mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-04 08:24:42 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
apparmor/parser/Makefile

322 lines
9.6 KiB
Makefile
Raw Normal View History

Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
# ----------------------------------------------------------------------
update copyright dates
2007-04-11 08:12:51 +00:00
# Copyright (c) 1999, 2000, 2001, 2002, 2004, 2005, 2006, 2007
# NOVELL (All rights reserved)
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
# License published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, contact Novell, Inc.
# ----------------------------------------------------------------------
NAME=apparmor-parser
all:
Update keywords attribute, svn:ignore attribute, update Makefile to point to the new location of the common/ dir.
2006-04-12 03:09:10 +00:00
COMMONDIR=../common/
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
Convert the rest of the packages to symlinking in the common directory so that 'make dist' will work.
2006-11-04 21:34:47 +00:00
include common/Make.rules
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
COMMONDIR_EXISTS=$(strip $(shell [ -d ${COMMONDIR} ] && echo true))
ifeq ($(COMMONDIR_EXISTS), true)
Convert the rest of the packages to symlinking in the common directory so that 'make dist' will work.
2006-11-04 21:34:47 +00:00
common/Make.rules: $(COMMONDIR)/Make.rules
ln -sf $(COMMONDIR) .
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
endif
DESTDIR=/
APPARMOR_BIN_PREFIX=${DESTDIR}/lib/apparmor
CONFDIR=/etc/apparmor
INSTALL_CONFDIR=${DESTDIR}${CONFDIR}
LOCALEDIR=/usr/share/locale
Move apparmor.vim.5 from parser to utils (apparmor.vim already lives there).
2013-06-30 00:25:44 +10:00
MANPAGES=apparmor.d.5 apparmor.7 apparmor_parser.8 subdomain.conf.5
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
YACC := /usr/bin/bison
YFLAGS := -d
LEX := /usr/bin/flex
LEXFLAGS = -B -v
This cleans up a number of warnings that appeared after the parser rework commits were made (as well as a few other minor warnings elsewhere). The Makefile change is to avoid passing -Wstrict-prototypes and -Wnested-externs to the C++ compiler, which the compiler yells about and then ignores. Since we compile with -Wmissing-field-initializers I dropped the unreferenced zero-width fields in the header structs, and then explicitly initialized the remaining fields. I tagged several unused function parameters to silence those warnings. And finally, I dropped the unused filter_escapes() too.
2010-11-09 13:39:18 -08:00
WARNINGS = -Wall
EXTRA_WARNINGS = -Wsign-compare -Wmissing-field-initializers -Wformat-security -Wunused-parameter
CXX_WARNINGS = ${WARNINGS} $(shell for warning in ${EXTRA_WARNINGS} ; do \
Convert the parser to C++ This conversion is nothing more than what is required to get it to compile. Further improvements will come as the code is refactored. Unfortunately due to C++ not supporting designated initializers, the auto generation of af names needed to be reworked, and "netlink" and "unix" domain socket keywords leaked in. Since these where going to be added in separate patches I have not bothered to do the extra work to replace them with a temporary place holder. Signed-off-by: John Johansen <john.johansen@canonical.com> [tyhicks: merged with dbus changes and memory leak fixes] Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-27 16:13:22 -07:00
if ${CXX} $${warning} -S -o /dev/null -xc /dev/null >/dev/null 2>&1; then \
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
echo "$${warning}"; \
fi ; \
done)
Convert the parser to C++ This conversion is nothing more than what is required to get it to compile. Further improvements will come as the code is refactored. Unfortunately due to C++ not supporting designated initializers, the auto generation of af names needed to be reworked, and "netlink" and "unix" domain socket keywords leaked in. Since these where going to be added in separate patches I have not bothered to do the extra work to replace them with a temporary place holder. Signed-off-by: John Johansen <john.johansen@canonical.com> [tyhicks: merged with dbus changes and memory leak fixes] Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-27 16:13:22 -07:00
CPP_WARNINGS =
This patch makes the parser's makefile honor CFLAGS that have been exported in the environment. Without it, merely setting the CFLAGS environment variable would not affect the compilation of the parser, though it was still possible to override it by passing the variable as an argument (e.g. make all CFLAGS="-Oinsane -Wextra-special"). It also makes the default CFLAGS for the parser consistent with the default for the C++ dfa library, and passes the flags on to the library. An audit of the other bits of C showed that they either supported CFLAGS during configure or were otherwise honoring CFLAGS when set as environment variable.
2010-10-09 14:15:59 -07:00
ifndef CFLAGS
CFLAGS = -g -O2 -pipe
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
ifdef DEBUG
Allow passing of DEBUG from make into the compile Fix the build so make DEBUG=1 results in a compile with DEBUG turned on. Also fix build errors in the compile with DEBUG is defined Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Kees Cook <kees.cook@canonical.com>
2011-09-01 11:57:54 -07:00
CFLAGS += -pg -D DEBUG
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
endif
This patch makes the parser's makefile honor CFLAGS that have been exported in the environment. Without it, merely setting the CFLAGS environment variable would not affect the compilation of the parser, though it was still possible to override it by passing the variable as an argument (e.g. make all CFLAGS="-Oinsane -Wextra-special"). It also makes the default CFLAGS for the parser consistent with the default for the C++ dfa library, and passes the flags on to the library. An audit of the other bits of C showed that they either supported CFLAGS during configure or were otherwise honoring CFLAGS when set as environment variable.
