12dd4e51d5c2a2dfc0bfdee9303269f5a665f6e3Stephen SmalleyLOCAL_PATH:= $(call my-dir) 2f0e0a94e032e55c13bc54f1cffe243f04872278eWilliam Roberts 36f14f6b7d957d4001160438882fb5cb7b09e399eDan Cashman# PLATFORM_SEPOLICY_VERSION is a number of the form "NN.m" with "NN" mapping to 46f14f6b7d957d4001160438882fb5cb7b09e399eDan Cashman# PLATFORM_SDK_VERSION and "m" as a minor number which allows for SELinux 56f14f6b7d957d4001160438882fb5cb7b09e399eDan Cashman# changes independent of PLATFORM_SDK_VERSION. This value will be set to 66f14f6b7d957d4001160438882fb5cb7b09e399eDan Cashman# 10000.0 to represent tip-of-tree development that is inherently unstable and 76f14f6b7d957d4001160438882fb5cb7b09e399eDan Cashman# thus designed not to work with any shipping vendor policy. This is similar in 86f14f6b7d957d4001160438882fb5cb7b09e399eDan Cashman# spirit to how DEFAULT_APP_TARGET_SDK is set. 96f14f6b7d957d4001160438882fb5cb7b09e399eDan Cashman# The minor version ('m' component) must be updated every time a platform release 106f14f6b7d957d4001160438882fb5cb7b09e399eDan Cashman# is made which breaks compatibility with the previous platform sepolicy version, 116f14f6b7d957d4001160438882fb5cb7b09e399eDan Cashman# not just on every increase in PLATFORM_SDK_VERSION. The minor version should 126f14f6b7d957d4001160438882fb5cb7b09e399eDan Cashman# be reset to 0 on every bump of the PLATFORM_SDK_VERSION. 134816b8f00a129d0245d369fe34ac88dd82e566c6Ian Pedowitzsepolicy_major_vers := 26 146f14f6b7d957d4001160438882fb5cb7b09e399eDan Cashmansepolicy_minor_vers := 0 156f14f6b7d957d4001160438882fb5cb7b09e399eDan Cashman 166f14f6b7d957d4001160438882fb5cb7b09e399eDan Cashmanifneq ($(sepolicy_major_vers), $(PLATFORM_SDK_VERSION)) 176f14f6b7d957d4001160438882fb5cb7b09e399eDan Cashman$(error sepolicy_major_version does not match PLATFORM_SDK_VERSION, please update.) 186f14f6b7d957d4001160438882fb5cb7b09e399eDan Cashmanendif 196f14f6b7d957d4001160438882fb5cb7b09e399eDan Cashmanifneq (REL,$(PLATFORM_VERSION_CODENAME)) 206f14f6b7d957d4001160438882fb5cb7b09e399eDan Cashman sepolicy_major_vers := 10000 216f14f6b7d957d4001160438882fb5cb7b09e399eDan Cashman sepolicy_minor_vers := 0 226f14f6b7d957d4001160438882fb5cb7b09e399eDan Cashmanendif 236f14f6b7d957d4001160438882fb5cb7b09e399eDan CashmanPLATFORM_SEPOLICY_VERSION := $(join $(addsuffix .,$(sepolicy_major_vers)), $(sepolicy_minor_vers)) 246f14f6b7d957d4001160438882fb5cb7b09e399eDan Cashmansepolicy_major_vers := 256f14f6b7d957d4001160438882fb5cb7b09e399eDan Cashmansepolicy_minor_vers := 266f14f6b7d957d4001160438882fb5cb7b09e399eDan Cashman 272dd4e51d5c2a2dfc0bfdee9303269f5a665f6e3Stephen Smalleyinclude $(CLEAR_VARS) 282dd4e51d5c2a2dfc0bfdee9303269f5a665f6e3Stephen Smalley# SELinux policy version. 29b4f17069b3514a4b7b3f5c42e879494bbe96bbafStephen Smalley# Must be <= /sys/fs/selinux/policyvers reported by the Android kernel. 302dd4e51d5c2a2dfc0bfdee9303269f5a665f6e3Stephen Smalley# Must be within the compatibility range reported by checkpolicy -V. 313a0ce49b8623299ac7458306b30bda6adda12383Jeff Vander StoepPOLICYVERS ?= 30 322dd4e51d5c2a2dfc0bfdee9303269f5a665f6e3Stephen Smalley 332dd4e51d5c2a2dfc0bfdee9303269f5a665f6e3Stephen SmalleyMLS_SENS=1 342dd4e51d5c2a2dfc0bfdee9303269f5a665f6e3Stephen SmalleyMLS_CATS=1024 352dd4e51d5c2a2dfc0bfdee9303269f5a665f6e3Stephen Smalley 36b4f17069b3514a4b7b3f5c42e879494bbe96bbafStephen Smalleyifdef BOARD_SEPOLICY_REPLACE 37b4f17069b3514a4b7b3f5c42e879494bbe96bbafStephen Smalley$(error BOARD_SEPOLICY_REPLACE is no longer supported; please remove from your BoardConfig.mk or other .mk file.) 38b4f17069b3514a4b7b3f5c42e879494bbe96bbafStephen Smalleyendif 39b4f17069b3514a4b7b3f5c42e879494bbe96bbafStephen Smalley 40b4f17069b3514a4b7b3f5c42e879494bbe96bbafStephen Smalleyifdef BOARD_SEPOLICY_IGNORE 41b4f17069b3514a4b7b3f5c42e879494bbe96bbafStephen Smalley$(error BOARD_SEPOLICY_IGNORE is no longer supported; please remove from your BoardConfig.mk or other .mk file.) 42b4f17069b3514a4b7b3f5c42e879494bbe96bbafStephen Smalleyendif 4347cd396b11ca4b62d4d99902bec1b981760e818arpcraig 448e0ca8867eac09f8fd740485f147684d6a88b803Stephen Smalleyifdef BOARD_SEPOLICY_UNION 458e0ca8867eac09f8fd740485f147684d6a88b803Stephen Smalley$(warning BOARD_SEPOLICY_UNION is no longer required - all files found in BOARD_SEPOLICY_DIRS are implicitly unioned; please remove from your BoardConfig.mk or other .mk file.) 468e0ca8867eac09f8fd740485f147684d6a88b803Stephen Smalleyendif 478e0ca8867eac09f8fd740485f147684d6a88b803Stephen Smalley 48d21855824d178abea9ac93376757c7aed765cd83William Robertsifdef BOARD_SEPOLICY_M4DEFS 49d21855824d178abea9ac93376757c7aed765cd83William RobertsLOCAL_ADDITIONAL_M4DEFS := $(addprefix -D, $(BOARD_SEPOLICY_M4DEFS)) 50d21855824d178abea9ac93376757c7aed765cd83William Robertsendif 51d21855824d178abea9ac93376757c7aed765cd83William Roberts 52cc39f637734a8d84bc861b649bfd109290c06401dcashman# sepolicy is now divided into multiple portions: 53cc39f637734a8d84bc861b649bfd109290c06401dcashman# public - policy exported on which non-platform policy developers may write 54cc39f637734a8d84bc861b649bfd109290c06401dcashman# additional policy. types and attributes are versioned and included in 55cc39f637734a8d84bc861b649bfd109290c06401dcashman# delivered non-platform policy, which is to be combined with platform policy. 56cc39f637734a8d84bc861b649bfd109290c06401dcashman# private - platform-only policy required for platform functionality but which 57cc39f637734a8d84bc861b649bfd109290c06401dcashman# is not exported to vendor policy developers and as such may not be assumed 58cc39f637734a8d84bc861b649bfd109290c06401dcashman# to exist. 595596172d23a799d4131f36822e8afe817f2cf017Alex Klyubin# vendor - vendor-only policy required for vendor functionality. This policy can 605596172d23a799d4131f36822e8afe817f2cf017Alex Klyubin# reference the public policy but cannot reference the private policy. This 615596172d23a799d4131f36822e8afe817f2cf017Alex Klyubin# policy is for components which are produced from the core/non-vendor tree and 625596172d23a799d4131f36822e8afe817f2cf017Alex Klyubin# placed into a vendor partition. 6307791558051d0ffbbb6ac015cd4f195455695523dcashman# mapping - This contains policy statements which map the attributes 64cc39f637734a8d84bc861b649bfd109290c06401dcashman# exposed in the public policy of previous versions to the concrete types used 65cc39f637734a8d84bc861b649bfd109290c06401dcashman# in this policy to ensure that policy targeting attributes from public 66cc39f637734a8d84bc861b649bfd109290c06401dcashman# policy from an older platform version continues to work. 67cc39f637734a8d84bc861b649bfd109290c06401dcashman 682e00e6373faa6271d7839d33c5b9e69d998ff020dcashman# build process for device: 69cc39f637734a8d84bc861b649bfd109290c06401dcashman# 1) convert policies to CIL: 70cc39f637734a8d84bc861b649bfd109290c06401dcashman# - private + public platform policy to CIL 71cc39f637734a8d84bc861b649bfd109290c06401dcashman# - mapping file to CIL (should already be in CIL form) 72cc39f637734a8d84bc861b649bfd109290c06401dcashman# - non-platform public policy to CIL 73cc39f637734a8d84bc861b649bfd109290c06401dcashman# - non-platform public + private policy to CIL 74cc39f637734a8d84bc861b649bfd109290c06401dcashman# 2) attributize policy 75cc39f637734a8d84bc861b649bfd109290c06401dcashman# - run script which takes non-platform public and non-platform combined 76cc39f637734a8d84bc861b649bfd109290c06401dcashman# private + public policy and produces attributized and versioned 77cc39f637734a8d84bc861b649bfd109290c06401dcashman# non-platform policy 78cc39f637734a8d84bc861b649bfd109290c06401dcashman# 3) combine policy files 79cc39f637734a8d84bc861b649bfd109290c06401dcashman# - combine mapping, platform and non-platform policy. 80cc39f637734a8d84bc861b649bfd109290c06401dcashman# - compile output binary policy file 81cc39f637734a8d84bc861b649bfd109290c06401dcashman 82cc39f637734a8d84bc861b649bfd109290c06401dcashmanPLAT_PUBLIC_POLICY := $(LOCAL_PATH)/public 8351455fe9773e5b3e920e149c6fc48e34b2ab1327Dan Cashmanifneq ( ,$(BOARD_PLAT_PUBLIC_SEPOLICY_DIR)) 8451455fe9773e5b3e920e149c6fc48e34b2ab1327Dan Cashmanifneq (1, $(words $(BOARD_PLAT_PUBLIC_SEPOLICY_DIR))) 8551455fe9773e5b3e920e149c6fc48e34b2ab1327Dan Cashman$(error BOARD_PLAT_PUBLIC_SEPOLICY_DIR must only contain one directory) 8651455fe9773e5b3e920e149c6fc48e34b2ab1327Dan Cashmanelse 8751455fe9773e5b3e920e149c6fc48e34b2ab1327Dan CashmanPLAT_PUBLIC_POLICY += $(BOARD_PLAT_PUBLIC_SEPOLICY_DIR) 8851455fe9773e5b3e920e149c6fc48e34b2ab1327Dan Cashmanendif 8951455fe9773e5b3e920e149c6fc48e34b2ab1327Dan Cashmanendif 90cc39f637734a8d84bc861b649bfd109290c06401dcashmanPLAT_PRIVATE_POLICY := $(LOCAL_PATH)/private 9151455fe9773e5b3e920e149c6fc48e34b2ab1327Dan Cashmanifneq ( ,$(BOARD_PLAT_PRIVATE_SEPOLICY_DIR)) 9251455fe9773e5b3e920e149c6fc48e34b2ab1327Dan Cashmanifneq (1, $(words $(BOARD_PLAT_PRIVATE_SEPOLICY_DIR))) 9351455fe9773e5b3e920e149c6fc48e34b2ab1327Dan Cashman$(error BOARD_PLAT_PRIVATE_SEPOLICY_DIR must only contain one directory) 9451455fe9773e5b3e920e149c6fc48e34b2ab1327Dan Cashmanelse 9551455fe9773e5b3e920e149c6fc48e34b2ab1327Dan CashmanPLAT_PRIVATE_POLICY += $(BOARD_PLAT_PRIVATE_SEPOLICY_DIR) 9651455fe9773e5b3e920e149c6fc48e34b2ab1327Dan Cashmanendif 9751455fe9773e5b3e920e149c6fc48e34b2ab1327Dan Cashmanendif 985596172d23a799d4131f36822e8afe817f2cf017Alex KlyubinPLAT_VENDOR_POLICY := $(LOCAL_PATH)/vendor 992e00e6373faa6271d7839d33c5b9e69d998ff020dcashmanREQD_MASK_POLICY := $(LOCAL_PATH)/reqd_mask 1002e00e6373faa6271d7839d33c5b9e69d998ff020dcashman 1012e00e6373faa6271d7839d33c5b9e69d998ff020dcashman# TODO: move to README when doing the README update and finalizing versioning. 10242f95984b501f39cd5f8270b5854a985d1b6d528Sandeep Patil# BOARD_SEPOLICY_VERS must take the format "NN.m" and contain the sepolicy 10342f95984b501f39cd5f8270b5854a985d1b6d528Sandeep Patil# version identifier corresponding to the sepolicy on which the non-platform 10442f95984b501f39cd5f8270b5854a985d1b6d528Sandeep Patil# policy is to be based. If unspecified, this will build against the current 10542f95984b501f39cd5f8270b5854a985d1b6d528Sandeep Patil# public platform policy in tree 1062e00e6373faa6271d7839d33c5b9e69d998ff020dcashmanifndef BOARD_SEPOLICY_VERS 1072e00e6373faa6271d7839d33c5b9e69d998ff020dcashman$(warning BOARD_SEPOLICY_VERS not specified, assuming current platform version) 10842f95984b501f39cd5f8270b5854a985d1b6d528Sandeep Patil# The default platform policy version. 1096f14f6b7d957d4001160438882fb5cb7b09e399eDan CashmanBOARD_SEPOLICY_VERS := $(PLATFORM_SEPOLICY_VERSION) 1102e00e6373faa6271d7839d33c5b9e69d998ff020dcashmanendif 111cc39f637734a8d84bc861b649bfd109290c06401dcashman 1124d24a77551d30369542ac15e48e02f3ae582d0e6Dan Cashman 1134d24a77551d30369542ac15e48e02f3ae582d0e6Dan Cashmanplatform_mapping_file := $(BOARD_SEPOLICY_VERS).cil 1144d24a77551d30369542ac15e48e02f3ae582d0e6Dan Cashman 115cc39f637734a8d84bc861b649bfd109290c06401dcashman########################################################### 116cc39f637734a8d84bc861b649bfd109290c06401dcashman# Compute policy files to be used in policy build. 117cc39f637734a8d84bc861b649bfd109290c06401dcashman# $(1): files to include 118cc39f637734a8d84bc861b649bfd109290c06401dcashman# $(2): directories in which to find files 119cc39f637734a8d84bc861b649bfd109290c06401dcashman########################################################### 120cc39f637734a8d84bc861b649bfd109290c06401dcashman 121cc39f637734a8d84bc861b649bfd109290c06401dcashmandefine build_policy 122cc39f637734a8d84bc861b649bfd109290c06401dcashman$(foreach type, $(1), $(foreach file, $(addsuffix /$(type), $(2)), $(sort $(wildcard $(file))))) 123cc39f637734a8d84bc861b649bfd109290c06401dcashmanendef 12429d146887eacf432b90c0ae460060f79d84dbacaWilliam Roberts 12549693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Roberts# Builds paths for all policy files found in BOARD_SEPOLICY_DIRS. 12649693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Roberts# $(1): the set of policy name paths to build 1275596172d23a799d4131f36822e8afe817f2cf017Alex Klyubinbuild_device_policy = $(call build_policy, $(1), $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS)) 12849693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Roberts 129c8801fec63a785be65808e70232ea241c779fcb5Richard Haines# Add a file containing only a newline in-between each policy configuration 130c8801fec63a785be65808e70232ea241c779fcb5Richard Haines# 'contexts' file. This will allow OEM policy configuration files without a 131c8801fec63a785be65808e70232ea241c779fcb5Richard Haines# final newline (0x0A) to be built correctly by the m4(1) macro processor. 132c8801fec63a785be65808e70232ea241c779fcb5Richard Haines# $(1): the set of contexts file names. 133c8801fec63a785be65808e70232ea241c779fcb5Richard Haines# $(2): the file containing only 0x0A. 134c8801fec63a785be65808e70232ea241c779fcb5Richard Hainesadd_nl = $(foreach entry, $(1), $(subst $(entry), $(entry) $(2), $(entry))) 135c8801fec63a785be65808e70232ea241c779fcb5Richard Haines 136704741a5c24113b22a47bb854f20e2f2c607dd36dcashmansepolicy_build_files := security_classes \ 137704741a5c24113b22a47bb854f20e2f2c607dd36dcashman initial_sids \ 138704741a5c24113b22a47bb854f20e2f2c607dd36dcashman access_vectors \ 139704741a5c24113b22a47bb854f20e2f2c607dd36dcashman global_macros \ 140a17a266e7e466d281f0730449c492de46390fc76Nick Kralevich neverallow_macros \ 141704741a5c24113b22a47bb854f20e2f2c607dd36dcashman mls_macros \ 1422e00e6373faa6271d7839d33c5b9e69d998ff020dcashman mls_decl \ 143704741a5c24113b22a47bb854f20e2f2c607dd36dcashman mls \ 144704741a5c24113b22a47bb854f20e2f2c607dd36dcashman policy_capabilities \ 145704741a5c24113b22a47bb854f20e2f2c607dd36dcashman te_macros \ 146704741a5c24113b22a47bb854f20e2f2c607dd36dcashman attributes \ 147cbaa2b7d37c0810009cc0ffa4026334b4bf3096eJeff Vander Stoep ioctl_defines \ 148de9b5301a14abf388589b06e819bb001d69e0cf1Jeff Vander Stoep ioctl_macros \ 149704741a5c24113b22a47bb854f20e2f2c607dd36dcashman *.te \ 1502e00e6373faa6271d7839d33c5b9e69d998ff020dcashman roles_decl \ 151704741a5c24113b22a47bb854f20e2f2c607dd36dcashman roles \ 152704741a5c24113b22a47bb854f20e2f2c607dd36dcashman users \ 153704741a5c24113b22a47bb854f20e2f2c607dd36dcashman initial_sid_contexts \ 154704741a5c24113b22a47bb854f20e2f2c607dd36dcashman fs_use \ 155704741a5c24113b22a47bb854f20e2f2c607dd36dcashman genfs_contexts \ 156704741a5c24113b22a47bb854f20e2f2c607dd36dcashman port_contexts 157704741a5c24113b22a47bb854f20e2f2c607dd36dcashman 1587cda44f49f8b128f6a4673174220b4825024f654Alex Klyubin# CIL files which contain workarounds for current limitation of human-readable 1597cda44f49f8b128f6a4673174220b4825024f654Alex Klyubin# module policy language. These files are appended to the CIL files produced 1607cda44f49f8b128f6a4673174220b4825024f654Alex Klyubin# from module language files. 