]>
Commit | Line | Data |
---|---|---|
fb0a3a98 CP |
1 | ######################################## |
2 | # | |
3 | # Rules and Targets for building monolithic policies | |
4 | # | |
5 | ||
c634db20 CP |
6 | # determine the policy version and current kernel version if possible |
7 | pv := $(shell $(CHECKPOLICY) -V |cut -f 1 -d ' ') | |
8 | kv := $(shell cat /selinux/policyvers) | |
9 | ||
10 | # dont print version warnings if we are unable to determine | |
11 | # the currently running kernel's policy version | |
12 | ifeq "$(kv)" "" | |
13 | kv := $(pv) | |
14 | endif | |
15 | ||
16 | policy_conf = $(builddir)policy.conf | |
17 | fc = $(builddir)file_contexts | |
18 | polver = $(builddir)policy.$(pv) | |
19 | homedir_template = $(builddir)homedir_template | |
c9f20d5b | 20 | |
3abd5ee8 CP |
21 | M4PARAM += -D self_contained_policy |
22 | ||
fb0a3a98 | 23 | # install paths |
c634db20 | 24 | loadpath = $(policypath)/$(notdir $(polver)) |
fb0a3a98 | 25 | |
cee508bc | 26 | appfiles += $(installdir)/booleans $(installdir)/seusers $(userpath)/local.users |
fb0a3a98 | 27 | |
c767b14c | 28 | # for monolithic policy use all base and module to create policy |
c634db20 | 29 | all_modules := $(strip $(base_mods) $(mod_mods)) |
ab23bb90 | 30 | # off module interfaces included to make sure all interfaces are expanded. |
c634db20 CP |
31 | all_interfaces := $(all_modules:.te=.if) $(off_mods:.te=.if) |
32 | all_te_files := $(all_modules) | |
33 | all_fc_files := $(all_modules:.te=.fc) | |
fb0a3a98 | 34 | |
c07f9ccd | 35 | pre_te_files := $(secclass) $(isids) $(avs) $(m4support) $(poldir)/mls $(poldir)/mcs $(policycaps) |
c634db20 | 36 | post_te_files := $(user_files) $(poldir)/constraints |
fb0a3a98 | 37 | |
c634db20 | 38 | policy_sections := $(tmpdir)/pre_te_files.conf $(tmpdir)/all_attrs_types.conf $(tmpdir)/global_bools.conf $(tmpdir)/only_te_rules.conf $(tmpdir)/all_post.conf |
c767b14c CP |
39 | |
40 | # search layer dirs for source files | |
c634db20 CP |
41 | vpath %.te $(all_layers) |
42 | vpath %.if $(all_layers) | |
43 | vpath %.fc $(all_layers) | |
c767b14c | 44 | |
fb0a3a98 CP |
45 | ######################################## |
46 | # | |
47 | # default action: build policy locally | |
48 | # | |
49 | default: policy | |
50 | ||
c634db20 | 51 | policy: $(polver) |
fb0a3a98 | 52 | |
d17bab02 | 53 | install: $(loadpath) $(fcpath) $(appfiles) |
fb0a3a98 | 54 | |
c634db20 | 55 | load: $(tmpdir)/load |
fb0a3a98 | 56 | |
c634db20 CP |
57 | checklabels: $(fcpath) |
58 | restorelabels: $(fcpath) | |
59 | relabel: $(fcpath) | |
60 | resetlabels: $(fcpath) | |
120988c4 | 61 | |
fb0a3a98 CP |
62 | ######################################## |
63 | # | |
64 | # Build a binary policy locally | |
65 | # | |
8acfcbcc CP |
66 | ifneq "$(UNK_PERMS)" "" |
67 | $(polver): CHECKPOLICY += -U $(UNK_PERMS) | |
68 | endif | |
c634db20 CP |
69 | $(polver): $(policy_conf) |
70 | @echo "Compiling $(NAME) $(polver)" | |
71 | ifneq ($(pv),$(kv)) | |
fb0a3a98 CP |
72 | @echo |
73 | @echo "WARNING: Policy version mismatch! Is your OUTPUT_POLICY set correctly?" | |
