Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 1 | LOCAL_PATH:= $(call my-dir) |
William Roberts | f0e0a94 | 2012-08-27 15:41:15 -0700 | [diff] [blame] | 2 | |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 3 | include $(CLEAR_VARS) |
| 4 | |
| 5 | # SELinux policy version. |
Stephen Smalley | b4f1706 | 2015-03-13 10:03:52 -0400 | [diff] [blame] | 6 | # Must be <= /sys/fs/selinux/policyvers reported by the Android kernel. |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 7 | # Must be within the compatibility range reported by checkpolicy -V. |
Jeff Vander Stoep | 3a0ce49 | 2015-12-07 08:30:43 -0800 | [diff] [blame] | 8 | POLICYVERS ?= 30 |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 9 | |
| 10 | MLS_SENS=1 |
| 11 | MLS_CATS=1024 |
| 12 | |
Stephen Smalley | b4f1706 | 2015-03-13 10:03:52 -0400 | [diff] [blame] | 13 | ifdef BOARD_SEPOLICY_REPLACE |
| 14 | $(error BOARD_SEPOLICY_REPLACE is no longer supported; please remove from your BoardConfig.mk or other .mk file.) |
| 15 | endif |
| 16 | |
| 17 | ifdef BOARD_SEPOLICY_IGNORE |
| 18 | $(error BOARD_SEPOLICY_IGNORE is no longer supported; please remove from your BoardConfig.mk or other .mk file.) |
| 19 | endif |
Stephen Smalley | 5b340be | 2012-03-06 11:12:41 -0500 | [diff] [blame] | 20 | |
Stephen Smalley | 8e0ca88 | 2015-04-01 10:14:56 -0400 | [diff] [blame] | 21 | ifdef BOARD_SEPOLICY_UNION |
| 22 | $(warning BOARD_SEPOLICY_UNION is no longer required - all files found in BOARD_SEPOLICY_DIRS are implicitly unioned; please remove from your BoardConfig.mk or other .mk file.) |
| 23 | endif |
Robert Craig | 6b0ff47 | 2014-01-29 13:10:58 -0500 | [diff] [blame] | 24 | |
William Roberts | d218558 | 2015-07-16 11:28:02 -0700 | [diff] [blame] | 25 | ifdef BOARD_SEPOLICY_M4DEFS |
| 26 | LOCAL_ADDITIONAL_M4DEFS := $(addprefix -D, $(BOARD_SEPOLICY_M4DEFS)) |
| 27 | endif |
| 28 | |
dcashman | cc39f63 | 2016-07-22 13:13:11 -0700 | [diff] [blame] | 29 | # sepolicy is now divided into multiple portions: |
| 30 | # public - policy exported on which non-platform policy developers may write |
| 31 | # additional policy. types and attributes are versioned and included in |
| 32 | # delivered non-platform policy, which is to be combined with platform policy. |
| 33 | # private - platform-only policy required for platform functionality but which |
| 34 | # is not exported to vendor policy developers and as such may not be assumed |
| 35 | # to exist. |
Alex Klyubin | 5596172 | 2017-01-30 18:44:59 -0800 | [diff] [blame] | 36 | # vendor - vendor-only policy required for vendor functionality. This policy can |
| 37 | # reference the public policy but cannot reference the private policy. This |
| 38 | # policy is for components which are produced from the core/non-vendor tree and |
| 39 | # placed into a vendor partition. |
dcashman | 0779155 | 2016-12-07 11:27:47 -0800 | [diff] [blame] | 40 | # mapping - This contains policy statements which map the attributes |
dcashman | cc39f63 | 2016-07-22 13:13:11 -0700 | [diff] [blame] | 41 | # exposed in the public policy of previous versions to the concrete types used |
| 42 | # in this policy to ensure that policy targeting attributes from public |
| 43 | # policy from an older platform version continues to work. |
| 44 | |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 45 | # build process for device: |
dcashman | cc39f63 | 2016-07-22 13:13:11 -0700 | [diff] [blame] | 46 | # 1) convert policies to CIL: |
| 47 | # - private + public platform policy to CIL |
| 48 | # - mapping file to CIL (should already be in CIL form) |
| 49 | # - non-platform public policy to CIL |
| 50 | # - non-platform public + private policy to CIL |
| 51 | # 2) attributize policy |
dcashman | cc39f63 | 2016-07-22 13:13:11 -0700 | [diff] [blame] | 52 | # - run script which takes non-platform public and non-platform combined |
| 53 | # private + public policy and produces attributized and versioned |
| 54 | # non-platform policy |
| 55 | # 3) combine policy files |
| 56 | # - combine mapping, platform and non-platform policy. |
| 57 | # - compile output binary policy file |
| 58 | |
| 59 | PLAT_PUBLIC_POLICY := $(LOCAL_PATH)/public |
| 60 | PLAT_PRIVATE_POLICY := $(LOCAL_PATH)/private |
Alex Klyubin | 5596172 | 2017-01-30 18:44:59 -0800 | [diff] [blame] | 61 | PLAT_VENDOR_POLICY := $(LOCAL_PATH)/vendor |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 62 | REQD_MASK_POLICY := $(LOCAL_PATH)/reqd_mask |
| 63 | |
| 64 | # TODO: move to README when doing the README update and finalizing versioning. |
| 65 | # BOARD_SEPOLICY_VERS should contain the platform version identifier |
| 66 | # corresponding to the platform on which the non-platform policy is to be |
| 67 | # based. If unspecified, this will build against the current public platform |
| 68 | # policy in tree. |
| 69 | # BOARD_SEPOLICY_VERS_DIR should contain the public platform policy which |
| 70 | # is associated with the given BOARD_SEPOLICY_VERS. The policy therein will be |
| 71 | # versioned according to the BOARD_SEPOLICY_VERS identifier and included as |
| 72 | # part of the non-platform policy to ensure removal of access in future |
| 73 | # platform policy does not break non-platform policy. |
| 74 | ifndef BOARD_SEPOLICY_VERS |
| 75 | $(warning BOARD_SEPOLICY_VERS not specified, assuming current platform version) |
| 76 | BOARD_SEPOLICY_VERS := current |
| 77 | BOARD_SEPOLICY_VERS_DIR := $(PLAT_PUBLIC_POLICY) |
| 78 | else |
| 79 | ifndef BOARD_SEPOLICY_VERS_DIR |
| 80 | $(error BOARD_SEPOLICY_VERS_DIR not specified for versioned sepolicy.) |
| 81 | endif |
| 82 | endif |
dcashman | cc39f63 | 2016-07-22 13:13:11 -0700 | [diff] [blame] | 83 | |
| 84 | ########################################################### |
| 85 | # Compute policy files to be used in policy build. |
| 86 | # $(1): files to include |
| 87 | # $(2): directories in which to find files |
| 88 | ########################################################### |
| 89 | |
| 90 | define build_policy |
| 91 | $(foreach type, $(1), $(foreach file, $(addsuffix /$(type), $(2)), $(sort $(wildcard $(file))))) |
| 92 | endef |
William Roberts | 29d1468 | 2016-01-04 12:20:57 -0800 | [diff] [blame] | 93 | |
William Roberts | 49693f1 | 2016-01-04 12:20:57 -0800 | [diff] [blame] | 94 | # Builds paths for all policy files found in BOARD_SEPOLICY_DIRS. |
| 95 | # $(1): the set of policy name paths to build |
Alex Klyubin | 5596172 | 2017-01-30 18:44:59 -0800 | [diff] [blame] | 96 | build_device_policy = $(call build_policy, $(1), $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS)) |
William Roberts | 49693f1 | 2016-01-04 12:20:57 -0800 | [diff] [blame] | 97 | |
Richard Haines | c8801fe | 2015-12-11 10:39:19 +0000 | [diff] [blame] | 98 | # Add a file containing only a newline in-between each policy configuration |
| 99 | # 'contexts' file. This will allow OEM policy configuration files without a |
| 100 | # final newline (0x0A) to be built correctly by the m4(1) macro processor. |
| 101 | # $(1): the set of contexts file names. |
| 102 | # $(2): the file containing only 0x0A. |
| 103 | add_nl = $(foreach entry, $(1), $(subst $(entry), $(entry) $(2), $(entry))) |
| 104 | |
dcashman | 704741a | 2014-07-25 19:11:52 -0700 | [diff] [blame] | 105 | sepolicy_build_files := security_classes \ |
| 106 | initial_sids \ |
| 107 | access_vectors \ |
| 108 | global_macros \ |
Nick Kralevich | a17a266 | 2014-11-05 15:30:41 -0800 | [diff] [blame] | 109 | neverallow_macros \ |
dcashman | 704741a | 2014-07-25 19:11:52 -0700 | [diff] [blame] | 110 | mls_macros \ |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 111 | mls_decl \ |
dcashman | 704741a | 2014-07-25 19:11:52 -0700 | [diff] [blame] | 112 | mls \ |
| 113 | policy_capabilities \ |
| 114 | te_macros \ |
| 115 | attributes \ |
Jeff Vander Stoep | cbaa2b7 | 2015-12-22 10:39:34 -0800 | [diff] [blame] | 116 | ioctl_defines \ |
Jeff Vander Stoep | de9b530 | 2015-06-05 15:28:55 -0700 | [diff] [blame] | 117 | ioctl_macros \ |
dcashman | 704741a | 2014-07-25 19:11:52 -0700 | [diff] [blame] | 118 | *.te \ |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 119 | roles_decl \ |
dcashman | 704741a | 2014-07-25 19:11:52 -0700 | [diff] [blame] | 120 | roles \ |
| 121 | users \ |
| 122 | initial_sid_contexts \ |
| 123 | fs_use \ |
| 124 | genfs_contexts \ |
| 125 | port_contexts |
| 126 | |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 127 | my_target_arch := $(TARGET_ARCH) |
| 128 | ifneq (,$(filter mips mips64,$(TARGET_ARCH))) |
| 129 | my_target_arch := mips |
| 130 | endif |
| 131 | |
Ying Wang | 02fb5f3 | 2012-01-17 17:51:09 -0800 | [diff] [blame] | 132 | ################################## |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 133 | # reqd_policy_mask - a policy.conf file which contains only the bare minimum |
| 134 | # policy necessary to use checkpolicy. This bare-minimum policy needs to be |
| 135 | # present in all policy.conf files, but should not necessarily be exported as |
| 136 | # part of the public policy. The rules generated by reqd_policy_mask will allow |
| 137 | # the compilation of public policy and subsequent removal of CIL policy that |
| 138 | # should not be exported. |
| 139 | |
| 140 | reqd_policy_mask.conf := $(intermediates)/reqd_policy_mask.conf |
| 141 | $(reqd_policy_mask.conf): PRIVATE_MLS_SENS := $(MLS_SENS) |