1617cda44f49f8b128f6a4673174220b4825024f654Alex Klyubinsepolicy_build_cil_workaround_files := technical_debt.cil 1627cda44f49f8b128f6a4673174220b4825024f654Alex Klyubin 1631c0402779552e497900db0a649068019ce023dfbDan Cashmanmy_target_arch := $(TARGET_ARCH) 1641c0402779552e497900db0a649068019ce023dfbDan Cashmanifneq (,$(filter mips mips64,$(TARGET_ARCH))) 1651c0402779552e497900db0a649068019ce023dfbDan Cashman my_target_arch := mips 1661c0402779552e497900db0a649068019ce023dfbDan Cashmanendif 1671c0402779552e497900db0a649068019ce023dfbDan Cashman 168d2053bd024139d9993a3bfa9b81fd4e68b9bc865Jeff Vander Stoepintermediates := $(TARGET_OUT_INTERMEDIATES)/ETC/sepolicy_intermediates 169d2053bd024139d9993a3bfa9b81fd4e68b9bc865Jeff Vander Stoep 1707443484831a858848d71b95c3e9fa4e96dcbf830Jeff Vander Stoepwith_asan := false 1717443484831a858848d71b95c3e9fa4e96dcbf830Jeff Vander Stoepifneq (,$(filter address,$(SANITIZE_TARGET))) 1727443484831a858848d71b95c3e9fa4e96dcbf830Jeff Vander Stoep with_asan := true 1737443484831a858848d71b95c3e9fa4e96dcbf830Jeff Vander Stoependif 1747443484831a858848d71b95c3e9fa4e96dcbf830Jeff Vander Stoep 1754f9a648e90ed95716224b96348805accd27f4f51Dan Cashmaninclude $(CLEAR_VARS) 1764f9a648e90ed95716224b96348805accd27f4f51Dan CashmanLOCAL_MODULE := selinux_policy 1774f9a648e90ed95716224b96348805accd27f4f51Dan CashmanLOCAL_MODULE_TAGS := optional 1784f9a648e90ed95716224b96348805accd27f4f51Dan Cashman# Include SELinux policy. We do this here because different modules 1794f9a648e90ed95716224b96348805accd27f4f51Dan Cashman# need to be included based on the value of PRODUCT_FULL_TREBLE. This 1804f9a648e90ed95716224b96348805accd27f4f51Dan Cashman# type of conditional inclusion cannot be done in top-level files such 1814f9a648e90ed95716224b96348805accd27f4f51Dan Cashman# as build/target/product/embedded.mk. 1824f9a648e90ed95716224b96348805accd27f4f51Dan Cashman# This conditional inclusion closely mimics the conditional logic 1834f9a648e90ed95716224b96348805accd27f4f51Dan Cashman# inside init/init.cpp for loading SELinux policy from files. 1844f9a648e90ed95716224b96348805accd27f4f51Dan Cashmanifeq ($(PRODUCT_FULL_TREBLE),true) 1854f9a648e90ed95716224b96348805accd27f4f51Dan Cashman 1864f9a648e90ed95716224b96348805accd27f4f51Dan Cashman# Use split SELinux policy 1874f9a648e90ed95716224b96348805accd27f4f51Dan CashmanLOCAL_REQUIRED_MODULES += \ 1884f9a648e90ed95716224b96348805accd27f4f51Dan Cashman $(platform_mapping_file) \ 1894f9a648e90ed95716224b96348805accd27f4f51Dan Cashman nonplat_sepolicy.cil \ 1904f9a648e90ed95716224b96348805accd27f4f51Dan Cashman plat_sepolicy.cil \ 1914f9a648e90ed95716224b96348805accd27f4f51Dan Cashman plat_and_mapping_sepolicy.cil.sha256 \ 1924f9a648e90ed95716224b96348805accd27f4f51Dan Cashman secilc \ 1931fc0682ec629d10c5c48714def2fc96369977169Jeff Vander Stoep plat_sepolicy_vers.txt \ 1941fc0682ec629d10c5c48714def2fc96369977169Jeff Vander Stoep treble_sepolicy_tests 1954f9a648e90ed95716224b96348805accd27f4f51Dan Cashman 1964f9a648e90ed95716224b96348805accd27f4f51Dan Cashman# Include precompiled policy, unless told otherwise 1974f9a648e90ed95716224b96348805accd27f4f51Dan Cashmanifneq ($(PRODUCT_PRECOMPILED_SEPOLICY),false) 1984f9a648e90ed95716224b96348805accd27f4f51Dan CashmanLOCAL_REQUIRED_MODULES += precompiled_sepolicy precompiled_sepolicy.plat_and_mapping.sha256 1994f9a648e90ed95716224b96348805accd27f4f51Dan Cashmanendif 2004f9a648e90ed95716224b96348805accd27f4f51Dan Cashmanelse 2014f9a648e90ed95716224b96348805accd27f4f51Dan Cashman# Use monolithic SELinux policy 2027a68c5ae4ca81778f222c2817b698463878e5700Jeff Vander StoepLOCAL_REQUIRED_MODULES += sepolicy 2034f9a648e90ed95716224b96348805accd27f4f51Dan Cashmanendif 2047a68c5ae4ca81778f222c2817b698463878e5700Jeff Vander Stoep 2057a68c5ae4ca81778f222c2817b698463878e5700Jeff Vander StoepLOCAL_REQUIRED_MODULES += \ 2067a68c5ae4ca81778f222c2817b698463878e5700Jeff Vander Stoep nonplat_file_contexts \ 2077a68c5ae4ca81778f222c2817b698463878e5700Jeff Vander Stoep plat_file_contexts 2087a68c5ae4ca81778f222c2817b698463878e5700Jeff Vander Stoep 2094f9a648e90ed95716224b96348805accd27f4f51Dan Cashmaninclude $(BUILD_PHONY_PACKAGE) 2104f9a648e90ed95716224b96348805accd27f4f51Dan Cashman 21102fb5f3c6abbb7f12c278a04966314d06f6378e3Ying Wang################################## 2122e00e6373faa6271d7839d33c5b9e69d998ff020dcashman# reqd_policy_mask - a policy.conf file which contains only the bare minimum 2132e00e6373faa6271d7839d33c5b9e69d998ff020dcashman# policy necessary to use checkpolicy. This bare-minimum policy needs to be 2142e00e6373faa6271d7839d33c5b9e69d998ff020dcashman# present in all policy.conf files, but should not necessarily be exported as 2152e00e6373faa6271d7839d33c5b9e69d998ff020dcashman# part of the public policy. The rules generated by reqd_policy_mask will allow 2162e00e6373faa6271d7839d33c5b9e69d998ff020dcashman# the compilation of public policy and subsequent removal of CIL policy that 2172e00e6373faa6271d7839d33c5b9e69d998ff020dcashman# should not be exported. 2182e00e6373faa6271d7839d33c5b9e69d998ff020dcashman 2192e00e6373faa6271d7839d33c5b9e69d998ff020dcashmanreqd_policy_mask.conf := $(intermediates)/reqd_policy_mask.conf 2202e00e6373faa6271d7839d33c5b9e69d998ff020dcashman$(reqd_policy_mask.conf): PRIVATE_MLS_SENS := $(MLS_SENS) 2212e00e6373faa6271d7839d33c5b9e69d998ff020dcashman$(reqd_policy_mask.conf): PRIVATE_MLS_CATS := $(MLS_CATS) 2221c0402779552e497900db0a649068019ce023dfbDan Cashman$(reqd_policy_mask.conf): PRIVATE_TGT_ARCH := $(my_target_arch) 2237443484831a858848d71b95c3e9fa4e96dcbf830Jeff Vander Stoep$(reqd_policy_mask.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) 2242e00e6373faa6271d7839d33c5b9e69d998ff020dcashman$(reqd_policy_mask.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) 2252e00e6373faa6271d7839d33c5b9e69d998ff020dcashman$(reqd_policy_mask.conf): $(call build_policy, $(sepolicy_build_files), $(REQD_MASK_POLICY)) 2262e00e6373faa6271d7839d33c5b9e69d998ff020dcashman @mkdir -p $(dir $@) 2272e00e6373faa6271d7839d33c5b9e69d998ff020dcashman $(hide) m4 $(PRIVATE_ADDITIONAL_M4DEFS) \ 2282e00e6373faa6271d7839d33c5b9e69d998ff020dcashman -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \ 2292e00e6373faa6271d7839d33c5b9e69d998ff020dcashman -D target_build_variant=$(TARGET_BUILD_VARIANT) \ 2301c0402779552e497900db0a649068019ce023dfbDan Cashman -D target_with_dexpreopt=$(WITH_DEXPREOPT) \ 2311c0402779552e497900db0a649068019ce023dfbDan Cashman -D target_arch=$(PRIVATE_TGT_ARCH) \ 2327443484831a858848d71b95c3e9fa4e96dcbf830Jeff Vander Stoep -D target_with_asan=$(PRIVATE_TGT_WITH_ASAN) \ 233f5446eb1486816c00136b2b5f0a3cc4a01706000Alex Klyubin -D target_full_treble=$(PRODUCT_FULL_TREBLE) \ 2342e00e6373faa6271d7839d33c5b9e69d998ff020dcashman -s $^ > $@ 2352e00e6373faa6271d7839d33c5b9e69d998ff020dcashman 2362e00e6373faa6271d7839d33c5b9e69d998ff020dcashmanreqd_policy_mask.cil := $(intermediates)/reqd_policy_mask.cil 2372e00e6373faa6271d7839d33c5b9e69d998ff020dcashman$(reqd_policy_mask.cil): $(reqd_policy_mask.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy 2382e00e6373faa6271d7839d33c5b9e69d998ff020dcashman @mkdir -p $(dir $@) 2392e00e6373faa6271d7839d33c5b9e69d998ff020dcashman $(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -C -M -c $(POLICYVERS) -o $@ $< 2402e00e6373faa6271d7839d33c5b9e69d998ff020dcashman 2411faa644c81e90cfd226bb7e43cde68e309c10790dcashmanreqd_policy_mask.conf := 2421faa644c81e90cfd226bb7e43cde68e309c10790dcashman 2431faa644c81e90cfd226bb7e43cde68e309c10790dcashman################################## 2442e00e6373faa6271d7839d33c5b9e69d998ff020dcashman# plat_pub_policy - policy that will be exported to be a part of non-platform 2452e00e6373faa6271d7839d33c5b9e69d998ff020dcashman# policy corresponding to this platform version. This is a limited subset of 2462e00e6373faa6271d7839d33c5b9e69d998ff020dcashman# policy that would not compile in checkpolicy on its own. To get around this 2472e00e6373faa6271d7839d33c5b9e69d998ff020dcashman# limitation, add only the required files from private policy, which will 2482e00e6373faa6271d7839d33c5b9e69d998ff020dcashman# generate CIL policy that will then be filtered out by the reqd_policy_mask. 2492e00e6373faa6271d7839d33c5b9e69d998ff020dcashmanplat_pub_policy.conf := $(intermediates)/plat_pub_policy.conf 2502e00e6373faa6271d7839d33c5b9e69d998ff020dcashman$(plat_pub_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS) 2512e00e6373faa6271d7839d33c5b9e69d998ff020dcashman$(plat_pub_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS) 2521c0402779552e497900db0a649068019ce023dfbDan Cashman$(plat_pub_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch) 2537443484831a858848d71b95c3e9fa4e96dcbf830Jeff Vander Stoep$(plat_pub_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) 2542e00e6373faa6271d7839d33c5b9e69d998ff020dcashman$(plat_pub_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) 2552e00e6373faa6271d7839d33c5b9e69d998ff020dcashman$(plat_pub_policy.conf): $(call build_policy, $(sepolicy_build_files), \ 2566bf50e5c14a45088680ba5af971bf08657c343f5Dan Cashman$(PLAT_PUBLIC_POLICY) $(REQD_MASK_POLICY)) 2572e00e6373faa6271d7839d33c5b9e69d998ff020dcashman @mkdir -p $(dir $@) 2582e00e6373faa6271d7839d33c5b9e69d998ff020dcashman $(hide) m4 $(PRIVATE_ADDITIONAL_M4DEFS) \ 2592e00e6373faa6271d7839d33c5b9e69d998ff020dcashman -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \ 2602e00e6373faa6271d7839d33c5b9e69d998ff020dcashman -D target_build_variant=$(TARGET_BUILD_VARIANT) \ 2611c0402779552e497900db0a649068019ce023dfbDan Cashman -D target_with_dexpreopt=$(WITH_DEXPREOPT) \ 2621c0402779552e497900db0a649068019ce023dfbDan Cashman -D target_arch=$(PRIVATE_TGT_ARCH) \ 2637443484831a858848d71b95c3e9fa4e96dcbf830Jeff Vander Stoep -D target_with_asan=$(PRIVATE_TGT_WITH_ASAN) \ 264f5446eb1486816c00136b2b5f0a3cc4a01706000Alex Klyubin -D target_full_treble=$(PRODUCT_FULL_TREBLE) \ 2652e00e6373faa6271d7839d33c5b9e69d998ff020dcashman -s $^ > $@ 2662e00e6373faa6271d7839d33c5b9e69d998ff020dcashman 2672e00e6373faa6271d7839d33c5b9e69d998ff020dcashmanplat_pub_policy.cil := $(intermediates)/plat_pub_policy.cil 2681faa644c81e90cfd226bb7e43cde68e309c10790dcashman$(plat_pub_policy.cil): PRIVATE_POL_CONF := $(plat_pub_policy.conf) 2691faa644c81e90cfd226bb7e43cde68e309c10790dcashman$(plat_pub_policy.cil): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil) 2701faa644c81e90cfd226bb7e43cde68e309c10790dcashman$(plat_pub_policy.cil): $(HOST_OUT_EXECUTABLES)/checkpolicy $(plat_pub_policy.conf) $(reqd_policy_mask.cil) 2712e00e6373faa6271d7839d33c5b9e69d998ff020dcashman @mkdir -p $(dir $@) 2721faa644c81e90cfd226bb7e43cde68e309c10790dcashman $(hide) $< -C -M -c $(POLICYVERS) -o $@.tmp $(PRIVATE_POL_CONF) 2731faa644c81e90cfd226bb7e43cde68e309c10790dcashman $(hide) grep -Fxv -f $(PRIVATE_REQD_MASK) $@.tmp > $@ 2742e00e6373faa6271d7839d33c5b9e69d998ff020dcashman 2751faa644c81e90cfd226bb7e43cde68e309c10790dcashmanplat_pub_policy.conf := 2761c0402779552e497900db0a649068019ce023dfbDan Cashman 2771faa644c81e90cfd226bb7e43cde68e309c10790dcashman################################## 2781faa644c81e90cfd226bb7e43cde68e309c10790dcashmaninclude $(CLEAR_VARS) 2791faa644c81e90cfd226bb7e43cde68e309c10790dcashman 2801faa644c81e90cfd226bb7e43cde68e309c10790dcashmanLOCAL_MODULE := sectxfile_nl 2811faa644c81e90cfd226bb7e43cde68e309c10790dcashmanLOCAL_MODULE_CLASS := ETC 2821faa644c81e90cfd226bb7e43cde68e309c10790dcashmanLOCAL_MODULE_TAGS := optional 2831faa644c81e90cfd226bb7e43cde68e309c10790dcashman 2841faa644c81e90cfd226bb7e43cde68e309c10790dcashman# Create a file containing newline only to add between context config files 2851faa644c81e90cfd226bb7e43cde68e309c10790dcashmaninclude $(BUILD_SYSTEM)/base_rules.mk 2861faa644c81e90cfd226bb7e43cde68e309c10790dcashman$(LOCAL_BUILT_MODULE): 2872e00e6373faa6271d7839d33c5b9e69d998ff020dcashman @mkdir -p $(dir $@) 2881faa644c81e90cfd226bb7e43cde68e309c10790dcashman $(hide) echo > $@ 2891faa644c81e90cfd226bb7e43cde68e309c10790dcashman 2901faa644c81e90cfd226bb7e43cde68e309c10790dcashmanbuilt_nl := $(LOCAL_BUILT_MODULE) 2911faa644c81e90cfd226bb7e43cde68e309c10790dcashman 2921faa644c81e90cfd226bb7e43cde68e309c10790dcashman################################# 2931faa644c81e90cfd226bb7e43cde68e309c10790dcashmaninclude $(CLEAR_VARS) 2941faa644c81e90cfd226bb7e43cde68e309c10790dcashman 2951faa644c81e90cfd226bb7e43cde68e309c10790dcashmanLOCAL_MODULE := plat_sepolicy.cil 2961faa644c81e90cfd226bb7e43cde68e309c10790dcashmanLOCAL_MODULE_CLASS := ETC 2971faa644c81e90cfd226bb7e43cde68e309c10790dcashmanLOCAL_MODULE_TAGS := optional 298052b0bbb267d7629770184a6c53dd59a1eb0b671Alex KlyubinLOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux 2991faa644c81e90cfd226bb7e43cde68e309c10790dcashman 3001faa644c81e90cfd226bb7e43cde68e309c10790dcashmaninclude $(BUILD_SYSTEM)/base_rules.mk 3012e00e6373faa6271d7839d33c5b9e69d998ff020dcashman 3022e00e6373faa6271d7839d33c5b9e69d998ff020dcashman# plat_policy.conf - A combination of the private and public platform policy 3032e00e6373faa6271d7839d33c5b9e69d998ff020dcashman# which will ship with the device. The platform will always reflect the most 3042e00e6373faa6271d7839d33c5b9e69d998ff020dcashman# recent platform version and is not currently being attributized. 