blob: a7bfd2dfa4f6bfe8428d059099fbe5f5efa26c62 [file] [log] [blame]
Steven Moreland65b3fd92017-12-06 14:18:35 -08001// Copyright 2017 Google Inc. All rights reserved.
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7// http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15package android
16
17import (
Liz Kammera3d79152021-10-28 18:14:04 -040018 "fmt"
Steven Moreland65b3fd92017-12-06 14:18:35 -080019 "path/filepath"
20 "reflect"
Anton Hansson45376402020-04-09 14:18:21 +010021 "regexp"
Steven Moreland65b3fd92017-12-06 14:18:35 -080022 "strconv"
23 "strings"
24
25 "github.com/google/blueprint/proptools"
26)
27
28// "neverallow" rules for the build system.
29//
30// This allows things which aren't related to the build system and are enforced
Joe Onoratob4638c12021-10-27 15:47:06 -070031// against assumptions, in progress code refactors, or policy to be expressed in a
Steven Moreland65b3fd92017-12-06 14:18:35 -080032// straightforward away disjoint from implementations and tests which should
33// work regardless of these restrictions.
34//
35// A module is disallowed if all of the following are true:
Paul Duffin730f2a52019-06-27 14:08:51 +010036// - it is in one of the "In" paths
37// - it is not in one of the "NotIn" paths
38// - it has all "With" properties matched
Steven Moreland65b3fd92017-12-06 14:18:35 -080039// - - values are matched in their entirety
40// - - nil is interpreted as an empty string
41// - - nested properties are separated with a '.'
42// - - if the property is a list, any of the values in the list being matches
43// counts as a match
Paul Duffin730f2a52019-06-27 14:08:51 +010044// - it has none of the "Without" properties matched (same rules as above)
Steven Moreland65b3fd92017-12-06 14:18:35 -080045
Paul Duffin45338f02021-03-30 23:07:52 +010046func registerNeverallowMutator(ctx RegisterMutatorsContext) {
Colin Cross8a962802024-10-09 15:29:27 -070047 ctx.BottomUp("neverallow", neverallowMutator)
Steven Moreland65b3fd92017-12-06 14:18:35 -080048}
49
Paul Duffin730f2a52019-06-27 14:08:51 +010050var neverallows = []Rule{}
Steven Moreland65b3fd92017-12-06 14:18:35 -080051
Paul Duffin730f2a52019-06-27 14:08:51 +010052func init() {
Paul Duffinc8111702019-07-22 12:13:55 +010053 AddNeverAllowRules(createIncludeDirsRules()...)
Paul Duffin730f2a52019-06-27 14:08:51 +010054 AddNeverAllowRules(createTrebleRules()...)
Paul Duffin730f2a52019-06-27 14:08:51 +010055 AddNeverAllowRules(createJavaDeviceForHostRules()...)
Colin Crossc511bc52020-04-07 16:50:32 +000056 AddNeverAllowRules(createCcSdkVariantRules()...)
David Srbeckye033cba2020-05-20 22:20:28 +010057 AddNeverAllowRules(createUncompressDexRules()...)
Nelson Li43808202024-11-20 09:05:53 +000058 AddNeverAllowRules(createInstallInRootAllowingRules()...)
Jiyong Park3c306f32022-04-05 15:29:53 +090059 AddNeverAllowRules(createProhibitFrameworkAccessRules()...)
Alan Stokes73feba32022-11-14 12:21:24 +000060 AddNeverAllowRules(createCcStubsRule())
Mark Whitea15790a2023-08-22 21:28:11 +000061 AddNeverAllowRules(createProhibitHeaderOnlyRule())
Steven Moreland0db999c2024-09-03 22:06:24 +000062 AddNeverAllowRules(createLimitNdkExportRule()...)
Alyssa Haroldsenca3a0042025-03-08 00:56:45 +000063 AddNeverAllowRules(createLimitDirgroupRules()...)
64 AddNeverAllowRules(createLimitGenruleRules()...)
Jihoon Kang0d545b82024-10-11 00:21:57 +000065 AddNeverAllowRules(createFilesystemIsAutoGeneratedRule())
Luca Stefani50098f72024-10-12 17:55:31 +020066 AddNeverAllowRules(createKotlinPluginRule()...)
Jihoon Kang2a7bf752024-11-01 21:21:25 +000067 AddNeverAllowRules(createPrebuiltEtcBpDefineRule())
Spandan Dase2f98da2024-11-18 19:22:39 +000068 AddNeverAllowRules(createAutogenRroBpDefineRule())
Nikita Ioffe50fb49c2025-01-24 13:49:00 +000069 AddNeverAllowRules(createNoSha1HashRule())
Neil Fullerdf5f3562018-10-21 17:19:10 +010070}
Steven Moreland65b3fd92017-12-06 14:18:35 -080071
Paul Duffin730f2a52019-06-27 14:08:51 +010072// Add a NeverAllow rule to the set of rules to apply.
73func AddNeverAllowRules(rules ...Rule) {
74 neverallows = append(neverallows, rules...)
75}
76
Sam Delmerico46d08b42022-11-15 15:51:04 -050077var (
78 neverallowNotInIncludeDir = []string{
Paul Duffinc8111702019-07-22 12:13:55 +010079 "art",
Orion Hodson6341f012019-11-06 13:39:46 +000080 "art/libnativebridge",
81 "art/libnativeloader",
Paul Duffinc8111702019-07-22 12:13:55 +010082 "libcore",
83 "libnativehelper",
84 "external/apache-harmony",
85 "external/apache-xml",
86 "external/boringssl",
87 "external/bouncycastle",
88 "external/conscrypt",
89 "external/icu",
90 "external/okhttp",
91 "external/vixl",
92 "external/wycheproof",
Paul Duffinc8111702019-07-22 12:13:55 +010093 }
Sam Delmerico46d08b42022-11-15 15:51:04 -050094 neverallowNoUseIncludeDir = []string{
Steven Morelandf36a3ac2021-04-27 18:03:14 +000095 "frameworks/av/apex",
96 "frameworks/av/tools",
97 "frameworks/native/cmds",
98 "system/apex",
99 "system/bpf",
100 "system/gatekeeper",
101 "system/hwservicemanager",
102 "system/libbase",
Steven Moreland8fc8dbf2021-04-27 02:31:07 +0000103 "system/libfmq",
Steven Morelandf36a3ac2021-04-27 18:03:14 +0000104 "system/libvintf",
Steven Moreland8fc8dbf2021-04-27 02:31:07 +0000105 }
Sam Delmerico46d08b42022-11-15 15:51:04 -0500106)
Paul Duffinc8111702019-07-22 12:13:55 +0100107
Sam Delmerico46d08b42022-11-15 15:51:04 -0500108func createIncludeDirsRules() []Rule {
109 rules := make([]Rule, 0, len(neverallowNotInIncludeDir)+len(neverallowNoUseIncludeDir))
Steven Moreland8fc8dbf2021-04-27 02:31:07 +0000110
Sam Delmerico46d08b42022-11-15 15:51:04 -0500111 for _, path := range neverallowNotInIncludeDir {
Paul Duffinc8111702019-07-22 12:13:55 +0100112 rule :=
113 NeverAllow().
114 WithMatcher("include_dirs", StartsWith(path+"/")).
115 Because("include_dirs is deprecated, all usages of '" + path + "' have been migrated" +
116 " to use alternate mechanisms and so can no longer be used.")
