|
Chris PeBenito |
88d14a |
#
|
|
Chris PeBenito |
88d14a |
# Makefile for the security policy.
|
|
Chris PeBenito |
88d14a |
#
|
|
Chris PeBenito |
88d14a |
# Targets:
|
|
Chris PeBenito |
88d14a |
#
|
|
Chris PeBenito |
88d14a |
# install - compile and install the policy configuration, and context files.
|
|
Chris PeBenito |
88d14a |
# load - compile, install, and load the policy configuration.
|
|
Chris PeBenito |
88d14a |
# reload - compile, install, and load/reload the policy configuration.
|
|
Chris PeBenito |
88d14a |
# relabel - relabel filesystems based on the file contexts configuration.
|
|
Chris PeBenito |
88d14a |
# checklabels - check filesystems against the file context configuration
|
|
Chris PeBenito |
88d14a |
# restorelabels - check filesystems against the file context configuration
|
|
Chris PeBenito |
88d14a |
# and restore the label of files with incorrect labels
|
|
Chris PeBenito |
88d14a |
# policy - compile the policy configuration locally for testing/development.
|
|
Chris PeBenito |
88d14a |
#
|
|
Chris PeBenito |
88d14a |
# The default target is 'policy'.
|
|
Chris PeBenito |
88d14a |
#
|
|
Chris PeBenito |
88d14a |
|
|
Chris PeBenito |
b4cd15 |
########################################
|
|
Chris PeBenito |
b4cd15 |
#
|
|
Chris PeBenito |
b4cd15 |
# Configurable portions of the Makefile
|
|
Chris PeBenito |
b4cd15 |
#
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
b4cd15 |
# Build compatibility policies
|
|
Chris PeBenito |
b4cd15 |
POLICYCOMPAT = -c 18
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
b4cd15 |
# set distribution
|
|
Chris PeBenito |
b4cd15 |
#override M4PARAM += -D distro_redhat
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
b4cd15 |
# Uncomment this to disable command echoing
|
|
Chris PeBenito |
b4cd15 |
#QUIET:=@
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
b4cd15 |
########################################
|
|
Chris PeBenito |
b4cd15 |
#
|
|
Chris PeBenito |
b4cd15 |
# Invariant portions of the Makefile
|
|
Chris PeBenito |
b4cd15 |
#
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
b4cd15 |
# executable paths
|
|
Chris PeBenito |
b4cd15 |
PREFIX := /usr
|
|
Chris PeBenito |
b4cd15 |
BINDIR := $(PREFIX)/bin
|
|
Chris PeBenito |
b4cd15 |
SBINDIR := $(PREFIX)/sbin
|
|
Chris PeBenito |
b4cd15 |
CHECKPOLICY := $(BINDIR)/checkpolicy
|
|
Chris PeBenito |
b4cd15 |
SETFILES := $(SBINDIR)/setfiles
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
b4cd15 |
# determine the policy version and current kernel version if possible
|
|
Chris PeBenito |
b4cd15 |
PV := $(shell $(CHECKPOLICY) $(POLICYCOMPAT) -V |cut -f 1 -d ' ')
|
|
Chris PeBenito |
b4cd15 |
KV := $(shell cat /selinux/policyvers)
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
b4cd15 |
# dont print version warnings if we are unable to determine
|
|
Chris PeBenito |
b4cd15 |
# the currently running kernel's policy version
|
|
Chris PeBenito |
b4cd15 |
ifeq ($(KV),)
|
|
Chris PeBenito |
b4cd15 |
KV := $(PV)
|
|
Chris PeBenito |
b4cd15 |
endif
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
b4cd15 |
FC := file_contexts
|
|
Chris PeBenito |
b4cd15 |
POLVER := policy.$(PV)
|
|
Chris PeBenito |
b4cd15 |
TYPE := strict
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
b4cd15 |
# install paths
|
|
Chris PeBenito |
b4cd15 |
TOPDIR = $(DESTDIR)/etc/selinux
|
|
Chris PeBenito |
b4cd15 |
INSTALLDIR = $(TOPDIR)/$(TYPE)
|
|
