[people/stevee/selinux-policy.git] / refpolicy / Makefile

#
# Makefile for the security policy.
#
# Targets:
# 
# install       - compile and install the policy configuration, and context files.
# load          - compile, install, and load the policy configuration.
# reload        - compile, install, and load/reload the policy configuration.
# relabel       - relabel filesystems based on the file contexts configuration.
# checklabels   - check filesystems against the file context configuration
# restorelabels - check filesystems against the file context configuration
#                 and restore the label of files with incorrect labels
# policy        - compile the policy configuration locally for testing/development.
#
# The default target is 'policy'.
#
#
# Please see build.conf for policy build options.
#

########################################
#
# NO OPTIONS BELOW HERE
#

# Include the local build.conf if it exists, otherwise
# include the configuration of the root directory.
include build.conf

ifdef LOCAL_ROOT
	-include $(LOCAL_ROOT)/build.conf
endif

# refpolicy version
VERSION = $(shell cat VERSION)

ifdef LOCAL_ROOT
BUILDDIR := $(LOCAL_ROOT)/
TMPDIR := $(LOCAL_ROOT)/tmp
TAGS := $(LOCAL_ROOT)/tags
else
TMPDIR := tmp
TAGS := tags
endif

# executable paths
BINDIR := /usr/bin
SBINDIR := /usr/sbin
CHECKPOLICY := $(BINDIR)/checkpolicy
CHECKMODULE := $(BINDIR)/checkmodule
SEMODULE := $(SBINDIR)/semodule
SEMOD_PKG := $(BINDIR)/semodule_package
SEMOD_LNK := $(BINDIR)/semodule_link
SEMOD_EXP := $(BINDIR)/semodule_expand
LOADPOLICY := $(SBINDIR)/load_policy
SETFILES := $(SBINDIR)/setfiles
XMLLINT := $(BINDIR)/xmllint
SECHECK := $(BINDIR)/sechecker

# interpreters and aux tools
AWK ?= gawk
GREP ?= egrep
M4 ?= m4
PYTHON ?= python
SED ?= sed
SORT ?= LC_ALL=C sort

CFLAGS += -Wall

# policy source layout
POLDIR := policy
MODDIR := $(POLDIR)/modules
FLASKDIR := $(POLDIR)/flask
SECCLASS := $(FLASKDIR)/security_classes
ISIDS := $(FLASKDIR)/initial_sids
AVS := $(FLASKDIR)/access_vectors

# local source layout
ifdef LOCAL_ROOT
LOCAL_POLDIR := $(LOCAL_ROOT)/policy
LOCAL_MODDIR := $(LOCAL_POLDIR)/modules
endif

# policy building support tools
SUPPORT := support
GENXML := $(PYTHON) $(SUPPORT)/segenxml.py
GENDOC := $(PYTHON) $(SUPPORT)/sedoctool.py
GENPERM := $(PYTHON) $(SUPPORT)/genclassperms.py
FCSORT := $(TMPDIR)/fc_sort
SETBOOLS := $(AWK) -f $(SUPPORT)/set_bools_tuns.awk
get_type_attr_decl := $(SED) -r -f $(SUPPORT)/get_type_attr_decl.sed
comment_move_decl := $(SED) -r -f $(SUPPORT)/comment_move_decl.sed
# use our own genhomedircon to make sure we have a known usable one,
# so policycoreutils updates are not required (RHEL4)
genhomedircon := $(PYTHON) $(SUPPORT)/genhomedircon

# documentation paths
DOCS := doc
XMLDTD = $(DOCS)/policy.dtd
LAYERXML = metadata.xml
DOCTEMPLATE = $(DOCS)/templates
DOCFILES = $(DOCS)/Makefile.example $(addprefix $(DOCS)/,example.te example.if example.fc)

ifndef LOCAL_ROOT
POLXML = $(DOCS)/policy.xml
TUNXML = $(DOCS)/global_tunables.xml
BOOLXML = $(DOCS)/global_booleans.xml
HTMLDIR = $(DOCS)/html
else
POLXML = $(LOCAL_ROOT)/doc/policy.xml
TUNXML = $(LOCAL_ROOT)/doc/global_tunables.xml
BOOLXML = $(LOCAL_ROOT)/doc/global_booleans.xml
HTMLDIR = $(LOCAL_ROOT)/doc/html
endif

# config file paths
GLOBALTUN = $(POLDIR)/global_tunables
GLOBALBOOL = $(POLDIR)/global_booleans
TUNABLES = $(POLDIR)/tunables.conf
ROLEMAP = $(POLDIR)/rolemap
USER_FILES := $(POLDIR)/users

# local config file paths
ifndef LOCAL_ROOT
MOD_CONF = $(POLDIR)/modules.conf
BOOLEANS = $(POLDIR)/booleans.conf
else
MOD_CONF = $(LOCAL_POLDIR)/modules.conf
BOOLEANS = $(LOCAL_POLDIR)/booleans.conf
endif

# install paths
PKGNAME ?= refpolicy-$(VERSION)
PREFIX = $(DESTDIR)/usr
TOPDIR = $(DESTDIR)/etc/selinux
INSTALLDIR = $(TOPDIR)/$(NAME)
SRCPATH = $(INSTALLDIR)/src
USERPATH = $(INSTALLDIR)/users
CONTEXTPATH = $(INSTALLDIR)/contexts
FCPATH = $(CONTEXTPATH)/files/file_contexts
SHAREDIR = $(PREFIX)/share/selinux
MODPKGDIR = $(SHAREDIR)/$(NAME)
HEADERDIR = $(MODPKGDIR)/include
DOCSDIR = $(PREFIX)/share/doc/$(PKGNAME)

# compile strict policy if requested.
ifneq ($(findstring strict,$(TYPE)),)
	M4PARAM += -D strict_policy
endif

# compile targeted policy if requested.
ifneq ($(findstring targeted,$(TYPE)),)
	M4PARAM += -D targeted_policy
endif

# enable MLS if requested.
ifneq ($(findstring -mls,$(TYPE)),)
	M4PARAM += -D enable_mls
	CHECKPOLICY += -M
	CHECKMODULE += -M
endif

# enable MLS if MCS requested.
ifneq ($(findstring -mcs,$(TYPE)),)
	M4PARAM += -D enable_mcs
	CHECKPOLICY += -M
	CHECKMODULE += -M
endif

# enable distribution-specific policy
ifneq ($(DISTRO),)
	M4PARAM += -D distro_$(DISTRO)
endif

# rhel4 also implies redhat
ifeq "$(DISTRO)" "rhel4"
	M4PARAM += -D distro_redhat
endif

# enable polyinstantiation
ifeq ($(POLY),y)
	M4PARAM += -D enable_polyinstantiation
endif

ifneq ($(OUTPUT_POLICY),)
	CHECKPOLICY += -c $(OUTPUT_POLICY)
endif

# if not set, use the type as the name.
NAME ?= $(TYPE)

ifeq ($(DIRECT_INITRC),y)
	M4PARAM += -D direct_sysadm_daemon
endif

ifeq ($(QUIET),y)
	verbose = @
endif

M4PARAM += -D hide_broken_symptoms

# we need exuberant ctags; unfortunately it is named
# differently on different distros
ifeq ($(DISTRO),debian)
	CTAGS := ctags-exuberant
endif

ifeq ($(DISTRO),gentoo)
	CTAGS := exuberant-ctags	
endif

CTAGS ?= ctags

# determine the policy version and current kernel version if possible
PV := $(shell $(CHECKPOLICY) -V |cut -f 1 -d ' ')
KV := $(shell cat /selinux/policyvers)

