1################################################################################ 2# 3# refpolicy 4# 5################################################################################ 6 7REFPOLICY_LICENSE = GPL-2.0 8REFPOLICY_LICENSE_FILES = COPYING 9REFPOLICY_CPE_ID_VENDOR = selinuxproject 10REFPOLICY_INSTALL_STAGING = YES 11REFPOLICY_DEPENDENCIES = \ 12 host-m4 \ 13 host-checkpolicy \ 14 host-policycoreutils \ 15 host-python3 \ 16 host-setools \ 17 host-gawk \ 18 host-libxml2 19 20ifeq ($(BR2_PACKAGE_REFPOLICY_CUSTOM_GIT),y) 21REFPOLICY_VERSION = $(call qstrip,$(BR2_PACKAGE_REFPOLICY_CUSTOM_REPO_VERSION)) 22REFPOLICY_SITE = $(call qstrip,$(BR2_PACKAGE_REFPOLICY_CUSTOM_REPO_URL)) 23REFPOLICY_SITE_METHOD = git 24BR_NO_CHECK_HASH_FOR += $(REFPOLICY_SOURCE) 25else 26REFPOLICY_VERSION = 2.20210908 27REFPOLICY_SOURCE = refpolicy-$(REFPOLICY_VERSION).tar.bz2 28REFPOLICY_SITE = https://github.com/SELinuxProject/refpolicy/releases/download/RELEASE_$(subst .,_,$(REFPOLICY_VERSION)) 29endif 30 31# Cannot use multiple threads to build the reference policy 32REFPOLICY_MAKE = \ 33 PYTHON=$(HOST_DIR)/usr/bin/python3 \ 34 XMLLINT=$(LIBXML2_HOST_BINARY) \ 35 TEST_TOOLCHAIN=$(HOST_DIR) \ 36 $(TARGET_MAKE_ENV) \ 37 $(MAKE1) 38 39REFPOLICY_POLICY_VERSION = $(BR2_PACKAGE_LIBSEPOL_POLICY_VERSION) 40REFPOLICY_POLICY_STATE = \ 41 $(call qstrip,$(BR2_PACKAGE_REFPOLICY_POLICY_STATE)) 42 43ifeq ($(BR2_PACKAGE_REFPOLICY_UPSTREAM_VERSION),y) 44 45# Allow to provide out-of-tree SELinux modules in addition to the ones 46# in the refpolicy. 47REFPOLICY_EXTRA_MODULES_DIRS = \ 48 $(strip \ 49 $(call qstrip,$(BR2_REFPOLICY_EXTRA_MODULES_DIRS)) \ 50 $(PACKAGES_SELINUX_EXTRA_MODULES_DIRS)) 51$(foreach dir,$(REFPOLICY_EXTRA_MODULES_DIRS),\ 52 $(if $(wildcard $(dir)),,\ 53 $(error BR2_REFPOLICY_EXTRA_MODULES_DIRS contains nonexistent directory $(dir)))) 54 55REFPOLICY_MODULES = \ 56 application \ 57 authlogin \ 58 getty \ 59 init \ 60 libraries \ 61 locallogin \ 62 logging \ 63 miscfiles \ 64 modutils \ 65 mount \ 66 selinuxutil \ 67 storage \ 68 sysadm \ 69 sysnetwork \ 70 unconfined \ 71 userdomain \ 72 $(PACKAGES_SELINUX_MODULES) \ 73 $(call qstrip,$(BR2_REFPOLICY_EXTRA_MODULES)) \ 74 $(foreach d,$(REFPOLICY_EXTRA_MODULES_DIRS),\ 75 $(basename $(notdir $(wildcard $(d)/*.te)))) 76 77define REFPOLICY_COPY_EXTRA_MODULES 78 mkdir -p $(@D)/policy/modules/buildroot 79 rsync -au $(addsuffix /*,$(REFPOLICY_EXTRA_MODULES_DIRS)) \ 80 $(@D)/policy/modules/buildroot/ 81 if [ ! -f $(@D)/policy/modules/buildroot/metadata.xml ]; then \ 82 echo "<summary>Buildroot extra modules</summary>" > \ 83 $(@D)/policy/modules/buildroot/metadata.xml; \ 84 fi 85endef 86 87# In the context of a monolithic policy enabling a piece of the policy as 88# 'base' or 'module' is equivalent, so we enable them as 'base'. 89define REFPOLICY_CONFIGURE_MODULES 90 $(SED) "s/ = module/ = no/g" $(@D)/policy/modules.conf 91 $(foreach m,$(sort $(REFPOLICY_MODULES)), 92 $(SED) "/^$(m) =/c\$(m) = base" $(@D)/policy/modules.conf 93 ) 94endef 95 96endif # BR2_PACKAGE_REFPOLICY_UPSTREAM_VERSION = y 97 98ifeq ($(BR2_INIT_SYSTEMD),y) 99define REFPOLICY_CONFIGURE_SYSTEMD 100 $(SED) "/SYSTEMD/c\SYSTEMD = y" $(@D)/build.conf 101endef 102endif 103 104define REFPOLICY_CONFIGURE_CMDS 105 $(SED) "/OUTPUT_POLICY/c\OUTPUT_POLICY = $(REFPOLICY_POLICY_VERSION)" \ 106 $(@D)/build.conf 107 $(SED) "/MONOLITHIC/c\MONOLITHIC = y" $(@D)/build.conf 108 $(SED) "/NAME/c\NAME = targeted" $(@D)/build.conf 109 $(REFPOLICY_CONFIGURE_SYSTEMD) 110 $(if $(REFPOLICY_EXTRA_MODULES_DIRS), \ 111 $(REFPOLICY_COPY_EXTRA_MODULES) 112 ) 113 $(REFPOLICY_MAKE) -C $(@D) bare conf 114 $(REFPOLICY_CONFIGURE_MODULES) 115endef 116 117define REFPOLICY_BUILD_CMDS 118 $(REFPOLICY_MAKE) -C $(@D) policy 119endef 120 121define REFPOLICY_INSTALL_STAGING_CMDS 122 $(REFPOLICY_MAKE) -C $(@D) DESTDIR=$(STAGING_DIR) \ 123 install-src install-headers 124endef 125 126define REFPOLICY_INSTALL_TARGET_CMDS 127 $(REFPOLICY_MAKE) -C $(@D) DESTDIR=$(TARGET_DIR) install 128 $(INSTALL) -m 0755 -D package/refpolicy/config \ 129 $(TARGET_DIR)/etc/selinux/config 130 $(SED) "/^SELINUX=/c\SELINUX=$(REFPOLICY_POLICY_STATE)" \ 131 $(TARGET_DIR)/etc/selinux/config 132endef 133 134$(eval $(generic-package)) 135