:29 +0100 | [diff] [blame] | 288 | |
| 289 | # This conditional inclusion closely mimics the conditional logic |
| 290 | # inside init/init.cpp for loading SELinux policy from files. |
| 291 | ifneq ($(PRODUCT_SEPOLICY_SPLIT),true) |
| 292 | # The following files are only allowed for non-Treble devices. |
| 293 | LOCAL_REQUIRED_MODULES += \ |
| 294 | sepolicy \ |
| 295 | vendor_service_contexts \ |
| 296 | |
| 297 | endif # ($(PRODUCT_SEPOLICY_SPLIT),true) |
Jeff Vander Stoep | 7a68c5a | 2017-06-08 13:24:15 -0700 | [diff] [blame] | 298 | |
Dan Cashman | 91d398d | 2017-09-26 12:58:29 -0700 | [diff] [blame] | 299 | ifneq ($(with_asan),true) |
Jeff Vander Stoep | 3d4965b | 2018-02-13 20:29:55 -0800 | [diff] [blame] | 300 | ifneq ($(SELINUX_IGNORE_NEVERALLOWS),true) |
Dan Cashman | 91d398d | 2017-09-26 12:58:29 -0700 | [diff] [blame] | 301 | LOCAL_REQUIRED_MODULES += \ |
| 302 | sepolicy_tests \ |
Jeff Vander Stoep | 564e292 | 2019-05-02 13:48:44 -0700 | [diff] [blame] | 303 | $(addsuffix _compat_test,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS)) \ |
Dan Cashman | 91d398d | 2017-09-26 12:58:29 -0700 | [diff] [blame] | 304 | |
Steven Moreland | 1cb64c4 | 2019-09-20 11:16:29 -0700 | [diff] [blame] | 305 | ifeq ($(PRODUCT_SEPOLICY_SPLIT),true) |
| 306 | LOCAL_REQUIRED_MODULES += \ |
| 307 | $(addprefix treble_sepolicy_tests_,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS)) \ |
| 308 | |
| 309 | endif # PRODUCT_SEPOLICY_SPLIT |
| 310 | endif # SELINUX_IGNORE_NEVERALLOWS |
| 311 | endif # with_asan |
Dan Cashman | 91d398d | 2017-09-26 12:58:29 -0700 | [diff] [blame] | 312 | |
Anton Hansson | 8cfe1e6 | 2018-07-02 14:31:29 +0100 | [diff] [blame] | 313 | ifneq ($(PLATFORM_SEPOLICY_VERSION),$(TOT_SEPOLICY_VERSION)) |
| 314 | LOCAL_REQUIRED_MODULES += \ |
| 315 | sepolicy_freeze_test \ |
| 316 | |
Yiming Jing | 43e188a | 2020-10-14 20:37:13 +0000 | [diff] [blame] | 317 | else |
| 318 | ifneq (,$(FREEZE_TEST_EXTRA_DIRS)$(FREEZE_TEST_EXTRA_PREBUILT_DIRS)) |
| 319 | $(error SEPOLICY_FREEZE_TEST_EXTRA_DIRS or SEPOLICY_FREEZE_TEST_EXTRA_PREBUILT_DIRS\ |
| 320 | cannot be set before system/sepolicy freezes.) |
| 321 | endif # (,$(FREEZE_TEST_EXTRA_DIRS)$(FREEZE_TEST_EXTRA_PREBUILT_DIRS)) |
Anton Hansson | 8cfe1e6 | 2018-07-02 14:31:29 +0100 | [diff] [blame] | 322 | endif # ($(PLATFORM_SEPOLICY_VERSION),$(TOT_SEPOLICY_VERSION)) |
| 323 | |
| 324 | include $(BUILD_PHONY_PACKAGE) |
| 325 | |
| 326 | ################################# |
| 327 | |
| 328 | include $(CLEAR_VARS) |
| 329 | |
| 330 | LOCAL_MODULE := selinux_policy_nonsystem |
| 331 | # Include precompiled policy, unless told otherwise. |
| 332 | ifneq ($(PRODUCT_PRECOMPILED_SEPOLICY),false) |
| 333 | LOCAL_REQUIRED_MODULES += \ |
| 334 | precompiled_sepolicy \ |
Tri Vo | 1824e25 | 2019-01-22 18:07:58 -0800 | [diff] [blame] | 335 | precompiled_sepolicy.plat_sepolicy_and_mapping.sha256 \ |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 336 | precompiled_sepolicy.system_ext_sepolicy_and_mapping.sha256 \ |
| 337 | system_ext_sepolicy_and_mapping.sha256 \ |
Tri Vo | 1824e25 | 2019-01-22 18:07:58 -0800 | [diff] [blame] | 338 | precompiled_sepolicy.product_sepolicy_and_mapping.sha256 \ |
Tri Vo | 24a5587 | 2019-02-07 10:47:15 -0800 | [diff] [blame] | 339 | product_sepolicy_and_mapping.sha256 \ |
Anton Hansson | 8cfe1e6 | 2018-07-02 14:31:29 +0100 | [diff] [blame] | 340 | |
| 341 | endif # ($(PRODUCT_PRECOMPILED_SEPOLICY),false) |
| 342 | |
| 343 | |
| 344 | # These build targets are not used on non-Treble devices. However, we build these to avoid |
| 345 | # divergence between Treble and non-Treble devices. |
| 346 | LOCAL_REQUIRED_MODULES += \ |
| 347 | plat_pub_versioned.cil \ |
| 348 | vendor_sepolicy.cil \ |
| 349 | plat_sepolicy_vers.txt \ |
| 350 | |
| 351 | LOCAL_REQUIRED_MODULES += \ |
| 352 | vendor_file_contexts \ |
Inseob Kim | b554e59 | 2019-04-15 20:10:46 +0900 | [diff] [blame] | 353 | vendor_file_contexts_test \ |
Anton Hansson | 8cfe1e6 | 2018-07-02 14:31:29 +0100 | [diff] [blame] | 354 | vendor_mac_permissions.xml \ |
| 355 | vendor_property_contexts \ |
Inseob Kim | b554e59 | 2019-04-15 20:10:46 +0900 | [diff] [blame] | 356 | vendor_property_contexts_test \ |
Anton Hansson | 8cfe1e6 | 2018-07-02 14:31:29 +0100 | [diff] [blame] | 357 | vendor_seapp_contexts \ |
linpeter | e0fed1f | 2020-06-12 16:25:41 +0800 | [diff] [blame] | 358 | vendor_service_contexts \ |
Anton Hansson | 8cfe1e6 | 2018-07-02 14:31:29 +0100 | [diff] [blame] | 359 | vendor_hwservice_contexts \ |
Inseob Kim | b554e59 | 2019-04-15 20:10:46 +0900 | [diff] [blame] | 360 | vendor_hwservice_contexts_test \ |
Anton Hansson | 8cfe1e6 | 2018-07-02 14:31:29 +0100 | [diff] [blame] | 361 | vndservice_contexts \ |
| 362 | |
Bowgo Tsai | 45457e3 | 2017-11-27 11:41:33 +0800 | [diff] [blame] | 363 | ifdef BOARD_ODM_SEPOLICY_DIRS |
Bowgo Tsai | bae1517 | 2017-11-29 16:14:53 +0800 | [diff] [blame] | 364 | LOCAL_REQUIRED_MODULES += \ |
| 365 | odm_sepolicy.cil \ |
Bowgo Tsai | ecf656b | 2017-11-29 16:15:28 +0800 | [diff] [blame] | 366 | odm_file_contexts \ |
Inseob Kim | b554e59 | 2019-04-15 20:10:46 +0900 | [diff] [blame] | 367 | odm_file_contexts_test \ |
Bowgo Tsai | 1f717b1 | 2017-11-29 16:15:55 +0800 | [diff] [blame] | 368 | odm_seapp_contexts \ |
Bowgo Tsai | ad6231f | 2017-11-29 16:16:26 +0800 | [diff] [blame] | 369 | odm_property_contexts \ |
Inseob Kim | b554e59 | 2019-04-15 20:10:46 +0900 | [diff] [blame] | 370 | odm_property_contexts_test \ |
Bowgo Tsai | af7d85f | 2017-11-29 16:06:15 +0800 | [diff] [blame] | 371 | odm_hwservice_contexts \ |
Inseob Kim | b554e59 | 2019-04-15 20:10:46 +0900 | [diff] [blame] | 372 | odm_hwservice_contexts_test \ |
Bowgo Tsai | af7d85f | 2017-11-29 16:06:15 +0800 | [diff] [blame] | 373 | odm_mac_permissions.xml |
Bowgo Tsai | 45457e3 | 2017-11-27 11:41:33 +0800 | [diff] [blame] | 374 | endif |
Tri Vo | 75887dd | 2018-12-14 14:30:56 -0800 | [diff] [blame] | 375 | |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 376 | ifdef HAS_SYSTEM_EXT_SEPOLICY |
Bowgo Tsai | ac38125 | 2019-10-04 14:34:18 +0800 | [diff] [blame] | 377 | LOCAL_REQUIRED_MODULES += system_ext_sepolicy.cil |
| 378 | endif |
| 379 | |
| 380 | ifdef HAS_SYSTEM_EXT_PUBLIC_SEPOLICY |
Tri Vo | 6117855 | 2019-10-10 16:29:40 -0700 | [diff] [blame] | 381 | LOCAL_REQUIRED_MODULES += \ |
| 382 | system_ext_mapping_file \ |
| 383 | $(addprefix system_ext_,$(addsuffix .cil,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS))) \ |
| 384 | |
Bowgo Tsai | ac38125 | 2019-10-04 14:34:18 +0800 | [diff] [blame] | 385 | endif |
| 386 | |
| 387 | ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 388 | LOCAL_REQUIRED_MODULES += \ |
Bowgo Tsai | 86a048d | 2019-09-09 22:04:06 +0800 | [diff] [blame] | 389 | system_ext_file_contexts \ |
| 390 | system_ext_file_contexts_test \ |
Bowgo Tsai | 241d36e | 2019-09-09 22:05:10 +0800 | [diff] [blame] | 391 | system_ext_hwservice_contexts \ |
| 392 | system_ext_hwservice_contexts_test \ |
Bowgo Tsai | 1864cd0 | 2019-09-09 18:09:22 +0800 | [diff] [blame] | 393 | system_ext_property_contexts \ |
| 394 | system_ext_property_contexts_test \ |
Bowgo Tsai | 7bc47f4 | 2019-09-09 22:04:30 +0800 | [diff] [blame] | 395 | system_ext_seapp_contexts \ |
Bowgo Tsai | 9823116 | 2019-09-09 22:05:29 +0800 | [diff] [blame] | 396 | system_ext_service_contexts \ |
| 397 | system_ext_service_contexts_test \ |
Bowgo Tsai | a3429fc | 2019-09-09 22:05:49 +0800 | [diff] [blame] | 398 | system_ext_mac_permissions.xml \ |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 399 | |
| 400 | endif |
| 401 | |
Tri Vo | 75887dd | 2018-12-14 14:30:56 -0800 | [diff] [blame] | 402 | ifdef HAS_PRODUCT_SEPOLICY |
Bowgo Tsai | 7c4150c | 2019-10-04 15:36:05 +0800 | [diff] [blame] | 403 | LOCAL_REQUIRED_MODULES += product_sepolicy.cil |
| 404 | endif |
| 405 | |
| 406 | ifdef HAS_PRODUCT_PUBLIC_SEPOLICY |
Tri Vo | 6117855 | 2019-10-10 16:29:40 -0700 | [diff] [blame] | 407 | LOCAL_REQUIRED_MODULES += \ |
| 408 | product_mapping_file \ |
| 409 | $(addprefix product_,$(addsuffix .cil,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS))) \ |
| 410 | |
Bowgo Tsai | 7c4150c | 2019-10-04 15:36:05 +0800 | [diff] [blame] | 411 | endif |
| 412 | |
| 413 | ifdef HAS_PRODUCT_SEPOLICY_DIR |
Tri Vo | 75887dd | 2018-12-14 14:30:56 -0800 | [diff] [blame] | 414 | LOCAL_REQUIRED_MODULES += \ |
Tri Vo | 3361ec4 | 2018-12-18 19:51:19 -0800 | [diff] [blame] | 415 | product_file_contexts \ |
Inseob Kim | b554e59 | 2019-04-15 20:10:46 +0900 | [diff] [blame] | 416 | product_file_contexts_test \ |
Tri Vo | ade7416 | 2018-12-20 16:13:10 -0800 | [diff] [blame] | 417 | product_hwservice_contexts \ |
Inseob Kim | b554e59 | 2019-04-15 20:10:46 +0900 | [diff] [blame] | 418 | product_hwservice_contexts_test \ |
Tri Vo | 5da7200 | 2018-12-20 19:31:42 -0800 | [diff] [blame] | 419 | product_property_contexts \ |
Inseob Kim | b554e59 | 2019-04-15 20:10:46 +0900 | [diff] [blame] | 420 | product_property_contexts_test \ |
Tri Vo | 3507678 | 2018-12-21 10:46:45 -0800 | [diff] [blame] | 421 | product_seapp_contexts \ |
Tri Vo | 6ac0896 | 2018-12-21 12:28:14 -0800 | [diff] [blame] | 422 | product_service_contexts \ |
Inseob Kim | b554e59 | 2019-04-15 20:10:46 +0900 | [diff] [blame] | 423 | product_service_contexts_test \ |
Tri Vo | 35650d5 | 2018-12-21 16:07:21 -0800 | [diff] [blame] | 424 | product_mac_permissions.xml \ |
Tri Vo | 75887dd | 2018-12-14 14:30:56 -0800 | [diff] [blame] | 425 | |
| 426 | endif |
Tri Vo | 4eb6815 | 2019-01-23 09:47:05 -0800 | [diff] [blame] | 427 | |
Tri Vo | 4eb6815 | 2019-01-23 09:47:05 -0800 | [diff] [blame] | 428 | LOCAL_REQUIRED_MODULES += \ |
| 429 | selinux_denial_metadata \ |
| 430 | |
Bowgo Tsai | e763667 | 2019-04-19 22:03:33 +0800 | [diff] [blame] | 431 | # Builds an addtional userdebug sepolicy into the debug ramdisk. |
| 432 | LOCAL_REQUIRED_MODULES += \ |
| 433 | userdebug_plat_sepolicy.cil \ |
| 434 | |
Dan Cashman | 4f9a648 | 2017-04-10 12:27:18 -0700 | [diff] [blame] | 435 | include $(BUILD_PHONY_PACKAGE) |
| 436 | |
Joel Galenson | 5988b56 | 2018-01-03 16:53:24 -0800 | [diff] [blame] | 437 | ################################# |
| 438 | include $(CLEAR_VARS) |
| 439 | |
| 440 | LOCAL_MODULE := sepolicy_neverallows |
Jooyung Han | 749cf93 | 2019-05-30 01:05:43 +0900 | [diff] [blame] | 441 | LOCAL_MODULE_CLASS := FAKE |
Joel Galenson | 5988b56 | 2018-01-03 16:53:24 -0800 | [diff] [blame] | 442 | LOCAL_MODULE_TAGS := optional |
Joel Galenson | 5988b56 | 2018-01-03 16:53:24 -0800 | [diff] [blame] | 443 | |
| 444 | include $(BUILD_SYSTEM)/base_rules.mk |
| 445 | |
| 446 | # sepolicy_policy.conf - All of the policy for the device. This is only used to |
| 447 | # check neverallow rules. |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 448 | policy_files := $(call build_policy, $(sepolicy_build_files), \ |
| 449 | $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) $(PLAT_VENDOR_POLICY) \ |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 450 | $(SYSTEM_EXT_PUBLIC_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY) \ |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 451 | $(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY) \ |
| 452 | $(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_ODM_SEPOLICY_DIRS)) |
Joel Galenson | 5988b56 | 2018-01-03 16:53:24 -0800 | [diff] [blame] | 453 | sepolicy_policy.conf := $(intermediates)/policy.conf |
| 454 | $(sepolicy_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS) |
| 455 | $(sepolicy_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS) |
Joel Galenson | 8c72eea | 2018-03-07 15:36:29 -0800 | [diff] [blame] | 456 | $(sepolicy_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := user |
Joel Galenson | 5988b56 | 2018-01-03 16:53:24 -0800 | [diff] [blame] | 457 | $(sepolicy_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch) |
| 458 | $(sepolicy_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) |
Pirama Arumuga Nainar | ce9c0c5 | 2019-06-13 15:05:15 -0700 | [diff] [blame] | 459 | $(sepolicy_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage) |
Joel Galenson | 5988b56 | 2018-01-03 16:53:24 -0800 | [diff] [blame] | 460 | $(sepolicy_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) |
| 461 | $(sepolicy_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT) |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 462 | $(sepolicy_policy.conf): PRIVATE_POLICY_FILES := $(policy_files) |
| 463 | $(sepolicy_policy.conf): $(policy_files) $(M4) |
Joel Galenson | 5988b56 | 2018-01-03 16:53:24 -0800 | [diff] [blame] | 464 | $(transform-policy-to-conf) |
huangyanjun | 2509572 | 2018-09-13 14:04:19 +0800 | [diff] [blame] | 465 | $(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit |
Joel Galenson | 5988b56 | 2018-01-03 16:53:24 -0800 | [diff] [blame] | 466 | |
Nick Kralevich | 94c8893 | 2018-11-27 13:45:47 -0800 | [diff] [blame] | 467 | # sepolicy_policy_2.conf - All of the policy for the device. This is only used to |
| 468 | # check neverallow rules using sepolicy-analyze, similar to CTS. |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 469 | policy_files := $(call build_policy, $(sepolicy_build_files), \ |
| 470 | $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) $(PLAT_VENDOR_POLICY) \ |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 471 | $(SYSTEM_EXT_PUBLIC_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY) \ |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 472 | $(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY) \ |
| 473 | $(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_ODM_SEPOLICY_DIRS)) |
Nick Kralevich | 94c8893 | 2018-11-27 13:45:47 -0800 | [diff] [blame] | 474 | sepolicy_policy_2.conf := $(intermediates)/policy_2.conf |
| 475 | $(sepolicy_policy_2.conf): PRIVATE_MLS_SENS := $(MLS_SENS) |
| 476 | $(sepolicy_policy_2.conf): PRIVATE_MLS_CATS := $(MLS_CATS) |
| 477 | $(sepolicy_policy_2.conf): PRIVATE_TARGET_BUILD_VARIANT := user |
| 478 | $(sepolicy_policy_2.conf): PRIVATE_EXCLUDE_BUILD_TEST := true |
| 479 | $(sepolicy_policy_2.conf): PRIVATE_TGT_ARCH := $(my_target_arch) |
| 480 | $(sepolicy_policy_2.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) |