# dont print version warnings if we are unable to determine
# the currently running kernel's policy version
ifeq ($(KV),)
	KV := $(PV)
endif

M4SUPPORT := $(wildcard $(POLDIR)/support/*.spt)
ifdef LOCAL_ROOT
M4SUPPORT += $(wildcard $(LOCAL_POLDIR)/support/*.spt)
endif

APPCONF := config/appconfig-$(TYPE)
SEUSERS := $(APPCONF)/seusers
APPDIR := $(CONTEXTPATH)
APPFILES := $(addprefix $(APPDIR)/,default_contexts default_type initrc_context failsafe_context userhelper_context removable_context dbus_contexts customizable_types) $(CONTEXTPATH)/files/media
CONTEXTFILES += $(wildcard $(APPCONF)/*_context*) $(APPCONF)/media

ALL_LAYERS := $(filter-out $(MODDIR)/CVS,$(shell find $(wildcard $(MODDIR)/*) -maxdepth 0 -type d))
ifdef LOCAL_ROOT
ALL_LAYERS += $(filter-out $(LOCAL_MODDIR)/CVS,$(shell find $(wildcard $(LOCAL_MODDIR)/*) -maxdepth 0 -type d))
endif

GENERATED_TE := $(basename $(foreach dir,$(ALL_LAYERS),$(wildcard $(dir)/*.te.in)))
GENERATED_IF := $(basename $(foreach dir,$(ALL_LAYERS),$(wildcard $(dir)/*.if.in)))
GENERATED_FC := $(basename $(foreach dir,$(ALL_LAYERS),$(wildcard $(dir)/*.fc.in)))

# sort here since it removes duplicates, which can happen
# when a generated file is already generated
DETECTED_MODS := $(sort $(foreach dir,$(ALL_LAYERS),$(wildcard $(dir)/*.te)) $(GENERATED_TE))

# modules.conf setting for base module
MODBASE := base

# modules.conf setting for loadable module
MODMOD := module

# modules.conf setting for unused module
MODUNUSED := off

# test for module overrides from command line
MOD_TEST = $(filter $(APPS_OFF), $(APPS_BASE) $(APPS_MODS))
MOD_TEST += $(filter $(APPS_MODS), $(APPS_BASE))
ifneq ($(strip $(MOD_TEST)),)
        $(error Applications must be base, module, or off, and not in more than one list! $(strip $(MOD_TEST)) found in multiple lists!)
endif

# add on suffix to modules specified on command line
CMDLINE_BASE := $(addsuffix .te,$(APPS_BASE))
CMDLINE_MODS := $(addsuffix .te,$(APPS_MODS))
CMDLINE_OFF := $(addsuffix .te,$(APPS_OFF))

# extract settings from modules.conf
MOD_CONF_BASE := $(addsuffix .te,$(sort $(shell awk '/^[[:blank:]]*[[:alpha:]]/{ if ($$3 == "$(MODBASE)") print $$1 }' $(MOD_CONF) 2> /dev/null)))
MOD_CONF_MODS := $(addsuffix .te,$(sort $(shell awk '/^[[:blank:]]*[[:alpha:]]/{ if ($$3 == "$(MODMOD)") print $$1 }' $(MOD_CONF) 2> /dev/null)))
MOD_CONF_OFF := $(addsuffix .te,$(sort $(shell awk '/^[[:blank:]]*[[:alpha:]]/{ if ($$3 == "$(MODUNUSED)") print $$1 }' $(MOD_CONF) 2> /dev/null)))

BASE_MODS := $(CMDLINE_BASE)
MOD_MODS := $(CMDLINE_MODS)
OFF_MODS := $(CMDLINE_OFF)

BASE_MODS += $(filter-out $(CMDLINE_OFF) $(CMDLINE_BASE) $(CMDLINE_MODS), $(MOD_CONF_BASE))
MOD_MODS += $(filter-out $(CMDLINE_OFF) $(CMDLINE_BASE) $(CMDLINE_MODS), $(MOD_CONF_MODS))
OFF_MODS += $(filter-out $(CMDLINE_OFF) $(CMDLINE_BASE) $(CMDLINE_MODS), $(MOD_CONF_OFF))

# add modules not in modules.conf to the off list
OFF_MODS += $(filter-out $(BASE_MODS) $(MOD_MODS) $(OFF_MODS),$(notdir $(DETECTED_MODS)))

# filesystems to be used in labeling targets
FILESYSTEMS = $(shell mount | grep -v "context=" | egrep -v '\((|.*,)bind(,.*|)\)' | awk '/(ext[23]| xfs| jfs).*rw/{print $$3}';)

########################################
#
# Functions
#

# parse-rolemap modulename,outputfile
define parse-rolemap
	$(verbose) m4 $(M4PARAM) $(ROLEMAP) | \
		awk '/^[[:blank:]]*[A-Za-z]/{ print "gen_require(type " $$3 "; role " $$1 ";)\n$1_per_userdomain_template(" $$2 "," $$3 "," $$1 ")" }' >> $2
endef

# peruser-expansion modulename,outputfile
define peruser-expansion
	$(verbose) echo "ifdef(\`""$1""_per_userdomain_template',\`" > $2
	$(call parse-rolemap,$1,$2)
	$(verbose) echo "')" >> $2
endef

########################################
#
# Load appropriate rules
#

ifeq ($(MONOLITHIC),y)
	include Rules.monolithic
else
	include Rules.modular
endif

########################################
#
# Generated files
#
# NOTE: There is no "local" version of these files.
#
generate: $(GENERATED_TE) $(GENERATED_IF) $(GENERATED_FC)

$(MODDIR)/kernel/corenetwork.if: $(MODDIR)/kernel/corenetwork.if.m4 $(MODDIR)/kernel/corenetwork.if.in
	@echo "#" > $@
	@echo "# This is a generated file!  Instead of modifying this file, the" >> $@
	@echo "# $(notdir $@).in or $(notdir $@).m4 file should be modified." >> $@
	@echo "#" >> $@
	$(verbose) cat $(MODDIR)/kernel/corenetwork.if.in >> $@
	$(verbose) egrep "^[[:blank:]]*network_(interface|node|port|packet)\(.*\)" $(@:.if=.te).in \
		| m4 -D self_contained_policy $(M4PARAM) $(MODDIR)/kernel/corenetwork.if.m4 - \
		| sed -e 's/dollarsone/\$$1/g' -e 's/dollarszero/\$$0/g' >> $@