2010-10-09 14:15:59 -07:00
endif #CFLAGS
parser - build against in-tree libapparmor With trunk commit 2205 "use libapparmor's find mountpoint fn", the parser now builds against and uses libapparmor at runtime. However, it currently builds against the system installed libapparmor library and header files, which fails if either aren't installed, and is thus painful for bootstrapping in a new environment. Instead, the parser, like pam_apparmor and mod_apparmor, should build against the in-tree libapparmor header and library. This patch does that and adjusts the tests to point LD_LIBRARY_PATH at the location of the built library as well. Signed-off-by: Steve Beattie <steve@nxnw.org> Acked-by: John Johansen <john.johansen@canonical.com>
2013-10-15 16:46:18 -07:00
LIBAPPARMOR_PATH=../libraries/libapparmor/src/
LIBAPPARMOR_LDPATH=$(LIBAPPARMOR_PATH)/.libs/
parser: convert array into unordered map This patch converts the problematic-with-g++ 4.6 state_names array into a C++ unordered_map type. Using this depends on using the c++0x (aka c++11) standard, and as we have gnuisms elsewhere (using the typeof builtin), the patch also adds/converts to using -std=gnu++c0x in the build rules (which conveniently eliminates some other warnings we had due to other c++11-isms). Signed-off-by: Steve Beattie <steve@nxnw.org> Acked-By: Seth Arnold <seth.arnold@canonical.com>
2013-11-18 16:23:23 -08:00
EXTRA_CXXFLAGS = ${CFLAGS} ${CXX_WARNINGS} -std=gnu++0x -D_GNU_SOURCE -I$(LIBAPPARMOR_PATH)
This cleans up a number of warnings that appeared after the parser rework commits were made (as well as a few other minor warnings elsewhere). The Makefile change is to avoid passing -Wstrict-prototypes and -Wnested-externs to the C++ compiler, which the compiler yells about and then ignores. Since we compile with -Wmissing-field-initializers I dropped the unreferenced zero-width fields in the header structs, and then explicitly initialized the remaining fields. I tagged several unused function parameters to silence those warnings. And finally, I dropped the unused filter_escapes() too.
2010-11-09 13:39:18 -08:00
EXTRA_CFLAGS = ${EXTRA_CXXFLAGS} ${CPP_WARNINGS}
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
#LEXLIB := -lfl
# override this on the make command to point to where the immunix.h file is
# (yeah this is lame, but since we are tied to the kernel so tightly...)
#INCLUDEDIR = /usr/src/linux/include
INCLUDEDIR =
ifdef INCLUDEDIR
CFLAGS += -I$(INCLUDEDIR)
endif
# Internationalization support. Define a package and a LOCALEDIR
EXTRA_CFLAGS+=-DPACKAGE=\"${NAME}\" -DLOCALEDIR=\"${LOCALEDIR}\"
# Compile-time configuration of the location of the config file
EXTRA_CFLAGS+=-DSUBDOMAIN_CONFDIR=\"${CONFDIR}\"
[v2: added clean-ups, backed off on some of the build silencing] This is a rather large rearrangement of how a subset of the parser global variables are defined. Right now, there are unit tests built without linking against parser_main.c. As a result, none of the globals defined in parser_main.c could be used in the code that is built for unit tests (misc, regex, symtab, variable). To get a clean build, either stubs needed to be added to "#ifdef UNIT_TEST" blocks in each .c file, or we had to depend on link-time optimizations that would throw out the unused routines. First, this is a problem because all the compile-time warnings had to be explicitly silenced, so reviewing the build logs becomes difficult on failures, and we can potentially (in really unlucky situations) test something that isn't actually part of the "real" parser. Second, not all compilers will allow this kind of linking (e.g. mips gcc), and the missing symbols at link time will fail the entire build even though they're technically not needed. To solve all of this, I've moved all of the global variables used in lex, yacc, and main to parser_common.c, and adjusted the .h files. On top of this, I made sure to fully link the tst builds so all symbols are resolved (including aare lib) and removedonly tst build-log silencing (for now, deferring to another future patchset to consolidate the build silencing). Signed-off-by: Kees Cook <kees.cook@canonical.com>
2011-05-13 02:12:49 -07:00
SRCS = parser_common.c parser_include.c parser_interface.c parser_lex.c \
parser_main.c parser_misc.c parser_merge.c parser_symtab.c \
parser_yacc.c parser_regex.c parser_variable.c parser_policy.c \
Convert codomain to a class Convert the codomain to a class, and the policy lists that store codomains to stl containers instead of glibc twalk. Signed-off-by: John Johansen <john.johansen@canonical.com> [tyhicks: Merge with dbus changes and process_file_entries() cleanup] Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-27 16:16:37 -07:00
parser_alias.c mount.c dbus.c lib.c profile.cc
HDRS = parser.h parser_include.h immunix.h mount.h dbus.h lib.h profile.h
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
TOOLS = apparmor_parser
[v2: added clean-ups, backed off on some of the build silencing] This is a rather large rearrangement of how a subset of the parser global variables are defined. Right now, there are unit tests built without linking against parser_main.c. As a result, none of the globals defined in parser_main.c could be used in the code that is built for unit tests (misc, regex, symtab, variable). To get a clean build, either stubs needed to be added to "#ifdef UNIT_TEST" blocks in each .c file, or we had to depend on link-time optimizations that would throw out the unused routines. First, this is a problem because all the compile-time warnings had to be explicitly silenced, so reviewing the build logs becomes difficult on failures, and we can potentially (in really unlucky situations) test something that isn't actually part of the "real" parser. Second, not all compilers will allow this kind of linking (e.g. mips gcc), and the missing symbols at link time will fail the entire build even though they're technically not needed. To solve all of this, I've moved all of the global variables used in lex, yacc, and main to parser_common.c, and adjusted the .h files. On top of this, I made sure to fully link the tst builds so all symbols are resolved (including aare lib) and removedonly tst build-log silencing (for now, deferring to another future patchset to consolidate the build silencing). Signed-off-by: Kees Cook <kees.cook@canonical.com>
2011-05-13 02:12:49 -07:00
OBJECTS = $(SRCS:.c=.o)
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
Add dfa support to the parser
2007-02-27 02:29:16 +00:00
AAREDIR= libapparmor_re
