]>
Commit | Line | Data |
---|---|---|
fb0a3a98 CP |
1 | ######################################## |
2 | # | |
3 | # Rules and Targets for building monolithic policies | |
4 | # | |
5 | ||
c634db20 CP |
6 | # determine the policy version and current kernel version if possible |
7 | pv := $(shell $(CHECKPOLICY) -V |cut -f 1 -d ' ') | |
8 | kv := $(shell cat /selinux/policyvers) | |
9 | ||
10 | # dont print version warnings if we are unable to determine | |
11 | # the currently running kernel's policy version | |
12 | ifeq "$(kv)" "" | |
13 | kv := $(pv) | |
14 | endif | |
15 | ||
16 | policy_conf = $(builddir)policy.conf | |
17 | fc = $(builddir)file_contexts | |
18 | polver = $(builddir)policy.$(pv) | |
19 | homedir_template = $(builddir)homedir_template | |
c9f20d5b | 20 | |
3abd5ee8 CP |
21 | M4PARAM += -D self_contained_policy |
22 | ||
fb0a3a98 | 23 | # install paths |
c634db20 | 24 | loadpath = $(policypath)/$(notdir $(polver)) |
fb0a3a98 | 25 | |
c634db20 | 26 | appfiles += $(installdir)/booleans $(userpath)/local.users |
fb0a3a98 | 27 | |
c767b14c | 28 | # for monolithic policy use all base and module to create policy |
c634db20 | 29 | all_modules := $(strip $(base_mods) $(mod_mods)) |
ab23bb90 | 30 | # off module interfaces included to make sure all interfaces are expanded. |
c634db20 CP |
31 | all_interfaces := $(all_modules:.te=.if) $(off_mods:.te=.if) |
32 | all_te_files := $(all_modules) | |
33 | all_fc_files := $(all_modules:.te=.fc) | |
fb0a3a98 | 34 | |
c634db20 CP |
35 | pre_te_files := $(secclass) $(isids) $(avs) $(m4support) $(poldir)/mls $(poldir)/mcs |
36 | post_te_files := $(user_files) $(poldir)/constraints | |
fb0a3a98 | 37 | |
c634db20 | 38 | policy_sections := $(tmpdir)/pre_te_files.conf $(tmpdir)/all_attrs_types.conf $(tmpdir)/global_bools.conf $(tmpdir)/only_te_rules.conf $(tmpdir)/all_post.conf |
c767b14c CP |
39 | |
40 | # search layer dirs for source files | |
c634db20 CP |
41 | vpath %.te $(all_layers) |
42 | vpath %.if $(all_layers) | |
43 | vpath %.fc $(all_layers) | |
c767b14c | 44 | |
fb0a3a98 CP |
45 | ######################################## |
46 | # | |
47 | # default action: build policy locally | |
48 | # | |
49 | default: policy | |
50 | ||
c634db20 | 51 | policy: $(polver) |
fb0a3a98 | 52 | |
d17bab02 | 53 | install: $(loadpath) $(fcpath) $(appfiles) |
fb0a3a98 | 54 | |
c634db20 | 55 | load: $(tmpdir)/load |
fb0a3a98 | 56 | |
c634db20 CP |
57 | checklabels: $(fcpath) |
58 | restorelabels: $(fcpath) | |
59 | relabel: $(fcpath) | |
60 | resetlabels: $(fcpath) | |
120988c4 | 61 | |
fb0a3a98 CP |
62 | ######################################## |
63 | # | |
64 | # Build a binary policy locally | |
65 | # | |
8acfcbcc CP |
66 | ifneq "$(UNK_PERMS)" "" |
67 | $(polver): CHECKPOLICY += -U $(UNK_PERMS) | |
68 | endif | |
c634db20 CP |
69 | $(polver): $(policy_conf) |
70 | @echo "Compiling $(NAME) $(polver)" | |
71 | ifneq ($(pv),$(kv)) | |
fb0a3a98 CP |
72 | @echo |
73 | @echo "WARNING: Policy version mismatch! Is your OUTPUT_POLICY set correctly?" | |
