357 lines
12 KiB
Makefile
357 lines
12 KiB
Makefile
|
#
|
||
|
|
# Makefile for the security policy.
|
||
|
|
#
|
||
|
|
# Targets:
|
||
|
|
#
|
||
|
|
# install - compile and install the policy configuration, and context files.
|
||
|
|
# load - compile, install, and load the policy configuration.
|
||
|
|
# reload - compile, install, and load/reload the policy configuration.
|
||
|
|
# relabel - relabel filesystems based on the file contexts configuration.
|
||
|
|
# policy - compile the policy configuration locally for testing/development.
|
||
|
|
#
|
||
|
|
# The default target is 'install'.
|
||
|
|
#
|
||
|
|
|
||
|
|
# Set to y if MLS is enabled in the policy.
|
||
|
|
MLS=y
|
||
|
|
|
||
|
|
# Set to y if MCS is enabled in the policy
|
||
|
|
MCS=n
|
||
|
|
|
||
|
|
FLASKDIR = flask/
|
||
|
|
PREFIX = /usr
|
||
|
|
BINDIR = $(PREFIX)/bin
|
||
|
|
SBINDIR = $(PREFIX)/sbin
|
||
|
|
LOADPOLICY = $(SBINDIR)/load_policy
|
||
|
|
CHECKPOLICY = $(BINDIR)/checkpolicy
|
||
|
|
GENHOMEDIRCON = $(SBINDIR)/genhomedircon
|
||
|
|
SETFILES = $(SBINDIR)/setfiles
|
||
|
|
VERS := $(shell $(CHECKPOLICY) $(POLICYCOMPAT) -V |cut -f 1 -d ' ')
|
||
|
|
PREVERS := 20
|
||
|
|
KERNVERS := $(shell cat /selinux/policyvers)
|
||
|
|
MLSENABLED := $(shell cat /selinux/mls)
|
||
|
|
POLICYVER := policy.$(VERS)
|
||
|
|
TOPDIR = $(DESTDIR)/etc/selinux
|
||
|
|
TYPE=mls
|
||
|
|
|
||
|
|
INSTALLDIR = $(TOPDIR)/$(TYPE)
|
||
|
|
POLICYPATH = $(INSTALLDIR)/policy
|
||
|
|
SRCPATH = $(INSTALLDIR)/src
|
||
|
|
USERPATH = $(INSTALLDIR)/users
|
||
|
|
CONTEXTPATH = $(INSTALLDIR)/contexts
|
||
|
|
LOADPATH = $(POLICYPATH)/$(POLICYVER)
|
||
|
|
FCPATH = $(CONTEXTPATH)/files/file_contexts
|
||
|
|
HOMEDIRPATH = $(CONTEXTPATH)/files/homedir_template
|
||
|
|
|
||
|
|
ALL_PROGRAM_MACROS := $(wildcard macros/program/*.te)
|
||
|
|
ALL_MACROS := $(ALL_PROGRAM_MACROS) $(wildcard macros/*.te)
|
||
|
|
ALL_TYPES := $(wildcard types/*.te)
|
||
|
|
ALL_DOMAINS := $(wildcard domains/*.te domains/misc/*.te domains/program/*.te)
|
||
|
|
ALLTEFILES := attrib.te tmp/program_used_flags.te $(ALL_MACROS) $(ALL_TYPES) $(ALL_DOMAINS) assert.te
|
||
|
|
TE_RBAC_FILES := $(ALLTEFILES) rbac
|
||
|
|
ALL_TUNABLES := $(wildcard tunables/*.tun )
|
||
|
|
USER_FILES := users
|
||
|
|
POLICYFILES = $(addprefix $(FLASKDIR),security_classes initial_sids access_vectors)
|
||
|
|
ifeq ($(MLS),y)
|
||
|
|
POLICYFILES += mls
|
||
|
|
CHECKPOLMLS += -M
|
||
|
|
endif
|
||
|
|
ifeq ($(MCS), y)
|
||
|
|
POLICYFILES += mcs
