Rules.modular

   1 ########################################
   2 #
   3 # Rules and Targets for building modular policies
   4 #
   5
   6 all_modules := $(base_mods) $(mod_mods) $(off_mods)
   7 all_interfaces := $(all_modules:.te=.if)
   8
   9 base_pkg := $(builddir)base.pp
  10 base_fc := $(builddir)base.fc
  11 base_conf := $(builddir)base.conf
  12 base_mod := $(tmpdir)/base.mod
  13
  14 users_extra := $(tmpdir)/users_extra
  15
  16 base_sections := $(tmpdir)/pre_te_files.conf $(tmpdir)/all_attrs_types.conf $(tmpdir)/global_bools.conf $(tmpdir)/only_te_rules.conf $(tmpdir)/all_post.conf
  17
  18 base_pre_te_files := $(secclass) $(isids) $(avs) $(m4support) $(poldir)/mls $(poldir)/mcs
  19 base_te_files := $(base_mods)
  20 base_post_te_files := $(user_files) $(poldir)/constraints
  21 base_fc_files := $(base_mods:.te=.fc)
  22
  23 mod_pkgs := $(addprefix $(builddir),$(notdir $(mod_mods:.te=.pp)))
  24
  25 # policy packages to install
  26 instpkg := $(addprefix $(modpkgdir)/,$(notdir $(base_pkg)) $(mod_pkgs))
  27
  28 # search layer dirs for source files
  29 vpath %.te $(all_layers)
  30 vpath %.if $(all_layers)
  31 vpath %.fc $(all_layers)
  32
  33 # broken in make 3.81:
  34 #.SECONDARY:
  35
  36 ########################################
  37 #
  38 # default action: create all module packages
  39 #
  40 default: policy
  41
  42 all policy: base modules
  43
  44 base: $(base_pkg)
  45
  46 modules: $(mod_pkgs)
  47
  48 install: $(instpkg) $(appfiles)
  49
  50 ########################################
  51 #
  52 # Load all configured modules
  53 #
  54 load: $(instpkg) $(appfiles)
  55 # make sure two directories exist since they are not
  56 # created by semanage
  57         @mkdir -p $(policypath) $(dir $(fcpath))
  58         @echo "Loading configured modules."
  59         $(verbose) $(SEMODULE) -s $(NAME) -b $(modpkgdir)/$(notdir $(base_pkg)) $(foreach mod,$(mod_pkgs),-i $(modpkgdir)/$(mod))
  60
  61 ########################################
  62 #
  63 # Install policy packages
  64 #
  65 $(modpkgdir)/%.pp: $(builddir)%.pp
  66         @mkdir -p $(modpkgdir)
  67         @echo "Installing $(NAME) $(@F) policy package."
  68         $(verbose) $(INSTALL) -m 0644 $^ $(modpkgdir)
  69
  70 ########################################
  71 #
  72 # Build module packages
  73 #
  74 $(tmpdir)/%.mod: $(m4support) $(tmpdir)/generated_definitions.conf $(tmpdir)/all_interfaces.conf %.te
  75         @echo "Compliling $(NAME) $(@F) module"
  76         @test -d $(tmpdir) || mkdir -p $(tmpdir)
  77         $(call perrole-expansion,$(basename $(@F)),$@.role)
  78         $(verbose) $(M4) $(M4PARAM) -s $^ $@.role > $(@:.mod=.tmp)
  79         $(verbose) $(CHECKMODULE) -m $(@:.mod=.tmp) -o $@
  80
  81 $(tmpdir)/%.mod.fc: $(m4support) %.fc
  82         @test -d $(tmpdir) || mkdir -p $(tmpdir)
  83         $(verbose) $(M4) $(M4PARAM) $(m4support) $^ > $@
  84
  85 $(builddir)%.pp: $(tmpdir)/%.mod $(tmpdir)/%.mod.fc
  86         @echo "Creating $(NAME) $(@F) policy package"
  87         @test -d $(builddir) || mkdir -p $(builddir)
  88         $(verbose) $(SEMOD_PKG) -o $@ -m $< -f $<.fc
  89
  90 ########################################
  91 #
  92 # Create a base module package
  93 #
  94 $(base_pkg): $(base_mod) $(base_fc) $(users_extra) $(tmpdir)/seusers $(net_contexts)