[v2: added clean-ups, backed off on some of the build silencing] This is a rather large rearrangement of how a subset of the parser global variables are defined. Right now, there are unit tests built without linking against parser_main.c. As a result, none of the globals defined in parser_main.c could be used in the code that is built for unit tests (misc, regex, symtab, variable). To get a clean build, either stubs needed to be added to "#ifdef UNIT_TEST" blocks in each .c file, or we had to depend on link-time optimizations that would throw out the unused routines. First, this is a problem because all the compile-time warnings had to be explicitly silenced, so reviewing the build logs becomes difficult on failures, and we can potentially (in really unlucky situations) test something that isn't actually part of the "real" parser. Second, not all compilers will allow this kind of linking (e.g. mips gcc), and the missing symbols at link time will fail the entire build even though they're technically not needed. To solve all of this, I've moved all of the global variables used in lex, yacc, and main to parser_common.c, and adjusted the .h files. On top of this, I made sure to fully link the tst builds so all symbols are resolved (including aare lib) and removedonly tst build-log silencing (for now, deferring to another future patchset to consolidate the build silencing). Signed-off-by: Kees Cook <kees.cook@canonical.com>
2011-05-13 02:12:49 -07:00
AAREOBJECT = ${AAREDIR}/libapparmor_re.a
parser - remove hackish way of getting a static libstdc++ This patch switches over from using our hackish way to get a statically linked libstdc++ (which was based on the article at http://www.trilithium.com/johan/2005/06/static-libstdc/) with the -static-libstdc++ compiler option Signed-off-by: Steve Beattie <steve@nxnw.org> Acked-by: John Johansen <john.johansen@canonical.com>
2013-10-15 16:50:42 -07:00
AAREOBJECTS = $(AAREOBJECT)
AARE_LDFLAGS=-static-libgcc -static-libstdc++ -L. -L$(LIBAPPARMOR_LDPATH)
parser - link in libapparmor statically This patch converts to statically linking libapparmor with whichever static libapparmor it can find on its library search path (and verified to choose the in-tree version over the system one if both are available) Signed-off-by: Steve Beattie <steve@nxnw.org> Acked-by: John Johansen <john.johansen@canonical.com>
2013-10-15 17:02:59 -07:00
AALIB = -Wl,-Bstatic -lapparmor -Wl,-Bdynamic -lpthread
Add dfa support to the parser
2007-02-27 02:29:16 +00:00
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
LEX_C_FILES = parser_lex.c
YACC_C_FILES = parser_yacc.c parser_yacc.h
TESTS = tst_regex tst_misc tst_symtab tst_variable
[v2: added clean-ups, backed off on some of the build silencing] This is a rather large rearrangement of how a subset of the parser global variables are defined. Right now, there are unit tests built without linking against parser_main.c. As a result, none of the globals defined in parser_main.c could be used in the code that is built for unit tests (misc, regex, symtab, variable). To get a clean build, either stubs needed to be added to "#ifdef UNIT_TEST" blocks in each .c file, or we had to depend on link-time optimizations that would throw out the unused routines. First, this is a problem because all the compile-time warnings had to be explicitly silenced, so reviewing the build logs becomes difficult on failures, and we can potentially (in really unlucky situations) test something that isn't actually part of the "real" parser. Second, not all compilers will allow this kind of linking (e.g. mips gcc), and the missing symbols at link time will fail the entire build even though they're technically not needed. To solve all of this, I've moved all of the global variables used in lex, yacc, and main to parser_common.c, and adjusted the .h files. On top of this, I made sure to fully link the tst builds so all symbols are resolved (including aare lib) and removedonly tst build-log silencing (for now, deferring to another future patchset to consolidate the build silencing). Signed-off-by: Kees Cook <kees.cook@canonical.com>
2011-05-13 02:12:49 -07:00
TEST_CFLAGS = $(EXTRA_CFLAGS) -DUNIT_TEST -Wno-unused-result
TEST_OBJECTS = $(filter-out \
parser_lex.o \
parser_yacc.o \
parser_main.o, ${OBJECTS}) \
$(AAREOBJECTS)
TEST_LDFLAGS = $(AARE_LDFLAGS)
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
Add a flag so that 'make check V=1' will turn on verbose output.
2008-04-16 16:09:36 +00:00
ifdef V
VERBOSE = 1
endif
Make the build process significantly quieter with respect to the unit and regression tests to avoid developer confusion.
2006-05-31 21:30:50 +00:00
ifndef VERBOSE
VERBOSE = 0
endif
ifeq ($(VERBOSE),1)
BUILD_OUTPUT =
Q =
else
BUILD_OUTPUT = > /dev/null 2>&1
Q = @
endif
export Q VERBOSE BUILD_OUTPUT
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
po/${NAME}.pot: ${SRCS} ${HDRS}
Author: Michael (kensington) parser/Makefile has a number of issues. * Some warnings are produced: "make[1]: warning: jobserver unavailable: using -j1. Add `+' to parent make rule." * CXX is not always respected * LDFLAGS are not always respected modified to apply and retain $(Q) by John Johansen Signed-off-by: John Johansen <john.johansen@canoncial.com>
2011-11-10 09:36:52 -08:00
$(MAKE) -C po ${NAME}.pot NAME=${NAME} SOURCES="${SRCS} ${HDRS}"
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
Move the techdoc to the apparmor-parser package.
2007-04-12 06:01:40 +00:00
techdoc.pdf: techdoc.tex
various changes in building techdoc.tex: - make table of contents, footnotes etc. clickable hyperlinks - use timestamp of techdoc.tex (instead of build time) as creationdate in the PDF metadata - don't include build date on first page of the PDF - make clean: - delete techdoc.out (created by pdftex) - fix deletion of techdoc.txt (was techdo_r_.txt) The initial target was to get reproduceable PDF builds (therefore the timestamp-related changes), the other things came up during discussing this patch with David Haller. The only remaining difference in the PDF from build to build is the /ID line. This line can't be controlled in pdflatex and is now filtered out by build-compare in the openSUSE build service (bnc#760867). Credits go to David Haller for writing large parts of this patch (but he didn't notice the techdo_r_.txt ;-) Signed-Off-By: Christian Boltz <apparmor@cboltz.de>
2012-05-09 00:41:06 +02:00
timestamp=$(shell date "+%Y%m%d%H%M%S+02'00'" -r $< );\
while pdflatex "\def\fixedpdfdate{$$timestamp}\input $<" ${BUILD_OUTPUT} || exit 1 ; \
Move the techdoc to the apparmor-parser package.
