refpolicy/Rules.monolithic

   1 ########################################
   2 #
   3 # Rules and Targets for building monolithic policies
   4 #
   5
   6 # install paths
   7 POLICYPATH = $(INSTALLDIR)/policy
   8 LOADPATH = $(POLICYPATH)/$(POLVER)
   9 FCPATH = $(CONTEXTPATH)/files/file_contexts
  10 HOMEDIRPATH = $(CONTEXTPATH)/files/homedir_template
  11
  12 FC := file_contexts
  13 POLVER := policy.$(PV)
  14
  15 APPFILES += $(INSTALLDIR)/booleans
  16
  17 # for monolithic policy use all base and module to create policy
  18 ALL_MODULES := $(strip $(BASE_MODS) $(MOD_MODS))
  19
  20 ALL_INTERFACES := $(ALL_MODULES:.te=.if)
  21 ALL_TE_FILES := $(ALL_MODULES)
  22 ALL_FC_FILES := $(ALL_MODULES:.te=.fc)
  23
  24 PRE_TE_FILES := $(SECCLASS) $(ISIDS) $(AVS) $(M4SUPPORT) $(POLDIR)/mls $(POLDIR)/mcs
  25 POST_TE_FILES := $(USER_FILES) $(POLDIR)/constraints
  26
  27 POLICY_SECTIONS := tmp/pre_te_files.conf tmp/generated_definitions.conf tmp/all_interfaces.conf tmp/all_attrs_types.conf $(GLOBALBOOL) $(GLOBALTUN) tmp/only_te_rules.conf tmp/all_post.conf
  28
  29 HOMEDIR_TEMPLATE = homedir_template
  30
  31 # search layer dirs for source files
  32 vpath %.te $(ALL_LAYERS)
  33 vpath %.if $(ALL_LAYERS)
  34 vpath %.fc $(ALL_LAYERS)
  35
  36 ########################################
  37 #
  38 # default action: build policy locally
  39 #
  40 default: policy
  41
  42 policy: $(POLVER)
  43
  44 install: $(LOADPATH) $(FCPATH) $(APPFILES) $(USERPATH)/local.users
  45
  46 load: tmp/load
  47
  48 ########################################
  49 #
  50 # Build a binary policy locally
  51 #
  52 $(POLVER): policy.conf
  53         @echo "Compiling $(NAME) $(POLVER)"
  54 ifneq ($(PV),$(KV))
  55         @echo
  56         @echo "WARNING: Policy version mismatch!  Is your OUTPUT_POLICY set correctly?"
  57         @echo
  58 endif
  59         $(verbose) $(CHECKPOLICY) $^ -o $@
  60
  61 ########################################
  62 #
  63 # Install a binary policy
  64 #
  65 $(LOADPATH): policy.conf
  66         @mkdir -p $(POLICYPATH)
  67         @echo "Compiling and installing $(NAME) $(LOADPATH)"
  68 ifneq ($(PV),$(KV))
  69         @echo
  70         @echo "WARNING: Policy version mismatch!  Is your OUTPUT_POLICY set correctly?"