74 | @echo | |
75 | endif | |
5b45ffb0 | 76 | $(verbose) $(CHECKPOLICY) $^ -o $@ |
fb0a3a98 CP |
77 | |
78 | ######################################## | |
79 | # | |
80 | # Install a binary policy | |
81 | # | |
8acfcbcc CP |
82 | ifneq "$(UNK_PERMS)" "" |
83 | $(loadpath): CHECKPOLICY += -U $(UNK_PERMS) | |
84 | endif | |
c634db20 CP |
85 | $(loadpath): $(policy_conf) |
86 | @mkdir -p $(policypath) | |
87 | @echo "Compiling and installing $(NAME) $(loadpath)" | |
88 | ifneq ($(pv),$(kv)) | |
fb0a3a98 CP |
89 | @echo |
90 | @echo "WARNING: Policy version mismatch! Is your OUTPUT_POLICY set correctly?" | |
91 | @echo | |
92 | endif | |
9b3756bf | 93 | $(verbose) $(CHECKPOLICY) $^ -o $@ |
fb0a3a98 CP |
94 | |
95 | ######################################## | |
96 | # | |
97 | # Load the binary policy | |
98 | # | |
285d0093 | 99 | reload $(tmpdir)/load: $(loadpath) $(fcpath) $(appfiles) |
c634db20 CP |
100 | @echo "Loading $(NAME) $(loadpath)" |
101 | $(verbose) $(LOADPOLICY) -q $(loadpath) | |
102 | @touch $(tmpdir)/load | |
fb0a3a98 CP |
103 | |
104 | ######################################## | |
105 | # | |
106 | # Construct a monolithic policy.conf | |
107 | # | |
c634db20 | 108 | $(policy_conf): $(policy_sections) |
c9f20d5b | 109 | @echo "Creating $(NAME) $(@F)" |
3abd5ee8 CP |
110 | @test -d $(@D) || mkdir -p $(@D) |
111 | $(verbose) cat $^ > $@ | |
fb0a3a98 | 112 | |
c634db20 CP |
113 | $(tmpdir)/pre_te_files.conf: $(pre_te_files) |
114 | @test -d $(tmpdir) || mkdir -p $(tmpdir) | |
3abd5ee8 | 115 | $(verbose) $(M4) $(M4PARAM) $^ > $@ |
fb0a3a98 | 116 | |
c634db20 CP |
117 | $(tmpdir)/generated_definitions.conf: $(all_te_files) |
118 | @test -d $(tmpdir) || mkdir -p $(tmpdir) | |
70131678 | 119 | # define all available object classes |
c634db20 | 120 | $(verbose) $(genperm) $(avs) $(secclass) > $@ |
bbcd3c97 | 121 | $(verbose) $(call create-base-per-role-tmpl,$(basename $(notdir $(all_modules))),$@) |
c634db20 | 122 | $(verbose) test -f $(booleans) && $(setbools) $(booleans) >> $@ || true |
fb0a3a98 | 123 | |
c634db20 | 124 | $(tmpdir)/global_bools.conf: $(m4support) $(tmpdir)/generated_definitions.conf $(globalbool) $(globaltun) |
3abd5ee8 CP |
125 | $(verbose) $(M4) $(M4PARAM) $^ > $@ |
126 | ||
e276d50e | 127 | $(tmpdir)/all_interfaces.conf: $(m4support) $(all_interfaces) $(m4iferror) |
c634db20 | 128 | @test -d $(tmpdir) || mkdir -p $(tmpdir) |
3abd5ee8 | 129 | @echo "divert(-1)" > $@ |
e276d50e | 130 | $(verbose) $(M4) $^ >> $(tmpdir)/$(@F).tmp |
c634db20 | 131 | $(verbose) $(SED) -e s/dollarsstar/\$$\*/g $(tmpdir)/$(@F).tmp >> $@ |
3abd5ee8 | 132 | @echo "divert" >> $@ |
fb0a3a98 | 133 | |
c634db20 | 134 | $(tmpdir)/rolemap.conf: $(rolemap) |
96fc0a45 | 135 | $(verbose) echo "" > $@ |
3abd5ee8 CP |
136 | $(call parse-rolemap,base,$@) |
137 | ||
c634db20 CP |
138 | $(tmpdir)/all_te_files.conf: $(m4support) $(tmpdir)/generated_definitions.conf $(tmpdir)/all_interfaces.conf $(all_te_files) $(tmpdir)/rolemap.conf |
139 | ifeq "$(strip $(all_te_files))" "" | |
140 | $(error No enabled modules! $(notdir $(mod_conf)) may need to be generated by using "make conf") | |
