blob: a65de356fafb6933270be97b3b503862ca986ec0 [file] [log] [blame]
Inseob Kimb554e592019-04-15 20:10:46 +09001// Copyright (C) 2019 The Android Open Source Project
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7// http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15package selinux
16
17import (
18 "fmt"
19 "io"
Inseob Kimb554e592019-04-15 20:10:46 +090020
Inseob Kimcd616492020-03-24 23:06:40 +090021 "github.com/google/blueprint"
Inseob Kimb554e592019-04-15 20:10:46 +090022 "github.com/google/blueprint/proptools"
23
24 "android/soong/android"
Inseob Kimcd616492020-03-24 23:06:40 +090025 "android/soong/sysprop"
Inseob Kimb554e592019-04-15 20:10:46 +090026)
27
Inseob Kimb554e592019-04-15 20:10:46 +090028type selinuxContextsProperties struct {
29 // Filenames under sepolicy directories, which will be used to generate contexts file.
30 Srcs []string `android:"path"`
31
Yuntao Xu42e732c2021-11-18 22:33:02 +000032 // Output file name. Defaults to module name
33 Stem *string
34
Inseob Kimb554e592019-04-15 20:10:46 +090035 Product_variables struct {
Inseob Kimb554e592019-04-15 20:10:46 +090036 Address_sanitize struct {
Inseob Kim6d3d5a62021-12-21 20:55:32 +090037 Srcs []string `android:"path"`
Inseob Kimb554e592019-04-15 20:10:46 +090038 }
39 }
40
Inseob Kimb554e592019-04-15 20:10:46 +090041 // Whether the comments in generated contexts file will be removed or not.
42 Remove_comment *bool
43
44 // Whether the result context file is sorted with fc_sort or not.
45 Fc_sort *bool
46
47 // Make this module available when building for recovery
48 Recovery_available *bool
Inseob Kimb554e592019-04-15 20:10:46 +090049}
50
Inseob Kim2dac2672021-12-29 17:54:57 +090051type seappProperties struct {
52 // Files containing neverallow rules.
53 Neverallow_files []string `android:"path"`
54
55 // Precompiled sepolicy binary file which will be fed to checkseapp.
56 Sepolicy *string `android:"path"`
57}
58
Inseob Kimb554e592019-04-15 20:10:46 +090059type selinuxContextsModule struct {
60 android.ModuleBase
Inseob Kim6cd0ddd2023-10-25 23:48:16 +090061 android.DefaultableModuleBase
62 flaggableModuleBase
Inseob Kimb554e592019-04-15 20:10:46 +090063
Jooyung Han804e2342023-06-20 15:38:50 +090064 properties selinuxContextsProperties
65 seappProperties seappProperties
66 build func(ctx android.ModuleContext, inputs android.Paths) android.Path
67 deps func(ctx android.BottomUpMutatorContext)
68 outputPath android.Path
69 installPath android.InstallPath
Inseob Kimb554e592019-04-15 20:10:46 +090070}
71
Inseob Kim6cd0ddd2023-10-25 23:48:16 +090072var _ flaggableModule = (*selinuxContextsModule)(nil)
73
Inseob Kimb554e592019-04-15 20:10:46 +090074var (
Inseob Kimcd616492020-03-24 23:06:40 +090075 reuseContextsDepTag = dependencyTag{name: "reuseContexts"}
76 syspropLibraryDepTag = dependencyTag{name: "sysprop_library"}
Inseob Kimb554e592019-04-15 20:10:46 +090077)
78
79func init() {
80 pctx.HostBinToolVariable("fc_sort", "fc_sort")
81
Inseob Kim6cd0ddd2023-10-25 23:48:16 +090082 android.RegisterModuleType("contexts_defaults", contextsDefaultsFactory)
Inseob Kimb554e592019-04-15 20:10:46 +090083 android.RegisterModuleType("file_contexts", fileFactory)
84 android.RegisterModuleType("hwservice_contexts", hwServiceFactory)
85 android.RegisterModuleType("property_contexts", propertyFactory)
86 android.RegisterModuleType("service_contexts", serviceFactory)
Janis Danisevskisc40681f2020-07-25 13:02:29 -070087 android.RegisterModuleType("keystore2_key_contexts", keystoreKeyFactory)
Inseob Kim2dac2672021-12-29 17:54:57 +090088 android.RegisterModuleType("seapp_contexts", seappFactory)
Inseob Kimc7596c42022-02-25 11:45:41 +090089 android.RegisterModuleType("vndservice_contexts", vndServiceFactory)
Inseob Kimb5e23532022-02-16 02:26:11 +000090
91 android.RegisterModuleType("file_contexts_test", fileContextsTestFactory)
92 android.RegisterModuleType("property_contexts_test", propertyContextsTestFactory)
93 android.RegisterModuleType("hwservice_contexts_test", hwserviceContextsTestFactory)
94 android.RegisterModuleType("service_contexts_test", serviceContextsTestFactory)
Inseob Kimc7596c42022-02-25 11:45:41 +090095 android.RegisterModuleType("vndservice_contexts_test", vndServiceContextsTestFactory)
Inseob Kimb554e592019-04-15 20:10:46 +090096}
97
Colin Cross040f1512019-10-02 10:36:09 -070098func (m *selinuxContextsModule) InstallInRoot() bool {
Inseob Kimfa6fe472021-01-12 13:40:27 +090099 return m.InRecovery()
100}
101
102func (m *selinuxContextsModule) InstallInRecovery() bool {
103 // ModuleBase.InRecovery() checks the image variant
104 return m.InRecovery()
105}
106
