1LOCAL_PATH:= $(call my-dir) 2 3include $(LOCAL_PATH)/definitions.mk 4include $(LOCAL_PATH)/policy_version.mk 5 6include $(CLEAR_VARS) 7 8MLS_SENS=1 9MLS_CATS=1024 10 11ifdef BOARD_SEPOLICY_UNION 12$(warning BOARD_SEPOLICY_UNION is no longer required - all files found in BOARD_SEPOLICY_DIRS are implicitly unioned; please remove from your BoardConfig.mk or other .mk file.) 13endif 14 15ifdef BOARD_SEPOLICY_M4DEFS 16LOCAL_ADDITIONAL_M4DEFS := $(addprefix -D, $(BOARD_SEPOLICY_M4DEFS)) 17else 18LOCAL_ADDITIONAL_M4DEFS := 19endif 20 21# sepolicy is now divided into multiple portions: 22# public - policy exported on which non-platform policy developers may write 23# additional policy. types and attributes are versioned and included in 24# delivered non-platform policy, which is to be combined with platform policy. 25# private - platform-only policy required for platform functionality but which 26# is not exported to vendor policy developers and as such may not be assumed 27# to exist. 28# vendor - vendor-only policy required for vendor functionality. This policy can 29# reference the public policy but cannot reference the private policy. This 30# policy is for components which are produced from the core/non-vendor tree and 31# placed into a vendor partition. 32# mapping - This contains policy statements which map the attributes 33# exposed in the public policy of previous versions to the concrete types used 34# in this policy to ensure that policy targeting attributes from public 35# policy from an older platform version continues to work. 36 37# build process for device: 38# 1) convert policies to CIL: 39# - private + public platform policy to CIL 40# - mapping file to CIL (should already be in CIL form) 41# - non-platform public policy to CIL 42# - non-platform public + private policy to CIL 43# 2) attributize policy 44# - run script which takes non-platform public and non-platform combined 45# private + public policy and produces attributized and versioned 46# non-platform policy 47# 3) combine policy files 48# - combine mapping, platform and non-platform policy. 49# - compile output binary policy file 50 51PLAT_PUBLIC_POLICY := $(LOCAL_PATH)/public 52PLAT_PRIVATE_POLICY := $(LOCAL_PATH)/private 53PLAT_VENDOR_POLICY := $(LOCAL_PATH)/vendor 54REQD_MASK_POLICY := $(LOCAL_PATH)/reqd_mask 55 56SYSTEM_EXT_PUBLIC_POLICY := $(SYSTEM_EXT_PUBLIC_SEPOLICY_DIRS) 57ifneq (,$(BOARD_PLAT_PUBLIC_SEPOLICY_DIR)) 58 # TODO: Disallow BOARD_PLAT_* 59 SYSTEM_EXT_PUBLIC_POLICY += $(BOARD_PLAT_PUBLIC_SEPOLICY_DIR) 60endif 61SYSTEM_EXT_PRIVATE_POLICY := $(SYSTEM_EXT_PRIVATE_SEPOLICY_DIRS) 62ifneq (,$(BOARD_PLAT_PRIVATE_SEPOLICY_DIR)) 63 # TODO: Disallow BOARD_PLAT_* 64 SYSTEM_EXT_PRIVATE_POLICY += $(BOARD_PLAT_PRIVATE_SEPOLICY_DIR) 65endif 66 67PRODUCT_PUBLIC_POLICY := $(PRODUCT_PUBLIC_SEPOLICY_DIRS) 68PRODUCT_PRIVATE_POLICY := $(PRODUCT_PRIVATE_SEPOLICY_DIRS) 69 70# Extra sepolicy and prebuilts directories for sepolicy_freeze_test 71FREEZE_TEST_EXTRA_DIRS := $(SEPOLICY_FREEZE_TEST_EXTRA_DIRS) 72FREEZE_TEST_EXTRA_PREBUILT_DIRS := $(SEPOLICY_FREEZE_TEST_EXTRA_PREBUILT_DIRS) 73 74ifneq (,$(SYSTEM_EXT_PUBLIC_POLICY)$(SYSTEM_EXT_PRIVATE_POLICY)) 75HAS_SYSTEM_EXT_SEPOLICY_DIR := true 76endif 77 78# TODO(b/119305624): Currently if the device doesn't have a product partition, 79# we install product sepolicy into /system/product. We do that because bits of 80# product sepolicy that's still in /system might depend on bits that have moved 81# to /product. Once we finish migrating product sepolicy out of system, change 82# it so that if no product partition is present, product sepolicy artifacts are 83# not built and installed at all. 84ifneq (,$(PRODUCT_PUBLIC_POLICY)$(PRODUCT_PRIVATE_POLICY)) 85HAS_PRODUCT_SEPOLICY_DIR := true 86endif 87 88# TODO: move to README when doing the README update and finalizing versioning. 89# BOARD_SEPOLICY_VERS must take the format "NN.m" and contain the sepolicy 90# version identifier corresponding to the sepolicy on which the non-platform 91# policy is to be based. If unspecified, this will build against the current 92# public platform policy in tree 93ifndef BOARD_SEPOLICY_VERS 94# The default platform policy version. 95BOARD_SEPOLICY_VERS := $(PLATFORM_SEPOLICY_VERSION) 96endif 97 98# If BOARD_SEPOLICY_VERS is set to a value other than PLATFORM_SEPOLICY_VERSION, 99# policy files of platform (system, system_ext, product) can't be mixed with 100# policy files of vendor (vendor, odm). If it's the case, platform policies and 101# vendor policies are separately built. More specifically, 102# 103# - Platform policy files needed to build vendor policies, such as plat_policy, 104# plat_mapping_cil, plat_pub_policy, reqd_policy_mask, are built from the 105# prebuilts (copy of platform policy files of version BOARD_SEPOLICY_VERS). 106# 107# - sepolicy_neverallows only checks platform policies, and a new module 108# sepolicy_neverallows_vendor checks vendor policies. 109# 110# - neverallow checks are turned off while compiling precompiled_sepolicy module 111# and sepolicy module. 112# 113# - Vendor policies are not checked on the compat test (compat.mk). 114# 115# In such scenario, we can grab platform policy files from the prebuilts/api 116# directory. But we need more than that: prebuilts of system_ext, product, 117# system/sepolicy/reqd_mask, and system/sepolicy/vendor. The following variables 118# are introduced to specify such prebuilts. 119# 120# - BOARD_REQD_MASK_POLICY (prebuilt of system/sepolicy/reqd_mask) 121# - BOARD_PLAT_VENDOR_POLICY (prebuilt of system/sepolicy/vendor) 122# - BOARD_SYSTEM_EXT_PUBLIC_PREBUILT_DIRS (prebuilt of system_ext public) 123# - BOARD_SYSTEM_EXT_PRIVATE_PREBUILT_DIRS (prebuilt of system_ext private) 124# - BOARD_PRODUCT_PUBLIC_PREBUILT_DIRS (prebuilt of product public) 125# - BOARD_PRODUCT_PRIVATE_PREBUILT_DIRS (prebuilt of product private) 126# 127# Vendors are responsible for copying policy files from the old version of the 128# source tree as prebuilts, and for setting BOARD_*_POLICY variables so they can 129# be used to build vendor policies. See prebuilt_policy.mk for more details. 130# 131# To support both mixed build and normal build, platform policy files are 132# indirectly referred by {partition}_{public|private}_policy_$(ver) variables 133# when building vendor policies. See vendor_sepolicy.cil and odm_sepolicy.cil 134# for more details. 135# 136# sepolicy.recovery is also compiled from vendor and plat prebuilt policies. 137ifneq ($(PLATFORM_SEPOLICY_VERSION),$(BOARD_SEPOLICY_VERS)) 138mixed_sepolicy_build := true 139else 140mixed_sepolicy_build := 141endif 142 143NEVERALLOW_ARG := 144ifeq ($(SELINUX_IGNORE_NEVERALLOWS),true) 145ifeq ($(TARGET_BUILD_VARIANT),user) 146$(error SELINUX_IGNORE_NEVERALLOWS := true cannot be used in user builds) 147endif 148$(warning Be careful when using the SELINUX_IGNORE_NEVERALLOWS flag. \ 149 It does not work in user builds and using it will \ 150 not stop you from failing CTS.) 151NEVERALLOW_ARG := -N 152endif 153 154# BOARD_SEPOLICY_DIRS was used for vendor/odm sepolicy customization before. 155# It has been replaced by BOARD_VENDOR_SEPOLICY_DIRS (mandatory) and 156# BOARD_ODM_SEPOLICY_DIRS (optional). BOARD_SEPOLICY_DIRS is still allowed for 157# backward compatibility, which will be merged into BOARD_VENDOR_SEPOLICY_DIRS. 158ifdef BOARD_SEPOLICY_DIRS 159BOARD_VENDOR_SEPOLICY_DIRS += $(BOARD_SEPOLICY_DIRS) 160endif 161 162# Set default values for these prebuilt directories 163ifeq (,$(BOARD_REQD_MASK_POLICY)) 164BOARD_REQD_MASK_POLICY := $(REQD_MASK_POLICY) 165endif 166 167ifeq (,$(BOARD_PLAT_VENDOR_POLICY)) 168BOARD_PLAT_VENDOR_POLICY := $(PLAT_VENDOR_POLICY) 169endif 170 171$(foreach p,SYSTEM_EXT PRODUCT,$(foreach q,PUBLIC PRIVATE,$(eval \ 172 $(if $(BOARD_$(p)_$(q)_PREBUILT_DIRS),,\ 173 BOARD_$(p)_$(q)_PREBUILT_DIRS := $($(p)_$(q)_POLICY) \ 174 ) \ 175))) 176 177ifdef BOARD_ODM_SEPOLICY_DIRS 178ifneq ($(PRODUCT_SEPOLICY_SPLIT),true) 179$(error PRODUCT_SEPOLICY_SPLIT needs to be true when using BOARD_ODM_SEPOLICY_DIRS) 180endif 181endif 182 183########################################################### 184# Compute policy files to be used in policy build. 185# $(1): files to include 186# $(2): directories in which to find files 187########################################################### 188 189define build_policy 190$(foreach type, $(1), $(foreach file, $(addsuffix /$(type), $(2)), $(sort $(wildcard $(file))))) 191endef 192 193# Builds paths for all policy files found in BOARD_VENDOR_SEPOLICY_DIRS. 194# $(1): the set of policy name paths to build 195build_vendor_policy = $(call build_policy, $(1), $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS)) 196 197# Builds paths for all policy files found in BOARD_ODM_SEPOLICY_DIRS. 198build_odm_policy = $(call build_policy, $(1), $(BOARD_ODM_SEPOLICY_DIRS)) 199 200sepolicy_build_files := security_classes \ 201 initial_sids \ 202 access_vectors \ 203 global_macros \ 204 neverallow_macros \ 205 mls_macros \ 206 mls_decl \ 207 mls \ 208 policy_capabilities \ 209 te_macros \ 210 attributes \ 211 ioctl_defines \ 212 ioctl_macros \ 213 *.te \ 214 roles_decl \ 215 roles \ 216 users \ 217 initial_sid_contexts \ 218 fs_use \ 219 genfs_contexts \ 220 port_contexts 221 222sepolicy_compat_files := $(foreach ver, $(PLATFORM_SEPOLICY_COMPAT_VERSIONS), \ 223 $(addprefix compat/$(ver)/, $(addsuffix .cil, $(ver)))) 224 225# Security classes and permissions defined outside of system/sepolicy. 