| // Copyright 2021 The Android Open Source Project |
| // |
| // Licensed under the Apache License, Version 2.0 (the "License"); |
| // you may not use this file except in compliance with the License. |
| // You may obtain a copy of the License at |
| // |
| // http://www.apache.org/licenses/LICENSE-2.0 |
| // |
| // Unless required by applicable law or agreed to in writing, software |
| // distributed under the License is distributed on an "AS IS" BASIS, |
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| // See the License for the specific language governing permissions and |
| // limitations under the License. |
| |
| package selinux |
| |
| import ( |
| "fmt" |
| |
| "github.com/google/blueprint/proptools" |
| |
| "android/soong/android" |
| ) |
| |
| var ( |
| compatTestDepTag = dependencyTag{name: "compat_test"} |
| ) |
| |
| func init() { |
| ctx := android.InitRegistrationContext |
| ctx.RegisterModuleType("se_compat_cil", compatCilFactory) |
| ctx.RegisterSingletonModuleType("se_compat_test", compatTestFactory) |
| } |
| |
| // se_compat_cil collects and installs backwards compatibility cil files. |
| func compatCilFactory() android.Module { |
| c := &compatCil{} |
| c.AddProperties(&c.properties) |
| android.InitAndroidArchModule(c, android.DeviceSupported, android.MultilibCommon) |
| return c |
| } |
| |
| type compatCil struct { |
| android.ModuleBase |
| properties compatCilProperties |
| installSource android.Path |
| installPath android.InstallPath |
| } |
| |
| type compatCilProperties struct { |
| // List of source files. Can reference se_filegroup type modules with the ":module" syntax. |
| Srcs []string `android:"path"` |
| |
| // Output file name. Defaults to module name if unspecified. |
| Stem *string |
| } |
| |
| func (c *compatCil) stem() string { |
| return proptools.StringDefault(c.properties.Stem, c.Name()) |
| } |
| |
| func (c *compatCil) expandSeSources(ctx android.ModuleContext) android.Paths { |
| srcPaths := make(android.Paths, 0, len(c.properties.Srcs)) |
| for _, src := range c.properties.Srcs { |
| if m := android.SrcIsModule(src); m != "" { |
| module := android.GetModuleFromPathDep(ctx, m, "") |
| if module == nil { |
| // Error would have been handled by ExtractSourcesDeps |
| continue |
| } |
| if fg, ok := module.(*fileGroup); ok { |
| if c.SystemExtSpecific() { |
| srcPaths = append(srcPaths, fg.SystemExtPrivateSrcs()...) |
| } else { |
| srcPaths = append(srcPaths, fg.SystemPrivateSrcs()...) |
| } |
| } else { |
| ctx.PropertyErrorf("srcs", "%q is not an se_filegroup", m) |
| } |
| } else { |
| srcPaths = append(srcPaths, android.PathForModuleSrc(ctx, src)) |
| } |
| } |
| return srcPaths |
| } |
| |
| func (c *compatCil) GenerateAndroidBuildActions(ctx android.ModuleContext) { |
| if c.ProductSpecific() || c.SocSpecific() || c.DeviceSpecific() { |
| ctx.ModuleErrorf("Compat cil files only support system and system_ext partitions") |
| } |
| |
| srcPaths := c.expandSeSources(ctx) |
| out := android.PathForModuleGen(ctx, c.Name()) |
| ctx.Build(pctx, android.BuildParams{ |
| Rule: android.Cat, |
| Inputs: srcPaths, |
| Output: out, |
| Description: "Combining compat cil for " + c.Name(), |
| }) |
| |
| c.installPath = android.PathForModuleInstall(ctx, "etc", "selinux", "mapping") |
| c.installSource = out |
| ctx.InstallFile(c.installPath, c.stem(), c.installSource) |
| } |
| |
| func (c *compatCil) AndroidMkEntries() []android.AndroidMkEntries { |
| return []android.AndroidMkEntries{android.AndroidMkEntries{ |
| Class: "ETC", |
| OutputFile: android.OptionalPathForPath(c.installSource), |
| ExtraEntries: []android.AndroidMkExtraEntriesFunc{ |
| func(ctx android.AndroidMkExtraEntriesContext, entries *android.AndroidMkEntries) { |
| entries.SetPath("LOCAL_MODULE_PATH", c.installPath.ToMakePath()) |
| entries.SetString("LOCAL_INSTALLED_MODULE_STEM", c.stem()) |
| }, |
| }, |
| }} |
| } |
| |
| func (c *compatCil) OutputFiles(tag string) (android.Paths, error) { |
| switch tag { |
| case "": |
| return android.Paths{c.installSource}, nil |
| default: |
| return nil, fmt.Errorf("unsupported module reference tag %q", tag) |
| } |
| } |
| |
| var _ android.OutputFileProducer = (*compatCil)(nil) |
| |
| // se_compat_test checks if compat files ({ver}.cil, {ver}.compat.cil) files are compatible with |
| // current policy. |
| func compatTestFactory() android.SingletonModule { |
| f := &compatTestModule{} |
| android.InitAndroidModule(f) |
| android.AddLoadHook(f, func(ctx android.LoadHookContext) { |
| f.loadHook(ctx) |
| }) |
| return f |
| } |
| |
| type compatTestModule struct { |
| android.SingletonModuleBase |
| |
| compatTestTimestamp android.ModuleOutPath |
