blob: 812c4ca900e241e74e58b069f4eb0cdce21d7ce2 [file] [log] [blame]
Stephen Smalley2dd4e512012-01-04 12:33:27 -05001LOCAL_PATH:= $(call my-dir)
William Robertsf0e0a942012-08-27 15:41:15 -07002
Stephen Smalley2dd4e512012-01-04 12:33:27 -05003include $(CLEAR_VARS)
4
5# SELinux policy version.
Stephen Smalleyb4f17062015-03-13 10:03:52 -04006# Must be <= /sys/fs/selinux/policyvers reported by the Android kernel.
Stephen Smalley2dd4e512012-01-04 12:33:27 -05007# Must be within the compatibility range reported by checkpolicy -V.
Jeff Vander Stoep3a0ce492015-12-07 08:30:43 -08008POLICYVERS ?= 30
Stephen Smalley2dd4e512012-01-04 12:33:27 -05009
10MLS_SENS=1
11MLS_CATS=1024
12
Stephen Smalleyb4f17062015-03-13 10:03:52 -040013ifdef BOARD_SEPOLICY_REPLACE
14$(error BOARD_SEPOLICY_REPLACE is no longer supported; please remove from your BoardConfig.mk or other .mk file.)
15endif
16
17ifdef BOARD_SEPOLICY_IGNORE
18$(error BOARD_SEPOLICY_IGNORE is no longer supported; please remove from your BoardConfig.mk or other .mk file.)
19endif
Stephen Smalley5b340be2012-03-06 11:12:41 -050020
Stephen Smalley8e0ca882015-04-01 10:14:56 -040021ifdef BOARD_SEPOLICY_UNION
22$(warning BOARD_SEPOLICY_UNION is no longer required - all files found in BOARD_SEPOLICY_DIRS are implicitly unioned; please remove from your BoardConfig.mk or other .mk file.)
23endif
Robert Craig6b0ff472014-01-29 13:10:58 -050024
William Robertsd2185582015-07-16 11:28:02 -070025ifdef BOARD_SEPOLICY_M4DEFS
26LOCAL_ADDITIONAL_M4DEFS := $(addprefix -D, $(BOARD_SEPOLICY_M4DEFS))
27endif
28
dcashmancc39f632016-07-22 13:13:11 -070029# sepolicy is now divided into multiple portions:
30# public - policy exported on which non-platform policy developers may write
31# additional policy. types and attributes are versioned and included in
32# delivered non-platform policy, which is to be combined with platform policy.
33# private - platform-only policy required for platform functionality but which
34# is not exported to vendor policy developers and as such may not be assumed
35# to exist.
Alex Klyubin55961722017-01-30 18:44:59 -080036# vendor - vendor-only policy required for vendor functionality. This policy can
37# reference the public policy but cannot reference the private policy. This
38# policy is for components which are produced from the core/non-vendor tree and
39# placed into a vendor partition.
dcashman07791552016-12-07 11:27:47 -080040# mapping - This contains policy statements which map the attributes
dcashmancc39f632016-07-22 13:13:11 -070041# exposed in the public policy of previous versions to the concrete types used
42# in this policy to ensure that policy targeting attributes from public
43# policy from an older platform version continues to work.
44
dcashman2e00e632016-10-12 14:58:09 -070045# build process for device:
dcashmancc39f632016-07-22 13:13:11 -070046# 1) convert policies to CIL:
47# - private + public platform policy to CIL
48# - mapping file to CIL (should already be in CIL form)
49# - non-platform public policy to CIL
50# - non-platform public + private policy to CIL
51# 2) attributize policy
dcashmancc39f632016-07-22 13:13:11 -070052# - run script which takes non-platform public and non-platform combined
53# private + public policy and produces attributized and versioned
54# non-platform policy
55# 3) combine policy files
56# - combine mapping, platform and non-platform policy.
57# - compile output binary policy file
58
59PLAT_PUBLIC_POLICY := $(LOCAL_PATH)/public
60PLAT_PRIVATE_POLICY := $(LOCAL_PATH)/private
Alex Klyubin55961722017-01-30 18:44:59 -080061PLAT_VENDOR_POLICY := $(LOCAL_PATH)/vendor
dcashman2e00e632016-10-12 14:58:09 -070062REQD_MASK_POLICY := $(LOCAL_PATH)/reqd_mask
63
64# TODO: move to README when doing the README update and finalizing versioning.
65# BOARD_SEPOLICY_VERS should contain the platform version identifier
66# corresponding to the platform on which the non-platform policy is to be
67# based. If unspecified, this will build against the current public platform
68# policy in tree.
69# BOARD_SEPOLICY_VERS_DIR should contain the public platform policy which
70# is associated with the given BOARD_SEPOLICY_VERS. The policy therein will be
71# versioned according to the BOARD_SEPOLICY_VERS identifier and included as
72# part of the non-platform policy to ensure removal of access in future
73# platform policy does not break non-platform policy.
74ifndef BOARD_SEPOLICY_VERS
75$(warning BOARD_SEPOLICY_VERS not specified, assuming current platform version)
76BOARD_SEPOLICY_VERS := current
77BOARD_SEPOLICY_VERS_DIR := $(PLAT_PUBLIC_POLICY)
78else
79ifndef BOARD_SEPOLICY_VERS_DIR
80$(error BOARD_SEPOLICY_VERS_DIR not specified for versioned sepolicy.)
81endif
82endif
dcashmancc39f632016-07-22 13:13:11 -070083
84###########################################################
85# Compute policy files to be used in policy build.
86# $(1): files to include
87# $(2): directories in which to find files
88###########################################################
89
90define build_policy
91$(foreach type, $(1), $(foreach file, $(addsuffix /$(type), $(2)), $(sort $(wildcard $(file)))))
92endef
William Roberts29d14682016-01-04 12:20:57 -080093
William Roberts49693f12016-01-04 12:20:57 -080094# Builds paths for all policy files found in BOARD_SEPOLICY_DIRS.
95# $(1): the set of policy name paths to build
Alex Klyubin55961722017-01-30 18:44:59 -080096build_device_policy = $(call build_policy, $(1), $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS))
William Roberts49693f12016-01-04 12:20:57 -080097
Richard Hainesc8801fe2015-12-11 10:39:19 +000098# Add a file containing only a newline in-between each policy configuration
99# 'contexts' file. This will allow OEM policy configuration files without a
100# final newline (0x0A) to be built correctly by the m4(1) macro processor.
101# $(1): the set of contexts file names.
102# $(2): the file containing only 0x0A.
103add_nl = $(foreach entry, $(1), $(subst $(entry), $(entry) $(2), $(entry)))
104
dcashman704741a2014-07-25 19:11:52 -0700105sepolicy_build_files := security_classes \
106 initial_sids \
107 access_vectors \
108 global_macros \
Nick Kralevicha17a2662014-11-05 15:30:41 -0800109 neverallow_macros \
dcashman704741a2014-07-25 19:11:52 -0700110 mls_macros \
dcashman2e00e632016-10-12 14:58:09 -0700111 mls_decl \
dcashman704741a2014-07-25 19:11:52 -0700112 mls \
113 policy_capabilities \
114 te_macros \
115 attributes \
Jeff Vander Stoepcbaa2b72015-12-22 10:39:34 -0800116 ioctl_defines \
Jeff Vander Stoepde9b5302015-06-05 15:28:55 -0700117 ioctl_macros \
dcashman704741a2014-07-25 19:11:52 -0700118 *.te \
dcashman2e00e632016-10-12 14:58:09 -0700119 roles_decl \
dcashman704741a2014-07-25 19:11:52 -0700120 roles \
121 users \
122 initial_sid_contexts \
123 fs_use \
124 genfs_contexts \
125 port_contexts
126
Dan Cashman1c040272016-12-15 15:28:44 -0800127my_target_arch := $(TARGET_ARCH)
128ifneq (,$(filter mips mips64,$(TARGET_ARCH)))
129 my_target_arch := mips
130endif
131
Ying Wang02fb5f32012-01-17 17:51:09 -0800132##################################
dcashman2e00e632016-10-12 14:58:09 -0700133# reqd_policy_mask - a policy.conf file which contains only the bare minimum
134# policy necessary to use checkpolicy. This bare-minimum policy needs to be
135# present in all policy.conf files, but should not necessarily be exported as
136# part of the public policy. The rules generated by reqd_policy_mask will allow
137# the compilation of public policy and subsequent removal of CIL policy that
138# should not be exported.
139
140reqd_policy_mask.conf := $(intermediates)/reqd_policy_mask.conf
141$(reqd_policy_mask.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
142$(reqd_policy_mask.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Dan Cashman1c040272016-12-15 15:28:44 -0800143$(reqd_policy_mask.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
dcashman2e00e632016-10-12 14:58:09 -0700144$(reqd_policy_mask.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
145$(reqd_policy_mask.conf): $(call build_policy, $(sepolicy_build_files), $(REQD_MASK_POLICY))
146 @mkdir -p $(dir $@)
147 $(hide) m4 $(PRIVATE_ADDITIONAL_M4DEFS) \
148 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
149 -D target_build_variant=$(TARGET_BUILD_VARIANT) \
Dan Cashman1c040272016-12-15 15:28:44 -0800150 -D target_with_dexpreopt=$(WITH_DEXPREOPT) \
Dan Cashman1c040272016-12-15 15:28:44 -0800151 -D target_arch=$(PRIVATE_TGT_ARCH) \
dcashman2e00e632016-10-12 14:58:09 -0700152 -s $^ > $@
153
154reqd_policy_mask.cil := $(intermediates)/reqd_policy_mask.cil
155$(reqd_policy_mask.cil): $(reqd_policy_mask.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy
156 @mkdir -p $(dir $@)
157 $(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -C -M -c $(POLICYVERS) -o $@ $<
158
dcashman1faa6442016-11-28 07:20:28 -0800159reqd_policy_mask.conf :=
160
161##################################
dcashman2e00e632016-10-12 14:58:09 -0700162# plat_pub_policy - policy that will be exported to be a part of non-platform
163# policy corresponding to this platform version. This is a limited subset of
164# policy that would not compile in checkpolicy on its own. To get around this
165# limitation, add only the required files from private policy, which will
166# generate CIL policy that will then be filtered out by the reqd_policy_mask.
