Updatable sepolicy is shipped within an zip within an APEX. Because it needs to be available before Apexes are mounted, apexd copies the zip from the APEX and stores it in /metadata/sepolicy. If there is not updatable sepolicy in /metadata/sepolicy, then updatable policy is loaded from /system/etc/selinux/apex. Init performs the following steps on boot: 1. Validates the zip by checking its signature against a public key that is stored in /system/etc/selinux. 2. Extracts files from zip and stores them in /dev/selinux. 3. Checks if the apex_sepolicy.sha256 matches the sha256 of precompiled_sepolicy. if so, the precompiled sepolicy is used. Otherwise, an on-device compile of the policy is used. This is the same flow as on-device compilation of policy for Treble. 4. Cleans up files in /dev/selinux which are no longer needed. 5. Restorecons the remaining files in /dev/selinux. 6. Sets selinux into enforcing mode and continues normal booting. Bug: 199914227 Test: adb root adb shell cp /apex/com.android.sepolicy.apex/etc/SEPolicy-33.zip \ /metadata/sepolicy/SEPolicy.zip adb shell cp /apex/com.android.sepolicy.apex/etc/SEPolicy-33.zip.sig \ /metadata/sepolicy/SEPolicy.apk.sig adb shell cp /apex/com.android.sepolicy.apex/etc/SEPolicy-33.zip.fsv_sig \ /metadata/sepolicy/SEPolicy.zip.fsv_sig adb reboot ls -laZ /dev/selinux/ Verify that files exist and that the labels are expected. Change-Id: I614e8d84892693ecc663b17eebd204096367693d
580 lines
14 KiB
Text
580 lines
14 KiB
Text
//
|
|
// Copyright (C) 2017 The Android Open Source Project
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
//
|
|
|
|
package {
|
|
default_applicable_licenses: ["system_core_init_license"],
|
|
}
|
|
|
|
// Added automatically by a large-scale-change
|
|
// See: http://go/android-license-faq
|
|
license {
|
|
name: "system_core_init_license",
|
|
visibility: [":__subpackages__"],
|
|
license_kinds: [
|
|
"SPDX-license-identifier-Apache-2.0",
|
|
],
|
|
license_text: [
|
|
"NOTICE",
|
|
],
|
|
}
|
|
|
|
init_common_sources = [
|
|
"action.cpp",
|
|
"action_manager.cpp",
|
|
"action_parser.cpp",
|
|
"capabilities.cpp",
|
|
"epoll.cpp",
|
|
"import_parser.cpp",
|
|
"interface_utils.cpp",
|
|
"keychords.cpp",
|
|
"parser.cpp",
|
|
"property_type.cpp",
|
|
"rlimit_parser.cpp",
|
|
"service.cpp",
|
|
"service_list.cpp",
|
|
"service_parser.cpp",
|
|
"service_utils.cpp",
|
|
"subcontext.cpp",
|
|
"subcontext.proto",
|
|
"tokenizer.cpp",
|
|
"util.cpp",
|
|
]
|
|
init_device_sources = [
|
|
"block_dev_initializer.cpp",
|
|
"bootchart.cpp",
|
|
"builtins.cpp",
|
|
"devices.cpp",
|
|
"firmware_handler.cpp",
|
|
"first_stage_console.cpp",
|
|
"first_stage_init.cpp",
