blob: 3635a01a26b1c7016e643d1f8a516c264ff671b0 [file] [log] [blame]
Stephen Smalley2dd4e512012-01-04 12:33:27 -05001LOCAL_PATH:= $(call my-dir)
William Robertsf0e0a942012-08-27 15:41:15 -07002
Stephen Smalley2dd4e512012-01-04 12:33:27 -05003include $(CLEAR_VARS)
4
5# SELinux policy version.
Stephen Smalleyb4f17062015-03-13 10:03:52 -04006# Must be <= /sys/fs/selinux/policyvers reported by the Android kernel.
Stephen Smalley2dd4e512012-01-04 12:33:27 -05007# Must be within the compatibility range reported by checkpolicy -V.
Stephen Smalleye543a8b2013-04-01 10:07:43 -04008POLICYVERS ?= 26
Stephen Smalley2dd4e512012-01-04 12:33:27 -05009
10MLS_SENS=1
11MLS_CATS=1024
12
Stephen Smalleyb4f17062015-03-13 10:03:52 -040013ifdef BOARD_SEPOLICY_REPLACE
14$(error BOARD_SEPOLICY_REPLACE is no longer supported; please remove from your BoardConfig.mk or other .mk file.)
15endif
16
17ifdef BOARD_SEPOLICY_IGNORE
18$(error BOARD_SEPOLICY_IGNORE is no longer supported; please remove from your BoardConfig.mk or other .mk file.)
19endif
Stephen Smalley5b340be2012-03-06 11:12:41 -050020
Stephen Smalley8e0ca882015-04-01 10:14:56 -040021ifdef BOARD_SEPOLICY_UNION
22$(warning BOARD_SEPOLICY_UNION is no longer required - all files found in BOARD_SEPOLICY_DIRS are implicitly unioned; please remove from your BoardConfig.mk or other .mk file.)
23endif
Robert Craig6b0ff472014-01-29 13:10:58 -050024
Stephen Smalley8e0ca882015-04-01 10:14:56 -040025# Builds paths for all policy files found in BOARD_SEPOLICY_DIRS.
rpcraig47cd3962012-10-17 21:09:52 -040026# $(1): the set of policy name paths to build
Stephen Smalley8e0ca882015-04-01 10:14:56 -040027build_policy = $(foreach type, $(1), $(wildcard $(addsuffix /$(type), $(LOCAL_PATH) $(BOARD_SEPOLICY_DIRS))))
Stephen Smalley5b340be2012-03-06 11:12:41 -050028
dcashman704741a2014-07-25 19:11:52 -070029sepolicy_build_files := security_classes \
30 initial_sids \
31 access_vectors \
32 global_macros \
Nick Kralevicha17a2662014-11-05 15:30:41 -080033 neverallow_macros \
dcashman704741a2014-07-25 19:11:52 -070034 mls_macros \
35 mls \
36 policy_capabilities \
37 te_macros \
38 attributes \
39 *.te \
40 roles \
41 users \
42 initial_sid_contexts \
43 fs_use \
44 genfs_contexts \
45 port_contexts
46
Ying Wang02fb5f32012-01-17 17:51:09 -080047##################################
48include $(CLEAR_VARS)
Stephen Smalley2dd4e512012-01-04 12:33:27 -050049
Ying Wang02fb5f32012-01-17 17:51:09 -080050LOCAL_MODULE := sepolicy
51LOCAL_MODULE_CLASS := ETC
52LOCAL_MODULE_TAGS := optional
Ying Wang02fb5f32012-01-17 17:51:09 -080053LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Stephen Smalley2dd4e512012-01-04 12:33:27 -050054
Ying Wang02fb5f32012-01-17 17:51:09 -080055include $(BUILD_SYSTEM)/base_rules.mk
Stephen Smalley2dd4e512012-01-04 12:33:27 -050056
Ying Wang02fb5f32012-01-17 17:51:09 -080057sepolicy_policy.conf := $(intermediates)/policy.conf
58$(sepolicy_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
59$(sepolicy_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
dcashman704741a2014-07-25 19:11:52 -070060$(sepolicy_policy.conf) : $(call build_policy, $(sepolicy_build_files))
Ying Wang02fb5f32012-01-17 17:51:09 -080061 @mkdir -p $(dir $@)
