1version := $(version_under_treble_tests) 2 3include $(CLEAR_VARS) 4# For Treble builds run tests verifying that processes are properly labeled and 5# permissions granted do not violate the treble model. Also ensure that treble 6# compatibility guarantees are upheld between SELinux version bumps. 7LOCAL_MODULE := treble_sepolicy_tests_$(version) 8LOCAL_MODULE_CLASS := ETC 9LOCAL_MODULE_TAGS := tests 10 11include $(BUILD_SYSTEM)/base_rules.mk 12 13# $(version)_plat - the platform policy shipped as part of the $(version) release. This is 14# built to enable us to determine the diff between the current policy and the 15# $(version) policy, which will be used in tests to make sure that compatibility has 16# been maintained by our mapping files. 17$(version)_PLAT_PUBLIC_POLICY := $(LOCAL_PATH)/prebuilts/api/$(version)/public 18$(version)_PLAT_PRIVATE_POLICY := $(LOCAL_PATH)/prebuilts/api/$(version)/private 19$(version)_plat_policy.conf := $(intermediates)/$(version)_plat_policy.conf 20$($(version)_plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS) 21$($(version)_plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS) 22$($(version)_plat_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := user 23$($(version)_plat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch) 24$($(version)_plat_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan) 25$($(version)_plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS) 26$($(version)_plat_policy.conf): PRIVATE_SEPOLICY_SPLIT := true 27$($(version)_plat_policy.conf): $(call build_policy, $(sepolicy_build_files), \ 28$($(version)_PLAT_PUBLIC_POLICY) $($(version)_PLAT_PRIVATE_POLICY)) 29 $(transform-policy-to-conf) 30 $(hide) sed '/dontaudit/d' $@ > $@.dontaudit 31 32 33built_$(version)_plat_sepolicy := $(intermediates)/built_$(version)_plat_sepolicy 34$(built_$(version)_plat_sepolicy): PRIVATE_ADDITIONAL_CIL_FILES := \ 35 $(call build_policy, technical_debt.cil , $($(version)_PLAT_PRIVATE_POLICY)) 36$(built_$(version)_plat_sepolicy): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG) 37$(built_$(version)_plat_sepolicy): $($(version)_plat_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \ 38 $(HOST_OUT_EXECUTABLES)/secilc \ 39 $(call build_policy, technical_debt.cil, $($(version)_PLAT_PRIVATE_POLICY)) \ 40 $(built_sepolicy_neverallows) 41 @mkdir -p $(dir $@) 42 $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \ 43 $(POLICYVERS) -o $@ $< 44 $(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@ 45 $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $@ -o $@ -f /dev/null 46 47$(version)_plat_policy.conf := 48 49 50# $(version)_compat - the current plat_sepolicy.cil built with the compatibility file 51# targeting the $(version) SELinux release. This ensures that our policy will build 52# when used on a device that has non-platform policy targetting the $(version) release. 53$(version)_compat := $(intermediates)/$(version)_compat 54$(version)_mapping.cil := $(LOCAL_PATH)/private/compat/$(version)/$(version).cil 55$(version)_mapping.ignore.cil := $(LOCAL_PATH)/private/compat/$(version)/$(version).ignore.cil 56$(version)_nonplat := $(LOCAL_PATH)/prebuilts/api/$(version)/nonplat_sepolicy.cil 57$($(version)_compat): PRIVATE_CIL_FILES := \ 58$(built_plat_cil) $($(version)_mapping.cil) $($(version)_nonplat) 59$($(version)_compat): $(HOST_OUT_EXECUTABLES)/secilc \ 60$(built_plat_cil) $($(version)_mapping.cil) $($(version)_nonplat) 61 $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -N -c $(POLICYVERS) \ 62 $(PRIVATE_CIL_FILES) -o $@ -f /dev/null 63 64# $(version)_mapping.combined.cil - a combination of the mapping file used when 65# combining the current platform policy with nonplatform policy based on the 66# $(version) policy release and also a special ignored file that exists purely for 67# these tests. 68$(version)_mapping.combined.cil := $(intermediates)/$(version)_mapping.combined.cil 69$($(version)_mapping.combined.cil): $($(version)_mapping.cil) $($(version)_mapping.ignore.cil) 70 mkdir -p $(dir $@) 71 cat $^ > $@ 72 73treble_sepolicy_tests_$(version) := $(intermediates)/treble_sepolicy_tests_$(version) 74$(treble_sepolicy_tests_$(version)): ALL_FC_ARGS := $(all_fc_args) 75$(treble_sepolicy_tests_$(version)): PRIVATE_SEPOLICY := $(built_sepolicy) 76$(treble_sepolicy_tests_$(version)): PRIVATE_SEPOLICY_OLD := $(built_$(version)_plat_sepolicy) 77$(treble_sepolicy_tests_$(version)): PRIVATE_COMBINED_MAPPING := $($(version)_mapping.combined.cil) 78$(treble_sepolicy_tests_$(version)): PRIVATE_PLAT_SEPOLICY := $(built_plat_sepolicy) 79ifeq ($(PRODUCT_FULL_TREBLE_OVERRIDE),true) 80$(treble_sepolicy_tests_$(version)): PRIVATE_FAKE_TREBLE := --fake-treble 81else 82$(treble_sepolicy_tests_$(version)): PRIVATE_FAKE_TREBLE := 83endif 84$(treble_sepolicy_tests_$(version)): $(HOST_OUT_EXECUTABLES)/treble_sepolicy_tests \ 85 $(all_fc_files) $(built_sepolicy) $(built_plat_sepolicy) \ 86 $(built_$(version)_plat_sepolicy) $($(version)_compat) $($(version)_mapping.combined.cil) 87 @mkdir -p $(dir $@) 88 $(hide) $(HOST_OUT_EXECUTABLES)/treble_sepolicy_tests -l \ 89 $(HOST_OUT)/lib64/libsepolwrap.$(SHAREDLIB_EXT) $(ALL_FC_ARGS) \ 90 -b $(PRIVATE_PLAT_SEPOLICY) -m $(PRIVATE_COMBINED_MAPPING) \ 91 -o $(PRIVATE_SEPOLICY_OLD) -p $(PRIVATE_SEPOLICY) \ 92 $(PRIVATE_FAKE_TREBLE) 93 $(hide) touch $@ 94 95$(version)_PLAT_PUBLIC_POLICY := 96$(version)_PLAT_PRIVATE_POLICY := 97$(version)_compat := 98$(version)_mapping.cil := 99$(version)_mapping.combined.cil := 100$(version)_mapping.ignore.cil := 101$(version)_nonplat := 102built_$(version)_plat_sepolicy := 103version := 104version_under_treble_tests := 105