blob: 24176e84d2ea499ef20c96f27699c8553f09b6bf [file] [log] [blame]
Stephen Smalley2dd4e512012-01-04 12:33:27 -05001LOCAL_PATH:= $(call my-dir)
William Robertsf0e0a942012-08-27 15:41:15 -07002
Dan Cashman36ee91d2017-07-07 14:59:51 -07003include $(LOCAL_PATH)/definitions.mk
4
Stephen Smalley2dd4e512012-01-04 12:33:27 -05005include $(CLEAR_VARS)
Stephen Smalley2dd4e512012-01-04 12:33:27 -05006# SELinux policy version.
Stephen Smalleyb4f17062015-03-13 10:03:52 -04007# Must be <= /sys/fs/selinux/policyvers reported by the Android kernel.
Stephen Smalley2dd4e512012-01-04 12:33:27 -05008# Must be within the compatibility range reported by checkpolicy -V.
Jeff Vander Stoep3a0ce492015-12-07 08:30:43 -08009POLICYVERS ?= 30
Stephen Smalley2dd4e512012-01-04 12:33:27 -050010
11MLS_SENS=1
12MLS_CATS=1024
13
Stephen Smalleyb4f17062015-03-13 10:03:52 -040014ifdef BOARD_SEPOLICY_REPLACE
15$(error BOARD_SEPOLICY_REPLACE is no longer supported; please remove from your BoardConfig.mk or other .mk file.)
16endif
17
18ifdef BOARD_SEPOLICY_IGNORE
19$(error BOARD_SEPOLICY_IGNORE is no longer supported; please remove from your BoardConfig.mk or other .mk file.)
20endif
Stephen Smalley5b340be2012-03-06 11:12:41 -050021
Stephen Smalley8e0ca882015-04-01 10:14:56 -040022ifdef BOARD_SEPOLICY_UNION
23$(warning BOARD_SEPOLICY_UNION is no longer required - all files found in BOARD_SEPOLICY_DIRS are implicitly unioned; please remove from your BoardConfig.mk or other .mk file.)
24endif
Robert Craig6b0ff472014-01-29 13:10:58 -050025
William Robertsd2185582015-07-16 11:28:02 -070026ifdef BOARD_SEPOLICY_M4DEFS
27LOCAL_ADDITIONAL_M4DEFS := $(addprefix -D, $(BOARD_SEPOLICY_M4DEFS))
Dan Cashman36ee91d2017-07-07 14:59:51 -070028else
29LOCAL_ADDITIONAL_M4DEFS :=
William Robertsd2185582015-07-16 11:28:02 -070030endif
31
dcashmancc39f632016-07-22 13:13:11 -070032# sepolicy is now divided into multiple portions:
33# public - policy exported on which non-platform policy developers may write
34# additional policy. types and attributes are versioned and included in
35# delivered non-platform policy, which is to be combined with platform policy.
36# private - platform-only policy required for platform functionality but which
37# is not exported to vendor policy developers and as such may not be assumed
38# to exist.
Alex Klyubin55961722017-01-30 18:44:59 -080039# vendor - vendor-only policy required for vendor functionality. This policy can
40# reference the public policy but cannot reference the private policy. This
41# policy is for components which are produced from the core/non-vendor tree and
42# placed into a vendor partition.
dcashman07791552016-12-07 11:27:47 -080043# mapping - This contains policy statements which map the attributes
dcashmancc39f632016-07-22 13:13:11 -070044# exposed in the public policy of previous versions to the concrete types used
45# in this policy to ensure that policy targeting attributes from public
46# policy from an older platform version continues to work.
47
dcashman2e00e632016-10-12 14:58:09 -070048# build process for device:
dcashmancc39f632016-07-22 13:13:11 -070049# 1) convert policies to CIL:
50# - private + public platform policy to CIL
51# - mapping file to CIL (should already be in CIL form)
52# - non-platform public policy to CIL
53# - non-platform public + private policy to CIL
54# 2) attributize policy
dcashmancc39f632016-07-22 13:13:11 -070055# - run script which takes non-platform public and non-platform combined
56# private + public policy and produces attributized and versioned
57# non-platform policy
58# 3) combine policy files
59# - combine mapping, platform and non-platform policy.
60# - compile output binary policy file
61
62PLAT_PUBLIC_POLICY := $(LOCAL_PATH)/public
Dan Cashman51455fe2017-05-23 14:47:16 -070063ifneq ( ,$(BOARD_PLAT_PUBLIC_SEPOLICY_DIR))
64ifneq (1, $(words $(BOARD_PLAT_PUBLIC_SEPOLICY_DIR)))
65$(error BOARD_PLAT_PUBLIC_SEPOLICY_DIR must only contain one directory)
66else
67PLAT_PUBLIC_POLICY += $(BOARD_PLAT_PUBLIC_SEPOLICY_DIR)
68endif
69endif
dcashmancc39f632016-07-22 13:13:11 -070070PLAT_PRIVATE_POLICY := $(LOCAL_PATH)/private
Dan Cashman51455fe2017-05-23 14:47:16 -070071ifneq ( ,$(BOARD_PLAT_PRIVATE_SEPOLICY_DIR))
72ifneq (1, $(words $(BOARD_PLAT_PRIVATE_SEPOLICY_DIR)))
73$(error BOARD_PLAT_PRIVATE_SEPOLICY_DIR must only contain one directory)
74else
75PLAT_PRIVATE_POLICY += $(BOARD_PLAT_PRIVATE_SEPOLICY_DIR)
76endif
77endif
Alex Klyubin55961722017-01-30 18:44:59 -080078PLAT_VENDOR_POLICY := $(LOCAL_PATH)/vendor
dcashman2e00e632016-10-12 14:58:09 -070079REQD_MASK_POLICY := $(LOCAL_PATH)/reqd_mask
80
81# TODO: move to README when doing the README update and finalizing versioning.
Sandeep Patil42f95982017-04-07 14:18:48 -070082# BOARD_SEPOLICY_VERS must take the format "NN.m" and contain the sepolicy
83# version identifier corresponding to the sepolicy on which the non-platform
84# policy is to be based. If unspecified, this will build against the current
85# public platform policy in tree
dcashman2e00e632016-10-12 14:58:09 -070086ifndef BOARD_SEPOLICY_VERS
87$(warning BOARD_SEPOLICY_VERS not specified, assuming current platform version)
Sandeep Patil42f95982017-04-07 14:18:48 -070088# The default platform policy version.
Dan Cashman6f14f6b2017-04-07 16:36:23 -070089BOARD_SEPOLICY_VERS := $(PLATFORM_SEPOLICY_VERSION)
dcashman2e00e632016-10-12 14:58:09 -070090endif
dcashmancc39f632016-07-22 13:13:11 -070091
Joel Galenson5988b562018-01-03 16:53:24 -080092NEVERALLOW_ARG :=
93ifeq ($(SELINUX_IGNORE_NEVERALLOWS),true)
94ifeq ($(TARGET_BUILD_VARIANT),user)
95$(error SELINUX_IGNORE_NEVERALLOWS := true cannot be used in user builds)
96endif
97$(warning Be careful when using the SELINUX_IGNORE_NEVERALLOWS flag. \
98 It does not work in user builds and using it will \
99 not stop you from failing CTS.)
100NEVERALLOW_ARG := -N
101endif
102
Bowgo Tsai45457e32017-11-27 11:41:33 +0800103# BOARD_SEPOLICY_DIRS was used for vendor/odm sepolicy customization before.
104# It has been replaced by BOARD_VENDOR_SEPOLICY_DIRS (mandatory) and
105# BOARD_ODM_SEPOLICY_DIRS (optional). BOARD_SEPOLICY_DIRS is still allowed for
106# backward compatibility, which will be merged into BOARD_VENDOR_SEPOLICY_DIRS.
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800107ifdef BOARD_SEPOLICY_DIRS
108BOARD_VENDOR_SEPOLICY_DIRS += $(BOARD_SEPOLICY_DIRS)
109endif
Dan Cashman4d24a772017-04-12 14:28:34 -0700110
Bowgo Tsai45457e32017-11-27 11:41:33 +0800111ifdef BOARD_ODM_SEPOLICY_DIRS
112ifneq ($(PRODUCT_SEPOLICY_SPLIT),true)
113$(error PRODUCT_SEPOLICY_SPLIT needs to be true when using BOARD_ODM_SEPOLICY_DIRS)
114endif
115endif
116
Dan Cashman4d24a772017-04-12 14:28:34 -0700117platform_mapping_file := $(BOARD_SEPOLICY_VERS).cil
118
dcashmancc39f632016-07-22 13:13:11 -0700119###########################################################
120# Compute policy files to be used in policy build.
121# $(1): files to include
122# $(2): directories in which to find files
123###########################################################
124
125define build_policy
126$(foreach type, $(1), $(foreach file, $(addsuffix /$(type), $(2)), $(sort $(wildcard $(file)))))
127endef
William Roberts29d14682016-01-04 12:20:57 -0800128
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800129# Builds paths for all policy files found in BOARD_VENDOR_SEPOLICY_DIRS.
William Roberts49693f12016-01-04 12:20:57 -0800130# $(1): the set of policy name paths to build
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800131build_vendor_policy = $(call build_policy, $(1), $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS))
William Roberts49693f12016-01-04 12:20:57 -0800132
Bowgo Tsaibae15172017-11-29 16:14:53 +0800133# Builds paths for all policy files found in BOARD_ODM_SEPOLICY_DIRS.
134build_odm_policy = $(call build_policy, $(1), $(BOARD_ODM_SEPOLICY_DIRS))
135
Richard Hainesc8801fe2015-12-11 10:39:19 +0000136# Add a file containing only a newline in-between each policy configuration
137# 'contexts' file. This will allow OEM policy configuration files without a
138# final newline (0x0A) to be built correctly by the m4(1) macro processor.
139# $(1): the set of contexts file names.
140# $(2): the file containing only 0x0A.
141add_nl = $(foreach entry, $(1), $(subst $(entry), $(entry) $(2), $(entry)))
142
dcashman704741a2014-07-25 19:11:52 -0700143sepolicy_build_files := security_classes \
144 initial_sids \
145 access_vectors \
146 global_macros \
Nick Kralevicha17a2662014-11-05 15:30:41 -0800147 neverallow_macros \
dcashman704741a2014-07-25 19:11:52 -0700148 mls_macros \
dcashman2e00e632016-10-12 14:58:09 -0700149 mls_decl \
dcashman704741a2014-07-25 19:11:52 -0700150 mls \
151 policy_capabilities \
152 te_macros \
153 attributes \
Jeff Vander Stoepcbaa2b72015-12-22 10:39:34 -0800154 ioctl_defines \
Jeff Vander Stoepde9b5302015-06-05 15:28:55 -0700155 ioctl_macros \
dcashman704741a2014-07-25 19:11:52 -0700156 *.te \
dcashman2e00e632016-10-12 14:58:09 -0700157 roles_decl \
dcashman704741a2014-07-25 19:11:52 -0700158 roles \
159 users \
160 initial_sid_contexts \
161 fs_use \
162 genfs_contexts \
163 port_contexts
164
Alex Klyubin7cda44f2017-03-21 14:28:53 -0700165# CIL files which contain workarounds for current limitation of human-readable
166# module policy language. These files are appended to the CIL files produced
167# from module language files.
168sepolicy_build_cil_workaround_files := technical_debt.cil
169
Dan Cashman1c040272016-12-15 15:28:44 -0800170my_target_arch := $(TARGET_ARCH)
171ifneq (,$(filter mips mips64,$(TARGET_ARCH)))
172 my_target_arch := mips
173endif
174
Jeff Vander Stoepd2053bd2017-03-15 13:37:35 -0700175intermediates := $(TARGET_OUT_INTERMEDIATES)/ETC/sepolicy_intermediates
176
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700177with_asan := false
178ifneq (,$(filter address,$(SANITIZE_TARGET)))
179 with_asan := true
180endif
181
Jeff Vander Stoep3ca843a2017-10-04 09:42:29 -0700182# Library extension for host-side tests
Jeff Vander Stoepe06e4c12017-10-04 18:15:44 -0700183ifeq ($(HOST_OS),darwin)
Jeff Vander Stoep3ca843a2017-10-04 09:42:29 -0700184SHAREDLIB_EXT=dylib
185else
186SHAREDLIB_EXT=so
187endif
188
Dan Cashman4f9a6482017-04-10 12:27:18 -0700189include $(CLEAR_VARS)
190LOCAL_MODULE := selinux_policy
191LOCAL_MODULE_TAGS := optional
192# Include SELinux policy. We do this here because different modules
Steven Moreland763697d2017-11-09 11:24:56 -0800193# need to be included based on the value of PRODUCT_SEPOLICY_SPLIT. This
Dan Cashman4f9a6482017-04-10 12:27:18 -0700194# type of conditional inclusion cannot be done in top-level files such
195# as build/target/product/embedded.mk.
196# This conditional inclusion closely mimics the conditional logic
197# inside init/init.cpp for loading SELinux policy from files.