  95         @echo "Creating $(NAME) base module package"
  96         @test -d $(builddir) || mkdir -p $(builddir)
  97         $(verbose) $(SEMOD_PKG) -o $@ -m $(base_mod) -f $(base_fc) -u $(users_extra) -s $(tmpdir)/seusers -n $(net_contexts)
  98
  99 $(base_mod): $(base_conf)
 100         @echo "Compiling $(NAME) base module"
 101         $(verbose) $(CHECKMODULE) $^ -o $@
 102
 103 $(tmpdir)/seusers: $(seusers)
 104         @mkdir -p $(tmpdir)
 105         $(verbose) $(M4) $(M4PARAM) $(m4support) $^ | $(GREP) '^[a-z_]' > $@
 106
 107 $(users_extra): $(m4support) $(user_files)
 108         @test -d $(tmpdir) || mkdir -p $(tmpdir)
 109         $(verbose) $(M4) $(M4PARAM) -D users_extra $^ | \
 110                 $(SED) -r -n -e 's/^[[:blank:]]*//g' -e '/^user/p' > $@
 111
 112 ########################################
 113 #
 114 # Construct a base.conf
 115 #
 116 $(base_conf): $(base_sections)
 117         @echo "Creating $(NAME) base module $(@F)"
 118         @test -d $(@D) || mkdir -p $(@D)
 119         $(verbose) cat $^ > $@
 120
 121 $(tmpdir)/pre_te_files.conf: M4PARAM += -D self_contained_policy
 122 $(tmpdir)/pre_te_files.conf: $(base_pre_te_files)
 123         @test -d $(tmpdir) || mkdir -p $(tmpdir)
 124         $(verbose) $(M4) $(M4PARAM) $^ > $@
 125
 126 $(tmpdir)/generated_definitions.conf: $(base_te_files)
 127         @test -d $(tmpdir) || mkdir -p $(tmpdir)
 128 # define all available object classes
 129         $(verbose) $(genperm) $(avs) $(secclass) > $@
 130         $(verbose) $(call create-base-per-role-tmpl,$(patsubst %.te,%,$(base_mods)),$@)
 131         $(verbose) test -f $(booleans) && $(setbools) $(booleans) >> $@ || true
 132
 133 $(tmpdir)/global_bools.conf: M4PARAM += -D self_contained_policy
 134 $(tmpdir)/global_bools.conf: $(m4support) $(tmpdir)/generated_definitions.conf $(globalbool) $(globaltun)
 135         $(verbose) $(M4) $(M4PARAM) $^ > $@
 136
 137 $(tmpdir)/all_interfaces.conf: $(m4support) $(all_interfaces)
 138         @test -d $(tmpdir) || mkdir -p $(tmpdir)
 139         @echo "ifdef(\`__if_error',\`m4exit(1)')" > $(tmpdir)/iferror.m4
 140         @echo "divert(-1)" > $@
 141         $(verbose) $(M4) $^ $(tmpdir)/iferror.m4 >> $(tmpdir)/$(@F).tmp
 142         $(verbose) $(SED) -e s/dollarsstar/\$$\*/g $(tmpdir)/$(@F).tmp >> $@
 143         @echo "divert" >> $@
 144
 145 $(tmpdir)/rolemap.conf: M4PARAM += -D self_contained_policy
 146 $(tmpdir)/rolemap.conf: $(rolemap)
 147         $(call parse-rolemap,base,$@)
 148
 149 $(tmpdir)/all_te_files.conf: M4PARAM += -D self_contained_policy
 150 $(tmpdir)/all_te_files.conf: $(m4support) $(tmpdir)/generated_definitions.conf $(tmpdir)/all_interfaces.conf $(base_te_files) $(tmpdir)/rolemap.conf
 151 ifeq "$(strip $(base_te_files))" ""
 152         $(error No enabled modules! $(notdir $(mod_conf)) may need to be generated by using "make conf")
 153 endif
 154         @test -d $(tmpdir) || mkdir -p $(tmpdir)
 155         $(verbose) $(M4) $(M4PARAM) -s $^ > $@
 156
 157 $(tmpdir)/post_te_files.conf: M4PARAM += -D self_contained_policy
 158 $(tmpdir)/post_te_files.conf: $(m4support) $(base_post_te_files)
 159         @test -d $(tmpdir) || mkdir -p $(tmpdir)
 160         $(verbose) $(M4) $(M4PARAM) $^ > $@
 161
 162 # extract attributes and put them first. extract post te stuff
 163 # like genfscon and put last.
