blob: 03970b7b2b86335717900a8d27451a42fa81a2c0 [file] [log] [blame]
Stephen Smalley2dd4e512012-01-04 12:33:27 -05001LOCAL_PATH:= $(call my-dir)
William Robertsf0e0a942012-08-27 15:41:15 -07002
Dan Cashman6f14f6b2017-04-07 16:36:23 -07003# PLATFORM_SEPOLICY_VERSION is a number of the form "NN.m" with "NN" mapping to
4# PLATFORM_SDK_VERSION and "m" as a minor number which allows for SELinux
5# changes independent of PLATFORM_SDK_VERSION. This value will be set to
6# 10000.0 to represent tip-of-tree development that is inherently unstable and
7# thus designed not to work with any shipping vendor policy. This is similar in
8# spirit to how DEFAULT_APP_TARGET_SDK is set.
9# The minor version ('m' component) must be updated every time a platform release
10# is made which breaks compatibility with the previous platform sepolicy version,
11# not just on every increase in PLATFORM_SDK_VERSION. The minor version should
12# be reset to 0 on every bump of the PLATFORM_SDK_VERSION.
13sepolicy_major_vers := 25
14sepolicy_minor_vers := 0
15
16ifneq ($(sepolicy_major_vers), $(PLATFORM_SDK_VERSION))
17$(error sepolicy_major_version does not match PLATFORM_SDK_VERSION, please update.)
18endif
19ifneq (REL,$(PLATFORM_VERSION_CODENAME))
20 sepolicy_major_vers := 10000
21 sepolicy_minor_vers := 0
22endif
23PLATFORM_SEPOLICY_VERSION := $(join $(addsuffix .,$(sepolicy_major_vers)), $(sepolicy_minor_vers))
24sepolicy_major_vers :=
25sepolicy_minor_vers :=
26
Stephen Smalley2dd4e512012-01-04 12:33:27 -050027include $(CLEAR_VARS)
Stephen Smalley2dd4e512012-01-04 12:33:27 -050028# SELinux policy version.
Stephen Smalleyb4f17062015-03-13 10:03:52 -040029# Must be <= /sys/fs/selinux/policyvers reported by the Android kernel.
Stephen Smalley2dd4e512012-01-04 12:33:27 -050030# Must be within the compatibility range reported by checkpolicy -V.
Jeff Vander Stoep3a0ce492015-12-07 08:30:43 -080031POLICYVERS ?= 30
Stephen Smalley2dd4e512012-01-04 12:33:27 -050032
33MLS_SENS=1
34MLS_CATS=1024
35
Stephen Smalleyb4f17062015-03-13 10:03:52 -040036ifdef BOARD_SEPOLICY_REPLACE
37$(error BOARD_SEPOLICY_REPLACE is no longer supported; please remove from your BoardConfig.mk or other .mk file.)
38endif
39
40ifdef BOARD_SEPOLICY_IGNORE
41$(error BOARD_SEPOLICY_IGNORE is no longer supported; please remove from your BoardConfig.mk or other .mk file.)
42endif
Stephen Smalley5b340be2012-03-06 11:12:41 -050043
Stephen Smalley8e0ca882015-04-01 10:14:56 -040044ifdef BOARD_SEPOLICY_UNION
45$(warning BOARD_SEPOLICY_UNION is no longer required - all files found in BOARD_SEPOLICY_DIRS are implicitly unioned; please remove from your BoardConfig.mk or other .mk file.)
46endif
Robert Craig6b0ff472014-01-29 13:10:58 -050047
William Robertsd2185582015-07-16 11:28:02 -070048ifdef BOARD_SEPOLICY_M4DEFS
49LOCAL_ADDITIONAL_M4DEFS := $(addprefix -D, $(BOARD_SEPOLICY_M4DEFS))
50endif
51
dcashmancc39f632016-07-22 13:13:11 -070052# sepolicy is now divided into multiple portions:
53# public - policy exported on which non-platform policy developers may write
54# additional policy. types and attributes are versioned and included in
55# delivered non-platform policy, which is to be combined with platform policy.
56# private - platform-only policy required for platform functionality but which
57# is not exported to vendor policy developers and as such may not be assumed
58# to exist.
Alex Klyubin55961722017-01-30 18:44:59 -080059# vendor - vendor-only policy required for vendor functionality. This policy can
60# reference the public policy but cannot reference the private policy. This
61# policy is for components which are produced from the core/non-vendor tree and
62# placed into a vendor partition.
dcashman07791552016-12-07 11:27:47 -080063# mapping - This contains policy statements which map the attributes
dcashmancc39f632016-07-22 13:13:11 -070064# exposed in the public policy of previous versions to the concrete types used
65# in this policy to ensure that policy targeting attributes from public
66# policy from an older platform version continues to work.
67
dcashman2e00e632016-10-12 14:58:09 -070068# build process for device:
dcashmancc39f632016-07-22 13:13:11 -070069# 1) convert policies to CIL:
70# - private + public platform policy to CIL
71# - mapping file to CIL (should already be in CIL form)
72# - non-platform public policy to CIL
73# - non-platform public + private policy to CIL
74# 2) attributize policy
dcashmancc39f632016-07-22 13:13:11 -070075# - run script which takes non-platform public and non-platform combined
76# private + public policy and produces attributized and versioned
77# non-platform policy
78# 3) combine policy files
79# - combine mapping, platform and non-platform policy.
80# - compile output binary policy file
81
82PLAT_PUBLIC_POLICY := $(LOCAL_PATH)/public
83PLAT_PRIVATE_POLICY := $(LOCAL_PATH)/private
Alex Klyubin55961722017-01-30 18:44:59 -080084PLAT_VENDOR_POLICY := $(LOCAL_PATH)/vendor
dcashman2e00e632016-10-12 14:58:09 -070085REQD_MASK_POLICY := $(LOCAL_PATH)/reqd_mask
86
87# TODO: move to README when doing the README update and finalizing versioning.
Sandeep Patil42f95982017-04-07 14:18:48 -070088# BOARD_SEPOLICY_VERS must take the format "NN.m" and contain the sepolicy
89# version identifier corresponding to the sepolicy on which the non-platform
90# policy is to be based. If unspecified, this will build against the current
91# public platform policy in tree
dcashman2e00e632016-10-12 14:58:09 -070092ifndef BOARD_SEPOLICY_VERS
93$(warning BOARD_SEPOLICY_VERS not specified, assuming current platform version)
Sandeep Patil42f95982017-04-07 14:18:48 -070094# The default platform policy version.
Dan Cashman6f14f6b2017-04-07 16:36:23 -070095BOARD_SEPOLICY_VERS := $(PLATFORM_SEPOLICY_VERSION)
dcashman2e00e632016-10-12 14:58:09 -070096endif
dcashmancc39f632016-07-22 13:13:11 -070097
Dan Cashman4d24a772017-04-12 14:28:34 -070098
99platform_mapping_file := $(BOARD_SEPOLICY_VERS).cil
100
dcashmancc39f632016-07-22 13:13:11 -0700101###########################################################
102# Compute policy files to be used in policy build.
103# $(1): files to include
104# $(2): directories in which to find files
105###########################################################
106
107define build_policy
108$(foreach type, $(1), $(foreach file, $(addsuffix /$(type), $(2)), $(sort $(wildcard $(file)))))
109endef
William Roberts29d14682016-01-04 12:20:57 -0800110
William Roberts49693f12016-01-04 12:20:57 -0800111# Builds paths for all policy files found in BOARD_SEPOLICY_DIRS.
112# $(1): the set of policy name paths to build
Alex Klyubin55961722017-01-30 18:44:59 -0800113build_device_policy = $(call build_policy, $(1), $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS))
William Roberts49693f12016-01-04 12:20:57 -0800114
Richard Hainesc8801fe2015-12-11 10:39:19 +0000115# Add a file containing only a newline in-between each policy configuration
116# 'contexts' file. This will allow OEM policy configuration files without a
117# final newline (0x0A) to be built correctly by the m4(1) macro processor.
118# $(1): the set of contexts file names.
119# $(2): the file containing only 0x0A.
120add_nl = $(foreach entry, $(1), $(subst $(entry), $(entry) $(2), $(entry)))
121
dcashman704741a2014-07-25 19:11:52 -0700122sepolicy_build_files := security_classes \
123 initial_sids \
124 access_vectors \
125 global_macros \
Nick Kralevicha17a2662014-11-05 15:30:41 -0800126 neverallow_macros \
dcashman704741a2014-07-25 19:11:52 -0700127 mls_macros \
dcashman2e00e632016-10-12 14:58:09 -0700128 mls_decl \
dcashman704741a2014-07-25 19:11:52 -0700129 mls \
130 policy_capabilities \
131 te_macros \
132 attributes \
Jeff Vander Stoepcbaa2b72015-12-22 10:39:34 -0800133 ioctl_defines \
Jeff Vander Stoepde9b5302015-06-05 15:28:55 -0700134 ioctl_macros \
dcashman704741a2014-07-25 19:11:52 -0700135 *.te \
dcashman2e00e632016-10-12 14:58:09 -0700136 roles_decl \
dcashman704741a2014-07-25 19:11:52 -0700137 roles \
138 users \
139 initial_sid_contexts \
140 fs_use \
141 genfs_contexts \
142 port_contexts
143
Alex Klyubin7cda44f2017-03-21 14:28:53 -0700144# CIL files which contain workarounds for current limitation of human-readable
145# module policy language. These files are appended to the CIL files produced
146# from module language files.
147sepolicy_build_cil_workaround_files := technical_debt.cil
148
Dan Cashman1c040272016-12-15 15:28:44 -0800149my_target_arch := $(TARGET_ARCH)
150ifneq (,$(filter mips mips64,$(TARGET_ARCH)))
151 my_target_arch := mips
152endif
153
Jeff Vander Stoepd2053bd2017-03-15 13:37:35 -0700154intermediates := $(TARGET_OUT_INTERMEDIATES)/ETC/sepolicy_intermediates
155
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700156with_asan := false
157ifneq (,$(filter address,$(SANITIZE_TARGET)))
158 with_asan := true
159endif
160
Dan Cashman4f9a6482017-04-10 12:27:18 -0700161include $(CLEAR_VARS)
162LOCAL_MODULE := selinux_policy
163LOCAL_MODULE_TAGS := optional
164# Include SELinux policy. We do this here because different modules
165# need to be included based on the value of PRODUCT_FULL_TREBLE. This
166# type of conditional inclusion cannot be done in top-level files such
167# as build/target/product/embedded.mk.
