11406926d09feeb6ac90733a17bbe6d80996f980bTri Voversion := $(version_under_treble_tests)
21406926d09feeb6ac90733a17bbe6d80996f980bTri Vo
31406926d09feeb6ac90733a17bbe6d80996f980bTri Voinclude $(CLEAR_VARS)
41406926d09feeb6ac90733a17bbe6d80996f980bTri Vo# For Treble builds run tests verifying that processes are properly labeled and
51406926d09feeb6ac90733a17bbe6d80996f980bTri Vo# permissions granted do not violate the treble model.  Also ensure that treble
61406926d09feeb6ac90733a17bbe6d80996f980bTri Vo# compatibility guarantees are upheld between SELinux version bumps.
71406926d09feeb6ac90733a17bbe6d80996f980bTri VoLOCAL_MODULE := treble_sepolicy_tests_$(version)
81406926d09feeb6ac90733a17bbe6d80996f980bTri VoLOCAL_MODULE_CLASS := ETC
91406926d09feeb6ac90733a17bbe6d80996f980bTri VoLOCAL_MODULE_TAGS := tests
101406926d09feeb6ac90733a17bbe6d80996f980bTri Vo
111406926d09feeb6ac90733a17bbe6d80996f980bTri Voinclude $(BUILD_SYSTEM)/base_rules.mk
121406926d09feeb6ac90733a17bbe6d80996f980bTri Vo
131406926d09feeb6ac90733a17bbe6d80996f980bTri Vo# $(version)_plat - the platform policy shipped as part of the $(version) release.  This is
141406926d09feeb6ac90733a17bbe6d80996f980bTri Vo# built to enable us to determine the diff between the current policy and the
151406926d09feeb6ac90733a17bbe6d80996f980bTri Vo# $(version) policy, which will be used in tests to make sure that compatibility has
161406926d09feeb6ac90733a17bbe6d80996f980bTri Vo# been maintained by our mapping files.
171406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(version)_PLAT_PUBLIC_POLICY := $(LOCAL_PATH)/prebuilts/api/$(version)/public
181406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(version)_PLAT_PRIVATE_POLICY := $(LOCAL_PATH)/prebuilts/api/$(version)/private
191406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(version)_plat_policy.conf := $(intermediates)/$(version)_plat_policy.conf
201406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$($(version)_plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
211406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$($(version)_plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
22408584d5fe3f53d7df45a668a1c0aec912bf034cJoel Galenson$($(version)_plat_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := user
231406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$($(version)_plat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
241406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$($(version)_plat_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
251406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$($(version)_plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
261406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$($(version)_plat_policy.conf): PRIVATE_SEPOLICY_SPLIT := true
271406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$($(version)_plat_policy.conf): $(call build_policy, $(sepolicy_build_files), \
281406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$($(version)_PLAT_PUBLIC_POLICY) $($(version)_PLAT_PRIVATE_POLICY))
291406926d09feeb6ac90733a17bbe6d80996f980bTri Vo	$(transform-policy-to-conf)
301406926d09feeb6ac90733a17bbe6d80996f980bTri Vo	$(hide) sed '/dontaudit/d' $@ > $@.dontaudit
311406926d09feeb6ac90733a17bbe6d80996f980bTri Vo
321406926d09feeb6ac90733a17bbe6d80996f980bTri Vo
331406926d09feeb6ac90733a17bbe6d80996f980bTri Vobuilt_$(version)_plat_sepolicy := $(intermediates)/built_$(version)_plat_sepolicy
341406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(built_$(version)_plat_sepolicy): PRIVATE_ADDITIONAL_CIL_FILES := \