Steven Moreland763697d2017-11-09 11:24:56 -0800198ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Dan Cashman4f9a6482017-04-10 12:27:18 -0700199
Dan Cashman4f9a6482017-04-10 12:27:18 -0700200# Use split SELinux policy
201LOCAL_REQUIRED_MODULES += \
202 $(platform_mapping_file) \
Yifan Hong617e8532018-02-07 11:13:57 -0800203 $(addsuffix .cil,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS)) \
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800204 plat_pub_versioned.cil \
205 vendor_sepolicy.cil \
Dan Cashman4f9a6482017-04-10 12:27:18 -0700206 plat_sepolicy.cil \
207 plat_and_mapping_sepolicy.cil.sha256 \
208 secilc \
Jeff Vander Stoep1fc06822017-05-31 15:36:07 -0700209 plat_sepolicy_vers.txt \
Dan Cashman91d398d2017-09-26 12:58:29 -0700210
Dan Cashman4f9a6482017-04-10 12:27:18 -0700211# Include precompiled policy, unless told otherwise
212ifneq ($(PRODUCT_PRECOMPILED_SEPOLICY),false)
213LOCAL_REQUIRED_MODULES += precompiled_sepolicy precompiled_sepolicy.plat_and_mapping.sha256
214endif
Dan Cashman4f9a6482017-04-10 12:27:18 -0700215else
Bowgo Tsai741a70a2018-02-05 17:41:02 +0800216# The following files are only allowed for non-Treble devices.
217LOCAL_REQUIRED_MODULES += \
218 sepolicy \
219 vendor_service_contexts
Dan Cashman4f9a6482017-04-10 12:27:18 -0700220endif
Jeff Vander Stoep7a68c5a2017-06-08 13:24:15 -0700221
222LOCAL_REQUIRED_MODULES += \
Bowgo Tsai741a70a2018-02-05 17:41:02 +0800223 build_sepolicy \
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800224 vendor_file_contexts \
225 vendor_mac_permissions.xml \
226 vendor_property_contexts \
227 vendor_seapp_contexts \
228 vendor_hwservice_contexts \
Jeff Vander Stoep13fb5ed2017-08-22 13:29:53 -0700229 plat_file_contexts \
230 plat_mac_permissions.xml \
231 plat_property_contexts \
232 plat_seapp_contexts \
233 plat_service_contexts \
234 plat_hwservice_contexts \
Dan Cashman91d398d2017-09-26 12:58:29 -0700235 searchpolicy \
Jeff Vander Stoep13fb5ed2017-08-22 13:29:53 -0700236 vndservice_contexts \
Jeff Vander Stoep7a68c5a2017-06-08 13:24:15 -0700237
Dan Cashman91d398d2017-09-26 12:58:29 -0700238ifneq ($(TARGET_BUILD_VARIANT), user)
239LOCAL_REQUIRED_MODULES += \
240 selinux_denial_metadata \
241
242endif
243
244ifneq ($(with_asan),true)
Jeff Vander Stoep3d4965b2018-02-13 20:29:55 -0800245ifneq ($(SELINUX_IGNORE_NEVERALLOWS),true)
Dan Cashman91d398d2017-09-26 12:58:29 -0700246LOCAL_REQUIRED_MODULES += \
247 sepolicy_tests \
Tri Vo14069262018-01-31 16:22:35 -0800248 treble_sepolicy_tests_26.0 \
Tri Vo9299d932018-01-31 16:50:28 -0800249 treble_sepolicy_tests_27.0 \
Dan Cashman91d398d2017-09-26 12:58:29 -0700250
251endif
Jeff Vander Stoep3d4965b2018-02-13 20:29:55 -0800252endif
Dan Cashman91d398d2017-09-26 12:58:29 -0700253
Bowgo Tsai45457e32017-11-27 11:41:33 +0800254ifdef BOARD_ODM_SEPOLICY_DIRS
Bowgo Tsaibae15172017-11-29 16:14:53 +0800255LOCAL_REQUIRED_MODULES += \
256 odm_sepolicy.cil \
Bowgo Tsaiecf656b2017-11-29 16:15:28 +0800257 odm_file_contexts \
Bowgo Tsai1f717b12017-11-29 16:15:55 +0800258 odm_seapp_contexts \
259 odm_property_contexts
Bowgo Tsai45457e32017-11-27 11:41:33 +0800260endif
261
Dan Cashman4f9a6482017-04-10 12:27:18 -0700262include $(BUILD_PHONY_PACKAGE)
263
Joel Galenson5988b562018-01-03 16:53:24 -0800264#################################
265include $(CLEAR_VARS)
266
267LOCAL_MODULE := sepolicy_neverallows
268LOCAL_MODULE_CLASS := ETC
269LOCAL_MODULE_TAGS := optional
270LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
271
272include $(BUILD_SYSTEM)/base_rules.mk
273
274# sepolicy_policy.conf - All of the policy for the device. This is only used to
275# check neverallow rules.
276sepolicy_policy.conf := $(intermediates)/policy.conf
277$(sepolicy_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
278$(sepolicy_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Joel Galenson8c72eea2018-03-07 15:36:29 -0800279$(sepolicy_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := user
Joel Galenson5988b562018-01-03 16:53:24 -0800280$(sepolicy_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
281$(sepolicy_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
282$(sepolicy_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
283$(sepolicy_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
284$(sepolicy_policy.conf): $(call build_policy, $(sepolicy_build_files), \
285$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS))
286 $(transform-policy-to-conf)
287 $(hide) sed '/dontaudit/d' $@ > $@.dontaudit
288
289$(LOCAL_BUILT_MODULE): $(sepolicy_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy
290 rm -f $@
291ifneq ($(SELINUX_IGNORE_NEVERALLOWS),true)
292 $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c \
293 $(POLICYVERS) -o $@ $<
294else # ($(SELINUX_IGNORE_NEVERALLOWS),true)
295 $(hide) touch $@
296endif # ($(SELINUX_IGNORE_NEVERALLOWS),true)
297
298sepolicy_policy.conf :=
299built_sepolicy_neverallows := $(LOCAL_BUILT_MODULE)
300
Ying Wang02fb5f32012-01-17 17:51:09 -0800301##################################
dcashman2e00e632016-10-12 14:58:09 -0700302# reqd_policy_mask - a policy.conf file which contains only the bare minimum
303# policy necessary to use checkpolicy. This bare-minimum policy needs to be
304# present in all policy.conf files, but should not necessarily be exported as
305# part of the public policy. The rules generated by reqd_policy_mask will allow
306# the compilation of public policy and subsequent removal of CIL policy that
307# should not be exported.
308
309reqd_policy_mask.conf := $(intermediates)/reqd_policy_mask.conf
310$(reqd_policy_mask.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
311$(reqd_policy_mask.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Joel Galenson8c72eea2018-03-07 15:36:29 -0800312$(reqd_policy_mask.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
Dan Cashman1c040272016-12-15 15:28:44 -0800313$(reqd_policy_mask.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700314$(reqd_policy_mask.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
dcashman2e00e632016-10-12 14:58:09 -0700315$(reqd_policy_mask.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Steven Moreland763697d2017-11-09 11:24:56 -0800316$(reqd_policy_mask.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
Jaekyun Seoke4971452017-10-19 16:54:49 +0900317$(reqd_policy_mask.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
dcashman2e00e632016-10-12 14:58:09 -0700318$(reqd_policy_mask.conf): $(call build_policy, $(sepolicy_build_files), $(REQD_MASK_POLICY))
Dan Cashman36ee91d2017-07-07 14:59:51 -0700319 $(transform-policy-to-conf)
Andreas Gampe3ddc78b2017-04-27 17:16:13 -0700320# b/37755687
321CHECKPOLICY_ASAN_OPTIONS := ASAN_OPTIONS=detect_leaks=0
322
dcashman2e00e632016-10-12 14:58:09 -0700323reqd_policy_mask.cil := $(intermediates)/reqd_policy_mask.cil
324$(reqd_policy_mask.cil): $(reqd_policy_mask.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy
325 @mkdir -p $(dir $@)
Andreas Gampe3ddc78b2017-04-27 17:16:13 -0700326 $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -C -M -c \
327 $(POLICYVERS) -o $@ $<
dcashman2e00e632016-10-12 14:58:09 -0700328
dcashman1faa6442016-11-28 07:20:28 -0800329reqd_policy_mask.conf :=
330
331##################################
dcashman2e00e632016-10-12 14:58:09 -0700332# plat_pub_policy - policy that will be exported to be a part of non-platform
333# policy corresponding to this platform version. This is a limited subset of
334# policy that would not compile in checkpolicy on its own. To get around this
335# limitation, add only the required files from private policy, which will
336# generate CIL policy that will then be filtered out by the reqd_policy_mask.
337plat_pub_policy.conf := $(intermediates)/plat_pub_policy.conf
338$(plat_pub_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
339$(plat_pub_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Joel Galenson8c72eea2018-03-07 15:36:29 -0800340$(plat_pub_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
Dan Cashman1c040272016-12-15 15:28:44 -0800341$(plat_pub_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700342$(plat_pub_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
dcashman2e00e632016-10-12 14:58:09 -0700343$(plat_pub_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Steven Moreland763697d2017-11-09 11:24:56 -0800344$(plat_pub_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
Jaekyun Seoke4971452017-10-19 16:54:49 +0900345$(plat_pub_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
dcashman2e00e632016-10-12 14:58:09 -0700346$(plat_pub_policy.conf): $(call build_policy, $(sepolicy_build_files), \
Dan Cashman6bf50e52017-04-12 11:12:17 -0700347$(PLAT_PUBLIC_POLICY) $(REQD_MASK_POLICY))
Dan Cashman36ee91d2017-07-07 14:59:51 -0700348 $(transform-policy-to-conf)
dcashman2e00e632016-10-12 14:58:09 -0700349plat_pub_policy.cil := $(intermediates)/plat_pub_policy.cil
dcashman1faa6442016-11-28 07:20:28 -0800350$(plat_pub_policy.cil): PRIVATE_POL_CONF := $(plat_pub_policy.conf)
351$(plat_pub_policy.cil): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil)
352$(plat_pub_policy.cil): $(HOST_OUT_EXECUTABLES)/checkpolicy $(plat_pub_policy.conf) $(reqd_policy_mask.cil)
dcashman2e00e632016-10-12 14:58:09 -0700353 @mkdir -p $(dir $@)
Andreas Gampe3ddc78b2017-04-27 17:16:13 -0700354 $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $< -C -M -c $(POLICYVERS) -o $@.tmp $(PRIVATE_POL_CONF)
dcashman1faa6442016-11-28 07:20:28 -0800355 $(hide) grep -Fxv -f $(PRIVATE_REQD_MASK) $@.tmp > $@
dcashman2e00e632016-10-12 14:58:09 -0700356
dcashman1faa6442016-11-28 07:20:28 -0800357plat_pub_policy.conf :=
Dan Cashman1c040272016-12-15 15:28:44 -0800358
dcashman1faa6442016-11-28 07:20:28 -0800359##################################
360include $(CLEAR_VARS)
361
362LOCAL_MODULE := sectxfile_nl
363LOCAL_MODULE_CLASS := ETC
364LOCAL_MODULE_TAGS := optional
365
366# Create a file containing newline only to add between context config files
367include $(BUILD_SYSTEM)/base_rules.mk
368$(LOCAL_BUILT_MODULE):
dcashman2e00e632016-10-12 14:58:09 -0700369 @mkdir -p $(dir $@)
dcashman1faa6442016-11-28 07:20:28 -0800370 $(hide) echo > $@
371
372built_nl := $(LOCAL_BUILT_MODULE)
373
374#################################
375include $(CLEAR_VARS)
376
377LOCAL_MODULE := plat_sepolicy.cil
378LOCAL_MODULE_CLASS := ETC
379LOCAL_MODULE_TAGS := optional
Alex Klyubin052b0bb2017-03-02 12:39:25 -0800380LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
dcashman1faa6442016-11-28 07:20:28 -0800381
382include $(BUILD_SYSTEM)/base_rules.mk
dcashman2e00e632016-10-12 14:58:09 -0700383
384# plat_policy.conf - A combination of the private and public platform policy
385# which will ship with the device. The platform will always reflect the most
386# recent platform version and is not currently being attributized.
