refpolicy/Rules.monolithic

   1 ########################################
   2 #
   3 # Rules and Targets for building monolithic policies
   4 #
   5
   6 POLICY_CONF = $(BUILDDIR)policy.conf
   7 FC = $(BUILDDIR)file_contexts
   8 POLVER = $(BUILDDIR)policy.$(PV)
   9 HOMEDIR_TEMPLATE = $(BUILDDIR)homedir_template
  10
  11 M4PARAM += -D self_contained_policy
  12
  13 # install paths
  14 POLICYPATH = $(INSTALLDIR)/policy
  15 LOADPATH = $(POLICYPATH)/$(notdir $(POLVER))
  16 HOMEDIRPATH = $(CONTEXTPATH)/files/homedir_template
  17
  18 APPFILES += $(INSTALLDIR)/booleans
  19
  20 # for monolithic policy use all base and module to create policy
  21 ALL_MODULES := $(strip $(BASE_MODS) $(MOD_MODS))
  22
  23 ALL_INTERFACES := $(ALL_MODULES:.te=.if)
  24 ALL_TE_FILES := $(ALL_MODULES)
  25 ALL_FC_FILES := $(ALL_MODULES:.te=.fc)
  26
  27 PRE_TE_FILES := $(SECCLASS) $(ISIDS) $(AVS) $(M4SUPPORT) $(POLDIR)/mls $(POLDIR)/mcs
  28 POST_TE_FILES := $(USER_FILES) $(POLDIR)/constraints
  29
  30 POLICY_SECTIONS := $(TMPDIR)/pre_te_files.conf $(TMPDIR)/all_attrs_types.conf $(TMPDIR)/global_bools.conf $(TMPDIR)/only_te_rules.conf $(TMPDIR)/all_post.conf
  31
  32 # search layer dirs for source files
  33 vpath %.te $(ALL_LAYERS)
  34 vpath %.if $(ALL_LAYERS)
  35 vpath %.fc $(ALL_LAYERS)
  36
  37 ########################################
  38 #
  39 # default action: build policy locally
  40 #
  41 default: policy
  42
  43 policy: $(POLVER)
  44
  45 install: $(LOADPATH) $(FCPATH) $(APPFILES) $(USERPATH)/local.users
  46
  47 load: $(TMPDIR)/load
  48
  49 checklabels: $(FCPATH)
  50 restorelabels: $(FCPATH)
  51 relabel:  $(FCPATH)
  52 resetlabels:  $(FCPATH)
  53
  54 ########################################
  55 #
  56 # Build a binary policy locally
  57 #
  58 $(POLVER): $(POLICY_CONF)
  59         @echo "Compiling $(NAME) $(POLVER)"
  60 ifneq ($(PV),$(KV))
  61         @echo
  62         @echo "WARNING: Policy version mismatch!  Is your OUTPUT_POLICY set correctly?"
  63         @echo
  64 endif
  65         $(verbose) $(CHECKPOLICY) $^ -o $@
  66
  67 ########################################
  68 #
  69 # Install a binary policy
  70 #
  71 $(LOADPATH): $(POLICY_CONF)
  72         @mkdir -p $(POLICYPATH)
  73         @echo "Compiling and installing $(NAME) $(LOADPATH)"
  74 ifneq ($(PV),$(KV))
  75         @echo
  76         @echo "WARNING: Policy version mismatch!  Is your OUTPUT_POLICY set correctly?"
