blob: f02c6211b0c8545f7290820395de78c5cd5bed8a [file] [log] [blame]
Stephen Smalley2dd4e512012-01-04 12:33:27 -05001LOCAL_PATH:= $(call my-dir)
William Robertsf0e0a942012-08-27 15:41:15 -07002
Dan Cashman36ee91d2017-07-07 14:59:51 -07003include $(LOCAL_PATH)/definitions.mk
4
Stephen Smalley2dd4e512012-01-04 12:33:27 -05005include $(CLEAR_VARS)
Stephen Smalley2dd4e512012-01-04 12:33:27 -05006# SELinux policy version.
Stephen Smalleyb4f17062015-03-13 10:03:52 -04007# Must be <= /sys/fs/selinux/policyvers reported by the Android kernel.
Stephen Smalley2dd4e512012-01-04 12:33:27 -05008# Must be within the compatibility range reported by checkpolicy -V.
Jeff Vander Stoep3a0ce492015-12-07 08:30:43 -08009POLICYVERS ?= 30
Stephen Smalley2dd4e512012-01-04 12:33:27 -050010
11MLS_SENS=1
12MLS_CATS=1024
13
Stephen Smalleyb4f17062015-03-13 10:03:52 -040014ifdef BOARD_SEPOLICY_REPLACE
15$(error BOARD_SEPOLICY_REPLACE is no longer supported; please remove from your BoardConfig.mk or other .mk file.)
16endif
17
18ifdef BOARD_SEPOLICY_IGNORE
19$(error BOARD_SEPOLICY_IGNORE is no longer supported; please remove from your BoardConfig.mk or other .mk file.)
20endif
Stephen Smalley5b340be2012-03-06 11:12:41 -050021
Stephen Smalley8e0ca882015-04-01 10:14:56 -040022ifdef BOARD_SEPOLICY_UNION
23$(warning BOARD_SEPOLICY_UNION is no longer required - all files found in BOARD_SEPOLICY_DIRS are implicitly unioned; please remove from your BoardConfig.mk or other .mk file.)
24endif
Robert Craig6b0ff472014-01-29 13:10:58 -050025
William Robertsd2185582015-07-16 11:28:02 -070026ifdef BOARD_SEPOLICY_M4DEFS
27LOCAL_ADDITIONAL_M4DEFS := $(addprefix -D, $(BOARD_SEPOLICY_M4DEFS))
Dan Cashman36ee91d2017-07-07 14:59:51 -070028else
29LOCAL_ADDITIONAL_M4DEFS :=
William Robertsd2185582015-07-16 11:28:02 -070030endif
31
dcashmancc39f632016-07-22 13:13:11 -070032# sepolicy is now divided into multiple portions:
33# public - policy exported on which non-platform policy developers may write
34# additional policy. types and attributes are versioned and included in
35# delivered non-platform policy, which is to be combined with platform policy.
36# private - platform-only policy required for platform functionality but which
37# is not exported to vendor policy developers and as such may not be assumed
38# to exist.
Alex Klyubin55961722017-01-30 18:44:59 -080039# vendor - vendor-only policy required for vendor functionality. This policy can
40# reference the public policy but cannot reference the private policy. This
41# policy is for components which are produced from the core/non-vendor tree and
42# placed into a vendor partition.
dcashman07791552016-12-07 11:27:47 -080043# mapping - This contains policy statements which map the attributes
dcashmancc39f632016-07-22 13:13:11 -070044# exposed in the public policy of previous versions to the concrete types used
45# in this policy to ensure that policy targeting attributes from public
46# policy from an older platform version continues to work.
47
dcashman2e00e632016-10-12 14:58:09 -070048# build process for device:
dcashmancc39f632016-07-22 13:13:11 -070049# 1) convert policies to CIL:
50# - private + public platform policy to CIL
51# - mapping file to CIL (should already be in CIL form)
52# - non-platform public policy to CIL
53# - non-platform public + private policy to CIL
54# 2) attributize policy
dcashmancc39f632016-07-22 13:13:11 -070055# - run script which takes non-platform public and non-platform combined
56# private + public policy and produces attributized and versioned
57# non-platform policy
58# 3) combine policy files
59# - combine mapping, platform and non-platform policy.
60# - compile output binary policy file
61
62PLAT_PUBLIC_POLICY := $(LOCAL_PATH)/public
Dan Cashman51455fe2017-05-23 14:47:16 -070063ifneq ( ,$(BOARD_PLAT_PUBLIC_SEPOLICY_DIR))
64ifneq (1, $(words $(BOARD_PLAT_PUBLIC_SEPOLICY_DIR)))
65$(error BOARD_PLAT_PUBLIC_SEPOLICY_DIR must only contain one directory)
66else
67PLAT_PUBLIC_POLICY += $(BOARD_PLAT_PUBLIC_SEPOLICY_DIR)
68endif
69endif
dcashmancc39f632016-07-22 13:13:11 -070070PLAT_PRIVATE_POLICY := $(LOCAL_PATH)/private
Dan Cashman51455fe2017-05-23 14:47:16 -070071ifneq ( ,$(BOARD_PLAT_PRIVATE_SEPOLICY_DIR))
72ifneq (1, $(words $(BOARD_PLAT_PRIVATE_SEPOLICY_DIR)))
73$(error BOARD_PLAT_PRIVATE_SEPOLICY_DIR must only contain one directory)
74else
75PLAT_PRIVATE_POLICY += $(BOARD_PLAT_PRIVATE_SEPOLICY_DIR)
76endif
77endif
Alex Klyubin55961722017-01-30 18:44:59 -080078PLAT_VENDOR_POLICY := $(LOCAL_PATH)/vendor
dcashman2e00e632016-10-12 14:58:09 -070079REQD_MASK_POLICY := $(LOCAL_PATH)/reqd_mask
80
81# TODO: move to README when doing the README update and finalizing versioning.
Sandeep Patil42f95982017-04-07 14:18:48 -070082# BOARD_SEPOLICY_VERS must take the format "NN.m" and contain the sepolicy
83# version identifier corresponding to the sepolicy on which the non-platform
84# policy is to be based. If unspecified, this will build against the current
85# public platform policy in tree
dcashman2e00e632016-10-12 14:58:09 -070086ifndef BOARD_SEPOLICY_VERS
87$(warning BOARD_SEPOLICY_VERS not specified, assuming current platform version)
Sandeep Patil42f95982017-04-07 14:18:48 -070088# The default platform policy version.
Dan Cashman6f14f6b2017-04-07 16:36:23 -070089BOARD_SEPOLICY_VERS := $(PLATFORM_SEPOLICY_VERSION)
dcashman2e00e632016-10-12 14:58:09 -070090endif
dcashmancc39f632016-07-22 13:13:11 -070091
Joel Galenson5988b562018-01-03 16:53:24 -080092NEVERALLOW_ARG :=
93ifeq ($(SELINUX_IGNORE_NEVERALLOWS),true)
94ifeq ($(TARGET_BUILD_VARIANT),user)
95$(error SELINUX_IGNORE_NEVERALLOWS := true cannot be used in user builds)
96endif
97$(warning Be careful when using the SELINUX_IGNORE_NEVERALLOWS flag. \
98 It does not work in user builds and using it will \
99 not stop you from failing CTS.)
100NEVERALLOW_ARG := -N
101endif
102
Bowgo Tsai45457e32017-11-27 11:41:33 +0800103# BOARD_SEPOLICY_DIRS was used for vendor/odm sepolicy customization before.
104# It has been replaced by BOARD_VENDOR_SEPOLICY_DIRS (mandatory) and
105# BOARD_ODM_SEPOLICY_DIRS (optional). BOARD_SEPOLICY_DIRS is still allowed for
106# backward compatibility, which will be merged into BOARD_VENDOR_SEPOLICY_DIRS.
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800107ifdef BOARD_SEPOLICY_DIRS
108BOARD_VENDOR_SEPOLICY_DIRS += $(BOARD_SEPOLICY_DIRS)
109endif
Dan Cashman4d24a772017-04-12 14:28:34 -0700110
Bowgo Tsai45457e32017-11-27 11:41:33 +0800111ifdef BOARD_ODM_SEPOLICY_DIRS
112ifneq ($(PRODUCT_SEPOLICY_SPLIT),true)
113$(error PRODUCT_SEPOLICY_SPLIT needs to be true when using BOARD_ODM_SEPOLICY_DIRS)
114endif
115endif
116
Dan Cashman4d24a772017-04-12 14:28:34 -0700117platform_mapping_file := $(BOARD_SEPOLICY_VERS).cil
118
dcashmancc39f632016-07-22 13:13:11 -0700119###########################################################
120# Compute policy files to be used in policy build.
121# $(1): files to include
122# $(2): directories in which to find files
123###########################################################
124
125define build_policy
126$(foreach type, $(1), $(foreach file, $(addsuffix /$(type), $(2)), $(sort $(wildcard $(file)))))
127endef
William Roberts29d14682016-01-04 12:20:57 -0800128
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800129# Builds paths for all policy files found in BOARD_VENDOR_SEPOLICY_DIRS.
William Roberts49693f12016-01-04 12:20:57 -0800130# $(1): the set of policy name paths to build
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800131build_vendor_policy = $(call build_policy, $(1), $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS))
William Roberts49693f12016-01-04 12:20:57 -0800132
Richard Hainesc8801fe2015-12-11 10:39:19 +0000133# Add a file containing only a newline in-between each policy configuration
134# 'contexts' file. This will allow OEM policy configuration files without a
135# final newline (0x0A) to be built correctly by the m4(1) macro processor.
136# $(1): the set of contexts file names.
137# $(2): the file containing only 0x0A.
138add_nl = $(foreach entry, $(1), $(subst $(entry), $(entry) $(2), $(entry)))
139
dcashman704741a2014-07-25 19:11:52 -0700140sepolicy_build_files := security_classes \
141 initial_sids \
142 access_vectors \
143 global_macros \
Nick Kralevicha17a2662014-11-05 15:30:41 -0800144 neverallow_macros \
dcashman704741a2014-07-25 19:11:52 -0700145 mls_macros \
dcashman2e00e632016-10-12 14:58:09 -0700146 mls_decl \
dcashman704741a2014-07-25 19:11:52 -0700147 mls \
148 policy_capabilities \
149 te_macros \
150 attributes \
Jeff Vander Stoepcbaa2b72015-12-22 10:39:34 -0800151 ioctl_defines \
Jeff Vander Stoepde9b5302015-06-05 15:28:55 -0700152 ioctl_macros \
dcashman704741a2014-07-25 19:11:52 -0700153 *.te \
dcashman2e00e632016-10-12 14:58:09 -0700154 roles_decl \
dcashman704741a2014-07-25 19:11:52 -0700155 roles \
156 users \
157 initial_sid_contexts \
158 fs_use \
159 genfs_contexts \
160 port_contexts
161
Alex Klyubin7cda44f2017-03-21 14:28:53 -0700162# CIL files which contain workarounds for current limitation of human-readable
163# module policy language. These files are appended to the CIL files produced
164# from module language files.
165sepolicy_build_cil_workaround_files := technical_debt.cil
166
Dan Cashman1c040272016-12-15 15:28:44 -0800167my_target_arch := $(TARGET_ARCH)
168ifneq (,$(filter mips mips64,$(TARGET_ARCH)))
169 my_target_arch := mips
170endif
171
Jeff Vander Stoepd2053bd2017-03-15 13:37:35 -0700172intermediates := $(TARGET_OUT_INTERMEDIATES)/ETC/sepolicy_intermediates
173
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700174with_asan := false
175ifneq (,$(filter address,$(SANITIZE_TARGET)))
176 with_asan := true
177endif
178
Jeff Vander Stoep3ca843a2017-10-04 09:42:29 -0700179# Library extension for host-side tests
Jeff Vander Stoepe06e4c12017-10-04 18:15:44 -0700180ifeq ($(HOST_OS),darwin)
Jeff Vander Stoep3ca843a2017-10-04 09:42:29 -0700181SHAREDLIB_EXT=dylib
182else
183SHAREDLIB_EXT=so
184endif
185
Dan Cashman4f9a6482017-04-10 12:27:18 -0700186include $(CLEAR_VARS)
187LOCAL_MODULE := selinux_policy
188LOCAL_MODULE_TAGS := optional
189# Include SELinux policy. We do this here because different modules
Steven Moreland763697d2017-11-09 11:24:56 -0800190# need to be included based on the value of PRODUCT_SEPOLICY_SPLIT. This
Dan Cashman4f9a6482017-04-10 12:27:18 -0700191# type of conditional inclusion cannot be done in top-level files such
192# as build/target/product/embedded.mk.