$(MODDIR)/kernel/corenetwork.te: $(MODDIR)/kernel/corenetwork.te.m4 $(MODDIR)/kernel/corenetwork.te.in
	@echo "#" > $@
	@echo "# This is a generated file!  Instead of modifying this file, the" >> $@
	@echo "# $(notdir $@).in or $(notdir $@).m4 file should be modified." >> $@
	@echo "#" >> $@
	$(verbose) m4 -D self_contained_policy $(M4PARAM) $^ \
		| sed -e 's/dollarsone/\$$1/g' -e 's/dollarszero/\$$0/g' >> $@

########################################
#
# Create config files
#
conf: $(MOD_CONF) $(BOOLEANS) $(GENERATED_TE) $(GENERATED_IF) $(GENERATED_FC)

$(MOD_CONF) $(BOOLEANS): $(POLXML)
	@echo "Updating $(MOD_CONF) and $(BOOLEANS)"
	$(verbose) $(GENDOC) -b $(BOOLEANS) -m $(MOD_CONF) -x $(POLXML)

########################################
#
# Generate the fc_sort program
#
$(FCSORT) : $(SUPPORT)/fc_sort.c
	$(verbose) $(CC) $(CFLAGS) $(SUPPORT)/fc_sort.c -o $(FCSORT)

########################################
#
# Documentation generation
#

# minimal dependencies here, because we don't want to rebuild 
# this and its dependents every time the dependencies
# change.  Also use all .if files here, rather then just the
# enabled modules.
xml: $(POLXML)
$(POLXML): $(DETECTED_MODS:.te=.if) $(foreach dir,$(ALL_LAYERS),$(dir)/$(LAYERXML))
	@echo "Creating $(@F)"
	@test -d $(dir $(POLXML)) || mkdir -p $(dir $(POLXML))
	@test -d $(TMPDIR) || mkdir -p $(TMPDIR)
	$(verbose) echo '<?xml version="1.0" encoding="ISO-8859-1" standalone="no"?>' > $@
	$(verbose) echo '<!DOCTYPE policy SYSTEM "$(notdir $(XMLDTD))">' >> $@
	$(verbose) $(GENXML) -w -m $(LAYERXML) -t $(GLOBALTUN) -b $(GLOBALBOOL) -o $(DOCS) $(ALL_LAYERS) >> $@
	$(verbose) if test -x $(XMLLINT) && test -f $(XMLDTD); then \
		$(XMLLINT) --noout --path $(dir $(XMLDTD)) --dtdvalid $(XMLDTD) $@ ;\
	fi

$(TUNXML) $(BOOLXML): $(POLXML)

html $(TMPDIR)/html: $(POLXML)
	@echo "Building html interface reference documentation in $(HTMLDIR)"
	@test -d $(HTMLDIR) || mkdir -p $(HTMLDIR)
	@test -d $(TMPDIR) || mkdir -p $(TMPDIR)
	$(verbose) $(GENDOC) -d $(HTMLDIR) -T $(DOCTEMPLATE) -x $(POLXML)
	$(verbose) cp $(DOCTEMPLATE)/*.css $(HTMLDIR)
	@touch $(TMPDIR)/html

########################################
#
# Runtime binary policy patching of users
#
$(USERPATH)/system.users: $(M4SUPPORT) $(TMPDIR)/generated_definitions.conf $(USER_FILES)
	@mkdir -p $(TMPDIR)
	@mkdir -p $(USERPATH)
	@echo "Installing system.users"
	@echo "# " > $(TMPDIR)/system.users
	@echo "# Do not edit this file. " >> $(TMPDIR)/system.users
	@echo "# This file is replaced on reinstalls of this policy." >> $(TMPDIR)/system.users
	@echo "# Please edit local.users to make local changes." >> $(TMPDIR)/system.users
	@echo "#" >> $(TMPDIR)/system.users
	$(verbose) m4 -D self_contained_policy $(M4PARAM) $^ | sed -r -e 's/^[[:blank:]]+//' \
		-e '/^[[:blank:]]*($$|#)/d' >> $(TMPDIR)/system.users
	$(verbose) install -m 644 $(TMPDIR)/system.users $@

$(USERPATH)/local.users: config/local.users
	@mkdir -p $(USERPATH)
	@echo "Installing local.users"
	$(verbose) install -b -m 644 $< $@

########################################
#
# Appconfig files
#
install-appconfig: $(APPFILES)

$(INSTALLDIR)/booleans: $(BOOLEANS)
	@mkdir -p $(TMPDIR)
	@mkdir -p $(INSTALLDIR)
	$(verbose) sed -r -e 's/false/0/g' -e 's/true/1/g' \
		-e '/^[[:blank:]]*($$|#)/d' $(BOOLEANS) | sort > $(TMPDIR)/booleans
	$(verbose) install -m 644 $(TMPDIR)/booleans $@

$(CONTEXTPATH)/files/media: $(APPCONF)/media
	@mkdir -p $(CONTEXTPATH)/files/
	$(verbose) install -m 644 $< $@

$(APPDIR)/default_contexts: $(APPCONF)/default_contexts
	@mkdir -p $(APPDIR)
	$(verbose) install -m 644 $< $@

$(APPDIR)/removable_context: $(APPCONF)/removable_context
	@mkdir -p $(APPDIR)
	$(verbose) install -m 644 $< $@

$(APPDIR)/default_type: $(APPCONF)/default_type
	@mkdir -p $(APPDIR)
	$(verbose) install -m 644 $< $@

$(APPDIR)/userhelper_context: $(APPCONF)/userhelper_context
	@mkdir -p $(APPDIR)
	$(verbose) install -m 644 $< $@

$(APPDIR)/initrc_context: $(APPCONF)/initrc_context
	@mkdir -p $(APPDIR)
	$(verbose) install -m 644 $< $@

$(APPDIR)/failsafe_context: $(APPCONF)/failsafe_context
	@mkdir -p $(APPDIR)
	$(verbose) install -m 644 $< $@

$(APPDIR)/dbus_contexts: $(APPCONF)/dbus_contexts
	@mkdir -p $(APPDIR)
	$(verbose) install -m 644 $< $@

$(APPDIR)/users/root: $(APPCONF)/root_default_contexts
	@mkdir -p $(APPDIR)/users
	$(verbose) install -m 644 $< $@