168# This conditional inclusion closely mimics the conditional logic
169# inside init/init.cpp for loading SELinux policy from files.
170ifeq ($(PRODUCT_FULL_TREBLE),true)
171
Dan Cashman4f9a6482017-04-10 12:27:18 -0700172# Use split SELinux policy
173LOCAL_REQUIRED_MODULES += \
174 $(platform_mapping_file) \
175 nonplat_sepolicy.cil \
176 plat_sepolicy.cil \
177 plat_and_mapping_sepolicy.cil.sha256 \
178 secilc \
179 nonplat_file_contexts \
180 plat_file_contexts \
181 plat_sepolicy_vers.txt
182
183# Include precompiled policy, unless told otherwise
184ifneq ($(PRODUCT_PRECOMPILED_SEPOLICY),false)
185LOCAL_REQUIRED_MODULES += precompiled_sepolicy precompiled_sepolicy.plat_and_mapping.sha256
186endif
187
188else
189# Use monolithic SELinux policy
190LOCAL_REQUIRED_MODULES += sepolicy \
191 file_contexts.bin
192endif
193include $(BUILD_PHONY_PACKAGE)
194
Ying Wang02fb5f32012-01-17 17:51:09 -0800195##################################
dcashman2e00e632016-10-12 14:58:09 -0700196# reqd_policy_mask - a policy.conf file which contains only the bare minimum
197# policy necessary to use checkpolicy. This bare-minimum policy needs to be
198# present in all policy.conf files, but should not necessarily be exported as
199# part of the public policy. The rules generated by reqd_policy_mask will allow
200# the compilation of public policy and subsequent removal of CIL policy that
201# should not be exported.
202
203reqd_policy_mask.conf := $(intermediates)/reqd_policy_mask.conf
204$(reqd_policy_mask.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
205$(reqd_policy_mask.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Dan Cashman1c040272016-12-15 15:28:44 -0800206$(reqd_policy_mask.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700207$(reqd_policy_mask.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
dcashman2e00e632016-10-12 14:58:09 -0700208$(reqd_policy_mask.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
209$(reqd_policy_mask.conf): $(call build_policy, $(sepolicy_build_files), $(REQD_MASK_POLICY))
210 @mkdir -p $(dir $@)
211 $(hide) m4 $(PRIVATE_ADDITIONAL_M4DEFS) \
212 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
213 -D target_build_variant=$(TARGET_BUILD_VARIANT) \
Dan Cashman1c040272016-12-15 15:28:44 -0800214 -D target_with_dexpreopt=$(WITH_DEXPREOPT) \
Dan Cashman1c040272016-12-15 15:28:44 -0800215 -D target_arch=$(PRIVATE_TGT_ARCH) \
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700216 -D target_with_asan=$(PRIVATE_TGT_WITH_ASAN) \
Alex Klyubinf5446eb2017-03-23 14:27:32 -0700217 -D target_full_treble=$(PRODUCT_FULL_TREBLE) \
dcashman2e00e632016-10-12 14:58:09 -0700218 -s $^ > $@
219
220reqd_policy_mask.cil := $(intermediates)/reqd_policy_mask.cil
221$(reqd_policy_mask.cil): $(reqd_policy_mask.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy
222 @mkdir -p $(dir $@)
223 $(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -C -M -c $(POLICYVERS) -o $@ $<
224
dcashman1faa6442016-11-28 07:20:28 -0800225reqd_policy_mask.conf :=
226
227##################################
dcashman2e00e632016-10-12 14:58:09 -0700228# plat_pub_policy - policy that will be exported to be a part of non-platform
229# policy corresponding to this platform version. This is a limited subset of
230# policy that would not compile in checkpolicy on its own. To get around this
231# limitation, add only the required files from private policy, which will
232# generate CIL policy that will then be filtered out by the reqd_policy_mask.
233plat_pub_policy.conf := $(intermediates)/plat_pub_policy.conf
234$(plat_pub_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
235$(plat_pub_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Dan Cashman1c040272016-12-15 15:28:44 -0800236$(plat_pub_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700237$(plat_pub_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
dcashman2e00e632016-10-12 14:58:09 -0700238$(plat_pub_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
239$(plat_pub_policy.conf): $(call build_policy, $(sepolicy_build_files), \
Dan Cashman6bf50e52017-04-12 11:12:17 -0700240$(PLAT_PUBLIC_POLICY) $(REQD_MASK_POLICY))
dcashman2e00e632016-10-12 14:58:09 -0700241 @mkdir -p $(dir $@)
242 $(hide) m4 $(PRIVATE_ADDITIONAL_M4DEFS) \
243 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
244 -D target_build_variant=$(TARGET_BUILD_VARIANT) \
Dan Cashman1c040272016-12-15 15:28:44 -0800245 -D target_with_dexpreopt=$(WITH_DEXPREOPT) \
Dan Cashman1c040272016-12-15 15:28:44 -0800246 -D target_arch=$(PRIVATE_TGT_ARCH) \
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700247 -D target_with_asan=$(PRIVATE_TGT_WITH_ASAN) \
Alex Klyubinf5446eb2017-03-23 14:27:32 -0700248 -D target_full_treble=$(PRODUCT_FULL_TREBLE) \
dcashman2e00e632016-10-12 14:58:09 -0700249 -s $^ > $@
250
251plat_pub_policy.cil := $(intermediates)/plat_pub_policy.cil
dcashman1faa6442016-11-28 07:20:28 -0800252$(plat_pub_policy.cil): PRIVATE_POL_CONF := $(plat_pub_policy.conf)
253$(plat_pub_policy.cil): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil)
254$(plat_pub_policy.cil): $(HOST_OUT_EXECUTABLES)/checkpolicy $(plat_pub_policy.conf) $(reqd_policy_mask.cil)
dcashman2e00e632016-10-12 14:58:09 -0700255 @mkdir -p $(dir $@)
dcashman1faa6442016-11-28 07:20:28 -0800256 $(hide) $< -C -M -c $(POLICYVERS) -o $@.tmp $(PRIVATE_POL_CONF)
257 $(hide) grep -Fxv -f $(PRIVATE_REQD_MASK) $@.tmp > $@
dcashman2e00e632016-10-12 14:58:09 -0700258
dcashman1faa6442016-11-28 07:20:28 -0800259plat_pub_policy.conf :=
Dan Cashman1c040272016-12-15 15:28:44 -0800260
dcashman1faa6442016-11-28 07:20:28 -0800261##################################
262include $(CLEAR_VARS)
263
264LOCAL_MODULE := sectxfile_nl
265LOCAL_MODULE_CLASS := ETC
266LOCAL_MODULE_TAGS := optional
267
268# Create a file containing newline only to add between context config files
269include $(BUILD_SYSTEM)/base_rules.mk
270$(LOCAL_BUILT_MODULE):
dcashman2e00e632016-10-12 14:58:09 -0700271 @mkdir -p $(dir $@)
dcashman1faa6442016-11-28 07:20:28 -0800272 $(hide) echo > $@
273
274built_nl := $(LOCAL_BUILT_MODULE)
275
276#################################
277include $(CLEAR_VARS)
278
279LOCAL_MODULE := plat_sepolicy.cil
280LOCAL_MODULE_CLASS := ETC
281LOCAL_MODULE_TAGS := optional
Alex Klyubin052b0bb2017-03-02 12:39:25 -0800282LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
dcashman1faa6442016-11-28 07:20:28 -0800283
284include $(BUILD_SYSTEM)/base_rules.mk
dcashman2e00e632016-10-12 14:58:09 -0700285
286# plat_policy.conf - A combination of the private and public platform policy
287# which will ship with the device. The platform will always reflect the most
288# recent platform version and is not currently being attributized.
289plat_policy.conf := $(intermediates)/plat_policy.conf
290$(plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
291$(plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Dan Cashman1c040272016-12-15 15:28:44 -0800292$(plat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700293$(plat_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
dcashman2e00e632016-10-12 14:58:09 -0700294$(plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
295$(plat_policy.conf): $(call build_policy, $(sepolicy_build_files), \
dcashmancc39f632016-07-22 13:13:11 -0700296$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY))
297 @mkdir -p $(dir $@)
298 $(hide) m4 $(PRIVATE_ADDITIONAL_M4DEFS) \
299 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
300 -D target_build_variant=$(TARGET_BUILD_VARIANT) \
Jorge Lucangeli Obes84db84e2016-11-18 08:42:35 -0500301 -D target_with_dexpreopt=$(WITH_DEXPREOPT) \
Dan Cashman1c040272016-12-15 15:28:44 -0800302 -D target_arch=$(PRIVATE_TGT_ARCH) \
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700303 -D target_with_asan=$(PRIVATE_TGT_WITH_ASAN) \
Alex Klyubinf5446eb2017-03-23 14:27:32 -0700304 -D target_full_treble=$(PRODUCT_FULL_TREBLE) \
dcashmancc39f632016-07-22 13:13:11 -0700305 -s $^ > $@
306 $(hide) sed '/dontaudit/d' $@ > $@.dontaudit
307
dcashman1faa6442016-11-28 07:20:28 -0800308plat_policy_nvr := $(intermediates)/plat_policy_nvr.cil
Alex Klyubin7cda44f2017-03-21 14:28:53 -0700309$(plat_policy_nvr): PRIVATE_ADDITIONAL_CIL_FILES := \
310 $(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY))
311$(plat_policy_nvr): $(plat_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
312 $(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY))
dcashman2e00e632016-10-12 14:58:09 -0700313 @mkdir -p $(dir $@)
dcashman07791552016-12-07 11:27:47 -0800314 $(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c $(POLICYVERS) -o $@ $<
Alex Klyubin7cda44f2017-03-21 14:28:53 -0700315 $(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@
dcashmancc39f632016-07-22 13:13:11 -0700316
Alex Klyubin8f7173b2017-02-25 14:47:53 -0800317$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(plat_policy_nvr)
318$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(plat_policy_nvr)
dcashman1faa6442016-11-28 07:20:28 -0800319 @mkdir -p $(dir $@)
Alex Klyubin8f7173b2017-02-25 14:47:53 -0800320 # Strip out neverallow statements. They aren't needed on-device and their presence
321 # significantly slows down on-device compilation (e.g., from 400 ms to 6,400 ms on
322 # sailfish-eng).