107func (m *selinuxContextsModule) onlyInRecovery() bool {
108 // ModuleBase.InstallInRecovery() checks commonProperties.Recovery property
109 return m.ModuleBase.InstallInRecovery()
Colin Cross040f1512019-10-02 10:36:09 -0700110}
111
Inseob Kimcd616492020-03-24 23:06:40 +0900112func (m *selinuxContextsModule) DepsMutator(ctx android.BottomUpMutatorContext) {
Inseob Kimbf7f4a42024-02-14 13:53:39 +0900113 m.flagDeps(ctx)
114
Inseob Kimcd616492020-03-24 23:06:40 +0900115 if m.deps != nil {
116 m.deps(ctx)
117 }
Inseob Kimfa6fe472021-01-12 13:40:27 +0900118
119 if m.InRecovery() && !m.onlyInRecovery() {
120 ctx.AddFarVariationDependencies([]blueprint.Variation{
121 {Mutator: "image", Variation: android.CoreVariation},
122 }, reuseContextsDepTag, ctx.ModuleName())
123 }
Inseob Kimcd616492020-03-24 23:06:40 +0900124}
125
126func (m *selinuxContextsModule) propertyContextsDeps(ctx android.BottomUpMutatorContext) {
127 for _, lib := range sysprop.SyspropLibraries(ctx.Config()) {
128 ctx.AddFarVariationDependencies([]blueprint.Variation{}, syspropLibraryDepTag, lib)
129 }
130}
131
Yuntao Xu42e732c2021-11-18 22:33:02 +0000132func (m *selinuxContextsModule) stem() string {
133 return proptools.StringDefault(m.properties.Stem, m.Name())
134}
135
Inseob Kimb554e592019-04-15 20:10:46 +0900136func (m *selinuxContextsModule) GenerateAndroidBuildActions(ctx android.ModuleContext) {
Inseob Kimfa6fe472021-01-12 13:40:27 +0900137 if m.InRecovery() {
Colin Cross040f1512019-10-02 10:36:09 -0700138 // Installing context files at the root of the recovery partition
139 m.installPath = android.PathForModuleInstall(ctx)
Inseob Kimb554e592019-04-15 20:10:46 +0900140 } else {
141 m.installPath = android.PathForModuleInstall(ctx, "etc", "selinux")
142 }
143
Inseob Kimfa6fe472021-01-12 13:40:27 +0900144 if m.InRecovery() && !m.onlyInRecovery() {
Inseob Kimb554e592019-04-15 20:10:46 +0900145 dep := ctx.GetDirectDepWithTag(m.Name(), reuseContextsDepTag)
146
147 if reuseDeps, ok := dep.(*selinuxContextsModule); ok {
148 m.outputPath = reuseDeps.outputPath
Yuntao Xu42e732c2021-11-18 22:33:02 +0000149 ctx.InstallFile(m.installPath, m.stem(), m.outputPath)
Inseob Kimb554e592019-04-15 20:10:46 +0900150 return
151 }
152 }
153
Inseob Kim6d3d5a62021-12-21 20:55:32 +0900154 m.outputPath = m.build(ctx, android.PathsForModuleSrc(ctx, m.properties.Srcs))
Yuntao Xu42e732c2021-11-18 22:33:02 +0000155 ctx.InstallFile(m.installPath, m.stem(), m.outputPath)
mrziwangdc268a72024-06-06 14:42:10 -0700156
157 ctx.SetOutputFiles([]android.Path{m.outputPath}, "")
Inseob Kimb554e592019-04-15 20:10:46 +0900158}
159
160func newModule() *selinuxContextsModule {
161 m := &selinuxContextsModule{}
162 m.AddProperties(
163 &m.properties,
Inseob Kim2dac2672021-12-29 17:54:57 +0900164 &m.seappProperties,
Inseob Kimb554e592019-04-15 20:10:46 +0900165 )
Inseob Kim6cd0ddd2023-10-25 23:48:16 +0900166 initFlaggableModule(m)
Inseob Kimb554e592019-04-15 20:10:46 +0900167 android.InitAndroidArchModule(m, android.DeviceSupported, android.MultilibCommon)
Inseob Kim6cd0ddd2023-10-25 23:48:16 +0900168 android.InitDefaultableModule(m)
Inseob Kimb554e592019-04-15 20:10:46 +0900169 android.AddLoadHook(m, func(ctx android.LoadHookContext) {
170 m.selinuxContextsHook(ctx)
171 })
172 return m
173}
174
Inseob Kim6cd0ddd2023-10-25 23:48:16 +0900175type contextsDefaults struct {
176 android.ModuleBase
177 android.DefaultsModuleBase
178}
179
180// contexts_defaults provides a set of properties that can be inherited by other contexts modules.
181// (file_contexts, property_contexts, seapp_contexts, etc.) A module can use the properties from a
182// contexts_defaults using `defaults: ["<:default_module_name>"]`. Properties of both modules are
183// erged (when possible) by prepending the default module's values to the depending module's values.
184func contextsDefaultsFactory() android.Module {
185 m := &contextsDefaults{}
186 m.AddProperties(
187 &selinuxContextsProperties{},
188 &seappProperties{},
Inseob Kimbf7f4a42024-02-14 13:53:39 +0900189 &flaggableModuleProperties{},
Inseob Kim6cd0ddd2023-10-25 23:48:16 +0900190 )
191 android.InitDefaultsModule(m)
192 return m
193}
194
Inseob Kimb554e592019-04-15 20:10:46 +0900195func (m *selinuxContextsModule) selinuxContextsHook(ctx android.LoadHookContext) {
196 // TODO: clean this up to use build/soong/android/variable.go after b/79249983
197 var srcs []string
198
Inseob Kimb554e592019-04-15 20:10:46 +0900199 for _, sanitize := range ctx.Config().SanitizeDevice() {
200 if sanitize == "address" {
201 srcs = append(srcs, m.properties.Product_variables.Address_sanitize.Srcs...)