|
|
"first_stage_mount.cpp",
|
|
"fscrypt_init_extensions.cpp",
|
|
"init.cpp",
|
|
"lmkd_service.cpp",
|
|
"modalias_handler.cpp",
|
|
"mount_handler.cpp",
|
|
"mount_namespace.cpp",
|
|
"persistent_properties.cpp",
|
|
"persistent_properties.proto",
|
|
"property_service.cpp",
|
|
"property_service.proto",
|
|
"reboot.cpp",
|
|
"reboot_utils.cpp",
|
|
"security.cpp",
|
|
"selabel.cpp",
|
|
"selinux.cpp",
|
|
"sigchld_handler.cpp",
|
|
"snapuserd_transition.cpp",
|
|
"switch_root.cpp",
|
|
"uevent_listener.cpp",
|
|
"ueventd.cpp",
|
|
"ueventd_parser.cpp",
|
|
]
|
|
init_host_sources = [
|
|
"check_builtins.cpp",
|
|
"host_import_parser.cpp",
|
|
"host_init_verifier.cpp",
|
|
]
|
|
|
|
soong_config_module_type {
|
|
name: "libinit_cc_defaults",
|
|
module_type: "cc_defaults",
|
|
config_namespace: "ANDROID",
|
|
bool_variables: [
|
|
"PRODUCT_INSTALL_DEBUG_POLICY_TO_SYSTEM_EXT",
|
|
],
|
|
properties: [
|
|
"cflags",
|
|
],
|
|
}
|
|
|
|
libinit_cc_defaults {
|
|
name: "init_defaults",
|
|
sanitize: {
|
|
misc_undefined: ["signed-integer-overflow"],
|
|
},
|
|
cflags: [
|
|
"-DLOG_UEVENTS=0",
|
|
"-Wall",
|
|
"-Wextra",
|
|
"-Wno-unused-parameter",
|
|
"-Werror",
|
|
"-Wthread-safety",
|
|
"-DALLOW_FIRST_STAGE_CONSOLE=0",
|
|
"-DALLOW_LOCAL_PROP_OVERRIDE=0",
|
|
"-DALLOW_PERMISSIVE_SELINUX=0",
|
|
"-DREBOOT_BOOTLOADER_ON_PANIC=0",
|
|
"-DWORLD_WRITABLE_KMSG=0",
|
|
"-DDUMP_ON_UMOUNT_FAILURE=0",
|
|
"-DSHUTDOWN_ZERO_TIMEOUT=0",
|
|
"-DINIT_FULL_SOURCES",
|
|
"-DINSTALL_DEBUG_POLICY_TO_SYSTEM_EXT=0",
|
|
],
|
|
product_variables: {
|
|
debuggable: {
|
|
cppflags: [
|
|
"-UALLOW_FIRST_STAGE_CONSOLE",
|
|
"-DALLOW_FIRST_STAGE_CONSOLE=1",
|
|
"-UALLOW_LOCAL_PROP_OVERRIDE",
|
|
"-DALLOW_LOCAL_PROP_OVERRIDE=1",
|
|
"-UALLOW_PERMISSIVE_SELINUX",
|
|
"-DALLOW_PERMISSIVE_SELINUX=1",
|
|
"-UREBOOT_BOOTLOADER_ON_PANIC",
|
|
"-DREBOOT_BOOTLOADER_ON_PANIC=1",
|
|
"-UWORLD_WRITABLE_KMSG",
|
|
"-DWORLD_WRITABLE_KMSG=1",
|
|
"-UDUMP_ON_UMOUNT_FAILURE",
|
|
"-DDUMP_ON_UMOUNT_FAILURE=1",
|
|
],
|
|
},
|
|
eng: {
|
|
cppflags: [
|
|
"-USHUTDOWN_ZERO_TIMEOUT",
|
|
"-DSHUTDOWN_ZERO_TIMEOUT=1",
|
|
],
|
|
},
|
|
uml: {
|
|
cppflags: ["-DUSER_MODE_LINUX"],
|
|
},
|
|
},
|
|
soong_config_variables: {
|
|
PRODUCT_INSTALL_DEBUG_POLICY_TO_SYSTEM_EXT: {
|
|
cflags: [
|
|
"-UINSTALL_DEBUG_POLICY_TO_SYSTEM_EXT",
|
|
"-DINSTALL_DEBUG_POLICY_TO_SYSTEM_EXT=1",
|
|
],
|
|
},
|
|
},
|
|
static_libs: [
|
|
"libavb",
|
|
"libc++fs",
|
|
"libcgrouprc_format",
|
|
"libfsverity_init",
|
|
"liblmkd_utils",
|
|
"libmini_keyctl_static",
|
|
"libmodprobe",
|
|
"libprocinfo",
|
|
"libprotobuf-cpp-lite",
|
|
"libpropertyinfoserializer",
|
|
"libpropertyinfoparser",