351406926d09feeb6ac90733a17bbe6d80996f980bTri Vo  $(call build_policy, technical_debt.cil , $($(version)_PLAT_PRIVATE_POLICY))
361406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(built_$(version)_plat_sepolicy): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
371406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(built_$(version)_plat_sepolicy): $($(version)_plat_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
381406926d09feeb6ac90733a17bbe6d80996f980bTri Vo  $(HOST_OUT_EXECUTABLES)/secilc \
391406926d09feeb6ac90733a17bbe6d80996f980bTri Vo  $(call build_policy, technical_debt.cil, $($(version)_PLAT_PRIVATE_POLICY)) \
401406926d09feeb6ac90733a17bbe6d80996f980bTri Vo  $(built_sepolicy_neverallows)
411406926d09feeb6ac90733a17bbe6d80996f980bTri Vo	@mkdir -p $(dir $@)
421406926d09feeb6ac90733a17bbe6d80996f980bTri Vo	$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \
431406926d09feeb6ac90733a17bbe6d80996f980bTri Vo		$(POLICYVERS) -o $@ $<
441406926d09feeb6ac90733a17bbe6d80996f980bTri Vo	$(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@
451406926d09feeb6ac90733a17bbe6d80996f980bTri Vo	$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $@ -o $@ -f /dev/null
461406926d09feeb6ac90733a17bbe6d80996f980bTri Vo
471406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(version)_plat_policy.conf :=
481406926d09feeb6ac90733a17bbe6d80996f980bTri Vo
491406926d09feeb6ac90733a17bbe6d80996f980bTri Vo
501406926d09feeb6ac90733a17bbe6d80996f980bTri Vo# $(version)_compat - the current plat_sepolicy.cil built with the compatibility file
511406926d09feeb6ac90733a17bbe6d80996f980bTri Vo# targeting the $(version) SELinux release.  This ensures that our policy will build
521406926d09feeb6ac90733a17bbe6d80996f980bTri Vo# when used on a device that has non-platform policy targetting the $(version) release.
531406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(version)_compat := $(intermediates)/$(version)_compat
541406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(version)_mapping.cil := $(LOCAL_PATH)/private/compat/$(version)/$(version).cil
551406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(version)_mapping.ignore.cil := $(LOCAL_PATH)/private/compat/$(version)/$(version).ignore.cil
561406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(version)_nonplat := $(LOCAL_PATH)/prebuilts/api/$(version)/nonplat_sepolicy.cil
571406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$($(version)_compat): PRIVATE_CIL_FILES := \
581406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(built_plat_cil) $($(version)_mapping.cil) $($(version)_nonplat)
591406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$($(version)_compat): $(HOST_OUT_EXECUTABLES)/secilc \
601406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(built_plat_cil) $($(version)_mapping.cil) $($(version)_nonplat)
611406926d09feeb6ac90733a17bbe6d80996f980bTri Vo	$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -N -c $(POLICYVERS) \
621406926d09feeb6ac90733a17bbe6d80996f980bTri Vo		$(PRIVATE_CIL_FILES) -o $@ -f /dev/null
631406926d09feeb6ac90733a17bbe6d80996f980bTri Vo
641406926d09feeb6ac90733a17bbe6d80996f980bTri Vo# $(version)_mapping.combined.cil - a combination of the mapping file used when
651406926d09feeb6ac90733a17bbe6d80996f980bTri Vo# combining the current platform policy with nonplatform policy based on the
661406926d09feeb6ac90733a17bbe6d80996f980bTri Vo# $(version) policy release and also a special ignored file that exists purely for
671406926d09feeb6ac90733a17bbe6d80996f980bTri Vo# these tests.