202 break
203 }
204 }
205
206 m.properties.Srcs = append(m.properties.Srcs, srcs...)
207}
208
209func (m *selinuxContextsModule) AndroidMk() android.AndroidMkData {
Colin Crossf82aed02021-11-04 17:25:55 -0700210 nameSuffix := ""
211 if m.InRecovery() && !m.onlyInRecovery() {
212 nameSuffix = ".recovery"
213 }
Inseob Kimb554e592019-04-15 20:10:46 +0900214 return android.AndroidMkData{
Colin Crossf82aed02021-11-04 17:25:55 -0700215 Class: "ETC",
216 OutputFile: android.OptionalPathForPath(m.outputPath),
217 SubName: nameSuffix,
218 Extra: []android.AndroidMkExtraFunc{
219 func(w io.Writer, outputFile android.Path) {
Colin Cross6c7f9372022-01-11 19:35:43 -0800220 fmt.Fprintln(w, "LOCAL_MODULE_PATH :=", m.installPath.String())
Yuntao Xu42e732c2021-11-18 22:33:02 +0000221 fmt.Fprintln(w, "LOCAL_INSTALLED_MODULE_STEM :=", m.stem())
Colin Crossf82aed02021-11-04 17:25:55 -0700222 },
Inseob Kimb554e592019-04-15 20:10:46 +0900223 },
224 }
225}
226
Inseob Kimfa6fe472021-01-12 13:40:27 +0900227func (m *selinuxContextsModule) ImageMutatorBegin(ctx android.BaseModuleContext) {
Yuntao Xu42e732c2021-11-18 22:33:02 +0000228 if proptools.Bool(m.properties.Recovery_available) && m.ModuleBase.InstallInRecovery() {
Inseob Kimfa6fe472021-01-12 13:40:27 +0900229 ctx.PropertyErrorf("recovery_available",
230 "doesn't make sense at the same time as `recovery: true`")
Inseob Kimb554e592019-04-15 20:10:46 +0900231 }
232}
233
Inseob Kimfa6fe472021-01-12 13:40:27 +0900234func (m *selinuxContextsModule) CoreVariantNeeded(ctx android.BaseModuleContext) bool {
Yuntao Xu42e732c2021-11-18 22:33:02 +0000235 return !m.ModuleBase.InstallInRecovery()
Inseob Kimfa6fe472021-01-12 13:40:27 +0900236}
237
238func (m *selinuxContextsModule) RamdiskVariantNeeded(ctx android.BaseModuleContext) bool {
239 return false
240}
241
242func (m *selinuxContextsModule) VendorRamdiskVariantNeeded(ctx android.BaseModuleContext) bool {
243 return false
244}
245
Inseob Kim6cc75f42021-04-29 13:53:20 +0000246func (m *selinuxContextsModule) DebugRamdiskVariantNeeded(ctx android.BaseModuleContext) bool {
247 return false
248}
249
Inseob Kimfa6fe472021-01-12 13:40:27 +0900250func (m *selinuxContextsModule) RecoveryVariantNeeded(ctx android.BaseModuleContext) bool {
Yuntao Xu42e732c2021-11-18 22:33:02 +0000251 return m.ModuleBase.InstallInRecovery() || proptools.Bool(m.properties.Recovery_available)
Inseob Kimfa6fe472021-01-12 13:40:27 +0900252}
253
254func (m *selinuxContextsModule) ExtraImageVariations(ctx android.BaseModuleContext) []string {
255 return nil
256}
257
Jihoon Kang8298ae52024-06-13 21:30:15 +0000258func (m *selinuxContextsModule) SetImageVariation(ctx android.BaseModuleContext, variation string) {
Inseob Kimfa6fe472021-01-12 13:40:27 +0900259}
260
261var _ android.ImageInterface = (*selinuxContextsModule)(nil)
262
Inseob Kimcd616492020-03-24 23:06:40 +0900263func (m *selinuxContextsModule) buildGeneralContexts(ctx android.ModuleContext, inputs android.Paths) android.Path {
Inseob Kim6c6f53b2023-04-26 11:03:35 +0900264 builtContext := pathForModuleOut(ctx, ctx.ModuleName()+"_m4out")
Inseob Kimb554e592019-04-15 20:10:46 +0900265
Colin Cross242c8bc2020-11-16 17:58:17 -0800266 rule := android.NewRuleBuilder(pctx, ctx)
Inseob Kimb554e592019-04-15 20:10:46 +0900267
Inseob Kim6c6f53b2023-04-26 11:03:35 +0900268 newlineFile := pathForModuleOut(ctx, "newline")
Inseob Kim35e9d412023-01-04 15:27:32 +0900269
270 rule.Command().Text("echo").FlagWithOutput("> ", newlineFile)
271 rule.Temporary(newlineFile)
272
273 var inputsWithNewline android.Paths
274 for _, input := range inputs {
275 inputsWithNewline = append(inputsWithNewline, input, newlineFile)
276 }
277
Inseob Kim6cd0ddd2023-10-25 23:48:16 +0900278 flags := m.getBuildFlags(ctx)
Inseob Kimb554e592019-04-15 20:10:46 +0900279 rule.Command().
