blob: 31a48b01b9db3bf8ea6fb418c7a0d5d6ea149832 [file] [log] [blame]
Stephen Smalley2dd4e512012-01-04 12:33:27 -05001LOCAL_PATH:= $(call my-dir)
William Robertsf0e0a942012-08-27 15:41:15 -07002
Dan Cashman36ee91d2017-07-07 14:59:51 -07003include $(LOCAL_PATH)/definitions.mk
4
Stephen Smalley2dd4e512012-01-04 12:33:27 -05005include $(CLEAR_VARS)
Stephen Smalley2dd4e512012-01-04 12:33:27 -05006# SELinux policy version.
Stephen Smalleyb4f17062015-03-13 10:03:52 -04007# Must be <= /sys/fs/selinux/policyvers reported by the Android kernel.
Stephen Smalley2dd4e512012-01-04 12:33:27 -05008# Must be within the compatibility range reported by checkpolicy -V.
Jeff Vander Stoep3a0ce492015-12-07 08:30:43 -08009POLICYVERS ?= 30
Stephen Smalley2dd4e512012-01-04 12:33:27 -050010
11MLS_SENS=1
12MLS_CATS=1024
13
Stephen Smalley8e0ca882015-04-01 10:14:56 -040014ifdef BOARD_SEPOLICY_UNION
15$(warning BOARD_SEPOLICY_UNION is no longer required - all files found in BOARD_SEPOLICY_DIRS are implicitly unioned; please remove from your BoardConfig.mk or other .mk file.)
16endif
Robert Craig6b0ff472014-01-29 13:10:58 -050017
William Robertsd2185582015-07-16 11:28:02 -070018ifdef BOARD_SEPOLICY_M4DEFS
19LOCAL_ADDITIONAL_M4DEFS := $(addprefix -D, $(BOARD_SEPOLICY_M4DEFS))
Dan Cashman36ee91d2017-07-07 14:59:51 -070020else
21LOCAL_ADDITIONAL_M4DEFS :=
William Robertsd2185582015-07-16 11:28:02 -070022endif
23
dcashmancc39f632016-07-22 13:13:11 -070024# sepolicy is now divided into multiple portions:
25# public - policy exported on which non-platform policy developers may write
26# additional policy. types and attributes are versioned and included in
27# delivered non-platform policy, which is to be combined with platform policy.
28# private - platform-only policy required for platform functionality but which
29# is not exported to vendor policy developers and as such may not be assumed
30# to exist.
Alex Klyubin55961722017-01-30 18:44:59 -080031# vendor - vendor-only policy required for vendor functionality. This policy can
32# reference the public policy but cannot reference the private policy. This
33# policy is for components which are produced from the core/non-vendor tree and
34# placed into a vendor partition.
dcashman07791552016-12-07 11:27:47 -080035# mapping - This contains policy statements which map the attributes
dcashmancc39f632016-07-22 13:13:11 -070036# exposed in the public policy of previous versions to the concrete types used
37# in this policy to ensure that policy targeting attributes from public
38# policy from an older platform version continues to work.
39
dcashman2e00e632016-10-12 14:58:09 -070040# build process for device:
dcashmancc39f632016-07-22 13:13:11 -070041# 1) convert policies to CIL:
42# - private + public platform policy to CIL
43# - mapping file to CIL (should already be in CIL form)
44# - non-platform public policy to CIL
45# - non-platform public + private policy to CIL
46# 2) attributize policy
dcashmancc39f632016-07-22 13:13:11 -070047# - run script which takes non-platform public and non-platform combined
48# private + public policy and produces attributized and versioned
49# non-platform policy
50# 3) combine policy files
51# - combine mapping, platform and non-platform policy.
52# - compile output binary policy file
53
54PLAT_PUBLIC_POLICY := $(LOCAL_PATH)/public
55PLAT_PRIVATE_POLICY := $(LOCAL_PATH)/private
Alex Klyubin55961722017-01-30 18:44:59 -080056PLAT_VENDOR_POLICY := $(LOCAL_PATH)/vendor
dcashman2e00e632016-10-12 14:58:09 -070057REQD_MASK_POLICY := $(LOCAL_PATH)/reqd_mask
Tri Vo75887dd2018-12-14 14:30:56 -080058PRODUCT_PUBLIC_POLICY := $(BOARD_PLAT_PUBLIC_SEPOLICY_DIR)
59PRODUCT_PRIVATE_POLICY := $(BOARD_PLAT_PRIVATE_SEPOLICY_DIR)
60
61# TODO(b/119305624): Currently if the device doesn't have a product partition,
62# we install product sepolicy into /system/product. We do that because bits of
63# product sepolicy that's still in /system might depend on bits that have moved
64# to /product. Once we finish migrating product sepolicy out of system, change
65# it so that if no product partition is present, product sepolicy artifacts are
66# not built and installed at all.
67ifneq (,$(PRODUCT_PUBLIC_POLICY)$(PRODUCT_PRIVATE_POLICY))
68HAS_PRODUCT_SEPOLICY := true
69endif
dcashman2e00e632016-10-12 14:58:09 -070070
71# TODO: move to README when doing the README update and finalizing versioning.
Sandeep Patil42f95982017-04-07 14:18:48 -070072# BOARD_SEPOLICY_VERS must take the format "NN.m" and contain the sepolicy
73# version identifier corresponding to the sepolicy on which the non-platform
74# policy is to be based. If unspecified, this will build against the current
75# public platform policy in tree
dcashman2e00e632016-10-12 14:58:09 -070076ifndef BOARD_SEPOLICY_VERS
77$(warning BOARD_SEPOLICY_VERS not specified, assuming current platform version)
Sandeep Patil42f95982017-04-07 14:18:48 -070078# The default platform policy version.
Dan Cashman6f14f6b2017-04-07 16:36:23 -070079BOARD_SEPOLICY_VERS := $(PLATFORM_SEPOLICY_VERSION)
dcashman2e00e632016-10-12 14:58:09 -070080endif
dcashmancc39f632016-07-22 13:13:11 -070081
Joel Galenson5988b562018-01-03 16:53:24 -080082NEVERALLOW_ARG :=
83ifeq ($(SELINUX_IGNORE_NEVERALLOWS),true)
84ifeq ($(TARGET_BUILD_VARIANT),user)
85$(error SELINUX_IGNORE_NEVERALLOWS := true cannot be used in user builds)
86endif
87$(warning Be careful when using the SELINUX_IGNORE_NEVERALLOWS flag. \
88 It does not work in user builds and using it will \
89 not stop you from failing CTS.)
90NEVERALLOW_ARG := -N
91endif
92
Bowgo Tsai45457e32017-11-27 11:41:33 +080093# BOARD_SEPOLICY_DIRS was used for vendor/odm sepolicy customization before.
94# It has been replaced by BOARD_VENDOR_SEPOLICY_DIRS (mandatory) and
95# BOARD_ODM_SEPOLICY_DIRS (optional). BOARD_SEPOLICY_DIRS is still allowed for
96# backward compatibility, which will be merged into BOARD_VENDOR_SEPOLICY_DIRS.
Bowgo Tsaiafbcf212018-02-05 17:34:52 +080097ifdef BOARD_SEPOLICY_DIRS
98BOARD_VENDOR_SEPOLICY_DIRS += $(BOARD_SEPOLICY_DIRS)
99endif
Dan Cashman4d24a772017-04-12 14:28:34 -0700100
Bowgo Tsai45457e32017-11-27 11:41:33 +0800101ifdef BOARD_ODM_SEPOLICY_DIRS
102ifneq ($(PRODUCT_SEPOLICY_SPLIT),true)
103$(error PRODUCT_SEPOLICY_SPLIT needs to be true when using BOARD_ODM_SEPOLICY_DIRS)
104endif
105endif
106
Dan Cashman4d24a772017-04-12 14:28:34 -0700107platform_mapping_file := $(BOARD_SEPOLICY_VERS).cil
108
dcashmancc39f632016-07-22 13:13:11 -0700109###########################################################
110# Compute policy files to be used in policy build.
111# $(1): files to include
112# $(2): directories in which to find files
113###########################################################
114
115define build_policy
116$(foreach type, $(1), $(foreach file, $(addsuffix /$(type), $(2)), $(sort $(wildcard $(file)))))
117endef
William Roberts29d14682016-01-04 12:20:57 -0800118
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800119# Builds paths for all policy files found in BOARD_VENDOR_SEPOLICY_DIRS.
William Roberts49693f12016-01-04 12:20:57 -0800120# $(1): the set of policy name paths to build
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800121build_vendor_policy = $(call build_policy, $(1), $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS))
William Roberts49693f12016-01-04 12:20:57 -0800122
Bowgo Tsaibae15172017-11-29 16:14:53 +0800123# Builds paths for all policy files found in BOARD_ODM_SEPOLICY_DIRS.
124build_odm_policy = $(call build_policy, $(1), $(BOARD_ODM_SEPOLICY_DIRS))
125
Richard Hainesc8801fe2015-12-11 10:39:19 +0000126# Add a file containing only a newline in-between each policy configuration
127# 'contexts' file. This will allow OEM policy configuration files without a
128# final newline (0x0A) to be built correctly by the m4(1) macro processor.
129# $(1): the set of contexts file names.
130# $(2): the file containing only 0x0A.
131add_nl = $(foreach entry, $(1), $(subst $(entry), $(entry) $(2), $(entry)))
132
dcashman704741a2014-07-25 19:11:52 -0700133sepolicy_build_files := security_classes \
134 initial_sids \
135 access_vectors \
136 global_macros \
Nick Kralevicha17a2662014-11-05 15:30:41 -0800137 neverallow_macros \
dcashman704741a2014-07-25 19:11:52 -0700138 mls_macros \
dcashman2e00e632016-10-12 14:58:09 -0700139 mls_decl \
dcashman704741a2014-07-25 19:11:52 -0700140 mls \
141 policy_capabilities \
142 te_macros \
143 attributes \
Jeff Vander Stoepcbaa2b72015-12-22 10:39:34 -0800144 ioctl_defines \
Jeff Vander Stoepde9b5302015-06-05 15:28:55 -0700145 ioctl_macros \
dcashman704741a2014-07-25 19:11:52 -0700146 *.te \
dcashman2e00e632016-10-12 14:58:09 -0700147 roles_decl \
dcashman704741a2014-07-25 19:11:52 -0700148 roles \
149 users \
150 initial_sid_contexts \
151 fs_use \
152 genfs_contexts \
153 port_contexts
154
Alex Klyubin7cda44f2017-03-21 14:28:53 -0700155# CIL files which contain workarounds for current limitation of human-readable
156# module policy language. These files are appended to the CIL files produced
157# from module language files.
158sepolicy_build_cil_workaround_files := technical_debt.cil
159
Dan Cashman1c040272016-12-15 15:28:44 -0800160my_target_arch := $(TARGET_ARCH)
161ifneq (,$(filter mips mips64,$(TARGET_ARCH)))
162 my_target_arch := mips
163endif
164
Jeff Vander Stoepd2053bd2017-03-15 13:37:35 -0700165intermediates := $(TARGET_OUT_INTERMEDIATES)/ETC/sepolicy_intermediates
166
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700167with_asan := false
168ifneq (,$(filter address,$(SANITIZE_TARGET)))
169 with_asan := true
170endif
171
Jeff Vander Stoep3ca843a2017-10-04 09:42:29 -0700172# Library extension for host-side tests
Jeff Vander Stoepe06e4c12017-10-04 18:15:44 -0700173ifeq ($(HOST_OS),darwin)
Jeff Vander Stoep3ca843a2017-10-04 09:42:29 -0700174SHAREDLIB_EXT=dylib
175else
176SHAREDLIB_EXT=so
177endif
178
Anton Hansson8cfe1e62018-07-02 14:31:29 +0100179#################################
180
Dan Cashman4f9a6482017-04-10 12:27:18 -0700181include $(CLEAR_VARS)
Anton Hansson8cfe1e62018-07-02 14:31:29 +0100182
Dan Cashman4f9a6482017-04-10 12:27:18 -0700183LOCAL_MODULE := selinux_policy
184LOCAL_MODULE_TAGS := optional
Tri Vo1f4a28b2018-05-08 18:52:11 -0700185LOCAL_REQUIRED_MODULES += \
Anton Hansson8cfe1e62018-07-02 14:31:29 +0100186 selinux_policy_nonsystem \
187 selinux_policy_system \
Tri Vo1f4a28b2018-05-08 18:52:11 -0700188
Anton Hansson8cfe1e62018-07-02 14:31:29 +0100189include $(BUILD_PHONY_PACKAGE)
Tri Vo1f4a28b2018-05-08 18:52:11 -0700190
Tri Vo1f4a28b2018-05-08 18:52:11 -0700191
Anton Hansson8cfe1e62018-07-02 14:31:29 +0100192include $(CLEAR_VARS)
193LOCAL_MODULE := selinux_policy_system
Tri Vo1f4a28b2018-05-08 18:52:11 -0700194# These build targets are not used on non-Treble devices. However, we build these to avoid
195# divergence between Treble and non-Treble devices.
Dan Cashman4f9a6482017-04-10 12:27:18 -0700196LOCAL_REQUIRED_MODULES += \
197 $(platform_mapping_file) \
Yifan Hong617e8532018-02-07 11:13:57 -0800198 $(addsuffix .cil,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS)) \
Dan Cashman4f9a6482017-04-10 12:27:18 -0700199 plat_sepolicy.cil \
200 plat_and_mapping_sepolicy.cil.sha256 \
201 secilc \
Dan Cashman91d398d2017-09-26 12:58:29 -0700202
Jeff Vander Stoep7a68c5a2017-06-08 13:24:15 -0700203LOCAL_REQUIRED_MODULES += \
Bowgo Tsai741a70a2018-02-05 17:41:02 +0800204 build_sepolicy \
Jeff Vander Stoep13fb5ed2017-08-22 13:29:53 -0700205 plat_file_contexts \
206 plat_mac_permissions.xml \
207 plat_property_contexts \
208 plat_seapp_contexts \
209 plat_service_contexts \
210 plat_hwservice_contexts \
Dan Cashman91d398d2017-09-26 12:58:29 -0700211 searchpolicy \
Anton Hansson8cfe1e62018-07-02 14:31:29 +0100212
213# This conditional inclusion closely mimics the conditional logic
214# inside init/init.cpp for loading SELinux policy from files.
215ifneq ($(PRODUCT_SEPOLICY_SPLIT),true)
216# The following files are only allowed for non-Treble devices.
217LOCAL_REQUIRED_MODULES += \
218 sepolicy \
219 vendor_service_contexts \
220
221endif # ($(PRODUCT_SEPOLICY_SPLIT),true)
Jeff Vander Stoep7a68c5a2017-06-08 13:24:15 -0700222
Dan Cashman91d398d2017-09-26 12:58:29 -0700223ifneq ($(TARGET_BUILD_VARIANT), user)
224LOCAL_REQUIRED_MODULES += \
225 selinux_denial_metadata \
226
227endif
228
229ifneq ($(with_asan),true)
Jeff Vander Stoep3d4965b2018-02-13 20:29:55 -0800230ifneq ($(SELINUX_IGNORE_NEVERALLOWS),true)
Dan Cashman91d398d2017-09-26 12:58:29 -0700231LOCAL_REQUIRED_MODULES += \
232 sepolicy_tests \
Jae Shin1fa96342018-07-11 18:30:44 +0900233 $(addprefix treble_sepolicy_tests_,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS)) \
Dan Cashman91d398d2017-09-26 12:58:29 -0700234
235endif
Jeff Vander Stoep3d4965b2018-02-13 20:29:55 -0800236endif
Dan Cashman91d398d2017-09-26 12:58:29 -0700237
Anton Hansson8cfe1e62018-07-02 14:31:29 +0100238ifneq ($(PLATFORM_SEPOLICY_VERSION),$(TOT_SEPOLICY_VERSION))
239LOCAL_REQUIRED_MODULES += \
240 sepolicy_freeze_test \
241
242endif # ($(PLATFORM_SEPOLICY_VERSION),$(TOT_SEPOLICY_VERSION))
243
244include $(BUILD_PHONY_PACKAGE)
245
246#################################
247
248include $(CLEAR_VARS)
249
250LOCAL_MODULE := selinux_policy_nonsystem
251# Include precompiled policy, unless told otherwise.