2007-04-12 06:01:40 +00:00
grep -q "Label(s) may have changed" techdoc.log; \
do :; done
techdoc/index.html: techdoc.pdf
Quiet techdoc build output when not building in verbose mode.
2007-05-15 20:02:15 +00:00
latex2html -show_section_numbers -split 0 -noinfo -nonavigation -noaddress techdoc.tex ${BUILD_OUTPUT}
Move the techdoc to the apparmor-parser package.
2007-04-12 06:01:40 +00:00
techdoc.txt: techdoc/index.html
w3m -dump $< > $@
- Break out make targets so that distributors that don't want full docs can pick targets they want. Patch from Arkadiusz Miskiewicz <arekm at maven.pl>. - Comment out debug dump of generate af_names.h
2010-03-16 15:18:55 -07:00
# targets arranged this way so that people who don't want full docs can
# pick specific targets they want.
In some cases, it is desirable to build the parser without building the binary portions (Hurd). This patch splits up the build targets so this is possible: "main" becomes "arch" "indep" is created and depends on "docs" po building is moved from "main" to "indep" "all" has "tests" removed (standard build practices are to "make" then "make check" so I think "tests"/"check" should stay separate from "all"). redundant chunk is removed (this exists twice in the Makefile): -.SILENT: check -check: tests "install" is split into "install-indep" and "install-arch" "install-arch" requires "arch" and only installs the binaries "install-indep" requires "indep" and only install non-binaries Additionally, update the README to mention the "check" target both for the parser and the utils. Signed-off-by: Kees Cook <kees.cook@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>
2011-05-27 14:57:43 -07:00
arch: $(TOOLS)
- Break out make targets so that distributors that don't want full docs can pick targets they want. Patch from Arkadiusz Miskiewicz <arekm at maven.pl>. - Comment out debug dump of generate af_names.h
2010-03-16 15:18:55 -07:00
manpages: $(MANPAGES)
htmlmanpages: $(HTMLMANPAGES)
pdf: techdoc.pdf
docs: manpages htmlmanpages pdf
In some cases, it is desirable to build the parser without building the binary portions (Hurd). This patch splits up the build targets so this is possible: "main" becomes "arch" "indep" is created and depends on "docs" po building is moved from "main" to "indep" "all" has "tests" removed (standard build practices are to "make" then "make check" so I think "tests"/"check" should stay separate from "all"). redundant chunk is removed (this exists twice in the Makefile): -.SILENT: check -check: tests "install" is split into "install-indep" and "install-arch" "install-arch" requires "arch" and only installs the binaries "install-indep" requires "indep" and only install non-binaries Additionally, update the README to mention the "check" target both for the parser and the utils. Signed-off-by: Kees Cook <kees.cook@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>
2011-05-27 14:57:43 -07:00
indep: docs
Author: Michael (kensington) parser/Makefile has a number of issues. * Some warnings are produced: "make[1]: warning: jobserver unavailable: using -j1. Add `+' to parent make rule." * CXX is not always respected * LDFLAGS are not always respected modified to apply and retain $(Q) by John Johansen Signed-off-by: John Johansen <john.johansen@canoncial.com>
2011-11-10 09:36:52 -08:00
$(Q)$(MAKE) -C po all
In some cases, it is desirable to build the parser without building the binary portions (Hurd). This patch splits up the build targets so this is possible: "main" becomes "arch" "indep" is created and depends on "docs" po building is moved from "main" to "indep" "all" has "tests" removed (standard build practices are to "make" then "make check" so I think "tests"/"check" should stay separate from "all"). redundant chunk is removed (this exists twice in the Makefile): -.SILENT: check -check: tests "install" is split into "install-indep" and "install-arch" "install-arch" requires "arch" and only installs the binaries "install-indep" requires "indep" and only install non-binaries Additionally, update the README to mention the "check" target both for the parser and the utils. Signed-off-by: Kees Cook <kees.cook@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>
2011-05-27 14:57:43 -07:00
all: arch indep
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
[v2: added clean-ups, backed off on some of the build silencing] This is a rather large rearrangement of how a subset of the parser global variables are defined. Right now, there are unit tests built without linking against parser_main.c. As a result, none of the globals defined in parser_main.c could be used in the code that is built for unit tests (misc, regex, symtab, variable). To get a clean build, either stubs needed to be added to "#ifdef UNIT_TEST" blocks in each .c file, or we had to depend on link-time optimizations that would throw out the unused routines. First, this is a problem because all the compile-time warnings had to be explicitly silenced, so reviewing the build logs becomes difficult on failures, and we can potentially (in really unlucky situations) test something that isn't actually part of the "real" parser. Second, not all compilers will allow this kind of linking (e.g. mips gcc), and the missing symbols at link time will fail the entire build even though they're technically not needed. To solve all of this, I've moved all of the global variables used in lex, yacc, and main to parser_common.c, and adjusted the .h files. On top of this, I made sure to fully link the tst builds so all symbols are resolved (including aare lib) and removedonly tst build-log silencing (for now, deferring to another future patchset to consolidate the build silencing). Signed-off-by: Kees Cook <kees.cook@canonical.com>
2011-05-13 02:12:49 -07:00
apparmor_parser: $(OBJECTS) $(AAREOBJECTS)
Respect LDFLAGS.
