Add flag-guarding also to compat modules
Bug: 353121021
Test: m selinux_policy
Change-Id: I88db84063966fd4fe3d4d11b0be5ea1822d57a0d
diff --git a/build/soong/policy.go b/build/soong/policy.go
index 7b2122c..5611ed0 100644
--- a/build/soong/policy.go
+++ b/build/soong/policy.go
@@ -90,8 +90,9 @@
// Desired number of MLS categories. Defaults to 1024
Mls_cats *int64
- // Whether to turn on board_api_level guard or not. Defaults to false
- Board_api_level_guard *bool
+ // Board api level of policy files. Set "vendor" for RELEASE_BOARD_API_LEVEL, "system" for
+ // turning off the guard, or a direct version string (e.g. "202404"). Defaults to "system"
+ Board_api_level *string
}
type policyConf struct {
@@ -223,11 +224,17 @@
}
func (c *policyConf) boardApiLevel(ctx android.ModuleContext) string {
- if proptools.Bool(c.properties.Board_api_level_guard) {
+ level := proptools.StringDefault(c.properties.Board_api_level, "system")
+
+ if level == "system" {
+ // aribtrary value greater than any other vendor API levels
+ return "1000000"
+ } else if level == "vendor" {
return ctx.Config().VendorApiLevel()
+ } else {
+ return level
}
- // aribtrary value greater than any other vendor API levels
- return "1000000"
+
}
func findPolicyConfOrder(name string) int {
diff --git a/flagging/Android.bp b/flagging/Android.bp
index 26e8989..cf6ded1 100644
--- a/flagging/Android.bp
+++ b/flagging/Android.bp
@@ -43,7 +43,7 @@
name: "se_policy_conf_public_flags_defaults",
srcs: [":sepolicy_flagging_macros"],
build_flags: ["all_selinux_flags"],
- board_api_level_guard: true,
+ board_api_level: "vendor",
}
contexts_defaults {
diff --git a/prebuilts/api/202404/Android.bp b/prebuilts/api/202404/Android.bp
index 598ab0d..bca377e 100644
--- a/prebuilts/api/202404/Android.bp
+++ b/prebuilts/api/202404/Android.bp
@@ -1,4 +1,33 @@
-// Automatically generated file, do not edit!
+// Copyright (C) 2024 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+se_policy_conf {
+ name: "202404_reqd_policy_mask.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
+ srcs: reqd_mask_policy,
+ installable: false,
+ build_variant: "user",
+ board_api_level: "202404",
+}
+
+se_policy_cil {
+ name: "202404_reqd_policy_mask.cil",
+ src: ":202404_reqd_policy_mask.conf",
+ secilc_check: false,
+ installable: false,
+}
+
se_policy_conf {
name: "202404_plat_pub_policy.conf",
defaults: ["se_policy_conf_flags_defaults"],
@@ -8,12 +37,13 @@
],
installable: false,
build_variant: "user",
+ board_api_level: "202404",
}
se_policy_cil {
name: "202404_plat_pub_policy.cil",
src: ":202404_plat_pub_policy.conf",
- filter_out: [":reqd_policy_mask.cil"],
+ filter_out: [":202404_reqd_policy_mask.cil"],
secilc_check: false,
installable: false,
}
@@ -29,12 +59,13 @@
],
installable: false,
build_variant: "user",
+ board_api_level: "202404",
}
se_policy_cil {
name: "202404_product_pub_policy.cil",
src: ":202404_product_pub_policy.conf",
- filter_out: [":reqd_policy_mask.cil"],
+ filter_out: [":202404_reqd_policy_mask.cil"],
secilc_check: false,
installable: false,
}
@@ -60,6 +91,7 @@
],
installable: false,
build_variant: "user",
+ board_api_level: "202404",
}
se_policy_cil {
diff --git a/prebuilts/api/29.0/Android.bp b/prebuilts/api/29.0/Android.bp
index f280c29..e835288 100644
--- a/prebuilts/api/29.0/Android.bp
+++ b/prebuilts/api/29.0/Android.bp
@@ -13,25 +13,44 @@
// limitations under the License.