Nick Kralevich623975f2014-01-11 01:31:03 -080062 $(hide) m4 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
63 -D target_build_variant=$(TARGET_BUILD_VARIANT) \
Nick Kralevich623975f2014-01-11 01:31:03 -080064 -s $^ > $@
Robert Craig65d4f442013-03-27 06:30:25 -040065 $(hide) sed '/dontaudit/d' $@ > $@.dontaudit
Stephen Smalley2dd4e512012-01-04 12:33:27 -050066
Stephen Smalley2b826fc2012-01-24 08:46:13 -050067$(LOCAL_BUILT_MODULE) : $(sepolicy_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy
Ying Wang02fb5f32012-01-17 17:51:09 -080068 @mkdir -p $(dir $@)
Ying Wangf4ea5b22012-04-09 15:31:03 -070069 $(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c $(POLICYVERS) -o $@ $<
Robert Craig65d4f442013-03-27 06:30:25 -040070 $(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c $(POLICYVERS) -o $(dir $<)/$(notdir $@).dontaudit $<.dontaudit
Ying Wang02fb5f32012-01-17 17:51:09 -080071
Ying Wangd8b122c2012-10-25 19:01:31 -070072built_sepolicy := $(LOCAL_BUILT_MODULE)
Ying Wang02fb5f32012-01-17 17:51:09 -080073sepolicy_policy.conf :=
Stephen Smalley01a58af2012-10-02 12:46:37 -040074
Stephen Smalleye60723a2014-05-29 16:40:15 -040075##################################
76include $(CLEAR_VARS)
77
78LOCAL_MODULE := sepolicy.recovery
79LOCAL_MODULE_CLASS := ETC
80LOCAL_MODULE_TAGS := eng
81
82include $(BUILD_SYSTEM)/base_rules.mk
83
84sepolicy_policy_recovery.conf := $(intermediates)/policy_recovery.conf
85$(sepolicy_policy_recovery.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
86$(sepolicy_policy_recovery.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
dcashman704741a2014-07-25 19:11:52 -070087$(sepolicy_policy_recovery.conf) : $(call build_policy, $(sepolicy_build_files))
Stephen Smalleye60723a2014-05-29 16:40:15 -040088 @mkdir -p $(dir $@)
89 $(hide) m4 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
90 -D target_build_variant=$(TARGET_BUILD_VARIANT) \
Stephen Smalleye60723a2014-05-29 16:40:15 -040091 -D target_recovery=true \
92 -s $^ > $@
93
94$(LOCAL_BUILT_MODULE) : $(sepolicy_policy_recovery.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy
95 @mkdir -p $(dir $@)
96 $(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c $(POLICYVERS) -o $@ $<
97
98built_sepolicy_recovery := $(LOCAL_BUILT_MODULE)
99sepolicy_policy_recovery.conf :=
100
dcashman704741a2014-07-25 19:11:52 -0700101##################################
102include $(CLEAR_VARS)
103
104LOCAL_MODULE := general_sepolicy.conf
105LOCAL_MODULE_CLASS := ETC
106LOCAL_MODULE_TAGS := tests
107
108include $(BUILD_SYSTEM)/base_rules.mk
109
110exp_sepolicy_build_files :=\
111 $(wildcard $(addprefix $(LOCAL_PATH)/, $(sepolicy_build_files)))
112
113$(LOCAL_BUILT_MODULE): PRIVATE_MLS_SENS := $(MLS_SENS)
114$(LOCAL_BUILT_MODULE): PRIVATE_MLS_CATS := $(MLS_CATS)
115$(LOCAL_BUILT_MODULE): $(exp_sepolicy_build_files)
116 mkdir -p $(dir $@)
117 $(hide) m4 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
118 -D target_build_variant=user \
dcashman704741a2014-07-25 19:11:52 -0700119 -s $^ > $@
120 $(hide) sed '/dontaudit/d' $@ > $@.dontaudit
121
122GENERAL_SEPOLICY_POLICY.CONF = $(LOCAL_BUILT_MODULE)
123
124exp_sepolicy_build_files :=
125
126##################################
Stephen Smalley01a58af2012-10-02 12:46:37 -0400127include $(CLEAR_VARS)
128