167plat_pub_policy.conf := $(intermediates)/plat_pub_policy.conf
168$(plat_pub_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
169$(plat_pub_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Dan Cashman1c040272016-12-15 15:28:44 -0800170$(plat_pub_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
dcashman2e00e632016-10-12 14:58:09 -0700171$(plat_pub_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
172$(plat_pub_policy.conf): $(call build_policy, $(sepolicy_build_files), \
173$(BOARD_SEPOLICY_VERS_DIR) $(REQD_MASK_POLICY))
174 @mkdir -p $(dir $@)
175 $(hide) m4 $(PRIVATE_ADDITIONAL_M4DEFS) \
176 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
177 -D target_build_variant=$(TARGET_BUILD_VARIANT) \
Dan Cashman1c040272016-12-15 15:28:44 -0800178 -D target_with_dexpreopt=$(WITH_DEXPREOPT) \
Dan Cashman1c040272016-12-15 15:28:44 -0800179 -D target_arch=$(PRIVATE_TGT_ARCH) \
dcashman2e00e632016-10-12 14:58:09 -0700180 -s $^ > $@
181
182plat_pub_policy.cil := $(intermediates)/plat_pub_policy.cil
dcashman1faa6442016-11-28 07:20:28 -0800183$(plat_pub_policy.cil): PRIVATE_POL_CONF := $(plat_pub_policy.conf)
184$(plat_pub_policy.cil): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil)
185$(plat_pub_policy.cil): $(HOST_OUT_EXECUTABLES)/checkpolicy $(plat_pub_policy.conf) $(reqd_policy_mask.cil)
dcashman2e00e632016-10-12 14:58:09 -0700186 @mkdir -p $(dir $@)
dcashman1faa6442016-11-28 07:20:28 -0800187 $(hide) $< -C -M -c $(POLICYVERS) -o $@.tmp $(PRIVATE_POL_CONF)
188 $(hide) grep -Fxv -f $(PRIVATE_REQD_MASK) $@.tmp > $@
dcashman2e00e632016-10-12 14:58:09 -0700189
dcashman1faa6442016-11-28 07:20:28 -0800190plat_pub_policy.conf :=
Dan Cashman1c040272016-12-15 15:28:44 -0800191
dcashman1faa6442016-11-28 07:20:28 -0800192##################################
193include $(CLEAR_VARS)
194
195LOCAL_MODULE := sectxfile_nl
196LOCAL_MODULE_CLASS := ETC
197LOCAL_MODULE_TAGS := optional
198
199# Create a file containing newline only to add between context config files
200include $(BUILD_SYSTEM)/base_rules.mk
201$(LOCAL_BUILT_MODULE):
dcashman2e00e632016-10-12 14:58:09 -0700202 @mkdir -p $(dir $@)
dcashman1faa6442016-11-28 07:20:28 -0800203 $(hide) echo > $@
204
205built_nl := $(LOCAL_BUILT_MODULE)
206
207#################################
208include $(CLEAR_VARS)
209
210LOCAL_MODULE := plat_sepolicy.cil
211LOCAL_MODULE_CLASS := ETC
212LOCAL_MODULE_TAGS := optional
Alex Klyubin052b0bb2017-03-02 12:39:25 -0800213LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
dcashman1faa6442016-11-28 07:20:28 -0800214
215include $(BUILD_SYSTEM)/base_rules.mk
dcashman2e00e632016-10-12 14:58:09 -0700216
217# plat_policy.conf - A combination of the private and public platform policy
218# which will ship with the device. The platform will always reflect the most
219# recent platform version and is not currently being attributized.
220plat_policy.conf := $(intermediates)/plat_policy.conf
221$(plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
222$(plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Dan Cashman1c040272016-12-15 15:28:44 -0800223$(plat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
dcashman2e00e632016-10-12 14:58:09 -0700224$(plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
225$(plat_policy.conf): $(call build_policy, $(sepolicy_build_files), \
dcashmancc39f632016-07-22 13:13:11 -0700226$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY))
227 @mkdir -p $(dir $@)
228 $(hide) m4 $(PRIVATE_ADDITIONAL_M4DEFS) \
229 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
230 -D target_build_variant=$(TARGET_BUILD_VARIANT) \
Jorge Lucangeli Obes84db84e2016-11-18 08:42:35 -0500231 -D target_with_dexpreopt=$(WITH_DEXPREOPT) \
Dan Cashman1c040272016-12-15 15:28:44 -0800232 -D target_arch=$(PRIVATE_TGT_ARCH) \
dcashmancc39f632016-07-22 13:13:11 -0700233 -s $^ > $@
234 $(hide) sed '/dontaudit/d' $@ > $@.dontaudit
235
dcashman1faa6442016-11-28 07:20:28 -0800236plat_policy_nvr := $(intermediates)/plat_policy_nvr.cil
237$(plat_policy_nvr): $(plat_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy
dcashman2e00e632016-10-12 14:58:09 -0700238 @mkdir -p $(dir $@)
dcashman07791552016-12-07 11:27:47 -0800239 $(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c $(POLICYVERS) -o $@ $<
dcashmancc39f632016-07-22 13:13:11 -0700240
Alex Klyubin8f7173b2017-02-25 14:47:53 -0800241$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(plat_policy_nvr)
242$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(plat_policy_nvr)
dcashman1faa6442016-11-28 07:20:28 -0800243 @mkdir -p $(dir $@)
Alex Klyubin8f7173b2017-02-25 14:47:53 -0800244 # Strip out neverallow statements. They aren't needed on-device and their presence
245 # significantly slows down on-device compilation (e.g., from 400 ms to 6,400 ms on
246 # sailfish-eng).
247 grep -v '^(neverallow' $(PRIVATE_CIL_FILES) > $@
248 # Confirm that the resulting policy compiles
249 $(hide) $(HOST_OUT_EXECUTABLES)/secilc -M true -c $(POLICYVERS) $@ -o /dev/null -f /dev/null
dcashman1faa6442016-11-28 07:20:28 -0800250
Alex Klyubin8f7173b2017-02-25 14:47:53 -0800251built_plat_cil := $(LOCAL_BUILT_MODULE)
dcashman1faa6442016-11-28 07:20:28 -0800252plat_policy.conf :=
253
254#################################
255include $(CLEAR_VARS)
256
257LOCAL_MODULE := mapping_sepolicy.cil
258LOCAL_MODULE_CLASS := ETC
259LOCAL_MODULE_TAGS := optional
Alex Klyubin052b0bb2017-03-02 12:39:25 -0800260LOCAL_PROPRIETARY_MODULE := true
261LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
dcashman1faa6442016-11-28 07:20:28 -0800262
263include $(BUILD_SYSTEM)/base_rules.mk
264
265# auto-generate the mapping file for current platform policy, since it needs to
266# track platform policy development
267current_mapping.cil := $(intermediates)/mapping/current.cil
268$(current_mapping.cil) : PRIVATE_VERS := $(BOARD_SEPOLICY_VERS)
269$(current_mapping.cil) : $(plat_pub_policy.cil) $(HOST_OUT_EXECUTABLES)/version_policy
270 @mkdir -p $(dir $@)
271 $(hide) $(HOST_OUT_EXECUTABLES)/version_policy -b $< -m -n $(PRIVATE_VERS) -o $@
272
273ifeq ($(BOARD_SEPOLICY_VERS), current)
274mapping_policy_nvr := $(current_mapping.cil)
275else
276mapping_policy_nvr := $(addsuffix /$(BOARD_SEPOLICY_VERS).cil, $(PLAT_PRIVATE_POLICY)/mapping)
277endif
278
279$(LOCAL_BUILT_MODULE): $(mapping_policy_nvr)
Alex Klyubin8f7173b2017-02-25 14:47:53 -0800280 # Strip out neverallow statements. They aren't needed on-device and their presence
281 # significantly slows down on-device compilation (e.g., from 400 ms to 6,400 ms on
282 # sailfish-eng).
283 grep -v '^(neverallow' $< > $@
dcashman1faa6442016-11-28 07:20:28 -0800284
Alex Klyubin8f7173b2017-02-25 14:47:53 -0800285built_mapping_cil := $(LOCAL_BUILT_MODULE)
dcashman1faa6442016-11-28 07:20:28 -0800286current_mapping.cil :=
287
288#################################
289include $(CLEAR_VARS)
290
291LOCAL_MODULE := nonplat_sepolicy.cil
292LOCAL_MODULE_CLASS := ETC
293LOCAL_MODULE_TAGS := optional
Alex Klyubin052b0bb2017-03-02 12:39:25 -0800294LOCAL_PROPRIETARY_MODULE := true
295LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
dcashman1faa6442016-11-28 07:20:28 -0800296
297include $(BUILD_SYSTEM)/base_rules.mk
298
Alex Klyubin55961722017-01-30 18:44:59 -0800299# nonplat_policy.conf - A combination of the non-platform private, vendor and
300# the exported platform policy associated with the version the non-platform
301# policy targets. This needs attributization and to be combined with the
dcashman2e00e632016-10-12 14:58:09 -0700302# platform-provided policy. Like plat_pub_policy.conf, this needs to make use
303# of the reqd_policy_mask files from private policy in order to use checkpolicy.
