Chris PeBenito fb0a3a
########################################
Chris PeBenito fb0a3a
#
Chris PeBenito fb0a3a
# Rules and Targets for building monolithic policies
Chris PeBenito fb0a3a
#
Chris PeBenito fb0a3a
Chris PeBenito c634db
# determine the policy version and current kernel version if possible
Chris PeBenito c634db
pv := $(shell $(CHECKPOLICY) -V |cut -f 1 -d ' ')
Chris PeBenito c634db
kv := $(shell cat /selinux/policyvers)
Chris PeBenito c634db
Chris PeBenito c634db
# dont print version warnings if we are unable to determine
Chris PeBenito c634db
# the currently running kernel's policy version
Chris PeBenito c634db
ifeq "$(kv)" ""
Chris PeBenito c634db
	kv := $(pv)
Chris PeBenito c634db
endif
Chris PeBenito c634db
Chris PeBenito c634db
policy_conf = $(builddir)policy.conf
Chris PeBenito c634db
fc = $(builddir)file_contexts
Chris PeBenito c634db
polver = $(builddir)policy.$(pv)
Chris PeBenito c634db
homedir_template = $(builddir)homedir_template
Chris PeBenito c9f20d
Chris PeBenito 3abd5e
M4PARAM += -D self_contained_policy
Chris PeBenito 3abd5e
Chris PeBenito fb0a3a
# install paths
Chris PeBenito c634db
loadpath = $(policypath)/$(notdir $(polver))
Chris PeBenito fb0a3a
Chris PeBenito c634db
appfiles += $(installdir)/booleans $(userpath)/local.users
Chris PeBenito fb0a3a
Chris PeBenito c767b1
# for monolithic policy use all base and module to create policy
Chris PeBenito c634db
all_modules := $(strip $(base_mods) $(mod_mods))
Chris PeBenito ab23bb
# off module interfaces included to make sure all interfaces are expanded.
Chris PeBenito c634db
all_interfaces := $(all_modules:.te=.if) $(off_mods:.te=.if)
Chris PeBenito c634db
all_te_files := $(all_modules)
Chris PeBenito c634db
all_fc_files := $(all_modules:.te=.fc)
Chris PeBenito fb0a3a
Chris PeBenito c07f9c
pre_te_files := $(secclass) $(isids) $(avs) $(m4support) $(poldir)/mls $(poldir)/mcs $(policycaps)
Chris PeBenito c634db
post_te_files := $(user_files) $(poldir)/constraints
Chris PeBenito fb0a3a
Chris PeBenito c634db
policy_sections := $(tmpdir)/pre_te_files.conf $(tmpdir)/all_attrs_types.conf $(tmpdir)/global_bools.conf $(tmpdir)/only_te_rules.conf $(tmpdir)/all_post.conf
Chris PeBenito c767b1
Chris PeBenito c767b1
# search layer dirs for source files
Chris PeBenito c634db
vpath %.te $(all_layers)
Chris PeBenito c634db
vpath %.if $(all_layers)
Chris PeBenito c634db
vpath %.fc $(all_layers)
Chris PeBenito c767b1
Chris PeBenito fb0a3a
########################################
Chris PeBenito fb0a3a
#
Chris PeBenito fb0a3a
# default action: build policy locally
Chris PeBenito fb0a3a
#
Chris PeBenito fb0a3a
default: policy
Chris PeBenito fb0a3a
Chris PeBenito c634db
policy: $(polver)
Chris PeBenito fb0a3a
Chris PeBenito d17bab
install: $(loadpath) $(fcpath) $(appfiles)
Chris PeBenito fb0a3a
Chris PeBenito c634db
load: $(tmpdir)/load
Chris PeBenito fb0a3a
Chris PeBenito c634db
checklabels: $(fcpath)
Chris PeBenito c634db
restorelabels: $(fcpath)
Chris PeBenito c634db
relabel:  $(fcpath)
Chris PeBenito c634db
resetlabels:  $(fcpath)
Chris PeBenito 120988
Chris PeBenito fb0a3a
########################################
Chris PeBenito fb0a3a
#
Chris PeBenito fb0a3a
# Build a binary policy locally
Chris PeBenito fb0a3a
#
Chris PeBenito 8acfcb
ifneq "$(UNK_PERMS)" ""
Chris PeBenito 8acfcb
$(polver): CHECKPOLICY += -U $(UNK_PERMS)
Chris PeBenito 8acfcb
endif
Chris PeBenito c634db
$(polver): $(policy_conf)
Chris PeBenito c634db
	@echo "Compiling $(NAME) $(polver)"
Chris PeBenito c634db
ifneq ($(pv),$(kv))
Chris PeBenito fb0a3a
	@echo
Chris PeBenito fb0a3a
	@echo "WARNING: Policy version mismatch!  Is your OUTPUT_POLICY set correctly?"
