Skip to content
Snippets Groups Projects
Commit be3abb95 authored by android-build-team Robot's avatar android-build-team Robot
Browse files

Snap for 4489599 from cf9fd376 to pi-release 

Change-Id: Ifee1d5ed81430c21736b1fe3b3e8b213e42386bf
parents 4de49671 cf9fd376
No related branches found
No related tags found
No related merge requests found
Hide whitespace changes
Inline Side-by-side
Android.mk
+ 166
− 122
View file @ be3abb95
...@@ -113,6 +113,13 @@ $(warning BOARD_SEPOLICY_VERS not specified, assuming current platform version) ...@@ -113,6 +113,13 @@ $(warning BOARD_SEPOLICY_VERS not specified, assuming current platform version)
BOARD_SEPOLICY_VERS := $(PLATFORM_SEPOLICY_VERSION) BOARD_SEPOLICY_VERS := $(PLATFORM_SEPOLICY_VERSION)
endif endif
# BOARD_SEPOLICY_DIRS was used for vendor sepolicy customization before.
# It has been replaced by BOARD_VENDOR_SEPOLICY_DIRS. BOARD_SEPOLICY_DIRS is
# still allowed for backward compatibility, which will be merged into
# BOARD_VENDOR_SEPOLICY_DIRS.
ifdef BOARD_SEPOLICY_DIRS
BOARD_VENDOR_SEPOLICY_DIRS += $(BOARD_SEPOLICY_DIRS)
endif
platform_mapping_file := $(BOARD_SEPOLICY_VERS).cil platform_mapping_file := $(BOARD_SEPOLICY_VERS).cil
...@@ -126,9 +133,9 @@ define build_policy ...@@ -126,9 +133,9 @@ define build_policy
$(foreach type, $(1), $(foreach file, $(addsuffix /$(type), $(2)), $(sort $(wildcard $(file))))) $(foreach type, $(1), $(foreach file, $(addsuffix /$(type), $(2)), $(sort $(wildcard $(file)))))
endef endef
# Builds paths for all policy files found in BOARD_SEPOLICY_DIRS. # Builds paths for all policy files found in BOARD_VENDOR_SEPOLICY_DIRS.
# $(1): the set of policy name paths to build # $(1): the set of policy name paths to build
build_device_policy = $(call build_policy, $(1), $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS)) build_vendor_policy = $(call build_policy, $(1), $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS))
# Add a file containing only a newline in-between each policy configuration # Add a file containing only a newline in-between each policy configuration
# 'contexts' file. This will allow OEM policy configuration files without a # 'contexts' file. This will allow OEM policy configuration files without a
...@@ -198,7 +205,8 @@ ifeq ($(PRODUCT_SEPOLICY_SPLIT),true) ...@@ -198,7 +205,8 @@ ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
LOCAL_REQUIRED_MODULES += \ LOCAL_REQUIRED_MODULES += \
$(platform_mapping_file) \ $(platform_mapping_file) \
26.0.cil \ 26.0.cil \
nonplat_sepolicy.cil \ plat_pub_versioned.cil \
vendor_sepolicy.cil \
plat_sepolicy.cil \ plat_sepolicy.cil \
plat_and_mapping_sepolicy.cil.sha256 \ plat_and_mapping_sepolicy.cil.sha256 \
secilc \ secilc \
...@@ -214,11 +222,11 @@ LOCAL_REQUIRED_MODULES += sepolicy ...@@ -214,11 +222,11 @@ LOCAL_REQUIRED_MODULES += sepolicy
endif endif
LOCAL_REQUIRED_MODULES += \ LOCAL_REQUIRED_MODULES += \
nonplat_file_contexts \ vendor_file_contexts \
nonplat_mac_permissions.xml \ vendor_mac_permissions.xml \
nonplat_property_contexts \ vendor_property_contexts \
nonplat_seapp_contexts \ vendor_seapp_contexts \
nonplat_hwservice_contexts \ vendor_hwservice_contexts \
plat_file_contexts \ plat_file_contexts \
plat_mac_permissions.xml \ plat_mac_permissions.xml \
plat_property_contexts \ plat_property_contexts \
...@@ -229,7 +237,7 @@ LOCAL_REQUIRED_MODULES += \ ...@@ -229,7 +237,7 @@ LOCAL_REQUIRED_MODULES += \
vndservice_contexts \ vndservice_contexts \
ifneq ($(PRODUCT_SEPOLICY_SPLIT),true) ifneq ($(PRODUCT_SEPOLICY_SPLIT),true)
LOCAL_REQUIRED_MODULES += nonplat_service_contexts LOCAL_REQUIRED_MODULES += vendor_service_contexts
endif endif
ifneq ($(TARGET_BUILD_VARIANT), user) ifneq ($(TARGET_BUILD_VARIANT), user)
...@@ -431,7 +439,35 @@ $(LOCAL_BUILT_MODULE): $(built_plat_cil) $(built_mapping_cil) ...@@ -431,7 +439,35 @@ $(LOCAL_BUILT_MODULE): $(built_plat_cil) $(built_mapping_cil)
################################# #################################
include $(CLEAR_VARS) include $(CLEAR_VARS)
LOCAL_MODULE := nonplat_sepolicy.cil # plat_pub_versioned.cil - the exported platform policy associated with the version
# that non-platform policy targets.
LOCAL_MODULE := plat_pub_versioned.cil
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_PROPRIETARY_MODULE := true
LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
include $(BUILD_SYSTEM)/base_rules.mk
$(LOCAL_BUILT_MODULE) : PRIVATE_VERS := $(BOARD_SEPOLICY_VERS)
$(LOCAL_BUILT_MODULE) : PRIVATE_TGT_POL := $(plat_pub_policy.cil)
$(LOCAL_BUILT_MODULE) : PRIVATE_DEP_CIL_FILES := $(built_plat_cil) $(built_mapping_cil)
$(LOCAL_BUILT_MODULE) : $(plat_pub_policy.cil) $(HOST_OUT_EXECUTABLES)/version_policy \
$(HOST_OUT_EXECUTABLES)/secilc $(built_plat_cil) $(built_mapping_cil)
@mkdir -p $(dir $@)
$(HOST_OUT_EXECUTABLES)/version_policy -b $< -t $(PRIVATE_TGT_POL) -n $(PRIVATE_VERS) -o $@
$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -N -c $(POLICYVERS) \
$(PRIVATE_DEP_CIL_FILES) $@ -o /dev/null -f /dev/null
built_plat_pub_vers_cil := $(LOCAL_BUILT_MODULE)
#################################
include $(CLEAR_VARS)