Pirama Arumuga Nainar | ce9c0c5 | 2019-06-13 15:05:15 -0700 | [diff] [blame] | 481 | $(sepolicy_policy_2.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage) |
Nick Kralevich | 94c8893 | 2018-11-27 13:45:47 -0800 | [diff] [blame] | 482 | $(sepolicy_policy_2.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) |
| 483 | $(sepolicy_policy_2.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT) |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 484 | $(sepolicy_policy_2.conf): PRIVATE_POLICY_FILES := $(policy_files) |
| 485 | $(sepolicy_policy_2.conf): $(policy_files) $(M4) |
Nick Kralevich | 94c8893 | 2018-11-27 13:45:47 -0800 | [diff] [blame] | 486 | $(transform-policy-to-conf) |
| 487 | $(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit |
| 488 | |
| 489 | $(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY_1 := $(sepolicy_policy.conf) |
| 490 | $(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY_2 := $(sepolicy_policy_2.conf) |
| 491 | $(LOCAL_BUILT_MODULE): $(sepolicy_policy.conf) $(sepolicy_policy_2.conf) \ |
| 492 | $(HOST_OUT_EXECUTABLES)/checkpolicy $(HOST_OUT_EXECUTABLES)/sepolicy-analyze |
Joel Galenson | 5988b56 | 2018-01-03 16:53:24 -0800 | [diff] [blame] | 493 | ifneq ($(SELINUX_IGNORE_NEVERALLOWS),true) |
| 494 | $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c \ |
Nick Kralevich | 94c8893 | 2018-11-27 13:45:47 -0800 | [diff] [blame] | 495 | $(POLICYVERS) -o $@.tmp $(PRIVATE_SEPOLICY_1) |
| 496 | $(hide) $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $@.tmp neverallow -w -f $(PRIVATE_SEPOLICY_2) || \ |
| 497 | ( echo "" 1>&2; \ |
| 498 | echo "sepolicy-analyze failed. This is most likely due to the use" 1>&2; \ |
| 499 | echo "of an expanded attribute in a neverallow assertion. Please fix" 1>&2; \ |
| 500 | echo "the policy." 1>&2; \ |
| 501 | exit 1 ) |
Joel Galenson | 5988b56 | 2018-01-03 16:53:24 -0800 | [diff] [blame] | 502 | endif # ($(SELINUX_IGNORE_NEVERALLOWS),true) |
Nick Kralevich | 94c8893 | 2018-11-27 13:45:47 -0800 | [diff] [blame] | 503 | $(hide) touch $@.tmp |
| 504 | $(hide) mv $@.tmp $@ |
Joel Galenson | 5988b56 | 2018-01-03 16:53:24 -0800 | [diff] [blame] | 505 | |
| 506 | sepolicy_policy.conf := |
Nick Kralevich | 94c8893 | 2018-11-27 13:45:47 -0800 | [diff] [blame] | 507 | sepolicy_policy_2.conf := |
Joel Galenson | 5988b56 | 2018-01-03 16:53:24 -0800 | [diff] [blame] | 508 | built_sepolicy_neverallows := $(LOCAL_BUILT_MODULE) |
| 509 | |
Ying Wang | 02fb5f3 | 2012-01-17 17:51:09 -0800 | [diff] [blame] | 510 | ################################## |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 511 | # reqd_policy_mask - a policy.conf file which contains only the bare minimum |
| 512 | # policy necessary to use checkpolicy. This bare-minimum policy needs to be |
| 513 | # present in all policy.conf files, but should not necessarily be exported as |
| 514 | # part of the public policy. The rules generated by reqd_policy_mask will allow |
| 515 | # the compilation of public policy and subsequent removal of CIL policy that |
| 516 | # should not be exported. |
| 517 | |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 518 | policy_files := $(call build_policy, $(sepolicy_build_files), $(REQD_MASK_POLICY)) |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 519 | reqd_policy_mask.conf := $(intermediates)/reqd_policy_mask.conf |
| 520 | $(reqd_policy_mask.conf): PRIVATE_MLS_SENS := $(MLS_SENS) |
| 521 | $(reqd_policy_mask.conf): PRIVATE_MLS_CATS := $(MLS_CATS) |
Joel Galenson | 8c72eea | 2018-03-07 15:36:29 -0800 | [diff] [blame] | 522 | $(reqd_policy_mask.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT) |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 523 | $(reqd_policy_mask.conf): PRIVATE_TGT_ARCH := $(my_target_arch) |
Jeff Vander Stoep | 7443484 | 2017-03-13 12:22:15 -0700 | [diff] [blame] | 524 | $(reqd_policy_mask.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) |
Pirama Arumuga Nainar | ce9c0c5 | 2019-06-13 15:05:15 -0700 | [diff] [blame] | 525 | $(reqd_policy_mask.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage) |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 526 | $(reqd_policy_mask.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) |
Steven Moreland | 763697d | 2017-11-09 11:24:56 -0800 | [diff] [blame] | 527 | $(reqd_policy_mask.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT) |
Jaekyun Seok | e497145 | 2017-10-19 16:54:49 +0900 | [diff] [blame] | 528 | $(reqd_policy_mask.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY) |
Inseob Kim | ed59c22 | 2019-09-26 15:14:55 +0900 | [diff] [blame] | 529 | $(reqd_policy_mask.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow) |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 530 | $(reqd_policy_mask.conf): PRIVATE_POLICY_FILES := $(policy_files) |
| 531 | $(reqd_policy_mask.conf): $(policy_files) $(M4) |
Dan Cashman | 36ee91d | 2017-07-07 14:59:51 -0700 | [diff] [blame] | 532 | $(transform-policy-to-conf) |
Andreas Gampe | 3ddc78b | 2017-04-27 17:16:13 -0700 | [diff] [blame] | 533 | # b/37755687 |
| 534 | CHECKPOLICY_ASAN_OPTIONS := ASAN_OPTIONS=detect_leaks=0 |
| 535 | |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 536 | reqd_policy_mask.cil := $(intermediates)/reqd_policy_mask.cil |
| 537 | $(reqd_policy_mask.cil): $(reqd_policy_mask.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy |
| 538 | @mkdir -p $(dir $@) |
Andreas Gampe | 3ddc78b | 2017-04-27 17:16:13 -0700 | [diff] [blame] | 539 | $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -C -M -c \ |
| 540 | $(POLICYVERS) -o $@ $< |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 541 | |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 542 | reqd_policy_mask.conf := |
| 543 | |
| 544 | ################################## |
Tri Vo | e68ba59 | 2019-01-15 13:31:03 -0800 | [diff] [blame] | 545 | # pub_policy - policy that will be exported to be a part of non-platform |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 546 | # policy corresponding to this platform version. This is a limited subset of |
| 547 | # policy that would not compile in checkpolicy on its own. To get around this |
| 548 | # limitation, add only the required files from private policy, which will |
| 549 | # generate CIL policy that will then be filtered out by the reqd_policy_mask. |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 550 | # |
| 551 | # There are three pub_policy.cil files below: |
| 552 | # - pub_policy.cil: exported 'product', 'system_ext' and 'system' policy. |
| 553 | # - system_ext_pub_policy.cil: exported 'system_ext' and 'system' policy. |
| 554 | # - plat_pub_policy.cil: exported 'system' policy. |
| 555 | # |
| 556 | # Those above files will in turn be used to generate the following versioned cil files: |
| 557 | # - product_mapping_file: the versioned, exported 'product' policy in product partition. |
| 558 | # - system_ext_mapping_file: the versioned, exported 'system_ext' policy in system_ext partition. |
| 559 | # - plat_mapping_file: the versioned, exported 'system' policy in system partition. |
| 560 | # - plat_pub_versioned.cil: the versioned, exported 'product', 'system_ext' and 'system' |
| 561 | # policy in vendor partition. |
| 562 | # |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 563 | policy_files := $(call build_policy, $(sepolicy_build_files), \ |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 564 | $(PLAT_PUBLIC_POLICY) $(SYSTEM_EXT_PUBLIC_POLICY) $(PRODUCT_PUBLIC_POLICY) $(REQD_MASK_POLICY)) |
Tri Vo | e68ba59 | 2019-01-15 13:31:03 -0800 | [diff] [blame] | 565 | pub_policy.conf := $(intermediates)/pub_policy.conf |
| 566 | $(pub_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS) |
| 567 | $(pub_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS) |
| 568 | $(pub_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT) |
| 569 | $(pub_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch) |
| 570 | $(pub_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) |
Pirama Arumuga Nainar | ce9c0c5 | 2019-06-13 15:05:15 -0700 | [diff] [blame] | 571 | $(pub_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage) |
Tri Vo | e68ba59 | 2019-01-15 13:31:03 -0800 | [diff] [blame] | 572 | $(pub_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) |
| 573 | $(pub_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT) |
| 574 | $(pub_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY) |
Inseob Kim | ed59c22 | 2019-09-26 15:14:55 +0900 | [diff] [blame] | 575 | $(pub_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow) |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 576 | $(pub_policy.conf): PRIVATE_POLICY_FILES := $(policy_files) |
| 577 | $(pub_policy.conf): $(policy_files) $(M4) |
Dan Cashman | 36ee91d | 2017-07-07 14:59:51 -0700 | [diff] [blame] | 578 | $(transform-policy-to-conf) |
Tri Vo | e68ba59 | 2019-01-15 13:31:03 -0800 | [diff] [blame] | 579 | pub_policy.cil := $(intermediates)/pub_policy.cil |
| 580 | $(pub_policy.cil): PRIVATE_POL_CONF := $(pub_policy.conf) |
| 581 | $(pub_policy.cil): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil) |
| 582 | $(pub_policy.cil): $(HOST_OUT_EXECUTABLES)/checkpolicy \ |
| 583 | $(HOST_OUT_EXECUTABLES)/build_sepolicy $(pub_policy.conf) $(reqd_policy_mask.cil) |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 584 | @mkdir -p $(dir $@) |
Tri Vo | d57789f | 2018-12-17 16:35:41 -0800 | [diff] [blame] | 585 | $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $< -C -M -c $(POLICYVERS) -o $@ $(PRIVATE_POL_CONF) |
| 586 | $(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) filter_out \ |
| 587 | -f $(PRIVATE_REQD_MASK) -t $@ |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 588 | |
Tri Vo | e68ba59 | 2019-01-15 13:31:03 -0800 | [diff] [blame] | 589 | pub_policy.conf := |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 590 | |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 591 | ################################## |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 592 | policy_files := $(call build_policy, $(sepolicy_build_files), \ |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 593 | $(PLAT_PUBLIC_POLICY) $(SYSTEM_EXT_PUBLIC_POLICY) $(REQD_MASK_POLICY)) |
| 594 | system_ext_pub_policy.conf := $(intermediates)/system_ext_pub_policy.conf |
| 595 | $(system_ext_pub_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS) |
| 596 | $(system_ext_pub_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS) |
| 597 | $(system_ext_pub_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT) |
| 598 | $(system_ext_pub_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch) |
| 599 | $(system_ext_pub_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) |
| 600 | $(system_ext_pub_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage) |
| 601 | $(system_ext_pub_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) |
| 602 | $(system_ext_pub_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT) |
| 603 | $(system_ext_pub_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY) |
Inseob Kim | e2ef86f | 2019-10-16 11:46:50 +0900 | [diff] [blame] | 604 | $(system_ext_pub_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow) |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 605 | $(system_ext_pub_policy.conf): PRIVATE_POLICY_FILES := $(policy_files) |
| 606 | $(system_ext_pub_policy.conf): $(policy_files) $(M4) |
| 607 | $(transform-policy-to-conf) |
| 608 | |
| 609 | system_ext_pub_policy.cil := $(intermediates)/system_ext_pub_policy.cil |
| 610 | $(system_ext_pub_policy.cil): PRIVATE_POL_CONF := $(system_ext_pub_policy.conf) |
| 611 | $(system_ext_pub_policy.cil): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil) |
| 612 | $(system_ext_pub_policy.cil): $(HOST_OUT_EXECUTABLES)/checkpolicy \ |
| 613 | $(HOST_OUT_EXECUTABLES)/build_sepolicy $(system_ext_pub_policy.conf) $(reqd_policy_mask.cil) |
| 614 | @mkdir -p $(dir $@) |
| 615 | $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $< -C -M -c $(POLICYVERS) -o $@ $(PRIVATE_POL_CONF) |
| 616 | $(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) filter_out \ |
| 617 | -f $(PRIVATE_REQD_MASK) -t $@ |
| 618 | |
| 619 | system_ext_pub_policy.conf := |
| 620 | |
| 621 | ################################## |
| 622 | policy_files := $(call build_policy, $(sepolicy_build_files), \ |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 623 | $(PLAT_PUBLIC_POLICY) $(REQD_MASK_POLICY)) |
Tri Vo | 937e664 | 2019-01-15 15:16:55 -0800 | [diff] [blame] | 624 | plat_pub_policy.conf := $(intermediates)/plat_pub_policy.conf |
| 625 | $(plat_pub_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS) |
| 626 | $(plat_pub_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS) |
| 627 | $(plat_pub_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT) |
| 628 | $(plat_pub_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch) |
| 629 | $(plat_pub_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) |
Pirama Arumuga Nainar | ce9c0c5 | 2019-06-13 15:05:15 -0700 | [diff] [blame] | 630 | $(plat_pub_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage) |
Tri Vo | 937e664 | 2019-01-15 15:16:55 -0800 | [diff] [blame] | 631 | $(plat_pub_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) |
| 632 | $(plat_pub_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT) |
| 633 | $(plat_pub_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY) |
Inseob Kim | ed59c22 | 2019-09-26 15:14:55 +0900 | [diff] [blame] | 634 | $(plat_pub_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow) |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 635 | $(plat_pub_policy.conf): PRIVATE_POLICY_FILES := $(policy_files) |
| 636 | $(plat_pub_policy.conf): $(policy_files) $(M4) |
Tri Vo | 937e664 | 2019-01-15 15:16:55 -0800 | [diff] [blame] | 637 | $(transform-policy-to-conf) |
| 638 | |
| 639 | plat_pub_policy.cil := $(intermediates)/plat_pub_policy.cil |
| 640 | $(plat_pub_policy.cil): PRIVATE_POL_CONF := $(plat_pub_policy.conf) |
| 641 | $(plat_pub_policy.cil): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil) |