fb0a3a98 | 141 | endif |
c634db20 | 142 | @test -d $(tmpdir) || mkdir -p $(tmpdir) |
3abd5ee8 | 143 | $(verbose) $(M4) $(M4PARAM) -s $^ > $@ |
fb0a3a98 | 144 | |
296273a7 | 145 | $(tmpdir)/post_te_files.conf: $(m4support) $(tmpdir)/generated_definitions.conf $(post_te_files) |
c634db20 | 146 | @test -d $(tmpdir) || mkdir -p $(tmpdir) |
3abd5ee8 | 147 | $(verbose) $(M4) $(M4PARAM) $^ > $@ |
fb0a3a98 CP |
148 | |
149 | # extract attributes and put them first. extract post te stuff | |
3abd5ee8 | 150 | # like genfscon and put last. |
c634db20 CP |
151 | $(tmpdir)/all_attrs_types.conf $(tmpdir)/only_te_rules.conf $(tmpdir)/all_post.conf: $(tmpdir)/all_te_files.conf $(tmpdir)/post_te_files.conf |
152 | $(verbose) $(get_type_attr_decl) $(tmpdir)/all_te_files.conf | $(SORT) > $(tmpdir)/all_attrs_types.conf | |
153 | $(verbose) cat $(tmpdir)/post_te_files.conf > $(tmpdir)/all_post.conf | |
3abd5ee8 | 154 | # these have to run individually because order matters: |
c634db20 CP |
155 | $(verbose) $(GREP) '^sid ' $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true |
156 | $(verbose) $(GREP) '^fs_use_(xattr|task|trans)' $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true | |
157 | $(verbose) $(GREP) ^genfscon $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true | |
158 | $(verbose) $(GREP) ^portcon $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true | |
159 | $(verbose) $(GREP) ^netifcon $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true | |
160 | $(verbose) $(GREP) ^nodecon $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true | |
161 | $(verbose) $(comment_move_decl) $(tmpdir)/all_te_files.conf > $(tmpdir)/only_te_rules.conf | |
fb0a3a98 CP |
162 | |
163 | ######################################## | |
164 | # | |
165 | # Remove the dontaudit rules from the policy.conf | |
166 | # | |
c634db20 CP |
167 | enableaudit: $(policy_conf) |
168 | @test -d $(tmpdir) || mkdir -p $(tmpdir) | |
169 | @echo "Removing dontaudit rules from $(notdir $(policy_conf))" | |
170 | $(verbose) $(GREP) -v dontaudit $^ > $(tmpdir)/policy.audit | |
171 | $(verbose) mv $(tmpdir)/policy.audit $(policy_conf) | |
fb0a3a98 CP |
172 | |
173 | ######################################## | |
174 | # | |
175 | # Construct file_contexts | |
176 | # | |
c634db20 CP |
177 | $(fc): $(tmpdir)/$(notdir $(fc)).tmp $(fcsort) |
178 | $(verbose) $(fcsort) $< $@ | |
6627570e CP |
179 | $(verbose) $(GREP) -e HOME -e ROLE -e USER $@ > $(homedir_template) |
180 | $(verbose) $(SED) -i -e /HOME/d -e /ROLE/d -e /USER/d $@ | |
c767b14c | 181 | |
c634db20 CP |
182 | $(tmpdir)/$(notdir $(fc)).tmp: $(m4support) $(tmpdir)/generated_definitions.conf $(all_fc_files) |
183 | ifeq ($(all_fc_files),) | |
184 | $(error No enabled modules! $(notdir $(mod_conf)) may need to be generated by using "make conf") | |
fb0a3a98 CP |
185 | endif |
186 | @echo "Creating $(NAME) file_contexts." | |
c634db20 | 187 | @test -d $(tmpdir) || mkdir -p $(tmpdir) |
3abd5ee8 | 188 | $(verbose) $(M4) $(M4PARAM) $^ > $@ |