|
|
"libsigningutils",
|
|
"libsnapshot_cow",
|
|
"libsnapshot_init",
|
|
"libxml2",
|
|
"lib_apex_manifest_proto_lite",
|
|
"update_metadata-protos",
|
|
],
|
|
shared_libs: [
|
|
"libbacktrace",
|
|
"libbase",
|
|
"libbootloader_message",
|
|
"libcrypto",
|
|
"libcutils",
|
|
"libdl",
|
|
"libext4_utils",
|
|
"libfs_mgr",
|
|
"libgsi",
|
|
"libhidl-gen-utils",
|
|
"libkeyutils",
|
|
"liblog",
|
|
"liblogwrap",
|
|
"liblp",
|
|
"libprocessgroup",
|
|
"libprocessgroup_setup",
|
|
"libselinux",
|
|
"libutils",
|
|
"libziparchive",
|
|
],
|
|
bootstrap: true,
|
|
visibility: [":__subpackages__"],
|
|
}
|
|
|
|
cc_library_static {
|
|
name: "libinit",
|
|
recovery_available: true,
|
|
defaults: [
|
|
"init_defaults",
|
|
"selinux_policy_version",
|
|
],
|
|
srcs: init_common_sources + init_device_sources,
|
|
generated_sources: [
|
|
"apex-info-list",
|
|
],
|
|
whole_static_libs: [
|
|
"libcap",
|
|
"com.android.sysprop.apex",
|
|
"com.android.sysprop.init",
|
|
],
|
|
header_libs: ["bootimg_headers"],
|
|
proto: {
|
|
type: "lite",
|
|
export_proto_headers: true,
|
|
},
|
|
|
|
target: {
|
|
recovery: {
|
|
cflags: ["-DRECOVERY"],
|
|
exclude_static_libs: [
|
|
"libxml2",
|
|
],
|
|
exclude_generated_sources: [
|
|
"apex-info-list",
|
|
],
|
|
exclude_shared_libs: [
|
|
"libbinder",
|
|
"libutils",
|
|
],
|
|
},
|
|
},
|
|
}
|
|
|
|
phony {
|
|
name: "init",
|
|
required: [
|
|
"init_second_stage",
|
|
],
|
|
}
|
|
|
|
cc_binary {
|
|
name: "init_second_stage",
|
|
recovery_available: true,
|
|
stem: "init",
|
|
defaults: ["init_defaults"],
|
|
static_libs: ["libinit"],
|
|
srcs: ["main.cpp"],
|
|
symlinks: ["ueventd"],
|
|
target: {
|
|
platform: {
|
|
required: [
|
|
"init.rc",
|
|
"ueventd.rc",
|
|
"e2fsdroid",
|
|
"extra_free_kbytes.sh",
|
|
"make_f2fs",
|
|
"mke2fs",
|
|
"sload_f2fs",
|
|
],
|
|
},
|
|
recovery: {
|
|
cflags: ["-DRECOVERY"],
|
|
exclude_static_libs: [
|
|
"libxml2",
|
|
],
|
|
exclude_shared_libs: [
|
|
"libbinder",
|
|
"libutils",
|
|
],
|
|
required: [
|
|
"init_recovery.rc",
|
|
"ueventd.rc.recovery",
|
|
"e2fsdroid.recovery",
|
|
"make_f2fs.recovery",
|
|
"mke2fs.recovery",
|
|
"sload_f2fs.recovery",
|
|
],
|
|
},
|
|
},
|
|
visibility: ["//packages/modules/Virtualization/microdroid"],
|
|
}
|
|
|
|
soong_config_module_type {
|
|
name: "init_first_stage_cc_defaults",
|
|
module_type: "cc_defaults",
|
|
config_namespace: "ANDROID",
|
|
bool_variables: ["BOARD_BUILD_SYSTEM_ROOT_IMAGE", "BOARD_USES_RECOVERY_AS_BOOT"],
|
|
properties: ["installable"],
|
|
}
|
|
|
|
// Do not install init_first_stage even with mma if we're system-as-root.
|
|
// Otherwise, it will overwrite the symlink.