| 642 | $(plat_pub_policy.cil): $(HOST_OUT_EXECUTABLES)/checkpolicy \ |
| 643 | $(HOST_OUT_EXECUTABLES)/build_sepolicy $(plat_pub_policy.conf) $(reqd_policy_mask.cil) |
| 644 | @mkdir -p $(dir $@) |
| 645 | $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $< -C -M -c $(POLICYVERS) -o $@ $(PRIVATE_POL_CONF) |
| 646 | $(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) filter_out \ |
| 647 | -f $(PRIVATE_REQD_MASK) -t $@ |
| 648 | |
| 649 | plat_pub_policy.conf := |
| 650 | |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 651 | ################################# |
| 652 | include $(CLEAR_VARS) |
| 653 | |
| 654 | LOCAL_MODULE := plat_sepolicy.cil |
| 655 | LOCAL_MODULE_CLASS := ETC |
| 656 | LOCAL_MODULE_TAGS := optional |
Alex Klyubin | 052b0bb | 2017-03-02 12:39:25 -0800 | [diff] [blame] | 657 | LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 658 | |
| 659 | include $(BUILD_SYSTEM)/base_rules.mk |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 660 | |
| 661 | # plat_policy.conf - A combination of the private and public platform policy |
| 662 | # which will ship with the device. The platform will always reflect the most |
| 663 | # recent platform version and is not currently being attributized. |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 664 | policy_files := $(call build_policy, $(sepolicy_build_files), \ |
| 665 | $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY)) |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 666 | plat_policy.conf := $(intermediates)/plat_policy.conf |
| 667 | $(plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS) |
| 668 | $(plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS) |
Joel Galenson | 8c72eea | 2018-03-07 15:36:29 -0800 | [diff] [blame] | 669 | $(plat_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT) |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 670 | $(plat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch) |
Jeff Vander Stoep | 7443484 | 2017-03-13 12:22:15 -0700 | [diff] [blame] | 671 | $(plat_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) |
Pirama Arumuga Nainar | ce9c0c5 | 2019-06-13 15:05:15 -0700 | [diff] [blame] | 672 | $(plat_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage) |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 673 | $(plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) |
Steven Moreland | 763697d | 2017-11-09 11:24:56 -0800 | [diff] [blame] | 674 | $(plat_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT) |
Jaekyun Seok | e497145 | 2017-10-19 16:54:49 +0900 | [diff] [blame] | 675 | $(plat_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY) |
Inseob Kim | ed59c22 | 2019-09-26 15:14:55 +0900 | [diff] [blame] | 676 | $(plat_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow) |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 677 | $(plat_policy.conf): PRIVATE_POLICY_FILES := $(policy_files) |
| 678 | $(plat_policy.conf): $(policy_files) $(M4) |
Dan Cashman | 36ee91d | 2017-07-07 14:59:51 -0700 | [diff] [blame] | 679 | $(transform-policy-to-conf) |
huangyanjun | 2509572 | 2018-09-13 14:04:19 +0800 | [diff] [blame] | 680 | $(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit |
dcashman | cc39f63 | 2016-07-22 13:13:11 -0700 | [diff] [blame] | 681 | |
Jeff Vander Stoep | b878769 | 2017-04-21 15:57:07 -0700 | [diff] [blame] | 682 | $(LOCAL_BUILT_MODULE): PRIVATE_ADDITIONAL_CIL_FILES := \ |
Alex Klyubin | 7cda44f | 2017-03-21 14:28:53 -0700 | [diff] [blame] | 683 | $(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY)) |
Joel Galenson | 5988b56 | 2018-01-03 16:53:24 -0800 | [diff] [blame] | 684 | $(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG) |
Jeff Vander Stoep | b878769 | 2017-04-21 15:57:07 -0700 | [diff] [blame] | 685 | $(LOCAL_BUILT_MODULE): $(plat_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \ |
| 686 | $(HOST_OUT_EXECUTABLES)/secilc \ |
Joel Galenson | 5988b56 | 2018-01-03 16:53:24 -0800 | [diff] [blame] | 687 | $(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY)) \ |
| 688 | $(built_sepolicy_neverallows) |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 689 | @mkdir -p $(dir $@) |
Andreas Gampe | 3ddc78b | 2017-04-27 17:16:13 -0700 | [diff] [blame] | 690 | $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \ |
Nick Kralevich | 6b2a4ae | 2018-11-26 14:29:06 -0800 | [diff] [blame] | 691 | $(POLICYVERS) -o $@.tmp $< |
| 692 | $(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@.tmp |
| 693 | $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $@.tmp -o /dev/null -f /dev/null |
| 694 | $(hide) mv $@.tmp $@ |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 695 | |
Alex Klyubin | 8f7173b | 2017-02-25 14:47:53 -0800 | [diff] [blame] | 696 | built_plat_cil := $(LOCAL_BUILT_MODULE) |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 697 | plat_policy.conf := |
| 698 | |
| 699 | ################################# |
| 700 | include $(CLEAR_VARS) |
| 701 | |
Bowgo Tsai | e763667 | 2019-04-19 22:03:33 +0800 | [diff] [blame] | 702 | LOCAL_MODULE := userdebug_plat_sepolicy.cil |
| 703 | LOCAL_MODULE_CLASS := ETC |
| 704 | LOCAL_MODULE_TAGS := optional |
| 705 | LOCAL_MODULE_PATH := $(TARGET_DEBUG_RAMDISK_OUT) |
| 706 | |
| 707 | include $(BUILD_SYSTEM)/base_rules.mk |
| 708 | |
| 709 | # userdebug_plat_policy.conf - the userdebug version plat_sepolicy.cil |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 710 | policy_files := $(call build_policy, $(sepolicy_build_files), \ |
| 711 | $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY)) |
Bowgo Tsai | e763667 | 2019-04-19 22:03:33 +0800 | [diff] [blame] | 712 | userdebug_plat_policy.conf := $(intermediates)/userdebug_plat_policy.conf |
| 713 | $(userdebug_plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS) |
| 714 | $(userdebug_plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS) |
| 715 | $(userdebug_plat_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := userdebug |
| 716 | $(userdebug_plat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch) |
| 717 | $(userdebug_plat_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) |
Pirama Arumuga Nainar | ce9c0c5 | 2019-06-13 15:05:15 -0700 | [diff] [blame] | 718 | $(userdebug_plat_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage) |
Bowgo Tsai | e763667 | 2019-04-19 22:03:33 +0800 | [diff] [blame] | 719 | $(userdebug_plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) |
| 720 | $(userdebug_plat_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT) |
| 721 | $(userdebug_plat_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY) |
Inseob Kim | ed59c22 | 2019-09-26 15:14:55 +0900 | [diff] [blame] | 722 | $(userdebug_plat_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow) |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 723 | $(userdebug_plat_policy.conf): PRIVATE_POLICY_FILES := $(policy_files) |
| 724 | $(userdebug_plat_policy.conf): $(policy_files) $(M4) |
Bowgo Tsai | e763667 | 2019-04-19 22:03:33 +0800 | [diff] [blame] | 725 | $(transform-policy-to-conf) |
| 726 | $(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit |
| 727 | |
| 728 | $(LOCAL_BUILT_MODULE): PRIVATE_ADDITIONAL_CIL_FILES := \ |
| 729 | $(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY)) |
| 730 | $(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG) |
| 731 | $(LOCAL_BUILT_MODULE): $(userdebug_plat_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \ |
| 732 | $(HOST_OUT_EXECUTABLES)/secilc \ |
| 733 | $(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY)) \ |
| 734 | $(built_sepolicy_neverallows) |
| 735 | @mkdir -p $(dir $@) |
| 736 | $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \ |
| 737 | $(POLICYVERS) -o $@.tmp $< |
| 738 | $(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@.tmp |
| 739 | $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $@.tmp -o /dev/null -f /dev/null |
| 740 | $(hide) mv $@.tmp $@ |
| 741 | |
| 742 | userdebug_plat_policy.conf := |
| 743 | |
| 744 | ################################# |
| 745 | include $(CLEAR_VARS) |
| 746 | |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 747 | ifdef HAS_SYSTEM_EXT_SEPOLICY |
| 748 | LOCAL_MODULE := system_ext_sepolicy.cil |
| 749 | LOCAL_MODULE_CLASS := ETC |
| 750 | LOCAL_MODULE_TAGS := optional |
| 751 | LOCAL_MODULE_PATH := $(TARGET_OUT_SYSTEM_EXT)/etc/selinux |
| 752 | |
| 753 | include $(BUILD_SYSTEM)/base_rules.mk |
| 754 | |
| 755 | # system_ext_policy.conf - A combination of the private and public system_ext policy |
| 756 | # which will ship with the device. System_ext policy is not attributized. |
| 757 | policy_files := $(call build_policy, $(sepolicy_build_files), \ |
| 758 | $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) \ |
| 759 | $(SYSTEM_EXT_PUBLIC_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY)) |
| 760 | system_ext_policy.conf := $(intermediates)/system_ext_policy.conf |
| 761 | $(system_ext_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS) |
| 762 | $(system_ext_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS) |
| 763 | $(system_ext_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT) |
| 764 | $(system_ext_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch) |
| 765 | $(system_ext_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) |
| 766 | $(system_ext_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage) |
| 767 | $(system_ext_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) |
| 768 | $(system_ext_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT) |
| 769 | $(system_ext_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY) |
Inseob Kim | e2ef86f | 2019-10-16 11:46:50 +0900 | [diff] [blame] | 770 | $(system_ext_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow) |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 771 | $(system_ext_policy.conf): PRIVATE_POLICY_FILES := $(policy_files) |
| 772 | $(system_ext_policy.conf): $(policy_files) $(M4) |
| 773 | $(transform-policy-to-conf) |
| 774 | $(hide) sed '/dontaudit/d' $@ > $@.dontaudit |
| 775 | |
| 776 | $(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG) |
| 777 | $(LOCAL_BUILT_MODULE): PRIVATE_PLAT_CIL := $(built_plat_cil) |
| 778 | $(LOCAL_BUILT_MODULE): $(system_ext_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \ |
| 779 | $(HOST_OUT_EXECUTABLES)/build_sepolicy $(HOST_OUT_EXECUTABLES)/secilc $(built_plat_cil) |
| 780 | @mkdir -p $(dir $@) |
| 781 | $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \ |
| 782 | $(POLICYVERS) -o $@ $< |
| 783 | $(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) filter_out \ |
| 784 | -f $(PRIVATE_PLAT_CIL) -t $@ |
| 785 | # Line markers (denoted by ;;) are malformed after above cmd. They are only |
| 786 | # used for debugging, so we remove them. |
| 787 | $(hide) grep -v ';;' $@ > $@.tmp |
| 788 | $(hide) mv $@.tmp $@ |
| 789 | # Combine plat_sepolicy.cil and system_ext_sepolicy.cil to make sure that the |
| 790 | # latter doesn't accidentally depend on vendor/odm policies. |
| 791 | $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) \ |
| 792 | $(PRIVATE_NEVERALLOW_ARG) $(PRIVATE_PLAT_CIL) $@ -o /dev/null -f /dev/null |
| 793 | |
| 794 | |
| 795 | built_system_ext_cil := $(LOCAL_BUILT_MODULE) |
| 796 | system_ext_policy.conf := |
| 797 | endif # ifdef HAS_SYSTEM_EXT_SEPOLICY |
| 798 | |
| 799 | ################################# |
| 800 | include $(CLEAR_VARS) |
| 801 | |
Tri Vo | 75887dd | 2018-12-14 14:30:56 -0800 | [diff] [blame] | 802 | ifdef HAS_PRODUCT_SEPOLICY |
| 803 | LOCAL_MODULE := product_sepolicy.cil |
| 804 | LOCAL_MODULE_CLASS := ETC |
| 805 | LOCAL_MODULE_TAGS := optional |
| 806 | LOCAL_MODULE_PATH := $(TARGET_OUT_PRODUCT)/etc/selinux |
| 807 | |
| 808 | include $(BUILD_SYSTEM)/base_rules.mk |
| 809 | |
| 810 | # product_policy.conf - A combination of the private and public product policy |
| 811 | # which will ship with the device. Product policy is not attributized. |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 812 | policy_files := $(call build_policy, $(sepolicy_build_files), \ |
| 813 | $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) \ |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 814 | $(SYSTEM_EXT_PUBLIC_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY) \ |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 815 | $(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY)) |
Tri Vo | 75887dd | 2018-12-14 14:30:56 -0800 | [diff] [blame] | 816 | product_policy.conf := $(intermediates)/product_policy.conf |
| 817 | $(product_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS) |
| 818 | $(product_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS) |
| 819 | $(product_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT) |
| 820 | $(product_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch) |
| 821 | $(product_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) |
Pirama Arumuga Nainar | ce9c0c5 | 2019-06-13 15:05:15 -0700 | [diff] [blame] | 822 | $(product_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage) |
Tri Vo | 75887dd | 2018-12-14 14:30:56 -0800 | [diff] [blame] | 823 | $(product_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) |
| 824 | $(product_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT) |
| 825 | $(product_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY) |
Inseob Kim | ed59c22 | 2019-09-26 15:14:55 +0900 | [diff] [blame] | 826 | $(product_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow) |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 827 | $(product_policy.conf): PRIVATE_POLICY_FILES := $(policy_files) |
| 828 | $(product_policy.conf): $(policy_files) $(M4) |
Tri Vo | 75887dd | 2018-12-14 14:30:56 -0800 | [diff] [blame] | 829 | $(transform-policy-to-conf) |
| 830 | $(hide) sed '/dontaudit/d' $@ > $@.dontaudit |
| 831 | |
| 832 | $(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG) |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 833 | $(LOCAL_BUILT_MODULE): PRIVATE_PLAT_CIL_FILES := $(built_plat_cil) $(built_system_ext_cil) |
