blob: 42b343878c40a49a274fd92e180a0dea10a9148d [file] [log] [blame]
Stephen Smalley2dd4e512012-01-04 12:33:27 -05001LOCAL_PATH:= $(call my-dir)
William Robertsf0e0a942012-08-27 15:41:15 -07002
Dan Cashman6f14f6b2017-04-07 16:36:23 -07003# PLATFORM_SEPOLICY_VERSION is a number of the form "NN.m" with "NN" mapping to
4# PLATFORM_SDK_VERSION and "m" as a minor number which allows for SELinux
5# changes independent of PLATFORM_SDK_VERSION. This value will be set to
6# 10000.0 to represent tip-of-tree development that is inherently unstable and
7# thus designed not to work with any shipping vendor policy. This is similar in
8# spirit to how DEFAULT_APP_TARGET_SDK is set.
9# The minor version ('m' component) must be updated every time a platform release
10# is made which breaks compatibility with the previous platform sepolicy version,
11# not just on every increase in PLATFORM_SDK_VERSION. The minor version should
12# be reset to 0 on every bump of the PLATFORM_SDK_VERSION.
Ian Pedowitz4816b8f2017-05-04 00:09:57 +000013sepolicy_major_vers := 26
Dan Cashman6f14f6b2017-04-07 16:36:23 -070014sepolicy_minor_vers := 0
15
16ifneq ($(sepolicy_major_vers), $(PLATFORM_SDK_VERSION))
17$(error sepolicy_major_version does not match PLATFORM_SDK_VERSION, please update.)
18endif
19ifneq (REL,$(PLATFORM_VERSION_CODENAME))
20 sepolicy_major_vers := 10000
21 sepolicy_minor_vers := 0
22endif
23PLATFORM_SEPOLICY_VERSION := $(join $(addsuffix .,$(sepolicy_major_vers)), $(sepolicy_minor_vers))
24sepolicy_major_vers :=
25sepolicy_minor_vers :=
26
Stephen Smalley2dd4e512012-01-04 12:33:27 -050027include $(CLEAR_VARS)
Stephen Smalley2dd4e512012-01-04 12:33:27 -050028# SELinux policy version.
Stephen Smalleyb4f17062015-03-13 10:03:52 -040029# Must be <= /sys/fs/selinux/policyvers reported by the Android kernel.
Stephen Smalley2dd4e512012-01-04 12:33:27 -050030# Must be within the compatibility range reported by checkpolicy -V.
Jeff Vander Stoep3a0ce492015-12-07 08:30:43 -080031POLICYVERS ?= 30
Stephen Smalley2dd4e512012-01-04 12:33:27 -050032
33MLS_SENS=1
34MLS_CATS=1024
35
Stephen Smalleyb4f17062015-03-13 10:03:52 -040036ifdef BOARD_SEPOLICY_REPLACE
37$(error BOARD_SEPOLICY_REPLACE is no longer supported; please remove from your BoardConfig.mk or other .mk file.)
38endif
39
40ifdef BOARD_SEPOLICY_IGNORE
41$(error BOARD_SEPOLICY_IGNORE is no longer supported; please remove from your BoardConfig.mk or other .mk file.)
42endif
Stephen Smalley5b340be2012-03-06 11:12:41 -050043
Stephen Smalley8e0ca882015-04-01 10:14:56 -040044ifdef BOARD_SEPOLICY_UNION
45$(warning BOARD_SEPOLICY_UNION is no longer required - all files found in BOARD_SEPOLICY_DIRS are implicitly unioned; please remove from your BoardConfig.mk or other .mk file.)
46endif
Robert Craig6b0ff472014-01-29 13:10:58 -050047
William Robertsd2185582015-07-16 11:28:02 -070048ifdef BOARD_SEPOLICY_M4DEFS
49LOCAL_ADDITIONAL_M4DEFS := $(addprefix -D, $(BOARD_SEPOLICY_M4DEFS))
50endif
51
dcashmancc39f632016-07-22 13:13:11 -070052# sepolicy is now divided into multiple portions:
53# public - policy exported on which non-platform policy developers may write
54# additional policy. types and attributes are versioned and included in
55# delivered non-platform policy, which is to be combined with platform policy.
56# private - platform-only policy required for platform functionality but which
57# is not exported to vendor policy developers and as such may not be assumed
58# to exist.
Alex Klyubin55961722017-01-30 18:44:59 -080059# vendor - vendor-only policy required for vendor functionality. This policy can
60# reference the public policy but cannot reference the private policy. This
61# policy is for components which are produced from the core/non-vendor tree and
62# placed into a vendor partition.
dcashman07791552016-12-07 11:27:47 -080063# mapping - This contains policy statements which map the attributes
dcashmancc39f632016-07-22 13:13:11 -070064# exposed in the public policy of previous versions to the concrete types used
65# in this policy to ensure that policy targeting attributes from public
66# policy from an older platform version continues to work.
67
dcashman2e00e632016-10-12 14:58:09 -070068# build process for device:
dcashmancc39f632016-07-22 13:13:11 -070069# 1) convert policies to CIL:
70# - private + public platform policy to CIL
71# - mapping file to CIL (should already be in CIL form)
72# - non-platform public policy to CIL
73# - non-platform public + private policy to CIL
74# 2) attributize policy
dcashmancc39f632016-07-22 13:13:11 -070075# - run script which takes non-platform public and non-platform combined
76# private + public policy and produces attributized and versioned
77# non-platform policy
78# 3) combine policy files
79# - combine mapping, platform and non-platform policy.
80# - compile output binary policy file
81
82PLAT_PUBLIC_POLICY := $(LOCAL_PATH)/public
Dan Cashmanf8937002017-05-08 14:26:52 -070083PLAT_PUBLIC_POLICY += $(BOARD_PLAT_PUBLIC_SEPOLICY_DIRS)
dcashmancc39f632016-07-22 13:13:11 -070084PLAT_PRIVATE_POLICY := $(LOCAL_PATH)/private
Dan Cashmanf8937002017-05-08 14:26:52 -070085PLAT_PRIVATE_POLICY += $(BOARD_PLAT_PRIVATE_SEPOLICY_DIRS)
Alex Klyubin55961722017-01-30 18:44:59 -080086PLAT_VENDOR_POLICY := $(LOCAL_PATH)/vendor
dcashman2e00e632016-10-12 14:58:09 -070087REQD_MASK_POLICY := $(LOCAL_PATH)/reqd_mask
88
89# TODO: move to README when doing the README update and finalizing versioning.
Sandeep Patil42f95982017-04-07 14:18:48 -070090# BOARD_SEPOLICY_VERS must take the format "NN.m" and contain the sepolicy
91# version identifier corresponding to the sepolicy on which the non-platform
92# policy is to be based. If unspecified, this will build against the current
93# public platform policy in tree
dcashman2e00e632016-10-12 14:58:09 -070094ifndef BOARD_SEPOLICY_VERS
95$(warning BOARD_SEPOLICY_VERS not specified, assuming current platform version)
Sandeep Patil42f95982017-04-07 14:18:48 -070096# The default platform policy version.
Dan Cashman6f14f6b2017-04-07 16:36:23 -070097BOARD_SEPOLICY_VERS := $(PLATFORM_SEPOLICY_VERSION)
dcashman2e00e632016-10-12 14:58:09 -070098endif
dcashmancc39f632016-07-22 13:13:11 -070099
Dan Cashman4d24a772017-04-12 14:28:34 -0700100
101platform_mapping_file := $(BOARD_SEPOLICY_VERS).cil
102
dcashmancc39f632016-07-22 13:13:11 -0700103###########################################################
104# Compute policy files to be used in policy build.
105# $(1): files to include
106# $(2): directories in which to find files
107###########################################################
108
109define build_policy
110$(foreach type, $(1), $(foreach file, $(addsuffix /$(type), $(2)), $(sort $(wildcard $(file)))))
111endef
William Roberts29d14682016-01-04 12:20:57 -0800112
William Roberts49693f12016-01-04 12:20:57 -0800113# Builds paths for all policy files found in BOARD_SEPOLICY_DIRS.
114# $(1): the set of policy name paths to build
Alex Klyubin55961722017-01-30 18:44:59 -0800115build_device_policy = $(call build_policy, $(1), $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS))
William Roberts49693f12016-01-04 12:20:57 -0800116
Richard Hainesc8801fe2015-12-11 10:39:19 +0000117# Add a file containing only a newline in-between each policy configuration
118# 'contexts' file. This will allow OEM policy configuration files without a
119# final newline (0x0A) to be built correctly by the m4(1) macro processor.
120# $(1): the set of contexts file names.
121# $(2): the file containing only 0x0A.
122add_nl = $(foreach entry, $(1), $(subst $(entry), $(entry) $(2), $(entry)))
123
dcashman704741a2014-07-25 19:11:52 -0700124sepolicy_build_files := security_classes \
125 initial_sids \
126 access_vectors \
127 global_macros \
Nick Kralevicha17a2662014-11-05 15:30:41 -0800128 neverallow_macros \
dcashman704741a2014-07-25 19:11:52 -0700129 mls_macros \
dcashman2e00e632016-10-12 14:58:09 -0700130 mls_decl \
dcashman704741a2014-07-25 19:11:52 -0700131 mls \
132 policy_capabilities \
133 te_macros \
134 attributes \
Jeff Vander Stoepcbaa2b72015-12-22 10:39:34 -0800135 ioctl_defines \
Jeff Vander Stoepde9b5302015-06-05 15:28:55 -0700136 ioctl_macros \
dcashman704741a2014-07-25 19:11:52 -0700137 *.te \
dcashman2e00e632016-10-12 14:58:09 -0700138 roles_decl \
dcashman704741a2014-07-25 19:11:52 -0700139 roles \
140 users \
141 initial_sid_contexts \
142 fs_use \
143 genfs_contexts \
144 port_contexts
145
Alex Klyubin7cda44f2017-03-21 14:28:53 -0700146# CIL files which contain workarounds for current limitation of human-readable
147# module policy language. These files are appended to the CIL files produced
148# from module language files.