304nonplat_policy.conf := $(intermediates)/nonplat_policy.conf
305$(nonplat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
306$(nonplat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Dan Cashman1c040272016-12-15 15:28:44 -0800307$(nonplat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
dcashman2e00e632016-10-12 14:58:09 -0700308$(nonplat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
309$(nonplat_policy.conf): $(call build_policy, $(sepolicy_build_files), \
Alex Klyubin55961722017-01-30 18:44:59 -0800310$(BOARD_SEPOLICY_VERS_DIR) $(REQD_MASK_POLICY) $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS))
Ying Wang02fb5f32012-01-17 17:51:09 -0800311 @mkdir -p $(dir $@)
William Robertsd2185582015-07-16 11:28:02 -0700312 $(hide) m4 $(PRIVATE_ADDITIONAL_M4DEFS) \
313 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
Nick Kralevich623975f2014-01-11 01:31:03 -0800314 -D target_build_variant=$(TARGET_BUILD_VARIANT) \
Jorge Lucangeli Obes84db84e2016-11-18 08:42:35 -0500315 -D target_with_dexpreopt=$(WITH_DEXPREOPT) \
Dan Cashman1c040272016-12-15 15:28:44 -0800316 -D target_arch=$(PRIVATE_TGT_ARCH) \
Nick Kralevich623975f2014-01-11 01:31:03 -0800317 -s $^ > $@
Robert Craig65d4f442013-03-27 06:30:25 -0400318 $(hide) sed '/dontaudit/d' $@ > $@.dontaudit
Stephen Smalley2dd4e512012-01-04 12:33:27 -0500319
dcashman1faa6442016-11-28 07:20:28 -0800320nonplat_policy_raw := $(intermediates)/nonplat_policy_raw.cil
321$(nonplat_policy_raw): PRIVATE_POL_CONF := $(nonplat_policy.conf)
322$(nonplat_policy_raw): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil)
323$(nonplat_policy_raw): $(HOST_OUT_EXECUTABLES)/checkpolicy $(nonplat_policy.conf) \
324$(reqd_policy_mask.cil)
Ying Wang02fb5f32012-01-17 17:51:09 -0800325 @mkdir -p $(dir $@)
dcashman1faa6442016-11-28 07:20:28 -0800326 $(hide) $< -C -M -c $(POLICYVERS) -o $@.tmp $(PRIVATE_POL_CONF)
327 $(hide) grep -Fxv -f $(PRIVATE_REQD_MASK) $@.tmp > $@
dcashman2e00e632016-10-12 14:58:09 -0700328
dcashman1faa6442016-11-28 07:20:28 -0800329nonplat_policy_nvr := $(intermediates)/nonplat_policy_nvr.cil
330$(nonplat_policy_nvr) : PRIVATE_VERS := $(BOARD_SEPOLICY_VERS)
331$(nonplat_policy_nvr) : PRIVATE_TGT_POL := $(nonplat_policy_raw)
332$(nonplat_policy_nvr) : $(plat_pub_policy.cil) $(nonplat_policy_raw) \
dcashman2e00e632016-10-12 14:58:09 -0700333$(HOST_OUT_EXECUTABLES)/version_policy
334 @mkdir -p $(dir $@)
335 $(HOST_OUT_EXECUTABLES)/version_policy -b $< -t $(PRIVATE_TGT_POL) -n $(PRIVATE_VERS) -o $@
336
Alex Klyubin8f7173b2017-02-25 14:47:53 -0800337$(LOCAL_BUILT_MODULE): PRIVATE_NONPLAT_CIL_FILES := $(nonplat_policy_nvr)
338$(LOCAL_BUILT_MODULE): PRIVATE_DEP_CIL_FILES := $(built_plat_cil) $(built_mapping_cil)
339$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(nonplat_policy_nvr) $(built_plat_cil) \
340$(built_mapping_cil)
dcashman2e00e632016-10-12 14:58:09 -0700341 @mkdir -p $(dir $@)
Alex Klyubin8f7173b2017-02-25 14:47:53 -0800342 # Strip out neverallow statements. They aren't needed on-device and their presence
343 # significantly slows down on-device compilation (e.g., from 400 ms to 6,400 ms on
344 # sailfish-eng).
345 grep -v '^(neverallow' $(PRIVATE_NONPLAT_CIL_FILES) > $@
346 # Confirm that the resulting policy compiles combined with platform and mapping policies
347 $(hide) $(HOST_OUT_EXECUTABLES)/secilc -M true -c $(POLICYVERS) \
348 $(PRIVATE_DEP_CIL_FILES) $@ -o /dev/null -f /dev/null
dcashman2e00e632016-10-12 14:58:09 -0700349
dcashman1faa6442016-11-28 07:20:28 -0800350nonplat_policy.conf :=
351nonplat_policy_raw :=
352
353#################################
354include $(CLEAR_VARS)
Dan Cashman1c040272016-12-15 15:28:44 -0800355# build this target so that we can still perform neverallow checks
dcashman1faa6442016-11-28 07:20:28 -0800356
357LOCAL_MODULE := sepolicy
358LOCAL_MODULE_CLASS := ETC
359LOCAL_MODULE_TAGS := optional
Daniel Cashman65d01342016-12-17 00:53:26 +0000360LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
dcashman2e00e632016-10-12 14:58:09 -0700361
dcashman1faa6442016-11-28 07:20:28 -0800362include $(BUILD_SYSTEM)/base_rules.mk
363
dcashman2e00e632016-10-12 14:58:09 -0700364all_cil_files := \
dcashman1faa6442016-11-28 07:20:28 -0800365 $(plat_policy_nvr) \
366 $(mapping_policy_nvr) \
367 $(nonplat_policy_nvr) \
dcashman2e00e632016-10-12 14:58:09 -0700368
369$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(all_cil_files)
370$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $(all_cil_files)
371 @mkdir -p $(dir $@)
372 $(hide) $< -M true -c $(POLICYVERS) $(PRIVATE_CIL_FILES) -o $@.tmp
Nick Kralevichbca98ef2016-02-26 20:06:52 -0800373 $(hide) $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $@.tmp permissive > $@.permissivedomains
374 $(hide) if [ "$(TARGET_BUILD_VARIANT)" = "user" -a -s $@.permissivedomains ]; then \
375 echo "==========" 1>&2; \
376 echo "ERROR: permissive domains not allowed in user builds" 1>&2; \
377 echo "List of invalid domains:" 1>&2; \
378 cat $@.permissivedomains 1>&2; \
379 exit 1; \
380 fi
381 $(hide) mv $@.tmp $@
Ying Wang02fb5f32012-01-17 17:51:09 -0800382
Ying Wangd8b122c2012-10-25 19:01:31 -0700383built_sepolicy := $(LOCAL_BUILT_MODULE)
dcashman2e00e632016-10-12 14:58:09 -0700384all_cil_files :=
Stephen Smalley01a58af2012-10-02 12:46:37 -0400385
Stephen Smalleye60723a2014-05-29 16:40:15 -0400386##################################
Dan Cashman1c040272016-12-15 15:28:44 -0800387plat_pub_policy.recovery.conf := $(intermediates)/plat_pub_policy.recovery.conf
388$(plat_pub_policy.recovery.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
389$(plat_pub_policy.recovery.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
390$(plat_pub_policy.recovery.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
391$(plat_pub_policy.recovery.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
392$(plat_pub_policy.recovery.conf): $(call build_policy, $(sepolicy_build_files), \
393$(BOARD_SEPOLICY_VERS_DIR) $(REQD_MASK_POLICY))
Stephen Smalleye60723a2014-05-29 16:40:15 -0400394 @mkdir -p $(dir $@)
William Robertsd2185582015-07-16 11:28:02 -0700395 $(hide) m4 $(PRIVATE_ADDITIONAL_M4DEFS) \
396 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
Stephen Smalleye60723a2014-05-29 16:40:15 -0400397 -D target_build_variant=$(TARGET_BUILD_VARIANT) \
Jorge Lucangeli Obes84db84e2016-11-18 08:42:35 -0500398 -D target_with_dexpreopt=$(WITH_DEXPREOPT) \
Dan Cashman1c040272016-12-15 15:28:44 -0800399 -D target_arch=$(PRIVATE_TGT_ARCH) \
Stephen Smalleye60723a2014-05-29 16:40:15 -0400400 -D target_recovery=true \
401 -s $^ > $@
402
Dan Cashman1c040272016-12-15 15:28:44 -0800403plat_pub_policy.recovery.cil := $(intermediates)/plat_pub_policy.recovery.cil
404$(plat_pub_policy.recovery.cil): PRIVATE_POL_CONF := $(plat_pub_policy.recovery.conf)
405$(plat_pub_policy.recovery.cil): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil)
406$(plat_pub_policy.recovery.cil): $(HOST_OUT_EXECUTABLES)/checkpolicy \
407$(plat_pub_policy.recovery.conf) $(reqd_policy_mask.cil)
Stephen Smalleye60723a2014-05-29 16:40:15 -0400408 @mkdir -p $(dir $@)
Dan Cashman1c040272016-12-15 15:28:44 -0800409 $(hide) $< -C -M -c $(POLICYVERS) -o $@.tmp $(PRIVATE_POL_CONF)
410 $(hide) grep -Fxv -f $(PRIVATE_REQD_MASK) $@.tmp > $@
411
412plat_pub_policy.recovery.conf :=
413
414#################################
415include $(CLEAR_VARS)
416
417LOCAL_MODULE := plat_sepolicy.recovery.cil
418LOCAL_MODULE_CLASS := ETC
419LOCAL_MODULE_TAGS := optional
420LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
421
422include $(BUILD_SYSTEM)/base_rules.mk
423
424plat_policy.recovery.conf := $(intermediates)/plat_policy.recovery.conf
425$(plat_policy.recovery.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
426$(plat_policy.recovery.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
427$(plat_policy.recovery.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
428$(plat_policy.recovery.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
429$(plat_policy.recovery.conf): $(call build_policy, $(sepolicy_build_files), \
430$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY))
431 @mkdir -p $(dir $@)
432 $(hide) m4 $(PRIVATE_ADDITIONAL_M4DEFS) \
433 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
434 -D target_build_variant=$(TARGET_BUILD_VARIANT) \
Dan Cashman1c040272016-12-15 15:28:44 -0800435 -D target_with_dexpreopt=$(WITH_DEXPREOPT) \
Dan Cashman1c040272016-12-15 15:28:44 -0800436 -D target_arch=$(PRIVATE_TGT_ARCH) \
437 -D target_recovery=true \
438 -s $^ > $@
439 $(hide) sed '/dontaudit/d' $@ > $@.dontaudit
440
441plat_policy_nvr.recovery := $(intermediates)/plat_policy_nvr.recovery.cil
442$(plat_policy_nvr.recovery): $(plat_policy.recovery.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy
443 @mkdir -p $(dir $@)
444 $(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c $(POLICYVERS) -o $@ $<
445
Alex Klyubin8f7173b2017-02-25 14:47:53 -0800446$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(plat_policy_nvr.recovery)
447$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(plat_policy_nvr.recovery)
Dan Cashman1c040272016-12-15 15:28:44 -0800448 @mkdir -p $(dir $@)
Alex Klyubin8f7173b2017-02-25 14:47:53 -0800449 # Strip out neverallow statements. They aren't needed on-device and their presence
450 # significantly slows down on-device compilation (e.g., from 400 ms to 6,400 ms on
451 # sailfish-eng).