74 | @echo | |
75 | endif | |
5b45ffb0 | 76 | $(verbose) $(CHECKPOLICY) $^ -o $@ |
fb0a3a98 CP |
77 | |
78 | ######################################## | |
79 | # | |
80 | # Install a binary policy | |
81 | # | |
8acfcbcc CP |
82 | ifneq "$(UNK_PERMS)" "" |
83 | $(loadpath): CHECKPOLICY += -U $(UNK_PERMS) | |
84 | endif | |
c634db20 CP |
85 | $(loadpath): $(policy_conf) |
86 | @mkdir -p $(policypath) | |
87 | @echo "Compiling and installing $(NAME) $(loadpath)" | |
88 | ifneq ($(pv),$(kv)) | |
fb0a3a98 CP |
89 | @echo |
90 | @echo "WARNING: Policy version mismatch! Is your OUTPUT_POLICY set correctly?" | |
91 | @echo | |
92 | endif | |
9b3756bf | 93 | $(verbose) $(CHECKPOLICY) $^ -o $@ |
fb0a3a98 CP |
94 | |
95 | ######################################## | |
96 | # | |
97 | # Load the binary policy | |
98 | # | |
c634db20 CP |
99 | reload $(tmpdir)/load: $(loadpath) $(fcpath) $(ncpath) $(appfiles) |
100 | @echo "Loading $(NAME) $(loadpath)" | |
101 | $(verbose) $(LOADPOLICY) -q $(loadpath) | |
102 | @touch $(tmpdir)/load | |
fb0a3a98 CP |
103 | |
104 | ######################################## | |
105 | # | |
106 | # Construct a monolithic policy.conf | |
107 | # | |
c634db20 | 108 | $(policy_conf): $(policy_sections) |
c9f20d5b | 109 | @echo "Creating $(NAME) $(@F)" |
3abd5ee8 CP |
110 | @test -d $(@D) || mkdir -p $(@D) |
111 | $(verbose) cat $^ > $@ | |
fb0a3a98 | 112 | |
c634db20 CP |
113 | $(tmpdir)/pre_te_files.conf: $(pre_te_files) |
114 | @test -d $(tmpdir) || mkdir -p $(tmpdir) | |
3abd5ee8 | 115 | $(verbose) $(M4) $(M4PARAM) $^ > $@ |
fb0a3a98 | 116 | |
c634db20 CP |
117 | $(tmpdir)/generated_definitions.conf: $(all_te_files) |
118 | @test -d $(tmpdir) || mkdir -p $(tmpdir) | |
70131678 | 119 | # define all available object classes |
c634db20 | 120 | $(verbose) $(genperm) $(avs) $(secclass) > $@ |
bbcd3c97 | 121 | $(verbose) $(call create-base-per-role-tmpl,$(basename $(notdir $(all_modules))),$@) |
c634db20 | 122 | $(verbose) test -f $(booleans) && $(setbools) $(booleans) >> $@ || true |
fb0a3a98 | 123 | |
c634db20 | 124 | $(tmpdir)/global_bools.conf: $(m4support) $(tmpdir)/generated_definitions.conf $(globalbool) $(globaltun) |
3abd5ee8 CP |
125 | $(verbose) $(M4) $(M4PARAM) $^ > $@ |
126 | ||
c634db20 CP |
127 | $(tmpdir)/all_interfaces.conf: $(m4support) $(all_interfaces) |
128 | @test -d $(tmpdir) || mkdir -p $(tmpdir) | |
129 | @echo "ifdef(\`__if_error',\`m4exit(1)')" > $(tmpdir)/iferror.m4 | |
3abd5ee8 | 130 | @echo "divert(-1)" > $@ |
c634db20 CP |
131 | $(verbose) $(M4) $^ $(tmpdir)/iferror.m4 >> $(tmpdir)/$(@F).tmp |
132 | $(verbose) $(SED) -e s/dollarsstar/\$$\*/g $(tmpdir)/$(@F).tmp >> $@ | |
3abd5ee8 | 133 | @echo "divert" >> $@ |
fb0a3a98 | 134 | |
c634db20 | 135 | $(tmpdir)/rolemap.conf: $(rolemap) |
96fc0a45 | 136 | $(verbose) echo "" > $@ |
3abd5ee8 CP |
137 | $(call parse-rolemap,base,$@) |
138 | ||
c634db20 CP |
139 | $(tmpdir)/all_te_files.conf: $(m4support) $(tmpdir)/generated_definitions.conf $(tmpdir)/all_interfaces.conf $(all_te_files) $(tmpdir)/rolemap.conf |