193# This conditional inclusion closely mimics the conditional logic
194# inside init/init.cpp for loading SELinux policy from files.
Steven Moreland763697d2017-11-09 11:24:56 -0800195ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Dan Cashman4f9a6482017-04-10 12:27:18 -0700196
Dan Cashman4f9a6482017-04-10 12:27:18 -0700197# Use split SELinux policy
198LOCAL_REQUIRED_MODULES += \
199 $(platform_mapping_file) \
Yifan Hong617e8532018-02-07 11:13:57 -0800200 $(addsuffix .cil,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS)) \
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800201 plat_pub_versioned.cil \
202 vendor_sepolicy.cil \
Dan Cashman4f9a6482017-04-10 12:27:18 -0700203 plat_sepolicy.cil \
204 plat_and_mapping_sepolicy.cil.sha256 \
205 secilc \
Jeff Vander Stoep1fc06822017-05-31 15:36:07 -0700206 plat_sepolicy_vers.txt \
Dan Cashman91d398d2017-09-26 12:58:29 -0700207
Dan Cashman4f9a6482017-04-10 12:27:18 -0700208# Include precompiled policy, unless told otherwise
209ifneq ($(PRODUCT_PRECOMPILED_SEPOLICY),false)
210LOCAL_REQUIRED_MODULES += precompiled_sepolicy precompiled_sepolicy.plat_and_mapping.sha256
211endif
Dan Cashman4f9a6482017-04-10 12:27:18 -0700212else
Bowgo Tsai741a70a2018-02-05 17:41:02 +0800213# The following files are only allowed for non-Treble devices.
214LOCAL_REQUIRED_MODULES += \
215 sepolicy \
216 vendor_service_contexts
Dan Cashman4f9a6482017-04-10 12:27:18 -0700217endif
Jeff Vander Stoep7a68c5a2017-06-08 13:24:15 -0700218
219LOCAL_REQUIRED_MODULES += \
Bowgo Tsai741a70a2018-02-05 17:41:02 +0800220 build_sepolicy \
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800221 vendor_file_contexts \
222 vendor_mac_permissions.xml \
223 vendor_property_contexts \
224 vendor_seapp_contexts \
225 vendor_hwservice_contexts \
Jeff Vander Stoep13fb5ed2017-08-22 13:29:53 -0700226 plat_file_contexts \
227 plat_mac_permissions.xml \
228 plat_property_contexts \
229 plat_seapp_contexts \
230 plat_service_contexts \
231 plat_hwservice_contexts \
Dan Cashman91d398d2017-09-26 12:58:29 -0700232 searchpolicy \
Jeff Vander Stoep13fb5ed2017-08-22 13:29:53 -0700233 vndservice_contexts \
Jeff Vander Stoep7a68c5a2017-06-08 13:24:15 -0700234
Dan Cashman91d398d2017-09-26 12:58:29 -0700235ifneq ($(TARGET_BUILD_VARIANT), user)
236LOCAL_REQUIRED_MODULES += \
237 selinux_denial_metadata \
238
239endif
240
241ifneq ($(with_asan),true)
Jeff Vander Stoep3d4965b2018-02-13 20:29:55 -0800242ifneq ($(SELINUX_IGNORE_NEVERALLOWS),true)
Dan Cashman91d398d2017-09-26 12:58:29 -0700243LOCAL_REQUIRED_MODULES += \
244 sepolicy_tests \
Tri Vo14069262018-01-31 16:22:35 -0800245 treble_sepolicy_tests_26.0 \
Tri Vo9299d932018-01-31 16:50:28 -0800246 treble_sepolicy_tests_27.0 \
Dan Cashman91d398d2017-09-26 12:58:29 -0700247
248endif
Jeff Vander Stoep3d4965b2018-02-13 20:29:55 -0800249endif
Dan Cashman91d398d2017-09-26 12:58:29 -0700250
Bowgo Tsai45457e32017-11-27 11:41:33 +0800251ifdef BOARD_ODM_SEPOLICY_DIRS
252LOCAL_REQUIRED_MODULES += odm_sepolicy.cil
253endif
254
Dan Cashman4f9a6482017-04-10 12:27:18 -0700255include $(BUILD_PHONY_PACKAGE)
256
Joel Galenson5988b562018-01-03 16:53:24 -0800257#################################
258include $(CLEAR_VARS)
259
260LOCAL_MODULE := sepolicy_neverallows
261LOCAL_MODULE_CLASS := ETC
262LOCAL_MODULE_TAGS := optional
263LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
264
265include $(BUILD_SYSTEM)/base_rules.mk
266
267# sepolicy_policy.conf - All of the policy for the device. This is only used to
268# check neverallow rules.
269sepolicy_policy.conf := $(intermediates)/policy.conf
270$(sepolicy_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
271$(sepolicy_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Joel Galenson8c72eea2018-03-07 15:36:29 -0800272$(sepolicy_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := user
Joel Galenson5988b562018-01-03 16:53:24 -0800273$(sepolicy_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
274$(sepolicy_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
275$(sepolicy_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
276$(sepolicy_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
277$(sepolicy_policy.conf): $(call build_policy, $(sepolicy_build_files), \
278$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS))
279 $(transform-policy-to-conf)
280 $(hide) sed '/dontaudit/d' $@ > $@.dontaudit
281
282$(LOCAL_BUILT_MODULE): $(sepolicy_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy
283 rm -f $@
284ifneq ($(SELINUX_IGNORE_NEVERALLOWS),true)
285 $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c \
286 $(POLICYVERS) -o $@ $<
287else # ($(SELINUX_IGNORE_NEVERALLOWS),true)
288 $(hide) touch $@
289endif # ($(SELINUX_IGNORE_NEVERALLOWS),true)
290
291sepolicy_policy.conf :=
292built_sepolicy_neverallows := $(LOCAL_BUILT_MODULE)
293
Ying Wang02fb5f32012-01-17 17:51:09 -0800294##################################
dcashman2e00e632016-10-12 14:58:09 -0700295# reqd_policy_mask - a policy.conf file which contains only the bare minimum
296# policy necessary to use checkpolicy. This bare-minimum policy needs to be
297# present in all policy.conf files, but should not necessarily be exported as
298# part of the public policy. The rules generated by reqd_policy_mask will allow
299# the compilation of public policy and subsequent removal of CIL policy that
300# should not be exported.
301
302reqd_policy_mask.conf := $(intermediates)/reqd_policy_mask.conf
303$(reqd_policy_mask.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
304$(reqd_policy_mask.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Joel Galenson8c72eea2018-03-07 15:36:29 -0800305$(reqd_policy_mask.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
Dan Cashman1c040272016-12-15 15:28:44 -0800306$(reqd_policy_mask.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700307$(reqd_policy_mask.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
dcashman2e00e632016-10-12 14:58:09 -0700308$(reqd_policy_mask.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Steven Moreland763697d2017-11-09 11:24:56 -0800309$(reqd_policy_mask.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
Jaekyun Seoke4971452017-10-19 16:54:49 +0900310$(reqd_policy_mask.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
dcashman2e00e632016-10-12 14:58:09 -0700311$(reqd_policy_mask.conf): $(call build_policy, $(sepolicy_build_files), $(REQD_MASK_POLICY))
Dan Cashman36ee91d2017-07-07 14:59:51 -0700312 $(transform-policy-to-conf)
Andreas Gampe3ddc78b2017-04-27 17:16:13 -0700313# b/37755687
314CHECKPOLICY_ASAN_OPTIONS := ASAN_OPTIONS=detect_leaks=0
315
dcashman2e00e632016-10-12 14:58:09 -0700316reqd_policy_mask.cil := $(intermediates)/reqd_policy_mask.cil
317$(reqd_policy_mask.cil): $(reqd_policy_mask.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy
318 @mkdir -p $(dir $@)
Andreas Gampe3ddc78b2017-04-27 17:16:13 -0700319 $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -C -M -c \
320 $(POLICYVERS) -o $@ $<
dcashman2e00e632016-10-12 14:58:09 -0700321
dcashman1faa6442016-11-28 07:20:28 -0800322reqd_policy_mask.conf :=
323
324##################################
dcashman2e00e632016-10-12 14:58:09 -0700325# plat_pub_policy - policy that will be exported to be a part of non-platform
326# policy corresponding to this platform version. This is a limited subset of
327# policy that would not compile in checkpolicy on its own. To get around this
328# limitation, add only the required files from private policy, which will
329# generate CIL policy that will then be filtered out by the reqd_policy_mask.
330plat_pub_policy.conf := $(intermediates)/plat_pub_policy.conf
331$(plat_pub_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
332$(plat_pub_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Joel Galenson8c72eea2018-03-07 15:36:29 -0800333$(plat_pub_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
Dan Cashman1c040272016-12-15 15:28:44 -0800334$(plat_pub_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700335$(plat_pub_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
dcashman2e00e632016-10-12 14:58:09 -0700336$(plat_pub_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Steven Moreland763697d2017-11-09 11:24:56 -0800337$(plat_pub_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
Jaekyun Seoke4971452017-10-19 16:54:49 +0900338$(plat_pub_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
dcashman2e00e632016-10-12 14:58:09 -0700339$(plat_pub_policy.conf): $(call build_policy, $(sepolicy_build_files), \
Dan Cashman6bf50e52017-04-12 11:12:17 -0700340$(PLAT_PUBLIC_POLICY) $(REQD_MASK_POLICY))
Dan Cashman36ee91d2017-07-07 14:59:51 -0700341 $(transform-policy-to-conf)
dcashman2e00e632016-10-12 14:58:09 -0700342plat_pub_policy.cil := $(intermediates)/plat_pub_policy.cil
dcashman1faa6442016-11-28 07:20:28 -0800343$(plat_pub_policy.cil): PRIVATE_POL_CONF := $(plat_pub_policy.conf)
344$(plat_pub_policy.cil): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil)
345$(plat_pub_policy.cil): $(HOST_OUT_EXECUTABLES)/checkpolicy $(plat_pub_policy.conf) $(reqd_policy_mask.cil)
dcashman2e00e632016-10-12 14:58:09 -0700346 @mkdir -p $(dir $@)
Andreas Gampe3ddc78b2017-04-27 17:16:13 -0700347 $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $< -C -M -c $(POLICYVERS) -o $@.tmp $(PRIVATE_POL_CONF)
dcashman1faa6442016-11-28 07:20:28 -0800348 $(hide) grep -Fxv -f $(PRIVATE_REQD_MASK) $@.tmp > $@
dcashman2e00e632016-10-12 14:58:09 -0700349
dcashman1faa6442016-11-28 07:20:28 -0800350plat_pub_policy.conf :=
Dan Cashman1c040272016-12-15 15:28:44 -0800351
dcashman1faa6442016-11-28 07:20:28 -0800352##################################
353include $(CLEAR_VARS)
354
355LOCAL_MODULE := sectxfile_nl
356LOCAL_MODULE_CLASS := ETC
357LOCAL_MODULE_TAGS := optional
358
359# Create a file containing newline only to add between context config files
360include $(BUILD_SYSTEM)/base_rules.mk
361$(LOCAL_BUILT_MODULE):
dcashman2e00e632016-10-12 14:58:09 -0700362 @mkdir -p $(dir $@)
dcashman1faa6442016-11-28 07:20:28 -0800363 $(hide) echo > $@
364
365built_nl := $(LOCAL_BUILT_MODULE)
366
367#################################
368include $(CLEAR_VARS)
369
370LOCAL_MODULE := plat_sepolicy.cil
371LOCAL_MODULE_CLASS := ETC
372LOCAL_MODULE_TAGS := optional
Alex Klyubin052b0bb2017-03-02 12:39:25 -0800373LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
dcashman1faa6442016-11-28 07:20:28 -0800374
375include $(BUILD_SYSTEM)/base_rules.mk
dcashman2e00e632016-10-12 14:58:09 -0700376
377# plat_policy.conf - A combination of the private and public platform policy
378# which will ship with the device. The platform will always reflect the most
379# recent platform version and is not currently being attributized.