3052e00e6373faa6271d7839d33c5b9e69d998ff020dcashmanplat_policy.conf := $(intermediates)/plat_policy.conf 3062e00e6373faa6271d7839d33c5b9e69d998ff020dcashman$(plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS) 3072e00e6373faa6271d7839d33c5b9e69d998ff020dcashman$(plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS) 3081c0402779552e497900db0a649068019ce023dfbDan Cashman$(plat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch) 3097443484831a858848d71b95c3e9fa4e96dcbf830Jeff Vander Stoep$(plat_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) 3102e00e6373faa6271d7839d33c5b9e69d998ff020dcashman$(plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) 3112e00e6373faa6271d7839d33c5b9e69d998ff020dcashman$(plat_policy.conf): $(call build_policy, $(sepolicy_build_files), \ 312cc39f637734a8d84bc861b649bfd109290c06401dcashman$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY)) 313cc39f637734a8d84bc861b649bfd109290c06401dcashman @mkdir -p $(dir $@) 314cc39f637734a8d84bc861b649bfd109290c06401dcashman $(hide) m4 $(PRIVATE_ADDITIONAL_M4DEFS) \ 315cc39f637734a8d84bc861b649bfd109290c06401dcashman -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \ 316cc39f637734a8d84bc861b649bfd109290c06401dcashman -D target_build_variant=$(TARGET_BUILD_VARIANT) \ 31784db84e6cdc6a04ac85fb4413c813412c0dea600Jorge Lucangeli Obes -D target_with_dexpreopt=$(WITH_DEXPREOPT) \ 3181c0402779552e497900db0a649068019ce023dfbDan Cashman -D target_arch=$(PRIVATE_TGT_ARCH) \ 3197443484831a858848d71b95c3e9fa4e96dcbf830Jeff Vander Stoep -D target_with_asan=$(PRIVATE_TGT_WITH_ASAN) \ 320f5446eb1486816c00136b2b5f0a3cc4a01706000Alex Klyubin -D target_full_treble=$(PRODUCT_FULL_TREBLE) \ 321cc39f637734a8d84bc861b649bfd109290c06401dcashman -s $^ > $@ 322cc39f637734a8d84bc861b649bfd109290c06401dcashman $(hide) sed '/dontaudit/d' $@ > $@.dontaudit 323cc39f637734a8d84bc861b649bfd109290c06401dcashman 324b87876937b8ed73063fd44800beb86f3dd7079beJeff Vander Stoep$(LOCAL_BUILT_MODULE): PRIVATE_ADDITIONAL_CIL_FILES := \ 3257cda44f49f8b128f6a4673174220b4825024f654Alex Klyubin $(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY)) 326b87876937b8ed73063fd44800beb86f3dd7079beJeff Vander Stoep$(LOCAL_BUILT_MODULE): $(plat_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \ 327b87876937b8ed73063fd44800beb86f3dd7079beJeff Vander Stoep $(HOST_OUT_EXECUTABLES)/secilc \ 3287cda44f49f8b128f6a4673174220b4825024f654Alex Klyubin $(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY)) 3292e00e6373faa6271d7839d33c5b9e69d998ff020dcashman @mkdir -p $(dir $@) 33007791558051d0ffbbb6ac015cd4f195455695523dcashman $(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c $(POLICYVERS) -o $@ $< 3317cda44f49f8b128f6a4673174220b4825024f654Alex Klyubin $(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@ 332cfb6f3523159d87d444ace1b4c24fa09a11b31f0Sandeep Patil $(hide) $(HOST_OUT_EXECUTABLES)/secilc -M true -G -c $(POLICYVERS) $@ -o /dev/null -f /dev/null 3338f7173b01601040ae17810d07dea37a895f94dddAlex Klyubin 3348f7173b01601040ae17810d07dea37a895f94dddAlex Klyubinbuilt_plat_cil := $(LOCAL_BUILT_MODULE) 3351faa644c81e90cfd226bb7e43cde68e309c10790dcashmanplat_policy.conf := 3361faa644c81e90cfd226bb7e43cde68e309c10790dcashman 3371faa644c81e90cfd226bb7e43cde68e309c10790dcashman################################# 3381faa644c81e90cfd226bb7e43cde68e309c10790dcashmaninclude $(CLEAR_VARS) 3391faa644c81e90cfd226bb7e43cde68e309c10790dcashman 3404f9a648e90ed95716224b96348805accd27f4f51Dan CashmanLOCAL_MODULE := plat_sepolicy_vers.txt 3411faa644c81e90cfd226bb7e43cde68e309c10790dcashmanLOCAL_MODULE_CLASS := ETC 3421faa644c81e90cfd226bb7e43cde68e309c10790dcashmanLOCAL_MODULE_TAGS := optional 3434f9a648e90ed95716224b96348805accd27f4f51Dan CashmanLOCAL_PROPRIETARY_MODULE := true 3444f9a648e90ed95716224b96348805accd27f4f51Dan CashmanLOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux 3454f9a648e90ed95716224b96348805accd27f4f51Dan Cashman 3464f9a648e90ed95716224b96348805accd27f4f51Dan Cashmaninclude $(BUILD_SYSTEM)/base_rules.mk 3474f9a648e90ed95716224b96348805accd27f4f51Dan Cashman 3484f9a648e90ed95716224b96348805accd27f4f51Dan Cashman$(LOCAL_BUILT_MODULE) : PRIVATE_PLAT_SEPOL_VERS := $(BOARD_SEPOLICY_VERS) 3494f9a648e90ed95716224b96348805accd27f4f51Dan Cashman$(LOCAL_BUILT_MODULE) : 3504f9a648e90ed95716224b96348805accd27f4f51Dan Cashman mkdir -p $(dir $@) 3514f9a648e90ed95716224b96348805accd27f4f51Dan Cashman echo $(PRIVATE_PLAT_SEPOL_VERS) > $@ 3524f9a648e90ed95716224b96348805accd27f4f51Dan Cashman 3534f9a648e90ed95716224b96348805accd27f4f51Dan Cashman################################# 3544f9a648e90ed95716224b96348805accd27f4f51Dan Cashmaninclude $(CLEAR_VARS) 3554f9a648e90ed95716224b96348805accd27f4f51Dan Cashman 3564f9a648e90ed95716224b96348805accd27f4f51Dan CashmanLOCAL_MODULE := $(platform_mapping_file) 3574f9a648e90ed95716224b96348805accd27f4f51Dan CashmanLOCAL_MODULE_CLASS := ETC 3584f9a648e90ed95716224b96348805accd27f4f51Dan CashmanLOCAL_MODULE_TAGS := optional 3594f9a648e90ed95716224b96348805accd27f4f51Dan CashmanLOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux/mapping 3601faa644c81e90cfd226bb7e43cde68e309c10790dcashman 3611faa644c81e90cfd226bb7e43cde68e309c10790dcashmaninclude $(BUILD_SYSTEM)/base_rules.mk 3621faa644c81e90cfd226bb7e43cde68e309c10790dcashman 3631b0a71f308a18ab31147ea34c692f4fe7f4d7066Dan Cashmancurrent_mapping.cil := $(intermediates)/mapping/$(PLATFORM_SEPOLICY_VERSION).cil 3641b0a71f308a18ab31147ea34c692f4fe7f4d7066Dan Cashmanifeq ($(BOARD_SEPOLICY_VERS), $(PLATFORM_SEPOLICY_VERSION)) 3651faa644c81e90cfd226bb7e43cde68e309c10790dcashman# auto-generate the mapping file for current platform policy, since it needs to 3661faa644c81e90cfd226bb7e43cde68e309c10790dcashman# track platform policy development 3676f14f6b7d957d4001160438882fb5cb7b09e399eDan Cashman$(current_mapping.cil) : PRIVATE_VERS := $(PLATFORM_SEPOLICY_VERSION) 3681faa644c81e90cfd226bb7e43cde68e309c10790dcashman$(current_mapping.cil) : $(plat_pub_policy.cil) $(HOST_OUT_EXECUTABLES)/version_policy 3691faa644c81e90cfd226bb7e43cde68e309c10790dcashman @mkdir -p $(dir $@) 3701faa644c81e90cfd226bb7e43cde68e309c10790dcashman $(hide) $(HOST_OUT_EXECUTABLES)/version_policy -b $< -m -n $(PRIVATE_VERS) -o $@ 3711faa644c81e90cfd226bb7e43cde68e309c10790dcashman 3721b0a71f308a18ab31147ea34c692f4fe7f4d7066Dan Cashmanelse # ifeq ($(BOARD_SEPOLICY_VERS), $(PLATFORM_SEPOLICY_VERSION)) 3731b0a71f308a18ab31147ea34c692f4fe7f4d7066Dan Cashmanprebuilt_mapping_files := $(wildcard $(addsuffix /mapping/$(BOARD_SEPOLICY_VERS).cil, $(PLAT_PRIVATE_POLICY))) 3741b0a71f308a18ab31147ea34c692f4fe7f4d7066Dan Cashman$(current_mapping.cil) : $(prebuilt_mapping_files) 3751b0a71f308a18ab31147ea34c692f4fe7f4d7066Dan Cashman @mkdir -p $(dir $@) 3761b0a71f308a18ab31147ea34c692f4fe7f4d7066Dan Cashman cat $^ > $@ 37742f95984b501f39cd5f8270b5854a985d1b6d528Sandeep Patil 3781b0a71f308a18ab31147ea34c692f4fe7f4d7066Dan Cashmanprebuilt_mapping_files := 3791faa644c81e90cfd226bb7e43cde68e309c10790dcashmanendif 3801faa644c81e90cfd226bb7e43cde68e309c10790dcashman 3811b0a71f308a18ab31147ea34c692f4fe7f4d7066Dan Cashman$(LOCAL_BUILT_MODULE): $(current_mapping.cil) $(ACP) 382b87876937b8ed73063fd44800beb86f3dd7079beJeff Vander Stoep $(hide) $(ACP) $< $@ 3831faa644c81e90cfd226bb7e43cde68e309c10790dcashman 3848f7173b01601040ae17810d07dea37a895f94dddAlex Klyubinbuilt_mapping_cil := $(LOCAL_BUILT_MODULE) 3851faa644c81e90cfd226bb7e43cde68e309c10790dcashmancurrent_mapping.cil := 3861faa644c81e90cfd226bb7e43cde68e309c10790dcashman 3871faa644c81e90cfd226bb7e43cde68e309c10790dcashman################################# 3881faa644c81e90cfd226bb7e43cde68e309c10790dcashmaninclude $(CLEAR_VARS) 3891faa644c81e90cfd226bb7e43cde68e309c10790dcashman 3900e9c47c0af92005ea81772e82663865f1a3572b3Dan CashmanLOCAL_MODULE := plat_and_mapping_sepolicy.cil.sha256 3910e9c47c0af92005ea81772e82663865f1a3572b3Dan CashmanLOCAL_MODULE_CLASS := ETC 3920e9c47c0af92005ea81772e82663865f1a3572b3Dan CashmanLOCAL_MODULE_TAGS := optional 3930e9c47c0af92005ea81772e82663865f1a3572b3Dan CashmanLOCAL_MODULE_PATH = $(TARGET_OUT)/etc/selinux 3940e9c47c0af92005ea81772e82663865f1a3572b3Dan Cashman 3950e9c47c0af92005ea81772e82663865f1a3572b3Dan Cashmaninclude $(BUILD_SYSTEM)/base_rules.mk 3960e9c47c0af92005ea81772e82663865f1a3572b3Dan Cashman 3970e9c47c0af92005ea81772e82663865f1a3572b3Dan Cashman$(LOCAL_BUILT_MODULE): $(built_plat_cil) $(built_mapping_cil) 3980e9c47c0af92005ea81772e82663865f1a3572b3Dan Cashman cat $^ | sha256sum | cut -d' ' -f1 > $@ 3990e9c47c0af92005ea81772e82663865f1a3572b3Dan Cashman 4000e9c47c0af92005ea81772e82663865f1a3572b3Dan Cashman################################# 4010e9c47c0af92005ea81772e82663865f1a3572b3Dan Cashmaninclude $(CLEAR_VARS) 4020e9c47c0af92005ea81772e82663865f1a3572b3Dan Cashman 4031faa644c81e90cfd226bb7e43cde68e309c10790dcashmanLOCAL_MODULE := nonplat_sepolicy.cil 4041faa644c81e90cfd226bb7e43cde68e309c10790dcashmanLOCAL_MODULE_CLASS := ETC 4051faa644c81e90cfd226bb7e43cde68e309c10790dcashmanLOCAL_MODULE_TAGS := optional 406052b0bbb267d7629770184a6c53dd59a1eb0b671Alex KlyubinLOCAL_PROPRIETARY_MODULE := true 407052b0bbb267d7629770184a6c53dd59a1eb0b671Alex KlyubinLOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux 4081faa644c81e90cfd226bb7e43cde68e309c10790dcashman 4091faa644c81e90cfd226bb7e43cde68e309c10790dcashmaninclude $(BUILD_SYSTEM)/base_rules.mk 4101faa644c81e90cfd226bb7e43cde68e309c10790dcashman 4115596172d23a799d4131f36822e8afe817f2cf017Alex Klyubin# nonplat_policy.conf - A combination of the non-platform private, vendor and 4125596172d23a799d4131f36822e8afe817f2cf017Alex Klyubin# the exported platform policy associated with the version the non-platform 4135596172d23a799d4131f36822e8afe817f2cf017Alex Klyubin# policy targets. This needs attributization and to be combined with the 4142e00e6373faa6271d7839d33c5b9e69d998ff020dcashman# platform-provided policy. Like plat_pub_policy.conf, this needs to make use 4152e00e6373faa6271d7839d33c5b9e69d998ff020dcashman# of the reqd_policy_mask files from private policy in order to use checkpolicy. 4162e00e6373faa6271d7839d33c5b9e69d998ff020dcashmannonplat_policy.conf := $(intermediates)/nonplat_policy.conf 4172e00e6373faa6271d7839d33c5b9e69d998ff020dcashman$(nonplat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS) 4182e00e6373faa6271d7839d33c5b9e69d998ff020dcashman$(nonplat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS) 4191c0402779552e497900db0a649068019ce023dfbDan Cashman$(nonplat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch) 4207443484831a858848d71b95c3e9fa4e96dcbf830Jeff Vander Stoep$(nonplat_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) 4212e00e6373faa6271d7839d33c5b9e69d998ff020dcashman$(nonplat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) 4222e00e6373faa6271d7839d33c5b9e69d998ff020dcashman$(nonplat_policy.conf): $(call build_policy, $(sepolicy_build_files), \ 4236bf50e5c14a45088680ba5af971bf08657c343f5Dan Cashman$(PLAT_PUBLIC_POLICY) $(REQD_MASK_POLICY) $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS)) 42402fb5f3c6abbb7f12c278a04966314d06f6378e3Ying Wang @mkdir -p $(dir $@) 425d21855824d178abea9ac93376757c7aed765cd83William Roberts $(hide) m4 $(PRIVATE_ADDITIONAL_M4DEFS) \ 426d21855824d178abea9ac93376757c7aed765cd83William Roberts -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \ 427623975fa5aece708032aaf29689d73e1f3a615e7Nick Kralevich -D target_build_variant=$(TARGET_BUILD_VARIANT) \ 42884db84e6cdc6a04ac85fb4413c813412c0dea600Jorge Lucangeli Obes -D target_with_dexpreopt=$(WITH_DEXPREOPT) \ 4291c0402779552e497900db0a649068019ce023dfbDan Cashman -D target_arch=$(PRIVATE_TGT_ARCH) \ 4307443484831a858848d71b95c3e9fa4e96dcbf830Jeff Vander Stoep -D target_with_asan=$(PRIVATE_TGT_WITH_ASAN) \ 431f5446eb1486816c00136b2b5f0a3cc4a01706000Alex Klyubin -D target_full_treble=$(PRODUCT_FULL_TREBLE) \ 432623975fa5aece708032aaf29689d73e1f3a615e7Nick Kralevich -s $^ > $@ 43365d4f44c1fd999d9cf9c4ef4dc65deb71bafcd8eRobert Craig $(hide) sed '/dontaudit/d' $@ > $@.dontaudit 43402fb5f3c6abbb7f12c278a04966314d06f6378e3Ying Wang 4351faa644c81e90cfd226bb7e43cde68e309c10790dcashmannonplat_policy_raw := $(intermediates)/nonplat_policy_raw.cil 4361faa644c81e90cfd226bb7e43cde68e309c10790dcashman$(nonplat_policy_raw): PRIVATE_POL_CONF := $(nonplat_policy.conf) 4371faa644c81e90cfd226bb7e43cde68e309c10790dcashman$(nonplat_policy_raw): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil) 4381faa644c81e90cfd226bb7e43cde68e309c10790dcashman$(nonplat_policy_raw): $(HOST_OUT_EXECUTABLES)/checkpolicy $(nonplat_policy.conf) \ 4391faa644c81e90cfd226bb7e43cde68e309c10790dcashman$(reqd_policy_mask.cil) 44002fb5f3c6abbb7f12c278a04966314d06f6378e3Ying Wang @mkdir -p $(dir $@) 4411faa644c81e90cfd226bb7e43cde68e309c10790dcashman $(hide) $< -C -M -c $(POLICYVERS) -o $@.tmp $(PRIVATE_POL_CONF) 4421faa644c81e90cfd226bb7e43cde68e309c10790dcashman $(hide) grep -Fxv -f $(PRIVATE_REQD_MASK) $@.tmp > $@ 4432e00e6373faa6271d7839d33c5b9e69d998ff020dcashman 444b87876937b8ed73063fd44800beb86f3dd7079beJeff Vander Stoep$(LOCAL_BUILT_MODULE) : PRIVATE_VERS := $(BOARD_SEPOLICY_VERS) 445b87876937b8ed73063fd44800beb86f3dd7079beJeff Vander Stoep$(LOCAL_BUILT_MODULE) : PRIVATE_TGT_POL := $(nonplat_policy_raw) 446b87876937b8ed73063fd44800beb86f3dd7079beJeff Vander Stoep$(LOCAL_BUILT_MODULE) : PRIVATE_DEP_CIL_FILES := $(built_plat_cil) $(built_mapping_cil) 447b87876937b8ed73063fd44800beb86f3dd7079beJeff Vander Stoep$(LOCAL_BUILT_MODULE) : $(plat_pub_policy.cil) $(nonplat_policy_raw) \ 448b87876937b8ed73063fd44800beb86f3dd7079beJeff Vander Stoep$(HOST_OUT_EXECUTABLES)/version_policy $(HOST_OUT_EXECUTABLES)/secilc \ 4495edd96d915ef98dc92f21bd303bca5ee82b0f54aJeff Vander Stoep$(built_plat_cil) $(built_mapping_cil) 4502e00e6373faa6271d7839d33c5b9e69d998ff020dcashman @mkdir -p $(dir $@) 4512e00e6373faa6271d7839d33c5b9e69d998ff020dcashman $(HOST_OUT_EXECUTABLES)/version_policy -b $< -t $(PRIVATE_TGT_POL) -n $(PRIVATE_VERS) -o $@ 452b87876937b8ed73063fd44800beb86f3dd7079beJeff Vander Stoep $(hide) $(HOST_OUT_EXECUTABLES)/secilc -M true -G -N -c $(POLICYVERS) \ 4538f7173b01601040ae17810d07dea37a895f94dddAlex Klyubin $(PRIVATE_DEP_CIL_FILES) $@ -o /dev/null -f /dev/null 4542e00e6373faa6271d7839d33c5b9e69d998ff020dcashman 455193dccda7922e3cfdcbbd19da93960335ca0d224Alex Klyubinbuilt_nonplat_cil := $(LOCAL_BUILT_MODULE) 4561faa644c81e90cfd226bb7e43cde68e309c10790dcashmannonplat_policy.conf := 4571faa644c81e90cfd226bb7e43cde68e309c10790dcashmannonplat_policy_raw := 4581faa644c81e90cfd226bb7e43cde68e309c10790dcashman 4591faa644c81e90cfd226bb7e43cde68e309c10790dcashman################################# 4601faa644c81e90cfd226bb7e43cde68e309c10790dcashmaninclude $(CLEAR_VARS) 461193dccda7922e3cfdcbbd19da93960335ca0d224Alex Klyubin 462193dccda7922e3cfdcbbd19da93960335ca0d224Alex KlyubinLOCAL_MODULE := precompiled_sepolicy 463193dccda7922e3cfdcbbd19da93960335ca0d224Alex KlyubinLOCAL_MODULE_CLASS := ETC 464193dccda7922e3cfdcbbd19da93960335ca0d224Alex KlyubinLOCAL_MODULE_TAGS := optional 465193dccda7922e3cfdcbbd19da93960335ca0d224Alex KlyubinLOCAL_PROPRIETARY_MODULE := true 466193dccda7922e3cfdcbbd19da93960335ca0d224Alex KlyubinLOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux 467193dccda7922e3cfdcbbd19da93960335ca0d224Alex Klyubin 468193dccda7922e3cfdcbbd19da93960335ca0d224Alex Klyubininclude $(BUILD_SYSTEM)/base_rules.mk 469193dccda7922e3cfdcbbd19da93960335ca0d224Alex Klyubin 470193dccda7922e3cfdcbbd19da93960335ca0d224Alex Klyubin$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := \ 471193dccda7922e3cfdcbbd19da93960335ca0d224Alex Klyubin$(built_plat_cil) $(built_mapping_cil) $(built_nonplat_cil) 472193dccda7922e3cfdcbbd19da93960335ca0d224Alex Klyubin$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc \ 473193dccda7922e3cfdcbbd19da93960335ca0d224Alex Klyubin$(built_plat_cil) $(built_mapping_cil) $(built_nonplat_cil) 474ac171b44372ad506fecf1cd0399db2fa9fd1289fJeff Vander Stoep $(hide) $(HOST_OUT_EXECUTABLES)/secilc -M true -G -c $(POLICYVERS) \ 475193dccda7922e3cfdcbbd19da93960335ca0d224Alex Klyubin $(PRIVATE_CIL_FILES) -o $@ -f /dev/null 476193dccda7922e3cfdcbbd19da93960335ca0d224Alex Klyubin 477193dccda7922e3cfdcbbd19da93960335ca0d224Alex Klyubinbuilt_precompiled_sepolicy := $(LOCAL_BUILT_MODULE) 478193dccda7922e3cfdcbbd19da93960335ca0d224Alex Klyubin 479193dccda7922e3cfdcbbd19da93960335ca0d224Alex Klyubin################################# 4800e9c47c0af92005ea81772e82663865f1a3572b3Dan Cashman# SHA-256 digest of the plat_sepolicy.cil and mapping_sepolicy.cil files against 4810e9c47c0af92005ea81772e82663865f1a3572b3Dan Cashman# which precompiled_policy was built. 482193dccda7922e3cfdcbbd19da93960335ca0d224Alex Klyubin################################# 483193dccda7922e3cfdcbbd19da93960335ca0d224Alex Klyubininclude $(CLEAR_VARS) 4840e9c47c0af92005ea81772e82663865f1a3572b3Dan CashmanLOCAL_MODULE := precompiled_sepolicy.plat_and_mapping.sha256 485193dccda7922e3cfdcbbd19da93960335ca0d224Alex KlyubinLOCAL_MODULE_CLASS := ETC 486193dccda7922e3cfdcbbd19da93960335ca0d224Alex KlyubinLOCAL_MODULE_TAGS := optional 487193dccda7922e3cfdcbbd19da93960335ca0d224Alex KlyubinLOCAL_PROPRIETARY_MODULE := true 488193dccda7922e3cfdcbbd19da93960335ca0d224Alex KlyubinLOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux 489193dccda7922e3cfdcbbd19da93960335ca0d224Alex Klyubin 490193dccda7922e3cfdcbbd19da93960335ca0d224Alex Klyubininclude $(BUILD_SYSTEM)/base_rules.mk 491193dccda7922e3cfdcbbd19da93960335ca0d224Alex Klyubin 4920e9c47c0af92005ea81772e82663865f1a3572b3Dan Cashman$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(built_plat_cil) $(built_mapping_cil) 4930e9c47c0af92005ea81772e82663865f1a3572b3Dan Cashman$(LOCAL_BUILT_MODULE): $(built_precompiled_sepolicy) $(built_plat_cil) $(built_mapping_cil) 4940e9c47c0af92005ea81772e82663865f1a3572b3Dan Cashman cat $(PRIVATE_CIL_FILES) | sha256sum | cut -d' ' -f1 > $@ 495193dccda7922e3cfdcbbd19da93960335ca0d224Alex Klyubin 496193dccda7922e3cfdcbbd19da93960335ca0d224Alex Klyubin################################# 497193dccda7922e3cfdcbbd19da93960335ca0d224Alex Klyubininclude $(CLEAR_VARS) 4981c0402779552e497900db0a649068019ce023dfbDan Cashman# build this target so that we can still perform neverallow checks 4991faa644c81e90cfd226bb7e43cde68e309c10790dcashman 5001faa644c81e90cfd226bb7e43cde68e309c10790dcashmanLOCAL_MODULE := sepolicy 5011faa644c81e90cfd226bb7e43cde68e309c10790dcashmanLOCAL_MODULE_CLASS := ETC 5021faa644c81e90cfd226bb7e43cde68e309c10790dcashmanLOCAL_MODULE_TAGS := optional 50365d01349a00e15a4bed55fc685e43b9058c480a4Daniel CashmanLOCAL_MODULE_PATH := $(TARGET_ROOT_OUT) 5042e00e6373faa6271d7839d33c5b9e69d998ff020dcashman 5051faa644c81e90cfd226bb7e43cde68e309c10790dcashmaninclude $(BUILD_SYSTEM)/base_rules.mk 5061faa644c81e90cfd226bb7e43cde68e309c10790dcashman 5072e00e6373faa6271d7839d33c5b9e69d998ff020dcashmanall_cil_files := \ 508b87876937b8ed73063fd44800beb86f3dd7079beJeff Vander Stoep $(built_plat_cil) \ 509b87876937b8ed73063fd44800beb86f3dd7079beJeff Vander Stoep $(built_mapping_cil) \ 510b87876937b8ed73063fd44800beb86f3dd7079beJeff Vander Stoep $(built_nonplat_cil) 5112e00e6373faa6271d7839d33c5b9e69d998ff020dcashman 5122e00e6373faa6271d7839d33c5b9e69d998ff020dcashman$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(all_cil_files) 5132e00e6373faa6271d7839d33c5b9e69d998ff020dcashman$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $(all_cil_files) 5142e00e6373faa6271d7839d33c5b9e69d998ff020dcashman @mkdir -p $(dir $@) 515748cae865d3aa1755c59b8cffbe4c1a7eb7ac363Jeff Vander Stoep $(hide) $< -M true -G -c $(POLICYVERS) $(PRIVATE_CIL_FILES) -o $@.tmp -f /dev/null 516bca98efa575bedab68f2d5eaee2cd1fd1741962bNick Kralevich $(hide) $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $@.tmp permissive > $@.permissivedomains 517bca98efa575bedab68f2d5eaee2cd1fd1741962bNick Kralevich $(hide) if [ "$(TARGET_BUILD_VARIANT)" = "user" -a -s $@.permissivedomains ]; then \ 518bca98efa575bedab68f2d5eaee2cd1fd1741962bNick Kralevich echo "==========" 1>&2; \ 519bca98efa575bedab68f2d5eaee2cd1fd1741962bNick Kralevich echo "ERROR: permissive domains not allowed in user builds" 1>&2; \ 520bca98efa575bedab68f2d5eaee2cd1fd1741962bNick Kralevich echo "List of invalid domains:" 1>&2; \ 521bca98efa575bedab68f2d5eaee2cd1fd1741962bNick Kralevich cat $@.permissivedomains 1>&2; \ 522bca98efa575bedab68f2d5eaee2cd1fd1741962bNick Kralevich exit 1; \ 523bca98efa575bedab68f2d5eaee2cd1fd1741962bNick Kralevich fi 524bca98efa575bedab68f2d5eaee2cd1fd1741962bNick Kralevich $(hide) mv $@.tmp $@ 52502fb5f3c6abbb7f12c278a04966314d06f6378e3Ying Wang 526d8b122c7bbe3a57620bee0a5c6bfcb8f7c574081Ying Wangbuilt_sepolicy := $(LOCAL_BUILT_MODULE) 5272e00e6373faa6271d7839d33c5b9e69d998ff020dcashmanall_cil_files := 52801a58af19494420bb259505bc5404790a21fdd64Stephen Smalley 52984aa74218421f8d2dbad1408ba114f680331ace0Alex Klyubin################################# 53084aa74218421f8d2dbad1408ba114f680331ace0Alex Klyubininclude $(CLEAR_VARS) 53184aa74218421f8d2dbad1408ba114f680331ace0Alex Klyubin 53284aa74218421f8d2dbad1408ba114f680331ace0Alex Klyubin# keep concrete sepolicy for neverallow checks 53384aa74218421f8d2dbad1408ba114f680331ace0Alex Klyubin 53484aa74218421f8d2dbad1408ba114f680331ace0Alex KlyubinLOCAL_MODULE := sepolicy.recovery 535ec78c377c006040d14d92f5b1a1a52da779f20aaAlex KlyubinLOCAL_MODULE_STEM := sepolicy 53684aa74218421f8d2dbad1408ba114f680331ace0Alex KlyubinLOCAL_MODULE_CLASS := ETC 53784aa74218421f8d2dbad1408ba114f680331ace0Alex KlyubinLOCAL_MODULE_TAGS := optional 538ec78c377c006040d14d92f5b1a1a52da779f20aaAlex KlyubinLOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT) 53984aa74218421f8d2dbad1408ba114f680331ace0Alex Klyubin 54084aa74218421f8d2dbad1408ba114f680331ace0Alex Klyubininclude $(BUILD_SYSTEM)/base_rules.mk 54184aa74218421f8d2dbad1408ba114f680331ace0Alex Klyubin 542c8d4535cc2a7691dd0a3562008a03a72b43f560cDan Cashmansepolicy.recovery.conf := $(intermediates)/sepolicy.recovery.conf 543c8d4535cc2a7691dd0a3562008a03a72b43f560cDan Cashman$(sepolicy.recovery.conf): PRIVATE_MLS_SENS := $(MLS_SENS) 544c8d4535cc2a7691dd0a3562008a03a72b43f560cDan Cashman$(sepolicy.recovery.conf): PRIVATE_MLS_CATS := $(MLS_CATS) 545c8d4535cc2a7691dd0a3562008a03a72b43f560cDan Cashman$(sepolicy.recovery.conf): PRIVATE_TGT_ARCH := $(my_target_arch) 546c8d4535cc2a7691dd0a3562008a03a72b43f560cDan Cashman$(sepolicy.recovery.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) 547c8d4535cc2a7691dd0a3562008a03a72b43f560cDan Cashman$(sepolicy.recovery.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) 548c8d4535cc2a7691dd0a3562008a03a72b43f560cDan Cashman$(sepolicy.recovery.conf): $(call build_policy, $(sepolicy_build_files), \ 549c8d4535cc2a7691dd0a3562008a03a72b43f560cDan Cashman $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) \ 550c8d4535cc2a7691dd0a3562008a03a72b43f560cDan Cashman $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS)) 5511c0402779552e497900db0a649068019ce023dfbDan Cashman @mkdir -p $(dir $@) 5521c0402779552e497900db0a649068019ce023dfbDan Cashman $(hide) m4 $(PRIVATE_ADDITIONAL_M4DEFS) \ 5531c0402779552e497900db0a649068019ce023dfbDan Cashman -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \ 5541c0402779552e497900db0a649068019ce023dfbDan Cashman -D target_build_variant=$(TARGET_BUILD_VARIANT) \ 5551c0402779552e497900db0a649068019ce023dfbDan Cashman -D target_with_dexpreopt=$(WITH_DEXPREOPT) \ 5561c0402779552e497900db0a649068019ce023dfbDan Cashman -D target_arch=$(PRIVATE_TGT_ARCH) \ 5577443484831a858848d71b95c3e9fa4e96dcbf830Jeff Vander Stoep -D target_with_asan=$(PRIVATE_TGT_WITH_ASAN) \ 5581c0402779552e497900db0a649068019ce023dfbDan Cashman -D target_recovery=true \ 5591c0402779552e497900db0a649068019ce023dfbDan Cashman -s $^ > $@ 5601c0402779552e497900db0a649068019ce023dfbDan Cashman $(hide) sed '/dontaudit/d' $@ > $@.dontaudit 5611c0402779552e497900db0a649068019ce023dfbDan Cashman 562c8d4535cc2a7691dd0a3562008a03a72b43f560cDan Cashman$(LOCAL_BUILT_MODULE): $(sepolicy.recovery.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \ 563c8d4535cc2a7691dd0a3562008a03a72b43f560cDan Cashman $(HOST_OUT_EXECUTABLES)/sepolicy-analyze 5641c0402779552e497900db0a649068019ce023dfbDan Cashman @mkdir -p $(dir $@) 565c8d4535cc2a7691dd0a3562008a03a72b43f560cDan Cashman $(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c $(POLICYVERS) -o $@.tmp $< 566bca98efa575bedab68f2d5eaee2cd1fd1741962bNick Kralevich $(hide) $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $@.tmp permissive > $@.permissivedomains 567bca98efa575bedab68f2d5eaee2cd1fd1741962bNick Kralevich $(hide) if [ "$(TARGET_BUILD_VARIANT)" = "user" -a -s $@.permissivedomains ]; then \ 568bca98efa575bedab68f2d5eaee2cd1fd1741962bNick Kralevich echo "==========" 1>&2; \ 569bca98efa575bedab68f2d5eaee2cd1fd1741962bNick Kralevich echo "ERROR: permissive domains not allowed in user builds" 1>&2; \ 570bca98efa575bedab68f2d5eaee2cd1fd1741962bNick Kralevich echo "List of invalid domains:" 1>&2; \ 571bca98efa575bedab68f2d5eaee2cd1fd1741962bNick Kralevich cat $@.permissivedomains 1>&2; \ 572bca98efa575bedab68f2d5eaee2cd1fd1741962bNick Kralevich exit 1; \ 573bca98efa575bedab68f2d5eaee2cd1fd1741962bNick Kralevich fi 574bca98efa575bedab68f2d5eaee2cd1fd1741962bNick Kralevich $(hide) mv $@.tmp $@ 575e60723ab59f48626c6a700ba645bfe5eac6f0fc3Stephen Smalley 576c8d4535cc2a7691dd0a3562008a03a72b43f560cDan Cashmansepolicy.recovery.conf := 577e60723ab59f48626c6a700ba645bfe5eac6f0fc3Stephen Smalley 578704741a5c24113b22a47bb854f20e2f2c607dd36dcashman################################## 579446279a6b9bcc9689c73c5e27f3f4757e1edd661Alex Klyubin# SELinux policy embedded into CTS. 580446279a6b9bcc9689c73c5e27f3f4757e1edd661Alex Klyubin# CTS checks neverallow rules of this policy against the policy of the device under test. 581446279a6b9bcc9689c73c5e27f3f4757e1edd661Alex Klyubin################################## 582704741a5c24113b22a47bb854f20e2f2c607dd36dcashmaninclude $(CLEAR_VARS) 583704741a5c24113b22a47bb854f20e2f2c607dd36dcashman 584704741a5c24113b22a47bb854f20e2f2c607dd36dcashmanLOCAL_MODULE := general_sepolicy.conf 585704741a5c24113b22a47bb854f20e2f2c607dd36dcashmanLOCAL_MODULE_CLASS := ETC 586704741a5c24113b22a47bb854f20e2f2c607dd36dcashmanLOCAL_MODULE_TAGS := tests 587704741a5c24113b22a47bb854f20e2f2c607dd36dcashman 588704741a5c24113b22a47bb854f20e2f2c607dd36dcashmaninclude $(BUILD_SYSTEM)/base_rules.mk 589704741a5c24113b22a47bb854f20e2f2c607dd36dcashman 590704741a5c24113b22a47bb854f20e2f2c607dd36dcashman$(LOCAL_BUILT_MODULE): PRIVATE_MLS_SENS := $(MLS_SENS) 591704741a5c24113b22a47bb854f20e2f2c607dd36dcashman$(LOCAL_BUILT_MODULE): PRIVATE_MLS_CATS := $(MLS_CATS) 5921c0402779552e497900db0a649068019ce023dfbDan Cashman$(LOCAL_BUILT_MODULE): PRIVATE_TGT_ARCH := $(my_target_arch) 593cc39f637734a8d84bc861b649bfd109290c06401dcashman$(LOCAL_BUILT_MODULE): $(call build_policy, $(sepolicy_build_files), \ 594cc39f637734a8d84bc861b649bfd109290c06401dcashman$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY)) 595704741a5c24113b22a47bb854f20e2f2c607dd36dcashman mkdir -p $(dir $@) 596704741a5c24113b22a47bb854f20e2f2c607dd36dcashman $(hide) m4 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \ 597704741a5c24113b22a47bb854f20e2f2c607dd36dcashman -D target_build_variant=user \ 59884db84e6cdc6a04ac85fb4413c813412c0dea600Jorge Lucangeli Obes -D target_with_dexpreopt=$(WITH_DEXPREOPT) \ 5991c0402779552e497900db0a649068019ce023dfbDan Cashman -D target_arch=$(PRIVATE_TGT_ARCH) \ 6007443484831a858848d71b95c3e9fa4e96dcbf830Jeff Vander Stoep -D target_with_asan=false \ 601446279a6b9bcc9689c73c5e27f3f4757e1edd661Alex Klyubin -D target_full_treble=cts \ 602704741a5c24113b22a47bb854f20e2f2c607dd36dcashman -s $^ > $@ 603704741a5c24113b22a47bb854f20e2f2c607dd36dcashman $(hide) sed '/dontaudit/d' $@ > $@.dontaudit 604704741a5c24113b22a47bb854f20e2f2c607dd36dcashman 605b876993f4ee25fb299b7521b0dc565248d3db2a6William Roberts################################## 606d225b6979db89959c272b4351fb05363a7a18ea7dcashman# TODO - remove this. Keep around until we get the filesystem creation stuff taken care of. 607d225b6979db89959c272b4351fb05363a7a18ea7dcashman# 608b876993f4ee25fb299b7521b0dc565248d3db2a6William Robertsinclude $(CLEAR_VARS) 609b876993f4ee25fb299b7521b0dc565248d3db2a6William Roberts 610c2d01914d12b1c153b5ef32293079764a4342169Richard HainesLOCAL_MODULE := file_contexts.bin 61102fb5f3c6abbb7f12c278a04966314d06f6378e3Ying WangLOCAL_MODULE_CLASS := ETC 61202fb5f3c6abbb7f12c278a04966314d06f6378e3Ying WangLOCAL_MODULE_TAGS := optional 61302fb5f3c6abbb7f12c278a04966314d06f6378e3Ying WangLOCAL_MODULE_PATH := $(TARGET_ROOT_OUT) 61402fb5f3c6abbb7f12c278a04966314d06f6378e3Ying Wang 6155b340befb4f964365c856606050254a65df909d1Stephen Smalleyinclude $(BUILD_SYSTEM)/base_rules.mk 61602fb5f3c6abbb7f12c278a04966314d06f6378e3Ying Wang 61749693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Roberts# The file_contexts.bin is built in the following way: 61849693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Roberts# 1. Collect all file_contexts files in THIS repository and process them with 61949693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Roberts# m4 into a tmp file called file_contexts.local.tmp. 62049693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Roberts# 2. Collect all device specific file_contexts files and process them with m4 62149693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Roberts# into a tmp file called file_contexts.device.tmp. 62249693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Roberts# 3. Run checkfc -e (allow no device fc entries ie empty) and fc_sort on 62349693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Roberts# file_contexts.device.tmp and output to file_contexts.device.sorted.tmp. 62449693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Roberts# 4. Concatenate file_contexts.local.tmp and file_contexts.device.tmp into 62549693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Roberts# file_contexts.concat.tmp. 62649693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Roberts# 5. Run checkfc and sefcontext_compile on file_contexts.concat.tmp to produce 62749693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Roberts# file_contexts.bin. 62849693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Roberts# 62949693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Roberts# Note: That a newline file is placed between each file_context file found to 63049693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Roberts# ensure a proper build when an fc file is missing an ending newline. 63149693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Roberts 6321b0a71f308a18ab31147ea34c692f4fe7f4d7066Dan Cashmanlocal_fc_files := $(call build_policy, file_contexts, $(PLAT_PRIVATE_POLICY)) 6331b0a71f308a18ab31147ea34c692f4fe7f4d7066Dan Cashman 6349aa413036bde2c80c25b381bd685ab05f8390127Ivan Krasinifneq ($(filter address,$(SANITIZE_TARGET)),) 6351b0a71f308a18ab31147ea34c692f4fe7f4d7066Dan Cashman local_fc_files := $(local_fc_files) $(wildcard $(addsuffix /file_contexts_asan, $(PLAT_PRIVATE_POLICY))) 636930304829b2cadd3c88876c6234af702d1e43bd5Evgenii Stepanovendif 63749693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Robertslocal_fcfiles_with_nl := $(call add_nl, $(local_fc_files), $(built_nl)) 63849693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Roberts 63949693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Robertsfile_contexts.local.tmp := $(intermediates)/file_contexts.local.tmp 64049693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Roberts$(file_contexts.local.tmp): $(local_fcfiles_with_nl) 64149693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Roberts @mkdir -p $(dir $@) 64249693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Roberts $(hide) m4 -s $^ > $@ 64349693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Roberts 64449693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Robertsdevice_fc_files := $(call build_device_policy, file_contexts) 64549693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Robertsdevice_fcfiles_with_nl := $(call add_nl, $(device_fc_files), $(built_nl)) 64649693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Roberts 64749693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Robertsfile_contexts.device.tmp := $(intermediates)/file_contexts.device.tmp 64849693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Roberts$(file_contexts.device.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) 64949693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Roberts$(file_contexts.device.tmp): $(device_fcfiles_with_nl) 65049693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Roberts @mkdir -p $(dir $@) 65149693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Roberts $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@ 65249693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Roberts 65349693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Robertsfile_contexts.device.sorted.tmp := $(intermediates)/file_contexts.device.sorted.tmp 65449693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Roberts$(file_contexts.device.sorted.tmp): PRIVATE_SEPOLICY := $(built_sepolicy) 65549693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Roberts$(file_contexts.device.sorted.tmp): $(file_contexts.device.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/fc_sort $(HOST_OUT_EXECUTABLES)/checkfc 65649693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Roberts @mkdir -p $(dir $@) 65707791558051d0ffbbb6ac015cd4f195455695523dcashman $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e $(PRIVATE_SEPOLICY) $< 65849693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Roberts $(hide) $(HOST_OUT_EXECUTABLES)/fc_sort $< $@ 65901a58af19494420bb259505bc5404790a21fdd64Stephen Smalley 66049693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Robertsfile_contexts.concat.tmp := $(intermediates)/file_contexts.concat.tmp 66149693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Roberts$(file_contexts.concat.tmp): $(file_contexts.local.tmp) $(file_contexts.device.sorted.tmp) 6625b340befb4f964365c856606050254a65df909d1Stephen Smalley @mkdir -p $(dir $@) 66349693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Roberts $(hide) m4 -s $^ > $@ 66402fb5f3c6abbb7f12c278a04966314d06f6378e3Ying Wang 6653746a0ae63a56a6b18fabd3e89bfe4760a1691e3William Roberts$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) 66649693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Roberts$(LOCAL_BUILT_MODULE): $(file_contexts.concat.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/sefcontext_compile $(HOST_OUT_EXECUTABLES)/checkfc 667c2d01914d12b1c153b5ef32293079764a4342169Richard Haines @mkdir -p $(dir $@) 66807791558051d0ffbbb6ac015cd4f195455695523dcashman $(hide) $(HOST_OUT_EXECUTABLES)/checkfc $(PRIVATE_SEPOLICY) $< 669c2d01914d12b1c153b5ef32293079764a4342169Richard Haines $(hide) $(HOST_OUT_EXECUTABLES)/sefcontext_compile -o $@ $< 670c2d01914d12b1c153b5ef32293079764a4342169Richard Haines 6718b7545bf5745e1e0aba55b0334de40d2334728b1Robert Craigbuilt_fc := $(LOCAL_BUILT_MODULE) 67249693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Robertslocal_fc_files := 67349693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Robertslocal_fcfiles_with_nl := 67449693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Robertsdevice_fc_files := 67549693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Robertsdevice_fcfiles_with_nl := 67649693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Robertsfile_contexts.concat.tmp := 67749693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Robertsfile_contexts.device.sorted.tmp := 67849693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Robertsfile_contexts.device.tmp := 67949693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Robertsfile_contexts.local.tmp := 680171a06257124401af2e7c33fbbcbc69c18e45486William Roberts 68102fb5f3c6abbb7f12c278a04966314d06f6378e3Ying Wang################################## 68202fb5f3c6abbb7f12c278a04966314d06f6378e3Ying Wanginclude $(CLEAR_VARS) 6832e0cd5ad36321fd7a8f21768dac080d09b658920Stephen Smalley 684d225b6979db89959c272b4351fb05363a7a18ea7dcashmanLOCAL_MODULE := plat_file_contexts 6852e0cd5ad36321fd7a8f21768dac080d09b658920Stephen SmalleyLOCAL_MODULE_CLASS := ETC 686d225b6979db89959c272b4351fb05363a7a18ea7dcashmanLOCAL_MODULE_TAGS := optional 6877a68c5ae4ca81778f222c2817b698463878e5700Jeff Vander Stoepifeq ($(PRODUCT_FULL_TREBLE),true) 6880cb417a6392c63e9670c2718fcb5e2f485d9baa4Jeff Vander StoepLOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux 6897a68c5ae4ca81778f222c2817b698463878e5700Jeff Vander Stoepelse 6907a68c5ae4ca81778f222c2817b698463878e5700Jeff Vander StoepLOCAL_MODULE_PATH := $(TARGET_ROOT_OUT) 6917a68c5ae4ca81778f222c2817b698463878e5700Jeff Vander Stoependif 6922e0cd5ad36321fd7a8f21768dac080d09b658920Stephen Smalley 6932e0cd5ad36321fd7a8f21768dac080d09b658920Stephen Smalleyinclude $(BUILD_SYSTEM)/base_rules.mk 6942e0cd5ad36321fd7a8f21768dac080d09b658920Stephen Smalley 6951b0a71f308a18ab31147ea34c692f4fe7f4d7066Dan Cashmanlocal_fc_files := $(call build_policy, file_contexts, $(PLAT_PRIVATE_POLICY)) 696d225b6979db89959c272b4351fb05363a7a18ea7dcashmanifneq ($(filter address,$(SANITIZE_TARGET)),) 6971b0a71f308a18ab31147ea34c692f4fe7f4d7066Dan Cashman local_fc_files += $(wildcard $(addsuffix /file_contexts_asan, $(PLAT_PRIVATE_POLICY))) 698d225b6979db89959c272b4351fb05363a7a18ea7dcashmanendif 699e4665d7f85c7ee550f24d1799c09eb87a229b5c9Alex Klyubinlocal_fcfiles_with_nl := $(call add_nl, $(local_fc_files), $(built_nl)) 700d225b6979db89959c272b4351fb05363a7a18ea7dcashman 701e4665d7f85c7ee550f24d1799c09eb87a229b5c9Alex Klyubin$(LOCAL_BUILT_MODULE): PRIVATE_FC_FILES := $(local_fcfiles_with_nl) 702d225b6979db89959c272b4351fb05363a7a18ea7dcashman$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) 703e4665d7f85c7ee550f24d1799c09eb87a229b5c9Alex Klyubin$(LOCAL_BUILT_MODULE): PRIVATE_FC_SORT := $(HOST_OUT_EXECUTABLES)/fc_sort 704e4665d7f85c7ee550f24d1799c09eb87a229b5c9Alex Klyubin$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/checkfc $(HOST_OUT_EXECUTABLES)/fc_sort \ 705e4665d7f85c7ee550f24d1799c09eb87a229b5c9Alex Klyubin$(local_fcfiles_with_nl) $(built_sepolicy) 7062e0cd5ad36321fd7a8f21768dac080d09b658920Stephen Smalley @mkdir -p $(dir $@) 707e4665d7f85c7ee550f24d1799c09eb87a229b5c9Alex Klyubin $(hide) m4 -s $(PRIVATE_FC_FILES) > $@.tmp 708e4665d7f85c7ee550f24d1799c09eb87a229b5c9Alex Klyubin $(hide) $< $(PRIVATE_SEPOLICY) $@.tmp 709e4665d7f85c7ee550f24d1799c09eb87a229b5c9Alex Klyubin $(hide) $(PRIVATE_FC_SORT) $@.tmp $@ 7102e0cd5ad36321fd7a8f21768dac080d09b658920Stephen Smalley 711d225b6979db89959c272b4351fb05363a7a18ea7dcashmanbuilt_plat_fc := $(LOCAL_BUILT_MODULE) 712d225b6979db89959c272b4351fb05363a7a18ea7dcashmanlocal_fc_files := 713e4665d7f85c7ee550f24d1799c09eb87a229b5c9Alex Klyubinlocal_fcfiles_with_nl := 714d225b6979db89959c272b4351fb05363a7a18ea7dcashman 715d225b6979db89959c272b4351fb05363a7a18ea7dcashman################################## 716d225b6979db89959c272b4351fb05363a7a18ea7dcashmaninclude $(CLEAR_VARS) 717d225b6979db89959c272b4351fb05363a7a18ea7dcashman 718d225b6979db89959c272b4351fb05363a7a18ea7dcashmanLOCAL_MODULE := nonplat_file_contexts 719d225b6979db89959c272b4351fb05363a7a18ea7dcashmanLOCAL_MODULE_CLASS := ETC 720d225b6979db89959c272b4351fb05363a7a18ea7dcashmanLOCAL_MODULE_TAGS := optional 7217a68c5ae4ca81778f222c2817b698463878e5700Jeff Vander Stoepifeq ($(PRODUCT_FULL_TREBLE),true) 7220cb417a6392c63e9670c2718fcb5e2f485d9baa4Jeff Vander StoepLOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux 7237a68c5ae4ca81778f222c2817b698463878e5700Jeff Vander Stoepelse 7247a68c5ae4ca81778f222c2817b698463878e5700Jeff Vander StoepLOCAL_MODULE_PATH := $(TARGET_ROOT_OUT) 7257a68c5ae4ca81778f222c2817b698463878e5700Jeff Vander Stoependif 726d225b6979db89959c272b4351fb05363a7a18ea7dcashman 727d225b6979db89959c272b4351fb05363a7a18ea7dcashmaninclude $(BUILD_SYSTEM)/base_rules.mk 728d225b6979db89959c272b4351fb05363a7a18ea7dcashman 729d225b6979db89959c272b4351fb05363a7a18ea7dcashmannonplat_fc_files := $(call build_device_policy, file_contexts) 730d225b6979db89959c272b4351fb05363a7a18ea7dcashmannonplat_fcfiles_with_nl := $(call add_nl, $(nonplat_fc_files), $(built_nl)) 731d225b6979db89959c272b4351fb05363a7a18ea7dcashman 732d225b6979db89959c272b4351fb05363a7a18ea7dcashman$(LOCAL_BUILT_MODULE): PRIVATE_FC_FILES := $(nonplat_fcfiles_with_nl) 733d225b6979db89959c272b4351fb05363a7a18ea7dcashman$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) 734d225b6979db89959c272b4351fb05363a7a18ea7dcashman$(LOCAL_BUILT_MODULE): PRIVATE_FC_SORT := $(HOST_OUT_EXECUTABLES)/fc_sort 735d225b6979db89959c272b4351fb05363a7a18ea7dcashman$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/checkfc $(HOST_OUT_EXECUTABLES)/fc_sort \ 736e4665d7f85c7ee550f24d1799c09eb87a229b5c9Alex Klyubin$(nonplat_fcfiles_with_nl) $(built_sepolicy) 737c2d01914d12b1c153b5ef32293079764a4342169Richard Haines @mkdir -p $(dir $@) 738d225b6979db89959c272b4351fb05363a7a18ea7dcashman $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_FC_FILES) > $@.tmp 739d225b6979db89959c272b4351fb05363a7a18ea7dcashman $(hide) $< $(PRIVATE_SEPOLICY) $@.tmp 740d225b6979db89959c272b4351fb05363a7a18ea7dcashman $(hide) $(PRIVATE_FC_SORT) $@.tmp $@ 741c2d01914d12b1c153b5ef32293079764a4342169Richard Haines 742d225b6979db89959c272b4351fb05363a7a18ea7dcashmanbuilt_nonplat_fc := $(LOCAL_BUILT_MODULE) 743d225b6979db89959c272b4351fb05363a7a18ea7dcashmannonplat_fc_files := 744d225b6979db89959c272b4351fb05363a7a18ea7dcashmannonplat_fcfiles_with_nl := 7452e0cd5ad36321fd7a8f21768dac080d09b658920Stephen Smalley 