387plat_policy.conf := $(intermediates)/plat_policy.conf
388$(plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
389$(plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Joel Galenson8c72eea2018-03-07 15:36:29 -0800390$(plat_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
Dan Cashman1c040272016-12-15 15:28:44 -0800391$(plat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700392$(plat_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
dcashman2e00e632016-10-12 14:58:09 -0700393$(plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Steven Moreland763697d2017-11-09 11:24:56 -0800394$(plat_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
Jaekyun Seoke4971452017-10-19 16:54:49 +0900395$(plat_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
dcashman2e00e632016-10-12 14:58:09 -0700396$(plat_policy.conf): $(call build_policy, $(sepolicy_build_files), \
dcashmancc39f632016-07-22 13:13:11 -0700397$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY))
Dan Cashman36ee91d2017-07-07 14:59:51 -0700398 $(transform-policy-to-conf)
dcashmancc39f632016-07-22 13:13:11 -0700399 $(hide) sed '/dontaudit/d' $@ > $@.dontaudit
400
Jeff Vander Stoepb8787692017-04-21 15:57:07 -0700401$(LOCAL_BUILT_MODULE): PRIVATE_ADDITIONAL_CIL_FILES := \
Alex Klyubin7cda44f2017-03-21 14:28:53 -0700402 $(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY))
Joel Galenson5988b562018-01-03 16:53:24 -0800403$(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
Jeff Vander Stoepb8787692017-04-21 15:57:07 -0700404$(LOCAL_BUILT_MODULE): $(plat_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
405 $(HOST_OUT_EXECUTABLES)/secilc \
Joel Galenson5988b562018-01-03 16:53:24 -0800406 $(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY)) \
407 $(built_sepolicy_neverallows)
dcashman2e00e632016-10-12 14:58:09 -0700408 @mkdir -p $(dir $@)
Andreas Gampe3ddc78b2017-04-27 17:16:13 -0700409 $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \
410 $(POLICYVERS) -o $@ $<
Alex Klyubin7cda44f2017-03-21 14:28:53 -0700411 $(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@
Joel Galenson5988b562018-01-03 16:53:24 -0800412 $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $@ -o /dev/null -f /dev/null
dcashman1faa6442016-11-28 07:20:28 -0800413
Alex Klyubin8f7173b2017-02-25 14:47:53 -0800414built_plat_cil := $(LOCAL_BUILT_MODULE)
dcashman1faa6442016-11-28 07:20:28 -0800415plat_policy.conf :=
416
417#################################
418include $(CLEAR_VARS)
419
Dan Cashman4f9a6482017-04-10 12:27:18 -0700420LOCAL_MODULE := plat_sepolicy_vers.txt
dcashman1faa6442016-11-28 07:20:28 -0800421LOCAL_MODULE_CLASS := ETC
422LOCAL_MODULE_TAGS := optional
Dan Cashman4f9a6482017-04-10 12:27:18 -0700423LOCAL_PROPRIETARY_MODULE := true
424LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
425
426include $(BUILD_SYSTEM)/base_rules.mk
427
428$(LOCAL_BUILT_MODULE) : PRIVATE_PLAT_SEPOL_VERS := $(BOARD_SEPOLICY_VERS)
429$(LOCAL_BUILT_MODULE) :
430 mkdir -p $(dir $@)
431 echo $(PRIVATE_PLAT_SEPOL_VERS) > $@
432
433#################################
434include $(CLEAR_VARS)
435
436LOCAL_MODULE := $(platform_mapping_file)
437LOCAL_MODULE_CLASS := ETC
438LOCAL_MODULE_TAGS := optional
439LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux/mapping
dcashman1faa6442016-11-28 07:20:28 -0800440
441include $(BUILD_SYSTEM)/base_rules.mk
442
Dan Cashman1b0a71f2017-05-08 14:26:52 -0700443current_mapping.cil := $(intermediates)/mapping/$(PLATFORM_SEPOLICY_VERSION).cil
444ifeq ($(BOARD_SEPOLICY_VERS), $(PLATFORM_SEPOLICY_VERSION))
dcashman1faa6442016-11-28 07:20:28 -0800445# auto-generate the mapping file for current platform policy, since it needs to
446# track platform policy development
Dan Cashman6f14f6b2017-04-07 16:36:23 -0700447$(current_mapping.cil) : PRIVATE_VERS := $(PLATFORM_SEPOLICY_VERSION)
dcashman1faa6442016-11-28 07:20:28 -0800448$(current_mapping.cil) : $(plat_pub_policy.cil) $(HOST_OUT_EXECUTABLES)/version_policy
449 @mkdir -p $(dir $@)
450 $(hide) $(HOST_OUT_EXECUTABLES)/version_policy -b $< -m -n $(PRIVATE_VERS) -o $@
451
Dan Cashman1b0a71f2017-05-08 14:26:52 -0700452else # ifeq ($(BOARD_SEPOLICY_VERS), $(PLATFORM_SEPOLICY_VERSION))
453prebuilt_mapping_files := $(wildcard $(addsuffix /mapping/$(BOARD_SEPOLICY_VERS).cil, $(PLAT_PRIVATE_POLICY)))
454$(current_mapping.cil) : $(prebuilt_mapping_files)
455 @mkdir -p $(dir $@)
456 cat $^ > $@
Sandeep Patil42f95982017-04-07 14:18:48 -0700457
Dan Cashman1b0a71f2017-05-08 14:26:52 -0700458prebuilt_mapping_files :=
dcashman1faa6442016-11-28 07:20:28 -0800459endif
460
Dan Cashman1b0a71f2017-05-08 14:26:52 -0700461$(LOCAL_BUILT_MODULE): $(current_mapping.cil) $(ACP)
Jeff Vander Stoepb8787692017-04-21 15:57:07 -0700462 $(hide) $(ACP) $< $@
dcashman1faa6442016-11-28 07:20:28 -0800463
Alex Klyubin8f7173b2017-02-25 14:47:53 -0800464built_mapping_cil := $(LOCAL_BUILT_MODULE)
dcashman1faa6442016-11-28 07:20:28 -0800465current_mapping.cil :=
466
467#################################
468include $(CLEAR_VARS)
469
Tri Vofb558082018-01-31 18:07:24 -0800470LOCAL_MODULE := 27.0.cil
471LOCAL_SRC_FILES := private/compat/27.0/27.0.cil
472LOCAL_MODULE_CLASS := ETC
473LOCAL_MODULE_TAGS := optional
474LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux/mapping
475
476include $(BUILD_PREBUILT)
477#################################
478include $(CLEAR_VARS)
479
Dan Cashmanc96721e2017-09-28 15:06:39 -0700480LOCAL_MODULE := 26.0.cil
481LOCAL_SRC_FILES := private/compat/26.0/26.0.cil
482LOCAL_MODULE_CLASS := ETC
483LOCAL_MODULE_TAGS := optional
484LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux/mapping
485
486include $(BUILD_PREBUILT)
487#################################
488include $(CLEAR_VARS)
489
Dan Cashman0e9c47c2017-04-04 14:27:41 -0700490LOCAL_MODULE := plat_and_mapping_sepolicy.cil.sha256
491LOCAL_MODULE_CLASS := ETC
492LOCAL_MODULE_TAGS := optional
493LOCAL_MODULE_PATH = $(TARGET_OUT)/etc/selinux
494
495include $(BUILD_SYSTEM)/base_rules.mk
496
497$(LOCAL_BUILT_MODULE): $(built_plat_cil) $(built_mapping_cil)
498 cat $^ | sha256sum | cut -d' ' -f1 > $@
499
500#################################
501include $(CLEAR_VARS)
502
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800503# plat_pub_versioned.cil - the exported platform policy associated with the version
504# that non-platform policy targets.
505LOCAL_MODULE := plat_pub_versioned.cil
dcashman1faa6442016-11-28 07:20:28 -0800506LOCAL_MODULE_CLASS := ETC
507LOCAL_MODULE_TAGS := optional
Alex Klyubin052b0bb2017-03-02 12:39:25 -0800508LOCAL_PROPRIETARY_MODULE := true
509LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
dcashman1faa6442016-11-28 07:20:28 -0800510
511include $(BUILD_SYSTEM)/base_rules.mk
512
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800513$(LOCAL_BUILT_MODULE) : PRIVATE_VERS := $(BOARD_SEPOLICY_VERS)
514$(LOCAL_BUILT_MODULE) : PRIVATE_TGT_POL := $(plat_pub_policy.cil)
515$(LOCAL_BUILT_MODULE) : PRIVATE_DEP_CIL_FILES := $(built_plat_cil) $(built_mapping_cil)
516$(LOCAL_BUILT_MODULE) : $(plat_pub_policy.cil) $(HOST_OUT_EXECUTABLES)/version_policy \
517 $(HOST_OUT_EXECUTABLES)/secilc $(built_plat_cil) $(built_mapping_cil)
518 @mkdir -p $(dir $@)
519 $(HOST_OUT_EXECUTABLES)/version_policy -b $< -t $(PRIVATE_TGT_POL) -n $(PRIVATE_VERS) -o $@
520 $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -N -c $(POLICYVERS) \
521 $(PRIVATE_DEP_CIL_FILES) $@ -o /dev/null -f /dev/null
522
523built_plat_pub_vers_cil := $(LOCAL_BUILT_MODULE)
524
525#################################
526include $(CLEAR_VARS)
527
528# vendor_policy.cil - the vendor sepolicy. This needs attributization and to be combined
529# with the platform-provided policy. It makes use of the reqd_policy_mask files from private
530# policy and the platform public policy files in order to use checkpolicy.
531LOCAL_MODULE := vendor_sepolicy.cil
532LOCAL_MODULE_CLASS := ETC
533LOCAL_MODULE_TAGS := optional
534LOCAL_PROPRIETARY_MODULE := true
535LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
536
537include $(BUILD_SYSTEM)/base_rules.mk
538
539vendor_policy.conf := $(intermediates)/vendor_policy.conf
540$(vendor_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
541$(vendor_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Joel Galenson8c72eea2018-03-07 15:36:29 -0800542$(vendor_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800543$(vendor_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
544$(vendor_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
545$(vendor_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
546$(vendor_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
547$(vendor_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
548$(vendor_policy.conf): $(call build_policy, $(sepolicy_build_files), \
549$(PLAT_PUBLIC_POLICY) $(REQD_MASK_POLICY) $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS))
Dan Cashman36ee91d2017-07-07 14:59:51 -0700550 $(transform-policy-to-conf)
Robert Craig65d4f442013-03-27 06:30:25 -0400551 $(hide) sed '/dontaudit/d' $@ > $@.dontaudit
Stephen Smalley2dd4e512012-01-04 12:33:27 -0500552
Bowgo Tsai741a70a2018-02-05 17:41:02 +0800553$(LOCAL_BUILT_MODULE): PRIVATE_POL_CONF := $(vendor_policy.conf)
554$(LOCAL_BUILT_MODULE): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil)
555$(LOCAL_BUILT_MODULE): PRIVATE_BASE_CIL := $(plat_pub_policy.cil)
556$(LOCAL_BUILT_MODULE): PRIVATE_VERS := $(BOARD_SEPOLICY_VERS)
557$(LOCAL_BUILT_MODULE): PRIVATE_DEP_CIL_FILES := $(built_plat_cil) $(built_plat_pub_vers_cil) $(built_mapping_cil)
558$(LOCAL_BUILT_MODULE): PRIVATE_FILTER_CIL := $(built_plat_pub_vers_cil)
559$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/build_sepolicy \
560 $(vendor_policy.conf) $(reqd_policy_mask.cil) $(plat_pub_policy.cil) \
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800561 $(built_plat_cil) $(built_plat_pub_vers_cil) $(built_mapping_cil)
dcashman2e00e632016-10-12 14:58:09 -0700562 @mkdir -p $(dir $@)
Bowgo Tsai741a70a2018-02-05 17:41:02 +0800563 $(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) build_cil \
564 -i $(PRIVATE_POL_CONF) -m $(PRIVATE_REQD_MASK) -c $(CHECKPOLICY_ASAN_OPTIONS) \
565 -b $(PRIVATE_BASE_CIL) -d $(PRIVATE_DEP_CIL_FILES) -f $(PRIVATE_FILTER_CIL) \
566 -t $(PRIVATE_VERS) -p $(POLICYVERS) -o $@
dcashman2e00e632016-10-12 14:58:09 -0700567
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800568built_vendor_cil := $(LOCAL_BUILT_MODULE)
569vendor_policy.conf :=
dcashman1faa6442016-11-28 07:20:28 -0800570
571#################################
572include $(CLEAR_VARS)
Alex Klyubin193dccd2017-03-07 14:05:57 -0800573
Bowgo Tsai45457e32017-11-27 11:41:33 +0800574# odm_policy.cil - the odm sepolicy. This needs attributization and to be combined
575# with the platform-provided policy. It makes use of the reqd_policy_mask files from private
576# policy and the platform public policy files in order to use checkpolicy.