252ifneq ($(PRODUCT_PRECOMPILED_SEPOLICY),false)
253LOCAL_REQUIRED_MODULES += \
254 precompiled_sepolicy \
255 precompiled_sepolicy.plat_and_mapping.sha256 \
Anton Hansson8cfe1e62018-07-02 14:31:29 +0100256
257endif # ($(PRODUCT_PRECOMPILED_SEPOLICY),false)
258
259
260# These build targets are not used on non-Treble devices. However, we build these to avoid
261# divergence between Treble and non-Treble devices.
262LOCAL_REQUIRED_MODULES += \
263 plat_pub_versioned.cil \
264 vendor_sepolicy.cil \
265 plat_sepolicy_vers.txt \
266
267LOCAL_REQUIRED_MODULES += \
268 vendor_file_contexts \
269 vendor_mac_permissions.xml \
270 vendor_property_contexts \
271 vendor_seapp_contexts \
272 vendor_hwservice_contexts \
273 vndservice_contexts \
274
Bowgo Tsai45457e32017-11-27 11:41:33 +0800275ifdef BOARD_ODM_SEPOLICY_DIRS
Bowgo Tsaibae15172017-11-29 16:14:53 +0800276LOCAL_REQUIRED_MODULES += \
277 odm_sepolicy.cil \
Bowgo Tsaiecf656b2017-11-29 16:15:28 +0800278 odm_file_contexts \
Bowgo Tsai1f717b12017-11-29 16:15:55 +0800279 odm_seapp_contexts \
Bowgo Tsaiad6231f2017-11-29 16:16:26 +0800280 odm_property_contexts \
Bowgo Tsaiaf7d85f2017-11-29 16:06:15 +0800281 odm_hwservice_contexts \
282 odm_mac_permissions.xml
Bowgo Tsai45457e32017-11-27 11:41:33 +0800283endif
Tri Vo75887dd2018-12-14 14:30:56 -0800284
285ifdef HAS_PRODUCT_SEPOLICY
286LOCAL_REQUIRED_MODULES += \
287 product_sepolicy.cil \
Tri Vo3361ec42018-12-18 19:51:19 -0800288 product_file_contexts \
Tri Voade74162018-12-20 16:13:10 -0800289 product_hwservice_contexts \
Tri Vo75887dd2018-12-14 14:30:56 -0800290
291endif
Dan Cashman4f9a6482017-04-10 12:27:18 -0700292include $(BUILD_PHONY_PACKAGE)
293
Joel Galenson5988b562018-01-03 16:53:24 -0800294#################################
295include $(CLEAR_VARS)
296
297LOCAL_MODULE := sepolicy_neverallows
298LOCAL_MODULE_CLASS := ETC
299LOCAL_MODULE_TAGS := optional
300LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
301
302include $(BUILD_SYSTEM)/base_rules.mk
303
304# sepolicy_policy.conf - All of the policy for the device. This is only used to
305# check neverallow rules.
306sepolicy_policy.conf := $(intermediates)/policy.conf
307$(sepolicy_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
308$(sepolicy_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Joel Galenson8c72eea2018-03-07 15:36:29 -0800309$(sepolicy_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := user
Joel Galenson5988b562018-01-03 16:53:24 -0800310$(sepolicy_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
311$(sepolicy_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
312$(sepolicy_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
313$(sepolicy_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
314$(sepolicy_policy.conf): $(call build_policy, $(sepolicy_build_files), \
Tri Vo5dbaa242018-12-13 13:36:10 -0800315$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) $(PLAT_VENDOR_POLICY) \
Tri Vo75887dd2018-12-14 14:30:56 -0800316$(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY) \
Tri Vo5dbaa242018-12-13 13:36:10 -0800317$(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_ODM_SEPOLICY_DIRS))
Joel Galenson5988b562018-01-03 16:53:24 -0800318 $(transform-policy-to-conf)
huangyanjun25095722018-09-13 14:04:19 +0800319 $(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
Joel Galenson5988b562018-01-03 16:53:24 -0800320
Nick Kralevich94c88932018-11-27 13:45:47 -0800321# sepolicy_policy_2.conf - All of the policy for the device. This is only used to
322# check neverallow rules using sepolicy-analyze, similar to CTS.
323sepolicy_policy_2.conf := $(intermediates)/policy_2.conf
324$(sepolicy_policy_2.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
325$(sepolicy_policy_2.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
326$(sepolicy_policy_2.conf): PRIVATE_TARGET_BUILD_VARIANT := user
327$(sepolicy_policy_2.conf): PRIVATE_EXCLUDE_BUILD_TEST := true
328$(sepolicy_policy_2.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
329$(sepolicy_policy_2.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
330$(sepolicy_policy_2.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
331$(sepolicy_policy_2.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
332$(sepolicy_policy_2.conf): $(call build_policy, $(sepolicy_build_files), \
Tri Vo5dbaa242018-12-13 13:36:10 -0800333$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) $(PLAT_VENDOR_POLICY) \
Tri Vo75887dd2018-12-14 14:30:56 -0800334$(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY) \
Tri Vo5dbaa242018-12-13 13:36:10 -0800335$(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_ODM_SEPOLICY_DIRS))
Nick Kralevich94c88932018-11-27 13:45:47 -0800336 $(transform-policy-to-conf)
337 $(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
338
339$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY_1 := $(sepolicy_policy.conf)
340$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY_2 := $(sepolicy_policy_2.conf)
341$(LOCAL_BUILT_MODULE): $(sepolicy_policy.conf) $(sepolicy_policy_2.conf) \
342 $(HOST_OUT_EXECUTABLES)/checkpolicy $(HOST_OUT_EXECUTABLES)/sepolicy-analyze
Joel Galenson5988b562018-01-03 16:53:24 -0800343ifneq ($(SELINUX_IGNORE_NEVERALLOWS),true)
344 $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c \
Nick Kralevich94c88932018-11-27 13:45:47 -0800345 $(POLICYVERS) -o $@.tmp $(PRIVATE_SEPOLICY_1)
346 $(hide) $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $@.tmp neverallow -w -f $(PRIVATE_SEPOLICY_2) || \
347 ( echo "" 1>&2; \
348 echo "sepolicy-analyze failed. This is most likely due to the use" 1>&2; \
349 echo "of an expanded attribute in a neverallow assertion. Please fix" 1>&2; \
350 echo "the policy." 1>&2; \
351 exit 1 )
Joel Galenson5988b562018-01-03 16:53:24 -0800352endif # ($(SELINUX_IGNORE_NEVERALLOWS),true)
Nick Kralevich94c88932018-11-27 13:45:47 -0800353 $(hide) touch $@.tmp
354 $(hide) mv $@.tmp $@
Joel Galenson5988b562018-01-03 16:53:24 -0800355
356sepolicy_policy.conf :=
Nick Kralevich94c88932018-11-27 13:45:47 -0800357sepolicy_policy_2.conf :=
Joel Galenson5988b562018-01-03 16:53:24 -0800358built_sepolicy_neverallows := $(LOCAL_BUILT_MODULE)
359
Ying Wang02fb5f32012-01-17 17:51:09 -0800360##################################
dcashman2e00e632016-10-12 14:58:09 -0700361# reqd_policy_mask - a policy.conf file which contains only the bare minimum
362# policy necessary to use checkpolicy. This bare-minimum policy needs to be
363# present in all policy.conf files, but should not necessarily be exported as
364# part of the public policy. The rules generated by reqd_policy_mask will allow
365# the compilation of public policy and subsequent removal of CIL policy that
366# should not be exported.
367
368reqd_policy_mask.conf := $(intermediates)/reqd_policy_mask.conf
369$(reqd_policy_mask.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
370$(reqd_policy_mask.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Joel Galenson8c72eea2018-03-07 15:36:29 -0800371$(reqd_policy_mask.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
Dan Cashman1c040272016-12-15 15:28:44 -0800372$(reqd_policy_mask.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700373$(reqd_policy_mask.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
dcashman2e00e632016-10-12 14:58:09 -0700374$(reqd_policy_mask.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Steven Moreland763697d2017-11-09 11:24:56 -0800375$(reqd_policy_mask.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
Jaekyun Seoke4971452017-10-19 16:54:49 +0900376$(reqd_policy_mask.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
dcashman2e00e632016-10-12 14:58:09 -0700377$(reqd_policy_mask.conf): $(call build_policy, $(sepolicy_build_files), $(REQD_MASK_POLICY))
Dan Cashman36ee91d2017-07-07 14:59:51 -0700378 $(transform-policy-to-conf)
Andreas Gampe3ddc78b2017-04-27 17:16:13 -0700379# b/37755687
380CHECKPOLICY_ASAN_OPTIONS := ASAN_OPTIONS=detect_leaks=0
381
dcashman2e00e632016-10-12 14:58:09 -0700382reqd_policy_mask.cil := $(intermediates)/reqd_policy_mask.cil
383$(reqd_policy_mask.cil): $(reqd_policy_mask.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy
384 @mkdir -p $(dir $@)
Andreas Gampe3ddc78b2017-04-27 17:16:13 -0700385 $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -C -M -c \
386 $(POLICYVERS) -o $@ $<
dcashman2e00e632016-10-12 14:58:09 -0700387
dcashman1faa6442016-11-28 07:20:28 -0800388reqd_policy_mask.conf :=
389
390##################################
dcashman2e00e632016-10-12 14:58:09 -0700391# plat_pub_policy - policy that will be exported to be a part of non-platform
392# policy corresponding to this platform version. This is a limited subset of
393# policy that would not compile in checkpolicy on its own. To get around this
394# limitation, add only the required files from private policy, which will
395# generate CIL policy that will then be filtered out by the reqd_policy_mask.
396plat_pub_policy.conf := $(intermediates)/plat_pub_policy.conf
397$(plat_pub_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
398$(plat_pub_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Joel Galenson8c72eea2018-03-07 15:36:29 -0800399$(plat_pub_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
Dan Cashman1c040272016-12-15 15:28:44 -0800400$(plat_pub_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700401$(plat_pub_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
dcashman2e00e632016-10-12 14:58:09 -0700402$(plat_pub_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Steven Moreland763697d2017-11-09 11:24:56 -0800403$(plat_pub_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
Jaekyun Seoke4971452017-10-19 16:54:49 +0900404$(plat_pub_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
dcashman2e00e632016-10-12 14:58:09 -0700405$(plat_pub_policy.conf): $(call build_policy, $(sepolicy_build_files), \
Tri Vo75887dd2018-12-14 14:30:56 -0800406$(PLAT_PUBLIC_POLICY) $(PRODUCT_PUBLIC_POLICY) $(REQD_MASK_POLICY))
Dan Cashman36ee91d2017-07-07 14:59:51 -0700407 $(transform-policy-to-conf)
dcashman2e00e632016-10-12 14:58:09 -0700408plat_pub_policy.cil := $(intermediates)/plat_pub_policy.cil
dcashman1faa6442016-11-28 07:20:28 -0800409$(plat_pub_policy.cil): PRIVATE_POL_CONF := $(plat_pub_policy.conf)
410$(plat_pub_policy.cil): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil)
Tri Vod57789f2018-12-17 16:35:41 -0800411$(plat_pub_policy.cil): $(HOST_OUT_EXECUTABLES)/checkpolicy \
412$(HOST_OUT_EXECUTABLES)/build_sepolicy $(plat_pub_policy.conf) $(reqd_policy_mask.cil)
dcashman2e00e632016-10-12 14:58:09 -0700413 @mkdir -p $(dir $@)
Tri Vod57789f2018-12-17 16:35:41 -0800414 $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $< -C -M -c $(POLICYVERS) -o $@ $(PRIVATE_POL_CONF)
415 $(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) filter_out \
416 -f $(PRIVATE_REQD_MASK) -t $@
dcashman2e00e632016-10-12 14:58:09 -0700417
dcashman1faa6442016-11-28 07:20:28 -0800418plat_pub_policy.conf :=
Dan Cashman1c040272016-12-15 15:28:44 -0800419
dcashman1faa6442016-11-28 07:20:28 -0800420##################################
421include $(CLEAR_VARS)
422
423LOCAL_MODULE := sectxfile_nl
424LOCAL_MODULE_CLASS := ETC
425LOCAL_MODULE_TAGS := optional
426
427# Create a file containing newline only to add between context config files
428include $(BUILD_SYSTEM)/base_rules.mk
429$(LOCAL_BUILT_MODULE):
dcashman2e00e632016-10-12 14:58:09 -0700430 @mkdir -p $(dir $@)
dcashman1faa6442016-11-28 07:20:28 -0800431 $(hide) echo > $@
432
433built_nl := $(LOCAL_BUILT_MODULE)
434
435#################################
436include $(CLEAR_VARS)
437
438LOCAL_MODULE := plat_sepolicy.cil
439LOCAL_MODULE_CLASS := ETC
440LOCAL_MODULE_TAGS := optional
Alex Klyubin052b0bb2017-03-02 12:39:25 -0800441LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
dcashman1faa6442016-11-28 07:20:28 -0800442
443include $(BUILD_SYSTEM)/base_rules.mk
dcashman2e00e632016-10-12 14:58:09 -0700444
445# plat_policy.conf - A combination of the private and public platform policy
446# which will ship with the device. The platform will always reflect the most
447# recent platform version and is not currently being attributized.
448plat_policy.conf := $(intermediates)/plat_policy.conf
449$(plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
450$(plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Joel Galenson8c72eea2018-03-07 15:36:29 -0800451$(plat_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
Dan Cashman1c040272016-12-15 15:28:44 -0800452$(plat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700453$(plat_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
dcashman2e00e632016-10-12 14:58:09 -0700454$(plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Steven Moreland763697d2017-11-09 11:24:56 -0800455$(plat_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
Jaekyun Seoke4971452017-10-19 16:54:49 +0900456$(plat_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
dcashman2e00e632016-10-12 14:58:09 -0700457$(plat_policy.conf): $(call build_policy, $(sepolicy_build_files), \
dcashmancc39f632016-07-22 13:13:11 -0700458$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY))
Dan Cashman36ee91d2017-07-07 14:59:51 -0700459 $(transform-policy-to-conf)
huangyanjun25095722018-09-13 14:04:19 +0800460 $(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
dcashmancc39f632016-07-22 13:13:11 -0700461
Jeff Vander Stoepb8787692017-04-21 15:57:07 -0700462$(LOCAL_BUILT_MODULE): PRIVATE_ADDITIONAL_CIL_FILES := \
Alex Klyubin7cda44f2017-03-21 14:28:53 -0700463 $(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY))
Joel Galenson5988b562018-01-03 16:53:24 -0800464$(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
Jeff Vander Stoepb8787692017-04-21 15:57:07 -0700465$(LOCAL_BUILT_MODULE): $(plat_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
466 $(HOST_OUT_EXECUTABLES)/secilc \
Joel Galenson5988b562018-01-03 16:53:24 -0800467 $(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY)) \
468 $(built_sepolicy_neverallows)
dcashman2e00e632016-10-12 14:58:09 -0700469 @mkdir -p $(dir $@)
Andreas Gampe3ddc78b2017-04-27 17:16:13 -0700470 $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \
Nick Kralevich6b2a4ae2018-11-26 14:29:06 -0800471 $(POLICYVERS) -o $@.tmp $<
472 $(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@.tmp
473 $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $@.tmp -o /dev/null -f /dev/null
474 $(hide) mv $@.tmp $@
dcashman1faa6442016-11-28 07:20:28 -0800475
Alex Klyubin8f7173b2017-02-25 14:47:53 -0800476built_plat_cil := $(LOCAL_BUILT_MODULE)
dcashman1faa6442016-11-28 07:20:28 -0800477plat_policy.conf :=
478
479#################################
480include $(CLEAR_VARS)
481
Tri Vo75887dd2018-12-14 14:30:56 -0800482ifdef HAS_PRODUCT_SEPOLICY
483LOCAL_MODULE := product_sepolicy.cil
484LOCAL_MODULE_CLASS := ETC
485LOCAL_MODULE_TAGS := optional
486LOCAL_MODULE_PATH := $(TARGET_OUT_PRODUCT)/etc/selinux
487
488include $(BUILD_SYSTEM)/base_rules.mk
489
490# product_policy.conf - A combination of the private and public product policy
491# which will ship with the device. Product policy is not attributized.