323 grep -v '^(neverallow' $(PRIVATE_CIL_FILES) > $@
324 # Confirm that the resulting policy compiles
325 $(hide) $(HOST_OUT_EXECUTABLES)/secilc -M true -c $(POLICYVERS) $@ -o /dev/null -f /dev/null
dcashman1faa6442016-11-28 07:20:28 -0800326
Alex Klyubin8f7173b2017-02-25 14:47:53 -0800327built_plat_cil := $(LOCAL_BUILT_MODULE)
dcashman1faa6442016-11-28 07:20:28 -0800328plat_policy.conf :=
329
330#################################
331include $(CLEAR_VARS)
332
Dan Cashman4f9a6482017-04-10 12:27:18 -0700333LOCAL_MODULE := plat_sepolicy_vers.txt
dcashman1faa6442016-11-28 07:20:28 -0800334LOCAL_MODULE_CLASS := ETC
335LOCAL_MODULE_TAGS := optional
Dan Cashman4f9a6482017-04-10 12:27:18 -0700336LOCAL_PROPRIETARY_MODULE := true
337LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
338
339include $(BUILD_SYSTEM)/base_rules.mk
340
341$(LOCAL_BUILT_MODULE) : PRIVATE_PLAT_SEPOL_VERS := $(BOARD_SEPOLICY_VERS)
342$(LOCAL_BUILT_MODULE) :
343 mkdir -p $(dir $@)
344 echo $(PRIVATE_PLAT_SEPOL_VERS) > $@
345
346#################################
347include $(CLEAR_VARS)
348
349LOCAL_MODULE := $(platform_mapping_file)
350LOCAL_MODULE_CLASS := ETC
351LOCAL_MODULE_TAGS := optional
352LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux/mapping
dcashman1faa6442016-11-28 07:20:28 -0800353
354include $(BUILD_SYSTEM)/base_rules.mk
355
356# auto-generate the mapping file for current platform policy, since it needs to
357# track platform policy development
Dan Cashman6f14f6b2017-04-07 16:36:23 -0700358current_mapping.cil := $(intermediates)/mapping/$(PLATFORM_SEPOLICY_VERSION).cil
359$(current_mapping.cil) : PRIVATE_VERS := $(PLATFORM_SEPOLICY_VERSION)
dcashman1faa6442016-11-28 07:20:28 -0800360$(current_mapping.cil) : $(plat_pub_policy.cil) $(HOST_OUT_EXECUTABLES)/version_policy
361 @mkdir -p $(dir $@)
362 $(hide) $(HOST_OUT_EXECUTABLES)/version_policy -b $< -m -n $(PRIVATE_VERS) -o $@
363
Sandeep Patil42f95982017-04-07 14:18:48 -0700364
Dan Cashman6f14f6b2017-04-07 16:36:23 -0700365ifeq ($(BOARD_SEPOLICY_VERS), $(PLATFORM_SEPOLICY_VERSION))
dcashman1faa6442016-11-28 07:20:28 -0800366mapping_policy_nvr := $(current_mapping.cil)
367else
368mapping_policy_nvr := $(addsuffix /$(BOARD_SEPOLICY_VERS).cil, $(PLAT_PRIVATE_POLICY)/mapping)
369endif
370
371$(LOCAL_BUILT_MODULE): $(mapping_policy_nvr)
Alex Klyubin8f7173b2017-02-25 14:47:53 -0800372 # Strip out neverallow statements. They aren't needed on-device and their presence
373 # significantly slows down on-device compilation (e.g., from 400 ms to 6,400 ms on
374 # sailfish-eng).
375 grep -v '^(neverallow' $< > $@
dcashman1faa6442016-11-28 07:20:28 -0800376
Alex Klyubin8f7173b2017-02-25 14:47:53 -0800377built_mapping_cil := $(LOCAL_BUILT_MODULE)
dcashman1faa6442016-11-28 07:20:28 -0800378current_mapping.cil :=
379
380#################################
381include $(CLEAR_VARS)
382
Dan Cashman0e9c47c2017-04-04 14:27:41 -0700383LOCAL_MODULE := plat_and_mapping_sepolicy.cil.sha256
384LOCAL_MODULE_CLASS := ETC
385LOCAL_MODULE_TAGS := optional
386LOCAL_MODULE_PATH = $(TARGET_OUT)/etc/selinux
387
388include $(BUILD_SYSTEM)/base_rules.mk
389
390$(LOCAL_BUILT_MODULE): $(built_plat_cil) $(built_mapping_cil)
391 cat $^ | sha256sum | cut -d' ' -f1 > $@
392
393#################################
394include $(CLEAR_VARS)
395
dcashman1faa6442016-11-28 07:20:28 -0800396LOCAL_MODULE := nonplat_sepolicy.cil
397LOCAL_MODULE_CLASS := ETC
398LOCAL_MODULE_TAGS := optional
Alex Klyubin052b0bb2017-03-02 12:39:25 -0800399LOCAL_PROPRIETARY_MODULE := true
400LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
dcashman1faa6442016-11-28 07:20:28 -0800401
402include $(BUILD_SYSTEM)/base_rules.mk
403
Alex Klyubin55961722017-01-30 18:44:59 -0800404# nonplat_policy.conf - A combination of the non-platform private, vendor and
405# the exported platform policy associated with the version the non-platform
406# policy targets. This needs attributization and to be combined with the
dcashman2e00e632016-10-12 14:58:09 -0700407# platform-provided policy. Like plat_pub_policy.conf, this needs to make use
408# of the reqd_policy_mask files from private policy in order to use checkpolicy.
409nonplat_policy.conf := $(intermediates)/nonplat_policy.conf
410$(nonplat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
411$(nonplat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
Dan Cashman1c040272016-12-15 15:28:44 -0800412$(nonplat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700413$(nonplat_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
dcashman2e00e632016-10-12 14:58:09 -0700414$(nonplat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
415$(nonplat_policy.conf): $(call build_policy, $(sepolicy_build_files), \
Dan Cashman6bf50e52017-04-12 11:12:17 -0700416$(PLAT_PUBLIC_POLICY) $(REQD_MASK_POLICY) $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS))
Ying Wang02fb5f32012-01-17 17:51:09 -0800417 @mkdir -p $(dir $@)
William Robertsd2185582015-07-16 11:28:02 -0700418 $(hide) m4 $(PRIVATE_ADDITIONAL_M4DEFS) \
419 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
Nick Kralevich623975f2014-01-11 01:31:03 -0800420 -D target_build_variant=$(TARGET_BUILD_VARIANT) \
Jorge Lucangeli Obes84db84e2016-11-18 08:42:35 -0500421 -D target_with_dexpreopt=$(WITH_DEXPREOPT) \
Dan Cashman1c040272016-12-15 15:28:44 -0800422 -D target_arch=$(PRIVATE_TGT_ARCH) \
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700423 -D target_with_asan=$(PRIVATE_TGT_WITH_ASAN) \
Alex Klyubinf5446eb2017-03-23 14:27:32 -0700424 -D target_full_treble=$(PRODUCT_FULL_TREBLE) \
Nick Kralevich623975f2014-01-11 01:31:03 -0800425 -s $^ > $@
Robert Craig65d4f442013-03-27 06:30:25 -0400426 $(hide) sed '/dontaudit/d' $@ > $@.dontaudit
Stephen Smalley2dd4e512012-01-04 12:33:27 -0500427
dcashman1faa6442016-11-28 07:20:28 -0800428nonplat_policy_raw := $(intermediates)/nonplat_policy_raw.cil
429$(nonplat_policy_raw): PRIVATE_POL_CONF := $(nonplat_policy.conf)
430$(nonplat_policy_raw): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil)
431$(nonplat_policy_raw): $(HOST_OUT_EXECUTABLES)/checkpolicy $(nonplat_policy.conf) \
432$(reqd_policy_mask.cil)
Ying Wang02fb5f32012-01-17 17:51:09 -0800433 @mkdir -p $(dir $@)
dcashman1faa6442016-11-28 07:20:28 -0800434 $(hide) $< -C -M -c $(POLICYVERS) -o $@.tmp $(PRIVATE_POL_CONF)
435 $(hide) grep -Fxv -f $(PRIVATE_REQD_MASK) $@.tmp > $@
dcashman2e00e632016-10-12 14:58:09 -0700436
dcashman1faa6442016-11-28 07:20:28 -0800437nonplat_policy_nvr := $(intermediates)/nonplat_policy_nvr.cil
438$(nonplat_policy_nvr) : PRIVATE_VERS := $(BOARD_SEPOLICY_VERS)
439$(nonplat_policy_nvr) : PRIVATE_TGT_POL := $(nonplat_policy_raw)
440$(nonplat_policy_nvr) : $(plat_pub_policy.cil) $(nonplat_policy_raw) \
dcashman2e00e632016-10-12 14:58:09 -0700441$(HOST_OUT_EXECUTABLES)/version_policy
442 @mkdir -p $(dir $@)
443 $(HOST_OUT_EXECUTABLES)/version_policy -b $< -t $(PRIVATE_TGT_POL) -n $(PRIVATE_VERS) -o $@
444
Alex Klyubin8f7173b2017-02-25 14:47:53 -0800445$(LOCAL_BUILT_MODULE): PRIVATE_NONPLAT_CIL_FILES := $(nonplat_policy_nvr)
446$(LOCAL_BUILT_MODULE): PRIVATE_DEP_CIL_FILES := $(built_plat_cil) $(built_mapping_cil)
447$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(nonplat_policy_nvr) $(built_plat_cil) \
448$(built_mapping_cil)
dcashman2e00e632016-10-12 14:58:09 -0700449 @mkdir -p $(dir $@)
Alex Klyubin8f7173b2017-02-25 14:47:53 -0800450 # Strip out neverallow statements. They aren't needed on-device and their presence
451 # significantly slows down on-device compilation (e.g., from 400 ms to 6,400 ms on
452 # sailfish-eng).