577LOCAL_MODULE := odm_sepolicy.cil
578LOCAL_MODULE_CLASS := ETC
579LOCAL_MODULE_TAGS := optional
580LOCAL_PROPRIETARY_MODULE := true
581LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux
582
583include $(BUILD_SYSTEM)/base_rules.mk
584
585odm_policy.conf := $(intermediates)/odm_policy.conf
586$(odm_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
587$(odm_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
588$(odm_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
589$(odm_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
590$(odm_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
591$(odm_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
592$(odm_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
593$(odm_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
594$(odm_policy.conf): $(call build_policy, $(sepolicy_build_files), \
595 $(PLAT_PUBLIC_POLICY) $(REQD_MASK_POLICY) $(PLAT_VENDOR_POLICY) \
596 $(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_ODM_SEPOLICY_DIRS))
597 $(transform-policy-to-conf)
598 $(hide) sed '/dontaudit/d' $@ > $@.dontaudit
599
600$(LOCAL_BUILT_MODULE): PRIVATE_POL_CONF := $(odm_policy.conf)
601$(LOCAL_BUILT_MODULE): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil)
602$(LOCAL_BUILT_MODULE): PRIVATE_BASE_CIL := $(plat_pub_policy.cil)
603$(LOCAL_BUILT_MODULE): PRIVATE_VERS := $(BOARD_SEPOLICY_VERS)
604$(LOCAL_BUILT_MODULE): PRIVATE_DEP_CIL_FILES := $(built_plat_cil) $(built_plat_pub_vers_cil) \
605 $(built_mapping_cil) $(built_vendor_cil)
606$(LOCAL_BUILT_MODULE) : PRIVATE_FILTER_CIL_FILES := $(built_plat_pub_vers_cil) $(built_vendor_cil)
607$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/build_sepolicy \
608 $(odm_policy.conf) $(reqd_policy_mask.cil) $(plat_pub_policy.cil) \
609 $(built_plat_cil) $(built_plat_pub_vers_cil) $(built_mapping_cil) $(built_vendor_cil)
610 @mkdir -p $(dir $@)
611 $(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) build_cil \
612 -i $(PRIVATE_POL_CONF) -m $(PRIVATE_REQD_MASK) -c $(CHECKPOLICY_ASAN_OPTIONS) \
613 -b $(PRIVATE_BASE_CIL) -d $(PRIVATE_DEP_CIL_FILES) -f $(PRIVATE_FILTER_CIL_FILES) \
614 -t $(PRIVATE_VERS) -p $(POLICYVERS) -o $@
615
616built_odm_cil := $(LOCAL_BUILT_MODULE)
617odm_policy.conf :=
618odm_policy_raw :=
619
620#################################
621include $(CLEAR_VARS)
622
Alex Klyubin193dccd2017-03-07 14:05:57 -0800623LOCAL_MODULE := precompiled_sepolicy
624LOCAL_MODULE_CLASS := ETC
625LOCAL_MODULE_TAGS := optional
626LOCAL_PROPRIETARY_MODULE := true
Bowgo Tsai45457e32017-11-27 11:41:33 +0800627
628ifeq ($(BOARD_USES_ODMIMAGE),true)
629LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux
630else
Alex Klyubin193dccd2017-03-07 14:05:57 -0800631LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
Bowgo Tsai45457e32017-11-27 11:41:33 +0800632endif
Alex Klyubin193dccd2017-03-07 14:05:57 -0800633
634include $(BUILD_SYSTEM)/base_rules.mk
635
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800636all_cil_files := \
637 $(built_plat_cil) \
638 $(built_mapping_cil) \
639 $(built_plat_pub_vers_cil) \
640 $(built_vendor_cil)
641
Bowgo Tsai45457e32017-11-27 11:41:33 +0800642ifdef BOARD_ODM_SEPOLICY_DIRS
643all_cil_files += $(built_odm_cil)
644endif
645
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800646$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(all_cil_files)
Joel Galenson5988b562018-01-03 16:53:24 -0800647$(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800648$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(all_cil_files) $(built_sepolicy_neverallows)
Joel Galenson5988b562018-01-03 16:53:24 -0800649 $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) \
Alex Klyubin193dccd2017-03-07 14:05:57 -0800650 $(PRIVATE_CIL_FILES) -o $@ -f /dev/null
651
652built_precompiled_sepolicy := $(LOCAL_BUILT_MODULE)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800653all_cil_files :=
Alex Klyubin193dccd2017-03-07 14:05:57 -0800654
655#################################
Dan Cashman0e9c47c2017-04-04 14:27:41 -0700656# SHA-256 digest of the plat_sepolicy.cil and mapping_sepolicy.cil files against
657# which precompiled_policy was built.
Alex Klyubin193dccd2017-03-07 14:05:57 -0800658#################################
659include $(CLEAR_VARS)
Dan Cashman0e9c47c2017-04-04 14:27:41 -0700660LOCAL_MODULE := precompiled_sepolicy.plat_and_mapping.sha256
Alex Klyubin193dccd2017-03-07 14:05:57 -0800661LOCAL_MODULE_CLASS := ETC
662LOCAL_MODULE_TAGS := optional
663LOCAL_PROPRIETARY_MODULE := true
Bowgo Tsai45457e32017-11-27 11:41:33 +0800664
665ifeq ($(BOARD_USES_ODMIMAGE),true)
666LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux
667else
Alex Klyubin193dccd2017-03-07 14:05:57 -0800668LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
Bowgo Tsai45457e32017-11-27 11:41:33 +0800669endif
Alex Klyubin193dccd2017-03-07 14:05:57 -0800670
671include $(BUILD_SYSTEM)/base_rules.mk
672
Dan Cashman0e9c47c2017-04-04 14:27:41 -0700673$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(built_plat_cil) $(built_mapping_cil)
674$(LOCAL_BUILT_MODULE): $(built_precompiled_sepolicy) $(built_plat_cil) $(built_mapping_cil)
675 cat $(PRIVATE_CIL_FILES) | sha256sum | cut -d' ' -f1 > $@
Alex Klyubin193dccd2017-03-07 14:05:57 -0800676
677#################################
678include $(CLEAR_VARS)
Dan Cashman1c040272016-12-15 15:28:44 -0800679# build this target so that we can still perform neverallow checks
dcashman1faa6442016-11-28 07:20:28 -0800680
681LOCAL_MODULE := sepolicy
682LOCAL_MODULE_CLASS := ETC
683LOCAL_MODULE_TAGS := optional
Daniel Cashman65d01342016-12-17 00:53:26 +0000684LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
dcashman2e00e632016-10-12 14:58:09 -0700685
dcashman1faa6442016-11-28 07:20:28 -0800686include $(BUILD_SYSTEM)/base_rules.mk
687
dcashman2e00e632016-10-12 14:58:09 -0700688all_cil_files := \
Jeff Vander Stoepb8787692017-04-21 15:57:07 -0700689 $(built_plat_cil) \
690 $(built_mapping_cil) \
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800691 $(built_plat_pub_vers_cil) \
692 $(built_vendor_cil)
dcashman2e00e632016-10-12 14:58:09 -0700693
Bowgo Tsai45457e32017-11-27 11:41:33 +0800694ifdef BOARD_ODM_SEPOLICY_DIRS
695all_cil_files += $(built_odm_cil)
696endif
697
dcashman2e00e632016-10-12 14:58:09 -0700698$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(all_cil_files)
Joel Galenson5988b562018-01-03 16:53:24 -0800699$(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
700$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $(all_cil_files) \
701$(built_sepolicy_neverallows)
dcashman2e00e632016-10-12 14:58:09 -0700702 @mkdir -p $(dir $@)
Joel Galenson5988b562018-01-03 16:53:24 -0800703 $(hide) $< -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $(PRIVATE_CIL_FILES) -o $@.tmp -f /dev/null
Nick Kralevichbca98ef2016-02-26 20:06:52 -0800704 $(hide) $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $@.tmp permissive > $@.permissivedomains
705 $(hide) if [ "$(TARGET_BUILD_VARIANT)" = "user" -a -s $@.permissivedomains ]; then \
706 echo "==========" 1>&2; \
707 echo "ERROR: permissive domains not allowed in user builds" 1>&2; \
708 echo "List of invalid domains:" 1>&2; \
709 cat $@.permissivedomains 1>&2; \
710 exit 1; \
711 fi
712 $(hide) mv $@.tmp $@
Ying Wang02fb5f32012-01-17 17:51:09 -0800713
Ying Wangd8b122c2012-10-25 19:01:31 -0700714built_sepolicy := $(LOCAL_BUILT_MODULE)
dcashman2e00e632016-10-12 14:58:09 -0700715all_cil_files :=
Stephen Smalley01a58af2012-10-02 12:46:37 -0400716
Alex Klyubin84aa7422017-03-10 09:36:07 -0800717#################################
718include $(CLEAR_VARS)
719
720# keep concrete sepolicy for neverallow checks
Joel Galenson5988b562018-01-03 16:53:24 -0800721# If SELINUX_IGNORE_NEVERALLOWS is set, we use sed to remove the neverallow lines before compiling.
Alex Klyubin84aa7422017-03-10 09:36:07 -0800722
723LOCAL_MODULE := sepolicy.recovery
Alex Klyubinec78c372017-03-10 12:44:16 -0800724LOCAL_MODULE_STEM := sepolicy
Alex Klyubin84aa7422017-03-10 09:36:07 -0800725LOCAL_MODULE_CLASS := ETC
726LOCAL_MODULE_TAGS := optional
Alex Klyubinec78c372017-03-10 12:44:16 -0800727LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
Alex Klyubin84aa7422017-03-10 09:36:07 -0800728
729include $(BUILD_SYSTEM)/base_rules.mk
730
Dan Cashmanc8d45352017-04-11 07:38:48 -0700731sepolicy.recovery.conf := $(intermediates)/sepolicy.recovery.conf
732$(sepolicy.recovery.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
733$(sepolicy.recovery.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Joel Galenson8c72eea2018-03-07 15:36:29 -0800734$(sepolicy.recovery.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
Dan Cashmanc8d45352017-04-11 07:38:48 -0700735$(sepolicy.recovery.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
736$(sepolicy.recovery.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
737$(sepolicy.recovery.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Dan Cashman36ee91d2017-07-07 14:59:51 -0700738$(sepolicy.recovery.conf): PRIVATE_TGT_RECOVERY := -D target_recovery=true
Dan Cashmanc8d45352017-04-11 07:38:48 -0700739$(sepolicy.recovery.conf): $(call build_policy, $(sepolicy_build_files), \
740 $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) \
Bowgo Tsai45457e32017-11-27 11:41:33 +0800741 $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) \
742 $(BOARD_ODM_SEPOLICY_DIRS))
Dan Cashman36ee91d2017-07-07 14:59:51 -0700743 $(transform-policy-to-conf)
Dan Cashman1c040272016-12-15 15:28:44 -0800744 $(hide) sed '/dontaudit/d' $@ > $@.dontaudit
Joel Galenson5988b562018-01-03 16:53:24 -0800745ifeq ($(SELINUX_IGNORE_NEVERALLOWS),true)
746 $(hide) sed -z 's/\n\s*neverallow[^;]*;/\n/g' $@ > $@.neverallow
747 $(hide) mv $@.neverallow $@
748endif
Dan Cashman1c040272016-12-15 15:28:44 -0800749
Dan Cashmanc8d45352017-04-11 07:38:48 -0700750$(LOCAL_BUILT_MODULE): $(sepolicy.recovery.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
751 $(HOST_OUT_EXECUTABLES)/sepolicy-analyze
Dan Cashman1c040272016-12-15 15:28:44 -0800752 @mkdir -p $(dir $@)
Andreas Gampe3ddc78b2017-04-27 17:16:13 -0700753 $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c \
754 $(POLICYVERS) -o $@.tmp $<
Nick Kralevichbca98ef2016-02-26 20:06:52 -0800755 $(hide) $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $@.tmp permissive > $@.permissivedomains
756 $(hide) if [ "$(TARGET_BUILD_VARIANT)" = "user" -a -s $@.permissivedomains ]; then \
757 echo "==========" 1>&2; \
758 echo "ERROR: permissive domains not allowed in user builds" 1>&2; \
759 echo "List of invalid domains:" 1>&2; \
760 cat $@.permissivedomains 1>&2; \
761 exit 1; \
762 fi
763 $(hide) mv $@.tmp $@
Stephen Smalleye60723a2014-05-29 16:40:15 -0400764
Dan Cashmanc8d45352017-04-11 07:38:48 -0700765sepolicy.recovery.conf :=
Stephen Smalleye60723a2014-05-29 16:40:15 -0400766
dcashman704741a2014-07-25 19:11:52 -0700767##################################
Alex Klyubin446279a2017-04-06 14:45:50 -0700768# SELinux policy embedded into CTS.
769# CTS checks neverallow rules of this policy against the policy of the device under test.
770##################################
dcashman704741a2014-07-25 19:11:52 -0700771include $(CLEAR_VARS)
772
773LOCAL_MODULE := general_sepolicy.conf
774LOCAL_MODULE_CLASS := ETC
775LOCAL_MODULE_TAGS := tests
776
777include $(BUILD_SYSTEM)/base_rules.mk
778
dcashman704741a2014-07-25 19:11:52 -0700779$(LOCAL_BUILT_MODULE): PRIVATE_MLS_SENS := $(MLS_SENS)
780$(LOCAL_BUILT_MODULE): PRIVATE_MLS_CATS := $(MLS_CATS)
Joel Galenson8c72eea2018-03-07 15:36:29 -0800781$(LOCAL_BUILT_MODULE): PRIVATE_TARGET_BUILD_VARIANT := user
Dan Cashman1c040272016-12-15 15:28:44 -0800782$(LOCAL_BUILT_MODULE): PRIVATE_TGT_ARCH := $(my_target_arch)
Dan Cashman36ee91d2017-07-07 14:59:51 -0700783$(LOCAL_BUILT_MODULE): PRIVATE_WITH_ASAN := false
Steven Moreland763697d2017-11-09 11:24:56 -0800784$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY_SPLIT := cts
Jaekyun Seok64ade652018-01-30 17:23:58 +0900785$(LOCAL_BUILT_MODULE): PRIVATE_COMPATIBLE_PROPERTY := cts
dcashmancc39f632016-07-22 13:13:11 -0700786$(LOCAL_BUILT_MODULE): $(call build_policy, $(sepolicy_build_files), \
787$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY))
Dan Cashman36ee91d2017-07-07 14:59:51 -0700788 $(transform-policy-to-conf)
dcashman704741a2014-07-25 19:11:52 -0700789 $(hide) sed '/dontaudit/d' $@ > $@.dontaudit
790
William Robertsb8769932015-06-29 16:31:23 -0700791##################################
dcashmand225b692016-12-12 09:29:04 -0800792# TODO - remove this. Keep around until we get the filesystem creation stuff taken care of.
793#
William Robertsb8769932015-06-29 16:31:23 -0700794include $(CLEAR_VARS)
795
Richard Hainesc2d01912015-08-06 17:43:52 +0100796LOCAL_MODULE := file_contexts.bin
Ying Wang02fb5f32012-01-17 17:51:09 -0800797LOCAL_MODULE_CLASS := ETC
798LOCAL_MODULE_TAGS := optional
799LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
800
Stephen Smalley5b340be2012-03-06 11:12:41 -0500801include $(BUILD_SYSTEM)/base_rules.mk
Ying Wang02fb5f32012-01-17 17:51:09 -0800802
William Roberts49693f12016-01-04 12:20:57 -0800803# The file_contexts.bin is built in the following way:
804# 1. Collect all file_contexts files in THIS repository and process them with
805# m4 into a tmp file called file_contexts.local.tmp.
