264 lines
8.0 KiB
Makefile
264 lines
8.0 KiB
Makefile
|
|
# helper tools
|
|
AWK ?= gawk
|
|
INSTALL ?= install
|
|
M4 ?= m4
|
|
SED ?= sed
|
|
EINFO ?= echo
|
|
PYTHON ?= python
|
|
|
|
NAME ?= $(shell $(AWK) -F= '/^SELINUXTYPE/{ print $$2 }' /etc/selinux/config)
|
|
SHAREDIR ?= /usr/share/selinux
|
|
HEADERDIR ?= $(SHAREDIR)/$(NAME)/include
|
|
|
|
include $(HEADERDIR)/build.conf
|
|
|
|
# executables
|
|
PREFIX := /usr
|
|
BINDIR := $(PREFIX)/bin
|
|
SBINDIR := $(PREFIX)/sbin
|
|
CHECKMODULE := $(BINDIR)/checkmodule
|
|
SEMODULE := $(SBINDIR)/semodule
|
|
SEMOD_PKG := $(BINDIR)/semodule_package
|
|
XMLLINT := $(BINDIR)/xmllint
|
|
|
|
# set default build options if missing
|
|
TYPE ?= strict
|
|
DIRECT_INITRC ?= n
|
|
POLY ?= n
|
|
QUIET ?= y
|
|
|
|
genxml := $(PYTHON) $(HEADERDIR)/support/segenxml.py
|
|
|
|
docs = doc
|
|
polxml = $(docs)/policy.xml
|
|
xmldtd = $(HEADERDIR)/support/policy.dtd
|
|
metaxml = metadata.xml
|
|
|
|
globaltun = $(HEADERDIR)/global_tunables.xml
|
|
globalbool = $(HEADERDIR)/global_booleans.xml
|
|
|
|
# compile strict policy if requested.
|
|
ifneq ($(findstring strict,$(TYPE)),)
|
|
M4PARAM += -D strict_policy
|
|
endif
|
|
|
|
# compile targeted policy if requested.
|
|
ifneq ($(findstring targeted,$(TYPE)),)
|
|
M4PARAM += -D targeted_policy
|
|
endif
|
|
|
|
# enable MLS if requested.
|
|
ifneq ($(findstring -mls,$(TYPE)),)
|
|
M4PARAM += -D enable_mls
|
|
CHECKPOLICY += -M
|
|
CHECKMODULE += -M
|
|
endif
|
|
|
|
# enable MLS if MCS requested.
|
|
ifneq ($(findstring -mcs,$(TYPE)),)
|
|
M4PARAM += -D enable_mcs
|
|
CHECKPOLICY += -M
|
|
CHECKMODULE += -M
|
|
endif
|
|
|
|
# enable distribution-specific policy
|
|
ifneq ($(DISTRO),)
|
|
M4PARAM += -D distro_$(DISTRO)
|
|
endif
|
|
|
|
ifeq ($(DIRECT_INITRC),y)
|
|
M4PARAM += -D direct_sysadm_daemon
|
|
endif
|
|
|
|
# default MLS/MCS sensitivity and category settings.
|
|
MLS_SENS ?= 16
|
|
MLS_CATS ?= 256
|
|
MCS_CATS ?= 256
|
|
|
|
ifeq ($(QUIET),y)
|
|
verbose := @
|
|
endif
|
|
|
|
M4PARAM += -D hide_broken_symptoms -D mls_num_sens=$(MLS_SENS) -D mls_num_cats=$(MLS_CATS) -D mcs_num_cats=$(MCS_CATS)
|
|
|
|
# policy headers
|
|
m4support = $(wildcard $(HEADERDIR)/support/*.spt)
|
|
|
|
all_layers = $(filter-out $(HEADERDIR)/support,$(shell find $(wildcard $(HEADERDIR)/*) -maxdepth 0 -type d))
|
|
all_interfaces = $(foreach layer,$(all_layers),$(wildcard $(layer)/*.if))
|
|
rolemap = $(HEADERDIR)/rolemap
|
|
|
|
detected_layers = $(filter-out CVS tmp $(docs),$(shell find $(wildcard *) -maxdepth 0 -type d))
|
|
|
|
clayers = $(addprefix $(CURDIR)/, $(filter $(notdir $(detected_layers)), $(notdir $(all_layers))))
|
|
all_layers_subset = $(addprefix $(HEADERDIR)/, $(filter-out $(notdir $(detected_layers)), $(notdir $(all_layers))))
|
|
detected_layers_subset = $(addprefix $(CURDIR)/, $(filter-out $(notdir $(clayers)), $(notdir $(detected_layers))))
