From cfb6f3523159d87d444ace1b4c24fa09a11b31f0 Mon Sep 17 00:00:00 2001
From: Sandeep Patil <sspatil@google.com>
Date: Wed, 14 Jun 2017 09:57:43 -0700
Subject: [PATCH] build: run neverallow checks on platform sepolicy
This will prevent us from breaking our own neverallow rules
in the platform sepolicy regardless of vendor policy adding
exceptions to the neverallow rules using "*_violators" attributes
Bug: 62616897
Bug: 62343727
Test: Build policy for sailfish
Test: Build policy with radio to rild socket rule enabled for all
and ensure the build fails
Change-Id: Ic66ec3e10c76a7c9a17669e0d3deb3a1c7b00809
Signed-off-by: Sandeep Patil <sspatil@google.com>
---
Android.mk | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/Android.mk b/Android.mk
index 7ab0f447d..b1d64f47e 100644
--- a/Android.mk
+++ b/Android.mk
@@ -329,7 +329,7 @@ $(LOCAL_BUILT_MODULE): $(plat_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
@mkdir -p $(dir $@)
$(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c $(POLICYVERS) -o $@ $<
$(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@
- $(hide) $(HOST_OUT_EXECUTABLES)/secilc -M true -G -N -c $(POLICYVERS) $@ -o /dev/null -f /dev/null
+ $(hide) $(HOST_OUT_EXECUTABLES)/secilc -M true -G -c $(POLICYVERS) $@ -o /dev/null -f /dev/null
built_plat_cil := $(LOCAL_BUILT_MODULE)
plat_policy.conf :=
--
GitLab