Chris PeBenito |
b4cd15 |
POLICYPATH = $(INSTALLDIR)/policy
|
|
Chris PeBenito |
b4cd15 |
SRCPATH = $(INSTALLDIR)/src
|
|
Chris PeBenito |
b4cd15 |
USERPATH = $(INSTALLDIR)/users
|
|
Chris PeBenito |
b4cd15 |
CONTEXTPATH = $(INSTALLDIR)/contexts
|
|
Chris PeBenito |
b4cd15 |
LOADPATH = $(POLICYPATH)/$(POLVER)
|
|
Chris PeBenito |
b4cd15 |
FCPATH = $(CONTEXTPATH)/files/file_contexts
|
|
Chris PeBenito |
b4cd15 |
HOMEDIRPATH = $(CONTEXTPATH)/files/homedir_template
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
b4cd15 |
BASE_MODULE = kernel
|
|
Chris PeBenito |
b4cd15 |
FLASKDIR = $(BASE_MODULE)/flask/
|
|
Chris PeBenito |
b4cd15 |
MISCDIR = $(BASE_MODULE)/misc/
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
b4cd15 |
DETECTED_DIRS := $(shell find $(wildcard *) -maxdepth 0 -type d)
|
|
Chris PeBenito |
b4cd15 |
ALL_MODULES := $(filter-out tmp,$(DETECTED_DIRS))
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
b4cd15 |
PRE_TE_FILES := $(addprefix $(FLASKDIR),security_classes initial_sids access_vectors)
|
|
Chris PeBenito |
b4cd15 |
ALL_INTERFACES := $(foreach dir,$(ALL_MODULES),$(wildcard $(dir)/*.if))
|
|
Chris PeBenito |
b4cd15 |
ALL_TE_FILES := $(foreach dir,$(ALL_MODULES),$(wildcard $(dir)/*.te))
|
|
Chris PeBenito |
099c8b |
POST_TE_FILES := $(addprefix $(MISCDIR),users constraints mls initial_sid_contexts fs_use)
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
b4cd15 |
ALL_FC_FILES := $(foreach dir,$(ALL_MODULES),$(wildcard $(dir)/*.fc))
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
f66a1a |
POLICY_SECTIONS := tmp/pre_te_files.conf tmp/generated_definitions.conf tmp/all_interfaces.conf tmp/all_attrs_types.conf tmp/only_te_rules.conf tmp/all_post.conf
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
b4cd15 |
override M4PARAM += -D monolithic_policy
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
b4cd15 |
########################################
|
|
Chris PeBenito |
b4cd15 |
#
|
|
Chris PeBenito |
b4cd15 |
# default action: build policy locally
|
|
Chris PeBenito |
b4cd15 |
#
|
|
Chris PeBenito |
b4cd15 |
default: policy
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
b4cd15 |
policy: $(POLVER)
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
b4cd15 |
install: $(LOADPATH)
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
b4cd15 |
########################################
|
|
Chris PeBenito |
b4cd15 |
#
|
|
Chris PeBenito |
b4cd15 |
# Build a binary policy locally
|
|
Chris PeBenito |
b4cd15 |
#
|
|
Chris PeBenito |
b4cd15 |
$(POLVER): policy.conf
|
|
Chris PeBenito |
b4cd15 |
ifneq ($(PV),$(KV))
|
|
Chris PeBenito |
b4cd15 |
@echo
|
|
Chris PeBenito |
b4cd15 |
@echo "WARNING: Policy version mismatch! Is your POLICYCOMPAT set correctly?"
|
|
Chris PeBenito |
b4cd15 |
@echo
|
|
Chris PeBenito |
b4cd15 |
endif
|
|
Chris PeBenito |
b4cd15 |
$(QUIET) $(CHECKPOLICY) $(POLICYCOMPAT) $^ -o $(POLVER)
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
b4cd15 |
########################################
|
|
Chris PeBenito |
b4cd15 |
#
|
|
Chris PeBenito |
b4cd15 |
# Install a binary policy
|
|
Chris PeBenito |
b4cd15 |
#
|
|
Chris PeBenito |
b4cd15 |
$(LOADPATH): policy.conf
|
|
Chris PeBenito |
b4cd15 |
@mkdir -p $(POLICYPATH)
|
|
Chris PeBenito |
b4cd15 |
ifneq ($(PV),$(KV))
|
|
Chris PeBenito |
b4cd15 |
@echo
|
|
Chris PeBenito |
b4cd15 |
@echo "WARNING: Policy version mismatch! Is your POLICYCOMPAT set correctly?"