| 142 | $(reqd_policy_mask.conf): PRIVATE_MLS_CATS := $(MLS_CATS) |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 143 | $(reqd_policy_mask.conf): PRIVATE_TGT_ARCH := $(my_target_arch) |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 144 | $(reqd_policy_mask.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) |
| 145 | $(reqd_policy_mask.conf): $(call build_policy, $(sepolicy_build_files), $(REQD_MASK_POLICY)) |
| 146 | @mkdir -p $(dir $@) |
| 147 | $(hide) m4 $(PRIVATE_ADDITIONAL_M4DEFS) \ |
| 148 | -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \ |
| 149 | -D target_build_variant=$(TARGET_BUILD_VARIANT) \ |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 150 | -D target_with_dexpreopt=$(WITH_DEXPREOPT) \ |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 151 | -D target_arch=$(PRIVATE_TGT_ARCH) \ |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 152 | -s $^ > $@ |
| 153 | |
| 154 | reqd_policy_mask.cil := $(intermediates)/reqd_policy_mask.cil |
| 155 | $(reqd_policy_mask.cil): $(reqd_policy_mask.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy |
| 156 | @mkdir -p $(dir $@) |
| 157 | $(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -C -M -c $(POLICYVERS) -o $@ $< |
| 158 | |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 159 | reqd_policy_mask.conf := |
| 160 | |
| 161 | ################################## |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 162 | # plat_pub_policy - policy that will be exported to be a part of non-platform |
| 163 | # policy corresponding to this platform version. This is a limited subset of |
| 164 | # policy that would not compile in checkpolicy on its own. To get around this |
| 165 | # limitation, add only the required files from private policy, which will |
| 166 | # generate CIL policy that will then be filtered out by the reqd_policy_mask. |
| 167 | plat_pub_policy.conf := $(intermediates)/plat_pub_policy.conf |
| 168 | $(plat_pub_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS) |
| 169 | $(plat_pub_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS) |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 170 | $(plat_pub_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch) |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 171 | $(plat_pub_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) |
| 172 | $(plat_pub_policy.conf): $(call build_policy, $(sepolicy_build_files), \ |
| 173 | $(BOARD_SEPOLICY_VERS_DIR) $(REQD_MASK_POLICY)) |
| 174 | @mkdir -p $(dir $@) |
| 175 | $(hide) m4 $(PRIVATE_ADDITIONAL_M4DEFS) \ |
| 176 | -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \ |
| 177 | -D target_build_variant=$(TARGET_BUILD_VARIANT) \ |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 178 | -D target_with_dexpreopt=$(WITH_DEXPREOPT) \ |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 179 | -D target_arch=$(PRIVATE_TGT_ARCH) \ |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 180 | -s $^ > $@ |
| 181 | |
| 182 | plat_pub_policy.cil := $(intermediates)/plat_pub_policy.cil |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 183 | $(plat_pub_policy.cil): PRIVATE_POL_CONF := $(plat_pub_policy.conf) |
| 184 | $(plat_pub_policy.cil): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil) |
| 185 | $(plat_pub_policy.cil): $(HOST_OUT_EXECUTABLES)/checkpolicy $(plat_pub_policy.conf) $(reqd_policy_mask.cil) |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 186 | @mkdir -p $(dir $@) |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 187 | $(hide) $< -C -M -c $(POLICYVERS) -o $@.tmp $(PRIVATE_POL_CONF) |
| 188 | $(hide) grep -Fxv -f $(PRIVATE_REQD_MASK) $@.tmp > $@ |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 189 | |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 190 | plat_pub_policy.conf := |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 191 | |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 192 | ################################## |
| 193 | include $(CLEAR_VARS) |
| 194 | |
| 195 | LOCAL_MODULE := sectxfile_nl |
| 196 | LOCAL_MODULE_CLASS := ETC |
| 197 | LOCAL_MODULE_TAGS := optional |
| 198 | |
| 199 | # Create a file containing newline only to add between context config files |
| 200 | include $(BUILD_SYSTEM)/base_rules.mk |
| 201 | $(LOCAL_BUILT_MODULE): |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 202 | @mkdir -p $(dir $@) |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 203 | $(hide) echo > $@ |
| 204 | |
| 205 | built_nl := $(LOCAL_BUILT_MODULE) |
| 206 | |
| 207 | ################################# |
| 208 | include $(CLEAR_VARS) |
| 209 | |
| 210 | LOCAL_MODULE := plat_sepolicy.cil |
| 211 | LOCAL_MODULE_CLASS := ETC |
| 212 | LOCAL_MODULE_TAGS := optional |
Alex Klyubin | 052b0bb | 2017-03-02 12:39:25 -0800 | [diff] [blame] | 213 | LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 214 | |
| 215 | include $(BUILD_SYSTEM)/base_rules.mk |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 216 | |
| 217 | # plat_policy.conf - A combination of the private and public platform policy |
| 218 | # which will ship with the device. The platform will always reflect the most |
| 219 | # recent platform version and is not currently being attributized. |
| 220 | plat_policy.conf := $(intermediates)/plat_policy.conf |
| 221 | $(plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS) |
| 222 | $(plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS) |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 223 | $(plat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch) |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 224 | $(plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) |
| 225 | $(plat_policy.conf): $(call build_policy, $(sepolicy_build_files), \ |
dcashman | cc39f63 | 2016-07-22 13:13:11 -0700 | [diff] [blame] | 226 | $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY)) |
| 227 | @mkdir -p $(dir $@) |
| 228 | $(hide) m4 $(PRIVATE_ADDITIONAL_M4DEFS) \ |
| 229 | -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \ |
| 230 | -D target_build_variant=$(TARGET_BUILD_VARIANT) \ |
Jorge Lucangeli Obes | 84db84e | 2016-11-18 08:42:35 -0500 | [diff] [blame] | 231 | -D target_with_dexpreopt=$(WITH_DEXPREOPT) \ |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 232 | -D target_arch=$(PRIVATE_TGT_ARCH) \ |
dcashman | cc39f63 | 2016-07-22 13:13:11 -0700 | [diff] [blame] | 233 | -s $^ > $@ |
| 234 | $(hide) sed '/dontaudit/d' $@ > $@.dontaudit |
| 235 | |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 236 | plat_policy_nvr := $(intermediates)/plat_policy_nvr.cil |
| 237 | $(plat_policy_nvr): $(plat_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 238 | @mkdir -p $(dir $@) |
dcashman | 0779155 | 2016-12-07 11:27:47 -0800 | [diff] [blame] | 239 | $(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c $(POLICYVERS) -o $@ $< |
dcashman | cc39f63 | 2016-07-22 13:13:11 -0700 | [diff] [blame] | 240 | |
Alex Klyubin | 8f7173b | 2017-02-25 14:47:53 -0800 | [diff] [blame] | 241 | $(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(plat_policy_nvr) |
| 242 | $(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(plat_policy_nvr) |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 243 | @mkdir -p $(dir $@) |
Alex Klyubin | 8f7173b | 2017-02-25 14:47:53 -0800 | [diff] [blame] | 244 | # Strip out neverallow statements. They aren't needed on-device and their presence |
| 245 | # significantly slows down on-device compilation (e.g., from 400 ms to 6,400 ms on |
| 246 | # sailfish-eng). |
| 247 | grep -v '^(neverallow' $(PRIVATE_CIL_FILES) > $@ |
| 248 | # Confirm that the resulting policy compiles |
| 249 | $(hide) $(HOST_OUT_EXECUTABLES)/secilc -M true -c $(POLICYVERS) $@ -o /dev/null -f /dev/null |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 250 | |
Alex Klyubin | 8f7173b | 2017-02-25 14:47:53 -0800 | [diff] [blame] | 251 | built_plat_cil := $(LOCAL_BUILT_MODULE) |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 252 | plat_policy.conf := |
| 253 | |
| 254 | ################################# |
| 255 | include $(CLEAR_VARS) |
| 256 | |
| 257 | LOCAL_MODULE := mapping_sepolicy.cil |
| 258 | LOCAL_MODULE_CLASS := ETC |
| 259 | LOCAL_MODULE_TAGS := optional |
Alex Klyubin | 052b0bb | 2017-03-02 12:39:25 -0800 | [diff] [blame] | 260 | LOCAL_PROPRIETARY_MODULE := true |
| 261 | LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 262 | |
| 263 | include $(BUILD_SYSTEM)/base_rules.mk |
| 264 | |
| 265 | # auto-generate the mapping file for current platform policy, since it needs to |
| 266 | # track platform policy development |
| 267 | current_mapping.cil := $(intermediates)/mapping/current.cil |
| 268 | $(current_mapping.cil) : PRIVATE_VERS := $(BOARD_SEPOLICY_VERS) |
| 269 | $(current_mapping.cil) : $(plat_pub_policy.cil) $(HOST_OUT_EXECUTABLES)/version_policy |
| 270 | @mkdir -p $(dir $@) |
| 271 | $(hide) $(HOST_OUT_EXECUTABLES)/version_policy -b $< -m -n $(PRIVATE_VERS) -o $@ |
| 272 | |
| 273 | ifeq ($(BOARD_SEPOLICY_VERS), current) |
| 274 | mapping_policy_nvr := $(current_mapping.cil) |
| 275 | else |
| 276 | mapping_policy_nvr := $(addsuffix /$(BOARD_SEPOLICY_VERS).cil, $(PLAT_PRIVATE_POLICY)/mapping) |
| 277 | endif |
| 278 | |
| 279 | $(LOCAL_BUILT_MODULE): $(mapping_policy_nvr) |
Alex Klyubin | 8f7173b | 2017-02-25 14:47:53 -0800 | [diff] [blame] | 280 | # Strip out neverallow statements. They aren't needed on-device and their presence |
| 281 | # significantly slows down on-device compilation (e.g., from 400 ms to 6,400 ms on |
| 282 | # sailfish-eng). |
| 283 | grep -v '^(neverallow' $< > $@ |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 284 | |