se_policy_conf {
+ name: "29.0_reqd_policy_mask.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
+ srcs: reqd_mask_policy,
+ installable: false,
+ build_variant: "user",
+ board_api_level: "29",
+}
+
+se_policy_cil {
+ name: "29.0_reqd_policy_mask.cil",
+ src: ":29.0_reqd_policy_mask.conf",
+ secilc_check: false,
+ installable: false,
+}
+
+se_policy_conf {
name: "29.0_plat_pub_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: [
":se_build_files{.plat_public_29.0}",
":se_build_files{.reqd_mask}",
],
installable: false,
build_variant: "user",
+ board_api_level: "29",
}
se_policy_cil {
name: "29.0_plat_pub_policy.cil",
src: ":29.0_plat_pub_policy.conf",
- filter_out: [":reqd_policy_mask.cil"],
+ filter_out: [":29.0_reqd_policy_mask.cil"],
secilc_check: false,
installable: false,
}
se_policy_conf {
name: "29.0_product_pub_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: [
":se_build_files{.plat_public_29.0}",
":se_build_files{.system_ext_public_29.0}",
@@ -40,12 +59,13 @@
],
installable: false,
build_variant: "user",
+ board_api_level: "29",
}
se_policy_cil {
name: "29.0_product_pub_policy.cil",
src: ":29.0_product_pub_policy.conf",
- filter_out: [":reqd_policy_mask.cil"],
+ filter_out: [":29.0_reqd_policy_mask.cil"],
secilc_check: false,
installable: false,
}
@@ -60,6 +80,7 @@
se_policy_conf {
name: "29.0_plat_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: [
":se_build_files{.plat_public_29.0}",
":se_build_files{.plat_private_29.0}",
@@ -70,6 +91,7 @@
],
installable: false,
build_variant: "user",
+ board_api_level: "29",
}
se_policy_cil {
diff --git a/prebuilts/api/30.0/Android.bp b/prebuilts/api/30.0/Android.bp
index 87b3f31..df13756 100644
--- a/prebuilts/api/30.0/Android.bp
+++ b/prebuilts/api/30.0/Android.bp
@@ -13,25 +13,44 @@
// limitations under the License.
se_policy_conf {
+ name: "30.0_reqd_policy_mask.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
+ srcs: reqd_mask_policy,
+ installable: false,
+ build_variant: "user",
+ board_api_level: "30",
+}
+
+se_policy_cil {
+ name: "30.0_reqd_policy_mask.cil",
+ src: ":30.0_reqd_policy_mask.conf",
+ secilc_check: false,
+ installable: false,
+}
+
+se_policy_conf {
name: "30.0_plat_pub_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: [
":se_build_files{.plat_public_30.0}",
":se_build_files{.reqd_mask}",
],
installable: false,
build_variant: "user",
+ board_api_level: "30",
}
se_policy_cil {
name: "30.0_plat_pub_policy.cil",
src: ":30.0_plat_pub_policy.conf",
- filter_out: [":reqd_policy_mask.cil"],
+ filter_out: [":30.0_reqd_policy_mask.cil"],
secilc_check: false,
installable: false,
}
se_policy_conf {
name: "30.0_product_pub_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: [
":se_build_files{.plat_public_30.0}",
":se_build_files{.system_ext_public_30.0}",
@@ -40,12 +59,13 @@
],
installable: false,
build_variant: "user",
+ board_api_level: "30",
}
se_policy_cil {
name: "30.0_product_pub_policy.cil",
src: ":30.0_product_pub_policy.conf",
- filter_out: [":reqd_policy_mask.cil"],
+ filter_out: [":30.0_reqd_policy_mask.cil"],
secilc_check: false,
installable: false,
}
@@ -60,6 +80,7 @@
se_policy_conf {
name: "30.0_plat_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: [
":se_build_files{.plat_public_30.0}",
":se_build_files{.plat_private_30.0}",
@@ -70,6 +91,7 @@
],
installable: false,
build_variant: "user",
+ board_api_level: "30",
}
se_policy_cil {
diff --git a/prebuilts/api/31.0/Android.bp b/prebuilts/api/31.0/Android.bp
index 442fae9..ba8d67c 100644
--- a/prebuilts/api/31.0/Android.bp
+++ b/prebuilts/api/31.0/Android.bp
@@ -13,25 +13,44 @@
// limitations under the License.
