Chris PeBenito 88d14a
#
Chris PeBenito 88d14a
# Makefile for the security policy.
Chris PeBenito 88d14a
#
Chris PeBenito 88d14a
# Targets:
Chris PeBenito 88d14a
# 
Chris PeBenito 88d14a
# install       - compile and install the policy configuration, and context files.
Chris PeBenito 88d14a
# load          - compile, install, and load the policy configuration.
Chris PeBenito 88d14a
# reload        - compile, install, and load/reload the policy configuration.
Chris PeBenito 88d14a
# relabel       - relabel filesystems based on the file contexts configuration.
Chris PeBenito 88d14a
# checklabels   - check filesystems against the file context configuration
Chris PeBenito 88d14a
# restorelabels - check filesystems against the file context configuration
Chris PeBenito 88d14a
#                 and restore the label of files with incorrect labels
Chris PeBenito 88d14a
# policy        - compile the policy configuration locally for testing/development.
Chris PeBenito 88d14a
#
Chris PeBenito 88d14a
# The default target is 'policy'.
Chris PeBenito 88d14a
#
Chris PeBenito 88d14a
Chris PeBenito b4cd15
########################################
Chris PeBenito b4cd15
#
Chris PeBenito b4cd15
# Configurable portions of the Makefile
Chris PeBenito b4cd15
#
Chris PeBenito b4cd15
Chris PeBenito b4cd15
# Build compatibility policies 
Chris PeBenito b4cd15
POLICYCOMPAT = -c 18
Chris PeBenito b4cd15
Chris PeBenito b4cd15
# set distribution
Chris PeBenito b4cd15
#override M4PARAM += -D distro_redhat
Chris PeBenito b4cd15
Chris PeBenito b4cd15
# Uncomment this to disable command echoing
Chris PeBenito b4cd15
#QUIET:=@
Chris PeBenito b4cd15
Chris PeBenito b4cd15
########################################
Chris PeBenito b4cd15
#
Chris PeBenito b4cd15
# Invariant portions of the Makefile
Chris PeBenito b4cd15
#
Chris PeBenito b4cd15
Chris PeBenito b4cd15
# executable paths
Chris PeBenito b4cd15
PREFIX := /usr
Chris PeBenito b4cd15
BINDIR := $(PREFIX)/bin
Chris PeBenito b4cd15
SBINDIR := $(PREFIX)/sbin
Chris PeBenito b4cd15
CHECKPOLICY := $(BINDIR)/checkpolicy
Chris PeBenito b4cd15
SETFILES := $(SBINDIR)/setfiles
Chris PeBenito b4cd15
Chris PeBenito b4cd15
# determine the policy version and current kernel version if possible
Chris PeBenito b4cd15
PV := $(shell $(CHECKPOLICY) $(POLICYCOMPAT) -V |cut -f 1 -d ' ')
Chris PeBenito b4cd15
KV := $(shell cat /selinux/policyvers)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
# dont print version warnings if we are unable to determine
Chris PeBenito b4cd15
# the currently running kernel's policy version
Chris PeBenito b4cd15
ifeq ($(KV),)
Chris PeBenito b4cd15
KV := $(PV)
Chris PeBenito b4cd15
endif
Chris PeBenito b4cd15
Chris PeBenito b4cd15
FC := file_contexts
Chris PeBenito b4cd15
POLVER := policy.$(PV)
Chris PeBenito b4cd15
TYPE := strict
Chris PeBenito b4cd15
Chris PeBenito b4cd15
# install paths
Chris PeBenito b4cd15
TOPDIR = $(DESTDIR)/etc/selinux
Chris PeBenito b4cd15
INSTALLDIR = $(TOPDIR)/$(TYPE)