Ying Wang02fb5f32012-01-17 17:51:09 -0800129LOCAL_MODULE := file_contexts
Ying Wang02fb5f32012-01-17 17:51:09 -0800130LOCAL_MODULE_CLASS := ETC
131LOCAL_MODULE_TAGS := optional
132LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
133
Stephen Smalley5b340be2012-03-06 11:12:41 -0500134include $(BUILD_SYSTEM)/base_rules.mk
Ying Wang02fb5f32012-01-17 17:51:09 -0800135
rpcraig47cd3962012-10-17 21:09:52 -0400136ALL_FC_FILES := $(call build_policy, file_contexts)
Stephen Smalley01a58af2012-10-02 12:46:37 -0400137
Ying Wangd8b122c2012-10-25 19:01:31 -0700138$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
139$(LOCAL_BUILT_MODULE): $(ALL_FC_FILES) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc
Stephen Smalley5b340be2012-03-06 11:12:41 -0500140 @mkdir -p $(dir $@)
Stephen Smalley01a58af2012-10-02 12:46:37 -0400141 $(hide) m4 -s $(ALL_FC_FILES) > $@
Ying Wangd8b122c2012-10-25 19:01:31 -0700142 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc $(PRIVATE_SEPOLICY) $@
Stephen Smalley5b340be2012-03-06 11:12:41 -0500143
Robert Craig8b7545b2014-03-20 09:35:08 -0400144built_fc := $(LOCAL_BUILT_MODULE)
William Roberts171a0622012-08-16 10:55:05 -0700145
Ying Wang02fb5f32012-01-17 17:51:09 -0800146##################################
147include $(CLEAR_VARS)
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400148
149LOCAL_MODULE := general_file_contexts
150LOCAL_MODULE_CLASS := ETC
151LOCAL_MODULE_TAGS := tests
152
153include $(BUILD_SYSTEM)/base_rules.mk
154
155$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
156$(LOCAL_BUILT_MODULE) : $(addprefix $(LOCAL_PATH)/, file_contexts) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc
157 @mkdir -p $(dir $@)
158 $(hide) m4 -s $< > $@
159 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc $(PRIVATE_SEPOLICY) $@
160
161GENERAL_FILE_CONTEXTS := $(LOCAL_BUILT_MODULE)
162
163##################################
164include $(CLEAR_VARS)
Ying Wang02fb5f32012-01-17 17:51:09 -0800165LOCAL_MODULE := seapp_contexts
Ying Wang02fb5f32012-01-17 17:51:09 -0800166LOCAL_MODULE_CLASS := ETC
167LOCAL_MODULE_TAGS := optional
168LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
169
William Roberts171a0622012-08-16 10:55:05 -0700170include $(BUILD_SYSTEM)/base_rules.mk
Ying Wang02fb5f32012-01-17 17:51:09 -0800171
William Roberts98ed3922012-09-05 11:19:07 -0700172seapp_contexts.tmp := $(intermediates)/seapp_contexts.tmp
rpcraig47cd3962012-10-17 21:09:52 -0400173$(seapp_contexts.tmp): $(call build_policy, seapp_contexts)
William Roberts171a0622012-08-16 10:55:05 -0700174 @mkdir -p $(dir $@)
175 $(hide) m4 -s $^ > $@
176
Ying Wangd8b122c2012-10-25 19:01:31 -0700177$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
178$(LOCAL_BUILT_MODULE) : $(seapp_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkseapp
William Robertsf0e0a942012-08-27 15:41:15 -0700179 @mkdir -p $(dir $@)
Ying Wangd8b122c2012-10-25 19:01:31 -0700180 $(HOST_OUT_EXECUTABLES)/checkseapp -p $(PRIVATE_SEPOLICY) -o $@ $<
Ying Wang02fb5f32012-01-17 17:51:09 -0800181
Robert Craig8b7545b2014-03-20 09:35:08 -0400182built_sc := $(LOCAL_BUILT_MODULE)
William Roberts98ed3922012-09-05 11:19:07 -0700183seapp_contexts.tmp :=
Robert Craig8b7545b2014-03-20 09:35:08 -0400184
Ying Wang02fb5f32012-01-17 17:51:09 -0800185##################################