453 grep -v '^(neverallow' $(PRIVATE_NONPLAT_CIL_FILES) > $@
454 # Confirm that the resulting policy compiles combined with platform and mapping policies
455 $(hide) $(HOST_OUT_EXECUTABLES)/secilc -M true -c $(POLICYVERS) \
456 $(PRIVATE_DEP_CIL_FILES) $@ -o /dev/null -f /dev/null
dcashman2e00e632016-10-12 14:58:09 -0700457
Alex Klyubin193dccd2017-03-07 14:05:57 -0800458built_nonplat_cil := $(LOCAL_BUILT_MODULE)
dcashman1faa6442016-11-28 07:20:28 -0800459nonplat_policy.conf :=
460nonplat_policy_raw :=
461
462#################################
463include $(CLEAR_VARS)
Alex Klyubin193dccd2017-03-07 14:05:57 -0800464
465LOCAL_MODULE := precompiled_sepolicy
466LOCAL_MODULE_CLASS := ETC
467LOCAL_MODULE_TAGS := optional
468LOCAL_PROPRIETARY_MODULE := true
469LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
470
471include $(BUILD_SYSTEM)/base_rules.mk
472
473$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := \
474$(built_plat_cil) $(built_mapping_cil) $(built_nonplat_cil)
475$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc \
476$(built_plat_cil) $(built_mapping_cil) $(built_nonplat_cil)
Jeff Vander Stoepac171b42017-04-12 17:01:54 -0700477 $(hide) $(HOST_OUT_EXECUTABLES)/secilc -M true -G -c $(POLICYVERS) \
Alex Klyubin193dccd2017-03-07 14:05:57 -0800478 $(PRIVATE_CIL_FILES) -o $@ -f /dev/null
479
480built_precompiled_sepolicy := $(LOCAL_BUILT_MODULE)
481
482#################################
Dan Cashman0e9c47c2017-04-04 14:27:41 -0700483# SHA-256 digest of the plat_sepolicy.cil and mapping_sepolicy.cil files against
484# which precompiled_policy was built.
Alex Klyubin193dccd2017-03-07 14:05:57 -0800485#################################
486include $(CLEAR_VARS)
Dan Cashman0e9c47c2017-04-04 14:27:41 -0700487LOCAL_MODULE := precompiled_sepolicy.plat_and_mapping.sha256
Alex Klyubin193dccd2017-03-07 14:05:57 -0800488LOCAL_MODULE_CLASS := ETC
489LOCAL_MODULE_TAGS := optional
490LOCAL_PROPRIETARY_MODULE := true
491LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
492
493include $(BUILD_SYSTEM)/base_rules.mk
494
Dan Cashman0e9c47c2017-04-04 14:27:41 -0700495$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(built_plat_cil) $(built_mapping_cil)
496$(LOCAL_BUILT_MODULE): $(built_precompiled_sepolicy) $(built_plat_cil) $(built_mapping_cil)
497 cat $(PRIVATE_CIL_FILES) | sha256sum | cut -d' ' -f1 > $@
Alex Klyubin193dccd2017-03-07 14:05:57 -0800498
499#################################
500include $(CLEAR_VARS)
Dan Cashman1c040272016-12-15 15:28:44 -0800501# build this target so that we can still perform neverallow checks
dcashman1faa6442016-11-28 07:20:28 -0800502
503LOCAL_MODULE := sepolicy
504LOCAL_MODULE_CLASS := ETC
505LOCAL_MODULE_TAGS := optional
Daniel Cashman65d01342016-12-17 00:53:26 +0000506LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
dcashman2e00e632016-10-12 14:58:09 -0700507
dcashman1faa6442016-11-28 07:20:28 -0800508include $(BUILD_SYSTEM)/base_rules.mk
509
dcashman2e00e632016-10-12 14:58:09 -0700510all_cil_files := \
dcashman1faa6442016-11-28 07:20:28 -0800511 $(plat_policy_nvr) \
512 $(mapping_policy_nvr) \
513 $(nonplat_policy_nvr) \
dcashman2e00e632016-10-12 14:58:09 -0700514
515$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(all_cil_files)
516$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $(all_cil_files)
517 @mkdir -p $(dir $@)
William Roberts5d0c2e42017-03-23 11:26:29 -0700518 $(hide) $< -M true -c $(POLICYVERS) $(PRIVATE_CIL_FILES) -o $@.tmp -f /dev/null
Nick Kralevichbca98ef2016-02-26 20:06:52 -0800519 $(hide) $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $@.tmp permissive > $@.permissivedomains
520 $(hide) if [ "$(TARGET_BUILD_VARIANT)" = "user" -a -s $@.permissivedomains ]; then \
521 echo "==========" 1>&2; \
522 echo "ERROR: permissive domains not allowed in user builds" 1>&2; \
523 echo "List of invalid domains:" 1>&2; \
524 cat $@.permissivedomains 1>&2; \
525 exit 1; \
526 fi
527 $(hide) mv $@.tmp $@
Ying Wang02fb5f32012-01-17 17:51:09 -0800528
Ying Wangd8b122c2012-10-25 19:01:31 -0700529built_sepolicy := $(LOCAL_BUILT_MODULE)
dcashman2e00e632016-10-12 14:58:09 -0700530all_cil_files :=
Stephen Smalley01a58af2012-10-02 12:46:37 -0400531
Alex Klyubin84aa7422017-03-10 09:36:07 -0800532#################################
533include $(CLEAR_VARS)
534
535# keep concrete sepolicy for neverallow checks
536
537LOCAL_MODULE := sepolicy.recovery
Alex Klyubinec78c372017-03-10 12:44:16 -0800538LOCAL_MODULE_STEM := sepolicy
Alex Klyubin84aa7422017-03-10 09:36:07 -0800539LOCAL_MODULE_CLASS := ETC
540LOCAL_MODULE_TAGS := optional
Alex Klyubinec78c372017-03-10 12:44:16 -0800541LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
Alex Klyubin84aa7422017-03-10 09:36:07 -0800542
543include $(BUILD_SYSTEM)/base_rules.mk
544
Dan Cashmanc8d45352017-04-11 07:38:48 -0700545sepolicy.recovery.conf := $(intermediates)/sepolicy.recovery.conf
546$(sepolicy.recovery.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
547$(sepolicy.recovery.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
548$(sepolicy.recovery.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
549$(sepolicy.recovery.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
550$(sepolicy.recovery.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
551$(sepolicy.recovery.conf): $(call build_policy, $(sepolicy_build_files), \
552 $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) \
553 $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS))
Dan Cashman1c040272016-12-15 15:28:44 -0800554 @mkdir -p $(dir $@)
555 $(hide) m4 $(PRIVATE_ADDITIONAL_M4DEFS) \
556 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
557 -D target_build_variant=$(TARGET_BUILD_VARIANT) \
Dan Cashman1c040272016-12-15 15:28:44 -0800558 -D target_with_dexpreopt=$(WITH_DEXPREOPT) \
Dan Cashman1c040272016-12-15 15:28:44 -0800559 -D target_arch=$(PRIVATE_TGT_ARCH) \
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700560 -D target_with_asan=$(PRIVATE_TGT_WITH_ASAN) \
Dan Cashman1c040272016-12-15 15:28:44 -0800561 -D target_recovery=true \
562 -s $^ > $@
563 $(hide) sed '/dontaudit/d' $@ > $@.dontaudit
564
Dan Cashmanc8d45352017-04-11 07:38:48 -0700565$(LOCAL_BUILT_MODULE): $(sepolicy.recovery.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
566 $(HOST_OUT_EXECUTABLES)/sepolicy-analyze
Dan Cashman1c040272016-12-15 15:28:44 -0800567 @mkdir -p $(dir $@)
Dan Cashmanc8d45352017-04-11 07:38:48 -0700568 $(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c $(POLICYVERS) -o $@.tmp $<
Nick Kralevichbca98ef2016-02-26 20:06:52 -0800569 $(hide) $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $@.tmp permissive > $@.permissivedomains
570 $(hide) if [ "$(TARGET_BUILD_VARIANT)" = "user" -a -s $@.permissivedomains ]; then \
571 echo "==========" 1>&2; \
572 echo "ERROR: permissive domains not allowed in user builds" 1>&2; \
573 echo "List of invalid domains:" 1>&2; \
574 cat $@.permissivedomains 1>&2; \
575 exit 1; \
576 fi
577 $(hide) mv $@.tmp $@
Stephen Smalleye60723a2014-05-29 16:40:15 -0400578
Dan Cashmanc8d45352017-04-11 07:38:48 -0700579sepolicy.recovery.conf :=
Stephen Smalleye60723a2014-05-29 16:40:15 -0400580
dcashman704741a2014-07-25 19:11:52 -0700581##################################
Alex Klyubin446279a2017-04-06 14:45:50 -0700582# SELinux policy embedded into CTS.
583# CTS checks neverallow rules of this policy against the policy of the device under test.