########################################
#
# Install policy headers
#
install-headers: $(TUNXML) $(BOOLXML)
	@mkdir -p $(HEADERDIR)
	@echo "Installing $(TYPE) policy headers."
	$(verbose) install -m 644 $(TUNXML) $(BOOLXML) $(HEADERDIR)
	$(verbose) m4 $(M4PARAM) $(ROLEMAP) > $(HEADERDIR)/$(notdir $(ROLEMAP))
	$(verbose) mkdir -p $(HEADERDIR)/support
	$(verbose) install -m 644 $(M4SUPPORT) $(word $(words $(GENXML)),$(GENXML)) $(XMLDTD) $(HEADERDIR)/support
	$(verbose) $(GENPERM) $(AVS) $(SECCLASS) > $(HEADERDIR)/support/all_perms.spt
	$(verbose) for i in $(notdir $(ALL_LAYERS)); do \
		mkdir -p $(HEADERDIR)/$$i ;\
		install -m 644 $(MODDIR)/$$i/*.if \
			$(MODDIR)/$$i/metadata.xml \
			$(HEADERDIR)/$$i ;\
	done
	$(verbose) echo "TYPE ?= $(TYPE)" > $(HEADERDIR)/build.conf
	$(verbose) echo "NAME ?= $(NAME)" >> $(HEADERDIR)/build.conf
ifneq "$(DISTRO)" ""
	$(verbose) echo "DISTRO ?= $(DISTRO)" >> $(HEADERDIR)/build.conf
endif
	$(verbose) echo "MONOLITHIC ?= n" >> $(HEADERDIR)/build.conf
	$(verbose) echo "DIRECT_INITRC ?= $(DIRECT_INITRC)" >> $(HEADERDIR)/build.conf
	$(verbose) echo "POLY ?= $(POLY)" >> $(HEADERDIR)/build.conf
	$(verbose) install -m 644 $(SUPPORT)/Makefile.devel $(HEADERDIR)/Makefile

########################################
#
# Install policy documentation
#
install-docs: $(TMPDIR)/html
	@mkdir -p $(DOCSDIR)/html
	@echo "Installing policy documentation"
	$(verbose) install -m 644 $(DOCFILES) $(DOCSDIR)
	$(verbose) install -m 644 $(wildcard $(HTMLDIR)/*) $(DOCSDIR)/html

########################################
#
# Install policy sources
#
install-src:
	rm -rf $(SRCPATH)/policy.old
	-mv $(SRCPATH)/policy $(SRCPATH)/policy.old
	mkdir -p $(SRCPATH)/policy
	cp -R . $(SRCPATH)/policy

########################################
#
# Generate tags file
#
tags: $(TAGS)
$(TAGS):
	@($(CTAGS) --version | grep -q Exuberant) || (echo ERROR: Need exuberant-ctags to function!; exit 1)
	@LC_ALL=C $(CTAGS) -f $(TAGS) --langdef=te --langmap=te:..te.if.spt \
	 --regex-te='/^type[ \t]+(\w+)(,|;)/\1/t,type/' \
	 --regex-te='/^typealias[ \t]+\w+[ \t+]+alias[ \t]+(\w+);/\1/t,type/' \
	 --regex-te='/^attribute[ \t]+(\w+);/\1/a,attribute/' \
	 --regex-te='/^[ \t]*define\(`(\w+)/\1/d,define/' \
	 --regex-te='/^[ \t]*interface\(`(\w+)/\1/i,interface/' \
	 --regex-te='/^[ \t]*bool[ \t]+(\w+)/\1/b,bool/' policy/modules/*/*.{if,te} policy/support/*.spt

########################################
#
# Filesystem labeling
#
checklabels:
	@echo "Checking labels on filesystem types: ext2 ext3 xfs jfs"
	@if test -z "$(FILESYSTEMS)"; then \
		echo "No filesystems with extended attributes found!" ;\
		false ;\
	fi
	$(verbose) $(SETFILES) -v -n $(FCPATH) $(FILESYSTEMS)

restorelabels:
	@echo "Restoring labels on filesystem types: ext2 ext3 xfs jfs"
	@if test -z "$(FILESYSTEMS)"; then \
		echo "No filesystems with extended attributes found!" ;\
		false ;\
	fi
	$(verbose) $(SETFILES) -v $(FCPATH) $(FILESYSTEMS)

relabel:
	@echo "Relabeling filesystem types: ext2 ext3 xfs jfs"
	@if test -z "$(FILESYSTEMS)"; then \
		echo "No filesystems with extended attributes found!" ;\
		false ;\
	fi
	$(verbose) $(SETFILES) $(FCPATH) $(FILESYSTEMS)

resetlabels:
	@echo "Resetting labels on filesystem types: ext2 ext3 xfs jfs"
	@if test -z "$(FILESYSTEMS)"; then \
		echo "No filesystems with extended attributes found!" ;\
		false ;\
	fi
	$(verbose) $(SETFILES) -F $(FCPATH) $(FILESYSTEMS)

########################################
#
# Clean everything
#
bare: clean
	rm -f $(POLXML)
	rm -f $(TUNXML)
	rm -f $(BOOLXML)
	rm -f $(MOD_CONF)
	rm -f $(BOOLEANS)
	rm -fR $(HTMLDIR)
	rm -f $(TAGS)
# don't remove these files if we're given a local root
ifndef LOCAL_ROOT
	rm -f $(FCSORT)
	rm -f $(SUPPORT)/*.pyc
ifneq ($(GENERATED_TE),)
	rm -f $(GENERATED_TE)
endif
ifneq ($(GENERATED_IF),)
	rm -f $(GENERATED_IF)
endif
ifneq ($(GENERATED_FC),)
	rm -f $(GENERATED_FC)
endif
endif