  77         @echo
  78 endif
  79         $(verbose) $(CHECKPOLICY) $^ -o $@
  80
  81 ########################################
  82 #
  83 # Load the binary policy
  84 #
  85 reload $(TMPDIR)/load: $(LOADPATH) $(FCPATH) $(APPFILES)
  86         @echo "Loading $(NAME) $(LOADPATH)"
  87         $(verbose) $(LOADPOLICY) -q $(LOADPATH)
  88         @touch $(TMPDIR)/load
  89
  90 ########################################
  91 #
  92 # Construct a monolithic policy.conf
  93 #
  94 $(POLICY_CONF): $(POLICY_SECTIONS)
  95         @echo "Creating $(NAME) $(@F)"
  96         @test -d $(@D) || mkdir -p $(@D)
  97         $(verbose) cat $^ > $@
  98
  99 $(TMPDIR)/pre_te_files.conf: $(PRE_TE_FILES)
 100         @test -d $(TMPDIR) || mkdir -p $(TMPDIR)
 101         $(verbose) $(M4) $(M4PARAM) $^ > $@
 102
 103 $(TMPDIR)/generated_definitions.conf: $(ALL_TE_FILES)
 104 # per-userdomain templates:
 105         @test -d $(TMPDIR) || mkdir -p $(TMPDIR)
 106         $(verbose) echo "define(\`base_per_userdomain_template',\`" > $@
 107         $(verbose) $(foreach mod,$(basename $(notdir $(ALL_MODULES))), \
 108                 echo "ifdef(\`""$(mod)""_per_userdomain_template',\`""$(mod)""_per_userdomain_template("'$$*'")')" >> $@ ;)
 109         $(verbose) echo "')" >> $@
 110 # define foo.te
 111         $(verbose) for i in $(notdir $(ALL_MODULES)); do \
 112                 echo "define(\`$$i')" >> $@ ;\
 113         done
 114         $(verbose) test -f $(BOOLEANS) && $(SETBOOLS) $(BOOLEANS) >> $@ || true
 115
 116 $(TMPDIR)/global_bools.conf: $(M4SUPPORT) $(TMPDIR)/generated_definitions.conf $(GLOBALBOOL) $(GLOBALTUN)
 117         $(verbose) $(M4) $(M4PARAM) $^ > $@
 118
 119 $(TMPDIR)/all_interfaces.conf: $(M4SUPPORT) $(ALL_INTERFACES)
 120 ifeq ($(ALL_INTERFACES),)
 121         $(error No enabled modules! $(notdir $(MOD_CONF)) may need to be generated by using "make conf")
 122 endif
 123         @test -d $(TMPDIR) || mkdir -p $(TMPDIR)
 124         @echo "divert(-1)" > $@
 125         $(verbose) $(M4) $^ | $(SED) -e s/dollarsstar/\$$\*/g >> $@
 126         @echo "divert" >> $@
 127
 128 $(TMPDIR)/rolemap.conf: $(ROLEMAP)
 129         $(call parse-rolemap,base,$@)
 130
 131 $(TMPDIR)/all_te_files.conf: $(M4SUPPORT) $(TMPDIR)/generated_definitions.conf $(TMPDIR)/all_interfaces.conf $(ALL_TE_FILES) $(TMPDIR)/rolemap.conf
 132 ifeq ($(ALL_TE_FILES),)
 133         $(error No enabled modules! $(notdir $(MOD_CONF)) may need to be generated by using "make conf")
 134 endif
 135         @test -d $(TMPDIR) || mkdir -p $(TMPDIR)
 136         $(verbose) $(M4) $(M4PARAM) -s $^ > $@
 137
 138 $(TMPDIR)/post_te_files.conf: $(M4SUPPORT) $(POST_TE_FILES)
 139         @test -d $(TMPDIR) || mkdir -p $(TMPDIR)
 140         $(verbose) $(M4) $(M4PARAM) $^ > $@
 141
 142 # extract attributes and put them first. extract post te stuff
 143 # like genfscon and put last.
