2006-04-11 21:52:54 +00:00
|
|
|
# ----------------------------------------------------------------------
|
2007-04-11 08:12:51 +00:00
|
|
|
# Copyright (c) 1999, 2000, 2001, 2002, 2004, 2005, 2006, 2007
|
|
|
|
# NOVELL (All rights reserved)
|
2006-04-11 21:52:54 +00:00
|
|
|
#
|
|
|
|
# This program is free software; you can redistribute it and/or
|
|
|
|
# modify it under the terms of version 2 of the GNU General Public
|
|
|
|
# License published by the Free Software Foundation.
|
|
|
|
#
|
|
|
|
# This program is distributed in the hope that it will be useful,
|
|
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
# GNU General Public License for more details.
|
|
|
|
#
|
|
|
|
# You should have received a copy of the GNU General Public License
|
|
|
|
# along with this program; if not, contact Novell, Inc.
|
|
|
|
# ----------------------------------------------------------------------
|
|
|
|
NAME=apparmor-parser
|
|
|
|
all:
|
2006-04-12 03:09:10 +00:00
|
|
|
COMMONDIR=../common/
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2006-11-04 21:34:47 +00:00
|
|
|
include common/Make.rules
|
2006-04-11 21:52:54 +00:00
|
|
|
|
|
|
|
COMMONDIR_EXISTS=$(strip $(shell [ -d ${COMMONDIR} ] && echo true))
|
|
|
|
ifeq ($(COMMONDIR_EXISTS), true)
|
2006-11-04 21:34:47 +00:00
|
|
|
common/Make.rules: $(COMMONDIR)/Make.rules
|
|
|
|
ln -sf $(COMMONDIR) .
|
2006-04-11 21:52:54 +00:00
|
|
|
endif
|
|
|
|
|
|
|
|
DESTDIR=/
|
|
|
|
APPARMOR_BIN_PREFIX=${DESTDIR}/lib/apparmor
|
|
|
|
CONFDIR=/etc/apparmor
|
|
|
|
INSTALL_CONFDIR=${DESTDIR}${CONFDIR}
|
|
|
|
LOCALEDIR=/usr/share/locale
|
2007-04-03 19:04:10 +00:00
|
|
|
MANPAGES=apparmor.d.5 apparmor.7 apparmor_parser.8 subdomain.conf.5 apparmor.vim.5
|
2006-04-11 21:52:54 +00:00
|
|
|
|
|
|
|
YACC := /usr/bin/bison
|
|
|
|
YFLAGS := -d
|
|
|
|
LEX := /usr/bin/flex
|
|
|
|
LEXFLAGS = -B -v
|
2010-11-09 13:39:18 -08:00
|
|
|
WARNINGS = -Wall
|
|
|
|
EXTRA_WARNINGS = -Wsign-compare -Wmissing-field-initializers -Wformat-security -Wunused-parameter
|
|
|
|
CXX_WARNINGS = ${WARNINGS} $(shell for warning in ${EXTRA_WARNINGS} ; do \
|
2006-04-11 21:52:54 +00:00
|
|
|
if ${CC} $${warning} -S -o /dev/null -xc /dev/null >/dev/null 2>&1; then \
|
|
|
|
echo "$${warning}"; \
|
|
|
|
fi ; \
|
|
|
|
done)