Dan Willemsen3c3e59b2019-06-19 10:52:50 -0700280 Tool(ctx.Config().PrebuiltBuildTool(ctx, "m4")).
281 Text("--fatal-warnings -s").
Inseob Kimb554e592019-04-15 20:10:46 +0900282 FlagForEachArg("-D", ctx.DeviceConfig().SepolicyM4Defs()).
Inseob Kim6cd0ddd2023-10-25 23:48:16 +0900283 Flags(flagsToM4Macros(flags)).
Inseob Kim35e9d412023-01-04 15:27:32 +0900284 Inputs(inputsWithNewline).
Yuntao Xu42e732c2021-11-18 22:33:02 +0000285 FlagWithOutput("> ", builtContext)
Inseob Kimb554e592019-04-15 20:10:46 +0900286
287 if proptools.Bool(m.properties.Remove_comment) {
Yuntao Xu42e732c2021-11-18 22:33:02 +0000288 rule.Temporary(builtContext)
Inseob Kimb554e592019-04-15 20:10:46 +0900289
Inseob Kim6c6f53b2023-04-26 11:03:35 +0900290 remove_comment_output := pathForModuleOut(ctx, ctx.ModuleName()+"_remove_comment")
Inseob Kimb554e592019-04-15 20:10:46 +0900291
292 rule.Command().
293 Text("sed -e 's/#.*$//' -e '/^$/d'").
Yuntao Xu42e732c2021-11-18 22:33:02 +0000294 Input(builtContext).
Inseob Kimb554e592019-04-15 20:10:46 +0900295 FlagWithOutput("> ", remove_comment_output)
296
Yuntao Xu42e732c2021-11-18 22:33:02 +0000297 builtContext = remove_comment_output
Inseob Kimb554e592019-04-15 20:10:46 +0900298 }
299
300 if proptools.Bool(m.properties.Fc_sort) {
Yuntao Xu42e732c2021-11-18 22:33:02 +0000301 rule.Temporary(builtContext)
Inseob Kimb554e592019-04-15 20:10:46 +0900302
Inseob Kim6c6f53b2023-04-26 11:03:35 +0900303 sorted_output := pathForModuleOut(ctx, ctx.ModuleName()+"_sorted")
Inseob Kimb554e592019-04-15 20:10:46 +0900304
305 rule.Command().
306 Tool(ctx.Config().HostToolPath(ctx, "fc_sort")).
Yuntao Xu42e732c2021-11-18 22:33:02 +0000307 FlagWithInput("-i ", builtContext).
Inseob Kimb554e592019-04-15 20:10:46 +0900308 FlagWithOutput("-o ", sorted_output)
309
Yuntao Xu42e732c2021-11-18 22:33:02 +0000310 builtContext = sorted_output
Inseob Kimb554e592019-04-15 20:10:46 +0900311 }
312
Inseob Kim6c6f53b2023-04-26 11:03:35 +0900313 ret := pathForModuleOut(ctx, m.stem())
Yuntao Xu42e732c2021-11-18 22:33:02 +0000314 rule.Temporary(builtContext)
315 rule.Command().Text("cp").Input(builtContext).Output(ret)
Inseob Kimb554e592019-04-15 20:10:46 +0900316
317 rule.DeleteTemporaryFiles()
Yuntao Xu42e732c2021-11-18 22:33:02 +0000318 rule.Build("selinux_contexts", "building contexts: "+m.Name())
Inseob Kimb554e592019-04-15 20:10:46 +0900319
Inseob Kimcd616492020-03-24 23:06:40 +0900320 return ret
Inseob Kimb554e592019-04-15 20:10:46 +0900321}
322
Inseob Kimcd616492020-03-24 23:06:40 +0900323func (m *selinuxContextsModule) buildFileContexts(ctx android.ModuleContext, inputs android.Paths) android.Path {
Inseob Kimdfa4a482023-11-01 17:58:18 +0900324 if m.properties.Remove_comment == nil {
325 m.properties.Remove_comment = proptools.BoolPtr(true)
Inseob Kimb554e592019-04-15 20:10:46 +0900326 }
Inseob Kimcd616492020-03-24 23:06:40 +0900327 return m.buildGeneralContexts(ctx, inputs)
Inseob Kimb554e592019-04-15 20:10:46 +0900328}
329
330func fileFactory() android.Module {
331 m := newModule()
Inseob Kimb554e592019-04-15 20:10:46 +0900332 m.build = m.buildFileContexts
333 return m
334}
335
Thiébaud Weksteen74482f52023-04-26 13:46:59 +1000336func (m *selinuxContextsModule) buildServiceContexts(ctx android.ModuleContext, inputs android.Paths) android.Path {
Inseob Kimb554e592019-04-15 20:10:46 +0900337 if m.properties.Remove_comment == nil {
338 m.properties.Remove_comment = proptools.BoolPtr(true)
339 }
340
Inseob Kimcd616492020-03-24 23:06:40 +0900341 return m.buildGeneralContexts(ctx, inputs)
342}
343
Inseob Kim085f22f2023-11-09 11:13:01 +0900344func (m *selinuxContextsModule) checkVendorPropertyNamespace(ctx android.ModuleContext, input android.Path) android.Path {
Inseob Kim2bcc0452020-12-21 13:16:44 +0900345 shippingApiLevel := ctx.DeviceConfig().ShippingApiLevel()
346 ApiLevelR := android.ApiLevelOrPanic(ctx, "R")
347
348 rule := android.NewRuleBuilder(pctx, ctx)
349
350 // This list is from vts_treble_sys_prop_test.