Chris PeBenito fb0a3a
	@echo
Chris PeBenito fb0a3a
endif
Chris PeBenito 5b45ff
	$(verbose) $(CHECKPOLICY) $^ -o $@
Chris PeBenito fb0a3a
Chris PeBenito fb0a3a
########################################
Chris PeBenito fb0a3a
#
Chris PeBenito fb0a3a
# Install a binary policy
Chris PeBenito fb0a3a
#
Chris PeBenito 8acfcb
ifneq "$(UNK_PERMS)" ""
Chris PeBenito 8acfcb
$(loadpath): CHECKPOLICY += -U $(UNK_PERMS)
Chris PeBenito 8acfcb
endif
Chris PeBenito c634db
$(loadpath): $(policy_conf)
Chris PeBenito c634db
	@mkdir -p $(policypath)
Chris PeBenito c634db
	@echo "Compiling and installing $(NAME) $(loadpath)"
Chris PeBenito c634db
ifneq ($(pv),$(kv))
Chris PeBenito fb0a3a
	@echo
Chris PeBenito fb0a3a
	@echo "WARNING: Policy version mismatch!  Is your OUTPUT_POLICY set correctly?"
Chris PeBenito fb0a3a
	@echo
Chris PeBenito fb0a3a
endif
Chris PeBenito 9b3756
	$(verbose) $(CHECKPOLICY) $^ -o $@
Chris PeBenito fb0a3a
Chris PeBenito fb0a3a
########################################
Chris PeBenito fb0a3a
#
Chris PeBenito fb0a3a
# Load the binary policy
Chris PeBenito fb0a3a
#
Chris PeBenito 285d00
reload $(tmpdir)/load: $(loadpath) $(fcpath) $(appfiles)
Chris PeBenito c634db
	@echo "Loading $(NAME) $(loadpath)"
Chris PeBenito c634db
	$(verbose) $(LOADPOLICY) -q $(loadpath)
Chris PeBenito c634db
	@touch $(tmpdir)/load
Chris PeBenito fb0a3a
Chris PeBenito fb0a3a
########################################
Chris PeBenito fb0a3a
#
Chris PeBenito fb0a3a
# Construct a monolithic policy.conf
Chris PeBenito fb0a3a
#
Chris PeBenito c634db
$(policy_conf): $(policy_sections)
Chris PeBenito c9f20d
	@echo "Creating $(NAME) $(@F)"
Chris PeBenito 3abd5e
	@test -d $(@D) || mkdir -p $(@D)
Chris PeBenito 3abd5e
	$(verbose) cat $^ > $@
Chris PeBenito fb0a3a
Chris PeBenito c634db
$(tmpdir)/pre_te_files.conf: $(pre_te_files)
Chris PeBenito c634db
	@test -d $(tmpdir) || mkdir -p $(tmpdir)
Chris PeBenito 3abd5e
	$(verbose) $(M4) $(M4PARAM) $^ > $@
Chris PeBenito fb0a3a
Chris PeBenito c634db
