11406926d09feeb6ac90733a17bbe6d80996f980bTri Voversion := $(version_under_treble_tests) 21406926d09feeb6ac90733a17bbe6d80996f980bTri Vo 31406926d09feeb6ac90733a17bbe6d80996f980bTri Voinclude $(CLEAR_VARS) 41406926d09feeb6ac90733a17bbe6d80996f980bTri Vo# For Treble builds run tests verifying that processes are properly labeled and 51406926d09feeb6ac90733a17bbe6d80996f980bTri Vo# permissions granted do not violate the treble model. Also ensure that treble 61406926d09feeb6ac90733a17bbe6d80996f980bTri Vo# compatibility guarantees are upheld between SELinux version bumps. 71406926d09feeb6ac90733a17bbe6d80996f980bTri VoLOCAL_MODULE := treble_sepolicy_tests_$(version) 81406926d09feeb6ac90733a17bbe6d80996f980bTri VoLOCAL_MODULE_CLASS := ETC 91406926d09feeb6ac90733a17bbe6d80996f980bTri VoLOCAL_MODULE_TAGS := tests 101406926d09feeb6ac90733a17bbe6d80996f980bTri Vo 111406926d09feeb6ac90733a17bbe6d80996f980bTri Voinclude $(BUILD_SYSTEM)/base_rules.mk 121406926d09feeb6ac90733a17bbe6d80996f980bTri Vo 131406926d09feeb6ac90733a17bbe6d80996f980bTri Vo# $(version)_plat - the platform policy shipped as part of the $(version) release. This is 141406926d09feeb6ac90733a17bbe6d80996f980bTri Vo# built to enable us to determine the diff between the current policy and the 151406926d09feeb6ac90733a17bbe6d80996f980bTri Vo# $(version) policy, which will be used in tests to make sure that compatibility has 161406926d09feeb6ac90733a17bbe6d80996f980bTri Vo# been maintained by our mapping files. 171406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(version)_PLAT_PUBLIC_POLICY := $(LOCAL_PATH)/prebuilts/api/$(version)/public 181406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(version)_PLAT_PRIVATE_POLICY := $(LOCAL_PATH)/prebuilts/api/$(version)/private 191406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(version)_plat_policy.conf := $(intermediates)/$(version)_plat_policy.conf 201406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$($(version)_plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS) 211406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$($(version)_plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS) 22408584d5fe3f53d7df45a668a1c0aec912bf034cJoel Galenson$($(version)_plat_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := user 231406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$($(version)_plat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch) 241406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$($(version)_plat_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) 251406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$($(version)_plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) 261406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$($(version)_plat_policy.conf): PRIVATE_SEPOLICY_SPLIT := true 271406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$($(version)_plat_policy.conf): $(call build_policy, $(sepolicy_build_files), \ 281406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$($(version)_PLAT_PUBLIC_POLICY) $($(version)_PLAT_PRIVATE_POLICY)) 291406926d09feeb6ac90733a17bbe6d80996f980bTri Vo $(transform-policy-to-conf) 301406926d09feeb6ac90733a17bbe6d80996f980bTri Vo $(hide) sed '/dontaudit/d' $@ > $@.dontaudit 311406926d09feeb6ac90733a17bbe6d80996f980bTri Vo 321406926d09feeb6ac90733a17bbe6d80996f980bTri Vo 331406926d09feeb6ac90733a17bbe6d80996f980bTri Vobuilt_$(version)_plat_sepolicy := $(intermediates)/built_$(version)_plat_sepolicy 341406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(built_$(version)_plat_sepolicy): PRIVATE_ADDITIONAL_CIL_FILES := \ 351406926d09feeb6ac90733a17bbe6d80996f980bTri Vo $(call build_policy, technical_debt.cil , $($(version)_PLAT_PRIVATE_POLICY)) 361406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(built_$(version)_plat_sepolicy): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG) 371406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(built_$(version)_plat_sepolicy): $($(version)_plat_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \ 381406926d09feeb6ac90733a17bbe6d80996f980bTri Vo $(HOST_OUT_EXECUTABLES)/secilc \ 391406926d09feeb6ac90733a17bbe6d80996f980bTri Vo $(call build_policy, technical_debt.cil, $($(version)_PLAT_PRIVATE_POLICY)) \ 401406926d09feeb6ac90733a17bbe6d80996f980bTri Vo $(built_sepolicy_neverallows) 411406926d09feeb6ac90733a17bbe6d80996f980bTri Vo @mkdir -p $(dir $@) 421406926d09feeb6ac90733a17bbe6d80996f980bTri Vo $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \ 431406926d09feeb6ac90733a17bbe6d80996f980bTri Vo $(POLICYVERS) -o $@ $< 441406926d09feeb6ac90733a17bbe6d80996f980bTri Vo $(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@ 451406926d09feeb6ac90733a17bbe6d80996f980bTri Vo $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $@ -o $@ -f /dev/null 461406926d09feeb6ac90733a17bbe6d80996f980bTri Vo 471406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(version)_plat_policy.conf := 481406926d09feeb6ac90733a17bbe6d80996f980bTri Vo 491406926d09feeb6ac90733a17bbe6d80996f980bTri Vo 501406926d09feeb6ac90733a17bbe6d80996f980bTri Vo# $(version)_compat - the current plat_sepolicy.cil built with the compatibility file 511406926d09feeb6ac90733a17bbe6d80996f980bTri Vo# targeting the $(version) SELinux release. This ensures that our policy will build 521406926d09feeb6ac90733a17bbe6d80996f980bTri Vo# when used on a device that has non-platform policy targetting the $(version) release. 