351 allowedPropertyPrefixes := []string{
352 "ctl.odm.",
353 "ctl.vendor.",
354 "ctl.start$odm.",
355 "ctl.start$vendor.",
356 "ctl.stop$odm.",
357 "ctl.stop$vendor.",
358 "init.svc.odm.",
359 "init.svc.vendor.",
360 "ro.boot.",
361 "ro.hardware.",
362 "ro.odm.",
363 "ro.vendor.",
364 "odm.",
365 "persist.odm.",
366 "persist.vendor.",
367 "vendor.",
368 }
369
370 // persist.camera is also allowed for devices launching with R or eariler
371 if shippingApiLevel.LessThanOrEqualTo(ApiLevelR) {
372 allowedPropertyPrefixes = append(allowedPropertyPrefixes, "persist.camera.")
373 }
374
375 var allowedContextPrefixes []string
376
377 if shippingApiLevel.GreaterThanOrEqualTo(ApiLevelR) {
378 // This list is from vts_treble_sys_prop_test.
379 allowedContextPrefixes = []string{
380 "vendor_",
381 "odm_",
382 }
383 }
384
Inseob Kim085f22f2023-11-09 11:13:01 +0900385 cmd := rule.Command().
386 BuiltTool("check_prop_prefix").
387 FlagWithInput("--property-contexts ", input).
388 FlagForEachArg("--allowed-property-prefix ", proptools.ShellEscapeList(allowedPropertyPrefixes)). // contains shell special character '$'
389 FlagForEachArg("--allowed-context-prefix ", allowedContextPrefixes)
Inseob Kim2bcc0452020-12-21 13:16:44 +0900390
Inseob Kim085f22f2023-11-09 11:13:01 +0900391 if !ctx.DeviceConfig().BuildBrokenVendorPropertyNamespace() {
392 cmd.Flag("--strict")
Inseob Kim2bcc0452020-12-21 13:16:44 +0900393 }
Inseob Kim085f22f2023-11-09 11:13:01 +0900394
Luca Stefani0b2d7112023-11-16 17:42:52 +0100395 out := pathForModuleOut(ctx, ctx.ModuleName()+"_namespace_checked")
Inseob Kim085f22f2023-11-09 11:13:01 +0900396 rule.Command().Text("cp -f").Input(input).Output(out)
Inseob Kim2bcc0452020-12-21 13:16:44 +0900397 rule.Build("check_namespace", "checking namespace of "+ctx.ModuleName())
Inseob Kim085f22f2023-11-09 11:13:01 +0900398 return out
Inseob Kim2bcc0452020-12-21 13:16:44 +0900399}
400
Inseob Kimcd616492020-03-24 23:06:40 +0900401func (m *selinuxContextsModule) buildPropertyContexts(ctx android.ModuleContext, inputs android.Paths) android.Path {
Inseob Kim2bcc0452020-12-21 13:16:44 +0900402 // vendor/odm properties are enforced for devices launching with Android Q or later. So, if
403 // vendor/odm, make sure that only vendor/odm properties exist.
Inseob Kim085f22f2023-11-09 11:13:01 +0900404 builtCtxFile := m.buildGeneralContexts(ctx, inputs)
405
Inseob Kim2bcc0452020-12-21 13:16:44 +0900406 shippingApiLevel := ctx.DeviceConfig().ShippingApiLevel()
407 ApiLevelQ := android.ApiLevelOrPanic(ctx, "Q")
408 if (ctx.SocSpecific() || ctx.DeviceSpecific()) && shippingApiLevel.GreaterThanOrEqualTo(ApiLevelQ) {
Inseob Kim085f22f2023-11-09 11:13:01 +0900409 builtCtxFile = m.checkVendorPropertyNamespace(ctx, builtCtxFile)
Inseob Kim2bcc0452020-12-21 13:16:44 +0900410 }
411
Inseob Kimcd616492020-03-24 23:06:40 +0900412 var apiFiles android.Paths
413 ctx.VisitDirectDepsWithTag(syspropLibraryDepTag, func(c android.Module) {
Inseob Kim3a3539a2021-01-15 18:10:29 +0900414 i, ok := c.(interface{ CurrentSyspropApiFile() android.OptionalPath })
Inseob Kimcd616492020-03-24 23:06:40 +0900415 if !ok {
416 panic(fmt.Errorf("unknown dependency %q for %q", ctx.OtherModuleName(c), ctx.ModuleName()))
417 }
Inseob Kim3a3539a2021-01-15 18:10:29 +0900418 if api := i.CurrentSyspropApiFile(); api.Valid() {
419 apiFiles = append(apiFiles, api.Path())
420 }
Inseob Kimcd616492020-03-24 23:06:40 +0900421 })
422
423 // check compatibility with sysprop_library
424 if len(apiFiles) > 0 {
Inseob Kim6c6f53b2023-04-26 11:03:35 +0900425 out := pathForModuleOut(ctx, ctx.ModuleName()+"_api_checked")
Colin Cross242c8bc2020-11-16 17:58:17 -0800426 rule := android.NewRuleBuilder(pctx, ctx)
Inseob Kimcd616492020-03-24 23:06:40 +0900427
428 msg := `\n******************************\n` +
429 `API of sysprop_library doesn't match with property_contexts\n` +
430 `Please fix the breakage and rebuild.\n` +
431 `******************************\n`
432
433 rule.Command().
434 Text("( ").
Colin Cross242c8bc2020-11-16 17:58:17 -0800435 BuiltTool("sysprop_type_checker").