Tri Vo | 75887dd | 2018-12-14 14:30:56 -0800 | [diff] [blame] | 834 | $(LOCAL_BUILT_MODULE): $(product_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \ |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 835 | $(HOST_OUT_EXECUTABLES)/build_sepolicy $(HOST_OUT_EXECUTABLES)/secilc \ |
| 836 | $(built_plat_cil) $(built_system_ext_cil) |
Tri Vo | 75887dd | 2018-12-14 14:30:56 -0800 | [diff] [blame] | 837 | @mkdir -p $(dir $@) |
| 838 | $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \ |
| 839 | $(POLICYVERS) -o $@ $< |
| 840 | $(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) filter_out \ |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 841 | -f $(PRIVATE_PLAT_CIL_FILES) -t $@ |
Tri Vo | 75887dd | 2018-12-14 14:30:56 -0800 | [diff] [blame] | 842 | # Line markers (denoted by ;;) are malformed after above cmd. They are only |
| 843 | # used for debugging, so we remove them. |
Tri Vo | ebf3eac | 2018-12-19 12:22:05 -0800 | [diff] [blame] | 844 | $(hide) grep -v ';;' $@ > $@.tmp |
| 845 | $(hide) mv $@.tmp $@ |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 846 | # Combine plat_sepolicy.cil, system_ext_sepolicy.cil and product_sepolicy.cil to |
| 847 | # make sure that the latter doesn't accidentally depend on vendor/odm policies. |
Tri Vo | 75887dd | 2018-12-14 14:30:56 -0800 | [diff] [blame] | 848 | $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) \ |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 849 | $(PRIVATE_NEVERALLOW_ARG) $(PRIVATE_PLAT_CIL_FILES) $@ -o /dev/null -f /dev/null |
Tri Vo | 75887dd | 2018-12-14 14:30:56 -0800 | [diff] [blame] | 850 | |
| 851 | |
| 852 | built_product_cil := $(LOCAL_BUILT_MODULE) |
| 853 | product_policy.conf := |
| 854 | endif # ifdef HAS_PRODUCT_SEPOLICY |
| 855 | |
| 856 | ################################# |
| 857 | include $(CLEAR_VARS) |
| 858 | |
Dan Cashman | 4f9a648 | 2017-04-10 12:27:18 -0700 | [diff] [blame] | 859 | LOCAL_MODULE := plat_sepolicy_vers.txt |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 860 | LOCAL_MODULE_CLASS := ETC |
| 861 | LOCAL_MODULE_TAGS := optional |
Dan Cashman | 4f9a648 | 2017-04-10 12:27:18 -0700 | [diff] [blame] | 862 | LOCAL_PROPRIETARY_MODULE := true |
| 863 | LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux |
| 864 | |
| 865 | include $(BUILD_SYSTEM)/base_rules.mk |
| 866 | |
| 867 | $(LOCAL_BUILT_MODULE) : PRIVATE_PLAT_SEPOL_VERS := $(BOARD_SEPOLICY_VERS) |
| 868 | $(LOCAL_BUILT_MODULE) : |
| 869 | mkdir -p $(dir $@) |
| 870 | echo $(PRIVATE_PLAT_SEPOL_VERS) > $@ |
| 871 | |
| 872 | ################################# |
| 873 | include $(CLEAR_VARS) |
| 874 | |
Tri Vo | 937e664 | 2019-01-15 15:16:55 -0800 | [diff] [blame] | 875 | LOCAL_MODULE := plat_mapping_file |
| 876 | LOCAL_MODULE_STEM := $(PLATFORM_SEPOLICY_VERSION).cil |
Dan Cashman | 4f9a648 | 2017-04-10 12:27:18 -0700 | [diff] [blame] | 877 | LOCAL_MODULE_CLASS := ETC |
| 878 | LOCAL_MODULE_TAGS := optional |
| 879 | LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux/mapping |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 880 | |
| 881 | include $(BUILD_SYSTEM)/base_rules.mk |
| 882 | |
| 883 | # auto-generate the mapping file for current platform policy, since it needs to |
| 884 | # track platform policy development |
Tri Vo | 8a2b652 | 2019-01-14 17:25:17 -0800 | [diff] [blame] | 885 | $(LOCAL_BUILT_MODULE) : PRIVATE_VERS := $(PLATFORM_SEPOLICY_VERSION) |
Tri Vo | 937e664 | 2019-01-15 15:16:55 -0800 | [diff] [blame] | 886 | $(LOCAL_BUILT_MODULE) : $(plat_pub_policy.cil) $(HOST_OUT_EXECUTABLES)/version_policy |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 887 | @mkdir -p $(dir $@) |
| 888 | $(hide) $(HOST_OUT_EXECUTABLES)/version_policy -b $< -m -n $(PRIVATE_VERS) -o $@ |
| 889 | |
Tri Vo | 937e664 | 2019-01-15 15:16:55 -0800 | [diff] [blame] | 890 | built_plat_mapping_cil := $(LOCAL_BUILT_MODULE) |
| 891 | |
| 892 | ################################# |
| 893 | include $(CLEAR_VARS) |
| 894 | |
Bowgo Tsai | ac38125 | 2019-10-04 14:34:18 +0800 | [diff] [blame] | 895 | ifdef HAS_SYSTEM_EXT_PUBLIC_SEPOLICY |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 896 | LOCAL_MODULE := system_ext_mapping_file |
| 897 | LOCAL_MODULE_STEM := $(PLATFORM_SEPOLICY_VERSION).cil |
| 898 | LOCAL_MODULE_CLASS := ETC |
| 899 | LOCAL_MODULE_TAGS := optional |
| 900 | LOCAL_MODULE_PATH := $(TARGET_OUT_SYSTEM_EXT)/etc/selinux/mapping |
| 901 | |
| 902 | include $(BUILD_SYSTEM)/base_rules.mk |
| 903 | |
| 904 | $(LOCAL_BUILT_MODULE) : PRIVATE_VERS := $(PLATFORM_SEPOLICY_VERSION) |
| 905 | $(LOCAL_BUILT_MODULE) : PRIVATE_PLAT_MAPPING_CIL := $(built_plat_mapping_cil) |
| 906 | $(LOCAL_BUILT_MODULE) : $(system_ext_pub_policy.cil) $(HOST_OUT_EXECUTABLES)/version_policy \ |
| 907 | $(built_plat_mapping_cil) |
| 908 | @mkdir -p $(dir $@) |
| 909 | # Generate system_ext mapping file as mapping file of 'system' (plat) and 'system_ext' |
| 910 | # sepolicy minus plat_mapping_file. |
| 911 | $(hide) $(HOST_OUT_EXECUTABLES)/version_policy -b $< -m -n $(PRIVATE_VERS) -o $@ |
| 912 | $(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) filter_out \ |
| 913 | -f $(PRIVATE_PLAT_MAPPING_CIL) -t $@ |
| 914 | |
| 915 | built_system_ext_mapping_cil := $(LOCAL_BUILT_MODULE) |
Bowgo Tsai | ac38125 | 2019-10-04 14:34:18 +0800 | [diff] [blame] | 916 | endif # ifdef HAS_SYSTEM_EXT_PUBLIC_SEPOLICY |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 917 | |
| 918 | ################################# |
| 919 | include $(CLEAR_VARS) |
| 920 | |
Bowgo Tsai | 7c4150c | 2019-10-04 15:36:05 +0800 | [diff] [blame] | 921 | ifdef HAS_PRODUCT_PUBLIC_SEPOLICY |
Tri Vo | 937e664 | 2019-01-15 15:16:55 -0800 | [diff] [blame] | 922 | LOCAL_MODULE := product_mapping_file |
| 923 | LOCAL_MODULE_STEM := $(PLATFORM_SEPOLICY_VERSION).cil |
| 924 | LOCAL_MODULE_CLASS := ETC |
| 925 | LOCAL_MODULE_TAGS := optional |
| 926 | LOCAL_MODULE_PATH := $(TARGET_OUT_PRODUCT)/etc/selinux/mapping |
| 927 | |
| 928 | include $(BUILD_SYSTEM)/base_rules.mk |
| 929 | |
| 930 | $(LOCAL_BUILT_MODULE) : PRIVATE_VERS := $(PLATFORM_SEPOLICY_VERSION) |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 931 | $(LOCAL_BUILT_MODULE) : PRIVATE_FILTER_CIL_FILES := $(built_plat_mapping_cil) $(built_system_ext_mapping_cil) |
Tri Vo | 937e664 | 2019-01-15 15:16:55 -0800 | [diff] [blame] | 932 | $(LOCAL_BUILT_MODULE) : $(pub_policy.cil) $(HOST_OUT_EXECUTABLES)/version_policy \ |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 933 | $(built_plat_mapping_cil) $(built_system_ext_mapping_cil) |
Tri Vo | 937e664 | 2019-01-15 15:16:55 -0800 | [diff] [blame] | 934 | @mkdir -p $(dir $@) |
| 935 | # Generate product mapping file as mapping file of all public sepolicy minus |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 936 | # plat_mapping_file and system_ext_mapping_file. |
Tri Vo | 937e664 | 2019-01-15 15:16:55 -0800 | [diff] [blame] | 937 | $(hide) $(HOST_OUT_EXECUTABLES)/version_policy -b $< -m -n $(PRIVATE_VERS) -o $@ |
| 938 | $(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) filter_out \ |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 939 | -f $(PRIVATE_FILTER_CIL_FILES) -t $@ |
Tri Vo | 937e664 | 2019-01-15 15:16:55 -0800 | [diff] [blame] | 940 | |
| 941 | built_product_mapping_cil := $(LOCAL_BUILT_MODULE) |
Bowgo Tsai | 7c4150c | 2019-10-04 15:36:05 +0800 | [diff] [blame] | 942 | endif # ifdef HAS_PRODUCT_PUBLIC_SEPOLICY |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 943 | |
| 944 | ################################# |
| 945 | include $(CLEAR_VARS) |
| 946 | |
Bowgo Tsai | afbcf21 | 2018-02-05 17:34:52 +0800 | [diff] [blame] | 947 | # plat_pub_versioned.cil - the exported platform policy associated with the version |
| 948 | # that non-platform policy targets. |
| 949 | LOCAL_MODULE := plat_pub_versioned.cil |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 950 | LOCAL_MODULE_CLASS := ETC |
| 951 | LOCAL_MODULE_TAGS := optional |
Alex Klyubin | 052b0bb | 2017-03-02 12:39:25 -0800 | [diff] [blame] | 952 | LOCAL_PROPRIETARY_MODULE := true |
| 953 | LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 954 | |
| 955 | include $(BUILD_SYSTEM)/base_rules.mk |
| 956 | |
Bowgo Tsai | afbcf21 | 2018-02-05 17:34:52 +0800 | [diff] [blame] | 957 | $(LOCAL_BUILT_MODULE) : PRIVATE_VERS := $(BOARD_SEPOLICY_VERS) |
Tri Vo | e68ba59 | 2019-01-15 13:31:03 -0800 | [diff] [blame] | 958 | $(LOCAL_BUILT_MODULE) : PRIVATE_TGT_POL := $(pub_policy.cil) |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 959 | $(LOCAL_BUILT_MODULE) : PRIVATE_DEP_CIL_FILES := $(built_plat_cil) $(built_system_ext_cil) \ |
| 960 | $(built_product_cil) $(built_plat_mapping_cil) $(built_system_ext_mapping_cil) \ |
| 961 | $(built_product_mapping_cil) |
Tri Vo | e68ba59 | 2019-01-15 13:31:03 -0800 | [diff] [blame] | 962 | $(LOCAL_BUILT_MODULE) : $(pub_policy.cil) $(HOST_OUT_EXECUTABLES)/version_policy \ |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 963 | $(HOST_OUT_EXECUTABLES)/secilc $(built_plat_cil) $(built_system_ext_cil) $(built_product_cil) \ |
| 964 | $(built_plat_mapping_cil) $(built_system_ext_mapping_cil) $(built_product_mapping_cil) |
Bowgo Tsai | afbcf21 | 2018-02-05 17:34:52 +0800 | [diff] [blame] | 965 | @mkdir -p $(dir $@) |
| 966 | $(HOST_OUT_EXECUTABLES)/version_policy -b $< -t $(PRIVATE_TGT_POL) -n $(PRIVATE_VERS) -o $@ |
| 967 | $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -N -c $(POLICYVERS) \ |
| 968 | $(PRIVATE_DEP_CIL_FILES) $@ -o /dev/null -f /dev/null |
| 969 | |
Tri Vo | e68ba59 | 2019-01-15 13:31:03 -0800 | [diff] [blame] | 970 | built_pub_vers_cil := $(LOCAL_BUILT_MODULE) |
Bowgo Tsai | afbcf21 | 2018-02-05 17:34:52 +0800 | [diff] [blame] | 971 | |
| 972 | ################################# |
| 973 | include $(CLEAR_VARS) |
| 974 | |
| 975 | # vendor_policy.cil - the vendor sepolicy. This needs attributization and to be combined |
| 976 | # with the platform-provided policy. It makes use of the reqd_policy_mask files from private |
| 977 | # policy and the platform public policy files in order to use checkpolicy. |
| 978 | LOCAL_MODULE := vendor_sepolicy.cil |
| 979 | LOCAL_MODULE_CLASS := ETC |
| 980 | LOCAL_MODULE_TAGS := optional |
| 981 | LOCAL_PROPRIETARY_MODULE := true |
| 982 | LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux |
| 983 | |
| 984 | include $(BUILD_SYSTEM)/base_rules.mk |
| 985 | |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 986 | policy_files := $(call build_policy, $(sepolicy_build_files), \ |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 987 | $(PLAT_PUBLIC_POLICY) $(SYSTEM_EXT_PUBLIC_POLICY) $(PRODUCT_PUBLIC_POLICY) \ |
| 988 | $(REQD_MASK_POLICY) $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS)) |
Bowgo Tsai | afbcf21 | 2018-02-05 17:34:52 +0800 | [diff] [blame] | 989 | vendor_policy.conf := $(intermediates)/vendor_policy.conf |
| 990 | $(vendor_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS) |
| 991 | $(vendor_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS) |
Joel Galenson | 8c72eea | 2018-03-07 15:36:29 -0800 | [diff] [blame] | 992 | $(vendor_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT) |
Bowgo Tsai | afbcf21 | 2018-02-05 17:34:52 +0800 | [diff] [blame] | 993 | $(vendor_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch) |
| 994 | $(vendor_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) |
Pirama Arumuga Nainar | ce9c0c5 | 2019-06-13 15:05:15 -0700 | [diff] [blame] | 995 | $(vendor_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage) |
Bowgo Tsai | afbcf21 | 2018-02-05 17:34:52 +0800 | [diff] [blame] | 996 | $(vendor_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) |
| 997 | $(vendor_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT) |
| 998 | $(vendor_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY) |
Inseob Kim | ed59c22 | 2019-09-26 15:14:55 +0900 | [diff] [blame] | 999 | $(vendor_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow) |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 1000 | $(vendor_policy.conf): PRIVATE_POLICY_FILES := $(policy_files) |
| 1001 | $(vendor_policy.conf): $(policy_files) $(M4) |
Dan Cashman | 36ee91d | 2017-07-07 14:59:51 -0700 | [diff] [blame] | 1002 | $(transform-policy-to-conf) |
huangyanjun | 2509572 | 2018-09-13 14:04:19 +0800 | [diff] [blame] | 1003 | $(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 1004 | |
Bowgo Tsai | 741a70a | 2018-02-05 17:41:02 +0800 | [diff] [blame] | 1005 | $(LOCAL_BUILT_MODULE): PRIVATE_POL_CONF := $(vendor_policy.conf) |
| 1006 | $(LOCAL_BUILT_MODULE): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil) |
Tri Vo | e68ba59 | 2019-01-15 13:31:03 -0800 | [diff] [blame] | 1007 | $(LOCAL_BUILT_MODULE): PRIVATE_BASE_CIL := $(pub_policy.cil) |
Bowgo Tsai | 741a70a | 2018-02-05 17:41:02 +0800 | [diff] [blame] | 1008 | $(LOCAL_BUILT_MODULE): PRIVATE_VERS := $(BOARD_SEPOLICY_VERS) |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 1009 | $(LOCAL_BUILT_MODULE): PRIVATE_DEP_CIL_FILES := $(built_plat_cil) $(built_system_ext_cil) \ |
| 1010 | $(built_product_cil) $(built_pub_vers_cil) $(built_plat_mapping_cil) \ |
| 1011 | $(built_system_ext_mapping_cil) $(built_product_mapping_cil) |
Tri Vo | e68ba59 | 2019-01-15 13:31:03 -0800 | [diff] [blame] | 1012 | $(LOCAL_BUILT_MODULE): PRIVATE_FILTER_CIL := $(built_pub_vers_cil) |
Bowgo Tsai | 741a70a | 2018-02-05 17:41:02 +0800 | [diff] [blame] | 1013 | $(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/build_sepolicy \ |
Tri Vo | e68ba59 | 2019-01-15 13:31:03 -0800 | [diff] [blame] | 1014 | $(vendor_policy.conf) $(reqd_policy_mask.cil) $(pub_policy.cil) \ |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 1015 | $(built_plat_cil) $(built_system_ext_cil) $(built_product_cil) \ |
| 1016 | $(built_pub_vers_cil) $(built_plat_mapping_cil) $(built_system_ext_mapping_cil) \ |
| 1017 | $(built_product_mapping_cil) |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 1018 | @mkdir -p $(dir $@) |
Bowgo Tsai | 741a70a | 2018-02-05 17:41:02 +0800 | [diff] [blame] | 1019 | $(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) build_cil \ |
| 1020 | -i $(PRIVATE_POL_CONF) -m $(PRIVATE_REQD_MASK) -c $(CHECKPOLICY_ASAN_OPTIONS) \ |
| 1021 | -b $(PRIVATE_BASE_CIL) -d $(PRIVATE_DEP_CIL_FILES) -f $(PRIVATE_FILTER_CIL) \ |