492product_policy.conf := $(intermediates)/product_policy.conf
493$(product_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
494$(product_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
495$(product_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
496$(product_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
497$(product_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
498$(product_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
499$(product_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
500$(product_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
501$(product_policy.conf): $(call build_policy, $(sepolicy_build_files), \
502$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) \
503$(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY))
504 $(transform-policy-to-conf)
505 $(hide) sed '/dontaudit/d' $@ > $@.dontaudit
506
507$(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
508$(LOCAL_BUILT_MODULE): PRIVATE_PLAT_CIL := $(built_plat_cil)
509$(LOCAL_BUILT_MODULE): $(product_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
510$(HOST_OUT_EXECUTABLES)/build_sepolicy $(HOST_OUT_EXECUTABLES)/secilc $(built_plat_cil)
511 @mkdir -p $(dir $@)
512 $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \
513 $(POLICYVERS) -o $@ $<
514 $(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) filter_out \
515 -f $(PRIVATE_PLAT_CIL) -t $@
516 # Line markers (denoted by ;;) are malformed after above cmd. They are only
517 # used for debugging, so we remove them.
Tri Voebf3eac2018-12-19 12:22:05 -0800518 $(hide) grep -v ';;' $@ > $@.tmp
519 $(hide) mv $@.tmp $@
Tri Vo75887dd2018-12-14 14:30:56 -0800520 # Combine plat_sepolicy.cil and product_sepolicy.cil to make sure that the
521 # latter doesn't accidentally depend on vendor/odm policies.
522 $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) \
523 $(PRIVATE_NEVERALLOW_ARG) $(PRIVATE_PLAT_CIL) $@ -o /dev/null -f /dev/null
524
525
526built_product_cil := $(LOCAL_BUILT_MODULE)
527product_policy.conf :=
528endif # ifdef HAS_PRODUCT_SEPOLICY
529
530#################################
531include $(CLEAR_VARS)
532
Dan Cashman4f9a6482017-04-10 12:27:18 -0700533LOCAL_MODULE := plat_sepolicy_vers.txt
dcashman1faa6442016-11-28 07:20:28 -0800534LOCAL_MODULE_CLASS := ETC
535LOCAL_MODULE_TAGS := optional
Dan Cashman4f9a6482017-04-10 12:27:18 -0700536LOCAL_PROPRIETARY_MODULE := true
537LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
538
539include $(BUILD_SYSTEM)/base_rules.mk
540
541$(LOCAL_BUILT_MODULE) : PRIVATE_PLAT_SEPOL_VERS := $(BOARD_SEPOLICY_VERS)
542$(LOCAL_BUILT_MODULE) :
543 mkdir -p $(dir $@)
544 echo $(PRIVATE_PLAT_SEPOL_VERS) > $@
545
546#################################
547include $(CLEAR_VARS)
548
549LOCAL_MODULE := $(platform_mapping_file)
550LOCAL_MODULE_CLASS := ETC
551LOCAL_MODULE_TAGS := optional
552LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux/mapping
dcashman1faa6442016-11-28 07:20:28 -0800553
554include $(BUILD_SYSTEM)/base_rules.mk
555
Dan Cashman1b0a71f2017-05-08 14:26:52 -0700556current_mapping.cil := $(intermediates)/mapping/$(PLATFORM_SEPOLICY_VERSION).cil
557ifeq ($(BOARD_SEPOLICY_VERS), $(PLATFORM_SEPOLICY_VERSION))
dcashman1faa6442016-11-28 07:20:28 -0800558# auto-generate the mapping file for current platform policy, since it needs to
559# track platform policy development
Dan Cashman6f14f6b2017-04-07 16:36:23 -0700560$(current_mapping.cil) : PRIVATE_VERS := $(PLATFORM_SEPOLICY_VERSION)
dcashman1faa6442016-11-28 07:20:28 -0800561$(current_mapping.cil) : $(plat_pub_policy.cil) $(HOST_OUT_EXECUTABLES)/version_policy
562 @mkdir -p $(dir $@)
563 $(hide) $(HOST_OUT_EXECUTABLES)/version_policy -b $< -m -n $(PRIVATE_VERS) -o $@
564
Dan Cashman1b0a71f2017-05-08 14:26:52 -0700565else # ifeq ($(BOARD_SEPOLICY_VERS), $(PLATFORM_SEPOLICY_VERSION))
Tri Vo75887dd2018-12-14 14:30:56 -0800566# TODO(b/119305624): Move product-specific sepolicy out of mapping files.
Tri Vobbb8f5b2018-03-20 18:06:37 -0700567prebuilt_mapping_files := $(wildcard \
Tri Vo75887dd2018-12-14 14:30:56 -0800568 $(addsuffix /compat/$(BOARD_SEPOLICY_VERS)/$(BOARD_SEPOLICY_VERS).cil, \
569 $(PLAT_PRIVATE_POLICY) $(PRODUCT_PRIVATE_POLICY)))
Dan Cashman1b0a71f2017-05-08 14:26:52 -0700570$(current_mapping.cil) : $(prebuilt_mapping_files)
571 @mkdir -p $(dir $@)
572 cat $^ > $@
Sandeep Patil42f95982017-04-07 14:18:48 -0700573
Dan Cashman1b0a71f2017-05-08 14:26:52 -0700574prebuilt_mapping_files :=
dcashman1faa6442016-11-28 07:20:28 -0800575endif
576
Dan Cashman1b0a71f2017-05-08 14:26:52 -0700577$(LOCAL_BUILT_MODULE): $(current_mapping.cil) $(ACP)
Jeff Vander Stoepb8787692017-04-21 15:57:07 -0700578 $(hide) $(ACP) $< $@
dcashman1faa6442016-11-28 07:20:28 -0800579
Alex Klyubin8f7173b2017-02-25 14:47:53 -0800580built_mapping_cil := $(LOCAL_BUILT_MODULE)
dcashman1faa6442016-11-28 07:20:28 -0800581current_mapping.cil :=
582
583#################################
584include $(CLEAR_VARS)
585
Dan Cashman0e9c47c2017-04-04 14:27:41 -0700586LOCAL_MODULE := plat_and_mapping_sepolicy.cil.sha256
587LOCAL_MODULE_CLASS := ETC
588LOCAL_MODULE_TAGS := optional
589LOCAL_MODULE_PATH = $(TARGET_OUT)/etc/selinux
590
591include $(BUILD_SYSTEM)/base_rules.mk
592
Tri Vo75887dd2018-12-14 14:30:56 -0800593$(LOCAL_BUILT_MODULE): $(built_plat_cil) $(built_mapping_cil) $(built_product_cil)
Dan Cashman0e9c47c2017-04-04 14:27:41 -0700594 cat $^ | sha256sum | cut -d' ' -f1 > $@
595
596#################################
597include $(CLEAR_VARS)
598
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800599# plat_pub_versioned.cil - the exported platform policy associated with the version
600# that non-platform policy targets.
601LOCAL_MODULE := plat_pub_versioned.cil
dcashman1faa6442016-11-28 07:20:28 -0800602LOCAL_MODULE_CLASS := ETC
603LOCAL_MODULE_TAGS := optional
Alex Klyubin052b0bb2017-03-02 12:39:25 -0800604LOCAL_PROPRIETARY_MODULE := true
605LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
dcashman1faa6442016-11-28 07:20:28 -0800606
607include $(BUILD_SYSTEM)/base_rules.mk
608
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800609$(LOCAL_BUILT_MODULE) : PRIVATE_VERS := $(BOARD_SEPOLICY_VERS)
610$(LOCAL_BUILT_MODULE) : PRIVATE_TGT_POL := $(plat_pub_policy.cil)
611$(LOCAL_BUILT_MODULE) : PRIVATE_DEP_CIL_FILES := $(built_plat_cil) $(built_mapping_cil)
612$(LOCAL_BUILT_MODULE) : $(plat_pub_policy.cil) $(HOST_OUT_EXECUTABLES)/version_policy \
613 $(HOST_OUT_EXECUTABLES)/secilc $(built_plat_cil) $(built_mapping_cil)
614 @mkdir -p $(dir $@)
615 $(HOST_OUT_EXECUTABLES)/version_policy -b $< -t $(PRIVATE_TGT_POL) -n $(PRIVATE_VERS) -o $@
616 $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -N -c $(POLICYVERS) \
617 $(PRIVATE_DEP_CIL_FILES) $@ -o /dev/null -f /dev/null
618
619built_plat_pub_vers_cil := $(LOCAL_BUILT_MODULE)
620
621#################################
622include $(CLEAR_VARS)
623
624# vendor_policy.cil - the vendor sepolicy. This needs attributization and to be combined
625# with the platform-provided policy. It makes use of the reqd_policy_mask files from private
626# policy and the platform public policy files in order to use checkpolicy.
627LOCAL_MODULE := vendor_sepolicy.cil
628LOCAL_MODULE_CLASS := ETC
629LOCAL_MODULE_TAGS := optional
630LOCAL_PROPRIETARY_MODULE := true
631LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
632
633include $(BUILD_SYSTEM)/base_rules.mk
634
635vendor_policy.conf := $(intermediates)/vendor_policy.conf
636$(vendor_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
637$(vendor_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Joel Galenson8c72eea2018-03-07 15:36:29 -0800638$(vendor_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800639$(vendor_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
640$(vendor_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
641$(vendor_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
642$(vendor_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
643$(vendor_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
644$(vendor_policy.conf): $(call build_policy, $(sepolicy_build_files), \
Tri Vo75887dd2018-12-14 14:30:56 -0800645$(PLAT_PUBLIC_POLICY) $(PRODUCT_PUBLIC_POLICY) $(REQD_MASK_POLICY) $(PLAT_VENDOR_POLICY) \
646$(BOARD_VENDOR_SEPOLICY_DIRS))
Dan Cashman36ee91d2017-07-07 14:59:51 -0700647 $(transform-policy-to-conf)
huangyanjun25095722018-09-13 14:04:19 +0800648 $(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
Stephen Smalley2dd4e512012-01-04 12:33:27 -0500649
Bowgo Tsai741a70a2018-02-05 17:41:02 +0800650$(LOCAL_BUILT_MODULE): PRIVATE_POL_CONF := $(vendor_policy.conf)
651$(LOCAL_BUILT_MODULE): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil)
652$(LOCAL_BUILT_MODULE): PRIVATE_BASE_CIL := $(plat_pub_policy.cil)
653$(LOCAL_BUILT_MODULE): PRIVATE_VERS := $(BOARD_SEPOLICY_VERS)
654$(LOCAL_BUILT_MODULE): PRIVATE_DEP_CIL_FILES := $(built_plat_cil) $(built_plat_pub_vers_cil) $(built_mapping_cil)
655$(LOCAL_BUILT_MODULE): PRIVATE_FILTER_CIL := $(built_plat_pub_vers_cil)
656$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/build_sepolicy \
657 $(vendor_policy.conf) $(reqd_policy_mask.cil) $(plat_pub_policy.cil) \
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800658 $(built_plat_cil) $(built_plat_pub_vers_cil) $(built_mapping_cil)
dcashman2e00e632016-10-12 14:58:09 -0700659 @mkdir -p $(dir $@)
Bowgo Tsai741a70a2018-02-05 17:41:02 +0800660 $(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) build_cil \
661 -i $(PRIVATE_POL_CONF) -m $(PRIVATE_REQD_MASK) -c $(CHECKPOLICY_ASAN_OPTIONS) \
662 -b $(PRIVATE_BASE_CIL) -d $(PRIVATE_DEP_CIL_FILES) -f $(PRIVATE_FILTER_CIL) \
663 -t $(PRIVATE_VERS) -p $(POLICYVERS) -o $@
dcashman2e00e632016-10-12 14:58:09 -0700664
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800665built_vendor_cil := $(LOCAL_BUILT_MODULE)
666vendor_policy.conf :=
dcashman1faa6442016-11-28 07:20:28 -0800667
668#################################
669include $(CLEAR_VARS)
Alex Klyubin193dccd2017-03-07 14:05:57 -0800670
Nick Kralevich1b2ea492018-09-25 11:03:48 -0700671ifdef BOARD_ODM_SEPOLICY_DIRS
Bowgo Tsai45457e32017-11-27 11:41:33 +0800672# odm_policy.cil - the odm sepolicy. This needs attributization and to be combined
673# with the platform-provided policy. It makes use of the reqd_policy_mask files from private
674# policy and the platform public policy files in order to use checkpolicy.
675LOCAL_MODULE := odm_sepolicy.cil
676LOCAL_MODULE_CLASS := ETC
677LOCAL_MODULE_TAGS := optional
678LOCAL_PROPRIETARY_MODULE := true
679LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux
680
681include $(BUILD_SYSTEM)/base_rules.mk
682
683odm_policy.conf := $(intermediates)/odm_policy.conf
684$(odm_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
685$(odm_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
686$(odm_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
687$(odm_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
688$(odm_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
689$(odm_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
690$(odm_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
691$(odm_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
692$(odm_policy.conf): $(call build_policy, $(sepolicy_build_files), \
Tri Vo75887dd2018-12-14 14:30:56 -0800693 $(PLAT_PUBLIC_POLICY) $(PRODUCT_PUBLIC_POLICY) $(REQD_MASK_POLICY) $(PLAT_VENDOR_POLICY) \
Bowgo Tsai45457e32017-11-27 11:41:33 +0800694 $(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_ODM_SEPOLICY_DIRS))
695 $(transform-policy-to-conf)
huangyanjun25095722018-09-13 14:04:19 +0800696 $(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
Bowgo Tsai45457e32017-11-27 11:41:33 +0800697
698$(LOCAL_BUILT_MODULE): PRIVATE_POL_CONF := $(odm_policy.conf)
699$(LOCAL_BUILT_MODULE): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil)
700$(LOCAL_BUILT_MODULE): PRIVATE_BASE_CIL := $(plat_pub_policy.cil)
701$(LOCAL_BUILT_MODULE): PRIVATE_VERS := $(BOARD_SEPOLICY_VERS)
702$(LOCAL_BUILT_MODULE): PRIVATE_DEP_CIL_FILES := $(built_plat_cil) $(built_plat_pub_vers_cil) \
703 $(built_mapping_cil) $(built_vendor_cil)
704$(LOCAL_BUILT_MODULE) : PRIVATE_FILTER_CIL_FILES := $(built_plat_pub_vers_cil) $(built_vendor_cil)
705$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/build_sepolicy \
706 $(odm_policy.conf) $(reqd_policy_mask.cil) $(plat_pub_policy.cil) \
707 $(built_plat_cil) $(built_plat_pub_vers_cil) $(built_mapping_cil) $(built_vendor_cil)
708 @mkdir -p $(dir $@)
709 $(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) build_cil \
710 -i $(PRIVATE_POL_CONF) -m $(PRIVATE_REQD_MASK) -c $(CHECKPOLICY_ASAN_OPTIONS) \
711 -b $(PRIVATE_BASE_CIL) -d $(PRIVATE_DEP_CIL_FILES) -f $(PRIVATE_FILTER_CIL_FILES) \
712 -t $(PRIVATE_VERS) -p $(POLICYVERS) -o $@
713
714built_odm_cil := $(LOCAL_BUILT_MODULE)
715odm_policy.conf :=
716odm_policy_raw :=
Nick Kralevich1b2ea492018-09-25 11:03:48 -0700717endif
Bowgo Tsai45457e32017-11-27 11:41:33 +0800718
719#################################
720include $(CLEAR_VARS)
721
Alex Klyubin193dccd2017-03-07 14:05:57 -0800722LOCAL_MODULE := precompiled_sepolicy
723LOCAL_MODULE_CLASS := ETC
724LOCAL_MODULE_TAGS := optional
725LOCAL_PROPRIETARY_MODULE := true
Bowgo Tsai45457e32017-11-27 11:41:33 +0800726
727ifeq ($(BOARD_USES_ODMIMAGE),true)
728LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux
729else
Alex Klyubin193dccd2017-03-07 14:05:57 -0800730LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
Bowgo Tsai45457e32017-11-27 11:41:33 +0800731endif
Alex Klyubin193dccd2017-03-07 14:05:57 -0800732
733include $(BUILD_SYSTEM)/base_rules.mk
734
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800735all_cil_files := \
736 $(built_plat_cil) \
737 $(built_mapping_cil) \
738 $(built_plat_pub_vers_cil) \
739 $(built_vendor_cil)
740
Tri Vo75887dd2018-12-14 14:30:56 -0800741ifdef HAS_PRODUCT_SEPOLICY
742all_cil_files += $(built_product_cil)
743endif
744
Bowgo Tsai45457e32017-11-27 11:41:33 +0800745ifdef BOARD_ODM_SEPOLICY_DIRS
746all_cil_files += $(built_odm_cil)
747endif
748
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800749$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(all_cil_files)
Joel Galenson5988b562018-01-03 16:53:24 -0800750$(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800751$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(all_cil_files) $(built_sepolicy_neverallows)
Joel Galenson5988b562018-01-03 16:53:24 -0800752 $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) \
Alex Klyubin193dccd2017-03-07 14:05:57 -0800753 $(PRIVATE_CIL_FILES) -o $@ -f /dev/null
754
755built_precompiled_sepolicy := $(LOCAL_BUILT_MODULE)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800756all_cil_files :=
Alex Klyubin193dccd2017-03-07 14:05:57 -0800757
758#################################
Dan Cashman0e9c47c2017-04-04 14:27:41 -0700759# SHA-256 digest of the plat_sepolicy.cil and mapping_sepolicy.cil files against
760# which precompiled_policy was built.