226security_class_extension_files := $(call build_policy, security_classes access_vectors, \ 227 $(SYSTEM_EXT_PUBLIC_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY) \ 228 $(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY) \ 229 $(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_ODM_SEPOLICY_DIRS)) 230 231ifneq (,$(strip $(security_class_extension_files))) 232 $(error Only platform SELinux policy may define classes and permissions: $(strip $(security_class_extension_files))) 233endif 234 235ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR 236 # Checks if there are public system_ext policy files. 237 policy_files := $(call build_policy, $(sepolicy_build_files), $(SYSTEM_EXT_PUBLIC_POLICY)) 238 ifneq (,$(strip $(policy_files))) 239 HAS_SYSTEM_EXT_PUBLIC_SEPOLICY := true 240 endif 241 # Checks if there are public/private system_ext policy files. 242 policy_files := $(call build_policy, $(sepolicy_build_files), $(SYSTEM_EXT_PUBLIC_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY)) 243 ifneq (,$(strip $(policy_files))) 244 HAS_SYSTEM_EXT_SEPOLICY := true 245 endif 246endif # ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR 247 248ifdef HAS_PRODUCT_SEPOLICY_DIR 249 # Checks if there are public product policy files. 250 policy_files := $(call build_policy, $(sepolicy_build_files), $(PRODUCT_PUBLIC_POLICY)) 251 ifneq (,$(strip $(policy_files))) 252 HAS_PRODUCT_PUBLIC_SEPOLICY := true 253 endif 254 # Checks if there are public/private product policy files. 255 policy_files := $(call build_policy, $(sepolicy_build_files), $(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY)) 256 ifneq (,$(strip $(policy_files))) 257 HAS_PRODUCT_SEPOLICY := true 258 endif 259endif # ifdef HAS_PRODUCT_SEPOLICY_DIR 260 261# CIL files which contain workarounds for current limitation of human-readable 262# module policy language. These files are appended to the CIL files produced 263# from module language files. 264sepolicy_build_cil_workaround_files := technical_debt.cil 265 266my_target_arch := $(TARGET_ARCH) 267ifneq (,$(filter mips mips64,$(TARGET_ARCH))) 268 my_target_arch := mips 269endif 270 271intermediates := $(TARGET_OUT_INTERMEDIATES)/ETC/sepolicy_intermediates 272 273with_asan := false 274ifneq (,$(filter address,$(SANITIZE_TARGET))) 275 with_asan := true 276endif 277 278with_native_coverage := false 279ifeq ($(NATIVE_COVERAGE),true) 280 with_native_coverage := true 281endif 282ifeq ($(CLANG_COVERAGE),true) 283 with_native_coverage := true 284endif 285 286treble_sysprop_neverallow := true 287ifeq ($(BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW),true) 288 treble_sysprop_neverallow := false 289endif 290 291ifeq ($(PRODUCT_SHIPPING_API_LEVEL),) 292 #$(warning no product shipping level defined) 293else ifneq ($(call math_lt,29,$(PRODUCT_SHIPPING_API_LEVEL)),) 294 ifneq ($(BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW),) 295 $(error BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW cannot be set on a device shipping with R or later, and this is tested by CTS.) 296 endif 297endif 298 299enforce_sysprop_owner := true 300ifeq ($(BUILD_BROKEN_ENFORCE_SYSPROP_OWNER),true) 301 enforce_sysprop_owner := false 302endif 303 304enforce_debugfs_restriction := false 305ifeq ($(PRODUCT_SET_DEBUGFS_RESTRICTIONS),true) 306 enforce_debugfs_restriction := true 307endif 308 309ifeq ($(PRODUCT_SHIPPING_API_LEVEL),) 310 #$(warning no product shipping level defined) 311else ifneq ($(call math_lt,30,$(PRODUCT_SHIPPING_API_LEVEL)),) 312 ifneq ($(BUILD_BROKEN_ENFORCE_SYSPROP_OWNER),) 313 $(error BUILD_BROKEN_ENFORCE_SYSPROP_OWNER cannot be set on a device shipping with S or later, and this is tested by CTS.) 314 endif 315endif 316 317# Library extension for host-side tests 318ifeq ($(HOST_OS),darwin) 319SHAREDLIB_EXT=dylib 320else 321SHAREDLIB_EXT=so 322endif 323 324# Convert a file_context file for a non-flattened APEX into a file for 325# flattened APEX. /system/apex/<apex_name> path is prepended to the original paths 326# $(1): path to the input file_contexts file for non-flattened APEX 327# $(2): path to the flattened APEX 328# $(3): path to the generated file_contexts file for flattened APEX 329# $(4): variable where $(3) is added to 330define build_flattened_apex_file_contexts 331$(4) += $(3) 332$(3): PRIVATE_APEX_PATH := $(subst .,\\.,$(2)) 333$(3): $(1) 334 $(hide) awk '/object_r/{printf("$$(PRIVATE_APEX_PATH)%s\n",$$$$0)}' $$< > $$@ 335endef 336 337################################# 338 339include $(CLEAR_VARS) 340 341LOCAL_MODULE := selinux_policy 342LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered 343LOCAL_LICENSE_CONDITIONS := notice unencumbered 344LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE 345LOCAL_MODULE_TAGS := optional 346LOCAL_REQUIRED_MODULES += \ 347 selinux_policy_nonsystem \ 348 selinux_policy_system \ 349 350include $(BUILD_PHONY_PACKAGE) 351 352# selinux_policy is a main goal and triggers lots of tests. 353# Most tests are FAKE modules, so aren'triggered on normal builds. (e.g. 'm') 354# By setting as droidcore's dependency, tests will run on normal builds. 355droidcore: selinux_policy 356 357include $(CLEAR_VARS) 358LOCAL_MODULE := selinux_policy_system 359LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered 360LOCAL_LICENSE_CONDITIONS := notice unencumbered 361LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE 362# These build targets are not used on non-Treble devices. However, we build these to avoid 363# divergence between Treble and non-Treble devices. 364LOCAL_REQUIRED_MODULES += \ 365 plat_mapping_file \ 366 $(addprefix plat_,$(addsuffix .cil,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS))) \ 367 $(addsuffix .compat.cil,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS)) \ 368 plat_sepolicy.cil \ 369 secilc \ 370 371ifneq ($(PRODUCT_PRECOMPILED_SEPOLICY),false) 372LOCAL_REQUIRED_MODULES += plat_sepolicy_and_mapping.sha256 373endif 374 375LOCAL_REQUIRED_MODULES += \ 376 build_sepolicy \ 377 plat_file_contexts \ 378 plat_file_contexts_test \ 379 plat_keystore2_key_contexts \ 380 plat_mac_permissions.xml \ 381 plat_property_contexts \ 382 plat_property_contexts_test \ 383 plat_seapp_contexts \ 384 plat_service_contexts \ 385 plat_service_contexts_test \ 386 plat_hwservice_contexts \ 387 plat_hwservice_contexts_test \ 388 searchpolicy \ 389 390# This conditional inclusion closely mimics the conditional logic 391# inside init/init.cpp for loading SELinux policy from files. 392ifneq ($(PRODUCT_SEPOLICY_SPLIT),true) 393# The following files are only allowed for non-Treble devices. 394LOCAL_REQUIRED_MODULES += \ 395 sepolicy \ 396 vendor_service_contexts \ 397 398endif # ($(PRODUCT_SEPOLICY_SPLIT),true) 399 400ifneq ($(with_asan),true) 401ifneq ($(SELINUX_IGNORE_NEVERALLOWS),true) 402LOCAL_REQUIRED_MODULES += \ 403 sepolicy_tests \ 404 $(addsuffix _compat_test,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS)) \ 405 406ifeq ($(PRODUCT_SEPOLICY_SPLIT),true) 407LOCAL_REQUIRED_MODULES += \ 408 $(addprefix treble_sepolicy_tests_,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS)) \ 409 410endif # PRODUCT_SEPOLICY_SPLIT 411endif # SELINUX_IGNORE_NEVERALLOWS 412endif # with_asan 413 414ifneq ($(PLATFORM_SEPOLICY_VERSION),$(TOT_SEPOLICY_VERSION)) 415LOCAL_REQUIRED_MODULES += \ 416 sepolicy_freeze_test \ 417 418else 419ifneq (,$(FREEZE_TEST_EXTRA_DIRS)$(FREEZE_TEST_EXTRA_PREBUILT_DIRS)) 420$(error SEPOLICY_FREEZE_TEST_EXTRA_DIRS or SEPOLICY_FREEZE_TEST_EXTRA_PREBUILT_DIRS\ 421cannot be set before system/sepolicy freezes.) 422endif # (,$(FREEZE_TEST_EXTRA_DIRS)$(FREEZE_TEST_EXTRA_PREBUILT_DIRS)) 423endif # ($(PLATFORM_SEPOLICY_VERSION),$(TOT_SEPOLICY_VERSION)) 424 425include $(BUILD_PHONY_PACKAGE) 426 427################################# 428 429include $(CLEAR_VARS) 430 431LOCAL_MODULE := selinux_policy_system_ext 432LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered 433LOCAL_LICENSE_CONDITIONS := notice unencumbered 434LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE 435# Include precompiled policy, unless told otherwise. 436ifneq ($(PRODUCT_PRECOMPILED_SEPOLICY),false) 437ifdef HAS_SYSTEM_EXT_SEPOLICY 438LOCAL_REQUIRED_MODULES += system_ext_sepolicy_and_mapping.sha256 439endif 440endif 441 442ifdef HAS_SYSTEM_EXT_SEPOLICY 443LOCAL_REQUIRED_MODULES += system_ext_sepolicy.cil 444endif 445 446ifdef HAS_SYSTEM_EXT_PUBLIC_SEPOLICY 447LOCAL_REQUIRED_MODULES += \ 448 system_ext_mapping_file 449 450system_ext_compat_files := $(call build_policy, $(sepolicy_compat_files), $(SYSTEM_EXT_PRIVATE_POLICY)) 451 452LOCAL_REQUIRED_MODULES += $(addprefix system_ext_, $(notdir $(system_ext_compat_files))) 453 454endif 455 456ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR 457LOCAL_REQUIRED_MODULES += \ 458 system_ext_file_contexts \ 459 system_ext_file_contexts_test \ 460 system_ext_hwservice_contexts \ 461 system_ext_hwservice_contexts_test \ 462 system_ext_property_contexts \ 463 system_ext_property_contexts_test \ 464 system_ext_seapp_contexts \ 465 system_ext_service_contexts \ 466 system_ext_service_contexts_test \ 467 system_ext_mac_permissions.xml \ 468 $(addprefix system_ext_,$(addsuffix .compat.cil,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS))) \ 469 470endif 471 472include $(BUILD_PHONY_PACKAGE) 473 474################################# 475 476include $(CLEAR_VARS) 477 478LOCAL_MODULE := selinux_policy_product 479LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered 480LOCAL_LICENSE_CONDITIONS := notice unencumbered 481LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE 482# Include precompiled policy, unless told otherwise. 