Stephen Smalley124720a2012-04-04 10:11:16 -0400186include $(CLEAR_VARS)
Stephen Smalley37712872015-03-12 15:46:36 -0400187LOCAL_MODULE := general_seapp_contexts
188LOCAL_MODULE_CLASS := ETC
189LOCAL_MODULE_TAGS := tests
190
191include $(BUILD_SYSTEM)/base_rules.mk
192
193general_seapp_contexts.tmp := $(intermediates)/general_seapp_contexts.tmp
194$(general_seapp_contexts.tmp): $(addprefix $(LOCAL_PATH)/, seapp_contexts)
195 @mkdir -p $(dir $@)
196 $(hide) m4 -s $^ > $@
197
198$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
199$(LOCAL_BUILT_MODULE) : $(general_seapp_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkseapp
200 @mkdir -p $(dir $@)
201 $(HOST_OUT_EXECUTABLES)/checkseapp -p $(PRIVATE_SEPOLICY) -o $@ $<
202
203GENERAL_SEAPP_CONTEXTS := $(LOCAL_BUILT_MODULE)
204general_seapp_contexts.tmp :=
205
206##################################
207include $(CLEAR_VARS)
Stephen Smalley124720a2012-04-04 10:11:16 -0400208
209LOCAL_MODULE := property_contexts
210LOCAL_MODULE_CLASS := ETC
211LOCAL_MODULE_TAGS := optional
212LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
213
214include $(BUILD_SYSTEM)/base_rules.mk
215
Robert Craigd98d26e2013-01-23 14:04:50 -0500216ALL_PC_FILES := $(call build_policy, property_contexts)
217
218$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
219$(LOCAL_BUILT_MODULE): $(ALL_PC_FILES) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc
Stephen Smalley124720a2012-04-04 10:11:16 -0400220 @mkdir -p $(dir $@)
Robert Craigd98d26e2013-01-23 14:04:50 -0500221 $(hide) m4 -s $(ALL_PC_FILES) > $@
222 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -p $(PRIVATE_SEPOLICY) $@
Stephen Smalley124720a2012-04-04 10:11:16 -0400223
Robert Craig8b7545b2014-03-20 09:35:08 -0400224built_pc := $(LOCAL_BUILT_MODULE)
225
Stephen Smalley124720a2012-04-04 10:11:16 -0400226##################################
Riley Spahnf90c41f2014-06-05 15:52:02 -0700227include $(CLEAR_VARS)
228
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400229LOCAL_MODULE := general_property_contexts
230LOCAL_MODULE_CLASS := ETC
231LOCAL_MODULE_TAGS := tests
232
Stephen Smalleyc9361732015-03-13 09:36:57 -0400233include $(BUILD_SYSTEM)/base_rules.mk
234
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400235$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
236$(LOCAL_BUILT_MODULE) : $(addprefix $(LOCAL_PATH)/, property_contexts) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc
237 @mkdir -p $(dir $@)
238 $(hide) m4 -s $< > $@
239 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -p $(PRIVATE_SEPOLICY) $@
240
241GENERAL_PROPERTY_CONTEXTS := $(LOCAL_BUILT_MODULE)
242
243##################################
244include $(CLEAR_VARS)
245
Riley Spahnf90c41f2014-06-05 15:52:02 -0700246LOCAL_MODULE := service_contexts
247LOCAL_MODULE_CLASS := ETC
248LOCAL_MODULE_TAGS := optional
249LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
250
251include $(BUILD_SYSTEM)/base_rules.mk
252
253ALL_SVC_FILES := $(call build_policy, service_contexts)
254
255$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
256$(LOCAL_BUILT_MODULE): $(ALL_SVC_FILES) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc
257 @mkdir -p $(dir $@)
258 $(hide) m4 -s $(ALL_SVC_FILES) > $@