149sepolicy_build_cil_workaround_files := technical_debt.cil
150
Dan Cashman1c040272016-12-15 15:28:44 -0800151my_target_arch := $(TARGET_ARCH)
152ifneq (,$(filter mips mips64,$(TARGET_ARCH)))
153 my_target_arch := mips
154endif
155
Jeff Vander Stoepd2053bd2017-03-15 13:37:35 -0700156intermediates := $(TARGET_OUT_INTERMEDIATES)/ETC/sepolicy_intermediates
157
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700158with_asan := false
159ifneq (,$(filter address,$(SANITIZE_TARGET)))
160 with_asan := true
161endif
162
Dan Cashman4f9a6482017-04-10 12:27:18 -0700163include $(CLEAR_VARS)
164LOCAL_MODULE := selinux_policy
165LOCAL_MODULE_TAGS := optional
166# Include SELinux policy. We do this here because different modules
167# need to be included based on the value of PRODUCT_FULL_TREBLE. This
168# type of conditional inclusion cannot be done in top-level files such
169# as build/target/product/embedded.mk.
170# This conditional inclusion closely mimics the conditional logic
171# inside init/init.cpp for loading SELinux policy from files.
172ifeq ($(PRODUCT_FULL_TREBLE),true)
173
Dan Cashman4f9a6482017-04-10 12:27:18 -0700174# Use split SELinux policy
175LOCAL_REQUIRED_MODULES += \
176 $(platform_mapping_file) \
177 nonplat_sepolicy.cil \
178 plat_sepolicy.cil \
179 plat_and_mapping_sepolicy.cil.sha256 \
180 secilc \
181 nonplat_file_contexts \
182 plat_file_contexts \
183 plat_sepolicy_vers.txt
184
185# Include precompiled policy, unless told otherwise
186ifneq ($(PRODUCT_PRECOMPILED_SEPOLICY),false)
187LOCAL_REQUIRED_MODULES += precompiled_sepolicy precompiled_sepolicy.plat_and_mapping.sha256
188endif
189
190else
191# Use monolithic SELinux policy
192LOCAL_REQUIRED_MODULES += sepolicy \
193 file_contexts.bin
194endif
195include $(BUILD_PHONY_PACKAGE)
196
Ying Wang02fb5f32012-01-17 17:51:09 -0800197##################################
dcashman2e00e632016-10-12 14:58:09 -0700198# reqd_policy_mask - a policy.conf file which contains only the bare minimum
199# policy necessary to use checkpolicy. This bare-minimum policy needs to be
200# present in all policy.conf files, but should not necessarily be exported as
201# part of the public policy. The rules generated by reqd_policy_mask will allow
202# the compilation of public policy and subsequent removal of CIL policy that
203# should not be exported.
204
205reqd_policy_mask.conf := $(intermediates)/reqd_policy_mask.conf
206$(reqd_policy_mask.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
207$(reqd_policy_mask.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Dan Cashman1c040272016-12-15 15:28:44 -0800208$(reqd_policy_mask.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700209$(reqd_policy_mask.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
dcashman2e00e632016-10-12 14:58:09 -0700210$(reqd_policy_mask.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
211$(reqd_policy_mask.conf): $(call build_policy, $(sepolicy_build_files), $(REQD_MASK_POLICY))
212 @mkdir -p $(dir $@)
213 $(hide) m4 $(PRIVATE_ADDITIONAL_M4DEFS) \
214 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
215 -D target_build_variant=$(TARGET_BUILD_VARIANT) \
Dan Cashman1c040272016-12-15 15:28:44 -0800216 -D target_with_dexpreopt=$(WITH_DEXPREOPT) \
Dan Cashman1c040272016-12-15 15:28:44 -0800217 -D target_arch=$(PRIVATE_TGT_ARCH) \
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700218 -D target_with_asan=$(PRIVATE_TGT_WITH_ASAN) \
Alex Klyubinf5446eb2017-03-23 14:27:32 -0700219 -D target_full_treble=$(PRODUCT_FULL_TREBLE) \
dcashman2e00e632016-10-12 14:58:09 -0700220 -s $^ > $@
221
Andreas Gampe3ddc78b2017-04-27 17:16:13 -0700222# b/37755687
223CHECKPOLICY_ASAN_OPTIONS := ASAN_OPTIONS=detect_leaks=0
224
dcashman2e00e632016-10-12 14:58:09 -0700225reqd_policy_mask.cil := $(intermediates)/reqd_policy_mask.cil
226$(reqd_policy_mask.cil): $(reqd_policy_mask.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy
227 @mkdir -p $(dir $@)
Andreas Gampe3ddc78b2017-04-27 17:16:13 -0700228 $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -C -M -c \
229 $(POLICYVERS) -o $@ $<
dcashman2e00e632016-10-12 14:58:09 -0700230
dcashman1faa6442016-11-28 07:20:28 -0800231reqd_policy_mask.conf :=
232
233##################################
dcashman2e00e632016-10-12 14:58:09 -0700234# plat_pub_policy - policy that will be exported to be a part of non-platform
235# policy corresponding to this platform version. This is a limited subset of
236# policy that would not compile in checkpolicy on its own. To get around this
237# limitation, add only the required files from private policy, which will
238# generate CIL policy that will then be filtered out by the reqd_policy_mask.
239plat_pub_policy.conf := $(intermediates)/plat_pub_policy.conf
240$(plat_pub_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
241$(plat_pub_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Dan Cashman1c040272016-12-15 15:28:44 -0800242$(plat_pub_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700243$(plat_pub_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
dcashman2e00e632016-10-12 14:58:09 -0700244$(plat_pub_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
245$(plat_pub_policy.conf): $(call build_policy, $(sepolicy_build_files), \
Dan Cashman6bf50e52017-04-12 11:12:17 -0700246$(PLAT_PUBLIC_POLICY) $(REQD_MASK_POLICY))
dcashman2e00e632016-10-12 14:58:09 -0700247 @mkdir -p $(dir $@)
248 $(hide) m4 $(PRIVATE_ADDITIONAL_M4DEFS) \
249 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
250 -D target_build_variant=$(TARGET_BUILD_VARIANT) \
Dan Cashman1c040272016-12-15 15:28:44 -0800251 -D target_with_dexpreopt=$(WITH_DEXPREOPT) \
Dan Cashman1c040272016-12-15 15:28:44 -0800252 -D target_arch=$(PRIVATE_TGT_ARCH) \
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700253 -D target_with_asan=$(PRIVATE_TGT_WITH_ASAN) \
Alex Klyubinf5446eb2017-03-23 14:27:32 -0700254 -D target_full_treble=$(PRODUCT_FULL_TREBLE) \
dcashman2e00e632016-10-12 14:58:09 -0700255 -s $^ > $@
256
257plat_pub_policy.cil := $(intermediates)/plat_pub_policy.cil
dcashman1faa6442016-11-28 07:20:28 -0800258$(plat_pub_policy.cil): PRIVATE_POL_CONF := $(plat_pub_policy.conf)
259$(plat_pub_policy.cil): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil)
260$(plat_pub_policy.cil): $(HOST_OUT_EXECUTABLES)/checkpolicy $(plat_pub_policy.conf) $(reqd_policy_mask.cil)
dcashman2e00e632016-10-12 14:58:09 -0700261 @mkdir -p $(dir $@)
Andreas Gampe3ddc78b2017-04-27 17:16:13 -0700262 $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $< -C -M -c $(POLICYVERS) -o $@.tmp $(PRIVATE_POL_CONF)
dcashman1faa6442016-11-28 07:20:28 -0800263 $(hide) grep -Fxv -f $(PRIVATE_REQD_MASK) $@.tmp > $@
dcashman2e00e632016-10-12 14:58:09 -0700264
dcashman1faa6442016-11-28 07:20:28 -0800265plat_pub_policy.conf :=
Dan Cashman1c040272016-12-15 15:28:44 -0800266
dcashman1faa6442016-11-28 07:20:28 -0800267##################################
268include $(CLEAR_VARS)
269
270LOCAL_MODULE := sectxfile_nl
271LOCAL_MODULE_CLASS := ETC
272LOCAL_MODULE_TAGS := optional
273
274# Create a file containing newline only to add between context config files
275include $(BUILD_SYSTEM)/base_rules.mk
276$(LOCAL_BUILT_MODULE):
dcashman2e00e632016-10-12 14:58:09 -0700277 @mkdir -p $(dir $@)
dcashman1faa6442016-11-28 07:20:28 -0800278 $(hide) echo > $@
279
280built_nl := $(LOCAL_BUILT_MODULE)
281
282#################################
283include $(CLEAR_VARS)
284
285LOCAL_MODULE := plat_sepolicy.cil
286LOCAL_MODULE_CLASS := ETC
287LOCAL_MODULE_TAGS := optional
Alex Klyubin052b0bb2017-03-02 12:39:25 -0800288LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
dcashman1faa6442016-11-28 07:20:28 -0800289
290include $(BUILD_SYSTEM)/base_rules.mk
dcashman2e00e632016-10-12 14:58:09 -0700291
292# plat_policy.conf - A combination of the private and public platform policy
293# which will ship with the device. The platform will always reflect the most
294# recent platform version and is not currently being attributized.