|
2010-11-09 13:39:18 -08:00
|
|
|
CPP_WARNINGS = -Wstrict-prototypes -Wnested-externs
|
2010-10-09 14:15:59 -07:00
|
|
|
ifndef CFLAGS
|
|
|
|
CFLAGS = -g -O2 -pipe
|
2006-04-11 21:52:54 +00:00
|
|
|
|
|
|
|
ifdef DEBUG
|
2011-09-01 11:57:54 -07:00
|
|
|
CFLAGS += -pg -D DEBUG
|
2006-04-11 21:52:54 +00:00
|
|
|
endif
|
2010-10-09 14:15:59 -07:00
|
|
|
endif #CFLAGS
|
|
|
|
|
2010-11-09 13:39:18 -08:00
|
|
|
EXTRA_CXXFLAGS = ${CFLAGS} ${CXX_WARNINGS} -D_GNU_SOURCE
|
|
|
|
EXTRA_CFLAGS = ${EXTRA_CXXFLAGS} ${CPP_WARNINGS}
|
2006-04-11 21:52:54 +00:00
|
|
|
|
|
|
|
#LEXLIB := -lfl
|
|
|
|
|
|
|
|
# override this on the make command to point to where the immunix.h file is
|
|
|
|
# (yeah this is lame, but since we are tied to the kernel so tightly...)
|
|
|
|
#INCLUDEDIR = /usr/src/linux/include
|
|
|
|
INCLUDEDIR =
|
|
|
|
|
|
|
|
ifdef INCLUDEDIR
|
|
|
|
CFLAGS += -I$(INCLUDEDIR)
|
|
|
|
endif
|
|
|
|
|
|
|
|
# Internationalization support. Define a package and a LOCALEDIR
|
|
|
|
EXTRA_CFLAGS+=-DPACKAGE=\"${NAME}\" -DLOCALEDIR=\"${LOCALEDIR}\"
|
|
|
|
|
|
|
|
# Compile-time configuration of the location of the config file
|
|
|
|
EXTRA_CFLAGS+=-DSUBDOMAIN_CONFDIR=\"${CONFDIR}\"
|
|
|
|
|
[v2: added clean-ups, backed off on some of the build silencing]
This is a rather large rearrangement of how a subset of the parser global
variables are defined. Right now, there are unit tests built without
linking against parser_main.c. As a result, none of the globals defined in
parser_main.c could be used in the code that is built for unit tests
(misc, regex, symtab, variable). To get a clean build, either stubs needed
to be added to "#ifdef UNIT_TEST" blocks in each .c file, or we had to
depend on link-time optimizations that would throw out the unused routines.
First, this is a problem because all the compile-time warnings had to be
explicitly silenced, so reviewing the build logs becomes difficult on
failures, and we can potentially (in really unlucky situations) test
something that isn't actually part of the "real" parser.
Second, not all compilers will allow this kind of linking (e.g. mips gcc),
and the missing symbols at link time will fail the entire build even though
they're technically not needed.
To solve all of this, I've moved all of the global variables used in lex,
yacc, and main to parser_common.c, and adjusted the .h files. On top of
this, I made sure to fully link the tst builds so all symbols are resolved
(including aare lib) and removedonly tst build-log silencing (for now,
deferring to another future patchset to consolidate the build silencing).
Signed-off-by: Kees Cook <kees.cook@canonical.com>
2011-05-13 02:12:49 -07:00
|
|
|
SRCS = parser_common.c parser_include.c parser_interface.c parser_lex.c \
|
|
|
|
parser_main.c parser_misc.c parser_merge.c parser_symtab.c \
|
|
|
|
parser_yacc.c parser_regex.c parser_variable.c parser_policy.c \
|
Add mount rules
Add the ability to control mounting and unmounting
The basic form of the rules are.
[audit] [deny] mount [conds]* [device] [ -> [conds] path],
[audit] [deny] remount [conds]* [path],
[audit] [deny] umount [conds]* [path],
[audit] [deny] pivotroot [oldroot=<value>] <path> -> <profile>
remount is just a short cut for mount options=remount
where [conds] can be
fstype=<expr>
options=<expr>
conds follow the extended conditional syntax of allowing either:
* a single value after the equals, which has the same character range as
regular IDS (ie most anything but it can't be terminated with a , (comma)
and if spaces or other characters are needed it can be quoted
eg.
options=foo
options = foo
options="foo bar"
* a list of values after the equals, the list of values is enclosed within
parenthesis () and its has a slightly reduced character set but again
elements can be quoted.
the separation between elements is whitespace and commas.
eg.
options=(foo bar)
options=(foo, bar)
options=(foo , bar)
options=(foo,bar)
The rules are flexible and follow a similar pattern as network, capability,
etc.
mount, # allow all mounts, but not umount or pivotroot
mount fstype=procfs, # allow mounting procfs anywhere
mount options=(bind, ro) /foo -> /bar, # readonly bind mount
mount /dev/sda -> /mnt,
mount /dev/sd** -> /mnt/**,
mount fstype=overlayfs options=(rw,upperdir=/tmp/upper/,lowerdir=/) overlay -> /mnt/
umount,
umount /m*,
Currently variables and regexs are are supported on the device and mount
point. ie.
mount <devince> -> <mount point>,
Regexes are supported in fstype and options. The options have a further
caveat that regexs only work if the option is fs specific option.
eg. options=(upperdir=/tmp/*,lowerdir=/)
regex's will not currently work against the standard options like ro, rw
nosuid
Conditionals (fstype) can only be applied to the device (source) at this
time and will be disregarded in situations where the mount is manipulating
an existing mount (bind, remount).
Options can be specified multiple times
mount option=rw option=(nosuid,upperdir=/foo),
and will be combined together into a single set of values
The ordering of the standard mount options (rw,ro, ...) does not matter
but the ordering of fs specific options does.
Specifying that the value of a particular option does not matter can be
acheived by providing both the positive and negative forms of and option
option=(rw,ro) options=(suid,nosuid)
For the fs specific options specifying that a particular value does not
matter is achieve using a regex with alternations.
Improvements to the syntax and order restrictions are planned for the
future.