2013-01-14 00:10:41 +11:00
$(CXX) $(LDFLAGS) $(EXTRA_CFLAGS) -o $@ $(OBJECTS) $(LIBS) \
use libapparmor's find mountpoint fn to find the interface Drop support for the old subdomainfs mountpoint and use the fn exported by libapparmor. Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-09-29 02:44:19 -07:00
${LEXLIB} $(AAREOBJECTS) $(AARE_LDFLAGS) $(AALIB)
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
Convert codomain to a class Convert the codomain to a class, and the policy lists that store codomains to stl containers instead of glibc twalk. Signed-off-by: John Johansen <john.johansen@canonical.com> [tyhicks: Merge with dbus changes and process_file_entries() cleanup] Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-27 16:16:37 -07:00
parser_yacc.c parser_yacc.h: parser_yacc.y parser.h profile.h
Bah, the last commit message was wrong; it added support for mixing alias rules and variable declarations within the preamble of a profile. This commit adds another testcase for alias rules; one in which there is an overlapping pair of aliases. The parser parses it, but based on -dd output, I don't believe it's treating it properly.
2008-11-14 16:46:16 +00:00
$(YACC) $(YFLAGS) -o parser_yacc.c parser_yacc.y
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
Convert codomain to a class Convert the codomain to a class, and the policy lists that store codomains to stl containers instead of glibc twalk. Signed-off-by: John Johansen <john.johansen@canonical.com> [tyhicks: Merge with dbus changes and process_file_entries() cleanup] Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-27 16:16:37 -07:00
parser_lex.c: parser_lex.l parser_yacc.h parser.h profile.h
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
$(LEX) ${LEXFLAGS} -o$@ $<
parser_lex.o: parser_lex.c parser.h parser_yacc.h
Convert the parser to C++ This conversion is nothing more than what is required to get it to compile. Further improvements will come as the code is refactored. Unfortunately due to C++ not supporting designated initializers, the auto generation of af names needed to be reworked, and "netlink" and "unix" domain socket keywords leaked in. Since these where going to be added in separate patches I have not bothered to do the extra work to replace them with a temporary place holder. Signed-off-by: John Johansen <john.johansen@canonical.com> [tyhicks: merged with dbus changes and memory leak fixes] Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-27 16:13:22 -07:00
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
Convert codomain to a class Convert the codomain to a class, and the policy lists that store codomains to stl containers instead of glibc twalk. Signed-off-by: John Johansen <john.johansen@canonical.com> [tyhicks: Merge with dbus changes and process_file_entries() cleanup] Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-27 16:16:37 -07:00
parser_misc.o: parser_misc.c parser.h parser_yacc.h profile.h af_names.h cap_names.h
Convert the parser to C++ This conversion is nothing more than what is required to get it to compile. Further improvements will come as the code is refactored. Unfortunately due to C++ not supporting designated initializers, the auto generation of af names needed to be reworked, and "netlink" and "unix" domain socket keywords leaked in. Since these where going to be added in separate patches I have not bothered to do the extra work to replace them with a temporary place holder. Signed-off-by: John Johansen <john.johansen@canonical.com> [tyhicks: merged with dbus changes and memory leak fixes] Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-27 16:13:22 -07:00
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
parser_yacc.o: parser_yacc.c parser_yacc.h
Convert the parser to C++ This conversion is nothing more than what is required to get it to compile. Further improvements will come as the code is refactored. Unfortunately due to C++ not supporting designated initializers, the auto generation of af names needed to be reworked, and "netlink" and "unix" domain socket keywords leaked in. Since these where going to be added in separate patches I have not bothered to do the extra work to replace them with a temporary place holder. Signed-off-by: John Johansen <john.johansen@canonical.com> [tyhicks: merged with dbus changes and memory leak fixes] Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-27 16:13:22 -07:00
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
This minor patch updates the compilation dependencies for bits of the parser that interact with the regex DFA generation library, and thus need to be recompiled when the header file changes. (This patch isn't particularly of interest to distros, as they typically won't be doing incremental compilation.)
2010-11-12 13:38:21 -08:00
parser_main.o: parser_main.c parser.h parser_version.h libapparmor_re/apparmor_re.h
Convert the parser to C++ This conversion is nothing more than what is required to get it to compile. Further improvements will come as the code is refactored. Unfortunately due to C++ not supporting designated initializers, the auto generation of af names needed to be reworked, and "netlink" and "unix" domain socket keywords leaked in. Since these where going to be added in separate patches I have not bothered to do the extra work to replace them with a temporary place holder. Signed-off-by: John Johansen <john.johansen@canonical.com> [tyhicks: merged with dbus changes and memory leak fixes] Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-27 16:13:22 -07:00
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
Convert codomain to a class Convert the codomain to a class, and the policy lists that store codomains to stl containers instead of glibc twalk. Signed-off-by: John Johansen <john.johansen@canonical.com> [tyhicks: Merge with dbus changes and process_file_entries() cleanup] Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-27 16:16:37 -07:00
parser_interface.o: parser_interface.c parser.h profile.h libapparmor_re/apparmor_re.h
Convert the parser to C++ This conversion is nothing more than what is required to get it to compile. Further improvements will come as the code is refactored. Unfortunately due to C++ not supporting designated initializers, the auto generation of af names needed to be reworked, and "netlink" and "unix" domain socket keywords leaked in. Since these where going to be added in separate patches I have not bothered to do the extra work to replace them with a temporary place holder. Signed-off-by: John Johansen <john.johansen@canonical.com> [tyhicks: merged with dbus changes and memory leak fixes] Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-27 16:13:22 -07:00
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
parser_include.o: parser_include.c parser.h parser_include.h
Convert the parser to C++ This conversion is nothing more than what is required to get it to compile. Further improvements will come as the code is refactored. Unfortunately due to C++ not supporting designated initializers, the auto generation of af names needed to be reworked, and "netlink" and "unix" domain socket keywords leaked in. Since these where going to be added in separate patches I have not bothered to do the extra work to replace them with a temporary place holder. Signed-off-by: John Johansen <john.johansen@canonical.com> [tyhicks: merged with dbus changes and memory leak fixes] Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-27 16:13:22 -07:00
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