295plat_policy.conf := $(intermediates)/plat_policy.conf
296$(plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
297$(plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Dan Cashman1c040272016-12-15 15:28:44 -0800298$(plat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700299$(plat_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
dcashman2e00e632016-10-12 14:58:09 -0700300$(plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
301$(plat_policy.conf): $(call build_policy, $(sepolicy_build_files), \
dcashmancc39f632016-07-22 13:13:11 -0700302$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY))
303 @mkdir -p $(dir $@)
304 $(hide) m4 $(PRIVATE_ADDITIONAL_M4DEFS) \
305 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
306 -D target_build_variant=$(TARGET_BUILD_VARIANT) \
Jorge Lucangeli Obes84db84e2016-11-18 08:42:35 -0500307 -D target_with_dexpreopt=$(WITH_DEXPREOPT) \
Dan Cashman1c040272016-12-15 15:28:44 -0800308 -D target_arch=$(PRIVATE_TGT_ARCH) \
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700309 -D target_with_asan=$(PRIVATE_TGT_WITH_ASAN) \
Alex Klyubinf5446eb2017-03-23 14:27:32 -0700310 -D target_full_treble=$(PRODUCT_FULL_TREBLE) \
dcashmancc39f632016-07-22 13:13:11 -0700311 -s $^ > $@
312 $(hide) sed '/dontaudit/d' $@ > $@.dontaudit
313
Jeff Vander Stoepb8787692017-04-21 15:57:07 -0700314$(LOCAL_BUILT_MODULE): PRIVATE_ADDITIONAL_CIL_FILES := \
Alex Klyubin7cda44f2017-03-21 14:28:53 -0700315 $(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY))
Jeff Vander Stoepb8787692017-04-21 15:57:07 -0700316$(LOCAL_BUILT_MODULE): $(plat_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
317 $(HOST_OUT_EXECUTABLES)/secilc \
Alex Klyubin7cda44f2017-03-21 14:28:53 -0700318 $(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY))
dcashman2e00e632016-10-12 14:58:09 -0700319 @mkdir -p $(dir $@)
Andreas Gampe3ddc78b2017-04-27 17:16:13 -0700320 $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \
321 $(POLICYVERS) -o $@ $<
Alex Klyubin7cda44f2017-03-21 14:28:53 -0700322 $(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@
Jeff Vander Stoepb8787692017-04-21 15:57:07 -0700323 $(hide) $(HOST_OUT_EXECUTABLES)/secilc -M true -G -N -c $(POLICYVERS) $@ -o /dev/null -f /dev/null
dcashman1faa6442016-11-28 07:20:28 -0800324
Alex Klyubin8f7173b2017-02-25 14:47:53 -0800325built_plat_cil := $(LOCAL_BUILT_MODULE)
dcashman1faa6442016-11-28 07:20:28 -0800326plat_policy.conf :=
327
328#################################
329include $(CLEAR_VARS)
330
Dan Cashman4f9a6482017-04-10 12:27:18 -0700331LOCAL_MODULE := plat_sepolicy_vers.txt
dcashman1faa6442016-11-28 07:20:28 -0800332LOCAL_MODULE_CLASS := ETC
333LOCAL_MODULE_TAGS := optional
Dan Cashman4f9a6482017-04-10 12:27:18 -0700334LOCAL_PROPRIETARY_MODULE := true
335LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
336
337include $(BUILD_SYSTEM)/base_rules.mk
338
339$(LOCAL_BUILT_MODULE) : PRIVATE_PLAT_SEPOL_VERS := $(BOARD_SEPOLICY_VERS)
340$(LOCAL_BUILT_MODULE) :
341 mkdir -p $(dir $@)
342 echo $(PRIVATE_PLAT_SEPOL_VERS) > $@
343
344#################################
345include $(CLEAR_VARS)
346
347LOCAL_MODULE := $(platform_mapping_file)
348LOCAL_MODULE_CLASS := ETC
349LOCAL_MODULE_TAGS := optional
350LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux/mapping
dcashman1faa6442016-11-28 07:20:28 -0800351
352include $(BUILD_SYSTEM)/base_rules.mk
353
Dan Cashmanf8937002017-05-08 14:26:52 -0700354current_mapping.cil := $(intermediates)/mapping/$(PLATFORM_SEPOLICY_VERSION).cil
355ifeq ($(BOARD_SEPOLICY_VERS), $(PLATFORM_SEPOLICY_VERSION))
dcashman1faa6442016-11-28 07:20:28 -0800356# auto-generate the mapping file for current platform policy, since it needs to
357# track platform policy development
Dan Cashman6f14f6b2017-04-07 16:36:23 -0700358$(current_mapping.cil) : PRIVATE_VERS := $(PLATFORM_SEPOLICY_VERSION)
dcashman1faa6442016-11-28 07:20:28 -0800359$(current_mapping.cil) : $(plat_pub_policy.cil) $(HOST_OUT_EXECUTABLES)/version_policy
360 @mkdir -p $(dir $@)
361 $(hide) $(HOST_OUT_EXECUTABLES)/version_policy -b $< -m -n $(PRIVATE_VERS) -o $@
362
Dan Cashmanf8937002017-05-08 14:26:52 -0700363else # ifeq ($(BOARD_SEPOLICY_VERS), $(PLATFORM_SEPOLICY_VERSION))
364prebuilt_mapping_files := $(wildcard $(addsuffix /mapping/$(BOARD_SEPOLICY_VERS).cil, $(PLAT_PRIVATE_POLICY)))
365$(current_mapping.cil) : $(prebuilt_mapping_files)
366 @mkdir -p $(dir $@)
367 cat $^ > $@
Sandeep Patil42f95982017-04-07 14:18:48 -0700368
Dan Cashmanf8937002017-05-08 14:26:52 -0700369prebuilt_mapping_files :=
dcashman1faa6442016-11-28 07:20:28 -0800370endif
371
Dan Cashmanf8937002017-05-08 14:26:52 -0700372$(LOCAL_BUILT_MODULE): $(current_mapping.cil) $(ACP)
Jeff Vander Stoepb8787692017-04-21 15:57:07 -0700373 $(hide) $(ACP) $< $@
dcashman1faa6442016-11-28 07:20:28 -0800374
Alex Klyubin8f7173b2017-02-25 14:47:53 -0800375built_mapping_cil := $(LOCAL_BUILT_MODULE)
dcashman1faa6442016-11-28 07:20:28 -0800376current_mapping.cil :=
377
378#################################
379include $(CLEAR_VARS)
380
Dan Cashman0e9c47c2017-04-04 14:27:41 -0700381LOCAL_MODULE := plat_and_mapping_sepolicy.cil.sha256
382LOCAL_MODULE_CLASS := ETC
383LOCAL_MODULE_TAGS := optional
384LOCAL_MODULE_PATH = $(TARGET_OUT)/etc/selinux
385
386include $(BUILD_SYSTEM)/base_rules.mk
387
388$(LOCAL_BUILT_MODULE): $(built_plat_cil) $(built_mapping_cil)
389 cat $^ | sha256sum | cut -d' ' -f1 > $@
390
391#################################
392include $(CLEAR_VARS)
393
dcashman1faa6442016-11-28 07:20:28 -0800394LOCAL_MODULE := nonplat_sepolicy.cil
395LOCAL_MODULE_CLASS := ETC
396LOCAL_MODULE_TAGS := optional
Alex Klyubin052b0bb2017-03-02 12:39:25 -0800397LOCAL_PROPRIETARY_MODULE := true
398LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
dcashman1faa6442016-11-28 07:20:28 -0800399
400include $(BUILD_SYSTEM)/base_rules.mk
401
Alex Klyubin55961722017-01-30 18:44:59 -0800402# nonplat_policy.conf - A combination of the non-platform private, vendor and
403# the exported platform policy associated with the version the non-platform
404# policy targets. This needs attributization and to be combined with the
dcashman2e00e632016-10-12 14:58:09 -0700405# platform-provided policy. Like plat_pub_policy.conf, this needs to make use
406# of the reqd_policy_mask files from private policy in order to use checkpolicy.
