mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 02:01:24 +01:00
Wei Liu
c47237a3d9
The flask policy can be build twice -- one for hypervisor and one for tools. Before this patch, everything is built inside tools/flask/policy directory. It is possible to have a race to write to the same output file when running parallel builds. Prepend output file names with FLASK_BUILD_DIR. Hypervisor and tools build will set that variable to different directories, so that we can be safe from races. Adjust other bits of the build system as needed. Signed-off-by: Wei Liu <wei.liu2@citrix.com> Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Release-acked-by: Wei Liu <wei.liu2@citrix.com>
133 lines
4.0 KiB
Makefile
133 lines
4.0 KiB
Makefile
# This file is referenced by both hypervisor build and tools build
|
|
# so there shouldn't be any tools specific things here.
|
|
|
|
XEN_ROOT=$(CURDIR)/../../..
|
|
|
|
ifeq ($(FLASK_BUILD_DIR),)
|
|
$(error FLASK_BUILD_DIR not set)
|
|
endif
|
|
|
|
########################################
|
|
#
|
|
# Configurable portions of the Makefile
|
|
#
|
|
########################################
|
|
|
|
CONFIG_MLS ?= n
|
|
|
|
# Number of available MLS sensitivities and categories.
|
|
# The sensitivities will be s0 to s(MLS_SENS-1). Dominance will be in
|
|
# increasing numerical order with s0 being lowest.
|
|
MLS_SENS ?= 16
|
|
# The categories will be c0 to c(MLS_CATS-1).
|
|
MLS_CATS ?= 256
|
|
|
|
# executable paths
|
|
CHECKPOLICY ?= checkpolicy
|
|
M4 ?= m4
|
|
|
|
# Output security policy version. Leave unset to autodetect.
|
|
OUTPUT_POLICY ?= $(BEST_POLICY_VER)
|
|
|
|
########################################
|
|
#
|
|
# End of configuration options
|
|
#
|
|
########################################
|
|
|
|
POLICY_FILENAME = $(FLASK_BUILD_DIR)/xenpolicy-$(shell $(MAKE) -C $(XEN_ROOT)/xen xenversion --no-print-directory)
|
|
POLICY_LOADPATH = /boot
|
|
|
|
# List of policy versions supported by the hypervisor
|
|
POLICY_VER_LIST_HV = 24 30
|
|
|
|
# policy source layout
|
|
POLDIR := policy
|
|
MODDIR := modules
|
|
|
|
# Classes and access vectors defined in the hypervisor. Changes to these require
|
|
# a recompile of both the hypervisor and security policy.
|
|
FLASKDIR := ../../../xen/xsm/flask/policy
|
|
SECCLASS := $(FLASKDIR)/security_classes
|
|
ISID_DECLS := $(FLASKDIR)/initial_sids
|
|
AVS := $(FLASKDIR)/access_vectors
|
|
|
|
# Additional classes and access vectors defined by local policy
|
|
SECCLASS += $(POLDIR)/security_classes
|
|
AVS += $(POLDIR)/access_vectors
|
|
|
|
# Other policy components
|
|
M4SUPPORT := $(wildcard $(POLDIR)/support/*.spt)
|
|
MLSSUPPORT := $(POLDIR)/mls
|
|
USERS := $(POLDIR)/users
|
|
ISID_DEFS := $(POLDIR)/initial_sids
|
|
DEV_OCONS := $(POLDIR)/device_contexts
|
|
|
|
# config file paths
|
|
GLOBALTUN := $(POLDIR)/global_tunables
|
|
MOD_CONF := $(MODDIR)/modules.conf
|
|
|
|
# checkpolicy can use the #line directives provided by -s for error reporting:
|
|
M4PARAM := -D self_contained_policy -s
|
|
|
|
# The output of checkpolicy -V is "30 (compatibility range 30-15)", and the
|
|
# first word of the output is the maximum policy version supported.
|
|
CHECKPOLICY_VER_MAX := $(firstword $(shell $(CHECKPOLICY) -V))
|
|
|
|
# Find the highest version supported by both the hypervisor and checkpolicy
|
|
BEST_POLICY_VER := $(shell best=24; for ver in $(POLICY_VER_LIST_HV); do if test $$ver -le $(CHECKPOLICY_VER_MAX); then best=$$ver; fi; done; echo $$best)
|
|
|
|
CHECKPOLICY_PARAM := -t Xen -c $(OUTPUT_POLICY)
|
|
|
|
# enable MLS if requested.
|
|
ifneq ($(CONFIG_MLS),n)
|
|
M4PARAM += -D enable_mls
|
|
CHECKPOLICY_PARAM += -M
|
|
endif
|
|
|
|
# Always define these because they are referenced even in non-MLS policy
|
|
M4PARAM += -D mls_num_sens=$(MLS_SENS) -D mls_num_cats=$(MLS_CATS)
|
|
|
|
|
|
# modules.conf setting for policy configuration
|
|
MODENABLED := on
|
|
|
|
# extract settings from modules.conf
|
|
ENABLED_LIST := $(shell awk '/^[ \t]*[a-z]/{ if ($$3 == "$(MODENABLED)") print $$1 }' $(MOD_CONF) 2> /dev/null)
|
|
|
|
# Modules must provide a .te file, although it could be empty
|
|
ALL_MODULES := $(foreach mod,$(ENABLED_LIST),$(MODDIR)/$(mod).te)
|
|
|
|
# Modules may also provide interfaces and constraint definitions
|
|
ALL_INTERFACES := $(wildcard $(ALL_MODULES:.te=.if))
|
|
ALL_CONSTRAINTS := $(wildcard $(ALL_MODULES:.te=.cons))
|
|
|
|
# The order of these files is important
|
|
POLICY_SECTIONS := $(SECCLASS) $(ISID_DECLS) $(AVS)
|
|
POLICY_SECTIONS += $(M4SUPPORT) $(MLSSUPPORT)
|
|
POLICY_SECTIONS += $(ALL_INTERFACES)
|
|
POLICY_SECTIONS += $(GLOBALTUN)
|
|
POLICY_SECTIONS += $(ALL_MODULES)
|
|
POLICY_SECTIONS += $(USERS)
|
|
POLICY_SECTIONS += $(ALL_CONSTRAINTS)
|
|
POLICY_SECTIONS += $(ISID_DEFS) $(DEV_OCONS)
|
|
|
|
all: $(POLICY_FILENAME)
|
|
|
|
install: $(POLICY_FILENAME)
|
|
$(INSTALL_DIR) $(DESTDIR)/$(POLICY_LOADPATH)
|
|
$(INSTALL_DATA) $^ $(DESTDIR)/$(POLICY_LOADPATH)
|
|
|
|
$(POLICY_FILENAME): $(FLASK_BUILD_DIR)/policy.conf
|
|
$(CHECKPOLICY) $(CHECKPOLICY_PARAM) $^ -o $@
|
|
|
|
$(FLASK_BUILD_DIR)/policy.conf: $(POLICY_SECTIONS) $(MOD_CONF)
|
|
$(M4) $(M4PARAM) $(POLICY_SECTIONS) > $@
|
|
|
|
clean:
|
|
$(RM) $(FLASK_BUILD_DIR)/policy.conf $(POLICY_FILENAME)
|
|
|
|
distclean: clean
|
|
|
|
.PHONY: all install clean distclean
|