Alex Klyubin193dccd2017-03-07 14:05:57 -0800761#################################
762include $(CLEAR_VARS)
Dan Cashman0e9c47c2017-04-04 14:27:41 -0700763LOCAL_MODULE := precompiled_sepolicy.plat_and_mapping.sha256
Alex Klyubin193dccd2017-03-07 14:05:57 -0800764LOCAL_MODULE_CLASS := ETC
765LOCAL_MODULE_TAGS := optional
766LOCAL_PROPRIETARY_MODULE := true
Bowgo Tsai45457e32017-11-27 11:41:33 +0800767
768ifeq ($(BOARD_USES_ODMIMAGE),true)
769LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux
770else
Alex Klyubin193dccd2017-03-07 14:05:57 -0800771LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
Bowgo Tsai45457e32017-11-27 11:41:33 +0800772endif
Alex Klyubin193dccd2017-03-07 14:05:57 -0800773
774include $(BUILD_SYSTEM)/base_rules.mk
775
Tri Vo75887dd2018-12-14 14:30:56 -0800776$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(built_plat_cil) $(built_mapping_cil) $(built_product_cil)
Dan Cashman0e9c47c2017-04-04 14:27:41 -0700777$(LOCAL_BUILT_MODULE): $(built_precompiled_sepolicy) $(built_plat_cil) $(built_mapping_cil)
778 cat $(PRIVATE_CIL_FILES) | sha256sum | cut -d' ' -f1 > $@
Alex Klyubin193dccd2017-03-07 14:05:57 -0800779
780#################################
781include $(CLEAR_VARS)
Dan Cashman1c040272016-12-15 15:28:44 -0800782# build this target so that we can still perform neverallow checks
dcashman1faa6442016-11-28 07:20:28 -0800783
784LOCAL_MODULE := sepolicy
785LOCAL_MODULE_CLASS := ETC
786LOCAL_MODULE_TAGS := optional
Daniel Cashman65d01342016-12-17 00:53:26 +0000787LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
dcashman2e00e632016-10-12 14:58:09 -0700788
dcashman1faa6442016-11-28 07:20:28 -0800789include $(BUILD_SYSTEM)/base_rules.mk
790
dcashman2e00e632016-10-12 14:58:09 -0700791all_cil_files := \
Jeff Vander Stoepb8787692017-04-21 15:57:07 -0700792 $(built_plat_cil) \
793 $(built_mapping_cil) \
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800794 $(built_plat_pub_vers_cil) \
795 $(built_vendor_cil)
dcashman2e00e632016-10-12 14:58:09 -0700796
Tri Vo75887dd2018-12-14 14:30:56 -0800797ifdef HAS_PRODUCT_SEPOLICY
798all_cil_files += $(built_product_cil)
799endif
800
Bowgo Tsai45457e32017-11-27 11:41:33 +0800801ifdef BOARD_ODM_SEPOLICY_DIRS
802all_cil_files += $(built_odm_cil)
803endif
804
dcashman2e00e632016-10-12 14:58:09 -0700805$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(all_cil_files)
Joel Galenson5988b562018-01-03 16:53:24 -0800806$(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
807$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $(all_cil_files) \
808$(built_sepolicy_neverallows)
dcashman2e00e632016-10-12 14:58:09 -0700809 @mkdir -p $(dir $@)
Joel Galenson5988b562018-01-03 16:53:24 -0800810 $(hide) $< -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $(PRIVATE_CIL_FILES) -o $@.tmp -f /dev/null
Nick Kralevichbca98ef2016-02-26 20:06:52 -0800811 $(hide) $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $@.tmp permissive > $@.permissivedomains
812 $(hide) if [ "$(TARGET_BUILD_VARIANT)" = "user" -a -s $@.permissivedomains ]; then \
813 echo "==========" 1>&2; \
814 echo "ERROR: permissive domains not allowed in user builds" 1>&2; \
815 echo "List of invalid domains:" 1>&2; \
816 cat $@.permissivedomains 1>&2; \
817 exit 1; \
818 fi
819 $(hide) mv $@.tmp $@
Ying Wang02fb5f32012-01-17 17:51:09 -0800820
Ying Wangd8b122c2012-10-25 19:01:31 -0700821built_sepolicy := $(LOCAL_BUILT_MODULE)
dcashman2e00e632016-10-12 14:58:09 -0700822all_cil_files :=
Stephen Smalley01a58af2012-10-02 12:46:37 -0400823
Alex Klyubin84aa7422017-03-10 09:36:07 -0800824#################################
825include $(CLEAR_VARS)
826
827# keep concrete sepolicy for neverallow checks
Joel Galenson5988b562018-01-03 16:53:24 -0800828# If SELINUX_IGNORE_NEVERALLOWS is set, we use sed to remove the neverallow lines before compiling.
Alex Klyubin84aa7422017-03-10 09:36:07 -0800829
830LOCAL_MODULE := sepolicy.recovery
Alex Klyubinec78c372017-03-10 12:44:16 -0800831LOCAL_MODULE_STEM := sepolicy
Alex Klyubin84aa7422017-03-10 09:36:07 -0800832LOCAL_MODULE_CLASS := ETC
833LOCAL_MODULE_TAGS := optional
Alex Klyubinec78c372017-03-10 12:44:16 -0800834LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
Alex Klyubin84aa7422017-03-10 09:36:07 -0800835
836include $(BUILD_SYSTEM)/base_rules.mk
837
Dan Cashmanc8d45352017-04-11 07:38:48 -0700838sepolicy.recovery.conf := $(intermediates)/sepolicy.recovery.conf
839$(sepolicy.recovery.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
840$(sepolicy.recovery.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Joel Galenson8c72eea2018-03-07 15:36:29 -0800841$(sepolicy.recovery.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
Dan Cashmanc8d45352017-04-11 07:38:48 -0700842$(sepolicy.recovery.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
843$(sepolicy.recovery.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
844$(sepolicy.recovery.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Dan Cashman36ee91d2017-07-07 14:59:51 -0700845$(sepolicy.recovery.conf): PRIVATE_TGT_RECOVERY := -D target_recovery=true
Dan Cashmanc8d45352017-04-11 07:38:48 -0700846$(sepolicy.recovery.conf): $(call build_policy, $(sepolicy_build_files), \
847 $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) \
Tri Vo75887dd2018-12-14 14:30:56 -0800848 $(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY) \
Bowgo Tsai45457e32017-11-27 11:41:33 +0800849 $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) \
850 $(BOARD_ODM_SEPOLICY_DIRS))
Dan Cashman36ee91d2017-07-07 14:59:51 -0700851 $(transform-policy-to-conf)
huangyanjun25095722018-09-13 14:04:19 +0800852 $(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
853
Joel Galenson5988b562018-01-03 16:53:24 -0800854ifeq ($(SELINUX_IGNORE_NEVERALLOWS),true)
855 $(hide) sed -z 's/\n\s*neverallow[^;]*;/\n/g' $@ > $@.neverallow
856 $(hide) mv $@.neverallow $@
857endif
Dan Cashman1c040272016-12-15 15:28:44 -0800858
Dan Cashmanc8d45352017-04-11 07:38:48 -0700859$(LOCAL_BUILT_MODULE): $(sepolicy.recovery.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
860 $(HOST_OUT_EXECUTABLES)/sepolicy-analyze
Dan Cashman1c040272016-12-15 15:28:44 -0800861 @mkdir -p $(dir $@)
Andreas Gampe3ddc78b2017-04-27 17:16:13 -0700862 $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c \
863 $(POLICYVERS) -o $@.tmp $<
Nick Kralevichbca98ef2016-02-26 20:06:52 -0800864 $(hide) $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $@.tmp permissive > $@.permissivedomains
865 $(hide) if [ "$(TARGET_BUILD_VARIANT)" = "user" -a -s $@.permissivedomains ]; then \
866 echo "==========" 1>&2; \
867 echo "ERROR: permissive domains not allowed in user builds" 1>&2; \
868 echo "List of invalid domains:" 1>&2; \
869 cat $@.permissivedomains 1>&2; \
870 exit 1; \
871 fi
872 $(hide) mv $@.tmp $@
Stephen Smalleye60723a2014-05-29 16:40:15 -0400873
Dan Cashmanc8d45352017-04-11 07:38:48 -0700874sepolicy.recovery.conf :=
Stephen Smalleye60723a2014-05-29 16:40:15 -0400875
dcashman704741a2014-07-25 19:11:52 -0700876##################################
Alex Klyubin446279a2017-04-06 14:45:50 -0700877# SELinux policy embedded into CTS.
878# CTS checks neverallow rules of this policy against the policy of the device under test.
879##################################
dcashman704741a2014-07-25 19:11:52 -0700880include $(CLEAR_VARS)
881
882LOCAL_MODULE := general_sepolicy.conf
883LOCAL_MODULE_CLASS := ETC
884LOCAL_MODULE_TAGS := tests
885
886include $(BUILD_SYSTEM)/base_rules.mk
887
dcashman704741a2014-07-25 19:11:52 -0700888$(LOCAL_BUILT_MODULE): PRIVATE_MLS_SENS := $(MLS_SENS)
889$(LOCAL_BUILT_MODULE): PRIVATE_MLS_CATS := $(MLS_CATS)
Joel Galenson8c72eea2018-03-07 15:36:29 -0800890$(LOCAL_BUILT_MODULE): PRIVATE_TARGET_BUILD_VARIANT := user
Dan Cashman1c040272016-12-15 15:28:44 -0800891$(LOCAL_BUILT_MODULE): PRIVATE_TGT_ARCH := $(my_target_arch)
Dan Cashman36ee91d2017-07-07 14:59:51 -0700892$(LOCAL_BUILT_MODULE): PRIVATE_WITH_ASAN := false
Steven Moreland763697d2017-11-09 11:24:56 -0800893$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY_SPLIT := cts
Jaekyun Seok64ade652018-01-30 17:23:58 +0900894$(LOCAL_BUILT_MODULE): PRIVATE_COMPATIBLE_PROPERTY := cts
Tri Vo77c44fc2018-06-05 14:11:08 -0700895$(LOCAL_BUILT_MODULE): PRIVATE_EXCLUDE_BUILD_TEST := true
dcashmancc39f632016-07-22 13:13:11 -0700896$(LOCAL_BUILT_MODULE): $(call build_policy, $(sepolicy_build_files), \
897$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY))
Dan Cashman36ee91d2017-07-07 14:59:51 -0700898 $(transform-policy-to-conf)
huangyanjun25095722018-09-13 14:04:19 +0800899 $(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
dcashman704741a2014-07-25 19:11:52 -0700900
William Robertsb8769932015-06-29 16:31:23 -0700901##################################
dcashmand225b692016-12-12 09:29:04 -0800902# TODO - remove this. Keep around until we get the filesystem creation stuff taken care of.
903#
William Robertsb8769932015-06-29 16:31:23 -0700904include $(CLEAR_VARS)
905
Richard Hainesc2d01912015-08-06 17:43:52 +0100906LOCAL_MODULE := file_contexts.bin
Ying Wang02fb5f32012-01-17 17:51:09 -0800907LOCAL_MODULE_CLASS := ETC
908LOCAL_MODULE_TAGS := optional
909LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
910
Stephen Smalley5b340be2012-03-06 11:12:41 -0500911include $(BUILD_SYSTEM)/base_rules.mk
Ying Wang02fb5f32012-01-17 17:51:09 -0800912
William Roberts49693f12016-01-04 12:20:57 -0800913# The file_contexts.bin is built in the following way:
914# 1. Collect all file_contexts files in THIS repository and process them with
915# m4 into a tmp file called file_contexts.local.tmp.
916# 2. Collect all device specific file_contexts files and process them with m4
917# into a tmp file called file_contexts.device.tmp.
918# 3. Run checkfc -e (allow no device fc entries ie empty) and fc_sort on
919# file_contexts.device.tmp and output to file_contexts.device.sorted.tmp.
920# 4. Concatenate file_contexts.local.tmp and file_contexts.device.tmp into
921# file_contexts.concat.tmp.
922# 5. Run checkfc and sefcontext_compile on file_contexts.concat.tmp to produce
923# file_contexts.bin.
924#
925# Note: That a newline file is placed between each file_context file found to
926# ensure a proper build when an fc file is missing an ending newline.