# vendor_policy.cil - the vendor sepolicy. This needs attributization and to be combined
# with the platform-provided policy. It makes use of the reqd_policy_mask files from private
# policy and the platform public policy files in order to use checkpolicy.
LOCAL_MODULE := vendor_sepolicy.cil
LOCAL_MODULE_CLASS := ETC LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional LOCAL_MODULE_TAGS := optional
LOCAL_PROPRIETARY_MODULE := true LOCAL_PROPRIETARY_MODULE := true
...@@ -439,46 +475,43 @@ LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux ...@@ -439,46 +475,43 @@ LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
include $(BUILD_SYSTEM)/base_rules.mk include $(BUILD_SYSTEM)/base_rules.mk
# nonplat_policy.conf - A combination of the non-platform private, vendor and vendor_policy.conf := $(intermediates)/vendor_policy.conf
# the exported platform policy associated with the version the non-platform $(vendor_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
# policy targets. This needs attributization and to be combined with the $(vendor_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
# platform-provided policy. Like plat_pub_policy.conf, this needs to make use $(vendor_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
# of the reqd_policy_mask files from private policy in order to use checkpolicy. $(vendor_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
nonplat_policy.conf := $(intermediates)/nonplat_policy.conf $(vendor_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(nonplat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS) $(vendor_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
$(nonplat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS) $(vendor_policy.conf): $(call build_policy, $(sepolicy_build_files), \
$(nonplat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch) $(PLAT_PUBLIC_POLICY) $(REQD_MASK_POLICY) $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS))
$(nonplat_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
$(nonplat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(nonplat_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
$(nonplat_policy.conf): $(call build_policy, $(sepolicy_build_files), \
$(PLAT_PUBLIC_POLICY) $(REQD_MASK_POLICY) $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS))
$(transform-policy-to-conf) $(transform-policy-to-conf)
$(hide) sed '/dontaudit/d' $@ > $@.dontaudit $(hide) sed '/dontaudit/d' $@ > $@.dontaudit
nonplat_policy_raw := $(intermediates)/nonplat_policy_raw.cil vendor_policy_raw := $(intermediates)/vendor_policy_raw.cil
$(nonplat_policy_raw): PRIVATE_POL_CONF := $(nonplat_policy.conf) $(vendor_policy_raw): PRIVATE_POL_CONF := $(vendor_policy.conf)
$(nonplat_policy_raw): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil) $(vendor_policy_raw): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil)
$(nonplat_policy_raw): $(HOST_OUT_EXECUTABLES)/checkpolicy $(nonplat_policy.conf) \ $(vendor_policy_raw): $(HOST_OUT_EXECUTABLES)/checkpolicy $(vendor_policy.conf) \
$(reqd_policy_mask.cil) $(reqd_policy_mask.cil)
@mkdir -p $(dir $@) @mkdir -p $(dir $@)
$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $< -C -M -c $(POLICYVERS) -o $@.tmp $(PRIVATE_POL_CONF) $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $< -C -M -c $(POLICYVERS) -o $@.tmp $(PRIVATE_POL_CONF)
$(hide) grep -Fxv -f $(PRIVATE_REQD_MASK) $@.tmp > $@ $(hide) grep -Fxv -f $(PRIVATE_REQD_MASK) $@.tmp > $@
$(LOCAL_BUILT_MODULE) : PRIVATE_VERS := $(BOARD_SEPOLICY_VERS) $(LOCAL_BUILT_MODULE) : PRIVATE_VERS := $(BOARD_SEPOLICY_VERS)
$(LOCAL_BUILT_MODULE) : PRIVATE_TGT_POL := $(nonplat_policy_raw) $(LOCAL_BUILT_MODULE) : PRIVATE_TGT_POL := $(vendor_policy_raw)
$(LOCAL_BUILT_MODULE) : PRIVATE_DEP_CIL_FILES := $(built_plat_cil) $(built_mapping_cil) $(LOCAL_BUILT_MODULE) : PRIVATE_DEP_CIL_FILES := $(built_plat_cil) $(built_plat_pub_vers_cil) $(built_mapping_cil)
$(LOCAL_BUILT_MODULE) : $(plat_pub_policy.cil) $(nonplat_policy_raw) \ $(LOCAL_BUILT_MODULE) : PRIVATE_FILTER_CIL := $(built_plat_pub_vers_cil)
$(HOST_OUT_EXECUTABLES)/version_policy $(HOST_OUT_EXECUTABLES)/secilc \ $(LOCAL_BUILT_MODULE) : $(plat_pub_policy.cil) $(vendor_policy_raw) \
$(built_plat_cil) $(built_mapping_cil) $(HOST_OUT_EXECUTABLES)/version_policy $(HOST_OUT_EXECUTABLES)/secilc \
$(built_plat_cil) $(built_plat_pub_vers_cil) $(built_mapping_cil)
@mkdir -p $(dir $@) @mkdir -p $(dir $@)
$(HOST_OUT_EXECUTABLES)/version_policy -b $< -t $(PRIVATE_TGT_POL) -n $(PRIVATE_VERS) -o $@ $(HOST_OUT_EXECUTABLES)/version_policy -b $< -t $(PRIVATE_TGT_POL) -n $(PRIVATE_VERS) -o $@.tmp
$(hide) grep -Fxv -f $(PRIVATE_FILTER_CIL) $@.tmp > $@
$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -N -c $(POLICYVERS) \ $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -N -c $(POLICYVERS) \
$(PRIVATE_DEP_CIL_FILES) $@ -o /dev/null -f /dev/null $(PRIVATE_DEP_CIL_FILES) $@ -o /dev/null -f /dev/null
built_nonplat_cil := $(LOCAL_BUILT_MODULE) built_vendor_cil := $(LOCAL_BUILT_MODULE)
nonplat_policy.conf := vendor_policy.conf :=
nonplat_policy_raw := vendor_policy_raw :=
################################# #################################
include $(CLEAR_VARS) include $(CLEAR_VARS)
...@@ -491,14 +524,19 @@ LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux ...@@ -491,14 +524,19 @@ LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
include $(BUILD_SYSTEM)/base_rules.mk include $(BUILD_SYSTEM)/base_rules.mk
$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := \ all_cil_files := \
$(built_plat_cil) $(built_mapping_cil) $(built_nonplat_cil) $(built_plat_cil) \
$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc \ $(built_mapping_cil) \
$(built_plat_cil) $(built_mapping_cil) $(built_nonplat_cil) $(built_plat_pub_vers_cil) \
$(built_vendor_cil)
$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(all_cil_files)
$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(all_cil_files)
$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) \ $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) \
$(PRIVATE_CIL_FILES) -o $@ -f /dev/null $(PRIVATE_CIL_FILES) -o $@ -f /dev/null