|
|
Chris PeBenito |
b4cd15 |
@echo
|
|
Chris PeBenito |
b4cd15 |
endif
|
|
Chris PeBenito |
b4cd15 |
$(QUIET) $(CHECKPOLICY) $(POLICYCOMPAT) $^ -o $(LOADPATH)
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
b4cd15 |
########################################
|
|
Chris PeBenito |
b4cd15 |
#
|
|
Chris PeBenito |
88d14a |
# Load the binary policy
|
|
Chris PeBenito |
88d14a |
#
|
|
Chris PeBenito |
88d14a |
reload tmp/load: $(LOADPATH) $(FCPATH)
|
|
Chris PeBenito |
88d14a |
$(QUIET) $(LOADPOLICY) -q $(LOADPATH)
|
|
Chris PeBenito |
88d14a |
@touch tmp/load
|
|
Chris PeBenito |
88d14a |
|
|
Chris PeBenito |
88d14a |
load: tmp/load
|
|
Chris PeBenito |
88d14a |
|
|
Chris PeBenito |
88d14a |
########################################
|
|
Chris PeBenito |
88d14a |
#
|
|
Chris PeBenito |
b4cd15 |
# Construct a monolithic policy.conf
|
|
Chris PeBenito |
b4cd15 |
#
|
|
Chris PeBenito |
b4cd15 |
policy.conf: $(POLICY_SECTIONS)
|
|
Chris PeBenito |
bd202f |
$(QUIET) # checkpolicy can use the #line directives provided by m4 -s
|
|
Chris PeBenito |
bd202f |
$(QUIET) # for error reporting:
|
|
Chris PeBenito |
bd202f |
$(QUIET) m4 $(M4PARAM) -s $^ > tmp/$@.tmp
|
|
Chris PeBenito |
b4cd15 |
$(QUIET) sed -e /^portcon/d -e /^nodecon/d -e /^netifcon/d < tmp/$@.tmp > $@
|
|
Chris PeBenito |
b4cd15 |
$(QUIET) # the ordering of these ocontexts matters:
|
|
Chris PeBenito |
b4cd15 |
$(QUIET) grep ^portcon tmp/$@.tmp >> $@ || true
|
|
Chris PeBenito |
b4cd15 |
$(QUIET) grep ^netifcon tmp/$@.tmp >> $@ || true
|
|
Chris PeBenito |
b4cd15 |
$(QUIET) grep ^nodecon tmp/$@.tmp >> $@ || true
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
b4cd15 |
tmp/pre_te_files.conf: $(PRE_TE_FILES)
|
|
Chris PeBenito |
b4cd15 |
@test -d tmp || mkdir -p tmp
|
|
Chris PeBenito |
b4cd15 |
$(QUIET) cat $^ > $@
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
b4cd15 |
tmp/generated_definitions.conf: $(ALL_MODULES) $(ALL_TE_FILES) $(BASE_MODULE)/corenetwork.if $(BASE_MODULE)/corenetwork.te
|
|
Chris PeBenito |
b4cd15 |
@test -d tmp || mkdir -p tmp
|
|
Chris PeBenito |
b4cd15 |
$(QUIET) echo "define(\`per_userdomain_templates',\`" > $@
|
|
Chris PeBenito |
0634b6 |
$(QUIET) for i in $(patsubst %.te,%,$(notdir $(ALL_TE_FILES))); do \
|
|
Chris PeBenito |
b4cd15 |
echo "ifdef(\`""$$i""_per_userdomain_template',\`""$$i""_per_userdomain_template("'$$1'")')" \
|
|
Chris PeBenito |
b4cd15 |
>> $@ ;\
|
|
Chris PeBenito |
b4cd15 |
done
|
|
Chris PeBenito |
b4cd15 |
$(QUIET) echo "')" >> $@
|
|
Chris PeBenito |
b4cd15 |
$(QUIET) for i in $(notdir $(ALL_TE_FILES)); do \
|
|
Chris PeBenito |
b4cd15 |
echo "define(\`$$i')" >> $@ ;\
|
|
Chris PeBenito |
b4cd15 |
done
|
|
Chris PeBenito |
0e730c |