746b236eb6ca204cefcb926e19bd5682f9dcad4021dJeff Vander Stoep################################## 747b236eb6ca204cefcb926e19bd5682f9dcad4021dJeff Vander Stoepinclude $(CLEAR_VARS) 748b236eb6ca204cefcb926e19bd5682f9dcad4021dJeff Vander Stoep 749b236eb6ca204cefcb926e19bd5682f9dcad4021dJeff Vander StoepLOCAL_MODULE := plat_file_contexts.recovery 750b236eb6ca204cefcb926e19bd5682f9dcad4021dJeff Vander StoepLOCAL_MODULE_STEM := plat_file_contexts 751b236eb6ca204cefcb926e19bd5682f9dcad4021dJeff Vander StoepLOCAL_MODULE_CLASS := ETC 752b236eb6ca204cefcb926e19bd5682f9dcad4021dJeff Vander StoepLOCAL_MODULE_TAGS := optional 753b236eb6ca204cefcb926e19bd5682f9dcad4021dJeff Vander StoepLOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT) 754b236eb6ca204cefcb926e19bd5682f9dcad4021dJeff Vander Stoep 755b236eb6ca204cefcb926e19bd5682f9dcad4021dJeff Vander Stoepinclude $(BUILD_SYSTEM)/base_rules.mk 756b236eb6ca204cefcb926e19bd5682f9dcad4021dJeff Vander Stoep 757b236eb6ca204cefcb926e19bd5682f9dcad4021dJeff Vander Stoep$(LOCAL_BUILT_MODULE): $(built_plat_fc) 758b236eb6ca204cefcb926e19bd5682f9dcad4021dJeff Vander Stoep $(hide) cp -f $< $@ 759b236eb6ca204cefcb926e19bd5682f9dcad4021dJeff Vander Stoep 760b236eb6ca204cefcb926e19bd5682f9dcad4021dJeff Vander Stoep################################## 761b236eb6ca204cefcb926e19bd5682f9dcad4021dJeff Vander Stoepinclude $(CLEAR_VARS) 762b236eb6ca204cefcb926e19bd5682f9dcad4021dJeff Vander StoepLOCAL_MODULE := nonplat_file_contexts.recovery 763b236eb6ca204cefcb926e19bd5682f9dcad4021dJeff Vander StoepLOCAL_MODULE_STEM := nonplat_file_contexts 764b236eb6ca204cefcb926e19bd5682f9dcad4021dJeff Vander StoepLOCAL_MODULE_CLASS := ETC 765b236eb6ca204cefcb926e19bd5682f9dcad4021dJeff Vander StoepLOCAL_MODULE_TAGS := optional 766b236eb6ca204cefcb926e19bd5682f9dcad4021dJeff Vander StoepLOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT) 767b236eb6ca204cefcb926e19bd5682f9dcad4021dJeff Vander Stoep 768b236eb6ca204cefcb926e19bd5682f9dcad4021dJeff Vander Stoepinclude $(BUILD_SYSTEM)/base_rules.mk 769b236eb6ca204cefcb926e19bd5682f9dcad4021dJeff Vander Stoep 770b236eb6ca204cefcb926e19bd5682f9dcad4021dJeff Vander Stoep$(LOCAL_BUILT_MODULE): $(built_nonplat_fc) 771b236eb6ca204cefcb926e19bd5682f9dcad4021dJeff Vander Stoep $(hide) cp -f $< $@ 772b236eb6ca204cefcb926e19bd5682f9dcad4021dJeff Vander Stoep 7732e0cd5ad36321fd7a8f21768dac080d09b658920Stephen Smalley################################## 7742e0cd5ad36321fd7a8f21768dac080d09b658920Stephen Smalleyinclude $(CLEAR_VARS) 7759c038072231ea475cf0dc7a378f930e9b06e8dacDan CashmanLOCAL_MODULE := plat_seapp_contexts 77602fb5f3c6abbb7f12c278a04966314d06f6378e3Ying WangLOCAL_MODULE_CLASS := ETC 77702fb5f3c6abbb7f12c278a04966314d06f6378e3Ying WangLOCAL_MODULE_TAGS := optional 7784e3a4c7b21f48eec2413d20e317d7d41d3fb0c0fJeff Vander Stoepifeq ($(PRODUCT_FULL_TREBLE),true) 7794e3a4c7b21f48eec2413d20e317d7d41d3fb0c0fJeff Vander StoepLOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux 7804e3a4c7b21f48eec2413d20e317d7d41d3fb0c0fJeff Vander Stoepelse 78102fb5f3c6abbb7f12c278a04966314d06f6378e3Ying WangLOCAL_MODULE_PATH := $(TARGET_ROOT_OUT) 7824e3a4c7b21f48eec2413d20e317d7d41d3fb0c0fJeff Vander Stoependif 78302fb5f3c6abbb7f12c278a04966314d06f6378e3Ying Wang 784171a06257124401af2e7c33fbbcbc69c18e45486William Robertsinclude $(BUILD_SYSTEM)/base_rules.mk 785171a06257124401af2e7c33fbbcbc69c18e45486William Roberts 7869c038072231ea475cf0dc7a378f930e9b06e8dacDan Cashmanplat_sc_files := $(call build_policy, seapp_contexts, $(PLAT_PRIVATE_POLICY)) 787171a06257124401af2e7c33fbbcbc69c18e45486William Roberts 788d8b122c7bbe3a57620bee0a5c6bfcb8f7c574081Ying Wang$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) 7899c038072231ea475cf0dc7a378f930e9b06e8dacDan Cashman$(LOCAL_BUILT_MODULE): PRIVATE_SC_FILES := $(plat_sc_files) 7909c038072231ea475cf0dc7a378f930e9b06e8dacDan Cashman$(LOCAL_BUILT_MODULE): $(built_sepolicy) $(plat_sc_files) $(HOST_OUT_EXECUTABLES)/checkseapp 791f0e0a94e032e55c13bc54f1cffe243f04872278eWilliam Roberts @mkdir -p $(dir $@) 79299fe8df245f4346c14a3dfaf856006c7ebf51ad2William Roberts $(hide) $(HOST_OUT_EXECUTABLES)/checkseapp -p $(PRIVATE_SEPOLICY) -o $@ $(PRIVATE_SC_FILES) 79302fb5f3c6abbb7f12c278a04966314d06f6378e3Ying Wang 7949c038072231ea475cf0dc7a378f930e9b06e8dacDan Cashmanbuilt_plat_sc := $(LOCAL_BUILT_MODULE) 7959c038072231ea475cf0dc7a378f930e9b06e8dacDan Cashmanplat_sc_files := 7968b7545bf5745e1e0aba55b0334de40d2334728b1Robert Craig 79702fb5f3c6abbb7f12c278a04966314d06f6378e3Ying Wang################################## 798124720a6976a69357522299afbe5591854e40775Stephen Smalleyinclude $(CLEAR_VARS) 7999c038072231ea475cf0dc7a378f930e9b06e8dacDan CashmanLOCAL_MODULE := nonplat_seapp_contexts 800377128778d2d2055044c8f4a65e7b0097ab59fd4Stephen SmalleyLOCAL_MODULE_CLASS := ETC 8019c038072231ea475cf0dc7a378f930e9b06e8dacDan CashmanLOCAL_MODULE_TAGS := optional 8024e3a4c7b21f48eec2413d20e317d7d41d3fb0c0fJeff Vander Stoepifeq ($(PRODUCT_FULL_TREBLE),true) 8034e3a4c7b21f48eec2413d20e317d7d41d3fb0c0fJeff Vander StoepLOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux 8044e3a4c7b21f48eec2413d20e317d7d41d3fb0c0fJeff Vander Stoepelse 8059c038072231ea475cf0dc7a378f930e9b06e8dacDan CashmanLOCAL_MODULE_PATH := $(TARGET_ROOT_OUT) 8064e3a4c7b21f48eec2413d20e317d7d41d3fb0c0fJeff Vander Stoependif 807377128778d2d2055044c8f4a65e7b0097ab59fd4Stephen Smalley 808377128778d2d2055044c8f4a65e7b0097ab59fd4Stephen Smalleyinclude $(BUILD_SYSTEM)/base_rules.mk 809377128778d2d2055044c8f4a65e7b0097ab59fd4Stephen Smalley 8105596172d23a799d4131f36822e8afe817f2cf017Alex Klyubinnonplat_sc_files := $(call build_policy, seapp_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY)) 8111b0a71f308a18ab31147ea34c692f4fe7f4d7066Dan Cashmanplat_sc_neverallow_files := $(call build_policy, seapp_contexts, $(PLAT_PRIVATE_POLICY)) 812377128778d2d2055044c8f4a65e7b0097ab59fd4Stephen Smalley 8139c038072231ea475cf0dc7a378f930e9b06e8dacDan Cashman$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) 8149c038072231ea475cf0dc7a378f930e9b06e8dacDan Cashman$(LOCAL_BUILT_MODULE): PRIVATE_SC_FILES := $(nonplat_sc_files) 81587ae5f7dbd894ad72da05bae6f3381c0eae190b7Jeff Vander Stoep$(LOCAL_BUILT_MODULE): PRIVATE_SC_NEVERALLOW_FILES := $(plat_sc_neverallow_files) 81687ae5f7dbd894ad72da05bae6f3381c0eae190b7Jeff Vander Stoep$(LOCAL_BUILT_MODULE): $(built_sepolicy) $(nonplat_sc_files) $(HOST_OUT_EXECUTABLES)/checkseapp $(plat_sc_neverallow_files) 817377128778d2d2055044c8f4a65e7b0097ab59fd4Stephen Smalley @mkdir -p $(dir $@) 818ec6f393d0761c04fa9783ba7b176cc61b72be2feXin Li $(hide) grep -ie '^neverallow' $(PRIVATE_SC_NEVERALLOW_FILES) > $@.tmp 819ec6f393d0761c04fa9783ba7b176cc61b72be2feXin Li $(hide) $(HOST_OUT_EXECUTABLES)/checkseapp -p $(PRIVATE_SEPOLICY) -o $@ $(PRIVATE_SC_FILES) $@.tmp 820377128778d2d2055044c8f4a65e7b0097ab59fd4Stephen Smalley 8219c038072231ea475cf0dc7a378f930e9b06e8dacDan Cashmanbuilt_nonplat_sc := $(LOCAL_BUILT_MODULE) 8229c038072231ea475cf0dc7a378f930e9b06e8dacDan Cashmannonplat_sc_files := 823377128778d2d2055044c8f4a65e7b0097ab59fd4Stephen Smalley 824377128778d2d2055044c8f4a65e7b0097ab59fd4Stephen Smalley################################## 825377128778d2d2055044c8f4a65e7b0097ab59fd4Stephen Smalleyinclude $(CLEAR_VARS) 8269c038072231ea475cf0dc7a378f930e9b06e8dacDan CashmanLOCAL_MODULE := plat_seapp_neverallows 8274ee7131ade43a046ad784a91bdded7c3c77206cdWilliam RobertsLOCAL_MODULE_CLASS := ETC 8284ee7131ade43a046ad784a91bdded7c3c77206cdWilliam RobertsLOCAL_MODULE_TAGS := tests 8294ee7131ade43a046ad784a91bdded7c3c77206cdWilliam Roberts 8304ee7131ade43a046ad784a91bdded7c3c77206cdWilliam Robertsinclude $(BUILD_SYSTEM)/base_rules.mk 8314ee7131ade43a046ad784a91bdded7c3c77206cdWilliam Roberts 83287ae5f7dbd894ad72da05bae6f3381c0eae190b7Jeff Vander Stoep$(LOCAL_BUILT_MODULE): $(plat_sc_neverallow_files) 8334ee7131ade43a046ad784a91bdded7c3c77206cdWilliam Roberts @mkdir -p $(dir $@) 8344ee7131ade43a046ad784a91bdded7c3c77206cdWilliam Roberts - $(hide) grep -ie '^neverallow' $< > $@ 8354ee7131ade43a046ad784a91bdded7c3c77206cdWilliam Roberts 83687ae5f7dbd894ad72da05bae6f3381c0eae190b7Jeff Vander Stoepplat_sc_neverallow_files := 8374ee7131ade43a046ad784a91bdded7c3c77206cdWilliam Roberts 8384ee7131ade43a046ad784a91bdded7c3c77206cdWilliam Roberts################################## 8394ee7131ade43a046ad784a91bdded7c3c77206cdWilliam Robertsinclude $(CLEAR_VARS) 840124720a6976a69357522299afbe5591854e40775Stephen Smalley 841a86316e85215de0e8bcd9920035af1a2d1f5a4ccSandeep PatilLOCAL_MODULE := plat_property_contexts 842124720a6976a69357522299afbe5591854e40775Stephen SmalleyLOCAL_MODULE_CLASS := ETC 843124720a6976a69357522299afbe5591854e40775Stephen SmalleyLOCAL_MODULE_TAGS := optional 8449d59041f63b22f3d1b59faa9afeb5bf2a02e3e17Alex Klyubin 8459d59041f63b22f3d1b59faa9afeb5bf2a02e3e17Alex Klyubinifeq ($(PRODUCT_FULL_TREBLE),true) 8469d59041f63b22f3d1b59faa9afeb5bf2a02e3e17Alex KlyubinLOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux 8479d59041f63b22f3d1b59faa9afeb5bf2a02e3e17Alex Klyubinelse 848124720a6976a69357522299afbe5591854e40775Stephen SmalleyLOCAL_MODULE_PATH := $(TARGET_ROOT_OUT) 8499d59041f63b22f3d1b59faa9afeb5bf2a02e3e17Alex Klyubinendif 850124720a6976a69357522299afbe5591854e40775Stephen Smalley 851124720a6976a69357522299afbe5591854e40775Stephen Smalleyinclude $(BUILD_SYSTEM)/base_rules.mk 852124720a6976a69357522299afbe5591854e40775Stephen Smalley 853a86316e85215de0e8bcd9920035af1a2d1f5a4ccSandeep Patilplat_pcfiles := $(call build_policy, property_contexts, $(PLAT_PRIVATE_POLICY)) 8546aabc1c77b98d0ce8e13871047504afb90108733William Roberts 855a86316e85215de0e8bcd9920035af1a2d1f5a4ccSandeep Patilplat_property_contexts.tmp := $(intermediates)/plat_property_contexts.tmp 856a86316e85215de0e8bcd9920035af1a2d1f5a4ccSandeep Patil$(plat_property_contexts.tmp): PRIVATE_PC_FILES := $(plat_pcfiles) 857a86316e85215de0e8bcd9920035af1a2d1f5a4ccSandeep Patil$(plat_property_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) 858a86316e85215de0e8bcd9920035af1a2d1f5a4ccSandeep Patil$(plat_property_contexts.tmp): $(plat_pcfiles) 859dcffd2b482a625a99233d82019d7b96919c41600William Roberts @mkdir -p $(dir $@) 860dcffd2b482a625a99233d82019d7b96919c41600William Roberts $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_PC_FILES) > $@ 861d98d26ef3c1fe9b44497ed4e2a1fcf66505092baRobert Craig$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) 862a86316e85215de0e8bcd9920035af1a2d1f5a4ccSandeep Patil$(LOCAL_BUILT_MODULE): $(plat_property_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc 863124720a6976a69357522299afbe5591854e40775Stephen Smalley @mkdir -p $(dir $@) 864a86316e85215de0e8bcd9920035af1a2d1f5a4ccSandeep Patil $(hide) sed -e 's/#.*$$//' -e '/^$$/d' $< | sort -u -o $@ 86507791558051d0ffbbb6ac015cd4f195455695523dcashman $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -p $(PRIVATE_SEPOLICY) $@ 866124720a6976a69357522299afbe5591854e40775Stephen Smalley 867a86316e85215de0e8bcd9920035af1a2d1f5a4ccSandeep Patilbuilt_plat_pc := $(LOCAL_BUILT_MODULE) 868a86316e85215de0e8bcd9920035af1a2d1f5a4ccSandeep Patilplat_pcfiles := 869a86316e85215de0e8bcd9920035af1a2d1f5a4ccSandeep Patilplat_property_contexts.tmp := 8708b7545bf5745e1e0aba55b0334de40d2334728b1Robert Craig 871124720a6976a69357522299afbe5591854e40775Stephen Smalley################################## 872f90c41f6e8d5c1266e154f46586a2ceb260f1be6Riley Spahninclude $(CLEAR_VARS) 873a86316e85215de0e8bcd9920035af1a2d1f5a4ccSandeep PatilLOCAL_MODULE := nonplat_property_contexts 8742e0cd5ad36321fd7a8f21768dac080d09b658920Stephen SmalleyLOCAL_MODULE_CLASS := ETC 875a86316e85215de0e8bcd9920035af1a2d1f5a4ccSandeep PatilLOCAL_MODULE_TAGS := optional 8769d59041f63b22f3d1b59faa9afeb5bf2a02e3e17Alex Klyubin 8779d59041f63b22f3d1b59faa9afeb5bf2a02e3e17Alex Klyubinifeq ($(PRODUCT_FULL_TREBLE),true) 8789d59041f63b22f3d1b59faa9afeb5bf2a02e3e17Alex KlyubinLOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux 8799d59041f63b22f3d1b59faa9afeb5bf2a02e3e17Alex Klyubinelse 880a86316e85215de0e8bcd9920035af1a2d1f5a4ccSandeep PatilLOCAL_MODULE_PATH := $(TARGET_ROOT_OUT) 8819d59041f63b22f3d1b59faa9afeb5bf2a02e3e17Alex Klyubinendif 8822e0cd5ad36321fd7a8f21768dac080d09b658920Stephen Smalley 883c93617315e69f9bd7319476afbd3f91d00dd6b5aStephen Smalleyinclude $(BUILD_SYSTEM)/base_rules.mk 884c93617315e69f9bd7319476afbd3f91d00dd6b5aStephen Smalley 8855596172d23a799d4131f36822e8afe817f2cf017Alex Klyubinnonplat_pcfiles := $(call build_policy, property_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY)) 886a86316e85215de0e8bcd9920035af1a2d1f5a4ccSandeep Patil 887a86316e85215de0e8bcd9920035af1a2d1f5a4ccSandeep Patilnonplat_property_contexts.tmp := $(intermediates)/nonplat_property_contexts.tmp 888a86316e85215de0e8bcd9920035af1a2d1f5a4ccSandeep Patil$(nonplat_property_contexts.tmp): PRIVATE_PC_FILES := $(nonplat_pcfiles) 889a86316e85215de0e8bcd9920035af1a2d1f5a4ccSandeep Patil$(nonplat_property_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) 890a86316e85215de0e8bcd9920035af1a2d1f5a4ccSandeep Patil$(nonplat_property_contexts.tmp): $(nonplat_pcfiles) 8917f81b337bc600251b37de2dfa70c47781a2f2d3cWilliam Roberts @mkdir -p $(dir $@) 892a86316e85215de0e8bcd9920035af1a2d1f5a4ccSandeep Patil $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_PC_FILES) > $@ 8937f81b337bc600251b37de2dfa70c47781a2f2d3cWilliam Roberts 894a86316e85215de0e8bcd9920035af1a2d1f5a4ccSandeep Patil 895a86316e85215de0e8bcd9920035af1a2d1f5a4ccSandeep Patil$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) 896a86316e85215de0e8bcd9920035af1a2d1f5a4ccSandeep Patil$(LOCAL_BUILT_MODULE): $(nonplat_property_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc 897dcffd2b482a625a99233d82019d7b96919c41600William Roberts @mkdir -p $(dir $@) 898a86316e85215de0e8bcd9920035af1a2d1f5a4ccSandeep Patil $(hide) sed -e 's/#.