Convert codomain to a class Convert the codomain to a class, and the policy lists that store codomains to stl containers instead of glibc twalk. Signed-off-by: John Johansen <john.johansen@canonical.com> [tyhicks: Merge with dbus changes and process_file_entries() cleanup] Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-27 16:16:37 -07:00
parser_merge.o: parser_merge.c parser.h profile.h
Convert the parser to C++ This conversion is nothing more than what is required to get it to compile. Further improvements will come as the code is refactored. Unfortunately due to C++ not supporting designated initializers, the auto generation of af names needed to be reworked, and "netlink" and "unix" domain socket keywords leaked in. Since these where going to be added in separate patches I have not bothered to do the extra work to replace them with a temporary place holder. Signed-off-by: John Johansen <john.johansen@canonical.com> [tyhicks: merged with dbus changes and memory leak fixes] Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-27 16:13:22 -07:00
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
Convert codomain to a class Convert the codomain to a class, and the policy lists that store codomains to stl containers instead of glibc twalk. Signed-off-by: John Johansen <john.johansen@canonical.com> [tyhicks: Merge with dbus changes and process_file_entries() cleanup] Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-27 16:16:37 -07:00
parser_regex.o: parser_regex.c parser.h profile.h libapparmor_re/apparmor_re.h
Convert the parser to C++ This conversion is nothing more than what is required to get it to compile. Further improvements will come as the code is refactored. Unfortunately due to C++ not supporting designated initializers, the auto generation of af names needed to be reworked, and "netlink" and "unix" domain socket keywords leaked in. Since these where going to be added in separate patches I have not bothered to do the extra work to replace them with a temporary place holder. Signed-off-by: John Johansen <john.johansen@canonical.com> [tyhicks: merged with dbus changes and memory leak fixes] Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-27 16:13:22 -07:00
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
parser_symtab.o: parser_symtab.c parser.h
Convert the parser to C++ This conversion is nothing more than what is required to get it to compile. Further improvements will come as the code is refactored. Unfortunately due to C++ not supporting designated initializers, the auto generation of af names needed to be reworked, and "netlink" and "unix" domain socket keywords leaked in. Since these where going to be added in separate patches I have not bothered to do the extra work to replace them with a temporary place holder. Signed-off-by: John Johansen <john.johansen@canonical.com> [tyhicks: merged with dbus changes and memory leak fixes] Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-27 16:13:22 -07:00
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
Convert codomain to a class Convert the codomain to a class, and the policy lists that store codomains to stl containers instead of glibc twalk. Signed-off-by: John Johansen <john.johansen@canonical.com> [tyhicks: Merge with dbus changes and process_file_entries() cleanup] Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-27 16:16:37 -07:00
parser_variable.o: parser_variable.c parser.h profile.h
Convert the parser to C++ This conversion is nothing more than what is required to get it to compile. Further improvements will come as the code is refactored. Unfortunately due to C++ not supporting designated initializers, the auto generation of af names needed to be reworked, and "netlink" and "unix" domain socket keywords leaked in. Since these where going to be added in separate patches I have not bothered to do the extra work to replace them with a temporary place holder. Signed-off-by: John Johansen <john.johansen@canonical.com> [tyhicks: merged with dbus changes and memory leak fixes] Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-27 16:13:22 -07:00
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
Convert codomain to a class Convert the codomain to a class, and the policy lists that store codomains to stl containers instead of glibc twalk. Signed-off-by: John Johansen <john.johansen@canonical.com> [tyhicks: Merge with dbus changes and process_file_entries() cleanup] Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-27 16:16:37 -07:00
parser_policy.o: parser_policy.c parser.h parser_yacc.h profile.h
Convert the parser to C++ This conversion is nothing more than what is required to get it to compile. Further improvements will come as the code is refactored. Unfortunately due to C++ not supporting designated initializers, the auto generation of af names needed to be reworked, and "netlink" and "unix" domain socket keywords leaked in. Since these where going to be added in separate patches I have not bothered to do the extra work to replace them with a temporary place holder. Signed-off-by: John Johansen <john.johansen@canonical.com> [tyhicks: merged with dbus changes and memory leak fixes] Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-27 16:13:22 -07:00
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
Convert codomain to a class Convert the codomain to a class, and the policy lists that store codomains to stl containers instead of glibc twalk. Signed-off-by: John Johansen <john.johansen@canonical.com> [tyhicks: Merge with dbus changes and process_file_entries() cleanup] Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-27 16:16:37 -07:00
parser_alias.o: parser_alias.c parser.h profile.h
Convert the parser to C++ This conversion is nothing more than what is required to get it to compile. Further improvements will come as the code is refactored. Unfortunately due to C++ not supporting designated initializers, the auto generation of af names needed to be reworked, and "netlink" and "unix" domain socket keywords leaked in. Since these where going to be added in separate patches I have not bothered to do the extra work to replace them with a temporary place holder. Signed-off-by: John Johansen <john.johansen@canonical.com> [tyhicks: merged with dbus changes and memory leak fixes] Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-27 16:13:22 -07:00
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
allow for simpe alias rules
2008-04-09 09:03:17 +00:00
include explicit parser_common.o rule, thanks to Steve Beattie
2011-05-23 11:29:41 -07:00
parser_common.o: parser_common.c parser.h
Convert the parser to C++ This conversion is nothing more than what is required to get it to compile. Further improvements will come as the code is refactored. Unfortunately due to C++ not supporting designated initializers, the auto generation of af names needed to be reworked, and "netlink" and "unix" domain socket keywords leaked in. Since these where going to be added in separate patches I have not bothered to do the extra work to replace them with a temporary place holder. Signed-off-by: John Johansen <john.johansen@canonical.com> [tyhicks: merged with dbus changes and memory leak fixes] Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-27 16:13:22 -07:00
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
include explicit parser_common.o rule, thanks to Steve Beattie
2011-05-23 11:29:41 -07:00
Fix Make file for mount.c so that warnings are emitted during a build Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-03-09 04:21:06 -08:00
mount.o: mount.c mount.h parser.h immunix.h