built_precompiled_sepolicy := $(LOCAL_BUILT_MODULE) built_precompiled_sepolicy := $(LOCAL_BUILT_MODULE)
all_cil_files :=
################################# #################################
# SHA-256 digest of the plat_sepolicy.cil and mapping_sepolicy.cil files against # SHA-256 digest of the plat_sepolicy.cil and mapping_sepolicy.cil files against
...@@ -531,7 +569,8 @@ include $(BUILD_SYSTEM)/base_rules.mk ...@@ -531,7 +569,8 @@ include $(BUILD_SYSTEM)/base_rules.mk
all_cil_files := \ all_cil_files := \
$(built_plat_cil) \ $(built_plat_cil) \
$(built_mapping_cil) \ $(built_mapping_cil) \
$(built_nonplat_cil) $(built_plat_pub_vers_cil) \
$(built_vendor_cil)
$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(all_cil_files) $(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(all_cil_files)
$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $(all_cil_files) $(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $(all_cil_files)
...@@ -572,7 +611,7 @@ $(sepolicy.recovery.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEF ...@@ -572,7 +611,7 @@ $(sepolicy.recovery.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEF
$(sepolicy.recovery.conf): PRIVATE_TGT_RECOVERY := -D target_recovery=true $(sepolicy.recovery.conf): PRIVATE_TGT_RECOVERY := -D target_recovery=true
$(sepolicy.recovery.conf): $(call build_policy, $(sepolicy_build_files), \ $(sepolicy.recovery.conf): $(call build_policy, $(sepolicy_build_files), \
$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) \ $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) \
$(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS)) $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS))
$(transform-policy-to-conf) $(transform-policy-to-conf)
$(hide) sed '/dontaudit/d' $@ > $@.dontaudit $(hide) sed '/dontaudit/d' $@ > $@.dontaudit
...@@ -654,7 +693,7 @@ $(file_contexts.local.tmp): $(local_fcfiles_with_nl) ...@@ -654,7 +693,7 @@ $(file_contexts.local.tmp): $(local_fcfiles_with_nl)
@mkdir -p $(dir $@) @mkdir -p $(dir $@)
$(hide) m4 -s $^ > $@ $(hide) m4 -s $^ > $@
device_fc_files := $(call build_device_policy, file_contexts) device_fc_files := $(call build_vendor_policy, file_contexts)
device_fcfiles_with_nl := $(call add_nl, $(device_fc_files), $(built_nl)) device_fcfiles_with_nl := $(call add_nl, $(device_fc_files), $(built_nl))
file_contexts.device.tmp := $(intermediates)/file_contexts.device.tmp file_contexts.device.tmp := $(intermediates)/file_contexts.device.tmp
...@@ -665,7 +704,8 @@ $(file_contexts.device.tmp): $(device_fcfiles_with_nl) ...@@ -665,7 +704,8 @@ $(file_contexts.device.tmp): $(device_fcfiles_with_nl)
file_contexts.device.sorted.tmp := $(intermediates)/file_contexts.device.sorted.tmp file_contexts.device.sorted.tmp := $(intermediates)/file_contexts.device.sorted.tmp
$(file_contexts.device.sorted.tmp): PRIVATE_SEPOLICY := $(built_sepolicy) $(file_contexts.device.sorted.tmp): PRIVATE_SEPOLICY := $(built_sepolicy)
$(file_contexts.device.sorted.tmp): $(file_contexts.device.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/fc_sort $(HOST_OUT_EXECUTABLES)/checkfc $(file_contexts.device.sorted.tmp): $(file_contexts.device.tmp) $(built_sepolicy) \
$(HOST_OUT_EXECUTABLES)/fc_sort $(HOST_OUT_EXECUTABLES)/checkfc
@mkdir -p $(dir $@) @mkdir -p $(dir $@)
$(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e $(PRIVATE_SEPOLICY) $< $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e $(PRIVATE_SEPOLICY) $<
$(hide) $(HOST_OUT_EXECUTABLES)/fc_sort $< $@ $(hide) $(HOST_OUT_EXECUTABLES)/fc_sort $< $@
...@@ -746,7 +786,7 @@ local_fcfiles_with_nl := ...@@ -746,7 +786,7 @@ local_fcfiles_with_nl :=
################################## ##################################
include $(CLEAR_VARS) include $(CLEAR_VARS)
LOCAL_MODULE := nonplat_file_contexts LOCAL_MODULE := vendor_file_contexts
LOCAL_MODULE_CLASS := ETC LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional LOCAL_MODULE_TAGS := optional
ifeq ($(PRODUCT_SEPOLICY_SPLIT),true) ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
...@@ -757,22 +797,22 @@ endif ...@@ -757,22 +797,22 @@ endif
include $(BUILD_SYSTEM)/base_rules.mk include $(BUILD_SYSTEM)/base_rules.mk
nonplat_fc_files := $(call build_device_policy, file_contexts) vendor_fc_files := $(call build_vendor_policy, file_contexts)
nonplat_fcfiles_with_nl := $(call add_nl, $(nonplat_fc_files), $(built_nl)) vendor_fcfiles_with_nl := $(call add_nl, $(vendor_fc_files), $(built_nl))
$(LOCAL_BUILT_MODULE): PRIVATE_FC_FILES := $(nonplat_fcfiles_with_nl) $(LOCAL_BUILT_MODULE): PRIVATE_FC_FILES := $(vendor_fcfiles_with_nl)
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) $(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
$(LOCAL_BUILT_MODULE): PRIVATE_FC_SORT := $(HOST_OUT_EXECUTABLES)/fc_sort $(LOCAL_BUILT_MODULE): PRIVATE_FC_SORT := $(HOST_OUT_EXECUTABLES)/fc_sort
$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/checkfc $(HOST_OUT_EXECUTABLES)/fc_sort \ $(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/checkfc $(HOST_OUT_EXECUTABLES)/fc_sort \
$(nonplat_fcfiles_with_nl) $(built_sepolicy) $(vendor_fcfiles_with_nl) $(built_sepolicy)
@mkdir -p $(dir $@) @mkdir -p $(dir $@)
$(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_FC_FILES) > $@.tmp $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_FC_FILES) > $@.tmp
$(hide) $< $(PRIVATE_SEPOLICY) $@.tmp $(hide) $< $(PRIVATE_SEPOLICY) $@.tmp
$(hide) $(PRIVATE_FC_SORT) $@.tmp $@ $(hide) $(PRIVATE_FC_SORT) $@.tmp $@
built_nonplat_fc := $(LOCAL_BUILT_MODULE) built_vendor_fc := $(LOCAL_BUILT_MODULE)
nonplat_fc_files := vendor_fc_files :=
nonplat_fcfiles_with_nl := vendor_fcfiles_with_nl :=
################################## ##################################
include $(CLEAR_VARS) include $(CLEAR_VARS)
...@@ -790,15 +830,15 @@ $(LOCAL_BUILT_MODULE): $(built_plat_fc) ...@@ -790,15 +830,15 @@ $(LOCAL_BUILT_MODULE): $(built_plat_fc)
################################## ##################################
include $(CLEAR_VARS) include $(CLEAR_VARS)
LOCAL_MODULE := nonplat_file_contexts.recovery LOCAL_MODULE := vendor_file_contexts.recovery
LOCAL_MODULE_STEM := nonplat_file_contexts LOCAL_MODULE_STEM := vendor_file_contexts