se_policy_conf {
+ name: "31.0_reqd_policy_mask.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
+ srcs: reqd_mask_policy,
+ installable: false,
+ build_variant: "user",
+ board_api_level: "31",
+}
+
+se_policy_cil {
+ name: "31.0_reqd_policy_mask.cil",
+ src: ":31.0_reqd_policy_mask.conf",
+ secilc_check: false,
+ installable: false,
+}
+
+se_policy_conf {
name: "31.0_plat_pub_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: [
":se_build_files{.plat_public_31.0}",
":se_build_files{.reqd_mask}",
],
installable: false,
build_variant: "user",
+ board_api_level: "31",
}
se_policy_cil {
name: "31.0_plat_pub_policy.cil",
src: ":31.0_plat_pub_policy.conf",
- filter_out: [":reqd_policy_mask.cil"],
+ filter_out: [":31.0_reqd_policy_mask.cil"],
secilc_check: false,
installable: false,
}
se_policy_conf {
name: "31.0_product_pub_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: [
":se_build_files{.plat_public_31.0}",
":se_build_files{.system_ext_public_31.0}",
@@ -40,12 +59,13 @@
],
installable: false,
build_variant: "user",
+ board_api_level: "31",
}
se_policy_cil {
name: "31.0_product_pub_policy.cil",
src: ":31.0_product_pub_policy.conf",
- filter_out: [":reqd_policy_mask.cil"],
+ filter_out: [":31.0_reqd_policy_mask.cil"],
secilc_check: false,
installable: false,
}
@@ -60,6 +80,7 @@
se_policy_conf {
name: "31.0_plat_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: [
":se_build_files{.plat_public_31.0}",
":se_build_files{.plat_private_31.0}",
@@ -70,6 +91,7 @@
],
installable: false,
build_variant: "user",
+ board_api_level: "31",
}
se_policy_cil {
diff --git a/prebuilts/api/32.0/Android.bp b/prebuilts/api/32.0/Android.bp
index d13babf..053e094 100644
--- a/prebuilts/api/32.0/Android.bp
+++ b/prebuilts/api/32.0/Android.bp
@@ -13,25 +13,44 @@
// limitations under the License.
se_policy_conf {
+ name: "32.0_reqd_policy_mask.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
+ srcs: reqd_mask_policy,
+ installable: false,
+ build_variant: "user",
+ board_api_level: "32",
+}
+
+se_policy_cil {
+ name: "32.0_reqd_policy_mask.cil",
+ src: ":32.0_reqd_policy_mask.conf",
+ secilc_check: false,
+ installable: false,
+}
+
+se_policy_conf {
name: "32.0_plat_pub_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: [
":se_build_files{.plat_public_32.0}",
":se_build_files{.reqd_mask}",
],
installable: false,
build_variant: "user",
+ board_api_level: "32",
}
se_policy_cil {
name: "32.0_plat_pub_policy.cil",
src: ":32.0_plat_pub_policy.conf",
- filter_out: [":reqd_policy_mask.cil"],
+ filter_out: [":32.0_reqd_policy_mask.cil"],
secilc_check: false,
installable: false,
}
se_policy_conf {
name: "32.0_product_pub_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: [
":se_build_files{.plat_public_32.0}",
":se_build_files{.system_ext_public_32.0}",
@@ -40,12 +59,13 @@
],
installable: false,
build_variant: "user",
+ board_api_level: "32",
}
se_policy_cil {
name: "32.0_product_pub_policy.cil",
src: ":32.0_product_pub_policy.conf",
- filter_out: [":reqd_policy_mask.cil"],
+ filter_out: [":32.0_reqd_policy_mask.cil"],
secilc_check: false,
installable: false,
}
@@ -60,6 +80,7 @@
se_policy_conf {
name: "32.0_plat_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: [
":se_build_files{.plat_public_32.0}",
":se_build_files{.plat_private_32.0}",
@@ -70,6 +91,7 @@
],
installable: false,
build_variant: "user",
+ board_api_level: "32",
}
se_policy_cil {
diff --git a/prebuilts/api/33.0/Android.bp b/prebuilts/api/33.0/Android.bp
index 5780d6b..0824e9c 100644
--- a/prebuilts/api/33.0/Android.bp
+++ b/prebuilts/api/33.0/Android.bp
@@ -13,25 +13,44 @@
// limitations under the License.
