refpolicy.mk 3.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131
  1. ################################################################################
  2. #
  3. # refpolicy
  4. #
  5. ################################################################################
  6. REFPOLICY_LICENSE = GPL-2.0
  7. REFPOLICY_LICENSE_FILES = COPYING
  8. REFPOLICY_INSTALL_STAGING = YES
  9. REFPOLICY_DEPENDENCIES = \
  10. host-m4 \
  11. host-checkpolicy \
  12. host-policycoreutils \
  13. host-python3 \
  14. host-setools \
  15. host-gawk
  16. ifeq ($(BR2_PACKAGE_REFPOLICY_CUSTOM_GIT),y)
  17. REFPOLICY_VERSION = $(call qstrip,$(BR2_PACKAGE_REFPOLICY_CUSTOM_REPO_VERSION))
  18. REFPOLICY_SITE = $(call qstrip,$(BR2_PACKAGE_REFPOLICY_CUSTOM_REPO_URL))
  19. REFPOLICY_SITE_METHOD = git
  20. BR_NO_CHECK_HASH_FOR += $(REFPOLICY_SOURCE)
  21. else
  22. REFPOLICY_VERSION = 2.20200229
  23. REFPOLICY_SOURCE = refpolicy-$(REFPOLICY_VERSION).tar.bz2
  24. REFPOLICY_SITE = https://github.com/SELinuxProject/refpolicy/releases/download/RELEASE_2_20200229
  25. endif
  26. # Cannot use multiple threads to build the reference policy
  27. REFPOLICY_MAKE = \
  28. PYTHON=$(HOST_DIR)/usr/bin/python3 \
  29. TEST_TOOLCHAIN=$(HOST_DIR) \
  30. $(TARGET_MAKE_ENV) \
  31. $(MAKE1)
  32. REFPOLICY_POLICY_VERSION = $(BR2_PACKAGE_LIBSEPOL_POLICY_VERSION)
  33. REFPOLICY_POLICY_STATE = \
  34. $(call qstrip,$(BR2_PACKAGE_REFPOLICY_POLICY_STATE))
  35. ifeq ($(BR2_PACKAGE_REFPOLICY_UPSTREAM_VERSION),y)
  36. # Allow to provide out-of-tree SELinux modules in addition to the ones
  37. # in the refpolicy.
  38. REFPOLICY_EXTRA_MODULES_DIRS = \
  39. $(strip \
  40. $(call qstrip,$(BR2_REFPOLICY_EXTRA_MODULES_DIRS)) \
  41. $(PACKAGES_SELINUX_EXTRA_MODULES_DIRS))
  42. $(foreach dir,$(REFPOLICY_EXTRA_MODULES_DIRS),\
  43. $(if $(wildcard $(dir)),,\
  44. $(error BR2_REFPOLICY_EXTRA_MODULES_DIRS contains nonexistent directory $(dir))))
  45. REFPOLICY_MODULES = \
  46. application \
  47. authlogin \
  48. getty \
  49. init \
  50. libraries \
  51. locallogin \
  52. logging \
  53. miscfiles \
  54. modutils \
  55. mount \
  56. selinuxutil \
  57. storage \
  58. sysadm \
  59. sysnetwork \
  60. unconfined \
  61. userdomain \
  62. $(PACKAGES_SELINUX_MODULES) \
  63. $(call qstrip,$(BR2_REFPOLICY_EXTRA_MODULES)) \
  64. $(foreach d,$(REFPOLICY_EXTRA_MODULES_DIRS),\
  65. $(basename $(notdir $(wildcard $(d)/*.te))))
  66. define REFPOLICY_COPY_EXTRA_MODULES
  67. mkdir -p $(@D)/policy/modules/buildroot
  68. rsync -au $(addsuffix /*,$(REFPOLICY_EXTRA_MODULES_DIRS)) \
  69. $(@D)/policy/modules/buildroot/
  70. if [ ! -f $(@D)/policy/modules/buildroot/metadata.xml ]; then \
  71. echo "<summary>Buildroot extra modules</summary>" > \
  72. $(@D)/policy/modules/buildroot/metadata.xml; \
  73. fi
  74. endef
  75. # In the context of a monolithic policy enabling a piece of the policy as
  76. # 'base' or 'module' is equivalent, so we enable them as 'base'.
  77. define REFPOLICY_CONFIGURE_MODULES
  78. $(SED) "s/ = module/ = no/g" $(@D)/policy/modules.conf
  79. $(foreach m,$(sort $(REFPOLICY_MODULES)),
  80. $(SED) "/^$(m) =/c\$(m) = base" $(@D)/policy/modules.conf
  81. )
  82. endef
  83. endif # BR2_PACKAGE_REFPOLICY_UPSTREAM_VERSION = y
  84. ifeq ($(BR2_INIT_SYSTEMD),y)
  85. define REFPOLICY_CONFIGURE_SYSTEMD
  86. $(SED) "/SYSTEMD/c\SYSTEMD = y" $(@D)/build.conf
  87. endef
  88. endif
  89. define REFPOLICY_CONFIGURE_CMDS
  90. $(SED) "/OUTPUT_POLICY/c\OUTPUT_POLICY = $(REFPOLICY_POLICY_VERSION)" \
  91. $(@D)/build.conf
  92. $(SED) "/MONOLITHIC/c\MONOLITHIC = y" $(@D)/build.conf
  93. $(SED) "/NAME/c\NAME = targeted" $(@D)/build.conf
  94. $(REFPOLICY_CONFIGURE_SYSTEMD)
  95. $(if $(REFPOLICY_EXTRA_MODULES_DIRS), \
  96. $(REFPOLICY_COPY_EXTRA_MODULES)
  97. )
  98. $(REFPOLICY_MAKE) -C $(@D) bare conf
  99. $(REFPOLICY_CONFIGURE_MODULES)
  100. endef
  101. define REFPOLICY_BUILD_CMDS
  102. $(REFPOLICY_MAKE) -C $(@D) policy
  103. endef
  104. define REFPOLICY_INSTALL_STAGING_CMDS
  105. $(REFPOLICY_MAKE) -C $(@D) DESTDIR=$(STAGING_DIR) \
  106. install-src install-headers
  107. endef
  108. define REFPOLICY_INSTALL_TARGET_CMDS
  109. $(REFPOLICY_MAKE) -C $(@D) DESTDIR=$(TARGET_DIR) install
  110. $(INSTALL) -m 0755 -D package/refpolicy/config \
  111. $(TARGET_DIR)/etc/selinux/config
  112. $(SED) "/^SELINUX=/c\SELINUX=$(REFPOLICY_POLICY_STATE)" \
  113. $(TARGET_DIR)/etc/selinux/config
  114. endef
  115. $(eval $(generic-package))