  71         @echo
  72 endif
  73         $(verbose) $(CHECKPOLICY) $^ -o $@
  74
  75 ########################################
  76 #
  77 # Load the binary policy
  78 #
  79 reload tmp/load: $(LOADPATH) $(FCPATH) $(APPFILES)
  80         @echo "Loading $(NAME) $(LOADPATH)"
  81         $(verbose) $(LOADPOLICY) -q $(LOADPATH)
  82         @touch tmp/load
  83
  84 ########################################
  85 #
  86 # Construct a monolithic policy.conf
  87 #
  88 policy.conf: $(POLICY_SECTIONS)
  89         @echo "Creating $(NAME) policy.conf"
  90 # checkpolicy can use the #line directives provided by -s for error reporting:
  91         $(verbose) m4 -D self_contained_policy $(M4PARAM) -s $^ > tmp/$@.tmp
  92         $(verbose) sed -e /^portcon/d -e /^nodecon/d -e /^netifcon/d < tmp/$@.tmp > $@
  93 # the ordering of these ocontexts matters:
  94         $(verbose) grep ^portcon tmp/$@.tmp >> $@ || true
  95         $(verbose) grep ^netifcon tmp/$@.tmp >> $@ || true
  96         $(verbose) grep ^nodecon tmp/$@.tmp >> $@ || true
  97
  98 tmp/pre_te_files.conf: $(PRE_TE_FILES)
  99         @test -d tmp || mkdir -p tmp
 100         $(verbose) cat $^ > $@
 101
 102 tmp/generated_definitions.conf: $(ALL_TE_FILES)
 103 # per-userdomain templates:
 104         @test -d tmp || mkdir -p tmp
 105         $(verbose) echo "define(\`base_per_userdomain_template',\`" > $@
 106         $(verbose) for i in $(patsubst %.te,%,$(notdir $(ALL_MODULES))); do \
 107                 echo "ifdef(\`""$$i""_per_userdomain_template',\`""$$i""_per_userdomain_template("'$$*'")')" \
 108                         >> $@ ;\
 109         done
 110         $(verbose) echo "')" >> $@
 111 # define foo.te
 112         $(verbose) for i in $(notdir $(ALL_MODULES)); do \
 113                 echo "define(\`$$i')" >> $@ ;\
 114         done
 115         $(verbose) $(SETTUN) $(BOOLEANS) >> $@
 116
 117 tmp/all_interfaces.conf: $(M4SUPPORT) $(ALL_INTERFACES)
 118 ifeq ($(ALL_INTERFACES),)
 119         $(error No enabled modules! $(notdir $(MOD_CONF)) may need to be generated by using "make conf")
 120 endif
 121         @test -d tmp || mkdir -p tmp
 122         $(verbose) m4 $^ | sed -e s/dollarsstar/\$$\*/g > $@
 123
 124 tmp/all_te_files.conf: $(ALL_TE_FILES)
 125 ifeq ($(ALL_TE_FILES),)
 126         $(error No enabled modules! $(notdir $(MOD_CONF)) may need to be generated by using "make conf")
 127 endif
 128         @test -d tmp || mkdir -p tmp
 129         $(verbose) cat $^ > $@
 130         $(call parse-rolemap,base,$@)
 131
 132 tmp/post_te_files.conf: $(POST_TE_FILES)
 133         @test -d tmp || mkdir -p tmp
 134         $(verbose) cat $^ > $@
 135
 136 # extract attributes and put them first. extract post te stuff
 137 # like genfscon and put last.  portcon, nodecon, and netifcon
 138 # is delayed since they are generated by m4
 139 tmp/all_attrs_types.conf tmp/only_te_rules.conf tmp/all_post.conf: tmp/all_te_files.conf tmp/post_te_files.conf
 140         $(verbose) grep ^attribute tmp/all_te_files.conf > tmp/all_attrs_types.conf || true
 141         $(verbose) grep '^type ' tmp/all_te_files.conf >> tmp/all_attrs_types.conf
 142         $(verbose) cat tmp/post_te_files.conf > tmp/all_post.conf
 143         $(verbose) grep '^sid ' tmp/all_te_files.conf >> tmp/all_post.conf || true
 144         $(verbose) egrep '^fs_use_(xattr|task|trans)' tmp/all_te_files.conf >> tmp/all_post.conf || true
 145         $(verbose) grep ^genfscon tmp/all_te_files.conf >> tmp/all_post.conf || true
 146         $(verbose) sed -r -e /^attribute/d -e '/^type /d' -e /^genfscon/d \
 147                         -e '/^sid /d' -e '/^fs_use_(xattr|task|trans)/d' \
 148                         < tmp/all_te_files.conf > tmp/only_te_rules.conf
 149
 150 ########################################
 151 #
 152 # Remove the dontaudit rules from the policy.conf
 153 #
 154 enableaudit: policy.conf
 155         @test -d tmp || mkdir -p tmp
 156         @echo "Removing dontaudit rules from policy.conf"
 157         $(verbose) grep -v dontaudit policy.conf > tmp/policy.audit
 158         $(verbose) mv tmp/policy.audit policy.conf
 159
 160 ########################################
 161 #
 162 # Construct file_contexts
 163 #
 164 $(FC): tmp/$(FC).tmp $(FCSORT)
 165         $(verbose) $(FCSORT) $< $@
 166         $(verbose) grep -e HOME -e ROLE $@ > $(HOMEDIR_TEMPLATE)
 167         $(verbose) sed -i -e /HOME/d -e /ROLE/d $@
 168
 169 tmp/$(FC).tmp: $(M4SUPPORT) tmp/generated_definitions.conf $(ALL_FC_FILES)
 170 ifeq ($(ALL_FC_FILES),)
 171         $(error No enabled modules! $(notdir $(MOD_CONF)) may need to be generated by using "make conf")
 172 endif
 173         @echo "Creating $(NAME) file_contexts."