Chris PeBenito b4cd15
POLICYPATH = $(INSTALLDIR)/policy
Chris PeBenito b4cd15
SRCPATH = $(INSTALLDIR)/src
Chris PeBenito b4cd15
USERPATH = $(INSTALLDIR)/users
Chris PeBenito b4cd15
CONTEXTPATH = $(INSTALLDIR)/contexts
Chris PeBenito b4cd15
LOADPATH = $(POLICYPATH)/$(POLVER)
Chris PeBenito b4cd15
FCPATH = $(CONTEXTPATH)/files/file_contexts
Chris PeBenito b4cd15
HOMEDIRPATH = $(CONTEXTPATH)/files/homedir_template
Chris PeBenito b4cd15
Chris PeBenito b4cd15
BASE_MODULE = kernel
Chris PeBenito b4cd15
FLASKDIR = $(BASE_MODULE)/flask/
Chris PeBenito b4cd15
MISCDIR = $(BASE_MODULE)/misc/
Chris PeBenito b4cd15
Chris PeBenito b4cd15
DETECTED_DIRS := $(shell find $(wildcard *) -maxdepth 0 -type d)
Chris PeBenito b4cd15
ALL_MODULES := $(filter-out tmp,$(DETECTED_DIRS))
Chris PeBenito b4cd15
Chris PeBenito b4cd15
PRE_TE_FILES := $(addprefix $(FLASKDIR),security_classes initial_sids access_vectors)
Chris PeBenito b4cd15
ALL_INTERFACES := $(foreach dir,$(ALL_MODULES),$(wildcard $(dir)/*.if))
Chris PeBenito b4cd15
ALL_TE_FILES := $(foreach dir,$(ALL_MODULES),$(wildcard $(dir)/*.te))
Chris PeBenito 099c8b
POST_TE_FILES := $(addprefix $(MISCDIR),users constraints mls initial_sid_contexts fs_use)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
ALL_FC_FILES := $(foreach dir,$(ALL_MODULES),$(wildcard $(dir)/*.fc))
Chris PeBenito b4cd15
Chris PeBenito f66a1a
POLICY_SECTIONS := tmp/pre_te_files.conf tmp/generated_definitions.conf tmp/all_interfaces.conf tmp/all_attrs_types.conf tmp/only_te_rules.conf tmp/all_post.conf
Chris PeBenito b4cd15
Chris PeBenito b4cd15
override M4PARAM += -D monolithic_policy
Chris PeBenito b4cd15
Chris PeBenito b4cd15
########################################
Chris PeBenito b4cd15
#
Chris PeBenito b4cd15
# default action: build policy locally
Chris PeBenito b4cd15
#
Chris PeBenito b4cd15
default: policy
Chris PeBenito b4cd15
Chris PeBenito b4cd15
policy: $(POLVER)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
install: $(LOADPATH)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
########################################
Chris PeBenito b4cd15
#
Chris PeBenito b4cd15
# Build a binary policy locally
Chris PeBenito b4cd15
#
Chris PeBenito b4cd15
$(POLVER): policy.conf
Chris PeBenito b4cd15
ifneq ($(PV),$(KV))
Chris PeBenito b4cd15
	@echo
Chris PeBenito b4cd15
	@echo "WARNING: Policy version mismatch!  Is your POLICYCOMPAT set correctly?"
Chris PeBenito b4cd15
	@echo
Chris PeBenito b4cd15
endif
Chris PeBenito b4cd15
	$(QUIET) $(CHECKPOLICY) $(POLICYCOMPAT) $^ -o $(POLVER)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
########################################
Chris PeBenito b4cd15
#
Chris PeBenito b4cd15
# Install a binary policy
Chris PeBenito b4cd15
#
Chris PeBenito b4cd15
$(LOADPATH): policy.conf
Chris PeBenito b4cd15
	@mkdir -p $(POLICYPATH)
Chris PeBenito b4cd15
ifneq ($(PV),$(KV))
Chris PeBenito b4cd15
	@echo
Chris PeBenito b4cd15
	@echo "WARNING: Policy version mismatch!  Is your POLICYCOMPAT set correctly?"