Alex Klyubin | 8f7173b | 2017-02-25 14:47:53 -0800 | [diff] [blame] | 285 | built_mapping_cil := $(LOCAL_BUILT_MODULE) |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 286 | current_mapping.cil := |
| 287 | |
| 288 | ################################# |
| 289 | include $(CLEAR_VARS) |
| 290 | |
| 291 | LOCAL_MODULE := nonplat_sepolicy.cil |
| 292 | LOCAL_MODULE_CLASS := ETC |
| 293 | LOCAL_MODULE_TAGS := optional |
Alex Klyubin | 052b0bb | 2017-03-02 12:39:25 -0800 | [diff] [blame] | 294 | LOCAL_PROPRIETARY_MODULE := true |
| 295 | LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 296 | |
| 297 | include $(BUILD_SYSTEM)/base_rules.mk |
| 298 | |
Alex Klyubin | 5596172 | 2017-01-30 18:44:59 -0800 | [diff] [blame] | 299 | # nonplat_policy.conf - A combination of the non-platform private, vendor and |
| 300 | # the exported platform policy associated with the version the non-platform |
| 301 | # policy targets. This needs attributization and to be combined with the |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 302 | # platform-provided policy. Like plat_pub_policy.conf, this needs to make use |
| 303 | # of the reqd_policy_mask files from private policy in order to use checkpolicy. |
| 304 | nonplat_policy.conf := $(intermediates)/nonplat_policy.conf |
| 305 | $(nonplat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS) |
| 306 | $(nonplat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS) |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 307 | $(nonplat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch) |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 308 | $(nonplat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) |
| 309 | $(nonplat_policy.conf): $(call build_policy, $(sepolicy_build_files), \ |
Alex Klyubin | 5596172 | 2017-01-30 18:44:59 -0800 | [diff] [blame] | 310 | $(BOARD_SEPOLICY_VERS_DIR) $(REQD_MASK_POLICY) $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS)) |
Ying Wang | 02fb5f3 | 2012-01-17 17:51:09 -0800 | [diff] [blame] | 311 | @mkdir -p $(dir $@) |
William Roberts | d218558 | 2015-07-16 11:28:02 -0700 | [diff] [blame] | 312 | $(hide) m4 $(PRIVATE_ADDITIONAL_M4DEFS) \ |
| 313 | -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \ |
Nick Kralevich | 623975f | 2014-01-11 01:31:03 -0800 | [diff] [blame] | 314 | -D target_build_variant=$(TARGET_BUILD_VARIANT) \ |
Jorge Lucangeli Obes | 84db84e | 2016-11-18 08:42:35 -0500 | [diff] [blame] | 315 | -D target_with_dexpreopt=$(WITH_DEXPREOPT) \ |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 316 | -D target_arch=$(PRIVATE_TGT_ARCH) \ |
Nick Kralevich | 623975f | 2014-01-11 01:31:03 -0800 | [diff] [blame] | 317 | -s $^ > $@ |
Robert Craig | 65d4f44 | 2013-03-27 06:30:25 -0400 | [diff] [blame] | 318 | $(hide) sed '/dontaudit/d' $@ > $@.dontaudit |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 319 | |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 320 | nonplat_policy_raw := $(intermediates)/nonplat_policy_raw.cil |
| 321 | $(nonplat_policy_raw): PRIVATE_POL_CONF := $(nonplat_policy.conf) |
| 322 | $(nonplat_policy_raw): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil) |
| 323 | $(nonplat_policy_raw): $(HOST_OUT_EXECUTABLES)/checkpolicy $(nonplat_policy.conf) \ |
| 324 | $(reqd_policy_mask.cil) |
Ying Wang | 02fb5f3 | 2012-01-17 17:51:09 -0800 | [diff] [blame] | 325 | @mkdir -p $(dir $@) |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 326 | $(hide) $< -C -M -c $(POLICYVERS) -o $@.tmp $(PRIVATE_POL_CONF) |
| 327 | $(hide) grep -Fxv -f $(PRIVATE_REQD_MASK) $@.tmp > $@ |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 328 | |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 329 | nonplat_policy_nvr := $(intermediates)/nonplat_policy_nvr.cil |
| 330 | $(nonplat_policy_nvr) : PRIVATE_VERS := $(BOARD_SEPOLICY_VERS) |
| 331 | $(nonplat_policy_nvr) : PRIVATE_TGT_POL := $(nonplat_policy_raw) |
| 332 | $(nonplat_policy_nvr) : $(plat_pub_policy.cil) $(nonplat_policy_raw) \ |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 333 | $(HOST_OUT_EXECUTABLES)/version_policy |
| 334 | @mkdir -p $(dir $@) |
| 335 | $(HOST_OUT_EXECUTABLES)/version_policy -b $< -t $(PRIVATE_TGT_POL) -n $(PRIVATE_VERS) -o $@ |
| 336 | |
Alex Klyubin | 8f7173b | 2017-02-25 14:47:53 -0800 | [diff] [blame] | 337 | $(LOCAL_BUILT_MODULE): PRIVATE_NONPLAT_CIL_FILES := $(nonplat_policy_nvr) |
| 338 | $(LOCAL_BUILT_MODULE): PRIVATE_DEP_CIL_FILES := $(built_plat_cil) $(built_mapping_cil) |
| 339 | $(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(nonplat_policy_nvr) $(built_plat_cil) \ |
| 340 | $(built_mapping_cil) |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 341 | @mkdir -p $(dir $@) |
Alex Klyubin | 8f7173b | 2017-02-25 14:47:53 -0800 | [diff] [blame] | 342 | # Strip out neverallow statements. They aren't needed on-device and their presence |
| 343 | # significantly slows down on-device compilation (e.g., from 400 ms to 6,400 ms on |
| 344 | # sailfish-eng). |
| 345 | grep -v '^(neverallow' $(PRIVATE_NONPLAT_CIL_FILES) > $@ |
| 346 | # Confirm that the resulting policy compiles combined with platform and mapping policies |
| 347 | $(hide) $(HOST_OUT_EXECUTABLES)/secilc -M true -c $(POLICYVERS) \ |
| 348 | $(PRIVATE_DEP_CIL_FILES) $@ -o /dev/null -f /dev/null |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 349 | |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 350 | nonplat_policy.conf := |
| 351 | nonplat_policy_raw := |
| 352 | |
| 353 | ################################# |
| 354 | include $(CLEAR_VARS) |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 355 | # build this target so that we can still perform neverallow checks |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 356 | |
| 357 | LOCAL_MODULE := sepolicy |
| 358 | LOCAL_MODULE_CLASS := ETC |
| 359 | LOCAL_MODULE_TAGS := optional |
Daniel Cashman | 65d0134 | 2016-12-17 00:53:26 +0000 | [diff] [blame] | 360 | LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT) |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 361 | |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 362 | include $(BUILD_SYSTEM)/base_rules.mk |
| 363 | |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 364 | all_cil_files := \ |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 365 | $(plat_policy_nvr) \ |
| 366 | $(mapping_policy_nvr) \ |
| 367 | $(nonplat_policy_nvr) \ |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 368 | |
| 369 | $(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(all_cil_files) |
| 370 | $(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $(all_cil_files) |
| 371 | @mkdir -p $(dir $@) |
| 372 | $(hide) $< -M true -c $(POLICYVERS) $(PRIVATE_CIL_FILES) -o $@.tmp |
Nick Kralevich | bca98ef | 2016-02-26 20:06:52 -0800 | [diff] [blame] | 373 | $(hide) $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $@.tmp permissive > $@.permissivedomains |
| 374 | $(hide) if [ "$(TARGET_BUILD_VARIANT)" = "user" -a -s $@.permissivedomains ]; then \ |
| 375 | echo "==========" 1>&2; \ |
| 376 | echo "ERROR: permissive domains not allowed in user builds" 1>&2; \ |
| 377 | echo "List of invalid domains:" 1>&2; \ |
| 378 | cat $@.permissivedomains 1>&2; \ |
| 379 | exit 1; \ |
| 380 | fi |
| 381 | $(hide) mv $@.tmp $@ |
Ying Wang | 02fb5f3 | 2012-01-17 17:51:09 -0800 | [diff] [blame] | 382 | |
Ying Wang | d8b122c | 2012-10-25 19:01:31 -0700 | [diff] [blame] | 383 | built_sepolicy := $(LOCAL_BUILT_MODULE) |
dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 384 | all_cil_files := |
Stephen Smalley | 01a58af | 2012-10-02 12:46:37 -0400 | [diff] [blame] | 385 | |
Stephen Smalley | e60723a | 2014-05-29 16:40:15 -0400 | [diff] [blame] | 386 | ################################## |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 387 | plat_pub_policy.recovery.conf := $(intermediates)/plat_pub_policy.recovery.conf |
| 388 | $(plat_pub_policy.recovery.conf): PRIVATE_MLS_SENS := $(MLS_SENS) |
| 389 | $(plat_pub_policy.recovery.conf): PRIVATE_MLS_CATS := $(MLS_CATS) |
| 390 | $(plat_pub_policy.recovery.conf): PRIVATE_TGT_ARCH := $(my_target_arch) |
| 391 | $(plat_pub_policy.recovery.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) |
| 392 | $(plat_pub_policy.recovery.conf): $(call build_policy, $(sepolicy_build_files), \ |
| 393 | $(BOARD_SEPOLICY_VERS_DIR) $(REQD_MASK_POLICY)) |
Stephen Smalley | e60723a | 2014-05-29 16:40:15 -0400 | [diff] [blame] | 394 | @mkdir -p $(dir $@) |
William Roberts | d218558 | 2015-07-16 11:28:02 -0700 | [diff] [blame] | 395 | $(hide) m4 $(PRIVATE_ADDITIONAL_M4DEFS) \ |
| 396 | -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \ |
Stephen Smalley | e60723a | 2014-05-29 16:40:15 -0400 | [diff] [blame] | 397 | -D target_build_variant=$(TARGET_BUILD_VARIANT) \ |
Jorge Lucangeli Obes | 84db84e | 2016-11-18 08:42:35 -0500 | [diff] [blame] | 398 | -D target_with_dexpreopt=$(WITH_DEXPREOPT) \ |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 399 | -D target_arch=$(PRIVATE_TGT_ARCH) \ |
Stephen Smalley | e60723a | 2014-05-29 16:40:15 -0400 | [diff] [blame] | 400 | -D target_recovery=true \ |
| 401 | -s $^ > $@ |
| 402 | |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 403 | plat_pub_policy.recovery.cil := $(intermediates)/plat_pub_policy.recovery.cil |
| 404 | $(plat_pub_policy.recovery.cil): PRIVATE_POL_CONF := $(plat_pub_policy.recovery.conf) |
| 405 | $(plat_pub_policy.recovery.cil): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil) |
| 406 | $(plat_pub_policy.recovery.cil): $(HOST_OUT_EXECUTABLES)/checkpolicy \ |