117
118 rules = append(rules, rule)
119 }
120
Sam Delmerico46d08b42022-11-15 15:51:04 -0500121 for _, path := range neverallowNoUseIncludeDir {
Steven Moreland8fc8dbf2021-04-27 02:31:07 +0000122 rule := NeverAllow().In(path+"/").WithMatcher("include_dirs", isSetMatcherInstance).
123 Because("include_dirs is deprecated, all usages of them in '" + path + "' have been migrated" +
124 " to use alternate mechanisms and so can no longer be used.")
125 rules = append(rules, rule)
126 }
127
Paul Duffinc8111702019-07-22 12:13:55 +0100128 return rules
129}
130
Paul Duffin730f2a52019-06-27 14:08:51 +0100131func createTrebleRules() []Rule {
132 return []Rule{
133 NeverAllow().
134 In("vendor", "device").
135 With("vndk.enabled", "true").
136 Without("vendor", "true").
Justin Yun0ecf0b22020-02-28 15:07:59 +0900137 Without("product_specific", "true").
Paul Duffin730f2a52019-06-27 14:08:51 +0100138 Because("the VNDK can never contain a library that is device dependent."),
139 NeverAllow().
140 With("vndk.enabled", "true").
141 Without("vendor", "true").
142 Without("owner", "").
143 Because("a VNDK module can never have an owner."),
Steven Moreland65b3fd92017-12-06 14:18:35 -0800144
Neil Fullerdf5f3562018-10-21 17:19:10 +0100145 // TODO(b/67974785): always enforce the manifest
Paul Duffin730f2a52019-06-27 14:08:51 +0100146 NeverAllow().
Steven Moreland51ce4f62020-02-10 17:21:32 -0800147 Without("name", "libhidlbase-combined-impl").
148 Without("name", "libhidlbase").
Paul Duffin730f2a52019-06-27 14:08:51 +0100149 With("product_variables.enforce_vintf_manifest.cflags", "*").
150 Because("manifest enforcement should be independent of ."),
Neil Fullerdf5f3562018-10-21 17:19:10 +0100151
152 // TODO(b/67975799): vendor code should always use /vendor/bin/sh
Paul Duffin730f2a52019-06-27 14:08:51 +0100153 NeverAllow().
154 Without("name", "libc_bionic_ndk").
155 With("product_variables.treble_linker_namespaces.cflags", "*").
156 Because("nothing should care if linker namespaces are enabled or not"),
Neil Fullerdf5f3562018-10-21 17:19:10 +0100157
158 // Example:
Paul Duffin730f2a52019-06-27 14:08:51 +0100159 // *NeverAllow().with("Srcs", "main.cpp"))
Neil Fullerdf5f3562018-10-21 17:19:10 +0100160 }
161}
162
Paul Duffin730f2a52019-06-27 14:08:51 +0100163func createJavaDeviceForHostRules() []Rule {
Colin Cross440e0d02020-06-11 11:32:11 -0700164 javaDeviceForHostProjectsAllowedList := []string{
Dan Willemsen9fe14102021-07-13 21:52:04 -0700165 "development/build",
Colin Crossb5191a52019-04-11 14:07:38 -0700166 "external/guava",
Steve Elliott8053f822022-10-18 17:09:28 -0400167 "external/kotlinx.coroutines",
Colin Crossfd4f7432019-03-05 15:06:16 -0800168 "external/robolectric-shadows",
Rex Hoffman54641d22022-08-25 17:29:50 +0000169 "external/robolectric",
Makoto Onukib66bba32023-11-11 00:06:09 +0000170 "frameworks/base/ravenwood",
171 "frameworks/base/tools/hoststubgen",
Jerome Gaillard655ee022021-09-23 11:38:08 +0000172 "frameworks/layoutlib",
Colin Crossfd4f7432019-03-05 15:06:16 -0800173 }
174
Paul Duffin730f2a52019-06-27 14:08:51 +0100175 return []Rule{
176 NeverAllow().
Colin Cross440e0d02020-06-11 11:32:11 -0700177 NotIn(javaDeviceForHostProjectsAllowedList...).
Paul Duffin730f2a52019-06-27 14:08:51 +0100178 ModuleType("java_device_for_host", "java_host_for_device").
Colin Cross440e0d02020-06-11 11:32:11 -0700179 Because("java_device_for_host can only be used in allowed projects"),
Colin Crossfd4f7432019-03-05 15:06:16 -0800180 }
181}
182
Colin Crossc511bc52020-04-07 16:50:32 +0000183func createCcSdkVariantRules() []Rule {
Colin Cross440e0d02020-06-11 11:32:11 -0700184 sdkVersionOnlyAllowedList := []string{
Colin Crossc511bc52020-04-07 16:50:32 +0000185 // derive_sdk_prefer32 has stem: "derive_sdk" which conflicts with the derive_sdk.
186 // This sometimes works because the APEX modules that contain derive_sdk and
187 // derive_sdk_prefer32 suppress the platform installation rules, but fails when
188 // the APEX modules contain the SDK variant and the platform variant still exists.
Anton Hansson4b8e64b2020-05-27 18:25:23 +0100189 "packages/modules/SdkExtensions/derive_sdk",
Dan Alberte2054a92020-04-20 14:46:47 -0700190 // These are for apps and shouldn't be used by non-SDK variant modules.