407nonplat_policy.conf := $(intermediates)/nonplat_policy.conf
408$(nonplat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
409$(nonplat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Dan Cashman1c040272016-12-15 15:28:44 -0800410$(nonplat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700411$(nonplat_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
dcashman2e00e632016-10-12 14:58:09 -0700412$(nonplat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
413$(nonplat_policy.conf): $(call build_policy, $(sepolicy_build_files), \
Dan Cashman6bf50e52017-04-12 11:12:17 -0700414$(PLAT_PUBLIC_POLICY) $(REQD_MASK_POLICY) $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS))
Ying Wang02fb5f32012-01-17 17:51:09 -0800415 @mkdir -p $(dir $@)
William Robertsd2185582015-07-16 11:28:02 -0700416 $(hide) m4 $(PRIVATE_ADDITIONAL_M4DEFS) \
417 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
Nick Kralevich623975f2014-01-11 01:31:03 -0800418 -D target_build_variant=$(TARGET_BUILD_VARIANT) \
Jorge Lucangeli Obes84db84e2016-11-18 08:42:35 -0500419 -D target_with_dexpreopt=$(WITH_DEXPREOPT) \
Dan Cashman1c040272016-12-15 15:28:44 -0800420 -D target_arch=$(PRIVATE_TGT_ARCH) \
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700421 -D target_with_asan=$(PRIVATE_TGT_WITH_ASAN) \
Alex Klyubinf5446eb2017-03-23 14:27:32 -0700422 -D target_full_treble=$(PRODUCT_FULL_TREBLE) \
Nick Kralevich623975f2014-01-11 01:31:03 -0800423 -s $^ > $@
Robert Craig65d4f442013-03-27 06:30:25 -0400424 $(hide) sed '/dontaudit/d' $@ > $@.dontaudit
Stephen Smalley2dd4e512012-01-04 12:33:27 -0500425
dcashman1faa6442016-11-28 07:20:28 -0800426nonplat_policy_raw := $(intermediates)/nonplat_policy_raw.cil
427$(nonplat_policy_raw): PRIVATE_POL_CONF := $(nonplat_policy.conf)
428$(nonplat_policy_raw): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil)
429$(nonplat_policy_raw): $(HOST_OUT_EXECUTABLES)/checkpolicy $(nonplat_policy.conf) \
430$(reqd_policy_mask.cil)
Ying Wang02fb5f32012-01-17 17:51:09 -0800431 @mkdir -p $(dir $@)
Andreas Gampe3ddc78b2017-04-27 17:16:13 -0700432 $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $< -C -M -c $(POLICYVERS) -o $@.tmp $(PRIVATE_POL_CONF)
dcashman1faa6442016-11-28 07:20:28 -0800433 $(hide) grep -Fxv -f $(PRIVATE_REQD_MASK) $@.tmp > $@
dcashman2e00e632016-10-12 14:58:09 -0700434
Jeff Vander Stoepb8787692017-04-21 15:57:07 -0700435$(LOCAL_BUILT_MODULE) : PRIVATE_VERS := $(BOARD_SEPOLICY_VERS)
436$(LOCAL_BUILT_MODULE) : PRIVATE_TGT_POL := $(nonplat_policy_raw)
437$(LOCAL_BUILT_MODULE) : PRIVATE_DEP_CIL_FILES := $(built_plat_cil) $(built_mapping_cil)
438$(LOCAL_BUILT_MODULE) : $(plat_pub_policy.cil) $(nonplat_policy_raw) \
439$(HOST_OUT_EXECUTABLES)/version_policy $(HOST_OUT_EXECUTABLES)/secilc \
Jeff Vander Stoep5edd96d2017-04-24 16:46:40 -0700440$(built_plat_cil) $(built_mapping_cil)
dcashman2e00e632016-10-12 14:58:09 -0700441 @mkdir -p $(dir $@)
442 $(HOST_OUT_EXECUTABLES)/version_policy -b $< -t $(PRIVATE_TGT_POL) -n $(PRIVATE_VERS) -o $@
Jeff Vander Stoepb8787692017-04-21 15:57:07 -0700443 $(hide) $(HOST_OUT_EXECUTABLES)/secilc -M true -G -N -c $(POLICYVERS) \
Alex Klyubin8f7173b2017-02-25 14:47:53 -0800444 $(PRIVATE_DEP_CIL_FILES) $@ -o /dev/null -f /dev/null
dcashman2e00e632016-10-12 14:58:09 -0700445
Alex Klyubin193dccd2017-03-07 14:05:57 -0800446built_nonplat_cil := $(LOCAL_BUILT_MODULE)
dcashman1faa6442016-11-28 07:20:28 -0800447nonplat_policy.conf :=
448nonplat_policy_raw :=
449
450#################################
451include $(CLEAR_VARS)
Alex Klyubin193dccd2017-03-07 14:05:57 -0800452
453LOCAL_MODULE := precompiled_sepolicy
454LOCAL_MODULE_CLASS := ETC
455LOCAL_MODULE_TAGS := optional
456LOCAL_PROPRIETARY_MODULE := true
457LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
458
459include $(BUILD_SYSTEM)/base_rules.mk
460
461$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := \
462$(built_plat_cil) $(built_mapping_cil) $(built_nonplat_cil)
463$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc \
464$(built_plat_cil) $(built_mapping_cil) $(built_nonplat_cil)
Jeff Vander Stoepac171b42017-04-12 17:01:54 -0700465 $(hide) $(HOST_OUT_EXECUTABLES)/secilc -M true -G -c $(POLICYVERS) \
Alex Klyubin193dccd2017-03-07 14:05:57 -0800466 $(PRIVATE_CIL_FILES) -o $@ -f /dev/null
467
468built_precompiled_sepolicy := $(LOCAL_BUILT_MODULE)
469
470#################################
Dan Cashman0e9c47c2017-04-04 14:27:41 -0700471# SHA-256 digest of the plat_sepolicy.cil and mapping_sepolicy.cil files against
472# which precompiled_policy was built.
Alex Klyubin193dccd2017-03-07 14:05:57 -0800473#################################
474include $(CLEAR_VARS)
Dan Cashman0e9c47c2017-04-04 14:27:41 -0700475LOCAL_MODULE := precompiled_sepolicy.plat_and_mapping.sha256
Alex Klyubin193dccd2017-03-07 14:05:57 -0800476LOCAL_MODULE_CLASS := ETC
477LOCAL_MODULE_TAGS := optional
478LOCAL_PROPRIETARY_MODULE := true
479LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
480
481include $(BUILD_SYSTEM)/base_rules.mk
482
Dan Cashman0e9c47c2017-04-04 14:27:41 -0700483$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(built_plat_cil) $(built_mapping_cil)
484$(LOCAL_BUILT_MODULE): $(built_precompiled_sepolicy) $(built_plat_cil) $(built_mapping_cil)
485 cat $(PRIVATE_CIL_FILES) | sha256sum | cut -d' ' -f1 > $@
Alex Klyubin193dccd2017-03-07 14:05:57 -0800486
487#################################
488include $(CLEAR_VARS)
Dan Cashman1c040272016-12-15 15:28:44 -0800489# build this target so that we can still perform neverallow checks
dcashman1faa6442016-11-28 07:20:28 -0800490
491LOCAL_MODULE := sepolicy
492LOCAL_MODULE_CLASS := ETC
493LOCAL_MODULE_TAGS := optional
Daniel Cashman65d01342016-12-17 00:53:26 +0000494LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
dcashman2e00e632016-10-12 14:58:09 -0700495
dcashman1faa6442016-11-28 07:20:28 -0800496include $(BUILD_SYSTEM)/base_rules.mk
497
dcashman2e00e632016-10-12 14:58:09 -0700498all_cil_files := \
Jeff Vander Stoepb8787692017-04-21 15:57:07 -0700499 $(built_plat_cil) \
500 $(built_mapping_cil) \
501 $(built_nonplat_cil)
dcashman2e00e632016-10-12 14:58:09 -0700502
503$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(all_cil_files)
504$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $(all_cil_files)
505 @mkdir -p $(dir $@)
Jeff Vander Stoep748cae82017-04-13 14:16:29 -0700506 $(hide) $< -M true -G -c $(POLICYVERS) $(PRIVATE_CIL_FILES) -o $@.tmp -f /dev/null
Nick Kralevichbca98ef2016-02-26 20:06:52 -0800507 $(hide) $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $@.tmp permissive > $@.permissivedomains
508 $(hide) if [ "$(TARGET_BUILD_VARIANT)" = "user" -a -s $@.permissivedomains ]; then \
509 echo "==========" 1>&2; \
510 echo "ERROR: permissive domains not allowed in user builds" 1>&2; \
511 echo "List of invalid domains:" 1>&2; \
512 cat $@.permissivedomains 1>&2; \
513 exit 1; \
514 fi
515 $(hide) mv $@.tmp $@
Ying Wang02fb5f32012-01-17 17:51:09 -0800516
Ying Wangd8b122c2012-10-25 19:01:31 -0700517built_sepolicy := $(LOCAL_BUILT_MODULE)
dcashman2e00e632016-10-12 14:58:09 -0700518all_cil_files :=
Stephen Smalley01a58af2012-10-02 12:46:37 -0400519
Alex Klyubin84aa7422017-03-10 09:36:07 -0800520#################################
521include $(CLEAR_VARS)
522
523# keep concrete sepolicy for neverallow checks
524
525LOCAL_MODULE := sepolicy.recovery
Alex Klyubinec78c372017-03-10 12:44:16 -0800526LOCAL_MODULE_STEM := sepolicy
Alex Klyubin84aa7422017-03-10 09:36:07 -0800527LOCAL_MODULE_CLASS := ETC
528LOCAL_MODULE_TAGS := optional
Alex Klyubinec78c372017-03-10 12:44:16 -0800529LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
Alex Klyubin84aa7422017-03-10 09:36:07 -0800530
531include $(BUILD_SYSTEM)/base_rules.mk
532
Dan Cashmanc8d45352017-04-11 07:38:48 -0700533sepolicy.recovery.conf := $(intermediates)/sepolicy.recovery.conf
534$(sepolicy.recovery.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
535$(sepolicy.recovery.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
536$(sepolicy.recovery.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
537$(sepolicy.recovery.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
538$(sepolicy.recovery.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
539$(sepolicy.recovery.conf): $(call build_policy, $(sepolicy_build_files), \
540 $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) \
541 $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS))
Dan Cashman1c040272016-12-15 15:28:44 -0800542 @mkdir -p $(dir $@)
543 $(hide) m4 $(PRIVATE_ADDITIONAL_M4DEFS) \
544 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
545 -D target_build_variant=$(TARGET_BUILD_VARIANT) \
Dan Cashman1c040272016-12-15 15:28:44 -0800546 -D target_with_dexpreopt=$(WITH_DEXPREOPT) \
Dan Cashman1c040272016-12-15 15:28:44 -0800547 -D target_arch=$(PRIVATE_TGT_ARCH) \
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700548 -D target_with_asan=$(PRIVATE_TGT_WITH_ASAN) \
Dan Cashman1c040272016-12-15 15:28:44 -0800549 -D target_recovery=true \
550 -s $^ > $@
551 $(hide) sed '/dontaudit/d' $@ > $@.dontaudit
552
Dan Cashmanc8d45352017-04-11 07:38:48 -0700553$(LOCAL_BUILT_MODULE): $(sepolicy.recovery.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
554 $(HOST_OUT_EXECUTABLES)/sepolicy-analyze
Dan Cashman1c040272016-12-15 15:28:44 -0800555 @mkdir -p $(dir $@)
Andreas Gampe3ddc78b2017-04-27 17:16:13 -0700556 $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c \
557 $(POLICYVERS) -o $@.tmp $<
Nick Kralevichbca98ef2016-02-26 20:06:52 -0800558 $(hide) $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $@.tmp permissive > $@.permissivedomains
559 $(hide) if [ "$(TARGET_BUILD_VARIANT)" = "user" -a -s $@.permissivedomains ]; then \
560 echo "==========" 1>&2; \
561 echo "ERROR: permissive domains not allowed in user builds" 1>&2; \
562 echo "List of invalid domains:" 1>&2; \
563 cat $@.permissivedomains 1>&2; \
564 exit 1; \
565 fi
566 $(hide) mv $@.tmp $@
Stephen Smalleye60723a2014-05-29 16:40:15 -0400567
Dan Cashmanc8d45352017-04-11 07:38:48 -0700568sepolicy.recovery.conf :=
Stephen Smalleye60723a2014-05-29 16:40:15 -0400569
dcashman704741a2014-07-25 19:11:52 -0700570##################################
Alex Klyubin446279a2017-04-06 14:45:50 -0700571# SELinux policy embedded into CTS.
572# CTS checks neverallow rules of this policy against the policy of the device under test.