483ifneq ($(PRODUCT_PRECOMPILED_SEPOLICY),false) 484ifdef HAS_PRODUCT_SEPOLICY 485LOCAL_REQUIRED_MODULES += product_sepolicy_and_mapping.sha256 486endif 487endif 488 489ifdef HAS_PRODUCT_SEPOLICY 490LOCAL_REQUIRED_MODULES += product_sepolicy.cil 491endif 492 493ifdef HAS_PRODUCT_PUBLIC_SEPOLICY 494LOCAL_REQUIRED_MODULES += \ 495 product_mapping_file 496 497product_compat_files := $(call build_policy, $(sepolicy_compat_files), $(PRODUCT_PRIVATE_POLICY)) 498 499LOCAL_REQUIRED_MODULES += $(addprefix product_, $(notdir $(product_compat_files))) 500 501endif 502 503ifdef HAS_PRODUCT_SEPOLICY_DIR 504LOCAL_REQUIRED_MODULES += \ 505 product_file_contexts \ 506 product_file_contexts_test \ 507 product_hwservice_contexts \ 508 product_hwservice_contexts_test \ 509 product_property_contexts \ 510 product_property_contexts_test \ 511 product_seapp_contexts \ 512 product_service_contexts \ 513 product_service_contexts_test \ 514 product_mac_permissions.xml \ 515 516endif 517 518include $(BUILD_PHONY_PACKAGE) 519 520################################# 521 522include $(CLEAR_VARS) 523 524LOCAL_MODULE := selinux_policy_nonsystem 525LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered 526LOCAL_LICENSE_CONDITIONS := notice unencumbered 527LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE 528# Include precompiled policy, unless told otherwise. 529ifneq ($(PRODUCT_PRECOMPILED_SEPOLICY),false) 530LOCAL_REQUIRED_MODULES += \ 531 precompiled_sepolicy \ 532 precompiled_sepolicy.plat_sepolicy_and_mapping.sha256 533 534ifdef HAS_SYSTEM_EXT_SEPOLICY 535LOCAL_REQUIRED_MODULES += precompiled_sepolicy.system_ext_sepolicy_and_mapping.sha256 536endif 537 538ifdef HAS_PRODUCT_SEPOLICY 539LOCAL_REQUIRED_MODULES += precompiled_sepolicy.product_sepolicy_and_mapping.sha256 540endif 541 542endif # ($(PRODUCT_PRECOMPILED_SEPOLICY),false) 543 544 545# These build targets are not used on non-Treble devices. However, we build these to avoid 546# divergence between Treble and non-Treble devices. 547LOCAL_REQUIRED_MODULES += \ 548 plat_pub_versioned.cil \ 549 vendor_sepolicy.cil \ 550 plat_sepolicy_vers.txt \ 551 552LOCAL_REQUIRED_MODULES += \ 553 vendor_file_contexts \ 554 vendor_file_contexts_test \ 555 vendor_mac_permissions.xml \ 556 vendor_property_contexts \ 557 vendor_property_contexts_test \ 558 vendor_seapp_contexts \ 559 vendor_service_contexts \ 560 vendor_hwservice_contexts \ 561 vendor_hwservice_contexts_test \ 562 vndservice_contexts \ 563 564ifdef BOARD_ODM_SEPOLICY_DIRS 565LOCAL_REQUIRED_MODULES += \ 566 odm_sepolicy.cil \ 567 odm_file_contexts \ 568 odm_file_contexts_test \ 569 odm_seapp_contexts \ 570 odm_property_contexts \ 571 odm_property_contexts_test \ 572 odm_hwservice_contexts \ 573 odm_hwservice_contexts_test \ 574 odm_mac_permissions.xml 575endif 576 577LOCAL_REQUIRED_MODULES += selinux_policy_system_ext 578LOCAL_REQUIRED_MODULES += selinux_policy_product 579 580LOCAL_REQUIRED_MODULES += \ 581 selinux_denial_metadata \ 582 583# Builds an addtional userdebug sepolicy into the debug ramdisk. 584LOCAL_REQUIRED_MODULES += \ 585 userdebug_plat_sepolicy.cil \ 586 587include $(BUILD_PHONY_PACKAGE) 588 589################################# 590 591ifeq ($(mixed_sepolicy_build),true) 592include $(LOCAL_PATH)/prebuilt_policy.mk 593else 594reqd_policy_$(PLATFORM_SEPOLICY_VERSION) := $(REQD_MASK_POLICY) 595plat_public_policy_$(PLATFORM_SEPOLICY_VERSION) := $(LOCAL_PATH)/public 596plat_private_policy_$(PLATFORM_SEPOLICY_VERSION) := $(LOCAL_PATH)/private 597system_ext_public_policy_$(PLATFORM_SEPOLICY_VERSION) := $(SYSTEM_EXT_PUBLIC_POLICY) 598system_ext_private_policy_$(PLATFORM_SEPOLICY_VERSION) := $(SYSTEM_EXT_PRIVATE_POLICY) 599product_public_policy_$(PLATFORM_SEPOLICY_VERSION) := $(PRODUCT_PUBLIC_POLICY) 600product_private_policy_$(PLATFORM_SEPOLICY_VERSION) := $(PRODUCT_PRIVATE_POLICY) 601endif 602 603################################# 604include $(CLEAR_VARS) 605 606LOCAL_MODULE := sepolicy_neverallows 607LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered 608LOCAL_LICENSE_CONDITIONS := notice unencumbered 609LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE 610LOCAL_MODULE_CLASS := FAKE 611LOCAL_MODULE_TAGS := optional 612 613include $(BUILD_SYSTEM)/base_rules.mk 614 615# sepolicy_policy.conf - All of the policy for the device. This is only used to 616# check neverallow rules. 617# In a mixed build target, vendor policies are checked separately, on the module 618# sepolicy_neverallows_vendor. 619 620all_plat_policy := $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) $(PLAT_VENDOR_POLICY) \ 621 $(SYSTEM_EXT_PUBLIC_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY) \ 622 $(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY) 623ifeq ($(mixed_sepolicy_build),true) 624policy_files := $(call build_policy, $(sepolicy_build_files), $(all_plat_policy)) 625else 626policy_files := $(call build_policy, $(sepolicy_build_files), \ 627 $(all_plat_policy) $(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_ODM_SEPOLICY_DIRS)) 628endif 629 630sepolicy_policy.conf := $(intermediates)/policy.conf 631$(sepolicy_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS) 632$(sepolicy_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS) 633$(sepolicy_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := user 634$(sepolicy_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch) 635$(sepolicy_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) 636$(sepolicy_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage) 637$(sepolicy_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) 638$(sepolicy_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT) 639$(sepolicy_policy.conf): PRIVATE_ENFORCE_DEBUGFS_RESTRICTION := $(enforce_debugfs_restriction) 640$(sepolicy_policy.conf): PRIVATE_POLICY_FILES := $(policy_files) 641$(sepolicy_policy.conf): $(policy_files) $(M4) 642 $(transform-policy-to-conf) 643 $(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit 644 645# sepolicy_policy_2.conf - All of the policy for the device. This is only used to 646# check neverallow rules using sepolicy-analyze, similar to CTS. 647sepolicy_policy_2.conf := $(intermediates)/policy_2.conf 648$(sepolicy_policy_2.conf): PRIVATE_MLS_SENS := $(MLS_SENS) 649$(sepolicy_policy_2.conf): PRIVATE_MLS_CATS := $(MLS_CATS) 650$(sepolicy_policy_2.conf): PRIVATE_TARGET_BUILD_VARIANT := user 651$(sepolicy_policy_2.conf): PRIVATE_EXCLUDE_BUILD_TEST := true 652$(sepolicy_policy_2.conf): PRIVATE_TGT_ARCH := $(my_target_arch) 653$(sepolicy_policy_2.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) 654$(sepolicy_policy_2.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage) 655$(sepolicy_policy_2.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) 656$(sepolicy_policy_2.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT) 657$(sepolicy_policy_2.conf): PRIVATE_ENFORCE_DEBUGFS_RESTRICTION := $(enforce_debugfs_restriction) 658$(sepolicy_policy_2.conf): PRIVATE_POLICY_FILES := $(policy_files) 659$(sepolicy_policy_2.conf): $(policy_files) $(M4) 660 $(transform-policy-to-conf) 661 $(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit 662 663$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY_1 := $(sepolicy_policy.conf) 664$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY_2 := $(sepolicy_policy_2.conf) 665$(LOCAL_BUILT_MODULE): $(sepolicy_policy.conf) $(sepolicy_policy_2.conf) \ 666 $(HOST_OUT_EXECUTABLES)/checkpolicy $(HOST_OUT_EXECUTABLES)/sepolicy-analyze 667ifneq ($(SELINUX_IGNORE_NEVERALLOWS),true) 668 $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c \ 669 $(POLICYVERS) -o $@.tmp $(PRIVATE_SEPOLICY_1) 670 $(hide) $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $@.tmp neverallow -w -f $(PRIVATE_SEPOLICY_2) || \ 671 ( echo "" 1>&2; \ 672 echo "sepolicy-analyze failed. This is most likely due to the use" 1>&2; \ 673 echo "of an expanded attribute in a neverallow assertion. Please fix" 1>&2; \ 674 echo "the policy." 1>&2; \ 675 exit 1 ) 676endif # ($(SELINUX_IGNORE_NEVERALLOWS),true) 677 $(hide) touch $@.tmp 678 $(hide) mv $@.tmp $@ 679 680sepolicy_policy.conf := 681sepolicy_policy_2.conf := 682built_sepolicy_neverallows := $(LOCAL_BUILT_MODULE) 683 684################################# 685# sepolicy_neverallows_vendor: neverallow check module for vendors in a mixed build target 686ifeq ($(mixed_sepolicy_build),true) 687include $(CLEAR_VARS) 688 689LOCAL_MODULE := sepolicy_neverallows_vendor 690LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered 691LOCAL_LICENSE_CONDITIONS := notice unencumbered 692LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE 693LOCAL_MODULE_CLASS := FAKE 694LOCAL_MODULE_TAGS := optional 695 696include $(BUILD_SYSTEM)/base_rules.mk 697 698# Check neverallow with prebuilt policy files 699policy_files := $(call build_policy, $(sepolicy_build_files), \ 700 $(plat_public_policy_$(BOARD_SEPOLICY_VERS)) $(plat_private_policy_$(BOARD_SEPOLICY_VERS)) \ 701 $(system_ext_public_policy_$(BOARD_SEPOLICY_VERS)) $(system_ext_private_policy_$(BOARD_SEPOLICY_VERS)) \ 702 $(product_public_policy_$(BOARD_SEPOLICY_VERS)) $(product_private_policy_$(BOARD_SEPOLICY_VERS)) \ 703 $(BOARD_PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_ODM_SEPOLICY_DIRS)) 704 705# sepolicy_policy.conf - All of the policy for the device. This is only used to 706# check neverallow rules. 