191 "prebuilts/ndk",
Jiyong Parka574d532024-08-28 18:06:43 +0900192 "frameworks/native/libs/binder/ndk",
Dan Alberte2054a92020-04-20 14:46:47 -0700193 "tools/test/graphicsbenchmark/apps/sample_app",
194 "tools/test/graphicsbenchmark/functional_tests/java",
Dan Albert55576052020-04-20 14:46:47 -0700195 "vendor/xts/gts-tests/hostsidetests/gamedevicecert/apps/javatests",
Chang Li66d3cb72021-06-18 14:04:50 +0000196 "external/libtextclassifier/native",
Colin Crossc511bc52020-04-07 16:50:32 +0000197 }
198
Colin Cross440e0d02020-06-11 11:32:11 -0700199 platformVariantPropertiesAllowedList := []string{
Colin Crossc511bc52020-04-07 16:50:32 +0000200 // android_native_app_glue and libRSSupport use native_window.h but target old
201 // sdk versions (minimum and 9 respectively) where libnativewindow didn't exist,
202 // so they can't add libnativewindow to shared_libs to get the header directory
203 // for the platform variant. Allow them to use the platform variant
204 // property to set shared_libs.
205 "prebuilts/ndk",
206 "frameworks/rs",
207 }
208
209 return []Rule{
210 NeverAllow().
Colin Cross440e0d02020-06-11 11:32:11 -0700211 NotIn(sdkVersionOnlyAllowedList...).
Colin Crossc511bc52020-04-07 16:50:32 +0000212 WithMatcher("sdk_variant_only", isSetMatcherInstance).
Colin Cross440e0d02020-06-11 11:32:11 -0700213 Because("sdk_variant_only can only be used in allowed projects"),
Colin Crossc511bc52020-04-07 16:50:32 +0000214 NeverAllow().
Colin Cross440e0d02020-06-11 11:32:11 -0700215 NotIn(platformVariantPropertiesAllowedList...).
Colin Crossc511bc52020-04-07 16:50:32 +0000216 WithMatcher("platform.shared_libs", isSetMatcherInstance).
Colin Cross440e0d02020-06-11 11:32:11 -0700217 Because("platform variant properties can only be used in allowed projects"),
Colin Crossc511bc52020-04-07 16:50:32 +0000218 }
219}
220
Alan Stokes73feba32022-11-14 12:21:24 +0000221func createCcStubsRule() Rule {
222 ccStubsImplementationInstallableProjectsAllowedList := []string{
Jiyong Parkf6736c72024-07-22 11:22:35 +0900223 "packages/modules/Virtualization/libs/libvm_payload",
Alan Stokes73feba32022-11-14 12:21:24 +0000224 }
225
226 return NeverAllow().
227 NotIn(ccStubsImplementationInstallableProjectsAllowedList...).
228 WithMatcher("stubs.implementation_installable", isSetMatcherInstance).
229 Because("implementation_installable can only be used in allowed projects.")
230}
231
David Srbeckye033cba2020-05-20 22:20:28 +0100232func createUncompressDexRules() []Rule {
233 return []Rule{
234 NeverAllow().
Jiakai Zhang8e7b98c2025-01-08 14:16:52 +0000235 NotIn("art", "cts/hostsidetests/compilation").
David Srbeckye033cba2020-05-20 22:20:28 +0100236 WithMatcher("uncompress_dex", isSetMatcherInstance).
237 Because("uncompress_dex is only allowed for certain jars for test in art."),
238 }
239}
240
Nelson Li43808202024-11-20 09:05:53 +0000241func createInstallInRootAllowingRules() []Rule {
Inseob Kim800d1142021-06-14 12:03:51 +0900242 return []Rule{
243 NeverAllow().
Nikita Ioffe11a9c2c2023-06-21 16:51:09 +0100244 Without("name", "init_first_stage_defaults").
Inseob Kim800d1142021-06-14 12:03:51 +0900245 Without("name", "init_first_stage").
Nikita Ioffe11a9c2c2023-06-21 16:51:09 +0100246 Without("name", "init_first_stage.microdroid").
Nelson Li43808202024-11-20 09:05:53 +0000247 Without("name", "librecovery_ui_ext").
Inseob Kim800d1142021-06-14 12:03:51 +0900248 With("install_in_root", "true").
Inseob Kimbe6a66d2024-07-11 15:43:44 +0900249 NotModuleType("prebuilt_root").
Jihoon Kang320ca7c2024-12-03 18:14:50 +0000250 NotModuleType("prebuilt_vendor").
251 NotModuleType("prebuilt_sbin").
252 NotModuleType("prebuilt_system").
253 NotModuleType("prebuilt_first_stage_ramdisk").
Jihoon Kang96f38d22024-12-03 23:17:55 +0000254 NotModuleType("prebuilt_res").
Nelson Li43808202024-11-20 09:05:53 +0000255 Because("install_in_root is only for init_first_stage or librecovery_ui_ext."),
Inseob Kim800d1142021-06-14 12:03:51 +0900256 }
257}
258
Jiyong Park3c306f32022-04-05 15:29:53 +0900259func createProhibitFrameworkAccessRules() []Rule {
260 return []Rule{
261 NeverAllow().
262 With("libs", "framework").
263 WithoutMatcher("sdk_version", Regexp("(core_.*|^$)")).
264 Because("framework can't be used when building against SDK"),
265 }
266}
267
Mark Whitea15790a2023-08-22 21:28:11 +0000268func createProhibitHeaderOnlyRule() Rule {
269 return NeverAllow().
270 Without("name", "framework-minus-apex-headers").
271 With("headers_only", "true").
272 Because("headers_only can only be used for generating framework-minus-apex headers for non-updatable modules")
273}
274
Steven Moreland0db999c2024-09-03 22:06:24 +0000275func createLimitNdkExportRule() []Rule {
276 reason := "If the headers you're trying to export are meant to be a part of the NDK, they should be exposed by an ndk_headers module. If the headers shouldn't be a part of the NDK, the headers should instead be exposed from a separate `cc_library_headers` which consumers depend on."
