mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 18:21:39 +01:00
Petre Pircalabu
f2b40dabab
Running "make uninstall" does not remove all installed files, a situation which might cause link related issues if xen is re-installed in a different location. In order to make uninstall correctly remove the files it is best the process should be done recursively by mirroring each "install" target with an "uninstall" who removes the installed files. An exception to this rule is uninstalling the files produced by "qemu-xen-dir-remote" and "qemu-xen-traditional-dir", which are external to the project. These projects do not implement an "uninstall" target so the files have to be removed manually. Signed-off-by: Petre Pircalabu <ppircalabu@bitdefender.com> Acked-by: Wei Liu <wei.liu2@citrix.com>
136 lines
4.1 KiB
Makefile
136 lines
4.1 KiB
Makefile
# This file is referenced by both hypervisor build and tools build
|
|
# so there shouldn't be any tools specific things here.
|
|
|
|
XEN_ROOT=$(CURDIR)/../../..
|
|
|
|
ifeq ($(FLASK_BUILD_DIR),)
|
|
$(error FLASK_BUILD_DIR not set)
|
|
endif
|
|
|
|
########################################
|
|
#
|
|
# Configurable portions of the Makefile
|
|
#
|
|
########################################
|
|
|
|
CONFIG_MLS ?= n
|
|
|
|
# Number of available MLS sensitivities and categories.
|
|
# The sensitivities will be s0 to s(MLS_SENS-1). Dominance will be in
|
|
# increasing numerical order with s0 being lowest.
|
|
MLS_SENS ?= 16
|
|
# The categories will be c0 to c(MLS_CATS-1).
|
|
MLS_CATS ?= 256
|
|
|
|
# executable paths
|
|
CHECKPOLICY ?= checkpolicy
|
|
M4 ?= m4
|
|
|
|
# Output security policy version. Leave unset to autodetect.
|
|
OUTPUT_POLICY ?= $(BEST_POLICY_VER)
|
|
|
|
########################################
|
|
#
|
|
# End of configuration options
|
|
#
|
|
########################################
|
|
|
|
POLICY_FILENAME = $(FLASK_BUILD_DIR)/xenpolicy-$(shell $(MAKE) -C $(XEN_ROOT)/xen xenversion --no-print-directory)
|
|
POLICY_LOADPATH = /boot
|
|
|
|
# List of policy versions supported by the hypervisor
|
|
POLICY_VER_LIST_HV = 24 30
|
|
|
|
# policy source layout
|
|
POLDIR := policy
|
|
MODDIR := modules
|
|
|
|
# Classes and access vectors defined in the hypervisor. Changes to these require
|
|
# a recompile of both the hypervisor and security policy.
|
|
FLASKDIR := ../../../xen/xsm/flask/policy
|
|
SECCLASS := $(FLASKDIR)/security_classes
|
|
ISID_DECLS := $(FLASKDIR)/initial_sids
|
|
AVS := $(FLASKDIR)/access_vectors
|
|
|
|
# Additional classes and access vectors defined by local policy
|
|
SECCLASS += $(POLDIR)/security_classes
|
|
AVS += $(POLDIR)/access_vectors
|
|
|
|
# Other policy components
|
|
M4SUPPORT := $(wildcard $(POLDIR)/support/*.spt)
|
|
MLSSUPPORT := $(POLDIR)/mls
|
|
USERS := $(POLDIR)/users
|
|
ISID_DEFS := $(POLDIR)/initial_sids
|
|
DEV_OCONS := $(POLDIR)/device_contexts
|
|
|
|
# config file paths
|
|
GLOBALTUN := $(POLDIR)/global_tunables
|
|
MOD_CONF := $(MODDIR)/modules.conf
|
|
|
|
# checkpolicy can use the #line directives provided by -s for error reporting:
|
|
M4PARAM := -D self_contained_policy -s
|
|
|
|
# The output of checkpolicy -V is "30 (compatibility range 30-15)", and the
|
|
# first word of the output is the maximum policy version supported.
|
|
CHECKPOLICY_VER_MAX := $(firstword $(shell $(CHECKPOLICY) -V))
|
|
|
|
# Find the highest version supported by both the hypervisor and checkpolicy
|
|
BEST_POLICY_VER := $(shell best=24; for ver in $(POLICY_VER_LIST_HV); do if test $$ver -le $(CHECKPOLICY_VER_MAX); then best=$$ver; fi; done; echo $$best)
|
|
|
|
CHECKPOLICY_PARAM := -t Xen -c $(OUTPUT_POLICY)
|
|
|
|
# enable MLS if requested.
|
|
ifneq ($(CONFIG_MLS),n)
|
|
M4PARAM += -D enable_mls
|
|
CHECKPOLICY_PARAM += -M
|
|
endif
|
|
|
|
# Always define these because they are referenced even in non-MLS policy
|
|
M4PARAM += -D mls_num_sens=$(MLS_SENS) -D mls_num_cats=$(MLS_CATS)
|
|
|
|
|
|
# modules.conf setting for policy configuration
|
|
MODENABLED := on
|
|
|
|
# extract settings from modules.conf
|
|
ENABLED_LIST := $(shell awk '/^[ \t]*[a-z]/{ if ($$3 == "$(MODENABLED)") print $$1 }' $(MOD_CONF) 2> /dev/null)
|
|
|
|
# Modules must provide a .te file, although it could be empty
|
|
ALL_MODULES := $(foreach mod,$(ENABLED_LIST),$(MODDIR)/$(mod).te)
|
|
|
|
# Modules may also provide interfaces and constraint definitions
|
|
ALL_INTERFACES := $(wildcard $(ALL_MODULES:.te=.if))
|
|
ALL_CONSTRAINTS := $(wildcard $(ALL_MODULES:.te=.cons))
|
|
|
|
# The order of these files is important
|
|
POLICY_SECTIONS := $(SECCLASS) $(ISID_DECLS) $(AVS)
|
|
POLICY_SECTIONS += $(M4SUPPORT) $(MLSSUPPORT)
|
|
POLICY_SECTIONS += $(ALL_INTERFACES)
|
|
POLICY_SECTIONS += $(GLOBALTUN)
|
|
POLICY_SECTIONS += $(ALL_MODULES)
|
|
POLICY_SECTIONS += $(USERS)
|
|
POLICY_SECTIONS += $(ALL_CONSTRAINTS)
|
|
POLICY_SECTIONS += $(ISID_DEFS) $(DEV_OCONS)
|
|
|
|
all: $(POLICY_FILENAME)
|
|
|
|
install: $(POLICY_FILENAME)
|
|
$(INSTALL_DIR) $(DESTDIR)/$(POLICY_LOADPATH)
|
|
$(INSTALL_DATA) $^ $(DESTDIR)/$(POLICY_LOADPATH)
|
|
|
|
uninstall:
|
|
rm -f $(DESTDIR)/$(POLICY_LOADPATH)/$(POLICY_FILENAME)
|
|
|
|
$(POLICY_FILENAME): $(FLASK_BUILD_DIR)/policy.conf
|
|
$(CHECKPOLICY) $(CHECKPOLICY_PARAM) $^ -o $@
|
|
|
|
$(FLASK_BUILD_DIR)/policy.conf: $(POLICY_SECTIONS) $(MOD_CONF)
|
|
$(M4) $(M4PARAM) $(POLICY_SECTIONS) > $@
|
|
|
|
clean:
|
|
$(RM) $(FLASK_BUILD_DIR)/policy.conf $(POLICY_FILENAME)
|
|
|
|
distclean: clean
|
|
|
|
.PHONY: all install clean distclean uninstall
|