LOCAL_MODULE_CLASS := ETC LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT) LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
include $(BUILD_SYSTEM)/base_rules.mk include $(BUILD_SYSTEM)/base_rules.mk
$(LOCAL_BUILT_MODULE): $(built_nonplat_fc) $(LOCAL_BUILT_MODULE): $(built_vendor_fc)
$(hide) cp -f $< $@ $(hide) cp -f $< $@
################################## ##################################
...@@ -827,7 +867,7 @@ plat_sc_files := ...@@ -827,7 +867,7 @@ plat_sc_files :=
################################## ##################################
include $(CLEAR_VARS) include $(CLEAR_VARS)
LOCAL_MODULE := nonplat_seapp_contexts LOCAL_MODULE := vendor_seapp_contexts
LOCAL_MODULE_CLASS := ETC LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional LOCAL_MODULE_TAGS := optional
ifeq ($(PRODUCT_SEPOLICY_SPLIT),true) ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
...@@ -838,19 +878,19 @@ endif ...@@ -838,19 +878,19 @@ endif
include $(BUILD_SYSTEM)/base_rules.mk include $(BUILD_SYSTEM)/base_rules.mk
nonplat_sc_files := $(call build_policy, seapp_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY)) vendor_sc_files := $(call build_policy, seapp_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
plat_sc_neverallow_files := $(call build_policy, seapp_contexts, $(PLAT_PRIVATE_POLICY)) plat_sc_neverallow_files := $(call build_policy, seapp_contexts, $(PLAT_PRIVATE_POLICY))
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) $(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
$(LOCAL_BUILT_MODULE): PRIVATE_SC_FILES := $(nonplat_sc_files) $(LOCAL_BUILT_MODULE): PRIVATE_SC_FILES := $(vendor_sc_files)
$(LOCAL_BUILT_MODULE): PRIVATE_SC_NEVERALLOW_FILES := $(plat_sc_neverallow_files) $(LOCAL_BUILT_MODULE): PRIVATE_SC_NEVERALLOW_FILES := $(plat_sc_neverallow_files)
$(LOCAL_BUILT_MODULE): $(built_sepolicy) $(nonplat_sc_files) $(HOST_OUT_EXECUTABLES)/checkseapp $(plat_sc_neverallow_files) $(LOCAL_BUILT_MODULE): $(built_sepolicy) $(vendor_sc_files) $(HOST_OUT_EXECUTABLES)/checkseapp $(plat_sc_neverallow_files)
@mkdir -p $(dir $@) @mkdir -p $(dir $@)
$(hide) grep -ihe '^neverallow' $(PRIVATE_SC_NEVERALLOW_FILES) > $@.tmp $(hide) grep -ihe '^neverallow' $(PRIVATE_SC_NEVERALLOW_FILES) > $@.tmp
$(hide) $(HOST_OUT_EXECUTABLES)/checkseapp -p $(PRIVATE_SEPOLICY) -o $@ $(PRIVATE_SC_FILES) $@.tmp $(hide) $(HOST_OUT_EXECUTABLES)/checkseapp -p $(PRIVATE_SEPOLICY) -o $@ $(PRIVATE_SC_FILES) $@.tmp
built_nonplat_sc := $(LOCAL_BUILT_MODULE) built_vendor_sc := $(LOCAL_BUILT_MODULE)
nonplat_sc_files := vendor_sc_files :=
################################## ##################################
include $(CLEAR_VARS) include $(CLEAR_VARS)
...@@ -902,7 +942,7 @@ plat_property_contexts.tmp := ...@@ -902,7 +942,7 @@ plat_property_contexts.tmp :=
################################## ##################################
include $(CLEAR_VARS) include $(CLEAR_VARS)
LOCAL_MODULE := nonplat_property_contexts LOCAL_MODULE := vendor_property_contexts
LOCAL_MODULE_CLASS := ETC LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional LOCAL_MODULE_TAGS := optional
...@@ -914,26 +954,26 @@ endif ...@@ -914,26 +954,26 @@ endif
include $(BUILD_SYSTEM)/base_rules.mk include $(BUILD_SYSTEM)/base_rules.mk
nonplat_pcfiles := $(call build_policy, property_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY)) vendor_pcfiles := $(call build_policy, property_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
nonplat_property_contexts.tmp := $(intermediates)/nonplat_property_contexts.tmp vendor_property_contexts.tmp := $(intermediates)/vendor_property_contexts.tmp
$(nonplat_property_contexts.tmp): PRIVATE_PC_FILES := $(nonplat_pcfiles) $(vendor_property_contexts.tmp): PRIVATE_PC_FILES := $(vendor_pcfiles)
$(nonplat_property_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) $(vendor_property_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(nonplat_property_contexts.tmp): $(nonplat_pcfiles) $(vendor_property_contexts.tmp): $(vendor_pcfiles)
@mkdir -p $(dir $@) @mkdir -p $(dir $@)
$(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_PC_FILES) > $@ $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_PC_FILES) > $@
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) $(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
$(LOCAL_BUILT_MODULE): PRIVATE_FC_SORT := $(HOST_OUT_EXECUTABLES)/fc_sort $(LOCAL_BUILT_MODULE): PRIVATE_FC_SORT := $(HOST_OUT_EXECUTABLES)/fc_sort
$(LOCAL_BUILT_MODULE): $(nonplat_property_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(HOST_OUT_EXECUTABLES)/fc_sort $(LOCAL_BUILT_MODULE): $(vendor_property_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(HOST_OUT_EXECUTABLES)/fc_sort
@mkdir -p $(dir $@) @mkdir -p $(dir $@)
$(hide) $(PRIVATE_FC_SORT) $< $@ $(hide) $(PRIVATE_FC_SORT) $< $@
$(hide) $(HOST_OUT_EXECUTABLES)/checkfc -p $(PRIVATE_SEPOLICY) $@ $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -p $(PRIVATE_SEPOLICY) $@
built_nonplat_pc := $(LOCAL_BUILT_MODULE) built_vendor_pc := $(LOCAL_BUILT_MODULE)
nonplat_pcfiles := vendor_pcfiles :=
nonplat_property_contexts.tmp := vendor_property_contexts.tmp :=
################################## ##################################
include $(CLEAR_VARS) include $(CLEAR_VARS)
...@@ -951,15 +991,15 @@ $(LOCAL_BUILT_MODULE): $(built_plat_pc) ...@@ -951,15 +991,15 @@ $(LOCAL_BUILT_MODULE): $(built_plat_pc)
################################## ##################################
include $(CLEAR_VARS) include $(CLEAR_VARS)
LOCAL_MODULE := nonplat_property_contexts.recovery LOCAL_MODULE := vendor_property_contexts.recovery
LOCAL_MODULE_STEM := nonplat_property_contexts LOCAL_MODULE_STEM := vendor_property_contexts
LOCAL_MODULE_CLASS := ETC LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT) LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
include $(BUILD_SYSTEM)/base_rules.mk include $(BUILD_SYSTEM)/base_rules.mk
$(LOCAL_BUILT_MODULE): $(built_nonplat_pc) $(LOCAL_BUILT_MODULE): $(built_vendor_pc)
$(hide) cp -f $< $@ $(hide) cp -f $< $@
################################## ##################################
...@@ -1001,31 +1041,31 @@ ifneq ($(PRODUCT_SEPOLICY_SPLIT),true) ...@@ -1001,31 +1041,31 @@ ifneq ($(PRODUCT_SEPOLICY_SPLIT),true)