| } |
| |
| func (f *compatTestModule) createPlatPubVersionedModule(ctx android.LoadHookContext, ver string) { |
| confName := fmt.Sprintf("pub_policy_%s.conf", ver) |
| cilName := fmt.Sprintf("pub_policy_%s.cil", ver) |
| platPubVersionedName := fmt.Sprintf("plat_pub_versioned_%s.cil", ver) |
| |
| ctx.CreateModule(policyConfFactory, &nameProperties{ |
| Name: proptools.StringPtr(confName), |
| }, &policyConfProperties{ |
| Srcs: []string{ |
| fmt.Sprintf(":se_build_files{.plat_public_%s}", ver), |
| ":se_build_files{.reqd_mask}", |
| }, |
| Installable: proptools.BoolPtr(false), |
| }) |
| |
| ctx.CreateModule(policyCilFactory, &nameProperties{ |
| Name: proptools.StringPtr(cilName), |
| }, &policyCilProperties{ |
| Src: proptools.StringPtr(":" + confName), |
| Filter_out: []string{":reqd_policy_mask.cil"}, |
| Secilc_check: proptools.BoolPtr(false), |
| Installable: proptools.BoolPtr(false), |
| }) |
| |
| ctx.CreateModule(versionedPolicyFactory, &nameProperties{ |
| Name: proptools.StringPtr(platPubVersionedName), |
| }, &versionedPolicyProperties{ |
| Base: proptools.StringPtr(":" + cilName), |
| Target_policy: proptools.StringPtr(":" + cilName), |
| Version: proptools.StringPtr(ver), |
| Installable: proptools.BoolPtr(false), |
| }) |
| } |
| |
| func (f *compatTestModule) createCompatTestModule(ctx android.LoadHookContext, ver string) { |
| srcs := []string{ |
| ":plat_sepolicy.cil", |
| ":system_ext_sepolicy.cil", |
| ":product_sepolicy.cil", |
| fmt.Sprintf(":plat_%s.cil", ver), |
| fmt.Sprintf(":%s.compat.cil", ver), |
| fmt.Sprintf(":system_ext_%s.cil", ver), |
| fmt.Sprintf(":system_ext_%s.compat.cil", ver), |
| fmt.Sprintf(":product_%s.cil", ver), |
| } |
| |
| if ver == ctx.DeviceConfig().BoardSepolicyVers() { |
| srcs = append(srcs, |
| ":plat_pub_versioned.cil", |
| ":vendor_sepolicy.cil", |
| ":odm_sepolicy.cil", |
| ) |
| } else { |
| srcs = append(srcs, fmt.Sprintf(":plat_pub_versioned_%s.cil", ver)) |
| } |
| |
| compatTestName := fmt.Sprintf("%s_compat_test", ver) |
| ctx.CreateModule(policyBinaryFactory, &nameProperties{ |
| Name: proptools.StringPtr(compatTestName), |
| }, &policyBinaryProperties{ |
| Srcs: srcs, |
| Ignore_neverallow: proptools.BoolPtr(true), |
| Installable: proptools.BoolPtr(false), |
| }) |
| } |
| |
| func (f *compatTestModule) loadHook(ctx android.LoadHookContext) { |
| for _, ver := range ctx.DeviceConfig().PlatformSepolicyCompatVersions() { |
| f.createPlatPubVersionedModule(ctx, ver) |
| f.createCompatTestModule(ctx, ver) |
| } |
| } |
| |
| func (f *compatTestModule) DepsMutator(ctx android.BottomUpMutatorContext) { |
| for _, ver := range ctx.DeviceConfig().PlatformSepolicyCompatVersions() { |
| ctx.AddDependency(f, compatTestDepTag, fmt.Sprintf("%s_compat_test", ver)) |
| } |
| } |
| |
| func (f *compatTestModule) GenerateSingletonBuildActions(ctx android.SingletonContext) { |
| // does nothing; se_compat_test is a singeton because two compat test modules don't make sense. |
| } |
| |
| func (f *compatTestModule) GenerateAndroidBuildActions(ctx android.ModuleContext) { |
| var inputs android.Paths |
| ctx.VisitDirectDepsWithTag(compatTestDepTag, func(child android.Module) { |
| o, ok := child.(android.OutputFileProducer) |
| if !ok { |
| panic(fmt.Errorf("Module %q should be an OutputFileProducer but it isn't", ctx.OtherModuleName(child))) |
| } |
| |
| outputs, err := o.OutputFiles("") |
| if err != nil { |
| panic(fmt.Errorf("Module %q error while producing output: %v", ctx.OtherModuleName(child), err)) |
| } |
| if len(outputs) != 1 { |
| panic(fmt.Errorf("Module %q should produce exactly one output, but did %q", ctx.OtherModuleName(child), outputs.Strings())) |
| } |
| |
| inputs = append(inputs, outputs[0]) |
| }) |
| |
| f.compatTestTimestamp = android.PathForModuleOut(ctx, "timestamp") |
| rule := android.NewRuleBuilder(pctx, ctx) |
| rule.Command().Text("touch").Output(f.compatTestTimestamp).Implicits(inputs) |
| rule.Build("compat", "compat test timestamp for: "+f.Name()) |
| } |
| |
| func (f *compatTestModule) AndroidMkEntries() []android.AndroidMkEntries { |
| return []android.AndroidMkEntries{android.AndroidMkEntries{ |
| Class: "FAKE", |
| // OutputFile is needed, even though BUILD_PHONY_PACKAGE doesn't use it. |
| // Without OutputFile this module won't be exported to Makefile. |
| OutputFile: android.OptionalPathForPath(f.compatTestTimestamp), |
| Include: "$(BUILD_PHONY_PACKAGE)", |
| ExtraEntries: []android.AndroidMkExtraEntriesFunc{ |
| func(ctx android.AndroidMkExtraEntriesContext, entries *android.AndroidMkEntries) { |
| entries.SetString("LOCAL_ADDITIONAL_DEPENDENCIES", f.compatTestTimestamp.String()) |
| }, |
| }, |
| }} |
| } |
