1version := $(version_under_treble_tests) 2 3include $(CLEAR_VARS) 4# For Treble builds run tests verifying that processes are properly labeled and 5# permissions granted do not violate the treble model. Also ensure that treble 6# compatibility guarantees are upheld between SELinux version bumps. 7LOCAL_MODULE := treble_sepolicy_tests_$(version) 8LOCAL_MODULE_CLASS := FAKE 9LOCAL_MODULE_TAGS := optional 10 11include $(BUILD_SYSTEM)/base_rules.mk 12 13# $(version)_plat - the platform policy shipped as part of the $(version) release. This is 14# built to enable us to determine the diff between the current policy and the 15# $(version) policy, which will be used in tests to make sure that compatibility has 16# been maintained by our mapping files. 17$(version)_PLAT_PUBLIC_POLICY := $(LOCAL_PATH)/prebuilts/api/$(version)/public 18$(version)_PLAT_PRIVATE_POLICY := $(LOCAL_PATH)/prebuilts/api/$(version)/private 19policy_files := $(call build_policy, $(sepolicy_build_files), $($(version)_PLAT_PUBLIC_POLICY) $($(version)_PLAT_PRIVATE_POLICY)) 20$(version)_plat_policy.conf := $(intermediates)/$(version)_plat_policy.conf 21$($(version)_plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS) 22$($(version)_plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS) 23$($(version)_plat_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := user 24$($(version)_plat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch) 25$($(version)_plat_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) 26$($(version)_plat_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage) 27$($(version)_plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) 28$($(version)_plat_policy.conf): PRIVATE_SEPOLICY_SPLIT := true 29$($(version)_plat_policy.conf): PRIVATE_POLICY_FILES := $(policy_files) 30$($(version)_plat_policy.conf): $(policy_files) $(M4) 31 $(transform-policy-to-conf) 32 $(hide) sed '/dontaudit/d' $@ > $@.dontaudit 33 34policy_files := 35 36built_$(version)_plat_sepolicy := $(intermediates)/built_$(version)_plat_sepolicy 37$(built_$(version)_plat_sepolicy): PRIVATE_ADDITIONAL_CIL_FILES := \ 38 $(call build_policy, technical_debt.cil , $($(version)_PLAT_PRIVATE_POLICY)) 39$(built_$(version)_plat_sepolicy): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG) 40$(built_$(version)_plat_sepolicy): $($(version)_plat_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \ 41 $(HOST_OUT_EXECUTABLES)/secilc \ 42 $(call build_policy, technical_debt.cil, $($(version)_PLAT_PRIVATE_POLICY)) \ 43 $(built_sepolicy_neverallows) 44 @mkdir -p $(dir $@) 45 $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \ 46 $(POLICYVERS) -o $@ $< 47 $(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@ 48 $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $@ -o $@ -f /dev/null 49 50$(version)_plat_policy.conf := 51 52 53# $(version)_compat - the current plat_sepolicy.cil built with the compatibility file 54# targeting the $(version) SELinux release. This ensures that our policy will build 55# when used on a device that has non-platform policy targetting the $(version) release. 56$(version)_compat := $(intermediates)/$(version)_compat 57$(version)_mapping.cil := $(call intermediates-dir-for,ETC,plat_$(version).cil)/plat_$(version).cil 58$(version)_mapping.ignore.cil := \ 59 $(call intermediates-dir-for,ETC,$(version).ignore.cil)/$(version).ignore.cil 60$(version)_prebuilts_dir := $(LOCAL_PATH)/prebuilts/api/$(version) 61 62# vendor_sepolicy.cil and plat_pub_versioned.cil are the new design to replace 63# nonplat_sepolicy.cil. 64$(version)_nonplat := $($(version)_prebuilts_dir)/vendor_sepolicy.cil \ 65$($(version)_prebuilts_dir)/plat_pub_versioned.cil 66ifeq (,$(wildcard $($(version)_nonplat))) 67$(version)_nonplat := $($(version)_prebuilts_dir)/nonplat_sepolicy.cil 68endif 69 70$($(version)_compat): PRIVATE_CIL_FILES := \ 71$(built_plat_cil) $($(version)_mapping.cil) $($(version)_nonplat) 72$($(version)_compat): $(HOST_OUT_EXECUTABLES)/secilc \ 73$(built_plat_cil) $($(version)_mapping.cil) $($(version)_nonplat) 74 $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -N -c $(POLICYVERS) \ 75 $(PRIVATE_CIL_FILES) -o $@ -f /dev/null 76 77# $(version)_mapping.combined.cil - a combination of the mapping file used when 78# combining the current platform policy with nonplatform policy based on the 79# $(version) policy release and also a special ignored file that exists purely for 80# these tests. 81$(version)_mapping.combined.cil := $(intermediates)/$(version)_mapping.combined.cil 82$($(version)_mapping.combined.cil): $($(version)_mapping.cil) $($(version)_mapping.ignore.cil) 83 mkdir -p $(dir $@) 84 cat $^ > $@ 85 86$(LOCAL_BUILT_MODULE): ALL_FC_ARGS := $(all_fc_args) 87$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) 88$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY_OLD := $(built_$(version)_plat_sepolicy) 89$(LOCAL_BUILT_MODULE): PRIVATE_COMBINED_MAPPING := $($(version)_mapping.combined.cil) 90$(LOCAL_BUILT_MODULE): PRIVATE_PLAT_SEPOLICY := $(built_plat_sepolicy) 91$(LOCAL_BUILT_MODULE): PRIVATE_PLAT_PUB_SEPOLICY := $(base_plat_pub_policy.cil) 92$(LOCAL_BUILT_MODULE): PRIVATE_FAKE_TREBLE := 93ifeq ($(PRODUCT_FULL_TREBLE_OVERRIDE),true) 94# TODO(b/113124961): remove fake-treble 95$(LOCAL_BUILT_MODULE): PRIVATE_FAKE_TREBLE := --fake-treble 96endif # PRODUCT_FULL_TREBLE_OVERRIDE = true 97$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/treble_sepolicy_tests \ 98 $(all_fc_files) $(built_sepolicy) $(built_plat_sepolicy) \ 99 $(base_plat_pub_policy.cil) \ 100 $(built_$(version)_plat_sepolicy) $($(version)_compat) $($(version)_mapping.combined.cil) 101 @mkdir -p $(dir $@) 102 $(hide) $(HOST_OUT_EXECUTABLES)/treble_sepolicy_tests -l \ 103 $(HOST_OUT)/lib64/libsepolwrap.$(SHAREDLIB_EXT) $(ALL_FC_ARGS) \ 104 -b $(PRIVATE_PLAT_SEPOLICY) -m $(PRIVATE_COMBINED_MAPPING) \ 105 -o $(PRIVATE_SEPOLICY_OLD) -p $(PRIVATE_SEPOLICY) \ 106 -u $(PRIVATE_PLAT_PUB_SEPOLICY) \ 107 $(PRIVATE_FAKE_TREBLE) 108 $(hide) touch $@ 109 110$(version)_PLAT_PUBLIC_POLICY := 111$(version)_PLAT_PRIVATE_POLICY := 112$(version)_compat := 113$(version)_mapping.cil := 114$(version)_mapping.combined.cil := 115$(version)_mapping.ignore.cil := 116$(version)_nonplat := 117$(version)_prebuilts_dir := 118built_$(version)_plat_sepolicy := 119version := 120version_under_treble_tests := 121