include $(CLEAR_VARS) include $(CLEAR_VARS)
LOCAL_MODULE := nonplat_service_contexts LOCAL_MODULE := vendor_service_contexts
LOCAL_MODULE_CLASS := ETC LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT) LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
include $(BUILD_SYSTEM)/base_rules.mk include $(BUILD_SYSTEM)/base_rules.mk
nonplat_svcfiles := $(call build_policy, service_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY)) vendor_svcfiles := $(call build_policy, service_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
nonplat_service_contexts.tmp := $(intermediates)/nonplat_service_contexts.tmp vendor_service_contexts.tmp := $(intermediates)/vendor_service_contexts.tmp
$(nonplat_service_contexts.tmp): PRIVATE_SVC_FILES := $(nonplat_svcfiles) $(vendor_service_contexts.tmp): PRIVATE_SVC_FILES := $(vendor_svcfiles)
$(nonplat_service_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) $(vendor_service_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(nonplat_service_contexts.tmp): $(nonplat_svcfiles) $(vendor_service_contexts.tmp): $(vendor_svcfiles)
@mkdir -p $(dir $@) @mkdir -p $(dir $@)
$(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@ $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) $(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
$(LOCAL_BUILT_MODULE): $(nonplat_service_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP) $(LOCAL_BUILT_MODULE): $(vendor_service_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
@mkdir -p $(dir $@) @mkdir -p $(dir $@)
sed -e 's/#.*$$//' -e '/^$$/d' $< > $@ sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
$(hide) $(HOST_OUT_EXECUTABLES)/checkfc -s $(PRIVATE_SEPOLICY) $@ $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -s $(PRIVATE_SEPOLICY) $@
built_nonplat_svc := $(LOCAL_BUILT_MODULE) built_vendor_svc := $(LOCAL_BUILT_MODULE)
nonplat_svcfiles := vendor_svcfiles :=
nonplat_service_contexts.tmp := vendor_service_contexts.tmp :=
endif endif
...@@ -1064,7 +1104,7 @@ plat_hwservice_contexts.tmp := ...@@ -1064,7 +1104,7 @@ plat_hwservice_contexts.tmp :=
################################## ##################################
include $(CLEAR_VARS) include $(CLEAR_VARS)
LOCAL_MODULE := nonplat_hwservice_contexts LOCAL_MODULE := vendor_hwservice_contexts
LOCAL_MODULE_CLASS := ETC LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional LOCAL_MODULE_TAGS := optional
ifeq ($(PRODUCT_SEPOLICY_SPLIT),true) ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
...@@ -1075,23 +1115,24 @@ endif ...@@ -1075,23 +1115,24 @@ endif
include $(BUILD_SYSTEM)/base_rules.mk include $(BUILD_SYSTEM)/base_rules.mk
nonplat_hwsvcfiles := $(call build_policy, hwservice_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY)) vendor_hwsvcfiles := $(call build_policy, hwservice_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
nonplat_hwservice_contexts.tmp := $(intermediates)/nonplat_hwservice_contexts.tmp vendor_hwservice_contexts.tmp := $(intermediates)/vendor_hwservice_contexts.tmp
$(nonplat_hwservice_contexts.tmp): PRIVATE_SVC_FILES := $(nonplat_hwsvcfiles) $(vendor_hwservice_contexts.tmp): PRIVATE_SVC_FILES := $(vendor_hwsvcfiles)
$(nonplat_hwservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) $(vendor_hwservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(nonplat_hwservice_contexts.tmp): $(nonplat_hwsvcfiles) $(vendor_hwservice_contexts.tmp): $(vendor_hwsvcfiles)
@mkdir -p $(dir $@) @mkdir -p $(dir $@)
$(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@ $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy) $(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
$(LOCAL_BUILT_MODULE): $(nonplat_hwservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP) $(LOCAL_BUILT_MODULE): $(vendor_hwservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
@mkdir -p $(dir $@) @mkdir -p $(dir $@)
sed -e 's/#.*$$//' -e '/^$$/d' $< > $@ sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
$(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e -l $(PRIVATE_SEPOLICY) $@ $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e -l $(PRIVATE_SEPOLICY) $@
nonplat_hwsvcfiles := vendor_hwsvcfiles :=
nonplat_hwservice_contexts.tmp := vendor_hwservice_contexts.tmp :=
################################## ##################################
include $(CLEAR_VARS) include $(CLEAR_VARS)
...@@ -1107,7 +1148,7 @@ endif ...@@ -1107,7 +1148,7 @@ endif
include $(BUILD_SYSTEM)/base_rules.mk include $(BUILD_SYSTEM)/base_rules.mk
vnd_svcfiles := $(call build_policy, vndservice_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY)) vnd_svcfiles := $(call build_policy, vndservice_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
vndservice_contexts.tmp := $(intermediates)/vndservice_contexts.tmp vndservice_contexts.tmp := $(intermediates)/vndservice_contexts.tmp
$(vndservice_contexts.tmp): PRIVATE_SVC_FILES := $(vnd_svcfiles) $(vndservice_contexts.tmp): PRIVATE_SVC_FILES := $(vnd_svcfiles)
...@@ -1161,7 +1202,7 @@ plat_mac_perms_keys.tmp := ...@@ -1161,7 +1202,7 @@ plat_mac_perms_keys.tmp :=
################################## ##################################
include $(CLEAR_VARS) include $(CLEAR_VARS)
LOCAL_MODULE := nonplat_mac_permissions.xml LOCAL_MODULE := vendor_mac_permissions.xml
LOCAL_MODULE_CLASS := ETC LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
...@@ -1169,22 +1210,22 @@ LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux ...@@ -1169,22 +1210,22 @@ LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
include $(BUILD_SYSTEM)/base_rules.mk include $(BUILD_SYSTEM)/base_rules.mk
# Build keys.conf # Build keys.conf
nonplat_mac_perms_keys.tmp := $(intermediates)/nonplat_keys.tmp vendor_mac_perms_keys.tmp := $(intermediates)/vendor_keys.tmp
$(nonplat_mac_perms_keys.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) $(vendor_mac_perms_keys.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(nonplat_mac_perms_keys.tmp): $(call build_policy, keys.conf, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY)) $(vendor_mac_perms_keys.tmp): $(call build_policy, keys.conf, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
@mkdir -p $(dir $@) @mkdir -p $(dir $@)