*$$//' -e '/^$$/d' $< | sort -u -o $@ 89907791558051d0ffbbb6ac015cd4f195455695523dcashman $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -p $(PRIVATE_SEPOLICY) $@ 900dcffd2b482a625a99233d82019d7b96919c41600William Roberts 901a86316e85215de0e8bcd9920035af1a2d1f5a4ccSandeep Patilbuilt_nonplat_pc := $(LOCAL_BUILT_MODULE) 902a86316e85215de0e8bcd9920035af1a2d1f5a4ccSandeep Patilnonplat_pcfiles := 903a86316e85215de0e8bcd9920035af1a2d1f5a4ccSandeep Patilnonplat_property_contexts.tmp := 9042e0cd5ad36321fd7a8f21768dac080d09b658920Stephen Smalley 9052e0cd5ad36321fd7a8f21768dac080d09b658920Stephen Smalley################################## 9062e0cd5ad36321fd7a8f21768dac080d09b658920Stephen Smalleyinclude $(CLEAR_VARS) 9072e0cd5ad36321fd7a8f21768dac080d09b658920Stephen Smalley 908ec78c377c006040d14d92f5b1a1a52da779f20aaAlex KlyubinLOCAL_MODULE := plat_property_contexts.recovery 909ec78c377c006040d14d92f5b1a1a52da779f20aaAlex KlyubinLOCAL_MODULE_STEM := plat_property_contexts 910ec78c377c006040d14d92f5b1a1a52da779f20aaAlex KlyubinLOCAL_MODULE_CLASS := ETC 911ec78c377c006040d14d92f5b1a1a52da779f20aaAlex KlyubinLOCAL_MODULE_TAGS := optional 912ec78c377c006040d14d92f5b1a1a52da779f20aaAlex KlyubinLOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT) 913ec78c377c006040d14d92f5b1a1a52da779f20aaAlex Klyubin 914ec78c377c006040d14d92f5b1a1a52da779f20aaAlex Klyubininclude $(BUILD_SYSTEM)/base_rules.mk 915ec78c377c006040d14d92f5b1a1a52da779f20aaAlex Klyubin 916ec78c377c006040d14d92f5b1a1a52da779f20aaAlex Klyubin$(LOCAL_BUILT_MODULE): $(built_plat_pc) 917ec78c377c006040d14d92f5b1a1a52da779f20aaAlex Klyubin $(hide) cp -f $< $@ 918ec78c377c006040d14d92f5b1a1a52da779f20aaAlex Klyubin 919ec78c377c006040d14d92f5b1a1a52da779f20aaAlex Klyubin################################## 920ec78c377c006040d14d92f5b1a1a52da779f20aaAlex Klyubininclude $(CLEAR_VARS) 921ec78c377c006040d14d92f5b1a1a52da779f20aaAlex KlyubinLOCAL_MODULE := nonplat_property_contexts.recovery 922ec78c377c006040d14d92f5b1a1a52da779f20aaAlex KlyubinLOCAL_MODULE_STEM := nonplat_property_contexts 923ec78c377c006040d14d92f5b1a1a52da779f20aaAlex KlyubinLOCAL_MODULE_CLASS := ETC 924ec78c377c006040d14d92f5b1a1a52da779f20aaAlex KlyubinLOCAL_MODULE_TAGS := optional 925ec78c377c006040d14d92f5b1a1a52da779f20aaAlex KlyubinLOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT) 926ec78c377c006040d14d92f5b1a1a52da779f20aaAlex Klyubin 927ec78c377c006040d14d92f5b1a1a52da779f20aaAlex Klyubininclude $(BUILD_SYSTEM)/base_rules.mk 928ec78c377c006040d14d92f5b1a1a52da779f20aaAlex Klyubin 929ec78c377c006040d14d92f5b1a1a52da779f20aaAlex Klyubin$(LOCAL_BUILT_MODULE): $(built_nonplat_pc) 930ec78c377c006040d14d92f5b1a1a52da779f20aaAlex Klyubin $(hide) cp -f $< $@ 931ec78c377c006040d14d92f5b1a1a52da779f20aaAlex Klyubin 932ec78c377c006040d14d92f5b1a1a52da779f20aaAlex Klyubin################################## 933ec78c377c006040d14d92f5b1a1a52da779f20aaAlex Klyubininclude $(CLEAR_VARS) 934ec78c377c006040d14d92f5b1a1a52da779f20aaAlex Klyubin 935a058b569e4c7204a756ccb3fc4f23b17042a8f43Sandeep PatilLOCAL_MODULE := plat_service_contexts 936f90c41f6e8d5c1266e154f46586a2ceb260f1be6Riley SpahnLOCAL_MODULE_CLASS := ETC 937f90c41f6e8d5c1266e154f46586a2ceb260f1be6Riley SpahnLOCAL_MODULE_TAGS := optional 9384e3a4c7b21f48eec2413d20e317d7d41d3fb0c0fJeff Vander Stoepifeq ($(PRODUCT_FULL_TREBLE),true) 9394e3a4c7b21f48eec2413d20e317d7d41d3fb0c0fJeff Vander StoepLOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux 9404e3a4c7b21f48eec2413d20e317d7d41d3fb0c0fJeff Vander Stoepelse 941f90c41f6e8d5c1266e154f46586a2ceb260f1be6Riley SpahnLOCAL_MODULE_PATH := $(TARGET_ROOT_OUT) 9424e3a4c7b21f48eec2413d20e317d7d41d3fb0c0fJeff Vander Stoependif 943f90c41f6e8d5c1266e154f46586a2ceb260f1be6Riley Spahn 944f90c41f6e8d5c1266e154f46586a2ceb260f1be6Riley Spahninclude $(BUILD_SYSTEM)/base_rules.mk 945f90c41f6e8d5c1266e154f46586a2ceb260f1be6Riley Spahn 946a058b569e4c7204a756ccb3fc4f23b17042a8f43Sandeep Patilplat_svcfiles := $(call build_policy, service_contexts, $(PLAT_PRIVATE_POLICY)) 947f90c41f6e8d5c1266e154f46586a2ceb260f1be6Riley Spahn 948a058b569e4c7204a756ccb3fc4f23b17042a8f43Sandeep Patilplat_service_contexts.tmp := $(intermediates)/plat_service_contexts.tmp 949a058b569e4c7204a756ccb3fc4f23b17042a8f43Sandeep Patil$(plat_service_contexts.tmp): PRIVATE_SVC_FILES := $(plat_svcfiles) 950a058b569e4c7204a756ccb3fc4f23b17042a8f43Sandeep Patil$(plat_service_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) 951a058b569e4c7204a756ccb3fc4f23b17042a8f43Sandeep Patil$(plat_service_contexts.tmp): $(plat_svcfiles) 952f6ee7a521942036ef7f5c0f6bc74520509934141William Roberts @mkdir -p $(dir $@) 953efcaecab4eb075fdc69942e6915999458fb5f88bColin Cross $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@ 9547fc865a4caec1a2ced41918449e34596f50f8c43William Roberts 9557fc865a4caec1a2ced41918449e34596f50f8c43William Roberts$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) 956a058b569e4c7204a756ccb3fc4f23b17042a8f43Sandeep Patil$(LOCAL_BUILT_MODULE): $(plat_service_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP) 9577fc865a4caec1a2ced41918449e34596f50f8c43William Roberts @mkdir -p $(dir $@) 958c9fce3fa595592fed96e0294bce55199c8582c7bWilliam Roberts sed -e 's/#.*$$//' -e '/^$$/d' $< > $@ 95907791558051d0ffbbb6ac015cd4f195455695523dcashman $(HOST_OUT_EXECUTABLES)/checkfc -s $(PRIVATE_SEPOLICY) $@ 960f90c41f6e8d5c1266e154f46586a2ceb260f1be6Riley Spahn 961a058b569e4c7204a756ccb3fc4f23b17042a8f43Sandeep Patilbuilt_plat_svc := $(LOCAL_BUILT_MODULE) 962a058b569e4c7204a756ccb3fc4f23b17042a8f43Sandeep Patilplat_svcfiles := 963a058b569e4c7204a756ccb3fc4f23b17042a8f43Sandeep Patilplat_service_contexts.tmp := 964f90c41f6e8d5c1266e154f46586a2ceb260f1be6Riley Spahn 965f90c41f6e8d5c1266e154f46586a2ceb260f1be6Riley Spahn################################## 966b19665c39da76c0e24c8cd9583e30c4a50567510rpcraiginclude $(CLEAR_VARS) 967b19665c39da76c0e24c8cd9583e30c4a50567510rpcraig 968a058b569e4c7204a756ccb3fc4f23b17042a8f43Sandeep PatilLOCAL_MODULE := nonplat_service_contexts 9692e0cd5ad36321fd7a8f21768dac080d09b658920Stephen SmalleyLOCAL_MODULE_CLASS := ETC 970a058b569e4c7204a756ccb3fc4f23b17042a8f43Sandeep PatilLOCAL_MODULE_TAGS := optional 9714e3a4c7b21f48eec2413d20e317d7d41d3fb0c0fJeff Vander Stoepifeq ($(PRODUCT_FULL_TREBLE),true) 9724e3a4c7b21f48eec2413d20e317d7d41d3fb0c0fJeff Vander StoepLOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux 9734e3a4c7b21f48eec2413d20e317d7d41d3fb0c0fJeff Vander Stoepelse 974a058b569e4c7204a756ccb3fc4f23b17042a8f43Sandeep PatilLOCAL_MODULE_PATH := $(TARGET_ROOT_OUT) 9754e3a4c7b21f48eec2413d20e317d7d41d3fb0c0fJeff Vander Stoependif 9762e0cd5ad36321fd7a8f21768dac080d09b658920Stephen Smalley 9772e0cd5ad36321fd7a8f21768dac080d09b658920Stephen Smalleyinclude $(BUILD_SYSTEM)/base_rules.mk 9782e0cd5ad36321fd7a8f21768dac080d09b658920Stephen Smalley 9795596172d23a799d4131f36822e8afe817f2cf017Alex Klyubinnonplat_svcfiles := $(call build_policy, service_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY)) 980a058b569e4c7204a756ccb3fc4f23b17042a8f43Sandeep Patil 981a058b569e4c7204a756ccb3fc4f23b17042a8f43Sandeep Patilnonplat_service_contexts.tmp := $(intermediates)/nonplat_service_contexts.tmp 982a058b569e4c7204a756ccb3fc4f23b17042a8f43Sandeep Patil$(nonplat_service_contexts.tmp): PRIVATE_SVC_FILES := $(nonplat_svcfiles) 983a058b569e4c7204a756ccb3fc4f23b17042a8f43Sandeep Patil$(nonplat_service_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) 984a058b569e4c7204a756ccb3fc4f23b17042a8f43Sandeep Patil$(nonplat_service_contexts.tmp): $(nonplat_svcfiles) 985f6ee7a521942036ef7f5c0f6bc74520509934141William Roberts @mkdir -p $(dir $@) 986a058b569e4c7204a756ccb3fc4f23b17042a8f43Sandeep Patil $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@ 987f6ee7a521942036ef7f5c0f6bc74520509934141William Roberts 988a058b569e4c7204a756ccb3fc4f23b17042a8f43Sandeep Patil$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) 989a058b569e4c7204a756ccb3fc4f23b17042a8f43Sandeep Patil$(LOCAL_BUILT_MODULE): $(nonplat_service_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP) 9907fc865a4caec1a2ced41918449e34596f50f8c43William Roberts @mkdir -p $(dir $@) 991c9fce3fa595592fed96e0294bce55199c8582c7bWilliam Roberts sed -e 's/#.*$$//' -e '/^$$/d' $< > $@ 99207791558051d0ffbbb6ac015cd4f195455695523dcashman $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -s $(PRIVATE_SEPOLICY) $@ 9937fc865a4caec1a2ced41918449e34596f50f8c43William Roberts 994a058b569e4c7204a756ccb3fc4f23b17042a8f43Sandeep Patilbuilt_nonplat_svc := $(LOCAL_BUILT_MODULE) 995a058b569e4c7204a756ccb3fc4f23b17042a8f43Sandeep Patilnonplat_svcfiles := 996a058b569e4c7204a756ccb3fc4f23b17042a8f43Sandeep Patilnonplat_service_contexts.tmp := 9972e0cd5ad36321fd7a8f21768dac080d09b658920Stephen Smalley 9982e0cd5ad36321fd7a8f21768dac080d09b658920Stephen Smalley################################## 9992e0cd5ad36321fd7a8f21768dac080d09b658920Stephen Smalleyinclude $(CLEAR_VARS) 10002e0cd5ad36321fd7a8f21768dac080d09b658920Stephen Smalley 10013ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn CoenenLOCAL_MODULE := plat_hwservice_contexts 10023ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn CoenenLOCAL_MODULE_CLASS := ETC 10033ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn CoenenLOCAL_MODULE_TAGS := optional 10043ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenenifeq ($(PRODUCT_FULL_TREBLE),true) 10053ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn CoenenLOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux 10063ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenenelse 10073ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn CoenenLOCAL_MODULE_PATH := $(TARGET_ROOT_OUT) 10083ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenenendif 10093ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenen 10103ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coeneninclude $(BUILD_SYSTEM)/base_rules.mk 10113ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenen 10123ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenenplat_hwsvcfiles := $(call build_policy, hwservice_contexts, $(PLAT_PRIVATE_POLICY)) 10133ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenen 10143ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenenplat_hwservice_contexts.tmp := $(intermediates)/plat_hwservice_contexts.tmp 10153ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenen$(plat_hwservice_contexts.tmp): PRIVATE_SVC_FILES := $(plat_hwsvcfiles) 10163ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenen$(plat_hwservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) 10173ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenen$(plat_hwservice_contexts.tmp): $(plat_hwsvcfiles) 10183ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenen @mkdir -p $(dir $@) 10193ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenen $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@ 10203ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenen 10213ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenen$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) 10223ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenen$(LOCAL_BUILT_MODULE): $(plat_hwservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP) 10233ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenen @mkdir -p $(dir $@) 10243ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenen sed -e 's/#.*$$//' -e '/^$$/d' $< > $@ 10253ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenen $(HOST_OUT_EXECUTABLES)/checkfc -e -l $(PRIVATE_SEPOLICY) $@ 10263ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenen 10273ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenenplat_hwsvcfiles := 10283ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenenplat_hwservice_contexts.tmp := 10293ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenen 10303ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenen################################## 10313ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coeneninclude $(CLEAR_VARS) 10323ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenen 10333ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn CoenenLOCAL_MODULE := nonplat_hwservice_contexts 10343ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn CoenenLOCAL_MODULE_CLASS := ETC 10353ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn CoenenLOCAL_MODULE_TAGS := optional 10363ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenenifeq ($(PRODUCT_FULL_TREBLE),true) 10373ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn CoenenLOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux 10383ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenenelse 10393ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn CoenenLOCAL_MODULE_PATH := $(TARGET_ROOT_OUT) 10403ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenenendif 10413ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenen 10423ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coeneninclude $(BUILD_SYSTEM)/base_rules.mk 10433ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenen 10443ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenennonplat_hwsvcfiles := $(call build_policy, hwservice_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY)) 10453ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenen 10463ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenennonplat_hwservice_contexts.tmp := $(intermediates)/nonplat_hwservice_contexts.tmp 10473ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenen$(nonplat_hwservice_contexts.tmp): PRIVATE_SVC_FILES := $(nonplat_hwsvcfiles) 10483ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenen$(nonplat_hwservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) 10493ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenen$(nonplat_hwservice_contexts.tmp): $(nonplat_hwsvcfiles) 10503ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenen @mkdir -p $(dir $@) 10513ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenen $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@ 10523ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenen 10533ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenen$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) 10543ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenen$(LOCAL_BUILT_MODULE): $(nonplat_hwservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP) 10553ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenen @mkdir -p $(dir $@) 10563ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenen sed -e 's/#.