277 // DO NOT ADD HERE - please consult danalbert@
278 // b/357711733
279 return []Rule{
280 NeverAllow().
281 NotIn("frameworks/native/libs/binder/ndk").
282 ModuleType("ndk_library").
283 WithMatcher("export_header_libs", isSetMatcherInstance).Because(reason),
284 NeverAllow().ModuleType("ndk_library").WithMatcher("export_generated_headers", isSetMatcherInstance).Because(reason),
285 NeverAllow().ModuleType("ndk_library").WithMatcher("export_include_dirs", isSetMatcherInstance).Because(reason),
286 NeverAllow().ModuleType("ndk_library").WithMatcher("export_shared_lib_headers", isSetMatcherInstance).Because(reason),
287 NeverAllow().ModuleType("ndk_library").WithMatcher("export_static_lib_headers", isSetMatcherInstance).Because(reason),
288 }
289}
290
Alyssa Haroldsenca3a0042025-03-08 00:56:45 +0000291func createLimitDirgroupRules() []Rule {
292 reason := "The dirgroup module can only be used with Trusty visibility"
293 scriptsDirsList := []string{"//trusty/vendor/google/aosp/scripts", "//trusty/vendor/google/proprietary/scripts"}
Inseob Kim76e19852024-10-10 17:57:22 +0900294 return []Rule{
295 NeverAllow().
296 ModuleType("dirgroup").
Alyssa Haroldsenca3a0042025-03-08 00:56:45 +0000297 WithMatcher("visibility", NotInList(scriptsDirsList)).Because(reason),
Inseob Kim76e19852024-10-10 17:57:22 +0900298 NeverAllow().
299 ModuleType("dirgroup").
Alyssa Haroldsenca3a0042025-03-08 00:56:45 +0000300 WithoutMatcher("visibility", InAllowedList(scriptsDirsList)).Because(reason),
301 }
302}
303
304func createLimitGenruleRules() []Rule {
305 dirSrcsReason := "The `dir_srcs` property in a `genrule` module can only be used by Trusty"
306 keepGendirReason := "The `keep_gendir` property in a `genrule` module can only be used by Trusty"
307 allowedModuleNameList := []string{
308 // Trusty TEE target names
309 "trusty_tee_package_goog",
310 "trusty_tee_package",
311 // Trusty vm target names
312 "trusty_test_vm_arm64.bin",
313 "trusty_test_vm_x86_64.elf",
314 "trusty_test_vm_os_arm64.bin",
315 "trusty_test_vm_os_x86_64.elf",
316 "trusty_security_vm_arm64.bin",
317 "trusty_security_vm_x86_64.elf",
318 "trusty_widevine_vm_arm64.bin",
319 "trusty_widevine_vm_x86_64.elf",
320 }
321 return []Rule{
Inseob Kim76e19852024-10-10 17:57:22 +0900322 NeverAllow().
323 ModuleType("genrule").
Alyssa Haroldsenca3a0042025-03-08 00:56:45 +0000324 WithoutMatcher("name", InAllowedList(allowedModuleNameList)).
325 WithMatcher("dir_srcs", isSetMatcherInstance).Because(dirSrcsReason),
Inseob Kim7195b062024-11-29 15:40:49 +0900326 NeverAllow().
327 ModuleType("genrule").
Alyssa Haroldsenca3a0042025-03-08 00:56:45 +0000328 WithoutMatcher("name", InAllowedList(allowedModuleNameList)).
329 With("keep_gendir", "true").Because(keepGendirReason),
Inseob Kim76e19852024-10-10 17:57:22 +0900330 }
331}
332
Jihoon Kang0d545b82024-10-11 00:21:57 +0000333func createFilesystemIsAutoGeneratedRule() Rule {
334 return NeverAllow().
335 NotIn("build/soong/fsgen").
336 ModuleType("filesystem", "android_system_image").
337 WithMatcher("is_auto_generated", isSetMatcherInstance).
338 Because("is_auto_generated property is only allowed for filesystem modules in build/soong/fsgen directory")
339}
340
Nikita Ioffe50fb49c2025-01-24 13:49:00 +0000341func createNoSha1HashRule() Rule {
342 return NeverAllow().
343 ModuleType("filesystem", "android_filesystem").
344 ModuleType("filesystem", "android_system_image").
345 With("avb_hash_algorithm", "sha1").
346 Because("sha1 is discouraged")
347}
348
Luca Stefani50098f72024-10-12 17:55:31 +0200349func createKotlinPluginRule() []Rule {
350 kotlinPluginProjectsAllowedList := []string{
Luca Stefani50098f72024-10-12 17:55:31 +0200351 "external/kotlinc",
352 }
353
354 return []Rule{
355 NeverAllow().
356 NotIn(kotlinPluginProjectsAllowedList...).
357 ModuleType("kotlin_plugin").
358 Because("kotlin_plugin can only be used in allowed projects"),
359 }
360}
361
Jihoon Kang2a7bf752024-11-01 21:21:25 +0000362// These module types are introduced to convert PRODUCT_COPY_FILES to Soong,
363// and is only intended to be used by filesystem_creator.
364func createPrebuiltEtcBpDefineRule() Rule {
365 return NeverAllow().
366 ModuleType(
367 "prebuilt_usr_srec",
368 "prebuilt_priv_app",
369 "prebuilt_rfs",
370 "prebuilt_framework",
Jihoon Kang2a7bf752024-11-01 21:21:25 +0000371 "prebuilt_wlc_upt",
372 "prebuilt_odm",
Jihoon Kang2e2b7442024-11-05 00:26:20 +0000373 "prebuilt_vendor_dlkm",
374 "prebuilt_bt_firmware",
Jihoon Kangdca2f2b2024-11-06 18:43:19 +0000375 "prebuilt_tvservice",
376 "prebuilt_optee",
Jihoon Kangecf76dd2024-11-12 05:24:46 +0000377 "prebuilt_tvconfig",
Jihoon Kang3ca07a12024-12-02 19:14:30 +0000378 "prebuilt_vendor",
Jihoon Kang320ca7c2024-12-03 18:14:50 +0000379 "prebuilt_sbin",
380 "prebuilt_system",
381 "prebuilt_first_stage_ramdisk",
Michael Bestas137fab42025-03-08 20:44:34 +0200382 "prebuilt_radio",
Luca Stefani04812eb2025-03-09 12:41:06 +0100383 "prebuilt_gpu",
Jihoon Kang2a7bf752024-11-01 21:21:25 +0000384 ).
385 DefinedInBpFile().
386 Because("module type not allowed to be defined in bp file")
387}
388
Spandan Dase2f98da2024-11-18 19:22:39 +0000389func createAutogenRroBpDefineRule() Rule {
390 return NeverAllow().
391 ModuleType(
392 "autogen_runtime_resource_overlay",
393 ).