140 | ifeq "$(strip $(all_te_files))" "" | |
141 | $(error No enabled modules! $(notdir $(mod_conf)) may need to be generated by using "make conf") | |
fb0a3a98 | 142 | endif |
c634db20 | 143 | @test -d $(tmpdir) || mkdir -p $(tmpdir) |
3abd5ee8 | 144 | $(verbose) $(M4) $(M4PARAM) -s $^ > $@ |
fb0a3a98 | 145 | |
c634db20 CP |
146 | $(tmpdir)/post_te_files.conf: $(m4support) $(post_te_files) |
147 | @test -d $(tmpdir) || mkdir -p $(tmpdir) | |
3abd5ee8 | 148 | $(verbose) $(M4) $(M4PARAM) $^ > $@ |
fb0a3a98 CP |
149 | |
150 | # extract attributes and put them first. extract post te stuff | |
3abd5ee8 | 151 | # like genfscon and put last. |
c634db20 CP |
152 | $(tmpdir)/all_attrs_types.conf $(tmpdir)/only_te_rules.conf $(tmpdir)/all_post.conf: $(tmpdir)/all_te_files.conf $(tmpdir)/post_te_files.conf |
153 | $(verbose) $(get_type_attr_decl) $(tmpdir)/all_te_files.conf | $(SORT) > $(tmpdir)/all_attrs_types.conf | |
154 | $(verbose) cat $(tmpdir)/post_te_files.conf > $(tmpdir)/all_post.conf | |
3abd5ee8 | 155 | # these have to run individually because order matters: |
c634db20 CP |
156 | $(verbose) $(GREP) '^sid ' $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true |
157 | $(verbose) $(GREP) '^fs_use_(xattr|task|trans)' $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true | |
158 | $(verbose) $(GREP) ^genfscon $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true | |
159 | $(verbose) $(GREP) ^portcon $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true | |
160 | $(verbose) $(GREP) ^netifcon $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true | |
161 | $(verbose) $(GREP) ^nodecon $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true | |
162 | $(verbose) $(comment_move_decl) $(tmpdir)/all_te_files.conf > $(tmpdir)/only_te_rules.conf | |
fb0a3a98 CP |
163 | |
164 | ######################################## | |
165 | # | |
166 | # Remove the dontaudit rules from the policy.conf | |
167 | # | |
c634db20 CP |
168 | enableaudit: $(policy_conf) |
169 | @test -d $(tmpdir) || mkdir -p $(tmpdir) | |
170 | @echo "Removing dontaudit rules from $(notdir $(policy_conf))" | |
171 | $(verbose) $(GREP) -v dontaudit $^ > $(tmpdir)/policy.audit | |
172 | $(verbose) mv $(tmpdir)/policy.audit $(policy_conf) | |
fb0a3a98 CP |
173 | |
174 | ######################################## | |
175 | # | |
176 | # Construct file_contexts | |
177 | # | |
c634db20 CP |
178 | $(fc): $(tmpdir)/$(notdir $(fc)).tmp $(fcsort) |
179 | $(verbose) $(fcsort) $< $@ | |
180 | $(verbose) $(GREP) -e HOME -e ROLE $@ > $(homedir_template) | |
3abd5ee8 | 181 | $(verbose) $(SED) -i -e /HOME/d -e /ROLE/d $@ |
c767b14c | 182 | |
c634db20 CP |
183 | $(tmpdir)/$(notdir $(fc)).tmp: $(m4support) $(tmpdir)/generated_definitions.conf $(all_fc_files) |
184 | ifeq ($(all_fc_files),) | |
185 | $(error No enabled modules! $(notdir $(mod_conf)) may need to be generated by using "make conf") | |
fb0a3a98 CP |
186 | endif |
187 | @echo "Creating $(NAME) file_contexts." | |