452 grep -v '^(neverallow' $(PRIVATE_CIL_FILES) > $@
453 # Confirm that the resulting policy compiles
454 $(hide) $(HOST_OUT_EXECUTABLES)/secilc -M true -c $(POLICYVERS) $@ -o /dev/null -f /dev/null
Dan Cashman1c040272016-12-15 15:28:44 -0800455
Alex Klyubin8f7173b2017-02-25 14:47:53 -0800456built_plat_cil.recovery := $(LOCAL_BUILT_MODULE)
Dan Cashman1c040272016-12-15 15:28:44 -0800457plat_policy.recovery.conf :=
458
459#################################
460include $(CLEAR_VARS)
461
462LOCAL_MODULE := mapping_sepolicy.recovery.cil
463LOCAL_MODULE_CLASS := ETC
464LOCAL_MODULE_TAGS := optional
465LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
466
467include $(BUILD_SYSTEM)/base_rules.mk
468
469# auto-generate the mapping file for current platform policy, since it needs to
470# track platform policy development
471current_mapping.recovery.cil := $(intermediates)/mapping/current.recovery.cil
472$(current_mapping.recovery.cil) : PRIVATE_VERS := $(BOARD_SEPOLICY_VERS)
473$(current_mapping.recovery.cil) : $(plat_pub_policy.recovery.cil) $(HOST_OUT_EXECUTABLES)/version_policy
474 @mkdir -p $(dir $@)
475 $(hide) $(HOST_OUT_EXECUTABLES)/version_policy -b $< -m -n $(PRIVATE_VERS) -o $@
476
477ifeq ($(BOARD_SEPOLICY_VERS), current)
478mapping_policy_nvr.recovery := $(current_mapping.recovery.cil)
479else
480mapping_policy_nvr.recovery := $(addsuffix /$(BOARD_SEPOLICY_VERS).recovery.cil, \
481$(PLAT_PRIVATE_POLICY)/mapping)
482endif
483
484$(LOCAL_BUILT_MODULE): $(mapping_policy_nvr.recovery)
Alex Klyubin8f7173b2017-02-25 14:47:53 -0800485 # Strip out neverallow statements. They aren't needed on-device and their presence
486 # significantly slows down on-device compilation (e.g., from 400 ms to 6,400 ms on
487 # sailfish-eng).
488 grep -v '^(neverallow' $< > $@
Dan Cashman1c040272016-12-15 15:28:44 -0800489
Alex Klyubin8f7173b2017-02-25 14:47:53 -0800490built_mapping_cil.recovery := $(LOCAL_BUILT_MODULE)
Dan Cashman1c040272016-12-15 15:28:44 -0800491current_mapping.recovery.cil :=
492
493#################################
494include $(CLEAR_VARS)
495
496LOCAL_MODULE := nonplat_sepolicy.recovery.cil
497LOCAL_MODULE_CLASS := ETC
498LOCAL_MODULE_TAGS := optional
499LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
500
501include $(BUILD_SYSTEM)/base_rules.mk
502
Alex Klyubin8f7173b2017-02-25 14:47:53 -0800503# nonplat_policy.recovery.conf - A combination of the non-platform private,
504# vendor and the exported platform policy associated with the version the
505# non-platform policy targets. This needs attributization and to be combined
506# with the platform-provided policy. Like plat_pub_policy.recovery.conf, this
507# needs to make use of the reqd_policy_mask files from private policy in order
508# to use checkpolicy.
Dan Cashman1c040272016-12-15 15:28:44 -0800509nonplat_policy.recovery.conf := $(intermediates)/nonplat_policy.recovery.conf
510$(nonplat_policy.recovery.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
511$(nonplat_policy.recovery.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
512$(nonplat_policy.recovery.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
513$(nonplat_policy.recovery.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
514$(nonplat_policy.recovery.conf): $(call build_policy, $(sepolicy_build_files), \
Alex Klyubin55961722017-01-30 18:44:59 -0800515$(BOARD_SEPOLICY_VERS_DIR) $(REQD_MASK_POLICY) $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS))
Dan Cashman1c040272016-12-15 15:28:44 -0800516 @mkdir -p $(dir $@)
517 $(hide) m4 $(PRIVATE_ADDITIONAL_M4DEFS) \
518 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
519 -D target_build_variant=$(TARGET_BUILD_VARIANT) \
Dan Cashman1c040272016-12-15 15:28:44 -0800520 -D target_with_dexpreopt=$(WITH_DEXPREOPT) \
Dan Cashman1c040272016-12-15 15:28:44 -0800521 -D target_arch=$(PRIVATE_TGT_ARCH) \
522 -D target_recovery=true \
523 -s $^ > $@
524 $(hide) sed '/dontaudit/d' $@ > $@.dontaudit
525
526nonplat_policy_raw.recovery := $(intermediates)/nonplat_policy_raw.recovery.cil
527$(nonplat_policy_raw.recovery): PRIVATE_POL_CONF := $(nonplat_policy.recovery.conf)
528$(nonplat_policy_raw.recovery): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil)
529$(nonplat_policy_raw.recovery): $(HOST_OUT_EXECUTABLES)/checkpolicy $(nonplat_policy.recovery.conf) \
530$(reqd_policy_mask.cil)
531 @mkdir -p $(dir $@)
532 $(hide) $< -C -M -c $(POLICYVERS) -o $@.tmp $(PRIVATE_POL_CONF)
533 $(hide) grep -Fxv -f $(PRIVATE_REQD_MASK) $@.tmp > $@
534
535nonplat_policy_nvr.recovery := $(intermediates)/nonplat_policy_nvr.recovery.cil
536$(nonplat_policy_nvr.recovery) : PRIVATE_VERS := $(BOARD_SEPOLICY_VERS)
537$(nonplat_policy_nvr.recovery) : PRIVATE_TGT_POL := $(nonplat_policy_raw.recovery)
538$(nonplat_policy_nvr.recovery) : $(plat_pub_policy.recovery.cil) $(nonplat_policy_raw.recovery) \
539$(HOST_OUT_EXECUTABLES)/version_policy
540 @mkdir -p $(dir $@)
541 $(HOST_OUT_EXECUTABLES)/version_policy -b $< -t $(PRIVATE_TGT_POL) -n $(PRIVATE_VERS) -o $@
542
Alex Klyubin8f7173b2017-02-25 14:47:53 -0800543$(LOCAL_BUILT_MODULE): PRIVATE_NONPLAT_CIL_FILES := $(nonplat_policy_nvr.recovery)
544$(LOCAL_BUILT_MODULE): PRIVATE_DEP_CIL_FILES := $(built_plat_cil.recovery) \
545$(built_mapping_cil.recovery)
546$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(nonplat_policy_nvr.recovery) \
547$(built_plat_cil.recovery) $(built_mapping_cil.recovery)
Dan Cashman1c040272016-12-15 15:28:44 -0800548 @mkdir -p $(dir $@)
Alex Klyubin8f7173b2017-02-25 14:47:53 -0800549 # Strip out neverallow statements. They aren't needed on-device and their presence
550 # significantly slows down on-device compilation (e.g., from 400 ms to 6,400 ms on
551 # sailfish-eng).