William Roberts29d14682016-01-04 12:20:57 -0800927
Dan Cashman1b0a71f2017-05-08 14:26:52 -0700928local_fc_files := $(call build_policy, file_contexts, $(PLAT_PRIVATE_POLICY))
929
Tri Vo75887dd2018-12-14 14:30:56 -0800930ifdef HAS_PRODUCT_SEPOLICY
931local_fc_files += $(call build_policy, file_contexts, $(PRODUCT_PRIVATE_POLICY))
932endif
933
William Roberts49693f12016-01-04 12:20:57 -0800934ifneq ($(filter address,$(SANITIZE_TARGET)),)
Mark Salyzyn9b398f32018-06-13 08:02:29 -0700935 local_fc_files += $(wildcard $(addsuffix /file_contexts_asan, $(PLAT_PRIVATE_POLICY)))
936endif
937ifneq (,$(filter userdebug eng,$(TARGET_BUILD_VARIANT)))
938 local_fc_files += $(wildcard $(addsuffix /file_contexts_overlayfs, $(PLAT_PRIVATE_POLICY)))
William Roberts49693f12016-01-04 12:20:57 -0800939endif
940local_fcfiles_with_nl := $(call add_nl, $(local_fc_files), $(built_nl))
941
942file_contexts.local.tmp := $(intermediates)/file_contexts.local.tmp
943$(file_contexts.local.tmp): $(local_fcfiles_with_nl)
Stephen Smalley5b340be2012-03-06 11:12:41 -0500944 @mkdir -p $(dir $@)
Nick Kralevich764cbd02018-08-15 09:55:27 -0700945 $(hide) m4 --fatal-warnings -s $^ > $@
William Roberts49693f12016-01-04 12:20:57 -0800946
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800947device_fc_files := $(call build_vendor_policy, file_contexts)
Bowgo Tsaibae15172017-11-29 16:14:53 +0800948
949ifdef BOARD_ODM_SEPOLICY_DIRS
950device_fc_files += $(call build_odm_policy, file_contexts)
951endif
952
William Roberts49693f12016-01-04 12:20:57 -0800953device_fcfiles_with_nl := $(call add_nl, $(device_fc_files), $(built_nl))
954
955file_contexts.device.tmp := $(intermediates)/file_contexts.device.tmp
956$(file_contexts.device.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
957$(file_contexts.device.tmp): $(device_fcfiles_with_nl)
958 @mkdir -p $(dir $@)
Nick Kralevich764cbd02018-08-15 09:55:27 -0700959 $(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@
William Roberts49693f12016-01-04 12:20:57 -0800960
961file_contexts.device.sorted.tmp := $(intermediates)/file_contexts.device.sorted.tmp
962$(file_contexts.device.sorted.tmp): PRIVATE_SEPOLICY := $(built_sepolicy)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800963$(file_contexts.device.sorted.tmp): $(file_contexts.device.tmp) $(built_sepolicy) \
964 $(HOST_OUT_EXECUTABLES)/fc_sort $(HOST_OUT_EXECUTABLES)/checkfc
William Roberts49693f12016-01-04 12:20:57 -0800965 @mkdir -p $(dir $@)
dcashman07791552016-12-07 11:27:47 -0800966 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e $(PRIVATE_SEPOLICY) $<
William Roberts49693f12016-01-04 12:20:57 -0800967 $(hide) $(HOST_OUT_EXECUTABLES)/fc_sort $< $@
968
969file_contexts.concat.tmp := $(intermediates)/file_contexts.concat.tmp
970$(file_contexts.concat.tmp): $(file_contexts.local.tmp) $(file_contexts.device.sorted.tmp)
971 @mkdir -p $(dir $@)
Nick Kralevich764cbd02018-08-15 09:55:27 -0700972 $(hide) m4 --fatal-warnings -s $^ > $@
Stephen Smalley5b340be2012-03-06 11:12:41 -0500973
William Roberts3746a0a2015-09-25 10:18:44 -0700974$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
William Roberts49693f12016-01-04 12:20:57 -0800975$(LOCAL_BUILT_MODULE): $(file_contexts.concat.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/sefcontext_compile $(HOST_OUT_EXECUTABLES)/checkfc
Richard Hainesc2d01912015-08-06 17:43:52 +0100976 @mkdir -p $(dir $@)
dcashman07791552016-12-07 11:27:47 -0800977 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc $(PRIVATE_SEPOLICY) $<
Richard Hainesc2d01912015-08-06 17:43:52 +0100978 $(hide) $(HOST_OUT_EXECUTABLES)/sefcontext_compile -o $@ $<
979
Robert Craig8b7545b2014-03-20 09:35:08 -0400980built_fc := $(LOCAL_BUILT_MODULE)
William Roberts49693f12016-01-04 12:20:57 -0800981local_fc_files :=
982local_fcfiles_with_nl :=
983device_fc_files :=
984device_fcfiles_with_nl :=
985file_contexts.concat.tmp :=
986file_contexts.device.sorted.tmp :=
987file_contexts.device.tmp :=
988file_contexts.local.tmp :=
William Roberts171a0622012-08-16 10:55:05 -0700989
Ying Wang02fb5f32012-01-17 17:51:09 -0800990##################################
Dan Cashman91d398d2017-09-26 12:58:29 -0700991ifneq ($(TARGET_BUILD_VARIANT), user)
992include $(CLEAR_VARS)
993
994LOCAL_MODULE := selinux_denial_metadata
995LOCAL_MODULE_CLASS := ETC
996LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
997
998include $(BUILD_SYSTEM)/base_rules.mk
999
1000bug_files := $(call build_policy, bug_map, $(LOCAL_PATH) $(PLAT_PRIVATE_POLICY) $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(PLAT_PUBLIC_POLICY))
1001
1002$(LOCAL_BUILT_MODULE) : $(bug_files)
1003 @mkdir -p $(dir $@)
1004 cat $^ > $@
1005
1006bug_files :=
1007endif
1008##################################
Ying Wang02fb5f32012-01-17 17:51:09 -08001009include $(CLEAR_VARS)
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -04001010
dcashmand225b692016-12-12 09:29:04 -08001011LOCAL_MODULE := plat_file_contexts
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -04001012LOCAL_MODULE_CLASS := ETC
dcashmand225b692016-12-12 09:29:04 -08001013LOCAL_MODULE_TAGS := optional
Steven Moreland763697d2017-11-09 11:24:56 -08001014ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Jeff Vander Stoep0cb417a2017-03-08 14:12:54 -08001015LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
Jeff Vander Stoep7a68c5a2017-06-08 13:24:15 -07001016else
1017LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
1018endif
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -04001019
1020include $(BUILD_SYSTEM)/base_rules.mk
1021
Tri Voade74162018-12-20 16:13:10 -08001022local_fc_files := $(call build_policy, file_contexts, $(PLAT_PRIVATE_POLICY))
dcashmand225b692016-12-12 09:29:04 -08001023ifneq ($(filter address,$(SANITIZE_TARGET)),)
Dan Cashman1b0a71f2017-05-08 14:26:52 -07001024 local_fc_files += $(wildcard $(addsuffix /file_contexts_asan, $(PLAT_PRIVATE_POLICY)))
dcashmand225b692016-12-12 09:29:04 -08001025endif
Mark Salyzyn9b398f32018-06-13 08:02:29 -07001026ifneq (,$(filter userdebug eng,$(TARGET_BUILD_VARIANT)))
1027 local_fc_files += $(wildcard $(addsuffix /file_contexts_overlayfs, $(PLAT_PRIVATE_POLICY)))
1028endif
Alex Klyubine4665d72017-01-19 19:58:34 -08001029local_fcfiles_with_nl := $(call add_nl, $(local_fc_files), $(built_nl))
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -04001030
Alex Klyubine4665d72017-01-19 19:58:34 -08001031$(LOCAL_BUILT_MODULE): PRIVATE_FC_FILES := $(local_fcfiles_with_nl)
dcashmand225b692016-12-12 09:29:04 -08001032$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Alex Klyubine4665d72017-01-19 19:58:34 -08001033$(LOCAL_BUILT_MODULE): PRIVATE_FC_SORT := $(HOST_OUT_EXECUTABLES)/fc_sort
1034$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/checkfc $(HOST_OUT_EXECUTABLES)/fc_sort \
1035$(local_fcfiles_with_nl) $(built_sepolicy)
Richard Hainesc2d01912015-08-06 17:43:52 +01001036 @mkdir -p $(dir $@)
Nick Kralevich764cbd02018-08-15 09:55:27 -07001037 $(hide) m4 --fatal-warnings -s $(PRIVATE_FC_FILES) > $@.tmp
Alex Klyubine4665d72017-01-19 19:58:34 -08001038 $(hide) $< $(PRIVATE_SEPOLICY) $@.tmp
1039 $(hide) $(PRIVATE_FC_SORT) $@.tmp $@
Richard Hainesc2d01912015-08-06 17:43:52 +01001040
dcashmand225b692016-12-12 09:29:04 -08001041built_plat_fc := $(LOCAL_BUILT_MODULE)
1042local_fc_files :=
Alex Klyubine4665d72017-01-19 19:58:34 -08001043local_fcfiles_with_nl :=
dcashmand225b692016-12-12 09:29:04 -08001044
1045##################################
1046include $(CLEAR_VARS)
1047
Tri Vo3361ec42018-12-18 19:51:19 -08001048LOCAL_MODULE := product_file_contexts
1049LOCAL_MODULE_CLASS := ETC
1050LOCAL_MODULE_TAGS := optional
1051LOCAL_MODULE_PATH := $(TARGET_OUT_PRODUCT)/etc/selinux
1052
1053include $(BUILD_SYSTEM)/base_rules.mk
1054
1055product_fc_files := $(call build_policy, file_contexts, $(PRODUCT_PRIVATE_POLICY))
1056product_fcfiles_with_nl := $(call add_nl, $(product_fc_files), $(built_nl))
1057
1058$(LOCAL_BUILT_MODULE): PRIVATE_FC_FILES := $(product_fcfiles_with_nl)
1059$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
1060$(LOCAL_BUILT_MODULE): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1061$(LOCAL_BUILT_MODULE): PRIVATE_FC_SORT := $(HOST_OUT_EXECUTABLES)/fc_sort
1062$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/checkfc $(HOST_OUT_EXECUTABLES)/fc_sort \
1063$(product_fcfiles_with_nl) $(built_sepolicy)
1064 @mkdir -p $(dir $@)
1065 $(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_FC_FILES) > $@.tmp
1066 $(hide) $< $(PRIVATE_SEPOLICY) $@.tmp
1067 $(hide) $(PRIVATE_FC_SORT) $@.tmp $@
1068
1069built_product_fc := $(LOCAL_BUILT_MODULE)
1070product_fc_files :=
1071product_fcfiles_with_nl :=
1072
1073##################################
1074include $(CLEAR_VARS)
1075
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001076LOCAL_MODULE := vendor_file_contexts
dcashmand225b692016-12-12 09:29:04 -08001077LOCAL_MODULE_CLASS := ETC
1078LOCAL_MODULE_TAGS := optional
Steven Moreland763697d2017-11-09 11:24:56 -08001079ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Jeff Vander Stoep0cb417a2017-03-08 14:12:54 -08001080LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
Jeff Vander Stoep7a68c5a2017-06-08 13:24:15 -07001081else
1082LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
1083endif
dcashmand225b692016-12-12 09:29:04 -08001084
1085include $(BUILD_SYSTEM)/base_rules.mk
1086
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001087vendor_fc_files := $(call build_vendor_policy, file_contexts)
1088vendor_fcfiles_with_nl := $(call add_nl, $(vendor_fc_files), $(built_nl))
dcashmand225b692016-12-12 09:29:04 -08001089
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001090$(LOCAL_BUILT_MODULE): PRIVATE_FC_FILES := $(vendor_fcfiles_with_nl)
dcashmand225b692016-12-12 09:29:04 -08001091$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Mustafa Yigit Bilgen1cffee62018-11-07 18:03:31 -08001092$(LOCAL_BUILT_MODULE): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
dcashmand225b692016-12-12 09:29:04 -08001093$(LOCAL_BUILT_MODULE): PRIVATE_FC_SORT := $(HOST_OUT_EXECUTABLES)/fc_sort
1094$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/checkfc $(HOST_OUT_EXECUTABLES)/fc_sort \
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001095$(vendor_fcfiles_with_nl) $(built_sepolicy)
dcashmand225b692016-12-12 09:29:04 -08001096 @mkdir -p $(dir $@)
Nick Kralevich764cbd02018-08-15 09:55:27 -07001097 $(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_FC_FILES) > $@.tmp
dcashmand225b692016-12-12 09:29:04 -08001098 $(hide) $< $(PRIVATE_SEPOLICY) $@.tmp
1099 $(hide) $(PRIVATE_FC_SORT) $@.tmp $@
1100
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001101built_vendor_fc := $(LOCAL_BUILT_MODULE)
1102vendor_fc_files :=
1103vendor_fcfiles_with_nl :=
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -04001104
1105##################################
1106include $(CLEAR_VARS)
Jeff Vander Stoepb236eb62017-06-13 08:24:17 -07001107
Bowgo Tsaibae15172017-11-29 16:14:53 +08001108LOCAL_MODULE := odm_file_contexts
1109LOCAL_MODULE_CLASS := ETC
1110LOCAL_MODULE_TAGS := optional
1111LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux
1112
1113include $(BUILD_SYSTEM)/base_rules.mk
1114
1115odm_fc_files := $(call build_odm_policy, file_contexts)
1116odm_fcfiles_with_nl := $(call add_nl, $(odm_fc_files), $(built_nl))
1117
1118$(LOCAL_BUILT_MODULE): PRIVATE_FC_FILES := $(odm_fcfiles_with_nl)
1119$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Mustafa Yigit Bilgen1cffee62018-11-07 18:03:31 -08001120$(LOCAL_BUILT_MODULE): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Bowgo Tsaibae15172017-11-29 16:14:53 +08001121$(LOCAL_BUILT_MODULE): PRIVATE_FC_SORT := $(HOST_OUT_EXECUTABLES)/fc_sort
1122$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/checkfc $(HOST_OUT_EXECUTABLES)/fc_sort \
1123$(odm_fcfiles_with_nl) $(built_sepolicy)
1124 @mkdir -p $(dir $@)
Nick Kralevich764cbd02018-08-15 09:55:27 -07001125 $(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_FC_FILES) > $@.tmp
Bowgo Tsaibae15172017-11-29 16:14:53 +08001126 $(hide) $< $(PRIVATE_SEPOLICY) $@.tmp
1127 $(hide) $(PRIVATE_FC_SORT) $@.tmp $@
1128
1129built_odm_fc := $(LOCAL_BUILT_MODULE)
1130odm_fc_files :=
1131odm_fcfiles_with_nl :=
1132
1133##################################
1134include $(CLEAR_VARS)
1135
Jeff Vander Stoepb236eb62017-06-13 08:24:17 -07001136LOCAL_MODULE := plat_file_contexts.recovery
1137LOCAL_MODULE_STEM := plat_file_contexts
1138LOCAL_MODULE_CLASS := ETC
1139LOCAL_MODULE_TAGS := optional
1140LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
1141
1142include $(BUILD_SYSTEM)/base_rules.mk
1143
1144$(LOCAL_BUILT_MODULE): $(built_plat_fc)
1145 $(hide) cp -f $< $@
1146
1147##################################
1148include $(CLEAR_VARS)
Tri Vo3361ec42018-12-18 19:51:19 -08001149
1150LOCAL_MODULE := product_file_contexts.recovery
1151LOCAL_MODULE_STEM := product_file_contexts
1152LOCAL_MODULE_CLASS := ETC
1153LOCAL_MODULE_TAGS := optional
1154LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
1155
1156include $(BUILD_SYSTEM)/base_rules.mk
1157
1158$(LOCAL_BUILT_MODULE): $(built_product_fc)
1159 $(hide) cp -f $< $@
1160
1161##################################
1162include $(CLEAR_VARS)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001163LOCAL_MODULE := vendor_file_contexts.recovery
1164LOCAL_MODULE_STEM := vendor_file_contexts
Jeff Vander Stoepb236eb62017-06-13 08:24:17 -07001165LOCAL_MODULE_CLASS := ETC
1166LOCAL_MODULE_TAGS := optional
1167LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
1168
1169include $(BUILD_SYSTEM)/base_rules.mk
1170
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001171$(LOCAL_BUILT_MODULE): $(built_vendor_fc)
Jeff Vander Stoepb236eb62017-06-13 08:24:17 -07001172 $(hide) cp -f $< $@
1173
1174##################################
1175include $(CLEAR_VARS)
Bowgo Tsaibae15172017-11-29 16:14:53 +08001176LOCAL_MODULE := odm_file_contexts.recovery
1177LOCAL_MODULE_STEM := odm_file_contexts
1178LOCAL_MODULE_CLASS := ETC
1179LOCAL_MODULE_TAGS := optional
1180LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
1181
1182include $(BUILD_SYSTEM)/base_rules.mk
1183
1184$(LOCAL_BUILT_MODULE): $(built_odm_fc)
1185 $(hide) cp -f $< $@
1186
1187##################################
1188include $(CLEAR_VARS)
Dan Cashman9c038072016-12-22 07:15:18 -08001189LOCAL_MODULE := plat_seapp_contexts
Ying Wang02fb5f32012-01-17 17:51:09 -08001190LOCAL_MODULE_CLASS := ETC
1191LOCAL_MODULE_TAGS := optional
Steven Moreland763697d2017-11-09 11:24:56 -08001192ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Jeff Vander Stoep4e3a4c72017-03-08 22:28:03 -08001193LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
1194else
Ying Wang02fb5f32012-01-17 17:51:09 -08001195LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Jeff Vander Stoep4e3a4c72017-03-08 22:28:03 -08001196endif