394 DefinedInBpFile().
395 Because("Module type will be autogenerated by soong. Use runtime_resource_overlay instead")
396}
397
Steven Moreland65b3fd92017-12-06 14:18:35 -0800398func neverallowMutator(ctx BottomUpMutatorContext) {
399 m, ok := ctx.Module().(Module)
400 if !ok {
401 return
402 }
403
404 dir := ctx.ModuleDir() + "/"
405 properties := m.GetProperties()
406
Paul Duffinf1c9bbe2019-07-26 10:48:06 +0100407 osClass := ctx.Module().Target().Os.Class
408
Paul Duffin115445b2019-08-07 15:31:07 +0100409 for _, r := range neverallowRules(ctx.Config()) {
Paul Duffin730f2a52019-06-27 14:08:51 +0100410 n := r.(*rule)
Steven Moreland65b3fd92017-12-06 14:18:35 -0800411 if !n.appliesToPath(dir) {
412 continue
413 }
414
Cole Faust55c03f02025-03-10 15:52:36 -0700415 modType := proptools.StringDefault(m.base().baseProperties.Soong_config_base_module_type, ctx.ModuleType())
416 if !n.appliesToModuleType(modType) {
Colin Crossfd4f7432019-03-05 15:06:16 -0800417 continue
418 }
419
Cole Faust5b35cb92024-08-27 15:47:06 -0700420 if !n.appliesToProperties(ctx, properties) {
Steven Moreland65b3fd92017-12-06 14:18:35 -0800421 continue
422 }
423
Paul Duffinf1c9bbe2019-07-26 10:48:06 +0100424 if !n.appliesToOsClass(osClass) {
425 continue
426 }
427
Paul Duffin35781882019-07-25 15:41:09 +0100428 if !n.appliesToDirectDeps(ctx) {
429 continue
430 }
431
Jihoon Kang2a7bf752024-11-01 21:21:25 +0000432 if !n.appliesToBpDefinedModule(ctx) {
433 continue
434 }
435
Steven Moreland65b3fd92017-12-06 14:18:35 -0800436 ctx.ModuleErrorf("violates " + n.String())
437 }
438}
439
Paul Duffin73bf0542019-07-12 14:12:49 +0100440type ValueMatcher interface {
Anton Hanssone1b18362021-12-23 15:05:38 +0000441 Test(string) bool
Paul Duffin73bf0542019-07-12 14:12:49 +0100442 String() string
443}
444
445type equalMatcher struct {
446 expected string
447}
448
Anton Hanssone1b18362021-12-23 15:05:38 +0000449func (m *equalMatcher) Test(value string) bool {
Paul Duffin73bf0542019-07-12 14:12:49 +0100450 return m.expected == value
451}
452
453func (m *equalMatcher) String() string {
454 return "=" + m.expected
455}
456
457type anyMatcher struct {
458}
459
Anton Hanssone1b18362021-12-23 15:05:38 +0000460func (m *anyMatcher) Test(value string) bool {
Paul Duffin73bf0542019-07-12 14:12:49 +0100461 return true
462}
463
464func (m *anyMatcher) String() string {
465 return "=*"
466}
467
468var anyMatcherInstance = &anyMatcher{}
469
Paul Duffinc8111702019-07-22 12:13:55 +0100470type startsWithMatcher struct {
471 prefix string
472}
473
Anton Hanssone1b18362021-12-23 15:05:38 +0000474func (m *startsWithMatcher) Test(value string) bool {
Paul Duffinc8111702019-07-22 12:13:55 +0100475 return strings.HasPrefix(value, m.prefix)
476}
477
478func (m *startsWithMatcher) String() string {
479 return ".starts-with(" + m.prefix + ")"
480}
481
Anton Hansson45376402020-04-09 14:18:21 +0100482type regexMatcher struct {
483 re *regexp.Regexp
484}
485
Anton Hanssone1b18362021-12-23 15:05:38 +0000486func (m *regexMatcher) Test(value string) bool {
Anton Hansson45376402020-04-09 14:18:21 +0100487 return m.re.MatchString(value)
488}
489
490func (m *regexMatcher) String() string {
491 return ".regexp(" + m.re.String() + ")"
492}
493
Andrei Onea115e7e72020-06-05 21:14:03 +0100494type notInListMatcher struct {
495 allowed []string
496}
497
Anton Hanssone1b18362021-12-23 15:05:38 +0000498func (m *notInListMatcher) Test(value string) bool {
Andrei Onea115e7e72020-06-05 21:14:03 +0100499 return !InList(value, m.allowed)
500}
501
502func (m *notInListMatcher) String() string {
503 return ".not-in-list(" + strings.Join(m.allowed, ",") + ")"
504}
505
Orlando Arbildo47afbdd2025-01-08 00:27:37 +0000506type InListMatcher struct {
507 allowed []string
508}
509
510func (m *InListMatcher) Test(value string) bool {
511 return InList(value, m.allowed)
512}
513
514func (m *InListMatcher) String() string {
515 return ".in-list(" + strings.Join(m.allowed, ",") + ")"
516}
517
Colin Crossc511bc52020-04-07 16:50:32 +0000518type isSetMatcher struct{}
519
Anton Hanssone1b18362021-12-23 15:05:38 +0000520func (m *isSetMatcher) Test(value string) bool {
Colin Crossc511bc52020-04-07 16:50:32 +0000521 return value != ""
522}
523
524func (m *isSetMatcher) String() string {
525 return ".is-set"
526}
527
528var isSetMatcherInstance = &isSetMatcher{}
529
Steven Moreland65b3fd92017-12-06 14:18:35 -0800530type ruleProperty struct {
Paul Duffin73bf0542019-07-12 14:12:49 +0100531 fields []string // e.x.: Vndk.Enabled
532 matcher ValueMatcher
Steven Moreland65b3fd92017-12-06 14:18:35 -0800533}
534
Liz Kammera3d79152021-10-28 18:14:04 -0400535func (r *ruleProperty) String() string {
536 return fmt.Sprintf("%q matches: %s", strings.Join(r.fields, "."), r.matcher)
537}
538
539type ruleProperties []ruleProperty
540
541func (r ruleProperties) String() string {
542 var s []string
543 for _, r := range r {
544 s = append(s, r.String())
545 }
546 return strings.Join(s, " ")
547}
548
Paul Duffin730f2a52019-06-27 14:08:51 +0100549// A NeverAllow rule.