.PHONY: install-src install-appconfig generate xml conf html bare tags
.SUFFIXES:
.SUFFIXES: .c
Commit	Line	Data
	1	#
	2	# Makefile for the security policy.
	3	#
	4	# Targets:
	5	#
	6	# install - compile and install the policy configuration, and context files.
	7	# load - compile, install, and load the policy configuration.
	8	# reload - compile, install, and load/reload the policy configuration.
	9	# relabel - relabel filesystems based on the file contexts configuration.
	10	# checklabels - check filesystems against the file context configuration
	11	# restorelabels - check filesystems against the file context configuration
	12	# and restore the label of files with incorrect labels
	13	# policy - compile the policy configuration locally for testing/development.
	14	#
	15	# The default target is 'policy'.
	16	#
	17	#
	18	# Please see build.conf for policy build options.
	19	#
	20
	21	########################################
	22	#
	23	# NO OPTIONS BELOW HERE
	24	#
	25
	26	# Include the local build.conf if it exists, otherwise
	27	# include the configuration of the root directory.
	28	include build.conf
	29
	30	ifdef LOCAL_ROOT
	31	-include $(LOCAL_ROOT)/build.conf
	32	endif
	33
	34	# refpolicy version
	35	VERSION = $(shell cat VERSION)
	36
	37	ifdef LOCAL_ROOT
	38	BUILDDIR := $(LOCAL_ROOT)/
	39	TMPDIR := $(LOCAL_ROOT)/tmp
	40	TAGS := $(LOCAL_ROOT)/tags
	41	else
	42	TMPDIR := tmp
	43	TAGS := tags
	44	endif
	45
	46	# executable paths
	47	BINDIR := /usr/bin
	48	SBINDIR := /usr/sbin
	49	CHECKPOLICY := $(BINDIR)/checkpolicy
	50	CHECKMODULE := $(BINDIR)/checkmodule
	51	SEMODULE := $(SBINDIR)/semodule
	52	SEMOD_PKG := $(BINDIR)/semodule_package
	53	SEMOD_LNK := $(BINDIR)/semodule_link
	54	SEMOD_EXP := $(BINDIR)/semodule_expand
	55	LOADPOLICY := $(SBINDIR)/load_policy
	56	SETFILES := $(SBINDIR)/setfiles
	57	XMLLINT := $(BINDIR)/xmllint
	58	SECHECK := $(BINDIR)/sechecker
	59
	60	# interpreters and aux tools
	61	AWK ?= gawk
	62	GREP ?= egrep
	63	M4 ?= m4
	64	PYTHON ?= python
	65	SED ?= sed
	66	SORT ?= LC_ALL=C sort
	67
	68	CFLAGS += -Wall
	69
	70	# policy source layout
	71	POLDIR := policy
	72	MODDIR := $(POLDIR)/modules
	73	FLASKDIR := $(POLDIR)/flask
	74	SECCLASS := $(FLASKDIR)/security_classes
	75	ISIDS := $(FLASKDIR)/initial_sids
	76	AVS := $(FLASKDIR)/access_vectors
	77
	78	# local source layout
	79	ifdef LOCAL_ROOT
	80	LOCAL_POLDIR := $(LOCAL_ROOT)/policy
	81	LOCAL_MODDIR := $(LOCAL_POLDIR)/modules
	82	endif
	83
	84	# policy building support tools
	85	SUPPORT := support
	86	GENXML := $(PYTHON) $(SUPPORT)/segenxml.py
	87	GENDOC := $(PYTHON) $(SUPPORT)/sedoctool.py
	88	GENPERM := $(PYTHON) $(SUPPORT)/genclassperms.py
	89	FCSORT := $(TMPDIR)/fc_sort
	90	SETBOOLS := $(AWK) -f $(SUPPORT)/set_bools_tuns.awk
	91	get_type_attr_decl := $(SED) -r -f $(SUPPORT)/get_type_attr_decl.sed
	92	comment_move_decl := $(SED) -r -f $(SUPPORT)/comment_move_decl.sed
	93	# use our own genhomedircon to make sure we have a known usable one,
	94	# so policycoreutils updates are not required (RHEL4)
	95	genhomedircon := $(PYTHON) $(SUPPORT)/genhomedircon
	96
	97	# documentation paths
	98	DOCS := doc
	99	XMLDTD = $(DOCS)/policy.dtd
	100	LAYERXML = metadata.xml
	101	DOCTEMPLATE = $(DOCS)/templates
	102	DOCFILES = $(DOCS)/Makefile.example $(addprefix $(DOCS)/,example.te example.if example.fc)
	103
	104	ifndef LOCAL_ROOT
	105	POLXML = $(DOCS)/policy.xml
	106	TUNXML = $(DOCS)/global_tunables.xml
	107	BOOLXML = $(DOCS)/global_booleans.xml
	108	HTMLDIR = $(DOCS)/html
	109	else
	110	POLXML = $(LOCAL_ROOT)/doc/policy.xml
	111	TUNXML = $(LOCAL_ROOT)/doc/global_tunables.xml
	112	BOOLXML = $(LOCAL_ROOT)/doc/global_booleans.xml
	113	HTMLDIR = $(LOCAL_ROOT)/doc/html
	114	endif
	115
	116	# config file paths
	117	GLOBALTUN = $(POLDIR)/global_tunables
	118	GLOBALBOOL = $(POLDIR)/global_booleans
	119	TUNABLES = $(POLDIR)/tunables.conf
	120	ROLEMAP = $(POLDIR)/rolemap
	121	USER_FILES := $(POLDIR)/users
	122
	123	# local config file paths
	124	ifndef LOCAL_ROOT
	125	MOD_CONF = $(POLDIR)/modules.conf
	126	BOOLEANS = $(POLDIR)/booleans.conf
	127	else
	128	MOD_CONF = $(LOCAL_POLDIR)/modules.conf
	129	BOOLEANS = $(LOCAL_POLDIR)/booleans.conf
	130	endif
	131
	132	# install paths
	133	PKGNAME ?= refpolicy-$(VERSION)
	134	PREFIX = $(DESTDIR)/usr
	135	TOPDIR = $(DESTDIR)/etc/selinux
	136	INSTALLDIR = $(TOPDIR)/$(NAME)
	137	SRCPATH = $(INSTALLDIR)/src
	138	USERPATH = $(INSTALLDIR)/users
	139	CONTEXTPATH = $(INSTALLDIR)/contexts
	140	FCPATH = $(CONTEXTPATH)/files/file_contexts
	141	SHAREDIR = $(PREFIX)/share/selinux
	142	MODPKGDIR = $(SHAREDIR)/$(NAME)
	143	HEADERDIR = $(MODPKGDIR)/include
	144	DOCSDIR = $(PREFIX)/share/doc/$(PKGNAME)
	145
	146	# compile strict policy if requested.
	147	ifneq ($(findstring strict,$(TYPE)),)
	148	M4PARAM += -D strict_policy
	149	endif
	150
	151	# compile targeted policy if requested.
	152	ifneq ($(findstring targeted,$(TYPE)),)
	153	M4PARAM += -D targeted_policy
	154	endif
	155
	156	# enable MLS if requested.
	157	ifneq ($(findstring -mls,$(TYPE)),)
	158	M4PARAM += -D enable_mls
	159	CHECKPOLICY += -M
	160	CHECKMODULE += -M
	161	endif
	162
	163	# enable MLS if MCS requested.
	164	ifneq ($(findstring -mcs,$(TYPE)),)
	165	M4PARAM += -D enable_mcs
	166	CHECKPOLICY += -M
	167	CHECKMODULE += -M