573##################################
dcashman704741a2014-07-25 19:11:52 -0700574include $(CLEAR_VARS)
575
576LOCAL_MODULE := general_sepolicy.conf
577LOCAL_MODULE_CLASS := ETC
578LOCAL_MODULE_TAGS := tests
579
580include $(BUILD_SYSTEM)/base_rules.mk
581
dcashman704741a2014-07-25 19:11:52 -0700582$(LOCAL_BUILT_MODULE): PRIVATE_MLS_SENS := $(MLS_SENS)
583$(LOCAL_BUILT_MODULE): PRIVATE_MLS_CATS := $(MLS_CATS)
Dan Cashman1c040272016-12-15 15:28:44 -0800584$(LOCAL_BUILT_MODULE): PRIVATE_TGT_ARCH := $(my_target_arch)
dcashmancc39f632016-07-22 13:13:11 -0700585$(LOCAL_BUILT_MODULE): $(call build_policy, $(sepolicy_build_files), \
586$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY))
dcashman704741a2014-07-25 19:11:52 -0700587 mkdir -p $(dir $@)
588 $(hide) m4 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
589 -D target_build_variant=user \
Jorge Lucangeli Obes84db84e2016-11-18 08:42:35 -0500590 -D target_with_dexpreopt=$(WITH_DEXPREOPT) \
Dan Cashman1c040272016-12-15 15:28:44 -0800591 -D target_arch=$(PRIVATE_TGT_ARCH) \
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700592 -D target_with_asan=false \
Alex Klyubin446279a2017-04-06 14:45:50 -0700593 -D target_full_treble=cts \
dcashman704741a2014-07-25 19:11:52 -0700594 -s $^ > $@
595 $(hide) sed '/dontaudit/d' $@ > $@.dontaudit
596
William Robertsb8769932015-06-29 16:31:23 -0700597##################################
dcashmand225b692016-12-12 09:29:04 -0800598# TODO - remove this. Keep around until we get the filesystem creation stuff taken care of.
599#
William Robertsb8769932015-06-29 16:31:23 -0700600include $(CLEAR_VARS)
601
Richard Hainesc2d01912015-08-06 17:43:52 +0100602LOCAL_MODULE := file_contexts.bin
Ying Wang02fb5f32012-01-17 17:51:09 -0800603LOCAL_MODULE_CLASS := ETC
604LOCAL_MODULE_TAGS := optional
605LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
606
Stephen Smalley5b340be2012-03-06 11:12:41 -0500607include $(BUILD_SYSTEM)/base_rules.mk
Ying Wang02fb5f32012-01-17 17:51:09 -0800608
William Roberts49693f12016-01-04 12:20:57 -0800609# The file_contexts.bin is built in the following way:
610# 1. Collect all file_contexts files in THIS repository and process them with
611# m4 into a tmp file called file_contexts.local.tmp.
612# 2. Collect all device specific file_contexts files and process them with m4
613# into a tmp file called file_contexts.device.tmp.
614# 3. Run checkfc -e (allow no device fc entries ie empty) and fc_sort on
615# file_contexts.device.tmp and output to file_contexts.device.sorted.tmp.
616# 4. Concatenate file_contexts.local.tmp and file_contexts.device.tmp into
617# file_contexts.concat.tmp.
618# 5. Run checkfc and sefcontext_compile on file_contexts.concat.tmp to produce
619# file_contexts.bin.
620#
621# Note: That a newline file is placed between each file_context file found to
622# ensure a proper build when an fc file is missing an ending newline.
William Roberts29d14682016-01-04 12:20:57 -0800623
Dan Cashmanf8937002017-05-08 14:26:52 -0700624local_fc_files := $(call build_policy, file_contexts, $(PLAT_PRIVATE_POLICY))
625
William Roberts49693f12016-01-04 12:20:57 -0800626ifneq ($(filter address,$(SANITIZE_TARGET)),)
Dan Cashmanf8937002017-05-08 14:26:52 -0700627 local_fc_files := $(local_fc_files) $(wildcard $(addsuffix /file_contexts_asan, $(PLAT_PRIVATE_POLICY)))
William Roberts49693f12016-01-04 12:20:57 -0800628endif
629local_fcfiles_with_nl := $(call add_nl, $(local_fc_files), $(built_nl))
630
631file_contexts.local.tmp := $(intermediates)/file_contexts.local.tmp
632$(file_contexts.local.tmp): $(local_fcfiles_with_nl)
Stephen Smalley5b340be2012-03-06 11:12:41 -0500633 @mkdir -p $(dir $@)
William Roberts49693f12016-01-04 12:20:57 -0800634 $(hide) m4 -s $^ > $@
635
636device_fc_files := $(call build_device_policy, file_contexts)
637device_fcfiles_with_nl := $(call add_nl, $(device_fc_files), $(built_nl))
638
639file_contexts.device.tmp := $(intermediates)/file_contexts.device.tmp
640$(file_contexts.device.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
641$(file_contexts.device.tmp): $(device_fcfiles_with_nl)
642 @mkdir -p $(dir $@)
643 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@
644
645file_contexts.device.sorted.tmp := $(intermediates)/file_contexts.device.sorted.tmp
646$(file_contexts.device.sorted.tmp): PRIVATE_SEPOLICY := $(built_sepolicy)
647$(file_contexts.device.sorted.tmp): $(file_contexts.device.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/fc_sort $(HOST_OUT_EXECUTABLES)/checkfc
648 @mkdir -p $(dir $@)
dcashman07791552016-12-07 11:27:47 -0800649 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e $(PRIVATE_SEPOLICY) $<
William Roberts49693f12016-01-04 12:20:57 -0800650 $(hide) $(HOST_OUT_EXECUTABLES)/fc_sort $< $@
651
652file_contexts.concat.tmp := $(intermediates)/file_contexts.concat.tmp
653$(file_contexts.concat.tmp): $(file_contexts.local.tmp) $(file_contexts.device.sorted.tmp)
654 @mkdir -p $(dir $@)
655 $(hide) m4 -s $^ > $@
Stephen Smalley5b340be2012-03-06 11:12:41 -0500656
William Roberts3746a0a2015-09-25 10:18:44 -0700657$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
William Roberts49693f12016-01-04 12:20:57 -0800658$(LOCAL_BUILT_MODULE): $(file_contexts.concat.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/sefcontext_compile $(HOST_OUT_EXECUTABLES)/checkfc
Richard Hainesc2d01912015-08-06 17:43:52 +0100659 @mkdir -p $(dir $@)
dcashman07791552016-12-07 11:27:47 -0800660 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc $(PRIVATE_SEPOLICY) $<
Richard Hainesc2d01912015-08-06 17:43:52 +0100661 $(hide) $(HOST_OUT_EXECUTABLES)/sefcontext_compile -o $@ $<
662
Robert Craig8b7545b2014-03-20 09:35:08 -0400663built_fc := $(LOCAL_BUILT_MODULE)
William Roberts49693f12016-01-04 12:20:57 -0800664local_fc_files :=
665local_fcfiles_with_nl :=
666device_fc_files :=
667device_fcfiles_with_nl :=
668file_contexts.concat.tmp :=
669file_contexts.device.sorted.tmp :=
670file_contexts.device.tmp :=
671file_contexts.local.tmp :=
William Roberts171a0622012-08-16 10:55:05 -0700672
Ying Wang02fb5f32012-01-17 17:51:09 -0800673##################################
674include $(CLEAR_VARS)
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400675
Alex Klyubinec78c372017-03-10 12:44:16 -0800676LOCAL_MODULE := file_contexts.bin.recovery
677LOCAL_MODULE_STEM := file_contexts.bin
678LOCAL_MODULE_CLASS := ETC
679LOCAL_MODULE_TAGS := optional
680LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
681
682include $(BUILD_SYSTEM)/base_rules.mk
683
684$(LOCAL_BUILT_MODULE): $(built_fc)
685 $(hide) cp -f $< $@
686
687##################################
688include $(CLEAR_VARS)
689
dcashmand225b692016-12-12 09:29:04 -0800690LOCAL_MODULE := plat_file_contexts
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400691LOCAL_MODULE_CLASS := ETC
dcashmand225b692016-12-12 09:29:04 -0800692LOCAL_MODULE_TAGS := optional
Jeff Vander Stoep0cb417a2017-03-08 14:12:54 -0800693LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400694
695include $(BUILD_SYSTEM)/base_rules.mk
696
Dan Cashmanf8937002017-05-08 14:26:52 -0700697local_fc_files := $(call build_policy, file_contexts, $(PLAT_PRIVATE_POLICY))
dcashmand225b692016-12-12 09:29:04 -0800698ifneq ($(filter address,$(SANITIZE_TARGET)),)
Dan Cashman5e9451b2017-05-10 17:25:14 -0700699 local_fc_files += $(wildcard $(addsuffix /file_contexts_asan, $(PLAT_PRIVATE_POLICY)))
dcashmand225b692016-12-12 09:29:04 -0800700endif
Alex Klyubine4665d72017-01-19 19:58:34 -0800701local_fcfiles_with_nl := $(call add_nl, $(local_fc_files), $(built_nl))
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400702
Alex Klyubine4665d72017-01-19 19:58:34 -0800703$(LOCAL_BUILT_MODULE): PRIVATE_FC_FILES := $(local_fcfiles_with_nl)
dcashmand225b692016-12-12 09:29:04 -0800704$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Alex Klyubine4665d72017-01-19 19:58:34 -0800705$(LOCAL_BUILT_MODULE): PRIVATE_FC_SORT := $(HOST_OUT_EXECUTABLES)/fc_sort
706$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/checkfc $(HOST_OUT_EXECUTABLES)/fc_sort \
707$(local_fcfiles_with_nl) $(built_sepolicy)
Richard Hainesc2d01912015-08-06 17:43:52 +0100708 @mkdir -p $(dir $@)
Alex Klyubine4665d72017-01-19 19:58:34 -0800709 $(hide) m4 -s $(PRIVATE_FC_FILES) > $@.tmp
710 $(hide) $< $(PRIVATE_SEPOLICY) $@.tmp
711 $(hide) $(PRIVATE_FC_SORT) $@.tmp $@