584##################################
dcashman704741a2014-07-25 19:11:52 -0700585include $(CLEAR_VARS)
586
587LOCAL_MODULE := general_sepolicy.conf
588LOCAL_MODULE_CLASS := ETC
589LOCAL_MODULE_TAGS := tests
590
591include $(BUILD_SYSTEM)/base_rules.mk
592
dcashman704741a2014-07-25 19:11:52 -0700593$(LOCAL_BUILT_MODULE): PRIVATE_MLS_SENS := $(MLS_SENS)
594$(LOCAL_BUILT_MODULE): PRIVATE_MLS_CATS := $(MLS_CATS)
Dan Cashman1c040272016-12-15 15:28:44 -0800595$(LOCAL_BUILT_MODULE): PRIVATE_TGT_ARCH := $(my_target_arch)
dcashmancc39f632016-07-22 13:13:11 -0700596$(LOCAL_BUILT_MODULE): $(call build_policy, $(sepolicy_build_files), \
597$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY))
dcashman704741a2014-07-25 19:11:52 -0700598 mkdir -p $(dir $@)
599 $(hide) m4 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
600 -D target_build_variant=user \
Jorge Lucangeli Obes84db84e2016-11-18 08:42:35 -0500601 -D target_with_dexpreopt=$(WITH_DEXPREOPT) \
Dan Cashman1c040272016-12-15 15:28:44 -0800602 -D target_arch=$(PRIVATE_TGT_ARCH) \
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700603 -D target_with_asan=false \
Alex Klyubin446279a2017-04-06 14:45:50 -0700604 -D target_full_treble=cts \
dcashman704741a2014-07-25 19:11:52 -0700605 -s $^ > $@
606 $(hide) sed '/dontaudit/d' $@ > $@.dontaudit
607
William Robertsb8769932015-06-29 16:31:23 -0700608##################################
dcashmand225b692016-12-12 09:29:04 -0800609# TODO - remove this. Keep around until we get the filesystem creation stuff taken care of.
610#
William Robertsb8769932015-06-29 16:31:23 -0700611include $(CLEAR_VARS)
612
Richard Hainesc2d01912015-08-06 17:43:52 +0100613LOCAL_MODULE := file_contexts.bin
Ying Wang02fb5f32012-01-17 17:51:09 -0800614LOCAL_MODULE_CLASS := ETC
615LOCAL_MODULE_TAGS := optional
616LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
617
Stephen Smalley5b340be2012-03-06 11:12:41 -0500618include $(BUILD_SYSTEM)/base_rules.mk
Ying Wang02fb5f32012-01-17 17:51:09 -0800619
William Roberts49693f12016-01-04 12:20:57 -0800620# The file_contexts.bin is built in the following way:
621# 1. Collect all file_contexts files in THIS repository and process them with
622# m4 into a tmp file called file_contexts.local.tmp.
623# 2. Collect all device specific file_contexts files and process them with m4
624# into a tmp file called file_contexts.device.tmp.
625# 3. Run checkfc -e (allow no device fc entries ie empty) and fc_sort on
626# file_contexts.device.tmp and output to file_contexts.device.sorted.tmp.
627# 4. Concatenate file_contexts.local.tmp and file_contexts.device.tmp into
628# file_contexts.concat.tmp.
629# 5. Run checkfc and sefcontext_compile on file_contexts.concat.tmp to produce
630# file_contexts.bin.
631#
632# Note: That a newline file is placed between each file_context file found to
633# ensure a proper build when an fc file is missing an ending newline.
William Roberts29d14682016-01-04 12:20:57 -0800634
dcashmancc39f632016-07-22 13:13:11 -0700635local_fc_files := $(PLAT_PRIVATE_POLICY)/file_contexts
William Roberts49693f12016-01-04 12:20:57 -0800636ifneq ($(filter address,$(SANITIZE_TARGET)),)
dcashmancc39f632016-07-22 13:13:11 -0700637 local_fc_files := $(local_fc_files) $(PLAT_PRIVATE_POLICY)/file_contexts_asan
William Roberts49693f12016-01-04 12:20:57 -0800638endif
639local_fcfiles_with_nl := $(call add_nl, $(local_fc_files), $(built_nl))
640
641file_contexts.local.tmp := $(intermediates)/file_contexts.local.tmp
642$(file_contexts.local.tmp): $(local_fcfiles_with_nl)
Stephen Smalley5b340be2012-03-06 11:12:41 -0500643 @mkdir -p $(dir $@)
William Roberts49693f12016-01-04 12:20:57 -0800644 $(hide) m4 -s $^ > $@
645
646device_fc_files := $(call build_device_policy, file_contexts)
647device_fcfiles_with_nl := $(call add_nl, $(device_fc_files), $(built_nl))
648
649file_contexts.device.tmp := $(intermediates)/file_contexts.device.tmp
650$(file_contexts.device.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
651$(file_contexts.device.tmp): $(device_fcfiles_with_nl)
652 @mkdir -p $(dir $@)
653 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@
654
655file_contexts.device.sorted.tmp := $(intermediates)/file_contexts.device.sorted.tmp
656$(file_contexts.device.sorted.tmp): PRIVATE_SEPOLICY := $(built_sepolicy)
657$(file_contexts.device.sorted.tmp): $(file_contexts.device.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/fc_sort $(HOST_OUT_EXECUTABLES)/checkfc
658 @mkdir -p $(dir $@)
dcashman07791552016-12-07 11:27:47 -0800659 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e $(PRIVATE_SEPOLICY) $<
William Roberts49693f12016-01-04 12:20:57 -0800660 $(hide) $(HOST_OUT_EXECUTABLES)/fc_sort $< $@
661
662file_contexts.concat.tmp := $(intermediates)/file_contexts.concat.tmp
663$(file_contexts.concat.tmp): $(file_contexts.local.tmp) $(file_contexts.device.sorted.tmp)
664 @mkdir -p $(dir $@)
665 $(hide) m4 -s $^ > $@
Stephen Smalley5b340be2012-03-06 11:12:41 -0500666
William Roberts3746a0a2015-09-25 10:18:44 -0700667$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
William Roberts49693f12016-01-04 12:20:57 -0800668$(LOCAL_BUILT_MODULE): $(file_contexts.concat.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/sefcontext_compile $(HOST_OUT_EXECUTABLES)/checkfc
Richard Hainesc2d01912015-08-06 17:43:52 +0100669 @mkdir -p $(dir $@)
dcashman07791552016-12-07 11:27:47 -0800670 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc $(PRIVATE_SEPOLICY) $<
Richard Hainesc2d01912015-08-06 17:43:52 +0100671 $(hide) $(HOST_OUT_EXECUTABLES)/sefcontext_compile -o $@ $<
672
Robert Craig8b7545b2014-03-20 09:35:08 -0400673built_fc := $(LOCAL_BUILT_MODULE)
William Roberts49693f12016-01-04 12:20:57 -0800674local_fc_files :=
675local_fcfiles_with_nl :=
676device_fc_files :=
677device_fcfiles_with_nl :=
678file_contexts.concat.tmp :=
679file_contexts.device.sorted.tmp :=
680file_contexts.device.tmp :=
681file_contexts.local.tmp :=
William Roberts171a0622012-08-16 10:55:05 -0700682
Ying Wang02fb5f32012-01-17 17:51:09 -0800683##################################
684include $(CLEAR_VARS)
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400685
Alex Klyubinec78c372017-03-10 12:44:16 -0800686LOCAL_MODULE := file_contexts.bin.recovery
687LOCAL_MODULE_STEM := file_contexts.bin
688LOCAL_MODULE_CLASS := ETC
689LOCAL_MODULE_TAGS := optional
690LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
691
692include $(BUILD_SYSTEM)/base_rules.mk
693
694$(LOCAL_BUILT_MODULE): $(built_fc)
695 $(hide) cp -f $< $@
696
697##################################
698include $(CLEAR_VARS)
699
dcashmand225b692016-12-12 09:29:04 -0800700LOCAL_MODULE := plat_file_contexts
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400701LOCAL_MODULE_CLASS := ETC
dcashmand225b692016-12-12 09:29:04 -0800702LOCAL_MODULE_TAGS := optional
Jeff Vander Stoep0cb417a2017-03-08 14:12:54 -0800703LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400704
705include $(BUILD_SYSTEM)/base_rules.mk
706
dcashmand225b692016-12-12 09:29:04 -0800707local_fc_files := $(PLAT_PRIVATE_POLICY)/file_contexts
708ifneq ($(filter address,$(SANITIZE_TARGET)),)
709 local_fc_files += $(PLAT_PRIVATE_POLICY)/file_contexts_asan
710endif
Alex Klyubine4665d72017-01-19 19:58:34 -0800711local_fcfiles_with_nl := $(call add_nl, $(local_fc_files), $(built_nl))
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400712
Alex Klyubine4665d72017-01-19 19:58:34 -0800713$(LOCAL_BUILT_MODULE): PRIVATE_FC_FILES := $(local_fcfiles_with_nl)
dcashmand225b692016-12-12 09:29:04 -0800714$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Alex Klyubine4665d72017-01-19 19:58:34 -0800715$(LOCAL_BUILT_MODULE): PRIVATE_FC_SORT := $(HOST_OUT_EXECUTABLES)/fc_sort
716$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/checkfc $(HOST_OUT_EXECUTABLES)/fc_sort \
717$(local_fcfiles_with_nl) $(built_sepolicy)
Richard Hainesc2d01912015-08-06 17:43:52 +0100718 @mkdir -p $(dir $@)
Alex Klyubine4665d72017-01-19 19:58:34 -0800719 $(hide) m4 -s $(PRIVATE_FC_FILES) > $@.tmp
720 $(hide) $< $(PRIVATE_SEPOLICY) $@.tmp
721 $(hide) $(PRIVATE_FC_SORT) $@.tmp $@
Richard Hainesc2d01912015-08-06 17:43:52 +0100722
dcashmand225b692016-12-12 09:29:04 -0800723built_plat_fc := $(LOCAL_BUILT_MODULE)
724local_fc_files :=
Alex Klyubine4665d72017-01-19 19:58:34 -0800725local_fcfiles_with_nl :=
