android_system_core/init/Android.bp
Jeff Vander Stoep 97ff3ab852 Use Apex sepolicy if it's available
Updatable sepolicy is shipped within an zip within an APEX. Because
it needs to be available before Apexes are mounted, apexd copies
the zip from the APEX and stores it in /metadata/sepolicy. If there is
not updatable sepolicy in /metadata/sepolicy, then updatable policy is
loaded from /system/etc/selinux/apex. Init performs the following
steps on boot:

1. Validates the zip by checking its signature against a public key
that is stored in /system/etc/selinux.
2. Extracts files from zip and stores them in /dev/selinux.
3. Checks if the apex_sepolicy.sha256 matches the sha256 of
precompiled_sepolicy. if so, the precompiled sepolicy is used.
Otherwise, an on-device compile of the policy is used. This is the
same flow as on-device compilation of policy for Treble.
4. Cleans up files in /dev/selinux which are no longer needed.
5. Restorecons the remaining files in /dev/selinux.
6. Sets selinux into enforcing mode and continues normal booting.

Bug: 199914227
Test: adb root
adb shell cp /apex/com.android.sepolicy.apex/etc/SEPolicy-33.zip \
/metadata/sepolicy/SEPolicy.zip
adb shell cp /apex/com.android.sepolicy.apex/etc/SEPolicy-33.zip.sig \
/metadata/sepolicy/SEPolicy.apk.sig
adb shell cp /apex/com.android.sepolicy.apex/etc/SEPolicy-33.zip.fsv_sig \
/metadata/sepolicy/SEPolicy.zip.fsv_sig
adb reboot
ls -laZ /dev/selinux/
Verify that files exist and that the labels are expected.

Change-Id: I614e8d84892693ecc663b17eebd204096367693d
2022-01-25 10:27:00 +01:00

580 lines
14 KiB
Text

//
// Copyright (C) 2017 The Android Open Source Project
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
package {
default_applicable_licenses: ["system_core_init_license"],
}
// Added automatically by a large-scale-change
// See: http://go/android-license-faq
license {
name: "system_core_init_license",
visibility: [":__subpackages__"],
license_kinds: [
"SPDX-license-identifier-Apache-2.0",
],
license_text: [
"NOTICE",
],
}
init_common_sources = [
"action.cpp",
"action_manager.cpp",
"action_parser.cpp",
"capabilities.cpp",
"epoll.cpp",
"import_parser.cpp",
"interface_utils.cpp",
"keychords.cpp",
"parser.cpp",
"property_type.cpp",
"rlimit_parser.cpp",
"service.cpp",
"service_list.cpp",
"service_parser.cpp",
"service_utils.cpp",
"subcontext.cpp",
"subcontext.proto",
"tokenizer.cpp",
"util.cpp",
]
init_device_sources = [
"block_dev_initializer.cpp",
"bootchart.cpp",
"builtins.cpp",
"devices.cpp",
"firmware_handler.cpp",
"first_stage_console.cpp",
"first_stage_init.cpp",
"first_stage_mount.cpp",
"fscrypt_init_extensions.cpp",
"init.cpp",
"lmkd_service.cpp",
"modalias_handler.cpp",
"mount_handler.cpp",
"mount_namespace.cpp",
"persistent_properties.cpp",
"persistent_properties.proto",
"property_service.cpp",
"property_service.proto",
"reboot.cpp",
"reboot_utils.cpp",
"security.cpp",
"selabel.cpp",
"selinux.cpp",
"sigchld_handler.cpp",
"snapuserd_transition.cpp",
"switch_root.cpp",