Richard Hainesc2d01912015-08-06 17:43:52 +0100712
dcashmand225b692016-12-12 09:29:04 -0800713built_plat_fc := $(LOCAL_BUILT_MODULE)
714local_fc_files :=
Alex Klyubine4665d72017-01-19 19:58:34 -0800715local_fcfiles_with_nl :=
dcashmand225b692016-12-12 09:29:04 -0800716
717##################################
718include $(CLEAR_VARS)
719
720LOCAL_MODULE := nonplat_file_contexts
721LOCAL_MODULE_CLASS := ETC
722LOCAL_MODULE_TAGS := optional
Jeff Vander Stoep0cb417a2017-03-08 14:12:54 -0800723LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
dcashmand225b692016-12-12 09:29:04 -0800724
725include $(BUILD_SYSTEM)/base_rules.mk
726
727nonplat_fc_files := $(call build_device_policy, file_contexts)
728nonplat_fcfiles_with_nl := $(call add_nl, $(nonplat_fc_files), $(built_nl))
729
730$(LOCAL_BUILT_MODULE): PRIVATE_FC_FILES := $(nonplat_fcfiles_with_nl)
731$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
732$(LOCAL_BUILT_MODULE): PRIVATE_FC_SORT := $(HOST_OUT_EXECUTABLES)/fc_sort
733$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/checkfc $(HOST_OUT_EXECUTABLES)/fc_sort \
Alex Klyubine4665d72017-01-19 19:58:34 -0800734$(nonplat_fcfiles_with_nl) $(built_sepolicy)
dcashmand225b692016-12-12 09:29:04 -0800735 @mkdir -p $(dir $@)
736 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_FC_FILES) > $@.tmp
737 $(hide) $< $(PRIVATE_SEPOLICY) $@.tmp
738 $(hide) $(PRIVATE_FC_SORT) $@.tmp $@
739
740built_nonplat_fc := $(LOCAL_BUILT_MODULE)
741nonplat_fc_files :=
742nonplat_fcfiles_with_nl :=
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400743
744##################################
745include $(CLEAR_VARS)
Dan Cashman9c038072016-12-22 07:15:18 -0800746LOCAL_MODULE := plat_seapp_contexts
Ying Wang02fb5f32012-01-17 17:51:09 -0800747LOCAL_MODULE_CLASS := ETC
748LOCAL_MODULE_TAGS := optional
Jeff Vander Stoep4e3a4c72017-03-08 22:28:03 -0800749ifeq ($(PRODUCT_FULL_TREBLE),true)
750LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
751else
Ying Wang02fb5f32012-01-17 17:51:09 -0800752LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Jeff Vander Stoep4e3a4c72017-03-08 22:28:03 -0800753endif
Ying Wang02fb5f32012-01-17 17:51:09 -0800754
William Roberts171a0622012-08-16 10:55:05 -0700755include $(BUILD_SYSTEM)/base_rules.mk
Ying Wang02fb5f32012-01-17 17:51:09 -0800756
Dan Cashman9c038072016-12-22 07:15:18 -0800757plat_sc_files := $(call build_policy, seapp_contexts, $(PLAT_PRIVATE_POLICY))
William Roberts171a0622012-08-16 10:55:05 -0700758
Ying Wangd8b122c2012-10-25 19:01:31 -0700759$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Dan Cashman9c038072016-12-22 07:15:18 -0800760$(LOCAL_BUILT_MODULE): PRIVATE_SC_FILES := $(plat_sc_files)
761$(LOCAL_BUILT_MODULE): $(built_sepolicy) $(plat_sc_files) $(HOST_OUT_EXECUTABLES)/checkseapp
William Robertsf0e0a942012-08-27 15:41:15 -0700762 @mkdir -p $(dir $@)
William Roberts99fe8df2015-06-30 13:53:51 -0700763 $(hide) $(HOST_OUT_EXECUTABLES)/checkseapp -p $(PRIVATE_SEPOLICY) -o $@ $(PRIVATE_SC_FILES)
Ying Wang02fb5f32012-01-17 17:51:09 -0800764
Dan Cashman9c038072016-12-22 07:15:18 -0800765built_plat_sc := $(LOCAL_BUILT_MODULE)
766plat_sc_files :=
Robert Craig8b7545b2014-03-20 09:35:08 -0400767
Ying Wang02fb5f32012-01-17 17:51:09 -0800768##################################
Stephen Smalley124720a2012-04-04 10:11:16 -0400769include $(CLEAR_VARS)
Dan Cashman9c038072016-12-22 07:15:18 -0800770LOCAL_MODULE := nonplat_seapp_contexts
Stephen Smalley37712872015-03-12 15:46:36 -0400771LOCAL_MODULE_CLASS := ETC
Dan Cashman9c038072016-12-22 07:15:18 -0800772LOCAL_MODULE_TAGS := optional
Jeff Vander Stoep4e3a4c72017-03-08 22:28:03 -0800773ifeq ($(PRODUCT_FULL_TREBLE),true)
774LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
775else
Dan Cashman9c038072016-12-22 07:15:18 -0800776LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Jeff Vander Stoep4e3a4c72017-03-08 22:28:03 -0800777endif
Stephen Smalley37712872015-03-12 15:46:36 -0400778
779include $(BUILD_SYSTEM)/base_rules.mk
780
Alex Klyubin55961722017-01-30 18:44:59 -0800781nonplat_sc_files := $(call build_policy, seapp_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
Dan Cashmanf8937002017-05-08 14:26:52 -0700782plat_sc_neverallow_files := $(call build_policy, seapp_contexts, $(PLAT_PRIVATE_POLICY))
Stephen Smalley37712872015-03-12 15:46:36 -0400783
Dan Cashman9c038072016-12-22 07:15:18 -0800784$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
785$(LOCAL_BUILT_MODULE): PRIVATE_SC_FILES := $(nonplat_sc_files)
Jeff Vander Stoep87ae5f72017-03-06 22:53:09 -0800786$(LOCAL_BUILT_MODULE): PRIVATE_SC_NEVERALLOW_FILES := $(plat_sc_neverallow_files)
787$(LOCAL_BUILT_MODULE): $(built_sepolicy) $(nonplat_sc_files) $(HOST_OUT_EXECUTABLES)/checkseapp $(plat_sc_neverallow_files)
Stephen Smalley37712872015-03-12 15:46:36 -0400788 @mkdir -p $(dir $@)
Xin Liec6f3932017-03-14 16:51:13 -0700789 $(hide) grep -ie '^neverallow' $(PRIVATE_SC_NEVERALLOW_FILES) > $@.tmp
790 $(hide) $(HOST_OUT_EXECUTABLES)/checkseapp -p $(PRIVATE_SEPOLICY) -o $@ $(PRIVATE_SC_FILES) $@.tmp
Stephen Smalley37712872015-03-12 15:46:36 -0400791
Dan Cashman9c038072016-12-22 07:15:18 -0800792built_nonplat_sc := $(LOCAL_BUILT_MODULE)
793nonplat_sc_files :=
Stephen Smalley37712872015-03-12 15:46:36 -0400794
795##################################
796include $(CLEAR_VARS)
Dan Cashman9c038072016-12-22 07:15:18 -0800797LOCAL_MODULE := plat_seapp_neverallows
William Roberts4ee71312015-06-25 11:59:30 -0700798LOCAL_MODULE_CLASS := ETC
799LOCAL_MODULE_TAGS := tests
800
801include $(BUILD_SYSTEM)/base_rules.mk
802
Jeff Vander Stoep87ae5f72017-03-06 22:53:09 -0800803$(LOCAL_BUILT_MODULE): $(plat_sc_neverallow_files)
William Roberts4ee71312015-06-25 11:59:30 -0700804 @mkdir -p $(dir $@)
805 - $(hide) grep -ie '^neverallow' $< > $@
806
Jeff Vander Stoep87ae5f72017-03-06 22:53:09 -0800807plat_sc_neverallow_files :=
William Roberts4ee71312015-06-25 11:59:30 -0700808
809##################################
810include $(CLEAR_VARS)
Stephen Smalley124720a2012-04-04 10:11:16 -0400811
Sandeep Patila86316e2016-12-27 16:08:44 -0800812LOCAL_MODULE := plat_property_contexts
Stephen Smalley124720a2012-04-04 10:11:16 -0400813LOCAL_MODULE_CLASS := ETC
814LOCAL_MODULE_TAGS := optional
Alex Klyubin9d590412017-03-08 13:10:05 -0800815
816ifeq ($(PRODUCT_FULL_TREBLE),true)
817LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
818else
Stephen Smalley124720a2012-04-04 10:11:16 -0400819LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Alex Klyubin9d590412017-03-08 13:10:05 -0800820endif
Stephen Smalley124720a2012-04-04 10:11:16 -0400821
822include $(BUILD_SYSTEM)/base_rules.mk
823
Sandeep Patila86316e2016-12-27 16:08:44 -0800824plat_pcfiles := $(call build_policy, property_contexts, $(PLAT_PRIVATE_POLICY))
William Roberts6aabc1c2015-07-30 11:44:26 -0700825
Sandeep Patila86316e2016-12-27 16:08:44 -0800826plat_property_contexts.tmp := $(intermediates)/plat_property_contexts.tmp
827$(plat_property_contexts.tmp): PRIVATE_PC_FILES := $(plat_pcfiles)
828$(plat_property_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
829$(plat_property_contexts.tmp): $(plat_pcfiles)
William Roberts7f81b332015-09-29 13:52:37 -0700830 @mkdir -p $(dir $@)
Colin Cross9eb6c872015-10-01 21:25:09 +0000831 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_PC_FILES) > $@
William Robertsdcffd2b2015-09-29 13:52:37 -0700832$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Sandeep Patila86316e2016-12-27 16:08:44 -0800833$(LOCAL_BUILT_MODULE): $(plat_property_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc
William Robertsdcffd2b2015-09-29 13:52:37 -0700834 @mkdir -p $(dir $@)
Sandeep Patila86316e2016-12-27 16:08:44 -0800835 $(hide) sed -e 's/#.*$$//' -e '/^$$/d' $< | sort -u -o $@
dcashman07791552016-12-07 11:27:47 -0800836 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -p $(PRIVATE_SEPOLICY) $@
Stephen Smalley124720a2012-04-04 10:11:16 -0400837
Sandeep Patila86316e2016-12-27 16:08:44 -0800838built_plat_pc := $(LOCAL_BUILT_MODULE)
839plat_pcfiles :=
840plat_property_contexts.tmp :=
Robert Craig8b7545b2014-03-20 09:35:08 -0400841
Stephen Smalley124720a2012-04-04 10:11:16 -0400842##################################
Riley Spahnf90c41f2014-06-05 15:52:02 -0700843include $(CLEAR_VARS)
Sandeep Patila86316e2016-12-27 16:08:44 -0800844LOCAL_MODULE := nonplat_property_contexts