| 1022 | -t $(PRIVATE_VERS) -p $(POLICYVERS) -o $@ |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 1023 | |
Bowgo Tsai | afbcf21 | 2018-02-05 17:34:52 +0800 | [diff] [blame] | 1024 | built_vendor_cil := $(LOCAL_BUILT_MODULE) |
| 1025 | vendor_policy.conf := |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 1026 | |
| 1027 | ################################# |
| 1028 | include $(CLEAR_VARS) |
Alex Klyubin | 193dccd | 2017-03-07 14:05:57 -0800 | [diff] [blame] | 1029 | |
Nick Kralevich | 1b2ea49 | 2018-09-25 11:03:48 -0700 | [diff] [blame] | 1030 | ifdef BOARD_ODM_SEPOLICY_DIRS |
Bowgo Tsai | 45457e3 | 2017-11-27 11:41:33 +0800 | [diff] [blame] | 1031 | # odm_policy.cil - the odm sepolicy. This needs attributization and to be combined |
| 1032 | # with the platform-provided policy. It makes use of the reqd_policy_mask files from private |
| 1033 | # policy and the platform public policy files in order to use checkpolicy. |
| 1034 | LOCAL_MODULE := odm_sepolicy.cil |
| 1035 | LOCAL_MODULE_CLASS := ETC |
| 1036 | LOCAL_MODULE_TAGS := optional |
| 1037 | LOCAL_PROPRIETARY_MODULE := true |
| 1038 | LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux |
| 1039 | |
| 1040 | include $(BUILD_SYSTEM)/base_rules.mk |
| 1041 | |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 1042 | policy_files := $(call build_policy, $(sepolicy_build_files), \ |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 1043 | $(PLAT_PUBLIC_POLICY) $(SYSTEM_EXT_PUBLIC_POLICY) $(PRODUCT_PUBLIC_POLICY) \ |
| 1044 | $(REQD_MASK_POLICY) $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_ODM_SEPOLICY_DIRS)) |
Bowgo Tsai | 45457e3 | 2017-11-27 11:41:33 +0800 | [diff] [blame] | 1045 | odm_policy.conf := $(intermediates)/odm_policy.conf |
| 1046 | $(odm_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS) |
| 1047 | $(odm_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS) |
| 1048 | $(odm_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT) |
| 1049 | $(odm_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch) |
| 1050 | $(odm_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) |
Pirama Arumuga Nainar | ce9c0c5 | 2019-06-13 15:05:15 -0700 | [diff] [blame] | 1051 | $(odm_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage) |
Bowgo Tsai | 45457e3 | 2017-11-27 11:41:33 +0800 | [diff] [blame] | 1052 | $(odm_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) |
| 1053 | $(odm_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT) |
| 1054 | $(odm_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY) |
Inseob Kim | ed59c22 | 2019-09-26 15:14:55 +0900 | [diff] [blame] | 1055 | $(odm_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow) |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 1056 | $(odm_policy.conf): PRIVATE_POLICY_FILES := $(policy_files) |
| 1057 | $(odm_policy.conf): $(policy_files) $(M4) |
Bowgo Tsai | 45457e3 | 2017-11-27 11:41:33 +0800 | [diff] [blame] | 1058 | $(transform-policy-to-conf) |
huangyanjun | 2509572 | 2018-09-13 14:04:19 +0800 | [diff] [blame] | 1059 | $(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit |
Bowgo Tsai | 45457e3 | 2017-11-27 11:41:33 +0800 | [diff] [blame] | 1060 | |
| 1061 | $(LOCAL_BUILT_MODULE): PRIVATE_POL_CONF := $(odm_policy.conf) |
| 1062 | $(LOCAL_BUILT_MODULE): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil) |
Tri Vo | e68ba59 | 2019-01-15 13:31:03 -0800 | [diff] [blame] | 1063 | $(LOCAL_BUILT_MODULE): PRIVATE_BASE_CIL := $(pub_policy.cil) |
Bowgo Tsai | 45457e3 | 2017-11-27 11:41:33 +0800 | [diff] [blame] | 1064 | $(LOCAL_BUILT_MODULE): PRIVATE_VERS := $(BOARD_SEPOLICY_VERS) |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 1065 | $(LOCAL_BUILT_MODULE): PRIVATE_DEP_CIL_FILES := $(built_plat_cil) $(built_system_ext_cil) \ |
| 1066 | $(built_product_cil) $(built_pub_vers_cil) $(built_plat_mapping_cil) \ |
| 1067 | $(built_system_ext_mapping_cil) $(built_product_mapping_cil) $(built_vendor_cil) |
Tri Vo | e68ba59 | 2019-01-15 13:31:03 -0800 | [diff] [blame] | 1068 | $(LOCAL_BUILT_MODULE) : PRIVATE_FILTER_CIL_FILES := $(built_pub_vers_cil) $(built_vendor_cil) |
Bowgo Tsai | 45457e3 | 2017-11-27 11:41:33 +0800 | [diff] [blame] | 1069 | $(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/build_sepolicy \ |
Tri Vo | e68ba59 | 2019-01-15 13:31:03 -0800 | [diff] [blame] | 1070 | $(odm_policy.conf) $(reqd_policy_mask.cil) $(pub_policy.cil) \ |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 1071 | $(built_plat_cil) $(built_system_ext_cil) $(built_product_cil) $(built_pub_vers_cil) \ |
| 1072 | $(built_plat_mapping_cil) $(built_system_ext_mapping_cil) $(built_product_mapping_cil) \ |
| 1073 | $(built_vendor_cil) |
Bowgo Tsai | 45457e3 | 2017-11-27 11:41:33 +0800 | [diff] [blame] | 1074 | @mkdir -p $(dir $@) |
| 1075 | $(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) build_cil \ |
| 1076 | -i $(PRIVATE_POL_CONF) -m $(PRIVATE_REQD_MASK) -c $(CHECKPOLICY_ASAN_OPTIONS) \ |
| 1077 | -b $(PRIVATE_BASE_CIL) -d $(PRIVATE_DEP_CIL_FILES) -f $(PRIVATE_FILTER_CIL_FILES) \ |
| 1078 | -t $(PRIVATE_VERS) -p $(POLICYVERS) -o $@ |
| 1079 | |
| 1080 | built_odm_cil := $(LOCAL_BUILT_MODULE) |
| 1081 | odm_policy.conf := |
| 1082 | odm_policy_raw := |
Nick Kralevich | 1b2ea49 | 2018-09-25 11:03:48 -0700 | [diff] [blame] | 1083 | endif |
Bowgo Tsai | 45457e3 | 2017-11-27 11:41:33 +0800 | [diff] [blame] | 1084 | |
| 1085 | ################################# |
| 1086 | include $(CLEAR_VARS) |
| 1087 | |
Alex Klyubin | 193dccd | 2017-03-07 14:05:57 -0800 | [diff] [blame] | 1088 | LOCAL_MODULE := precompiled_sepolicy |
| 1089 | LOCAL_MODULE_CLASS := ETC |
| 1090 | LOCAL_MODULE_TAGS := optional |
| 1091 | LOCAL_PROPRIETARY_MODULE := true |
Bowgo Tsai | 45457e3 | 2017-11-27 11:41:33 +0800 | [diff] [blame] | 1092 | |
| 1093 | ifeq ($(BOARD_USES_ODMIMAGE),true) |
| 1094 | LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux |
| 1095 | else |
Alex Klyubin | 193dccd | 2017-03-07 14:05:57 -0800 | [diff] [blame] | 1096 | LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux |
Bowgo Tsai | 45457e3 | 2017-11-27 11:41:33 +0800 | [diff] [blame] | 1097 | endif |
Alex Klyubin | 193dccd | 2017-03-07 14:05:57 -0800 | [diff] [blame] | 1098 | |
| 1099 | include $(BUILD_SYSTEM)/base_rules.mk |
| 1100 | |
Bowgo Tsai | afbcf21 | 2018-02-05 17:34:52 +0800 | [diff] [blame] | 1101 | all_cil_files := \ |
| 1102 | $(built_plat_cil) \ |
Tri Vo | 937e664 | 2019-01-15 15:16:55 -0800 | [diff] [blame] | 1103 | $(built_plat_mapping_cil) \ |
Tri Vo | e68ba59 | 2019-01-15 13:31:03 -0800 | [diff] [blame] | 1104 | $(built_pub_vers_cil) \ |
Bowgo Tsai | afbcf21 | 2018-02-05 17:34:52 +0800 | [diff] [blame] | 1105 | $(built_vendor_cil) |
| 1106 | |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 1107 | ifdef HAS_SYSTEM_EXT_SEPOLICY |
Bowgo Tsai | ac38125 | 2019-10-04 14:34:18 +0800 | [diff] [blame] | 1108 | all_cil_files += $(built_system_ext_cil) |
| 1109 | endif |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 1110 | |
Bowgo Tsai | ac38125 | 2019-10-04 14:34:18 +0800 | [diff] [blame] | 1111 | ifdef HAS_SYSTEM_EXT_PUBLIC_SEPOLICY |
| 1112 | all_cil_files += $(built_system_ext_mapping_cil) |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 1113 | endif |
| 1114 | |
Tri Vo | 75887dd | 2018-12-14 14:30:56 -0800 | [diff] [blame] | 1115 | ifdef HAS_PRODUCT_SEPOLICY |
Bowgo Tsai | 7c4150c | 2019-10-04 15:36:05 +0800 | [diff] [blame] | 1116 | all_cil_files += $(built_product_cil) |
| 1117 | endif |
Tri Vo | 937e664 | 2019-01-15 15:16:55 -0800 | [diff] [blame] | 1118 | |
Bowgo Tsai | 7c4150c | 2019-10-04 15:36:05 +0800 | [diff] [blame] | 1119 | ifdef HAS_PRODUCT_PUBLIC_SEPOLICY |
| 1120 | all_cil_files += $(built_product_mapping_cil) |
Tri Vo | 75887dd | 2018-12-14 14:30:56 -0800 | [diff] [blame] | 1121 | endif |
| 1122 | |
Bowgo Tsai | 45457e3 | 2017-11-27 11:41:33 +0800 | [diff] [blame] | 1123 | ifdef BOARD_ODM_SEPOLICY_DIRS |
| 1124 | all_cil_files += $(built_odm_cil) |
| 1125 | endif |
| 1126 | |
Bowgo Tsai | afbcf21 | 2018-02-05 17:34:52 +0800 | [diff] [blame] | 1127 | $(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(all_cil_files) |
Joel Galenson | 5988b56 | 2018-01-03 16:53:24 -0800 | [diff] [blame] | 1128 | $(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG) |
Bowgo Tsai | afbcf21 | 2018-02-05 17:34:52 +0800 | [diff] [blame] | 1129 | $(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(all_cil_files) $(built_sepolicy_neverallows) |
Joel Galenson | 5988b56 | 2018-01-03 16:53:24 -0800 | [diff] [blame] | 1130 | $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) \ |
Alex Klyubin | 193dccd | 2017-03-07 14:05:57 -0800 | [diff] [blame] | 1131 | $(PRIVATE_CIL_FILES) -o $@ -f /dev/null |
| 1132 | |
| 1133 | built_precompiled_sepolicy := $(LOCAL_BUILT_MODULE) |
Bowgo Tsai | afbcf21 | 2018-02-05 17:34:52 +0800 | [diff] [blame] | 1134 | all_cil_files := |
Alex Klyubin | 193dccd | 2017-03-07 14:05:57 -0800 | [diff] [blame] | 1135 | |
| 1136 | ################################# |
Tri Vo | 1824e25 | 2019-01-22 18:07:58 -0800 | [diff] [blame] | 1137 | # Precompiled sepolicy is loaded if and only if: |
| 1138 | # - plat_sepolicy_and_mapping.sha256 equals |
| 1139 | # precompiled_sepolicy.plat_sepolicy_and_mapping.sha256 |
| 1140 | # AND |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 1141 | # - system_ext_sepolicy_and_mapping.sha256 equals |
| 1142 | # precompiled_sepolicy.system_ext_sepolicy_and_mapping.sha256 |
| 1143 | # AND |
Tri Vo | 1824e25 | 2019-01-22 18:07:58 -0800 | [diff] [blame] | 1144 | # - product_sepolicy_and_mapping.sha256 equals |
| 1145 | # precompiled_sepolicy.product_sepolicy_and_mapping.sha256 |
| 1146 | # See system/core/init/selinux.cpp for details. |
| 1147 | ################################# |
| 1148 | include $(CLEAR_VARS) |
| 1149 | |
| 1150 | LOCAL_MODULE := plat_sepolicy_and_mapping.sha256 |
| 1151 | LOCAL_MODULE_CLASS := ETC |
| 1152 | LOCAL_MODULE_TAGS := optional |
| 1153 | LOCAL_MODULE_PATH = $(TARGET_OUT)/etc/selinux |
| 1154 | |
| 1155 | include $(BUILD_SYSTEM)/base_rules.mk |
| 1156 | |
| 1157 | $(LOCAL_BUILT_MODULE): $(built_plat_cil) $(built_plat_mapping_cil) |
| 1158 | cat $^ | sha256sum | cut -d' ' -f1 > $@ |
| 1159 | |
| 1160 | ################################# |
| 1161 | include $(CLEAR_VARS) |
| 1162 | |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 1163 | LOCAL_MODULE := system_ext_sepolicy_and_mapping.sha256 |
| 1164 | LOCAL_MODULE_CLASS := ETC |
| 1165 | LOCAL_MODULE_TAGS := optional |
| 1166 | LOCAL_MODULE_PATH = $(TARGET_OUT_SYSTEM_EXT)/etc/selinux |
| 1167 | |
| 1168 | include $(BUILD_SYSTEM)/base_rules.mk |
| 1169 | |
| 1170 | $(LOCAL_BUILT_MODULE): $(built_system_ext_cil) $(built_system_ext_mapping_cil) |
| 1171 | cat $^ | sha256sum | cut -d' ' -f1 > $@ |
| 1172 | |
| 1173 | ################################# |
| 1174 | include $(CLEAR_VARS) |
| 1175 | |
Tri Vo | 1824e25 | 2019-01-22 18:07:58 -0800 | [diff] [blame] | 1176 | LOCAL_MODULE := product_sepolicy_and_mapping.sha256 |
| 1177 | LOCAL_MODULE_CLASS := ETC |
| 1178 | LOCAL_MODULE_TAGS := optional |
| 1179 | LOCAL_MODULE_PATH = $(TARGET_OUT_PRODUCT)/etc/selinux |
| 1180 | |
| 1181 | include $(BUILD_SYSTEM)/base_rules.mk |
| 1182 | |
| 1183 | $(LOCAL_BUILT_MODULE): $(built_product_cil) $(built_product_mapping_cil) |
| 1184 | cat $^ | sha256sum | cut -d' ' -f1 > $@ |
| 1185 | |
| 1186 | ################################# |
| 1187 | # SHA-256 digest of the plat_sepolicy.cil and plat_mapping_file against |
Dan Cashman | 0e9c47c | 2017-04-04 14:27:41 -0700 | [diff] [blame] | 1188 | # which precompiled_policy was built. |
Alex Klyubin | 193dccd | 2017-03-07 14:05:57 -0800 | [diff] [blame] | 1189 | ################################# |
| 1190 | include $(CLEAR_VARS) |
Tri Vo | 1824e25 | 2019-01-22 18:07:58 -0800 | [diff] [blame] | 1191 | LOCAL_MODULE := precompiled_sepolicy.plat_sepolicy_and_mapping.sha256 |
Alex Klyubin | 193dccd | 2017-03-07 14:05:57 -0800 | [diff] [blame] | 1192 | LOCAL_MODULE_CLASS := ETC |
| 1193 | LOCAL_MODULE_TAGS := optional |
Bowgo Tsai | 45457e3 | 2017-11-27 11:41:33 +0800 | [diff] [blame] | 1194 | |
| 1195 | ifeq ($(BOARD_USES_ODMIMAGE),true) |
| 1196 | LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux |
| 1197 | else |
Alex Klyubin | 193dccd | 2017-03-07 14:05:57 -0800 | [diff] [blame] | 1198 | LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux |
Bowgo Tsai | 45457e3 | 2017-11-27 11:41:33 +0800 | [diff] [blame] | 1199 | endif |
Alex Klyubin | 193dccd | 2017-03-07 14:05:57 -0800 | [diff] [blame] | 1200 | |
| 1201 | include $(BUILD_SYSTEM)/base_rules.mk |
| 1202 | |
Tri Vo | 1824e25 | 2019-01-22 18:07:58 -0800 | [diff] [blame] | 1203 | $(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(built_plat_cil) $(built_plat_mapping_cil) |
| 1204 | $(LOCAL_BUILT_MODULE): $(built_precompiled_sepolicy) $(built_plat_cil) $(built_plat_mapping_cil) |
| 1205 | cat $(PRIVATE_CIL_FILES) | sha256sum | cut -d' ' -f1 > $@ |
| 1206 | |
| 1207 | ################################# |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 1208 | # SHA-256 digest of the system_ext_sepolicy.cil and system_ext_mapping_file against |
| 1209 | # which precompiled_policy was built. |
| 1210 | ################################# |
| 1211 | include $(CLEAR_VARS) |
| 1212 | LOCAL_MODULE := precompiled_sepolicy.system_ext_sepolicy_and_mapping.sha256 |
| 1213 | LOCAL_MODULE_CLASS := ETC |
| 1214 | LOCAL_MODULE_TAGS := optional |
| 1215 | |
| 1216 | ifeq ($(BOARD_USES_ODMIMAGE),true) |
| 1217 | LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux |
| 1218 | else |
| 1219 | LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux |
| 1220 | endif |
| 1221 | |
| 1222 | include $(BUILD_SYSTEM)/base_rules.mk |
| 1223 | |
| 1224 | $(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(built_system_ext_cil) $(built_system_ext_mapping_cil) |
| 1225 | $(LOCAL_BUILT_MODULE): $(built_precompiled_sepolicy) $(built_system_ext_cil) $(built_system_ext_mapping_cil) |
| 1226 | cat $(PRIVATE_CIL_FILES) | sha256sum | cut -d' ' -f1 > $@ |
| 1227 | |
| 1228 | ################################# |