| 407 | $(plat_pub_policy.recovery.conf) $(reqd_policy_mask.cil) |
Stephen Smalley | e60723a | 2014-05-29 16:40:15 -0400 | [diff] [blame] | 408 | @mkdir -p $(dir $@) |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 409 | $(hide) $< -C -M -c $(POLICYVERS) -o $@.tmp $(PRIVATE_POL_CONF) |
| 410 | $(hide) grep -Fxv -f $(PRIVATE_REQD_MASK) $@.tmp > $@ |
| 411 | |
| 412 | plat_pub_policy.recovery.conf := |
| 413 | |
| 414 | ################################# |
| 415 | include $(CLEAR_VARS) |
| 416 | |
| 417 | LOCAL_MODULE := plat_sepolicy.recovery.cil |
| 418 | LOCAL_MODULE_CLASS := ETC |
| 419 | LOCAL_MODULE_TAGS := optional |
| 420 | LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT) |
| 421 | |
| 422 | include $(BUILD_SYSTEM)/base_rules.mk |
| 423 | |
| 424 | plat_policy.recovery.conf := $(intermediates)/plat_policy.recovery.conf |
| 425 | $(plat_policy.recovery.conf): PRIVATE_MLS_SENS := $(MLS_SENS) |
| 426 | $(plat_policy.recovery.conf): PRIVATE_MLS_CATS := $(MLS_CATS) |
| 427 | $(plat_policy.recovery.conf): PRIVATE_TGT_ARCH := $(my_target_arch) |
| 428 | $(plat_policy.recovery.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) |
| 429 | $(plat_policy.recovery.conf): $(call build_policy, $(sepolicy_build_files), \ |
| 430 | $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY)) |
| 431 | @mkdir -p $(dir $@) |
| 432 | $(hide) m4 $(PRIVATE_ADDITIONAL_M4DEFS) \ |
| 433 | -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \ |
| 434 | -D target_build_variant=$(TARGET_BUILD_VARIANT) \ |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 435 | -D target_with_dexpreopt=$(WITH_DEXPREOPT) \ |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 436 | -D target_arch=$(PRIVATE_TGT_ARCH) \ |
| 437 | -D target_recovery=true \ |
| 438 | -s $^ > $@ |
| 439 | $(hide) sed '/dontaudit/d' $@ > $@.dontaudit |
| 440 | |
| 441 | plat_policy_nvr.recovery := $(intermediates)/plat_policy_nvr.recovery.cil |
| 442 | $(plat_policy_nvr.recovery): $(plat_policy.recovery.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy |
| 443 | @mkdir -p $(dir $@) |
| 444 | $(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c $(POLICYVERS) -o $@ $< |
| 445 | |
Alex Klyubin | 8f7173b | 2017-02-25 14:47:53 -0800 | [diff] [blame] | 446 | $(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(plat_policy_nvr.recovery) |
| 447 | $(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(plat_policy_nvr.recovery) |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 448 | @mkdir -p $(dir $@) |
Alex Klyubin | 8f7173b | 2017-02-25 14:47:53 -0800 | [diff] [blame] | 449 | # Strip out neverallow statements. They aren't needed on-device and their presence |
| 450 | # significantly slows down on-device compilation (e.g., from 400 ms to 6,400 ms on |
| 451 | # sailfish-eng). |
| 452 | grep -v '^(neverallow' $(PRIVATE_CIL_FILES) > $@ |
| 453 | # Confirm that the resulting policy compiles |
| 454 | $(hide) $(HOST_OUT_EXECUTABLES)/secilc -M true -c $(POLICYVERS) $@ -o /dev/null -f /dev/null |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 455 | |
Alex Klyubin | 8f7173b | 2017-02-25 14:47:53 -0800 | [diff] [blame] | 456 | built_plat_cil.recovery := $(LOCAL_BUILT_MODULE) |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 457 | plat_policy.recovery.conf := |
| 458 | |
| 459 | ################################# |
| 460 | include $(CLEAR_VARS) |
| 461 | |
| 462 | LOCAL_MODULE := mapping_sepolicy.recovery.cil |
| 463 | LOCAL_MODULE_CLASS := ETC |
| 464 | LOCAL_MODULE_TAGS := optional |
| 465 | LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT) |
| 466 | |
| 467 | include $(BUILD_SYSTEM)/base_rules.mk |
| 468 | |
| 469 | # auto-generate the mapping file for current platform policy, since it needs to |
| 470 | # track platform policy development |
| 471 | current_mapping.recovery.cil := $(intermediates)/mapping/current.recovery.cil |
| 472 | $(current_mapping.recovery.cil) : PRIVATE_VERS := $(BOARD_SEPOLICY_VERS) |
| 473 | $(current_mapping.recovery.cil) : $(plat_pub_policy.recovery.cil) $(HOST_OUT_EXECUTABLES)/version_policy |
| 474 | @mkdir -p $(dir $@) |
| 475 | $(hide) $(HOST_OUT_EXECUTABLES)/version_policy -b $< -m -n $(PRIVATE_VERS) -o $@ |
| 476 | |
| 477 | ifeq ($(BOARD_SEPOLICY_VERS), current) |
| 478 | mapping_policy_nvr.recovery := $(current_mapping.recovery.cil) |
| 479 | else |
| 480 | mapping_policy_nvr.recovery := $(addsuffix /$(BOARD_SEPOLICY_VERS).recovery.cil, \ |
| 481 | $(PLAT_PRIVATE_POLICY)/mapping) |
| 482 | endif |
| 483 | |
| 484 | $(LOCAL_BUILT_MODULE): $(mapping_policy_nvr.recovery) |
Alex Klyubin | 8f7173b | 2017-02-25 14:47:53 -0800 | [diff] [blame] | 485 | # Strip out neverallow statements. They aren't needed on-device and their presence |
| 486 | # significantly slows down on-device compilation (e.g., from 400 ms to 6,400 ms on |
| 487 | # sailfish-eng). |
| 488 | grep -v '^(neverallow' $< > $@ |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 489 | |
Alex Klyubin | 8f7173b | 2017-02-25 14:47:53 -0800 | [diff] [blame] | 490 | built_mapping_cil.recovery := $(LOCAL_BUILT_MODULE) |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 491 | current_mapping.recovery.cil := |
| 492 | |
| 493 | ################################# |
| 494 | include $(CLEAR_VARS) |
| 495 | |
| 496 | LOCAL_MODULE := nonplat_sepolicy.recovery.cil |
| 497 | LOCAL_MODULE_CLASS := ETC |
| 498 | LOCAL_MODULE_TAGS := optional |
| 499 | LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT) |
| 500 | |
| 501 | include $(BUILD_SYSTEM)/base_rules.mk |
| 502 | |
Alex Klyubin | 8f7173b | 2017-02-25 14:47:53 -0800 | [diff] [blame] | 503 | # nonplat_policy.recovery.conf - A combination of the non-platform private, |
| 504 | # vendor and the exported platform policy associated with the version the |
| 505 | # non-platform policy targets. This needs attributization and to be combined |
| 506 | # with the platform-provided policy. Like plat_pub_policy.recovery.conf, this |
| 507 | # needs to make use of the reqd_policy_mask files from private policy in order |
| 508 | # to use checkpolicy. |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 509 | nonplat_policy.recovery.conf := $(intermediates)/nonplat_policy.recovery.conf |
| 510 | $(nonplat_policy.recovery.conf): PRIVATE_MLS_SENS := $(MLS_SENS) |
| 511 | $(nonplat_policy.recovery.conf): PRIVATE_MLS_CATS := $(MLS_CATS) |
| 512 | $(nonplat_policy.recovery.conf): PRIVATE_TGT_ARCH := $(my_target_arch) |
| 513 | $(nonplat_policy.recovery.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) |
| 514 | $(nonplat_policy.recovery.conf): $(call build_policy, $(sepolicy_build_files), \ |
Alex Klyubin | 5596172 | 2017-01-30 18:44:59 -0800 | [diff] [blame] | 515 | $(BOARD_SEPOLICY_VERS_DIR) $(REQD_MASK_POLICY) $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS)) |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 516 | @mkdir -p $(dir $@) |
| 517 | $(hide) m4 $(PRIVATE_ADDITIONAL_M4DEFS) \ |
| 518 | -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \ |
| 519 | -D target_build_variant=$(TARGET_BUILD_VARIANT) \ |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 520 | -D target_with_dexpreopt=$(WITH_DEXPREOPT) \ |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 521 | -D target_arch=$(PRIVATE_TGT_ARCH) \ |
| 522 | -D target_recovery=true \ |
| 523 | -s $^ > $@ |
| 524 | $(hide) sed '/dontaudit/d' $@ > $@.dontaudit |
| 525 | |
| 526 | nonplat_policy_raw.recovery := $(intermediates)/nonplat_policy_raw.recovery.cil |
| 527 | $(nonplat_policy_raw.recovery): PRIVATE_POL_CONF := $(nonplat_policy.recovery.conf) |
| 528 | $(nonplat_policy_raw.recovery): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil) |
| 529 | $(nonplat_policy_raw.recovery): $(HOST_OUT_EXECUTABLES)/checkpolicy $(nonplat_policy.recovery.conf) \ |
| 530 | $(reqd_policy_mask.cil) |
| 531 | @mkdir -p $(dir $@) |
| 532 | $(hide) $< -C -M -c $(POLICYVERS) -o $@.tmp $(PRIVATE_POL_CONF) |
| 533 | $(hide) grep -Fxv -f $(PRIVATE_REQD_MASK) $@.tmp > $@ |
| 534 | |
| 535 | nonplat_policy_nvr.recovery := $(intermediates)/nonplat_policy_nvr.recovery.cil |
| 536 | $(nonplat_policy_nvr.recovery) : PRIVATE_VERS := $(BOARD_SEPOLICY_VERS) |
| 537 | $(nonplat_policy_nvr.recovery) : PRIVATE_TGT_POL := $(nonplat_policy_raw.recovery) |
| 538 | $(nonplat_policy_nvr.recovery) : $(plat_pub_policy.recovery.cil) $(nonplat_policy_raw.recovery) \ |
| 539 | $(HOST_OUT_EXECUTABLES)/version_policy |
| 540 | @mkdir -p $(dir $@) |
| 541 | $(HOST_OUT_EXECUTABLES)/version_policy -b $< -t $(PRIVATE_TGT_POL) -n $(PRIVATE_VERS) -o $@ |
| 542 | |
Alex Klyubin | 8f7173b | 2017-02-25 14:47:53 -0800 | [diff] [blame] | 543 | $(LOCAL_BUILT_MODULE): PRIVATE_NONPLAT_CIL_FILES := $(nonplat_policy_nvr.recovery) |
| 544 | $(LOCAL_BUILT_MODULE): PRIVATE_DEP_CIL_FILES := $(built_plat_cil.recovery) \ |
| 545 | $(built_mapping_cil.recovery) |
| 546 | $(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(nonplat_policy_nvr.recovery) \ |
| 547 | $(built_plat_cil.recovery) $(built_mapping_cil.recovery) |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 548 | @mkdir -p $(dir $@) |
Alex Klyubin | 8f7173b | 2017-02-25 14:47:53 -0800 | [diff] [blame] | 549 | # Strip out neverallow statements. They aren't needed on-device and their presence |
| 550 | # significantly slows down on-device compilation (e.g., from 400 ms to 6,400 ms on |
| 551 | # sailfish-eng). |
| 552 | grep -v '^(neverallow' $(PRIVATE_NONPLAT_CIL_FILES) > $@ |
| 553 | # Confirm that the resulting policy compiles combined with platform and mapping policies |