se_policy_conf {
+ name: "33.0_reqd_policy_mask.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
+ srcs: reqd_mask_policy,
+ installable: false,
+ build_variant: "user",
+ board_api_level: "33",
+}
+
+se_policy_cil {
+ name: "33.0_reqd_policy_mask.cil",
+ src: ":33.0_reqd_policy_mask.conf",
+ secilc_check: false,
+ installable: false,
+}
+
+se_policy_conf {
name: "33.0_plat_pub_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: [
":se_build_files{.plat_public_33.0}",
":se_build_files{.reqd_mask}",
],
installable: false,
build_variant: "user",
+ board_api_level: "33",
}
se_policy_cil {
name: "33.0_plat_pub_policy.cil",
src: ":33.0_plat_pub_policy.conf",
- filter_out: [":reqd_policy_mask.cil"],
+ filter_out: [":33.0_reqd_policy_mask.cil"],
secilc_check: false,
installable: false,
}
se_policy_conf {
name: "33.0_product_pub_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: [
":se_build_files{.plat_public_33.0}",
":se_build_files{.system_ext_public_33.0}",
@@ -40,12 +59,13 @@
],
installable: false,
build_variant: "user",
+ board_api_level: "33",
}
se_policy_cil {
name: "33.0_product_pub_policy.cil",
src: ":33.0_product_pub_policy.conf",
- filter_out: [":reqd_policy_mask.cil"],
+ filter_out: [":33.0_reqd_policy_mask.cil"],
secilc_check: false,
installable: false,
}
@@ -60,6 +80,7 @@
se_policy_conf {
name: "33.0_plat_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: [
":se_build_files{.plat_public_33.0}",
":se_build_files{.plat_private_33.0}",
@@ -70,6 +91,7 @@
],
installable: false,
build_variant: "user",
+ board_api_level: "33",
}
se_policy_cil {
diff --git a/prebuilts/api/34.0/Android.bp b/prebuilts/api/34.0/Android.bp
index c7bb4bc..efd3c25 100644
--- a/prebuilts/api/34.0/Android.bp
+++ b/prebuilts/api/34.0/Android.bp
@@ -13,25 +13,44 @@
// limitations under the License.
se_policy_conf {
+ name: "34.0_reqd_policy_mask.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
+ srcs: reqd_mask_policy,
+ installable: false,
+ build_variant: "user",
+ board_api_level: "34",
+}
+
+se_policy_cil {
+ name: "34.0_reqd_policy_mask.cil",
+ src: ":34.0_reqd_policy_mask.conf",
+ secilc_check: false,
+ installable: false,
+}
+
+se_policy_conf {
name: "34.0_plat_pub_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: [
":se_build_files{.plat_public_34.0}",
":se_build_files{.reqd_mask}",
],
installable: false,
build_variant: "user",
+ board_api_level: "34",
}
se_policy_cil {
name: "34.0_plat_pub_policy.cil",
src: ":34.0_plat_pub_policy.conf",
- filter_out: [":reqd_policy_mask.cil"],
+ filter_out: [":34.0_reqd_policy_mask.cil"],
secilc_check: false,
installable: false,
}
se_policy_conf {
name: "34.0_product_pub_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: [
":se_build_files{.plat_public_34.0}",
":se_build_files{.system_ext_public_34.0}",
@@ -40,12 +59,13 @@
],
installable: false,
build_variant: "user",
+ board_api_level: "34",
}
se_policy_cil {
name: "34.0_product_pub_policy.cil",
src: ":34.0_product_pub_policy.conf",
- filter_out: [":reqd_policy_mask.cil"],
+ filter_out: [":34.0_reqd_policy_mask.cil"],
secilc_check: false,
installable: false,
}
@@ -60,6 +80,7 @@
se_policy_conf {
name: "34.0_plat_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: [
":se_build_files{.plat_public_34.0}",
":se_build_files{.plat_private_34.0}",
@@ -70,6 +91,7 @@
],
installable: false,
build_variant: "user",
+ board_api_level: "34",
}
se_policy_cil {