$(tmpdir)/generated_definitions.conf: $(all_te_files)
Chris PeBenito c634db
	@test -d $(tmpdir) || mkdir -p $(tmpdir)
Chris PeBenito 701316
# define all available object classes
Chris PeBenito c634db
	$(verbose) $(genperm) $(avs) $(secclass) > $@
Chris PeBenito bbcd3c
	$(verbose) $(call create-base-per-role-tmpl,$(basename $(notdir $(all_modules))),$@)
Chris PeBenito c634db
	$(verbose) test -f $(booleans) && $(setbools) $(booleans) >> $@ || true
Chris PeBenito fb0a3a
Chris PeBenito c634db
$(tmpdir)/global_bools.conf: $(m4support) $(tmpdir)/generated_definitions.conf $(globalbool) $(globaltun)
Chris PeBenito 3abd5e
	$(verbose) $(M4) $(M4PARAM) $^ > $@
Chris PeBenito 3abd5e
Chris PeBenito e276d5
$(tmpdir)/all_interfaces.conf: $(m4support) $(all_interfaces) $(m4iferror)
Chris PeBenito c634db
	@test -d $(tmpdir) || mkdir -p $(tmpdir)
Chris PeBenito 3abd5e
	@echo "divert(-1)" > $@
Chris PeBenito e276d5
	$(verbose) $(M4) $^ >> $(tmpdir)/$(@F).tmp
Chris PeBenito c634db
	$(verbose) $(SED) -e s/dollarsstar/\$$\*/g $(tmpdir)/$(@F).tmp >> $@
Chris PeBenito 3abd5e
	@echo "divert" >> $@
Chris PeBenito fb0a3a
Chris PeBenito c634db
$(tmpdir)/rolemap.conf: $(rolemap)
Chris PeBenito 96fc0a
	$(verbose) echo "" > $@
Chris PeBenito 3abd5e
	$(call parse-rolemap,base,$@)
Chris PeBenito 3abd5e
Chris PeBenito c634db
$(tmpdir)/all_te_files.conf: $(m4support) $(tmpdir)/generated_definitions.conf $(tmpdir)/all_interfaces.conf $(all_te_files) $(tmpdir)/rolemap.conf
Chris PeBenito c634db
ifeq "$(strip $(all_te_files))" ""
Chris PeBenito c634db
	$(error No enabled modules! $(notdir $(mod_conf)) may need to be generated by using "make conf")
Chris PeBenito fb0a3a
endif
Chris PeBenito c634db
	@test -d $(tmpdir) || mkdir -p $(tmpdir)
Chris PeBenito 3abd5e
	$(verbose) $(M4) $(M4PARAM) -s $^ > $@
Chris PeBenito fb0a3a
Chris PeBenito 296273
$(tmpdir)/post_te_files.conf: $(m4support) $(tmpdir)/generated_definitions.conf $(post_te_files)
Chris PeBenito c634db
	@test -d $(tmpdir) || mkdir -p $(tmpdir)