*$$//' -e '/^$$/d' $< > $@ 10573ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenen $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e -l $(PRIVATE_SEPOLICY) $@ 10583ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenen 10593ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenennonplat_hwsvcfiles := 10603ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenennonplat_hwservice_contexts.tmp := 10613ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenen 10623ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenen################################## 10633ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coeneninclude $(CLEAR_VARS) 10643ea47b9249d4f9a4a90cae7867a119cbfdb7d4b6Martijn Coenen 10656676c234fc6a634cdf5231a3e33b3edc075daa51Martijn CoenenLOCAL_MODULE := vndservice_contexts 10666676c234fc6a634cdf5231a3e33b3edc075daa51Martijn CoenenLOCAL_MODULE_CLASS := ETC 10676676c234fc6a634cdf5231a3e33b3edc075daa51Martijn CoenenLOCAL_MODULE_TAGS := optional 10686676c234fc6a634cdf5231a3e33b3edc075daa51Martijn Coenenifeq ($(PRODUCT_FULL_TREBLE),true) 10696676c234fc6a634cdf5231a3e33b3edc075daa51Martijn CoenenLOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux 10706676c234fc6a634cdf5231a3e33b3edc075daa51Martijn Coenenelse 10716676c234fc6a634cdf5231a3e33b3edc075daa51Martijn CoenenLOCAL_MODULE_PATH := $(TARGET_ROOT_OUT) 10726676c234fc6a634cdf5231a3e33b3edc075daa51Martijn Coenenendif 10736676c234fc6a634cdf5231a3e33b3edc075daa51Martijn Coenen 10746676c234fc6a634cdf5231a3e33b3edc075daa51Martijn Coeneninclude $(BUILD_SYSTEM)/base_rules.mk 10756676c234fc6a634cdf5231a3e33b3edc075daa51Martijn Coenen 10766676c234fc6a634cdf5231a3e33b3edc075daa51Martijn Coenenvnd_svcfiles := $(call build_policy, vndservice_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY)) 10776676c234fc6a634cdf5231a3e33b3edc075daa51Martijn Coenen 10786676c234fc6a634cdf5231a3e33b3edc075daa51Martijn Coenenvndservice_contexts.tmp := $(intermediates)/vndservice_contexts.tmp 10796676c234fc6a634cdf5231a3e33b3edc075daa51Martijn Coenen$(vndservice_contexts.tmp): PRIVATE_SVC_FILES := $(vnd_svcfiles) 10806676c234fc6a634cdf5231a3e33b3edc075daa51Martijn Coenen$(vndservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) 10816676c234fc6a634cdf5231a3e33b3edc075daa51Martijn Coenen$(vndservice_contexts.tmp): $(vnd_svcfiles) 10826676c234fc6a634cdf5231a3e33b3edc075daa51Martijn Coenen @mkdir -p $(dir $@) 10836676c234fc6a634cdf5231a3e33b3edc075daa51Martijn Coenen $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@ 10846676c234fc6a634cdf5231a3e33b3edc075daa51Martijn Coenen 10856676c234fc6a634cdf5231a3e33b3edc075daa51Martijn Coenen$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) 10866676c234fc6a634cdf5231a3e33b3edc075daa51Martijn Coenen$(LOCAL_BUILT_MODULE): $(vndservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP) 10876676c234fc6a634cdf5231a3e33b3edc075daa51Martijn Coenen @mkdir -p $(dir $@) 10886676c234fc6a634cdf5231a3e33b3edc075daa51Martijn Coenen sed -e 's/#.*$$//' -e '/^$$/d' $< > $@ 1089ee97662f17c278b7988857162ea0f11b9afcf707Martijn Coenen $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e -v $(PRIVATE_SEPOLICY) $@ 10906676c234fc6a634cdf5231a3e33b3edc075daa51Martijn Coenen 10916676c234fc6a634cdf5231a3e33b3edc075daa51Martijn Coenenvnd_svcfiles := 10926676c234fc6a634cdf5231a3e33b3edc075daa51Martijn Coenenvndservice_contexts.tmp := 10936676c234fc6a634cdf5231a3e33b3edc075daa51Martijn Coenen################################## 10946676c234fc6a634cdf5231a3e33b3edc075daa51Martijn Coeneninclude $(CLEAR_VARS) 10956676c234fc6a634cdf5231a3e33b3edc075daa51Martijn Coenen 109690b3b948971a01a2a8b83edcbf07ae493bd43babdcashmanLOCAL_MODULE := plat_mac_permissions.xml 1097b19665c39da76c0e24c8cd9583e30c4a50567510rpcraigLOCAL_MODULE_CLASS := ETC 1098b19665c39da76c0e24c8cd9583e30c4a50567510rpcraigLOCAL_MODULE_TAGS := optional 1099bba9e7b92d903629c57dee02aa3675b27480a122Jeff Vander StoepLOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux 1100b19665c39da76c0e24c8cd9583e30c4a50567510rpcraig 11012c8a55dcf4e571c198118dd4459d62894f6378f3William Robertsinclude $(BUILD_SYSTEM)/base_rules.mk 1102b19665c39da76c0e24c8cd9583e30c4a50567510rpcraig 1103cd4104e84b438827fddd6a7fe6cb86e91392152dGeremy Condra# Build keys.conf 110490b3b948971a01a2a8b83edcbf07ae493bd43babdcashmanplat_mac_perms_keys.tmp := $(intermediates)/plat_keys.tmp 110590b3b948971a01a2a8b83edcbf07ae493bd43babdcashman$(plat_mac_perms_keys.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) 110690b3b948971a01a2a8b83edcbf07ae493bd43babdcashman$(plat_mac_perms_keys.tmp): $(call build_policy, keys.conf, $(PLAT_PRIVATE_POLICY)) 1107cd4104e84b438827fddd6a7fe6cb86e91392152dGeremy Condra @mkdir -p $(dir $@) 1108d21855824d178abea9ac93376757c7aed765cd83William Roberts $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@ 1109cd4104e84b438827fddd6a7fe6cb86e91392152dGeremy Condra 111090b3b948971a01a2a8b83edcbf07ae493bd43babdcashmanall_plat_mac_perms_files := $(call build_policy, mac_permissions.xml, $(PLAT_PRIVATE_POLICY)) 1111b19665c39da76c0e24c8cd9583e30c4a50567510rpcraig 1112ef0c14d3a2a469081a99111e48a3d421d4fe8d5bShinichiro Hamaji# Should be synced with keys.conf. 111390b3b948971a01a2a8b83edcbf07ae493bd43babdcashmanall_plat_keys := platform media shared testkey 111490b3b948971a01a2a8b83edcbf07ae493bd43babdcashmanall_plat_keys := $(all_keys:%=$(dir $(DEFAULT_SYSTEM_DEV_CERTIFICATE))/%.x509.pem) 1115ef0c14d3a2a469081a99111e48a3d421d4fe8d5bShinichiro Hamaji 111690b3b948971a01a2a8b83edcbf07ae493bd43babdcashman$(LOCAL_BUILT_MODULE): PRIVATE_MAC_PERMS_FILES := $(all_plat_mac_perms_files) 111790b3b948971a01a2a8b83edcbf07ae493bd43babdcashman$(LOCAL_BUILT_MODULE): $(plat_mac_perms_keys.tmp) $(HOST_OUT_EXECUTABLES)/insertkeys.py \ 111890b3b948971a01a2a8b83edcbf07ae493bd43babdcashman$(all_plat_mac_perms_files) $(all_plat_keys) 1119cd4104e84b438827fddd6a7fe6cb86e91392152dGeremy Condra @mkdir -p $(dir $@) 1120c3c9052bc7bf7f55e66a7560a28800066a6e044bNick Kralevich $(hide) DEFAULT_SYSTEM_DEV_CERTIFICATE="$(dir $(DEFAULT_SYSTEM_DEV_CERTIFICATE))" \ 11216aabc1c77b98d0ce8e13871047504afb90108733William Roberts $(HOST_OUT_EXECUTABLES)/insertkeys.py -t $(TARGET_BUILD_VARIANT) -c $(TOP) $< -o $@ $(PRIVATE_MAC_PERMS_FILES) 1122cd4104e84b438827fddd6a7fe6cb86e91392152dGeremy Condra 11236aabc1c77b98d0ce8e13871047504afb90108733William Robertsall_mac_perms_files := 112490b3b948971a01a2a8b83edcbf07ae493bd43babdcashmanall_plat_keys := 112590b3b948971a01a2a8b83edcbf07ae493bd43babdcashmanplat_mac_perms_keys.tmp := 112690b3b948971a01a2a8b83edcbf07ae493bd43babdcashman 112790b3b948971a01a2a8b83edcbf07ae493bd43babdcashman################################## 112890b3b948971a01a2a8b83edcbf07ae493bd43babdcashmaninclude $(CLEAR_VARS) 112990b3b948971a01a2a8b83edcbf07ae493bd43babdcashman 113090b3b948971a01a2a8b83edcbf07ae493bd43babdcashmanLOCAL_MODULE := nonplat_mac_permissions.xml 113190b3b948971a01a2a8b83edcbf07ae493bd43babdcashmanLOCAL_MODULE_CLASS := ETC 113290b3b948971a01a2a8b83edcbf07ae493bd43babdcashmanLOCAL_MODULE_TAGS := optional 1133bba9e7b92d903629c57dee02aa3675b27480a122Jeff Vander StoepLOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux 113490b3b948971a01a2a8b83edcbf07ae493bd43babdcashman 113590b3b948971a01a2a8b83edcbf07ae493bd43babdcashmaninclude $(BUILD_SYSTEM)/base_rules.mk 113690b3b948971a01a2a8b83edcbf07ae493bd43babdcashman 113790b3b948971a01a2a8b83edcbf07ae493bd43babdcashman# Build keys.conf 113890b3b948971a01a2a8b83edcbf07ae493bd43babdcashmannonplat_mac_perms_keys.tmp := $(intermediates)/nonplat_keys.tmp 113990b3b948971a01a2a8b83edcbf07ae493bd43babdcashman$(nonplat_mac_perms_keys.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) 11405596172d23a799d4131f36822e8afe817f2cf017Alex Klyubin$(nonplat_mac_perms_keys.tmp): $(call build_policy, keys.conf, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY)) 114190b3b948971a01a2a8b83edcbf07ae493bd43babdcashman @mkdir -p $(dir $@) 114290b3b948971a01a2a8b83edcbf07ae493bd43babdcashman $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@ 114390b3b948971a01a2a8b83edcbf07ae493bd43babdcashman 11445596172d23a799d4131f36822e8afe817f2cf017Alex Klyubinall_nonplat_mac_perms_files := $(call build_policy, mac_permissions.xml, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY)) 114590b3b948971a01a2a8b83edcbf07ae493bd43babdcashman 114690b3b948971a01a2a8b83edcbf07ae493bd43babdcashman$(LOCAL_BUILT_MODULE): PRIVATE_MAC_PERMS_FILES := $(all_nonplat_mac_perms_files) 114790b3b948971a01a2a8b83edcbf07ae493bd43babdcashman$(LOCAL_BUILT_MODULE): $(nonplat_mac_perms_keys.tmp) $(HOST_OUT_EXECUTABLES)/insertkeys.py \ 114890b3b948971a01a2a8b83edcbf07ae493bd43babdcashman$(all_nonplat_mac_perms_files) 114990b3b948971a01a2a8b83edcbf07ae493bd43babdcashman @mkdir -p $(dir $@) 115090b3b948971a01a2a8b83edcbf07ae493bd43babdcashman $(hide) $(HOST_OUT_EXECUTABLES)/insertkeys.py -t $(TARGET_BUILD_VARIANT) -c $(TOP) $< -o $@ $(PRIVATE_MAC_PERMS_FILES) 115190b3b948971a01a2a8b83edcbf07ae493bd43babdcashman 115290b3b948971a01a2a8b83edcbf07ae493bd43babdcashmannonplat_mac_perms_keys.tmp := 115390b3b948971a01a2a8b83edcbf07ae493bd43babdcashmanall_nonplat_mac_perms_files := 11546aabc1c77b98d0ce8e13871047504afb90108733William Roberts 1155b19665c39da76c0e24c8cd9583e30c4a50567510rpcraig################################## 11561fc0682ec629d10c5c48714def2fc96369977169Jeff Vander Stoepifeq ($(PRODUCT_FULL_TREBLE),true) 11571fc0682ec629d10c5c48714def2fc96369977169Jeff Vander Stoepinclude $(CLEAR_VARS) 11581fc0682ec629d10c5c48714def2fc96369977169Jeff Vander Stoep# For Treble builds run tests verifying that processes are properly labeled and 11591fc0682ec629d10c5c48714def2fc96369977169Jeff Vander Stoep# permissions granted do not violate the treble model. 11601fc0682ec629d10c5c48714def2fc96369977169Jeff Vander StoepLOCAL_MODULE := treble_sepolicy_tests 11611fc0682ec629d10c5c48714def2fc96369977169Jeff Vander StoepLOCAL_MODULE_CLASS := ETC 11621fc0682ec629d10c5c48714def2fc96369977169Jeff Vander StoepLOCAL_MODULE_TAGS := tests 11631fc0682ec629d10c5c48714def2fc96369977169Jeff Vander Stoep 11641fc0682ec629d10c5c48714def2fc96369977169Jeff Vander Stoepinclude $(BUILD_SYSTEM)/base_rules.mk 11651fc0682ec629d10c5c48714def2fc96369977169Jeff Vander Stoep 11661fc0682ec629d10c5c48714def2fc96369977169Jeff Vander Stoeptreble_sepolicy_tests := $(intermediates)/treble_sepolicy_tests 11671fc0682ec629d10c5c48714def2fc96369977169Jeff Vander Stoep$(treble_sepolicy_tests): PRIVATE_PLAT_FC := $(built_plat_fc) 11681fc0682ec629d10c5c48714def2fc96369977169Jeff Vander Stoep$(treble_sepolicy_tests): PRIVATE_NONPLAT_FC := $(built_nonplat_fc) 11691fc0682ec629d10c5c48714def2fc96369977169Jeff Vander Stoep$(treble_sepolicy_tests): PRIVATE_SEPOLICY := $(built_sepolicy) 11701fc0682ec629d10c5c48714def2fc96369977169Jeff Vander Stoep$(treble_sepolicy_tests): $(HOST_OUT_EXECUTABLES)/treble_sepolicy_tests.py \ 11711fc0682ec629d10c5c48714def2fc96369977169Jeff Vander Stoep$(built_plat_fc) $(built_nonplat_fc) $(built_sepolicy) 11721fc0682ec629d10c5c48714def2fc96369977169Jeff Vander Stoep @mkdir -p $(dir $@) 11731fc0682ec629d10c5c48714def2fc96369977169Jeff Vander Stoep $(hide) python $(HOST_OUT_EXECUTABLES)/treble_sepolicy_tests.py -l $(HOST_OUT)/lib64 -f $(PRIVATE_PLAT_FC) -f $(PRIVATE_NONPLAT_FC) -p $(PRIVATE_SEPOLICY) 11741fc0682ec629d10c5c48714def2fc96369977169Jeff Vander Stoep $(hide) touch $@ 11751fc0682ec629d10c5c48714def2fc96369977169Jeff Vander Stoependif # ($(PRODUCT_FULL_TREBLE),true) 11761fc0682ec629d10c5c48714def2fc96369977169Jeff Vander Stoep################################# 117747cd396b11ca4b62d4d99902bec1b981760e818arpcraig 11781c0402779552e497900db0a649068019ce023dfbDan Cashmanadd_nl := 117949693f1b4d7871e0e6ce2576fa68541ecb6d1f03William Robertsbuild_device_policy := 11801c0402779552e497900db0a649068019ce023dfbDan Cashmanbuild_policy := 1181d225b6979db89959c272b4351fb05363a7a18ea7dcashmanbuilt_plat_fc := 1182d225b6979db89959c272b4351fb05363a7a18ea7dcashmanbuilt_nonplat_fc := 1183c8801fec63a785be65808e70232ea241c779fcb5Richard Hainesbuilt_nl := 11848f7173b01601040ae17810d07dea37a895f94dddAlex Klyubinbuilt_plat_cil := 11858f7173b01601040ae17810d07dea37a895f94dddAlex Klyubinbuilt_mapping_cil := 1186a86316e85215de0e8bcd9920035af1a2d1f5a4ccSandeep Patilbuilt_plat_pc := 1187193dccda7922e3cfdcbbd19da93960335ca0d224Alex Klyubinbuilt_nonplat_cil := 1188a86316e85215de0e8bcd9920035af1a2d1f5a4ccSandeep Patilbuilt_nonplat_pc := 11899c038072231ea475cf0dc7a378f930e9b06e8dacDan Cashmanbuilt_nonplat_sc := 11909c038072231ea475cf0dc7a378f930e9b06e8dacDan Cashmanbuilt_plat_sc := 1191193dccda7922e3cfdcbbd19da93960335ca0d224Alex Klyubinbuilt_precompiled_sepolicy := 11921c0402779552e497900db0a649068019ce023dfbDan Cashmanbuilt_sepolicy := 1193a058b569e4c7204a756ccb3fc4f23b17042a8f43Sandeep Patilbuilt_plat_svc := 1194a058b569e4c7204a756ccb3fc4f23b17042a8f43Sandeep Patilbuilt_nonplat_svc := 1195b87876937b8ed73063fd44800beb86f3dd7079beJeff Vander Stoepmapping_policy := 11961c0402779552e497900db0a649068019ce023dfbDan Cashmanmy_target_arch := 11971faa644c81e90cfd226bb7e43cde68e309c10790dcashmanplat_pub_policy.cil := 11981faa644c81e90cfd226bb7e43cde68e309c10790dcashmanreqd_policy_mask.cil := 11991c0402779552e497900db0a649068019ce023dfbDan Cashmansepolicy_build_files := 12007cda44f49f8b128f6a4673174220b4825024f654Alex Klyubinsepolicy_build_cil_workaround_files := 12017443484831a858848d71b95c3e9fa4e96dcbf830Jeff Vander Stoepwith_asan := 1202cdfb06f55394d68a7df1110d83070961a2cc52aaAlice Chu 1203cdfb06f55394d68a7df1110d83070961a2cc52aaAlice Chuinclude $(call all-makefiles-under,$(LOCAL_PATH)) 1204