dcashmand225b692016-12-12 09:29:04 -0800726
727##################################
728include $(CLEAR_VARS)
729
730LOCAL_MODULE := nonplat_file_contexts
731LOCAL_MODULE_CLASS := ETC
732LOCAL_MODULE_TAGS := optional
Jeff Vander Stoep0cb417a2017-03-08 14:12:54 -0800733LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
dcashmand225b692016-12-12 09:29:04 -0800734
735include $(BUILD_SYSTEM)/base_rules.mk
736
737nonplat_fc_files := $(call build_device_policy, file_contexts)
738nonplat_fcfiles_with_nl := $(call add_nl, $(nonplat_fc_files), $(built_nl))
739
740$(LOCAL_BUILT_MODULE): PRIVATE_FC_FILES := $(nonplat_fcfiles_with_nl)
741$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
742$(LOCAL_BUILT_MODULE): PRIVATE_FC_SORT := $(HOST_OUT_EXECUTABLES)/fc_sort
743$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/checkfc $(HOST_OUT_EXECUTABLES)/fc_sort \
Alex Klyubine4665d72017-01-19 19:58:34 -0800744$(nonplat_fcfiles_with_nl) $(built_sepolicy)
dcashmand225b692016-12-12 09:29:04 -0800745 @mkdir -p $(dir $@)
746 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_FC_FILES) > $@.tmp
747 $(hide) $< $(PRIVATE_SEPOLICY) $@.tmp
748 $(hide) $(PRIVATE_FC_SORT) $@.tmp $@
749
750built_nonplat_fc := $(LOCAL_BUILT_MODULE)
751nonplat_fc_files :=
752nonplat_fcfiles_with_nl :=
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400753
754##################################
755include $(CLEAR_VARS)
Dan Cashman9c038072016-12-22 07:15:18 -0800756LOCAL_MODULE := plat_seapp_contexts
Ying Wang02fb5f32012-01-17 17:51:09 -0800757LOCAL_MODULE_CLASS := ETC
758LOCAL_MODULE_TAGS := optional
Jeff Vander Stoep4e3a4c72017-03-08 22:28:03 -0800759ifeq ($(PRODUCT_FULL_TREBLE),true)
760LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
761else
Ying Wang02fb5f32012-01-17 17:51:09 -0800762LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Jeff Vander Stoep4e3a4c72017-03-08 22:28:03 -0800763endif
Ying Wang02fb5f32012-01-17 17:51:09 -0800764
William Roberts171a0622012-08-16 10:55:05 -0700765include $(BUILD_SYSTEM)/base_rules.mk
Ying Wang02fb5f32012-01-17 17:51:09 -0800766
Dan Cashman9c038072016-12-22 07:15:18 -0800767plat_sc_files := $(call build_policy, seapp_contexts, $(PLAT_PRIVATE_POLICY))
William Roberts171a0622012-08-16 10:55:05 -0700768
Ying Wangd8b122c2012-10-25 19:01:31 -0700769$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Dan Cashman9c038072016-12-22 07:15:18 -0800770$(LOCAL_BUILT_MODULE): PRIVATE_SC_FILES := $(plat_sc_files)
771$(LOCAL_BUILT_MODULE): $(built_sepolicy) $(plat_sc_files) $(HOST_OUT_EXECUTABLES)/checkseapp
William Robertsf0e0a942012-08-27 15:41:15 -0700772 @mkdir -p $(dir $@)
William Roberts99fe8df2015-06-30 13:53:51 -0700773 $(hide) $(HOST_OUT_EXECUTABLES)/checkseapp -p $(PRIVATE_SEPOLICY) -o $@ $(PRIVATE_SC_FILES)
Ying Wang02fb5f32012-01-17 17:51:09 -0800774
Dan Cashman9c038072016-12-22 07:15:18 -0800775built_plat_sc := $(LOCAL_BUILT_MODULE)
776plat_sc_files :=
Robert Craig8b7545b2014-03-20 09:35:08 -0400777
Ying Wang02fb5f32012-01-17 17:51:09 -0800778##################################
Stephen Smalley124720a2012-04-04 10:11:16 -0400779include $(CLEAR_VARS)
Dan Cashman9c038072016-12-22 07:15:18 -0800780LOCAL_MODULE := nonplat_seapp_contexts
Stephen Smalley37712872015-03-12 15:46:36 -0400781LOCAL_MODULE_CLASS := ETC
Dan Cashman9c038072016-12-22 07:15:18 -0800782LOCAL_MODULE_TAGS := optional
Jeff Vander Stoep4e3a4c72017-03-08 22:28:03 -0800783ifeq ($(PRODUCT_FULL_TREBLE),true)
784LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
785else
Dan Cashman9c038072016-12-22 07:15:18 -0800786LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Jeff Vander Stoep4e3a4c72017-03-08 22:28:03 -0800787endif
Stephen Smalley37712872015-03-12 15:46:36 -0400788
789include $(BUILD_SYSTEM)/base_rules.mk
790
Alex Klyubin55961722017-01-30 18:44:59 -0800791nonplat_sc_files := $(call build_policy, seapp_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
Jeff Vander Stoep87ae5f72017-03-06 22:53:09 -0800792plat_sc_neverallow_files := $(addprefix $(PLAT_PRIVATE_POLICY)/, seapp_contexts)
Stephen Smalley37712872015-03-12 15:46:36 -0400793
Dan Cashman9c038072016-12-22 07:15:18 -0800794$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
795$(LOCAL_BUILT_MODULE): PRIVATE_SC_FILES := $(nonplat_sc_files)
Jeff Vander Stoep87ae5f72017-03-06 22:53:09 -0800796$(LOCAL_BUILT_MODULE): PRIVATE_SC_NEVERALLOW_FILES := $(plat_sc_neverallow_files)
797$(LOCAL_BUILT_MODULE): $(built_sepolicy) $(nonplat_sc_files) $(HOST_OUT_EXECUTABLES)/checkseapp $(plat_sc_neverallow_files)
Stephen Smalley37712872015-03-12 15:46:36 -0400798 @mkdir -p $(dir $@)
Xin Liec6f3932017-03-14 16:51:13 -0700799 $(hide) grep -ie '^neverallow' $(PRIVATE_SC_NEVERALLOW_FILES) > $@.tmp
800 $(hide) $(HOST_OUT_EXECUTABLES)/checkseapp -p $(PRIVATE_SEPOLICY) -o $@ $(PRIVATE_SC_FILES) $@.tmp
Stephen Smalley37712872015-03-12 15:46:36 -0400801
Dan Cashman9c038072016-12-22 07:15:18 -0800802built_nonplat_sc := $(LOCAL_BUILT_MODULE)
803nonplat_sc_files :=
Stephen Smalley37712872015-03-12 15:46:36 -0400804
805##################################
806include $(CLEAR_VARS)
Dan Cashman9c038072016-12-22 07:15:18 -0800807LOCAL_MODULE := plat_seapp_neverallows
William Roberts4ee71312015-06-25 11:59:30 -0700808LOCAL_MODULE_CLASS := ETC
809LOCAL_MODULE_TAGS := tests
810
811include $(BUILD_SYSTEM)/base_rules.mk
812
Jeff Vander Stoep87ae5f72017-03-06 22:53:09 -0800813$(LOCAL_BUILT_MODULE): $(plat_sc_neverallow_files)
William Roberts4ee71312015-06-25 11:59:30 -0700814 @mkdir -p $(dir $@)
815 - $(hide) grep -ie '^neverallow' $< > $@
816
Jeff Vander Stoep87ae5f72017-03-06 22:53:09 -0800817plat_sc_neverallow_files :=
William Roberts4ee71312015-06-25 11:59:30 -0700818
819##################################
820include $(CLEAR_VARS)
Stephen Smalley124720a2012-04-04 10:11:16 -0400821
Sandeep Patila86316e2016-12-27 16:08:44 -0800822LOCAL_MODULE := plat_property_contexts
Stephen Smalley124720a2012-04-04 10:11:16 -0400823LOCAL_MODULE_CLASS := ETC
824LOCAL_MODULE_TAGS := optional
Alex Klyubin9d590412017-03-08 13:10:05 -0800825
826ifeq ($(PRODUCT_FULL_TREBLE),true)
827LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
828else
Stephen Smalley124720a2012-04-04 10:11:16 -0400829LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Alex Klyubin9d590412017-03-08 13:10:05 -0800830endif
Stephen Smalley124720a2012-04-04 10:11:16 -0400831
832include $(BUILD_SYSTEM)/base_rules.mk
833
Sandeep Patila86316e2016-12-27 16:08:44 -0800834plat_pcfiles := $(call build_policy, property_contexts, $(PLAT_PRIVATE_POLICY))
William Roberts6aabc1c2015-07-30 11:44:26 -0700835
Sandeep Patila86316e2016-12-27 16:08:44 -0800836plat_property_contexts.tmp := $(intermediates)/plat_property_contexts.tmp
837$(plat_property_contexts.tmp): PRIVATE_PC_FILES := $(plat_pcfiles)
838$(plat_property_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
839$(plat_property_contexts.tmp): $(plat_pcfiles)
William Roberts7f81b332015-09-29 13:52:37 -0700840 @mkdir -p $(dir $@)
Colin Cross9eb6c872015-10-01 21:25:09 +0000841 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_PC_FILES) > $@
William Robertsdcffd2b2015-09-29 13:52:37 -0700842$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Sandeep Patila86316e2016-12-27 16:08:44 -0800843$(LOCAL_BUILT_MODULE): $(plat_property_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc
William Robertsdcffd2b2015-09-29 13:52:37 -0700844 @mkdir -p $(dir $@)
Sandeep Patila86316e2016-12-27 16:08:44 -0800845 $(hide) sed -e 's/#.*$$//' -e '/^$$/d' $< | sort -u -o $@
dcashman07791552016-12-07 11:27:47 -0800846 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -p $(PRIVATE_SEPOLICY) $@
Stephen Smalley124720a2012-04-04 10:11:16 -0400847
Sandeep Patila86316e2016-12-27 16:08:44 -0800848built_plat_pc := $(LOCAL_BUILT_MODULE)
849plat_pcfiles :=
850plat_property_contexts.tmp :=
Robert Craig8b7545b2014-03-20 09:35:08 -0400851
Stephen Smalley124720a2012-04-04 10:11:16 -0400852##################################
Riley Spahnf90c41f2014-06-05 15:52:02 -0700853include $(CLEAR_VARS)
Sandeep Patila86316e2016-12-27 16:08:44 -0800854LOCAL_MODULE := nonplat_property_contexts
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400855LOCAL_MODULE_CLASS := ETC
Sandeep Patila86316e2016-12-27 16:08:44 -0800856LOCAL_MODULE_TAGS := optional