Chris PeBenito 3abd5e
	$(verbose) $(M4) $(M4PARAM) $^ > $@
Chris PeBenito fb0a3a
Chris PeBenito fb0a3a
# extract attributes and put them first. extract post te stuff
Chris PeBenito 3abd5e
# like genfscon and put last.
Chris PeBenito c634db
$(tmpdir)/all_attrs_types.conf $(tmpdir)/only_te_rules.conf $(tmpdir)/all_post.conf: $(tmpdir)/all_te_files.conf $(tmpdir)/post_te_files.conf
Chris PeBenito c634db
	$(verbose) $(get_type_attr_decl) $(tmpdir)/all_te_files.conf | $(SORT) > $(tmpdir)/all_attrs_types.conf
Chris PeBenito c634db
	$(verbose) cat $(tmpdir)/post_te_files.conf > $(tmpdir)/all_post.conf
Chris PeBenito 3abd5e
# these have to run individually because order matters:
Chris PeBenito c634db
	$(verbose) $(GREP) '^sid ' $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true
Chris PeBenito c634db
	$(verbose) $(GREP) '^fs_use_(xattr|task|trans)' $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true
Chris PeBenito c634db
	$(verbose) $(GREP) ^genfscon $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true
Chris PeBenito c634db
	$(verbose) $(GREP) ^portcon $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true
Chris PeBenito c634db
	$(verbose) $(GREP) ^netifcon $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true
Chris PeBenito c634db
	$(verbose) $(GREP) ^nodecon $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true
Chris PeBenito c634db
	$(verbose) $(comment_move_decl) $(tmpdir)/all_te_files.conf > $(tmpdir)/only_te_rules.conf
Chris PeBenito fb0a3a
Chris PeBenito fb0a3a
########################################
Chris PeBenito fb0a3a
#
Chris PeBenito fb0a3a
# Remove the dontaudit rules from the policy.conf
Chris PeBenito fb0a3a
#
Chris PeBenito c634db
enableaudit: $(policy_conf)
Chris PeBenito c634db
	@test -d $(tmpdir) || mkdir -p $(tmpdir)
Chris PeBenito c634db
	@echo "Removing dontaudit rules from $(notdir $(policy_conf))"
Chris PeBenito c634db
	$(verbose) $(GREP) -v dontaudit $^ > $(tmpdir)/policy.audit
Chris PeBenito c634db
	$(verbose) mv $(tmpdir)/policy.audit $(policy_conf)
Chris PeBenito fb0a3a
Chris PeBenito fb0a3a
########################################
Chris PeBenito fb0a3a
#
Chris PeBenito fb0a3a
# Construct file_contexts
Chris PeBenito fb0a3a
#
Chris PeBenito c634db
$(fc): $(tmpdir)/$(notdir $(fc)).tmp $(fcsort)
Chris PeBenito c634db
	$(verbose) $(fcsort) $< $@
Chris PeBenito 662757
	$(verbose) $(GREP) -e HOME -e ROLE -e USER $@ > $(homedir_template)
Chris PeBenito 662757
	$(verbose) $(SED) -i -e /HOME/d -e /ROLE/d -e /USER/d $@
Chris PeBenito c767b1
Chris PeBenito c634db
$(tmpdir)/$(notdir $(fc)).tmp: $(m4support) $(tmpdir)/generated_definitions.conf $(all_fc_files)
Chris PeBenito c634db
ifeq ($(all_fc_files),)
Chris PeBenito c634db
	$(error No enabled modules! $(notdir $(mod_conf)) may need to be generated by using "make conf")
Chris PeBenito fb0a3a
endif
Chris PeBenito fb0a3a
	@echo "Creating $(NAME) file_contexts."
Chris PeBenito c634db
	@test -d $(tmpdir) || mkdir -p $(tmpdir)
Chris PeBenito 3abd5e
	$(verbose) $(M4) $(M4PARAM) $^ > $@
Chris PeBenito fb0a3a
Chris PeBenito c634db
$(homedir_template): $(fc)
Chris PeBenito fc47b3
Chris PeBenito fb0a3a
########################################
Chris PeBenito fb0a3a
#
Chris PeBenito fb0a3a
# Install file_contexts
Chris PeBenito fb0a3a
#
Chris PeBenito c634db
$(fcpath): $(fc) $(loadpath) $(userpath)/system.users
Chris PeBenito fb0a3a
	@echo "Validating $(NAME) file_contexts."
Chris PeBenito c634db
	$(verbose) $(SETFILES) -q -c $(loadpath) $(fc)
Chris PeBenito fb0a3a
	@echo "Installing file_contexts."
