Rules.monolithic

   1 ########################################
   2 #
   3 # Rules and Targets for building monolithic policies
   4 #
   5
   6 POLICY_CONF = $(BUILDDIR)policy.conf
   7 FC = $(BUILDDIR)file_contexts
   8 POLVER = $(BUILDDIR)policy.$(PV)
   9 HOMEDIR_TEMPLATE = $(BUILDDIR)homedir_template
  10
  11 M4PARAM += -D self_contained_policy
  12
  13 # install paths
  14 POLICYPATH = $(INSTALLDIR)/policy
  15 LOADPATH = $(POLICYPATH)/$(notdir $(POLVER))
  16 HOMEDIRPATH = $(CONTEXTPATH)/files/homedir_template
  17
  18 APPFILES += $(INSTALLDIR)/booleans
  19
  20 # for monolithic policy use all base and module to create policy
  21 ALL_MODULES := $(strip $(BASE_MODS) $(MOD_MODS))
  22 # off module interfaces included to make sure all interfaces are expanded.
  23 ALL_INTERFACES := $(ALL_MODULES:.te=.if) $(OFF_MODS:.te=.if)
  24 ALL_TE_FILES := $(ALL_MODULES)
  25 ALL_FC_FILES := $(ALL_MODULES:.te=.fc)
  26
  27 PRE_TE_FILES := $(SECCLASS) $(ISIDS) $(AVS) $(M4SUPPORT) $(POLDIR)/mls $(POLDIR)/mcs
  28 POST_TE_FILES := $(USER_FILES) $(POLDIR)/constraints
  29
  30 POLICY_SECTIONS := $(TMPDIR)/pre_te_files.conf $(TMPDIR)/all_attrs_types.conf $(TMPDIR)/global_bools.conf $(TMPDIR)/only_te_rules.conf $(TMPDIR)/all_post.conf
  31
  32 # search layer dirs for source files
  33 vpath %.te $(ALL_LAYERS)
  34 vpath %.if $(ALL_LAYERS)
  35 vpath %.fc $(ALL_LAYERS)
  36
  37 ########################################
  38 #
  39 # default action: build policy locally
  40 #
  41 default: policy
  42
  43 policy: $(POLVER)
  44
  45 install: $(LOADPATH) $(FCPATH) $(NCPATH) $(APPFILES) $(USERPATH)/local.users
  46
  47 load: $(TMPDIR)/load
  48
  49 checklabels: $(FCPATH)
  50 restorelabels: $(FCPATH)
  51 relabel:  $(FCPATH)
  52 resetlabels:  $(FCPATH)
  53
  54 ########################################
  55 #
  56 # Build a binary policy locally
  57 #
  58 $(POLVER): $(POLICY_CONF)
  59         @echo "Compiling $(NAME) $(POLVER)"
  60 ifneq ($(PV),$(KV))
  61         @echo
  62         @echo "WARNING: Policy version mismatch!  Is your OUTPUT_POLICY set correctly?"
  63         @echo
  64 endif
  65         $(verbose) $(CHECKPOLICY) $^ -o $@
  66
  67 ########################################
  68 #
  69 # Install a binary policy
  70 #
  71 $(LOADPATH): $(POLICY_CONF)
  72         @mkdir -p $(POLICYPATH)
  73         @echo "Compiling and installing $(NAME) $(LOADPATH)"
  74 ifneq ($(PV),$(KV))
  75         @echo
  76         @echo "WARNING: Policy version mismatch!  Is your OUTPUT_POLICY set correctly?"