Tri Vo | 1824e25 | 2019-01-22 18:07:58 -0800 | [diff] [blame] | 1229 | # SHA-256 digest of the product_sepolicy.cil and product_mapping_file against |
| 1230 | # which precompiled_policy was built. |
| 1231 | ################################# |
| 1232 | include $(CLEAR_VARS) |
| 1233 | LOCAL_MODULE := precompiled_sepolicy.product_sepolicy_and_mapping.sha256 |
| 1234 | LOCAL_MODULE_CLASS := ETC |
| 1235 | LOCAL_MODULE_TAGS := optional |
| 1236 | |
| 1237 | ifeq ($(BOARD_USES_ODMIMAGE),true) |
| 1238 | LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux |
| 1239 | else |
| 1240 | LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux |
| 1241 | endif |
| 1242 | |
| 1243 | include $(BUILD_SYSTEM)/base_rules.mk |
| 1244 | |
| 1245 | $(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(built_product_cil) $(built_product_mapping_cil) |
| 1246 | $(LOCAL_BUILT_MODULE): $(built_precompiled_sepolicy) $(built_product_cil) $(built_product_mapping_cil) |
Dan Cashman | 0e9c47c | 2017-04-04 14:27:41 -0700 | [diff] [blame] | 1247 | cat $(PRIVATE_CIL_FILES) | sha256sum | cut -d' ' -f1 > $@ |
Alex Klyubin | 193dccd | 2017-03-07 14:05:57 -0800 | [diff] [blame] | 1248 | |
| 1249 | ################################# |
| 1250 | include $(CLEAR_VARS) |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 1251 | # build this target so that we can still perform neverallow checks |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 1252 | |
| 1253 | LOCAL_MODULE := sepolicy |
| 1254 | LOCAL_MODULE_CLASS := ETC |
| 1255 | LOCAL_MODULE_TAGS := optional |
Daniel Cashman | 65d0134 | 2016-12-17 00:53:26 +0000 | [diff] [blame] | 1256 | LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT) |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 1257 | |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 1258 | include $(BUILD_SYSTEM)/base_rules.mk |
| 1259 | |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 1260 | all_cil_files := \ |
Jeff Vander Stoep | b878769 | 2017-04-21 15:57:07 -0700 | [diff] [blame] | 1261 | $(built_plat_cil) \ |
Tri Vo | 937e664 | 2019-01-15 15:16:55 -0800 | [diff] [blame] | 1262 | $(built_plat_mapping_cil) \ |
Tri Vo | e68ba59 | 2019-01-15 13:31:03 -0800 | [diff] [blame] | 1263 | $(built_pub_vers_cil) \ |
Bowgo Tsai | afbcf21 | 2018-02-05 17:34:52 +0800 | [diff] [blame] | 1264 | $(built_vendor_cil) |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 1265 | |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 1266 | ifdef HAS_SYSTEM_EXT_SEPOLICY |
Bowgo Tsai | ac38125 | 2019-10-04 14:34:18 +0800 | [diff] [blame] | 1267 | all_cil_files += $(built_system_ext_cil) |
| 1268 | endif |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 1269 | |
Bowgo Tsai | ac38125 | 2019-10-04 14:34:18 +0800 | [diff] [blame] | 1270 | ifdef HAS_SYSTEM_EXT_PUBLIC_SEPOLICY |
| 1271 | all_cil_files += $(built_system_ext_mapping_cil) |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 1272 | endif |
| 1273 | |
Tri Vo | 75887dd | 2018-12-14 14:30:56 -0800 | [diff] [blame] | 1274 | ifdef HAS_PRODUCT_SEPOLICY |
Bowgo Tsai | 7c4150c | 2019-10-04 15:36:05 +0800 | [diff] [blame] | 1275 | all_cil_files += $(built_product_cil) |
| 1276 | endif |
Tri Vo | 937e664 | 2019-01-15 15:16:55 -0800 | [diff] [blame] | 1277 | |
Bowgo Tsai | 7c4150c | 2019-10-04 15:36:05 +0800 | [diff] [blame] | 1278 | ifdef HAS_PRODUCT_PUBLIC_SEPOLICY |
| 1279 | all_cil_files += $(built_product_mapping_cil) |
Tri Vo | 75887dd | 2018-12-14 14:30:56 -0800 | [diff] [blame] | 1280 | endif |
| 1281 | |
Bowgo Tsai | 45457e3 | 2017-11-27 11:41:33 +0800 | [diff] [blame] | 1282 | ifdef BOARD_ODM_SEPOLICY_DIRS |
| 1283 | all_cil_files += $(built_odm_cil) |
| 1284 | endif |
| 1285 | |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 1286 | $(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(all_cil_files) |
Joel Galenson | 5988b56 | 2018-01-03 16:53:24 -0800 | [diff] [blame] | 1287 | $(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG) |
| 1288 | $(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $(all_cil_files) \ |
| 1289 | $(built_sepolicy_neverallows) |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 1290 | @mkdir -p $(dir $@) |
Joel Galenson | 5988b56 | 2018-01-03 16:53:24 -0800 | [diff] [blame] | 1291 | $(hide) $< -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $(PRIVATE_CIL_FILES) -o $@.tmp -f /dev/null |
Nick Kralevich | bca98ef | 2016-02-26 20:06:52 -0800 | [diff] [blame] | 1292 | $(hide) $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $@.tmp permissive > $@.permissivedomains |
| 1293 | $(hide) if [ "$(TARGET_BUILD_VARIANT)" = "user" -a -s $@.permissivedomains ]; then \ |
| 1294 | echo "==========" 1>&2; \ |
| 1295 | echo "ERROR: permissive domains not allowed in user builds" 1>&2; \ |
| 1296 | echo "List of invalid domains:" 1>&2; \ |
| 1297 | cat $@.permissivedomains 1>&2; \ |
| 1298 | exit 1; \ |
| 1299 | fi |
| 1300 | $(hide) mv $@.tmp $@ |
Ying Wang | 02fb5f3 | 2012-01-17 17:51:09 -0800 | [diff] [blame] | 1301 | |
Ying Wang | d8b122c | 2012-10-25 19:01:31 -0700 | [diff] [blame] | 1302 | built_sepolicy := $(LOCAL_BUILT_MODULE) |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 1303 | all_cil_files := |
Stephen Smalley | 01a58af | 2012-10-02 12:46:37 -0400 | [diff] [blame] | 1304 | |
Alex Klyubin | 84aa742 | 2017-03-10 09:36:07 -0800 | [diff] [blame] | 1305 | ################################# |
| 1306 | include $(CLEAR_VARS) |
| 1307 | |
| 1308 | # keep concrete sepolicy for neverallow checks |
Joel Galenson | 5988b56 | 2018-01-03 16:53:24 -0800 | [diff] [blame] | 1309 | # If SELINUX_IGNORE_NEVERALLOWS is set, we use sed to remove the neverallow lines before compiling. |
Alex Klyubin | 84aa742 | 2017-03-10 09:36:07 -0800 | [diff] [blame] | 1310 | |
| 1311 | LOCAL_MODULE := sepolicy.recovery |
Alex Klyubin | ec78c37 | 2017-03-10 12:44:16 -0800 | [diff] [blame] | 1312 | LOCAL_MODULE_STEM := sepolicy |
Alex Klyubin | 84aa742 | 2017-03-10 09:36:07 -0800 | [diff] [blame] | 1313 | LOCAL_MODULE_CLASS := ETC |
| 1314 | LOCAL_MODULE_TAGS := optional |
Alex Klyubin | ec78c37 | 2017-03-10 12:44:16 -0800 | [diff] [blame] | 1315 | LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT) |
Alex Klyubin | 84aa742 | 2017-03-10 09:36:07 -0800 | [diff] [blame] | 1316 | |
| 1317 | include $(BUILD_SYSTEM)/base_rules.mk |
| 1318 | |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 1319 | policy_files := $(call build_policy, $(sepolicy_build_files), \ |
| 1320 | $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) \ |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 1321 | $(SYSTEM_EXT_PUBLIC_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY) \ |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 1322 | $(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY) \ |
| 1323 | $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) \ |
| 1324 | $(BOARD_ODM_SEPOLICY_DIRS)) |
Dan Cashman | c8d4535 | 2017-04-11 07:38:48 -0700 | [diff] [blame] | 1325 | sepolicy.recovery.conf := $(intermediates)/sepolicy.recovery.conf |
| 1326 | $(sepolicy.recovery.conf): PRIVATE_MLS_SENS := $(MLS_SENS) |
| 1327 | $(sepolicy.recovery.conf): PRIVATE_MLS_CATS := $(MLS_CATS) |
Joel Galenson | 8c72eea | 2018-03-07 15:36:29 -0800 | [diff] [blame] | 1328 | $(sepolicy.recovery.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT) |
Dan Cashman | c8d4535 | 2017-04-11 07:38:48 -0700 | [diff] [blame] | 1329 | $(sepolicy.recovery.conf): PRIVATE_TGT_ARCH := $(my_target_arch) |
| 1330 | $(sepolicy.recovery.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) |
Pirama Arumuga Nainar | ce9c0c5 | 2019-06-13 15:05:15 -0700 | [diff] [blame] | 1331 | $(sepolicy.recovery.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage) |
Dan Cashman | c8d4535 | 2017-04-11 07:38:48 -0700 | [diff] [blame] | 1332 | $(sepolicy.recovery.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) |
Dan Cashman | 36ee91d | 2017-07-07 14:59:51 -0700 | [diff] [blame] | 1333 | $(sepolicy.recovery.conf): PRIVATE_TGT_RECOVERY := -D target_recovery=true |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 1334 | $(sepolicy.recovery.conf): PRIVATE_POLICY_FILES := $(policy_files) |
| 1335 | $(sepolicy.recovery.conf): $(policy_files) $(M4) |
Dan Cashman | 36ee91d | 2017-07-07 14:59:51 -0700 | [diff] [blame] | 1336 | $(transform-policy-to-conf) |
huangyanjun | 2509572 | 2018-09-13 14:04:19 +0800 | [diff] [blame] | 1337 | $(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit |
| 1338 | |
Joel Galenson | 5988b56 | 2018-01-03 16:53:24 -0800 | [diff] [blame] | 1339 | ifeq ($(SELINUX_IGNORE_NEVERALLOWS),true) |
| 1340 | $(hide) sed -z 's/\n\s*neverallow[^;]*;/\n/g' $@ > $@.neverallow |
| 1341 | $(hide) mv $@.neverallow $@ |
| 1342 | endif |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 1343 | |
Dan Cashman | c8d4535 | 2017-04-11 07:38:48 -0700 | [diff] [blame] | 1344 | $(LOCAL_BUILT_MODULE): $(sepolicy.recovery.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \ |
| 1345 | $(HOST_OUT_EXECUTABLES)/sepolicy-analyze |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 1346 | @mkdir -p $(dir $@) |
Andreas Gampe | 3ddc78b | 2017-04-27 17:16:13 -0700 | [diff] [blame] | 1347 | $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c \ |
| 1348 | $(POLICYVERS) -o $@.tmp $< |
Nick Kralevich | bca98ef | 2016-02-26 20:06:52 -0800 | [diff] [blame] | 1349 | $(hide) $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $@.tmp permissive > $@.permissivedomains |
| 1350 | $(hide) if [ "$(TARGET_BUILD_VARIANT)" = "user" -a -s $@.permissivedomains ]; then \ |
| 1351 | echo "==========" 1>&2; \ |
| 1352 | echo "ERROR: permissive domains not allowed in user builds" 1>&2; \ |
| 1353 | echo "List of invalid domains:" 1>&2; \ |
| 1354 | cat $@.permissivedomains 1>&2; \ |
| 1355 | exit 1; \ |
| 1356 | fi |
| 1357 | $(hide) mv $@.tmp $@ |
Stephen Smalley | e60723a | 2014-05-29 16:40:15 -0400 | [diff] [blame] | 1358 | |
Dan Cashman | c8d4535 | 2017-04-11 07:38:48 -0700 | [diff] [blame] | 1359 | sepolicy.recovery.conf := |
Stephen Smalley | e60723a | 2014-05-29 16:40:15 -0400 | [diff] [blame] | 1360 | |
dcashman | 704741a | 2014-07-25 19:11:52 -0700 | [diff] [blame] | 1361 | ################################## |
Alex Klyubin | 446279a | 2017-04-06 14:45:50 -0700 | [diff] [blame] | 1362 | # SELinux policy embedded into CTS. |
| 1363 | # CTS checks neverallow rules of this policy against the policy of the device under test. |
| 1364 | ################################## |
dcashman | 704741a | 2014-07-25 19:11:52 -0700 | [diff] [blame] | 1365 | include $(CLEAR_VARS) |
| 1366 | |
| 1367 | LOCAL_MODULE := general_sepolicy.conf |
| 1368 | LOCAL_MODULE_CLASS := ETC |
| 1369 | LOCAL_MODULE_TAGS := tests |
| 1370 | |
| 1371 | include $(BUILD_SYSTEM)/base_rules.mk |
| 1372 | |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 1373 | policy_files := $(call build_policy, $(sepolicy_build_files), \ |
| 1374 | $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY)) |
dcashman | 704741a | 2014-07-25 19:11:52 -0700 | [diff] [blame] | 1375 | $(LOCAL_BUILT_MODULE): PRIVATE_MLS_SENS := $(MLS_SENS) |
| 1376 | $(LOCAL_BUILT_MODULE): PRIVATE_MLS_CATS := $(MLS_CATS) |
Joel Galenson | 8c72eea | 2018-03-07 15:36:29 -0800 | [diff] [blame] | 1377 | $(LOCAL_BUILT_MODULE): PRIVATE_TARGET_BUILD_VARIANT := user |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 1378 | $(LOCAL_BUILT_MODULE): PRIVATE_TGT_ARCH := $(my_target_arch) |
Dan Cashman | 36ee91d | 2017-07-07 14:59:51 -0700 | [diff] [blame] | 1379 | $(LOCAL_BUILT_MODULE): PRIVATE_WITH_ASAN := false |
Steven Moreland | 763697d | 2017-11-09 11:24:56 -0800 | [diff] [blame] | 1380 | $(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY_SPLIT := cts |
Jaekyun Seok | 64ade65 | 2018-01-30 17:23:58 +0900 | [diff] [blame] | 1381 | $(LOCAL_BUILT_MODULE): PRIVATE_COMPATIBLE_PROPERTY := cts |
Inseob Kim | ed59c22 | 2019-09-26 15:14:55 +0900 | [diff] [blame] | 1382 | $(LOCAL_BUILT_MODULE): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := cts |
Tri Vo | 77c44fc | 2018-06-05 14:11:08 -0700 | [diff] [blame] | 1383 | $(LOCAL_BUILT_MODULE): PRIVATE_EXCLUDE_BUILD_TEST := true |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 1384 | $(LOCAL_BUILT_MODULE): PRIVATE_POLICY_FILES := $(policy_files) |
| 1385 | $(LOCAL_BUILT_MODULE): $(policy_files) $(M4) |
Dan Cashman | 36ee91d | 2017-07-07 14:59:51 -0700 | [diff] [blame] | 1386 | $(transform-policy-to-conf) |
huangyanjun | 2509572 | 2018-09-13 14:04:19 +0800 | [diff] [blame] | 1387 | $(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit |
dcashman | 704741a | 2014-07-25 19:11:52 -0700 | [diff] [blame] | 1388 | |
William Roberts | b876993 | 2015-06-29 16:31:23 -0700 | [diff] [blame] | 1389 | ################################## |
dcashman | d225b69 | 2016-12-12 09:29:04 -0800 | [diff] [blame] | 1390 | # TODO - remove this. Keep around until we get the filesystem creation stuff taken care of. |
| 1391 | # |
William Roberts | b876993 | 2015-06-29 16:31:23 -0700 | [diff] [blame] | 1392 | include $(CLEAR_VARS) |
| 1393 | |
Richard Haines | c2d0191 | 2015-08-06 17:43:52 +0100 | [diff] [blame] | 1394 | LOCAL_MODULE := file_contexts.bin |
Ying Wang | 02fb5f3 | 2012-01-17 17:51:09 -0800 | [diff] [blame] | 1395 | LOCAL_MODULE_CLASS := ETC |
| 1396 | LOCAL_MODULE_TAGS := optional |
| 1397 | LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT) |
| 1398 | |
Stephen Smalley | 5b340be | 2012-03-06 11:12:41 -0500 | [diff] [blame] | 1399 | include $(BUILD_SYSTEM)/base_rules.mk |
Ying Wang | 02fb5f3 | 2012-01-17 17:51:09 -0800 | [diff] [blame] | 1400 | |
William Roberts | 49693f1 | 2016-01-04 12:20:57 -0800 | [diff] [blame] | 1401 | # The file_contexts.bin is built in the following way: |
| 1402 | # 1. Collect all file_contexts files in THIS repository and process them with |
| 1403 | # m4 into a tmp file called file_contexts.local.tmp. |
| 1404 | # 2. Collect all device specific file_contexts files and process them with m4 |
| 1405 | # into a tmp file called file_contexts.device.tmp. |
| 1406 | # 3. Run checkfc -e (allow no device fc entries ie empty) and fc_sort on |
| 1407 | # file_contexts.device.tmp and output to file_contexts.device.sorted.tmp. |