380plat_policy.conf := $(intermediates)/plat_policy.conf
381$(plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
382$(plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Joel Galenson8c72eea2018-03-07 15:36:29 -0800383$(plat_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
Dan Cashman1c040272016-12-15 15:28:44 -0800384$(plat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700385$(plat_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
dcashman2e00e632016-10-12 14:58:09 -0700386$(plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Steven Moreland763697d2017-11-09 11:24:56 -0800387$(plat_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
Jaekyun Seoke4971452017-10-19 16:54:49 +0900388$(plat_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
dcashman2e00e632016-10-12 14:58:09 -0700389$(plat_policy.conf): $(call build_policy, $(sepolicy_build_files), \
dcashmancc39f632016-07-22 13:13:11 -0700390$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY))
Dan Cashman36ee91d2017-07-07 14:59:51 -0700391 $(transform-policy-to-conf)
dcashmancc39f632016-07-22 13:13:11 -0700392 $(hide) sed '/dontaudit/d' $@ > $@.dontaudit
393
Jeff Vander Stoepb8787692017-04-21 15:57:07 -0700394$(LOCAL_BUILT_MODULE): PRIVATE_ADDITIONAL_CIL_FILES := \
Alex Klyubin7cda44f2017-03-21 14:28:53 -0700395 $(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY))
Joel Galenson5988b562018-01-03 16:53:24 -0800396$(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
Jeff Vander Stoepb8787692017-04-21 15:57:07 -0700397$(LOCAL_BUILT_MODULE): $(plat_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
398 $(HOST_OUT_EXECUTABLES)/secilc \
Joel Galenson5988b562018-01-03 16:53:24 -0800399 $(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY)) \
400 $(built_sepolicy_neverallows)
dcashman2e00e632016-10-12 14:58:09 -0700401 @mkdir -p $(dir $@)
Andreas Gampe3ddc78b2017-04-27 17:16:13 -0700402 $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \
403 $(POLICYVERS) -o $@ $<
Alex Klyubin7cda44f2017-03-21 14:28:53 -0700404 $(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@
Joel Galenson5988b562018-01-03 16:53:24 -0800405 $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $@ -o /dev/null -f /dev/null
dcashman1faa6442016-11-28 07:20:28 -0800406
Alex Klyubin8f7173b2017-02-25 14:47:53 -0800407built_plat_cil := $(LOCAL_BUILT_MODULE)
dcashman1faa6442016-11-28 07:20:28 -0800408plat_policy.conf :=
409
410#################################
411include $(CLEAR_VARS)
412
Dan Cashman4f9a6482017-04-10 12:27:18 -0700413LOCAL_MODULE := plat_sepolicy_vers.txt
dcashman1faa6442016-11-28 07:20:28 -0800414LOCAL_MODULE_CLASS := ETC
415LOCAL_MODULE_TAGS := optional
Dan Cashman4f9a6482017-04-10 12:27:18 -0700416LOCAL_PROPRIETARY_MODULE := true
417LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
418
419include $(BUILD_SYSTEM)/base_rules.mk
420
421$(LOCAL_BUILT_MODULE) : PRIVATE_PLAT_SEPOL_VERS := $(BOARD_SEPOLICY_VERS)
422$(LOCAL_BUILT_MODULE) :
423 mkdir -p $(dir $@)
424 echo $(PRIVATE_PLAT_SEPOL_VERS) > $@
425
426#################################
427include $(CLEAR_VARS)
428
429LOCAL_MODULE := $(platform_mapping_file)
430LOCAL_MODULE_CLASS := ETC
431LOCAL_MODULE_TAGS := optional
432LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux/mapping
dcashman1faa6442016-11-28 07:20:28 -0800433
434include $(BUILD_SYSTEM)/base_rules.mk
435
Dan Cashman1b0a71f2017-05-08 14:26:52 -0700436current_mapping.cil := $(intermediates)/mapping/$(PLATFORM_SEPOLICY_VERSION).cil
437ifeq ($(BOARD_SEPOLICY_VERS), $(PLATFORM_SEPOLICY_VERSION))
dcashman1faa6442016-11-28 07:20:28 -0800438# auto-generate the mapping file for current platform policy, since it needs to
439# track platform policy development
Dan Cashman6f14f6b2017-04-07 16:36:23 -0700440$(current_mapping.cil) : PRIVATE_VERS := $(PLATFORM_SEPOLICY_VERSION)
dcashman1faa6442016-11-28 07:20:28 -0800441$(current_mapping.cil) : $(plat_pub_policy.cil) $(HOST_OUT_EXECUTABLES)/version_policy
442 @mkdir -p $(dir $@)
443 $(hide) $(HOST_OUT_EXECUTABLES)/version_policy -b $< -m -n $(PRIVATE_VERS) -o $@
444
Dan Cashman1b0a71f2017-05-08 14:26:52 -0700445else # ifeq ($(BOARD_SEPOLICY_VERS), $(PLATFORM_SEPOLICY_VERSION))
446prebuilt_mapping_files := $(wildcard $(addsuffix /mapping/$(BOARD_SEPOLICY_VERS).cil, $(PLAT_PRIVATE_POLICY)))
447$(current_mapping.cil) : $(prebuilt_mapping_files)
448 @mkdir -p $(dir $@)
449 cat $^ > $@
Sandeep Patil42f95982017-04-07 14:18:48 -0700450
Dan Cashman1b0a71f2017-05-08 14:26:52 -0700451prebuilt_mapping_files :=
dcashman1faa6442016-11-28 07:20:28 -0800452endif
453
Dan Cashman1b0a71f2017-05-08 14:26:52 -0700454$(LOCAL_BUILT_MODULE): $(current_mapping.cil) $(ACP)
Jeff Vander Stoepb8787692017-04-21 15:57:07 -0700455 $(hide) $(ACP) $< $@
dcashman1faa6442016-11-28 07:20:28 -0800456
Alex Klyubin8f7173b2017-02-25 14:47:53 -0800457built_mapping_cil := $(LOCAL_BUILT_MODULE)
dcashman1faa6442016-11-28 07:20:28 -0800458current_mapping.cil :=
459
460#################################
461include $(CLEAR_VARS)
462
Tri Vofb558082018-01-31 18:07:24 -0800463LOCAL_MODULE := 27.0.cil
464LOCAL_SRC_FILES := private/compat/27.0/27.0.cil
465LOCAL_MODULE_CLASS := ETC
466LOCAL_MODULE_TAGS := optional
467LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux/mapping
468
469include $(BUILD_PREBUILT)
470#################################
471include $(CLEAR_VARS)
472
Dan Cashmanc96721e2017-09-28 15:06:39 -0700473LOCAL_MODULE := 26.0.cil
474LOCAL_SRC_FILES := private/compat/26.0/26.0.cil
475LOCAL_MODULE_CLASS := ETC
476LOCAL_MODULE_TAGS := optional
477LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux/mapping
478
479include $(BUILD_PREBUILT)
480#################################
481include $(CLEAR_VARS)
482
Dan Cashman0e9c47c2017-04-04 14:27:41 -0700483LOCAL_MODULE := plat_and_mapping_sepolicy.cil.sha256
484LOCAL_MODULE_CLASS := ETC
485LOCAL_MODULE_TAGS := optional
486LOCAL_MODULE_PATH = $(TARGET_OUT)/etc/selinux
487
488include $(BUILD_SYSTEM)/base_rules.mk
489
490$(LOCAL_BUILT_MODULE): $(built_plat_cil) $(built_mapping_cil)
491 cat $^ | sha256sum | cut -d' ' -f1 > $@
492
493#################################
494include $(CLEAR_VARS)
495
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800496# plat_pub_versioned.cil - the exported platform policy associated with the version
497# that non-platform policy targets.
498LOCAL_MODULE := plat_pub_versioned.cil
dcashman1faa6442016-11-28 07:20:28 -0800499LOCAL_MODULE_CLASS := ETC
500LOCAL_MODULE_TAGS := optional
Alex Klyubin052b0bb2017-03-02 12:39:25 -0800501LOCAL_PROPRIETARY_MODULE := true
502LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
dcashman1faa6442016-11-28 07:20:28 -0800503
504include $(BUILD_SYSTEM)/base_rules.mk
505
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800506$(LOCAL_BUILT_MODULE) : PRIVATE_VERS := $(BOARD_SEPOLICY_VERS)
507$(LOCAL_BUILT_MODULE) : PRIVATE_TGT_POL := $(plat_pub_policy.cil)
508$(LOCAL_BUILT_MODULE) : PRIVATE_DEP_CIL_FILES := $(built_plat_cil) $(built_mapping_cil)
509$(LOCAL_BUILT_MODULE) : $(plat_pub_policy.cil) $(HOST_OUT_EXECUTABLES)/version_policy \
510 $(HOST_OUT_EXECUTABLES)/secilc $(built_plat_cil) $(built_mapping_cil)
511 @mkdir -p $(dir $@)
512 $(HOST_OUT_EXECUTABLES)/version_policy -b $< -t $(PRIVATE_TGT_POL) -n $(PRIVATE_VERS) -o $@
513 $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -N -c $(POLICYVERS) \
514 $(PRIVATE_DEP_CIL_FILES) $@ -o /dev/null -f /dev/null
515
516built_plat_pub_vers_cil := $(LOCAL_BUILT_MODULE)
517
518#################################
519include $(CLEAR_VARS)
520
521# vendor_policy.cil - the vendor sepolicy. This needs attributization and to be combined
522# with the platform-provided policy. It makes use of the reqd_policy_mask files from private
523# policy and the platform public policy files in order to use checkpolicy.
524LOCAL_MODULE := vendor_sepolicy.cil
525LOCAL_MODULE_CLASS := ETC
526LOCAL_MODULE_TAGS := optional
527LOCAL_PROPRIETARY_MODULE := true
528LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
529
530include $(BUILD_SYSTEM)/base_rules.mk
531
532vendor_policy.conf := $(intermediates)/vendor_policy.conf
533$(vendor_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
534$(vendor_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Joel Galenson8c72eea2018-03-07 15:36:29 -0800535$(vendor_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800536$(vendor_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
537$(vendor_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
538$(vendor_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
539$(vendor_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
540$(vendor_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
541$(vendor_policy.conf): $(call build_policy, $(sepolicy_build_files), \
542$(PLAT_PUBLIC_POLICY) $(REQD_MASK_POLICY) $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS))
Dan Cashman36ee91d2017-07-07 14:59:51 -0700543 $(transform-policy-to-conf)
Robert Craig65d4f442013-03-27 06:30:25 -0400544 $(hide) sed '/dontaudit/d' $@ > $@.dontaudit
Stephen Smalley2dd4e512012-01-04 12:33:27 -0500545
Bowgo Tsai741a70a2018-02-05 17:41:02 +0800546$(LOCAL_BUILT_MODULE): PRIVATE_POL_CONF := $(vendor_policy.conf)
547$(LOCAL_BUILT_MODULE): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil)
548$(LOCAL_BUILT_MODULE): PRIVATE_BASE_CIL := $(plat_pub_policy.cil)
549$(LOCAL_BUILT_MODULE): PRIVATE_VERS := $(BOARD_SEPOLICY_VERS)
550$(LOCAL_BUILT_MODULE): PRIVATE_DEP_CIL_FILES := $(built_plat_cil) $(built_plat_pub_vers_cil) $(built_mapping_cil)
551$(LOCAL_BUILT_MODULE): PRIVATE_FILTER_CIL := $(built_plat_pub_vers_cil)
552$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/build_sepolicy \
553 $(vendor_policy.conf) $(reqd_policy_mask.cil) $(plat_pub_policy.cil) \
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800554 $(built_plat_cil) $(built_plat_pub_vers_cil) $(built_mapping_cil)
dcashman2e00e632016-10-12 14:58:09 -0700555 @mkdir -p $(dir $@)
Bowgo Tsai741a70a2018-02-05 17:41:02 +0800556 $(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) build_cil \
557 -i $(PRIVATE_POL_CONF) -m $(PRIVATE_REQD_MASK) -c $(CHECKPOLICY_ASAN_OPTIONS) \
558 -b $(PRIVATE_BASE_CIL) -d $(PRIVATE_DEP_CIL_FILES) -f $(PRIVATE_FILTER_CIL) \
559 -t $(PRIVATE_VERS) -p $(POLICYVERS) -o $@
dcashman2e00e632016-10-12 14:58:09 -0700560
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800561built_vendor_cil := $(LOCAL_BUILT_MODULE)
562vendor_policy.conf :=
dcashman1faa6442016-11-28 07:20:28 -0800563
564#################################
565include $(CLEAR_VARS)
Alex Klyubin193dccd2017-03-07 14:05:57 -0800566
Bowgo Tsai45457e32017-11-27 11:41:33 +0800567# odm_policy.cil - the odm sepolicy. This needs attributization and to be combined
568# with the platform-provided policy. It makes use of the reqd_policy_mask files from private
569# policy and the platform public policy files in order to use checkpolicy.