$(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@ $(hide) m4 -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@
all_nonplat_mac_perms_files := $(call build_policy, mac_permissions.xml, $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(REQD_MASK_POLICY)) all_vendor_mac_perms_files := $(call build_policy, mac_permissions.xml, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
$(LOCAL_BUILT_MODULE): PRIVATE_MAC_PERMS_FILES := $(all_nonplat_mac_perms_files) $(LOCAL_BUILT_MODULE): PRIVATE_MAC_PERMS_FILES := $(all_vendor_mac_perms_files)
$(LOCAL_BUILT_MODULE): $(nonplat_mac_perms_keys.tmp) $(HOST_OUT_EXECUTABLES)/insertkeys.py \ $(LOCAL_BUILT_MODULE): $(vendor_mac_perms_keys.tmp) $(HOST_OUT_EXECUTABLES)/insertkeys.py \
$(all_nonplat_mac_perms_files) $(all_vendor_mac_perms_files)
@mkdir -p $(dir $@) @mkdir -p $(dir $@)
$(hide) $(HOST_OUT_EXECUTABLES)/insertkeys.py -t $(TARGET_BUILD_VARIANT) -c $(TOP) $< -o $@ $(PRIVATE_MAC_PERMS_FILES) $(hide) $(HOST_OUT_EXECUTABLES)/insertkeys.py -t $(TARGET_BUILD_VARIANT) -c $(TOP) $< -o $@ $(PRIVATE_MAC_PERMS_FILES)
nonplat_mac_perms_keys.tmp := vendor_mac_perms_keys.tmp :=
all_nonplat_mac_perms_files := all_vendor_mac_perms_files :=
################################# #################################
include $(CLEAR_VARS) include $(CLEAR_VARS)
...@@ -1194,15 +1235,16 @@ LOCAL_MODULE_TAGS := tests ...@@ -1194,15 +1235,16 @@ LOCAL_MODULE_TAGS := tests
include $(BUILD_SYSTEM)/base_rules.mk include $(BUILD_SYSTEM)/base_rules.mk
all_fc_files := $(built_plat_fc) $(built_vendor_fc)
all_fc_args := $(foreach file, $(all_fc_files), -f $(file))
sepolicy_tests := $(intermediates)/sepolicy_tests sepolicy_tests := $(intermediates)/sepolicy_tests
$(sepolicy_tests): PRIVATE_PLAT_FC := $(built_plat_fc) $(sepolicy_tests): ALL_FC_ARGS := $(all_fc_args)
$(sepolicy_tests): PRIVATE_NONPLAT_FC := $(built_nonplat_fc)
$(sepolicy_tests): PRIVATE_SEPOLICY := $(built_sepolicy) $(sepolicy_tests): PRIVATE_SEPOLICY := $(built_sepolicy)
$(sepolicy_tests): $(HOST_OUT_EXECUTABLES)/sepolicy_tests \ $(sepolicy_tests): $(HOST_OUT_EXECUTABLES)/sepolicy_tests $(all_fc_files) $(built_sepolicy)
$(built_plat_fc) $(built_nonplat_fc) $(built_sepolicy)
@mkdir -p $(dir $@) @mkdir -p $(dir $@)
$(hide) $(HOST_OUT_EXECUTABLES)/sepolicy_tests -l $(HOST_OUT)/lib64/libsepolwrap.$(SHAREDLIB_EXT) \ $(hide) $(HOST_OUT_EXECUTABLES)/sepolicy_tests -l $(HOST_OUT)/lib64/libsepolwrap.$(SHAREDLIB_EXT) \
-f $(PRIVATE_PLAT_FC) -f $(PRIVATE_NONPLAT_FC) -p $(PRIVATE_SEPOLICY) $(ALL_FC_ARGS) -p $(PRIVATE_SEPOLICY)
$(hide) touch $@ $(hide) touch $@
################################## ##################################
...@@ -1302,9 +1344,11 @@ $(call build_policy, $(sepolicy_build_cil_workaround_files), $(BASE_PLAT_PRIVATE ...@@ -1302,9 +1344,11 @@ $(call build_policy, $(sepolicy_build_cil_workaround_files), $(BASE_PLAT_PRIVATE
$(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@ $(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@
$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $@ -o $@ -f /dev/null $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $@ -o $@ -f /dev/null
all_fc_files := $(built_plat_fc) $(built_vendor_fc)
all_fc_args := $(foreach file, $(all_fc_files), -f $(file))
treble_sepolicy_tests := $(intermediates)/treble_sepolicy_tests treble_sepolicy_tests := $(intermediates)/treble_sepolicy_tests
$(treble_sepolicy_tests): PRIVATE_PLAT_FC := $(built_plat_fc) $(treble_sepolicy_tests): ALL_FC_ARGS := $(all_fc_args)
$(treble_sepolicy_tests): PRIVATE_NONPLAT_FC := $(built_nonplat_fc)
$(treble_sepolicy_tests): PRIVATE_SEPOLICY := $(built_sepolicy) $(treble_sepolicy_tests): PRIVATE_SEPOLICY := $(built_sepolicy)
$(treble_sepolicy_tests): PRIVATE_SEPOLICY_OLD := $(built_26.0_plat_sepolicy) $(treble_sepolicy_tests): PRIVATE_SEPOLICY_OLD := $(built_26.0_plat_sepolicy)
$(treble_sepolicy_tests): PRIVATE_COMBINED_MAPPING := $(26.0_mapping.combined.cil) $(treble_sepolicy_tests): PRIVATE_COMBINED_MAPPING := $(26.0_mapping.combined.cil)
...@@ -1315,12 +1359,11 @@ else ...@@ -1315,12 +1359,11 @@ else
$(treble_sepolicy_tests): PRIVATE_FAKE_TREBLE := $(treble_sepolicy_tests): PRIVATE_FAKE_TREBLE :=
endif endif
$(treble_sepolicy_tests): $(HOST_OUT_EXECUTABLES)/treble_sepolicy_tests \ $(treble_sepolicy_tests): $(HOST_OUT_EXECUTABLES)/treble_sepolicy_tests \
$(built_plat_fc) $(built_nonplat_fc) $(built_sepolicy) $(built_plat_sepolicy) \ $(all_fc_files) $(built_sepolicy) $(built_plat_sepolicy) \
$(built_26.0_plat_sepolicy) $(26.0_compat) $(26.0_mapping.combined.cil) $(built_26.0_plat_sepolicy) $(26.0_compat) $(26.0_mapping.combined.cil)
@mkdir -p $(dir $@) @mkdir -p $(dir $@)
$(hide) $(HOST_OUT_EXECUTABLES)/treble_sepolicy_tests -l \ $(hide) $(HOST_OUT_EXECUTABLES)/treble_sepolicy_tests -l \
$(HOST_OUT)/lib64/libsepolwrap.$(SHAREDLIB_EXT) \ $(HOST_OUT)/lib64/libsepolwrap.$(SHAREDLIB_EXT) $(ALL_FC_ARGS) \
-f $(PRIVATE_PLAT_FC) -f $(PRIVATE_NONPLAT_FC) \
-b $(PRIVATE_PLAT_SEPOLICY) -m $(PRIVATE_COMBINED_MAPPING) \ -b $(PRIVATE_PLAT_SEPOLICY) -m $(PRIVATE_COMBINED_MAPPING) \
-o $(PRIVATE_SEPOLICY_OLD) -p $(PRIVATE_SEPOLICY) \ -o $(PRIVATE_SEPOLICY_OLD) -p $(PRIVATE_SEPOLICY) \
$(PRIVATE_FAKE_TREBLE) $(PRIVATE_FAKE_TREBLE)
...@@ -1343,22 +1386,23 @@ endif # ($(PRODUCT_SEPOLICY_SPLIT),true) ...@@ -1343,22 +1386,23 @@ endif # ($(PRODUCT_SEPOLICY_SPLIT),true)
################################# #################################
add_nl := add_nl :=
build_device_policy := build_vendor_policy :=
build_policy := build_policy :=
built_plat_fc := built_plat_fc :=
built_nonplat_fc := built_vendor_fc :=
built_nl := built_nl :=
built_plat_cil := built_plat_cil :=
built_plat_pub_vers_cil :=
built_mapping_cil := built_mapping_cil :=
built_plat_pc := built_plat_pc :=
built_nonplat_cil := built_vendor_cil :=
built_nonplat_pc := built_vendor_pc :=
built_nonplat_sc := built_vendor_sc :=
built_plat_sc := built_plat_sc :=
built_precompiled_sepolicy := built_precompiled_sepolicy :=
built_sepolicy := built_sepolicy :=
built_plat_svc := built_plat_svc :=
built_nonplat_svc := built_vendor_svc :=
mapping_policy := mapping_policy :=
my_target_arch := my_target_arch :=
plat_pub_policy.cil := plat_pub_policy.cil :=
......