550type Rule interface {
551 In(path ...string) Rule
552
553 NotIn(path ...string) Rule
554
Paul Duffin35781882019-07-25 15:41:09 +0100555 InDirectDeps(deps ...string) Rule
556
Paul Duffinf1c9bbe2019-07-26 10:48:06 +0100557 WithOsClass(osClasses ...OsClass) Rule
558
Paul Duffin730f2a52019-06-27 14:08:51 +0100559 ModuleType(types ...string) Rule
560
561 NotModuleType(types ...string) Rule
562
563 With(properties, value string) Rule
564
Paul Duffinc8111702019-07-22 12:13:55 +0100565 WithMatcher(properties string, matcher ValueMatcher) Rule
566
Paul Duffin730f2a52019-06-27 14:08:51 +0100567 Without(properties, value string) Rule
568
Paul Duffinc8111702019-07-22 12:13:55 +0100569 WithoutMatcher(properties string, matcher ValueMatcher) Rule
570
Jihoon Kang2a7bf752024-11-01 21:21:25 +0000571 DefinedInBpFile() Rule
572
Paul Duffin730f2a52019-06-27 14:08:51 +0100573 Because(reason string) Rule
574}
575
Steven Moreland65b3fd92017-12-06 14:18:35 -0800576type rule struct {
577 // User string for why this is a thing.
578 reason string
579
580 paths []string
581 unlessPaths []string
582
Paul Duffin35781882019-07-25 15:41:09 +0100583 directDeps map[string]bool
584
Paul Duffinf1c9bbe2019-07-26 10:48:06 +0100585 osClasses []OsClass
586
Colin Crossfd4f7432019-03-05 15:06:16 -0800587 moduleTypes []string
588 unlessModuleTypes []string
589
Liz Kammera3d79152021-10-28 18:14:04 -0400590 props ruleProperties
591 unlessProps ruleProperties
Andrei Onea115e7e72020-06-05 21:14:03 +0100592
593 onlyBootclasspathJar bool
Jihoon Kang2a7bf752024-11-01 21:21:25 +0000594
595 definedInBp bool
Steven Moreland65b3fd92017-12-06 14:18:35 -0800596}
597
Paul Duffin730f2a52019-06-27 14:08:51 +0100598// Create a new NeverAllow rule.
599func NeverAllow() Rule {
Paul Duffin35781882019-07-25 15:41:09 +0100600 return &rule{directDeps: make(map[string]bool)}
Steven Moreland65b3fd92017-12-06 14:18:35 -0800601}
Colin Crossfd4f7432019-03-05 15:06:16 -0800602
Liz Kammera3d79152021-10-28 18:14:04 -0400603// In adds path(s) where this rule applies.
Paul Duffin730f2a52019-06-27 14:08:51 +0100604func (r *rule) In(path ...string) Rule {
Steven Moreland65b3fd92017-12-06 14:18:35 -0800605 r.paths = append(r.paths, cleanPaths(path)...)
606 return r
607}
Colin Crossfd4f7432019-03-05 15:06:16 -0800608
Liz Kammera3d79152021-10-28 18:14:04 -0400609// NotIn adds path(s) to that this rule does not apply to.
Paul Duffin730f2a52019-06-27 14:08:51 +0100610func (r *rule) NotIn(path ...string) Rule {
Steven Moreland65b3fd92017-12-06 14:18:35 -0800611 r.unlessPaths = append(r.unlessPaths, cleanPaths(path)...)
612 return r
613}
Colin Crossfd4f7432019-03-05 15:06:16 -0800614
Liz Kammera3d79152021-10-28 18:14:04 -0400615// InDirectDeps adds dep(s) that are not allowed with this rule.
Paul Duffin35781882019-07-25 15:41:09 +0100616func (r *rule) InDirectDeps(deps ...string) Rule {
617 for _, d := range deps {
618 r.directDeps[d] = true
619 }
620 return r
621}
622
Liz Kammera3d79152021-10-28 18:14:04 -0400623// WithOsClass adds osClass(es) that this rule applies to.
Paul Duffinf1c9bbe2019-07-26 10:48:06 +0100624func (r *rule) WithOsClass(osClasses ...OsClass) Rule {
625 r.osClasses = append(r.osClasses, osClasses...)
626 return r
627}
628
Liz Kammera3d79152021-10-28 18:14:04 -0400629// ModuleType adds type(s) that this rule applies to.
Paul Duffin730f2a52019-06-27 14:08:51 +0100630func (r *rule) ModuleType(types ...string) Rule {
Colin Crossfd4f7432019-03-05 15:06:16 -0800631 r.moduleTypes = append(r.moduleTypes, types...)
632 return r
633}
634
Liz Kammera3d79152021-10-28 18:14:04 -0400635// NotModuleType adds type(s) that this rule does not apply to..
Paul Duffin730f2a52019-06-27 14:08:51 +0100636func (r *rule) NotModuleType(types ...string) Rule {
Colin Crossfd4f7432019-03-05 15:06:16 -0800637 r.unlessModuleTypes = append(r.unlessModuleTypes, types...)
638 return r
639}
640
Liz Kammera3d79152021-10-28 18:14:04 -0400641// With specifies property/value combinations that are restricted for this rule.
Paul Duffin730f2a52019-06-27 14:08:51 +0100642func (r *rule) With(properties, value string) Rule {
Paul Duffinc8111702019-07-22 12:13:55 +0100643 return r.WithMatcher(properties, selectMatcher(value))
644}
645
Liz Kammera3d79152021-10-28 18:14:04 -0400646// WithMatcher specifies property/matcher combinations that are restricted for this rule.
Paul Duffinc8111702019-07-22 12:13:55 +0100647func (r *rule) WithMatcher(properties string, matcher ValueMatcher) Rule {
Steven Moreland65b3fd92017-12-06 14:18:35 -0800648 r.props = append(r.props, ruleProperty{
Paul Duffin73bf0542019-07-12 14:12:49 +0100649 fields: fieldNamesForProperties(properties),
Paul Duffinc8111702019-07-22 12:13:55 +0100650 matcher: matcher,
Steven Moreland65b3fd92017-12-06 14:18:35 -0800651 })
652 return r
653}
Colin Crossfd4f7432019-03-05 15:06:16 -0800654
Liz Kammera3d79152021-10-28 18:14:04 -0400655// Without specifies property/value combinations that this rule does not apply to.
Paul Duffin730f2a52019-06-27 14:08:51 +0100656func (r *rule) Without(properties, value string) Rule {
Paul Duffinc8111702019-07-22 12:13:55 +0100657 return r.WithoutMatcher(properties, selectMatcher(value))
658}
659
Liz Kammera3d79152021-10-28 18:14:04 -0400660// Without specifies property/matcher combinations that this rule does not apply to.