570LOCAL_MODULE := odm_sepolicy.cil
571LOCAL_MODULE_CLASS := ETC
572LOCAL_MODULE_TAGS := optional
573LOCAL_PROPRIETARY_MODULE := true
574LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux
575
576include $(BUILD_SYSTEM)/base_rules.mk
577
578odm_policy.conf := $(intermediates)/odm_policy.conf
579$(odm_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
580$(odm_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
581$(odm_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
582$(odm_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
583$(odm_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
584$(odm_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
585$(odm_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
586$(odm_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
587$(odm_policy.conf): $(call build_policy, $(sepolicy_build_files), \
588 $(PLAT_PUBLIC_POLICY) $(REQD_MASK_POLICY) $(PLAT_VENDOR_POLICY) \
589 $(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_ODM_SEPOLICY_DIRS))
590 $(transform-policy-to-conf)
591 $(hide) sed '/dontaudit/d' $@ > $@.dontaudit
592
593$(LOCAL_BUILT_MODULE): PRIVATE_POL_CONF := $(odm_policy.conf)
594$(LOCAL_BUILT_MODULE): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil)
595$(LOCAL_BUILT_MODULE): PRIVATE_BASE_CIL := $(plat_pub_policy.cil)
596$(LOCAL_BUILT_MODULE): PRIVATE_VERS := $(BOARD_SEPOLICY_VERS)
597$(LOCAL_BUILT_MODULE): PRIVATE_DEP_CIL_FILES := $(built_plat_cil) $(built_plat_pub_vers_cil) \
598 $(built_mapping_cil) $(built_vendor_cil)
599$(LOCAL_BUILT_MODULE) : PRIVATE_FILTER_CIL_FILES := $(built_plat_pub_vers_cil) $(built_vendor_cil)
600$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/build_sepolicy \
601 $(odm_policy.conf) $(reqd_policy_mask.cil) $(plat_pub_policy.cil) \
602 $(built_plat_cil) $(built_plat_pub_vers_cil) $(built_mapping_cil) $(built_vendor_cil)
603 @mkdir -p $(dir $@)
604 $(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) build_cil \
605 -i $(PRIVATE_POL_CONF) -m $(PRIVATE_REQD_MASK) -c $(CHECKPOLICY_ASAN_OPTIONS) \
606 -b $(PRIVATE_BASE_CIL) -d $(PRIVATE_DEP_CIL_FILES) -f $(PRIVATE_FILTER_CIL_FILES) \
607 -t $(PRIVATE_VERS) -p $(POLICYVERS) -o $@
608
609built_odm_cil := $(LOCAL_BUILT_MODULE)
610odm_policy.conf :=
611odm_policy_raw :=
612
613#################################
614include $(CLEAR_VARS)
615
Alex Klyubin193dccd2017-03-07 14:05:57 -0800616LOCAL_MODULE := precompiled_sepolicy
617LOCAL_MODULE_CLASS := ETC
618LOCAL_MODULE_TAGS := optional
619LOCAL_PROPRIETARY_MODULE := true
Bowgo Tsai45457e32017-11-27 11:41:33 +0800620
621ifeq ($(BOARD_USES_ODMIMAGE),true)
622LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux
623else
Alex Klyubin193dccd2017-03-07 14:05:57 -0800624LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
Bowgo Tsai45457e32017-11-27 11:41:33 +0800625endif
Alex Klyubin193dccd2017-03-07 14:05:57 -0800626
627include $(BUILD_SYSTEM)/base_rules.mk
628
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800629all_cil_files := \
630 $(built_plat_cil) \
631 $(built_mapping_cil) \
632 $(built_plat_pub_vers_cil) \
633 $(built_vendor_cil)
634
Bowgo Tsai45457e32017-11-27 11:41:33 +0800635ifdef BOARD_ODM_SEPOLICY_DIRS
636all_cil_files += $(built_odm_cil)
637endif
638
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800639$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(all_cil_files)
Joel Galenson5988b562018-01-03 16:53:24 -0800640$(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800641$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(all_cil_files) $(built_sepolicy_neverallows)
Joel Galenson5988b562018-01-03 16:53:24 -0800642 $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) \
Alex Klyubin193dccd2017-03-07 14:05:57 -0800643 $(PRIVATE_CIL_FILES) -o $@ -f /dev/null
644
645built_precompiled_sepolicy := $(LOCAL_BUILT_MODULE)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800646all_cil_files :=
Alex Klyubin193dccd2017-03-07 14:05:57 -0800647
648#################################
Dan Cashman0e9c47c2017-04-04 14:27:41 -0700649# SHA-256 digest of the plat_sepolicy.cil and mapping_sepolicy.cil files against
650# which precompiled_policy was built.
Alex Klyubin193dccd2017-03-07 14:05:57 -0800651#################################
652include $(CLEAR_VARS)
Dan Cashman0e9c47c2017-04-04 14:27:41 -0700653LOCAL_MODULE := precompiled_sepolicy.plat_and_mapping.sha256
Alex Klyubin193dccd2017-03-07 14:05:57 -0800654LOCAL_MODULE_CLASS := ETC
655LOCAL_MODULE_TAGS := optional
656LOCAL_PROPRIETARY_MODULE := true
Bowgo Tsai45457e32017-11-27 11:41:33 +0800657
658ifeq ($(BOARD_USES_ODMIMAGE),true)
659LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux
660else
Alex Klyubin193dccd2017-03-07 14:05:57 -0800661LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
Bowgo Tsai45457e32017-11-27 11:41:33 +0800662endif
Alex Klyubin193dccd2017-03-07 14:05:57 -0800663
664include $(BUILD_SYSTEM)/base_rules.mk
665
Dan Cashman0e9c47c2017-04-04 14:27:41 -0700666$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(built_plat_cil) $(built_mapping_cil)
667$(LOCAL_BUILT_MODULE): $(built_precompiled_sepolicy) $(built_plat_cil) $(built_mapping_cil)
668 cat $(PRIVATE_CIL_FILES) | sha256sum | cut -d' ' -f1 > $@
Alex Klyubin193dccd2017-03-07 14:05:57 -0800669
670#################################
671include $(CLEAR_VARS)
Dan Cashman1c040272016-12-15 15:28:44 -0800672# build this target so that we can still perform neverallow checks
dcashman1faa6442016-11-28 07:20:28 -0800673
674LOCAL_MODULE := sepolicy
675LOCAL_MODULE_CLASS := ETC
676LOCAL_MODULE_TAGS := optional
Daniel Cashman65d01342016-12-17 00:53:26 +0000677LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
dcashman2e00e632016-10-12 14:58:09 -0700678
dcashman1faa6442016-11-28 07:20:28 -0800679include $(BUILD_SYSTEM)/base_rules.mk
680
dcashman2e00e632016-10-12 14:58:09 -0700681all_cil_files := \
Jeff Vander Stoepb8787692017-04-21 15:57:07 -0700682 $(built_plat_cil) \
683 $(built_mapping_cil) \
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800684 $(built_plat_pub_vers_cil) \
685 $(built_vendor_cil)
dcashman2e00e632016-10-12 14:58:09 -0700686
Bowgo Tsai45457e32017-11-27 11:41:33 +0800687ifdef BOARD_ODM_SEPOLICY_DIRS
688all_cil_files += $(built_odm_cil)
689endif
690
dcashman2e00e632016-10-12 14:58:09 -0700691$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(all_cil_files)
Joel Galenson5988b562018-01-03 16:53:24 -0800692$(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
693$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $(all_cil_files) \
694$(built_sepolicy_neverallows)
dcashman2e00e632016-10-12 14:58:09 -0700695 @mkdir -p $(dir $@)
Joel Galenson5988b562018-01-03 16:53:24 -0800696 $(hide) $< -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $(PRIVATE_CIL_FILES) -o $@.tmp -f /dev/null
Nick Kralevichbca98ef2016-02-26 20:06:52 -0800697 $(hide) $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $@.tmp permissive > $@.permissivedomains
698 $(hide) if [ "$(TARGET_BUILD_VARIANT)" = "user" -a -s $@.permissivedomains ]; then \
699 echo "==========" 1>&2; \
700 echo "ERROR: permissive domains not allowed in user builds" 1>&2; \
701 echo "List of invalid domains:" 1>&2; \
702 cat $@.permissivedomains 1>&2; \
703 exit 1; \
704 fi
705 $(hide) mv $@.tmp $@
Ying Wang02fb5f32012-01-17 17:51:09 -0800706
Ying Wangd8b122c2012-10-25 19:01:31 -0700707built_sepolicy := $(LOCAL_BUILT_MODULE)
dcashman2e00e632016-10-12 14:58:09 -0700708all_cil_files :=
Stephen Smalley01a58af2012-10-02 12:46:37 -0400709
Alex Klyubin84aa7422017-03-10 09:36:07 -0800710#################################
711include $(CLEAR_VARS)
712
713# keep concrete sepolicy for neverallow checks
Joel Galenson5988b562018-01-03 16:53:24 -0800714# If SELINUX_IGNORE_NEVERALLOWS is set, we use sed to remove the neverallow lines before compiling.
Alex Klyubin84aa7422017-03-10 09:36:07 -0800715
716LOCAL_MODULE := sepolicy.recovery
Alex Klyubinec78c372017-03-10 12:44:16 -0800717LOCAL_MODULE_STEM := sepolicy
Alex Klyubin84aa7422017-03-10 09:36:07 -0800718LOCAL_MODULE_CLASS := ETC
719LOCAL_MODULE_TAGS := optional
Alex Klyubinec78c372017-03-10 12:44:16 -0800720LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
Alex Klyubin84aa7422017-03-10 09:36:07 -0800721
722include $(BUILD_SYSTEM)/base_rules.mk
723
Dan Cashmanc8d45352017-04-11 07:38:48 -0700724sepolicy.recovery.conf := $(intermediates)/sepolicy.recovery.conf
725$(sepolicy.recovery.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
726$(sepolicy.recovery.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Joel Galenson8c72eea2018-03-07 15:36:29 -0800727$(sepolicy.recovery.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
Dan Cashmanc8d45352017-04-11 07:38:48 -0700728$(sepolicy.recovery.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
729$(sepolicy.recovery.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
730$(sepolicy.recovery.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Dan Cashman36ee91d2017-07-07 14:59:51 -0700731$(sepolicy.recovery.conf): PRIVATE_TGT_RECOVERY := -D target_recovery=true
Dan Cashmanc8d45352017-04-11 07:38:48 -0700732$(sepolicy.recovery.conf): $(call build_policy, $(sepolicy_build_files), \
733 $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) \
Bowgo Tsai45457e32017-11-27 11:41:33 +0800734 $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) \
735 $(BOARD_ODM_SEPOLICY_DIRS))
Dan Cashman36ee91d2017-07-07 14:59:51 -0700736 $(transform-policy-to-conf)
Dan Cashman1c040272016-12-15 15:28:44 -0800737 $(hide) sed '/dontaudit/d' $@ > $@.dontaudit
Joel Galenson5988b562018-01-03 16:53:24 -0800738ifeq ($(SELINUX_IGNORE_NEVERALLOWS),true)
739 $(hide) sed -z 's/\n\s*neverallow[^;]*;/\n/g' $@ > $@.neverallow
740 $(hide) mv $@.neverallow $@
741endif
Dan Cashman1c040272016-12-15 15:28:44 -0800742
Dan Cashmanc8d45352017-04-11 07:38:48 -0700743$(LOCAL_BUILT_MODULE): $(sepolicy.recovery.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
744 $(HOST_OUT_EXECUTABLES)/sepolicy-analyze
Dan Cashman1c040272016-12-15 15:28:44 -0800745 @mkdir -p $(dir $@)
Andreas Gampe3ddc78b2017-04-27 17:16:13 -0700746 $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c \
747 $(POLICYVERS) -o $@.tmp $<
Nick Kralevichbca98ef2016-02-26 20:06:52 -0800748 $(hide) $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $@.tmp permissive > $@.permissivedomains
749 $(hide) if [ "$(TARGET_BUILD_VARIANT)" = "user" -a -s $@.permissivedomains ]; then \
750 echo "==========" 1>&2; \
751 echo "ERROR: permissive domains not allowed in user builds" 1>&2; \
752 echo "List of invalid domains:" 1>&2; \
753 cat $@.permissivedomains 1>&2; \
754 exit 1; \
755 fi
756 $(hide) mv $@.tmp $@
Stephen Smalleye60723a2014-05-29 16:40:15 -0400757
Dan Cashmanc8d45352017-04-11 07:38:48 -0700758sepolicy.recovery.conf :=
Stephen Smalleye60723a2014-05-29 16:40:15 -0400759
dcashman704741a2014-07-25 19:11:52 -0700760##################################
Alex Klyubin446279a2017-04-06 14:45:50 -0700761# SELinux policy embedded into CTS.