"uevent_listener.cpp",
"ueventd.cpp",
"ueventd_parser.cpp",
]
init_host_sources = [
"check_builtins.cpp",
"host_import_parser.cpp",
"host_init_verifier.cpp",
]
soong_config_module_type {
name: "libinit_cc_defaults",
module_type: "cc_defaults",
config_namespace: "ANDROID",
bool_variables: [
"PRODUCT_INSTALL_DEBUG_POLICY_TO_SYSTEM_EXT",
],
properties: [
"cflags",
],
}
libinit_cc_defaults {
name: "init_defaults",
sanitize: {
misc_undefined: ["signed-integer-overflow"],
},
cflags: [
"-DLOG_UEVENTS=0",
"-Wall",
"-Wextra",
"-Wno-unused-parameter",
"-Werror",
"-Wthread-safety",
"-DALLOW_FIRST_STAGE_CONSOLE=0",
"-DALLOW_LOCAL_PROP_OVERRIDE=0",
"-DALLOW_PERMISSIVE_SELINUX=0",
"-DREBOOT_BOOTLOADER_ON_PANIC=0",
"-DWORLD_WRITABLE_KMSG=0",
"-DDUMP_ON_UMOUNT_FAILURE=0",
"-DSHUTDOWN_ZERO_TIMEOUT=0",
"-DINIT_FULL_SOURCES",
"-DINSTALL_DEBUG_POLICY_TO_SYSTEM_EXT=0",
],
product_variables: {
debuggable: {
cppflags: [
"-UALLOW_FIRST_STAGE_CONSOLE",
"-DALLOW_FIRST_STAGE_CONSOLE=1",
"-UALLOW_LOCAL_PROP_OVERRIDE",
"-DALLOW_LOCAL_PROP_OVERRIDE=1",
"-UALLOW_PERMISSIVE_SELINUX",
"-DALLOW_PERMISSIVE_SELINUX=1",
"-UREBOOT_BOOTLOADER_ON_PANIC",
"-DREBOOT_BOOTLOADER_ON_PANIC=1",
"-UWORLD_WRITABLE_KMSG",
"-DWORLD_WRITABLE_KMSG=1",
"-UDUMP_ON_UMOUNT_FAILURE",
"-DDUMP_ON_UMOUNT_FAILURE=1",
],
},
eng: {
cppflags: [
"-USHUTDOWN_ZERO_TIMEOUT",
"-DSHUTDOWN_ZERO_TIMEOUT=1",
],
},
uml: {
cppflags: ["-DUSER_MODE_LINUX"],
},
},
soong_config_variables: {
PRODUCT_INSTALL_DEBUG_POLICY_TO_SYSTEM_EXT: {
cflags: [
"-UINSTALL_DEBUG_POLICY_TO_SYSTEM_EXT",
"-DINSTALL_DEBUG_POLICY_TO_SYSTEM_EXT=1",
],
},
},
static_libs: [
"libavb",
"libc++fs",
"libcgrouprc_format",
"libfsverity_init",
"liblmkd_utils",
"libmini_keyctl_static",
"libmodprobe",
"libprocinfo",
"libprotobuf-cpp-lite",
"libpropertyinfoserializer",
"libpropertyinfoparser",
"libsigningutils",
"libsnapshot_cow",
"libsnapshot_init",
"libxml2",
"lib_apex_manifest_proto_lite",
"update_metadata-protos",
],
shared_libs: [
"libbacktrace",
"libbase",
"libbootloader_message",
"libcrypto",
"libcutils",
"libdl",
"libext4_utils",
"libfs_mgr",
"libgsi",
"libhidl-gen-utils",
"libkeyutils",
"liblog",
"liblogwrap",
"liblp",
"libprocessgroup",
"libprocessgroup_setup",
"libselinux",
"libutils",
"libziparchive",
],
bootstrap: true,
visibility: [":__subpackages__"],
}
cc_library_static {
name: "libinit",
recovery_available: true,
defaults: [
"init_defaults",
"selinux_policy_version",
],
srcs: init_common_sources + init_device_sources,
generated_sources: [
"apex-info-list",
],
whole_static_libs: [
"libcap",
"com.android.sysprop.apex",
"com.android.sysprop.init",
],
header_libs: ["bootimg_headers"],
proto: {
type: "lite",
export_proto_headers: true,
},
target: {
recovery: {
cflags: ["-DRECOVERY"],
exclude_static_libs: [
"libxml2",
],
exclude_generated_sources: [
"apex-info-list",
],
exclude_shared_libs: [
"libbinder",
"libutils",
],
},
},
}
phony {
name: "init",
required: [
"init_second_stage",
],
}
cc_binary {
name: "init_second_stage",
recovery_available: true,
stem: "init",