707sepolicy_policy.conf := $(intermediates)/policy_vendor.conf 708$(sepolicy_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS) 709$(sepolicy_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS) 710$(sepolicy_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := user 711$(sepolicy_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch) 712$(sepolicy_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) 713$(sepolicy_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage) 714$(sepolicy_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) 715$(sepolicy_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT) 716$(sepolicy_policy.conf): PRIVATE_ENFORCE_DEBUGFS_RESTRICTION := $(enforce_debugfs_restriction) 717$(sepolicy_policy.conf): PRIVATE_POLICY_FILES := $(policy_files) 718$(sepolicy_policy.conf): $(policy_files) $(M4) 719 $(transform-policy-to-conf) 720 $(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit 721 722# sepolicy_policy_2.conf - All of the policy for the device. This is only used to 723# check neverallow rules using sepolicy-analyze, similar to CTS. 724sepolicy_policy_2.conf := $(intermediates)/policy_vendor_2.conf 725$(sepolicy_policy_2.conf): PRIVATE_MLS_SENS := $(MLS_SENS) 726$(sepolicy_policy_2.conf): PRIVATE_MLS_CATS := $(MLS_CATS) 727$(sepolicy_policy_2.conf): PRIVATE_TARGET_BUILD_VARIANT := user 728$(sepolicy_policy_2.conf): PRIVATE_EXCLUDE_BUILD_TEST := true 729$(sepolicy_policy_2.conf): PRIVATE_TGT_ARCH := $(my_target_arch) 730$(sepolicy_policy_2.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) 731$(sepolicy_policy_2.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage) 732$(sepolicy_policy_2.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) 733$(sepolicy_policy_2.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT) 734$(sepolicy_policy_2.conf): PRIVATE_ENFORCE_DEBUGFS_RESTRICTION := $(enforce_debugfs_restriction) 735$(sepolicy_policy_2.conf): PRIVATE_POLICY_FILES := $(policy_files) 736$(sepolicy_policy_2.conf): $(policy_files) $(M4) 737 $(transform-policy-to-conf) 738 $(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit 739 740$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY_1 := $(sepolicy_policy.conf) 741$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY_2 := $(sepolicy_policy_2.conf) 742$(LOCAL_BUILT_MODULE): $(sepolicy_policy.conf) $(sepolicy_policy_2.conf) \ 743 $(HOST_OUT_EXECUTABLES)/checkpolicy $(HOST_OUT_EXECUTABLES)/sepolicy-analyze 744ifneq ($(SELINUX_IGNORE_NEVERALLOWS),true) 745 $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c \ 746 $(POLICYVERS) -o $@.tmp $(PRIVATE_SEPOLICY_1) 747 $(hide) $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $@.tmp neverallow -w -f $(PRIVATE_SEPOLICY_2) || \ 748 ( echo "" 1>&2; \ 749 echo "sepolicy-analyze failed. This is most likely due to the use" 1>&2; \ 750 echo "of an expanded attribute in a neverallow assertion. Please fix" 1>&2; \ 751 echo "the policy." 1>&2; \ 752 exit 1 ) 753endif # ($(SELINUX_IGNORE_NEVERALLOWS),true) 754 $(hide) touch $@.tmp 755 $(hide) mv $@.tmp $@ 756 757sepolicy_policy.conf := 758sepolicy_policy_2.conf := 759built_sepolicy_neverallows += $(LOCAL_BUILT_MODULE) 760 761endif # ifeq ($(mixed_sepolicy_build),true) 762 763################################## 764# plat policy files are now built with Android.bp. Grab them from intermediate. 765# See Android.bp for details of plat policy files. 766# 767reqd_policy_mask.cil := $(call intermediates-dir-for,ETC,reqd_policy_mask.cil)/reqd_policy_mask.cil 768reqd_policy_mask_$(PLATFORM_SEPOLICY_VERSION).cil := $(reqd_policy_mask.cil) 769 770pub_policy.cil := $(call intermediates-dir-for,ETC,pub_policy.cil)/pub_policy.cil 771pub_policy_$(PLATFORM_SEPOLICY_VERSION).cil := $(pub_policy.cil) 772 773system_ext_pub_policy.cil := $(call intermediates-dir-for,ETC,system_ext_pub_policy.cil)/system_ext_pub_policy.cil 774system_ext_pub_policy_$(PLATFORM_SEPOLICY_VERSION).cil := $(system_ext_pub_policy.cil) 775 776plat_pub_policy.cil := $(call intermediates-dir-for,ETC,plat_pub_policy.cil)/plat_pub_policy.cil 777plat_pub_policy_$(PLATFORM_SEPOLICY_VERSION).cil := $(plat_pub_policy.cil) 778 779built_plat_cil := $(call intermediates-dir-for,ETC,plat_sepolicy.cil)/plat_sepolicy.cil 780built_plat_cil_$(PLATFORM_SEPOLICY_VERSION) := $(built_plat_cil) 781built_plat_mapping_cil := $(call intermediates-dir-for,ETC,plat_mapping_file)/plat_mapping_file 782built_plat_mapping_cil_$(PLATFORM_SEPOLICY_VERSION) := $(built_plat_mapping_cil) 783 784ifdef HAS_SYSTEM_EXT_SEPOLICY 785built_system_ext_cil := $(call intermediates-dir-for,ETC,system_ext_sepolicy.cil)/system_ext_sepolicy.cil 786built_system_ext_cil_$(PLATFORM_SEPOLICY_VERSION) := $(built_system_ext_cil) 787built_system_ext_mapping_cil := $(call intermediates-dir-for,ETC,system_ext_mapping_file)/system_ext_mapping_file 788built_system_ext_mapping_cil_$(PLATFORM_SEPOLICY_VERSION) := $(built_system_ext_mapping_cil) 789endif # ifdef HAS_SYSTEM_EXT_SEPOLICY 790 791ifdef HAS_PRODUCT_SEPOLICY 792built_product_cil := $(call intermediates-dir-for,ETC,product_sepolicy.cil)/product_sepolicy.cil 793built_product_cil_$(PLATFORM_SEPOLICY_VERSION) := $(built_product_cil) 794built_product_mapping_cil := $(call intermediates-dir-for,ETC,product_mapping_file)/product_mapping_file 795built_product_mapping_cil_$(PLATFORM_SEPOLICY_VERSION) := $(built_product_mapping_cil) 796endif # ifdef HAS_PRODUCT_SEPOLICY 797 798built_pub_vers_cil := $(call intermediates-dir-for,ETC,plat_pub_versioned.cil)/plat_pub_versioned.cil 799built_pub_vers_cil_$(PLATFORM_SEPOLICY_VERSION) := $(built_pub_vers_cil) 800 801# b/37755687 802CHECKPOLICY_ASAN_OPTIONS := ASAN_OPTIONS=detect_leaks=0 803 804################################# 805include $(CLEAR_VARS) 806 807# vendor_policy.cil - the vendor sepolicy. This needs attributization and to be combined 808# with the platform-provided policy. It makes use of the reqd_policy_mask files from private 809# policy and the platform public policy files in order to use checkpolicy. 810LOCAL_MODULE := vendor_sepolicy.cil 811LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered 812LOCAL_LICENSE_CONDITIONS := notice unencumbered 813LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE 814LOCAL_MODULE_CLASS := ETC 815LOCAL_MODULE_TAGS := optional 816LOCAL_PROPRIETARY_MODULE := true 817LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux 818 819include $(BUILD_SYSTEM)/base_rules.mk 820 821# Use either prebuilt policy files or current policy files, depending on BOARD_SEPOLICY_VERS 822policy_files := $(call build_policy, $(sepolicy_build_files), \ 823 $(plat_public_policy_$(BOARD_SEPOLICY_VERS)) $(system_ext_public_policy_$(BOARD_SEPOLICY_VERS)) \ 824 $(product_public_policy_$(BOARD_SEPOLICY_VERS)) $(reqd_policy_$(BOARD_SEPOLICY_VERS)) \ 825 $(BOARD_PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS)) 826vendor_policy.conf := $(intermediates)/vendor_policy.conf 827$(vendor_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS) 828$(vendor_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS) 829$(vendor_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT) 830$(vendor_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch) 831$(vendor_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) 832$(vendor_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage) 833$(vendor_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) 834$(vendor_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT) 835$(vendor_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY) 836$(vendor_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow) 837$(vendor_policy.conf): PRIVATE_ENFORCE_SYSPROP_OWNER := $(enforce_sysprop_owner) 838$(vendor_policy.conf): PRIVATE_ENFORCE_DEBUGFS_RESTRICTION := $(enforce_debugfs_restriction) 839$(vendor_policy.conf): PRIVATE_POLICY_FILES := $(policy_files) 840$(vendor_policy.conf): $(policy_files) $(M4) 841 $(transform-policy-to-conf) 842 $(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit 843 844$(LOCAL_BUILT_MODULE): PRIVATE_POL_CONF := $(vendor_policy.conf) 845$(LOCAL_BUILT_MODULE): PRIVATE_REQD_MASK := $(reqd_policy_mask_$(BOARD_SEPOLICY_VERS).cil) 846$(LOCAL_BUILT_MODULE): PRIVATE_BASE_CIL := $(pub_policy_$(BOARD_SEPOLICY_VERS).cil) 847$(LOCAL_BUILT_MODULE): PRIVATE_VERS := $(BOARD_SEPOLICY_VERS) 848$(LOCAL_BUILT_MODULE): PRIVATE_DEP_CIL_FILES := $(built_plat_cil_$(BOARD_SEPOLICY_VERS)) \ 849$(built_system_ext_cil_$(BOARD_SEPOLICY_VERS)) $(built_product_cil_$(BOARD_SEPOLICY_VERS)) \ 850$(built_pub_vers_cil_$(BOARD_SEPOLICY_VERS)) $(built_plat_mapping_cil_$(BOARD_SEPOLICY_VERS)) \ 851$(built_system_ext_mapping_cil_$(BOARD_SEPOLICY_VERS)) $(built_product_mapping_cil_$(BOARD_SEPOLICY_VERS)) 852$(LOCAL_BUILT_MODULE): PRIVATE_FILTER_CIL := $(built_pub_vers_cil_$(BOARD_SEPOLICY_VERS)) 853$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/build_sepolicy \ 854 $(vendor_policy.conf) $(reqd_policy_mask_$(BOARD_SEPOLICY_VERS).cil) \ 855 $(pub_policy_$(BOARD_SEPOLICY_VERS).cil) $(built_plat_cil_$(BOARD_SEPOLICY_VERS)) \ 856 $(built_system_ext_cil_$(BOARD_SEPOLICY_VERS)) $(built_product_cil_$(BOARD_SEPOLICY_VERS)) \ 857 $(built_pub_vers_cil_$(BOARD_SEPOLICY_VERS)) $(built_plat_mapping_cil_$(BOARD_SEPOLICY_VERS)) \ 858 $(built_system_ext_mapping_cil_$(BOARD_SEPOLICY_VERS)) $(built_product_mapping_cil_$(BOARD_SEPOLICY_VERS)) 859 @mkdir -p $(dir $@) 860 $(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) build_cil \ 861 -i $(PRIVATE_POL_CONF) -m $(PRIVATE_REQD_MASK) -c $(CHECKPOLICY_ASAN_OPTIONS) \ 862 -b $(PRIVATE_BASE_CIL) -d $(PRIVATE_DEP_CIL_FILES) -f $(PRIVATE_FILTER_CIL) \ 863 -t $(PRIVATE_VERS) -p $(POLICYVERS) -o $@ 864 865built_vendor_cil := $(LOCAL_BUILT_MODULE) 866vendor_policy.conf := 867 868################################# 869include $(CLEAR_VARS) 870 871ifdef BOARD_ODM_SEPOLICY_DIRS 872# odm_policy.cil - the odm sepolicy. This needs attributization and to be combined 873# with the platform-provided policy. It makes use of the reqd_policy_mask files from private 874# policy and the platform public policy files in order to use checkpolicy. 