762# CTS checks neverallow rules of this policy against the policy of the device under test.
763##################################
dcashman704741a2014-07-25 19:11:52 -0700764include $(CLEAR_VARS)
765
766LOCAL_MODULE := general_sepolicy.conf
767LOCAL_MODULE_CLASS := ETC
768LOCAL_MODULE_TAGS := tests
769
770include $(BUILD_SYSTEM)/base_rules.mk
771
dcashman704741a2014-07-25 19:11:52 -0700772$(LOCAL_BUILT_MODULE): PRIVATE_MLS_SENS := $(MLS_SENS)
773$(LOCAL_BUILT_MODULE): PRIVATE_MLS_CATS := $(MLS_CATS)
Joel Galenson8c72eea2018-03-07 15:36:29 -0800774$(LOCAL_BUILT_MODULE): PRIVATE_TARGET_BUILD_VARIANT := user
Dan Cashman1c040272016-12-15 15:28:44 -0800775$(LOCAL_BUILT_MODULE): PRIVATE_TGT_ARCH := $(my_target_arch)
Dan Cashman36ee91d2017-07-07 14:59:51 -0700776$(LOCAL_BUILT_MODULE): PRIVATE_WITH_ASAN := false
Steven Moreland763697d2017-11-09 11:24:56 -0800777$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY_SPLIT := cts
Jaekyun Seok64ade652018-01-30 17:23:58 +0900778$(LOCAL_BUILT_MODULE): PRIVATE_COMPATIBLE_PROPERTY := cts
dcashmancc39f632016-07-22 13:13:11 -0700779$(LOCAL_BUILT_MODULE): $(call build_policy, $(sepolicy_build_files), \
780$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY))
Dan Cashman36ee91d2017-07-07 14:59:51 -0700781 $(transform-policy-to-conf)
dcashman704741a2014-07-25 19:11:52 -0700782 $(hide) sed '/dontaudit/d' $@ > $@.dontaudit
783
William Robertsb8769932015-06-29 16:31:23 -0700784##################################
dcashmand225b692016-12-12 09:29:04 -0800785# TODO - remove this. Keep around until we get the filesystem creation stuff taken care of.
786#
William Robertsb8769932015-06-29 16:31:23 -0700787include $(CLEAR_VARS)
788
Richard Hainesc2d01912015-08-06 17:43:52 +0100789LOCAL_MODULE := file_contexts.bin
Ying Wang02fb5f32012-01-17 17:51:09 -0800790LOCAL_MODULE_CLASS := ETC
791LOCAL_MODULE_TAGS := optional
792LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
793
Stephen Smalley5b340be2012-03-06 11:12:41 -0500794include $(BUILD_SYSTEM)/base_rules.mk
Ying Wang02fb5f32012-01-17 17:51:09 -0800795
William Roberts49693f12016-01-04 12:20:57 -0800796# The file_contexts.bin is built in the following way:
797# 1. Collect all file_contexts files in THIS repository and process them with
798# m4 into a tmp file called file_contexts.local.tmp.
799# 2. Collect all device specific file_contexts files and process them with m4
800# into a tmp file called file_contexts.device.tmp.
801# 3. Run checkfc -e (allow no device fc entries ie empty) and fc_sort on
802# file_contexts.device.tmp and output to file_contexts.device.sorted.tmp.
803# 4. Concatenate file_contexts.local.tmp and file_contexts.device.tmp into
804# file_contexts.concat.tmp.
805# 5. Run checkfc and sefcontext_compile on file_contexts.concat.tmp to produce
806# file_contexts.bin.
807#
808# Note: That a newline file is placed between each file_context file found to
809# ensure a proper build when an fc file is missing an ending newline.
William Roberts29d14682016-01-04 12:20:57 -0800810
Dan Cashman1b0a71f2017-05-08 14:26:52 -0700811local_fc_files := $(call build_policy, file_contexts, $(PLAT_PRIVATE_POLICY))
812
William Roberts49693f12016-01-04 12:20:57 -0800813ifneq ($(filter address,$(SANITIZE_TARGET)),)
Dan Cashman1b0a71f2017-05-08 14:26:52 -0700814 local_fc_files := $(local_fc_files) $(wildcard $(addsuffix /file_contexts_asan, $(PLAT_PRIVATE_POLICY)))
William Roberts49693f12016-01-04 12:20:57 -0800815endif
816local_fcfiles_with_nl := $(call add_nl, $(local_fc_files), $(built_nl))
817
818file_contexts.local.tmp := $(intermediates)/file_contexts.local.tmp
819$(file_contexts.local.tmp): $(local_fcfiles_with_nl)
Stephen Smalley5b340be2012-03-06 11:12:41 -0500820 @mkdir -p $(dir $@)
William Roberts49693f12016-01-04 12:20:57 -0800821 $(hide) m4 -s $^ > $@
822
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800823device_fc_files := $(call build_vendor_policy, file_contexts)
William Roberts49693f12016-01-04 12:20:57 -0800824device_fcfiles_with_nl := $(call add_nl, $(device_fc_files), $(built_nl))
825
826file_contexts.device.tmp := $(intermediates)/file_contexts.device.tmp
827$(file_contexts.device.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
828$(file_contexts.device.tmp): $(device_fcfiles_with_nl)
829 @mkdir -p $(dir $@)
830 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@
831
832file_contexts.device.sorted.tmp := $(intermediates)/file_contexts.device.sorted.tmp
833$(file_contexts.device.sorted.tmp): PRIVATE_SEPOLICY := $(built_sepolicy)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800834$(file_contexts.device.sorted.tmp): $(file_contexts.device.tmp) $(built_sepolicy) \
835 $(HOST_OUT_EXECUTABLES)/fc_sort $(HOST_OUT_EXECUTABLES)/checkfc
William Roberts49693f12016-01-04 12:20:57 -0800836 @mkdir -p $(dir $@)
dcashman07791552016-12-07 11:27:47 -0800837 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e $(PRIVATE_SEPOLICY) $<
William Roberts49693f12016-01-04 12:20:57 -0800838 $(hide) $(HOST_OUT_EXECUTABLES)/fc_sort $< $@
839
840file_contexts.concat.tmp := $(intermediates)/file_contexts.concat.tmp
841$(file_contexts.concat.tmp): $(file_contexts.local.tmp) $(file_contexts.device.sorted.tmp)
842 @mkdir -p $(dir $@)
843 $(hide) m4 -s $^ > $@
Stephen Smalley5b340be2012-03-06 11:12:41 -0500844
William Roberts3746a0a2015-09-25 10:18:44 -0700845$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
William Roberts49693f12016-01-04 12:20:57 -0800846$(LOCAL_BUILT_MODULE): $(file_contexts.concat.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/sefcontext_compile $(HOST_OUT_EXECUTABLES)/checkfc
Richard Hainesc2d01912015-08-06 17:43:52 +0100847 @mkdir -p $(dir $@)
dcashman07791552016-12-07 11:27:47 -0800848 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc $(PRIVATE_SEPOLICY) $<
Richard Hainesc2d01912015-08-06 17:43:52 +0100849 $(hide) $(HOST_OUT_EXECUTABLES)/sefcontext_compile -o $@ $<
850
Robert Craig8b7545b2014-03-20 09:35:08 -0400851built_fc := $(LOCAL_BUILT_MODULE)
William Roberts49693f12016-01-04 12:20:57 -0800852local_fc_files :=
853local_fcfiles_with_nl :=
854device_fc_files :=
855device_fcfiles_with_nl :=
856file_contexts.concat.tmp :=
857file_contexts.device.sorted.tmp :=
858file_contexts.device.tmp :=
859file_contexts.local.tmp :=
William Roberts171a0622012-08-16 10:55:05 -0700860
Ying Wang02fb5f32012-01-17 17:51:09 -0800861##################################
Dan Cashman91d398d2017-09-26 12:58:29 -0700862ifneq ($(TARGET_BUILD_VARIANT), user)
863include $(CLEAR_VARS)
864
865LOCAL_MODULE := selinux_denial_metadata
866LOCAL_MODULE_CLASS := ETC
867LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
868
869include $(BUILD_SYSTEM)/base_rules.mk
870
871bug_files := $(call build_policy, bug_map, $(LOCAL_PATH) $(PLAT_PRIVATE_POLICY) $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(PLAT_PUBLIC_POLICY))
872
873$(LOCAL_BUILT_MODULE) : $(bug_files)
874 @mkdir -p $(dir $@)
875 cat $^ > $@
876
877bug_files :=
878endif
879##################################
Ying Wang02fb5f32012-01-17 17:51:09 -0800880include $(CLEAR_VARS)
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400881
dcashmand225b692016-12-12 09:29:04 -0800882LOCAL_MODULE := plat_file_contexts
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400883LOCAL_MODULE_CLASS := ETC
dcashmand225b692016-12-12 09:29:04 -0800884LOCAL_MODULE_TAGS := optional
Steven Moreland763697d2017-11-09 11:24:56 -0800885ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Jeff Vander Stoep0cb417a2017-03-08 14:12:54 -0800886LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
Jeff Vander Stoep7a68c5a2017-06-08 13:24:15 -0700887else
888LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
889endif
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400890
891include $(BUILD_SYSTEM)/base_rules.mk
892
Dan Cashman1b0a71f2017-05-08 14:26:52 -0700893local_fc_files := $(call build_policy, file_contexts, $(PLAT_PRIVATE_POLICY))
dcashmand225b692016-12-12 09:29:04 -0800894ifneq ($(filter address,$(SANITIZE_TARGET)),)
Dan Cashman1b0a71f2017-05-08 14:26:52 -0700895 local_fc_files += $(wildcard $(addsuffix /file_contexts_asan, $(PLAT_PRIVATE_POLICY)))
dcashmand225b692016-12-12 09:29:04 -0800896endif
Alex Klyubine4665d72017-01-19 19:58:34 -0800897local_fcfiles_with_nl := $(call add_nl, $(local_fc_files), $(built_nl))
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400898
Alex Klyubine4665d72017-01-19 19:58:34 -0800899$(LOCAL_BUILT_MODULE): PRIVATE_FC_FILES := $(local_fcfiles_with_nl)
dcashmand225b692016-12-12 09:29:04 -0800900$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Alex Klyubine4665d72017-01-19 19:58:34 -0800901$(LOCAL_BUILT_MODULE): PRIVATE_FC_SORT := $(HOST_OUT_EXECUTABLES)/fc_sort
902$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/checkfc $(HOST_OUT_EXECUTABLES)/fc_sort \
903$(local_fcfiles_with_nl) $(built_sepolicy)
Richard Hainesc2d01912015-08-06 17:43:52 +0100904 @mkdir -p $(dir $@)
Alex Klyubine4665d72017-01-19 19:58:34 -0800905 $(hide) m4 -s $(PRIVATE_FC_FILES) > $@.tmp
906 $(hide) $< $(PRIVATE_SEPOLICY) $@.tmp
907 $(hide) $(PRIVATE_FC_SORT) $@.tmp $@
Richard Hainesc2d01912015-08-06 17:43:52 +0100908
dcashmand225b692016-12-12 09:29:04 -0800909built_plat_fc := $(LOCAL_BUILT_MODULE)
910local_fc_files :=
Alex Klyubine4665d72017-01-19 19:58:34 -0800911local_fcfiles_with_nl :=
dcashmand225b692016-12-12 09:29:04 -0800912
913##################################
914include $(CLEAR_VARS)
915
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800916LOCAL_MODULE := vendor_file_contexts
dcashmand225b692016-12-12 09:29:04 -0800917LOCAL_MODULE_CLASS := ETC
918LOCAL_MODULE_TAGS := optional
Steven Moreland763697d2017-11-09 11:24:56 -0800919ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Jeff Vander Stoep0cb417a2017-03-08 14:12:54 -0800920LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
Jeff Vander Stoep7a68c5a2017-06-08 13:24:15 -0700921else
922LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
923endif
dcashmand225b692016-12-12 09:29:04 -0800924
925include $(BUILD_SYSTEM)/base_rules.mk
926
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800927vendor_fc_files := $(call build_vendor_policy, file_contexts)
928vendor_fcfiles_with_nl := $(call add_nl, $(vendor_fc_files), $(built_nl))
dcashmand225b692016-12-12 09:29:04 -0800929
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800930$(LOCAL_BUILT_MODULE): PRIVATE_FC_FILES := $(vendor_fcfiles_with_nl)
dcashmand225b692016-12-12 09:29:04 -0800931$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
932$(LOCAL_BUILT_MODULE): PRIVATE_FC_SORT := $(HOST_OUT_EXECUTABLES)/fc_sort
933$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/checkfc $(HOST_OUT_EXECUTABLES)/fc_sort \
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800934$(vendor_fcfiles_with_nl) $(built_sepolicy)
dcashmand225b692016-12-12 09:29:04 -0800935 @mkdir -p $(dir $@)
936 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_FC_FILES) > $@.tmp
937 $(hide) $< $(PRIVATE_SEPOLICY) $@.tmp
938 $(hide) $(PRIVATE_FC_SORT) $@.tmp $@
939
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800940built_vendor_fc := $(LOCAL_BUILT_MODULE)
941vendor_fc_files :=