CleanSpec.mk
+ 9
− 0
View file @ be3abb95
...@@ -74,3 +74,12 @@ $(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/etc/selinux/mapping_sepolicy ...@@ -74,3 +74,12 @@ $(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/etc/selinux/mapping_sepolicy
$(call add-clean-step, rm -rf $(PRODUCT_OUT)/vendor/etc/selinux/nonplat_service_contexts) $(call add-clean-step, rm -rf $(PRODUCT_OUT)/vendor/etc/selinux/nonplat_service_contexts)
$(call add-clean-step, rm -rf $(PRODUCT_OUT)/obj/ETC/nonplat_service_contexts_intermediates) $(call add-clean-step, rm -rf $(PRODUCT_OUT)/obj/ETC/nonplat_service_contexts_intermediates)
$(call add-clean-step, rm -rf $(PRODUCT_OUT)/obj/NOTICE_FILES/src/vendor/etc/selinux/nonplat_service_contexts.txt) $(call add-clean-step, rm -rf $(PRODUCT_OUT)/obj/NOTICE_FILES/src/vendor/etc/selinux/nonplat_service_contexts.txt)
$(call add-clean-step, rm -rf $(TARGET_OUT_VENDOR)/etc/selinux/nonplat_sepolicy.cil)
$(call add-clean-step, rm -rf $(TARGET_OUT_VENDOR)/etc/selinux/nonplat_file_contexts)
$(call add-clean-step, rm -rf $(TARGET_OUT_VENDOR)/etc/selinux/nonplat_hwservice_contexts)
$(call add-clean-step, rm -rf $(TARGET_OUT_VENDOR)/etc/selinux/nonplat_mac_permissions.xml)
$(call add-clean-step, rm -rf $(TARGET_OUT_VENDOR)/etc/selinux/nonplat_property_contexts)
$(call add-clean-step, rm -rf $(TARGET_OUT_VENDOR)/etc/selinux/nonplat_seapp_contexts)
$(call add-clean-step, rm -rf $(PRODUCT_OUT)/recovery/root/nonplat_file_contexts)
$(call add-clean-step, rm -rf $(PRODUCT_OUT)/recovery/root/nonplat_property_contexts)
private/file_contexts
+ 13
− 0
View file @ be3abb95
...@@ -38,20 +38,25 @@ ...@@ -38,20 +38,25 @@
# SELinux policy files # SELinux policy files
/nonplat_file_contexts u:object_r:file_contexts_file:s0 /nonplat_file_contexts u:object_r:file_contexts_file:s0
/vendor_file_contexts u:object_r:file_contexts_file:s0
/plat_file_contexts u:object_r:file_contexts_file:s0 /plat_file_contexts u:object_r:file_contexts_file:s0
/mapping_sepolicy\.cil u:object_r:sepolicy_file:s0 /mapping_sepolicy\.cil u:object_r:sepolicy_file:s0
/nonplat_sepolicy\.cil u:object_r:sepolicy_file:s0 /nonplat_sepolicy\.cil u:object_r:sepolicy_file:s0
/plat_sepolicy\.cil u:object_r:sepolicy_file:s0 /plat_sepolicy\.cil u:object_r:sepolicy_file:s0
/plat_property_contexts u:object_r:property_contexts_file:s0 /plat_property_contexts u:object_r:property_contexts_file:s0
/nonplat_property_contexts u:object_r:property_contexts_file:s0 /nonplat_property_contexts u:object_r:property_contexts_file:s0
/vendor_property_contexts u:object_r:property_contexts_file:s0
/seapp_contexts u:object_r:seapp_contexts_file:s0 /seapp_contexts u:object_r:seapp_contexts_file:s0
/nonplat_seapp_contexts u:object_r:seapp_contexts_file:s0 /nonplat_seapp_contexts u:object_r:seapp_contexts_file:s0
/vendor_seapp_contexts u:object_r:seapp_contexts_file:s0
/plat_seapp_contexts u:object_r:seapp_contexts_file:s0 /plat_seapp_contexts u:object_r:seapp_contexts_file:s0
/sepolicy u:object_r:sepolicy_file:s0 /sepolicy u:object_r:sepolicy_file:s0
/plat_service_contexts u:object_r:service_contexts_file:s0 /plat_service_contexts u:object_r:service_contexts_file:s0
/plat_hwservice_contexts u:object_r:hwservice_contexts_file:s0 /plat_hwservice_contexts u:object_r:hwservice_contexts_file:s0
/nonplat_service_contexts u:object_r:nonplat_service_contexts_file:s0 /nonplat_service_contexts u:object_r:nonplat_service_contexts_file:s0
/vendor_service_contexts u:object_r:service_contexts_file:s0
/nonplat_hwservice_contexts u:object_r:hwservice_contexts_file:s0 /nonplat_hwservice_contexts u:object_r:hwservice_contexts_file:s0
/vendor_hwservice_contexts u:object_r:hwservice_contexts_file:s0
/vndservice_contexts u:object_r:vndservice_contexts_file:s0 /vndservice_contexts u:object_r:vndservice_contexts_file:s0
########################## ##########################
...@@ -303,9 +308,17 @@ ...@@ -303,9 +308,17 @@
/vendor/etc/selinux/nonplat_file_contexts u:object_r:file_contexts_file:s0 /vendor/etc/selinux/nonplat_file_contexts u:object_r:file_contexts_file:s0
/vendor/etc/selinux/nonplat_seapp_contexts u:object_r:seapp_contexts_file:s0 /vendor/etc/selinux/nonplat_seapp_contexts u:object_r:seapp_contexts_file:s0
/vendor/etc/selinux/nonplat_sepolicy.cil u:object_r:sepolicy_file:s0 /vendor/etc/selinux/nonplat_sepolicy.cil u:object_r:sepolicy_file:s0
/vendor/etc/selinux/vendor_mac_permissions.xml u:object_r:mac_perms_file:s0
/vendor/etc/selinux/vendor_property_contexts u:object_r:property_contexts_file:s0
/vendor/etc/selinux/vendor_service_contexts u:object_r:service_contexts_file:s0
/vendor/etc/selinux/vendor_hwservice_contexts u:object_r:hwservice_contexts_file:s0
/vendor/etc/selinux/vendor_file_contexts u:object_r:file_contexts_file:s0
/vendor/etc/selinux/vendor_seapp_contexts u:object_r:seapp_contexts_file:s0
/vendor/etc/selinux/vendor_sepolicy.cil u:object_r:sepolicy_file:s0
/vendor/etc/selinux/precompiled_sepolicy u:object_r:sepolicy_file:s0 /vendor/etc/selinux/precompiled_sepolicy u:object_r:sepolicy_file:s0
/vendor/etc/selinux/precompiled_sepolicy\.plat_and_mapping\.sha256 u:object_r:sepolicy_file:s0 /vendor/etc/selinux/precompiled_sepolicy\.plat_and_mapping\.sha256 u:object_r:sepolicy_file:s0
/vendor/etc/selinux/vndservice_contexts u:object_r:vndservice_contexts_file:s0 /vendor/etc/selinux/vndservice_contexts u:object_r:vndservice_contexts_file:s0
/vendor/etc/selinux/plat_pub_versioned.cil u:object_r:sepolicy_file:s0
############################# #############################
# OEM and ODM files # OEM and ODM files
......