Paul Duffinc8111702019-07-22 12:13:55 +0100661func (r *rule) WithoutMatcher(properties string, matcher ValueMatcher) Rule {
Steven Moreland65b3fd92017-12-06 14:18:35 -0800662 r.unlessProps = append(r.unlessProps, ruleProperty{
Paul Duffin73bf0542019-07-12 14:12:49 +0100663 fields: fieldNamesForProperties(properties),
Paul Duffinc8111702019-07-22 12:13:55 +0100664 matcher: matcher,
Steven Moreland65b3fd92017-12-06 14:18:35 -0800665 })
666 return r
667}
Colin Crossfd4f7432019-03-05 15:06:16 -0800668
Jihoon Kang2a7bf752024-11-01 21:21:25 +0000669// DefinedInBpFile specifies that this rule applies to modules that are defined
670// in bp files, and does not apply to modules that are auto generated by other modules.
671func (r *rule) DefinedInBpFile() Rule {
672 r.definedInBp = true
673 return r
674}
675
Paul Duffin73bf0542019-07-12 14:12:49 +0100676func selectMatcher(expected string) ValueMatcher {
677 if expected == "*" {
678 return anyMatcherInstance
679 }
680 return &equalMatcher{expected: expected}
681}
682
Liz Kammera3d79152021-10-28 18:14:04 -0400683// Because specifies a reason for this rule.
Paul Duffin730f2a52019-06-27 14:08:51 +0100684func (r *rule) Because(reason string) Rule {
Steven Moreland65b3fd92017-12-06 14:18:35 -0800685 r.reason = reason
686 return r
687}
688
689func (r *rule) String() string {
Liz Kammera3d79152021-10-28 18:14:04 -0400690 s := []string{"neverallow requirements. Not allowed:"}
691 if len(r.paths) > 0 {
692 s = append(s, fmt.Sprintf("in dirs: %q", r.paths))
Steven Moreland65b3fd92017-12-06 14:18:35 -0800693 }
Liz Kammera3d79152021-10-28 18:14:04 -0400694 if len(r.moduleTypes) > 0 {
695 s = append(s, fmt.Sprintf("module types: %q", r.moduleTypes))
Steven Moreland65b3fd92017-12-06 14:18:35 -0800696 }
Liz Kammera3d79152021-10-28 18:14:04 -0400697 if len(r.props) > 0 {
698 s = append(s, fmt.Sprintf("properties matching: %s", r.props))
Colin Crossfd4f7432019-03-05 15:06:16 -0800699 }
Liz Kammera3d79152021-10-28 18:14:04 -0400700 if len(r.directDeps) > 0 {
Cole Faust18994c72023-02-28 16:02:16 -0800701 s = append(s, fmt.Sprintf("dep(s): %q", SortedKeys(r.directDeps)))
Colin Crossfd4f7432019-03-05 15:06:16 -0800702 }
Liz Kammera3d79152021-10-28 18:14:04 -0400703 if len(r.osClasses) > 0 {
704 s = append(s, fmt.Sprintf("os class(es): %q", r.osClasses))
Paul Duffinf1c9bbe2019-07-26 10:48:06 +0100705 }
Liz Kammera3d79152021-10-28 18:14:04 -0400706 if len(r.unlessPaths) > 0 {
707 s = append(s, fmt.Sprintf("EXCEPT in dirs: %q", r.unlessPaths))
708 }
709 if len(r.unlessModuleTypes) > 0 {
710 s = append(s, fmt.Sprintf("EXCEPT module types: %q", r.unlessModuleTypes))
711 }
712 if len(r.unlessProps) > 0 {
713 s = append(s, fmt.Sprintf("EXCEPT properties matching: %q", r.unlessProps))
Andrei Onea115e7e72020-06-05 21:14:03 +0100714 }
Steven Moreland65b3fd92017-12-06 14:18:35 -0800715 if len(r.reason) != 0 {
Liz Kammera3d79152021-10-28 18:14:04 -0400716 s = append(s, " which is restricted because "+r.reason)
Steven Moreland65b3fd92017-12-06 14:18:35 -0800717 }
Liz Kammera3d79152021-10-28 18:14:04 -0400718 if len(s) == 1 {
719 s[0] = "neverallow requirements (empty)"
720 }
721 return strings.Join(s, "\n\t")
Steven Moreland65b3fd92017-12-06 14:18:35 -0800722}
723
724func (r *rule) appliesToPath(dir string) bool {
Jaewoong Jung3aff5782020-02-11 07:54:35 -0800725 includePath := len(r.paths) == 0 || HasAnyPrefix(dir, r.paths)
726 excludePath := HasAnyPrefix(dir, r.unlessPaths)
Steven Moreland65b3fd92017-12-06 14:18:35 -0800727 return includePath && !excludePath
728}
729
Paul Duffin35781882019-07-25 15:41:09 +0100730func (r *rule) appliesToDirectDeps(ctx BottomUpMutatorContext) bool {
731 if len(r.directDeps) == 0 {
732 return true
733 }
734
735 matches := false
736 ctx.VisitDirectDeps(func(m Module) {
737 if !matches {
738 name := ctx.OtherModuleName(m)
739 matches = r.directDeps[name]
740 }
741 })
742
743 return matches
744}
745
Paul Duffinf1c9bbe2019-07-26 10:48:06 +0100746func (r *rule) appliesToOsClass(osClass OsClass) bool {
747 if len(r.osClasses) == 0 {
748 return true
749 }
750
751 for _, c := range r.osClasses {
752 if c == osClass {
753 return true
754 }
755 }
756
757 return false
758}
759
Colin Crossfd4f7432019-03-05 15:06:16 -0800760func (r *rule) appliesToModuleType(moduleType string) bool {
Jihoon Kangd5465072024-12-03 00:53:05 +0000761 // Remove prefix for auto-generated modules
762 moduleType = strings.TrimSuffix(moduleType, "__loadHookModule")
763 moduleType = strings.TrimSuffix(moduleType, "__bottomUpMutatorModule")
Colin Crossfd4f7432019-03-05 15:06:16 -0800764 return (len(r.moduleTypes) == 0 || InList(moduleType, r.moduleTypes)) && !InList(moduleType, r.unlessModuleTypes)
765}
766
Cole Faust5b35cb92024-08-27 15:47:06 -0700767func (r *rule) appliesToProperties(ctx BottomUpMutatorContext, properties []interface{}) bool {
768 includeProps := hasAllProperties(ctx, properties, r.props)
769 excludeProps := hasAnyProperty(ctx, properties, r.unlessProps)
Steven Moreland65b3fd92017-12-06 14:18:35 -0800770 return includeProps && !excludeProps
771}
772
Jihoon Kang2a7bf752024-11-01 21:21:25 +0000773func (r *rule) appliesToBpDefinedModule(ctx BottomUpMutatorContext) bool {
774 if !r.definedInBp {
775 return true
776 }
777 return !ctx.OtherModuleIsAutoGenerated(ctx.Module()) == r.definedInBp
778}
779
Paul Duffinc8111702019-07-22 12:13:55 +0100780func StartsWith(prefix string) ValueMatcher {
781 return &startsWithMatcher{prefix}
782}
783
Anton Hansson45376402020-04-09 14:18:21 +0100784func Regexp(re string) ValueMatcher {
785 r, err := regexp.Compile(re)
786 if err != nil {
787 panic(err)
788 }
789 return &regexMatcher{r}
790}
791
Andrei Onea115e7e72020-06-05 21:14:03 +0100792func NotInList(allowed []string) ValueMatcher {
793 return &notInListMatcher{allowed}
794}
795
Orlando Arbildo47afbdd2025-01-08 00:27:37 +0000796func InAllowedList(allowed []string) ValueMatcher {
797 return &InListMatcher{allowed}
798}
799
Steven Moreland65b3fd92017-12-06 14:18:35 -0800800// assorted utils
801
802func cleanPaths(paths []string) []string {
803 res := make([]string, len(paths))
804 for i, v := range paths {
805 res[i] = filepath.Clean(v) + "/"
806 }
807 return res
808}
809
810func fieldNamesForProperties(propertyNames string) []string {
811 names := strings.Split(propertyNames, ".")