875LOCAL_MODULE := odm_sepolicy.cil 876LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered 877LOCAL_LICENSE_CONDITIONS := notice unencumbered 878LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE 879LOCAL_MODULE_CLASS := ETC 880LOCAL_MODULE_TAGS := optional 881LOCAL_PROPRIETARY_MODULE := true 882LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux 883 884include $(BUILD_SYSTEM)/base_rules.mk 885 886# Use either prebuilt policy files or current policy files, depending on BOARD_SEPOLICY_VERS 887policy_files := $(call build_policy, $(sepolicy_build_files), \ 888 $(plat_public_policy_$(BOARD_SEPOLICY_VERS)) $(system_ext_public_policy_$(BOARD_SEPOLICY_VERS)) \ 889 $(product_public_policy_$(BOARD_SEPOLICY_VERS)) $(reqd_policy_$(BOARD_SEPOLICY_VERS)) \ 890 $(BOARD_PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_ODM_SEPOLICY_DIRS)) 891odm_policy.conf := $(intermediates)/odm_policy.conf 892$(odm_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS) 893$(odm_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS) 894$(odm_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT) 895$(odm_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch) 896$(odm_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) 897$(odm_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage) 898$(odm_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) 899$(odm_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT) 900$(odm_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY) 901$(odm_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow) 902$(odm_policy.conf): PRIVATE_ENFORCE_DEBUGFS_RESTRICTION := $(enforce_debugfs_restriction) 903$(odm_policy.conf): PRIVATE_ENFORCE_SYSPROP_OWNER := $(enforce_sysprop_owner) 904$(odm_policy.conf): PRIVATE_POLICY_FILES := $(policy_files) 905$(odm_policy.conf): $(policy_files) $(M4) 906 $(transform-policy-to-conf) 907 $(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit 908 909$(LOCAL_BUILT_MODULE): PRIVATE_POL_CONF := $(odm_policy.conf) 910$(LOCAL_BUILT_MODULE): PRIVATE_REQD_MASK := $(reqd_policy_mask_$(BOARD_SEPOLICY_VERS).cil) 911$(LOCAL_BUILT_MODULE): PRIVATE_BASE_CIL := $(pub_policy_$(BOARD_SEPOLICY_VERS).cil) 912$(LOCAL_BUILT_MODULE): PRIVATE_VERS := $(BOARD_SEPOLICY_VERS) 913$(LOCAL_BUILT_MODULE): PRIVATE_DEP_CIL_FILES := $(built_plat_cil_$(BOARD_SEPOLICY_VERS)) \ 914$(built_system_ext_cil_$(BOARD_SEPOLICY_VERS)) $(built_product_cil_$(BOARD_SEPOLICY_VERS)) \ 915$(built_pub_vers_cil_$(BOARD_SEPOLICY_VERS)) $(built_plat_mapping_cil_$(BOARD_SEPOLICY_VERS)) \ 916$(built_system_ext_mapping_cil_$(BOARD_SEPOLICY_VERS)) $(built_product_mapping_cil_$(BOARD_SEPOLICY_VERS)) \ 917$(built_vendor_cil) 918$(LOCAL_BUILT_MODULE) : PRIVATE_FILTER_CIL_FILES := $(built_pub_vers_cil_$(BOARD_SEPOLICY_VERS)) $(built_vendor_cil) 919$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/build_sepolicy \ 920 $(odm_policy.conf) $(reqd_policy_mask_$(BOARD_SEPOLICY_VERS).cil) \ 921 $(pub_policy_$(BOARD_SEPOLICY_VERS).cil) $(built_plat_cil_$(BOARD_SEPOLICY_VERS)) \ 922 $(built_system_ext_cil_$(BOARD_SEPOLICY_VERS)) $(built_product_cil_$(BOARD_SEPOLICY_VERS)) \ 923 $(built_pub_vers_cil_$(BOARD_SEPOLICY_VERS)) $(built_plat_mapping_cil_$(BOARD_SEPOLICY_VERS)) \ 924 $(built_system_ext_mapping_cil_$(BOARD_SEPOLICY_VERS)) $(built_product_mapping_cil_$(BOARD_SEPOLICY_VERS)) \ 925 $(built_vendor_cil) 926 @mkdir -p $(dir $@) 927 $(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) build_cil \ 928 -i $(PRIVATE_POL_CONF) -m $(PRIVATE_REQD_MASK) -c $(CHECKPOLICY_ASAN_OPTIONS) \ 929 -b $(PRIVATE_BASE_CIL) -d $(PRIVATE_DEP_CIL_FILES) -f $(PRIVATE_FILTER_CIL_FILES) \ 930 -t $(PRIVATE_VERS) -p $(POLICYVERS) -o $@ 931 932built_odm_cil := $(LOCAL_BUILT_MODULE) 933odm_policy.conf := 934odm_policy_raw := 935endif 936 937################################# 938include $(CLEAR_VARS) 939 940LOCAL_MODULE := precompiled_sepolicy 941LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered 942LOCAL_LICENSE_CONDITIONS := notice unencumbered 943LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE 944LOCAL_MODULE_CLASS := ETC 945LOCAL_MODULE_TAGS := optional 946LOCAL_PROPRIETARY_MODULE := true 947 948ifeq ($(BOARD_USES_ODMIMAGE),true) 949LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux 950else 951LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux 952endif 953 954include $(BUILD_SYSTEM)/base_rules.mk 955 956all_cil_files := \ 957 $(built_plat_cil) \ 958 $(TARGET_OUT)/etc/selinux/mapping/$(BOARD_SEPOLICY_VERS).cil \ 959 $(built_pub_vers_cil_$(BOARD_SEPOLICY_VERS)) \ 960 $(built_vendor_cil) 961 962ifdef HAS_SYSTEM_EXT_SEPOLICY 963all_cil_files += $(built_system_ext_cil) 964endif 965 966ifdef HAS_SYSTEM_EXT_PUBLIC_SEPOLICY 967all_cil_files += $(TARGET_OUT_SYSTEM_EXT)/etc/selinux/mapping/$(BOARD_SEPOLICY_VERS).cil 968endif 969 970ifdef HAS_PRODUCT_SEPOLICY 971all_cil_files += $(built_product_cil) 972endif 973 974ifdef HAS_PRODUCT_PUBLIC_SEPOLICY 975all_cil_files += $(TARGET_OUT_PRODUCT)/etc/selinux/mapping/$(BOARD_SEPOLICY_VERS).cil 976endif 977 978ifdef BOARD_ODM_SEPOLICY_DIRS 979all_cil_files += $(built_odm_cil) 980endif 981 982$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(all_cil_files) 983# Neverallow checks are skipped in a mixed build target. 984$(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(if $(filter $(PLATFORM_SEPOLICY_VERSION),$(BOARD_SEPOLICY_VERS)),$(NEVERALLOW_ARG),-N) 985$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(all_cil_files) $(built_sepolicy_neverallows) 986 $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) \ 987 $(PRIVATE_CIL_FILES) -o $@ -f /dev/null 988 989built_precompiled_sepolicy := $(LOCAL_BUILT_MODULE) 990all_cil_files := 991 992################################# 993# Precompiled sepolicy is loaded if and only if: 994# - plat_sepolicy_and_mapping.sha256 equals 995# precompiled_sepolicy.plat_sepolicy_and_mapping.sha256 996# AND 997# - system_ext_sepolicy_and_mapping.sha256 equals 998# precompiled_sepolicy.system_ext_sepolicy_and_mapping.sha256 999# AND 1000# - product_sepolicy_and_mapping.sha256 equals 1001# precompiled_sepolicy.product_sepolicy_and_mapping.sha256 1002# See system/core/init/selinux.cpp for details. 1003################################# 1004 1005################################# 1006include $(CLEAR_VARS) 1007# build this target so that we can still perform neverallow checks 1008 1009LOCAL_MODULE := sepolicy 1010LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered 1011LOCAL_LICENSE_CONDITIONS := notice unencumbered 1012LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE 1013LOCAL_MODULE_CLASS := ETC 1014LOCAL_MODULE_TAGS := optional 1015LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT) 1016 1017include $(BUILD_SYSTEM)/base_rules.mk 1018 1019all_cil_files := \ 1020 $(built_plat_cil) \ 1021 $(TARGET_OUT)/etc/selinux/mapping/$(BOARD_SEPOLICY_VERS).cil \ 1022 $(built_pub_vers_cil_$(BOARD_SEPOLICY_VERS)) \ 1023 $(built_vendor_cil) 1024 1025ifdef HAS_SYSTEM_EXT_SEPOLICY 1026all_cil_files += $(built_system_ext_cil) 1027endif 1028 1029ifdef HAS_SYSTEM_EXT_PUBLIC_SEPOLICY 1030all_cil_files += $(TARGET_OUT_SYSTEM_EXT)/etc/selinux/mapping/$(BOARD_SEPOLICY_VERS).cil 1031endif 1032 1033ifdef HAS_PRODUCT_SEPOLICY 1034all_cil_files += $(built_product_cil) 1035endif 1036 1037ifdef HAS_PRODUCT_PUBLIC_SEPOLICY 1038all_cil_files += $(TARGET_OUT_PRODUCT)/etc/selinux/mapping/$(BOARD_SEPOLICY_VERS).cil 1039endif 1040 1041ifdef BOARD_ODM_SEPOLICY_DIRS 1042all_cil_files += $(built_odm_cil) 1043endif 1044 1045$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(all_cil_files) 1046# Neverallow checks are skipped in a mixed build target. 1047$(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(if $(filter $(PLATFORM_SEPOLICY_VERSION),$(BOARD_SEPOLICY_VERS)),$(NEVERALLOW_ARG),-N) 1048$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $(all_cil_files) \ 1049$(built_sepolicy_neverallows) 1050 @mkdir -p $(dir $@) 1051 $(hide) $< -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $(PRIVATE_CIL_FILES) -o $@.tmp -f /dev/null 1052 $(hide) $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $@.tmp permissive > $@.permissivedomains 1053 $(hide) if [ "$(TARGET_BUILD_VARIANT)" = "user" -a -s $@.permissivedomains ]; then \ 1054 echo "==========" 1>&2; \ 1055 echo "ERROR: permissive domains not allowed in user builds" 1>&2; \ 1056 echo "List of invalid domains:" 1>&2; \ 1057 cat $@.permissivedomains 1>&2; \ 1058 exit 1; \ 1059 fi 1060 $(hide) mv $@.tmp $@ 1061 1062built_sepolicy := $(LOCAL_BUILT_MODULE) 1063all_cil_files := 1064 1065################################# 1066include $(CLEAR_VARS) 1067 1068# keep concrete sepolicy for neverallow checks 1069# If SELINUX_IGNORE_NEVERALLOWS is set, we use sed to remove the neverallow lines before compiling. 