aboutsummaryrefslogtreecommitdiffstats
path: root/README
Commit message (Collapse)AuthorAgeFilesLines
* Drop BOARD_SEPOLICY_UNION.Stephen Smalley2015-04-011-30/+9
| | | | | | | | | | | | | | | | | As suggested in the comments on https://android-review.googlesource.com/#/c/141560/ drop BOARD_SEPOLICY_UNION and simplify the build_policy logic. Union all files found under BOARD_SEPOLICY_DIRS. Unlike BOARD_SEPOLICY_REPLACE/IGNORE, on which we trigger an error to catch any lingering uses and force updating of the BoardConfig.mk files, we only warn on uses of BOARD_SEPOLICY_UNION to avoid breaking the build until all device BoardConfig*.mk files have been updated, and since they should be harmless - the files will be unioned regardless. Change-Id: I4214893c999c23631f5456cb1b8edd59771ef13b Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
* sepolicy: Drop BOARD_SEPOLICY_IGNORE/REPLACE support.Stephen Smalley2015-03-131-48/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With changes I431c1ab22fc53749f623937154b9ec43469d9645 and Ia54aa263f2245c7090f4b9d9703130c19f11bd28, it is no longer legitimate to use BOARD_SEPOLICY_IGNORE or REPLACE with any of the *_contexts files since the CTS requires the AOSP entries to be present in the device files. Further, these changes render BOARD_SEPOLICY_IGNORE unusable for most policy files since all domains and types referenced within any of the AOSP *_contexts entries must be defined in the kernel policy, so you cannot use BOARD_SEPOLICY_IGNORE to exclude any .te file that defines a type referenced in any of those *_contexts files. There does not seem to be a significant need for such a facility, as AOSP policy is small and only domains and types used by most devices should be defined in external/sepolicy. BOARD_SEPOLICY_REPLACE is commonly misused to eliminate neverallow rules from AOSP policy, which will only lead to CTS failures, especially since change Iefe508df265f62efa92f8eb74fc65542d39e3e74 introduced neverallow checking on the entire policy via sepolicy-analyze. The only remaining legitimate function of BOARD_SEPOLICY_REPLACE is to support overriding AOSP .te files with more restrictive rule sets. However, the need for this facility has been significantly reduced by the fact that AOSP policy is now fully confined + enforcing for all domains, and further restrictions beyond AOSP carry a compatibility risk. Builders of custom policies and custom ROMs still have the freedom to apply patches on top of external/sepolicy to tighten rule sets (which are likely more maintainable than maintaining a completely separate copy of the file via BOARD_SEPOLICY_REPLACE) and/or of using their own separate policy build system as exemplified by https://bitbucket.org/quarksecurity/build-policies Change-Id: I2611e983f7cbfa15f9d45ec3ea301e94132b06fa Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
* sepolicy: Add an introduction to the README.Stephen Smalley2015-02-231-0/+6
| | | | | | | | | | The README jumped directly into using the BOARD_SEPOLICY_* variables for device-specific policy; add a short introduction describing what external/sepolicy contains and noting where to put device-specific policy. Change-Id: I3c800df93d70074384da993a689a5a0771ecb314 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
* Update readme to reflect addition of SEPOLICY_IGNORE.dcashman2014-07-221-1/+1
| | | | Change-Id: I427c0f4828d45f2c43206c09cb37e3eb30455dee
* Update README.Robert Craig2014-02-031-0/+3
| | | | | | | | | | Commit Icc5febc5fe5a7cccb90ac5b83e6289c2aa5bf069 introduced a new error check for non existent BOARD_SEPOLICY_UNION files. Need an update to the docs describing the change. Change-Id: If96c9046565b05e0811ab2d526ae12a3b8b90bf0 Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
* README: recommend concatenation vs assignmentNick Kralevich2013-11-011-6/+6
| | | | | | | | Recommend using concatenation versus assignment when making policy declarations inside BoardConfig.mk. This will allow sepolicy to exist in the vendor directory. Change-Id: If982217fcb3645d9c6b37a341755b5b65f26fc5f
* readme: add info on generating pem files from apksWilliam Roberts2013-10-301-0/+11
| | | | | | | | Often times OEMs and other integrators will need to create PEM files from presigned APKs they are integrating. This patch will update the README to include a technique for doing so. Change-Id: Ica52269542409d2038cfe30cbd5f28ead2fba4de
* README: Add quip on keys.conf supporting env varsWilliam Roberts2013-10-291-1/+3
| | | | | | | | | Since Change-Id: If4f169d9ed4f37b6ebd062508de058f3baeafead the insert_keys.py tool has had support for expanding environment variable strings. This change addresses the lack of an updated README covering said change. Change-Id: I88e81ea58fb84110da3fc3cfb8b49fd0d6c027c2
* Expand insertkeys.py script to allow union of files.Robert Craig2013-03-271-10/+9
| | | | | | | | | Allow script to union mac_permissions.xml files specified using the BOARD_SEPOLICY_DIRS and BOARD_SEPOLICY_UNION constructs. Change-Id: I4fc65fd1ab4c612f25e966f030247e54a270b614 Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
* Revert "Revert "Revert "Revert "Dynamic insertion of pubkey to ↵Geremy Condra2013-03-261-0/+44
| | | | | | | | | | mac_permissions.xml"""" This reverts commit 60d4d71ead9e9ac96e9cb81380c254bac3a9df4f This should (finally) be fixed in https://android-review.googlesource.com/#/c/54730/ Change-Id: I3dd358560f7236f28387ffbe247fc2b004e303ea
* Revert "Revert "Revert "Dynamic insertion of pubkey to mac_permissions.xml"""Geremy Condra2013-03-261-44/+0
| | | | | | | | This reverts commit cd4104e84b438827fddd6a7fe6cb86e91392152d This builds clean locally, but seems to explode on the build servers. Reverting until there's a solution. Change-Id: I09200db37c193f39c77486d5957a8f5916e38aa0
* Revert "Revert "Dynamic insertion of pubkey to mac_permissions.xml""Geremy Condra2013-03-261-0/+44
| | | | | | | | This reverts commit 1446e714af0b0c358b5ecf37c5d704c96c72cf7c Hidden dependency has been resolved. Change-Id: Ia535c0b9468ea5f705dff9813186a7fa8bab84ae
* Add BOARD_SEPOLICY_IGNOREWilliam Roberts2013-03-211-2/+21
| | | | | | See README for further details. Change-Id: I4599c7ecd5a552e38de89d0a9e496e047068fe05
* Revert "Dynamic insertion of pubkey to mac_permissions.xml"Geremy Condra2013-03-191-44/+0
| | | | | | This reverts commit 22fc04103b70dd5a1cb1b5a8309ef20461e06289 Change-Id: I2d91b1262e8d0e82a21ea7c5333b1e86f3ed9bee
* Dynamic insertion of pubkey to mac_permissions.xmlWilliam Roberts2012-12-081-0/+44
| | | | | | | | Support the inseretion of the public key from pem files into the mac_permissions.xml file at build time. Change-Id: Ia42b6cba39bf93723ed3fb85236eb8f80a08962a
* README for configuration of selinux policyWilliam Roberts2012-11-261-0/+58
This README intends to document the various configuration options that exist for specifiying device specific additions to the policy. Change-Id: I7db708429a67deeb89b0c155a116606dcbbbc975
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-27 06:10:20 +0000