1 ########################################
3 # Rules and Targets for building modular policies
6 all_modules := $(base_mods) $(mod_mods) $(off_mods)
7 all_interfaces := $(all_modules:.te=.if)
9 base_pkg := $(builddir)base.pp
10 base_fc := $(builddir)base.fc
11 base_conf := $(builddir)base.conf
12 base_mod := $(tmpdir)/base.mod
14 users_extra := $(tmpdir)/users_extra
16 base_sections := $(tmpdir)/pre_te_files.conf $(tmpdir)/all_attrs_types.conf $(tmpdir)/global_bools.conf $(tmpdir)/only_te_rules.conf $(tmpdir)/all_post.conf
18 base_pre_te_files := $(secclass) $(isids) $(avs) $(m4support) $(poldir)/mls $(poldir)/mcs $(policycaps)
19 base_te_files := $(base_mods)
20 base_post_te_files := $(user_files) $(poldir)/constraints
21 base_fc_files := $(base_mods:.te=.fc)
23 mod_pkgs := $(addprefix $(builddir),$(notdir $(mod_mods:.te=.pp)))
25 # policy packages to install
26 instpkg := $(addprefix $(modpkgdir)/,$(notdir $(base_pkg)) $(mod_pkgs))
28 # search layer dirs for source files
29 vpath %.te $(all_layers)
30 vpath %.if $(all_layers)
31 vpath %.fc $(all_layers)
33 .SECONDARY: $(addprefix $(tmpdir)/,$(mod_pkgs:.pp=.mod)) $(addprefix $(tmpdir)/,$(mod_pkgs:.pp=.mod.fc))
35 ########################################
37 # default action: create all module packages
41 all policy: base modules
47 install: $(instpkg) $(appfiles)
49 ########################################
51 # Load all configured modules
53 load: $(instpkg) $(appfiles)
54 # make sure two directories exist since they are not
56 @mkdir -p $(policypath) $(dir $(fcpath))
57 @echo "Loading configured modules."
58 $(verbose) $(SEMODULE) -s $(NAME) -b $(modpkgdir)/$(notdir $(base_pkg)) $(foreach mod,$(mod_pkgs),-i $(modpkgdir)/$(mod))
60 ########################################
62 # Install policy packages
64 $(modpkgdir)/%.pp: $(builddir)%.pp
65 @mkdir -p $(modpkgdir)
66 @echo "Installing $(NAME) $(@F) policy package."
67 $(verbose) $(INSTALL) -m 0644 $^ $(modpkgdir)
69 ########################################
71 # Build module packages
73 $(tmpdir)/%.mod: $(m4support) $(tmpdir)/generated_definitions.conf $(tmpdir)/all_interfaces.conf %.te
74 @echo "Compliling $(NAME) $(@F) module"
75 @test -d $(tmpdir) || mkdir -p $(tmpdir)
76 $(call perrole-expansion,$(basename $(@F)),$@.role)
77 $(verbose) $(M4) $(M4PARAM) -s $^ $@.role > $(@:.mod=.tmp)
78 $(verbose) $(CHECKMODULE) -m $(@:.mod=.tmp) -o $@
80 $(tmpdir)/%.mod.fc: $(m4support) %.fc
81 @test -d $(tmpdir) || mkdir -p $(tmpdir)
82 $(verbose) $(M4) $(M4PARAM) $(m4support) $^ > $@
84 $(builddir)%.pp: $(tmpdir)/%.mod $(tmpdir)/%.mod.fc
85 @echo "Creating $(NAME) $(@F) policy package"
86 @test -d $(builddir) || mkdir -p $(builddir)
87 $(verbose) $(SEMOD_PKG) -o $@ -m $< -f $<.fc
89 ########################################
91 # Create a base module package
93 $(base_pkg): $(base_mod) $(base_fc) $(users_extra) $(tmpdir)/seusers
94 @echo "Creating $(NAME) base module package"
95 @test -d $(builddir) || mkdir -p $(builddir)
96 $(verbose) $(SEMOD_PKG) -o $@ -m $(base_mod) -f $(base_fc) -u $(users_extra) -s $(tmpdir)/seusers
98 ifneq "$(UNK_PERMS)" ""
99 $(base_mod): CHECKMODULE += -U $(UNK_PERMS)
101 $(base_mod): $(base_conf)
102 @echo "Compiling $(NAME) base module"
103 $(verbose) $(CHECKMODULE) $^ -o $@
105 $(tmpdir)/seusers: $(seusers)
107 $(verbose) $(M4) $(M4PARAM) $(m4support) $^ | $(GREP) '^[a-z_]' > $@
109 $(users_extra): $(m4support) $(user_files)
110 @test -d $(tmpdir) || mkdir -p $(tmpdir)
111 $(verbose) $(M4) $(M4PARAM) -D users_extra $^ | \
112 $(SED) -r -n -e 's/^[[:blank:]]*//g' -e '/^user/p' > $@
114 ########################################
116 # Construct a base.conf
118 $(base_conf): $(base_sections)
119 @echo "Creating $(NAME) base module $(@F)"
120 @test -d $(@D) || mkdir -p $(@D)
121 $(verbose) cat $^ > $@
123 $(tmpdir)/pre_te_files.conf: M4PARAM += -D self_contained_policy
124 $(tmpdir)/pre_te_files.conf: $(base_pre_te_files)
125 @test -d $(tmpdir) || mkdir -p $(tmpdir)
126 $(verbose) $(M4) $(M4PARAM) $^ > $@
128 $(tmpdir)/generated_definitions.conf:
129 @test -d $(tmpdir) || mkdir -p $(tmpdir)
130 # define all available object classes