|
||
|
|
CHECKPOLMLS += -M
|
||
|
|
endif
|
||
|
|
DEFCONTEXTFILES = initial_sid_contexts fs_use genfs_contexts net_contexts
|
||
|
|
POLICYFILES += $(ALL_TUNABLES) $(TE_RBAC_FILES)
|
||
|
|
POLICYFILES += $(USER_FILES)
|
||
|
|
POLICYFILES += constraints
|
||
|
|
POLICYFILES += $(DEFCONTEXTFILES)
|
||
|
|
CONTEXTFILES = $(DEFCONTEXTFILES)
|
||
|
|
POLICY_DIRS = domains domains/program domains/misc macros macros/program
|
||
|
|
|
||
|
|
UNUSED_TE_FILES := $(wildcard domains/program/unused/*.te)
|
||
|
|
|
||
|
|
FC = file_contexts/file_contexts
|
||
|
|
HOMEDIR_TEMPLATE = file_contexts/homedir_template
|
||
|
|
FCFILES=file_contexts/types.fc $(patsubst domains/program/%.te,file_contexts/program/%.fc, $(wildcard domains/program/*.te)) file_contexts/distros.fc $(wildcard file_contexts/misc/*.fc)
|
||
|
|
CONTEXTFILES += $(FCFILES)
|
||
|
|
|
||
|
|
APPDIR=$(CONTEXTPATH)
|
||
|
|
APPFILES = $(addprefix $(APPDIR)/,default_contexts default_type initrc_context failsafe_context userhelper_context removable_context dbus_contexts customizable_types port_types) $(CONTEXTPATH)/files/media
|
||
|
|
CONTEXTFILES += $(wildcard appconfig/*_context*) appconfig/media
|
||
|
|
|
||
|
|
ROOTFILES = $(addprefix $(APPDIR)/users/,root)
|
||
|
|
|
||
|
|
all: policy
|
||
|
|
|
||
|
|
tmp/valid_fc: $(LOADPATH) $(FC)
|
||
|
|
@echo "Validating file contexts files ..."
|
||
|
|
$(SETFILES) -q -c $(LOADPATH) $(FC)
|
||
|
|
@touch tmp/valid_fc
|
||
|
|
|
||
|
|
install: $(FCPATH) $(APPFILES) $(ROOTFILES) $(USERPATH)/local.users
|
||
|
|
|
||
|
|
$(USERPATH)/system.users: $(ALL_TUNABLES) $(USER_FILES) policy.conf
|
||
|
|
@mkdir -p $(USERPATH)
|
||
|
|
@echo "# " > tmp/system.users
|
||
|
|
@echo "# Do not edit this file. " >> tmp/system.users
|
||
|
|
@echo "# This file is replaced on reinstalls of this policy." >> tmp/system.users
|
||
|
|
@echo "# Please edit local.users to make local changes." >> tmp/system.users
|
||
|
|
@echo "#" >> tmp/system.users
|
||
|
|
@m4 $(ALL_TUNABLES) tmp/program_used_flags.te $(USER_FILES) | grep -v "^#" >> tmp/system.users
|
||
|
|
install -m 644 tmp/system.users $@
|
||
|
|
|
||
|
|
$(USERPATH)/local.users: local.users
|
||
|
|
@mkdir -p $(USERPATH)
|
||
|
|
install -b -m 644 $< $@
|
||
|
|
|
||
|
|
$(CONTEXTPATH)/files/media: appconfig/media
|
||
|
|
@mkdir -p $(CONTEXTPATH)/files/
|
||
|
|
install -m 644 $< $@
|
||
|
|
|
||
|
|
$(APPDIR)/default_contexts: appconfig/default_contexts
|
||
|
|
@mkdir -p $(APPDIR)
|
||
|
|
install -m 644 $< $@
|