|
|
init_first_stage_cc_defaults {
|
|
name: "init_first_stage_defaults",
|
|
soong_config_variables: {
|
|
BOARD_BUILD_SYSTEM_ROOT_IMAGE: {
|
|
installable: false,
|
|
},
|
|
BOARD_USES_RECOVERY_AS_BOOT: {
|
|
installable: false,
|
|
},
|
|
},
|
|
}
|
|
|
|
cc_binary {
|
|
name: "init_first_stage",
|
|
stem: "init",
|
|
defaults: ["init_first_stage_defaults"],
|
|
|
|
srcs: [
|
|
"block_dev_initializer.cpp",
|
|
"devices.cpp",
|
|
"first_stage_console.cpp",
|
|
"first_stage_init.cpp",
|
|
"first_stage_main.cpp",
|
|
"first_stage_mount.cpp",
|
|
"reboot_utils.cpp",
|
|
"selabel.cpp",
|
|
"service_utils.cpp",
|
|
"snapuserd_transition.cpp",
|
|
"switch_root.cpp",
|
|
"uevent_listener.cpp",
|
|
"util.cpp",
|
|
],
|
|
|
|
static_libs: [
|
|
"libc++fs",
|
|
"libfs_avb",
|
|
"libfs_mgr",
|
|
"libfec",
|
|
"libfec_rs",
|
|
"libsquashfs_utils",
|
|
"libcrypto_utils",
|
|
"libavb",
|
|
"liblp",
|
|
"libcutils",
|
|
"libbase",
|
|
"liblog",
|
|
"libcrypto_static",
|
|
"libselinux",
|
|
"libcap",
|
|
"libgsi",
|
|
"liblzma",
|
|
"libunwindstack_no_dex",
|
|
"libbacktrace_no_dex",
|
|
"libmodprobe",
|
|
"libext2_uuid",
|
|
"libprotobuf-cpp-lite",
|
|
"libsnapshot_cow",
|
|
"libsnapshot_init",
|
|
"update_metadata-protos",
|
|
"libprocinfo",
|
|
],
|
|
|
|
static_executable: true,
|
|
system_shared_libs: [],
|
|
|
|
cflags: [
|
|
"-Wall",
|
|
"-Wextra",
|
|
"-Wno-unused-parameter",
|
|
"-Werror",
|
|
"-DALLOW_FIRST_STAGE_CONSOLE=0",
|
|
"-DALLOW_LOCAL_PROP_OVERRIDE=0",
|
|
"-DALLOW_PERMISSIVE_SELINUX=0",
|
|
"-DREBOOT_BOOTLOADER_ON_PANIC=0",
|
|
"-DWORLD_WRITABLE_KMSG=0",
|
|
"-DDUMP_ON_UMOUNT_FAILURE=0",
|
|
"-DSHUTDOWN_ZERO_TIMEOUT=0",
|
|
"-DLOG_UEVENTS=0",
|
|
"-DSEPOLICY_VERSION=30", // TODO(jiyong): externalize the version number
|
|
],
|
|
|
|
product_variables: {
|
|
debuggable: {
|
|
cflags: [
|
|
"-UALLOW_FIRST_STAGE_CONSOLE",
|
|
"-DALLOW_FIRST_STAGE_CONSOLE=1",
|
|
|
|
"-UALLOW_LOCAL_PROP_OVERRIDE",
|
|
"-DALLOW_LOCAL_PROP_OVERRIDE=1",
|
|
|
|
"-UALLOW_PERMISSIVE_SELINUX",
|
|
"-DALLOW_PERMISSIVE_SELINUX=1",
|
|
|
|
"-UREBOOT_BOOTLOADER_ON_PANIC",
|
|
"-DREBOOT_BOOTLOADER_ON_PANIC=1",
|
|
|
|
"-UWORLD_WRITABLE_KMSG",
|
|
"-DWORLD_WRITABLE_KMSG=1",
|
|
|
|
"-UDUMP_ON_UMOUNT_FAILURE",
|
|
"-DDUMP_ON_UMOUNT_FAILURE=1",
|
|
],
|
|
},
|
|
|
|
eng: {
|
|
cflags: [
|
|
"-USHUTDOWN_ZERO_TIMEOUT",
|
|
"-DSHUTDOWN_ZERO_TIMEOUT=1",
|
|
],
|
|
},
|
|
},
|
|
|
|
sanitize: {
|
|
misc_undefined: ["signed-integer-overflow"],
|
|
|
|
// First stage init is weird: it may start without stdout/stderr, and no /proc.
|
|
hwaddress: false,
|
|
},
|
|
|
|
// Install adb_debug.prop into debug ramdisk.
|
|
// This allows adb root on a user build, when debug ramdisk is used.