Signed-off-by: John Johansen <john.johansen@canonical.com>
2012-02-24 04:19:38 -08:00
|
|
|
parser_alias.c mount.c
|
|
|
|
HDRS = parser.h parser_include.h immunix.h mount.h
|
2006-04-11 21:52:54 +00:00
|
|
|
TOOLS = apparmor_parser
|
|
|
|
|
[v2: added clean-ups, backed off on some of the build silencing]
This is a rather large rearrangement of how a subset of the parser global
variables are defined. Right now, there are unit tests built without
linking against parser_main.c. As a result, none of the globals defined in
parser_main.c could be used in the code that is built for unit tests
(misc, regex, symtab, variable). To get a clean build, either stubs needed
to be added to "#ifdef UNIT_TEST" blocks in each .c file, or we had to
depend on link-time optimizations that would throw out the unused routines.
First, this is a problem because all the compile-time warnings had to be
explicitly silenced, so reviewing the build logs becomes difficult on
failures, and we can potentially (in really unlucky situations) test
something that isn't actually part of the "real" parser.
Second, not all compilers will allow this kind of linking (e.g. mips gcc),
and the missing symbols at link time will fail the entire build even though
they're technically not needed.
To solve all of this, I've moved all of the global variables used in lex,
yacc, and main to parser_common.c, and adjusted the .h files. On top of
this, I made sure to fully link the tst builds so all symbols are resolved
(including aare lib) and removedonly tst build-log silencing (for now,
deferring to another future patchset to consolidate the build silencing).
Signed-off-by: Kees Cook <kees.cook@canonical.com>
2011-05-13 02:12:49 -07:00
|
|
|
OBJECTS = $(SRCS:.c=.o)
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2007-02-27 02:29:16 +00:00
|
|
|
AAREDIR= libapparmor_re
|
[v2: added clean-ups, backed off on some of the build silencing]
This is a rather large rearrangement of how a subset of the parser global
variables are defined. Right now, there are unit tests built without
linking against parser_main.c. As a result, none of the globals defined in
parser_main.c could be used in the code that is built for unit tests
(misc, regex, symtab, variable). To get a clean build, either stubs needed
to be added to "#ifdef UNIT_TEST" blocks in each .c file, or we had to
depend on link-time optimizations that would throw out the unused routines.
First, this is a problem because all the compile-time warnings had to be
explicitly silenced, so reviewing the build logs becomes difficult on
failures, and we can potentially (in really unlucky situations) test
something that isn't actually part of the "real" parser.
Second, not all compilers will allow this kind of linking (e.g. mips gcc),
and the missing symbols at link time will fail the entire build even though
they're technically not needed.
To solve all of this, I've moved all of the global variables used in lex,
yacc, and main to parser_common.c, and adjusted the .h files. On top of
this, I made sure to fully link the tst builds so all symbols are resolved
(including aare lib) and removedonly tst build-log silencing (for now,
deferring to another future patchset to consolidate the build silencing).
Signed-off-by: Kees Cook <kees.cook@canonical.com>
2011-05-13 02:12:49 -07:00
|
|
|
AAREOBJECT = ${AAREDIR}/libapparmor_re.a
|
|
|
|
AAREOBJECTS = $(AAREOBJECT) libstdc++.a
|
|
|
|
AARE_LDFLAGS=-static-libgcc -L.
|
2007-02-27 02:29:16 +00:00
|
|
|
|
2006-04-11 21:52:54 +00:00
|
|
|
LEX_C_FILES = parser_lex.c
|
|
|
|
YACC_C_FILES = parser_yacc.c parser_yacc.h
|
|
|
|
|
|
|
|
TESTS = tst_regex tst_misc tst_symtab tst_variable
|
[v2: added clean-ups, backed off on some of the build silencing]
This is a rather large rearrangement of how a subset of the parser global
variables are defined. Right now, there are unit tests built without
linking against parser_main.c. As a result, none of the globals defined in
parser_main.c could be used in the code that is built for unit tests
(misc, regex, symtab, variable). To get a clean build, either stubs needed
to be added to "#ifdef UNIT_TEST" blocks in each .c file, or we had to
depend on link-time optimizations that would throw out the unused routines.
First, this is a problem because all the compile-time warnings had to be
explicitly silenced, so reviewing the build logs becomes difficult on
failures, and we can potentially (in really unlucky situations) test
something that isn't actually part of the "real" parser.
Second, not all compilers will allow this kind of linking (e.g. mips gcc),
and the missing symbols at link time will fail the entire build even though
they're technically not needed.
To solve all of this, I've moved all of the global variables used in lex,
yacc, and main to parser_common.c, and adjusted the .h files. On top of
this, I made sure to fully link the tst builds so all symbols are resolved
(including aare lib) and removedonly tst build-log silencing (for now,
deferring to another future patchset to consolidate the build silencing).