| 554 | $(hide) $(HOST_OUT_EXECUTABLES)/secilc -M true -c $(POLICYVERS) \ |
| 555 | $(PRIVATE_DEP_CIL_FILES) $@ -o /dev/null -f /dev/null |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 556 | |
| 557 | nonplat_policy.recovery.conf := |
| 558 | nonplat_policy_raw.recovery := |
| 559 | |
| 560 | ################################## |
| 561 | include $(CLEAR_VARS) |
| 562 | |
| 563 | # keep concrete sepolicy for neverallow checks |
| 564 | |
| 565 | LOCAL_MODULE := sepolicy.recovery |
| 566 | LOCAL_MODULE_CLASS := ETC |
| 567 | LOCAL_MODULE_TAGS := optional |
Daniel Cashman | 65d0134 | 2016-12-17 00:53:26 +0000 | [diff] [blame] | 568 | LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT) |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 569 | |
| 570 | include $(BUILD_SYSTEM)/base_rules.mk |
| 571 | |
| 572 | all_cil_files.recovery := \ |
| 573 | $(plat_policy_nvr.recovery) \ |
| 574 | $(mapping_policy_nvr.recovery) \ |
| 575 | $(nonplat_policy_nvr.recovery) \ |
| 576 | |
| 577 | $(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(all_cil_files.recovery) |
| 578 | $(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $(all_cil_files.recovery) |
| 579 | @mkdir -p $(dir $@) |
| 580 | $(hide) $< -M true -c $(POLICYVERS) $(PRIVATE_CIL_FILES) -o $@.tmp |
Nick Kralevich | bca98ef | 2016-02-26 20:06:52 -0800 | [diff] [blame] | 581 | $(hide) $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $@.tmp permissive > $@.permissivedomains |
| 582 | $(hide) if [ "$(TARGET_BUILD_VARIANT)" = "user" -a -s $@.permissivedomains ]; then \ |
| 583 | echo "==========" 1>&2; \ |
| 584 | echo "ERROR: permissive domains not allowed in user builds" 1>&2; \ |
| 585 | echo "List of invalid domains:" 1>&2; \ |
| 586 | cat $@.permissivedomains 1>&2; \ |
| 587 | exit 1; \ |
| 588 | fi |
| 589 | $(hide) mv $@.tmp $@ |
Stephen Smalley | e60723a | 2014-05-29 16:40:15 -0400 | [diff] [blame] | 590 | |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 591 | all_cil_files.recovery := |
Stephen Smalley | e60723a | 2014-05-29 16:40:15 -0400 | [diff] [blame] | 592 | |
dcashman | 704741a | 2014-07-25 19:11:52 -0700 | [diff] [blame] | 593 | ################################## |
| 594 | include $(CLEAR_VARS) |
| 595 | |
| 596 | LOCAL_MODULE := general_sepolicy.conf |
| 597 | LOCAL_MODULE_CLASS := ETC |
| 598 | LOCAL_MODULE_TAGS := tests |
| 599 | |
| 600 | include $(BUILD_SYSTEM)/base_rules.mk |
| 601 | |
dcashman | 704741a | 2014-07-25 19:11:52 -0700 | [diff] [blame] | 602 | $(LOCAL_BUILT_MODULE): PRIVATE_MLS_SENS := $(MLS_SENS) |
| 603 | $(LOCAL_BUILT_MODULE): PRIVATE_MLS_CATS := $(MLS_CATS) |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 604 | $(LOCAL_BUILT_MODULE): PRIVATE_TGT_ARCH := $(my_target_arch) |
dcashman | cc39f63 | 2016-07-22 13:13:11 -0700 | [diff] [blame] | 605 | $(LOCAL_BUILT_MODULE): $(call build_policy, $(sepolicy_build_files), \ |
| 606 | $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY)) |
dcashman | 704741a | 2014-07-25 19:11:52 -0700 | [diff] [blame] | 607 | mkdir -p $(dir $@) |
| 608 | $(hide) m4 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \ |
| 609 | -D target_build_variant=user \ |
Jorge Lucangeli Obes | 84db84e | 2016-11-18 08:42:35 -0500 | [diff] [blame] | 610 | -D target_with_dexpreopt=$(WITH_DEXPREOPT) \ |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 611 | -D target_arch=$(PRIVATE_TGT_ARCH) \ |
dcashman | 704741a | 2014-07-25 19:11:52 -0700 | [diff] [blame] | 612 | -s $^ > $@ |
| 613 | $(hide) sed '/dontaudit/d' $@ > $@.dontaudit |
| 614 | |
William Roberts | b876993 | 2015-06-29 16:31:23 -0700 | [diff] [blame] | 615 | built_general_sepolicy.conf := $(LOCAL_BUILT_MODULE) |
dcashman | 704741a | 2014-07-25 19:11:52 -0700 | [diff] [blame] | 616 | exp_sepolicy_build_files := |
| 617 | |
| 618 | ################################## |
Stephen Smalley | 01a58af | 2012-10-02 12:46:37 -0400 | [diff] [blame] | 619 | include $(CLEAR_VARS) |
| 620 | |
William Roberts | b876993 | 2015-06-29 16:31:23 -0700 | [diff] [blame] | 621 | LOCAL_MODULE := sepolicy.general |
| 622 | LOCAL_MODULE_CLASS := ETC |
| 623 | LOCAL_MODULE_TAGS := tests |
| 624 | |
| 625 | include $(BUILD_SYSTEM)/base_rules.mk |
| 626 | |
| 627 | $(LOCAL_BUILT_MODULE): PRIVATE_BUILT_SEPOLICY.CONF := $(built_general_sepolicy.conf) |
| 628 | $(LOCAL_BUILT_MODULE): $(built_general_sepolicy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy |
| 629 | @mkdir -p $(dir $@) |
Nick Kralevich | 6ef10bd | 2016-02-29 16:59:33 -0800 | [diff] [blame] | 630 | $(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c $(POLICYVERS) -o $@ $(PRIVATE_BUILT_SEPOLICY.CONF) > /dev/null |
William Roberts | b876993 | 2015-06-29 16:31:23 -0700 | [diff] [blame] | 631 | |
| 632 | built_general_sepolicy := $(LOCAL_BUILT_MODULE) |
dcashman | d225b69 | 2016-12-12 09:29:04 -0800 | [diff] [blame] | 633 | |
William Roberts | b876993 | 2015-06-29 16:31:23 -0700 | [diff] [blame] | 634 | ################################## |
dcashman | d225b69 | 2016-12-12 09:29:04 -0800 | [diff] [blame] | 635 | # TODO - remove this. Keep around until we get the filesystem creation stuff taken care of. |
| 636 | # |
William Roberts | b876993 | 2015-06-29 16:31:23 -0700 | [diff] [blame] | 637 | include $(CLEAR_VARS) |
| 638 | |
Richard Haines | c2d0191 | 2015-08-06 17:43:52 +0100 | [diff] [blame] | 639 | LOCAL_MODULE := file_contexts.bin |
Ying Wang | 02fb5f3 | 2012-01-17 17:51:09 -0800 | [diff] [blame] | 640 | LOCAL_MODULE_CLASS := ETC |
| 641 | LOCAL_MODULE_TAGS := optional |
| 642 | LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT) |
| 643 | |
Stephen Smalley | 5b340be | 2012-03-06 11:12:41 -0500 | [diff] [blame] | 644 | include $(BUILD_SYSTEM)/base_rules.mk |
Ying Wang | 02fb5f3 | 2012-01-17 17:51:09 -0800 | [diff] [blame] | 645 | |
William Roberts | 49693f1 | 2016-01-04 12:20:57 -0800 | [diff] [blame] | 646 | # The file_contexts.bin is built in the following way: |
| 647 | # 1. Collect all file_contexts files in THIS repository and process them with |
| 648 | # m4 into a tmp file called file_contexts.local.tmp. |
| 649 | # 2. Collect all device specific file_contexts files and process them with m4 |
| 650 | # into a tmp file called file_contexts.device.tmp. |
| 651 | # 3. Run checkfc -e (allow no device fc entries ie empty) and fc_sort on |
| 652 | # file_contexts.device.tmp and output to file_contexts.device.sorted.tmp. |
| 653 | # 4. Concatenate file_contexts.local.tmp and file_contexts.device.tmp into |
| 654 | # file_contexts.concat.tmp. |
| 655 | # 5. Run checkfc and sefcontext_compile on file_contexts.concat.tmp to produce |
| 656 | # file_contexts.bin. |
| 657 | # |
| 658 | # Note: That a newline file is placed between each file_context file found to |
| 659 | # ensure a proper build when an fc file is missing an ending newline. |
William Roberts | 29d1468 | 2016-01-04 12:20:57 -0800 | [diff] [blame] | 660 | |
dcashman | cc39f63 | 2016-07-22 13:13:11 -0700 | [diff] [blame] | 661 | local_fc_files := $(PLAT_PRIVATE_POLICY)/file_contexts |
William Roberts | 49693f1 | 2016-01-04 12:20:57 -0800 | [diff] [blame] | 662 | ifneq ($(filter address,$(SANITIZE_TARGET)),) |
dcashman | cc39f63 | 2016-07-22 13:13:11 -0700 | [diff] [blame] | 663 | local_fc_files := $(local_fc_files) $(PLAT_PRIVATE_POLICY)/file_contexts_asan |
William Roberts | 49693f1 | 2016-01-04 12:20:57 -0800 | [diff] [blame] | 664 | endif |
| 665 | local_fcfiles_with_nl := $(call add_nl, $(local_fc_files), $(built_nl)) |
| 666 | |
| 667 | file_contexts.local.tmp := $(intermediates)/file_contexts.local.tmp |
| 668 | $(file_contexts.local.tmp): $(local_fcfiles_with_nl) |
Stephen Smalley | 5b340be | 2012-03-06 11:12:41 -0500 | [diff] [blame] | 669 | @mkdir -p $(dir $@) |
William Roberts | 49693f1 | 2016-01-04 12:20:57 -0800 | [diff] [blame] | 670 | $(hide) m4 -s $^ > $@ |
| 671 | |
| 672 | device_fc_files := $(call build_device_policy, file_contexts) |
| 673 | device_fcfiles_with_nl := $(call add_nl, $(device_fc_files), $(built_nl)) |
| 674 | |
| 675 | file_contexts.device.tmp := $(intermediates)/file_contexts.device.tmp |
| 676 | $(file_contexts.device.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) |
| 677 | $(file_contexts.device.tmp): $(device_fcfiles_with_nl) |
| 678 | @mkdir -p $(dir $@) |
| 679 | $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@ |
| 680 | |
| 681 | file_contexts.device.sorted.tmp := $(intermediates)/file_contexts.device.sorted.tmp |
| 682 | $(file_contexts.device.sorted.tmp): PRIVATE_SEPOLICY := $(built_sepolicy) |
| 683 | $(file_contexts.device.sorted.tmp): $(file_contexts.device.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/fc_sort $(HOST_OUT_EXECUTABLES)/checkfc |
| 684 | @mkdir -p $(dir $@) |
dcashman | 0779155 | 2016-12-07 11:27:47 -0800 | [diff] [blame] | 685 | $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e $(PRIVATE_SEPOLICY) $< |
William Roberts | 49693f1 | 2016-01-04 12:20:57 -0800 | [diff] [blame] | 686 | $(hide) $(HOST_OUT_EXECUTABLES)/fc_sort $< $@ |
| 687 | |
| 688 | file_contexts.concat.tmp := $(intermediates)/file_contexts.concat.tmp |
| 689 | $(file_contexts.concat.tmp): $(file_contexts.local.tmp) $(file_contexts.device.sorted.tmp) |
| 690 | @mkdir -p $(dir $@) |
| 691 | $(hide) m4 -s $^ > $@ |
Stephen Smalley | 5b340be | 2012-03-06 11:12:41 -0500 | [diff] [blame] | 692 | |
William Roberts | 3746a0a | 2015-09-25 10:18:44 -0700 | [diff] [blame] | 693 | $(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) |