defaults: ["init_defaults"],
static_libs: ["libinit"],
srcs: ["main.cpp"],
symlinks: ["ueventd"],
target: {
platform: {
required: [
"init.rc",
"ueventd.rc",
"e2fsdroid",
"extra_free_kbytes.sh",
"make_f2fs",
"mke2fs",
"sload_f2fs",
],
},
recovery: {
cflags: ["-DRECOVERY"],
exclude_static_libs: [
"libxml2",
],
exclude_shared_libs: [
"libbinder",
"libutils",
],
required: [
"init_recovery.rc",
"ueventd.rc.recovery",
"e2fsdroid.recovery",
"make_f2fs.recovery",
"mke2fs.recovery",
"sload_f2fs.recovery",
],
},
},
visibility: ["//packages/modules/Virtualization/microdroid"],
}
soong_config_module_type {
name: "init_first_stage_cc_defaults",
module_type: "cc_defaults",
config_namespace: "ANDROID",
bool_variables: ["BOARD_BUILD_SYSTEM_ROOT_IMAGE", "BOARD_USES_RECOVERY_AS_BOOT"],
properties: ["installable"],
}
// Do not install init_first_stage even with mma if we're system-as-root.
// Otherwise, it will overwrite the symlink.
init_first_stage_cc_defaults {
name: "init_first_stage_defaults",
soong_config_variables: {
BOARD_BUILD_SYSTEM_ROOT_IMAGE: {
installable: false,
},
BOARD_USES_RECOVERY_AS_BOOT: {
installable: false,
},
},
}
cc_binary {
name: "init_first_stage",
stem: "init",
defaults: ["init_first_stage_defaults"],
srcs: [
"block_dev_initializer.cpp",
"devices.cpp",
"first_stage_console.cpp",
"first_stage_init.cpp",
"first_stage_main.cpp",
"first_stage_mount.cpp",
"reboot_utils.cpp",
"selabel.cpp",
"service_utils.cpp",
"snapuserd_transition.cpp",
"switch_root.cpp",
"uevent_listener.cpp",
"util.cpp",
],
static_libs: [
"libc++fs",
"libfs_avb",
"libfs_mgr",
"libfec",
"libfec_rs",
"libsquashfs_utils",
"libcrypto_utils",
"libavb",
"liblp",
"libcutils",
"libbase",
"liblog",
"libcrypto_static",
"libselinux",
"libcap",
"libgsi",
"liblzma",
"libunwindstack_no_dex",
"libbacktrace_no_dex",
"libmodprobe",
"libext2_uuid",
"libprotobuf-cpp-lite",
"libsnapshot_cow",
"libsnapshot_init",
"update_metadata-protos",
"libprocinfo",
],
static_executable: true,
system_shared_libs: [],
cflags: [
"-Wall",
"-Wextra",
"-Wno-unused-parameter",
"-Werror",
"-DALLOW_FIRST_STAGE_CONSOLE=0",
"-DALLOW_LOCAL_PROP_OVERRIDE=0",
"-DALLOW_PERMISSIVE_SELINUX=0",
"-DREBOOT_BOOTLOADER_ON_PANIC=0",
"-DWORLD_WRITABLE_KMSG=0",
"-DDUMP_ON_UMOUNT_FAILURE=0",
"-DSHUTDOWN_ZERO_TIMEOUT=0",
"-DLOG_UEVENTS=0",
"-DSEPOLICY_VERSION=30", // TODO(jiyong): externalize the version number
],
product_variables: {
debuggable: {
cflags: [
"-UALLOW_FIRST_STAGE_CONSOLE",
"-DALLOW_FIRST_STAGE_CONSOLE=1",
"-UALLOW_LOCAL_PROP_OVERRIDE",
"-DALLOW_LOCAL_PROP_OVERRIDE=1",
"-UALLOW_PERMISSIVE_SELINUX",
"-DALLOW_PERMISSIVE_SELINUX=1",
"-UREBOOT_BOOTLOADER_ON_PANIC",
"-DREBOOT_BOOTLOADER_ON_PANIC=1",
"-UWORLD_WRITABLE_KMSG",
"-DWORLD_WRITABLE_KMSG=1",
"-UDUMP_ON_UMOUNT_FAILURE",
"-DDUMP_ON_UMOUNT_FAILURE=1",
],
},
eng: {
cflags: [
"-USHUTDOWN_ZERO_TIMEOUT",
"-DSHUTDOWN_ZERO_TIMEOUT=1",
],
},
},
sanitize: {
misc_undefined: ["signed-integer-overflow"],
// First stage init is weird: it may start without stdout/stderr, and no /proc.