||
|
|
|
||
|
|
$(APPDIR)/removable_context: appconfig/removable_context
|
||
|
|
@mkdir -p $(APPDIR)
|
||
|
|
install -m 644 $< $@
|
||
|
|
|
||
|
|
$(APPDIR)/customizable_types: policy.conf
|
||
|
|
@mkdir -p $(APPDIR)
|
||
|
|
@grep "^type .*customizable" $< | cut -d',' -f1 | cut -d' ' -f2 > tmp/customizable_types
|
||
|
|
install -m 644 tmp/customizable_types $@
|
||
|
|
|
||
|
|
$(APPDIR)/port_types: policy.conf
|
||
|
|
@mkdir -p $(APPDIR)
|
||
|
|
@grep "^type .*port_type" $< | cut -d',' -f1 | cut -d' ' -f2 > tmp/port_types
|
||
|
|
install -m 644 tmp/port_types $@
|
||
|
|
|
||
|
|
$(APPDIR)/default_type: appconfig/default_type
|
||
|
|
@mkdir -p $(APPDIR)
|
||
|
|
install -m 644 $< $@
|
||
|
|
|
||
|
|
$(APPDIR)/userhelper_context: appconfig/userhelper_context
|
||
|
|
@mkdir -p $(APPDIR)
|
||
|
|
install -m 644 $< $@
|
||
|
|
|
||
|
|
$(APPDIR)/initrc_context: appconfig/initrc_context
|
||
|
|
@mkdir -p $(APPDIR)
|
||
|
|
install -m 644 $< $@
|
||
|
|
|
||
|
|
$(APPDIR)/failsafe_context: appconfig/failsafe_context
|
||
|
|
@mkdir -p $(APPDIR)
|
||
|
|
install -m 644 $< $@
|
||
|
|
|
||
|
|
$(APPDIR)/dbus_contexts: appconfig/dbus_contexts
|
||
|
|
@mkdir -p $(APPDIR)
|
||
|
|
install -m 644 $< $@
|
||
|
|
|
||
|
|
$(APPDIR)/users/root: appconfig/root_default_contexts
|
||
|
|
@mkdir -p $(APPDIR)/users
|
||
|
|
install -m 644 $< $@
|
||
|
|
|
||
|
|
$(LOADPATH): policy.conf $(CHECKPOLICY)
|
||
|
|
@echo "Compiling policy ..."
|
||
|
|
@mkdir -p $(POLICYPATH)
|
||
|
|
$(CHECKPOLICY) $(CHECKPOLMLS) -o $@ policy.conf
|
||
|
|
ifneq ($(VERS),$(PREVERS))
|
||
|
|
$(CHECKPOLICY) $(CHECKPOLMLS) -c $(PREVERS) -o $(POLICYPATH)/policy.$(PREVERS) policy.conf
|
||
|
|
endif
|
||
|
|
|
||
|
|
# Note: Can't use install, so not sure how to deal with mode, user, and group
|
||
|
|
# other than by default.
|
||
|
|
|
||
|
|
policy: $(POLICYVER)
|
||
|
|
|
||
|
|
$(POLICYVER): policy.conf $(FC) $(CHECKPOLICY)
|
||
|
|
$(CHECKPOLICY) $(CHECKPOLMLS) -o $@ policy.conf
|
||
|
|
@echo "Validating file contexts files ..."
|
||
|
|
$(SETFILES) -q -c $(POLICYVER) $(FC)
|
||
|
|
|
||
|
|
reload tmp/load: $(LOADPATH)
|
||
|
|
@echo "Loading Policy ..."
|
||
|
|
$(LOADPOLICY)
|
||
|
|
touch tmp/load
|
||
|
|
|
||
|
|
load: tmp/load $(FCPATH)
|
||
|
|
|
||
|
|
enableaudit: policy.conf
|
||
|
|
grep -v dontaudit policy.conf > policy.audit
|
||
|
|
mv policy.audit policy.conf
|
||
|
|
|
||
|
|
policy.conf: $(POLICYFILES) $(POLICY_DIRS)
|
||
|
|
@echo "Building policy.conf ..."
