Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a4e25c19 authored by Cole Faust's avatar Cole Faust Committed by Automerger Merge Worker
Browse files

Merge "Enable genrule sandboxing by default" into main am: 2f07f035 am: 732b0b3b am: fe5018b5 

Original change: https://android-review.googlesource.com/c/platform/build/+/2782270



Change-Id: Ia56567cb0283ac184564f36d6a2dd0c2e78fd94f
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 54602429 fe5018b5

Changes.md

+9 −0
Original line number Diff line number Diff line 
# Build System Changes for Android.mk/Android.bp Writers



## Soong genrules are now sandboxed



Previously, soong genrules could access any files in the source tree, without specifying them as

inputs. This makes them incorrect in incremental builds, and incompatible with RBE and Bazel.



Now, genrules are sandboxed so they can only access their listed srcs. Modules denylisted in

genrule/allowlists.go are exempt from this. You can also set `BUILD_BROKEN_GENRULE_SANDBOXING`

in board config to disable this behavior.



## Partitions are no longer affected by previous builds



Partition builds used to include everything in their staging directories, and building an

core/board_config.mk

+1 −0
Original line number Diff line number Diff line
@@ -188,6 +188,7 @@ _build_broken_var_list := \ 
  BUILD_BROKEN_VENDOR_PROPERTY_NAMESPACE \

  BUILD_BROKEN_VINTF_PRODUCT_COPY_FILES \

  BUILD_BROKEN_INCORRECT_PARTITION_IMAGES \

  BUILD_BROKEN_GENRULE_SANDBOXING \



_build_broken_var_list += \

  $(foreach m,$(AVAILABLE_BUILD_MODULE_TYPES) \

core/soong_config.mk

+6 −1
Original line number Diff line number Diff line
@@ -16,6 +16,10 @@ endif 
# PRODUCT_AFDO_PROFILES takes precedence over product-agnostic profiles in AFDO_PROFILES

ALL_AFDO_PROFILES := $(PRODUCT_AFDO_PROFILES) $(AFDO_PROFILES)



ifneq (,$(filter-out environment undefined,$(origin GENRULE_SANDBOXING)))

  $(error GENRULE_SANDBOXING can only be provided via an environment variable, use BUILD_BROKEN_GENRULE_SANDBOXING to disable genrule sandboxing in board config)

endif



ifeq ($(WRITE_SOONG_VARIABLES),true)



# Create soong.variables with copies of makefile settings.  Runs every build,
@@ -281,7 +285,8 @@ $(call add_json_list, BuildBrokenPluginValidation, $(BUILD_BROKEN_PLUGIN 
$(call add_json_bool, BuildBrokenClangProperty,            $(filter true,$(BUILD_BROKEN_CLANG_PROPERTY)))

$(call add_json_bool, BuildBrokenClangAsFlags,             $(filter true,$(BUILD_BROKEN_CLANG_ASFLAGS)))

$(call add_json_bool, BuildBrokenClangCFlags,              $(filter true,$(BUILD_BROKEN_CLANG_CFLAGS)))

$(call add_json_bool, GenruleSandboxing,                   $(filter true,$(GENRULE_SANDBOXING)))

# Use the value of GENRULE_SANDBOXING if set, otherwise use the inverse of BUILD_BROKEN_GENRULE_SANDBOXING

$(call add_json_bool, GenruleSandboxing,                   $(if $(GENRULE_SANDBOXING),$(filter true,$(GENRULE_SANDBOXING)),$(if $(filter true,$(BUILD_BROKEN_GENRULE_SANDBOXING)),,true)))

$(call add_json_bool, BuildBrokenEnforceSyspropOwner,      $(filter true,$(BUILD_BROKEN_ENFORCE_SYSPROP_OWNER)))

$(call add_json_bool, BuildBrokenTrebleSyspropNeverallow,  $(filter true,$(BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW)))

$(call add_json_bool, BuildBrokenUsesSoongPython2Modules,  $(filter true,$(BUILD_BROKEN_USES_SOONG_PYTHON2_MODULES)))