Inseob Kimcd616492020-03-24 23:06:40 +0900436 FlagForEachInput("--api ", apiFiles).
437 FlagWithInput("--context ", builtCtxFile).
438 Text(" || ( echo").Flag("-e").
439 Flag(`"` + msg + `"`).
440 Text("; exit 38) )")
441
442 rule.Command().Text("cp -f").Input(builtCtxFile).Output(out)
Colin Cross242c8bc2020-11-16 17:58:17 -0800443 rule.Build("property_contexts_check_api", "checking API: "+m.Name())
Inseob Kimcd616492020-03-24 23:06:40 +0900444 builtCtxFile = out
445 }
446
447 return builtCtxFile
Inseob Kimb554e592019-04-15 20:10:46 +0900448}
449
Inseob Kim06518b12023-08-25 21:20:08 +0900450func (m *selinuxContextsModule) shouldCheckCoredomain(ctx android.ModuleContext) bool {
451 if !ctx.SocSpecific() && !ctx.DeviceSpecific() {
452 return false
453 }
454
455 return ctx.DeviceConfig().CheckVendorSeappViolations()
456}
457
Inseob Kim2dac2672021-12-29 17:54:57 +0900458func (m *selinuxContextsModule) buildSeappContexts(ctx android.ModuleContext, inputs android.Paths) android.Path {
Inseob Kim6c6f53b2023-04-26 11:03:35 +0900459 neverallowFile := pathForModuleOut(ctx, "neverallow")
Inseob Kim085f22f2023-11-09 11:13:01 +0900460 ret := pathForModuleOut(ctx, "checkseapp", m.stem())
Inseob Kim2dac2672021-12-29 17:54:57 +0900461
Inseob Kim085f22f2023-11-09 11:13:01 +0900462 // Step 1. Generate a M4 processed neverallow file
463 flags := m.getBuildFlags(ctx)
464 m4NeverallowFile := pathForModuleOut(ctx, "neverallow.m4out")
Inseob Kim2dac2672021-12-29 17:54:57 +0900465 rule := android.NewRuleBuilder(pctx, ctx)
Inseob Kim085f22f2023-11-09 11:13:01 +0900466 rule.Command().
467 Tool(ctx.Config().PrebuiltBuildTool(ctx, "m4")).
468 Flag("--fatal-warnings").
469 FlagForEachArg("-D", ctx.DeviceConfig().SepolicyM4Defs()).
470 Flags(flagsToM4Macros(flags)).
471 Inputs(android.PathsForModuleSrc(ctx, m.seappProperties.Neverallow_files)).
472 FlagWithOutput("> ", m4NeverallowFile)
473
474 rule.Temporary(m4NeverallowFile)
475 rule.Command().
476 Text("( grep").
Inseob Kim2dac2672021-12-29 17:54:57 +0900477 Flag("-ihe").
478 Text("'^neverallow'").
Inseob Kim085f22f2023-11-09 11:13:01 +0900479 Input(m4NeverallowFile).
Inseob Kim2dac2672021-12-29 17:54:57 +0900480 Text(">").
481 Output(neverallowFile).
Inseob Kim085f22f2023-11-09 11:13:01 +0900482 Text("|| true )") // to make ninja happy even when result is empty
Inseob Kim2dac2672021-12-29 17:54:57 +0900483
Inseob Kim085f22f2023-11-09 11:13:01 +0900484 // Step 2. Generate a M4 processed contexts file
485 builtCtx := m.buildGeneralContexts(ctx, inputs)
486
487 // Step 3. checkseapp
Inseob Kim2dac2672021-12-29 17:54:57 +0900488 rule.Temporary(neverallowFile)
Inseob Kimd7d36092023-06-26 20:48:48 +0900489 checkCmd := rule.Command().BuiltTool("checkseapp").
Inseob Kim2dac2672021-12-29 17:54:57 +0900490 FlagWithInput("-p ", android.PathForModuleSrc(ctx, proptools.String(m.seappProperties.Sepolicy))).
491 FlagWithOutput("-o ", ret).
Inseob Kim085f22f2023-11-09 11:13:01 +0900492 Input(builtCtx).
Inseob Kim2dac2672021-12-29 17:54:57 +0900493 Input(neverallowFile)
494
Inseob Kim06518b12023-08-25 21:20:08 +0900495 if m.shouldCheckCoredomain(ctx) {
496 checkCmd.Flag("-c") // check coredomain for vendor contexts
Inseob Kimd7d36092023-06-26 20:48:48 +0900497 }
498
Inseob Kim2dac2672021-12-29 17:54:57 +0900499 rule.Build("seapp_contexts", "Building seapp_contexts: "+m.Name())
500 return ret
501}
502
Inseob Kimb554e592019-04-15 20:10:46 +0900503func hwServiceFactory() android.Module {
504 m := newModule()
Thiébaud Weksteen74482f52023-04-26 13:46:59 +1000505 m.build = m.buildServiceContexts
Inseob Kimb554e592019-04-15 20:10:46 +0900506 return m
507}
508
509func propertyFactory() android.Module {
510 m := newModule()
Inseob Kimcd616492020-03-24 23:06:40 +0900511 m.build = m.buildPropertyContexts
512 m.deps = m.propertyContextsDeps
Inseob Kimb554e592019-04-15 20:10:46 +0900513 return m
514}
515
516func serviceFactory() android.Module {
517 m := newModule()
Thiébaud Weksteen74482f52023-04-26 13:46:59 +1000518 m.build = m.buildServiceContexts
Inseob Kimb554e592019-04-15 20:10:46 +0900519 return m
520}
Janis Danisevskisc40681f2020-07-25 13:02:29 -0700521
522func keystoreKeyFactory() android.Module {
523 m := newModule()
524 m.build = m.buildGeneralContexts
525 return m
526}
Yuntao Xu42e732c2021-11-18 22:33:02 +0000527
Inseob Kim2dac2672021-12-29 17:54:57 +0900528func seappFactory() android.Module {
529 m := newModule()
530 m.build = m.buildSeappContexts
531 return m
532}
533
Inseob Kimc7596c42022-02-25 11:45:41 +0900534func vndServiceFactory() android.Module {
535 m := newModule()
536 m.build = m.buildGeneralContexts
537 android.AddLoadHook(m, func(ctx android.LoadHookContext) {
538 if !ctx.SocSpecific() {
539 ctx.ModuleErrorf(m.Name(), "must set vendor: true")
540 return
541 }
542 })
543 return m
544}
545
Inseob Kimb5e23532022-02-16 02:26:11 +0000546type contextsTestProperties struct {
547 // Contexts files to be tested.