  77         @echo
  78 endif
  79         $(verbose) $(CHECKPOLICY) $^ -o $@
  80
  81 ########################################
  82 #
  83 # Load the binary policy
  84 #
  85 reload $(TMPDIR)/load: $(LOADPATH) $(FCPATH) $(APPFILES)
  86         @echo "Loading $(NAME) $(LOADPATH)"
  87         $(verbose) $(LOADPOLICY) -q $(LOADPATH)
  88         @touch $(TMPDIR)/load
  89
  90 ########################################
  91 #
  92 # Construct a monolithic policy.conf
  93 #
  94 $(POLICY_CONF): $(POLICY_SECTIONS)
  95         @echo "Creating $(NAME) $(@F)"
  96         @test -d $(@D) || mkdir -p $(@D)
  97         $(verbose) cat $^ > $@
  98
  99 $(TMPDIR)/pre_te_files.conf: $(PRE_TE_FILES)
 100         @test -d $(TMPDIR) || mkdir -p $(TMPDIR)
 101         $(verbose) $(M4) $(M4PARAM) $^ > $@
 102
 103 $(TMPDIR)/generated_definitions.conf: $(ALL_TE_FILES)
 104         @test -d $(TMPDIR) || mkdir -p $(TMPDIR)
 105 # define all available object classes
 106         $(verbose) $(GENPERM) $(AVS) $(SECCLASS) > $@
 107 # per-userdomain templates:
 108         $(verbose) echo "define(\`base_per_userdomain_template',\`" >> $@
 109         $(verbose) $(foreach mod,$(basename $(notdir $(ALL_MODULES))), \
 110                 echo "ifdef(\`""$(mod)""_per_userdomain_template',\`""$(mod)""_per_userdomain_template("'$$*'")')" >> $@ ;)
 111         $(verbose) echo "')" >> $@
 112         $(verbose) test -f $(BOOLEANS) && $(SETBOOLS) $(BOOLEANS) >> $@ || true
 113
 114 $(TMPDIR)/global_bools.conf: $(M4SUPPORT) $(TMPDIR)/generated_definitions.conf $(GLOBALBOOL) $(GLOBALTUN)
 115         $(verbose) $(M4) $(M4PARAM) $^ > $@
 116
 117 $(TMPDIR)/all_interfaces.conf: $(M4SUPPORT) $(ALL_INTERFACES)
 118         @test -d $(TMPDIR) || mkdir -p $(TMPDIR)
 119         @echo "ifdef(\`__if_error',\`m4exit(1)')" > $(TMPDIR)/iferror.m4
 120         @echo "divert(-1)" > $@
 121         $(verbose) $(M4) $^ $(TMPDIR)/iferror.m4 >> $(TMPDIR)/$(@F).tmp
 122         $(verbose) $(SED) -e s/dollarsstar/\$$\*/g $(TMPDIR)/$(@F).tmp >> $@
 123         @echo "divert" >> $@
 124
 125 $(TMPDIR)/rolemap.conf: $(ROLEMAP)
 126         $(call parse-rolemap,base,$@)
 127
 128 $(TMPDIR)/all_te_files.conf: $(M4SUPPORT) $(TMPDIR)/generated_definitions.conf $(TMPDIR)/all_interfaces.conf $(ALL_TE_FILES) $(TMPDIR)/rolemap.conf
 129 ifeq "$(strip $(ALL_TE_FILES))" ""
 130         $(error No enabled modules! $(notdir $(MOD_CONF)) may need to be generated by using "make conf")
 131 endif
 132         @test -d $(TMPDIR) || mkdir -p $(TMPDIR)
 133         $(verbose) $(M4) $(M4PARAM) -s $^ > $@
 134
 135 $(TMPDIR)/post_te_files.conf: $(M4SUPPORT) $(POST_TE_FILES)
 136         @test -d $(TMPDIR) || mkdir -p $(TMPDIR)
 137         $(verbose) $(M4) $(M4PARAM) $^ > $@
 138
 139 # extract attributes and put them first. extract post te stuff
 140 # like genfscon and put last.
 141 $(TMPDIR)/all_attrs_types.conf $(TMPDIR)/only_te_rules.conf $(TMPDIR)/all_post.conf: $(TMPDIR)/all_te_files.conf $(TMPDIR)/post_te_files.conf
 142         $(verbose) $(get_type_attr_decl) $(TMPDIR)/all_te_files.conf | $(SORT) > $(TMPDIR)/all_attrs_types.conf
 143         $(verbose) cat $(TMPDIR)/post_te_files.conf > $(TMPDIR)/all_post.conf
 144 # these have to run individually because order matters:
 145         $(verbose) $(GREP) '^sid ' $(TMPDIR)/all_te_files.conf >> $(TMPDIR)/all_post.conf || true
 146         $(verbose) $(GREP) '^fs_use_(xattr|task|trans)' $(TMPDIR)/all_te_files.conf >> $(TMPDIR)/all_post.conf || true
 147         $(verbose) $(GREP) ^genfscon $(TMPDIR)/all_te_files.conf >> $(TMPDIR)/all_post.conf || true
 148         $(verbose) $(GREP) ^portcon $(TMPDIR)/all_te_files.conf >> $(TMPDIR)/all_post.conf || true
 149         $(verbose) $(GREP) ^netifcon $(TMPDIR)/all_te_files.conf >> $(TMPDIR)/all_post.conf || true
 150         $(verbose) $(GREP) ^nodecon $(TMPDIR)/all_te_files.conf >> $(TMPDIR)/all_post.conf || true
 151         $(verbose) $(comment_move_decl) $(TMPDIR)/all_te_files.conf > $(TMPDIR)/only_te_rules.conf
 152
 153 ########################################
 154 #
 155 # Remove the dontaudit rules from the policy.conf
 156 #
 157 enableaudit: $(POLICY_CONF)
 158         @test -d $(TMPDIR) || mkdir -p $(TMPDIR)
 159         @echo "Removing dontaudit rules from $(notdir $(POLICY_CONF))"
 160         $(verbose) $(GREP) -v dontaudit $^ > $(TMPDIR)/policy.audit
 161         $(verbose) mv $(TMPDIR)/policy.audit $(POLICY_CONF)
 162
 163 ########################################
 164 #
 165 # Construct file_contexts
 166 #
 167 $(FC): $(TMPDIR)/$(notdir $(FC)).tmp $(FCSORT)
 168         $(verbose) $(FCSORT) $< $@
 169         $(verbose) $(GREP) -e HOME -e ROLE $@ > $(HOMEDIR_TEMPLATE)
 170         $(verbose) $(SED) -i -e /HOME/d -e /ROLE/d $@
 171
 172 $(TMPDIR)/$(notdir $(FC)).tmp: $(M4SUPPORT) $(TMPDIR)/generated_definitions.conf $(ALL_FC_FILES)
 173 ifeq ($(ALL_FC_FILES),)
 174         $(error No enabled modules! $(notdir $(MOD_CONF)) may need to be generated by using "make conf")
 175 endif
 176         @echo "Creating $(NAME) file_contexts."