Signed-off-by: Kees Cook <kees.cook@canonical.com>
2011-05-13 02:12:49 -07:00
|
|
|
TEST_CFLAGS = $(EXTRA_CFLAGS) -DUNIT_TEST -Wno-unused-result
|
|
|
|
TEST_OBJECTS = $(filter-out \
|
|
|
|
parser_lex.o \
|
|
|
|
parser_yacc.o \
|
|
|
|
parser_main.o, ${OBJECTS}) \
|
|
|
|
$(AAREOBJECTS)
|
|
|
|
TEST_LDFLAGS = $(AARE_LDFLAGS)
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2008-04-16 16:09:36 +00:00
|
|
|
ifdef V
|
|
|
|
VERBOSE = 1
|
|
|
|
endif
|
2006-05-31 21:30:50 +00:00
|
|
|
ifndef VERBOSE
|
|
|
|
VERBOSE = 0
|
|
|
|
endif
|
|
|
|
ifeq ($(VERBOSE),1)
|
|
|
|
BUILD_OUTPUT =
|
|
|
|
Q =
|
|
|
|
else
|
|
|
|
BUILD_OUTPUT = > /dev/null 2>&1
|
|
|
|
Q = @
|
|
|
|
endif
|
|
|
|
export Q VERBOSE BUILD_OUTPUT
|
|
|
|
|
2006-04-11 21:52:54 +00:00
|
|
|
po/${NAME}.pot: ${SRCS} ${HDRS}
|
2011-11-10 09:36:52 -08:00
|
|
|
$(MAKE) -C po ${NAME}.pot NAME=${NAME} SOURCES="${SRCS} ${HDRS}"
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2007-04-12 06:01:40 +00:00
|
|
|
techdoc.pdf: techdoc.tex
|
2007-05-15 20:02:15 +00:00
|
|
|
while pdflatex $< ${BUILD_OUTPUT} || exit 1 ; \
|
2007-04-12 06:01:40 +00:00
|
|
|
grep -q "Label(s) may have changed" techdoc.log; \
|
|
|
|
do :; done
|
|
|
|
|
|
|
|
techdoc/index.html: techdoc.pdf
|
2007-05-15 20:02:15 +00:00
|
|
|
latex2html -show_section_numbers -split 0 -noinfo -nonavigation -noaddress techdoc.tex ${BUILD_OUTPUT}
|
2007-04-12 06:01:40 +00:00
|
|
|
|
|
|
|
techdoc.txt: techdoc/index.html
|
|
|
|
w3m -dump $< > $@
|
|
|
|
|
2010-03-16 15:18:55 -07:00
|
|
|
# targets arranged this way so that people who don't want full docs can
|
|
|
|
# pick specific targets they want.
|
2011-05-27 14:57:43 -07:00
|
|
|
arch: $(TOOLS)
|
2010-03-16 15:18:55 -07:00
|
|
|
|
|
|
|
manpages: $(MANPAGES)
|
|
|
|
|
|
|
|
htmlmanpages: $(HTMLMANPAGES)
|
|
|
|
|
|
|
|
pdf: techdoc.pdf
|
|
|
|
|
|
|
|
docs: manpages htmlmanpages pdf
|
|
|
|
|
2011-05-27 14:57:43 -07:00
|
|
|
indep: docs
|
2011-11-10 09:36:52 -08:00
|
|
|
$(Q)$(MAKE) -C po all
|
2011-05-27 14:57:43 -07:00
|
|
|
|
|
|
|
all: arch indep
|
|
|
|
|
2006-04-11 21:52:54 +00:00
|
|
|
|
[v2: added clean-ups, backed off on some of the build silencing]
This is a rather large rearrangement of how a subset of the parser global
variables are defined. Right now, there are unit tests built without
linking against parser_main.c. As a result, none of the globals defined in
parser_main.c could be used in the code that is built for unit tests
(misc, regex, symtab, variable). To get a clean build, either stubs needed
to be added to "#ifdef UNIT_TEST" blocks in each .c file, or we had to
depend on link-time optimizations that would throw out the unused routines.
First, this is a problem because all the compile-time warnings had to be
explicitly silenced, so reviewing the build logs becomes difficult on
failures, and we can potentially (in really unlucky situations) test
something that isn't actually part of the "real" parser.
Second, not all compilers will allow this kind of linking (e.g. mips gcc),
and the missing symbols at link time will fail the entire build even though
they're technically not needed.
To solve all of this, I've moved all of the global variables used in lex,
yacc, and main to parser_common.c, and adjusted the .h files. On top of
this, I made sure to fully link the tst builds so all symbols are resolved
(including aare lib) and removedonly tst build-log silencing (for now,
deferring to another future patchset to consolidate the build silencing).
Signed-off-by: Kees Cook <kees.cook@canonical.com>
2011-05-13 02:12:49 -07:00
|
|
|
.PHONY: libstdc++.a
|
|
|
|
libstdc++.a:
|
2007-02-27 02:29:16 +00:00
|
|
|
rm -f ./libstdc++.a
|
2011-11-10 09:36:52 -08:00
|
|
|
ln -s `$(CXX) -print-file-name=libstdc++.a`
|
[v2: added clean-ups, backed off on some of the build silencing]
This is a rather large rearrangement of how a subset of the parser global
variables are defined. Right now, there are unit tests built without
linking against parser_main.c. As a result, none of the globals defined in
parser_main.c could be used in the code that is built for unit tests
(misc, regex, symtab, variable). To get a clean build, either stubs needed
to be added to "#ifdef UNIT_TEST" blocks in each .c file, or we had to
depend on link-time optimizations that would throw out the unused routines.