hwaddress: false,
},
// Install adb_debug.prop into debug ramdisk.
// This allows adb root on a user build, when debug ramdisk is used.
required: ["adb_debug.prop"],
ramdisk: true,
install_in_root: true,
}
phony {
name: "init_system",
required: ["init_second_stage"],
}
// Tests
// ------------------------------------------------------------------------------
cc_test {
name: "CtsInitTestCases",
defaults: ["init_defaults"],
require_root: true,
compile_multilib: "both",
multilib: {
lib32: {
suffix: "32",
},
lib64: {
suffix: "64",
},
},
srcs: [
"devices_test.cpp",
"epoll_test.cpp",
"firmware_handler_test.cpp",
"init_test.cpp",
"keychords_test.cpp",
"oneshot_on_test.cpp",
"persistent_properties_test.cpp",
"property_service_test.cpp",
"property_type_test.cpp",
"reboot_test.cpp",
"rlimit_parser_test.cpp",
"service_test.cpp",
"subcontext_test.cpp",
"tokenizer_test.cpp",
"ueventd_parser_test.cpp",
"ueventd_test.cpp",
"util_test.cpp",
],
static_libs: ["libinit"],
test_suites: [
"cts",
"device-tests",
],
}
cc_benchmark {
name: "init_benchmarks",
defaults: ["init_defaults"],
srcs: [
"subcontext_benchmark.cpp",
],
static_libs: ["libinit"],
}
cc_defaults {
name: "libinit_test_utils_libraries_defaults",
shared_libs: [
"libbase",
"libcutils",
"libselinux",
"libhidl-gen-utils",
"liblog",
"libprocessgroup",
"libprotobuf-cpp-lite",
],
}
cc_library_static {
name: "libinit_test_utils",
defaults: ["libinit_test_utils_libraries_defaults"],
cflags: [
"-Wall",
"-Wextra",
"-Wno-unused-parameter",
"-Werror",
],
srcs: init_common_sources + [
"test_utils/service_utils.cpp",
],
whole_static_libs: [
"libcap",
],
export_include_dirs: ["test_utils/include"], // for tests
}
// Host Verifier
// ------------------------------------------------------------------------------
genrule {
name: "generated_stub_builtin_function_map",
tool_files: ["host_builtin_map.py"],
out: ["generated_stub_builtin_function_map.h"],
srcs: [
"builtins.cpp",
"check_builtins.cpp",
],
cmd: "$(location host_builtin_map.py) --builtins $(location builtins.cpp) --check_builtins $(location check_builtins.cpp) > $(out)",
}
cc_binary {
name: "host_init_verifier",
host_supported: true,
cflags: [
"-Wall",
"-Wextra",
"-Wno-unused-parameter",
"-Werror",
],
static_libs: [
"libbase",
"libselinux",
"libpropertyinfoserializer",
"libpropertyinfoparser",
],
whole_static_libs: ["libcap"],
shared_libs: [
"libcutils",
"libhidl-gen-utils",
"libhidlmetadata",
"liblog",
"libprocessgroup",
"libprotobuf-cpp-lite",
],
srcs: init_common_sources + init_host_sources,
proto: {
type: "lite",
},
generated_headers: [
"generated_stub_builtin_function_map",
"generated_android_ids",
],
target: {
android: {
enabled: false,
},
darwin: {
enabled: false,
},
},
}
sh_binary {
name: "extra_free_kbytes.sh",
src: "extra_free_kbytes.sh",
}