806# 2. Collect all device specific file_contexts files and process them with m4
807# into a tmp file called file_contexts.device.tmp.
808# 3. Run checkfc -e (allow no device fc entries ie empty) and fc_sort on
809# file_contexts.device.tmp and output to file_contexts.device.sorted.tmp.
810# 4. Concatenate file_contexts.local.tmp and file_contexts.device.tmp into
811# file_contexts.concat.tmp.
812# 5. Run checkfc and sefcontext_compile on file_contexts.concat.tmp to produce
813# file_contexts.bin.
814#
815# Note: That a newline file is placed between each file_context file found to
816# ensure a proper build when an fc file is missing an ending newline.
William Roberts29d14682016-01-04 12:20:57 -0800817
Dan Cashman1b0a71f2017-05-08 14:26:52 -0700818local_fc_files := $(call build_policy, file_contexts, $(PLAT_PRIVATE_POLICY))
819
William Roberts49693f12016-01-04 12:20:57 -0800820ifneq ($(filter address,$(SANITIZE_TARGET)),)
Dan Cashman1b0a71f2017-05-08 14:26:52 -0700821 local_fc_files := $(local_fc_files) $(wildcard $(addsuffix /file_contexts_asan, $(PLAT_PRIVATE_POLICY)))
William Roberts49693f12016-01-04 12:20:57 -0800822endif
823local_fcfiles_with_nl := $(call add_nl, $(local_fc_files), $(built_nl))
824
825file_contexts.local.tmp := $(intermediates)/file_contexts.local.tmp
826$(file_contexts.local.tmp): $(local_fcfiles_with_nl)
Stephen Smalley5b340be2012-03-06 11:12:41 -0500827 @mkdir -p $(dir $@)
William Roberts49693f12016-01-04 12:20:57 -0800828 $(hide) m4 -s $^ > $@
829
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800830device_fc_files := $(call build_vendor_policy, file_contexts)
Bowgo Tsaibae15172017-11-29 16:14:53 +0800831
832ifdef BOARD_ODM_SEPOLICY_DIRS
833device_fc_files += $(call build_odm_policy, file_contexts)
834endif
835
William Roberts49693f12016-01-04 12:20:57 -0800836device_fcfiles_with_nl := $(call add_nl, $(device_fc_files), $(built_nl))
837
838file_contexts.device.tmp := $(intermediates)/file_contexts.device.tmp
839$(file_contexts.device.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
840$(file_contexts.device.tmp): $(device_fcfiles_with_nl)
841 @mkdir -p $(dir $@)
842 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@
843
844file_contexts.device.sorted.tmp := $(intermediates)/file_contexts.device.sorted.tmp
845$(file_contexts.device.sorted.tmp): PRIVATE_SEPOLICY := $(built_sepolicy)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800846$(file_contexts.device.sorted.tmp): $(file_contexts.device.tmp) $(built_sepolicy) \
847 $(HOST_OUT_EXECUTABLES)/fc_sort $(HOST_OUT_EXECUTABLES)/checkfc
William Roberts49693f12016-01-04 12:20:57 -0800848 @mkdir -p $(dir $@)
dcashman07791552016-12-07 11:27:47 -0800849 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e $(PRIVATE_SEPOLICY) $<
William Roberts49693f12016-01-04 12:20:57 -0800850 $(hide) $(HOST_OUT_EXECUTABLES)/fc_sort $< $@
851
852file_contexts.concat.tmp := $(intermediates)/file_contexts.concat.tmp
853$(file_contexts.concat.tmp): $(file_contexts.local.tmp) $(file_contexts.device.sorted.tmp)
854 @mkdir -p $(dir $@)
855 $(hide) m4 -s $^ > $@
Stephen Smalley5b340be2012-03-06 11:12:41 -0500856
William Roberts3746a0a2015-09-25 10:18:44 -0700857$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
William Roberts49693f12016-01-04 12:20:57 -0800858$(LOCAL_BUILT_MODULE): $(file_contexts.concat.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/sefcontext_compile $(HOST_OUT_EXECUTABLES)/checkfc
Richard Hainesc2d01912015-08-06 17:43:52 +0100859 @mkdir -p $(dir $@)
dcashman07791552016-12-07 11:27:47 -0800860 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc $(PRIVATE_SEPOLICY) $<
Richard Hainesc2d01912015-08-06 17:43:52 +0100861 $(hide) $(HOST_OUT_EXECUTABLES)/sefcontext_compile -o $@ $<
862
Robert Craig8b7545b2014-03-20 09:35:08 -0400863built_fc := $(LOCAL_BUILT_MODULE)
William Roberts49693f12016-01-04 12:20:57 -0800864local_fc_files :=
865local_fcfiles_with_nl :=
866device_fc_files :=
867device_fcfiles_with_nl :=
868file_contexts.concat.tmp :=
869file_contexts.device.sorted.tmp :=
870file_contexts.device.tmp :=
871file_contexts.local.tmp :=
William Roberts171a0622012-08-16 10:55:05 -0700872
Ying Wang02fb5f32012-01-17 17:51:09 -0800873##################################
Dan Cashman91d398d2017-09-26 12:58:29 -0700874ifneq ($(TARGET_BUILD_VARIANT), user)
875include $(CLEAR_VARS)
876
877LOCAL_MODULE := selinux_denial_metadata
878LOCAL_MODULE_CLASS := ETC
879LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
880
881include $(BUILD_SYSTEM)/base_rules.mk
882
883bug_files := $(call build_policy, bug_map, $(LOCAL_PATH) $(PLAT_PRIVATE_POLICY) $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(PLAT_PUBLIC_POLICY))
884
885$(LOCAL_BUILT_MODULE) : $(bug_files)
886 @mkdir -p $(dir $@)
887 cat $^ > $@
888
889bug_files :=
890endif
891##################################
Ying Wang02fb5f32012-01-17 17:51:09 -0800892include $(CLEAR_VARS)
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400893
dcashmand225b692016-12-12 09:29:04 -0800894LOCAL_MODULE := plat_file_contexts
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400895LOCAL_MODULE_CLASS := ETC
dcashmand225b692016-12-12 09:29:04 -0800896LOCAL_MODULE_TAGS := optional
Steven Moreland763697d2017-11-09 11:24:56 -0800897ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Jeff Vander Stoep0cb417a2017-03-08 14:12:54 -0800898LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
Jeff Vander Stoep7a68c5a2017-06-08 13:24:15 -0700899else
900LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
901endif
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400902
903include $(BUILD_SYSTEM)/base_rules.mk
904
Dan Cashman1b0a71f2017-05-08 14:26:52 -0700905local_fc_files := $(call build_policy, file_contexts, $(PLAT_PRIVATE_POLICY))
dcashmand225b692016-12-12 09:29:04 -0800906ifneq ($(filter address,$(SANITIZE_TARGET)),)
Dan Cashman1b0a71f2017-05-08 14:26:52 -0700907 local_fc_files += $(wildcard $(addsuffix /file_contexts_asan, $(PLAT_PRIVATE_POLICY)))
dcashmand225b692016-12-12 09:29:04 -0800908endif
Alex Klyubine4665d72017-01-19 19:58:34 -0800909local_fcfiles_with_nl := $(call add_nl, $(local_fc_files), $(built_nl))
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400910
Alex Klyubine4665d72017-01-19 19:58:34 -0800911$(LOCAL_BUILT_MODULE): PRIVATE_FC_FILES := $(local_fcfiles_with_nl)
dcashmand225b692016-12-12 09:29:04 -0800912$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Alex Klyubine4665d72017-01-19 19:58:34 -0800913$(LOCAL_BUILT_MODULE): PRIVATE_FC_SORT := $(HOST_OUT_EXECUTABLES)/fc_sort
914$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/checkfc $(HOST_OUT_EXECUTABLES)/fc_sort \
915$(local_fcfiles_with_nl) $(built_sepolicy)
Richard Hainesc2d01912015-08-06 17:43:52 +0100916 @mkdir -p $(dir $@)
Alex Klyubine4665d72017-01-19 19:58:34 -0800917 $(hide) m4 -s $(PRIVATE_FC_FILES) > $@.tmp
918 $(hide) $< $(PRIVATE_SEPOLICY) $@.tmp
919 $(hide) $(PRIVATE_FC_SORT) $@.tmp $@
Richard Hainesc2d01912015-08-06 17:43:52 +0100920
dcashmand225b692016-12-12 09:29:04 -0800921built_plat_fc := $(LOCAL_BUILT_MODULE)
922local_fc_files :=
Alex Klyubine4665d72017-01-19 19:58:34 -0800923local_fcfiles_with_nl :=
dcashmand225b692016-12-12 09:29:04 -0800924
925##################################
926include $(CLEAR_VARS)
927
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800928LOCAL_MODULE := vendor_file_contexts
dcashmand225b692016-12-12 09:29:04 -0800929LOCAL_MODULE_CLASS := ETC
930LOCAL_MODULE_TAGS := optional
Steven Moreland763697d2017-11-09 11:24:56 -0800931ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Jeff Vander Stoep0cb417a2017-03-08 14:12:54 -0800932LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
Jeff Vander Stoep7a68c5a2017-06-08 13:24:15 -0700933else
934LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
935endif
dcashmand225b692016-12-12 09:29:04 -0800936
937include $(BUILD_SYSTEM)/base_rules.mk
938
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800939vendor_fc_files := $(call build_vendor_policy, file_contexts)
940vendor_fcfiles_with_nl := $(call add_nl, $(vendor_fc_files), $(built_nl))
dcashmand225b692016-12-12 09:29:04 -0800941
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800942$(LOCAL_BUILT_MODULE): PRIVATE_FC_FILES := $(vendor_fcfiles_with_nl)
dcashmand225b692016-12-12 09:29:04 -0800943$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
944$(LOCAL_BUILT_MODULE): PRIVATE_FC_SORT := $(HOST_OUT_EXECUTABLES)/fc_sort
945$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/checkfc $(HOST_OUT_EXECUTABLES)/fc_sort \
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800946$(vendor_fcfiles_with_nl) $(built_sepolicy)
dcashmand225b692016-12-12 09:29:04 -0800947 @mkdir -p $(dir $@)
948 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_FC_FILES) > $@.tmp
949 $(hide) $< $(PRIVATE_SEPOLICY) $@.tmp
950 $(hide) $(PRIVATE_FC_SORT) $@.tmp $@
951
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800952built_vendor_fc := $(LOCAL_BUILT_MODULE)
953vendor_fc_files :=
954vendor_fcfiles_with_nl :=
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400955
956##################################
957include $(CLEAR_VARS)
Jeff Vander Stoepb236eb62017-06-13 08:24:17 -0700958
Bowgo Tsaibae15172017-11-29 16:14:53 +0800959LOCAL_MODULE := odm_file_contexts
960LOCAL_MODULE_CLASS := ETC
961LOCAL_MODULE_TAGS := optional
962LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux
963
964include $(BUILD_SYSTEM)/base_rules.mk
965
966odm_fc_files := $(call build_odm_policy, file_contexts)
967odm_fcfiles_with_nl := $(call add_nl, $(odm_fc_files), $(built_nl))
968
969$(LOCAL_BUILT_MODULE): PRIVATE_FC_FILES := $(odm_fcfiles_with_nl)
970$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
971$(LOCAL_BUILT_MODULE): PRIVATE_FC_SORT := $(HOST_OUT_EXECUTABLES)/fc_sort
972$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/checkfc $(HOST_OUT_EXECUTABLES)/fc_sort \
973$(odm_fcfiles_with_nl) $(built_sepolicy)
974 @mkdir -p $(dir $@)
975 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_FC_FILES) > $@.tmp
976 $(hide) $< $(PRIVATE_SEPOLICY) $@.tmp
977 $(hide) $(PRIVATE_FC_SORT) $@.tmp $@
978
979built_odm_fc := $(LOCAL_BUILT_MODULE)
980odm_fc_files :=
981odm_fcfiles_with_nl :=
982
983##################################
984include $(CLEAR_VARS)
985
Jeff Vander Stoepb236eb62017-06-13 08:24:17 -0700986LOCAL_MODULE := plat_file_contexts.recovery
987LOCAL_MODULE_STEM := plat_file_contexts
988LOCAL_MODULE_CLASS := ETC
989LOCAL_MODULE_TAGS := optional
990LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
991
992include $(BUILD_SYSTEM)/base_rules.mk
993
994$(LOCAL_BUILT_MODULE): $(built_plat_fc)
995 $(hide) cp -f $< $@
996
997##################################
998include $(CLEAR_VARS)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800999LOCAL_MODULE := vendor_file_contexts.recovery
1000LOCAL_MODULE_STEM := vendor_file_contexts
Jeff Vander Stoepb236eb62017-06-13 08:24:17 -07001001LOCAL_MODULE_CLASS := ETC
1002LOCAL_MODULE_TAGS := optional
1003LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
1004
1005include $(BUILD_SYSTEM)/base_rules.mk
1006
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001007$(LOCAL_BUILT_MODULE): $(built_vendor_fc)
Jeff Vander Stoepb236eb62017-06-13 08:24:17 -07001008 $(hide) cp -f $< $@
1009
1010##################################
1011include $(CLEAR_VARS)
Bowgo Tsaibae15172017-11-29 16:14:53 +08001012LOCAL_MODULE := odm_file_contexts.recovery
1013LOCAL_MODULE_STEM := odm_file_contexts
1014LOCAL_MODULE_CLASS := ETC
1015LOCAL_MODULE_TAGS := optional
1016LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
1017
1018include $(BUILD_SYSTEM)/base_rules.mk
1019
1020$(LOCAL_BUILT_MODULE): $(built_odm_fc)
1021 $(hide) cp -f $< $@
1022
1023##################################
1024include $(CLEAR_VARS)
Dan Cashman9c038072016-12-22 07:15:18 -08001025LOCAL_MODULE := plat_seapp_contexts