William Roberts | 49693f1 | 2016-01-04 12:20:57 -0800 | [diff] [blame] | 694 | $(LOCAL_BUILT_MODULE): $(file_contexts.concat.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/sefcontext_compile $(HOST_OUT_EXECUTABLES)/checkfc |
Richard Haines | c2d0191 | 2015-08-06 17:43:52 +0100 | [diff] [blame] | 695 | @mkdir -p $(dir $@) |
dcashman | 0779155 | 2016-12-07 11:27:47 -0800 | [diff] [blame] | 696 | $(hide) $(HOST_OUT_EXECUTABLES)/checkfc $(PRIVATE_SEPOLICY) $< |
Richard Haines | c2d0191 | 2015-08-06 17:43:52 +0100 | [diff] [blame] | 697 | $(hide) $(HOST_OUT_EXECUTABLES)/sefcontext_compile -o $@ $< |
| 698 | |
Robert Craig | 8b7545b | 2014-03-20 09:35:08 -0400 | [diff] [blame] | 699 | built_fc := $(LOCAL_BUILT_MODULE) |
William Roberts | 49693f1 | 2016-01-04 12:20:57 -0800 | [diff] [blame] | 700 | local_fc_files := |
| 701 | local_fcfiles_with_nl := |
| 702 | device_fc_files := |
| 703 | device_fcfiles_with_nl := |
| 704 | file_contexts.concat.tmp := |
| 705 | file_contexts.device.sorted.tmp := |
| 706 | file_contexts.device.tmp := |
| 707 | file_contexts.local.tmp := |
William Roberts | 171a062 | 2012-08-16 10:55:05 -0700 | [diff] [blame] | 708 | |
Ying Wang | 02fb5f3 | 2012-01-17 17:51:09 -0800 | [diff] [blame] | 709 | ################################## |
| 710 | include $(CLEAR_VARS) |
Stephen Smalley | 2e0cd5a | 2015-03-12 17:45:03 -0400 | [diff] [blame] | 711 | |
dcashman | d225b69 | 2016-12-12 09:29:04 -0800 | [diff] [blame] | 712 | LOCAL_MODULE := plat_file_contexts |
Stephen Smalley | 2e0cd5a | 2015-03-12 17:45:03 -0400 | [diff] [blame] | 713 | LOCAL_MODULE_CLASS := ETC |
dcashman | d225b69 | 2016-12-12 09:29:04 -0800 | [diff] [blame] | 714 | LOCAL_MODULE_TAGS := optional |
| 715 | LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT) |
Stephen Smalley | 2e0cd5a | 2015-03-12 17:45:03 -0400 | [diff] [blame] | 716 | |
| 717 | include $(BUILD_SYSTEM)/base_rules.mk |
| 718 | |
dcashman | d225b69 | 2016-12-12 09:29:04 -0800 | [diff] [blame] | 719 | local_fc_files := $(PLAT_PRIVATE_POLICY)/file_contexts |
| 720 | ifneq ($(filter address,$(SANITIZE_TARGET)),) |
| 721 | local_fc_files += $(PLAT_PRIVATE_POLICY)/file_contexts_asan |
| 722 | endif |
Alex Klyubin | e4665d7 | 2017-01-19 19:58:34 -0800 | [diff] [blame] | 723 | local_fcfiles_with_nl := $(call add_nl, $(local_fc_files), $(built_nl)) |
Stephen Smalley | 2e0cd5a | 2015-03-12 17:45:03 -0400 | [diff] [blame] | 724 | |
Alex Klyubin | e4665d7 | 2017-01-19 19:58:34 -0800 | [diff] [blame] | 725 | $(LOCAL_BUILT_MODULE): PRIVATE_FC_FILES := $(local_fcfiles_with_nl) |
dcashman | d225b69 | 2016-12-12 09:29:04 -0800 | [diff] [blame] | 726 | $(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) |
Alex Klyubin | e4665d7 | 2017-01-19 19:58:34 -0800 | [diff] [blame] | 727 | $(LOCAL_BUILT_MODULE): PRIVATE_FC_SORT := $(HOST_OUT_EXECUTABLES)/fc_sort |
| 728 | $(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/checkfc $(HOST_OUT_EXECUTABLES)/fc_sort \ |
| 729 | $(local_fcfiles_with_nl) $(built_sepolicy) |
Richard Haines | c2d0191 | 2015-08-06 17:43:52 +0100 | [diff] [blame] | 730 | @mkdir -p $(dir $@) |
Alex Klyubin | e4665d7 | 2017-01-19 19:58:34 -0800 | [diff] [blame] | 731 | $(hide) m4 -s $(PRIVATE_FC_FILES) > $@.tmp |
| 732 | $(hide) $< $(PRIVATE_SEPOLICY) $@.tmp |
| 733 | $(hide) $(PRIVATE_FC_SORT) $@.tmp $@ |
Richard Haines | c2d0191 | 2015-08-06 17:43:52 +0100 | [diff] [blame] | 734 | |
dcashman | d225b69 | 2016-12-12 09:29:04 -0800 | [diff] [blame] | 735 | built_plat_fc := $(LOCAL_BUILT_MODULE) |
| 736 | local_fc_files := |
Alex Klyubin | e4665d7 | 2017-01-19 19:58:34 -0800 | [diff] [blame] | 737 | local_fcfiles_with_nl := |
dcashman | d225b69 | 2016-12-12 09:29:04 -0800 | [diff] [blame] | 738 | |
| 739 | ################################## |
| 740 | include $(CLEAR_VARS) |
| 741 | |
| 742 | LOCAL_MODULE := nonplat_file_contexts |
| 743 | LOCAL_MODULE_CLASS := ETC |
| 744 | LOCAL_MODULE_TAGS := optional |
| 745 | LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT) |
| 746 | |
| 747 | include $(BUILD_SYSTEM)/base_rules.mk |
| 748 | |
| 749 | nonplat_fc_files := $(call build_device_policy, file_contexts) |
| 750 | nonplat_fcfiles_with_nl := $(call add_nl, $(nonplat_fc_files), $(built_nl)) |
| 751 | |
| 752 | $(LOCAL_BUILT_MODULE): PRIVATE_FC_FILES := $(nonplat_fcfiles_with_nl) |
| 753 | $(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) |
| 754 | $(LOCAL_BUILT_MODULE): PRIVATE_FC_SORT := $(HOST_OUT_EXECUTABLES)/fc_sort |
| 755 | $(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/checkfc $(HOST_OUT_EXECUTABLES)/fc_sort \ |
Alex Klyubin | e4665d7 | 2017-01-19 19:58:34 -0800 | [diff] [blame] | 756 | $(nonplat_fcfiles_with_nl) $(built_sepolicy) |
dcashman | d225b69 | 2016-12-12 09:29:04 -0800 | [diff] [blame] | 757 | @mkdir -p $(dir $@) |
| 758 | $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_FC_FILES) > $@.tmp |
| 759 | $(hide) $< $(PRIVATE_SEPOLICY) $@.tmp |
| 760 | $(hide) $(PRIVATE_FC_SORT) $@.tmp $@ |
| 761 | |
| 762 | built_nonplat_fc := $(LOCAL_BUILT_MODULE) |
| 763 | nonplat_fc_files := |
| 764 | nonplat_fcfiles_with_nl := |
Stephen Smalley | 2e0cd5a | 2015-03-12 17:45:03 -0400 | [diff] [blame] | 765 | |
| 766 | ################################## |
| 767 | include $(CLEAR_VARS) |
Dan Cashman | 9c03807 | 2016-12-22 07:15:18 -0800 | [diff] [blame] | 768 | LOCAL_MODULE := plat_seapp_contexts |
Ying Wang | 02fb5f3 | 2012-01-17 17:51:09 -0800 | [diff] [blame] | 769 | LOCAL_MODULE_CLASS := ETC |
| 770 | LOCAL_MODULE_TAGS := optional |
| 771 | LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT) |
| 772 | |
William Roberts | 171a062 | 2012-08-16 10:55:05 -0700 | [diff] [blame] | 773 | include $(BUILD_SYSTEM)/base_rules.mk |
Ying Wang | 02fb5f3 | 2012-01-17 17:51:09 -0800 | [diff] [blame] | 774 | |
Dan Cashman | 9c03807 | 2016-12-22 07:15:18 -0800 | [diff] [blame] | 775 | plat_sc_files := $(call build_policy, seapp_contexts, $(PLAT_PRIVATE_POLICY)) |
William Roberts | 171a062 | 2012-08-16 10:55:05 -0700 | [diff] [blame] | 776 | |
Ying Wang | d8b122c | 2012-10-25 19:01:31 -0700 | [diff] [blame] | 777 | $(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) |
Dan Cashman | 9c03807 | 2016-12-22 07:15:18 -0800 | [diff] [blame] | 778 | $(LOCAL_BUILT_MODULE): PRIVATE_SC_FILES := $(plat_sc_files) |
| 779 | $(LOCAL_BUILT_MODULE): $(built_sepolicy) $(plat_sc_files) $(HOST_OUT_EXECUTABLES)/checkseapp |
William Roberts | f0e0a94 | 2012-08-27 15:41:15 -0700 | [diff] [blame] | 780 | @mkdir -p $(dir $@) |
William Roberts | 99fe8df | 2015-06-30 13:53:51 -0700 | [diff] [blame] | 781 | $(hide) $(HOST_OUT_EXECUTABLES)/checkseapp -p $(PRIVATE_SEPOLICY) -o $@ $(PRIVATE_SC_FILES) |
Ying Wang | 02fb5f3 | 2012-01-17 17:51:09 -0800 | [diff] [blame] | 782 | |
Dan Cashman | 9c03807 | 2016-12-22 07:15:18 -0800 | [diff] [blame] | 783 | built_plat_sc := $(LOCAL_BUILT_MODULE) |
| 784 | plat_sc_files := |
Robert Craig | 8b7545b | 2014-03-20 09:35:08 -0400 | [diff] [blame] | 785 | |
Ying Wang | 02fb5f3 | 2012-01-17 17:51:09 -0800 | [diff] [blame] | 786 | ################################## |
Stephen Smalley | 124720a | 2012-04-04 10:11:16 -0400 | [diff] [blame] | 787 | include $(CLEAR_VARS) |
Dan Cashman | 9c03807 | 2016-12-22 07:15:18 -0800 | [diff] [blame] | 788 | LOCAL_MODULE := nonplat_seapp_contexts |
Stephen Smalley | 3771287 | 2015-03-12 15:46:36 -0400 | [diff] [blame] | 789 | LOCAL_MODULE_CLASS := ETC |
Dan Cashman | 9c03807 | 2016-12-22 07:15:18 -0800 | [diff] [blame] | 790 | LOCAL_MODULE_TAGS := optional |
| 791 | LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT) |
Stephen Smalley | 3771287 | 2015-03-12 15:46:36 -0400 | [diff] [blame] | 792 | |
| 793 | include $(BUILD_SYSTEM)/base_rules.mk |
| 794 | |
Alex Klyubin | 5596172 | 2017-01-30 18:44:59 -0800 | [diff] [blame] | 795 | nonplat_sc_files := $(call build_policy, seapp_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY)) |
Jeff Vander Stoep | 87ae5f7 | 2017-03-06 22:53:09 -0800 | [diff] [blame^] | 796 | plat_sc_neverallow_files := $(addprefix $(PLAT_PRIVATE_POLICY)/, seapp_contexts) |
Stephen Smalley | 3771287 | 2015-03-12 15:46:36 -0400 | [diff] [blame] | 797 | |
Dan Cashman | 9c03807 | 2016-12-22 07:15:18 -0800 | [diff] [blame] | 798 | $(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) |
| 799 | $(LOCAL_BUILT_MODULE): PRIVATE_SC_FILES := $(nonplat_sc_files) |
Jeff Vander Stoep | 87ae5f7 | 2017-03-06 22:53:09 -0800 | [diff] [blame^] | 800 | $(LOCAL_BUILT_MODULE): PRIVATE_SC_NEVERALLOW_FILES := $(plat_sc_neverallow_files) |
| 801 | $(LOCAL_BUILT_MODULE): $(built_sepolicy) $(nonplat_sc_files) $(HOST_OUT_EXECUTABLES)/checkseapp $(plat_sc_neverallow_files) |
Stephen Smalley | 3771287 | 2015-03-12 15:46:36 -0400 | [diff] [blame] | 802 | @mkdir -p $(dir $@) |
Jeff Vander Stoep | 87ae5f7 | 2017-03-06 22:53:09 -0800 | [diff] [blame^] | 803 | $(hide) grep -ie '^neverallow' $(PRIVATE_SC_NEVERALLOW_FILES) > plat_seapp_neverallows.tmp |
| 804 | $(hide) $(HOST_OUT_EXECUTABLES)/checkseapp -p $(PRIVATE_SEPOLICY) -o $@ $(PRIVATE_SC_FILES) plat_seapp_neverallows.tmp |
Stephen Smalley | 3771287 | 2015-03-12 15:46:36 -0400 | [diff] [blame] | 805 | |
Dan Cashman | 9c03807 | 2016-12-22 07:15:18 -0800 | [diff] [blame] | 806 | built_nonplat_sc := $(LOCAL_BUILT_MODULE) |
| 807 | nonplat_sc_files := |
Stephen Smalley | 3771287 | 2015-03-12 15:46:36 -0400 | [diff] [blame] | 808 | |
| 809 | ################################## |
| 810 | include $(CLEAR_VARS) |
Dan Cashman | 9c03807 | 2016-12-22 07:15:18 -0800 | [diff] [blame] | 811 | LOCAL_MODULE := plat_seapp_neverallows |
William Roberts | 4ee7131 | 2015-06-25 11:59:30 -0700 | [diff] [blame] | 812 | LOCAL_MODULE_CLASS := ETC |