Chris PeBenito b4cd15
	@echo
Chris PeBenito b4cd15
endif
Chris PeBenito b4cd15
	$(QUIET) $(CHECKPOLICY) $(POLICYCOMPAT) $^ -o $(LOADPATH)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
########################################
Chris PeBenito b4cd15
#
Chris PeBenito 88d14a
# Load the binary policy
Chris PeBenito 88d14a
#
Chris PeBenito 88d14a
reload tmp/load: $(LOADPATH) $(FCPATH)
Chris PeBenito 88d14a
	$(QUIET) $(LOADPOLICY) -q $(LOADPATH)
Chris PeBenito 88d14a
	@touch tmp/load
Chris PeBenito 88d14a
Chris PeBenito 88d14a
load: tmp/load
Chris PeBenito 88d14a
Chris PeBenito 88d14a
########################################
Chris PeBenito 88d14a
#
Chris PeBenito b4cd15
# Construct a monolithic policy.conf
Chris PeBenito b4cd15
#
Chris PeBenito b4cd15
policy.conf: $(POLICY_SECTIONS)
Chris PeBenito bd202f
	$(QUIET) # checkpolicy can use the #line directives provided by m4 -s
Chris PeBenito bd202f
	$(QUIET) # for error reporting:
Chris PeBenito bd202f
	$(QUIET) m4 $(M4PARAM) -s $^ > tmp/$@.tmp
Chris PeBenito b4cd15
	$(QUIET) sed -e /^portcon/d -e /^nodecon/d -e /^netifcon/d < tmp/$@.tmp > $@
Chris PeBenito b4cd15
	$(QUIET) # the ordering of these ocontexts matters:
Chris PeBenito b4cd15
	$(QUIET) grep ^portcon tmp/$@.tmp >> $@ || true
Chris PeBenito b4cd15
	$(QUIET) grep ^netifcon tmp/$@.tmp >> $@ || true
Chris PeBenito b4cd15
	$(QUIET) grep ^nodecon tmp/$@.tmp >> $@ || true
Chris PeBenito b4cd15
Chris PeBenito b4cd15
tmp/pre_te_files.conf: $(PRE_TE_FILES)
Chris PeBenito b4cd15
	@test -d tmp || mkdir -p tmp
Chris PeBenito b4cd15
	$(QUIET) cat $^ > $@
Chris PeBenito b4cd15
Chris PeBenito b4cd15
tmp/generated_definitions.conf: $(ALL_MODULES) $(ALL_TE_FILES) $(BASE_MODULE)/corenetwork.if $(BASE_MODULE)/corenetwork.te
Chris PeBenito b4cd15
	@test -d tmp || mkdir -p tmp
Chris PeBenito b4cd15
	$(QUIET) echo "define(\`per_userdomain_templates',\`" > $@
Chris PeBenito 0634b6
	$(QUIET) for i in $(patsubst %.te,%,$(notdir $(ALL_TE_FILES))); do \
Chris PeBenito b4cd15
		echo "ifdef(\`""$$i""_per_userdomain_template',\`""$$i""_per_userdomain_template("'$$1'")')" \
Chris PeBenito b4cd15
			>> $@ ;\
Chris PeBenito b4cd15
	done
Chris PeBenito b4cd15
	$(QUIET) echo "')" >> $@
Chris PeBenito b4cd15
	$(QUIET) for i in $(notdir $(ALL_TE_FILES)); do \
Chris PeBenito b4cd15
		echo "define(\`$$i')" >> $@ ;\
Chris PeBenito b4cd15
	done
Chris PeBenito 0e730c
	$(QUIET) m4 $(M4PARAM) -D interface_pass $(BASE_MODULE)/global.if $(BASE_MODULE)/corenetwork.if $(BASE_MODULE)/corenetwork.te \
Chris PeBenito bd202f
		| sed -e 's/dollarsone/\$$1/g' -e 's/dollarszero/\$$0/g' >> $@
Chris PeBenito b4cd15
Chris PeBenito b4cd15
tmp/all_interfaces.conf: $(ALL_INTERFACES)
Chris PeBenito b4cd15
	@test -d tmp || mkdir -p tmp
Chris PeBenito b4cd15
	$(QUIET) cat $^ > $@
Chris PeBenito b4cd15
Chris PeBenito b4cd15
tmp/all_te_files.conf: $(ALL_TE_FILES)
Chris PeBenito b4cd15
	@test -d tmp || mkdir -p tmp
Chris PeBenito b4cd15
	$(QUIET) cat $^ > $@
Chris PeBenito b4cd15
Chris PeBenito b4cd15
tmp/post_te_files.conf: $(POST_TE_FILES)
Chris PeBenito b4cd15
	@test -d tmp || mkdir -p tmp
Chris PeBenito b4cd15
	$(QUIET) cat $^ > $@
Chris PeBenito b4cd15
Chris PeBenito b4cd15
# extract attributes and put them first. extract post te stuff
Chris PeBenito b4cd15
# like genfscon and put last.  portcon, nodecon, and netifcon
Chris PeBenito b4cd15
# is delayed since they are generated by m4
Chris PeBenito f66a1a
tmp/all_attrs_types.conf tmp/only_te_rules.conf tmp/all_post.conf: tmp/all_te_files.conf tmp/post_te_files.conf
Chris PeBenito f66a1a