|
|
|
|
3rd_party_mods = $(wildcard *.te)
|
|
detected_mods = $(3rd_party_mods) $(foreach layer,$(detected_layers),$(wildcard $(layer)/*.te))
|
|
detected_mods_subset = $(3rd_party_mods) $(foreach layer,$(detected_layers_subset),$(wildcard $(layer)/*.te))
|
|
|
|
detected_ifs = $(detected_mods:.te=.if)
|
|
detected_fcs = $(detected_mods:.te=.fc)
|
|
all_packages = $(notdir $(detected_mods:.te=.pp))
|
|
|
|
modxml = $(addprefix $(CURDIR)/, $(detected_mods_subset:.te=.xml))
|
|
layerxml = $(addprefix tmp/, $(notdir $(addsuffix .xml, $(detected_layers_subset) $(CURDIR))))
|
|
|
|
hmodxml = $(all_interfaces:.if=.xml)
|
|
hlayerxml = $(addsuffix .xml, $(addprefix tmp/, $(notdir $(all_layers_subset))))
|
|
hmetaxml = $(foreach layer, $(all_layers_subset), $(layer)/$(metaxml))
|
|
|
|
cmods = $(foreach layer, $(clayers), $(wildcard $(layer)/*.te))
|
|
cmodxml = $(cmods:.te=.xml)
|
|
clayerxml= $(addsuffix .xml, $(addprefix tmp/, $(notdir $(clayers))))
|
|
cmetaxml = $(foreach layer, $(notdir $(clayers)), $(HEADERDIR)/$(layer)/$(metaxml))
|
|
|
|
vpath %.te $(detected_layers)
|
|
vpath %.if $(detected_layers)
|
|
vpath %.fc $(detected_layers)
|
|
|
|
########################################
|
|
#
|
|
# Functions
|
|
#
|
|
|
|
# parse-rolemap-compat modulename,outputfile
|
|
define parse-rolemap-compat
|
|
$(verbose) $(M4) $(M4PARAM) $(rolemap) | \
|
|
$(AWK) '/^[[:blank:]]*[A-Za-z]/{ print "gen_require(type " $$3 "; role " $$1 ";)\n$1_per_userdomain_template(" $$2 "," $$3 "," $$1 ")" }' >> $2
|
|
endef
|
|
|
|
# parse-rolemap modulename,outputfile
|
|
define parse-rolemap
|
|
$(verbose) $(M4) $(M4PARAM) $(rolemap) | \
|
|
$(AWK) '/^[[:blank:]]*[A-Za-z]/{ print "gen_require(type " $$3 "; role " $$1 ";)\n$1_per_role_template(" $$2 "," $$3 "," $$1 ")" }' >> $2
|
|
endef
|
|
|
|
# peruser-expansion modulename,outputfile
|
|
define peruser-expansion
|
|
$(verbose) echo "ifdef(\`""$1""_per_role_template',\`" > $2
|
|
$(call parse-rolemap,$1,$2)
|
|
$(verbose) echo "')" >> $2
|
|
|
|
$(verbose) echo "ifdef(\`""$1""_per_userdomain_template',\`" >> $2
|
|
$(verbose) echo "errprint(\`Warning: per_userdomain_templates have been renamed to per_role_templates (""$1""_per_userdomain_template)'__endline__)" >> $2
|
|
$(call parse-rolemap-compat,$1,$2)
|
|
$(verbose) echo "')" >> $2
|
|
endef
|
|
|
|
.PHONY: clean all xml load reload
|
|
.SUFFIXES:
|
|
.SUFFIXES: .pp
|
|
# broken in make 3.81:
|
|
#.SECONDARY:
|
|
|
|
########################################
|
|
#
|
|
# Main targets
|
|
#
|
|
|
|
all: $(all_packages)
|
|
|
|
xml: $(polxml)
|
|
|
|
########################################
|
|
#
|
|
# Load module packages
|
|
#
|
|
|
|
load: tmp/loaded
|
|
tmp/loaded: $(all_packages)
|
|
@$(EINFO) "Loading $(NAME) modules: $(basename $(notdir $?))"
|
|
$(verbose) $(SEMODULE) $(foreach mod,$?,-i $(mod))
|
|
@mkdir -p tmp
|
|
@touch tmp/loaded
|
|
|
|
reload: $(all_packages)
|
|
@$(EINFO) "Loading $(NAME) modules: $(basename $(notdir $^))"
|
|
$(verbose) $(SEMODULE) $(foreach mod,$^,-i $(mod))
|
|
@mkdir -p tmp
|
|
@touch tmp/loaded
|
|
|
|
########################################
|
|
#
|
|
# Build module packages
|
|
#
|
|
tmp/%.mod: $(m4support) tmp/all_interfaces.conf %.te
|
|
@$(EINFO) "Compiling $(NAME) $(basename $(@F)) module"
|
|
@test -d tmp || mkdir -p tmp
|
|
$(call peruser-expansion,$(basename $(@F)),$@.role)
|
|
$(verbose) $(M4) $(M4PARAM) -s $^ $@.role > $(@:.mod=.tmp)
|
|
$(verbose) $(CHECKMODULE) -m $(@:.mod=.tmp) -o $@
|
|
|
|
tmp/%.mod.fc: $(m4support) %.fc
|
|
$(verbose) $(M4) $(M4PARAM) $^ > $@
|
|
|
|
%.pp: tmp/%.mod tmp/%.mod.fc
|
|
@echo "Creating $(NAME) $(@F) policy package"
|
|
$(verbose) $(SEMOD_PKG) -o $@ -m $< -f $<.fc
|
|
|
|
tmp/all_interfaces.conf: $(m4support) $(all_interfaces) $(detected_ifs)
|
|
@test -d tmp || mkdir -p tmp
|
|
$(verbose) m4 $^ | sed -e s/dollarsstar/\$$\*/g > $@
|
|
|
|
# so users dont have to make empty .fc and .if files
|
|
$(detected_ifs) $(detected_fcs):
|
|
@touch $@
|
|
|
|
########################################
|
|
#
|
|
# Documentation generation
|
|
#
|
|
|
|
$(clayerxml): %.xml: $(cmodxml) $(hmodxml) $(cmetaxml)
|
|
@test -d tmp || mkdir -p tmp
|
|
$(verbose) echo '<layer name="$(*F)">' > $@
|
|
$(verbose) cat $(addprefix $(HEADERDIR)/, $(notdir $*)/$(metaxml)) >> $@;
|
|
$(verbose) cat $(filter $(addprefix $(CURDIR)/, $(notdir $*))/%, $(cmodxml)) >> $@
|
|
$(verbose) cat $(filter-out $(addprefix $(HEADERDIR)/, $(notdir $*))/$(metaxml), $(filter $(addprefix $(HEADERDIR)/, $(notdir $*))/%, $(hmodxml))) >> $@
|
|
$(verbose) echo '</layer>' >> $@
|
|
|
|
$(hlayerxml): %.xml: $(hmodxml) $(hmetaxml)
|
|
@test -d tmp || mkdir -p tmp
|
|
$(verbose) echo '<layer name="$(*F)">' > $@
|
|
$(verbose) cat $(addprefix $(HEADERDIR)/, $(notdir $*)/$(metaxml)) >> $@;
|
|
$(verbose) cat $(filter-out $(addprefix $(HEADERDIR)/, $(notdir $*))/$(metaxml), $(filter $(addprefix $(HEADERDIR)/, $(notdir $*))/%, $(hmodxml))) >> $@
|
|
$(verbose) echo '</layer>' >> $@
|
|
|
|
$(cmodxml) $(modxml): %.xml: %.if %.te
|
|
$(verbose) $(genxml) -w -m $* > $@
|
|
|
|
$(layerxml): %.xml: $(modxml)
|
|
@test -d tmp || mkdir -p tmp
|
|
$(verbose) echo '<layer name="$(*F)">' > $@
|
|
$(verbose) if test -f '$(metaxml)'; then \
|
|
cat $(metaxml) >> $@; \
|
|
else \
|
|
echo '<summary>This is all third-party generated modules.</summary>' >> $@; \
|
|
fi
|
|
$(verbose) cat $(filter-out %/$(metaxml), $^) >> $@
|
|
$(verbose) echo '</layer>' >> $@
|
|
|
|
$(polxml): $(clayerxml) $(hlayerxml) $(layerxml) $(globaltun) $(globalbool)
|
|
@echo "Creating $(@F)"
|
|
@test -d $(dir $(polxml)) || mkdir -p $(dir $(polxml))
|
|
$(verbose) echo '<?xml version="1.0" encoding="ISO-8859-1" standalone="no"?>' > $@
|
|
$(verbose) echo '<!DOCTYPE policy SYSTEM "$(notdir $(xmldtd))">' >> $@
|
|
$(verbose) echo '<policy>' >> $@
|
|
$(verbose) cat $(sort $(clayerxml) $(hlayerxml) $(layerxml)) $(globaltun) $(globalbool) >> $@
|
|
$(verbose) echo '</policy>' >> $@
|
|
$(verbose) if test -x $(XMLLINT) && test -f $(xmldtd); then \
|
|
$(XMLLINT) --noout --path $(dir $(xmldtd)) --dtdvalid $(xmldtd) $@ ;\
|
|
fi
|
|
|
|
########################################
|
|
#
|
|
# Clean the environment
|
|
#
|
|
|
|
clean:
|
|
rm -fR tmp
|
|
rm -f *.pp
|