Ying Wang02fb5f32012-01-17 17:51:09 -08001197
William Roberts171a0622012-08-16 10:55:05 -07001198include $(BUILD_SYSTEM)/base_rules.mk
Ying Wang02fb5f32012-01-17 17:51:09 -08001199
Tri Vo75887dd2018-12-14 14:30:56 -08001200# TODO(b/119305624): Move product-specific sepolicy out of plat_seapp_contexts
1201plat_sc_files := $(call build_policy, seapp_contexts, $(PLAT_PRIVATE_POLICY) $(PRODUCT_PRIVATE_POLICY))
William Roberts171a0622012-08-16 10:55:05 -07001202
Ying Wangd8b122c2012-10-25 19:01:31 -07001203$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Dan Cashman9c038072016-12-22 07:15:18 -08001204$(LOCAL_BUILT_MODULE): PRIVATE_SC_FILES := $(plat_sc_files)
1205$(LOCAL_BUILT_MODULE): $(built_sepolicy) $(plat_sc_files) $(HOST_OUT_EXECUTABLES)/checkseapp
William Robertsf0e0a942012-08-27 15:41:15 -07001206 @mkdir -p $(dir $@)
William Roberts99fe8df2015-06-30 13:53:51 -07001207 $(hide) $(HOST_OUT_EXECUTABLES)/checkseapp -p $(PRIVATE_SEPOLICY) -o $@ $(PRIVATE_SC_FILES)
Ying Wang02fb5f32012-01-17 17:51:09 -08001208
Dan Cashman9c038072016-12-22 07:15:18 -08001209built_plat_sc := $(LOCAL_BUILT_MODULE)
1210plat_sc_files :=
Robert Craig8b7545b2014-03-20 09:35:08 -04001211
Ying Wang02fb5f32012-01-17 17:51:09 -08001212##################################
Stephen Smalley124720a2012-04-04 10:11:16 -04001213include $(CLEAR_VARS)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001214LOCAL_MODULE := vendor_seapp_contexts
Stephen Smalley37712872015-03-12 15:46:36 -04001215LOCAL_MODULE_CLASS := ETC
Dan Cashman9c038072016-12-22 07:15:18 -08001216LOCAL_MODULE_TAGS := optional
Steven Moreland763697d2017-11-09 11:24:56 -08001217ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Jeff Vander Stoep4e3a4c72017-03-08 22:28:03 -08001218LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
1219else
Dan Cashman9c038072016-12-22 07:15:18 -08001220LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Jeff Vander Stoep4e3a4c72017-03-08 22:28:03 -08001221endif
Stephen Smalley37712872015-03-12 15:46:36 -04001222
1223include $(BUILD_SYSTEM)/base_rules.mk
1224
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001225vendor_sc_files := $(call build_policy, seapp_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
Tri Vo75887dd2018-12-14 14:30:56 -08001226plat_sc_neverallow_files := $(call build_policy, seapp_contexts, $(PLAT_PRIVATE_POLICY) $(PRODUCT_PRIVATE_POLICY))
Stephen Smalley37712872015-03-12 15:46:36 -04001227
Dan Cashman9c038072016-12-22 07:15:18 -08001228$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001229$(LOCAL_BUILT_MODULE): PRIVATE_SC_FILES := $(vendor_sc_files)
Jeff Vander Stoep87ae5f72017-03-06 22:53:09 -08001230$(LOCAL_BUILT_MODULE): PRIVATE_SC_NEVERALLOW_FILES := $(plat_sc_neverallow_files)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001231$(LOCAL_BUILT_MODULE): $(built_sepolicy) $(vendor_sc_files) $(HOST_OUT_EXECUTABLES)/checkseapp $(plat_sc_neverallow_files)
Stephen Smalley37712872015-03-12 15:46:36 -04001232 @mkdir -p $(dir $@)
Dan Cashman91d398d2017-09-26 12:58:29 -07001233 $(hide) grep -ihe '^neverallow' $(PRIVATE_SC_NEVERALLOW_FILES) > $@.tmp
Xin Liec6f3932017-03-14 16:51:13 -07001234 $(hide) $(HOST_OUT_EXECUTABLES)/checkseapp -p $(PRIVATE_SEPOLICY) -o $@ $(PRIVATE_SC_FILES) $@.tmp
Stephen Smalley37712872015-03-12 15:46:36 -04001235
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001236built_vendor_sc := $(LOCAL_BUILT_MODULE)
1237vendor_sc_files :=
Stephen Smalley37712872015-03-12 15:46:36 -04001238
1239##################################
1240include $(CLEAR_VARS)
Bowgo Tsaiecf656b2017-11-29 16:15:28 +08001241LOCAL_MODULE := odm_seapp_contexts
1242LOCAL_MODULE_CLASS := ETC
1243LOCAL_MODULE_TAGS := optional
1244LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux
1245
1246include $(BUILD_SYSTEM)/base_rules.mk
1247
1248odm_sc_files := $(call build_policy, seapp_contexts, $(BOARD_ODM_SEPOLICY_DIRS))
Tri Vo75887dd2018-12-14 14:30:56 -08001249plat_sc_neverallow_files := $(call build_policy, seapp_contexts, $(PLAT_PRIVATE_POLICY) $(PRODUCT_PRIVATE_POLICY))
Bowgo Tsaiecf656b2017-11-29 16:15:28 +08001250
1251$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
1252$(LOCAL_BUILT_MODULE): PRIVATE_SC_FILES := $(odm_sc_files)
1253$(LOCAL_BUILT_MODULE): PRIVATE_SC_NEVERALLOW_FILES := $(plat_sc_neverallow_files)
1254$(LOCAL_BUILT_MODULE): $(built_sepolicy) $(odm_sc_files) $(HOST_OUT_EXECUTABLES)/checkseapp $(plat_sc_neverallow_files)
1255 @mkdir -p $(dir $@)
1256 $(hide) grep -ihe '^neverallow' $(PRIVATE_SC_NEVERALLOW_FILES) > $@.tmp
1257 $(hide) $(HOST_OUT_EXECUTABLES)/checkseapp -p $(PRIVATE_SEPOLICY) -o $@ $(PRIVATE_SC_FILES) $@.tmp
1258
1259built_odm_sc := $(LOCAL_BUILT_MODULE)
1260odm_sc_files :=
1261
1262##################################
1263include $(CLEAR_VARS)
Dan Cashman9c038072016-12-22 07:15:18 -08001264LOCAL_MODULE := plat_seapp_neverallows
William Roberts4ee71312015-06-25 11:59:30 -07001265LOCAL_MODULE_CLASS := ETC
1266LOCAL_MODULE_TAGS := tests
1267
1268include $(BUILD_SYSTEM)/base_rules.mk
1269
Jeff Vander Stoep87ae5f72017-03-06 22:53:09 -08001270$(LOCAL_BUILT_MODULE): $(plat_sc_neverallow_files)
William Roberts4ee71312015-06-25 11:59:30 -07001271 @mkdir -p $(dir $@)
Dan Cashman91d398d2017-09-26 12:58:29 -07001272 - $(hide) grep -ihe '^neverallow' $< > $@
William Roberts4ee71312015-06-25 11:59:30 -07001273
Jeff Vander Stoep87ae5f72017-03-06 22:53:09 -08001274plat_sc_neverallow_files :=
William Roberts4ee71312015-06-25 11:59:30 -07001275
1276##################################
1277include $(CLEAR_VARS)
Stephen Smalley124720a2012-04-04 10:11:16 -04001278
Sandeep Patila86316e2016-12-27 16:08:44 -08001279LOCAL_MODULE := plat_property_contexts
Stephen Smalley124720a2012-04-04 10:11:16 -04001280LOCAL_MODULE_CLASS := ETC
1281LOCAL_MODULE_TAGS := optional
Alex Klyubin9d590412017-03-08 13:10:05 -08001282
Steven Moreland763697d2017-11-09 11:24:56 -08001283ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Alex Klyubin9d590412017-03-08 13:10:05 -08001284LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
1285else
Stephen Smalley124720a2012-04-04 10:11:16 -04001286LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Alex Klyubin9d590412017-03-08 13:10:05 -08001287endif
Stephen Smalley124720a2012-04-04 10:11:16 -04001288
1289include $(BUILD_SYSTEM)/base_rules.mk
1290
Tri Vo75887dd2018-12-14 14:30:56 -08001291# TODO(b/119305624): Move product-specific sepolicy out of plat_property_contexts.
1292plat_pcfiles := $(call build_policy, property_contexts, $(PLAT_PRIVATE_POLICY) $(PRODUCT_PRIVATE_POLICY))
Jaekyun Seoke4971452017-10-19 16:54:49 +09001293ifeq ($(PRODUCT_COMPATIBLE_PROPERTY),true)
1294plat_pcfiles += $(LOCAL_PATH)/public/property_contexts
1295endif
William Roberts6aabc1c2015-07-30 11:44:26 -07001296
Sandeep Patila86316e2016-12-27 16:08:44 -08001297plat_property_contexts.tmp := $(intermediates)/plat_property_contexts.tmp
1298$(plat_property_contexts.tmp): PRIVATE_PC_FILES := $(plat_pcfiles)
1299$(plat_property_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1300$(plat_property_contexts.tmp): $(plat_pcfiles)
William Roberts7f81b332015-09-29 13:52:37 -07001301 @mkdir -p $(dir $@)
Nick Kralevich764cbd02018-08-15 09:55:27 -07001302 $(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_PC_FILES) > $@
Tom Cherrya15df752018-03-23 14:15:23 -07001303$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
1304$(LOCAL_BUILT_MODULE): $(plat_property_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/property_info_checker
William Robertsdcffd2b2015-09-29 13:52:37 -07001305 @mkdir -p $(dir $@)
Tom Cherryf68b4c62018-01-04 09:46:48 -08001306 $(hide) cp -f $< $@
Tom Cherrya15df752018-03-23 14:15:23 -07001307 $(hide) $(HOST_OUT_EXECUTABLES)/property_info_checker $(PRIVATE_SEPOLICY) $@
Stephen Smalley124720a2012-04-04 10:11:16 -04001308
Sandeep Patila86316e2016-12-27 16:08:44 -08001309built_plat_pc := $(LOCAL_BUILT_MODULE)
1310plat_pcfiles :=
1311plat_property_contexts.tmp :=
Robert Craig8b7545b2014-03-20 09:35:08 -04001312
Stephen Smalley124720a2012-04-04 10:11:16 -04001313##################################
Riley Spahnf90c41f2014-06-05 15:52:02 -07001314include $(CLEAR_VARS)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001315LOCAL_MODULE := vendor_property_contexts
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -04001316LOCAL_MODULE_CLASS := ETC
Sandeep Patila86316e2016-12-27 16:08:44 -08001317LOCAL_MODULE_TAGS := optional
Alex Klyubin9d590412017-03-08 13:10:05 -08001318
Steven Moreland763697d2017-11-09 11:24:56 -08001319ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Alex Klyubin9d590412017-03-08 13:10:05 -08001320LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
1321else
Sandeep Patila86316e2016-12-27 16:08:44 -08001322LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Alex Klyubin9d590412017-03-08 13:10:05 -08001323endif
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -04001324
Stephen Smalleyc9361732015-03-13 09:36:57 -04001325include $(BUILD_SYSTEM)/base_rules.mk
1326
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001327vendor_pcfiles := $(call build_policy, property_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
Sandeep Patil262edc32016-12-27 16:08:44 -08001328
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001329vendor_property_contexts.tmp := $(intermediates)/vendor_property_contexts.tmp
1330$(vendor_property_contexts.tmp): PRIVATE_PC_FILES := $(vendor_pcfiles)
1331$(vendor_property_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1332$(vendor_property_contexts.tmp): $(vendor_pcfiles)
William Robertsdcffd2b2015-09-29 13:52:37 -07001333 @mkdir -p $(dir $@)
Nick Kralevich764cbd02018-08-15 09:55:27 -07001334 $(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_PC_FILES) > $@
Sandeep Patila86316e2016-12-27 16:08:44 -08001335
Tom Cherrya15df752018-03-23 14:15:23 -07001336$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
1337$(LOCAL_BUILT_MODULE): PRIVATE_BUILT_PLAT_PC := $(built_plat_pc)
1338$(LOCAL_BUILT_MODULE): $(vendor_property_contexts.tmp) $(built_sepolicy) $(built_plat_pc) $(HOST_OUT_EXECUTABLES)/property_info_checker
Sandeep Patila86316e2016-12-27 16:08:44 -08001339 @mkdir -p $(dir $@)
Tom Cherryf68b4c62018-01-04 09:46:48 -08001340 $(hide) cp -f $< $@
Tom Cherrya15df752018-03-23 14:15:23 -07001341 $(hide) $(HOST_OUT_EXECUTABLES)/property_info_checker $(PRIVATE_SEPOLICY) $(PRIVATE_BUILT_PLAT_PC) $@
William Robertsdcffd2b2015-09-29 13:52:37 -07001342
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001343built_vendor_pc := $(LOCAL_BUILT_MODULE)
1344vendor_pcfiles :=
1345vendor_property_contexts.tmp :=
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -04001346
1347##################################
1348include $(CLEAR_VARS)
Bowgo Tsai1f717b12017-11-29 16:15:55 +08001349LOCAL_MODULE := odm_property_contexts
1350LOCAL_MODULE_CLASS := ETC
1351LOCAL_MODULE_TAGS := optional
1352LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux
1353
1354include $(BUILD_SYSTEM)/base_rules.mk
1355
1356odm_pcfiles := $(call build_policy, property_contexts, $(BOARD_ODM_SEPOLICY_DIRS))
1357
1358odm_property_contexts.tmp := $(intermediates)/odm_property_contexts.tmp
1359$(odm_property_contexts.tmp): PRIVATE_PC_FILES := $(odm_pcfiles)
1360$(odm_property_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1361$(odm_property_contexts.tmp): $(odm_pcfiles)
1362 @mkdir -p $(dir $@)
Nick Kralevich764cbd02018-08-15 09:55:27 -07001363 $(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_PC_FILES) > $@
Bowgo Tsai1f717b12017-11-29 16:15:55 +08001364
1365
Tom Cherrya15df752018-03-23 14:15:23 -07001366$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
1367$(LOCAL_BUILT_MODULE): PRIVATE_BUILT_PLAT_PC := $(built_plat_pc)
1368$(LOCAL_BUILT_MODULE): PRIVATE_BUILT_VENDOR_PC := $(built_vendor_pc)
1369$(LOCAL_BUILT_MODULE): $(odm_property_contexts.tmp) $(built_sepolicy) $(built_plat_pc) $(built_vendor_pc) $(HOST_OUT_EXECUTABLES)/property_info_checker
Bowgo Tsai1f717b12017-11-29 16:15:55 +08001370 @mkdir -p $(dir $@)
1371 $(hide) cp -f $< $@
Tom Cherrya15df752018-03-23 14:15:23 -07001372 $(hide) $(HOST_OUT_EXECUTABLES)/property_info_checker $(PRIVATE_SEPOLICY) $(PRIVATE_BUILT_PLAT_PC) $(PRIVATE_BUILT_VENDOR_PC) $@
Bowgo Tsai1f717b12017-11-29 16:15:55 +08001373
1374built_odm_pc := $(LOCAL_BUILT_MODULE)
1375odm_pcfiles :=
1376odm_property_contexts.tmp :=
1377
1378##################################
1379include $(CLEAR_VARS)
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -04001380
Alex Klyubinec78c372017-03-10 12:44:16 -08001381LOCAL_MODULE := plat_property_contexts.recovery
1382LOCAL_MODULE_STEM := plat_property_contexts
1383LOCAL_MODULE_CLASS := ETC
1384LOCAL_MODULE_TAGS := optional
1385LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
1386
1387include $(BUILD_SYSTEM)/base_rules.mk
1388
1389$(LOCAL_BUILT_MODULE): $(built_plat_pc)
1390 $(hide) cp -f $< $@
1391
1392##################################
1393include $(CLEAR_VARS)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001394LOCAL_MODULE := vendor_property_contexts.recovery
1395LOCAL_MODULE_STEM := vendor_property_contexts
Alex Klyubinec78c372017-03-10 12:44:16 -08001396LOCAL_MODULE_CLASS := ETC
1397LOCAL_MODULE_TAGS := optional
1398LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
1399
1400include $(BUILD_SYSTEM)/base_rules.mk
1401
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001402$(LOCAL_BUILT_MODULE): $(built_vendor_pc)
Alex Klyubinec78c372017-03-10 12:44:16 -08001403 $(hide) cp -f $< $@
1404
1405##################################
1406include $(CLEAR_VARS)
Bowgo Tsai1f717b12017-11-29 16:15:55 +08001407LOCAL_MODULE := odm_property_contexts.recovery
1408LOCAL_MODULE_STEM := odm_property_contexts
1409LOCAL_MODULE_CLASS := ETC
1410LOCAL_MODULE_TAGS := optional
1411LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
1412
1413include $(BUILD_SYSTEM)/base_rules.mk
1414
1415$(LOCAL_BUILT_MODULE): $(built_odm_pc)
1416 $(hide) cp -f $< $@
1417
1418##################################
1419include $(CLEAR_VARS)
Alex Klyubinec78c372017-03-10 12:44:16 -08001420
Sandeep Patila058b562016-12-27 15:10:48 -08001421LOCAL_MODULE := plat_service_contexts
Riley Spahnf90c41f2014-06-05 15:52:02 -07001422LOCAL_MODULE_CLASS := ETC
1423LOCAL_MODULE_TAGS := optional
Steven Moreland763697d2017-11-09 11:24:56 -08001424ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Jeff Vander Stoep4e3a4c72017-03-08 22:28:03 -08001425LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
1426else
Riley Spahnf90c41f2014-06-05 15:52:02 -07001427LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Jeff Vander Stoep4e3a4c72017-03-08 22:28:03 -08001428endif
Riley Spahnf90c41f2014-06-05 15:52:02 -07001429
1430include $(BUILD_SYSTEM)/base_rules.mk
1431
Tri Vo75887dd2018-12-14 14:30:56 -08001432# TODO(b/119305624): Move product-specific sepolicy out of plat_service_contexts.