259 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -p $(PRIVATE_SEPOLICY) $@
260
261built_svc := $(LOCAL_BUILT_MODULE)
262
263##################################
rpcraigb19665c2012-07-30 09:33:03 -0400264include $(CLEAR_VARS)
265
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400266LOCAL_MODULE := general_service_contexts
267LOCAL_MODULE_CLASS := ETC
268LOCAL_MODULE_TAGS := tests
269
270include $(BUILD_SYSTEM)/base_rules.mk
271
272$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
273$(LOCAL_BUILT_MODULE) : $(addprefix $(LOCAL_PATH)/, service_contexts) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc
274 @mkdir -p $(dir $@)
275 $(hide) m4 -s $< > $@
276 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -p $(PRIVATE_SEPOLICY) $@
277
278GENERAL_SERVICE_CONTEXTS := $(LOCAL_BUILT_MODULE)
279
280##################################
281include $(CLEAR_VARS)
282
Robert Craig7f2392e2013-03-27 08:35:39 -0400283LOCAL_MODULE := mac_permissions.xml
rpcraigb19665c2012-07-30 09:33:03 -0400284LOCAL_MODULE_CLASS := ETC
285LOCAL_MODULE_TAGS := optional
286LOCAL_MODULE_PATH := $(TARGET_OUT_ETC)/security
287
William Roberts2c8a55d2012-11-30 14:59:09 -0800288include $(BUILD_SYSTEM)/base_rules.mk
rpcraigb19665c2012-07-30 09:33:03 -0400289
Geremy Condracd4104e2013-03-26 18:19:12 +0000290# Build keys.conf
291mac_perms_keys.tmp := $(intermediates)/keys.tmp
292$(mac_perms_keys.tmp) : $(call build_policy, keys.conf)
293 @mkdir -p $(dir $@)
294 $(hide) m4 -s $^ > $@
295
Robert Craig7f2392e2013-03-27 08:35:39 -0400296ALL_MAC_PERMS_FILES := $(call build_policy, $(LOCAL_MODULE))
rpcraigb19665c2012-07-30 09:33:03 -0400297
Robert Craig7f2392e2013-03-27 08:35:39 -0400298$(LOCAL_BUILT_MODULE) : $(mac_perms_keys.tmp) $(HOST_OUT_EXECUTABLES)/insertkeys.py $(ALL_MAC_PERMS_FILES)
Geremy Condracd4104e2013-03-26 18:19:12 +0000299 @mkdir -p $(dir $@)
Nick Kralevichc3c90522013-10-25 12:25:36 -0700300 $(hide) DEFAULT_SYSTEM_DEV_CERTIFICATE="$(dir $(DEFAULT_SYSTEM_DEV_CERTIFICATE))" \
301 $(HOST_OUT_EXECUTABLES)/insertkeys.py -t $(TARGET_BUILD_VARIANT) -c $(TOP) $< -o $@ $(ALL_MAC_PERMS_FILES)
Geremy Condracd4104e2013-03-26 18:19:12 +0000302
Robert Craig7f2392e2013-03-27 08:35:39 -0400303mac_perms_keys.tmp :=
rpcraigb19665c2012-07-30 09:33:03 -0400304##################################
Robert Craig8b7545b2014-03-20 09:35:08 -0400305include $(CLEAR_VARS)
306
307LOCAL_MODULE := selinux_version
308LOCAL_MODULE_CLASS := ETC
309LOCAL_MODULE_TAGS := optional
310LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
311
312include $(BUILD_SYSTEM)/base_rules.mk
Riley Spahnf90c41f2014-06-05 15:52:02 -0700313$(LOCAL_BUILT_MODULE) : $(built_sepolicy) $(built_pc) $(built_fc) $(built_sc) $(built_svc)
Robert Craig8b7545b2014-03-20 09:35:08 -0400314 @mkdir -p $(dir $@)
315 $(hide) echo -n $(BUILD_FINGERPRINT) > $@
316
317##################################
rpcraig47cd3962012-10-17 21:09:52 -0400318
319build_policy :=
dcashman704741a2014-07-25 19:11:52 -0700320sepolicy_build_files :=
Robert Craig8b7545b2014-03-20 09:35:08 -0400321built_sepolicy :=
322built_sc :=
323built_fc :=
324built_pc :=
Riley Spahnf90c41f2014-06-05 15:52:02 -0700325built_svc :=
Alice Chucdfb06f2012-11-01 11:33:04 -0700326
327include $(call all-makefiles-under,$(LOCAL_PATH))