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400845LOCAL_MODULE_CLASS := ETC
Sandeep Patila86316e2016-12-27 16:08:44 -0800846LOCAL_MODULE_TAGS := optional
Alex Klyubin9d590412017-03-08 13:10:05 -0800847
848ifeq ($(PRODUCT_FULL_TREBLE),true)
849LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
850else
Sandeep Patila86316e2016-12-27 16:08:44 -0800851LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Alex Klyubin9d590412017-03-08 13:10:05 -0800852endif
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400853
Stephen Smalleyc9361732015-03-13 09:36:57 -0400854include $(BUILD_SYSTEM)/base_rules.mk
855
Alex Klyubin55961722017-01-30 18:44:59 -0800856nonplat_pcfiles := $(call build_policy, property_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
Sandeep Patil262edc32016-12-27 16:08:44 -0800857
Sandeep Patila86316e2016-12-27 16:08:44 -0800858nonplat_property_contexts.tmp := $(intermediates)/nonplat_property_contexts.tmp
859$(nonplat_property_contexts.tmp): PRIVATE_PC_FILES := $(nonplat_pcfiles)
860$(nonplat_property_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
861$(nonplat_property_contexts.tmp): $(nonplat_pcfiles)
William Robertsdcffd2b2015-09-29 13:52:37 -0700862 @mkdir -p $(dir $@)
Sandeep Patila86316e2016-12-27 16:08:44 -0800863 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_PC_FILES) > $@
864
865
866$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
867$(LOCAL_BUILT_MODULE): $(nonplat_property_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc
868 @mkdir -p $(dir $@)
869 $(hide) sed -e 's/#.*$$//' -e '/^$$/d' $< | sort -u -o $@
dcashman07791552016-12-07 11:27:47 -0800870 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -p $(PRIVATE_SEPOLICY) $@
William Robertsdcffd2b2015-09-29 13:52:37 -0700871
Sandeep Patila86316e2016-12-27 16:08:44 -0800872built_nonplat_pc := $(LOCAL_BUILT_MODULE)
873nonplat_pcfiles :=
874nonplat_property_contexts.tmp :=
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400875
876##################################
877include $(CLEAR_VARS)
878
Alex Klyubinec78c372017-03-10 12:44:16 -0800879LOCAL_MODULE := plat_property_contexts.recovery
880LOCAL_MODULE_STEM := plat_property_contexts
881LOCAL_MODULE_CLASS := ETC
882LOCAL_MODULE_TAGS := optional
883LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
884
885include $(BUILD_SYSTEM)/base_rules.mk
886
887$(LOCAL_BUILT_MODULE): $(built_plat_pc)
888 $(hide) cp -f $< $@
889
890##################################
891include $(CLEAR_VARS)
Alex Klyubinec78c372017-03-10 12:44:16 -0800892LOCAL_MODULE := nonplat_property_contexts.recovery
893LOCAL_MODULE_STEM := nonplat_property_contexts
894LOCAL_MODULE_CLASS := ETC
895LOCAL_MODULE_TAGS := optional
896LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
897
898include $(BUILD_SYSTEM)/base_rules.mk
899
900$(LOCAL_BUILT_MODULE): $(built_nonplat_pc)
901 $(hide) cp -f $< $@
902
903##################################
904include $(CLEAR_VARS)
905
Sandeep Patila058b562016-12-27 15:10:48 -0800906LOCAL_MODULE := plat_service_contexts
Riley Spahnf90c41f2014-06-05 15:52:02 -0700907LOCAL_MODULE_CLASS := ETC
908LOCAL_MODULE_TAGS := optional
Jeff Vander Stoep4e3a4c72017-03-08 22:28:03 -0800909ifeq ($(PRODUCT_FULL_TREBLE),true)
910LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
911else
Riley Spahnf90c41f2014-06-05 15:52:02 -0700912LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Jeff Vander Stoep4e3a4c72017-03-08 22:28:03 -0800913endif
Riley Spahnf90c41f2014-06-05 15:52:02 -0700914
915include $(BUILD_SYSTEM)/base_rules.mk
916
Sandeep Patila058b562016-12-27 15:10:48 -0800917plat_svcfiles := $(call build_policy, service_contexts, $(PLAT_PRIVATE_POLICY))
Riley Spahnf90c41f2014-06-05 15:52:02 -0700918
Sandeep Patila058b562016-12-27 15:10:48 -0800919plat_service_contexts.tmp := $(intermediates)/plat_service_contexts.tmp
920$(plat_service_contexts.tmp): PRIVATE_SVC_FILES := $(plat_svcfiles)
921$(plat_service_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
922$(plat_service_contexts.tmp): $(plat_svcfiles)
Riley Spahnf90c41f2014-06-05 15:52:02 -0700923 @mkdir -p $(dir $@)
William Roberts6aabc1c2015-07-30 11:44:26 -0700924 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
William Roberts7fc865a2015-09-29 14:17:38 -0700925
926$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Sandeep Patila058b562016-12-27 15:10:48 -0800927$(LOCAL_BUILT_MODULE): $(plat_service_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
William Roberts7fc865a2015-09-29 14:17:38 -0700928 @mkdir -p $(dir $@)
William Robertsc9fce3f2016-04-06 11:53:04 -0700929 sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
dcashman07791552016-12-07 11:27:47 -0800930 $(HOST_OUT_EXECUTABLES)/checkfc -s $(PRIVATE_SEPOLICY) $@
Riley Spahnf90c41f2014-06-05 15:52:02 -0700931
Sandeep Patila058b562016-12-27 15:10:48 -0800932built_plat_svc := $(LOCAL_BUILT_MODULE)
933plat_svcfiles :=
934plat_service_contexts.tmp :=
Riley Spahnf90c41f2014-06-05 15:52:02 -0700935
936##################################
rpcraigb19665c2012-07-30 09:33:03 -0400937include $(CLEAR_VARS)
938
Sandeep Patila058b562016-12-27 15:10:48 -0800939LOCAL_MODULE := nonplat_service_contexts
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400940LOCAL_MODULE_CLASS := ETC
Sandeep Patila058b562016-12-27 15:10:48 -0800941LOCAL_MODULE_TAGS := optional
Jeff Vander Stoep4e3a4c72017-03-08 22:28:03 -0800942ifeq ($(PRODUCT_FULL_TREBLE),true)
943LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
944else
Sandeep Patila058b562016-12-27 15:10:48 -0800945LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Jeff Vander Stoep4e3a4c72017-03-08 22:28:03 -0800946endif
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400947
948include $(BUILD_SYSTEM)/base_rules.mk
949
Alex Klyubin55961722017-01-30 18:44:59 -0800950nonplat_svcfiles := $(call build_policy, service_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400951
Sandeep Patila058b562016-12-27 15:10:48 -0800952nonplat_service_contexts.tmp := $(intermediates)/nonplat_service_contexts.tmp
953$(nonplat_service_contexts.tmp): PRIVATE_SVC_FILES := $(nonplat_svcfiles)
954$(nonplat_service_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
955$(nonplat_service_contexts.tmp): $(nonplat_svcfiles)
956 @mkdir -p $(dir $@)
957 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
958
959$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
960$(LOCAL_BUILT_MODULE): $(nonplat_service_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
William Roberts7fc865a2015-09-29 14:17:38 -0700961 @mkdir -p $(dir $@)
William Robertsc9fce3f2016-04-06 11:53:04 -0700962 sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
dcashman07791552016-12-07 11:27:47 -0800963 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -s $(PRIVATE_SEPOLICY) $@
William Roberts7fc865a2015-09-29 14:17:38 -0700964
Sandeep Patila058b562016-12-27 15:10:48 -0800965built_nonplat_svc := $(LOCAL_BUILT_MODULE)
966nonplat_svcfiles :=
967nonplat_service_contexts.tmp :=
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400968
969##################################
970include $(CLEAR_VARS)
971
Martijn Coenen3ea47b92017-04-07 16:14:43 -0700972LOCAL_MODULE := plat_hwservice_contexts
973LOCAL_MODULE_CLASS := ETC
974LOCAL_MODULE_TAGS := optional
975ifeq ($(PRODUCT_FULL_TREBLE),true)
976LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
977else
978LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
979endif
980
981include $(BUILD_SYSTEM)/base_rules.mk
982
983plat_hwsvcfiles := $(call build_policy, hwservice_contexts, $(PLAT_PRIVATE_POLICY))
984
985plat_hwservice_contexts.tmp := $(intermediates)/plat_hwservice_contexts.tmp
986$(plat_hwservice_contexts.tmp): PRIVATE_SVC_FILES := $(plat_hwsvcfiles)
987$(plat_hwservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
988$(plat_hwservice_contexts.tmp): $(plat_hwsvcfiles)
989 @mkdir -p $(dir $@)
990 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
991
992$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
993$(LOCAL_BUILT_MODULE): $(plat_hwservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
994 @mkdir -p $(dir $@)
995 sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
996 $(HOST_OUT_EXECUTABLES)/checkfc -e -l $(PRIVATE_SEPOLICY) $@
997
998plat_hwsvcfiles :=
999plat_hwservice_contexts.tmp :=
1000
1001##################################
1002include $(CLEAR_VARS)