552 grep -v '^(neverallow' $(PRIVATE_NONPLAT_CIL_FILES) > $@
553 # Confirm that the resulting policy compiles combined with platform and mapping policies
554 $(hide) $(HOST_OUT_EXECUTABLES)/secilc -M true -c $(POLICYVERS) \
555 $(PRIVATE_DEP_CIL_FILES) $@ -o /dev/null -f /dev/null
Dan Cashman1c040272016-12-15 15:28:44 -0800556
557nonplat_policy.recovery.conf :=
558nonplat_policy_raw.recovery :=
559
560##################################
561include $(CLEAR_VARS)
562
563# keep concrete sepolicy for neverallow checks
564
565LOCAL_MODULE := sepolicy.recovery
566LOCAL_MODULE_CLASS := ETC
567LOCAL_MODULE_TAGS := optional
Daniel Cashman65d01342016-12-17 00:53:26 +0000568LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Dan Cashman1c040272016-12-15 15:28:44 -0800569
570include $(BUILD_SYSTEM)/base_rules.mk
571
572all_cil_files.recovery := \
573 $(plat_policy_nvr.recovery) \
574 $(mapping_policy_nvr.recovery) \
575 $(nonplat_policy_nvr.recovery) \
576
577$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(all_cil_files.recovery)
578$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $(all_cil_files.recovery)
579 @mkdir -p $(dir $@)
580 $(hide) $< -M true -c $(POLICYVERS) $(PRIVATE_CIL_FILES) -o $@.tmp
Nick Kralevichbca98ef2016-02-26 20:06:52 -0800581 $(hide) $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $@.tmp permissive > $@.permissivedomains
582 $(hide) if [ "$(TARGET_BUILD_VARIANT)" = "user" -a -s $@.permissivedomains ]; then \
583 echo "==========" 1>&2; \
584 echo "ERROR: permissive domains not allowed in user builds" 1>&2; \
585 echo "List of invalid domains:" 1>&2; \
586 cat $@.permissivedomains 1>&2; \
587 exit 1; \
588 fi
589 $(hide) mv $@.tmp $@
Stephen Smalleye60723a2014-05-29 16:40:15 -0400590
Dan Cashman1c040272016-12-15 15:28:44 -0800591all_cil_files.recovery :=
Stephen Smalleye60723a2014-05-29 16:40:15 -0400592
dcashman704741a2014-07-25 19:11:52 -0700593##################################
594include $(CLEAR_VARS)
595
596LOCAL_MODULE := general_sepolicy.conf
597LOCAL_MODULE_CLASS := ETC
598LOCAL_MODULE_TAGS := tests
599
600include $(BUILD_SYSTEM)/base_rules.mk
601
dcashman704741a2014-07-25 19:11:52 -0700602$(LOCAL_BUILT_MODULE): PRIVATE_MLS_SENS := $(MLS_SENS)
603$(LOCAL_BUILT_MODULE): PRIVATE_MLS_CATS := $(MLS_CATS)
Dan Cashman1c040272016-12-15 15:28:44 -0800604$(LOCAL_BUILT_MODULE): PRIVATE_TGT_ARCH := $(my_target_arch)
dcashmancc39f632016-07-22 13:13:11 -0700605$(LOCAL_BUILT_MODULE): $(call build_policy, $(sepolicy_build_files), \
606$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY))
dcashman704741a2014-07-25 19:11:52 -0700607 mkdir -p $(dir $@)
608 $(hide) m4 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
609 -D target_build_variant=user \
Jorge Lucangeli Obes84db84e2016-11-18 08:42:35 -0500610 -D target_with_dexpreopt=$(WITH_DEXPREOPT) \
Dan Cashman1c040272016-12-15 15:28:44 -0800611 -D target_arch=$(PRIVATE_TGT_ARCH) \
dcashman704741a2014-07-25 19:11:52 -0700612 -s $^ > $@
613 $(hide) sed '/dontaudit/d' $@ > $@.dontaudit
614
William Robertsb8769932015-06-29 16:31:23 -0700615built_general_sepolicy.conf := $(LOCAL_BUILT_MODULE)
dcashman704741a2014-07-25 19:11:52 -0700616exp_sepolicy_build_files :=
617
618##################################
Stephen Smalley01a58af2012-10-02 12:46:37 -0400619include $(CLEAR_VARS)
620
William Robertsb8769932015-06-29 16:31:23 -0700621LOCAL_MODULE := sepolicy.general
622LOCAL_MODULE_CLASS := ETC
623LOCAL_MODULE_TAGS := tests
624
625include $(BUILD_SYSTEM)/base_rules.mk
626
627$(LOCAL_BUILT_MODULE): PRIVATE_BUILT_SEPOLICY.CONF := $(built_general_sepolicy.conf)
628$(LOCAL_BUILT_MODULE): $(built_general_sepolicy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy
629 @mkdir -p $(dir $@)
Nick Kralevich6ef10bd2016-02-29 16:59:33 -0800630 $(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c $(POLICYVERS) -o $@ $(PRIVATE_BUILT_SEPOLICY.CONF) > /dev/null
William Robertsb8769932015-06-29 16:31:23 -0700631
632built_general_sepolicy := $(LOCAL_BUILT_MODULE)
dcashmand225b692016-12-12 09:29:04 -0800633
William Robertsb8769932015-06-29 16:31:23 -0700634##################################
dcashmand225b692016-12-12 09:29:04 -0800635# TODO - remove this. Keep around until we get the filesystem creation stuff taken care of.
636#
William Robertsb8769932015-06-29 16:31:23 -0700637include $(CLEAR_VARS)
638
Richard Hainesc2d01912015-08-06 17:43:52 +0100639LOCAL_MODULE := file_contexts.bin
Ying Wang02fb5f32012-01-17 17:51:09 -0800640LOCAL_MODULE_CLASS := ETC
641LOCAL_MODULE_TAGS := optional
642LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
643
Stephen Smalley5b340be2012-03-06 11:12:41 -0500644include $(BUILD_SYSTEM)/base_rules.mk
Ying Wang02fb5f32012-01-17 17:51:09 -0800645
William Roberts49693f12016-01-04 12:20:57 -0800646# The file_contexts.bin is built in the following way:
647# 1. Collect all file_contexts files in THIS repository and process them with
648# m4 into a tmp file called file_contexts.local.tmp.
649# 2. Collect all device specific file_contexts files and process them with m4
650# into a tmp file called file_contexts.device.tmp.
651# 3. Run checkfc -e (allow no device fc entries ie empty) and fc_sort on
652# file_contexts.device.tmp and output to file_contexts.device.sorted.tmp.
653# 4. Concatenate file_contexts.local.tmp and file_contexts.device.tmp into
654# file_contexts.concat.tmp.
655# 5. Run checkfc and sefcontext_compile on file_contexts.concat.tmp to produce
656# file_contexts.bin.
657#
658# Note: That a newline file is placed between each file_context file found to
659# ensure a proper build when an fc file is missing an ending newline.