1433plat_svcfiles := $(call build_policy, service_contexts, $(PLAT_PRIVATE_POLICY) $(PRODUCT_PRIVATE_POLICY))
Riley Spahnf90c41f2014-06-05 15:52:02 -07001434
Sandeep Patila058b562016-12-27 15:10:48 -08001435plat_service_contexts.tmp := $(intermediates)/plat_service_contexts.tmp
1436$(plat_service_contexts.tmp): PRIVATE_SVC_FILES := $(plat_svcfiles)
1437$(plat_service_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1438$(plat_service_contexts.tmp): $(plat_svcfiles)
Riley Spahnf90c41f2014-06-05 15:52:02 -07001439 @mkdir -p $(dir $@)
Nick Kralevich764cbd02018-08-15 09:55:27 -07001440 $(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
William Roberts7fc865a2015-09-29 14:17:38 -07001441
1442$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Sandeep Patila058b562016-12-27 15:10:48 -08001443$(LOCAL_BUILT_MODULE): $(plat_service_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
William Roberts7fc865a2015-09-29 14:17:38 -07001444 @mkdir -p $(dir $@)
William Robertsc9fce3f2016-04-06 11:53:04 -07001445 sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
dcashman07791552016-12-07 11:27:47 -08001446 $(HOST_OUT_EXECUTABLES)/checkfc -s $(PRIVATE_SEPOLICY) $@
Riley Spahnf90c41f2014-06-05 15:52:02 -07001447
Sandeep Patila058b562016-12-27 15:10:48 -08001448built_plat_svc := $(LOCAL_BUILT_MODULE)
1449plat_svcfiles :=
1450plat_service_contexts.tmp :=
Riley Spahnf90c41f2014-06-05 15:52:02 -07001451
1452##################################
Hung-ying Tyane83f1e52017-09-05 21:51:52 +08001453# nonplat_service_contexts is only allowed on non-full-treble devices
Steven Moreland763697d2017-11-09 11:24:56 -08001454ifneq ($(PRODUCT_SEPOLICY_SPLIT),true)
Hung-ying Tyane83f1e52017-09-05 21:51:52 +08001455
rpcraigb19665c2012-07-30 09:33:03 -04001456include $(CLEAR_VARS)
1457
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001458LOCAL_MODULE := vendor_service_contexts
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -04001459LOCAL_MODULE_CLASS := ETC
Sandeep Patila058b562016-12-27 15:10:48 -08001460LOCAL_MODULE_TAGS := optional
Sandeep Patila058b562016-12-27 15:10:48 -08001461LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -04001462
1463include $(BUILD_SYSTEM)/base_rules.mk
1464
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001465vendor_svcfiles := $(call build_policy, service_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -04001466
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001467vendor_service_contexts.tmp := $(intermediates)/vendor_service_contexts.tmp
1468$(vendor_service_contexts.tmp): PRIVATE_SVC_FILES := $(vendor_svcfiles)
1469$(vendor_service_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1470$(vendor_service_contexts.tmp): $(vendor_svcfiles)
Sandeep Patila058b562016-12-27 15:10:48 -08001471 @mkdir -p $(dir $@)
Nick Kralevich764cbd02018-08-15 09:55:27 -07001472 $(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
Sandeep Patila058b562016-12-27 15:10:48 -08001473
1474$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001475$(LOCAL_BUILT_MODULE): $(vendor_service_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
William Roberts7fc865a2015-09-29 14:17:38 -07001476 @mkdir -p $(dir $@)
William Robertsc9fce3f2016-04-06 11:53:04 -07001477 sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
dcashman07791552016-12-07 11:27:47 -08001478 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -s $(PRIVATE_SEPOLICY) $@
William Roberts7fc865a2015-09-29 14:17:38 -07001479
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001480built_vendor_svc := $(LOCAL_BUILT_MODULE)
1481vendor_svcfiles :=
1482vendor_service_contexts.tmp :=
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -04001483
Hung-ying Tyane83f1e52017-09-05 21:51:52 +08001484endif
1485
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -04001486##################################
1487include $(CLEAR_VARS)
1488
Martijn Coenen3ea47b92017-04-07 16:14:43 -07001489LOCAL_MODULE := plat_hwservice_contexts
1490LOCAL_MODULE_CLASS := ETC
1491LOCAL_MODULE_TAGS := optional
Steven Moreland763697d2017-11-09 11:24:56 -08001492ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Martijn Coenen3ea47b92017-04-07 16:14:43 -07001493LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
1494else
1495LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
1496endif
1497
1498include $(BUILD_SYSTEM)/base_rules.mk
1499
Tri Voade74162018-12-20 16:13:10 -08001500plat_hwsvcfiles := $(call build_policy, hwservice_contexts, $(PLAT_PRIVATE_POLICY))
Martijn Coenen3ea47b92017-04-07 16:14:43 -07001501
1502plat_hwservice_contexts.tmp := $(intermediates)/plat_hwservice_contexts.tmp
1503$(plat_hwservice_contexts.tmp): PRIVATE_SVC_FILES := $(plat_hwsvcfiles)
1504$(plat_hwservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1505$(plat_hwservice_contexts.tmp): $(plat_hwsvcfiles)
1506 @mkdir -p $(dir $@)
Nick Kralevich764cbd02018-08-15 09:55:27 -07001507 $(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
Martijn Coenen3ea47b92017-04-07 16:14:43 -07001508
1509$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
1510$(LOCAL_BUILT_MODULE): $(plat_hwservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
1511 @mkdir -p $(dir $@)
1512 sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
1513 $(HOST_OUT_EXECUTABLES)/checkfc -e -l $(PRIVATE_SEPOLICY) $@
1514
1515plat_hwsvcfiles :=
1516plat_hwservice_contexts.tmp :=
1517
1518##################################
1519include $(CLEAR_VARS)
1520
Tri Voade74162018-12-20 16:13:10 -08001521LOCAL_MODULE := product_hwservice_contexts
1522LOCAL_MODULE_CLASS := ETC
1523LOCAL_MODULE_TAGS := optional
1524LOCAL_MODULE_PATH := $(TARGET_OUT_PRODUCT)/etc/selinux
1525
1526include $(BUILD_SYSTEM)/base_rules.mk
1527
1528product_hwsvcfiles := $(call build_policy, hwservice_contexts, $(PRODUCT_PRIVATE_POLICY))
1529
1530product_hwservice_contexts.tmp := $(intermediates)/product_hwservice_contexts.tmp
1531$(product_hwservice_contexts.tmp): PRIVATE_SVC_FILES := $(product_hwsvcfiles)
1532$(product_hwservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1533$(product_hwservice_contexts.tmp): $(product_hwsvcfiles)
1534 @mkdir -p $(dir $@)
1535 $(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
1536
1537$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
1538$(LOCAL_BUILT_MODULE): $(product_hwservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc
1539 @mkdir -p $(dir $@)
1540 sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
1541 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e -l $(PRIVATE_SEPOLICY) $@
1542
1543product_hwsvcfiles :=
1544product_hwservice_contexts.tmp :=
1545
1546##################################
1547include $(CLEAR_VARS)
1548
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001549LOCAL_MODULE := vendor_hwservice_contexts
Martijn Coenen3ea47b92017-04-07 16:14:43 -07001550LOCAL_MODULE_CLASS := ETC
1551LOCAL_MODULE_TAGS := optional
Steven Moreland763697d2017-11-09 11:24:56 -08001552ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Martijn Coenen3ea47b92017-04-07 16:14:43 -07001553LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
1554else
1555LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
1556endif
1557
1558include $(BUILD_SYSTEM)/base_rules.mk
1559
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001560vendor_hwsvcfiles := $(call build_policy, hwservice_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
Martijn Coenen3ea47b92017-04-07 16:14:43 -07001561
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001562vendor_hwservice_contexts.tmp := $(intermediates)/vendor_hwservice_contexts.tmp
1563$(vendor_hwservice_contexts.tmp): PRIVATE_SVC_FILES := $(vendor_hwsvcfiles)
1564$(vendor_hwservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1565$(vendor_hwservice_contexts.tmp): $(vendor_hwsvcfiles)
Martijn Coenen3ea47b92017-04-07 16:14:43 -07001566 @mkdir -p $(dir $@)
Nick Kralevich764cbd02018-08-15 09:55:27 -07001567 $(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
Martijn Coenen3ea47b92017-04-07 16:14:43 -07001568
1569$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001570$(LOCAL_BUILT_MODULE): $(vendor_hwservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
Martijn Coenen3ea47b92017-04-07 16:14:43 -07001571 @mkdir -p $(dir $@)
1572 sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
1573 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e -l $(PRIVATE_SEPOLICY) $@
1574
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001575vendor_hwsvcfiles :=
1576vendor_hwservice_contexts.tmp :=
1577
Bowgo Tsaiad6231f2017-11-29 16:16:26 +08001578##################################
1579include $(CLEAR_VARS)
1580
1581LOCAL_MODULE := odm_hwservice_contexts
1582LOCAL_MODULE_CLASS := ETC
1583LOCAL_MODULE_TAGS := optional
1584LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux
1585
1586include $(BUILD_SYSTEM)/base_rules.mk
1587
1588odm_hwsvcfiles := $(call build_policy, hwservice_contexts, $(BOARD_ODM_SEPOLICY_DIRS))
1589
1590odm_hwservice_contexts.tmp := $(intermediates)/odm_hwservice_contexts.tmp
1591$(odm_hwservice_contexts.tmp): PRIVATE_SVC_FILES := $(odm_hwsvcfiles)
1592$(odm_hwservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1593$(odm_hwservice_contexts.tmp): $(odm_hwsvcfiles)
1594 @mkdir -p $(dir $@)
Nick Kralevich764cbd02018-08-15 09:55:27 -07001595 $(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
Bowgo Tsaiad6231f2017-11-29 16:16:26 +08001596
1597$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
1598$(LOCAL_BUILT_MODULE): $(odm_hwservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
1599 @mkdir -p $(dir $@)
1600 sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
1601 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e -l $(PRIVATE_SEPOLICY) $@
1602
1603odm_hwsvcfiles :=
1604odm_hwservice_contexts.tmp :=
Martijn Coenen3ea47b92017-04-07 16:14:43 -07001605
1606##################################
1607include $(CLEAR_VARS)
1608
Martijn Coenen6676c232017-03-31 17:29:53 -07001609LOCAL_MODULE := vndservice_contexts
1610LOCAL_MODULE_CLASS := ETC
1611LOCAL_MODULE_TAGS := optional
Steven Moreland763697d2017-11-09 11:24:56 -08001612ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Martijn Coenen6676c232017-03-31 17:29:53 -07001613LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
1614else
1615LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
1616endif
1617
1618include $(BUILD_SYSTEM)/base_rules.mk
1619
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001620vnd_svcfiles := $(call build_policy, vndservice_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
Martijn Coenen6676c232017-03-31 17:29:53 -07001621
1622vndservice_contexts.tmp := $(intermediates)/vndservice_contexts.tmp
1623$(vndservice_contexts.tmp): PRIVATE_SVC_FILES := $(vnd_svcfiles)
1624$(vndservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1625$(vndservice_contexts.tmp): $(vnd_svcfiles)
1626 @mkdir -p $(dir $@)
Nick Kralevich764cbd02018-08-15 09:55:27 -07001627 $(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
Martijn Coenen6676c232017-03-31 17:29:53 -07001628
1629$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
1630$(LOCAL_BUILT_MODULE): $(vndservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
1631 @mkdir -p $(dir $@)
1632 sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
Martijn Coenenee976622017-04-07 10:08:55 -07001633 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e -v $(PRIVATE_SEPOLICY) $@
Martijn Coenen6676c232017-03-31 17:29:53 -07001634
1635vnd_svcfiles :=
1636vndservice_contexts.tmp :=
1637##################################
1638include $(CLEAR_VARS)
1639
dcashman90b3b942016-12-14 13:47:55 -08001640LOCAL_MODULE := plat_mac_permissions.xml
rpcraigb19665c2012-07-30 09:33:03 -04001641LOCAL_MODULE_CLASS := ETC
1642LOCAL_MODULE_TAGS := optional
Jeff Vander Stoepbba9e7b2017-03-10 15:51:23 -08001643LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
rpcraigb19665c2012-07-30 09:33:03 -04001644
William Roberts2c8a55d2012-11-30 14:59:09 -08001645include $(BUILD_SYSTEM)/base_rules.mk
rpcraigb19665c2012-07-30 09:33:03 -04001646
Geremy Condracd4104e2013-03-26 18:19:12 +00001647# Build keys.conf
dcashman90b3b942016-12-14 13:47:55 -08001648plat_mac_perms_keys.tmp := $(intermediates)/plat_keys.tmp
1649$(plat_mac_perms_keys.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Tri Vo75887dd2018-12-14 14:30:56 -08001650$(plat_mac_perms_keys.tmp): $(call build_policy, keys.conf, $(PLAT_PRIVATE_POLICY) $(PRODUCT_PRIVATE_POLICY))
Geremy Condracd4104e2013-03-26 18:19:12 +00001651 @mkdir -p $(dir $@)
Nick Kralevich764cbd02018-08-15 09:55:27 -07001652 $(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@
Geremy Condracd4104e2013-03-26 18:19:12 +00001653
Tri Vo75887dd2018-12-14 14:30:56 -08001654# TODO(b/119305624): Move product-specific sepolicy out of plat_mac_permissions.
1655all_plat_mac_perms_files := $(call build_policy, mac_permissions.xml, $(PLAT_PRIVATE_POLICY) $(PRODUCT_PRIVATE_POLICY))
rpcraigb19665c2012-07-30 09:33:03 -04001656
Shinichiro Hamajief0c14d2016-05-13 16:04:58 +09001657# Should be synced with keys.conf.