 144 $(TMPDIR)/all_attrs_types.conf $(TMPDIR)/only_te_rules.conf $(TMPDIR)/all_post.conf: $(TMPDIR)/all_te_files.conf $(TMPDIR)/post_te_files.conf
 145         $(verbose) $(get_type_attr_decl) $(TMPDIR)/all_te_files.conf > $(TMPDIR)/all_attrs_types.conf
 146         $(verbose) cat $(TMPDIR)/post_te_files.conf > $(TMPDIR)/all_post.conf
 147 # these have to run individually because order matters:
 148         $(verbose) $(GREP) '^sid ' $(TMPDIR)/all_te_files.conf >> $(TMPDIR)/all_post.conf || true
 149         $(verbose) $(GREP) '^fs_use_(xattr|task|trans)' $(TMPDIR)/all_te_files.conf >> $(TMPDIR)/all_post.conf || true
 150         $(verbose) $(GREP) ^genfscon $(TMPDIR)/all_te_files.conf >> $(TMPDIR)/all_post.conf || true
 151         $(verbose) $(GREP) ^portcon $(TMPDIR)/all_te_files.conf >> $(TMPDIR)/all_post.conf || true
 152         $(verbose) $(GREP) ^netifcon $(TMPDIR)/all_te_files.conf >> $(TMPDIR)/all_post.conf || true
 153         $(verbose) $(GREP) ^nodecon $(TMPDIR)/all_te_files.conf >> $(TMPDIR)/all_post.conf || true
 154         $(verbose) $(comment_move_decl) $(TMPDIR)/all_te_files.conf > $(TMPDIR)/only_te_rules.conf
 155
 156 ########################################
 157 #
 158 # Remove the dontaudit rules from the policy.conf
 159 #
 160 enableaudit: $(POLICY_CONF)
 161         @test -d $(TMPDIR) || mkdir -p $(TMPDIR)
 162         @echo "Removing dontaudit rules from $(notdir $(POLICY_CONF))"
 163         $(verbose) $(GREP) -v dontaudit @^ > $(TMPDIR)/policy.audit
 164         $(verbose) mv $(TMPDIR)/policy.audit $(POLICY_CONF)
 165
 166 ########################################
 167 #
 168 # Construct file_contexts
 169 #
 170 $(FC): $(TMPDIR)/$(notdir $(FC)).tmp $(FCSORT)
 171         $(verbose) $(FCSORT) $< $@
 172         $(verbose) $(GREP) -e HOME -e ROLE $@ > $(HOMEDIR_TEMPLATE)
 173         $(verbose) $(SED) -i -e /HOME/d -e /ROLE/d $@
 174
 175 $(TMPDIR)/$(notdir $(FC)).tmp: $(M4SUPPORT) $(TMPDIR)/generated_definitions.conf $(ALL_FC_FILES)
 176 ifeq ($(ALL_FC_FILES),)
 177         $(error No enabled modules! $(notdir $(MOD_CONF)) may need to be generated by using "make conf")
 178 endif
 179         @echo "Creating $(NAME) file_contexts."
 180         @test -d $(TMPDIR) || mkdir -p $(TMPDIR)
 181         $(verbose) $(M4) $(M4PARAM) $^ > $@
 182
 183 ########################################
 184 #
 185 # Install file_contexts
 186 #
 187 $(FCPATH): $(FC) $(LOADPATH) $(USERPATH)/system.users
 188         @echo "Validating $(NAME) file_contexts."
 189         $(verbose) $(SETFILES) -q -c $(LOADPATH) $(FC)
 190         @echo "Installing file_contexts."
 191         @mkdir -p $(CONTEXTPATH)/files
 192         $(verbose) install -m 644 $(FC) $(FCPATH)
 193         $(verbose) install -m 644 $(HOMEDIR_TEMPLATE) $(HOMEDIRPATH)
 194         $(verbose) $(GENHOMEDIRCON) -d $(TOPDIR) -t $(NAME) $(USEPWD)
 195
 196 ########################################
 197 #
 198 # Run policy source checks
 199 #
 200 check: $(BUILDDIR)check.res
 201 $(BUILDDIR)check.res: $(POLICY_CONF) $(FC)
 202         $(SECHECK) -s --profile=development --policy=$(POLICY_CONF) --fcfile=$(FC) > $@
 203
 204 longcheck: $(BUILDDIR)longcheck.res
 205 $(BUILDDIR)longcheck.res: $(POLICY_CONF) $(FC)
 206         $(SECHECK) -s --profile=all --policy=$(POLICY_CONF) --fcfile=$(FC) > $@
 207
 208 ########################################
 209 #
 210 # Appconfig files
 211 #
 212 $(APPDIR)/customizable_types: $(POLICY_CONF)
 213         @mkdir -p $(APPDIR)
 214         $(verbose) $(GREP) "^type .*customizable" $< | cut -d',' -f1 | cut -d' ' -f2 > $(TMPDIR)/customizable_types
 215         $(verbose) install -m 644 $(TMPDIR)/customizable_types $@
 216
 217 ########################################
 218 #
 219 # Clean the sources
 220 #
 221 clean:
 222         rm -f $(POLICY_CONF)
 223         rm -f $(POLVER)
 224         rm -f $(FC)
 225         rm -f $(HOMEDIR_TEMPLATE)
 226         rm -f *.res
 227         rm -fR $(TMPDIR)
 228
 229 .PHONY: default policy install load reload enableaudit checklabels restorelabels relabel check longcheck clean