1070 1071LOCAL_MODULE := sepolicy.recovery 1072LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered 1073LOCAL_LICENSE_CONDITIONS := notice unencumbered 1074LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE 1075LOCAL_MODULE_STEM := sepolicy 1076LOCAL_MODULE_CLASS := ETC 1077LOCAL_MODULE_TAGS := optional 1078LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT) 1079 1080include $(BUILD_SYSTEM)/base_rules.mk 1081 1082# We use vendor version's policy files because recovery partition is vendor-owned. 1083policy_files := $(call build_policy, $(sepolicy_build_files), \ 1084 $(plat_public_policy_$(BOARD_SEPOLICY_VERS)) $(plat_private_policy_$(BOARD_SEPOLICY_VERS)) \ 1085 $(system_ext_public_policy_$(BOARD_SEPOLICY_VERS)) $(system_ext_private_policy_$(BOARD_SEPOLICY_VERS)) \ 1086 $(product_public_policy_$(BOARD_SEPOLICY_VERS)) $(product_private_policy_$(BOARD_SEPOLICY_VERS)) \ 1087 $(BOARD_PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_ODM_SEPOLICY_DIRS)) 1088sepolicy.recovery.conf := $(intermediates)/sepolicy.recovery.conf 1089$(sepolicy.recovery.conf): PRIVATE_MLS_SENS := $(MLS_SENS) 1090$(sepolicy.recovery.conf): PRIVATE_MLS_CATS := $(MLS_CATS) 1091$(sepolicy.recovery.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT) 1092$(sepolicy.recovery.conf): PRIVATE_TGT_ARCH := $(my_target_arch) 1093$(sepolicy.recovery.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) 1094$(sepolicy.recovery.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage) 1095$(sepolicy.recovery.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) 1096$(sepolicy.recovery.conf): PRIVATE_TGT_RECOVERY := -D target_recovery=true 1097$(sepolicy.recovery.conf): PRIVATE_ENFORCE_DEBUGFS_RESTRICTION := $(enforce_debugfs_restriction) 1098$(sepolicy.recovery.conf): PRIVATE_POLICY_FILES := $(policy_files) 1099$(sepolicy.recovery.conf): $(policy_files) $(M4) 1100 $(transform-policy-to-conf) 1101 $(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit 1102 1103ifeq ($(SELINUX_IGNORE_NEVERALLOWS),true) 1104 $(hide) sed -z 's/\n\s*neverallow[^;]*;/\n/g' $@ > $@.neverallow 1105 $(hide) mv $@.neverallow $@ 1106endif 1107 1108$(LOCAL_BUILT_MODULE): $(sepolicy.recovery.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \ 1109 $(HOST_OUT_EXECUTABLES)/sepolicy-analyze 1110 @mkdir -p $(dir $@) 1111 $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c \ 1112 $(POLICYVERS) -o $@.tmp $< 1113 $(hide) $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $@.tmp permissive > $@.permissivedomains 1114 $(hide) if [ "$(TARGET_BUILD_VARIANT)" = "user" -a -s $@.permissivedomains ]; then \ 1115 echo "==========" 1>&2; \ 1116 echo "ERROR: permissive domains not allowed in user builds" 1>&2; \ 1117 echo "List of invalid domains:" 1>&2; \ 1118 cat $@.permissivedomains 1>&2; \ 1119 exit 1; \ 1120 fi 1121 $(hide) mv $@.tmp $@ 1122 1123sepolicy.recovery.conf := 1124 1125################################## 1126# TODO - remove this. Keep around until we get the filesystem creation stuff taken care of. 1127# 1128include $(CLEAR_VARS) 1129 1130LOCAL_MODULE := file_contexts.bin 1131LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered 1132LOCAL_LICENSE_CONDITIONS := notice unencumbered 1133LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE 1134LOCAL_MODULE_CLASS := ETC 1135LOCAL_MODULE_TAGS := optional 1136LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT) 1137 1138include $(BUILD_SYSTEM)/base_rules.mk 1139 1140# The file_contexts.bin is built in the following way: 1141# 1. Collect all file_contexts files in THIS repository and process them with 1142# m4 into a tmp file called file_contexts.local.tmp. 1143# 2. Collect all file_contexts files from LOCAL_FILE_CONTEXTS of installed 1144# modules with m4 with a tmp file called file_contexts.modules.tmp. 1145# 3. Collect all device specific file_contexts files and process them with m4 1146# into a tmp file called file_contexts.device.tmp. 1147# 4. Run checkfc -e (allow no device fc entries ie empty) and fc_sort on 1148# file_contexts.device.tmp and output to file_contexts.device.sorted.tmp. 1149# 5. Concatenate file_contexts.local.tmp, file_contexts.modules.tmp and 1150# file_contexts.device.sorted.tmp into file_contexts.concat.tmp. 1151# 6. Run checkfc and sefcontext_compile on file_contexts.concat.tmp to produce 1152# file_contexts.bin. 1153# 1154# Note: That a newline file is placed between each file_context file found to 1155# ensure a proper build when an fc file is missing an ending newline. 1156 1157local_fc_files := $(call build_policy, file_contexts, $(PLAT_PRIVATE_POLICY)) 1158 1159ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR 1160local_fc_files += $(call build_policy, file_contexts, $(SYSTEM_EXT_PRIVATE_POLICY)) 1161endif 1162 1163ifdef HAS_PRODUCT_SEPOLICY_DIR 1164local_fc_files += $(call build_policy, file_contexts, $(PRODUCT_PRIVATE_POLICY)) 1165endif 1166 1167ifneq ($(filter address,$(SANITIZE_TARGET)),) 1168 local_fc_files += $(wildcard $(addsuffix /file_contexts_asan, $(PLAT_PRIVATE_POLICY))) 1169endif 1170ifneq (,$(filter userdebug eng,$(TARGET_BUILD_VARIANT))) 1171 local_fc_files += $(wildcard $(addsuffix /file_contexts_overlayfs, $(PLAT_PRIVATE_POLICY))) 1172endif 1173 1174file_contexts.local.tmp := $(intermediates)/file_contexts.local.tmp 1175$(call merge-fc-files,$(local_fc_files),$(file_contexts.local.tmp)) 1176 1177# The rule for file_contexts.modules.tmp is defined in build/make/core/Makefile. 1178# it gathers LOCAL_FILE_CONTEXTS from product_MODULES 1179file_contexts.modules.tmp := $(intermediates)/file_contexts.modules.tmp 1180 1181device_fc_files := $(call build_vendor_policy, file_contexts) 1182 1183ifdef BOARD_ODM_SEPOLICY_DIRS 1184device_fc_files += $(call build_odm_policy, file_contexts) 1185endif 1186 1187file_contexts.device.tmp := $(intermediates)/file_contexts.device.tmp 1188$(file_contexts.device.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) 1189$(file_contexts.device.tmp): PRIVATE_DEVICE_FC_FILES := $(device_fc_files) 1190$(file_contexts.device.tmp): $(device_fc_files) $(M4) 1191 @mkdir -p $(dir $@) 1192 $(hide) $(M4) --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_DEVICE_FC_FILES) > $@ 1193 1194file_contexts.device.sorted.tmp := $(intermediates)/file_contexts.device.sorted.tmp 1195$(file_contexts.device.sorted.tmp): PRIVATE_SEPOLICY := $(built_sepolicy) 1196$(file_contexts.device.sorted.tmp): $(file_contexts.device.tmp) $(built_sepolicy) \ 1197 $(HOST_OUT_EXECUTABLES)/fc_sort $(HOST_OUT_EXECUTABLES)/checkfc 1198 @mkdir -p $(dir $@) 1199 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e $(PRIVATE_SEPOLICY) $< 1200 $(hide) $(HOST_OUT_EXECUTABLES)/fc_sort -i $< -o $@ 1201 1202file_contexts.concat.tmp := $(intermediates)/file_contexts.concat.tmp 1203$(call merge-fc-files,\ 1204 $(file_contexts.local.tmp) $(file_contexts.modules.tmp) $(file_contexts.device.sorted.tmp),\ 1205 $(file_contexts.concat.tmp)) 1206 1207$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) 1208$(LOCAL_BUILT_MODULE): $(file_contexts.concat.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/sefcontext_compile $(HOST_OUT_EXECUTABLES)/checkfc 1209 @mkdir -p $(dir $@) 1210 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc $(PRIVATE_SEPOLICY) $< 1211 $(hide) $(HOST_OUT_EXECUTABLES)/sefcontext_compile -o $@ $< 1212 1213built_fc := $(LOCAL_BUILT_MODULE) 1214local_fc_files := 1215local_fcfiles_with_nl := 1216device_fc_files := 1217device_fcfiles_with_nl := 1218file_contexts.concat.tmp := 1219file_contexts.device.sorted.tmp := 1220file_contexts.device.tmp := 1221file_contexts.local.tmp := 1222file_contexts.modules.tmp := 1223 1224################################## 1225include $(CLEAR_VARS) 1226 1227LOCAL_MODULE := selinux_denial_metadata 1228LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered 1229LOCAL_LICENSE_CONDITIONS := notice unencumbered 1230LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE 1231LOCAL_MODULE_CLASS := ETC 1232LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux 1233 1234include $(BUILD_SYSTEM)/base_rules.mk 1235 1236bug_files := $(call build_policy, bug_map, $(LOCAL_PATH) $(PLAT_PRIVATE_POLICY) $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(PLAT_PUBLIC_POLICY)) 1237 1238$(LOCAL_BUILT_MODULE) : $(bug_files) 1239 @mkdir -p $(dir $@) 1240 cat $^ > $@ 1241 1242bug_files := 1243 1244################################## 1245include $(LOCAL_PATH)/seapp_contexts.mk 1246 1247################################## 1248include $(LOCAL_PATH)/contexts_tests.mk 1249 1250################################## 1251include $(CLEAR_VARS) 1252 1253LOCAL_MODULE := vndservice_contexts 1254LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered 1255LOCAL_LICENSE_CONDITIONS := notice unencumbered 1256LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE 1257LOCAL_MODULE_CLASS := ETC 1258LOCAL_MODULE_TAGS := optional 1259LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux 1260 1261include $(BUILD_SYSTEM)/base_rules.mk 1262 1263vnd_svcfiles := $(call build_policy, vndservice_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY)) 1264 1265vndservice_contexts.tmp := $(intermediates)/vndservice_contexts.tmp 1266$(vndservice_contexts.tmp): PRIVATE_SVC_FILES := $(vnd_svcfiles) 1267$(vndservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) 1268$(vndservice_contexts.tmp): $(vnd_svcfiles) $(M4) 1269 @mkdir -p $(dir $@) 1270 $(hide) $(M4) --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@ 1271 1272$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) 1273$(LOCAL_BUILT_MODULE): $(vndservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP) 1274 @mkdir -p $(dir $@) 1275 sed -e 's/#.