dcashman90b3b942016-12-14 13:47:55 -08001658all_plat_keys := platform media shared testkey
1659all_plat_keys := $(all_keys:%=$(dir $(DEFAULT_SYSTEM_DEV_CERTIFICATE))/%.x509.pem)
Shinichiro Hamajief0c14d2016-05-13 16:04:58 +09001660
dcashman90b3b942016-12-14 13:47:55 -08001661$(LOCAL_BUILT_MODULE): PRIVATE_MAC_PERMS_FILES := $(all_plat_mac_perms_files)
1662$(LOCAL_BUILT_MODULE): $(plat_mac_perms_keys.tmp) $(HOST_OUT_EXECUTABLES)/insertkeys.py \
1663$(all_plat_mac_perms_files) $(all_plat_keys)
Geremy Condracd4104e2013-03-26 18:19:12 +00001664 @mkdir -p $(dir $@)
Nick Kralevichc3c90522013-10-25 12:25:36 -07001665 $(hide) DEFAULT_SYSTEM_DEV_CERTIFICATE="$(dir $(DEFAULT_SYSTEM_DEV_CERTIFICATE))" \
William Roberts6aabc1c2015-07-30 11:44:26 -07001666 $(HOST_OUT_EXECUTABLES)/insertkeys.py -t $(TARGET_BUILD_VARIANT) -c $(TOP) $< -o $@ $(PRIVATE_MAC_PERMS_FILES)
Geremy Condracd4104e2013-03-26 18:19:12 +00001667
William Roberts6aabc1c2015-07-30 11:44:26 -07001668all_mac_perms_files :=
dcashman90b3b942016-12-14 13:47:55 -08001669all_plat_keys :=
1670plat_mac_perms_keys.tmp :=
1671
1672##################################
1673include $(CLEAR_VARS)
1674
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001675LOCAL_MODULE := vendor_mac_permissions.xml
dcashman90b3b942016-12-14 13:47:55 -08001676LOCAL_MODULE_CLASS := ETC
1677LOCAL_MODULE_TAGS := optional
Jeff Vander Stoepbba9e7b2017-03-10 15:51:23 -08001678LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
dcashman90b3b942016-12-14 13:47:55 -08001679
1680include $(BUILD_SYSTEM)/base_rules.mk
1681
1682# Build keys.conf
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001683vendor_mac_perms_keys.tmp := $(intermediates)/vendor_keys.tmp
1684$(vendor_mac_perms_keys.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1685$(vendor_mac_perms_keys.tmp): $(call build_policy, keys.conf, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
dcashman90b3b942016-12-14 13:47:55 -08001686 @mkdir -p $(dir $@)
Nick Kralevich764cbd02018-08-15 09:55:27 -07001687 $(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@
dcashman90b3b942016-12-14 13:47:55 -08001688
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001689all_vendor_mac_perms_files := $(call build_policy, mac_permissions.xml, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
dcashman90b3b942016-12-14 13:47:55 -08001690
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001691$(LOCAL_BUILT_MODULE): PRIVATE_MAC_PERMS_FILES := $(all_vendor_mac_perms_files)
1692$(LOCAL_BUILT_MODULE): $(vendor_mac_perms_keys.tmp) $(HOST_OUT_EXECUTABLES)/insertkeys.py \
1693$(all_vendor_mac_perms_files)
dcashman90b3b942016-12-14 13:47:55 -08001694 @mkdir -p $(dir $@)
1695 $(hide) $(HOST_OUT_EXECUTABLES)/insertkeys.py -t $(TARGET_BUILD_VARIANT) -c $(TOP) $< -o $@ $(PRIVATE_MAC_PERMS_FILES)
1696
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001697vendor_mac_perms_keys.tmp :=
1698all_vendor_mac_perms_files :=
William Roberts6aabc1c2015-07-30 11:44:26 -07001699
Bowgo Tsaiaf7d85f2017-11-29 16:06:15 +08001700##################################
1701include $(CLEAR_VARS)
1702
1703LOCAL_MODULE := odm_mac_permissions.xml
1704LOCAL_MODULE_CLASS := ETC
1705LOCAL_MODULE_TAGS := optional
1706LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux
1707
1708include $(BUILD_SYSTEM)/base_rules.mk
1709
1710# Build keys.conf
1711odm_mac_perms_keys.tmp := $(intermediates)/odm_keys.tmp
1712$(odm_mac_perms_keys.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1713$(odm_mac_perms_keys.tmp): $(call build_policy, keys.conf, $(BOARD_ODM_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
1714 @mkdir -p $(dir $@)
Nick Kralevich764cbd02018-08-15 09:55:27 -07001715 $(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@
Bowgo Tsaiaf7d85f2017-11-29 16:06:15 +08001716
1717all_odm_mac_perms_files := $(call build_policy, mac_permissions.xml, $(BOARD_ODM_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
1718
1719$(LOCAL_BUILT_MODULE): PRIVATE_MAC_PERMS_FILES := $(all_odm_mac_perms_files)
1720$(LOCAL_BUILT_MODULE): $(odm_mac_perms_keys.tmp) $(HOST_OUT_EXECUTABLES)/insertkeys.py \
1721$(all_odm_mac_perms_files)
1722 @mkdir -p $(dir $@)
1723 $(hide) $(HOST_OUT_EXECUTABLES)/insertkeys.py -t $(TARGET_BUILD_VARIANT) -c $(TOP) $< -o $@ $(PRIVATE_MAC_PERMS_FILES)
1724
1725odm_mac_perms_keys.tmp :=
1726all_odm_mac_perms_files :=
1727
Dan Cashman91d398d2017-09-26 12:58:29 -07001728#################################
1729include $(CLEAR_VARS)
1730LOCAL_MODULE := sepolicy_tests
1731LOCAL_MODULE_CLASS := ETC
1732LOCAL_MODULE_TAGS := tests
1733
1734include $(BUILD_SYSTEM)/base_rules.mk
1735
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001736all_fc_files := $(built_plat_fc) $(built_vendor_fc)
Tri Vo3361ec42018-12-18 19:51:19 -08001737ifdef HAS_PRODUCT_SEPOLICY
1738all_fc_args += $(built_product_fc)
1739endif
Bowgo Tsaibae15172017-11-29 16:14:53 +08001740ifdef BOARD_ODM_SEPOLICY_DIRS
1741all_fc_files += $(built_odm_fc)
1742endif
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001743all_fc_args := $(foreach file, $(all_fc_files), -f $(file))
1744
Dan Cashman91d398d2017-09-26 12:58:29 -07001745sepolicy_tests := $(intermediates)/sepolicy_tests
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001746$(sepolicy_tests): ALL_FC_ARGS := $(all_fc_args)
Dan Cashman91d398d2017-09-26 12:58:29 -07001747$(sepolicy_tests): PRIVATE_SEPOLICY := $(built_sepolicy)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001748$(sepolicy_tests): $(HOST_OUT_EXECUTABLES)/sepolicy_tests $(all_fc_files) $(built_sepolicy)
Dan Cashman91d398d2017-09-26 12:58:29 -07001749 @mkdir -p $(dir $@)
Jeff Vander Stoep3ca843a2017-10-04 09:42:29 -07001750 $(hide) $(HOST_OUT_EXECUTABLES)/sepolicy_tests -l $(HOST_OUT)/lib64/libsepolwrap.$(SHAREDLIB_EXT) \
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001751 $(ALL_FC_ARGS) -p $(PRIVATE_SEPOLICY)
Dan Cashman91d398d2017-09-26 12:58:29 -07001752 $(hide) touch $@
1753
rpcraigb19665c2012-07-30 09:33:03 -04001754##################################
Tri Vo14069262018-01-31 16:22:35 -08001755intermediates := $(call intermediates-dir-for,ETC,built_plat_sepolicy,,,,)
Dan Cashman91d398d2017-09-26 12:58:29 -07001756
1757# plat_sepolicy - the current platform policy only, built into a policy binary.
1758# TODO - this currently excludes partner extensions, but support should be added
1759# to enable partners to add their own compatibility mapping
Tri Vo75887dd2018-12-14 14:30:56 -08001760BASE_PLAT_PUBLIC_POLICY := $(PLAT_PUBLIC_POLICY)
1761BASE_PLAT_PRIVATE_POLICY := $(PLAT_PRIVATE_POLICY)
Dan Cashman91d398d2017-09-26 12:58:29 -07001762base_plat_policy.conf := $(intermediates)/base_plat_policy.conf
1763$(base_plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
1764$(base_plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Joel Galensonc1486212018-03-23 12:40:26 -07001765$(base_plat_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := user
Dan Cashman91d398d2017-09-26 12:58:29 -07001766$(base_plat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
1767$(base_plat_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
1768$(base_plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Steven Moreland763697d2017-11-09 11:24:56 -08001769$(base_plat_policy.conf): PRIVATE_SEPOLICY_SPLIT := true
Jaekyun Seoke4971452017-10-19 16:54:49 +09001770$(base_plat_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
Dan Cashman91d398d2017-09-26 12:58:29 -07001771$(base_plat_policy.conf): $(call build_policy, $(sepolicy_build_files), \
1772$(BASE_PLAT_PUBLIC_POLICY) $(BASE_PLAT_PRIVATE_POLICY))
1773 $(transform-policy-to-conf)
huangyanjun25095722018-09-13 14:04:19 +08001774 $(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
Dan Cashman91d398d2017-09-26 12:58:29 -07001775
1776built_plat_sepolicy := $(intermediates)/built_plat_sepolicy
1777$(built_plat_sepolicy): PRIVATE_ADDITIONAL_CIL_FILES := \
1778 $(call build_policy, $(sepolicy_build_cil_workaround_files), $(BASE_PLAT_PRIVATE_POLICY))
Joel Galenson5988b562018-01-03 16:53:24 -08001779$(built_plat_sepolicy): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
Dan Cashman91d398d2017-09-26 12:58:29 -07001780$(built_plat_sepolicy): $(base_plat_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
1781$(HOST_OUT_EXECUTABLES)/secilc \
Joel Galenson5988b562018-01-03 16:53:24 -08001782$(call build_policy, $(sepolicy_build_cil_workaround_files), $(BASE_PLAT_PRIVATE_POLICY)) \
1783$(built_sepolicy_neverallows)
Dan Cashman91d398d2017-09-26 12:58:29 -07001784 @mkdir -p $(dir $@)
1785 $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \
1786 $(POLICYVERS) -o $@ $<
1787 $(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@
Joel Galenson5988b562018-01-03 16:53:24 -08001788 $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $@ -o $@ -f /dev/null
Dan Cashman91d398d2017-09-26 12:58:29 -07001789
Tri Voe3f4f772018-09-28 17:21:08 -07001790base_plat_pub_policy.conf := $(intermediates)/base_plat_pub_policy.conf
1791$(base_plat_pub_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
1792$(base_plat_pub_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
1793$(base_plat_pub_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := user
1794$(base_plat_pub_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
1795$(base_plat_pub_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
1796$(base_plat_pub_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1797$(base_plat_pub_policy.conf): PRIVATE_SEPOLICY_SPLIT := true
1798$(base_plat_pub_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
1799$(base_plat_pub_policy.conf): $(call build_policy, $(sepolicy_build_files), \
1800$(BASE_PLAT_PUBLIC_POLICY) $(REQD_MASK_POLICY))
1801 $(transform-policy-to-conf)
1802
1803base_plat_pub_policy.cil := $(intermediates)/base_plat_pub_policy.cil
1804$(base_plat_pub_policy.cil): PRIVATE_POL_CONF := $(base_plat_pub_policy.conf)
1805$(base_plat_pub_policy.cil): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil)
Tri Vod57789f2018-12-17 16:35:41 -08001806$(base_plat_pub_policy.cil): $(HOST_OUT_EXECUTABLES)/checkpolicy \
1807$(HOST_OUT_EXECUTABLES)/build_sepolicy $(base_plat_pub_policy.conf) $(reqd_policy_mask.cil)
Tri Voe3f4f772018-09-28 17:21:08 -07001808 @mkdir -p $(dir $@)
Tri Vod57789f2018-12-17 16:35:41 -08001809 $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $< -C -M -c $(POLICYVERS) -o $@ $(PRIVATE_POL_CONF)
1810 $(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) filter_out \
1811 -f $(PRIVATE_REQD_MASK) -t $@
Tri Voe3f4f772018-09-28 17:21:08 -07001812
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001813all_fc_files := $(built_plat_fc) $(built_vendor_fc)
Tri Vo3361ec42018-12-18 19:51:19 -08001814ifdef HAS_PRODUCT_SEPOLICY
1815all_fc_files += $(built_product_fc)
1816endif
Bowgo Tsaibae15172017-11-29 16:14:53 +08001817ifdef BOARD_ODM_SEPOLICY_DIRS
1818all_fc_files += $(built_odm_fc)
1819endif
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001820all_fc_args := $(foreach file, $(all_fc_files), -f $(file))
1821
Tri Vo14069262018-01-31 16:22:35 -08001822# Tests for Treble compatibility of current platform policy and vendor policy of
1823# given release version.
1824version_under_treble_tests := 26.0
1825include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk
Dan Cashman91d398d2017-09-26 12:58:29 -07001826
Tri Vo9299d932018-01-31 16:50:28 -08001827version_under_treble_tests := 27.0
1828include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk
1829
Jae Shin1fa96342018-07-11 18:30:44 +09001830version_under_treble_tests := 28.0
1831include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk
1832
Dan Cashman91d398d2017-09-26 12:58:29 -07001833BASE_PLAT_PUBLIC_POLICY :=
1834BASE_PLAT_PRIVATE_POLICY :=
1835base_plat_policy.conf :=
Tri Voe3f4f772018-09-28 17:21:08 -07001836base_plat_pub_policy.conf :=
Dan Cashman91d398d2017-09-26 12:58:29 -07001837plat_sepolicy :=
1838
Jeff Vander Stoep1fc06822017-05-31 15:36:07 -07001839#################################
Tri Vo81198bb2018-03-15 11:38:08 -07001840include $(CLEAR_VARS)
1841LOCAL_MODULE := sepolicy_freeze_test
1842LOCAL_MODULE_CLASS := ETC
1843LOCAL_MODULE_TAGS := tests
1844
1845include $(BUILD_SYSTEM)/base_rules.mk
1846
1847base_plat_public := $(LOCAL_PATH)/public
1848base_plat_private := $(LOCAL_PATH)/private
1849base_plat_public_prebuilt := \
1850 $(LOCAL_PATH)/prebuilts/api/$(PLATFORM_SEPOLICY_VERSION)/public
1851base_plat_private_prebuilt := \
1852 $(LOCAL_PATH)/prebuilts/api/$(PLATFORM_SEPOLICY_VERSION)/private
1853
1854all_frozen_files := $(call build_policy,$(sepolicy_build_files), \
1855$(base_plat_public) $(base_plat_private) $(base_plat_public_prebuilt) $(base_plat_private_prebuilt))
1856
1857$(LOCAL_BUILT_MODULE): PRIVATE_BASE_PLAT_PUBLIC := $(base_plat_public)
1858$(LOCAL_BUILT_MODULE): PRIVATE_BASE_PLAT_PRIVATE := $(base_plat_private)
1859$(LOCAL_BUILT_MODULE): PRIVATE_BASE_PLAT_PUBLIC_PREBUILT := $(base_plat_public_prebuilt)
1860$(LOCAL_BUILT_MODULE): PRIVATE_BASE_PLAT_PRIVATE_PREBUILT := $(base_plat_private_prebuilt)
1861$(LOCAL_BUILT_MODULE): $(all_frozen_files)
1862ifneq ($(PLATFORM_SEPOLICY_VERSION),$(TOT_SEPOLICY_VERSION))
Joel Galenson98f83b62018-05-22 09:22:41 -07001863 @diff -rq -x bug_map $(PRIVATE_BASE_PLAT_PUBLIC_PREBUILT) $(PRIVATE_BASE_PLAT_PUBLIC)
1864 @diff -rq -x bug_map $(PRIVATE_BASE_PLAT_PRIVATE_PREBUILT) $(PRIVATE_BASE_PLAT_PRIVATE)
Tri Vo81198bb2018-03-15 11:38:08 -07001865endif # ($(PLATFORM_SEPOLICY_VERSION),$(TOT_SEPOLICY_VERSION))
1866 $(hide) touch $@
1867
1868base_plat_public :=
1869base_plat_private :=
1870base_plat_public_prebuilt :=
1871base_plat_private_prebuilt :=
1872all_frozen_files :=
1873
1874#################################
1875
rpcraig47cd3962012-10-17 21:09:52 -04001876
Dan Cashman1c040272016-12-15 15:28:44 -08001877add_nl :=
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001878build_vendor_policy :=
Bowgo Tsaibae15172017-11-29 16:14:53 +08001879build_odm_policy :=
Dan Cashman1c040272016-12-15 15:28:44 -08001880build_policy :=
dcashmand225b692016-12-12 09:29:04 -08001881built_plat_fc :=
Tri Vo3361ec42018-12-18 19:51:19 -08001882built_product_fc :=
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001883built_vendor_fc :=
Bowgo Tsaibae15172017-11-29 16:14:53 +08001884built_odm_fc :=
Richard Hainesc8801fe2015-12-11 10:39:19 +00001885built_nl :=
Alex Klyubin8f7173b2017-02-25 14:47:53 -08001886built_plat_cil :=
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001887built_plat_pub_vers_cil :=
Alex Klyubin8f7173b2017-02-25 14:47:53 -08001888built_mapping_cil :=
Sandeep Patila86316e2016-12-27 16:08:44 -08001889built_plat_pc :=
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001890built_vendor_cil :=
1891built_vendor_pc :=
1892built_vendor_sc :=
Bowgo Tsai45457e32017-11-27 11:41:33 +08001893built_odm_cil :=
Bowgo Tsai1f717b12017-11-29 16:15:55 +08001894built_odm_pc :=
Bowgo Tsaiecf656b2017-11-29 16:15:28 +08001895built_odm_sc :=
Dan Cashman9c038072016-12-22 07:15:18 -08001896built_plat_sc :=
Alex Klyubin193dccd2017-03-07 14:05:57 -08001897built_precompiled_sepolicy :=
Dan Cashman1c040272016-12-15 15:28:44 -08001898built_sepolicy :=
Joel Galenson5988b562018-01-03 16:53:24 -08001899built_sepolicy_neverallows :=
Sandeep Patila058b562016-12-27 15:10:48 -08001900built_plat_svc :=
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001901built_vendor_svc :=
Joel Galensonc1486212018-03-23 12:40:26 -07001902built_plat_sepolicy :=
Jeff Vander Stoepb8787692017-04-21 15:57:07 -07001903mapping_policy :=
Dan Cashman1c040272016-12-15 15:28:44 -08001904my_target_arch :=
dcashman1faa6442016-11-28 07:20:28 -08001905plat_pub_policy.cil :=
1906reqd_policy_mask.cil :=
Dan Cashman1c040272016-12-15 15:28:44 -08001907sepolicy_build_files :=
Alex Klyubin7cda44f2017-03-21 14:28:53 -07001908sepolicy_build_cil_workaround_files :=
Jeff Vander Stoep74434842017-03-13 12:22:15 -07001909with_asan :=
Alice Chucdfb06f2012-11-01 11:33:04 -07001910
1911include $(call all-makefiles-under,$(LOCAL_PATH))