William Roberts29d14682016-01-04 12:20:57 -0800660
dcashmancc39f632016-07-22 13:13:11 -0700661local_fc_files := $(PLAT_PRIVATE_POLICY)/file_contexts
William Roberts49693f12016-01-04 12:20:57 -0800662ifneq ($(filter address,$(SANITIZE_TARGET)),)
dcashmancc39f632016-07-22 13:13:11 -0700663 local_fc_files := $(local_fc_files) $(PLAT_PRIVATE_POLICY)/file_contexts_asan
William Roberts49693f12016-01-04 12:20:57 -0800664endif
665local_fcfiles_with_nl := $(call add_nl, $(local_fc_files), $(built_nl))
666
667file_contexts.local.tmp := $(intermediates)/file_contexts.local.tmp
668$(file_contexts.local.tmp): $(local_fcfiles_with_nl)
Stephen Smalley5b340be2012-03-06 11:12:41 -0500669 @mkdir -p $(dir $@)
William Roberts49693f12016-01-04 12:20:57 -0800670 $(hide) m4 -s $^ > $@
671
672device_fc_files := $(call build_device_policy, file_contexts)
673device_fcfiles_with_nl := $(call add_nl, $(device_fc_files), $(built_nl))
674
675file_contexts.device.tmp := $(intermediates)/file_contexts.device.tmp
676$(file_contexts.device.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
677$(file_contexts.device.tmp): $(device_fcfiles_with_nl)
678 @mkdir -p $(dir $@)
679 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@
680
681file_contexts.device.sorted.tmp := $(intermediates)/file_contexts.device.sorted.tmp
682$(file_contexts.device.sorted.tmp): PRIVATE_SEPOLICY := $(built_sepolicy)
683$(file_contexts.device.sorted.tmp): $(file_contexts.device.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/fc_sort $(HOST_OUT_EXECUTABLES)/checkfc
684 @mkdir -p $(dir $@)
dcashman07791552016-12-07 11:27:47 -0800685 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e $(PRIVATE_SEPOLICY) $<
William Roberts49693f12016-01-04 12:20:57 -0800686 $(hide) $(HOST_OUT_EXECUTABLES)/fc_sort $< $@
687
688file_contexts.concat.tmp := $(intermediates)/file_contexts.concat.tmp
689$(file_contexts.concat.tmp): $(file_contexts.local.tmp) $(file_contexts.device.sorted.tmp)
690 @mkdir -p $(dir $@)
691 $(hide) m4 -s $^ > $@
Stephen Smalley5b340be2012-03-06 11:12:41 -0500692
William Roberts3746a0a2015-09-25 10:18:44 -0700693$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
William Roberts49693f12016-01-04 12:20:57 -0800694$(LOCAL_BUILT_MODULE): $(file_contexts.concat.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/sefcontext_compile $(HOST_OUT_EXECUTABLES)/checkfc
Richard Hainesc2d01912015-08-06 17:43:52 +0100695 @mkdir -p $(dir $@)
dcashman07791552016-12-07 11:27:47 -0800696 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc $(PRIVATE_SEPOLICY) $<
Richard Hainesc2d01912015-08-06 17:43:52 +0100697 $(hide) $(HOST_OUT_EXECUTABLES)/sefcontext_compile -o $@ $<
698
Robert Craig8b7545b2014-03-20 09:35:08 -0400699built_fc := $(LOCAL_BUILT_MODULE)
William Roberts49693f12016-01-04 12:20:57 -0800700local_fc_files :=
701local_fcfiles_with_nl :=
702device_fc_files :=
703device_fcfiles_with_nl :=
704file_contexts.concat.tmp :=
705file_contexts.device.sorted.tmp :=
706file_contexts.device.tmp :=
707file_contexts.local.tmp :=
William Roberts171a0622012-08-16 10:55:05 -0700708
Ying Wang02fb5f32012-01-17 17:51:09 -0800709##################################
710include $(CLEAR_VARS)
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400711
dcashmand225b692016-12-12 09:29:04 -0800712LOCAL_MODULE := plat_file_contexts
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400713LOCAL_MODULE_CLASS := ETC
dcashmand225b692016-12-12 09:29:04 -0800714LOCAL_MODULE_TAGS := optional
715LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400716
717include $(BUILD_SYSTEM)/base_rules.mk
718
dcashmand225b692016-12-12 09:29:04 -0800719local_fc_files := $(PLAT_PRIVATE_POLICY)/file_contexts
720ifneq ($(filter address,$(SANITIZE_TARGET)),)
721 local_fc_files += $(PLAT_PRIVATE_POLICY)/file_contexts_asan
722endif
Alex Klyubine4665d72017-01-19 19:58:34 -0800723local_fcfiles_with_nl := $(call add_nl, $(local_fc_files), $(built_nl))
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400724
Alex Klyubine4665d72017-01-19 19:58:34 -0800725$(LOCAL_BUILT_MODULE): PRIVATE_FC_FILES := $(local_fcfiles_with_nl)
dcashmand225b692016-12-12 09:29:04 -0800726$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Alex Klyubine4665d72017-01-19 19:58:34 -0800727$(LOCAL_BUILT_MODULE): PRIVATE_FC_SORT := $(HOST_OUT_EXECUTABLES)/fc_sort
728$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/checkfc $(HOST_OUT_EXECUTABLES)/fc_sort \
729$(local_fcfiles_with_nl) $(built_sepolicy)
Richard Hainesc2d01912015-08-06 17:43:52 +0100730 @mkdir -p $(dir $@)
Alex Klyubine4665d72017-01-19 19:58:34 -0800731 $(hide) m4 -s $(PRIVATE_FC_FILES) > $@.tmp
732 $(hide) $< $(PRIVATE_SEPOLICY) $@.tmp
733 $(hide) $(PRIVATE_FC_SORT) $@.tmp $@
Richard Hainesc2d01912015-08-06 17:43:52 +0100734
dcashmand225b692016-12-12 09:29:04 -0800735built_plat_fc := $(LOCAL_BUILT_MODULE)
736local_fc_files :=
Alex Klyubine4665d72017-01-19 19:58:34 -0800737local_fcfiles_with_nl :=
dcashmand225b692016-12-12 09:29:04 -0800738
739##################################
740include $(CLEAR_VARS)
741
742LOCAL_MODULE := nonplat_file_contexts
743LOCAL_MODULE_CLASS := ETC
744LOCAL_MODULE_TAGS := optional
745LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
746
747include $(BUILD_SYSTEM)/base_rules.mk
748
749nonplat_fc_files := $(call build_device_policy, file_contexts)
750nonplat_fcfiles_with_nl := $(call add_nl, $(nonplat_fc_files), $(built_nl))
751
752$(LOCAL_BUILT_MODULE): PRIVATE_FC_FILES := $(nonplat_fcfiles_with_nl)
753$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
754$(LOCAL_BUILT_MODULE): PRIVATE_FC_SORT := $(HOST_OUT_EXECUTABLES)/fc_sort
755$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/checkfc $(HOST_OUT_EXECUTABLES)/fc_sort \
Alex Klyubine4665d72017-01-19 19:58:34 -0800756$(nonplat_fcfiles_with_nl) $(built_sepolicy)
dcashmand225b692016-12-12 09:29:04 -0800757 @mkdir -p $(dir $@)
758 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_FC_FILES) > $@.tmp
759 $(hide) $< $(PRIVATE_SEPOLICY) $@.tmp
760 $(hide) $(PRIVATE_FC_SORT) $@.tmp $@
761
762built_nonplat_fc := $(LOCAL_BUILT_MODULE)
763nonplat_fc_files :=
764nonplat_fcfiles_with_nl :=
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400765
766##################################
767include $(CLEAR_VARS)
Dan Cashman9c038072016-12-22 07:15:18 -0800768LOCAL_MODULE := plat_seapp_contexts
Ying Wang02fb5f32012-01-17 17:51:09 -0800769LOCAL_MODULE_CLASS := ETC
770LOCAL_MODULE_TAGS := optional
771LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
772
William Roberts171a0622012-08-16 10:55:05 -0700773include $(BUILD_SYSTEM)/base_rules.mk
Ying Wang02fb5f32012-01-17 17:51:09 -0800774
Dan Cashman9c038072016-12-22 07:15:18 -0800775plat_sc_files := $(call build_policy, seapp_contexts, $(PLAT_PRIVATE_POLICY))
William Roberts171a0622012-08-16 10:55:05 -0700776
Ying Wangd8b122c2012-10-25 19:01:31 -0700777$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Dan Cashman9c038072016-12-22 07:15:18 -0800778$(LOCAL_BUILT_MODULE): PRIVATE_SC_FILES := $(plat_sc_files)
779$(LOCAL_BUILT_MODULE): $(built_sepolicy) $(plat_sc_files) $(HOST_OUT_EXECUTABLES)/checkseapp
William Robertsf0e0a942012-08-27 15:41:15 -0700780 @mkdir -p $(dir $@)
William Roberts99fe8df2015-06-30 13:53:51 -0700781 $(hide) $(HOST_OUT_EXECUTABLES)/checkseapp -p $(PRIVATE_SEPOLICY) -o $@ $(PRIVATE_SC_FILES)
Ying Wang02fb5f32012-01-17 17:51:09 -0800782
Dan Cashman9c038072016-12-22 07:15:18 -0800783built_plat_sc := $(LOCAL_BUILT_MODULE)
784plat_sc_files :=
Robert Craig8b7545b2014-03-20 09:35:08 -0400785
Ying Wang02fb5f32012-01-17 17:51:09 -0800786##################################
Stephen Smalley124720a2012-04-04 10:11:16 -0400787include $(CLEAR_VARS)
Dan Cashman9c038072016-12-22 07:15:18 -0800788LOCAL_MODULE := nonplat_seapp_contexts
Stephen Smalley37712872015-03-12 15:46:36 -0400789LOCAL_MODULE_CLASS := ETC
Dan Cashman9c038072016-12-22 07:15:18 -0800790LOCAL_MODULE_TAGS := optional
791LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Stephen Smalley37712872015-03-12 15:46:36 -0400792
793include $(BUILD_SYSTEM)/base_rules.mk
794
Alex Klyubin55961722017-01-30 18:44:59 -0800795nonplat_sc_files := $(call build_policy, seapp_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
Jeff Vander Stoep87ae5f72017-03-06 22:53:09 -0800796plat_sc_neverallow_files := $(addprefix $(PLAT_PRIVATE_POLICY)/, seapp_contexts)
Stephen Smalley37712872015-03-12 15:46:36 -0400797
Dan Cashman9c038072016-12-22 07:15:18 -0800798$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
799$(LOCAL_BUILT_MODULE): PRIVATE_SC_FILES := $(nonplat_sc_files)
Jeff Vander Stoep87ae5f72017-03-06 22:53:09 -0800800$(LOCAL_BUILT_MODULE): PRIVATE_SC_NEVERALLOW_FILES := $(plat_sc_neverallow_files)
801$(LOCAL_BUILT_MODULE): $(built_sepolicy) $(nonplat_sc_files) $(HOST_OUT_EXECUTABLES)/checkseapp $(plat_sc_neverallow_files)
Stephen Smalley37712872015-03-12 15:46:36 -0400802 @mkdir -p $(dir $@)
Jeff Vander Stoep87ae5f72017-03-06 22:53:09 -0800803 $(hide) grep -ie '^neverallow' $(PRIVATE_SC_NEVERALLOW_FILES) > plat_seapp_neverallows.tmp
804 $(hide) $(HOST_OUT_EXECUTABLES)/checkseapp -p $(PRIVATE_SEPOLICY) -o $@ $(PRIVATE_SC_FILES) plat_seapp_neverallows.tmp
Stephen Smalley37712872015-03-12 15:46:36 -0400805
Dan Cashman9c038072016-12-22 07:15:18 -0800806built_nonplat_sc := $(LOCAL_BUILT_MODULE)
807nonplat_sc_files :=
Stephen Smalley37712872015-03-12 15:46:36 -0400808
809##################################
810include $(CLEAR_VARS)
Dan Cashman9c038072016-12-22 07:15:18 -0800811LOCAL_MODULE := plat_seapp_neverallows