First, this is a problem because all the compile-time warnings had to be
explicitly silenced, so reviewing the build logs becomes difficult on
failures, and we can potentially (in really unlucky situations) test
something that isn't actually part of the "real" parser.
Second, not all compilers will allow this kind of linking (e.g. mips gcc),
and the missing symbols at link time will fail the entire build even though
they're technically not needed.
To solve all of this, I've moved all of the global variables used in lex,
yacc, and main to parser_common.c, and adjusted the .h files. On top of
this, I made sure to fully link the tst builds so all symbols are resolved
(including aare lib) and removedonly tst build-log silencing (for now,
deferring to another future patchset to consolidate the build silencing).
Signed-off-by: Kees Cook <kees.cook@canonical.com>
2011-05-13 02:12:49 -07:00
|
|
|
|
|
|
|
apparmor_parser: $(OBJECTS) $(AAREOBJECTS)
|
2011-11-10 09:36:52 -08:00
|
|
|
$(CXX) $(EXTRA_CFLAGS) -o $@ $(OBJECTS) $(LIBS) \
|
[v2: added clean-ups, backed off on some of the build silencing]
This is a rather large rearrangement of how a subset of the parser global
variables are defined. Right now, there are unit tests built without
linking against parser_main.c. As a result, none of the globals defined in
parser_main.c could be used in the code that is built for unit tests
(misc, regex, symtab, variable). To get a clean build, either stubs needed
to be added to "#ifdef UNIT_TEST" blocks in each .c file, or we had to
depend on link-time optimizations that would throw out the unused routines.
First, this is a problem because all the compile-time warnings had to be
explicitly silenced, so reviewing the build logs becomes difficult on
failures, and we can potentially (in really unlucky situations) test
something that isn't actually part of the "real" parser.
Second, not all compilers will allow this kind of linking (e.g. mips gcc),
and the missing symbols at link time will fail the entire build even though
they're technically not needed.
To solve all of this, I've moved all of the global variables used in lex,
yacc, and main to parser_common.c, and adjusted the .h files. On top of
this, I made sure to fully link the tst builds so all symbols are resolved
(including aare lib) and removedonly tst build-log silencing (for now,
deferring to another future patchset to consolidate the build silencing).
Signed-off-by: Kees Cook <kees.cook@canonical.com>
2011-05-13 02:12:49 -07:00
|
|
|
${LEXLIB} $(AAREOBJECTS) $(AARE_LDFLAGS)
|
2006-04-11 21:52:54 +00:00
|
|
|
|
|
|
|
parser_yacc.c parser_yacc.h: parser_yacc.y parser.h
|
2008-11-14 16:46:16 +00:00
|
|
|
$(YACC) $(YFLAGS) -o parser_yacc.c parser_yacc.y
|
2006-04-11 21:52:54 +00:00
|
|
|
|
|
|
|
parser_lex.c: parser_lex.l parser_yacc.h parser.h
|
|
|
|
$(LEX) ${LEXFLAGS} -o$@ $<
|
|
|
|
|
|
|
|
parser_lex.o: parser_lex.c parser.h parser_yacc.h
|
|
|
|
$(CC) $(EXTRA_CFLAGS) -c -o $@ $<
|
|
|
|
|
2007-11-16 09:32:38 +00:00
|
|
|
parser_misc.o: parser_misc.c parser.h parser_yacc.h af_names.h cap_names.h
|
2006-04-11 21:52:54 +00:00
|
|
|
$(CC) $(EXTRA_CFLAGS) -c -o $@ $<
|
|
|
|
|
|
|
|
parser_yacc.o: parser_yacc.c parser_yacc.h
|
|
|
|
$(CC) $(EXTRA_CFLAGS) -c -o $@ $<
|
|
|
|
|
2010-11-12 13:38:21 -08:00
|
|
|
parser_main.o: parser_main.c parser.h parser_version.h libapparmor_re/apparmor_re.h
|
2006-04-11 21:52:54 +00:00
|
|
|
$(CC) $(EXTRA_CFLAGS) -c -o $@ $<
|
|
|
|
|
2010-11-12 13:38:21 -08:00
|
|
|
parser_interface.o: parser_interface.c parser.h libapparmor_re/apparmor_re.h
|
2006-04-11 21:52:54 +00:00
|
|
|
$(CC) $(EXTRA_CFLAGS) -c -o $@ $<
|
|
|
|
|
|
|
|
