Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5520f286 authored by Stephen Smalley's avatar Stephen Smalley
Browse files

Use a separate policy for the recovery image. 



Only the recovery image needs to include the recovery domain
in its policy, so create a separate policy for the recovery image
and replace the root policy with this one when building the
recovery image.

Depends on the change with the same Change-Id in external/sepolicy.

Change-Id: I444107f9821eabf4164ba07a44d03bd71e719989
Signed-off-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
parent aae7e3fa

core/Makefile

+4 −1
Original line number Diff line number Diff line
@@ -650,6 +650,7 @@ ifeq (,$(filter true, $(TARGET_NO_KERNEL) $(TARGET_NO_RECOVERY))) 
INSTALLED_RECOVERYIMAGE_TARGET := $(PRODUCT_OUT)/recovery.img



recovery_initrc := $(call include-path-for, recovery)/etc/init.rc

recovery_sepolicy := $(call intermediates-dir-for,ETC,sepolicy.recovery)/sepolicy.recovery

recovery_kernel := $(INSTALLED_KERNEL_TARGET) # same as a non-recovery system

recovery_ramdisk := $(PRODUCT_OUT)/ramdisk-recovery.img

recovery_build_prop := $(INSTALLED_BUILD_PROP_TARGET)
@@ -724,7 +725,7 @@ $(INSTALLED_RECOVERYIMAGE_TARGET): $(MKBOOTFS) $(MKBOOTIMG) $(MINIGZIP) \ 
		$(INSTALLED_RAMDISK_TARGET) \

		$(INSTALLED_BOOTIMAGE_TARGET) \

		$(recovery_binary) \

		$(recovery_initrc) $(recovery_kernel) \

		$(recovery_initrc) $(recovery_sepolicy) $(recovery_kernel) \

		$(INSTALLED_2NDBOOTLOADER_TARGET) \

		$(recovery_build_prop) $(recovery_resource_deps) \

		$(recovery_fstab) \
@@ -738,6 +739,8 @@ $(INSTALLED_RECOVERYIMAGE_TARGET): $(MKBOOTFS) $(MKBOOTIMG) $(MINIGZIP) \ 
	@echo Modifying ramdisk contents...

	$(hide) rm -f $(TARGET_RECOVERY_ROOT_OUT)/init*.rc

	$(hide) cp -f $(recovery_initrc) $(TARGET_RECOVERY_ROOT_OUT)/

	$(hide) rm -f $(TARGET_RECOVERY_ROOT_OUT)/sepolicy

	$(hide) cp -f $(recovery_sepolicy) $(TARGET_RECOVERY_ROOT_OUT)/sepolicy

	$(hide) -cp $(TARGET_ROOT_OUT)/init.recovery.*.rc $(TARGET_RECOVERY_ROOT_OUT)/

	$(hide) cp -f $(recovery_binary) $(TARGET_RECOVERY_ROOT_OUT)/sbin/

	$(hide) cp -rf $(recovery_resources_common) $(TARGET_RECOVERY_ROOT_OUT)/