	168	endif
	169
	170	# enable distribution-specific policy
	171	ifneq ($(DISTRO),)
	172	M4PARAM += -D distro_$(DISTRO)
	173	endif
	174
	175	# rhel4 also implies redhat
	176	ifeq "$(DISTRO)" "rhel4"
	177	M4PARAM += -D distro_redhat
	178	endif
	179
	180	# enable polyinstantiation
	181	ifeq ($(POLY),y)
	182	M4PARAM += -D enable_polyinstantiation
	183	endif
	184
	185	ifneq ($(OUTPUT_POLICY),)
	186	CHECKPOLICY += -c $(OUTPUT_POLICY)
	187	endif
	188
	189	# if not set, use the type as the name.
	190	NAME ?= $(TYPE)
	191
	192	ifeq ($(DIRECT_INITRC),y)
	193	M4PARAM += -D direct_sysadm_daemon
	194	endif
	195
	196	ifeq ($(QUIET),y)
	197	verbose = @
	198	endif
	199
	200	M4PARAM += -D hide_broken_symptoms
	201
	202	# we need exuberant ctags; unfortunately it is named
	203	# differently on different distros
	204	ifeq ($(DISTRO),debian)
	205	CTAGS := ctags-exuberant
	206	endif
	207
	208	ifeq ($(DISTRO),gentoo)
	209	CTAGS := exuberant-ctags
	210	endif
	211
	212	CTAGS ?= ctags
	213
	214	# determine the policy version and current kernel version if possible
	215	PV := $(shell $(CHECKPOLICY) -V \|cut -f 1 -d ' ')
	216	KV := $(shell cat /selinux/policyvers)
	217
	218	# dont print version warnings if we are unable to determine
	219	# the currently running kernel's policy version
	220	ifeq ($(KV),)
	221	KV := $(PV)
	222	endif
	223
	224	M4SUPPORT := $(wildcard $(POLDIR)/support/*.spt)
	225	ifdef LOCAL_ROOT
	226	M4SUPPORT += $(wildcard $(LOCAL_POLDIR)/support/*.spt)
	227	endif
	228
	229	APPCONF := config/appconfig-$(TYPE)
	230	SEUSERS := $(APPCONF)/seusers
	231	APPDIR := $(CONTEXTPATH)
	232	APPFILES := $(addprefix $(APPDIR)/,default_contexts default_type initrc_context failsafe_context userhelper_context removable_context dbus_contexts customizable_types) $(CONTEXTPATH)/files/media
	233	CONTEXTFILES += $(wildcard $(APPCONF)/_context) $(APPCONF)/media
	234
	235	ALL_LAYERS := $(filter-out $(MODDIR)/CVS,$(shell find $(wildcard $(MODDIR)/*) -maxdepth 0 -type d))
	236	ifdef LOCAL_ROOT
	237	ALL_LAYERS += $(filter-out $(LOCAL_MODDIR)/CVS,$(shell find $(wildcard $(LOCAL_MODDIR)/*) -maxdepth 0 -type d))
	238	endif
	239
	240	GENERATED_TE := $(basename $(foreach dir,$(ALL_LAYERS),$(wildcard $(dir)/*.te.in)))
	241	GENERATED_IF := $(basename $(foreach dir,$(ALL_LAYERS),$(wildcard $(dir)/*.if.in)))
	242	GENERATED_FC := $(basename $(foreach dir,$(ALL_LAYERS),$(wildcard $(dir)/*.fc.in)))
	243
	244	# sort here since it removes duplicates, which can happen
	245	# when a generated file is already generated
	246	DETECTED_MODS := $(sort $(foreach dir,$(ALL_LAYERS),$(wildcard $(dir)/*.te)) $(GENERATED_TE))
	247
	248	# modules.conf setting for base module
	249	MODBASE := base
	250
	251	# modules.conf setting for loadable module
	252	MODMOD := module
	253
	254	# modules.conf setting for unused module
	255	MODUNUSED := off
	256
	257	# test for module overrides from command line
	258	MOD_TEST = $(filter $(APPS_OFF), $(APPS_BASE) $(APPS_MODS))
	259	MOD_TEST += $(filter $(APPS_MODS), $(APPS_BASE))
	260	ifneq ($(strip $(MOD_TEST)),)
	261	$(error Applications must be base, module, or off, and not in more than one list! $(strip $(MOD_TEST)) found in multiple lists!)
	262	endif
	263
	264	# add on suffix to modules specified on command line
	265	CMDLINE_BASE := $(addsuffix .te,$(APPS_BASE))
	266	CMDLINE_MODS := $(addsuffix .te,$(APPS_MODS))
	267	CMDLINE_OFF := $(addsuffix .te,$(APPS_OFF))
	268
	269	# extract settings from modules.conf
	270	MOD_CONF_BASE := $(addsuffix .te,$(sort $(shell awk '/^[[:blank:]]*[[:alpha:]]/{ if ($$3 == "$(MODBASE)") print $$1 }' $(MOD_CONF) 2> /dev/null)))
	271	MOD_CONF_MODS := $(addsuffix .te,$(sort $(shell awk '/^[[:blank:]]*[[:alpha:]]/{ if ($$3 == "$(MODMOD)") print $$1 }' $(MOD_CONF) 2> /dev/null)))
	272	MOD_CONF_OFF := $(addsuffix .te,$(sort $(shell awk '/^[[:blank:]]*[[:alpha:]]/{ if ($$3 == "$(MODUNUSED)") print $$1 }' $(MOD_CONF) 2> /dev/null)))
	273
	274	BASE_MODS := $(CMDLINE_BASE)
	275	MOD_MODS := $(CMDLINE_MODS)
	276	OFF_MODS := $(CMDLINE_OFF)
	277
	278	BASE_MODS += $(filter-out $(CMDLINE_OFF) $(CMDLINE_BASE) $(CMDLINE_MODS), $(MOD_CONF_BASE))
	279	MOD_MODS += $(filter-out $(CMDLINE_OFF) $(CMDLINE_BASE) $(CMDLINE_MODS), $(MOD_CONF_MODS))
	280	OFF_MODS += $(filter-out $(CMDLINE_OFF) $(CMDLINE_BASE) $(CMDLINE_MODS), $(MOD_CONF_OFF))
	281
	282	# add modules not in modules.conf to the off list
	283	OFF_MODS += $(filter-out $(BASE_MODS) $(MOD_MODS) $(OFF_MODS),$(notdir $(DETECTED_MODS)))
	284
	285	# filesystems to be used in labeling targets
	286	FILESYSTEMS = $(shell mount \| grep -v "context=" \| egrep -v '\((\|.,)bind(,.\|)\)' \| awk '/(ext[23]\| xfs\| jfs).*rw/{print $$3}';)
	287
	288	########################################
	289	#
	290	# Functions
	291	#
	292
	293	# parse-rolemap modulename,outputfile
	294	define parse-rolemap
	295	$(verbose) m4 $(M4PARAM) $(ROLEMAP) \| \
	296	awk '/^[[:blank:]]*[A-Za-z]/{ print "gen_require(type " $$3 "; role " $$1 ";)\n$1_per_userdomain_template(" $$2 "," $$3 "," $$1 ")" }' >> $2
	297	endef
	298
	299	# peruser-expansion modulename,outputfile
	300	define peruser-expansion
	301	$(verbose) echo "ifdef(\`""$1""_per_userdomain_template',\`" > $2
	302	$(call parse-rolemap,$1,$2)
	303	$(verbose) echo "')" >> $2
	304	endef
	305