681406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(version)_mapping.combined.cil := $(intermediates)/$(version)_mapping.combined.cil
691406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$($(version)_mapping.combined.cil): $($(version)_mapping.cil) $($(version)_mapping.ignore.cil)
701406926d09feeb6ac90733a17bbe6d80996f980bTri Vo	mkdir -p $(dir $@)
711406926d09feeb6ac90733a17bbe6d80996f980bTri Vo	cat $^ > $@
721406926d09feeb6ac90733a17bbe6d80996f980bTri Vo
731406926d09feeb6ac90733a17bbe6d80996f980bTri Votreble_sepolicy_tests_$(version) := $(intermediates)/treble_sepolicy_tests_$(version)
741406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(treble_sepolicy_tests_$(version)): ALL_FC_ARGS := $(all_fc_args)
751406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(treble_sepolicy_tests_$(version)): PRIVATE_SEPOLICY := $(built_sepolicy)
761406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(treble_sepolicy_tests_$(version)): PRIVATE_SEPOLICY_OLD := $(built_$(version)_plat_sepolicy)
771406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(treble_sepolicy_tests_$(version)): PRIVATE_COMBINED_MAPPING := $($(version)_mapping.combined.cil)
781406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(treble_sepolicy_tests_$(version)): PRIVATE_PLAT_SEPOLICY := $(built_plat_sepolicy)
791406926d09feeb6ac90733a17bbe6d80996f980bTri Voifeq ($(PRODUCT_FULL_TREBLE_OVERRIDE),true)
801406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(treble_sepolicy_tests_$(version)): PRIVATE_FAKE_TREBLE := --fake-treble
811406926d09feeb6ac90733a17bbe6d80996f980bTri Voelse
821406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(treble_sepolicy_tests_$(version)): PRIVATE_FAKE_TREBLE :=
831406926d09feeb6ac90733a17bbe6d80996f980bTri Voendif
841406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(treble_sepolicy_tests_$(version)): $(HOST_OUT_EXECUTABLES)/treble_sepolicy_tests \
851406926d09feeb6ac90733a17bbe6d80996f980bTri Vo  $(all_fc_files) $(built_sepolicy) $(built_plat_sepolicy) \
861406926d09feeb6ac90733a17bbe6d80996f980bTri Vo  $(built_$(version)_plat_sepolicy) $($(version)_compat) $($(version)_mapping.combined.cil)
871406926d09feeb6ac90733a17bbe6d80996f980bTri Vo	@mkdir -p $(dir $@)
881406926d09feeb6ac90733a17bbe6d80996f980bTri Vo	$(hide) $(HOST_OUT_EXECUTABLES)/treble_sepolicy_tests -l \
891406926d09feeb6ac90733a17bbe6d80996f980bTri Vo		$(HOST_OUT)/lib64/libsepolwrap.$(SHAREDLIB_EXT) $(ALL_FC_ARGS) \
901406926d09feeb6ac90733a17bbe6d80996f980bTri Vo		-b $(PRIVATE_PLAT_SEPOLICY) -m $(PRIVATE_COMBINED_MAPPING) \
911406926d09feeb6ac90733a17bbe6d80996f980bTri Vo		-o $(PRIVATE_SEPOLICY_OLD) -p $(PRIVATE_SEPOLICY) \
921406926d09feeb6ac90733a17bbe6d80996f980bTri Vo		$(PRIVATE_FAKE_TREBLE)
931406926d09feeb6ac90733a17bbe6d80996f980bTri Vo	$(hide) touch $@
941406926d09feeb6ac90733a17bbe6d80996f980bTri Vo
951406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(version)_PLAT_PUBLIC_POLICY :=
961406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(version)_PLAT_PRIVATE_POLICY :=
971406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(version)_compat :=
981406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(version)_mapping.cil :=
991406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(version)_mapping.combined.cil :=
1001406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(version)_mapping.ignore.cil :=
1011406926d09feeb6ac90733a17bbe6d80996f980bTri Vo$(version)_nonplat :=
1021406926d09feeb6ac90733a17bbe6d80996f980bTri Vobuilt_$(version)_plat_sepolicy :=
1031406926d09feeb6ac90733a17bbe6d80996f980bTri Voversion :=
1041406926d09feeb6ac90733a17bbe6d80996f980bTri Voversion_under_treble_tests :=
105