548 Srcs []string `android:"path"`
549
550 // Precompiled sepolicy binary to be tesed together.
551 Sepolicy *string `android:"path"`
552}
553
Thiébaud Weksteenb6e74302023-10-20 15:36:15 +1100554type fileContextsTestProperties struct {
555 // Test data. File passed to `checkfc -t` to validate how contexts are resolved.
556 Test_data *string `android:"path"`
557}
558
Inseob Kimb5e23532022-02-16 02:26:11 +0000559type contextsTestModule struct {
560 android.ModuleBase
561
Thiébaud Weksteena69e14f2023-10-20 13:31:19 +1100562 // The type of context.
563 context contextType
Inseob Kimb5e23532022-02-16 02:26:11 +0000564
Thiébaud Weksteenb6e74302023-10-20 15:36:15 +1100565 properties contextsTestProperties
566 fileProperties fileContextsTestProperties
567 testTimestamp android.OutputPath
Inseob Kimb5e23532022-02-16 02:26:11 +0000568}
569
Thiébaud Weksteena69e14f2023-10-20 13:31:19 +1100570type contextType int
571
572const (
573 FileContext contextType = iota
574 PropertyContext
575 ServiceContext
576 HwServiceContext
577 VndServiceContext
578)
579
Inseob Kimb5e23532022-02-16 02:26:11 +0000580// checkfc parses a context file and checks for syntax errors.
581// If -s is specified, the service backend is used to verify binder services.
582// If -l is specified, the service backend is used to verify hwbinder services.
583// Otherwise, context_file is assumed to be a file_contexts file
584// If -e is specified, then the context_file is allowed to be empty.
585
586// file_contexts_test tests given file_contexts files with checkfc.
587func fileContextsTestFactory() android.Module {
Thiébaud Weksteena69e14f2023-10-20 13:31:19 +1100588 m := &contextsTestModule{context: FileContext}
Inseob Kimb5e23532022-02-16 02:26:11 +0000589 m.AddProperties(&m.properties)
Thiébaud Weksteenb6e74302023-10-20 15:36:15 +1100590 m.AddProperties(&m.fileProperties)
Inseob Kimb5e23532022-02-16 02:26:11 +0000591 android.InitAndroidArchModule(m, android.DeviceSupported, android.MultilibCommon)
592 return m
593}
594
595// property_contexts_test tests given property_contexts files with property_info_checker.
596func propertyContextsTestFactory() android.Module {
Thiébaud Weksteena69e14f2023-10-20 13:31:19 +1100597 m := &contextsTestModule{context: PropertyContext}
Inseob Kimb5e23532022-02-16 02:26:11 +0000598 m.AddProperties(&m.properties)
599 android.InitAndroidArchModule(m, android.DeviceSupported, android.MultilibCommon)
600 return m
601}
602
603// hwservice_contexts_test tests given hwservice_contexts files with checkfc.
604func hwserviceContextsTestFactory() android.Module {
Thiébaud Weksteena69e14f2023-10-20 13:31:19 +1100605 m := &contextsTestModule{context: HwServiceContext}
Inseob Kimb5e23532022-02-16 02:26:11 +0000606 m.AddProperties(&m.properties)
607 android.InitAndroidArchModule(m, android.DeviceSupported, android.MultilibCommon)
608 return m
609}
610
611// service_contexts_test tests given service_contexts files with checkfc.
612func serviceContextsTestFactory() android.Module {
613 // checkfc -s: service_contexts test
Thiébaud Weksteena69e14f2023-10-20 13:31:19 +1100614 m := &contextsTestModule{context: ServiceContext}
Inseob Kimb5e23532022-02-16 02:26:11 +0000615 m.AddProperties(&m.properties)
616 android.InitAndroidArchModule(m, android.DeviceSupported, android.MultilibCommon)
617 return m
618}
619
Inseob Kimc7596c42022-02-25 11:45:41 +0900620// vndservice_contexts_test tests given vndservice_contexts files with checkfc.
