Implement compat file generator
sepolicy_generate_compat is a binary that creates a new compat file when
freezing sepolicy API.
Suppose that we are adding {ver} compat file, after freezing {ver}
sepolicy. Then the workflow would be:
1) copy prebuilts to system/sepolicy/prebuilts/api/{ver}
2) add {ver} to PLATFORM_SEPOLICY_COMPAT_VERSIONS under
build/make/core/config.mk
3) touch the following three files
- system/sepolicy/private/compat/{ver}/{ver}.cil
- system/sepolicy/private/compat/{ver}/{ver}.compat.cil
- system/sepolicy/private/compat/{ver}/{ver}.ignore.cil
- system/sepolicy/prebuilts/api/{ver}/vendor_sepolicy.cil
- system/sepolicy/prebuilts/api/{ver}/plat_pub_versioned.cil
* This step is to build base compat files, and won't be needed in the
future.
4) add compat module files (won't be needed in the future)
- {ver}.cil
- {ver}.compat.cil
- {ver}.ignore.cil
* This step is to build base compat files, and won't be needed in the
future.
5) run the following command to update above three files:
$ source build/envsetup.sh && lunch aosp_arm64-userdebug
$ m sepolicy_generate_compat
$ sepolicy_generate_compat --branch=(branch_for_ver) \
--build latest --target-version {ver} \
--latest-version {ver-1}
6) upload build/make and system/sepolicy changes.
This script still lacks:
- handling of plat_pub_versioned.cil
- test cases
We will tackle such problems with follow-up changes.
Bug: 214336258
Test: manual
Change-Id: I21723a0832e5adadae7c22797c5aba867dc0174e
1 file changed