| 813 | LOCAL_MODULE_TAGS := tests |
| 814 | |
| 815 | include $(BUILD_SYSTEM)/base_rules.mk |
| 816 | |
Jeff Vander Stoep | 87ae5f7 | 2017-03-06 22:53:09 -0800 | [diff] [blame^] | 817 | $(LOCAL_BUILT_MODULE): $(plat_sc_neverallow_files) |
William Roberts | 4ee7131 | 2015-06-25 11:59:30 -0700 | [diff] [blame] | 818 | @mkdir -p $(dir $@) |
| 819 | - $(hide) grep -ie '^neverallow' $< > $@ |
| 820 | |
Jeff Vander Stoep | 87ae5f7 | 2017-03-06 22:53:09 -0800 | [diff] [blame^] | 821 | plat_sc_neverallow_files := |
William Roberts | 4ee7131 | 2015-06-25 11:59:30 -0700 | [diff] [blame] | 822 | |
| 823 | ################################## |
| 824 | include $(CLEAR_VARS) |
Stephen Smalley | 124720a | 2012-04-04 10:11:16 -0400 | [diff] [blame] | 825 | |
Sandeep Patil | a86316e | 2016-12-27 16:08:44 -0800 | [diff] [blame] | 826 | LOCAL_MODULE := plat_property_contexts |
Stephen Smalley | 124720a | 2012-04-04 10:11:16 -0400 | [diff] [blame] | 827 | LOCAL_MODULE_CLASS := ETC |
| 828 | LOCAL_MODULE_TAGS := optional |
Sandeep Patil | a86316e | 2016-12-27 16:08:44 -0800 | [diff] [blame] | 829 | # TODO: Change module path to TARGET_SYSTEM_OUT after b/27805372 |
Stephen Smalley | 124720a | 2012-04-04 10:11:16 -0400 | [diff] [blame] | 830 | LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT) |
| 831 | |
| 832 | include $(BUILD_SYSTEM)/base_rules.mk |
| 833 | |
Sandeep Patil | a86316e | 2016-12-27 16:08:44 -0800 | [diff] [blame] | 834 | plat_pcfiles := $(call build_policy, property_contexts, $(PLAT_PRIVATE_POLICY)) |
William Roberts | 6aabc1c | 2015-07-30 11:44:26 -0700 | [diff] [blame] | 835 | |
Sandeep Patil | a86316e | 2016-12-27 16:08:44 -0800 | [diff] [blame] | 836 | plat_property_contexts.tmp := $(intermediates)/plat_property_contexts.tmp |
| 837 | $(plat_property_contexts.tmp): PRIVATE_PC_FILES := $(plat_pcfiles) |
| 838 | $(plat_property_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) |
| 839 | $(plat_property_contexts.tmp): $(plat_pcfiles) |
William Roberts | 7f81b33 | 2015-09-29 13:52:37 -0700 | [diff] [blame] | 840 | @mkdir -p $(dir $@) |
Colin Cross | 9eb6c87 | 2015-10-01 21:25:09 +0000 | [diff] [blame] | 841 | $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_PC_FILES) > $@ |
William Roberts | dcffd2b | 2015-09-29 13:52:37 -0700 | [diff] [blame] | 842 | |
| 843 | |
| 844 | $(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) |
Sandeep Patil | a86316e | 2016-12-27 16:08:44 -0800 | [diff] [blame] | 845 | $(LOCAL_BUILT_MODULE): $(plat_property_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc |
William Roberts | dcffd2b | 2015-09-29 13:52:37 -0700 | [diff] [blame] | 846 | @mkdir -p $(dir $@) |
Sandeep Patil | a86316e | 2016-12-27 16:08:44 -0800 | [diff] [blame] | 847 | $(hide) sed -e 's/#.*$$//' -e '/^$$/d' $< | sort -u -o $@ |
dcashman | 0779155 | 2016-12-07 11:27:47 -0800 | [diff] [blame] | 848 | $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -p $(PRIVATE_SEPOLICY) $@ |
Stephen Smalley | 124720a | 2012-04-04 10:11:16 -0400 | [diff] [blame] | 849 | |
Sandeep Patil | a86316e | 2016-12-27 16:08:44 -0800 | [diff] [blame] | 850 | built_plat_pc := $(LOCAL_BUILT_MODULE) |
| 851 | plat_pcfiles := |
| 852 | plat_property_contexts.tmp := |
Robert Craig | 8b7545b | 2014-03-20 09:35:08 -0400 | [diff] [blame] | 853 | |
Stephen Smalley | 124720a | 2012-04-04 10:11:16 -0400 | [diff] [blame] | 854 | ################################## |
Riley Spahn | f90c41f | 2014-06-05 15:52:02 -0700 | [diff] [blame] | 855 | include $(CLEAR_VARS) |
| 856 | |
Sandeep Patil | a86316e | 2016-12-27 16:08:44 -0800 | [diff] [blame] | 857 | LOCAL_MODULE := nonplat_property_contexts |
Stephen Smalley | 2e0cd5a | 2015-03-12 17:45:03 -0400 | [diff] [blame] | 858 | LOCAL_MODULE_CLASS := ETC |
Sandeep Patil | a86316e | 2016-12-27 16:08:44 -0800 | [diff] [blame] | 859 | LOCAL_MODULE_TAGS := optional |
| 860 | # TODO: Change module path to TARGET_SYSTEM_OUT after b/27805372 |
| 861 | LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT) |
Stephen Smalley | 2e0cd5a | 2015-03-12 17:45:03 -0400 | [diff] [blame] | 862 | |
Stephen Smalley | c936173 | 2015-03-13 09:36:57 -0400 | [diff] [blame] | 863 | include $(BUILD_SYSTEM)/base_rules.mk |
| 864 | |
Alex Klyubin | 5596172 | 2017-01-30 18:44:59 -0800 | [diff] [blame] | 865 | nonplat_pcfiles := $(call build_policy, property_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY)) |
Sandeep Patil | 262edc3 | 2016-12-27 16:08:44 -0800 | [diff] [blame] | 866 | |
Sandeep Patil | a86316e | 2016-12-27 16:08:44 -0800 | [diff] [blame] | 867 | nonplat_property_contexts.tmp := $(intermediates)/nonplat_property_contexts.tmp |
| 868 | $(nonplat_property_contexts.tmp): PRIVATE_PC_FILES := $(nonplat_pcfiles) |
| 869 | $(nonplat_property_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) |
| 870 | $(nonplat_property_contexts.tmp): $(nonplat_pcfiles) |
William Roberts | dcffd2b | 2015-09-29 13:52:37 -0700 | [diff] [blame] | 871 | @mkdir -p $(dir $@) |
Sandeep Patil | a86316e | 2016-12-27 16:08:44 -0800 | [diff] [blame] | 872 | $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_PC_FILES) > $@ |
| 873 | |
| 874 | |
| 875 | $(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) |
| 876 | $(LOCAL_BUILT_MODULE): $(nonplat_property_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc |
| 877 | @mkdir -p $(dir $@) |
| 878 | $(hide) sed -e 's/#.*$$//' -e '/^$$/d' $< | sort -u -o $@ |
dcashman | 0779155 | 2016-12-07 11:27:47 -0800 | [diff] [blame] | 879 | $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -p $(PRIVATE_SEPOLICY) $@ |
William Roberts | dcffd2b | 2015-09-29 13:52:37 -0700 | [diff] [blame] | 880 | |
Sandeep Patil | a86316e | 2016-12-27 16:08:44 -0800 | [diff] [blame] | 881 | built_nonplat_pc := $(LOCAL_BUILT_MODULE) |
| 882 | nonplat_pcfiles := |
| 883 | nonplat_property_contexts.tmp := |
Stephen Smalley | 2e0cd5a | 2015-03-12 17:45:03 -0400 | [diff] [blame] | 884 | |
| 885 | ################################## |
| 886 | include $(CLEAR_VARS) |
| 887 | |
Sandeep Patil | a058b56 | 2016-12-27 15:10:48 -0800 | [diff] [blame] | 888 | LOCAL_MODULE := plat_service_contexts |
Riley Spahn | f90c41f | 2014-06-05 15:52:02 -0700 | [diff] [blame] | 889 | LOCAL_MODULE_CLASS := ETC |
| 890 | LOCAL_MODULE_TAGS := optional |
Sandeep Patil | a058b56 | 2016-12-27 15:10:48 -0800 | [diff] [blame] | 891 | # TODO: Change module path to TARGET_SYSTEM_OUT after b/27805372 |
Riley Spahn | f90c41f | 2014-06-05 15:52:02 -0700 | [diff] [blame] | 892 | LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT) |
| 893 | |
| 894 | include $(BUILD_SYSTEM)/base_rules.mk |
| 895 | |
Sandeep Patil | a058b56 | 2016-12-27 15:10:48 -0800 | [diff] [blame] | 896 | plat_svcfiles := $(call build_policy, service_contexts, $(PLAT_PRIVATE_POLICY)) |
Riley Spahn | f90c41f | 2014-06-05 15:52:02 -0700 | [diff] [blame] | 897 | |
Sandeep Patil | a058b56 | 2016-12-27 15:10:48 -0800 | [diff] [blame] | 898 | plat_service_contexts.tmp := $(intermediates)/plat_service_contexts.tmp |
| 899 | $(plat_service_contexts.tmp): PRIVATE_SVC_FILES := $(plat_svcfiles) |
| 900 | $(plat_service_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) |
| 901 | $(plat_service_contexts.tmp): $(plat_svcfiles) |
Riley Spahn | f90c41f | 2014-06-05 15:52:02 -0700 | [diff] [blame] | 902 | @mkdir -p $(dir $@) |
William Roberts | 6aabc1c | 2015-07-30 11:44:26 -0700 | [diff] [blame] | 903 | $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@ |
William Roberts | 7fc865a | 2015-09-29 14:17:38 -0700 | [diff] [blame] | 904 | |
| 905 | $(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) |
Sandeep Patil | a058b56 | 2016-12-27 15:10:48 -0800 | [diff] [blame] | 906 | $(LOCAL_BUILT_MODULE): $(plat_service_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP) |
William Roberts | 7fc865a | 2015-09-29 14:17:38 -0700 | [diff] [blame] | 907 | @mkdir -p $(dir $@) |
William Roberts | c9fce3f | 2016-04-06 11:53:04 -0700 | [diff] [blame] | 908 | sed -e 's/#.*$$//' -e '/^$$/d' $< > $@ |
dcashman | 0779155 | 2016-12-07 11:27:47 -0800 | [diff] [blame] | 909 | $(HOST_OUT_EXECUTABLES)/checkfc -s $(PRIVATE_SEPOLICY) $@ |
Riley Spahn | f90c41f | 2014-06-05 15:52:02 -0700 | [diff] [blame] | 910 | |
Sandeep Patil | a058b56 | 2016-12-27 15:10:48 -0800 | [diff] [blame] | 911 | built_plat_svc := $(LOCAL_BUILT_MODULE) |
| 912 | plat_svcfiles := |
| 913 | plat_service_contexts.tmp := |
Riley Spahn | f90c41f | 2014-06-05 15:52:02 -0700 | [diff] [blame] | 914 | |
| 915 | ################################## |
rpcraig | b19665c | 2012-07-30 09:33:03 -0400 | [diff] [blame] | 916 | include $(CLEAR_VARS) |
| 917 | |
Sandeep Patil | a058b56 | 2016-12-27 15:10:48 -0800 | [diff] [blame] | 918 | LOCAL_MODULE := nonplat_service_contexts |
Stephen Smalley | 2e0cd5a | 2015-03-12 17:45:03 -0400 | [diff] [blame] | 919 | LOCAL_MODULE_CLASS := ETC |
Sandeep Patil | a058b56 | 2016-12-27 15:10:48 -0800 | [diff] [blame] | 920 | LOCAL_MODULE_TAGS := optional |
| 921 | # TODO: Change module path to TARGET_VENDOR_OUT after b/27805372 |
| 922 | LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT) |
Stephen Smalley | 2e0cd5a | 2015-03-12 17:45:03 -0400 | [diff] [blame] | 923 | |
| 924 | include $(BUILD_SYSTEM)/base_rules.mk |
| 925 | |
Alex Klyubin | 5596172 | 2017-01-30 18:44:59 -0800 | [diff] [blame] | 926 | nonplat_svcfiles := $(call build_policy, service_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY)) |
Stephen Smalley | 2e0cd5a | 2015-03-12 17:45:03 -0400 | [diff] [blame] | 927 | |