	$(QUIET) grep ^attribute tmp/all_te_files.conf > tmp/all_attrs_types.conf || true
Chris PeBenito f66a1a
	$(QUIET) grep '^type ' tmp/all_te_files.conf >> tmp/all_attrs_types.conf
Chris PeBenito b4cd15
	$(QUIET) cat tmp/post_te_files.conf > tmp/all_post.conf
Chris PeBenito b4cd15
	$(QUIET) grep ^genfscon tmp/all_te_files.conf >> tmp/all_post.conf || true
Chris PeBenito f66a1a
	$(QUIET) sed -e /^attribute/d -e '/^type /d' -e /^genfscon/d < tmp/all_te_files.conf > tmp/only_te_rules.conf
Chris PeBenito b4cd15
Chris PeBenito b4cd15
########################################
Chris PeBenito b4cd15
#
Chris PeBenito 88d14a
# Remove the dontaudit rules from the policy.conf
Chris PeBenito 88d14a
#
Chris PeBenito 88d14a
enableaudit: policy.conf
Chris PeBenito 88d14a
	@test -d tmp || mkdir -p tmp
Chris PeBenito 88d14a
	@echo "Removing dontaudit rules from policy.conf"
Chris PeBenito 88d14a
	$(QUIET) grep -v dontaudit policy.conf > tmp/policy.audit
Chris PeBenito 88d14a
	$(QUIET) mv tmp/policy.audit policy.conf
Chris PeBenito 88d14a
Chris PeBenito 88d14a
########################################
Chris PeBenito 88d14a
#
Chris PeBenito 6d314f
# Construct file_contexts
Chris PeBenito 6d314f
#
Chris PeBenito 6d314f
$(FC): kernel/global.if $(ALL_FC_FILES)
Chris PeBenito 6d314f
	@test -d tmp || mkdir -p tmp
Chris PeBenito 6d314f
	$(QUIET) m4 $(M4PARAM) $^ > $@
Chris PeBenito 6d314f
Chris PeBenito 6d314f
########################################
Chris PeBenito 6d314f
#
Chris PeBenito b4cd15
# Filesystem labeling
Chris PeBenito b4cd15
#
Chris PeBenito 88d14a
FILESYSTEMS := `mount | grep -v "context=" | egrep -v '\((|.*,)bind(,.*|)\)' | awk '/(ext[23]| xfs| jfs).*rw/{print $$3}';`
Chris PeBenito b4cd15
Chris PeBenito 88d14a
checklabels: $(FC) $(SETFILES)
Chris PeBenito 88d14a
	@if test -z "$(FILESYSTEMS)"; then \
Chris PeBenito 88d14a
		echo "No filesystems with extended attributes found!" ;\
Chris PeBenito 88d14a
		false ;\
Chris PeBenito 88d14a
	fi
Chris PeBenito b4cd15
	$(QUIET) $(SETFILES) -v -n $(FC) $(FILESYSTEMS)
Chris PeBenito b4cd15
Chris PeBenito 88d14a
restorelabels: $(FC) $(SETFILES)
Chris PeBenito 88d14a
	@if test -z "$(FILESYSTEMS)"; then \
Chris PeBenito 88d14a
		echo "No filesystems with extended attributes found!" ;\
Chris PeBenito 88d14a
		false ;\
Chris PeBenito 88d14a
	fi
Chris PeBenito b4cd15
	$(QUIET) $(SETFILES) -v $(FC) $(FILESYSTEMS)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
relabel:  $(FC) $(SETFILES)
Chris PeBenito 88d14a
	@if test -z "$(FILESYSTEMS)"; then \
Chris PeBenito 88d14a
		echo "No filesystems with extended attributes found!" ;\
Chris PeBenito 88d14a
		false ;\
Chris PeBenito 88d14a
	fi
Chris PeBenito b4cd15
	$(QUIET) $(SETFILES) $(FC) $(FILESYSTEMS)
Chris PeBenito b4cd15
Chris PeBenito 6d314f
########################################
Chris PeBenito 6d314f
#
Chris PeBenito 6d314f
# Documentation generation
Chris PeBenito 6d314f
#
Chris PeBenito 6d314f
Chris PeBenito 6d314f
xml: policy.xml
Chris PeBenito 6d314f
Chris PeBenito 6d314f
policy.xml: $(ALL_INTERFACES) tmp/generated_definitions.conf
Chris PeBenito 6d314f
	echo "<policy>" > $@
Chris PeBenito 6d314f
	grep -h -E "^##[[:space:]]" $^ | sed -e 's/^##[[:space:]]//g' >> $@
Chris PeBenito 6d314f
	echo "</policy>" >> $@
Chris PeBenito 6d314f
Chris PeBenito b4cd15
clean:
Chris PeBenito b4cd15
	rm -fR tmp
Chris PeBenito 6d314f
	rm -f policy.xml
Chris PeBenito b4cd15
	rm -f policy.conf
Chris PeBenito b4cd15
	rm -f policy.$(PV)
Chris PeBenito b4cd15
	rm -f $(FC)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
.PHONY: default clean policy install