	306	########################################
	307	#
	308	# Load appropriate rules
	309	#
	310
	311	ifeq ($(MONOLITHIC),y)
	312	include Rules.monolithic
	313	else
	314	include Rules.modular
	315	endif
	316
	317	########################################
	318	#
	319	# Generated files
	320	#
	321	# NOTE: There is no "local" version of these files.
	322	#
	323	generate: $(GENERATED_TE) $(GENERATED_IF) $(GENERATED_FC)
	324
	325	$(MODDIR)/kernel/corenetwork.if: $(MODDIR)/kernel/corenetwork.if.m4 $(MODDIR)/kernel/corenetwork.if.in
	326	@echo "#" > $@
	327	@echo "# This is a generated file! Instead of modifying this file, the" >> $@
	328	@echo "# $(notdir $@).in or $(notdir $@).m4 file should be modified." >> $@
	329	@echo "#" >> $@
	330	$(verbose) cat $(MODDIR)/kernel/corenetwork.if.in >> $@
	331	$(verbose) egrep "^[[:blank:]]network_(interface\|node\|port\|packet)\(.\)" $(@:.if=.te).in \
	332	\| m4 -D self_contained_policy $(M4PARAM) $(MODDIR)/kernel/corenetwork.if.m4 - \
	333	\| sed -e 's/dollarsone/\$$1/g' -e 's/dollarszero/\$$0/g' >> $@
	334
	335	$(MODDIR)/kernel/corenetwork.te: $(MODDIR)/kernel/corenetwork.te.m4 $(MODDIR)/kernel/corenetwork.te.in
	336	@echo "#" > $@
	337	@echo "# This is a generated file! Instead of modifying this file, the" >> $@
	338	@echo "# $(notdir $@).in or $(notdir $@).m4 file should be modified." >> $@
	339	@echo "#" >> $@
	340	$(verbose) m4 -D self_contained_policy $(M4PARAM) $^ \
	341	\| sed -e 's/dollarsone/\$$1/g' -e 's/dollarszero/\$$0/g' >> $@
	342
	343	########################################
	344	#
	345	# Create config files
	346	#
	347	conf: $(MOD_CONF) $(BOOLEANS) $(GENERATED_TE) $(GENERATED_IF) $(GENERATED_FC)
	348
	349	$(MOD_CONF) $(BOOLEANS): $(POLXML)
	350	@echo "Updating $(MOD_CONF) and $(BOOLEANS)"
	351	$(verbose) $(GENDOC) -b $(BOOLEANS) -m $(MOD_CONF) -x $(POLXML)
	352
	353	########################################
	354	#
	355	# Generate the fc_sort program
	356	#
	357	$(FCSORT) : $(SUPPORT)/fc_sort.c
	358	$(verbose) $(CC) $(CFLAGS) $(SUPPORT)/fc_sort.c -o $(FCSORT)
	359
	360	########################################
	361	#
	362	# Documentation generation
	363	#
	364
	365	# minimal dependencies here, because we don't want to rebuild
	366	# this and its dependents every time the dependencies
	367	# change. Also use all .if files here, rather then just the
	368	# enabled modules.
	369	xml: $(POLXML)
	370	$(POLXML): $(DETECTED_MODS:.te=.if) $(foreach dir,$(ALL_LAYERS),$(dir)/$(LAYERXML))
	371	@echo "Creating $(@F)"
	372	@test -d $(dir $(POLXML)) \|\| mkdir -p $(dir $(POLXML))
	373	@test -d $(TMPDIR) \|\| mkdir -p $(TMPDIR)
	374	$(verbose) echo '<?xml version="1.0" encoding="ISO-8859-1" standalone="no"?>' > $@
	375	$(verbose) echo '<!DOCTYPE policy SYSTEM "$(notdir $(XMLDTD))">' >> $@
	376	$(verbose) $(GENXML) -w -m $(LAYERXML) -t $(GLOBALTUN) -b $(GLOBALBOOL) -o $(DOCS) $(ALL_LAYERS) >> $@
	377	$(verbose) if test -x $(XMLLINT) && test -f $(XMLDTD); then \
	378	$(XMLLINT) --noout --path $(dir $(XMLDTD)) --dtdvalid $(XMLDTD) $@ ;\
	379	fi
	380
	381	$(TUNXML) $(BOOLXML): $(POLXML)
	382
	383	html $(TMPDIR)/html: $(POLXML)
	384	@echo "Building html interface reference documentation in $(HTMLDIR)"
	385	@test -d $(HTMLDIR) \|\| mkdir -p $(HTMLDIR)
	386	@test -d $(TMPDIR) \|\| mkdir -p $(TMPDIR)
	387	$(verbose) $(GENDOC) -d $(HTMLDIR) -T $(DOCTEMPLATE) -x $(POLXML)
	388	$(verbose) cp $(DOCTEMPLATE)/*.css $(HTMLDIR)
	389	@touch $(TMPDIR)/html
	390
	391	########################################
	392	#
	393	# Runtime binary policy patching of users
	394	#
	395	$(USERPATH)/system.users: $(M4SUPPORT) $(TMPDIR)/generated_definitions.conf $(USER_FILES)
	396	@mkdir -p $(TMPDIR)
	397	@mkdir -p $(USERPATH)
	398	@echo "Installing system.users"
	399	@echo "# " > $(TMPDIR)/system.users
	400	@echo "# Do not edit this file. " >> $(TMPDIR)/system.users
	401	@echo "# This file is replaced on reinstalls of this policy." >> $(TMPDIR)/system.users
	402	@echo "# Please edit local.users to make local changes." >> $(TMPDIR)/system.users
	403	@echo "#" >> $(TMPDIR)/system.users
	404	$(verbose) m4 -D self_contained_policy $(M4PARAM) $^ \| sed -r -e 's/^[[:blank:]]+//' \
	405	-e '/^[[:blank:]]*($$\|#)/d' >> $(TMPDIR)/system.users
	406	$(verbose) install -m 644 $(TMPDIR)/system.users $@
	407
	408	$(USERPATH)/local.users: config/local.users
	409	@mkdir -p $(USERPATH)
	410	@echo "Installing local.users"
	411	$(verbose) install -b -m 644 $< $@
	412
	413	########################################
	414	#
	415	# Appconfig files
	416	#
	417	install-appconfig: $(APPFILES)
	418
	419	$(INSTALLDIR)/booleans: $(BOOLEANS)
	420	@mkdir -p $(TMPDIR)
	421	@mkdir -p $(INSTALLDIR)
	422	$(verbose) sed -r -e 's/false/0/g' -e 's/true/1/g' \
	423	-e '/^[[:blank:]]*($$\|#)/d' $(BOOLEANS) \| sort > $(TMPDIR)/booleans
	424	$(verbose) install -m 644 $(TMPDIR)/booleans $@
	425
	426	$(CONTEXTPATH)/files/media: $(APPCONF)/media
	427	@mkdir -p $(CONTEXTPATH)/files/
	428	$(verbose) install -m 644 $< $@
	429
	430	$(APPDIR)/default_contexts: $(APPCONF)/default_contexts
	431	@mkdir -p $(APPDIR)
	432	$(verbose) install -m 644 $< $@
	433
	434	$(APPDIR)/removable_context: $(APPCONF)/removable_context
	435	@mkdir -p $(APPDIR)
	436	$(verbose) install -m 644 $< $@
	437
	438	$(APPDIR)/default_type: $(APPCONF)/default_type