812 for i, v := range names {
813 names[i] = proptools.FieldNameForProperty(v)
814 }
815 return names
816}
817
Cole Faust5b35cb92024-08-27 15:47:06 -0700818func hasAnyProperty(ctx BottomUpMutatorContext, properties []interface{}, props []ruleProperty) bool {
Steven Moreland65b3fd92017-12-06 14:18:35 -0800819 for _, v := range props {
Cole Faust5b35cb92024-08-27 15:47:06 -0700820 if hasProperty(ctx, properties, v) {
Steven Moreland65b3fd92017-12-06 14:18:35 -0800821 return true
822 }
823 }
824 return false
825}
826
Cole Faust5b35cb92024-08-27 15:47:06 -0700827func hasAllProperties(ctx BottomUpMutatorContext, properties []interface{}, props []ruleProperty) bool {
Steven Moreland65b3fd92017-12-06 14:18:35 -0800828 for _, v := range props {
Cole Faust5b35cb92024-08-27 15:47:06 -0700829 if !hasProperty(ctx, properties, v) {
Steven Moreland65b3fd92017-12-06 14:18:35 -0800830 return false
831 }
832 }
833 return true
834}
835
Cole Faust5b35cb92024-08-27 15:47:06 -0700836func hasProperty(ctx BottomUpMutatorContext, properties []interface{}, prop ruleProperty) bool {
Steven Moreland65b3fd92017-12-06 14:18:35 -0800837 for _, propertyStruct := range properties {
838 propertiesValue := reflect.ValueOf(propertyStruct).Elem()
839 for _, v := range prop.fields {
840 if !propertiesValue.IsValid() {
841 break
842 }
843 propertiesValue = propertiesValue.FieldByName(v)
844 }
845 if !propertiesValue.IsValid() {
846 continue
847 }
848
Paul Duffin73bf0542019-07-12 14:12:49 +0100849 check := func(value string) bool {
Anton Hanssone1b18362021-12-23 15:05:38 +0000850 return prop.matcher.Test(value)
Steven Moreland65b3fd92017-12-06 14:18:35 -0800851 }
852
Cole Faust5b35cb92024-08-27 15:47:06 -0700853 if matchValue(ctx, propertiesValue, check) {
Steven Moreland65b3fd92017-12-06 14:18:35 -0800854 return true
855 }
856 }
857 return false
858}
859
Cole Faust5b35cb92024-08-27 15:47:06 -0700860func matchValue(ctx BottomUpMutatorContext, value reflect.Value, check func(string) bool) bool {
Steven Moreland65b3fd92017-12-06 14:18:35 -0800861 if !value.IsValid() {
862 return false
863 }
864
865 if value.Kind() == reflect.Ptr {
866 if value.IsNil() {
867 return check("")
868 }
869 value = value.Elem()
870 }
871
Cole Faust5b35cb92024-08-27 15:47:06 -0700872 switch v := value.Interface().(type) {
873 case string:
874 return check(v)
875 case bool:
876 return check(strconv.FormatBool(v))
877 case int:
878 return check(strconv.FormatInt((int64)(v), 10))
879 case []string:
880 for _, v := range v {
881 if check(v) {
882 return true
883 }
Steven Moreland65b3fd92017-12-06 14:18:35 -0800884 }
Cole Faust5b35cb92024-08-27 15:47:06 -0700885 return false
886 case proptools.Configurable[string]:
887 return check(v.GetOrDefault(ctx, ""))
888 case proptools.Configurable[bool]:
889 return check(strconv.FormatBool(v.GetOrDefault(ctx, false)))
890 case proptools.Configurable[[]string]:
891 for _, v := range v.GetOrDefault(ctx, nil) {
Steven Moreland65b3fd92017-12-06 14:18:35 -0800892 if check(v) {
893 return true
894 }
895 }
896 return false
897 }
898
899 panic("Can't handle type: " + value.Kind().String())
900}
Paul Duffin115445b2019-08-07 15:31:07 +0100901
902var neverallowRulesKey = NewOnceKey("neverallowRules")
903
904func neverallowRules(config Config) []Rule {
905 return config.Once(neverallowRulesKey, func() interface{} {
906 // No test rules were set by setTestNeverallowRules, use the global rules
907 return neverallows
908 }).([]Rule)
909}
910
911// Overrides the default neverallow rules for the supplied config.
912//
913// For testing only.
Paul Duffin45338f02021-03-30 23:07:52 +0100914func setTestNeverallowRules(config Config, testRules []Rule) {
Paul Duffin115445b2019-08-07 15:31:07 +0100915 config.Once(neverallowRulesKey, func() interface{} { return testRules })
916}
Paul Duffin45338f02021-03-30 23:07:52 +0100917
918// Prepares for a test by setting neverallow rules and enabling the mutator.
919//
920// If the supplied rules are nil then the default rules are used.
921func PrepareForTestWithNeverallowRules(testRules []Rule) FixturePreparer {
922 return GroupFixturePreparers(
923 FixtureModifyConfig(func(config Config) {
924 if testRules != nil {
925 setTestNeverallowRules(config, testRules)
926 }
927 }),
928 FixtureRegisterWithContext(func(ctx RegistrationContext) {
929 ctx.PostDepsMutators(registerNeverallowMutator)
930 }),
931 )
932}