# This file is referenced by both hypervisor build and tools build
# so there shouldn't be any tools specific things here.

XEN_ROOT=$(CURDIR)/../../..

ifeq ($(FLASK_BUILD_DIR),)
$(error FLASK_BUILD_DIR not set)
endif

########################################
#
# Configurable portions of the Makefile
#
########################################

CONFIG_MLS ?= n

# Number of available MLS sensitivities and categories.
# The sensitivities will be s0 to s(MLS_SENS-1).  Dominance will be in
# increasing numerical order with s0 being lowest.
MLS_SENS ?= 16
# The categories will be c0 to c(MLS_CATS-1).
MLS_CATS ?= 256

# executable paths
CHECKPOLICY ?= checkpolicy
M4 ?= m4

# Output security policy version.  Leave unset to autodetect.
OUTPUT_POLICY ?= $(BEST_POLICY_VER)

########################################
#
# End of configuration options
#
########################################

POLICY_FILENAME = $(FLASK_BUILD_DIR)/xenpolicy-$(XEN_FULLVERSION)
POLICY_LOADPATH = /boot

# List of policy versions supported by the hypervisor
POLICY_VER_LIST_HV = 24 30

# policy source layout
POLDIR := policy
MODDIR := modules

# Classes and access vectors defined in the hypervisor. Changes to these require
# a recompile of both the hypervisor and security policy.
FLASKDIR := ../../../xen/xsm/flask/policy
SECCLASS := $(FLASKDIR)/security_classes
ISID_DECLS := $(FLASKDIR)/initial_sids
AVS := $(FLASKDIR)/access_vectors

# Additional classes and access vectors defined by local policy
SECCLASS += $(POLDIR)/security_classes
AVS += $(POLDIR)/access_vectors

# Other policy components
M4SUPPORT := $(wildcard $(POLDIR)/support/*.spt)
MLSSUPPORT := $(POLDIR)/mls
USERS := $(POLDIR)/users
ISID_DEFS := $(POLDIR)/initial_sids
DEV_OCONS := $(POLDIR)/device_contexts

# config file paths
GLOBALTUN := $(POLDIR)/global_tunables
MOD_CONF := $(MODDIR)/modules.conf

# checkpolicy can use the #line directives provided by -s for error reporting:
M4PARAM := -D self_contained_policy -s

# The output of checkpolicy -V is "30 (compatibility range 30-15)", and the
# first word of the output is the maximum policy version supported.
CHECKPOLICY_VER_MAX := $(firstword $(shell $(CHECKPOLICY) -V))

# Find the highest version supported by both the hypervisor and checkpolicy
BEST_POLICY_VER := $(shell best=24; for ver in $(POLICY_VER_LIST_HV); do if test $$ver -le $(CHECKPOLICY_VER_MAX); then best=$$ver; fi; done; echo $$best)

CHECKPOLICY_PARAM := -t Xen -c $(OUTPUT_POLICY)

# enable MLS if requested.
ifneq ($(CONFIG_MLS),n)
	M4PARAM += -D enable_mls
	CHECKPOLICY_PARAM += -M
endif

# Always define these because they are referenced even in non-MLS policy
M4PARAM += -D mls_num_sens=$(MLS_SENS) -D mls_num_cats=$(MLS_CATS)


# modules.conf setting for policy configuration
MODENABLED := on

# extract settings from modules.conf
ENABLED_LIST := $(shell awk '/^[ \t]*[a-z]/{ if ($$3 == "$(MODENABLED)") print $$1 }' $(MOD_CONF) 2> /dev/null)

# Modules must provide a .te file, although it could be empty
ALL_MODULES := $(foreach mod,$(ENABLED_LIST),$(MODDIR)/$(mod).te)

# Modules may also provide interfaces and constraint definitions
ALL_INTERFACES := $(wildcard $(ALL_MODULES:.te=.if))
ALL_CONSTRAINTS := $(wildcard $(ALL_MODULES:.te=.cons))

# The order of these files is important
POLICY_SECTIONS := $(SECCLASS) $(ISID_DECLS) $(AVS)
POLICY_SECTIONS += $(M4SUPPORT) $(MLSSUPPORT)
POLICY_SECTIONS += $(ALL_INTERFACES)
POLICY_SECTIONS += $(GLOBALTUN)
POLICY_SECTIONS += $(ALL_MODULES)
POLICY_SECTIONS += $(USERS)
POLICY_SECTIONS += $(ALL_CONSTRAINTS)
POLICY_SECTIONS += $(ISID_DEFS) $(DEV_OCONS)

all: $(POLICY_FILENAME)

install: $(POLICY_FILENAME)
	$(INSTALL_DIR) $(DESTDIR)/$(POLICY_LOADPATH)
	$(INSTALL_DATA) $^ $(DESTDIR)/$(POLICY_LOADPATH)

uninstall:
	rm -f $(DESTDIR)/$(POLICY_LOADPATH)/$(POLICY_FILENAME)

$(POLICY_FILENAME): $(FLASK_BUILD_DIR)/policy.conf
	$(CHECKPOLICY) $(CHECKPOLICY_PARAM) $^ -o $@

$(FLASK_BUILD_DIR)/policy.conf: $(POLICY_SECTIONS) $(MOD_CONF)
	$(M4) $(M4PARAM) $(POLICY_SECTIONS) > $@

clean:
	$(RM) $(FLASK_BUILD_DIR)/policy.conf $(POLICY_FILENAME)

distclean: clean

.PHONY: all install clean distclean uninstall