*$$//' -e '/^$$/d' $< > $@ 1276 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e -v $(PRIVATE_SEPOLICY) $@ 1277 1278vnd_svcfiles := 1279vndservice_contexts.tmp := 1280 1281################################## 1282include $(LOCAL_PATH)/mac_permissions.mk 1283 1284################################# 1285include $(CLEAR_VARS) 1286LOCAL_MODULE := sepolicy_tests 1287LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered 1288LOCAL_LICENSE_CONDITIONS := notice unencumbered 1289LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE 1290LOCAL_MODULE_CLASS := FAKE 1291LOCAL_MODULE_TAGS := optional 1292 1293include $(BUILD_SYSTEM)/base_rules.mk 1294 1295all_fc_files := $(TARGET_OUT)/etc/selinux/plat_file_contexts 1296all_fc_files += $(TARGET_OUT_VENDOR)/etc/selinux/vendor_file_contexts 1297ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR 1298all_fc_files += $(TARGET_OUT_SYSTEM_EXT)/etc/selinux/system_ext_file_contexts 1299endif 1300ifdef HAS_PRODUCT_SEPOLICY_DIR 1301all_fc_files += $(TARGET_OUT_PRODUCT)/etc/selinux/product_file_contexts 1302endif 1303ifdef BOARD_ODM_SEPOLICY_DIRS 1304all_fc_files += $(TARGET_OUT_ODM)/etc/selinux/odm_file_contexts 1305endif 1306all_fc_args := $(foreach file, $(all_fc_files), -f $(file)) 1307 1308$(LOCAL_BUILT_MODULE): ALL_FC_ARGS := $(all_fc_args) 1309$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) 1310$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/sepolicy_tests $(all_fc_files) $(built_sepolicy) 1311 @mkdir -p $(dir $@) 1312 $(hide) $(HOST_OUT_EXECUTABLES)/sepolicy_tests -l $(HOST_OUT)/lib64/libsepolwrap.$(SHAREDLIB_EXT) \ 1313 $(ALL_FC_ARGS) -p $(PRIVATE_SEPOLICY) 1314 $(hide) touch $@ 1315 1316################################## 1317intermediates := $(call intermediates-dir-for,ETC,built_plat_sepolicy,,,,) 1318 1319# plat_sepolicy - the current platform policy only, built into a policy binary. 1320# TODO - this currently excludes partner extensions, but support should be added 1321# to enable partners to add their own compatibility mapping 1322policy_files := $(call build_policy, $(sepolicy_build_files), \ 1323 $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY)) 1324base_plat_policy.conf := $(intermediates)/base_plat_policy.conf 1325$(base_plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS) 1326$(base_plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS) 1327$(base_plat_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := user 1328$(base_plat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch) 1329$(base_plat_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) 1330$(base_plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) 1331$(base_plat_policy.conf): PRIVATE_SEPOLICY_SPLIT := true 1332$(base_plat_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY) 1333$(base_plat_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow) 1334$(base_plat_policy.conf): PRIVATE_ENFORCE_SYSPROP_OWNER := $(enforce_sysprop_owner) 1335$(base_plat_policy.conf): PRIVATE_ENFORCE_DEBUGFS_RESTRICTION := $(enforce_debugfs_restriction) 1336$(base_plat_policy.conf): PRIVATE_POLICY_FILES := $(policy_files) 1337$(base_plat_policy.conf): $(policy_files) $(M4) 1338 $(transform-policy-to-conf) 1339 $(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit 1340 1341built_plat_sepolicy := $(intermediates)/built_plat_sepolicy 1342$(built_plat_sepolicy): PRIVATE_ADDITIONAL_CIL_FILES := \ 1343 $(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY)) 1344$(built_plat_sepolicy): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG) 1345$(built_plat_sepolicy): $(base_plat_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \ 1346$(HOST_OUT_EXECUTABLES)/secilc \ 1347$(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY)) \ 1348$(built_sepolicy_neverallows) 1349 @mkdir -p $(dir $@) 1350 $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \ 1351 $(POLICYVERS) -o $@ $< 1352 $(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@ 1353 $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $@ -o $@ -f /dev/null 1354 1355policy_files := $(call build_policy, $(sepolicy_build_files), \ 1356 $(PLAT_PUBLIC_POLICY) $(REQD_MASK_POLICY)) 1357base_plat_pub_policy.conf := $(intermediates)/base_plat_pub_policy.conf 1358$(base_plat_pub_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS) 1359$(base_plat_pub_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS) 1360$(base_plat_pub_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := user 1361$(base_plat_pub_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch) 1362$(base_plat_pub_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) 1363$(base_plat_pub_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) 1364$(base_plat_pub_policy.conf): PRIVATE_SEPOLICY_SPLIT := true 1365$(base_plat_pub_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY) 1366$(base_plat_pub_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow) 1367$(base_plat_pub_policy.conf): PRIVATE_ENFORCE_SYSPROP_OWNER := $(enforce_sysprop_owner) 1368$(base_plat_pub_policy.conf): PRIVATE_ENFORCE_DEBUGFS_RESTRICTION := $(enforce_debugfs_restriction) 1369$(base_plat_pub_policy.conf): PRIVATE_POLICY_FILES := $(policy_files) 1370$(base_plat_pub_policy.conf): $(policy_files) $(M4) 1371 $(transform-policy-to-conf) 1372 1373base_plat_pub_policy.cil := $(intermediates)/base_plat_pub_policy.cil 1374$(base_plat_pub_policy.cil): PRIVATE_POL_CONF := $(base_plat_pub_policy.conf) 1375$(base_plat_pub_policy.cil): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil) 1376$(base_plat_pub_policy.cil): $(HOST_OUT_EXECUTABLES)/checkpolicy \ 1377$(HOST_OUT_EXECUTABLES)/build_sepolicy $(base_plat_pub_policy.conf) $(reqd_policy_mask.cil) 1378 @mkdir -p $(dir $@) 1379 $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $< -C -M -c $(POLICYVERS) -o $@ $(PRIVATE_POL_CONF) 1380 $(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) filter_out \ 1381 -f $(PRIVATE_REQD_MASK) -t $@ 1382 1383 1384##################################################### 1385intermediates := $(call intermediates-dir-for,ETC,built_system_ext_sepolicy,,,,) 1386 1387policy_files := $(call build_policy, $(sepolicy_build_files), \ 1388 $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) $(SYSTEM_EXT_PUBLIC_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY)) 1389base_system_ext_policy.conf := $(intermediates)/base_system_ext_policy.conf 1390$(base_system_ext_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS) 1391$(base_system_ext_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS) 1392$(base_system_ext_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := user 1393$(base_system_ext_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch) 1394$(base_system_ext_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) 1395$(base_system_ext_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) 1396$(base_system_ext_policy.conf): PRIVATE_SEPOLICY_SPLIT := true 1397$(base_system_ext_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY) 1398$(base_system_ext_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow) 1399$(base_system_ext_policy.conf): PRIVATE_POLICY_FILES := $(policy_files) 1400$(base_system_ext_policy.conf): $(policy_files) $(M4) 1401 $(transform-policy-to-conf) 1402 $(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit 1403 1404built_system_ext_sepolicy := $(intermediates)/built_system_ext_sepolicy 1405$(built_system_ext_sepolicy): PRIVATE_ADDITIONAL_CIL_FILES := \ 1406 $(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY)) 1407$(built_system_ext_sepolicy): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG) 1408$(built_system_ext_sepolicy): $(base_system_ext_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \ 1409$(HOST_OUT_EXECUTABLES)/secilc \ 1410$(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY)) \ 1411$(built_sepolicy_neverallows) 1412 @mkdir -p $(dir $@) 1413 $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \ 1414 $(POLICYVERS) -o $@ $< 1415 $(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@ 1416 $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $@ -o $@ -f /dev/null 1417 1418policy_files := $(call build_policy, $(sepolicy_build_files), \ 1419$(PLAT_PUBLIC_POLICY) $(SYSTEM_EXT_PUBLIC_POLICY) $(REQD_MASK_POLICY)) 1420base_system_ext_pub_policy.conf := $(intermediates)/base_system_ext_pub_policy.conf 1421$(base_system_ext_pub_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS) 1422$(base_system_ext_pub_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS) 1423$(base_system_ext_pub_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := user 1424$(base_system_ext_pub_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch) 1425$(base_system_ext_pub_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) 1426$(base_system_ext_pub_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) 1427$(base_system_ext_pub_policy.conf): PRIVATE_SEPOLICY_SPLIT := true 1428$(base_system_ext_pub_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY) 1429$(base_system_ext_pub_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow) 