Ying Wang02fb5f32012-01-17 17:51:09 -08001026LOCAL_MODULE_CLASS := ETC
1027LOCAL_MODULE_TAGS := optional
Steven Moreland763697d2017-11-09 11:24:56 -08001028ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Jeff Vander Stoep4e3a4c72017-03-08 22:28:03 -08001029LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
1030else
Ying Wang02fb5f32012-01-17 17:51:09 -08001031LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Jeff Vander Stoep4e3a4c72017-03-08 22:28:03 -08001032endif
Ying Wang02fb5f32012-01-17 17:51:09 -08001033
William Roberts171a0622012-08-16 10:55:05 -07001034include $(BUILD_SYSTEM)/base_rules.mk
Ying Wang02fb5f32012-01-17 17:51:09 -08001035
Dan Cashman9c038072016-12-22 07:15:18 -08001036plat_sc_files := $(call build_policy, seapp_contexts, $(PLAT_PRIVATE_POLICY))
William Roberts171a0622012-08-16 10:55:05 -07001037
Ying Wangd8b122c2012-10-25 19:01:31 -07001038$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Dan Cashman9c038072016-12-22 07:15:18 -08001039$(LOCAL_BUILT_MODULE): PRIVATE_SC_FILES := $(plat_sc_files)
1040$(LOCAL_BUILT_MODULE): $(built_sepolicy) $(plat_sc_files) $(HOST_OUT_EXECUTABLES)/checkseapp
William Robertsf0e0a942012-08-27 15:41:15 -07001041 @mkdir -p $(dir $@)
William Roberts99fe8df2015-06-30 13:53:51 -07001042 $(hide) $(HOST_OUT_EXECUTABLES)/checkseapp -p $(PRIVATE_SEPOLICY) -o $@ $(PRIVATE_SC_FILES)
Ying Wang02fb5f32012-01-17 17:51:09 -08001043
Dan Cashman9c038072016-12-22 07:15:18 -08001044built_plat_sc := $(LOCAL_BUILT_MODULE)
1045plat_sc_files :=
Robert Craig8b7545b2014-03-20 09:35:08 -04001046
Ying Wang02fb5f32012-01-17 17:51:09 -08001047##################################
Stephen Smalley124720a2012-04-04 10:11:16 -04001048include $(CLEAR_VARS)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001049LOCAL_MODULE := vendor_seapp_contexts
Stephen Smalley37712872015-03-12 15:46:36 -04001050LOCAL_MODULE_CLASS := ETC
Dan Cashman9c038072016-12-22 07:15:18 -08001051LOCAL_MODULE_TAGS := optional
Steven Moreland763697d2017-11-09 11:24:56 -08001052ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Jeff Vander Stoep4e3a4c72017-03-08 22:28:03 -08001053LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
1054else
Dan Cashman9c038072016-12-22 07:15:18 -08001055LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Jeff Vander Stoep4e3a4c72017-03-08 22:28:03 -08001056endif
Stephen Smalley37712872015-03-12 15:46:36 -04001057
1058include $(BUILD_SYSTEM)/base_rules.mk
1059
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001060vendor_sc_files := $(call build_policy, seapp_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
Dan Cashman1b0a71f2017-05-08 14:26:52 -07001061plat_sc_neverallow_files := $(call build_policy, seapp_contexts, $(PLAT_PRIVATE_POLICY))
Stephen Smalley37712872015-03-12 15:46:36 -04001062
Dan Cashman9c038072016-12-22 07:15:18 -08001063$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001064$(LOCAL_BUILT_MODULE): PRIVATE_SC_FILES := $(vendor_sc_files)
Jeff Vander Stoep87ae5f72017-03-06 22:53:09 -08001065$(LOCAL_BUILT_MODULE): PRIVATE_SC_NEVERALLOW_FILES := $(plat_sc_neverallow_files)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001066$(LOCAL_BUILT_MODULE): $(built_sepolicy) $(vendor_sc_files) $(HOST_OUT_EXECUTABLES)/checkseapp $(plat_sc_neverallow_files)
Stephen Smalley37712872015-03-12 15:46:36 -04001067 @mkdir -p $(dir $@)
Dan Cashman91d398d2017-09-26 12:58:29 -07001068 $(hide) grep -ihe '^neverallow' $(PRIVATE_SC_NEVERALLOW_FILES) > $@.tmp
Xin Liec6f3932017-03-14 16:51:13 -07001069 $(hide) $(HOST_OUT_EXECUTABLES)/checkseapp -p $(PRIVATE_SEPOLICY) -o $@ $(PRIVATE_SC_FILES) $@.tmp
Stephen Smalley37712872015-03-12 15:46:36 -04001070
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001071built_vendor_sc := $(LOCAL_BUILT_MODULE)
1072vendor_sc_files :=
Stephen Smalley37712872015-03-12 15:46:36 -04001073
1074##################################
1075include $(CLEAR_VARS)
Bowgo Tsaiecf656b2017-11-29 16:15:28 +08001076LOCAL_MODULE := odm_seapp_contexts
1077LOCAL_MODULE_CLASS := ETC
1078LOCAL_MODULE_TAGS := optional
1079LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux
1080
1081include $(BUILD_SYSTEM)/base_rules.mk
1082
1083odm_sc_files := $(call build_policy, seapp_contexts, $(BOARD_ODM_SEPOLICY_DIRS))
1084plat_sc_neverallow_files := $(call build_policy, seapp_contexts, $(PLAT_PRIVATE_POLICY))
1085
1086$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
1087$(LOCAL_BUILT_MODULE): PRIVATE_SC_FILES := $(odm_sc_files)
1088$(LOCAL_BUILT_MODULE): PRIVATE_SC_NEVERALLOW_FILES := $(plat_sc_neverallow_files)
1089$(LOCAL_BUILT_MODULE): $(built_sepolicy) $(odm_sc_files) $(HOST_OUT_EXECUTABLES)/checkseapp $(plat_sc_neverallow_files)
1090 @mkdir -p $(dir $@)
1091 $(hide) grep -ihe '^neverallow' $(PRIVATE_SC_NEVERALLOW_FILES) > $@.tmp
1092 $(hide) $(HOST_OUT_EXECUTABLES)/checkseapp -p $(PRIVATE_SEPOLICY) -o $@ $(PRIVATE_SC_FILES) $@.tmp
1093
1094built_odm_sc := $(LOCAL_BUILT_MODULE)
1095odm_sc_files :=
1096
1097##################################
1098include $(CLEAR_VARS)
Dan Cashman9c038072016-12-22 07:15:18 -08001099LOCAL_MODULE := plat_seapp_neverallows
William Roberts4ee71312015-06-25 11:59:30 -07001100LOCAL_MODULE_CLASS := ETC
1101LOCAL_MODULE_TAGS := tests
1102
1103include $(BUILD_SYSTEM)/base_rules.mk
1104
Jeff Vander Stoep87ae5f72017-03-06 22:53:09 -08001105$(LOCAL_BUILT_MODULE): $(plat_sc_neverallow_files)
William Roberts4ee71312015-06-25 11:59:30 -07001106 @mkdir -p $(dir $@)
Dan Cashman91d398d2017-09-26 12:58:29 -07001107 - $(hide) grep -ihe '^neverallow' $< > $@
William Roberts4ee71312015-06-25 11:59:30 -07001108
Jeff Vander Stoep87ae5f72017-03-06 22:53:09 -08001109plat_sc_neverallow_files :=
William Roberts4ee71312015-06-25 11:59:30 -07001110
1111##################################
1112include $(CLEAR_VARS)
Stephen Smalley124720a2012-04-04 10:11:16 -04001113
Sandeep Patila86316e2016-12-27 16:08:44 -08001114LOCAL_MODULE := plat_property_contexts
Stephen Smalley124720a2012-04-04 10:11:16 -04001115LOCAL_MODULE_CLASS := ETC
1116LOCAL_MODULE_TAGS := optional
Alex Klyubin9d590412017-03-08 13:10:05 -08001117
Steven Moreland763697d2017-11-09 11:24:56 -08001118ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Alex Klyubin9d590412017-03-08 13:10:05 -08001119LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
1120else
Stephen Smalley124720a2012-04-04 10:11:16 -04001121LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Alex Klyubin9d590412017-03-08 13:10:05 -08001122endif
Stephen Smalley124720a2012-04-04 10:11:16 -04001123
1124include $(BUILD_SYSTEM)/base_rules.mk
1125
Sandeep Patila86316e2016-12-27 16:08:44 -08001126plat_pcfiles := $(call build_policy, property_contexts, $(PLAT_PRIVATE_POLICY))
Jaekyun Seoke4971452017-10-19 16:54:49 +09001127ifeq ($(PRODUCT_COMPATIBLE_PROPERTY),true)
1128plat_pcfiles += $(LOCAL_PATH)/public/property_contexts
1129endif
William Roberts6aabc1c2015-07-30 11:44:26 -07001130
Sandeep Patila86316e2016-12-27 16:08:44 -08001131plat_property_contexts.tmp := $(intermediates)/plat_property_contexts.tmp
1132$(plat_property_contexts.tmp): PRIVATE_PC_FILES := $(plat_pcfiles)
1133$(plat_property_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1134$(plat_property_contexts.tmp): $(plat_pcfiles)
William Roberts7f81b332015-09-29 13:52:37 -07001135 @mkdir -p $(dir $@)
Colin Cross9eb6c872015-10-01 21:25:09 +00001136 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_PC_FILES) > $@
Tom Cherryf68b4c62018-01-04 09:46:48 -08001137$(LOCAL_BUILT_MODULE): $(plat_property_contexts.tmp) $(HOST_OUT_EXECUTABLES)/property_info_checker
William Robertsdcffd2b2015-09-29 13:52:37 -07001138 @mkdir -p $(dir $@)
Tom Cherryf68b4c62018-01-04 09:46:48 -08001139 $(hide) cp -f $< $@
1140 $(hide) $(HOST_OUT_EXECUTABLES)/property_info_checker $@
Stephen Smalley124720a2012-04-04 10:11:16 -04001141
Sandeep Patila86316e2016-12-27 16:08:44 -08001142built_plat_pc := $(LOCAL_BUILT_MODULE)
1143plat_pcfiles :=
1144plat_property_contexts.tmp :=
Robert Craig8b7545b2014-03-20 09:35:08 -04001145
Stephen Smalley124720a2012-04-04 10:11:16 -04001146##################################
Riley Spahnf90c41f2014-06-05 15:52:02 -07001147include $(CLEAR_VARS)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001148LOCAL_MODULE := vendor_property_contexts
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -04001149LOCAL_MODULE_CLASS := ETC
Sandeep Patila86316e2016-12-27 16:08:44 -08001150LOCAL_MODULE_TAGS := optional
Alex Klyubin9d590412017-03-08 13:10:05 -08001151
Steven Moreland763697d2017-11-09 11:24:56 -08001152ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Alex Klyubin9d590412017-03-08 13:10:05 -08001153LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
1154else
Sandeep Patila86316e2016-12-27 16:08:44 -08001155LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Alex Klyubin9d590412017-03-08 13:10:05 -08001156endif
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -04001157
Stephen Smalleyc9361732015-03-13 09:36:57 -04001158include $(BUILD_SYSTEM)/base_rules.mk
1159
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001160vendor_pcfiles := $(call build_policy, property_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
Sandeep Patil262edc32016-12-27 16:08:44 -08001161
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001162vendor_property_contexts.tmp := $(intermediates)/vendor_property_contexts.tmp
1163$(vendor_property_contexts.tmp): PRIVATE_PC_FILES := $(vendor_pcfiles)
1164$(vendor_property_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1165$(vendor_property_contexts.tmp): $(vendor_pcfiles)
William Robertsdcffd2b2015-09-29 13:52:37 -07001166 @mkdir -p $(dir $@)
Sandeep Patila86316e2016-12-27 16:08:44 -08001167 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_PC_FILES) > $@
1168
1169
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001170$(LOCAL_BUILT_MODULE): $(vendor_property_contexts.tmp) $(HOST_OUT_EXECUTABLES)/property_info_checker
Sandeep Patila86316e2016-12-27 16:08:44 -08001171 @mkdir -p $(dir $@)
Tom Cherryf68b4c62018-01-04 09:46:48 -08001172 $(hide) cp -f $< $@
1173 $(hide) $(HOST_OUT_EXECUTABLES)/property_info_checker $@
William Robertsdcffd2b2015-09-29 13:52:37 -07001174
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001175built_vendor_pc := $(LOCAL_BUILT_MODULE)
1176vendor_pcfiles :=
1177vendor_property_contexts.tmp :=
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -04001178
1179##################################
1180include $(CLEAR_VARS)
Bowgo Tsai1f717b12017-11-29 16:15:55 +08001181LOCAL_MODULE := odm_property_contexts
1182LOCAL_MODULE_CLASS := ETC
1183LOCAL_MODULE_TAGS := optional
1184LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux
1185
1186include $(BUILD_SYSTEM)/base_rules.mk
1187
1188odm_pcfiles := $(call build_policy, property_contexts, $(BOARD_ODM_SEPOLICY_DIRS))
1189
1190odm_property_contexts.tmp := $(intermediates)/odm_property_contexts.tmp
1191$(odm_property_contexts.tmp): PRIVATE_PC_FILES := $(odm_pcfiles)
1192$(odm_property_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1193$(odm_property_contexts.tmp): $(odm_pcfiles)
1194 @mkdir -p $(dir $@)
1195 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_PC_FILES) > $@
1196
1197
1198$(LOCAL_BUILT_MODULE): $(odm_property_contexts.tmp) $(HOST_OUT_EXECUTABLES)/property_info_checker
1199 @mkdir -p $(dir $@)
1200 $(hide) cp -f $< $@
1201 $(hide) $(HOST_OUT_EXECUTABLES)/property_info_checker $@
1202
1203built_odm_pc := $(LOCAL_BUILT_MODULE)
1204odm_pcfiles :=
1205odm_property_contexts.tmp :=
1206
1207##################################
1208include $(CLEAR_VARS)
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -04001209
Alex Klyubinec78c372017-03-10 12:44:16 -08001210LOCAL_MODULE := plat_property_contexts.recovery
1211LOCAL_MODULE_STEM := plat_property_contexts
1212LOCAL_MODULE_CLASS := ETC
1213LOCAL_MODULE_TAGS := optional
1214LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
1215
1216include $(BUILD_SYSTEM)/base_rules.mk