|
|
required: ["adb_debug.prop"],
|
|
|
|
ramdisk: true,
|
|
|
|
install_in_root: true,
|
|
}
|
|
|
|
phony {
|
|
name: "init_system",
|
|
required: ["init_second_stage"],
|
|
}
|
|
|
|
// Tests
|
|
// ------------------------------------------------------------------------------
|
|
|
|
cc_test {
|
|
name: "CtsInitTestCases",
|
|
defaults: ["init_defaults"],
|
|
require_root: true,
|
|
|
|
compile_multilib: "both",
|
|
multilib: {
|
|
lib32: {
|
|
suffix: "32",
|
|
},
|
|
lib64: {
|
|
suffix: "64",
|
|
},
|
|
},
|
|
|
|
srcs: [
|
|
"devices_test.cpp",
|
|
"epoll_test.cpp",
|
|
"firmware_handler_test.cpp",
|
|
"init_test.cpp",
|
|
"keychords_test.cpp",
|
|
"oneshot_on_test.cpp",
|
|
"persistent_properties_test.cpp",
|
|
"property_service_test.cpp",
|
|
"property_type_test.cpp",
|
|
"reboot_test.cpp",
|
|
"rlimit_parser_test.cpp",
|
|
"service_test.cpp",
|
|
"subcontext_test.cpp",
|
|
"tokenizer_test.cpp",
|
|
"ueventd_parser_test.cpp",
|
|
"ueventd_test.cpp",
|
|
"util_test.cpp",
|
|
],
|
|
static_libs: ["libinit"],
|
|
|
|
test_suites: [
|
|
"cts",
|
|
"device-tests",
|
|
],
|
|
}
|
|
|
|
cc_benchmark {
|
|
name: "init_benchmarks",
|
|
defaults: ["init_defaults"],
|
|
srcs: [
|
|
"subcontext_benchmark.cpp",
|
|
],
|
|
static_libs: ["libinit"],
|
|
}
|
|
|
|
cc_defaults {
|
|
name: "libinit_test_utils_libraries_defaults",
|
|
shared_libs: [
|
|
"libbase",
|
|
"libcutils",
|
|
"libselinux",
|
|
"libhidl-gen-utils",
|
|
"liblog",
|
|
"libprocessgroup",
|
|
"libprotobuf-cpp-lite",
|
|
],
|
|
}
|
|
|
|
cc_library_static {
|
|
name: "libinit_test_utils",
|
|
defaults: ["libinit_test_utils_libraries_defaults"],
|
|
cflags: [
|
|
"-Wall",
|
|
"-Wextra",
|
|
"-Wno-unused-parameter",
|
|
"-Werror",
|
|
],
|
|
srcs: init_common_sources + [
|
|
"test_utils/service_utils.cpp",
|
|
],
|
|
whole_static_libs: [
|
|
"libcap",
|
|
],
|
|
export_include_dirs: ["test_utils/include"], // for tests
|
|
}
|
|
|
|
// Host Verifier
|
|
// ------------------------------------------------------------------------------
|
|
|
|
genrule {
|
|
name: "generated_stub_builtin_function_map",
|
|
tool_files: ["host_builtin_map.py"],
|
|
out: ["generated_stub_builtin_function_map.h"],
|
|
srcs: [
|
|
"builtins.cpp",
|
|
"check_builtins.cpp",
|
|
],
|
|
cmd: "$(location host_builtin_map.py) --builtins $(location builtins.cpp) --check_builtins $(location check_builtins.cpp) > $(out)",
|
|
}
|
|
|
|
cc_binary {
|
|
name: "host_init_verifier",
|
|
host_supported: true,
|
|
cflags: [
|
|
"-Wall",
|
|
"-Wextra",
|
|
"-Wno-unused-parameter",
|
|
"-Werror",
|
|
],
|
|
static_libs: [
|
|
"libbase",
|
|
"libselinux",
|
|
"libpropertyinfoserializer",
|
|
"libpropertyinfoparser",
|
|
],
|
|
whole_static_libs: ["libcap"],
|
|
shared_libs: [
|
|
"libcutils",
|
|
"libhidl-gen-utils",
|
|
"libhidlmetadata",
|
|
"liblog",
|
|
"libprocessgroup",
|
|
"libprotobuf-cpp-lite",
|
|
],
|
|
srcs: init_common_sources + init_host_sources,
|
|
proto: {
|
|
type: "lite",
|
|
},
|
|
generated_headers: [
|
|
"generated_stub_builtin_function_map",
|
|
"generated_android_ids",
|
|
],
|
|
target: {
|
|
android: {
|
|
enabled: false,
|
|
},
|
|
darwin: {
|
|
enabled: false,
|
|
},
|
|
},
|
|
}
|
|
|
|
sh_binary {
|
|
name: "extra_free_kbytes.sh",
|
|
src: "extra_free_kbytes.sh",
|
|
}
|