Convert the parser to C++ This conversion is nothing more than what is required to get it to compile. Further improvements will come as the code is refactored. Unfortunately due to C++ not supporting designated initializers, the auto generation of af names needed to be reworked, and "netlink" and "unix" domain socket keywords leaked in. Since these where going to be added in separate patches I have not bothered to do the extra work to replace them with a temporary place holder. Signed-off-by: John Johansen <john.johansen@canonical.com> [tyhicks: merged with dbus changes and memory leak fixes] Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-27 16:13:22 -07:00
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
Fix Make file for mount.c so that warnings are emitted during a build Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-03-09 04:21:06 -08:00
apparmor: abstract out the directory walking routine The apparmor_parser has 3 different directory walking routines. Abstract them out and use a single common routine. Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-08-16 16:26:03 -07:00
lib.o: lib.c lib.h parser.h
Convert the parser to C++ This conversion is nothing more than what is required to get it to compile. Further improvements will come as the code is refactored. Unfortunately due to C++ not supporting designated initializers, the auto generation of af names needed to be reworked, and "netlink" and "unix" domain socket keywords leaked in. Since these where going to be added in separate patches I have not bothered to do the extra work to replace them with a temporary place holder. Signed-off-by: John Johansen <john.johansen@canonical.com> [tyhicks: merged with dbus changes and memory leak fixes] Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-27 16:13:22 -07:00
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
apparmor: abstract out the directory walking routine The apparmor_parser has 3 different directory walking routines. Abstract them out and use a single common routine. Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-08-16 16:26:03 -07:00
parser - dbus code depends on yacc definitions Fix Makefile to rebuild dbus object when yacc definitions change. Signed-off-by: Steve Beattie <steve@nxnw.org> Acked-by: John Johansen <john.johansen@canonical.com>
2013-10-14 14:38:53 -07:00
dbus.o: dbus.c dbus.h parser.h immunix.h parser_yacc.h
Convert the parser to C++ This conversion is nothing more than what is required to get it to compile. Further improvements will come as the code is refactored. Unfortunately due to C++ not supporting designated initializers, the auto generation of af names needed to be reworked, and "netlink" and "unix" domain socket keywords leaked in. Since these where going to be added in separate patches I have not bothered to do the extra work to replace them with a temporary place holder. Signed-off-by: John Johansen <john.johansen@canonical.com> [tyhicks: merged with dbus changes and memory leak fixes] Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-27 16:13:22 -07:00
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
parser: Add support for DBus rules This patch implements the parsing of DBus rules. It attempts to catch all corner cases, such as specifying a bind permission with an interface conditional or specifying a subject name conditional and a peer name conditional in the same rule. It introduces the concept of conditional lists to the lexer and parser in order to handle 'peer=(label=/usr/bin/foo name=com.foo.bar)', since the existing list support in the lexer only supports a list of values. The DBus rules are encoded as follows: bus,name<bind_perm>,peer_label,path,interface,member<rw_perms> Bind rules stop matching at name<bind_perm>. Note that name is used for the subject name in bind rules and the peer name in rw rules. The function new_dbus_entry() is what does the proper sanitization to make sure that if a name conditional is specified, that it is the subject name in the case of a bind rule or that it is the peer name in the case of a rw rule. Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-07-31 09:05:51 -07:00
Convert codomain to a class Convert the codomain to a class, and the policy lists that store codomains to stl containers instead of glibc twalk. Signed-off-by: John Johansen <john.johansen@canonical.com> [tyhicks: Merge with dbus changes and process_file_entries() cleanup] Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-27 16:16:37 -07:00
profile.o: profile.cc profile.h parser.h
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
parser_version.h: Makefile
@echo \#define PARSER_VERSION \"$(VERSION)\" > .ver
@mv -f .ver $@
Subject: abstract out cap and net proto generation to common/Make.rules This patch abstracts out the generation of the lists of capabilities and network protocol names to the common Make.rules file that is included in most locations in the build tree, to allow it to be re-used in the utils/ tree and possibly elsewhere. It provides the lists in both make variables and as make targets. It also sorts the resulting lists, which causes it to output differently than the before case. I did confirm that the results for the generated files used in the parser build were the same after taking the sorting into account.
2012-03-22 13:19:27 -07:00
# af_names and capabilities generation has moved to common/Make.rules,
# as well as the filtering that occurs for network protocols that
# apparmor should not mediate.
parser/Makefile: * move network families to filter out into a separate variable to so that the list doesn't get lost in a complex sed invocation * pull out the actual macro definitions from linux/socket.h and use them if glibc's sys/socket.h (really bit/socket.h) hasn't caught up with the family definitions.
2009-06-10 19:20:51 +00:00
Due to the Ubuntu multiarch project, internal paths to things keep changing. Since we arguably shouldn't be hardcoding this kind of thing, this changes a path around to use the C preprocessor to do the work of finding the kernel definitions. Signed-off-by: Kees Cook <kees.cook@canonical.com> Acked-by: John Johansen <john.johansen@canonical.com>
2011-08-18 18:26:02 -05:00
.PHONY: af_names.h
af_names.h:
Subject: abstract out cap and net proto generation to common/Make.rules This patch abstracts out the generation of the lists of capabilities and network protocol names to the common Make.rules file that is included in most locations in the build tree, to allow it to be re-used in the utils/ tree and possibly elsewhere. It provides the lists in both make variables and as make targets. It also sorts the resulting lists, which causes it to output differently than the before case. I did confirm that the results for the generated files used in the parser build were the same after taking the sorting into account.
2012-03-22 13:19:27 -07:00
echo "$(AF_NAMES)" | LC_ALL=C sed -n -e 's/[ \t]\?AF_MAX[ \t]\+[0-9]\+,//g' -e 's/[ \t]\+\?AF_\([A-Z0-9_]\+\)[ \t]\+\([0-9]\+\),/#ifndef AF_\1\n# define AF_\1 \2\n#endif\nAA_GEN_NET_ENT("\L\1", \UAF_\1)\n\n/pg' > $@
echo "$(AF_NAMES)" | LC_ALL=C sed -n -e 's/.*,[ \t]\+AF_MAX[ \t]\+\([0-9]\+\),\?.*/#define AA_AF_MAX \1\n/p' >> $@
- Break out make targets so that distributors that don't want full docs can pick targets they want. Patch from Arkadiusz Miskiewicz <arekm at maven.pl>. - Comment out debug dump of generate af_names.h
2010-03-16 15:18:55 -07:00
# cat $@
Patch by jjohansen@suse.de Acked-By: Steve Beattie <sbeattie@suse.de> Support for basic network mediation keywords.