 174         @test -d tmp || mkdir -p tmp
 175         $(verbose) m4 $(M4PARAM) $^ > $@
 176
 177 ########################################
 178 #
 179 # Install file_contexts
 180 #
 181 $(FCPATH): $(FC) $(LOADPATH) $(USERPATH)/system.users
 182         @echo "Validating $(NAME) file_contexts."
 183         $(verbose) $(SETFILES) -q -c $(LOADPATH) $(FC)
 184         @echo "Installing file_contexts."
 185         @mkdir -p $(CONTEXTPATH)/files
 186         $(verbose) install -m 644 $(FC) $(FCPATH)
 187         $(verbose) install -m 644 $(HOMEDIR_TEMPLATE) $(HOMEDIRPATH)
 188         $(verbose) $(GENHOMEDIRCON) -d $(TOPDIR) -t $(NAME) $(USEPWD)
 189
 190 ########################################
 191 #
 192 # Filesystem labeling
 193 #
 194 FILESYSTEMS := `mount | grep -v "context=" | egrep -v '\((|.*,)bind(,.*|)\)' | awk '/(ext[23]| xfs| jfs).*rw/{print $$3}';`
 195
 196 checklabels: $(FCPATH) $(SETFILES)
 197         @echo "Checking labels on filesystem types: ext2 ext3 xfs jfs"
 198         @if test -z "$(FILESYSTEMS)"; then \
 199                 echo "No filesystems with extended attributes found!" ;\
 200                 false ;\
 201         fi
 202         $(verbose) $(SETFILES) -v -n $(FCPATH) $(FILESYSTEMS)
 203
 204 restorelabels: $(FCPATH) $(SETFILES)
 205         @echo "Restoring labels on filesystem types: ext2 ext3 xfs jfs"
 206         @if test -z "$(FILESYSTEMS)"; then \
 207                 echo "No filesystems with extended attributes found!" ;\
 208                 false ;\
 209         fi
 210         $(verbose) $(SETFILES) -v $(FCPATH) $(FILESYSTEMS)
 211
 212 relabel:  $(FCPATH) $(SETFILES)
 213         @echo "Relabeling filesystem types: ext2 ext3 xfs jfs"
 214         @if test -z "$(FILESYSTEMS)"; then \
 215                 echo "No filesystems with extended attributes found!" ;\
 216                 false ;\
 217         fi
 218         $(verbose) $(SETFILES) $(FCPATH) $(FILESYSTEMS)
 219
 220 ########################################
 221 #
 222 # Run policy source checks
 223 #
 224 check: policy.conf $(FC)
 225         $(SECHECK) -s --profile=development --policy=policy.conf --fcfile=$(FC) > $@.res
 226
 227 longcheck: policy.conf $(FC)
 228         $(SECHECK) -s --profile=all --policy=policy.conf --fcfile=$(FC) > $@.res
 229
 230 ########################################
 231 #
 232 # Appconfig files
 233 #
 234 $(APPDIR)/customizable_types: policy.conf
 235         @mkdir -p $(APPDIR)
 236         $(verbose) grep "^type .*customizable" $< | cut -d',' -f1 | cut -d' ' -f2 > tmp/customizable_types
 237         $(verbose) install -m 644 tmp/customizable_types $@
 238
 239 ########################################
 240 #
 241 # Clean the sources
 242 #
 243 clean:
 244         rm -f policy.conf
 245         rm -f policy.$(PV)
 246         rm -f $(FC)
 247         rm -f $(HOMEDIR_TEMPLATE)
 248         rm -f *.res
 249         rm -fR tmp
 250
 251 .PHONY: default policy install load reload enableaudit checklabels restorelabels relabel check longcheck clean