 177         @test -d $(TMPDIR) || mkdir -p $(TMPDIR)
 178         $(verbose) $(M4) $(M4PARAM) $^ > $@
 179
 180 $(HOMEDIR_TEMPLATE): $(FC)
 181
 182 ########################################
 183 #
 184 # Install file_contexts
 185 #
 186 $(FCPATH): $(FC) $(LOADPATH) $(USERPATH)/system.users
 187         @echo "Validating $(NAME) file_contexts."
 188         $(verbose) $(SETFILES) -q -c $(LOADPATH) $(FC)
 189         @echo "Installing file_contexts."
 190         @mkdir -p $(CONTEXTPATH)/files
 191         $(verbose) install -m 644 $(FC) $(FCPATH)
 192         $(verbose) install -m 644 $(HOMEDIR_TEMPLATE) $(HOMEDIRPATH)
 193         $(verbose) $(genhomedircon) -d $(TOPDIR) -t $(NAME) $(USEPWD)
 194 ifeq "$(DISTRO)" "rhel4"
 195 # Setfiles in RHEL4 does not look at file_contexts.homedirs.
 196         $(verbose) cat $@.homedirs >> $@
 197 # Delete the file_contexts.homedirs in case the toolchain has
 198 # been updated, to prevent duplicate match errors.
 199         $(verbose) rm -f $@.homedirs
 200 endif
 201
 202 ########################################
 203 #
 204 # Intall netfilter_contexts
 205 #
 206 $(NCPATH): $(net_contexts)
 207         @echo "Installing $(NAME) netfilter_contexts."
 208         $(verbose) install -m 0644 $^ $@
 209
 210 ########################################
 211 #
 212 # Run policy source checks
 213 #
 214 check: $(BUILDDIR)check.res
 215 $(BUILDDIR)check.res: $(POLICY_CONF) $(FC)
 216         $(SECHECK) -s --profile=development --policy=$(POLICY_CONF) --fcfile=$(FC) > $@
 217
 218 longcheck: $(BUILDDIR)longcheck.res
 219 $(BUILDDIR)longcheck.res: $(POLICY_CONF) $(FC)
 220         $(SECHECK) -s --profile=all --policy=$(POLICY_CONF) --fcfile=$(FC) > $@
 221
 222 ########################################
 223 #
 224 # Appconfig files
 225 #
 226 $(APPDIR)/customizable_types: $(POLICY_CONF)
 227         @mkdir -p $(APPDIR)
 228         $(verbose) $(GREP) '^[[:blank:]]*type .*customizable' $< | cut -d';' -f1 | cut -d',' -f1 | cut -d' ' -f2 | $(SORT) -u > $(TMPDIR)/customizable_types
 229         $(verbose) install -m 644 $(TMPDIR)/customizable_types $@
 230
 231 ########################################
 232 #
 233 # Clean the sources
 234 #
 235 clean:
 236         rm -f $(POLICY_CONF)
 237         rm -f $(POLVER)
 238         rm -f $(FC)
 239         rm -f $(HOMEDIR_TEMPLATE)
 240         rm -f $(net_contexts)
 241         rm -f *.res
 242         rm -fR $(TMPDIR)
 243
 244 .PHONY: default policy install load reload enableaudit checklabels restorelabels relabel check longcheck clean