parser_include.o: parser_include.c parser.h parser_include.h
|
|
|
|
$(CC) $(EXTRA_CFLAGS) -c -o $@ $<
|
|
|
|
|
|
|
|
parser_merge.o: parser_merge.c parser.h
|
|
|
|
$(CC) $(EXTRA_CFLAGS) -c -o $@ $<
|
|
|
|
|
2010-11-12 13:38:21 -08:00
|
|
|
parser_regex.o: parser_regex.c parser.h libapparmor_re/apparmor_re.h
|
2006-04-11 21:52:54 +00:00
|
|
|
$(CC) $(EXTRA_CFLAGS) -c -o $@ $<
|
|
|
|
|
|
|
|
parser_symtab.o: parser_symtab.c parser.h
|
|
|
|
$(CC) $(EXTRA_CFLAGS) -c -o $@ $<
|
|
|
|
|
|
|
|
parser_variable.o: parser_variable.c parser.h
|
|
|
|
$(CC) $(EXTRA_CFLAGS) -c -o $@ $<
|
|
|
|
|
|
|
|
parser_policy.o: parser_policy.c parser.h parser_yacc.h
|
|
|
|
$(CC) $(EXTRA_CFLAGS) -c -o $@ $<
|
|
|
|
|
2008-04-09 09:03:17 +00:00
|
|
|
parser_alias.o: parser_alias.c parser.h
|
|
|
|
$(CC) $(EXTRA_CFLAGS) -c -o $@ $<
|
|
|
|
|
2011-05-23 11:29:41 -07:00
|
|
|
parser_common.o: parser_common.c parser.h
|
|
|
|
$(CC) $(EXTRA_CFLAGS) -c -o $@ $<
|
|
|
|
|
2012-03-09 04:21:06 -08:00
|
|
|
mount.o: mount.c mount.h parser.h immunix.h
|
|
|
|
$(CC) $(EXTRA_CFLAGS) -c -o $@ $<
|
|
|
|
|
2006-04-11 21:52:54 +00:00
|
|
|
parser_version.h: Makefile
|
|
|
|
@echo \#define PARSER_VERSION \"$(VERSION)\" > .ver
|
|
|
|
@mv -f .ver $@
|
|
|
|
|
2012-03-22 13:19:27 -07:00
|
|
|
# af_names and capabilities generation has moved to common/Make.rules,
|
|
|
|
# as well as the filtering that occurs for network protocols that
|
|
|
|
# apparmor should not mediate.
|
2009-06-10 19:20:51 +00:00
|
|
|
|
2011-08-18 18:26:02 -05:00
|
|
|
.PHONY: af_names.h
|
|
|
|
af_names.h:
|
2012-03-22 13:19:27 -07:00
|
|
|
echo "$(AF_NAMES)" | LC_ALL=C sed -n -e 's/[ \t]\?AF_MAX[ \t]\+[0-9]\+,//g' -e 's/[ \t]\+\?AF_\([A-Z0-9_]\+\)[ \t]\+\([0-9]\+\),/#ifndef AF_\1\n# define AF_\1 \2\n#endif\nAA_GEN_NET_ENT("\L\1", \UAF_\1)\n\n/pg' > $@
|
|
|
|
echo "$(AF_NAMES)" | LC_ALL=C sed -n -e 's/.*,[ \t]\+AF_MAX[ \t]\+\([0-9]\+\),\?.*/#define AA_AF_MAX \1\n/p' >> $@
|
2010-03-16 15:18:55 -07:00
|
|
|
# cat $@
|
2007-07-27 20:29:47 +00:00
|
|
|
|
2007-11-16 09:32:38 +00:00
|
|
|
cap_names.h: /usr/include/linux/capability.h
|
2012-03-22 13:19:27 -07:00
|
|
|
echo "$(CAPABILITIES)" | LC_ALL=C sed -n -e "s/[ \\t]\\?CAP_\\([A-Z0-9_]\\+\\)/\{\"\\L\\1\", \\UCAP_\\1\},\\n/pg" > $@
|
2007-07-27 20:29:47 +00:00
|
|
|
|
[v2: added clean-ups, backed off on some of the build silencing]
This is a rather large rearrangement of how a subset of the parser global
variables are defined. Right now, there are unit tests built without
linking against parser_main.c. As a result, none of the globals defined in
parser_main.c could be used in the code that is built for unit tests
(misc, regex, symtab, variable). To get a clean build, either stubs needed
to be added to "#ifdef UNIT_TEST" blocks in each .c file, or we had to
depend on link-time optimizations that would throw out the unused routines.
First, this is a problem because all the compile-time warnings had to be
explicitly silenced, so reviewing the build logs becomes difficult on
failures, and we can potentially (in really unlucky situations) test
something that isn't actually part of the "real" parser.
Second, not all compilers will allow this kind of linking (e.g. mips gcc),
and the missing symbols at link time will fail the entire build even though
they're technically not needed.
To solve all of this, I've moved all of the global variables used in lex,
yacc, and main to parser_common.c, and adjusted the .h files. On top of
this, I made sure to fully link the tst builds so all symbols are resolved
(including aare lib) and removedonly tst build-log silencing (for now,
deferring to another future patchset to consolidate the build silencing).