private/genfs_contexts
+ 1
− 0
View file @ be3abb95
...@@ -101,6 +101,7 @@ genfscon sysfs /devices/virtual/net u:object_r:sysfs_net:s0 ...@@ -101,6 +101,7 @@ genfscon sysfs /devices/virtual/net u:object_r:sysfs_net:s0
genfscon sysfs /devices/virtual/switch u:object_r:sysfs_switch:s0 genfscon sysfs /devices/virtual/switch u:object_r:sysfs_switch:s0
genfscon sysfs /firmware/devicetree/base/firmware/android u:object_r:sysfs_dt_firmware_android:s0 genfscon sysfs /firmware/devicetree/base/firmware/android u:object_r:sysfs_dt_firmware_android:s0
genfscon sysfs /fs/ext4/features u:object_r:sysfs_fs_ext4_features:s0 genfscon sysfs /fs/ext4/features u:object_r:sysfs_fs_ext4_features:s0
genfscon sysfs /power/autosleep u:object_r:sysfs_power:s0
genfscon sysfs /power/state u:object_r:sysfs_power:s0 genfscon sysfs /power/state u:object_r:sysfs_power:s0
genfscon sysfs /power/wakeup_count u:object_r:sysfs_power:s0 genfscon sysfs /power/wakeup_count u:object_r:sysfs_power:s0
genfscon sysfs /power/wake_lock u:object_r:sysfs_wake_lock:s0 genfscon sysfs /power/wake_lock u:object_r:sysfs_wake_lock:s0
......
public/crash_dump.te
+ 4
− 2
View file @ be3abb95
...@@ -23,9 +23,11 @@ userdebug_or_eng(` ...@@ -23,9 +23,11 @@ userdebug_or_eng(`
# Use inherited file descriptors # Use inherited file descriptors
allow crash_dump domain:fd use; allow crash_dump domain:fd use;
# Write to the IPC pipe inherited from crashing processes. # Read/write IPC pipes inherited from crashing processes.
allow crash_dump domain:fifo_file { read write };
# Append to pipes given to us by processes requesting dumps (e.g. dumpstate) # Append to pipes given to us by processes requesting dumps (e.g. dumpstate)
allow crash_dump domain:fifo_file { write append }; allow crash_dump domain:fifo_file { append };
r_dir_file(crash_dump, domain) r_dir_file(crash_dump, domain)
allow crash_dump exec_type:file r_file_perms; allow crash_dump exec_type:file r_file_perms;
......
public/init.te
+ 22
− 5
View file @ be3abb95
...@@ -211,6 +211,7 @@ allow init { ...@@ -211,6 +211,7 @@ allow init {
-contextmount_type -contextmount_type
-proc -proc
-sdcard_type -sdcard_type
-sysfs
-rootfs -rootfs
}:file { open read setattr }; }:file { open read setattr };
allow init { fs_type -contextmount_type -sdcard_type -rootfs }:dir { open read setattr search }; allow init { fs_type -contextmount_type -sdcard_type -rootfs }:dir { open read setattr search };
...@@ -292,6 +293,24 @@ allow init { ...@@ -292,6 +293,24 @@ allow init {
proc_security proc_security
}:file rw_file_perms; }:file rw_file_perms;
# init access to /sys files.
allow init {
sysfs_android_usb
sysfs_leds
sysfs_power
sysfs_zram
}:file w_file_perms;
# init chmod/chown access to /sys files.
allow init {
sysfs_android_usb
sysfs_devices_system_cpu
sysfs_ipv4
sysfs_leds
sysfs_lowmemorykiller
sysfs_power
}:file setattr;
# Set usermodehelpers. # Set usermodehelpers.
allow init { usermodehelper sysfs_usermodehelper }:file rw_file_perms; allow init { usermodehelper sysfs_usermodehelper }:file rw_file_perms;
...@@ -300,11 +319,6 @@ allow init self:global_capability_class_set net_admin; ...@@ -300,11 +319,6 @@ allow init self:global_capability_class_set net_admin;
# Reboot. # Reboot.
allow init self:global_capability_class_set sys_boot; allow init self:global_capability_class_set sys_boot;
# Write to sysfs nodes.
allow init sysfs_type:dir r_dir_perms;
allow init sysfs_type:lnk_file read;
allow init sysfs_type:file rw_file_perms;
# Init will create /data/misc/logd when the property persist.logd.logpersistd is "logcatd". # Init will create /data/misc/logd when the property persist.logd.logpersistd is "logcatd".
# Init will also walk through the directory as part of a recursive restorecon. # Init will also walk through the directory as part of a recursive restorecon.
allow init misc_logd_file:dir { add_name open create read getattr setattr search write }; allow init misc_logd_file:dir { add_name open create read getattr setattr search write };
...@@ -456,3 +470,6 @@ neverallow init servicemanager:service_manager list; ...@@ -456,3 +470,6 @@ neverallow init servicemanager:service_manager list;
# Init should not be creating subdirectories in /data/local/tmp # Init should not be creating subdirectories in /data/local/tmp
neverallow init shell_data_file:dir { write add_name remove_name }; neverallow init shell_data_file:dir { write add_name remove_name };
# Init should not access sysfs node that are not explicitly labeled.
neverallow init sysfs:file { open read write };
public/perfprofd.te
+ 6
− 0
View file @ be3abb95
...@@ -56,4 +56,10 @@ userdebug_or_eng(` ...@@ -56,4 +56,10 @@ userdebug_or_eng(`
# needed for simpleperf on some kernels # needed for simpleperf on some kernels
allow perfprofd self:global_capability_class_set ipc_lock; allow perfprofd self:global_capability_class_set ipc_lock;
# simpleperf attempts to put a temp file into /data/local/tmp. Do not allow,
# use the fallback cwd code, do not spam the log. But ensure this is correctly
# removed at some point. b/70232908.
dontaudit perfprofd shell_data_file:dir *;
dontaudit perfprofd shell_data_file:file *;
') ')
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment