1# Copyright (c) 2021-2023 北京万里红科技有限公司 2# 3# Licensed under the Apache License, Version 2.0 (the "License"); 4# you may not use this file except in compliance with the License. 5# You may obtain a copy of the License at 6# 7# http://www.apache.org/licenses/LICENSE-2.0 8# 9# Unless required by applicable law or agreed to in writing, software 10# distributed under the License is distributed on an "AS IS" BASIS, 11# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12# See the License for the specific language governing permissions and 13# limitations under the License. 14 15import("//build/ohos.gni") 16import("selinux.gni") 17 18startup_init_with_param_base = false 19if (!use_musl) { 20 startup_init_with_param_base = true 21} 22 23special_build_selinux_gni_exist = 24 selinux_adapter_special_build_selinux_gni_path != "" && 25 exec_script("/bin/sh", 26 [ 27 "-c", 28 "if [ -f " + rebase_path( 29 selinux_adapter_special_build_selinux_gni_path) + 30 " ]; then echo true; else echo false; fi", 31 ], 32 "value") 33if (special_build_selinux_gni_exist) { 34 import(selinux_adapter_special_build_selinux_gni_path) 35} 36 37config("selinux_core_config") { 38 include_dirs = [ "interfaces/policycoreutils/include" ] 39} 40 41ohos_shared_library("libload_policy") { 42 output_name = "libload_policy" 43 sources = [ "framework/policycoreutils/src/load_policy.cpp" ] 44 include_dirs = [ "interfaces/policycoreutils/include" ] 45 deps = [ ":libselinux_klog_static" ] 46 external_deps = [ "selinux:libselinux" ] 47 cflags = [ 48 "-D_GNU_SOURCE", 49 "-Wall", 50 "-Werror", 51 ] 52 if (is_emulator) { 53 cflags += [ "-DEMULATOR_MODE" ] 54 } 55 if (selinux_adapter_support_developer_mode) { 56 cflags += [ "-DWITH_DEVELOPER" ] 57 } 58 install_enable = true 59 install_images = [ 60 "system", 61 "ramdisk", 62 "updater", 63 ] 64 license_file = "LICENSE" 65 part_name = "selinux_adapter" 66 subsystem_name = "security" 67} 68 69ohos_shared_library("librestorecon") { 70 branch_protector_ret = "pac_ret" 71 72 output_name = "librestorecon" 73 sources = [ "framework/policycoreutils/src/selinux_restorecon.c" ] 74 public_configs = [ ":selinux_core_config" ] 75 deps = [ ":libselinux_hilog_static" ] 76 external_deps = [ "hilog:libhilog" ] 77 78 public_external_deps = [ "selinux:libselinux" ] 79 80 cflags = [ 81 "-D_GNU_SOURCE", 82 "-Wall", 83 "-Werror", 84 ] 85 install_enable = true 86 install_images = [ 87 "system", 88 "ramdisk", 89 "updater", 90 ] 91 innerapi_tags = [ "platformsdk_indirect" ] 92 license_file = "LICENSE" 93 part_name = "selinux_adapter" 94 subsystem_name = "security" 95} 96 97ohos_static_library("libselinux_hilog_real_static") { 98 output_name = "libselinux_hilog_real_static" 99 sources = [ "framework/policycoreutils/src/selinux_log.c" ] 100 include_dirs = [ "interfaces/policycoreutils/include" ] 101 external_deps = [ 102 "bounds_checking_function:libsec_static", 103 "hilog:libhilog_base", 104 ] 105 cflags = [ 106 "-D_GNU_SOURCE", 107 "-Wall", 108 "-Werror", 109 ] 110 part_name = "selinux_adapter" 111 subsystem_name = "security" 112} 113 114ohos_static_library("librestorecon_static") { 115 output_name = "librestorecon_static" 116 sources = [ "framework/policycoreutils/src/selinux_restorecon.c" ] 117 public_configs = [ ":selinux_core_config" ] 118 deps = [ ":libselinux_hilog_real_static" ] 119 external_deps = [ "hilog:libhilog_base" ] 120 121 public_external_deps = [ "selinux:libselinux_static" ] 122 123 cflags = [ 124 "-D_GNU_SOURCE", 125 "-Wall", 126 "-Werror", 127 ] 128 license_file = "LICENSE" 129 part_name = "selinux_adapter" 130 subsystem_name = "security" 131} 132 133ohos_shared_library("libhap_restorecon") { 134 output_name = "libhap_restorecon" 135 sources = [ 136 "framework/policycoreutils/src/hap_restorecon.cpp", 137 "framework/policycoreutils/src/sehap_contexts_trie.cpp", 138 ] 139 public_configs = [ ":selinux_core_config" ] 140 deps = [ 141 ":libselinux_error_static", 142 ":libselinux_hilog_static", 143 ] 144 external_deps = [ "hilog:libhilog" ] 145 146 public_external_deps = [ "selinux:libselinux" ] 147 148 cflags = [ 149 "-D_GNU_SOURCE", 150 "-Wall", 151 "-Werror", 152 ] 153 install_enable = true 154 license_file = "LICENSE" 155 part_name = "selinux_adapter" 156 subsystem_name = "security" 157} 158 159ohos_static_library("libselinux_error_static") { 160 output_name = "libselinux_error_static" 161 sources = [ "framework/policycoreutils/src/selinux_error.cpp" ] 162 include_dirs = [ "interfaces/policycoreutils/include" ] 163 cflags = [ 164 "-D_GNU_SOURCE", 165 "-w", 166 ] 167 part_name = "selinux_adapter" 168 subsystem_name = "security" 169} 170 171ohos_static_library("libselinux_klog_static") { 172 output_name = "libselinux_klog_static" 173 sources = [ "framework/policycoreutils/src/selinux_klog.c" ] 174 include_dirs = [ "interfaces/policycoreutils/include" ] 175 external_deps = [ "bounds_checking_function:libsec_shared" ] 176 cflags = [ 177 "-D_GNU_SOURCE", 178 "-Wall", 179 "-Werror", 180 ] 181 part_name = "selinux_adapter" 182 subsystem_name = "security" 183} 184 185ohos_static_library("libselinux_hilog_static") { 186 branch_protector_ret = "pac_ret" 187 188 output_name = "libselinux_hilog_static" 189 sources = [ "framework/policycoreutils/src/selinux_log.c" ] 190 include_dirs = [ "interfaces/policycoreutils/include" ] 191 external_deps = [ 192 "bounds_checking_function:libsec_shared", 193 "hilog:libhilog", 194 ] 195 cflags = [ 196 "-D_GNU_SOURCE", 197 "-Wall", 198 "-Werror", 199 ] 200 part_name = "selinux_adapter" 201 subsystem_name = "security" 202} 203 204if (!startup_init_with_param_base) { 205 inherited_configs = [ 206 "$BUILD_CONFIG_DIR/compiler:afdo", 207 "$BUILD_CONFIG_DIR/compiler:afdo_optimize_size", 208 "$BUILD_CONFIG_DIR/compiler:compiler", 209 "$BUILD_CONFIG_DIR/compiler:compiler_arm_fpu", 210 "$BUILD_CONFIG_DIR/compiler:compiler_arm_thumb", 211 "$BUILD_CONFIG_DIR/compiler:chromium_code", 212 "$BUILD_CONFIG_DIR/compiler:default_include_dirs", 213 "$BUILD_CONFIG_DIR/compiler:default_optimization", 214 "$BUILD_CONFIG_DIR/compiler:default_stack_frames", 215 "$BUILD_CONFIG_DIR/compiler:default_symbols", 216 "$BUILD_CONFIG_DIR/compiler:export_dynamic", 217 "$BUILD_CONFIG_DIR/compiler:no_exceptions", 218 "$BUILD_CONFIG_DIR/compiler:no_rtti", 219 "$BUILD_CONFIG_DIR/compiler:runtime_library", 220 "$BUILD_CONFIG_DIR/compiler:thin_archive", 221 "$BUILD_CONFIG_DIR/sanitizers:default_sanitizer_flags", 222 ] 223} 224 225static_library("libselinux_parameter_static") { 226 output_name = "libselinux_parameter_static" 227 sources = [ 228 "framework/policycoreutils/src/contexts_trie.c", 229 "framework/policycoreutils/src/selinux_map.c", 230 "framework/policycoreutils/src/selinux_parameter.c", 231 "framework/policycoreutils/src/selinux_share_mem.c", 232 ] 233 public_configs = [ ":selinux_core_config" ] 234 include_dirs = [ "interfaces/policycoreutils/include" ] 235 cflags = [ 236 "-D_GNU_SOURCE", 237 "-Wall", 238 "-Werror", 239 ] 240 if (!startup_init_with_param_base) { 241 ldflags = [ "-nostdlib" ] 242 configs -= inherited_configs 243 configs += [ "$BUILD_CONFIG_DIR/compiler:compiler" ] 244 } 245} 246 247ohos_shared_library("libparaperm_checker") { 248 output_name = "libparaperm_checker" 249 sources = [ "framework/policycoreutils/src/param_checker.c" ] 250 public_configs = [ ":selinux_core_config" ] 251 deps = [ ":libselinux_klog_static" ] 252 deps += [ ":libselinux_parameter_static" ] 253 external_deps = [ "bounds_checking_function:libsec_shared" ] 254 public_external_deps = [ "selinux:libselinux" ] 255 256 cflags = [ 257 "-D_GNU_SOURCE", 258 "-Wall", 259 "-Werror", 260 ] 261 install_images = [ 262 "system", 263 "updater", 264 ] 265 part_name = "selinux_adapter" 266 subsystem_name = "security" 267} 268 269ohos_shared_library("libservice_checker") { 270 output_name = "libservice_checker" 271 sources = [ "framework/policycoreutils/src/service_checker.cpp" ] 272 public_configs = [ ":selinux_core_config" ] 273 deps = [ 274 ":libselinux_error_static", 275 ":libselinux_hilog_static", 276 ] 277 external_deps = [ 278 "bounds_checking_function:libsec_shared", 279 "hilog:libhilog", 280 ] 281 public_external_deps = [ "selinux:libselinux" ] 282 cflags = [ 283 "-D_GNU_SOURCE", 284 "-Wall", 285 "-Werror", 286 ] 287 innerapi_tags = [ "chipsetsdk" ] 288 part_name = "selinux_adapter" 289 subsystem_name = "security" 290} 291 292ohos_executable("load_policy") { 293 install_enable = true 294 sources = [ "framework/tools/load_policy/load_policy.c" ] 295 include_dirs = [ "interfaces/policycoreutils/include" ] 296 deps = [ ":libload_policy" ] 297 cflags = [ 298 "-D_GNU_SOURCE", 299 "-Wall", 300 "-Werror", 301 ] 302 license_file = "LICENSE" 303 part_name = "selinux_adapter" 304 subsystem_name = "security" 305 install_images = [ 306 "system", 307 "updater", 308 ] 309} 310 311ohos_executable("restorecon") { 312 install_enable = true 313 sources = [ "framework/tools/restorecon/restorecon.c" ] 314 include_dirs = [ "interfaces/policycoreutils/include" ] 315 deps = [ ":librestorecon" ] 316 external_deps = [ 317 "bounds_checking_function:libsec_shared", 318 "selinux:libselinux", 319 ] 320 cflags = [ 321 "-D_GNU_SOURCE", 322 "-Wall", 323 "-Werror", 324 ] 325 license_file = "LICENSE" 326 part_name = "selinux_adapter" 327 subsystem_name = "security" 328 install_images = [ 329 "system", 330 "updater", 331 ] 332} 333 334ohos_executable("hap_restorecon") { 335 install_enable = false 336 sources = [ "framework/tools/hap_restorecon/test.cpp" ] 337 include_dirs = [ "interfaces/policycoreutils/include" ] 338 deps = [ 339 ":libhap_restorecon", 340 ":libselinux_error_static", 341 ] 342 cflags = [ 343 "-D_GNU_SOURCE", 344 "-Wall", 345 "-Werror", 346 ] 347 external_deps = [ "selinux:libselinux" ] 348 license_file = "LICENSE" 349 part_name = "selinux_adapter" 350 subsystem_name = "security" 351} 352 353ohos_executable("param_check") { 354 install_enable = false 355 sources = [ "framework/tools/param_check/test.cpp" ] 356 include_dirs = [ "interfaces/policycoreutils/include" ] 357 deps = [ 358 ":libparaperm_checker", 359 ":libselinux_error_static", 360 ":libselinux_parameter_static", 361 ] 362 external_deps = [ 363 "pcre2:libpcre2", 364 "selinux:libselinux", 365 ] 366 if (startup_init_with_param_base) { 367 deps += [ ":libselinux_parameter_static" ] 368 } 369 cflags = [ 370 "-D_GNU_SOURCE", 371 "-DTIME_DISPLAY", 372 "-Wall", 373 "-Werror", 374 ] 375 license_file = "LICENSE" 376 part_name = "selinux_adapter" 377 subsystem_name = "security" 378} 379 380ohos_executable("service_check") { 381 install_enable = false 382 sources = [ "framework/tools/service_check/test.cpp" ] 383 include_dirs = [ "interfaces/policycoreutils/include" ] 384 deps = [ 385 ":libselinux_error_static", 386 ":libservice_checker", 387 ] 388 cflags = [ 389 "-D_GNU_SOURCE", 390 "-Wall", 391 "-Werror", 392 ] 393 license_file = "LICENSE" 394 part_name = "selinux_adapter" 395 subsystem_name = "security" 396} 397 398debug_version = "disable" 399updater_version = "disable" 400 401action("build_policy") { 402 if (build_variant == "user") { 403 debug_version = "disable" 404 } else if (build_variant == "root") { 405 debug_version = "enable" 406 } else { 407 debug_version = "enable" 408 } 409 410 updater_version = "disable" 411 412 inputs = exec_script("//build/scripts/find.py", 413 [ rebase_path("sepolicy") ], 414 "list lines") 415 if (selinux_adapter_build_path != "default") { 416 foreach(src, string_split(selinux_adapter_build_path, ":")) { 417 src = "//" + src 418 inputs += exec_script("//build/scripts/find.py", 419 [ rebase_path(src) ], 420 "list lines") 421 } 422 if (special_build_selinux_gni_exist && 423 selinux_build_path_ext != "default") { 424 selinux_adapter_build_path = 425 selinux_adapter_build_path + ":" + selinux_build_path_ext 426 } 427 } else { 428 selinux_adapter_build_path = 429 selinux_adapter_build_path + ":" + OHOS_PRODUCT_DIR 430 } 431 432 if (selinux_adapter_special_build_policy_script != "default") { 433 script = selinux_adapter_special_build_policy_script 434 } else { 435 script = "scripts/build_policy.py" 436 } 437 438 args = [ 439 "--dst-file", 440 rebase_path(target_out_dir + "/policy.31"), 441 "--tool-path", 442 rebase_path(root_build_dir + "/clang_${host_cpu}/thirdparty/selinux/"), 443 "--source-root-dir", 444 rebase_path("//"), 445 "--policy_dir_list", 446 selinux_adapter_build_path, 447 "--debug-version", 448 debug_version, 449 "--updater-version", 450 updater_version, 451 "--components", 452 selinux_adapter_components, 453 ] 454 455 if (selinux_adapter_components != "default") { 456 args += [ 457 "--vendor-policy-version", 458 "$selinux_adapter_vendor_policy_version", 459 ] 460 } 461 462 if (selinux_adapter_extra_args != "default") { 463 foreach(arg, string_split(selinux_adapter_extra_args, " ")) { 464 args += [ arg ] 465 } 466 } 467 468 external_deps = [ 469 "selinux:checkpolicy($host_toolchain)", 470 "selinux:secilc($host_toolchain)", 471 ] 472 outputs = [ 473 target_out_dir + "/policy.31", 474 target_out_dir + "/user_policy", 475 target_out_dir + "/vendor.cil", 476 target_out_dir + "/prebuild_sepolicy.system.cil.sha256", 477 target_out_dir + "/system.cil", 478 target_out_dir + "/system.cil.sha256", 479 target_out_dir + "/compatible/$selinux_adapter_vendor_policy_version.cil", 480 target_out_dir + "/compatible", 481 target_out_dir + "/version", 482 target_out_dir + "/public.cil", 483 ] 484 485 outputs += [ 486 target_out_dir + "/developer/prebuild_sepolicy.system.cil.sha256", 487 target_out_dir + "/developer/system.cil.sha256", 488 target_out_dir + 489 "/developer/compatible/$selinux_adapter_vendor_policy_version.cil", 490 target_out_dir + "/developer/compatible", 491 target_out_dir + "/developer/developer_policy", 492 target_out_dir + "/developer/policy.31", 493 target_out_dir + "/developer/vendor.cil", 494 target_out_dir + "/developer/system.cil", 495 target_out_dir + "/developer/public.cil", 496 ] 497 498 if (selinux_adapter_components != "default") { 499 outputs += [ 500 target_out_dir + "/system_common.cil", 501 target_out_dir + "/vendor_common.cil", 502 target_out_dir + "/public_common.cil", 503 ] 504 } 505} 506 507action("build_update_policy") { 508 if (build_variant == "user") { 509 debug_version = "disable" 510 } else if (build_variant == "root") { 511 debug_version = "enable" 512 } else { 513 debug_version = "enable" 514 } 515 516 updater_version = "enable" 517 selinux_adapter_components = "default" 518 inputs = exec_script("//build/scripts/find.py", 519 [ rebase_path("sepolicy") ], 520 "list lines") 521 if (selinux_adapter_build_path != "default") { 522 foreach(src, string_split(selinux_adapter_build_path, ":")) { 523 src = "//" + src 524 inputs += exec_script("//build/scripts/find.py", 525 [ rebase_path(src) ], 526 "list lines") 527 } 528 if (special_build_selinux_gni_exist && 529 selinux_build_path_ext_updater != "default") { 530 selinux_adapter_build_path = 531 selinux_adapter_build_path + ":" + selinux_build_path_ext_updater 532 } 533 } else { 534 selinux_adapter_build_path = 535 selinux_adapter_build_path + ":" + OHOS_PRODUCT_DIR 536 } 537 538 if (selinux_adapter_special_build_policy_script != "default") { 539 script = selinux_adapter_special_build_policy_script 540 } else { 541 script = "scripts/build_policy.py" 542 } 543 544 args = [ 545 "--dst-file", 546 rebase_path(target_out_dir + "/updater/policy.31"), 547 "--tool-path", 548 rebase_path(root_build_dir + "/clang_${host_cpu}/thirdparty/selinux/"), 549 "--source-root-dir", 550 rebase_path("//"), 551 "--policy_dir_list", 552 selinux_adapter_build_path, 553 "--debug-version", 554 debug_version, 555 "--updater-version", 556 updater_version, 557 "--components", 558 selinux_adapter_components, 559 ] 560 561 if (selinux_adapter_extra_args != "default") { 562 foreach(arg, string_split(selinux_adapter_extra_args, " ")) { 563 args += [ arg ] 564 } 565 } 566 567 external_deps = [ 568 "selinux:checkpolicy($host_toolchain)", 569 "selinux:secilc($host_toolchain)", 570 ] 571 outputs = [ target_out_dir + "/updater/policy.31" ] 572} 573 574action("build_contexts") { 575 inputs = exec_script("//build/scripts/find.py", 576 [ rebase_path("sepolicy") ], 577 "list lines") 578 if (selinux_adapter_build_path != "default") { 579 foreach(src, string_split(selinux_adapter_build_path, ":")) { 580 src = "//" + src 581 inputs += exec_script("//build/scripts/find.py", 582 [ rebase_path(src) ], 583 "list lines") 584 } 585 if (special_build_selinux_gni_exist && 586 selinux_build_path_ext != "default") { 587 selinux_adapter_build_path = 588 selinux_adapter_build_path + ":" + selinux_build_path_ext 589 } 590 } else { 591 selinux_adapter_build_path = 592 selinux_adapter_build_path + ":" + OHOS_PRODUCT_DIR 593 } 594 595 if (selinux_adapter_special_build_contexts_script != "default") { 596 script = selinux_adapter_special_build_contexts_script 597 } else { 598 script = "scripts/build_contexts.py" 599 } 600 args = [ 601 "--dst-dir", 602 rebase_path(target_out_dir + "/"), 603 "--tool-path", 604 rebase_path(root_build_dir + "/clang_${host_cpu}/thirdparty/selinux/"), 605 "--policy-file", 606 rebase_path(target_out_dir + "/policy.31"), 607 "--source-root-dir", 608 rebase_path("//"), 609 "--policy_dir_list", 610 selinux_adapter_build_path, 611 "--components", 612 selinux_adapter_components, 613 ] 614 if (selinux_adapter_contexts_extra_args != "default") { 615 foreach(arg, string_split(selinux_adapter_contexts_extra_args, " ")) { 616 args += [ arg ] 617 } 618 } 619 deps = [ ":build_policy" ] 620 external_deps = [ "selinux:sefcontext_compile($host_toolchain)" ] 621 outputs = [ 622 target_out_dir + "/file_contexts.bin", 623 target_out_dir + "/file_contexts", 624 target_out_dir + "/sehap_contexts", 625 target_out_dir + "/service_contexts", 626 target_out_dir + "/hdf_service_contexts", 627 target_out_dir + "/parameter_contexts", 628 ] 629} 630 631action("build_ignore_cfg") { 632 inputs = exec_script("//build/scripts/find.py", 633 [ rebase_path("sepolicy") ], 634 "list lines") 635 if (selinux_adapter_build_path != "default") { 636 foreach(src, string_split(selinux_adapter_build_path, ":")) { 637 src = "//" + src 638 inputs += exec_script("//build/scripts/find.py", 639 [ rebase_path(src) ], 640 "list lines") 641 } 642 if (special_build_selinux_gni_exist && 643 selinux_build_path_ext != "default") { 644 selinux_adapter_build_path = 645 selinux_adapter_build_path + ":" + selinux_build_path_ext 646 } 647 } else { 648 selinux_adapter_build_path = 649 selinux_adapter_build_path + ":" + OHOS_PRODUCT_DIR 650 } 651 652 if (special_build_ignore_cfg != "default") { 653 script = special_build_ignore_cfg 654 } else { 655 script = "scripts/build_ignore_cfg.py" 656 } 657 args = [ 658 "--dst-dir", 659 rebase_path(target_out_dir + "/"), 660 "--source-root-dir", 661 rebase_path("//"), 662 "--policy-dir-list", 663 selinux_adapter_build_path, 664 "--components", 665 selinux_adapter_components, 666 ] 667 outputs = [ target_out_dir + "/ignore_cfg" ] 668} 669 670action("build_updater_contexts") { 671 inputs = exec_script("//build/scripts/find.py", 672 [ rebase_path("sepolicy") ], 673 "list lines") 674 if (selinux_adapter_build_path != "default") { 675 foreach(src, string_split(selinux_adapter_build_path, ":")) { 676 src = "//" + src 677 inputs += exec_script("//build/scripts/find.py", 678 [ rebase_path(src) ], 679 "list lines") 680 } 681 if (special_build_selinux_gni_exist && 682 selinux_build_path_ext_updater != "default") { 683 selinux_adapter_build_path = 684 selinux_adapter_build_path + ":" + selinux_build_path_ext_updater 685 } 686 } else { 687 selinux_adapter_build_path = 688 selinux_adapter_build_path + ":" + OHOS_PRODUCT_DIR 689 } 690 691 if (selinux_adapter_special_build_contexts_script != "default") { 692 script = selinux_adapter_special_build_contexts_script 693 } else { 694 script = "scripts/build_contexts.py" 695 } 696 args = [ 697 "--dst-dir", 698 rebase_path(target_out_dir + "/updater"), 699 "--tool-path", 700 rebase_path(root_build_dir + "/clang_${host_cpu}/thirdparty/selinux/"), 701 "--policy-file", 702 rebase_path(target_out_dir + "/updater/policy.31"), 703 "--source-root-dir", 704 rebase_path("//"), 705 "--policy_dir_list", 706 selinux_adapter_build_path, 707 "--components", 708 selinux_adapter_components, 709 ] 710 if (selinux_adapter_contexts_extra_args != "default") { 711 foreach(arg, string_split(selinux_adapter_contexts_extra_args, " ")) { 712 args += [ arg ] 713 } 714 } 715 deps = [ ":build_update_policy" ] 716 external_deps = [ "selinux:sefcontext_compile($host_toolchain)" ] 717 outputs = [ 718 target_out_dir + "/updater/file_contexts.bin", 719 target_out_dir + "/updater/file_contexts", 720 target_out_dir + "/updater/sehap_contexts", 721 target_out_dir + "/updater/service_contexts", 722 target_out_dir + "/updater/hdf_service_contexts", 723 target_out_dir + "/updater/parameter_contexts", 724 ] 725} 726 727action("selinux_check") { 728 script = "scripts/selinux_check/selinux_check_main.py" 729 730 if (selinux_adapter_build_path == "default") { 731 selinux_adapter_build_path = 732 selinux_adapter_build_path + ":" + OHOS_PRODUCT_DIR 733 } 734 735 if (selinux_adapter_check_extend_list != "default") { 736 selinux_adapter_build_path = 737 selinux_adapter_build_path + ":" + selinux_adapter_check_extend_list 738 } 739 740 args = [ 741 "--output-path", 742 rebase_path(target_out_dir), 743 "--source-root-dir", 744 rebase_path("//"), 745 "--user-policy", 746 rebase_path(target_out_dir + "/user_policy"), 747 "--developer-policy", 748 rebase_path(target_out_dir + "/developer/developer_policy"), 749 "--tool-path", 750 rebase_path(root_build_dir + "/clang_${host_cpu}/thirdparty/selinux/"), 751 "--policy-dir-list", 752 selinux_adapter_build_path, 753 ] 754 755 if (special_selinux_check_config != "default") { 756 args += [ 757 "--selinux-check-config", 758 special_selinux_check_config, 759 ] 760 } else { 761 args += [ 762 "--selinux-check-config", 763 "base/security/selinux_adapter/scripts/selinux_check/config/selinux_check.json", 764 ] 765 } 766 767 outputs = [ "$target_out_dir" ] 768 769 deps = [ 770 ":build_contexts", 771 ":build_policy", 772 ] 773} 774 775copy("selinux_config") { 776 if (selinux_adapter_enforce) { 777 sources = [ "config/config.enforce" ] 778 } else { 779 sources = [ "config/config.permissive" ] 780 } 781 outputs = [ "$target_out_dir/config" ] 782} 783 784copy("updater_selinux_config") { 785 sources = [ "config/config.enforce" ] 786 outputs = [ "$target_out_dir/updater/config" ] 787} 788 789ohos_prebuilt_etc("build_sepolicy") { 790 deps = [ ":build_policy" ] 791 source = target_out_dir + "/policy.31" 792 license_file = "LICENSE" 793 part_name = "selinux_adapter" 794 subsystem_name = "security" 795 if (selinux_adapter_components == "vendor") { 796 relative_install_dir = "selinux/prebuild_sepolicy/" 797 install_images = [ "vendor" ] 798 } else if (selinux_adapter_components == "default") { 799 if (!selinux_adapter_support_developer_mode) { 800 source = target_out_dir + "/developer/policy.31" 801 } 802 relative_install_dir = "selinux/targeted/policy/" 803 install_images = [ "system" ] 804 } 805} 806 807ohos_prebuilt_etc("build_updater_sepolicy") { 808 deps = [ ":build_update_policy" ] 809 source = target_out_dir + "/updater/policy.31" 810 license_file = "LICENSE" 811 part_name = "selinux_adapter" 812 subsystem_name = "security" 813 relative_install_dir = "selinux/targeted/policy/" 814 install_images = [ "updater" ] 815} 816 817ohos_prebuilt_etc("selinux_version") { 818 deps = [ ":build_policy" ] 819 source = target_out_dir + "/version" 820 license_file = "LICENSE" 821 part_name = "selinux_adapter" 822 subsystem_name = "security" 823 relative_install_dir = "selinux/" 824 install_images = [ "vendor" ] 825} 826 827ohos_prebuilt_etc("config") { 828 deps = [ ":selinux_config" ] 829 source = target_out_dir + "/config" 830 license_file = "LICENSE" 831 part_name = "selinux_adapter" 832 subsystem_name = "security" 833 relative_install_dir = "selinux/" 834 install_images = [ "system" ] 835} 836 837ohos_prebuilt_etc("updater_config") { 838 deps = [ ":updater_selinux_config" ] 839 source = target_out_dir + "/updater/config" 840 license_file = "LICENSE" 841 part_name = "selinux_adapter" 842 subsystem_name = "security" 843 relative_install_dir = "selinux/" 844 install_images = [ "updater" ] 845} 846 847ohos_prebuilt_etc("sehap_contexts") { 848 deps = [ ":build_contexts" ] 849 source = target_out_dir + "/sehap_contexts" 850 license_file = "LICENSE" 851 part_name = "selinux_adapter" 852 subsystem_name = "security" 853 relative_install_dir = "selinux/targeted/contexts/" 854} 855 856ohos_prebuilt_etc("parameter_contexts") { 857 deps = [ ":build_contexts" ] 858 source = target_out_dir + "/parameter_contexts" 859 license_file = "LICENSE" 860 part_name = "selinux_adapter" 861 subsystem_name = "security" 862 relative_install_dir = "selinux/targeted/contexts/" 863 if (selinux_adapter_components == "vendor") { 864 install_images = [ "vendor" ] 865 } else { 866 install_images = [ 867 "system", 868 "updater", 869 ] 870 } 871} 872 873ohos_prebuilt_etc("service_contexts") { 874 deps = [ ":build_contexts" ] 875 source = target_out_dir + "/service_contexts" 876 license_file = "LICENSE" 877 part_name = "selinux_adapter" 878 subsystem_name = "security" 879 relative_install_dir = "selinux/targeted/contexts/" 880 if (selinux_adapter_components == "vendor") { 881 install_images = [ "vendor" ] 882 } else { 883 install_images = [ "system" ] 884 } 885} 886 887ohos_prebuilt_etc("hdf_service_contexts") { 888 deps = [ ":build_contexts" ] 889 source = target_out_dir + "/hdf_service_contexts" 890 license_file = "LICENSE" 891 part_name = "selinux_adapter" 892 subsystem_name = "security" 893 relative_install_dir = "selinux/targeted/contexts/" 894 if (selinux_adapter_components == "vendor") { 895 install_images = [ "vendor" ] 896 } else { 897 install_images = [ "system" ] 898 } 899} 900 901ohos_prebuilt_etc("file_contexts") { 902 deps = [ ":build_contexts" ] 903 source = target_out_dir + "/file_contexts" 904 license_file = "LICENSE" 905 part_name = "selinux_adapter" 906 subsystem_name = "security" 907 relative_install_dir = "selinux/targeted/contexts/" 908 if (selinux_adapter_components == "vendor") { 909 install_images = [ "vendor" ] 910 } else { 911 install_images = [ "system" ] 912 } 913} 914 915ohos_prebuilt_etc("ignore_cfg") { 916 deps = [ ":build_ignore_cfg" ] 917 source = target_out_dir + "/ignore_cfg" 918 license_file = "LICENSE" 919 part_name = "selinux_adapter" 920 subsystem_name = "security" 921 relative_install_dir = "selinux/" 922 if (selinux_adapter_components == "vendor") { 923 install_images = [ "vendor" ] 924 } else { 925 install_images = [ "system" ] 926 } 927} 928 929ohos_prebuilt_etc("file_contexts_updater") { 930 deps = [ ":build_updater_contexts" ] 931 source = target_out_dir + "/updater/file_contexts" 932 license_file = "LICENSE" 933 part_name = "selinux_adapter" 934 subsystem_name = "security" 935 relative_install_dir = "selinux/targeted/contexts/" 936 if (selinux_adapter_components == "vendor") { 937 install_images = [ "updater_vendor" ] 938 } else { 939 install_images = [ "updater" ] 940 } 941} 942 943ohos_prebuilt_etc("vendor_cil") { 944 deps = [ ":build_policy" ] 945 source = target_out_dir + "/vendor.cil" 946 license_file = "LICENSE" 947 part_name = "selinux_adapter" 948 subsystem_name = "security" 949 relative_install_dir = "selinux/" 950 install_images = [ "vendor" ] 951} 952 953if (selinux_adapter_components == "vendor") { 954 ohos_prebuilt_etc("vendor_common_cil") { 955 deps = [ ":build_policy" ] 956 source = target_out_dir + "/vendor_common.cil" 957 license_file = "LICENSE" 958 part_name = "selinux_adapter" 959 subsystem_name = "security" 960 relative_install_dir = "selinux/" 961 install_images = [ "vendor" ] 962 } 963} 964 965ohos_prebuilt_etc("public_cil") { 966 deps = [ ":build_policy" ] 967 source = target_out_dir + "/public.cil" 968 license_file = "LICENSE" 969 part_name = "selinux_adapter" 970 subsystem_name = "security" 971 relative_install_dir = "selinux/" 972 install_images = [ "vendor" ] 973} 974 975if (selinux_adapter_components == "vendor") { 976 ohos_prebuilt_etc("public_common_cil") { 977 deps = [ ":build_policy" ] 978 source = target_out_dir + "/public_common.cil" 979 license_file = "LICENSE" 980 part_name = "selinux_adapter" 981 subsystem_name = "security" 982 relative_install_dir = "selinux/" 983 install_images = [ "vendor" ] 984 } 985} 986 987ohos_prebuilt_etc("version_cil") { 988 deps = [ ":build_policy" ] 989 source = 990 target_out_dir + "/compatible/$selinux_adapter_vendor_policy_version.cil" 991 license_file = "LICENSE" 992 part_name = "selinux_adapter" 993 subsystem_name = "security" 994 relative_install_dir = "selinux/compatible/" 995 install_images = [ "system" ] 996} 997 998ohos_prebuilt_etc("prebuild_sepolicy_system_cil_sha256") { 999 deps = [ ":build_policy" ] 1000 source = target_out_dir + "/prebuild_sepolicy.system.cil.sha256" 1001 license_file = "LICENSE" 1002 part_name = "selinux_adapter" 1003 subsystem_name = "security" 1004 relative_install_dir = "selinux/" 1005 install_images = [ "vendor" ] 1006} 1007 1008ohos_prebuilt_etc("system_cil") { 1009 deps = [ ":build_policy" ] 1010 source = target_out_dir + "/system.cil" 1011 license_file = "LICENSE" 1012 part_name = "selinux_adapter" 1013 subsystem_name = "security" 1014 relative_install_dir = "selinux/" 1015 install_images = [ "system" ] 1016} 1017 1018if (selinux_adapter_components == "system") { 1019 ohos_prebuilt_etc("system_common_cil") { 1020 deps = [ ":build_policy" ] 1021 source = target_out_dir + "/system_common.cil" 1022 license_file = "LICENSE" 1023 part_name = "selinux_adapter" 1024 subsystem_name = "security" 1025 relative_install_dir = "selinux/" 1026 install_images = [ "system" ] 1027 } 1028} 1029 1030ohos_prebuilt_etc("system_cil_sha256") { 1031 deps = [ ":build_policy" ] 1032 source = target_out_dir + "/system.cil.sha256" 1033 license_file = "LICENSE" 1034 part_name = "selinux_adapter" 1035 subsystem_name = "security" 1036 relative_install_dir = "selinux/" 1037 install_images = [ "system" ] 1038} 1039 1040if (selinux_adapter_support_developer_mode) { 1041 ohos_prebuilt_etc("system_developer_cil") { 1042 deps = [ ":build_policy" ] 1043 source = target_out_dir + "/developer/system.cil" 1044 output = "system_developer.cil" 1045 license_file = "LICENSE" 1046 part_name = "selinux_adapter" 1047 subsystem_name = "security" 1048 relative_install_dir = "selinux/" 1049 install_images = [ "system" ] 1050 } 1051 1052 ohos_prebuilt_etc("vendor_developer_cil") { 1053 deps = [ ":build_policy" ] 1054 source = target_out_dir + "/developer/vendor.cil" 1055 output = "vendor_developer.cil" 1056 license_file = "LICENSE" 1057 part_name = "selinux_adapter" 1058 subsystem_name = "security" 1059 relative_install_dir = "selinux/" 1060 install_images = [ "vendor" ] 1061 } 1062 1063 ohos_prebuilt_etc("public_developer_cil") { 1064 deps = [ ":build_policy" ] 1065 source = target_out_dir + "/developer/public.cil" 1066 output = "public_developer.cil" 1067 license_file = "LICENSE" 1068 part_name = "selinux_adapter" 1069 subsystem_name = "security" 1070 relative_install_dir = "selinux/" 1071 install_images = [ "vendor" ] 1072 } 1073 1074 ohos_prebuilt_etc("version_developer_cil") { 1075 deps = [ ":build_policy" ] 1076 source = target_out_dir + 1077 "/developer/compatible/$selinux_adapter_vendor_policy_version.cil" 1078 license_file = "LICENSE" 1079 part_name = "selinux_adapter" 1080 subsystem_name = "security" 1081 relative_install_dir = "selinux/compatible_developer/" 1082 install_images = [ "system" ] 1083 } 1084 1085 ohos_prebuilt_etc("developer_policy") { 1086 deps = [ ":build_policy" ] 1087 source = target_out_dir + "/developer/policy.31" 1088 output = "developer_policy" 1089 license_file = "LICENSE" 1090 part_name = "selinux_adapter" 1091 subsystem_name = "security" 1092 if (selinux_adapter_components == "vendor") { 1093 relative_install_dir = "selinux/prebuild_sepolicy/" 1094 install_images = [ "vendor" ] 1095 } else if (selinux_adapter_components == "default") { 1096 relative_install_dir = "selinux/targeted/policy/" 1097 install_images = [ "system" ] 1098 } 1099 } 1100 1101 ohos_prebuilt_etc("prebuild_sepolicy_system_developer_cil_sha256") { 1102 deps = [ ":build_policy" ] 1103 source = target_out_dir + "/developer/prebuild_sepolicy.system.cil.sha256" 1104 output = "prebuild_sepolicy.system_developer.cil.sha256" 1105 license_file = "LICENSE" 1106 part_name = "selinux_adapter" 1107 subsystem_name = "security" 1108 relative_install_dir = "selinux/" 1109 install_images = [ "vendor" ] 1110 } 1111 1112 ohos_prebuilt_etc("system_developer_cil_sha256") { 1113 deps = [ ":build_policy" ] 1114 source = target_out_dir + "/developer/system.cil.sha256" 1115 output = "system_developer.cil.sha256" 1116 license_file = "LICENSE" 1117 part_name = "selinux_adapter" 1118 subsystem_name = "security" 1119 relative_install_dir = "selinux/" 1120 install_images = [ "system" ] 1121 } 1122} 1123 1124if (build_selinux && !ohos_indep_compiler_enable) { 1125 ohos_copy("libselinux_toolchain") { 1126 external_deps = [ "selinux:libselinux($host_toolchain)" ] 1127 sources = 1128 [ "$root_build_dir/clang_${host_cpu}/thirdparty/selinux/libselinux.so" ] 1129 outputs = 1130 [ "$root_build_dir/clang_${host_cpu}/security/selinux/libselinux.so" ] 1131 part_name = "selinux_adapter" 1132 subsystem_name = "security" 1133 } 1134 1135 ohos_copy("libpcre2_toolchain") { 1136 external_deps = [ "pcre2:libpcre2($host_toolchain)" ] 1137 sources = 1138 [ "$root_build_dir/clang_${host_cpu}/thirdparty/pcre2/libpcre2.so" ] 1139 outputs = 1140 [ "$root_build_dir/clang_${host_cpu}/security/selinux/libpcre2.so" ] 1141 part_name = "selinux_adapter" 1142 subsystem_name = "security" 1143 } 1144} 1145 1146ohos_copy("filecontexts_toolchain") { 1147 deps = [ ":build_contexts" ] 1148 sources = [ "$target_out_dir/file_contexts.bin" ] 1149 outputs = [ "$target_out_dir/../security/selinux/file_contexts.bin" ] 1150 part_name = "selinux_adapter" 1151 subsystem_name = "security" 1152} 1153 1154if (selinux_adapter_components != "default") { 1155 copy("eng_system_compatible") { 1156 deps = [ ":build_policy" ] 1157 sources = [ "$target_out_dir/compatible" ] 1158 outputs = [ "$root_out_dir/$eng_system_base_dir/etc/selinux/compatible" ] 1159 } 1160 1161 copy("eng_system_compatible_developer") { 1162 deps = [ ":build_policy" ] 1163 sources = [ "$target_out_dir/developer/compatible" ] 1164 outputs = [ 1165 "$root_out_dir/$eng_system_base_dir/etc/selinux/compatible_developer", 1166 ] 1167 } 1168 1169 copy("eng_system_system_cil") { 1170 deps = [ ":build_policy" ] 1171 sources = [ "$target_out_dir/system.cil" ] 1172 outputs = [ "$root_out_dir/$eng_system_base_dir/etc/selinux/system.cil" ] 1173 } 1174 1175 copy("eng_system_system_cil_sha256") { 1176 deps = [ ":build_policy" ] 1177 sources = [ "$target_out_dir/system.cil.sha256" ] 1178 outputs = 1179 [ "$root_out_dir/$eng_system_base_dir/etc/selinux/system.cil.sha256" ] 1180 } 1181 1182 copy("eng_system_system_common_cil") { 1183 deps = [ ":build_policy" ] 1184 sources = [ "$target_out_dir/system_common.cil" ] 1185 outputs = 1186 [ "$root_out_dir/$eng_system_base_dir/etc/selinux/system_common.cil" ] 1187 } 1188 1189 copy("eng_system_system_developer_cil") { 1190 deps = [ ":build_policy" ] 1191 sources = [ "$target_out_dir/developer/system.cil" ] 1192 outputs = [ 1193 "$root_out_dir/$eng_system_base_dir/etc/selinux/system_developer.cil", 1194 ] 1195 } 1196 1197 copy("eng_system_system_developer_cil_sha256") { 1198 deps = [ ":build_policy" ] 1199 sources = [ "$target_out_dir/developer/system.cil.sha256" ] 1200 outputs = [ "$root_out_dir/$eng_system_base_dir/etc/selinux/system_developer.cil.sha256" ] 1201 } 1202 1203 copy("eng_chipset_developer_policy") { 1204 deps = [ ":build_policy" ] 1205 sources = [ "$target_out_dir/developer/policy.31" ] 1206 outputs = [ "$root_out_dir/$eng_chipset_base_dir/etc/selinux/prebuild_sepolicy/developer_policy" ] 1207 } 1208 1209 copy("eng_chipset_policy") { 1210 deps = [ ":build_policy" ] 1211 sources = [ "$target_out_dir/policy.31" ] 1212 outputs = [ "$root_out_dir/$eng_chipset_base_dir/etc/selinux/prebuild_sepolicy/policy.31" ] 1213 } 1214 1215 copy("eng_chipset_system_cil_sha256") { 1216 deps = [ ":build_policy" ] 1217 sources = [ "$target_out_dir/prebuild_sepolicy.system.cil.sha256" ] 1218 outputs = [ "$root_out_dir/$eng_chipset_base_dir/etc/selinux/prebuild_sepolicy.system.cil.sha256" ] 1219 } 1220 1221 copy("eng_chipset_system_developer_cil_sha256") { 1222 deps = [ ":build_policy" ] 1223 sources = 1224 [ "$target_out_dir/developer/prebuild_sepolicy.system.cil.sha256" ] 1225 outputs = [ "$root_out_dir/$eng_chipset_base_dir/etc/selinux/prebuild_sepolicy.system_developer.cil.sha256" ] 1226 } 1227 1228 copy("eng_chipset_public_cil") { 1229 deps = [ ":build_policy" ] 1230 sources = [ "$target_out_dir/public.cil" ] 1231 outputs = [ "$root_out_dir/$eng_chipset_base_dir/etc/selinux/public.cil" ] 1232 } 1233 1234 copy("eng_chipset_public_common_cil") { 1235 deps = [ ":build_policy" ] 1236 sources = [ "$target_out_dir/public_common.cil" ] 1237 outputs = 1238 [ "$root_out_dir/$eng_chipset_base_dir/etc/selinux/public_common.cil" ] 1239 } 1240 1241 copy("eng_chipset_public_developer_cil") { 1242 deps = [ ":build_policy" ] 1243 sources = [ "$target_out_dir/developer/public.cil" ] 1244 outputs = [ 1245 "$root_out_dir/$eng_chipset_base_dir/etc/selinux/public_developer.cil", 1246 ] 1247 } 1248 1249 copy("eng_chipset_vendor_cil") { 1250 deps = [ ":build_policy" ] 1251 sources = [ "$target_out_dir/vendor.cil" ] 1252 outputs = [ "$root_out_dir/$eng_chipset_base_dir/etc/selinux/vendor.cil" ] 1253 } 1254 1255 copy("eng_chipset_vendor_common_cil") { 1256 deps = [ ":build_policy" ] 1257 sources = [ "$target_out_dir/vendor_common.cil" ] 1258 outputs = 1259 [ "$root_out_dir/$eng_chipset_base_dir/etc/selinux/vendor_common.cil" ] 1260 } 1261 1262 copy("eng_chipset_vendor_developer_cil") { 1263 deps = [ ":build_policy" ] 1264 sources = [ "$target_out_dir/developer/vendor.cil" ] 1265 outputs = [ 1266 "$root_out_dir/$eng_chipset_base_dir/etc/selinux/vendor_developer.cil", 1267 ] 1268 } 1269 1270 group("eng_system_selinux_group") { 1271 deps = [ 1272 ":eng_system_compatible", 1273 ":eng_system_compatible_developer", 1274 ":eng_system_system_cil", 1275 ":eng_system_system_cil_sha256", 1276 ":eng_system_system_common_cil", 1277 ":eng_system_system_developer_cil", 1278 ":eng_system_system_developer_cil_sha256", 1279 ":filecontexts_toolchain", 1280 ] 1281 } 1282 1283 group("eng_chipset_selinux_group") { 1284 deps = [ 1285 ":eng_chipset_developer_policy", 1286 ":eng_chipset_policy", 1287 ":eng_chipset_public_cil", 1288 ":eng_chipset_public_common_cil", 1289 ":eng_chipset_public_developer_cil", 1290 ":eng_chipset_system_cil_sha256", 1291 ":eng_chipset_system_developer_cil_sha256", 1292 ":eng_chipset_vendor_cil", 1293 ":eng_chipset_vendor_common_cil", 1294 ":eng_chipset_vendor_developer_cil", 1295 ":filecontexts_toolchain", 1296 ] 1297 } 1298} 1299 1300group("selinux_group") { 1301 if (build_selinux) { 1302 if (!ohos_indep_compiler_enable) { 1303 deps = [ 1304 ":build_updater_sepolicy", 1305 ":config", 1306 ":file_contexts", 1307 ":file_contexts_updater", 1308 ":filecontexts_toolchain", 1309 ":hap_restorecon", 1310 ":hdf_service_contexts", 1311 ":ignore_cfg", 1312 ":libpcre2_toolchain", 1313 ":libselinux_toolchain", 1314 ":load_policy", 1315 ":param_check", 1316 ":parameter_contexts", 1317 ":restorecon", 1318 ":sehap_contexts", 1319 ":selinux_check", 1320 ":service_check", 1321 ":service_contexts", 1322 ":updater_config", 1323 ] 1324 external_deps = [ 1325 "selinux:checkpolicy($host_toolchain)", 1326 "selinux:chkcon", 1327 "selinux:getenforce", 1328 "selinux:getfilecon", 1329 "selinux:getpidcon", 1330 "selinux:secilc", 1331 "selinux:secilc($host_toolchain)", 1332 "selinux:sefcontext_compile($host_toolchain)", 1333 "selinux:selinux_check_access", 1334 "selinux:selinuxexeccon", 1335 "selinux:setenforce", 1336 "selinux:setfilecon", 1337 ] 1338 if (selinux_adapter_components == "system") { 1339 deps += [ 1340 ":system_cil", 1341 ":system_cil_sha256", 1342 ":system_common_cil", 1343 ":version_cil", 1344 ] 1345 if (selinux_adapter_support_developer_mode) { 1346 deps += [ 1347 ":system_developer_cil", 1348 ":system_developer_cil_sha256", 1349 ":version_developer_cil", 1350 ] 1351 } 1352 } else if (selinux_adapter_components == "vendor") { 1353 deps += [ 1354 ":build_sepolicy", 1355 ":prebuild_sepolicy_system_cil_sha256", 1356 ":public_cil", 1357 ":public_common_cil", 1358 ":selinux_version", 1359 ":vendor_cil", 1360 ":vendor_common_cil", 1361 ] 1362 if (selinux_adapter_support_developer_mode) { 1363 deps += [ 1364 ":developer_policy", 1365 ":prebuild_sepolicy_system_developer_cil_sha256", 1366 ":public_developer_cil", 1367 ":vendor_developer_cil", 1368 ] 1369 } 1370 } else { 1371 deps += [ ":build_sepolicy" ] 1372 if (selinux_adapter_support_developer_mode) { 1373 deps += [ ":developer_policy" ] 1374 } 1375 } 1376 } else { 1377 deps = [ 1378 ":hap_restorecon", 1379 ":load_policy", 1380 ":param_check", 1381 ":restorecon", 1382 ":service_check", 1383 ] 1384 } 1385 } 1386} 1387