Chris PeBenito c634db
	@mkdir -p $(contextpath)/files
Chris PeBenito c634db
	$(verbose) $(INSTALL) -m 644 $(fc) $(fcpath)
Chris PeBenito c634db
	$(verbose) $(INSTALL) -m 644 $(homedir_template) $(homedirpath)
Chris PeBenito c634db
	$(verbose) $(genhomedircon) -d $(topdir) -t $(NAME) $(USEPWD)
Chris PeBenito fc47b3
ifeq "$(DISTRO)" "rhel4"
Chris PeBenito fc47b3
# Setfiles in RHEL4 does not look at file_contexts.homedirs.
Chris PeBenito fc47b3
	$(verbose) cat $@.homedirs >> $@
Chris PeBenito fc47b3
# Delete the file_contexts.homedirs in case the toolchain has
Chris PeBenito fc47b3
# been updated, to prevent duplicate match errors.
Chris PeBenito fc47b3
	$(verbose) rm -f $@.homedirs
Chris PeBenito 185ab2
endif
Chris PeBenito fb0a3a
Chris PeBenito fb0a3a
########################################
Chris PeBenito 5a7c06
#
Chris PeBenito 5a7c06
# Intall netfilter_contexts
Chris PeBenito 5a7c06
#
Chris PeBenito c634db
$(ncpath): $(net_contexts)
Chris PeBenito 5a7c06
	@echo "Installing $(NAME) netfilter_contexts."
Chris PeBenito cfd5c5
	$(verbose) $(INSTALL) -m 0644 $^ $@
Chris PeBenito 5a7c06
Chris PeBenito 5a7c06
########################################
Chris PeBenito fb0a3a
#
Chris PeBenito 8df65f
# Run policy source checks
Chris PeBenito 8df65f
#
Chris PeBenito c634db
check: $(builddir)check.res
Chris PeBenito c634db
$(builddir)check.res: $(policy_conf) $(fc)
Chris PeBenito c634db
	$(SECHECK) -s --profile=development --policy=$(policy_conf) --fcfile=$(fc) > $@
Chris PeBenito 8df65f
Chris PeBenito c634db
longcheck: $(builddir)longcheck.res
Chris PeBenito c634db
$(builddir)longcheck.res: $(policy_conf) $(fc)
Chris PeBenito c634db
	$(SECHECK) -s --profile=all --policy=$(policy_conf) --fcfile=$(fc) > $@
Chris PeBenito 8df65f
Chris PeBenito 8df65f
########################################
Chris PeBenito 8df65f
#
Chris PeBenito 049e11
# Appconfig files
Chris PeBenito 049e11
#
Chris PeBenito c634db
$(appdir)/customizable_types: $(policy_conf)
Chris PeBenito c634db
	@mkdir -p $(appdir)
Chris PeBenito c634db
	$(verbose) $(GREP) '^[[:blank:]]*type .*customizable' $< | cut -d';' -f1 | cut -d',' -f1 | cut -d' ' -f2 | $(SORT) -u > $(tmpdir)/customizable_types
Chris PeBenito c634db
	$(verbose) $(INSTALL) -m 644 $(tmpdir)/customizable_types $@ 
Chris PeBenito 049e11
Chris PeBenito 049e11
########################################
Chris PeBenito 049e11
#
Chris PeBenito fb0a3a
# Clean the sources
Chris PeBenito fb0a3a
#
Chris PeBenito fb0a3a
clean:
Chris PeBenito c634db
	rm -f $(policy_conf)
Chris PeBenito c634db
	rm -f $(polver)
Chris PeBenito c634db
	rm -f $(fc)
Chris PeBenito c634db
	rm -f $(homedir_template)
Chris PeBenito 6962bb
	rm -f $(net_contexts)
Chris PeBenito 8df65f
	rm -f *.res
Chris PeBenito c634db
	rm -fR $(tmpdir)
Chris PeBenito fb0a3a
Chris PeBenito 8df65f
.PHONY: default policy install load reload enableaudit checklabels restorelabels relabel check longcheck clean