|
||
|
|
@mkdir -p tmp
|
||
|
|
m4 $(M4PARAM) -Imacros -s $(POLICYFILES) > $@.tmp
|
||
|
|
@mv $@.tmp $@
|
||
|
|
|
||
|
|
install-src:
|
||
|
|
rm -rf $(SRCPATH)/policy.old
|
||
|
|
-mv $(SRCPATH)/policy $(SRCPATH)/policy.old
|
||
|
|
@mkdir -p $(SRCPATH)/policy
|
||
|
|
cp -R . $(SRCPATH)/policy
|
||
|
|
|
||
|
|
tmp/program_used_flags.te: $(wildcard domains/program/*.te) domains/program
|
||
|
|
@mkdir -p tmp
|
||
|
|
( cd domains/program/ ; for n in *.te ; do echo "define(\`$$n')"; done ) > $@.tmp
|
||
|
|
( cd domains/misc/ ; for n in *.te ; do echo "define(\`$$n')"; done ) >> $@.tmp
|
||
|
|
mv $@.tmp $@
|
||
|
|
|
||
|
|
FILESYSTEMS=`mount | grep -v "context=" | egrep -v '\((|.*,)bind(,.*|)\)' | awk '/(ext[23]| xfs| jfs | reiserfs ).*rw/{print $$3}';`
|
||
|
|
|
||
|
|
checklabels: $(SETFILES)
|
||
|
|
$(SETFILES) -v -n $(FC) $(FILESYSTEMS)
|
||
|
|
|
||
|
|
restorelabels: $(SETFILES)
|
||
|
|
$(SETFILES) -v $(FC) $(FILESYSTEMS)
|
||
|
|
|
||
|
|
relabel: $(FC) $(SETFILES)
|
||
|
|
$(SETFILES) $(FC) $(FILESYSTEMS)
|
||
|
|
|
||
|
|
file_contexts/misc:
|
||
|
|
@mkdir -p file_contexts/misc
|
||
|
|
|
||
|
|
$(FCPATH): tmp/valid_fc $(USERPATH)/system.users $(APPDIR)/customizable_types $(APPDIR)/port_types
|
||
|
|
@echo "Installing file contexts files..."
|
||
|
|
@mkdir -p $(CONTEXTPATH)/files
|
||
|
|
install -m 644 $(HOMEDIR_TEMPLATE) $(HOMEDIRPATH)
|
||
|
|
install -m 644 $(FC) $(FCPATH)
|
||
|
|
@$(GENHOMEDIRCON) -d $(TOPDIR) -t $(TYPE) $(USEPWD)
|
||
|
|
|
||
|
|
$(FC): $(ALL_TUNABLES) tmp/program_used_flags.te $(FCFILES) domains/program domains/misc file_contexts/program file_contexts/misc users /etc/passwd
|
||
|
|
@echo "Building file contexts files..."
|
||
|
|
@m4 $(M4PARAM) $(ALL_TUNABLES) tmp/program_used_flags.te $(FCFILES) > $@.tmp
|
||
|
|
@grep -v -e HOME -e ROLE -e USER $@.tmp > $@
|
||
|
|
@grep -e HOME -e ROLE -e USER $@.tmp > $(HOMEDIR_TEMPLATE)