1217
1218$(LOCAL_BUILT_MODULE): $(built_plat_pc)
1219 $(hide) cp -f $< $@
1220
1221##################################
1222include $(CLEAR_VARS)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001223LOCAL_MODULE := vendor_property_contexts.recovery
1224LOCAL_MODULE_STEM := vendor_property_contexts
Alex Klyubinec78c372017-03-10 12:44:16 -08001225LOCAL_MODULE_CLASS := ETC
1226LOCAL_MODULE_TAGS := optional
1227LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
1228
1229include $(BUILD_SYSTEM)/base_rules.mk
1230
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001231$(LOCAL_BUILT_MODULE): $(built_vendor_pc)
Alex Klyubinec78c372017-03-10 12:44:16 -08001232 $(hide) cp -f $< $@
1233
1234##################################
1235include $(CLEAR_VARS)
Bowgo Tsai1f717b12017-11-29 16:15:55 +08001236LOCAL_MODULE := odm_property_contexts.recovery
1237LOCAL_MODULE_STEM := odm_property_contexts
1238LOCAL_MODULE_CLASS := ETC
1239LOCAL_MODULE_TAGS := optional
1240LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
1241
1242include $(BUILD_SYSTEM)/base_rules.mk
1243
1244$(LOCAL_BUILT_MODULE): $(built_odm_pc)
1245 $(hide) cp -f $< $@
1246
1247##################################
1248include $(CLEAR_VARS)
Alex Klyubinec78c372017-03-10 12:44:16 -08001249
Sandeep Patila058b562016-12-27 15:10:48 -08001250LOCAL_MODULE := plat_service_contexts
Riley Spahnf90c41f2014-06-05 15:52:02 -07001251LOCAL_MODULE_CLASS := ETC
1252LOCAL_MODULE_TAGS := optional
Steven Moreland763697d2017-11-09 11:24:56 -08001253ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Jeff Vander Stoep4e3a4c72017-03-08 22:28:03 -08001254LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
1255else
Riley Spahnf90c41f2014-06-05 15:52:02 -07001256LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Jeff Vander Stoep4e3a4c72017-03-08 22:28:03 -08001257endif
Riley Spahnf90c41f2014-06-05 15:52:02 -07001258
1259include $(BUILD_SYSTEM)/base_rules.mk
1260
Sandeep Patila058b562016-12-27 15:10:48 -08001261plat_svcfiles := $(call build_policy, service_contexts, $(PLAT_PRIVATE_POLICY))
Riley Spahnf90c41f2014-06-05 15:52:02 -07001262
Sandeep Patila058b562016-12-27 15:10:48 -08001263plat_service_contexts.tmp := $(intermediates)/plat_service_contexts.tmp
1264$(plat_service_contexts.tmp): PRIVATE_SVC_FILES := $(plat_svcfiles)
1265$(plat_service_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1266$(plat_service_contexts.tmp): $(plat_svcfiles)
Riley Spahnf90c41f2014-06-05 15:52:02 -07001267 @mkdir -p $(dir $@)
William Roberts6aabc1c2015-07-30 11:44:26 -07001268 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
William Roberts7fc865a2015-09-29 14:17:38 -07001269
1270$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Sandeep Patila058b562016-12-27 15:10:48 -08001271$(LOCAL_BUILT_MODULE): $(plat_service_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
William Roberts7fc865a2015-09-29 14:17:38 -07001272 @mkdir -p $(dir $@)
William Robertsc9fce3f2016-04-06 11:53:04 -07001273 sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
dcashman07791552016-12-07 11:27:47 -08001274 $(HOST_OUT_EXECUTABLES)/checkfc -s $(PRIVATE_SEPOLICY) $@
Riley Spahnf90c41f2014-06-05 15:52:02 -07001275
Sandeep Patila058b562016-12-27 15:10:48 -08001276built_plat_svc := $(LOCAL_BUILT_MODULE)
1277plat_svcfiles :=
1278plat_service_contexts.tmp :=
Riley Spahnf90c41f2014-06-05 15:52:02 -07001279
1280##################################
Hung-ying Tyane83f1e52017-09-05 21:51:52 +08001281# nonplat_service_contexts is only allowed on non-full-treble devices
Steven Moreland763697d2017-11-09 11:24:56 -08001282ifneq ($(PRODUCT_SEPOLICY_SPLIT),true)
Hung-ying Tyane83f1e52017-09-05 21:51:52 +08001283
rpcraigb19665c2012-07-30 09:33:03 -04001284include $(CLEAR_VARS)
1285
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001286LOCAL_MODULE := vendor_service_contexts
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -04001287LOCAL_MODULE_CLASS := ETC
Sandeep Patila058b562016-12-27 15:10:48 -08001288LOCAL_MODULE_TAGS := optional
Sandeep Patila058b562016-12-27 15:10:48 -08001289LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -04001290
1291include $(BUILD_SYSTEM)/base_rules.mk
1292
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001293vendor_svcfiles := $(call build_policy, service_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -04001294
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001295vendor_service_contexts.tmp := $(intermediates)/vendor_service_contexts.tmp
1296$(vendor_service_contexts.tmp): PRIVATE_SVC_FILES := $(vendor_svcfiles)
1297$(vendor_service_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1298$(vendor_service_contexts.tmp): $(vendor_svcfiles)
Sandeep Patila058b562016-12-27 15:10:48 -08001299 @mkdir -p $(dir $@)
1300 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
1301
1302$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001303$(LOCAL_BUILT_MODULE): $(vendor_service_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
William Roberts7fc865a2015-09-29 14:17:38 -07001304 @mkdir -p $(dir $@)
William Robertsc9fce3f2016-04-06 11:53:04 -07001305 sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
dcashman07791552016-12-07 11:27:47 -08001306 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -s $(PRIVATE_SEPOLICY) $@
William Roberts7fc865a2015-09-29 14:17:38 -07001307
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001308built_vendor_svc := $(LOCAL_BUILT_MODULE)
1309vendor_svcfiles :=
1310vendor_service_contexts.tmp :=
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -04001311
Hung-ying Tyane83f1e52017-09-05 21:51:52 +08001312endif
1313
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -04001314##################################
1315include $(CLEAR_VARS)
1316
Martijn Coenen3ea47b92017-04-07 16:14:43 -07001317LOCAL_MODULE := plat_hwservice_contexts
1318LOCAL_MODULE_CLASS := ETC
1319LOCAL_MODULE_TAGS := optional
Steven Moreland763697d2017-11-09 11:24:56 -08001320ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Martijn Coenen3ea47b92017-04-07 16:14:43 -07001321LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
1322else
1323LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
1324endif
1325
1326include $(BUILD_SYSTEM)/base_rules.mk
1327
1328plat_hwsvcfiles := $(call build_policy, hwservice_contexts, $(PLAT_PRIVATE_POLICY))
1329
1330plat_hwservice_contexts.tmp := $(intermediates)/plat_hwservice_contexts.tmp
1331$(plat_hwservice_contexts.tmp): PRIVATE_SVC_FILES := $(plat_hwsvcfiles)
1332$(plat_hwservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1333$(plat_hwservice_contexts.tmp): $(plat_hwsvcfiles)
1334 @mkdir -p $(dir $@)
1335 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
1336
1337$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
1338$(LOCAL_BUILT_MODULE): $(plat_hwservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
1339 @mkdir -p $(dir $@)
1340 sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
1341 $(HOST_OUT_EXECUTABLES)/checkfc -e -l $(PRIVATE_SEPOLICY) $@
1342
1343plat_hwsvcfiles :=
1344plat_hwservice_contexts.tmp :=
1345
1346##################################
1347include $(CLEAR_VARS)
1348
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001349LOCAL_MODULE := vendor_hwservice_contexts
Martijn Coenen3ea47b92017-04-07 16:14:43 -07001350LOCAL_MODULE_CLASS := ETC
1351LOCAL_MODULE_TAGS := optional
Steven Moreland763697d2017-11-09 11:24:56 -08001352ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Martijn Coenen3ea47b92017-04-07 16:14:43 -07001353LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
1354else
1355LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
1356endif
1357
1358include $(BUILD_SYSTEM)/base_rules.mk
1359
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001360vendor_hwsvcfiles := $(call build_policy, hwservice_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
Martijn Coenen3ea47b92017-04-07 16:14:43 -07001361
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001362vendor_hwservice_contexts.tmp := $(intermediates)/vendor_hwservice_contexts.tmp
1363$(vendor_hwservice_contexts.tmp): PRIVATE_SVC_FILES := $(vendor_hwsvcfiles)
1364$(vendor_hwservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1365$(vendor_hwservice_contexts.tmp): $(vendor_hwsvcfiles)
Martijn Coenen3ea47b92017-04-07 16:14:43 -07001366 @mkdir -p $(dir $@)
1367 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
1368
1369$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001370$(LOCAL_BUILT_MODULE): $(vendor_hwservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
Martijn Coenen3ea47b92017-04-07 16:14:43 -07001371 @mkdir -p $(dir $@)
1372 sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
1373 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e -l $(PRIVATE_SEPOLICY) $@
1374
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001375vendor_hwsvcfiles :=
1376vendor_hwservice_contexts.tmp :=
1377
Martijn Coenen3ea47b92017-04-07 16:14:43 -07001378
1379##################################
1380include $(CLEAR_VARS)
1381
Martijn Coenen6676c232017-03-31 17:29:53 -07001382LOCAL_MODULE := vndservice_contexts
1383LOCAL_MODULE_CLASS := ETC
1384LOCAL_MODULE_TAGS := optional
Steven Moreland763697d2017-11-09 11:24:56 -08001385ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Martijn Coenen6676c232017-03-31 17:29:53 -07001386LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
1387else
1388LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
1389endif
1390
1391include $(BUILD_SYSTEM)/base_rules.mk
1392
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001393vnd_svcfiles := $(call build_policy, vndservice_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
Martijn Coenen6676c232017-03-31 17:29:53 -07001394
1395vndservice_contexts.tmp := $(intermediates)/vndservice_contexts.tmp
1396$(vndservice_contexts.tmp): PRIVATE_SVC_FILES := $(vnd_svcfiles)
1397$(vndservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1398$(vndservice_contexts.tmp): $(vnd_svcfiles)
1399 @mkdir -p $(dir $@)
1400 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
1401
1402$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
1403$(LOCAL_BUILT_MODULE): $(vndservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
1404 @mkdir -p $(dir $@)
1405 sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
Martijn Coenenee976622017-04-07 10:08:55 -07001406 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e -v $(PRIVATE_SEPOLICY) $@
Martijn Coenen6676c232017-03-31 17:29:53 -07001407
1408vnd_svcfiles :=
1409vndservice_contexts.tmp :=
1410##################################
1411include $(CLEAR_VARS)
1412
dcashman90b3b942016-12-14 13:47:55 -08001413LOCAL_MODULE := plat_mac_permissions.xml
rpcraigb19665c2012-07-30 09:33:03 -04001414LOCAL_MODULE_CLASS := ETC
1415LOCAL_MODULE_TAGS := optional
Jeff Vander Stoepbba9e7b2017-03-10 15:51:23 -08001416LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
rpcraigb19665c2012-07-30 09:33:03 -04001417
William Roberts2c8a55d2012-11-30 14:59:09 -08001418include $(BUILD_SYSTEM)/base_rules.mk
rpcraigb19665c2012-07-30 09:33:03 -04001419
Geremy Condracd4104e2013-03-26 18:19:12 +00001420# Build keys.conf
dcashman90b3b942016-12-14 13:47:55 -08001421plat_mac_perms_keys.tmp := $(intermediates)/plat_keys.tmp
1422$(plat_mac_perms_keys.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1423$(plat_mac_perms_keys.tmp): $(call build_policy, keys.conf, $(PLAT_PRIVATE_POLICY))
Geremy Condracd4104e2013-03-26 18:19:12 +00001424 @mkdir -p $(dir $@)
William Robertsd2185582015-07-16 11:28:02 -07001425 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@
Geremy Condracd4104e2013-03-26 18:19:12 +00001426
dcashman90b3b942016-12-14 13:47:55 -08001427all_plat_mac_perms_files := $(call build_policy, mac_permissions.xml, $(PLAT_PRIVATE_POLICY))
rpcraigb19665c2012-07-30 09:33:03 -04001428
Shinichiro Hamajief0c14d2016-05-13 16:04:58 +09001429# Should be synced with keys.conf.