Alex Klyubin9d590412017-03-08 13:10:05 -0800857
858ifeq ($(PRODUCT_FULL_TREBLE),true)
859LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
860else
Sandeep Patila86316e2016-12-27 16:08:44 -0800861LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Alex Klyubin9d590412017-03-08 13:10:05 -0800862endif
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400863
Stephen Smalleyc9361732015-03-13 09:36:57 -0400864include $(BUILD_SYSTEM)/base_rules.mk
865
Alex Klyubin55961722017-01-30 18:44:59 -0800866nonplat_pcfiles := $(call build_policy, property_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
Sandeep Patil262edc32016-12-27 16:08:44 -0800867
Sandeep Patila86316e2016-12-27 16:08:44 -0800868nonplat_property_contexts.tmp := $(intermediates)/nonplat_property_contexts.tmp
869$(nonplat_property_contexts.tmp): PRIVATE_PC_FILES := $(nonplat_pcfiles)
870$(nonplat_property_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
871$(nonplat_property_contexts.tmp): $(nonplat_pcfiles)
William Robertsdcffd2b2015-09-29 13:52:37 -0700872 @mkdir -p $(dir $@)
Sandeep Patila86316e2016-12-27 16:08:44 -0800873 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_PC_FILES) > $@
874
875
876$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
877$(LOCAL_BUILT_MODULE): $(nonplat_property_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc
878 @mkdir -p $(dir $@)
879 $(hide) sed -e 's/#.*$$//' -e '/^$$/d' $< | sort -u -o $@
dcashman07791552016-12-07 11:27:47 -0800880 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -p $(PRIVATE_SEPOLICY) $@
William Robertsdcffd2b2015-09-29 13:52:37 -0700881
Sandeep Patila86316e2016-12-27 16:08:44 -0800882built_nonplat_pc := $(LOCAL_BUILT_MODULE)
883nonplat_pcfiles :=
884nonplat_property_contexts.tmp :=
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400885
886##################################
887include $(CLEAR_VARS)
888
Alex Klyubinec78c372017-03-10 12:44:16 -0800889LOCAL_MODULE := plat_property_contexts.recovery
890LOCAL_MODULE_STEM := plat_property_contexts
891LOCAL_MODULE_CLASS := ETC
892LOCAL_MODULE_TAGS := optional
893LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
894
895include $(BUILD_SYSTEM)/base_rules.mk
896
897$(LOCAL_BUILT_MODULE): $(built_plat_pc)
898 $(hide) cp -f $< $@
899
900##################################
901include $(CLEAR_VARS)
Alex Klyubinec78c372017-03-10 12:44:16 -0800902LOCAL_MODULE := nonplat_property_contexts.recovery
903LOCAL_MODULE_STEM := nonplat_property_contexts
904LOCAL_MODULE_CLASS := ETC
905LOCAL_MODULE_TAGS := optional
906LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
907
908include $(BUILD_SYSTEM)/base_rules.mk
909
910$(LOCAL_BUILT_MODULE): $(built_nonplat_pc)
911 $(hide) cp -f $< $@
912
913##################################
914include $(CLEAR_VARS)
915
Sandeep Patila058b562016-12-27 15:10:48 -0800916LOCAL_MODULE := plat_service_contexts
Riley Spahnf90c41f2014-06-05 15:52:02 -0700917LOCAL_MODULE_CLASS := ETC
918LOCAL_MODULE_TAGS := optional
Jeff Vander Stoep4e3a4c72017-03-08 22:28:03 -0800919ifeq ($(PRODUCT_FULL_TREBLE),true)
920LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
921else
Riley Spahnf90c41f2014-06-05 15:52:02 -0700922LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Jeff Vander Stoep4e3a4c72017-03-08 22:28:03 -0800923endif
Riley Spahnf90c41f2014-06-05 15:52:02 -0700924
925include $(BUILD_SYSTEM)/base_rules.mk
926
Sandeep Patila058b562016-12-27 15:10:48 -0800927plat_svcfiles := $(call build_policy, service_contexts, $(PLAT_PRIVATE_POLICY))
Riley Spahnf90c41f2014-06-05 15:52:02 -0700928
Sandeep Patila058b562016-12-27 15:10:48 -0800929plat_service_contexts.tmp := $(intermediates)/plat_service_contexts.tmp
930$(plat_service_contexts.tmp): PRIVATE_SVC_FILES := $(plat_svcfiles)
931$(plat_service_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
932$(plat_service_contexts.tmp): $(plat_svcfiles)
Riley Spahnf90c41f2014-06-05 15:52:02 -0700933 @mkdir -p $(dir $@)
William Roberts6aabc1c2015-07-30 11:44:26 -0700934 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
William Roberts7fc865a2015-09-29 14:17:38 -0700935
936$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
Sandeep Patila058b562016-12-27 15:10:48 -0800937$(LOCAL_BUILT_MODULE): $(plat_service_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
William Roberts7fc865a2015-09-29 14:17:38 -0700938 @mkdir -p $(dir $@)
William Robertsc9fce3f2016-04-06 11:53:04 -0700939 sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
dcashman07791552016-12-07 11:27:47 -0800940 $(HOST_OUT_EXECUTABLES)/checkfc -s $(PRIVATE_SEPOLICY) $@
Riley Spahnf90c41f2014-06-05 15:52:02 -0700941
Sandeep Patila058b562016-12-27 15:10:48 -0800942built_plat_svc := $(LOCAL_BUILT_MODULE)
943plat_svcfiles :=
944plat_service_contexts.tmp :=
Riley Spahnf90c41f2014-06-05 15:52:02 -0700945
946##################################
rpcraigb19665c2012-07-30 09:33:03 -0400947include $(CLEAR_VARS)
948
Sandeep Patila058b562016-12-27 15:10:48 -0800949LOCAL_MODULE := nonplat_service_contexts
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400950LOCAL_MODULE_CLASS := ETC
Sandeep Patila058b562016-12-27 15:10:48 -0800951LOCAL_MODULE_TAGS := optional
Jeff Vander Stoep4e3a4c72017-03-08 22:28:03 -0800952ifeq ($(PRODUCT_FULL_TREBLE),true)
953LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
954else
Sandeep Patila058b562016-12-27 15:10:48 -0800955LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
Jeff Vander Stoep4e3a4c72017-03-08 22:28:03 -0800956endif
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400957
958include $(BUILD_SYSTEM)/base_rules.mk
959
Alex Klyubin55961722017-01-30 18:44:59 -0800960nonplat_svcfiles := $(call build_policy, service_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400961
Sandeep Patila058b562016-12-27 15:10:48 -0800962nonplat_service_contexts.tmp := $(intermediates)/nonplat_service_contexts.tmp
963$(nonplat_service_contexts.tmp): PRIVATE_SVC_FILES := $(nonplat_svcfiles)
964$(nonplat_service_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
965$(nonplat_service_contexts.tmp): $(nonplat_svcfiles)
966 @mkdir -p $(dir $@)
967 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
968
969$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
970$(LOCAL_BUILT_MODULE): $(nonplat_service_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
William Roberts7fc865a2015-09-29 14:17:38 -0700971 @mkdir -p $(dir $@)
William Robertsc9fce3f2016-04-06 11:53:04 -0700972 sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
dcashman07791552016-12-07 11:27:47 -0800973 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -s $(PRIVATE_SEPOLICY) $@
William Roberts7fc865a2015-09-29 14:17:38 -0700974
Sandeep Patila058b562016-12-27 15:10:48 -0800975built_nonplat_svc := $(LOCAL_BUILT_MODULE)
976nonplat_svcfiles :=
977nonplat_service_contexts.tmp :=
Stephen Smalley2e0cd5a2015-03-12 17:45:03 -0400978
979##################################
980include $(CLEAR_VARS)
981
Martijn Coenen3ea47b92017-04-07 16:14:43 -0700982LOCAL_MODULE := plat_hwservice_contexts
983LOCAL_MODULE_CLASS := ETC
984LOCAL_MODULE_TAGS := optional
985ifeq ($(PRODUCT_FULL_TREBLE),true)
986LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
987else
988LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
989endif
990
991include $(BUILD_SYSTEM)/base_rules.mk
992
993plat_hwsvcfiles := $(call build_policy, hwservice_contexts, $(PLAT_PRIVATE_POLICY))
994
995plat_hwservice_contexts.tmp := $(intermediates)/plat_hwservice_contexts.tmp
996$(plat_hwservice_contexts.tmp): PRIVATE_SVC_FILES := $(plat_hwsvcfiles)
997$(plat_hwservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
998$(plat_hwservice_contexts.tmp): $(plat_hwsvcfiles)
999 @mkdir -p $(dir $@)
1000 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
1001
1002$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
1003$(LOCAL_BUILT_MODULE): $(plat_hwservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
1004 @mkdir -p $(dir $@)
1005 sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
1006 $(HOST_OUT_EXECUTABLES)/checkfc -e -l $(PRIVATE_SEPOLICY) $@
1007
1008plat_hwsvcfiles :=
1009plat_hwservice_contexts.tmp :=
1010
1011##################################
1012include $(CLEAR_VARS)
1013
1014LOCAL_MODULE := nonplat_hwservice_contexts
1015LOCAL_MODULE_CLASS := ETC
1016LOCAL_MODULE_TAGS := optional