Signed-off-by: Kees Cook <kees.cook@canonical.com>
2011-05-13 02:12:49 -07:00
|
|
|
tst_%: parser_%.c parser.h $(filter-out parser_%.o, ${TEST_OBJECTS})
|
|
|
|
$(CC) $(TEST_CFLAGS) -o $@ $< $(filter-out $(<:.c=.o), ${TEST_OBJECTS}) $(TEST_LDFLAGS)
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2007-10-01 06:12:26 +00:00
|
|
|
.SILENT: check
|
|
|
|
.PHONY: check
|
|
|
|
check: tests
|
|
|
|
|
2006-04-11 21:52:54 +00:00
|
|
|
.SILENT: tests
|
2011-08-09 00:54:14 -07:00
|
|
|
tests: apparmor_parser ${TESTS}
|
[v2: added clean-ups, backed off on some of the build silencing]
This is a rather large rearrangement of how a subset of the parser global
variables are defined. Right now, there are unit tests built without
linking against parser_main.c. As a result, none of the globals defined in
parser_main.c could be used in the code that is built for unit tests
(misc, regex, symtab, variable). To get a clean build, either stubs needed
to be added to "#ifdef UNIT_TEST" blocks in each .c file, or we had to
depend on link-time optimizations that would throw out the unused routines.
First, this is a problem because all the compile-time warnings had to be
explicitly silenced, so reviewing the build logs becomes difficult on
failures, and we can potentially (in really unlucky situations) test
something that isn't actually part of the "real" parser.
Second, not all compilers will allow this kind of linking (e.g. mips gcc),
and the missing symbols at link time will fail the entire build even though
they're technically not needed.
To solve all of this, I've moved all of the global variables used in lex,
yacc, and main to parser_common.c, and adjusted the .h files. On top of
this, I made sure to fully link the tst builds so all symbols are resolved
(including aare lib) and removedonly tst build-log silencing (for now,
deferring to another future patchset to consolidate the build silencing).
Signed-off-by: Kees Cook <kees.cook@canonical.com>
2011-05-13 02:12:49 -07:00
|
|
|
sh -e -c 'for test in ${TESTS} ; do echo "*** running $${test}" && ./$${test}; done'
|
2011-11-10 09:36:52 -08:00
|
|
|
$(Q)$(MAKE) -s -C tst tests
|
2006-04-11 21:52:54 +00:00
|
|
|
|
|
|
|
# always need to rebuild.
|
[v2: added clean-ups, backed off on some of the build silencing]
This is a rather large rearrangement of how a subset of the parser global
variables are defined. Right now, there are unit tests built without
linking against parser_main.c. As a result, none of the globals defined in
parser_main.c could be used in the code that is built for unit tests
(misc, regex, symtab, variable). To get a clean build, either stubs needed
to be added to "#ifdef UNIT_TEST" blocks in each .c file, or we had to
depend on link-time optimizations that would throw out the unused routines.
First, this is a problem because all the compile-time warnings had to be
explicitly silenced, so reviewing the build logs becomes difficult on
failures, and we can potentially (in really unlucky situations) test
something that isn't actually part of the "real" parser.
Second, not all compilers will allow this kind of linking (e.g. mips gcc),
and the missing symbols at link time will fail the entire build even though
they're technically not needed.
To solve all of this, I've moved all of the global variables used in lex,
yacc, and main to parser_common.c, and adjusted the .h files. On top of
this, I made sure to fully link the tst builds so all symbols are resolved
(including aare lib) and removedonly tst build-log silencing (for now,
deferring to another future patchset to consolidate the build silencing).
