#
# Makefile for the security policy.
#
# Targets:
# 
# install - compile and install the policy configuration.
# load    - compile, install, and load the policy configuration.
# reload  - compile, install, and load/reload the policy configuration.
# relabel - relabel filesystems based on the file contexts configuration.
# policy  - compile the policy configuration locally for testing/development.
#
# The default target is 'install'.
#

# Set to y if MLS is enabled in the module.
MLS=n

FLASKDIR = flask/
PREFIX = /usr
BINDIR = $(PREFIX)/bin
SBINDIR = $(PREFIX)/sbin
LOADPOLICY  = $(SBINDIR)/load_policy
CHECKPOLICY = $(BINDIR)/checkpolicy
SETFILES = $(SBINDIR)/setfiles
POLICYVER := policy.$(shell $(CHECKPOLICY) $(POLICYCOMPAT) -V |cut -f 1 -d ' ')
INSTALLDIR = $(DESTDIR)/etc/selinux/strict
POLICYPATH = $(INSTALLDIR)/policy
SRCPATH = $(INSTALLDIR)/src
CONTEXTPATH = $(INSTALLDIR)/contexts
LOADPATH = $(POLICYPATH)/$(POLICYVER)
FCPATH = $(CONTEXTPATH)/files/file_contexts

ALL_PROGRAM_MACROS := $(wildcard macros/program/*.te)
ALL_MACROS := $(ALL_PROGRAM_MACROS) $(wildcard macros/*.te)
ALL_TYPES := $(wildcard types/*.te)
ALL_DOMAINS := $(wildcard domains/*.te domains/misc/*.te domains/program/*.te)
ALLTEFILES := attrib.te tmp/program_used_flags.te $(ALL_MACROS) $(ALL_TYPES) $(ALL_DOMAINS) assert.te 
TE_RBAC_FILES := $(ALLTEFILES) rbac
ALL_TUNABLES := $(wildcard tunables/*.tun )

POLICYFILES = $(addprefix $(FLASKDIR),security_classes initial_sids access_vectors)
ifeq ($(MLS),y)
POLICYFILES += mls
endif
POLICYFILES += $(ALL_TUNABLES) $(TE_RBAC_FILES)
POLICYFILES += users serviceusers
POLICYFILES += constraints initial_sid_contexts fs_use genfs_contexts net_contexts

UNUSED_TE_FILES := $(wildcard domains/program/unused/*.te)

FC = file_contexts/file_contexts
FCFILES=tmp/program_used_flags.te file_contexts/types.fc file_contexts/distros.fc $(patsubst domains/program/%.te,file_contexts/program/%.fc, $(wildcard domains/program/*.te)) $(wildcard file_contexts/misc/*.fc)

APPDIR=$(CONTEXTPATH)
APPFILES = $(addprefix $(APPDIR)/,default_contexts default_type initrc_context failsafe_context userhelper_context removable_context dbus_contexts) $(CONTEXTPATH)/files/media

ROOTFILES = $(addprefix $(APPDIR)/users/,root)

install: $(APPFILES) $(ROOTFILES) $(LOADPATH) $(FCPATH) 
	@echo "Validating file_contexts ..."	
	$(SETFILES) -q -c $(LOADPATH) $(FCPATH)

$(CONTEXTPATH)/files/media: appconfig/media
	mkdir -p $(CONTEXTPATH)/files/
	install -m 644 $< $@

$(APPDIR)/default_contexts: appconfig/default_contexts
	mkdir -p $(APPDIR)
	install -m 644 $< $@

$(APPDIR)/removable_context: appconfig/removable_context
	mkdir -p $(APPDIR)
	install -m 644 $< $@

$(APPDIR)/default_type: appconfig/default_type
	mkdir -p $(APPDIR)
	install -m 644 $< $@

$(APPDIR)/userhelper_context: appconfig/userhelper_context
	mkdir -p $(APPDIR)
	install -m 644 $< $@

$(APPDIR)/initrc_context: appconfig/initrc_context
	mkdir -p $(APPDIR)
	install -m 644 $< $@

$(APPDIR)/failsafe_context: appconfig/failsafe_context
	mkdir -p $(APPDIR)
	install -m 644 $< $@

$(APPDIR)/dbus_contexts: appconfig/dbus_contexts
	mkdir -p $(APPDIR)
	install -m 644 $< $@

$(APPDIR)/users/root: appconfig/root_default_contexts
	mkdir -p $(APPDIR)/users
	install -m 644 $< $@

$(LOADPATH):  policy.conf $(CHECKPOLICY)
	mkdir -p $(POLICYPATH)
	$(CHECKPOLICY) -o $@ policy.conf
# Note: Can't use install, so not sure how to deal with mode, user, and group
#	other than by default.

policy: $(POLICYVER)