William Roberts4ee71312015-06-25 11:59:30 -0700812LOCAL_MODULE_CLASS := ETC
813LOCAL_MODULE_TAGS := tests
814
815include $(BUILD_SYSTEM)/base_rules.mk
816
Jeff Vander Stoep87ae5f72017-03-06 22:53:09 -0800817$(LOCAL_BUILT_MODULE): $(plat_sc_neverallow_files)
William Roberts4ee71312015-06-25 11:59:30 -0700818 @mkdir -p $(dir $@)
819 - $(hide) grep -ie '^neverallow' $< > $@
820
Jeff Vander Stoep87ae5f72017-03-06 22:53:09 -0800821plat_sc_neverallow_files :=
William Roberts4ee71312015-06-25 11:59:30 -0700822
823##################################
824include $(CLEAR_VARS)
Stephen Smalley124720a2012-04-04 10:11:16 -0400825
Sandeep Patila86316e2016-12-27 16:08:44 -0800826LOCAL_MODULE := plat_property_contexts
Stephen Smalley124720a2012-04-04 10:11:16 -0400827LOCAL_MODULE_CLASS := ETC
828LOCAL_MODULE_TAGS := optional
Sandeep Patila86316e2016-12-27 16:08:44 -0800829# TODO: Change module path to TARGET_SYSTEM_OUT after b/27805372
Stephen Smalley124720a2012-04-04 10:11:16 -0400830LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
831
832include $(BUILD_SYSTEM)/base_rules.mk
833
Sandeep Patila86316e2016-12-27 16:08:44 -0800834plat_pcfiles := $(call build_policy, property_contexts, $(PLAT_PRIVATE_POLICY))
William Roberts6aabc1c2015-07-30 11:44:26 -0700835
Sandeep Patila86316e2016-12-27 16:08:44 -0800836plat_property_contexts.tmp := $(intermediates)/plat_property_contexts.tmp
837$(plat_property_contexts.tmp): PRIVATE_PC_FILES := $(plat_pcfiles)
838$(plat_property_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
839$(plat_property_contexts.tmp): $(plat_pcfiles)
William Roberts7f81b332015-09-29 13:52:37 -0700840 @mkdir -p $(dir $@)
Colin Cross9eb6c872015-10-01 21:25:09 +0000841 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_PC_FILES) > $@
William Robertsdcffd2b2015-09-29 13:52:37 -0700842
843
844$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Sandeep Patila86316e2016-12-27 16:08:44 -0800845$(LOCAL_BUILT_MODULE): $(plat_property_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc
William Robertsdcffd2b2015-09-29 13:52:37 -0700846 @mkdir -p $(dir $@)
Sandeep Patila86316e2016-12-27 16:08:44 -0800847 $(hide) sed -e 's/#.*$$//' -e '/^$$/d' $< | sort -u -o $@
dcashman07791552016-12-07 11:27:47 -0800848 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -p $(PRIVATE_SEPOLICY) $@
Stephen Smalley124720a2012-04-04 10:11:16 -0400849
Sandeep Patila86316e2016-12-27 16:08:44 -0800850built_plat_pc := $(LOCAL_BUILT_MODULE)
851plat_pcfiles :=
852plat_property_contexts.tmp :=
Robert Craig8b7545b2014-03-20 09:35:08 -0400853
Stephen Smalley124720a2012-04-04 10:11:16 -0400854##################################
Riley Spahnf90c41f2014-06-05 15:52:02 -0700855include $(CLEAR_VARS)
856
Sandeep Patila86316e2016-12-27 16:08:44 -0800857LOCAL_MODULE := nonplat_property_contexts
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400858LOCAL_MODULE_CLASS := ETC
Sandeep Patila86316e2016-12-27 16:08:44 -0800859LOCAL_MODULE_TAGS := optional
860# TODO: Change module path to TARGET_SYSTEM_OUT after b/27805372
861LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400862
Stephen Smalleyc9361732015-03-13 09:36:57 -0400863include $(BUILD_SYSTEM)/base_rules.mk
864
Alex Klyubin55961722017-01-30 18:44:59 -0800865nonplat_pcfiles := $(call build_policy, property_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
Sandeep Patil262edc32016-12-27 16:08:44 -0800866
Sandeep Patila86316e2016-12-27 16:08:44 -0800867nonplat_property_contexts.tmp := $(intermediates)/nonplat_property_contexts.tmp
868$(nonplat_property_contexts.tmp): PRIVATE_PC_FILES := $(nonplat_pcfiles)
869$(nonplat_property_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
870$(nonplat_property_contexts.tmp): $(nonplat_pcfiles)
William Robertsdcffd2b2015-09-29 13:52:37 -0700871 @mkdir -p $(dir $@)
Sandeep Patila86316e2016-12-27 16:08:44 -0800872 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_PC_FILES) > $@
873
874
875$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
876$(LOCAL_BUILT_MODULE): $(nonplat_property_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc
877 @mkdir -p $(dir $@)
878 $(hide) sed -e 's/#.*$$//' -e '/^$$/d' $< | sort -u -o $@
dcashman07791552016-12-07 11:27:47 -0800879 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -p $(PRIVATE_SEPOLICY) $@
William Robertsdcffd2b2015-09-29 13:52:37 -0700880
Sandeep Patila86316e2016-12-27 16:08:44 -0800881built_nonplat_pc := $(LOCAL_BUILT_MODULE)
882nonplat_pcfiles :=
883nonplat_property_contexts.tmp :=
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400884
885##################################
886include $(CLEAR_VARS)
887
Sandeep Patila058b562016-12-27 15:10:48 -0800888LOCAL_MODULE := plat_service_contexts
Riley Spahnf90c41f2014-06-05 15:52:02 -0700889LOCAL_MODULE_CLASS := ETC
890LOCAL_MODULE_TAGS := optional
Sandeep Patila058b562016-12-27 15:10:48 -0800891# TODO: Change module path to TARGET_SYSTEM_OUT after b/27805372
Riley Spahnf90c41f2014-06-05 15:52:02 -0700892LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
893
894include $(BUILD_SYSTEM)/base_rules.mk
895
Sandeep Patila058b562016-12-27 15:10:48 -0800896plat_svcfiles := $(call build_policy, service_contexts, $(PLAT_PRIVATE_POLICY))
Riley Spahnf90c41f2014-06-05 15:52:02 -0700897
Sandeep Patila058b562016-12-27 15:10:48 -0800898plat_service_contexts.tmp := $(intermediates)/plat_service_contexts.tmp
899$(plat_service_contexts.tmp): PRIVATE_SVC_FILES := $(plat_svcfiles)
900$(plat_service_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
901$(plat_service_contexts.tmp): $(plat_svcfiles)
Riley Spahnf90c41f2014-06-05 15:52:02 -0700902 @mkdir -p $(dir $@)
William Roberts6aabc1c2015-07-30 11:44:26 -0700903 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
William Roberts7fc865a2015-09-29 14:17:38 -0700904
905$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Sandeep Patila058b562016-12-27 15:10:48 -0800906$(LOCAL_BUILT_MODULE): $(plat_service_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
William Roberts7fc865a2015-09-29 14:17:38 -0700907 @mkdir -p $(dir $@)
William Robertsc9fce3f2016-04-06 11:53:04 -0700908 sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
dcashman07791552016-12-07 11:27:47 -0800909 $(HOST_OUT_EXECUTABLES)/checkfc -s $(PRIVATE_SEPOLICY) $@
Riley Spahnf90c41f2014-06-05 15:52:02 -0700910
Sandeep Patila058b562016-12-27 15:10:48 -0800911built_plat_svc := $(LOCAL_BUILT_MODULE)
912plat_svcfiles :=
913plat_service_contexts.tmp :=
Riley Spahnf90c41f2014-06-05 15:52:02 -0700914
915##################################
rpcraigb19665c2012-07-30 09:33:03 -0400916include $(CLEAR_VARS)
917
Sandeep Patila058b562016-12-27 15:10:48 -0800918LOCAL_MODULE := nonplat_service_contexts
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400919LOCAL_MODULE_CLASS := ETC
Sandeep Patila058b562016-12-27 15:10:48 -0800920LOCAL_MODULE_TAGS := optional
921# TODO: Change module path to TARGET_VENDOR_OUT after b/27805372
922LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400923
924include $(BUILD_SYSTEM)/base_rules.mk
925
Alex Klyubin55961722017-01-30 18:44:59 -0800926nonplat_svcfiles := $(call build_policy, service_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400927
Sandeep Patila058b562016-12-27 15:10:48 -0800928nonplat_service_contexts.tmp := $(intermediates)/nonplat_service_contexts.tmp
929$(nonplat_service_contexts.tmp): PRIVATE_SVC_FILES := $(nonplat_svcfiles)
930$(nonplat_service_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
931$(nonplat_service_contexts.tmp): $(nonplat_svcfiles)
932 @mkdir -p $(dir $@)
933 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
934
935$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
936$(LOCAL_BUILT_MODULE): $(nonplat_service_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
William Roberts7fc865a2015-09-29 14:17:38 -0700937 @mkdir -p $(dir $@)
William Robertsc9fce3f2016-04-06 11:53:04 -0700938 sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
dcashman07791552016-12-07 11:27:47 -0800939 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -s $(PRIVATE_SEPOLICY) $@
William Roberts7fc865a2015-09-29 14:17:38 -0700940
Sandeep Patila058b562016-12-27 15:10:48 -0800941built_nonplat_svc := $(LOCAL_BUILT_MODULE)
942nonplat_svcfiles :=
943nonplat_service_contexts.tmp :=
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400944
945##################################
946include $(CLEAR_VARS)
947
dcashman90b3b942016-12-14 13:47:55 -0800948LOCAL_MODULE := plat_mac_permissions.xml
rpcraigb19665c2012-07-30 09:33:03 -0400949LOCAL_MODULE_CLASS := ETC
950LOCAL_MODULE_TAGS := optional
951LOCAL_MODULE_PATH := $(TARGET_OUT_ETC)/security
952
William Roberts2c8a55d2012-11-30 14:59:09 -0800953include $(BUILD_SYSTEM)/base_rules.mk
rpcraigb19665c2012-07-30 09:33:03 -0400954
Geremy Condracd4104e2013-03-26 18:19:12 +0000955# Build keys.conf
dcashman90b3b942016-12-14 13:47:55 -0800956plat_mac_perms_keys.tmp := $(intermediates)/plat_keys.tmp
957$(plat_mac_perms_keys.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
958$(plat_mac_perms_keys.tmp): $(call build_policy, keys.conf, $(PLAT_PRIVATE_POLICY))
Geremy Condracd4104e2013-03-26 18:19:12 +0000959 @mkdir -p $(dir $@)
William Robertsd2185582015-07-16 11:28:02 -0700960 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@
Geremy Condracd4104e2013-03-26 18:19:12 +0000961
dcashman90b3b942016-12-14 13:47:55 -0800962all_plat_mac_perms_files := $(call build_policy, mac_permissions.xml, $(PLAT_PRIVATE_POLICY))
rpcraigb19665c2012-07-30 09:33:03 -0400963
Shinichiro Hamajief0c14d2016-05-13 16:04:58 +0900964# Should be synced with keys.conf.