621func vndServiceContextsTestFactory() android.Module {
Thiébaud Weksteena69e14f2023-10-20 13:31:19 +1100622 m := &contextsTestModule{context: VndServiceContext}
Inseob Kimc7596c42022-02-25 11:45:41 +0900623 m.AddProperties(&m.properties)
624 android.InitAndroidArchModule(m, android.DeviceSupported, android.MultilibCommon)
625 return m
626}
627
Inseob Kimb5e23532022-02-16 02:26:11 +0000628func (m *contextsTestModule) GenerateAndroidBuildActions(ctx android.ModuleContext) {
Thiébaud Weksteena69e14f2023-10-20 13:31:19 +1100629 tool := "checkfc"
630 if m.context == PropertyContext {
631 tool = "property_info_checker"
Inseob Kimb5e23532022-02-16 02:26:11 +0000632 }
633
634 if len(m.properties.Srcs) == 0 {
635 ctx.PropertyErrorf("srcs", "can't be empty")
636 return
637 }
638
Thiébaud Weksteenb6e74302023-10-20 15:36:15 +1100639 validateWithPolicy := true
Inseob Kimb5e23532022-02-16 02:26:11 +0000640 if proptools.String(m.properties.Sepolicy) == "" {
Thiébaud Weksteenb6e74302023-10-20 15:36:15 +1100641 if m.context == FileContext {
642 if proptools.String(m.fileProperties.Test_data) == "" {
643 ctx.PropertyErrorf("test_data", "Either test_data or sepolicy should be provided")
644 return
645 }
646 validateWithPolicy = false
647 } else {
648 ctx.PropertyErrorf("sepolicy", "can't be empty")
649 return
650 }
Inseob Kimb5e23532022-02-16 02:26:11 +0000651 }
652
Thiébaud Weksteena69e14f2023-10-20 13:31:19 +1100653 flags := []string(nil)
654 switch m.context {
Thiébaud Weksteenb6e74302023-10-20 15:36:15 +1100655 case FileContext:
656 if !validateWithPolicy {
657 flags = []string{"-t"}
658 }
Thiébaud Weksteena69e14f2023-10-20 13:31:19 +1100659 case ServiceContext:
660 flags = []string{"-s" /* binder services */}
661 case HwServiceContext:
662 flags = []string{"-e" /* allow empty */, "-l" /* hwbinder services */}
663 case VndServiceContext:
664 flags = []string{"-e" /* allow empty */, "-v" /* vnd service */}
665 }
666
Inseob Kimb5e23532022-02-16 02:26:11 +0000667 srcs := android.PathsForModuleSrc(ctx, m.properties.Srcs)
Inseob Kimb5e23532022-02-16 02:26:11 +0000668 rule := android.NewRuleBuilder(pctx, ctx)
Thiébaud Weksteenb6e74302023-10-20 15:36:15 +1100669
670 if validateWithPolicy {
671 sepolicy := android.PathForModuleSrc(ctx, proptools.String(m.properties.Sepolicy))
672 rule.Command().BuiltTool(tool).
673 Flags(flags).
674 Input(sepolicy).
675 Inputs(srcs)
676 } else {
677 test_data := android.PathForModuleSrc(ctx, proptools.String(m.fileProperties.Test_data))
678 rule.Command().BuiltTool(tool).
679 Flags(flags).
680 Inputs(srcs).
681 Input(test_data)
682 }
Inseob Kimb5e23532022-02-16 02:26:11 +0000683
Inseob Kim6c6f53b2023-04-26 11:03:35 +0900684 m.testTimestamp = pathForModuleOut(ctx, "timestamp")
Inseob Kimb5e23532022-02-16 02:26:11 +0000685 rule.Command().Text("touch").Output(m.testTimestamp)
686 rule.Build("contexts_test", "running contexts test: "+ctx.ModuleName())
687}
688
689func (m *contextsTestModule) AndroidMkEntries() []android.AndroidMkEntries {
690 return []android.AndroidMkEntries{android.AndroidMkEntries{
691 Class: "FAKE",
692 // OutputFile is needed, even though BUILD_PHONY_PACKAGE doesn't use it.
693 // Without OutputFile this module won't be exported to Makefile.
694 OutputFile: android.OptionalPathForPath(m.testTimestamp),
695 Include: "$(BUILD_PHONY_PACKAGE)",
696 ExtraEntries: []android.AndroidMkExtraEntriesFunc{
697 func(ctx android.AndroidMkExtraEntriesContext, entries *android.AndroidMkEntries) {
698 entries.SetString("LOCAL_ADDITIONAL_DEPENDENCIES", m.testTimestamp.String())
699 },
700 },
701 }}
702}
703
704// contextsTestModule implements ImageInterface to be able to include recovery_available contexts
705// modules as its sources.
706func (m *contextsTestModule) ImageMutatorBegin(ctx android.BaseModuleContext) {
707}
708
709func (m *contextsTestModule) CoreVariantNeeded(ctx android.BaseModuleContext) bool {
710 return true
711}
712
713func (m *contextsTestModule) RamdiskVariantNeeded(ctx android.BaseModuleContext) bool {
714 return false
715}
716
717func (m *contextsTestModule) VendorRamdiskVariantNeeded(ctx android.BaseModuleContext) bool {
718 return false
719}
720
721func (m *contextsTestModule) DebugRamdiskVariantNeeded(ctx android.BaseModuleContext) bool {
722 return false
723}
724
725func (m *contextsTestModule) RecoveryVariantNeeded(ctx android.BaseModuleContext) bool {
726 return false
727}
728
729func (m *contextsTestModule) ExtraImageVariations(ctx android.BaseModuleContext) []string {
730 return nil
731}
732
Jihoon Kang8298ae52024-06-13 21:30:15 +0000733func (m *contextsTestModule) SetImageVariation(ctx android.BaseModuleContext, variation string) {
Inseob Kimb5e23532022-02-16 02:26:11 +0000734}
735
736var _ android.ImageInterface = (*contextsTestModule)(nil)