942vendor_fcfiles_with_nl :=
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400943
944##################################
945include $(CLEAR_VARS)
Jeff Vander Stoepb236eb62017-06-13 08:24:17 -0700946
947LOCAL_MODULE := plat_file_contexts.recovery
948LOCAL_MODULE_STEM := plat_file_contexts
949LOCAL_MODULE_CLASS := ETC
950LOCAL_MODULE_TAGS := optional
951LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
952
953include $(BUILD_SYSTEM)/base_rules.mk
954
955$(LOCAL_BUILT_MODULE): $(built_plat_fc)
956 $(hide) cp -f $< $@
957
958##################################
959include $(CLEAR_VARS)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800960LOCAL_MODULE := vendor_file_contexts.recovery
961LOCAL_MODULE_STEM := vendor_file_contexts
Jeff Vander Stoepb236eb62017-06-13 08:24:17 -0700962LOCAL_MODULE_CLASS := ETC
963LOCAL_MODULE_TAGS := optional
964LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
965
966include $(BUILD_SYSTEM)/base_rules.mk
967
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800968$(LOCAL_BUILT_MODULE): $(built_vendor_fc)
Jeff Vander Stoepb236eb62017-06-13 08:24:17 -0700969 $(hide) cp -f $< $@
970
971##################################
972include $(CLEAR_VARS)
Dan Cashman9c038072016-12-22 07:15:18 -0800973LOCAL_MODULE := plat_seapp_contexts
Ying Wang02fb5f32012-01-17 17:51:09 -0800974LOCAL_MODULE_CLASS := ETC
975LOCAL_MODULE_TAGS := optional
Steven Moreland763697d2017-11-09 11:24:56 -0800976ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Jeff Vander Stoep4e3a4c72017-03-08 22:28:03 -0800977LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
978else
Ying Wang02fb5f32012-01-17 17:51:09 -0800979LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Jeff Vander Stoep4e3a4c72017-03-08 22:28:03 -0800980endif
Ying Wang02fb5f32012-01-17 17:51:09 -0800981
William Roberts171a0622012-08-16 10:55:05 -0700982include $(BUILD_SYSTEM)/base_rules.mk
Ying Wang02fb5f32012-01-17 17:51:09 -0800983
Dan Cashman9c038072016-12-22 07:15:18 -0800984plat_sc_files := $(call build_policy, seapp_contexts, $(PLAT_PRIVATE_POLICY))
William Roberts171a0622012-08-16 10:55:05 -0700985
Ying Wangd8b122c2012-10-25 19:01:31 -0700986$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Dan Cashman9c038072016-12-22 07:15:18 -0800987$(LOCAL_BUILT_MODULE): PRIVATE_SC_FILES := $(plat_sc_files)
988$(LOCAL_BUILT_MODULE): $(built_sepolicy) $(plat_sc_files) $(HOST_OUT_EXECUTABLES)/checkseapp
William Robertsf0e0a942012-08-27 15:41:15 -0700989 @mkdir -p $(dir $@)
William Roberts99fe8df2015-06-30 13:53:51 -0700990 $(hide) $(HOST_OUT_EXECUTABLES)/checkseapp -p $(PRIVATE_SEPOLICY) -o $@ $(PRIVATE_SC_FILES)
Ying Wang02fb5f32012-01-17 17:51:09 -0800991
Dan Cashman9c038072016-12-22 07:15:18 -0800992built_plat_sc := $(LOCAL_BUILT_MODULE)
993plat_sc_files :=
Robert Craig8b7545b2014-03-20 09:35:08 -0400994
Ying Wang02fb5f32012-01-17 17:51:09 -0800995##################################
Stephen Smalley124720a2012-04-04 10:11:16 -0400996include $(CLEAR_VARS)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +0800997LOCAL_MODULE := vendor_seapp_contexts
Stephen Smalley37712872015-03-12 15:46:36 -0400998LOCAL_MODULE_CLASS := ETC
Dan Cashman9c038072016-12-22 07:15:18 -0800999LOCAL_MODULE_TAGS := optional
Steven Moreland763697d2017-11-09 11:24:56 -08001000ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Jeff Vander Stoep4e3a4c72017-03-08 22:28:03 -08001001LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
1002else
Dan Cashman9c038072016-12-22 07:15:18 -08001003LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Jeff Vander Stoep4e3a4c72017-03-08 22:28:03 -08001004endif
Stephen Smalley37712872015-03-12 15:46:36 -04001005
1006include $(BUILD_SYSTEM)/base_rules.mk
1007
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001008vendor_sc_files := $(call build_policy, seapp_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
Dan Cashman1b0a71f2017-05-08 14:26:52 -07001009plat_sc_neverallow_files := $(call build_policy, seapp_contexts, $(PLAT_PRIVATE_POLICY))
Stephen Smalley37712872015-03-12 15:46:36 -04001010
Dan Cashman9c038072016-12-22 07:15:18 -08001011$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001012$(LOCAL_BUILT_MODULE): PRIVATE_SC_FILES := $(vendor_sc_files)
Jeff Vander Stoep87ae5f72017-03-06 22:53:09 -08001013$(LOCAL_BUILT_MODULE): PRIVATE_SC_NEVERALLOW_FILES := $(plat_sc_neverallow_files)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001014$(LOCAL_BUILT_MODULE): $(built_sepolicy) $(vendor_sc_files) $(HOST_OUT_EXECUTABLES)/checkseapp $(plat_sc_neverallow_files)
Stephen Smalley37712872015-03-12 15:46:36 -04001015 @mkdir -p $(dir $@)
Dan Cashman91d398d2017-09-26 12:58:29 -07001016 $(hide) grep -ihe '^neverallow' $(PRIVATE_SC_NEVERALLOW_FILES) > $@.tmp
Xin Liec6f3932017-03-14 16:51:13 -07001017 $(hide) $(HOST_OUT_EXECUTABLES)/checkseapp -p $(PRIVATE_SEPOLICY) -o $@ $(PRIVATE_SC_FILES) $@.tmp
Stephen Smalley37712872015-03-12 15:46:36 -04001018
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001019built_vendor_sc := $(LOCAL_BUILT_MODULE)
1020vendor_sc_files :=
Stephen Smalley37712872015-03-12 15:46:36 -04001021
1022##################################
1023include $(CLEAR_VARS)
Dan Cashman9c038072016-12-22 07:15:18 -08001024LOCAL_MODULE := plat_seapp_neverallows
William Roberts4ee71312015-06-25 11:59:30 -07001025LOCAL_MODULE_CLASS := ETC
1026LOCAL_MODULE_TAGS := tests
1027
1028include $(BUILD_SYSTEM)/base_rules.mk
1029
Jeff Vander Stoep87ae5f72017-03-06 22:53:09 -08001030$(LOCAL_BUILT_MODULE): $(plat_sc_neverallow_files)
William Roberts4ee71312015-06-25 11:59:30 -07001031 @mkdir -p $(dir $@)
Dan Cashman91d398d2017-09-26 12:58:29 -07001032 - $(hide) grep -ihe '^neverallow' $< > $@
William Roberts4ee71312015-06-25 11:59:30 -07001033
Jeff Vander Stoep87ae5f72017-03-06 22:53:09 -08001034plat_sc_neverallow_files :=
William Roberts4ee71312015-06-25 11:59:30 -07001035
1036##################################
1037include $(CLEAR_VARS)
Stephen Smalley124720a2012-04-04 10:11:16 -04001038
Sandeep Patila86316e2016-12-27 16:08:44 -08001039LOCAL_MODULE := plat_property_contexts
Stephen Smalley124720a2012-04-04 10:11:16 -04001040LOCAL_MODULE_CLASS := ETC
1041LOCAL_MODULE_TAGS := optional
Alex Klyubin9d590412017-03-08 13:10:05 -08001042
Steven Moreland763697d2017-11-09 11:24:56 -08001043ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Alex Klyubin9d590412017-03-08 13:10:05 -08001044LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
1045else
Stephen Smalley124720a2012-04-04 10:11:16 -04001046LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Alex Klyubin9d590412017-03-08 13:10:05 -08001047endif
Stephen Smalley124720a2012-04-04 10:11:16 -04001048
1049include $(BUILD_SYSTEM)/base_rules.mk
1050
Sandeep Patila86316e2016-12-27 16:08:44 -08001051plat_pcfiles := $(call build_policy, property_contexts, $(PLAT_PRIVATE_POLICY))
Jaekyun Seoke4971452017-10-19 16:54:49 +09001052ifeq ($(PRODUCT_COMPATIBLE_PROPERTY),true)
1053plat_pcfiles += $(LOCAL_PATH)/public/property_contexts
1054endif
William Roberts6aabc1c2015-07-30 11:44:26 -07001055
Sandeep Patila86316e2016-12-27 16:08:44 -08001056plat_property_contexts.tmp := $(intermediates)/plat_property_contexts.tmp
1057$(plat_property_contexts.tmp): PRIVATE_PC_FILES := $(plat_pcfiles)
1058$(plat_property_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1059$(plat_property_contexts.tmp): $(plat_pcfiles)
William Roberts7f81b332015-09-29 13:52:37 -07001060 @mkdir -p $(dir $@)
Colin Cross9eb6c872015-10-01 21:25:09 +00001061 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_PC_FILES) > $@
Tom Cherryf68b4c62018-01-04 09:46:48 -08001062$(LOCAL_BUILT_MODULE): $(plat_property_contexts.tmp) $(HOST_OUT_EXECUTABLES)/property_info_checker
William Robertsdcffd2b2015-09-29 13:52:37 -07001063 @mkdir -p $(dir $@)
Tom Cherryf68b4c62018-01-04 09:46:48 -08001064 $(hide) cp -f $< $@
1065 $(hide) $(HOST_OUT_EXECUTABLES)/property_info_checker $@
Stephen Smalley124720a2012-04-04 10:11:16 -04001066
Sandeep Patila86316e2016-12-27 16:08:44 -08001067built_plat_pc := $(LOCAL_BUILT_MODULE)
1068plat_pcfiles :=
1069plat_property_contexts.tmp :=
Robert Craig8b7545b2014-03-20 09:35:08 -04001070
Stephen Smalley124720a2012-04-04 10:11:16 -04001071##################################
Riley Spahnf90c41f2014-06-05 15:52:02 -07001072include $(CLEAR_VARS)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001073LOCAL_MODULE := vendor_property_contexts
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -04001074LOCAL_MODULE_CLASS := ETC
Sandeep Patila86316e2016-12-27 16:08:44 -08001075LOCAL_MODULE_TAGS := optional
Alex Klyubin9d590412017-03-08 13:10:05 -08001076
Steven Moreland763697d2017-11-09 11:24:56 -08001077ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Alex Klyubin9d590412017-03-08 13:10:05 -08001078LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
1079else
Sandeep Patila86316e2016-12-27 16:08:44 -08001080LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Alex Klyubin9d590412017-03-08 13:10:05 -08001081endif
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -04001082
Stephen Smalleyc9361732015-03-13 09:36:57 -04001083include $(BUILD_SYSTEM)/base_rules.mk
1084
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001085vendor_pcfiles := $(call build_policy, property_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
Sandeep Patil262edc32016-12-27 16:08:44 -08001086
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001087vendor_property_contexts.tmp := $(intermediates)/vendor_property_contexts.tmp
1088$(vendor_property_contexts.tmp): PRIVATE_PC_FILES := $(vendor_pcfiles)
1089$(vendor_property_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1090$(vendor_property_contexts.tmp): $(vendor_pcfiles)
William Robertsdcffd2b2015-09-29 13:52:37 -07001091 @mkdir -p $(dir $@)
Sandeep Patila86316e2016-12-27 16:08:44 -08001092 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_PC_FILES) > $@
1093
1094
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001095$(LOCAL_BUILT_MODULE): $(vendor_property_contexts.tmp) $(HOST_OUT_EXECUTABLES)/property_info_checker
Sandeep Patila86316e2016-12-27 16:08:44 -08001096 @mkdir -p $(dir $@)
Tom Cherryf68b4c62018-01-04 09:46:48 -08001097 $(hide) cp -f $< $@
1098 $(hide) $(HOST_OUT_EXECUTABLES)/property_info_checker $@
William Robertsdcffd2b2015-09-29 13:52:37 -07001099
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001100built_vendor_pc := $(LOCAL_BUILT_MODULE)
1101vendor_pcfiles :=
1102vendor_property_contexts.tmp :=
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -04001103
1104##################################
1105include $(CLEAR_VARS)
1106
Alex Klyubinec78c372017-03-10 12:44:16 -08001107LOCAL_MODULE := plat_property_contexts.recovery
1108LOCAL_MODULE_STEM := plat_property_contexts
1109LOCAL_MODULE_CLASS := ETC
1110LOCAL_MODULE_TAGS := optional
1111LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
1112
1113include $(BUILD_SYSTEM)/base_rules.mk
1114
1115$(LOCAL_BUILT_MODULE): $(built_plat_pc)
1116 $(hide) cp -f $< $@
1117
1118##################################
1119include $(CLEAR_VARS)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001120LOCAL_MODULE := vendor_property_contexts.recovery