|
||
|
|
@-rm $@.tmp
|
||
|
|
|
||
|
|
# Create a tags-file for the policy:
|
||
|
|
# we need exuberant ctags; unfortunately it is named differently on different distros, sigh...
|
||
|
|
pathsearch = $(firstword $(wildcard $(addsuffix /$(1),$(subst :, ,$(PATH))))) # taken from make-docs
|
||
|
|
CTAGS := $(call pathsearch,ctags-exuberant) # debian naming scheme
|
||
|
|
ifeq ($(strip $(CTAGS)),)
|
||
|
|
CTAGS := $(call pathsearch,ctags) # suse naming scheme
|
||
|
|
endif
|
||
|
|
|
||
|
|
tags: $(wildcard *.te types/*.te domains/*.te domains/misc/*.te domains/program/*.te domains/program/unused/*.te macros/*.te macros/program/*.te)
|
||
|
|
@($(CTAGS) --version | grep -q Exuberant) || (echo ERROR: Need exuberant-ctags to function!; exit 1)
|
||
|
|
@LC_ALL=C $(CTAGS) --langdef=te --langmap=te:..te \
|
||
|
|
--regex-te='/^[ \t]*type[ \t]+(\w+)(,|;)/\1/t,type/' \
|
||
|
|
--regex-te='/^[ \t]*typealias[ \t]+\w+[ \t+]+alias[ \t]+(\w+);/\1/t,type/' \
|
||
|
|
--regex-te='/^[ \t]*attribute[ \t]+(\w+);/\1/a,attribute/' \
|
||
|
|
--regex-te='/^[ \t]*define\(`(\w+)/\1/d,define/' \
|
||
|
|
--regex-te='/^[ \t]*bool[ \t]+(\w+)/\1/b,bool/' $^
|
||
|
|
|
||
|
|
clean:
|
||
|
|
rm -f policy.conf $(POLICYVER)
|
||
|
|
rm -f tags
|
||
|
|
rm -f tmp/*
|
||
|
|
rm -f $(FC)
|
||
|
|
rm -f flask/*.h
|
||
|
|
# for the policy regression tester
|
||
|
|
find "domains/program/" -maxdepth 1 -type l -exec rm {} \; ; \
|
||
|
|
|
||
|
|
# Policy regression tester.
|
||
|
|
# Written by Colin Walters <walters@debian.org>
|
||
|
|
cur_te = $(filter-out %/,$(subst /,/ ,$@))
|
||
|
|
|
||
|
|
TESTED_TE_FILES := $(notdir $(UNUSED_TE_FILES))
|
||
|
|
|
||
|
|
define compute_depends
|
||
|
|
export TE_DEPENDS_$(1) := $(shell egrep '^#[[:space:]]*Depends: ' domains/program/unused/$(1) | head -1 | sed -e 's/^.*Depends: //')
|
||
|
|
endef
|
||
|
|
|
||
|
|
|
||
|
|
ifeq ($(TE_DEPENDS_DEFINED),)
|
||
|
|
ifeq ($(MAKECMDGOALS),check-all)
|
||
|
|
GENRULES := $(TESTED_TE_FILES)
|
||
|
|
export TE_DEPENDS_DEFINED := yes
|
||
|
|
else
|
||
|
|
# Handle the case where checkunused/blah.te is run directly.
|
||
|
|
ifneq ($(findstring checkunused/,$(MAKECMDGOALS)),)
|
||
|
|
GENRULES := $(TESTED_TE_FILES)
|
||
|
|
export TE_DEPENDS_DEFINED := yes
|
||
|
|
endif
|
||
|
|
endif
|
||
|
|
endif
|
||
|
|
|
||
|
|
# Test for a new enough version of GNU Make.
|
||
|
|
$(eval have_eval := yes)
|
||
|
|
ifneq ($(GENRULES),)
|
||
|
|
ifeq ($(have_eval),)
|
||
|
|
$(error Need GNU Make 3.80 or better!)
|
||
|
|
Need GNU Make 3.80 or better
|
||
|
|
endif
|
||
|
|
endif
|
||
|
|
$(foreach f,$(GENRULES),$(eval $(call compute_depends,$(f))))
|
||
|
|
|
||
|
|
PHONIES :=
|
||
|
|
|
||
|
|
define compute_presymlinks
|
||
|
|
PHONIES += presymlink/$(1)
|
||
|
|
presymlink/$(1):: $(patsubst %,presymlink/%,$(TE_DEPENDS_$(1)))