c634db20 | 188 | @test -d $(tmpdir) || mkdir -p $(tmpdir) |
3abd5ee8 | 189 | $(verbose) $(M4) $(M4PARAM) $^ > $@ |
fb0a3a98 | 190 | |
c634db20 | 191 | $(homedir_template): $(fc) |
fc47b34c | 192 | |
fb0a3a98 CP |
193 | ######################################## |
194 | # | |
195 | # Install file_contexts | |
196 | # | |
c634db20 | 197 | $(fcpath): $(fc) $(loadpath) $(userpath)/system.users |
fb0a3a98 | 198 | @echo "Validating $(NAME) file_contexts." |
c634db20 | 199 | $(verbose) $(SETFILES) -q -c $(loadpath) $(fc) |
fb0a3a98 | 200 | @echo "Installing file_contexts." |
c634db20 CP |
201 | @mkdir -p $(contextpath)/files |
202 | $(verbose) $(INSTALL) -m 644 $(fc) $(fcpath) | |
203 | $(verbose) $(INSTALL) -m 644 $(homedir_template) $(homedirpath) | |
204 | $(verbose) $(genhomedircon) -d $(topdir) -t $(NAME) $(USEPWD) | |
fc47b34c CP |
205 | ifeq "$(DISTRO)" "rhel4" |
206 | # Setfiles in RHEL4 does not look at file_contexts.homedirs. | |
207 | $(verbose) cat $@.homedirs >> $@ | |
208 | # Delete the file_contexts.homedirs in case the toolchain has | |
209 | # been updated, to prevent duplicate match errors. | |
210 | $(verbose) rm -f $@.homedirs | |
185ab241 | 211 | endif |
fb0a3a98 | 212 | |
8df65f13 | 213 | ######################################## |
5a7c06fd CP |
214 | # |
215 | # Intall netfilter_contexts | |
216 | # | |
c634db20 | 217 | $(ncpath): $(net_contexts) |
5a7c06fd | 218 | @echo "Installing $(NAME) netfilter_contexts." |
cfd5c5e1 | 219 | $(verbose) $(INSTALL) -m 0644 $^ $@ |
5a7c06fd CP |
220 | |
221 | ######################################## | |
8df65f13 CP |
222 | # |
223 | # Run policy source checks | |
224 | # | |
c634db20 CP |
225 | check: $(builddir)check.res |
226 | $(builddir)check.res: $(policy_conf) $(fc) | |
227 | $(SECHECK) -s --profile=development --policy=$(policy_conf) --fcfile=$(fc) > $@ | |
8df65f13 | 228 | |
c634db20 CP |
229 | longcheck: $(builddir)longcheck.res |
230 | $(builddir)longcheck.res: $(policy_conf) $(fc) | |
231 | $(SECHECK) -s --profile=all --policy=$(policy_conf) --fcfile=$(fc) > $@ | |
8df65f13 | 232 | |
049e11af CP |
233 | ######################################## |
234 | # | |
235 | # Appconfig files | |
236 | # | |
c634db20 CP |
237 | $(appdir)/customizable_types: $(policy_conf) |
238 | @mkdir -p $(appdir) | |
239 | $(verbose) $(GREP) '^[[:blank:]]*type .*customizable' $< | cut -d';' -f1 | cut -d',' -f1 | cut -d' ' -f2 | $(SORT) -u > $(tmpdir)/customizable_types | |
240 | $(verbose) $(INSTALL) -m 644 $(tmpdir)/customizable_types $@ | |
049e11af | 241 | |
fb0a3a98 CP |
242 | ######################################## |
243 | # | |
244 | # Clean the sources | |
245 | # | |
246 | clean: | |
c634db20 CP |
247 | rm -f $(policy_conf) |
248 | rm -f $(polver) | |
249 | rm -f $(fc) | |
250 | rm -f $(homedir_template) | |
6962bb32 | 251 | rm -f $(net_contexts) |
8df65f13 | 252 | rm -f *.res |
c634db20 | 253 | rm -fR $(tmpdir) |
fb0a3a98 | 254 | |
8df65f13 | 255 | .PHONY: default policy install load reload enableaudit checklabels restorelabels relabel check longcheck clean |