fb0a3a98 | 189 | |
c634db20 | 190 | $(homedir_template): $(fc) |
fc47b34c | 191 | |
fb0a3a98 CP |
192 | ######################################## |
193 | # | |
194 | # Install file_contexts | |
195 | # | |
c634db20 | 196 | $(fcpath): $(fc) $(loadpath) $(userpath)/system.users |
fb0a3a98 | 197 | @echo "Validating $(NAME) file_contexts." |
c634db20 | 198 | $(verbose) $(SETFILES) -q -c $(loadpath) $(fc) |
fb0a3a98 | 199 | @echo "Installing file_contexts." |
c634db20 CP |
200 | @mkdir -p $(contextpath)/files |
201 | $(verbose) $(INSTALL) -m 644 $(fc) $(fcpath) | |
202 | $(verbose) $(INSTALL) -m 644 $(homedir_template) $(homedirpath) | |
203 | $(verbose) $(genhomedircon) -d $(topdir) -t $(NAME) $(USEPWD) | |
fc47b34c CP |
204 | ifeq "$(DISTRO)" "rhel4" |
205 | # Setfiles in RHEL4 does not look at file_contexts.homedirs. | |
206 | $(verbose) cat $@.homedirs >> $@ | |
207 | # Delete the file_contexts.homedirs in case the toolchain has | |
208 | # been updated, to prevent duplicate match errors. | |
209 | $(verbose) rm -f $@.homedirs | |
185ab241 | 210 | endif |
fb0a3a98 | 211 | |
8df65f13 | 212 | ######################################## |
5a7c06fd CP |
213 | # |
214 | # Intall netfilter_contexts | |
215 | # | |
c634db20 | 216 | $(ncpath): $(net_contexts) |
5a7c06fd | 217 | @echo "Installing $(NAME) netfilter_contexts." |
cfd5c5e1 | 218 | $(verbose) $(INSTALL) -m 0644 $^ $@ |
5a7c06fd CP |
219 | |
220 | ######################################## | |
8df65f13 CP |
221 | # |
222 | # Run policy source checks | |
223 | # | |
c634db20 CP |
224 | check: $(builddir)check.res |
225 | $(builddir)check.res: $(policy_conf) $(fc) | |
226 | $(SECHECK) -s --profile=development --policy=$(policy_conf) --fcfile=$(fc) > $@ | |
8df65f13 | 227 | |
c634db20 CP |
228 | longcheck: $(builddir)longcheck.res |
229 | $(builddir)longcheck.res: $(policy_conf) $(fc) | |
230 | $(SECHECK) -s --profile=all --policy=$(policy_conf) --fcfile=$(fc) > $@ | |
8df65f13 | 231 | |
049e11af CP |
232 | ######################################## |
233 | # | |
234 | # Appconfig files | |
235 | # | |
c634db20 CP |
236 | $(appdir)/customizable_types: $(policy_conf) |
237 | @mkdir -p $(appdir) | |
238 | $(verbose) $(GREP) '^[[:blank:]]*type .*customizable' $< | cut -d';' -f1 | cut -d',' -f1 | cut -d' ' -f2 | $(SORT) -u > $(tmpdir)/customizable_types | |
239 | $(verbose) $(INSTALL) -m 644 $(tmpdir)/customizable_types $@ | |
049e11af | 240 | |
cee508bc CP |
241 | $(installdir)/seusers: $(seusers) |
242 | @mkdir -p $(installdir) | |
243 | $(verbose) $(INSTALL) -m 644 $^ $@ | |
244 | ||
fb0a3a98 CP |
245 | ######################################## |
246 | # | |
247 | # Clean the sources | |
248 | # | |
249 | clean: | |
c634db20 CP |
250 | rm -f $(policy_conf) |
251 | rm -f $(polver) | |
252 | rm -f $(fc) | |
253 | rm -f $(homedir_template) | |
6962bb32 | 254 | rm -f $(net_contexts) |
8df65f13 | 255 | rm -f *.res |
c634db20 | 256 | rm -fR $(tmpdir) |
fb0a3a98 | 257 | |
8df65f13 | 258 | .PHONY: default policy install load reload enableaudit checklabels restorelabels relabel check longcheck clean |