1017ifeq ($(PRODUCT_FULL_TREBLE),true)
1018LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
1019else
1020LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
1021endif
1022
1023include $(BUILD_SYSTEM)/base_rules.mk
1024
1025nonplat_hwsvcfiles := $(call build_policy, hwservice_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
1026
1027nonplat_hwservice_contexts.tmp := $(intermediates)/nonplat_hwservice_contexts.tmp
1028$(nonplat_hwservice_contexts.tmp): PRIVATE_SVC_FILES := $(nonplat_hwsvcfiles)
1029$(nonplat_hwservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1030$(nonplat_hwservice_contexts.tmp): $(nonplat_hwsvcfiles)
1031 @mkdir -p $(dir $@)
1032 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
1033
1034$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
1035$(LOCAL_BUILT_MODULE): $(nonplat_hwservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
1036 @mkdir -p $(dir $@)
1037 sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
1038 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e -l $(PRIVATE_SEPOLICY) $@
1039
1040nonplat_hwsvcfiles :=
1041nonplat_hwservice_contexts.tmp :=
1042
1043##################################
1044include $(CLEAR_VARS)
1045
Martijn Coenen6676c232017-03-31 17:29:53 -07001046LOCAL_MODULE := vndservice_contexts
1047LOCAL_MODULE_CLASS := ETC
1048LOCAL_MODULE_TAGS := optional
1049ifeq ($(PRODUCT_FULL_TREBLE),true)
1050LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
1051else
1052LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
1053endif
1054
1055include $(BUILD_SYSTEM)/base_rules.mk
1056
1057vnd_svcfiles := $(call build_policy, vndservice_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
1058
1059vndservice_contexts.tmp := $(intermediates)/vndservice_contexts.tmp
1060$(vndservice_contexts.tmp): PRIVATE_SVC_FILES := $(vnd_svcfiles)
1061$(vndservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1062$(vndservice_contexts.tmp): $(vnd_svcfiles)
1063 @mkdir -p $(dir $@)
1064 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
1065
1066$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
1067$(LOCAL_BUILT_MODULE): $(vndservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
1068 @mkdir -p $(dir $@)
1069 sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
Martijn Coenenee976622017-04-07 10:08:55 -07001070 $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e -v $(PRIVATE_SEPOLICY) $@
Martijn Coenen6676c232017-03-31 17:29:53 -07001071
1072vnd_svcfiles :=
1073vndservice_contexts.tmp :=
1074##################################
1075include $(CLEAR_VARS)
1076
dcashman90b3b942016-12-14 13:47:55 -08001077LOCAL_MODULE := plat_mac_permissions.xml
rpcraigb19665c2012-07-30 09:33:03 -04001078LOCAL_MODULE_CLASS := ETC
1079LOCAL_MODULE_TAGS := optional
Jeff Vander Stoepbba9e7b2017-03-10 15:51:23 -08001080LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
rpcraigb19665c2012-07-30 09:33:03 -04001081
William Roberts2c8a55d2012-11-30 14:59:09 -08001082include $(BUILD_SYSTEM)/base_rules.mk
rpcraigb19665c2012-07-30 09:33:03 -04001083
Geremy Condracd4104e2013-03-26 18:19:12 +00001084# Build keys.conf
dcashman90b3b942016-12-14 13:47:55 -08001085plat_mac_perms_keys.tmp := $(intermediates)/plat_keys.tmp
1086$(plat_mac_perms_keys.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
1087$(plat_mac_perms_keys.tmp): $(call build_policy, keys.conf, $(PLAT_PRIVATE_POLICY))
Geremy Condracd4104e2013-03-26 18:19:12 +00001088 @mkdir -p $(dir $@)
William Robertsd2185582015-07-16 11:28:02 -07001089 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@
Geremy Condracd4104e2013-03-26 18:19:12 +00001090
dcashman90b3b942016-12-14 13:47:55 -08001091all_plat_mac_perms_files := $(call build_policy, mac_permissions.xml, $(PLAT_PRIVATE_POLICY))
rpcraigb19665c2012-07-30 09:33:03 -04001092
Shinichiro Hamajief0c14d2016-05-13 16:04:58 +09001093# Should be synced with keys.conf.
dcashman90b3b942016-12-14 13:47:55 -08001094all_plat_keys := platform media shared testkey
1095all_plat_keys := $(all_keys:%=$(dir $(DEFAULT_SYSTEM_DEV_CERTIFICATE))/%.x509.pem)
Shinichiro Hamajief0c14d2016-05-13 16:04:58 +09001096
dcashman90b3b942016-12-14 13:47:55 -08001097$(LOCAL_BUILT_MODULE): PRIVATE_MAC_PERMS_FILES := $(all_plat_mac_perms_files)
1098$(LOCAL_BUILT_MODULE): $(plat_mac_perms_keys.tmp) $(HOST_OUT_EXECUTABLES)/insertkeys.py \
1099$(all_plat_mac_perms_files) $(all_plat_keys)
Geremy Condracd4104e2013-03-26 18:19:12 +00001100 @mkdir -p $(dir $@)
Nick Kralevichc3c90522013-10-25 12:25:36 -07001101 $(hide) DEFAULT_SYSTEM_DEV_CERTIFICATE="$(dir $(DEFAULT_SYSTEM_DEV_CERTIFICATE))" \
William Roberts6aabc1c2015-07-30 11:44:26 -07001102 $(HOST_OUT_EXECUTABLES)/insertkeys.py -t $(TARGET_BUILD_VARIANT) -c $(TOP) $< -o $@ $(PRIVATE_MAC_PERMS_FILES)
Geremy Condracd4104e2013-03-26 18:19:12 +00001103
William Roberts6aabc1c2015-07-30 11:44:26 -07001104all_mac_perms_files :=
dcashman90b3b942016-12-14 13:47:55 -08001105all_plat_keys :=
1106plat_mac_perms_keys.tmp :=
1107
1108##################################
1109include $(CLEAR_VARS)
1110
1111LOCAL_MODULE := nonplat_mac_permissions.xml
1112LOCAL_MODULE_CLASS := ETC
1113LOCAL_MODULE_TAGS := optional
Jeff Vander Stoepbba9e7b2017-03-10 15:51:23 -08001114LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
dcashman90b3b942016-12-14 13:47:55 -08001115
1116include $(BUILD_SYSTEM)/base_rules.mk
1117
1118# Build keys.conf
1119nonplat_mac_perms_keys.tmp := $(intermediates)/nonplat_keys.tmp
1120$(nonplat_mac_perms_keys.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
Alex Klyubin55961722017-01-30 18:44:59 -08001121$(nonplat_mac_perms_keys.tmp): $(call build_policy, keys.conf, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
dcashman90b3b942016-12-14 13:47:55 -08001122 @mkdir -p $(dir $@)
1123 $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@
1124
Alex Klyubin55961722017-01-30 18:44:59 -08001125all_nonplat_mac_perms_files := $(call build_policy, mac_permissions.xml, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
dcashman90b3b942016-12-14 13:47:55 -08001126
1127$(LOCAL_BUILT_MODULE): PRIVATE_MAC_PERMS_FILES := $(all_nonplat_mac_perms_files)
1128$(LOCAL_BUILT_MODULE): $(nonplat_mac_perms_keys.tmp) $(HOST_OUT_EXECUTABLES)/insertkeys.py \
1129$(all_nonplat_mac_perms_files)
1130 @mkdir -p $(dir $@)
1131 $(hide) $(HOST_OUT_EXECUTABLES)/insertkeys.py -t $(TARGET_BUILD_VARIANT) -c $(TOP) $< -o $@ $(PRIVATE_MAC_PERMS_FILES)
1132
1133nonplat_mac_perms_keys.tmp :=
1134all_nonplat_mac_perms_files :=
William Roberts6aabc1c2015-07-30 11:44:26 -07001135
rpcraigb19665c2012-07-30 09:33:03 -04001136##################################
rpcraig47cd3962012-10-17 21:09:52 -04001137
Dan Cashman1c040272016-12-15 15:28:44 -08001138add_nl :=
William Roberts49693f12016-01-04 12:20:57 -08001139build_device_policy :=
Dan Cashman1c040272016-12-15 15:28:44 -08001140build_policy :=
dcashmand225b692016-12-12 09:29:04 -08001141built_plat_fc :=
1142built_nonplat_fc :=
Richard Hainesc8801fe2015-12-11 10:39:19 +00001143built_nl :=
Alex Klyubin8f7173b2017-02-25 14:47:53 -08001144built_plat_cil :=
Alex Klyubin8f7173b2017-02-25 14:47:53 -08001145built_mapping_cil :=
Sandeep Patila86316e2016-12-27 16:08:44 -08001146built_plat_pc :=
Alex Klyubin193dccd2017-03-07 14:05:57 -08001147built_nonplat_cil :=
Sandeep Patila86316e2016-12-27 16:08:44 -08001148built_nonplat_pc :=
Dan Cashman9c038072016-12-22 07:15:18 -08001149built_nonplat_sc :=
1150built_plat_sc :=
Alex Klyubin193dccd2017-03-07 14:05:57 -08001151built_precompiled_sepolicy :=
Dan Cashman1c040272016-12-15 15:28:44 -08001152built_sepolicy :=
Sandeep Patila058b562016-12-27 15:10:48 -08001153built_plat_svc :=
1154built_nonplat_svc :=
Dan Cashman1c040272016-12-15 15:28:44 -08001155mapping_policy_nvr :=
Dan Cashman1c040272016-12-15 15:28:44 -08001156my_target_arch :=
1157nonplat_policy_nvr :=
Dan Cashman1c040272016-12-15 15:28:44 -08001158plat_policy_nvr :=
dcashman1faa6442016-11-28 07:20:28 -08001159plat_pub_policy.cil :=
1160reqd_policy_mask.cil :=
Dan Cashman1c040272016-12-15 15:28:44 -08001161sepolicy_build_files :=
Alex Klyubin7cda44f2017-03-21 14:28:53 -07001162sepolicy_build_cil_workaround_files :=
Jeff Vander Stoep74434842017-03-13 12:22:15 -07001163with_asan :=
Alice Chucdfb06f2012-11-01 11:33:04 -07001164
1165include $(call all-makefiles-under,$(LOCAL_PATH))