1121LOCAL_MODULE_STEM := vendor_property_contexts
Alex Klyubinec78c372017-03-10 12:44:16 -08001122LOCAL_MODULE_CLASS := ETC
1123LOCAL_MODULE_TAGS := optional
1124LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
1125
1126include $(BUILD_SYSTEM)/base_rules.mk
1127
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001128$(LOCAL_BUILT_MODULE): $(built_vendor_pc)
Alex Klyubinec78c372017-03-10 12:44:16 -08001129 $(hide) cp -f $< $@
1130
1131##################################
1132include $(CLEAR_VARS)
1133
Sandeep Patila058b562016-12-27 15:10:48 -08001134LOCAL_MODULE := plat_service_contexts
Riley Spahnf90c41f2014-06-05 15:52:02 -07001135LOCAL_MODULE_CLASS := ETC
1136LOCAL_MODULE_TAGS := optional
Steven Moreland763697d2017-11-09 11:24:56 -08001137ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Jeff Vander Stoep4e3a4c72017-03-08 22:28:03 -08001138LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
1139else
Riley Spahnf90c41f2014-06-05 15:52:02 -07001140LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Jeff Vander Stoep4e3a4c72017-03-08 22:28:03 -08001141endif
Riley Spahnf90c41f2014-06-05 15:52:02 -07001142
1143include $(BUILD_SYSTEM)/base_rules.mk
1144
Sandeep Patila058b562016-12-27 15:10:48 -08001145plat_svcfiles := $(call build_policy, service_contexts, $(PLAT_PRIVATE_POLICY))
Riley Spahnf90c41f2014-06-05 15:52:02 -07001146
Sandeep Patila058b562016-12-27 15:10:48 -08001147plat_service_contexts.tmp := $(intermediates)/plat_service_contexts.tmp
1148$(plat_service_contexts.tmp): PRIVATE_SVC_FILES := $(plat_svcfiles)
1149$(plat_service_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1150$(plat_service_contexts.tmp): $(plat_svcfiles)
Riley Spahnf90c41f2014-06-05 15:52:02 -07001151 @mkdir -p $(dir $@)
William Roberts6aabc1c2015-07-30 11:44:26 -07001152 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
William Roberts7fc865a2015-09-29 14:17:38 -07001153
1154$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Sandeep Patila058b562016-12-27 15:10:48 -08001155$(LOCAL_BUILT_MODULE): $(plat_service_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
William Roberts7fc865a2015-09-29 14:17:38 -07001156 @mkdir -p $(dir $@)
William Robertsc9fce3f2016-04-06 11:53:04 -07001157 sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
dcashman07791552016-12-07 11:27:47 -08001158 $(HOST_OUT_EXECUTABLES)/checkfc -s $(PRIVATE_SEPOLICY) $@
Riley Spahnf90c41f2014-06-05 15:52:02 -07001159
Sandeep Patila058b562016-12-27 15:10:48 -08001160built_plat_svc := $(LOCAL_BUILT_MODULE)
1161plat_svcfiles :=
1162plat_service_contexts.tmp :=
Riley Spahnf90c41f2014-06-05 15:52:02 -07001163
1164##################################
Hung-ying Tyane83f1e52017-09-05 21:51:52 +08001165# nonplat_service_contexts is only allowed on non-full-treble devices
Steven Moreland763697d2017-11-09 11:24:56 -08001166ifneq ($(PRODUCT_SEPOLICY_SPLIT),true)
Hung-ying Tyane83f1e52017-09-05 21:51:52 +08001167
rpcraigb19665c2012-07-30 09:33:03 -04001168include $(CLEAR_VARS)
1169
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001170LOCAL_MODULE := vendor_service_contexts
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -04001171LOCAL_MODULE_CLASS := ETC
Sandeep Patila058b562016-12-27 15:10:48 -08001172LOCAL_MODULE_TAGS := optional
Sandeep Patila058b562016-12-27 15:10:48 -08001173LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -04001174
1175include $(BUILD_SYSTEM)/base_rules.mk
1176
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001177vendor_svcfiles := $(call build_policy, service_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -04001178
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001179vendor_service_contexts.tmp := $(intermediates)/vendor_service_contexts.tmp
1180$(vendor_service_contexts.tmp): PRIVATE_SVC_FILES := $(vendor_svcfiles)
1181$(vendor_service_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1182$(vendor_service_contexts.tmp): $(vendor_svcfiles)
Sandeep Patila058b562016-12-27 15:10:48 -08001183 @mkdir -p $(dir $@)
1184 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
1185
1186$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001187$(LOCAL_BUILT_MODULE): $(vendor_service_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
William Roberts7fc865a2015-09-29 14:17:38 -07001188 @mkdir -p $(dir $@)
William Robertsc9fce3f2016-04-06 11:53:04 -07001189 sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
dcashman07791552016-12-07 11:27:47 -08001190 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -s $(PRIVATE_SEPOLICY) $@
William Roberts7fc865a2015-09-29 14:17:38 -07001191
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001192built_vendor_svc := $(LOCAL_BUILT_MODULE)
1193vendor_svcfiles :=
1194vendor_service_contexts.tmp :=
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -04001195
Hung-ying Tyane83f1e52017-09-05 21:51:52 +08001196endif
1197
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -04001198##################################
1199include $(CLEAR_VARS)
1200
Martijn Coenen3ea47b92017-04-07 16:14:43 -07001201LOCAL_MODULE := plat_hwservice_contexts
1202LOCAL_MODULE_CLASS := ETC
1203LOCAL_MODULE_TAGS := optional
Steven Moreland763697d2017-11-09 11:24:56 -08001204ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Martijn Coenen3ea47b92017-04-07 16:14:43 -07001205LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
1206else
1207LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
1208endif
1209
1210include $(BUILD_SYSTEM)/base_rules.mk
1211
1212plat_hwsvcfiles := $(call build_policy, hwservice_contexts, $(PLAT_PRIVATE_POLICY))
1213
1214plat_hwservice_contexts.tmp := $(intermediates)/plat_hwservice_contexts.tmp
1215$(plat_hwservice_contexts.tmp): PRIVATE_SVC_FILES := $(plat_hwsvcfiles)
1216$(plat_hwservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1217$(plat_hwservice_contexts.tmp): $(plat_hwsvcfiles)
1218 @mkdir -p $(dir $@)
1219 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
1220
1221$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
1222$(LOCAL_BUILT_MODULE): $(plat_hwservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
1223 @mkdir -p $(dir $@)
1224 sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
1225 $(HOST_OUT_EXECUTABLES)/checkfc -e -l $(PRIVATE_SEPOLICY) $@
1226
1227plat_hwsvcfiles :=
1228plat_hwservice_contexts.tmp :=
1229
1230##################################
1231include $(CLEAR_VARS)
1232
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001233LOCAL_MODULE := vendor_hwservice_contexts
Martijn Coenen3ea47b92017-04-07 16:14:43 -07001234LOCAL_MODULE_CLASS := ETC
1235LOCAL_MODULE_TAGS := optional
Steven Moreland763697d2017-11-09 11:24:56 -08001236ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Martijn Coenen3ea47b92017-04-07 16:14:43 -07001237LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
1238else
1239LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
1240endif
1241
1242include $(BUILD_SYSTEM)/base_rules.mk
1243
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001244vendor_hwsvcfiles := $(call build_policy, hwservice_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
Martijn Coenen3ea47b92017-04-07 16:14:43 -07001245
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001246vendor_hwservice_contexts.tmp := $(intermediates)/vendor_hwservice_contexts.tmp
1247$(vendor_hwservice_contexts.tmp): PRIVATE_SVC_FILES := $(vendor_hwsvcfiles)
1248$(vendor_hwservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1249$(vendor_hwservice_contexts.tmp): $(vendor_hwsvcfiles)
Martijn Coenen3ea47b92017-04-07 16:14:43 -07001250 @mkdir -p $(dir $@)
1251 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
1252
1253$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001254$(LOCAL_BUILT_MODULE): $(vendor_hwservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
Martijn Coenen3ea47b92017-04-07 16:14:43 -07001255 @mkdir -p $(dir $@)
1256 sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
1257 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e -l $(PRIVATE_SEPOLICY) $@
1258
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001259vendor_hwsvcfiles :=
1260vendor_hwservice_contexts.tmp :=
1261
Martijn Coenen3ea47b92017-04-07 16:14:43 -07001262
1263##################################
1264include $(CLEAR_VARS)
1265
Martijn Coenen6676c232017-03-31 17:29:53 -07001266LOCAL_MODULE := vndservice_contexts
1267LOCAL_MODULE_CLASS := ETC
1268LOCAL_MODULE_TAGS := optional
Steven Moreland763697d2017-11-09 11:24:56 -08001269ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Martijn Coenen6676c232017-03-31 17:29:53 -07001270LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
1271else
1272LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
1273endif
1274
1275include $(BUILD_SYSTEM)/base_rules.mk
1276
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001277vnd_svcfiles := $(call build_policy, vndservice_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
Martijn Coenen6676c232017-03-31 17:29:53 -07001278
1279vndservice_contexts.tmp := $(intermediates)/vndservice_contexts.tmp
1280$(vndservice_contexts.tmp): PRIVATE_SVC_FILES := $(vnd_svcfiles)
1281$(vndservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1282$(vndservice_contexts.tmp): $(vnd_svcfiles)
1283 @mkdir -p $(dir $@)
1284 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
1285
1286$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
1287$(LOCAL_BUILT_MODULE): $(vndservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
1288 @mkdir -p $(dir $@)
1289 sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
Martijn Coenenee976622017-04-07 10:08:55 -07001290 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e -v $(PRIVATE_SEPOLICY) $@
Martijn Coenen6676c232017-03-31 17:29:53 -07001291
1292vnd_svcfiles :=
1293vndservice_contexts.tmp :=
1294##################################
1295include $(CLEAR_VARS)
1296
dcashman90b3b942016-12-14 13:47:55 -08001297LOCAL_MODULE := plat_mac_permissions.xml
rpcraigb19665c2012-07-30 09:33:03 -04001298LOCAL_MODULE_CLASS := ETC
1299LOCAL_MODULE_TAGS := optional
Jeff Vander Stoepbba9e7b2017-03-10 15:51:23 -08001300LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
rpcraigb19665c2012-07-30 09:33:03 -04001301
William Roberts2c8a55d2012-11-30 14:59:09 -08001302include $(BUILD_SYSTEM)/base_rules.mk
rpcraigb19665c2012-07-30 09:33:03 -04001303
Geremy Condracd4104e2013-03-26 18:19:12 +00001304# Build keys.conf
dcashman90b3b942016-12-14 13:47:55 -08001305plat_mac_perms_keys.tmp := $(intermediates)/plat_keys.tmp
1306$(plat_mac_perms_keys.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1307$(plat_mac_perms_keys.tmp): $(call build_policy, keys.conf, $(PLAT_PRIVATE_POLICY))
Geremy Condracd4104e2013-03-26 18:19:12 +00001308 @mkdir -p $(dir $@)
William Robertsd2185582015-07-16 11:28:02 -07001309 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@
Geremy Condracd4104e2013-03-26 18:19:12 +00001310
dcashman90b3b942016-12-14 13:47:55 -08001311all_plat_mac_perms_files := $(call build_policy, mac_permissions.xml, $(PLAT_PRIVATE_POLICY))
rpcraigb19665c2012-07-30 09:33:03 -04001312
Shinichiro Hamajief0c14d2016-05-13 16:04:58 +09001313# Should be synced with keys.conf.