dcashman90b3b942016-12-14 13:47:55 -0800965all_plat_keys := platform media shared testkey
966all_plat_keys := $(all_keys:%=$(dir $(DEFAULT_SYSTEM_DEV_CERTIFICATE))/%.x509.pem)
Shinichiro Hamajief0c14d2016-05-13 16:04:58 +0900967
dcashman90b3b942016-12-14 13:47:55 -0800968$(LOCAL_BUILT_MODULE): PRIVATE_MAC_PERMS_FILES := $(all_plat_mac_perms_files)
969$(LOCAL_BUILT_MODULE): $(plat_mac_perms_keys.tmp) $(HOST_OUT_EXECUTABLES)/insertkeys.py \
970$(all_plat_mac_perms_files) $(all_plat_keys)
Geremy Condracd4104e2013-03-26 18:19:12 +0000971 @mkdir -p $(dir $@)
Nick Kralevichc3c90522013-10-25 12:25:36 -0700972 $(hide) DEFAULT_SYSTEM_DEV_CERTIFICATE="$(dir $(DEFAULT_SYSTEM_DEV_CERTIFICATE))" \
William Roberts6aabc1c2015-07-30 11:44:26 -0700973 $(HOST_OUT_EXECUTABLES)/insertkeys.py -t $(TARGET_BUILD_VARIANT) -c $(TOP) $< -o $@ $(PRIVATE_MAC_PERMS_FILES)
Geremy Condracd4104e2013-03-26 18:19:12 +0000974
William Roberts6aabc1c2015-07-30 11:44:26 -0700975all_mac_perms_files :=
dcashman90b3b942016-12-14 13:47:55 -0800976all_plat_keys :=
977plat_mac_perms_keys.tmp :=
978
979##################################
980include $(CLEAR_VARS)
981
982LOCAL_MODULE := nonplat_mac_permissions.xml
983LOCAL_MODULE_CLASS := ETC
984LOCAL_MODULE_TAGS := optional
985LOCAL_MODULE_PATH := $(TARGET_OUT_ETC)/security
986
987include $(BUILD_SYSTEM)/base_rules.mk
988
989# Build keys.conf
990nonplat_mac_perms_keys.tmp := $(intermediates)/nonplat_keys.tmp
991$(nonplat_mac_perms_keys.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Alex Klyubin55961722017-01-30 18:44:59 -0800992$(nonplat_mac_perms_keys.tmp): $(call build_policy, keys.conf, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
dcashman90b3b942016-12-14 13:47:55 -0800993 @mkdir -p $(dir $@)
994 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@
995
Alex Klyubin55961722017-01-30 18:44:59 -0800996all_nonplat_mac_perms_files := $(call build_policy, mac_permissions.xml, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
dcashman90b3b942016-12-14 13:47:55 -0800997
998$(LOCAL_BUILT_MODULE): PRIVATE_MAC_PERMS_FILES := $(all_nonplat_mac_perms_files)
999$(LOCAL_BUILT_MODULE): $(nonplat_mac_perms_keys.tmp) $(HOST_OUT_EXECUTABLES)/insertkeys.py \
1000$(all_nonplat_mac_perms_files)
1001 @mkdir -p $(dir $@)
1002 $(hide) $(HOST_OUT_EXECUTABLES)/insertkeys.py -t $(TARGET_BUILD_VARIANT) -c $(TOP) $< -o $@ $(PRIVATE_MAC_PERMS_FILES)
1003
1004nonplat_mac_perms_keys.tmp :=
1005all_nonplat_mac_perms_files :=
William Roberts6aabc1c2015-07-30 11:44:26 -07001006
rpcraigb19665c2012-07-30 09:33:03 -04001007##################################
Robert Craig8b7545b2014-03-20 09:35:08 -04001008include $(CLEAR_VARS)
1009
1010LOCAL_MODULE := selinux_version
1011LOCAL_MODULE_CLASS := ETC
1012LOCAL_MODULE_TAGS := optional
1013LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
1014
1015include $(BUILD_SYSTEM)/base_rules.mk
Sandeep Patila86316e2016-12-27 16:08:44 -08001016$(LOCAL_BUILT_MODULE): $(built_sepolicy) $(built_plat_pc) $(built_nonplat_pc) $(built_plat_fc) \
Sandeep Patila058b562016-12-27 15:10:48 -08001017$(buit_nonplat_fc) $(built_plat_sc) $(built_nonplat_sc) $(built_plat_svc) $(built_nonplat_svc)
Robert Craig8b7545b2014-03-20 09:35:08 -04001018 @mkdir -p $(dir $@)
Colin Cross29a463d2015-07-17 13:08:41 -07001019 $(hide) echo -n $(BUILD_FINGERPRINT_FROM_FILE) > $@
Robert Craig8b7545b2014-03-20 09:35:08 -04001020
1021##################################
rpcraig47cd3962012-10-17 21:09:52 -04001022
Dan Cashman1c040272016-12-15 15:28:44 -08001023add_nl :=
William Roberts49693f12016-01-04 12:20:57 -08001024build_device_policy :=
Dan Cashman1c040272016-12-15 15:28:44 -08001025build_policy :=
dcashmand225b692016-12-12 09:29:04 -08001026built_plat_fc :=
1027built_nonplat_fc :=
William Robertsb8769932015-06-29 16:31:23 -07001028built_general_sepolicy :=
1029built_general_sepolicy.conf :=
Richard Hainesc8801fe2015-12-11 10:39:19 +00001030built_nl :=
Alex Klyubin8f7173b2017-02-25 14:47:53 -08001031built_plat_cil :=
1032built_plat_cil.recovery :=
1033built_mapping_cil :=
1034built_mapping_cil.recovery :=
Sandeep Patila86316e2016-12-27 16:08:44 -08001035built_plat_pc :=
1036built_nonplat_pc :=
Dan Cashman9c038072016-12-22 07:15:18 -08001037built_nonplat_sc :=
1038built_plat_sc :=
Dan Cashman1c040272016-12-15 15:28:44 -08001039built_sepolicy :=
Sandeep Patila058b562016-12-27 15:10:48 -08001040built_plat_svc :=
1041built_nonplat_svc :=
Dan Cashman1c040272016-12-15 15:28:44 -08001042mapping_policy_nvr :=
1043mapping_policy_nvr.recovery :=
1044my_target_arch :=
1045nonplat_policy_nvr :=
1046nonplat_policy_nvr.recovery :=
1047plat_policy_nvr :=
1048plat_policy_nvr.recovery :=
dcashman1faa6442016-11-28 07:20:28 -08001049plat_pub_policy.cil :=
Dan Cashman1c040272016-12-15 15:28:44 -08001050plat_pub_policy.recovery.cil :=
dcashman1faa6442016-11-28 07:20:28 -08001051reqd_policy_mask.cil :=
Dan Cashman1c040272016-12-15 15:28:44 -08001052sepolicy_build_files :=
Alice Chucdfb06f2012-11-01 11:33:04 -07001053
1054include $(call all-makefiles-under,$(LOCAL_PATH))