 164 $(tmpdir)/all_attrs_types.conf $(tmpdir)/only_te_rules.conf $(tmpdir)/all_post.conf: $(tmpdir)/all_te_files.conf $(tmpdir)/post_te_files.conf
 165         $(verbose) $(get_type_attr_decl) $(tmpdir)/all_te_files.conf | $(SORT) > $(tmpdir)/all_attrs_types.conf
 166         $(verbose) cat $(tmpdir)/post_te_files.conf > $(tmpdir)/all_post.conf
 167 # these have to run individually because order matters:
 168         $(verbose) $(GREP) '^sid ' $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true
 169         $(verbose) $(GREP) '^fs_use_(xattr|task|trans)' $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true
 170         $(verbose) $(GREP) ^genfscon $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true
 171         $(verbose) $(GREP) ^portcon $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true
 172         $(verbose) $(GREP) ^netifcon $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true
 173         $(verbose) $(GREP) ^nodecon $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true
 174         $(verbose) $(comment_move_decl) $(tmpdir)/all_te_files.conf > $(tmpdir)/only_te_rules.conf
 175
 176 ########################################
 177 #
 178 # Construct a base.fc
 179 #
 180 $(base_fc): $(tmpdir)/$(notdir $(base_fc)).tmp $(fcsort)
 181         $(verbose) $(fcsort) $< $@
 182
 183 $(tmpdir)/$(notdir $(base_fc)).tmp: $(m4support) $(tmpdir)/generated_definitions.conf $(base_fc_files)
 184 ifeq ($(base_fc_files),)
 185         $(error No enabled modules! $(notdir $(mod_conf)) may need to be generated by using "make conf")
 186 endif
 187         @echo "Creating $(NAME) base module file contexts."
 188         @test -d $(tmpdir) || mkdir -p $(tmpdir)
 189         $(verbose) $(M4) $(M4PARAM) $^ > $@
 190
 191 ########################################
 192 #
 193 # Remove the dontaudit rules from the base.conf
 194 #
 195 enableaudit: $(base_conf)
 196         @test -d $(tmpdir) || mkdir -p $(tmpdir)
 197         @echo "Removing dontaudit rules from $(^F)"
 198         $(verbose) $(GREP) -v dontaudit $(base_conf) > $(tmpdir)/base.audit
 199         $(verbose) mv $(tmpdir)/base.audit $(base_conf)
 200
 201 ########################################
 202 #
 203 # Appconfig files
 204 #
 205 $(appdir)/customizable_types: $(base_conf)
 206         @mkdir -p $(appdir)
 207         $(verbose) $(GREP) '^[[:blank:]]*type .*customizable' $< | cut -d';' -f1 | cut -d',' -f1 | cut -d' ' -f2 | $(SORT) -u > $(tmpdir)/customizable_types
 208         $(verbose) $(INSTALL) -m 644 $(tmpdir)/customizable_types $@
 209
 210 ########################################
 211 #
 212 # Validate linking and expanding of modules
 213 #
 214 validate: $(base_pkg) $(mod_pkgs)
 215         @echo "Validating policy linking."
 216         $(verbose) $(SEMOD_LNK) -o $(tmpdir)/test.lnk $^
 217         $(verbose) $(SEMOD_EXP) $(tmpdir)/test.lnk $(tmpdir)/policy.bin
 218         @echo "Success."
 219
 220 ########################################
 221 #
 222 # Clean the sources
 223 #
 224 clean:
 225         rm -f $(base_conf)
 226         rm -f $(base_fc)
 227         rm -f $(builddir)*.pp
 228         rm -f $(net_contexts)
 229         rm -fR $(tmpdir)
 230
 231 .PHONY: default all policy base modules install load clean validate