dcashman90b3b942016-12-14 13:47:55 -08001314all_plat_keys := platform media shared testkey
1315all_plat_keys := $(all_keys:%=$(dir $(DEFAULT_SYSTEM_DEV_CERTIFICATE))/%.x509.pem)
Shinichiro Hamajief0c14d2016-05-13 16:04:58 +09001316
dcashman90b3b942016-12-14 13:47:55 -08001317$(LOCAL_BUILT_MODULE): PRIVATE_MAC_PERMS_FILES := $(all_plat_mac_perms_files)
1318$(LOCAL_BUILT_MODULE): $(plat_mac_perms_keys.tmp) $(HOST_OUT_EXECUTABLES)/insertkeys.py \
1319$(all_plat_mac_perms_files) $(all_plat_keys)
Geremy Condracd4104e2013-03-26 18:19:12 +00001320 @mkdir -p $(dir $@)
Nick Kralevichc3c90522013-10-25 12:25:36 -07001321 $(hide) DEFAULT_SYSTEM_DEV_CERTIFICATE="$(dir $(DEFAULT_SYSTEM_DEV_CERTIFICATE))" \
William Roberts6aabc1c2015-07-30 11:44:26 -07001322 $(HOST_OUT_EXECUTABLES)/insertkeys.py -t $(TARGET_BUILD_VARIANT) -c $(TOP) $< -o $@ $(PRIVATE_MAC_PERMS_FILES)
Geremy Condracd4104e2013-03-26 18:19:12 +00001323
William Roberts6aabc1c2015-07-30 11:44:26 -07001324all_mac_perms_files :=
dcashman90b3b942016-12-14 13:47:55 -08001325all_plat_keys :=
1326plat_mac_perms_keys.tmp :=
1327
1328##################################
1329include $(CLEAR_VARS)
1330
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001331LOCAL_MODULE := vendor_mac_permissions.xml
dcashman90b3b942016-12-14 13:47:55 -08001332LOCAL_MODULE_CLASS := ETC
1333LOCAL_MODULE_TAGS := optional
Jeff Vander Stoepbba9e7b2017-03-10 15:51:23 -08001334LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
dcashman90b3b942016-12-14 13:47:55 -08001335
1336include $(BUILD_SYSTEM)/base_rules.mk
1337
1338# Build keys.conf
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001339vendor_mac_perms_keys.tmp := $(intermediates)/vendor_keys.tmp
1340$(vendor_mac_perms_keys.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1341$(vendor_mac_perms_keys.tmp): $(call build_policy, keys.conf, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
dcashman90b3b942016-12-14 13:47:55 -08001342 @mkdir -p $(dir $@)
1343 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@
1344
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001345all_vendor_mac_perms_files := $(call build_policy, mac_permissions.xml, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
dcashman90b3b942016-12-14 13:47:55 -08001346
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001347$(LOCAL_BUILT_MODULE): PRIVATE_MAC_PERMS_FILES := $(all_vendor_mac_perms_files)
1348$(LOCAL_BUILT_MODULE): $(vendor_mac_perms_keys.tmp) $(HOST_OUT_EXECUTABLES)/insertkeys.py \
1349$(all_vendor_mac_perms_files)
dcashman90b3b942016-12-14 13:47:55 -08001350 @mkdir -p $(dir $@)
1351 $(hide) $(HOST_OUT_EXECUTABLES)/insertkeys.py -t $(TARGET_BUILD_VARIANT) -c $(TOP) $< -o $@ $(PRIVATE_MAC_PERMS_FILES)
1352
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001353vendor_mac_perms_keys.tmp :=
1354all_vendor_mac_perms_files :=
William Roberts6aabc1c2015-07-30 11:44:26 -07001355
Dan Cashman91d398d2017-09-26 12:58:29 -07001356#################################
1357include $(CLEAR_VARS)
1358LOCAL_MODULE := sepolicy_tests
1359LOCAL_MODULE_CLASS := ETC
1360LOCAL_MODULE_TAGS := tests
1361
1362include $(BUILD_SYSTEM)/base_rules.mk
1363
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001364all_fc_files := $(built_plat_fc) $(built_vendor_fc)
1365all_fc_args := $(foreach file, $(all_fc_files), -f $(file))
1366
Dan Cashman91d398d2017-09-26 12:58:29 -07001367sepolicy_tests := $(intermediates)/sepolicy_tests
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001368$(sepolicy_tests): ALL_FC_ARGS := $(all_fc_args)
Dan Cashman91d398d2017-09-26 12:58:29 -07001369$(sepolicy_tests): PRIVATE_SEPOLICY := $(built_sepolicy)
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001370$(sepolicy_tests): $(HOST_OUT_EXECUTABLES)/sepolicy_tests $(all_fc_files) $(built_sepolicy)
Dan Cashman91d398d2017-09-26 12:58:29 -07001371 @mkdir -p $(dir $@)
Jeff Vander Stoep3ca843a2017-10-04 09:42:29 -07001372 $(hide) $(HOST_OUT_EXECUTABLES)/sepolicy_tests -l $(HOST_OUT)/lib64/libsepolwrap.$(SHAREDLIB_EXT) \
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001373 $(ALL_FC_ARGS) -p $(PRIVATE_SEPOLICY)
Dan Cashman91d398d2017-09-26 12:58:29 -07001374 $(hide) touch $@
1375
rpcraigb19665c2012-07-30 09:33:03 -04001376##################################
Steven Moreland763697d2017-11-09 11:24:56 -08001377ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
Jeff Vander Stoep1fc06822017-05-31 15:36:07 -07001378
Tri Vo14069262018-01-31 16:22:35 -08001379intermediates := $(call intermediates-dir-for,ETC,built_plat_sepolicy,,,,)
Dan Cashman91d398d2017-09-26 12:58:29 -07001380
1381# plat_sepolicy - the current platform policy only, built into a policy binary.
1382# TODO - this currently excludes partner extensions, but support should be added
1383# to enable partners to add their own compatibility mapping
1384BASE_PLAT_PUBLIC_POLICY := $(filter-out $(BOARD_PLAT_PUBLIC_SEPOLICY_DIR), $(PLAT_PUBLIC_POLICY))
1385BASE_PLAT_PRIVATE_POLICY := $(filter-out $(BOARD_PLAT_PRIVATE_SEPOLICY_DIR), $(PLAT_PRIVATE_POLICY))
1386base_plat_policy.conf := $(intermediates)/base_plat_policy.conf
1387$(base_plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
1388$(base_plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Joel Galenson8c72eea2018-03-07 15:36:29 -08001389$(base_plat_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
Dan Cashman91d398d2017-09-26 12:58:29 -07001390$(base_plat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
1391$(base_plat_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
1392$(base_plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Steven Moreland763697d2017-11-09 11:24:56 -08001393$(base_plat_policy.conf): PRIVATE_SEPOLICY_SPLIT := true
Jaekyun Seoke4971452017-10-19 16:54:49 +09001394$(base_plat_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
Dan Cashman91d398d2017-09-26 12:58:29 -07001395$(base_plat_policy.conf): $(call build_policy, $(sepolicy_build_files), \
1396$(BASE_PLAT_PUBLIC_POLICY) $(BASE_PLAT_PRIVATE_POLICY))
1397 $(transform-policy-to-conf)
1398 $(hide) sed '/dontaudit/d' $@ > $@.dontaudit
1399
1400built_plat_sepolicy := $(intermediates)/built_plat_sepolicy
1401$(built_plat_sepolicy): PRIVATE_ADDITIONAL_CIL_FILES := \
1402 $(call build_policy, $(sepolicy_build_cil_workaround_files), $(BASE_PLAT_PRIVATE_POLICY))
Joel Galenson5988b562018-01-03 16:53:24 -08001403$(built_plat_sepolicy): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
Dan Cashman91d398d2017-09-26 12:58:29 -07001404$(built_plat_sepolicy): $(base_plat_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
1405$(HOST_OUT_EXECUTABLES)/secilc \
Joel Galenson5988b562018-01-03 16:53:24 -08001406$(call build_policy, $(sepolicy_build_cil_workaround_files), $(BASE_PLAT_PRIVATE_POLICY)) \
1407$(built_sepolicy_neverallows)
Dan Cashman91d398d2017-09-26 12:58:29 -07001408 @mkdir -p $(dir $@)
1409 $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \
1410 $(POLICYVERS) -o $@ $<
1411 $(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@
Joel Galenson5988b562018-01-03 16:53:24 -08001412 $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $@ -o $@ -f /dev/null
Dan Cashman91d398d2017-09-26 12:58:29 -07001413
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001414all_fc_files := $(built_plat_fc) $(built_vendor_fc)
1415all_fc_args := $(foreach file, $(all_fc_files), -f $(file))
1416
Tri Vo14069262018-01-31 16:22:35 -08001417# Tests for Treble compatibility of current platform policy and vendor policy of
1418# given release version.
1419version_under_treble_tests := 26.0
1420include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk
Dan Cashman91d398d2017-09-26 12:58:29 -07001421
Tri Vo9299d932018-01-31 16:50:28 -08001422version_under_treble_tests := 27.0
1423include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk
1424
Dan Cashman91d398d2017-09-26 12:58:29 -07001425BASE_PLAT_PUBLIC_POLICY :=
1426BASE_PLAT_PRIVATE_POLICY :=
1427base_plat_policy.conf :=
Dan Cashman91d398d2017-09-26 12:58:29 -07001428plat_sepolicy :=
1429
Steven Moreland763697d2017-11-09 11:24:56 -08001430endif # ($(PRODUCT_SEPOLICY_SPLIT),true)
Jeff Vander Stoep1fc06822017-05-31 15:36:07 -07001431#################################
rpcraig47cd3962012-10-17 21:09:52 -04001432
Dan Cashman1c040272016-12-15 15:28:44 -08001433add_nl :=
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001434build_vendor_policy :=
Dan Cashman1c040272016-12-15 15:28:44 -08001435build_policy :=
dcashmand225b692016-12-12 09:29:04 -08001436built_plat_fc :=
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001437built_vendor_fc :=
Richard Hainesc8801fe2015-12-11 10:39:19 +00001438built_nl :=
Alex Klyubin8f7173b2017-02-25 14:47:53 -08001439built_plat_cil :=
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001440built_plat_pub_vers_cil :=
Alex Klyubin8f7173b2017-02-25 14:47:53 -08001441built_mapping_cil :=
Sandeep Patila86316e2016-12-27 16:08:44 -08001442built_plat_pc :=
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001443built_vendor_cil :=
1444built_vendor_pc :=
1445built_vendor_sc :=
Bowgo Tsai45457e32017-11-27 11:41:33 +08001446built_odm_cil :=
Dan Cashman9c038072016-12-22 07:15:18 -08001447built_plat_sc :=
Alex Klyubin193dccd2017-03-07 14:05:57 -08001448built_precompiled_sepolicy :=
Dan Cashman1c040272016-12-15 15:28:44 -08001449built_sepolicy :=
Joel Galenson5988b562018-01-03 16:53:24 -08001450built_sepolicy_neverallows :=
Sandeep Patila058b562016-12-27 15:10:48 -08001451built_plat_svc :=
Bowgo Tsaiafbcf212018-02-05 17:34:52 +08001452built_vendor_svc :=
Jeff Vander Stoepb8787692017-04-21 15:57:07 -07001453mapping_policy :=
Dan Cashman1c040272016-12-15 15:28:44 -08001454my_target_arch :=
dcashman1faa6442016-11-28 07:20:28 -08001455plat_pub_policy.cil :=
1456reqd_policy_mask.cil :=
Dan Cashman1c040272016-12-15 15:28:44 -08001457sepolicy_build_files :=
Alex Klyubin7cda44f2017-03-21 14:28:53 -07001458sepolicy_build_cil_workaround_files :=
Jeff Vander Stoep74434842017-03-13 12:22:15 -07001459with_asan :=
Alice Chucdfb06f2012-11-01 11:33:04 -07001460
1461include $(call all-makefiles-under,$(LOCAL_PATH))