$(QUIET) m4 $(M4PARAM) -D interface_pass $(BASE_MODULE)/global.if $(BASE_MODULE)/corenetwork.if $(BASE_MODULE)/corenetwork.te \
|
|
Chris PeBenito |
bd202f |
| sed -e 's/dollarsone/\$$1/g' -e 's/dollarszero/\$$0/g' >> $@
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
b4cd15 |
tmp/all_interfaces.conf: $(ALL_INTERFACES)
|
|
Chris PeBenito |
b4cd15 |
@test -d tmp || mkdir -p tmp
|
|
Chris PeBenito |
b4cd15 |
$(QUIET) cat $^ > $@
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
b4cd15 |
tmp/all_te_files.conf: $(ALL_TE_FILES)
|
|
Chris PeBenito |
b4cd15 |
@test -d tmp || mkdir -p tmp
|
|
Chris PeBenito |
b4cd15 |
$(QUIET) cat $^ > $@
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
b4cd15 |
tmp/post_te_files.conf: $(POST_TE_FILES)
|
|
Chris PeBenito |
b4cd15 |
@test -d tmp || mkdir -p tmp
|
|
Chris PeBenito |
b4cd15 |
$(QUIET) cat $^ > $@
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
b4cd15 |
# extract attributes and put them first. extract post te stuff
|
|
Chris PeBenito |
b4cd15 |
# like genfscon and put last. portcon, nodecon, and netifcon
|
|
Chris PeBenito |
b4cd15 |
# is delayed since they are generated by m4
|
|
Chris PeBenito |
f66a1a |
tmp/all_attrs_types.conf tmp/only_te_rules.conf tmp/all_post.conf: tmp/all_te_files.conf tmp/post_te_files.conf
|
|
Chris PeBenito |
f66a1a |
$(QUIET) grep ^attribute tmp/all_te_files.conf > tmp/all_attrs_types.conf || true
|
|
Chris PeBenito |
f66a1a |
$(QUIET) grep '^type ' tmp/all_te_files.conf >> tmp/all_attrs_types.conf
|
|
Chris PeBenito |
b4cd15 |
$(QUIET) cat tmp/post_te_files.conf > tmp/all_post.conf
|
|
Chris PeBenito |
b4cd15 |
$(QUIET) grep ^genfscon tmp/all_te_files.conf >> tmp/all_post.conf || true
|
|
Chris PeBenito |
f66a1a |
$(QUIET) sed -e /^attribute/d -e '/^type /d' -e /^genfscon/d < tmp/all_te_files.conf > tmp/only_te_rules.conf
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
b4cd15 |
########################################
|
|
Chris PeBenito |
b4cd15 |
#
|
|
Chris PeBenito |
88d14a |
# Remove the dontaudit rules from the policy.conf
|
|
Chris PeBenito |
88d14a |
#
|
|
Chris PeBenito |
88d14a |
enableaudit: policy.conf
|
|
Chris PeBenito |
88d14a |
@test -d tmp || mkdir -p tmp
|
|
Chris PeBenito |
88d14a |
@echo "Removing dontaudit rules from policy.conf"
|
|
Chris PeBenito |
88d14a |
$(QUIET) grep -v dontaudit policy.conf > tmp/policy.audit
|
|
Chris PeBenito |
88d14a |
$(QUIET) mv tmp/policy.audit policy.conf
|
|
Chris PeBenito |
88d14a |
|
|
Chris PeBenito |
88d14a |
########################################
|
|
Chris PeBenito |
88d14a |
#
|
|
Chris PeBenito |
6d314f |
# Construct file_contexts
|
|
Chris PeBenito |
6d314f |
#
|
|
Chris PeBenito |
6d314f |
$(FC): kernel/global.if $(ALL_FC_FILES)
|
|
Chris PeBenito |
6d314f |
@test -d tmp || mkdir -p tmp
|
|
Chris PeBenito |
6d314f |
$(QUIET) m4 $(M4PARAM) $^ > $@
|
|
Chris PeBenito |
6d314f |
|
|
Chris PeBenito |
6d314f |
########################################
|
|
Chris PeBenito |
6d314f |
#
|
|
Chris PeBenito |
b4cd15 |
# Filesystem labeling
|
|
Chris PeBenito |
b4cd15 |
#
|
|
Chris PeBenito |
88d14a |
FILESYSTEMS := `mount | grep -v "context=" | egrep -v '\((|.*,)bind(,.*|)\)' | awk '/(ext[23]| xfs| jfs).*rw/{print $$3}';`
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
88d14a |
checklabels: $(FC) $(SETFILES)
|
|
Chris PeBenito |
88d14a |
@if test -z "$(FILESYSTEMS)"; then \
|
|
Chris PeBenito |
88d14a |
echo "No filesystems with extended attributes found!" ;\
|
|
Chris PeBenito |
88d14a |
false ;\
|
|
Chris PeBenito |
88d14a |
fi
|
|
Chris PeBenito |
b4cd15 |
$(QUIET) $(SETFILES) -v -n $(FC) $(FILESYSTEMS)
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
88d14a |
restorelabels: $(FC) $(SETFILES)
|
|
Chris PeBenito |
88d14a |
@if test -z "$(FILESYSTEMS)"; then \
|
|
Chris PeBenito |
88d14a |
echo "No filesystems with extended attributes found!" ;\
|
|
Chris PeBenito |
88d14a |
false ;\
|
|
Chris PeBenito |
88d14a |
fi
|
|
Chris PeBenito |
b4cd15 |
$(QUIET) $(SETFILES) -v $(FC) $(FILESYSTEMS)
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
b4cd15 |
relabel: $(FC) $(SETFILES)
|
|
Chris PeBenito |
88d14a |
@if test -z "$(FILESYSTEMS)"; then \
|
|
Chris PeBenito |
88d14a |
echo "No filesystems with extended attributes found!" ;\
|
|
Chris PeBenito |
88d14a |
false ;\
|
|
Chris PeBenito |
88d14a |
fi
|
|
Chris PeBenito |
b4cd15 |
$(QUIET) $(SETFILES) $(FC) $(FILESYSTEMS)
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
6d314f |
########################################
|
|
Chris PeBenito |
6d314f |
#
|
|
Chris PeBenito |
6d314f |
# Documentation generation
|
|
Chris PeBenito |
6d314f |
#
|
|
Chris PeBenito |
6d314f |
|
|
Chris PeBenito |
6d314f |
xml: policy.xml
|
|
Chris PeBenito |
6d314f |
|
|
Chris PeBenito |
6d314f |
policy.xml: $(ALL_INTERFACES) tmp/generated_definitions.conf
|
|
Chris PeBenito |
6d314f |
echo "<policy>" > $@
|
|
Chris PeBenito |
6d314f |
grep -h -E "^##[[:space:]]" $^ | sed -e 's/^##[[:space:]]//g' >> $@
|
|
Chris PeBenito |
6d314f |
echo "</policy>" >> $@
|
|
Chris PeBenito |
6d314f |
|
|
Chris PeBenito |
b4cd15 |
clean:
|
|
Chris PeBenito |
b4cd15 |
rm -fR tmp
|
|
Chris PeBenito |
6d314f |
rm -f policy.xml
|
|
Chris PeBenito |
b4cd15 |
rm -f policy.conf
|
|
Chris PeBenito |
b4cd15 |
rm -f policy.$(PV)
|
|
Chris PeBenito |
b4cd15 |
rm -f $(FC)
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
b4cd15 |
.PHONY: default clean policy install
|