dcashman90b3b942016-12-14 13:47:55 -08001430all_plat_keys := platform media shared testkey
1431all_plat_keys := $(all_keys:%=$(dir $(DEFAULT_SYSTEM_DEV_CERTIFICATE))/%.x509.pem)
Shinichiro Hamajief0c14d2016-05-13 16:04:58 +09001432
dcashman90b3b942016-12-14 13:47:55 -08001433$(LOCAL_BUILT_MODULE): PRIVATE_MAC_PERMS_FILES := $(all_plat_mac_perms_files)
1434$(LOCAL_BUILT_MODULE): $(plat_mac_perms_keys.tmp) $(HOST_OUT_EXECUTABLES)/insertkeys.py \
1435$(all_plat_mac_perms_files) $(all_plat_keys)
Geremy Condracd4104e2013-03-26 18:19:12 +00001436 @mkdir -p $(dir $@)
Nick Kralevichc3c90522013-10-25 12:25:36 -07001437 $(hide) DEFAULT_SYSTEM_DEV_CERTIFICATE="$(dir $(DEFAULT_SYSTEM_DEV_CERTIFICATE))" \
William Roberts6aabc1c2015-07-30 11:44:26 -07001438 $(HOST_OUT_EXECUTABLES)/insertkeys.py -t $(TARGET_BUILD_VARIANT) -c $(TOP) $< -o $@ $(PRIVATE_MAC_PERMS_FILES)
Geremy Condracd4104e2013-03-26 18:19:12 +00001439
William Roberts6aabc1c2015-07-30 11:44:26 -07001440all_mac_perms_files :=
dcashman90b3b942016-12-14 13:47:55 -08001441all_plat_keys :=
1442plat_mac_perms_keys.tmp :=
1443
1444##################################
1445include $(CLEAR_VARS)
1446
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001447LOCAL_MODULE := vendor_mac_permissions.xml
dcashman90b3b942016-12-14 13:47:55 -08001448LOCAL_MODULE_CLASS := ETC
1449LOCAL_MODULE_TAGS := optional
Jeff Vander Stoepbba9e7b2017-03-10 15:51:23 -08001450LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
dcashman90b3b942016-12-14 13:47:55 -08001451
1452include $(BUILD_SYSTEM)/base_rules.mk
1453
1454# Build keys.conf
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001455vendor_mac_perms_keys.tmp := $(intermediates)/vendor_keys.tmp
1456$(vendor_mac_perms_keys.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1457$(vendor_mac_perms_keys.tmp): $(call build_policy, keys.conf, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
dcashman90b3b942016-12-14 13:47:55 -08001458 @mkdir -p $(dir $@)
1459 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@
1460
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001461all_vendor_mac_perms_files := $(call build_policy, mac_permissions.xml, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
dcashman90b3b942016-12-14 13:47:55 -08001462
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001463$(LOCAL_BUILT_MODULE): PRIVATE_MAC_PERMS_FILES := $(all_vendor_mac_perms_files)
1464$(LOCAL_BUILT_MODULE): $(vendor_mac_perms_keys.tmp) $(HOST_OUT_EXECUTABLES)/insertkeys.py \
1465$(all_vendor_mac_perms_files)
dcashman90b3b942016-12-14 13:47:55 -08001466 @mkdir -p $(dir $@)
1467 $(hide) $(HOST_OUT_EXECUTABLES)/insertkeys.py -t $(TARGET_BUILD_VARIANT) -c $(TOP) $< -o $@ $(PRIVATE_MAC_PERMS_FILES)
1468
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001469vendor_mac_perms_keys.tmp :=
1470all_vendor_mac_perms_files :=
William Roberts6aabc1c2015-07-30 11:44:26 -07001471
Dan Cashman91d398d2017-09-26 12:58:29 -07001472#################################
1473include $(CLEAR_VARS)
1474LOCAL_MODULE := sepolicy_tests
1475LOCAL_MODULE_CLASS := ETC
1476LOCAL_MODULE_TAGS := tests
1477
1478include $(BUILD_SYSTEM)/base_rules.mk
1479
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001480all_fc_files := $(built_plat_fc) $(built_vendor_fc)
Bowgo Tsaibae15172017-11-29 16:14:53 +08001481ifdef BOARD_ODM_SEPOLICY_DIRS
1482all_fc_files += $(built_odm_fc)
1483endif
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001484all_fc_args := $(foreach file, $(all_fc_files), -f $(file))
1485
Dan Cashman91d398d2017-09-26 12:58:29 -07001486sepolicy_tests := $(intermediates)/sepolicy_tests
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001487$(sepolicy_tests): ALL_FC_ARGS := $(all_fc_args)
Dan Cashman91d398d2017-09-26 12:58:29 -07001488$(sepolicy_tests): PRIVATE_SEPOLICY := $(built_sepolicy)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001489$(sepolicy_tests): $(HOST_OUT_EXECUTABLES)/sepolicy_tests $(all_fc_files) $(built_sepolicy)
Dan Cashman91d398d2017-09-26 12:58:29 -07001490 @mkdir -p $(dir $@)
Jeff Vander Stoep3ca843a2017-10-04 09:42:29 -07001491 $(hide) $(HOST_OUT_EXECUTABLES)/sepolicy_tests -l $(HOST_OUT)/lib64/libsepolwrap.$(SHAREDLIB_EXT) \
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001492 $(ALL_FC_ARGS) -p $(PRIVATE_SEPOLICY)
Dan Cashman91d398d2017-09-26 12:58:29 -07001493 $(hide) touch $@
1494
rpcraigb19665c2012-07-30 09:33:03 -04001495##################################
Steven Moreland763697d2017-11-09 11:24:56 -08001496ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Jeff Vander Stoep1fc06822017-05-31 15:36:07 -07001497
Tri Vo14069262018-01-31 16:22:35 -08001498intermediates := $(call intermediates-dir-for,ETC,built_plat_sepolicy,,,,)
Dan Cashman91d398d2017-09-26 12:58:29 -07001499
1500# plat_sepolicy - the current platform policy only, built into a policy binary.
1501# TODO - this currently excludes partner extensions, but support should be added
1502# to enable partners to add their own compatibility mapping
1503BASE_PLAT_PUBLIC_POLICY := $(filter-out $(BOARD_PLAT_PUBLIC_SEPOLICY_DIR), $(PLAT_PUBLIC_POLICY))
1504BASE_PLAT_PRIVATE_POLICY := $(filter-out $(BOARD_PLAT_PRIVATE_SEPOLICY_DIR), $(PLAT_PRIVATE_POLICY))
1505base_plat_policy.conf := $(intermediates)/base_plat_policy.conf
1506$(base_plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
1507$(base_plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Joel Galenson8c72eea2018-03-07 15:36:29 -08001508$(base_plat_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
Dan Cashman91d398d2017-09-26 12:58:29 -07001509$(base_plat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
1510$(base_plat_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
1511$(base_plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Steven Moreland763697d2017-11-09 11:24:56 -08001512$(base_plat_policy.conf): PRIVATE_SEPOLICY_SPLIT := true
Jaekyun Seoke4971452017-10-19 16:54:49 +09001513$(base_plat_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
Dan Cashman91d398d2017-09-26 12:58:29 -07001514$(base_plat_policy.conf): $(call build_policy, $(sepolicy_build_files), \
1515$(BASE_PLAT_PUBLIC_POLICY) $(BASE_PLAT_PRIVATE_POLICY))
1516 $(transform-policy-to-conf)
1517 $(hide) sed '/dontaudit/d' $@ > $@.dontaudit
1518
1519built_plat_sepolicy := $(intermediates)/built_plat_sepolicy
1520$(built_plat_sepolicy): PRIVATE_ADDITIONAL_CIL_FILES := \
1521 $(call build_policy, $(sepolicy_build_cil_workaround_files), $(BASE_PLAT_PRIVATE_POLICY))
Joel Galenson5988b562018-01-03 16:53:24 -08001522$(built_plat_sepolicy): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
Dan Cashman91d398d2017-09-26 12:58:29 -07001523$(built_plat_sepolicy): $(base_plat_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
1524$(HOST_OUT_EXECUTABLES)/secilc \
Joel Galenson5988b562018-01-03 16:53:24 -08001525$(call build_policy, $(sepolicy_build_cil_workaround_files), $(BASE_PLAT_PRIVATE_POLICY)) \
1526$(built_sepolicy_neverallows)
Dan Cashman91d398d2017-09-26 12:58:29 -07001527 @mkdir -p $(dir $@)
1528 $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \
1529 $(POLICYVERS) -o $@ $<
1530 $(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@
Joel Galenson5988b562018-01-03 16:53:24 -08001531 $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $@ -o $@ -f /dev/null
Dan Cashman91d398d2017-09-26 12:58:29 -07001532
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001533all_fc_files := $(built_plat_fc) $(built_vendor_fc)
Bowgo Tsaibae15172017-11-29 16:14:53 +08001534ifdef BOARD_ODM_SEPOLICY_DIRS
1535all_fc_files += $(built_odm_fc)
1536endif
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001537all_fc_args := $(foreach file, $(all_fc_files), -f $(file))
1538
Tri Vo14069262018-01-31 16:22:35 -08001539# Tests for Treble compatibility of current platform policy and vendor policy of
1540# given release version.
1541version_under_treble_tests := 26.0
1542include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk
Dan Cashman91d398d2017-09-26 12:58:29 -07001543
Tri Vo9299d932018-01-31 16:50:28 -08001544version_under_treble_tests := 27.0
1545include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk
1546
Dan Cashman91d398d2017-09-26 12:58:29 -07001547BASE_PLAT_PUBLIC_POLICY :=
1548BASE_PLAT_PRIVATE_POLICY :=
1549base_plat_policy.conf :=
Dan Cashman91d398d2017-09-26 12:58:29 -07001550plat_sepolicy :=
1551
Steven Moreland763697d2017-11-09 11:24:56 -08001552endif # ($(PRODUCT_SEPOLICY_SPLIT),true)
Jeff Vander Stoep1fc06822017-05-31 15:36:07 -07001553#################################
rpcraig47cd3962012-10-17 21:09:52 -04001554
Dan Cashman1c040272016-12-15 15:28:44 -08001555add_nl :=
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001556build_vendor_policy :=
Bowgo Tsaibae15172017-11-29 16:14:53 +08001557build_odm_policy :=
Dan Cashman1c040272016-12-15 15:28:44 -08001558build_policy :=
dcashmand225b692016-12-12 09:29:04 -08001559built_plat_fc :=
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001560built_vendor_fc :=
Bowgo Tsaibae15172017-11-29 16:14:53 +08001561built_odm_fc :=
Richard Hainesc8801fe2015-12-11 10:39:19 +00001562built_nl :=
Alex Klyubin8f7173b2017-02-25 14:47:53 -08001563built_plat_cil :=
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001564built_plat_pub_vers_cil :=
Alex Klyubin8f7173b2017-02-25 14:47:53 -08001565built_mapping_cil :=
Sandeep Patila86316e2016-12-27 16:08:44 -08001566built_plat_pc :=
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001567built_vendor_cil :=
1568built_vendor_pc :=
1569built_vendor_sc :=
Bowgo Tsai45457e32017-11-27 11:41:33 +08001570built_odm_cil :=
Bowgo Tsai1f717b12017-11-29 16:15:55 +08001571built_odm_pc :=
Bowgo Tsaiecf656b2017-11-29 16:15:28 +08001572built_odm_sc :=
Dan Cashman9c038072016-12-22 07:15:18 -08001573built_plat_sc :=
Alex Klyubin193dccd2017-03-07 14:05:57 -08001574built_precompiled_sepolicy :=
Dan Cashman1c040272016-12-15 15:28:44 -08001575built_sepolicy :=
Joel Galenson5988b562018-01-03 16:53:24 -08001576built_sepolicy_neverallows :=
Sandeep Patila058b562016-12-27 15:10:48 -08001577built_plat_svc :=
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001578built_vendor_svc :=
Jeff Vander Stoepb8787692017-04-21 15:57:07 -07001579mapping_policy :=
Dan Cashman1c040272016-12-15 15:28:44 -08001580my_target_arch :=
dcashman1faa6442016-11-28 07:20:28 -08001581plat_pub_policy.cil :=
1582reqd_policy_mask.cil :=
Dan Cashman1c040272016-12-15 15:28:44 -08001583sepolicy_build_files :=
Alex Klyubin7cda44f2017-03-21 14:28:53 -07001584sepolicy_build_cil_workaround_files :=
Jeff Vander Stoep74434842017-03-13 12:22:15 -07001585with_asan :=
Alice Chucdfb06f2012-11-01 11:33:04 -07001586
1587include $(call all-makefiles-under,$(LOCAL_PATH))