131 $(verbose) $(genperm) $(avs) $(secclass) > $@
132 $(verbose) $(call create-base-per-role-tmpl,$(patsubst %.te,%,$(base_mods)),$@)
133 $(verbose) test -f $(booleans) && $(setbools) $(booleans) >> $@ || true
135 $(tmpdir)/global_bools.conf: M4PARAM += -D self_contained_policy
136 $(tmpdir)/global_bools.conf: $(m4support) $(tmpdir)/generated_definitions.conf $(globalbool) $(globaltun)
137 $(verbose) $(M4) $(M4PARAM) $^ > $@
139 $(tmpdir)/all_interfaces.conf: $(m4support) $(all_interfaces) $(m4iferror)
140 @test -d $(tmpdir) || mkdir -p $(tmpdir)
141 @echo "divert(-1)" > $@
142 $(verbose) $(M4) $^ >> $(tmpdir)/$(@F).tmp
143 $(verbose) $(SED) -e s/dollarsstar/\$$\*/g $(tmpdir)/$(@F).tmp >> $@
146 $(tmpdir)/rolemap.conf: M4PARAM += -D self_contained_policy
147 $(tmpdir)/rolemap.conf: $(rolemap)
148 $(verbose) echo "" > $@
149 $(call parse-rolemap,base,$@)
151 $(tmpdir)/all_te_files.conf: M4PARAM += -D self_contained_policy
152 $(tmpdir)/all_te_files.conf: $(m4support) $(tmpdir)/generated_definitions.conf $(tmpdir)/all_interfaces.conf $(base_te_files) $(tmpdir)/rolemap.conf
153 ifeq "$(strip $(base_te_files))" ""
154 $(error No enabled modules! $(notdir $(mod_conf)) may need to be generated by using "make conf")
156 @test -d $(tmpdir) || mkdir -p $(tmpdir)
157 $(verbose) $(M4) $(M4PARAM) -s $^ > $@
159 $(tmpdir)/post_te_files.conf: M4PARAM += -D self_contained_policy
160 $(tmpdir)/post_te_files.conf: $(m4support) $(tmpdir)/generated_definitions.conf $(base_post_te_files)
161 @test -d $(tmpdir) || mkdir -p $(tmpdir)
162 $(verbose) $(M4) $(M4PARAM) $^ > $@
164 # extract attributes and put them first. extract post te stuff
165 # like genfscon and put last.
166 $(tmpdir)/all_attrs_types.conf $(tmpdir)/only_te_rules.conf $(tmpdir)/all_post.conf: $(tmpdir)/all_te_files.conf $(tmpdir)/post_te_files.conf
167 $(verbose) $(get_type_attr_decl) $(tmpdir)/all_te_files.conf | $(SORT) > $(tmpdir)/all_attrs_types.conf
168 $(verbose) cat $(tmpdir)/post_te_files.conf > $(tmpdir)/all_post.conf
169 # these have to run individually because order matters:
170 $(verbose) $(GREP) '^sid ' $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true
171 $(verbose) $(GREP) '^fs_use_(xattr|task|trans)' $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true
172 $(verbose) $(GREP) ^genfscon $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true
173 $(verbose) $(GREP) ^portcon $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true
174 $(verbose) $(GREP) ^netifcon $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true
175 $(verbose) $(GREP) ^nodecon $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true
176 $(verbose) $(comment_move_decl) $(tmpdir)/all_te_files.conf > $(tmpdir)/only_te_rules.conf
178 ########################################
180 # Construct a base.fc
182 $(base_fc): $(tmpdir)/$(notdir $(base_fc)).tmp $(fcsort)
183 $(verbose) $(fcsort) $< $@
185 $(tmpdir)/$(notdir $(base_fc)).tmp: $(m4support) $(tmpdir)/generated_definitions.conf $(base_fc_files)
186 ifeq ($(base_fc_files),)
187 $(error No enabled modules! $(notdir $(mod_conf)) may need to be generated by using "make conf")
189 @echo "Creating $(NAME) base module file contexts."
190 @test -d $(tmpdir) || mkdir -p $(tmpdir)
191 $(verbose) $(M4) $(M4PARAM) $^ > $@
193 ########################################
197 $(appdir)/customizable_types: $(base_conf)
199 $(verbose) $(GREP) '^[[:blank:]]*type .*customizable' $< | cut -d';' -f1 | cut -d',' -f1 | cut -d' ' -f2 | $(SORT) -u > $(tmpdir)/customizable_types
200 $(verbose) $(INSTALL) -m 644 $(tmpdir)/customizable_types $@
202 ########################################
204 # Validate linking and expanding of modules
206 validate: $(base_pkg) $(mod_pkgs)
207 @echo "Validating policy linking."
208 $(verbose) $(SEMOD_LNK) -o $(tmpdir)/test.lnk $^
209 $(verbose) $(SEMOD_EXP) $(tmpdir)/test.lnk $(tmpdir)/policy.bin
210 $(verbose) $(SEPOLGEN) -p $(tmpdir)/policy.bin -i $(poldir) -o $(tmpdir)/output
213 ########################################
220 rm -f $(builddir)*.pp
221 rm -f $(net_contexts)
224 .PHONY: default all policy base modules install load clean validate