Signed-off-by: Kees Cook <kees.cook@canonical.com>
2011-05-13 02:12:49 -07:00
|
|
|
.SILENT: $(AAREOBJECT)
|
|
|
|
.PHONY: $(AAREOBJECT)
|
|
|
|
$(AAREOBJECT):
|
2011-11-10 09:36:52 -08:00
|
|
|
$(MAKE) -C $(AAREDIR) CFLAGS="$(EXTRA_CXXFLAGS)"
|
2007-02-27 02:29:16 +00:00
|
|
|
|
2006-04-11 21:52:54 +00:00
|
|
|
.PHONY: install-rhel4
|
|
|
|
install-rhel4: install-redhat
|
|
|
|
|
|
|
|
.PHONY: install-redhat
|
|
|
|
install-redhat:
|
|
|
|
install -m 755 -d $(DESTDIR)/etc/init.d
|
|
|
|
install -m 755 rc.apparmor.$(subst install-,,$@) $(DESTDIR)/etc/init.d/apparmor
|
|
|
|
|
|
|
|
.PHONY: install-suse
|
|
|
|
install-suse:
|
|
|
|
install -m 755 -d $(DESTDIR)/etc/init.d
|
|
|
|
install -m 755 rc.apparmor.$(subst install-,,$(@)) $(DESTDIR)/etc/init.d/boot.apparmor
|
|
|
|
install -m 755 -d $(DESTDIR)/sbin
|
|
|
|
ln -sf /etc/init.d/boot.apparmor $(DESTDIR)/sbin/rcapparmor
|
|
|
|
ln -sf rcapparmor $(DESTDIR)/sbin/rcsubdomain
|
2007-02-27 02:29:16 +00:00
|
|
|
|
2006-04-11 21:52:54 +00:00
|
|
|
.PHONY: install-slackware
|
|
|
|
install-slackware:
|
|
|
|
install -m 755 -d $(APPARMOR_BIN_PREFIX)/install
|
|
|
|
install -m 755 frob_slack_rc $(APPARMOR_BIN_PREFIX)/install
|
|
|
|
install -m 755 -d $(DESTDIR)/etc/rc.d
|
|
|
|
install -m 755 rc.apparmor.$(subst install-,,$(@)) $(DESTDIR)/etc/rc.d/rc.apparmor
|
|
|
|
|
2007-03-30 16:09:50 +00:00
|
|
|
.PHONY: install-debian
|
|
|
|
install-debian:
|
|
|
|
|
2008-11-18 17:33:38 +00:00
|
|
|
.PHONY: install-unknown
|
|
|
|
install-unknown:
|
|
|
|
|
2011-05-27 14:57:43 -07:00
|
|
|
INSTALLDEPS=arch
|
2006-04-11 21:52:54 +00:00
|
|
|
ifdef DISTRO
|
|
|
|
INSTALLDEPS+=install-$(DISTRO)
|
|
|
|
endif
|
|
|
|
|
|
|
|
.PHONY: install
|
2011-05-27 14:57:43 -07:00
|
|
|
install: install-indep install-arch
|
|
|
|
|
|
|
|
.PHONY: install-arch
|
|
|
|
install-arch: $(INSTALLDEPS)
|
2006-04-11 21:52:54 +00:00
|
|
|
install -m 755 -d $(DESTDIR)/sbin
|
|
|
|
install -m 755 ${TOOLS} $(DESTDIR)/sbin
|
2011-05-27 14:57:43 -07:00
|
|
|
|
|
|
|
.PHONY: install-indep
|
|
|
|
install-indep:
|
2006-04-11 21:52:54 +00:00
|
|
|
install -m 755 -d $(INSTALL_CONFDIR)
|
|
|
|
install -m 644 subdomain.conf $(INSTALL_CONFDIR)
|
2011-10-07 14:43:54 -07:00
|
|
|
install -m 644 parser.conf $(INSTALL_CONFDIR)
|
2006-04-11 21:52:54 +00:00
|
|
|
install -m 755 -d ${DESTDIR}/var/lib/apparmor
|
|
|
|
install -m 755 -d $(APPARMOR_BIN_PREFIX)
|
|
|
|
install -m 755 rc.apparmor.functions $(APPARMOR_BIN_PREFIX)
|
2011-11-10 09:36:52 -08:00
|
|
|
$(MAKE) -C po install NAME=${NAME} DESTDIR=${DESTDIR}
|
|
|
|
$(MAKE) install_manpages DESTDIR=${DESTDIR}
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2006-05-31 21:30:50 +00:00
|
|
|
.SILENT: clean
|
2006-04-11 21:52:54 +00:00
|
|
|
.PHONY: clean
|
2007-04-03 20:12:16 +00:00
|
|
|
clean: _clean
|
2007-04-03 19:04:10 +00:00
|
|
|
rm -f core core.* *.o *.s *.a *~
|
2007-04-03 20:12:16 +00:00
|
|
|
rm -f $(TOOLS) $(TESTS)
|
2006-04-11 21:52:54 +00:00
|
|
|
rm -f $(LEX_C_FILES)
|
|
|
|
rm -f $(YACC_C_FILES)
|
|
|
|
rm -f parser_version.h
|
|
|
|
rm -f $(NAME)*.tar.gz $(NAME)*.tgz
|
2007-07-27 20:29:47 +00:00
|
|
|
rm -f af_names.h
|
2007-11-16 09:32:38 +00:00
|
|
|
rm -f cap_names.h
|
2010-11-03 17:04:43 -07:00
|
|
|
rm -rf techdoc.aux techdoc.log techdoc.pdf techdoc.toc techdor.txt techdoc/
|
2011-11-10 09:36:52 -08:00
|
|
|
$(MAKE) -s -C $(AAREDIR) clean
|
|
|
|
$(MAKE) -s -C po clean
|
|
|
|
$(MAKE) -s -C tst clean
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2006-05-31 21:30:50 +00:00
|
|
|
.SILENT: dist_clean
|
2006-04-11 21:52:54 +00:00
|
|
|
dist_clean:
|
2011-11-10 09:36:52 -08:00
|
|
|
@$(MAKE) clean
|
2006-05-31 21:30:50 +00:00
|
|
|
@rm -f $(LEX_C_FILES) $(YACC_C_FILES)
|