| 1408 | # 4. Concatenate file_contexts.local.tmp and file_contexts.device.tmp into |
| 1409 | # file_contexts.concat.tmp. |
| 1410 | # 5. Run checkfc and sefcontext_compile on file_contexts.concat.tmp to produce |
| 1411 | # file_contexts.bin. |
| 1412 | # |
| 1413 | # Note: That a newline file is placed between each file_context file found to |
| 1414 | # ensure a proper build when an fc file is missing an ending newline. |
William Roberts | 29d1468 | 2016-01-04 12:20:57 -0800 | [diff] [blame] | 1415 | |
Dan Cashman | 1b0a71f | 2017-05-08 14:26:52 -0700 | [diff] [blame] | 1416 | local_fc_files := $(call build_policy, file_contexts, $(PLAT_PRIVATE_POLICY)) |
| 1417 | |
Bowgo Tsai | ac38125 | 2019-10-04 14:34:18 +0800 | [diff] [blame] | 1418 | ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR |
Bowgo Tsai | 86a048d | 2019-09-09 22:04:06 +0800 | [diff] [blame] | 1419 | local_fc_files += $(call build_policy, file_contexts, $(SYSTEM_EXT_PRIVATE_POLICY)) |
| 1420 | endif |
| 1421 | |
Bowgo Tsai | 7c4150c | 2019-10-04 15:36:05 +0800 | [diff] [blame] | 1422 | ifdef HAS_PRODUCT_SEPOLICY_DIR |
Tri Vo | 75887dd | 2018-12-14 14:30:56 -0800 | [diff] [blame] | 1423 | local_fc_files += $(call build_policy, file_contexts, $(PRODUCT_PRIVATE_POLICY)) |
| 1424 | endif |
| 1425 | |
William Roberts | 49693f1 | 2016-01-04 12:20:57 -0800 | [diff] [blame] | 1426 | ifneq ($(filter address,$(SANITIZE_TARGET)),) |
Mark Salyzyn | 9b398f3 | 2018-06-13 08:02:29 -0700 | [diff] [blame] | 1427 | local_fc_files += $(wildcard $(addsuffix /file_contexts_asan, $(PLAT_PRIVATE_POLICY))) |
| 1428 | endif |
| 1429 | ifneq (,$(filter userdebug eng,$(TARGET_BUILD_VARIANT))) |
| 1430 | local_fc_files += $(wildcard $(addsuffix /file_contexts_overlayfs, $(PLAT_PRIVATE_POLICY))) |
William Roberts | 49693f1 | 2016-01-04 12:20:57 -0800 | [diff] [blame] | 1431 | endif |
Jooyung Han | a932474 | 2019-11-20 17:54:34 +0900 | [diff] [blame] | 1432 | |
| 1433 | # Even if TARGET_FLATTEN_APEX is not turned on, "flattened" APEXes are installed |
| 1434 | $(foreach _tuple,$(APEX_FILE_CONTEXTS_INFOS),\ |
| 1435 | $(eval _apex_name := $(call word-colon,1,$(_tuple)))\ |
| 1436 | $(eval _apex_path := $(call word-colon,2,$(_tuple)))\ |
| 1437 | $(eval _fc_path := $(call word-colon,3,$(_tuple)))\ |
| 1438 | $(eval _input := $(_fc_path))\ |
| 1439 | $(eval _output := $(intermediates)/$(_apex_name)-flattened)\ |
| 1440 | $(eval $(call build_flattened_apex_file_contexts,$(_input),$(_apex_path),$(_output),local_fc_files))\ |
| 1441 | ) |
William Roberts | 49693f1 | 2016-01-04 12:20:57 -0800 | [diff] [blame] | 1442 | |
| 1443 | file_contexts.local.tmp := $(intermediates)/file_contexts.local.tmp |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 1444 | $(file_contexts.local.tmp): PRIVATE_FC_FILES := $(local_fc_files) |
| 1445 | $(file_contexts.local.tmp): $(local_fc_files) $(M4) |
Stephen Smalley | 5b340be | 2012-03-06 11:12:41 -0500 | [diff] [blame] | 1446 | @mkdir -p $(dir $@) |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 1447 | $(hide) $(M4) --fatal-warnings -s $(PRIVATE_FC_FILES) > $@ |
William Roberts | 49693f1 | 2016-01-04 12:20:57 -0800 | [diff] [blame] | 1448 | |
Bowgo Tsai | afbcf21 | 2018-02-05 17:34:52 +0800 | [diff] [blame] | 1449 | device_fc_files := $(call build_vendor_policy, file_contexts) |
Bowgo Tsai | bae1517 | 2017-11-29 16:14:53 +0800 | [diff] [blame] | 1450 | |
| 1451 | ifdef BOARD_ODM_SEPOLICY_DIRS |
| 1452 | device_fc_files += $(call build_odm_policy, file_contexts) |
| 1453 | endif |
| 1454 | |
William Roberts | 49693f1 | 2016-01-04 12:20:57 -0800 | [diff] [blame] | 1455 | file_contexts.device.tmp := $(intermediates)/file_contexts.device.tmp |
| 1456 | $(file_contexts.device.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 1457 | $(file_contexts.device.tmp): PRIVATE_DEVICE_FC_FILES := $(device_fc_files) |
| 1458 | $(file_contexts.device.tmp): $(device_fc_files) $(M4) |
William Roberts | 49693f1 | 2016-01-04 12:20:57 -0800 | [diff] [blame] | 1459 | @mkdir -p $(dir $@) |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 1460 | $(hide) $(M4) --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_DEVICE_FC_FILES) > $@ |
William Roberts | 49693f1 | 2016-01-04 12:20:57 -0800 | [diff] [blame] | 1461 | |
| 1462 | file_contexts.device.sorted.tmp := $(intermediates)/file_contexts.device.sorted.tmp |
| 1463 | $(file_contexts.device.sorted.tmp): PRIVATE_SEPOLICY := $(built_sepolicy) |
Bowgo Tsai | afbcf21 | 2018-02-05 17:34:52 +0800 | [diff] [blame] | 1464 | $(file_contexts.device.sorted.tmp): $(file_contexts.device.tmp) $(built_sepolicy) \ |
| 1465 | $(HOST_OUT_EXECUTABLES)/fc_sort $(HOST_OUT_EXECUTABLES)/checkfc |
William Roberts | 49693f1 | 2016-01-04 12:20:57 -0800 | [diff] [blame] | 1466 | @mkdir -p $(dir $@) |
dcashman | 0779155 | 2016-12-07 11:27:47 -0800 | [diff] [blame] | 1467 | $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e $(PRIVATE_SEPOLICY) $< |
Jeff Vander Stoep | 1ca7a4c | 2019-04-10 16:53:17 -0700 | [diff] [blame] | 1468 | $(hide) $(HOST_OUT_EXECUTABLES)/fc_sort -i $< -o $@ |
William Roberts | 49693f1 | 2016-01-04 12:20:57 -0800 | [diff] [blame] | 1469 | |
| 1470 | file_contexts.concat.tmp := $(intermediates)/file_contexts.concat.tmp |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 1471 | $(file_contexts.concat.tmp): PRIVATE_CONTEXTS := $(file_contexts.local.tmp) $(file_contexts.device.sorted.tmp) |
| 1472 | $(file_contexts.concat.tmp): $(file_contexts.local.tmp) $(file_contexts.device.sorted.tmp) $(M4) |
William Roberts | 49693f1 | 2016-01-04 12:20:57 -0800 | [diff] [blame] | 1473 | @mkdir -p $(dir $@) |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 1474 | $(hide) $(M4) --fatal-warnings -s $(PRIVATE_CONTEXTS) > $@ |
Stephen Smalley | 5b340be | 2012-03-06 11:12:41 -0500 | [diff] [blame] | 1475 | |
William Roberts | 3746a0a | 2015-09-25 10:18:44 -0700 | [diff] [blame] | 1476 | $(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) |
William Roberts | 49693f1 | 2016-01-04 12:20:57 -0800 | [diff] [blame] | 1477 | $(LOCAL_BUILT_MODULE): $(file_contexts.concat.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/sefcontext_compile $(HOST_OUT_EXECUTABLES)/checkfc |
Richard Haines | c2d0191 | 2015-08-06 17:43:52 +0100 | [diff] [blame] | 1478 | @mkdir -p $(dir $@) |
dcashman | 0779155 | 2016-12-07 11:27:47 -0800 | [diff] [blame] | 1479 | $(hide) $(HOST_OUT_EXECUTABLES)/checkfc $(PRIVATE_SEPOLICY) $< |
Richard Haines | c2d0191 | 2015-08-06 17:43:52 +0100 | [diff] [blame] | 1480 | $(hide) $(HOST_OUT_EXECUTABLES)/sefcontext_compile -o $@ $< |
| 1481 | |
Robert Craig | 8b7545b | 2014-03-20 09:35:08 -0400 | [diff] [blame] | 1482 | built_fc := $(LOCAL_BUILT_MODULE) |
William Roberts | 49693f1 | 2016-01-04 12:20:57 -0800 | [diff] [blame] | 1483 | local_fc_files := |
| 1484 | local_fcfiles_with_nl := |
| 1485 | device_fc_files := |
| 1486 | device_fcfiles_with_nl := |
| 1487 | file_contexts.concat.tmp := |
| 1488 | file_contexts.device.sorted.tmp := |
| 1489 | file_contexts.device.tmp := |
| 1490 | file_contexts.local.tmp := |
William Roberts | 171a062 | 2012-08-16 10:55:05 -0700 | [diff] [blame] | 1491 | |
Ying Wang | 02fb5f3 | 2012-01-17 17:51:09 -0800 | [diff] [blame] | 1492 | ################################## |
Dan Cashman | 91d398d | 2017-09-26 12:58:29 -0700 | [diff] [blame] | 1493 | include $(CLEAR_VARS) |
| 1494 | |
| 1495 | LOCAL_MODULE := selinux_denial_metadata |
| 1496 | LOCAL_MODULE_CLASS := ETC |
Tri Vo | 4eb6815 | 2019-01-23 09:47:05 -0800 | [diff] [blame] | 1497 | LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux |
Dan Cashman | 91d398d | 2017-09-26 12:58:29 -0700 | [diff] [blame] | 1498 | |
| 1499 | include $(BUILD_SYSTEM)/base_rules.mk |
| 1500 | |
Tri Vo | fd3c3e2 | 2019-06-06 17:09:29 -0700 | [diff] [blame] | 1501 | bug_files := $(call build_policy, bug_map, $(LOCAL_PATH) $(PLAT_PRIVATE_POLICY) $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(PLAT_PUBLIC_POLICY)) |
Dan Cashman | 91d398d | 2017-09-26 12:58:29 -0700 | [diff] [blame] | 1502 | |
| 1503 | $(LOCAL_BUILT_MODULE) : $(bug_files) |
| 1504 | @mkdir -p $(dir $@) |
| 1505 | cat $^ > $@ |
| 1506 | |
| 1507 | bug_files := |
dcashman | d225b69 | 2016-12-12 09:29:04 -0800 | [diff] [blame] | 1508 | |
| 1509 | ################################## |
Tri Vo | 8b3016b | 2019-01-07 16:43:31 -0800 | [diff] [blame] | 1510 | include $(LOCAL_PATH)/seapp_contexts.mk |
Stephen Smalley | 2e0cd5a | 2015-03-12 17:45:03 -0400 | [diff] [blame] | 1511 | |
| 1512 | ################################## |
Inseob Kim | b554e59 | 2019-04-15 20:10:46 +0900 | [diff] [blame] | 1513 | include $(LOCAL_PATH)/contexts_tests.mk |
Martijn Coenen | 3ea47b9 | 2017-04-07 16:14:43 -0700 | [diff] [blame] | 1514 | |
| 1515 | ################################## |
| 1516 | include $(CLEAR_VARS) |
| 1517 | |
Martijn Coenen | 6676c23 | 2017-03-31 17:29:53 -0700 | [diff] [blame] | 1518 | LOCAL_MODULE := vndservice_contexts |
| 1519 | LOCAL_MODULE_CLASS := ETC |
| 1520 | LOCAL_MODULE_TAGS := optional |
Martijn Coenen | 6676c23 | 2017-03-31 17:29:53 -0700 | [diff] [blame] | 1521 | LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux |
Martijn Coenen | 6676c23 | 2017-03-31 17:29:53 -0700 | [diff] [blame] | 1522 | |
| 1523 | include $(BUILD_SYSTEM)/base_rules.mk |
| 1524 | |
Bowgo Tsai | afbcf21 | 2018-02-05 17:34:52 +0800 | [diff] [blame] | 1525 | vnd_svcfiles := $(call build_policy, vndservice_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY)) |
Martijn Coenen | 6676c23 | 2017-03-31 17:29:53 -0700 | [diff] [blame] | 1526 | |
| 1527 | vndservice_contexts.tmp := $(intermediates)/vndservice_contexts.tmp |
| 1528 | $(vndservice_contexts.tmp): PRIVATE_SVC_FILES := $(vnd_svcfiles) |
| 1529 | $(vndservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 1530 | $(vndservice_contexts.tmp): $(vnd_svcfiles) $(M4) |
Martijn Coenen | 6676c23 | 2017-03-31 17:29:53 -0700 | [diff] [blame] | 1531 | @mkdir -p $(dir $@) |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 1532 | $(hide) $(M4) --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@ |
Martijn Coenen | 6676c23 | 2017-03-31 17:29:53 -0700 | [diff] [blame] | 1533 | |
| 1534 | $(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) |
| 1535 | $(LOCAL_BUILT_MODULE): $(vndservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP) |
| 1536 | @mkdir -p $(dir $@) |
| 1537 | sed -e 's/#.*$$//' -e '/^$$/d' $< > $@ |
Martijn Coenen | ee97662 | 2017-04-07 10:08:55 -0700 | [diff] [blame] | 1538 | $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e -v $(PRIVATE_SEPOLICY) $@ |
Martijn Coenen | 6676c23 | 2017-03-31 17:29:53 -0700 | [diff] [blame] | 1539 | |
| 1540 | vnd_svcfiles := |
| 1541 | vndservice_contexts.tmp := |
dcashman | 90b3b94 | 2016-12-14 13:47:55 -0800 | [diff] [blame] | 1542 | |
| 1543 | ################################## |
Tri Vo | 8b3016b | 2019-01-07 16:43:31 -0800 | [diff] [blame] | 1544 | include $(LOCAL_PATH)/mac_permissions.mk |
Bowgo Tsai | af7d85f | 2017-11-29 16:06:15 +0800 | [diff] [blame] | 1545 | |
Dan Cashman | 91d398d | 2017-09-26 12:58:29 -0700 | [diff] [blame] | 1546 | ################################# |
| 1547 | include $(CLEAR_VARS) |
| 1548 | LOCAL_MODULE := sepolicy_tests |
Jooyung Han | 749cf93 | 2019-05-30 01:05:43 +0900 | [diff] [blame] | 1549 | LOCAL_MODULE_CLASS := FAKE |
| 1550 | LOCAL_MODULE_TAGS := optional |
Dan Cashman | 91d398d | 2017-09-26 12:58:29 -0700 | [diff] [blame] | 1551 | |
| 1552 | include $(BUILD_SYSTEM)/base_rules.mk |
| 1553 | |
Inseob Kim | b554e59 | 2019-04-15 20:10:46 +0900 | [diff] [blame] | 1554 | all_fc_files := $(TARGET_OUT)/etc/selinux/plat_file_contexts |
| 1555 | all_fc_files += $(TARGET_OUT_VENDOR)/etc/selinux/vendor_file_contexts |
Bowgo Tsai | ac38125 | 2019-10-04 14:34:18 +0800 | [diff] [blame] | 1556 | ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR |
Bowgo Tsai | 86a048d | 2019-09-09 22:04:06 +0800 | [diff] [blame] | 1557 | all_fc_files += $(TARGET_OUT_SYSTEM_EXT)/etc/selinux/system_ext_file_contexts |
| 1558 | endif |
Bowgo Tsai | 7c4150c | 2019-10-04 15:36:05 +0800 | [diff] [blame] | 1559 | ifdef HAS_PRODUCT_SEPOLICY_DIR |
Inseob Kim | b554e59 | 2019-04-15 20:10:46 +0900 | [diff] [blame] | 1560 | all_fc_files += $(TARGET_OUT_PRODUCT)/etc/selinux/product_file_contexts |
Tri Vo | 3361ec4 | 2018-12-18 19:51:19 -0800 | [diff] [blame] | 1561 | endif |
Bowgo Tsai | bae1517 | 2017-11-29 16:14:53 +0800 | [diff] [blame] | 1562 | ifdef BOARD_ODM_SEPOLICY_DIRS |
Inseob Kim | b554e59 | 2019-04-15 20:10:46 +0900 | [diff] [blame] | 1563 | all_fc_files += $(TARGET_OUT_ODM)/etc/selinux/odm_file_contexts |
Bowgo Tsai | bae1517 | 2017-11-29 16:14:53 +0800 | [diff] [blame] | 1564 | endif |
Bowgo Tsai | afbcf21 | 2018-02-05 17:34:52 +0800 | [diff] [blame] | 1565 | all_fc_args := $(foreach file, $(all_fc_files), -f $(file)) |
| 1566 | |
Jooyung Han | 749cf93 | 2019-05-30 01:05:43 +0900 | [diff] [blame] | 1567 | $(LOCAL_BUILT_MODULE): ALL_FC_ARGS := $(all_fc_args) |
| 1568 | $(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) |
| 1569 | $(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/sepolicy_tests $(all_fc_files) $(built_sepolicy) |
Dan Cashman | 91d398d | 2017-09-26 12:58:29 -0700 | [diff] [blame] | 1570 | @mkdir -p $(dir $@) |
Jeff Vander Stoep | 3ca843a | 2017-10-04 09:42:29 -0700 | [diff] [blame] | 1571 | $(hide) $(HOST_OUT_EXECUTABLES)/sepolicy_tests -l $(HOST_OUT)/lib64/libsepolwrap.$(SHAREDLIB_EXT) \ |
Bowgo Tsai | afbcf21 | 2018-02-05 17:34:52 +0800 | [diff] [blame] | 1572 | $(ALL_FC_ARGS) -p $(PRIVATE_SEPOLICY) |
Dan Cashman | 91d398d | 2017-09-26 12:58:29 -0700 | [diff] [blame] | 1573 | $(hide) touch $@ |
| 1574 | |
rpcraig | b19665c | 2012-07-30 09:33:03 -0400 | [diff] [blame] | 1575 | ################################## |
Tri Vo | 1406926 | 2018-01-31 16:22:35 -0800 | [diff] [blame] | 1576 | intermediates := $(call intermediates-dir-for,ETC,built_plat_sepolicy,,,,) |
Dan Cashman | 91d398d | 2017-09-26 12:58:29 -0700 | [diff] [blame] | 1577 | |
| 1578 | # plat_sepolicy - the current platform policy only, built into a policy binary. |
| 1579 | # TODO - this currently excludes partner extensions, but support should be added |