531406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(version)_compat := $(intermediates)/$(version)_compat 541406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(version)_mapping.cil := $(LOCAL_PATH)/private/compat/$(version)/$(version).cil 551406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(version)_mapping.ignore.cil := $(LOCAL_PATH)/private/compat/$(version)/$(version).ignore.cil 561406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(version)_nonplat := $(LOCAL_PATH)/prebuilts/api/$(version)/nonplat_sepolicy.cil 571406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$($(version)_compat): PRIVATE_CIL_FILES := \ 581406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(built_plat_cil) $($(version)_mapping.cil) $($(version)_nonplat) 591406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$($(version)_compat): $(HOST_OUT_EXECUTABLES)/secilc \ 601406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(built_plat_cil) $($(version)_mapping.cil) $($(version)_nonplat) 611406926d09feeb6ac90733a17bbe6d80996f980bTri Vo $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -N -c $(POLICYVERS) \ 621406926d09feeb6ac90733a17bbe6d80996f980bTri Vo $(PRIVATE_CIL_FILES) -o $@ -f /dev/null 631406926d09feeb6ac90733a17bbe6d80996f980bTri Vo 641406926d09feeb6ac90733a17bbe6d80996f980bTri Vo# $(version)_mapping.combined.cil - a combination of the mapping file used when 651406926d09feeb6ac90733a17bbe6d80996f980bTri Vo# combining the current platform policy with nonplatform policy based on the 661406926d09feeb6ac90733a17bbe6d80996f980bTri Vo# $(version) policy release and also a special ignored file that exists purely for 671406926d09feeb6ac90733a17bbe6d80996f980bTri Vo# these tests. 681406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(version)_mapping.combined.cil := $(intermediates)/$(version)_mapping.combined.cil 691406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$($(version)_mapping.combined.cil): $($(version)_mapping.cil) $($(version)_mapping.ignore.cil) 701406926d09feeb6ac90733a17bbe6d80996f980bTri Vo mkdir -p $(dir $@) 711406926d09feeb6ac90733a17bbe6d80996f980bTri Vo cat $^ > $@ 721406926d09feeb6ac90733a17bbe6d80996f980bTri Vo 731406926d09feeb6ac90733a17bbe6d80996f980bTri Votreble_sepolicy_tests_$(version) := $(intermediates)/treble_sepolicy_tests_$(version) 741406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(treble_sepolicy_tests_$(version)): ALL_FC_ARGS := $(all_fc_args) 751406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(treble_sepolicy_tests_$(version)): PRIVATE_SEPOLICY := $(built_sepolicy) 761406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(treble_sepolicy_tests_$(version)): PRIVATE_SEPOLICY_OLD := $(built_$(version)_plat_sepolicy) 771406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(treble_sepolicy_tests_$(version)): PRIVATE_COMBINED_MAPPING := $($(version)_mapping.combined.cil) 781406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(treble_sepolicy_tests_$(version)): PRIVATE_PLAT_SEPOLICY := $(built_plat_sepolicy) 791406926d09feeb6ac90733a17bbe6d80996f980bTri Voifeq ($(PRODUCT_FULL_TREBLE_OVERRIDE),true) 801406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(treble_sepolicy_tests_$(version)): PRIVATE_FAKE_TREBLE := --fake-treble 811406926d09feeb6ac90733a17bbe6d80996f980bTri Voelse 821406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(treble_sepolicy_tests_$(version)): PRIVATE_FAKE_TREBLE := 831406926d09feeb6ac90733a17bbe6d80996f980bTri Voendif 841406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(treble_sepolicy_tests_$(version)): $(HOST_OUT_EXECUTABLES)/treble_sepolicy_tests \ 851406926d09feeb6ac90733a17bbe6d80996f980bTri Vo $(all_fc_files) $(built_sepolicy) $(built_plat_sepolicy) \ 861406926d09feeb6ac90733a17bbe6d80996f980bTri Vo $(built_$(version)_plat_sepolicy) $($(version)_compat) $($(version)_mapping.combined.cil) 871406926d09feeb6ac90733a17bbe6d80996f980bTri Vo @mkdir -p $(dir $@) 881406926d09feeb6ac90733a17bbe6d80996f980bTri Vo $(hide) $(HOST_OUT_EXECUTABLES)/treble_sepolicy_tests -l \ 891406926d09feeb6ac90733a17bbe6d80996f980bTri Vo $(HOST_OUT)/lib64/libsepolwrap.$(SHAREDLIB_EXT) $(ALL_FC_ARGS) \ 901406926d09feeb6ac90733a17bbe6d80996f980bTri Vo -b $(PRIVATE_PLAT_SEPOLICY) -m $(PRIVATE_COMBINED_MAPPING) \ 911406926d09feeb6ac90733a17bbe6d80996f980bTri Vo -o $(PRIVATE_SEPOLICY_OLD) -p $(PRIVATE_SEPOLICY) \ 921406926d09feeb6ac90733a17bbe6d80996f980bTri Vo $(PRIVATE_FAKE_TREBLE) 931406926d09feeb6ac90733a17bbe6d80996f980bTri Vo $(hide) touch $@ 941406926d09feeb6ac90733a17bbe6d80996f980bTri Vo 951406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(version)_PLAT_PUBLIC_POLICY := 961406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(version)_PLAT_PRIVATE_POLICY := 971406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(version)_compat := 981406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(version)_mapping.cil := 991406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(version)_mapping.combined.cil := 1001406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(version)_mapping.ignore.cil := 1011406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(version)_nonplat := 1021406926d09feeb6ac90733a17bbe6d80996f980bTri Vobuilt_$(version)_plat_sepolicy := 1031406926d09feeb6ac90733a17bbe6d80996f980bTri Voversion := 1041406926d09feeb6ac90733a17bbe6d80996f980bTri Voversion_under_treble_tests := 105