$(POLICYVER):  policy.conf $(FC) $(CHECKPOLICY)
	$(CHECKPOLICY) -o $@ policy.conf
	@echo "Validating file_contexts ..."
	$(SETFILES) -q -c $(POLICYVER) $(FC)

reload tmp/load: install
	$(LOADPOLICY) $(LOADPATH)
	touch tmp/load

load: tmp/load

enableaudit: policy.conf 
	grep -v dontaudit policy.conf > policy.audit
	mv policy.audit policy.conf

policy.conf: $(POLICYFILES) 
	mkdir -p tmp
	m4 $(M4PARAM) -Imacros -s $^ > $@.tmp
	mv $@.tmp $@

install-src: 
	rm -rf $(SRCPATH)/policy.old
	-mv $(SRCPATH)/policy $(SRCPATH)/policy.old
	mkdir -p $(SRCPATH)/policy
	cp -R . $(SRCPATH)/policy

tmp/program_used_flags.te: $(wildcard domains/program/*.te) domains/program
	mkdir -p tmp
	( cd domains/program/ ; for n in *.te ; do echo "define(\`$$n')"; done ) > $@.tmp
	( cd domains/misc/ ; for n in *.te ; do echo "define(\`$$n')"; done ) >> $@.tmp
	mv $@.tmp $@

FILESYSTEMS=`mount | grep -v "context=" | egrep -v '\((|.*,)bind(,.*|)\)' | awk '/(ext[23]| xfs|reiserfs).*rw/{print $$3}';`

checklabels: $(SETFILES)
	$(SETFILES) -v -n $(FC) $(FILESYSTEMS)

restorelabels: $(SETFILES)
	$(SETFILES) -v $(FC) $(FILESYSTEMS)

relabel:  $(FC) $(SETFILES)
	$(SETFILES) $(FC) $(FILESYSTEMS)

file_contexts/misc:
	mkdir -p file_contexts/misc

$(FCPATH): $(FC) 
	@mkdir -p $(CONTEXTPATH)/files
	install -m 644 $(FC) $(FCPATH)

$(FC): $(FCFILES) $(ALL_TUNABLES) domains/program domains/misc file_contexts/program file_contexts/misc users /etc/passwd
	@echo "Building file_contexts ..."
	@m4 $(M4PARAM) $(ALL_TUNABLES) $(FCFILES) > $@.tmp
	@grep -v "^/root" $@.tmp > $@.root
	@/usr/sbin/genhomedircon . $@.root  > $@
	@grep "^/root" $@.tmp >> $@
	@-rm $@.tmp $@.root

clean:
	rm -f policy.conf $(POLICYVER)
	rm -f tmp/*
	rm -f $(FC)
	rm -f flask/*.h
# for the policy regression tester
	find "domains/program/" -maxdepth 1 -type l -exec rm {} \; ; \

# Policy regression tester.
# Written by Colin Walters <walters@debian.org>
cur_te = $(filter-out %/,$(subst /,/ ,$@))

TESTED_TE_FILES := $(notdir $(UNUSED_TE_FILES))

define compute_depends
  export TE_DEPENDS_$(1) := $(shell egrep '^#[[:space:]]*Depends: ' domains/program/unused/$(1) | head -1 | sed -e 's/^.*Depends: //')
endef


ifeq ($(TE_DEPENDS_DEFINED),)
ifeq ($(MAKECMDGOALS),check-all)
  GENRULES := $(TESTED_TE_FILES)
  export TE_DEPENDS_DEFINED := yes
else
  # Handle the case where checkunused/blah.te is run directly.
  ifneq ($(findstring checkunused/,$(MAKECMDGOALS)),)
    GENRULES := $(TESTED_TE_FILES)
    export TE_DEPENDS_DEFINED := yes
  endif
endif
endif

# Test for a new enough version of GNU Make.
$(eval have_eval := yes)
ifneq ($(GENRULES),)
  ifeq ($(have_eval),)
$(error Need GNU Make 3.80 or better!)
Need GNU Make 3.80 or better
  endif
endif
$(foreach f,$(GENRULES),$(eval $(call compute_depends,$(f))))

PHONIES :=

define compute_presymlinks
PHONIES += presymlink/$(1)
presymlink/$(1):: $(patsubst %,presymlink/%,$(TE_DEPENDS_$(1)))
	@if ! test -L domains/program/$(1); then \
	  cd domains/program && ln -s unused/$(1) .; \
	fi
endef

# Compute dependencies.
$(foreach f,$(TESTED_TE_FILES),$(eval $(call compute_presymlinks,$(f))))

PHONIES += $(patsubst %,checkunused/%,$(TESTED_TE_FILES))
$(patsubst %,checkunused/%,$(TESTED_TE_FILES)) :: checkunused/% : 
	@$(MAKE) -s clean

$(patsubst %,checkunused/%,$(TESTED_TE_FILES)) :: checkunused/% : presymlink/%
	@if test -n "$(TE_DEPENDS_$(cur_te))"; then \
	  echo "Dependencies for $(cur_te): $(TE_DEPENDS_$(cur_te))"; \
	fi
	@echo "Testing $(cur_te)...";
	@if ! make -s policy 1>/dev/null; then \
	  echo "Testing $(cur_te)...FAILED"; \
	  exit 1; \
	fi;
	@echo "Testing $(cur_te)...success."; \

check-all:
	@for goal in  $(patsubst %,checkunused/%,$(TESTED_TE_FILES)); do \
	  $(MAKE) --no-print-directory $$goal; \
	done

.PHONY: clean $(PHONIES)