| 1580 | # to enable partners to add their own compatibility mapping |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 1581 | policy_files := $(call build_policy, $(sepolicy_build_files), \ |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 1582 | $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY)) |
Dan Cashman | 91d398d | 2017-09-26 12:58:29 -0700 | [diff] [blame] | 1583 | base_plat_policy.conf := $(intermediates)/base_plat_policy.conf |
| 1584 | $(base_plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS) |
| 1585 | $(base_plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS) |
Joel Galenson | c148621 | 2018-03-23 12:40:26 -0700 | [diff] [blame] | 1586 | $(base_plat_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := user |
Dan Cashman | 91d398d | 2017-09-26 12:58:29 -0700 | [diff] [blame] | 1587 | $(base_plat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch) |
| 1588 | $(base_plat_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) |
| 1589 | $(base_plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) |
Steven Moreland | 763697d | 2017-11-09 11:24:56 -0800 | [diff] [blame] | 1590 | $(base_plat_policy.conf): PRIVATE_SEPOLICY_SPLIT := true |
Jaekyun Seok | e497145 | 2017-10-19 16:54:49 +0900 | [diff] [blame] | 1591 | $(base_plat_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY) |
Inseob Kim | ed59c22 | 2019-09-26 15:14:55 +0900 | [diff] [blame] | 1592 | $(base_plat_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow) |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 1593 | $(base_plat_policy.conf): PRIVATE_POLICY_FILES := $(policy_files) |
| 1594 | $(base_plat_policy.conf): $(policy_files) $(M4) |
Dan Cashman | 91d398d | 2017-09-26 12:58:29 -0700 | [diff] [blame] | 1595 | $(transform-policy-to-conf) |
huangyanjun | 2509572 | 2018-09-13 14:04:19 +0800 | [diff] [blame] | 1596 | $(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit |
Dan Cashman | 91d398d | 2017-09-26 12:58:29 -0700 | [diff] [blame] | 1597 | |
| 1598 | built_plat_sepolicy := $(intermediates)/built_plat_sepolicy |
| 1599 | $(built_plat_sepolicy): PRIVATE_ADDITIONAL_CIL_FILES := \ |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 1600 | $(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY)) |
Joel Galenson | 5988b56 | 2018-01-03 16:53:24 -0800 | [diff] [blame] | 1601 | $(built_plat_sepolicy): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG) |
Dan Cashman | 91d398d | 2017-09-26 12:58:29 -0700 | [diff] [blame] | 1602 | $(built_plat_sepolicy): $(base_plat_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \ |
| 1603 | $(HOST_OUT_EXECUTABLES)/secilc \ |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 1604 | $(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY)) \ |
Joel Galenson | 5988b56 | 2018-01-03 16:53:24 -0800 | [diff] [blame] | 1605 | $(built_sepolicy_neverallows) |
Dan Cashman | 91d398d | 2017-09-26 12:58:29 -0700 | [diff] [blame] | 1606 | @mkdir -p $(dir $@) |
| 1607 | $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \ |
| 1608 | $(POLICYVERS) -o $@ $< |
| 1609 | $(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@ |
Joel Galenson | 5988b56 | 2018-01-03 16:53:24 -0800 | [diff] [blame] | 1610 | $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $@ -o $@ -f /dev/null |
Dan Cashman | 91d398d | 2017-09-26 12:58:29 -0700 | [diff] [blame] | 1611 | |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 1612 | policy_files := $(call build_policy, $(sepolicy_build_files), \ |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 1613 | $(PLAT_PUBLIC_POLICY) $(REQD_MASK_POLICY)) |
Tri Vo | e3f4f77 | 2018-09-28 17:21:08 -0700 | [diff] [blame] | 1614 | base_plat_pub_policy.conf := $(intermediates)/base_plat_pub_policy.conf |
| 1615 | $(base_plat_pub_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS) |
| 1616 | $(base_plat_pub_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS) |
| 1617 | $(base_plat_pub_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := user |
| 1618 | $(base_plat_pub_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch) |
| 1619 | $(base_plat_pub_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) |
| 1620 | $(base_plat_pub_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) |
| 1621 | $(base_plat_pub_policy.conf): PRIVATE_SEPOLICY_SPLIT := true |
| 1622 | $(base_plat_pub_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY) |
Inseob Kim | ed59c22 | 2019-09-26 15:14:55 +0900 | [diff] [blame] | 1623 | $(base_plat_pub_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow) |
Dan Willemsen | 3c3e59b | 2019-06-19 10:52:50 -0700 | [diff] [blame] | 1624 | $(base_plat_pub_policy.conf): PRIVATE_POLICY_FILES := $(policy_files) |
| 1625 | $(base_plat_pub_policy.conf): $(policy_files) $(M4) |
Tri Vo | e3f4f77 | 2018-09-28 17:21:08 -0700 | [diff] [blame] | 1626 | $(transform-policy-to-conf) |
| 1627 | |
| 1628 | base_plat_pub_policy.cil := $(intermediates)/base_plat_pub_policy.cil |
| 1629 | $(base_plat_pub_policy.cil): PRIVATE_POL_CONF := $(base_plat_pub_policy.conf) |
| 1630 | $(base_plat_pub_policy.cil): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil) |
Tri Vo | d57789f | 2018-12-17 16:35:41 -0800 | [diff] [blame] | 1631 | $(base_plat_pub_policy.cil): $(HOST_OUT_EXECUTABLES)/checkpolicy \ |
| 1632 | $(HOST_OUT_EXECUTABLES)/build_sepolicy $(base_plat_pub_policy.conf) $(reqd_policy_mask.cil) |
Tri Vo | e3f4f77 | 2018-09-28 17:21:08 -0700 | [diff] [blame] | 1633 | @mkdir -p $(dir $@) |
Tri Vo | d57789f | 2018-12-17 16:35:41 -0800 | [diff] [blame] | 1634 | $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $< -C -M -c $(POLICYVERS) -o $@ $(PRIVATE_POL_CONF) |
| 1635 | $(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) filter_out \ |
| 1636 | -f $(PRIVATE_REQD_MASK) -t $@ |
Tri Vo | e3f4f77 | 2018-09-28 17:21:08 -0700 | [diff] [blame] | 1637 | |
Steven Moreland | 1cb64c4 | 2019-09-20 11:16:29 -0700 | [diff] [blame] | 1638 | ifeq ($(PRODUCT_SEPOLICY_SPLIT),true) |
Tri Vo | 1406926 | 2018-01-31 16:22:35 -0800 | [diff] [blame] | 1639 | # Tests for Treble compatibility of current platform policy and vendor policy of |
| 1640 | # given release version. |
| 1641 | version_under_treble_tests := 26.0 |
| 1642 | include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk |
Tri Vo | 9299d93 | 2018-01-31 16:50:28 -0800 | [diff] [blame] | 1643 | version_under_treble_tests := 27.0 |
| 1644 | include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk |
Jae Shin | 1fa9634 | 2018-07-11 18:30:44 +0900 | [diff] [blame] | 1645 | version_under_treble_tests := 28.0 |
| 1646 | include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk |
Tri Vo | 50aa029 | 2019-06-01 17:04:13 -0700 | [diff] [blame] | 1647 | version_under_treble_tests := 29.0 |
| 1648 | include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk |
Steven Moreland | 1cb64c4 | 2019-09-20 11:16:29 -0700 | [diff] [blame] | 1649 | endif # PRODUCT_SEPOLICY_SPLIT |
Jae Shin | 1fa9634 | 2018-07-11 18:30:44 +0900 | [diff] [blame] | 1650 | |
Jeff Vander Stoep | 564e292 | 2019-05-02 13:48:44 -0700 | [diff] [blame] | 1651 | version_under_treble_tests := 26.0 |
| 1652 | include $(LOCAL_PATH)/compat.mk |
| 1653 | version_under_treble_tests := 27.0 |
| 1654 | include $(LOCAL_PATH)/compat.mk |
| 1655 | version_under_treble_tests := 28.0 |
| 1656 | include $(LOCAL_PATH)/compat.mk |
Tri Vo | 50aa029 | 2019-06-01 17:04:13 -0700 | [diff] [blame] | 1657 | version_under_treble_tests := 29.0 |
| 1658 | include $(LOCAL_PATH)/compat.mk |
Jeff Vander Stoep | 564e292 | 2019-05-02 13:48:44 -0700 | [diff] [blame] | 1659 | |
Dan Cashman | 91d398d | 2017-09-26 12:58:29 -0700 | [diff] [blame] | 1660 | base_plat_policy.conf := |
Tri Vo | e3f4f77 | 2018-09-28 17:21:08 -0700 | [diff] [blame] | 1661 | base_plat_pub_policy.conf := |
Dan Cashman | 91d398d | 2017-09-26 12:58:29 -0700 | [diff] [blame] | 1662 | plat_sepolicy := |
Inseob Kim | b554e59 | 2019-04-15 20:10:46 +0900 | [diff] [blame] | 1663 | all_fc_files := |
| 1664 | all_fc_args := |
Dan Cashman | 91d398d | 2017-09-26 12:58:29 -0700 | [diff] [blame] | 1665 | |
Jeff Vander Stoep | 1fc0682 | 2017-05-31 15:36:07 -0700 | [diff] [blame] | 1666 | ################################# |
Tri Vo | 81198bb | 2018-03-15 11:38:08 -0700 | [diff] [blame] | 1667 | include $(CLEAR_VARS) |
| 1668 | LOCAL_MODULE := sepolicy_freeze_test |
Jooyung Han | 749cf93 | 2019-05-30 01:05:43 +0900 | [diff] [blame] | 1669 | LOCAL_MODULE_CLASS := FAKE |
| 1670 | LOCAL_MODULE_TAGS := optional |
Tri Vo | 81198bb | 2018-03-15 11:38:08 -0700 | [diff] [blame] | 1671 | |
| 1672 | include $(BUILD_SYSTEM)/base_rules.mk |
| 1673 | |
Yiming Jing | 43e188a | 2020-10-14 20:37:13 +0000 | [diff] [blame] | 1674 | define ziplist |
| 1675 | $(if $(and $1,$2), "$(firstword $1) $(firstword $2)"\ |
| 1676 | $(call ziplist,$(wordlist 2,$(words $1),$1),$(wordlist 2,$(words $2),$2))) |
| 1677 | endef |
| 1678 | |
Tri Vo | 81198bb | 2018-03-15 11:38:08 -0700 | [diff] [blame] | 1679 | base_plat_public := $(LOCAL_PATH)/public |
| 1680 | base_plat_private := $(LOCAL_PATH)/private |
| 1681 | base_plat_public_prebuilt := \ |
| 1682 | $(LOCAL_PATH)/prebuilts/api/$(PLATFORM_SEPOLICY_VERSION)/public |
| 1683 | base_plat_private_prebuilt := \ |
| 1684 | $(LOCAL_PATH)/prebuilts/api/$(PLATFORM_SEPOLICY_VERSION)/private |
| 1685 | |
| 1686 | all_frozen_files := $(call build_policy,$(sepolicy_build_files), \ |
| 1687 | $(base_plat_public) $(base_plat_private) $(base_plat_public_prebuilt) $(base_plat_private_prebuilt)) |
| 1688 | |
| 1689 | $(LOCAL_BUILT_MODULE): PRIVATE_BASE_PLAT_PUBLIC := $(base_plat_public) |
| 1690 | $(LOCAL_BUILT_MODULE): PRIVATE_BASE_PLAT_PRIVATE := $(base_plat_private) |
| 1691 | $(LOCAL_BUILT_MODULE): PRIVATE_BASE_PLAT_PUBLIC_PREBUILT := $(base_plat_public_prebuilt) |
| 1692 | $(LOCAL_BUILT_MODULE): PRIVATE_BASE_PLAT_PRIVATE_PREBUILT := $(base_plat_private_prebuilt) |
Yiming Jing | 43e188a | 2020-10-14 20:37:13 +0000 | [diff] [blame] | 1693 | $(LOCAL_BUILT_MODULE): PRIVATE_EXTRA := $(sort $(FREEZE_TEST_EXTRA_DIRS)) |
| 1694 | $(LOCAL_BUILT_MODULE): PRIVATE_EXTRA_PREBUILT := $(sort $(FREEZE_TEST_EXTRA_PREBUILT_DIRS)) |
Tri Vo | 81198bb | 2018-03-15 11:38:08 -0700 | [diff] [blame] | 1695 | $(LOCAL_BUILT_MODULE): $(all_frozen_files) |
| 1696 | ifneq ($(PLATFORM_SEPOLICY_VERSION),$(TOT_SEPOLICY_VERSION)) |
Joel Galenson | 98f83b6 | 2018-05-22 09:22:41 -0700 | [diff] [blame] | 1697 | @diff -rq -x bug_map $(PRIVATE_BASE_PLAT_PUBLIC_PREBUILT) $(PRIVATE_BASE_PLAT_PUBLIC) |
| 1698 | @diff -rq -x bug_map $(PRIVATE_BASE_PLAT_PRIVATE_PREBUILT) $(PRIVATE_BASE_PLAT_PRIVATE) |
Yiming Jing | 43e188a | 2020-10-14 20:37:13 +0000 | [diff] [blame] | 1699 | ifneq (,$(FREEZE_TEST_EXTRA_DIRS)$(FREEZE_TEST_EXTRA_PREBUILT_DIRS)) |
| 1700 | @for pair in $(call ziplist, $(PRIVATE_EXTRA_PREBUILT), $(PRIVATE_EXTRA)); \ |
| 1701 | do diff -rq -x bug_map $$pair; done |
| 1702 | endif # (,$(FREEZE_TEST_EXTRA_DIRS)$(FREEZE_TEST_EXTRA_PREBUILT_DIRS)) |
Tri Vo | 81198bb | 2018-03-15 11:38:08 -0700 | [diff] [blame] | 1703 | endif # ($(PLATFORM_SEPOLICY_VERSION),$(TOT_SEPOLICY_VERSION)) |
| 1704 | $(hide) touch $@ |
| 1705 | |
| 1706 | base_plat_public := |
| 1707 | base_plat_private := |
| 1708 | base_plat_public_prebuilt := |
| 1709 | base_plat_private_prebuilt := |
| 1710 | all_frozen_files := |
| 1711 | |
| 1712 | ################################# |
| 1713 | |
rpcraig | 47cd396 | 2012-10-17 21:09:52 -0400 | [diff] [blame] | 1714 | |
Bowgo Tsai | afbcf21 | 2018-02-05 17:34:52 +0800 | [diff] [blame] | 1715 | build_vendor_policy := |
Bowgo Tsai | bae1517 | 2017-11-29 16:14:53 +0800 | [diff] [blame] | 1716 | build_odm_policy := |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 1717 | build_policy := |
Alex Klyubin | 8f7173b | 2017-02-25 14:47:53 -0800 | [diff] [blame] | 1718 | built_plat_cil := |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 1719 | built_system_ext_cil := |
| 1720 | built_product_cil := |
Tri Vo | e68ba59 | 2019-01-15 13:31:03 -0800 | [diff] [blame] | 1721 | built_pub_vers_cil := |
Tri Vo | 937e664 | 2019-01-15 15:16:55 -0800 | [diff] [blame] | 1722 | built_plat_mapping_cil := |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 1723 | built_system_ext_mapping_cil := |
Tri Vo | 937e664 | 2019-01-15 15:16:55 -0800 | [diff] [blame] | 1724 | built_product_mapping_cil := |
Bowgo Tsai | afbcf21 | 2018-02-05 17:34:52 +0800 | [diff] [blame] | 1725 | built_vendor_cil := |
Bowgo Tsai | 45457e3 | 2017-11-27 11:41:33 +0800 | [diff] [blame] | 1726 | built_odm_cil := |
Alex Klyubin | 193dccd | 2017-03-07 14:05:57 -0800 | [diff] [blame] | 1727 | built_precompiled_sepolicy := |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 1728 | built_sepolicy := |
Joel Galenson | 5988b56 | 2018-01-03 16:53:24 -0800 | [diff] [blame] | 1729 | built_sepolicy_neverallows := |
Sandeep Patil | a058b56 | 2016-12-27 15:10:48 -0800 | [diff] [blame] | 1730 | built_plat_svc := |
Bowgo Tsai | afbcf21 | 2018-02-05 17:34:52 +0800 | [diff] [blame] | 1731 | built_vendor_svc := |
Joel Galenson | c148621 | 2018-03-23 12:40:26 -0700 | [diff] [blame] | 1732 | built_plat_sepolicy := |
Inseob Kim | ed59c22 | 2019-09-26 15:14:55 +0900 | [diff] [blame] | 1733 | treble_sysprop_neverallow := |
Jeff Vander Stoep | b878769 | 2017-04-21 15:57:07 -0700 | [diff] [blame] | 1734 | mapping_policy := |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 1735 | my_target_arch := |
Tri Vo | e68ba59 | 2019-01-15 13:31:03 -0800 | [diff] [blame] | 1736 | pub_policy.cil := |
Bowgo Tsai | 948934b | 2019-08-29 17:12:11 +0800 | [diff] [blame] | 1737 | system_ext_pub_policy.cil := |
| 1738 | plat_pub_policy.cil := |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 1739 | reqd_policy_mask.cil := |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 1740 | sepolicy_build_files := |
Alex Klyubin | 7cda44f | 2017-03-21 14:28:53 -0700 | [diff] [blame] | 1741 | sepolicy_build_cil_workaround_files := |
Jeff Vander Stoep | 7443484 | 2017-03-13 12:22:15 -0700 | [diff] [blame] | 1742 | with_asan := |
Alice Chu | cdfb06f | 2012-11-01 11:33:04 -0700 | [diff] [blame] | 1743 | |
| 1744 | include $(call all-makefiles-under,$(LOCAL_PATH)) |