1#!/bin/bash 2# 3# This script must be run in the location of the script! 4# 5# This script generates Android.bp files for this and all subdirs of this 6# 7DIR="${ANDROID_BUILD_TOP}/external/crosvm/seccomp" 8 9function remove_trailing_slash { 10 if [[ $1 == "/" ]]; then 11 echo $i 12 else 13 echo ${1%/} 14 fi 15} 16 17set -o errexit 18 19function check_location() { 20 local my_loc="$(realpath ${DIR})" 21 my_loc=$(remove_trailing_slash ${my_loc}) 22 23 local my_pwd="$(realpath $PWD)" 24 my_pwd="$(remove_trailing_slash ${my_pwd})" 25 if [[ "${my_loc}" != "${my_pwd}" ]]; then 26 echo ${my_loc} 27 echo ${my_pwd} 28 >&2 echo "the script location must be run where the script is located" 29 exit 10 30 fi 31} 32 33my_name=`basename $0` 34all_archs=("x86_64" "aarch64" "arm" "x86") 35seccomp_archs=("x86_64" "aarch64") 36 37# define arch dir pattern: e.g. ${ARCH}-linux-gnu 38function get_arch_dir() { 39 local suffix="-linux-gnu" 40 local arch=$1 41 echo ${arch}${suffix} 42} 43 44# convert seccomp arch to bp arch 45function get_bp_arch() { 46 [ $1 = "aarch64" ] && echo "arm64" || echo $1 47} 48 49# utility function to enumerate policy files 50# 51# 1: seccomp dir to scan 52function scan_policy_name() { 53 local seccomp_dir=$1 54 ( 55 # pushd but no output to stdout/stderr 56 # the output is taken and used by the caller 57 pushd $seccomp_dir > /dev/null 2>&1 58 ls --hide=common_device.policy --hide=common_device.frequency -1 59 popd > /dev/null 2>&1 60 ) 61} 62 63function gen_license() { 64 local cchars=${1:-"//"} 65 local year=${2:-"2020"} 66cat <<EOF 67${cchars} Autogenerated via ${my_name} 68${cchars} 69${cchars} Copyright (C) ${year} The Android Open Source Project 70${cchars} 71${cchars} Licensed under the Apache License, Version 2.0 (the "License"); 72${cchars} you may not use this file except in compliance with the License. 73${cchars} You may obtain a copy of the License at 74${cchars} 75${cchars} http://www.apache.org/licenses/LICENSE-2.0 76${cchars} 77${cchars} Unless required by applicable law or agreed to in writing, software 78${cchars} distributed under the License is distributed on an "AS IS" BASIS, 79${cchars} WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 80${cchars} See the License for the specific language governing permissions and 81${cchars} limitations under the License. 82 83EOF 84} 85 86function gen_blueprint_boilerplate() { 87cat <<EOF 88genrule_defaults { 89 name: "crosvm_inline_seccomp_policy_x86_64", 90 cmd: "\$(location policy-inliner.sh) \$(location x86_64/common_device.policy) < \$(in) > \$(out)", 91 tool_files: [ 92 "policy-inliner.sh", 93 "x86_64/common_device.policy", 94 ], 95} 96 97genrule_defaults { 98 name: "crosvm_inline_seccomp_policy_aarch64", 99 cmd: "\$(location policy-inliner.sh) \$(location aarch64/common_device.policy) < \$(in) > \$(out)", 100 tool_files: [ 101 "policy-inliner.sh", 102 "aarch64/common_device.policy", 103 ], 104} 105 106EOF 107} 108 109function gen_blueprint_arch_policy_files() { 110 local archs=("$@") 111 declare -A policy_genrules 112 for arch in ${archs[@]}; do 113 for file in $(scan_policy_name ${arch}); do 114 local base_name="$(basename $file)" 115 policy_genrules[${base_name}]="${policy_genrules[${base_name}]} $arch" 116 done 117 done 118 for file in "${!policy_genrules[@]}"; do 119 for arch in ${policy_genrules[$file]}; do 120 echo "genrule {" 121 echo " name: \"${file}_inline_${arch}\"," 122 echo " defaults: [\"crosvm_inline_seccomp_policy_${arch}\"]," 123 echo " out: [\"${file}\"]," 124 echo " srcs: [\"${arch}/${file}\"]," 125 echo "}" 126 echo 127 if [[ $arch != "arm" ]]; then 128 echo "prebuilt_usr_share_host {" 129 echo " name: \"${file}_${arch}\"," 130 echo " filename: \"${file}\"," 131 echo " relative_install_path: \"crosvm/$(get_arch_dir ${arch})/seccomp\"," 132 echo " src: \":${file}_inline_${arch}\"," 133 echo "}" 134 echo 135 fi 136 done 137 echo "prebuilt_etc {" 138 echo " name: \"${file}\"," 139 echo " relative_install_path: \"seccomp_policy/crosvm\"," 140 declare -a target_archs 141 echo " arch: {" 142 declare -a disabled_archs=${all_archs[@]} 143 for arch in ${policy_genrules[$file]}; do 144 disabled_archs=("${disabled_archs[@]/$arch}") 145 local bp_arch=$(get_bp_arch ${arch}) 146 echo " ${bp_arch}: {" 147 echo " src: \":${file}_inline_${arch}\"," 148 echo " }," 149 done 150 echo " }," 151 echo " target: {" 152 for arch in ${disabled_archs[@]}; do 153 local bp_arch=$(get_bp_arch ${arch}) 154 echo " android_${bp_arch}: {" 155 echo " enabled: false," 156 echo " }," 157 done 158 echo " }," 159 echo "}" 160 echo 161 done 162} 163 164function gen_crosvm_seccomp_policy_product_packages_mk_fragment() { 165 local archs=("$@") 166 declare -A policy_genrules 167 for arch in ${archs[@]}; do 168 for file in $(scan_policy_name ${arch}); do 169 local base_name="$(basename $file)" 170 policy_genrules[${base_name}]="${policy_genrules[${base_name}]} $arch" 171 done 172 done 173 echo "PRODUCT_PACKAGES += \\" 174 for file in "${!policy_genrules[@]}"; do 175 echo " ${file} \\" 176 done | sort 177 echo 178 179 echo "# TODO: Remove this when crosvm is added to generic system image" 180 echo "PRODUCT_ARTIFACT_PATH_REQUIREMENT_ALLOWED_LIST += \\" 181 for file in "${!policy_genrules[@]}"; do 182 echo " system/etc/seccomp_policy/crosvm/${file} \\" 183 done | sort 184} 185 186# main 187check_location 188gen_license >Android.bp 189gen_license \# >crosvm_seccomp_policy_product_packages.mk 190gen_blueprint_boilerplate >>Android.bp 191gen_blueprint_arch_policy_files "${seccomp_archs[@]}" >>Android.bp 192gen_crosvm_seccomp_policy_product_packages_mk_fragment \ 193 "${seccomp_archs[@]}" >>crosvm_seccomp_policy_product_packages.mk 194