|
||
|
|
@if ! test -L domains/program/$(1); then \
|
||
|
|
cd domains/program && ln -s unused/$(1) .; \
|
||
|
|
fi
|
||
|
|
endef
|
||
|
|
|
||
|
|
# Compute dependencies.
|
||
|
|
$(foreach f,$(TESTED_TE_FILES),$(eval $(call compute_presymlinks,$(f))))
|
||
|
|
|
||
|
|
PHONIES += $(patsubst %,checkunused/%,$(TESTED_TE_FILES))
|
||
|
|
$(patsubst %,checkunused/%,$(TESTED_TE_FILES)) :: checkunused/% :
|
||
|
|
@$(MAKE) -s clean
|
||
|
|
|
||
|
|
$(patsubst %,checkunused/%,$(TESTED_TE_FILES)) :: checkunused/% : presymlink/%
|
||
|
|
@if test -n "$(TE_DEPENDS_$(cur_te))"; then \
|
||
|
|
echo "Dependencies for $(cur_te): $(TE_DEPENDS_$(cur_te))"; \
|
||
|
|
fi
|
||
|
|
@echo "Testing $(cur_te)...";
|
||
|
|
@if ! make -s policy 1>/dev/null; then \
|
||
|
|
echo "Testing $(cur_te)...FAILED"; \
|
||
|
|
exit 1; \
|
||
|
|
fi;
|
||
|
|
@echo "Testing $(cur_te)...success."; \
|
||
|
|
|
||
|
|
check-all:
|
||
|
|
@for goal in $(patsubst %,checkunused/%,$(TESTED_TE_FILES)); do \
|
||
|
|
$(MAKE) --no-print-directory $$goal; \
|
||
|
|
done
|
||
|
|
|
||
|
|
.PHONY: clean $(PHONIES)
|
||
|
|
|
||
|
|
mlsconvert:
|
||
|
|
@for file in $(CONTEXTFILES); do \
|
||
|
|
echo "Converting $$file"; \
|
||
|
|
sed -e 's/_t\b/_t:s0/g' $$file > $$file.new && \
|
||
|
|
mv $$file.new $$file; \
|
||
|
|
done
|
||
|
|
@for file in $(USER_FILES); do \
|
||
|
|
echo "Converting $$file"; \
|
||
|
|
sed -e 's/;/ level s0 range s0 - s15:c0.c255;/' $$file > $$file.new && \
|
||
|
|
mv $$file.new $$file; \
|
||
|
|
done
|
||
|
|
@sed -e '/sid kernel/s/s0/s0 - s15:c0.c255/' initial_sid_contexts > initial_sid_contexts.new && mv initial_sid_contexts.new initial_sid_contexts
|
||
|
|
@echo "Enabling MLS in the Makefile"
|
||
|
|
@sed "s/MLS=y/MLS=y/" Makefile > Makefile.new
|
||
|
|
@mv Makefile.new Makefile
|
||
|
|
@echo "Done"
|
||
|
|
|
||
|
|
mcsconvert:
|
||
|
|
@for file in $(CONTEXTFILES); do \
|
||
|
|
echo "Converting $$file"; \
|
||
|
|
sed -e 's/_t\b/_t:s0/g' $$file > $$file.new && \
|
||
|
|
mv $$file.new $$file; \
|
||
|
|
done
|
||
|
|
@for file in $(USER_FILES); do \
|
||
|
|
echo "Converting $$file"; \
|
||
|
|
sed -r -e 's/\;/ level s0 range s0;/' $$file | \
|
||
|
|
sed -r -e 's/(user (user_u|root|system_u).*);/\1 - s0:c0.c255;/' > $$file.new; \
|
||
|
|
mv $$file.new $$file; \
|
||
|
|
done
|
||
|
|
@echo "Enabling MCS in the Makefile"
|
||
|
|
@sed "s/MCS=n/MCS=y/" Makefile > Makefile.new
|
||
|
|
@mv Makefile.new Makefile
|
||
|
|
@echo "Done"
|
||
|
|
|