1003
1004LOCAL_MODULE := nonplat_hwservice_contexts
1005LOCAL_MODULE_CLASS := ETC
1006LOCAL_MODULE_TAGS := optional
1007ifeq ($(PRODUCT_FULL_TREBLE),true)
1008LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
1009else
1010LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
1011endif
1012
1013include $(BUILD_SYSTEM)/base_rules.mk
1014
1015nonplat_hwsvcfiles := $(call build_policy, hwservice_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
1016
1017nonplat_hwservice_contexts.tmp := $(intermediates)/nonplat_hwservice_contexts.tmp
1018$(nonplat_hwservice_contexts.tmp): PRIVATE_SVC_FILES := $(nonplat_hwsvcfiles)
1019$(nonplat_hwservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1020$(nonplat_hwservice_contexts.tmp): $(nonplat_hwsvcfiles)
1021 @mkdir -p $(dir $@)
1022 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
1023
1024$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
1025$(LOCAL_BUILT_MODULE): $(nonplat_hwservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
1026 @mkdir -p $(dir $@)
1027 sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
1028 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e -l $(PRIVATE_SEPOLICY) $@
1029
1030nonplat_hwsvcfiles :=
1031nonplat_hwservice_contexts.tmp :=
1032
1033##################################
1034include $(CLEAR_VARS)
1035
Martijn Coenen6676c232017-03-31 17:29:53 -07001036LOCAL_MODULE := vndservice_contexts
1037LOCAL_MODULE_CLASS := ETC
1038LOCAL_MODULE_TAGS := optional
1039ifeq ($(PRODUCT_FULL_TREBLE),true)
1040LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
1041else
1042LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
1043endif
1044
1045include $(BUILD_SYSTEM)/base_rules.mk
1046
1047vnd_svcfiles := $(call build_policy, vndservice_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
1048
1049vndservice_contexts.tmp := $(intermediates)/vndservice_contexts.tmp
1050$(vndservice_contexts.tmp): PRIVATE_SVC_FILES := $(vnd_svcfiles)
1051$(vndservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1052$(vndservice_contexts.tmp): $(vnd_svcfiles)
1053 @mkdir -p $(dir $@)
1054 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
1055
1056$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
1057$(LOCAL_BUILT_MODULE): $(vndservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
1058 @mkdir -p $(dir $@)
1059 sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
Martijn Coenenee976622017-04-07 10:08:55 -07001060 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e -v $(PRIVATE_SEPOLICY) $@
Martijn Coenen6676c232017-03-31 17:29:53 -07001061
1062vnd_svcfiles :=
1063vndservice_contexts.tmp :=
1064##################################
1065include $(CLEAR_VARS)
1066
dcashman90b3b942016-12-14 13:47:55 -08001067LOCAL_MODULE := plat_mac_permissions.xml
rpcraigb19665c2012-07-30 09:33:03 -04001068LOCAL_MODULE_CLASS := ETC
1069LOCAL_MODULE_TAGS := optional
Jeff Vander Stoepbba9e7b2017-03-10 15:51:23 -08001070LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
rpcraigb19665c2012-07-30 09:33:03 -04001071
William Roberts2c8a55d2012-11-30 14:59:09 -08001072include $(BUILD_SYSTEM)/base_rules.mk
rpcraigb19665c2012-07-30 09:33:03 -04001073
Geremy Condracd4104e2013-03-26 18:19:12 +00001074# Build keys.conf
dcashman90b3b942016-12-14 13:47:55 -08001075plat_mac_perms_keys.tmp := $(intermediates)/plat_keys.tmp
1076$(plat_mac_perms_keys.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1077$(plat_mac_perms_keys.tmp): $(call build_policy, keys.conf, $(PLAT_PRIVATE_POLICY))
Geremy Condracd4104e2013-03-26 18:19:12 +00001078 @mkdir -p $(dir $@)
William Robertsd2185582015-07-16 11:28:02 -07001079 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@
Geremy Condracd4104e2013-03-26 18:19:12 +00001080
dcashman90b3b942016-12-14 13:47:55 -08001081all_plat_mac_perms_files := $(call build_policy, mac_permissions.xml, $(PLAT_PRIVATE_POLICY))
rpcraigb19665c2012-07-30 09:33:03 -04001082
Shinichiro Hamajief0c14d2016-05-13 16:04:58 +09001083# Should be synced with keys.conf.
dcashman90b3b942016-12-14 13:47:55 -08001084all_plat_keys := platform media shared testkey
1085all_plat_keys := $(all_keys:%=$(dir $(DEFAULT_SYSTEM_DEV_CERTIFICATE))/%.x509.pem)
Shinichiro Hamajief0c14d2016-05-13 16:04:58 +09001086
dcashman90b3b942016-12-14 13:47:55 -08001087$(LOCAL_BUILT_MODULE): PRIVATE_MAC_PERMS_FILES := $(all_plat_mac_perms_files)
1088$(LOCAL_BUILT_MODULE): $(plat_mac_perms_keys.tmp) $(HOST_OUT_EXECUTABLES)/insertkeys.py \
1089$(all_plat_mac_perms_files) $(all_plat_keys)
Geremy Condracd4104e2013-03-26 18:19:12 +00001090 @mkdir -p $(dir $@)
Nick Kralevichc3c90522013-10-25 12:25:36 -07001091 $(hide) DEFAULT_SYSTEM_DEV_CERTIFICATE="$(dir $(DEFAULT_SYSTEM_DEV_CERTIFICATE))" \
William Roberts6aabc1c2015-07-30 11:44:26 -07001092 $(HOST_OUT_EXECUTABLES)/insertkeys.py -t $(TARGET_BUILD_VARIANT) -c $(TOP) $< -o $@ $(PRIVATE_MAC_PERMS_FILES)
Geremy Condracd4104e2013-03-26 18:19:12 +00001093
William Roberts6aabc1c2015-07-30 11:44:26 -07001094all_mac_perms_files :=
dcashman90b3b942016-12-14 13:47:55 -08001095all_plat_keys :=
1096plat_mac_perms_keys.tmp :=
1097
1098##################################
1099include $(CLEAR_VARS)
1100
1101LOCAL_MODULE := nonplat_mac_permissions.xml
1102LOCAL_MODULE_CLASS := ETC
1103LOCAL_MODULE_TAGS := optional
Jeff Vander Stoepbba9e7b2017-03-10 15:51:23 -08001104LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
dcashman90b3b942016-12-14 13:47:55 -08001105
1106include $(BUILD_SYSTEM)/base_rules.mk
1107
1108# Build keys.conf
1109nonplat_mac_perms_keys.tmp := $(intermediates)/nonplat_keys.tmp
1110$(nonplat_mac_perms_keys.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Alex Klyubin55961722017-01-30 18:44:59 -08001111$(nonplat_mac_perms_keys.tmp): $(call build_policy, keys.conf, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
dcashman90b3b942016-12-14 13:47:55 -08001112 @mkdir -p $(dir $@)
1113 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@
1114
Alex Klyubin55961722017-01-30 18:44:59 -08001115all_nonplat_mac_perms_files := $(call build_policy, mac_permissions.xml, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
dcashman90b3b942016-12-14 13:47:55 -08001116
1117$(LOCAL_BUILT_MODULE): PRIVATE_MAC_PERMS_FILES := $(all_nonplat_mac_perms_files)
1118$(LOCAL_BUILT_MODULE): $(nonplat_mac_perms_keys.tmp) $(HOST_OUT_EXECUTABLES)/insertkeys.py \
1119$(all_nonplat_mac_perms_files)
1120 @mkdir -p $(dir $@)
1121 $(hide) $(HOST_OUT_EXECUTABLES)/insertkeys.py -t $(TARGET_BUILD_VARIANT) -c $(TOP) $< -o $@ $(PRIVATE_MAC_PERMS_FILES)
1122
1123nonplat_mac_perms_keys.tmp :=
1124all_nonplat_mac_perms_files :=
William Roberts6aabc1c2015-07-30 11:44:26 -07001125
rpcraigb19665c2012-07-30 09:33:03 -04001126##################################
rpcraig47cd3962012-10-17 21:09:52 -04001127
Dan Cashman1c040272016-12-15 15:28:44 -08001128add_nl :=
William Roberts49693f12016-01-04 12:20:57 -08001129build_device_policy :=
Dan Cashman1c040272016-12-15 15:28:44 -08001130build_policy :=
dcashmand225b692016-12-12 09:29:04 -08001131built_plat_fc :=
1132built_nonplat_fc :=
Richard Hainesc8801fe2015-12-11 10:39:19 +00001133built_nl :=
Alex Klyubin8f7173b2017-02-25 14:47:53 -08001134built_plat_cil :=
Alex Klyubin8f7173b2017-02-25 14:47:53 -08001135built_mapping_cil :=
Sandeep Patila86316e2016-12-27 16:08:44 -08001136built_plat_pc :=
Alex Klyubin193dccd2017-03-07 14:05:57 -08001137built_nonplat_cil :=
Sandeep Patila86316e2016-12-27 16:08:44 -08001138built_nonplat_pc :=
Dan Cashman9c038072016-12-22 07:15:18 -08001139built_nonplat_sc :=
1140built_plat_sc :=
Alex Klyubin193dccd2017-03-07 14:05:57 -08001141built_precompiled_sepolicy :=
Dan Cashman1c040272016-12-15 15:28:44 -08001142built_sepolicy :=
Sandeep Patila058b562016-12-27 15:10:48 -08001143built_plat_svc :=
1144built_nonplat_svc :=
Jeff Vander Stoepb8787692017-04-21 15:57:07 -07001145mapping_policy :=
Dan Cashman1c040272016-12-15 15:28:44 -08001146my_target_arch :=
dcashman1faa6442016-11-28 07:20:28 -08001147plat_pub_policy.cil :=
1148reqd_policy_mask.cil :=
Dan Cashman1c040272016-12-15 15:28:44 -08001149sepolicy_build_files :=
Alex Klyubin7cda44f2017-03-21 14:28:53 -07001150sepolicy_build_cil_workaround_files :=
Jeff Vander Stoep74434842017-03-13 12:22:15 -07001151with_asan :=
Alice Chucdfb06f2012-11-01 11:33:04 -07001152
1153include $(call all-makefiles-under,$(LOCAL_PATH))