Sandeep Patil | a058b56 | 2016-12-27 15:10:48 -0800 | [diff] [blame] | 928 | nonplat_service_contexts.tmp := $(intermediates)/nonplat_service_contexts.tmp |
| 929 | $(nonplat_service_contexts.tmp): PRIVATE_SVC_FILES := $(nonplat_svcfiles) |
| 930 | $(nonplat_service_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) |
| 931 | $(nonplat_service_contexts.tmp): $(nonplat_svcfiles) |
| 932 | @mkdir -p $(dir $@) |
| 933 | $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@ |
| 934 | |
| 935 | $(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) |
| 936 | $(LOCAL_BUILT_MODULE): $(nonplat_service_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP) |
William Roberts | 7fc865a | 2015-09-29 14:17:38 -0700 | [diff] [blame] | 937 | @mkdir -p $(dir $@) |
William Roberts | c9fce3f | 2016-04-06 11:53:04 -0700 | [diff] [blame] | 938 | sed -e 's/#.*$$//' -e '/^$$/d' $< > $@ |
dcashman | 0779155 | 2016-12-07 11:27:47 -0800 | [diff] [blame] | 939 | $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -s $(PRIVATE_SEPOLICY) $@ |
William Roberts | 7fc865a | 2015-09-29 14:17:38 -0700 | [diff] [blame] | 940 | |
Sandeep Patil | a058b56 | 2016-12-27 15:10:48 -0800 | [diff] [blame] | 941 | built_nonplat_svc := $(LOCAL_BUILT_MODULE) |
| 942 | nonplat_svcfiles := |
| 943 | nonplat_service_contexts.tmp := |
Stephen Smalley | 2e0cd5a | 2015-03-12 17:45:03 -0400 | [diff] [blame] | 944 | |
| 945 | ################################## |
| 946 | include $(CLEAR_VARS) |
| 947 | |
dcashman | 90b3b94 | 2016-12-14 13:47:55 -0800 | [diff] [blame] | 948 | LOCAL_MODULE := plat_mac_permissions.xml |
rpcraig | b19665c | 2012-07-30 09:33:03 -0400 | [diff] [blame] | 949 | LOCAL_MODULE_CLASS := ETC |
| 950 | LOCAL_MODULE_TAGS := optional |
| 951 | LOCAL_MODULE_PATH := $(TARGET_OUT_ETC)/security |
| 952 | |
William Roberts | 2c8a55d | 2012-11-30 14:59:09 -0800 | [diff] [blame] | 953 | include $(BUILD_SYSTEM)/base_rules.mk |
rpcraig | b19665c | 2012-07-30 09:33:03 -0400 | [diff] [blame] | 954 | |
Geremy Condra | cd4104e | 2013-03-26 18:19:12 +0000 | [diff] [blame] | 955 | # Build keys.conf |
dcashman | 90b3b94 | 2016-12-14 13:47:55 -0800 | [diff] [blame] | 956 | plat_mac_perms_keys.tmp := $(intermediates)/plat_keys.tmp |
| 957 | $(plat_mac_perms_keys.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) |
| 958 | $(plat_mac_perms_keys.tmp): $(call build_policy, keys.conf, $(PLAT_PRIVATE_POLICY)) |
Geremy Condra | cd4104e | 2013-03-26 18:19:12 +0000 | [diff] [blame] | 959 | @mkdir -p $(dir $@) |
William Roberts | d218558 | 2015-07-16 11:28:02 -0700 | [diff] [blame] | 960 | $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@ |
Geremy Condra | cd4104e | 2013-03-26 18:19:12 +0000 | [diff] [blame] | 961 | |
dcashman | 90b3b94 | 2016-12-14 13:47:55 -0800 | [diff] [blame] | 962 | all_plat_mac_perms_files := $(call build_policy, mac_permissions.xml, $(PLAT_PRIVATE_POLICY)) |
rpcraig | b19665c | 2012-07-30 09:33:03 -0400 | [diff] [blame] | 963 | |
Shinichiro Hamaji | ef0c14d | 2016-05-13 16:04:58 +0900 | [diff] [blame] | 964 | # Should be synced with keys.conf. |
dcashman | 90b3b94 | 2016-12-14 13:47:55 -0800 | [diff] [blame] | 965 | all_plat_keys := platform media shared testkey |
| 966 | all_plat_keys := $(all_keys:%=$(dir $(DEFAULT_SYSTEM_DEV_CERTIFICATE))/%.x509.pem) |
Shinichiro Hamaji | ef0c14d | 2016-05-13 16:04:58 +0900 | [diff] [blame] | 967 | |
dcashman | 90b3b94 | 2016-12-14 13:47:55 -0800 | [diff] [blame] | 968 | $(LOCAL_BUILT_MODULE): PRIVATE_MAC_PERMS_FILES := $(all_plat_mac_perms_files) |
| 969 | $(LOCAL_BUILT_MODULE): $(plat_mac_perms_keys.tmp) $(HOST_OUT_EXECUTABLES)/insertkeys.py \ |
| 970 | $(all_plat_mac_perms_files) $(all_plat_keys) |
Geremy Condra | cd4104e | 2013-03-26 18:19:12 +0000 | [diff] [blame] | 971 | @mkdir -p $(dir $@) |
Nick Kralevich | c3c9052 | 2013-10-25 12:25:36 -0700 | [diff] [blame] | 972 | $(hide) DEFAULT_SYSTEM_DEV_CERTIFICATE="$(dir $(DEFAULT_SYSTEM_DEV_CERTIFICATE))" \ |
William Roberts | 6aabc1c | 2015-07-30 11:44:26 -0700 | [diff] [blame] | 973 | $(HOST_OUT_EXECUTABLES)/insertkeys.py -t $(TARGET_BUILD_VARIANT) -c $(TOP) $< -o $@ $(PRIVATE_MAC_PERMS_FILES) |
Geremy Condra | cd4104e | 2013-03-26 18:19:12 +0000 | [diff] [blame] | 974 | |
William Roberts | 6aabc1c | 2015-07-30 11:44:26 -0700 | [diff] [blame] | 975 | all_mac_perms_files := |
dcashman | 90b3b94 | 2016-12-14 13:47:55 -0800 | [diff] [blame] | 976 | all_plat_keys := |
| 977 | plat_mac_perms_keys.tmp := |
| 978 | |
| 979 | ################################## |
| 980 | include $(CLEAR_VARS) |
| 981 | |
| 982 | LOCAL_MODULE := nonplat_mac_permissions.xml |
| 983 | LOCAL_MODULE_CLASS := ETC |
| 984 | LOCAL_MODULE_TAGS := optional |
| 985 | LOCAL_MODULE_PATH := $(TARGET_OUT_ETC)/security |
| 986 | |
| 987 | include $(BUILD_SYSTEM)/base_rules.mk |
| 988 | |
| 989 | # Build keys.conf |
| 990 | nonplat_mac_perms_keys.tmp := $(intermediates)/nonplat_keys.tmp |
| 991 | $(nonplat_mac_perms_keys.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) |
Alex Klyubin | 5596172 | 2017-01-30 18:44:59 -0800 | [diff] [blame] | 992 | $(nonplat_mac_perms_keys.tmp): $(call build_policy, keys.conf, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY)) |
dcashman | 90b3b94 | 2016-12-14 13:47:55 -0800 | [diff] [blame] | 993 | @mkdir -p $(dir $@) |
| 994 | $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@ |
| 995 | |
Alex Klyubin | 5596172 | 2017-01-30 18:44:59 -0800 | [diff] [blame] | 996 | all_nonplat_mac_perms_files := $(call build_policy, mac_permissions.xml, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY)) |
dcashman | 90b3b94 | 2016-12-14 13:47:55 -0800 | [diff] [blame] | 997 | |
| 998 | $(LOCAL_BUILT_MODULE): PRIVATE_MAC_PERMS_FILES := $(all_nonplat_mac_perms_files) |
| 999 | $(LOCAL_BUILT_MODULE): $(nonplat_mac_perms_keys.tmp) $(HOST_OUT_EXECUTABLES)/insertkeys.py \ |
| 1000 | $(all_nonplat_mac_perms_files) |
| 1001 | @mkdir -p $(dir $@) |
| 1002 | $(hide) $(HOST_OUT_EXECUTABLES)/insertkeys.py -t $(TARGET_BUILD_VARIANT) -c $(TOP) $< -o $@ $(PRIVATE_MAC_PERMS_FILES) |
| 1003 | |
| 1004 | nonplat_mac_perms_keys.tmp := |
| 1005 | all_nonplat_mac_perms_files := |
William Roberts | 6aabc1c | 2015-07-30 11:44:26 -0700 | [diff] [blame] | 1006 | |
rpcraig | b19665c | 2012-07-30 09:33:03 -0400 | [diff] [blame] | 1007 | ################################## |
Robert Craig | 8b7545b | 2014-03-20 09:35:08 -0400 | [diff] [blame] | 1008 | include $(CLEAR_VARS) |
| 1009 | |
| 1010 | LOCAL_MODULE := selinux_version |
| 1011 | LOCAL_MODULE_CLASS := ETC |
| 1012 | LOCAL_MODULE_TAGS := optional |
| 1013 | LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT) |
| 1014 | |
| 1015 | include $(BUILD_SYSTEM)/base_rules.mk |
Sandeep Patil | a86316e | 2016-12-27 16:08:44 -0800 | [diff] [blame] | 1016 | $(LOCAL_BUILT_MODULE): $(built_sepolicy) $(built_plat_pc) $(built_nonplat_pc) $(built_plat_fc) \ |
Sandeep Patil | a058b56 | 2016-12-27 15:10:48 -0800 | [diff] [blame] | 1017 | $(buit_nonplat_fc) $(built_plat_sc) $(built_nonplat_sc) $(built_plat_svc) $(built_nonplat_svc) |
Robert Craig | 8b7545b | 2014-03-20 09:35:08 -0400 | [diff] [blame] | 1018 | @mkdir -p $(dir $@) |
Colin Cross | 29a463d | 2015-07-17 13:08:41 -0700 | [diff] [blame] | 1019 | $(hide) echo -n $(BUILD_FINGERPRINT_FROM_FILE) > $@ |
Robert Craig | 8b7545b | 2014-03-20 09:35:08 -0400 | [diff] [blame] | 1020 | |
| 1021 | ################################## |
rpcraig | 47cd396 | 2012-10-17 21:09:52 -0400 | [diff] [blame] | 1022 | |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 1023 | add_nl := |
William Roberts | 49693f1 | 2016-01-04 12:20:57 -0800 | [diff] [blame] | 1024 | build_device_policy := |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 1025 | build_policy := |
dcashman | d225b69 | 2016-12-12 09:29:04 -0800 | [diff] [blame] | 1026 | built_plat_fc := |
| 1027 | built_nonplat_fc := |
William Roberts | b876993 | 2015-06-29 16:31:23 -0700 | [diff] [blame] | 1028 | built_general_sepolicy := |
| 1029 | built_general_sepolicy.conf := |
Richard Haines | c8801fe | 2015-12-11 10:39:19 +0000 | [diff] [blame] | 1030 | built_nl := |
Alex Klyubin | 8f7173b | 2017-02-25 14:47:53 -0800 | [diff] [blame] | 1031 | built_plat_cil := |
| 1032 | built_plat_cil.recovery := |
| 1033 | built_mapping_cil := |
| 1034 | built_mapping_cil.recovery := |
Sandeep Patil | a86316e | 2016-12-27 16:08:44 -0800 | [diff] [blame] | 1035 | built_plat_pc := |
| 1036 | built_nonplat_pc := |
Dan Cashman | 9c03807 | 2016-12-22 07:15:18 -0800 | [diff] [blame] | 1037 | built_nonplat_sc := |
| 1038 | built_plat_sc := |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 1039 | built_sepolicy := |
Sandeep Patil | a058b56 | 2016-12-27 15:10:48 -0800 | [diff] [blame] | 1040 | built_plat_svc := |
| 1041 | built_nonplat_svc := |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 1042 | mapping_policy_nvr := |
| 1043 | mapping_policy_nvr.recovery := |
| 1044 | my_target_arch := |
| 1045 | nonplat_policy_nvr := |
| 1046 | nonplat_policy_nvr.recovery := |
| 1047 | plat_policy_nvr := |
| 1048 | plat_policy_nvr.recovery := |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 1049 | plat_pub_policy.cil := |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 1050 | plat_pub_policy.recovery.cil := |
dcashman | 1faa644 | 2016-11-28 07:20:28 -0800 | [diff] [blame] | 1051 | reqd_policy_mask.cil := |
Dan Cashman | 1c04027 | 2016-12-15 15:28:44 -0800 | [diff] [blame] | 1052 | sepolicy_build_files := |
Alice Chu | cdfb06f | 2012-11-01 11:33:04 -0700 | [diff] [blame] | 1053 | |
| 1054 | include $(call all-makefiles-under,$(LOCAL_PATH)) |