1430$(base_system_ext_pub_policy.conf): PRIVATE_POLICY_FILES := $(policy_files) 1431$(base_system_ext_pub_policy.conf): $(policy_files) $(M4) 1432 $(transform-policy-to-conf) 1433 1434base_system_ext_pub_policy.cil := $(intermediates)/base_system_ext_pub_policy.cil 1435$(base_system_ext_pub_policy.cil): PRIVATE_POL_CONF := $(base_system_ext_pub_policy.conf) 1436$(base_system_ext_pub_policy.cil): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil) 1437$(base_system_ext_pub_policy.cil): $(HOST_OUT_EXECUTABLES)/checkpolicy \ 1438$(HOST_OUT_EXECUTABLES)/build_sepolicy $(base_system_ext_pub_policy.conf) $(reqd_policy_mask.cil) 1439 @mkdir -p $(dir $@) 1440 $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $< -C -M -c $(POLICYVERS) -o $@ $(PRIVATE_POL_CONF) 1441 $(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) filter_out \ 1442 -f $(PRIVATE_REQD_MASK) -t $@ 1443 1444 1445################################################################################ 1446intermediates := $(call intermediates-dir-for,ETC,built_product_sepolicy,,,,) 1447 1448policy_files := $(call build_policy, $(sepolicy_build_files), \ 1449 $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) $(SYSTEM_EXT_PUBLIC_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY) \ 1450 $(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY)) 1451base_product_policy.conf := $(intermediates)/base_product_policy.conf 1452$(base_product_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS) 1453$(base_product_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS) 1454$(base_product_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := user 1455$(base_product_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch) 1456$(base_product_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) 1457$(base_product_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) 1458$(base_product_policy.conf): PRIVATE_SEPOLICY_SPLIT := true 1459$(base_product_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY) 1460$(base_product_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow) 1461$(base_product_policy.conf): PRIVATE_POLICY_FILES := $(policy_files) 1462$(base_product_policy.conf): $(policy_files) $(M4) 1463 $(transform-policy-to-conf) 1464 $(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit 1465 1466built_product_sepolicy := $(intermediates)/built_product_sepolicy 1467$(built_product_sepolicy): PRIVATE_ADDITIONAL_CIL_FILES := \ 1468 $(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY)) 1469$(built_product_sepolicy): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG) 1470$(built_product_sepolicy): $(base_product_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \ 1471$(HOST_OUT_EXECUTABLES)/secilc \ 1472$(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY)) \ 1473$(built_sepolicy_neverallows) 1474 @mkdir -p $(dir $@) 1475 $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \ 1476 $(POLICYVERS) -o $@ $< 1477 $(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@ 1478 $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $@ -o $@ -f /dev/null 1479 1480 1481policy_files := $(call build_policy, $(sepolicy_build_files), \ 1482$(PLAT_PUBLIC_POLICY) $(SYSTEM_EXT_PUBLIC_POLICY) $(PRODUCT_PUBLIC_POLICY) $(REQD_MASK_POLICY)) 1483base_product_pub_policy.conf := $(intermediates)/base_product_pub_policy.conf 1484$(base_product_pub_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS) 1485$(base_product_pub_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS) 1486$(base_product_pub_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := user 1487$(base_product_pub_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch) 1488$(base_product_pub_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) 1489$(base_product_pub_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) 1490$(base_product_pub_policy.conf): PRIVATE_SEPOLICY_SPLIT := true 1491$(base_product_pub_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY) 1492$(base_product_pub_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow) 1493$(base_product_pub_policy.conf): PRIVATE_POLICY_FILES := $(policy_files) 1494$(base_product_pub_policy.conf): $(policy_files) $(M4) 1495 $(transform-policy-to-conf) 1496 1497base_product_pub_policy.cil := $(intermediates)/base_product_pub_policy.cil 1498$(base_product_pub_policy.cil): PRIVATE_POL_CONF := $(base_product_pub_policy.conf) 1499$(base_product_pub_policy.cil): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil) 1500$(base_product_pub_policy.cil): $(HOST_OUT_EXECUTABLES)/checkpolicy \ 1501$(HOST_OUT_EXECUTABLES)/build_sepolicy $(base_product_pub_policy.conf) $(reqd_policy_mask.cil) 1502 @mkdir -p $(dir $@) 1503 $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $< -C -M -c $(POLICYVERS) -o $@ $(PRIVATE_POL_CONF) 1504 $(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) filter_out \ 1505 -f $(PRIVATE_REQD_MASK) -t $@ 1506 1507ifeq ($(PRODUCT_SEPOLICY_SPLIT),true) 1508# Tests for Treble compatibility of current platform policy and vendor policy of 1509# given release version. 1510version_under_treble_tests := 26.0 1511include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk 1512version_under_treble_tests := 27.0 1513include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk 1514version_under_treble_tests := 28.0 1515include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk 1516version_under_treble_tests := 29.0 1517include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk 1518version_under_treble_tests := 30.0 1519include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk 1520endif # PRODUCT_SEPOLICY_SPLIT 1521 1522version_under_treble_tests := 26.0 1523include $(LOCAL_PATH)/compat.mk 1524version_under_treble_tests := 27.0 1525include $(LOCAL_PATH)/compat.mk 1526version_under_treble_tests := 28.0 1527include $(LOCAL_PATH)/compat.mk 1528version_under_treble_tests := 29.0 1529include $(LOCAL_PATH)/compat.mk 1530version_under_treble_tests := 30.0 1531include $(LOCAL_PATH)/compat.mk 1532 1533base_plat_policy.conf := 1534base_plat_pub_policy.conf := 1535plat_sepolicy := 1536all_fc_files := 1537all_fc_args := 1538 1539################################# 1540include $(CLEAR_VARS) 1541LOCAL_MODULE := sepolicy_freeze_test 1542LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered 1543LOCAL_LICENSE_CONDITIONS := notice unencumbered 1544LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE 1545LOCAL_MODULE_CLASS := FAKE 1546LOCAL_MODULE_TAGS := optional 1547 1548include $(BUILD_SYSTEM)/base_rules.mk 1549 1550define ziplist 1551$(if $(and $1,$2), "$(firstword $1) $(firstword $2)"\ 1552 $(call ziplist,$(wordlist 2,$(words $1),$1),$(wordlist 2,$(words $2),$2))) 1553endef 1554 1555base_plat_public := $(LOCAL_PATH)/public 1556base_plat_private := $(LOCAL_PATH)/private 1557base_plat_public_prebuilt := \ 1558 $(LOCAL_PATH)/prebuilts/api/$(PLATFORM_SEPOLICY_VERSION)/public 1559base_plat_private_prebuilt := \ 1560 $(LOCAL_PATH)/prebuilts/api/$(PLATFORM_SEPOLICY_VERSION)/private 1561 1562all_frozen_files := $(call build_policy,$(sepolicy_build_files), \ 1563$(base_plat_public) $(base_plat_private) $(base_plat_public_prebuilt) $(base_plat_private_prebuilt)) 1564 1565$(LOCAL_BUILT_MODULE): PRIVATE_BASE_PLAT_PUBLIC := $(base_plat_public) 1566$(LOCAL_BUILT_MODULE): PRIVATE_BASE_PLAT_PRIVATE := $(base_plat_private) 1567$(LOCAL_BUILT_MODULE): PRIVATE_BASE_PLAT_PUBLIC_PREBUILT := $(base_plat_public_prebuilt) 1568$(LOCAL_BUILT_MODULE): PRIVATE_BASE_PLAT_PRIVATE_PREBUILT := $(base_plat_private_prebuilt) 1569$(LOCAL_BUILT_MODULE): PRIVATE_EXTRA := $(sort $(FREEZE_TEST_EXTRA_DIRS)) 1570$(LOCAL_BUILT_MODULE): PRIVATE_EXTRA_PREBUILT := $(sort $(FREEZE_TEST_EXTRA_PREBUILT_DIRS)) 1571$(LOCAL_BUILT_MODULE): $(all_frozen_files) 1572ifneq ($(PLATFORM_SEPOLICY_VERSION),$(TOT_SEPOLICY_VERSION)) 1573 @diff -rq -x bug_map $(PRIVATE_BASE_PLAT_PUBLIC_PREBUILT) $(PRIVATE_BASE_PLAT_PUBLIC) 1574 @diff -rq -x bug_map $(PRIVATE_BASE_PLAT_PRIVATE_PREBUILT) $(PRIVATE_BASE_PLAT_PRIVATE) 1575ifneq (,$(FREEZE_TEST_EXTRA_DIRS)$(FREEZE_TEST_EXTRA_PREBUILT_DIRS)) 1576 @for pair in $(call ziplist, $(PRIVATE_EXTRA_PREBUILT), $(PRIVATE_EXTRA)); \ 1577 do diff -rq -x bug_map $$pair; done 1578endif # (,$(FREEZE_TEST_EXTRA_DIRS)$(FREEZE_TEST_EXTRA_PREBUILT_DIRS)) 1579endif # ($(PLATFORM_SEPOLICY_VERSION),$(TOT_SEPOLICY_VERSION)) 1580 $(hide) touch $@ 1581 1582base_plat_public := 1583base_plat_private := 1584base_plat_public_prebuilt := 1585base_plat_private_prebuilt := 1586all_frozen_files := 1587 1588################################# 1589 1590 1591build_vendor_policy := 1592build_odm_policy := 1593build_policy := 1594built_plat_cil := 1595built_system_ext_cil := 1596built_product_cil := 1597built_pub_vers_cil := 1598built_plat_mapping_cil := 1599built_system_ext_mapping_cil := 1600built_product_mapping_cil := 1601built_vendor_cil := 1602built_odm_cil := 1603built_precompiled_sepolicy := 1604built_sepolicy := 1605built_sepolicy_neverallows := 1606built_plat_svc := 1607built_vendor_svc := 1608built_plat_sepolicy := 1609treble_sysprop_neverallow := 1610enforce_sysprop_owner := 1611enforce_debugfs_restriction := 1612mapping_policy := 1613my_target_arch := 1614pub_policy.cil := 1615system_ext_pub_policy.cil := 1616plat_pub_policy.cil := 1617reqd_policy_mask.cil := 1618sepolicy_build_files := 1619sepolicy_build_cil_workaround_files := 1620with_asan := 1621 1622include $(call all-makefiles-under,$(LOCAL_PATH)) 1623