	439	@mkdir -p $(APPDIR)
	440	$(verbose) install -m 644 $< $@
	441
	442	$(APPDIR)/userhelper_context: $(APPCONF)/userhelper_context
	443	@mkdir -p $(APPDIR)
	444	$(verbose) install -m 644 $< $@
	445
	446	$(APPDIR)/initrc_context: $(APPCONF)/initrc_context
	447	@mkdir -p $(APPDIR)
	448	$(verbose) install -m 644 $< $@
	449
	450	$(APPDIR)/failsafe_context: $(APPCONF)/failsafe_context
	451	@mkdir -p $(APPDIR)
	452	$(verbose) install -m 644 $< $@
	453
	454	$(APPDIR)/dbus_contexts: $(APPCONF)/dbus_contexts
	455	@mkdir -p $(APPDIR)
	456	$(verbose) install -m 644 $< $@
	457
	458	$(APPDIR)/users/root: $(APPCONF)/root_default_contexts
	459	@mkdir -p $(APPDIR)/users
	460	$(verbose) install -m 644 $< $@
	461
	462	########################################
	463	#
	464	# Install policy headers
	465	#
	466	install-headers: $(TUNXML) $(BOOLXML)
	467	@mkdir -p $(HEADERDIR)
	468	@echo "Installing $(TYPE) policy headers."
	469	$(verbose) install -m 644 $(TUNXML) $(BOOLXML) $(HEADERDIR)
	470	$(verbose) m4 $(M4PARAM) $(ROLEMAP) > $(HEADERDIR)/$(notdir $(ROLEMAP))
	471	$(verbose) mkdir -p $(HEADERDIR)/support
	472	$(verbose) install -m 644 $(M4SUPPORT) $(word $(words $(GENXML)),$(GENXML)) $(XMLDTD) $(HEADERDIR)/support
	473	$(verbose) $(GENPERM) $(AVS) $(SECCLASS) > $(HEADERDIR)/support/all_perms.spt
	474	$(verbose) for i in $(notdir $(ALL_LAYERS)); do \
	475	mkdir -p $(HEADERDIR)/$$i ;\
	476	install -m 644 $(MODDIR)/$$i/*.if \
	477	$(MODDIR)/$$i/metadata.xml \
	478	$(HEADERDIR)/$$i ;\
	479	done
	480	$(verbose) echo "TYPE ?= $(TYPE)" > $(HEADERDIR)/build.conf
	481	$(verbose) echo "NAME ?= $(NAME)" >> $(HEADERDIR)/build.conf
	482	ifneq "$(DISTRO)" ""
	483	$(verbose) echo "DISTRO ?= $(DISTRO)" >> $(HEADERDIR)/build.conf
	484	endif
	485	$(verbose) echo "MONOLITHIC ?= n" >> $(HEADERDIR)/build.conf
	486	$(verbose) echo "DIRECT_INITRC ?= $(DIRECT_INITRC)" >> $(HEADERDIR)/build.conf
	487	$(verbose) echo "POLY ?= $(POLY)" >> $(HEADERDIR)/build.conf
	488	$(verbose) install -m 644 $(SUPPORT)/Makefile.devel $(HEADERDIR)/Makefile
	489
	490	########################################
	491	#
	492	# Install policy documentation
	493	#
	494	install-docs: $(TMPDIR)/html
	495	@mkdir -p $(DOCSDIR)/html
	496	@echo "Installing policy documentation"
	497	$(verbose) install -m 644 $(DOCFILES) $(DOCSDIR)
	498	$(verbose) install -m 644 $(wildcard $(HTMLDIR)/*) $(DOCSDIR)/html
	499
	500	########################################
	501	#
	502	# Install policy sources
	503	#
	504	install-src:
	505	rm -rf $(SRCPATH)/policy.old
	506	-mv $(SRCPATH)/policy $(SRCPATH)/policy.old
	507	mkdir -p $(SRCPATH)/policy
	508	cp -R . $(SRCPATH)/policy
	509
	510	########################################
	511	#
	512	# Generate tags file
	513	#
	514	tags: $(TAGS)
	515	$(TAGS):
	516	@($(CTAGS) --version \| grep -q Exuberant) \|\| (echo ERROR: Need exuberant-ctags to function!; exit 1)
	517	@LC_ALL=C $(CTAGS) -f $(TAGS) --langdef=te --langmap=te:..te.if.spt \
	518	--regex-te='/^type[ \t]+(\w+)(,\|;)/\1/t,type/' \
	519	--regex-te='/^typealias[ \t]+\w+[ \t+]+alias[ \t]+(\w+);/\1/t,type/' \
	520	--regex-te='/^attribute[ \t]+(\w+);/\1/a,attribute/' \
	521	--regex-te='/^[ \t]*define\(`(\w+)/\1/d,define/' \
	522	--regex-te='/^[ \t]*interface\(`(\w+)/\1/i,interface/' \
	523	--regex-te='/^[ \t]bool[ \t]+(\w+)/\1/b,bool/' policy/modules//.{if,te} policy/support/.spt
	524
	525	########################################
	526	#
	527	# Filesystem labeling
	528	#
	529	checklabels:
	530	@echo "Checking labels on filesystem types: ext2 ext3 xfs jfs"
	531	@if test -z "$(FILESYSTEMS)"; then \
	532	echo "No filesystems with extended attributes found!" ;\
	533	false ;\
	534	fi
	535	$(verbose) $(SETFILES) -v -n $(FCPATH) $(FILESYSTEMS)
	536
	537	restorelabels:
	538	@echo "Restoring labels on filesystem types: ext2 ext3 xfs jfs"
	539	@if test -z "$(FILESYSTEMS)"; then \
	540	echo "No filesystems with extended attributes found!" ;\
	541	false ;\
	542	fi
	543	$(verbose) $(SETFILES) -v $(FCPATH) $(FILESYSTEMS)
	544
	545	relabel:
	546	@echo "Relabeling filesystem types: ext2 ext3 xfs jfs"
	547	@if test -z "$(FILESYSTEMS)"; then \
	548	echo "No filesystems with extended attributes found!" ;\
	549	false ;\
	550	fi
	551	$(verbose) $(SETFILES) $(FCPATH) $(FILESYSTEMS)
	552
	553	resetlabels:
	554	@echo "Resetting labels on filesystem types: ext2 ext3 xfs jfs"
	555	@if test -z "$(FILESYSTEMS)"; then \
	556	echo "No filesystems with extended attributes found!" ;\
	557	false ;\
	558	fi
	559	$(verbose) $(SETFILES) -F $(FCPATH) $(FILESYSTEMS)
	560
	561	########################################
	562	#
	563	# Clean everything
	564	#
	565	bare: clean
	566	rm -f $(POLXML)
	567	rm -f $(TUNXML)
	568	rm -f $(BOOLXML)
	569	rm -f $(MOD_CONF)
	570	rm -f $(BOOLEANS)
	571	rm -fR $(HTMLDIR)
	572	rm -f $(TAGS)
	573	# don't remove these files if we're given a local root
	574	ifndef LOCAL_ROOT
	575	rm -f $(FCSORT)
	576	rm -f $(SUPPORT)/*.pyc
	577	ifneq ($(GENERATED_TE),)
	578	rm -f $(GENERATED_TE)
	579	endif
	580	ifneq ($(GENERATED_IF),)
	581	rm -f $(GENERATED_IF)
	582	endif
	583	ifneq ($(GENERATED_FC),)
	584	rm -f $(GENERATED_FC)
	585	endif
	586	endif
	587
	588	.PHONY: install-src install-appconfig generate xml conf html bare tags
	589	.SUFFIXES:
	590	.SUFFIXES: .c