2007-07-27 20:29:47 +00:00
autogenerate the capability names file
2007-11-16 09:32:38 +00:00
cap_names.h: /usr/include/linux/capability.h
Subject: abstract out cap and net proto generation to common/Make.rules This patch abstracts out the generation of the lists of capabilities and network protocol names to the common Make.rules file that is included in most locations in the build tree, to allow it to be re-used in the utils/ tree and possibly elsewhere. It provides the lists in both make variables and as make targets. It also sorts the resulting lists, which causes it to output differently than the before case. I did confirm that the results for the generated files used in the parser build were the same after taking the sorting into account.
2012-03-22 13:19:27 -07:00
echo "$(CAPABILITIES)" | LC_ALL=C sed -n -e "s/[ \\t]\\?CAP_\\([A-Z0-9_]\\+\\)/\{\"\\L\\1\", \\UCAP_\\1\},\\n/pg" > $@
Patch by jjohansen@suse.de Acked-By: Steve Beattie <sbeattie@suse.de> Support for basic network mediation keywords.
2007-07-27 20:29:47 +00:00
[v2: added clean-ups, backed off on some of the build silencing] This is a rather large rearrangement of how a subset of the parser global variables are defined. Right now, there are unit tests built without linking against parser_main.c. As a result, none of the globals defined in parser_main.c could be used in the code that is built for unit tests (misc, regex, symtab, variable). To get a clean build, either stubs needed to be added to "#ifdef UNIT_TEST" blocks in each .c file, or we had to depend on link-time optimizations that would throw out the unused routines. First, this is a problem because all the compile-time warnings had to be explicitly silenced, so reviewing the build logs becomes difficult on failures, and we can potentially (in really unlucky situations) test something that isn't actually part of the "real" parser. Second, not all compilers will allow this kind of linking (e.g. mips gcc), and the missing symbols at link time will fail the entire build even though they're technically not needed. To solve all of this, I've moved all of the global variables used in lex, yacc, and main to parser_common.c, and adjusted the .h files. On top of this, I made sure to fully link the tst builds so all symbols are resolved (including aare lib) and removedonly tst build-log silencing (for now, deferring to another future patchset to consolidate the build silencing). Signed-off-by: Kees Cook <kees.cook@canonical.com>
2011-05-13 02:12:49 -07:00
tst_%: parser_%.c parser.h $(filter-out parser_%.o, ${TEST_OBJECTS})
Convert the parser to C++ This conversion is nothing more than what is required to get it to compile. Further improvements will come as the code is refactored. Unfortunately due to C++ not supporting designated initializers, the auto generation of af names needed to be reworked, and "netlink" and "unix" domain socket keywords leaked in. Since these where going to be added in separate patches I have not bothered to do the extra work to replace them with a temporary place holder. Signed-off-by: John Johansen <john.johansen@canonical.com> [tyhicks: merged with dbus changes and memory leak fixes] Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-27 16:13:22 -07:00
$(CXX) $(TEST_CFLAGS) -o $@ $< $(filter-out $(<:.c=.o), ${TEST_OBJECTS}) $(TEST_LDFLAGS)
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
lock mode bit tests from jjohansen@suse.de Also, make 'check' toplevel target be an alias for 'tests' Acked-By: Steve Beattie <steve@nxnw.org>
2007-10-01 06:12:26 +00:00
.SILENT: check
.PHONY: check
check: tests
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
.SILENT: tests
Make parser's 'tests' target depend on the apparmor_parser binary having been generated first; otherwise, 'make clean tests' fails.
2011-08-09 00:54:14 -07:00
tests: apparmor_parser ${TESTS}
[v2: added clean-ups, backed off on some of the build silencing] This is a rather large rearrangement of how a subset of the parser global variables are defined. Right now, there are unit tests built without linking against parser_main.c. As a result, none of the globals defined in parser_main.c could be used in the code that is built for unit tests (misc, regex, symtab, variable). To get a clean build, either stubs needed to be added to "#ifdef UNIT_TEST" blocks in each .c file, or we had to depend on link-time optimizations that would throw out the unused routines. First, this is a problem because all the compile-time warnings had to be explicitly silenced, so reviewing the build logs becomes difficult on failures, and we can potentially (in really unlucky situations) test something that isn't actually part of the "real" parser. Second, not all compilers will allow this kind of linking (e.g. mips gcc), and the missing symbols at link time will fail the entire build even though they're technically not needed. To solve all of this, I've moved all of the global variables used in lex, yacc, and main to parser_common.c, and adjusted the .h files. On top of this, I made sure to fully link the tst builds so all symbols are resolved (including aare lib) and removedonly tst build-log silencing (for now, deferring to another future patchset to consolidate the build silencing). Signed-off-by: Kees Cook <kees.cook@canonical.com>
2011-05-13 02:12:49 -07:00
sh -e -c 'for test in ${TESTS} ; do echo "*** running $${test}" && ./$${test}; done'
Author: Michael (kensington) parser/Makefile has a number of issues. * Some warnings are produced: "make[1]: warning: jobserver unavailable: using -j1. Add `+' to parent make rule." * CXX is not always respected * LDFLAGS are not always respected modified to apply and retain $(Q) by John Johansen Signed-off-by: John Johansen <john.johansen@canoncial.com>
2011-11-10 09:36:52 -08:00
$(Q)$(MAKE) -s -C tst tests
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
# always need to rebuild.
[v2: added clean-ups, backed off on some of the build silencing] This is a rather large rearrangement of how a subset of the parser global variables are defined. Right now, there are unit tests built without linking against parser_main.c. As a result, none of the globals defined in parser_main.c could be used in the code that is built for unit tests (misc, regex, symtab, variable). To get a clean build, either stubs needed to be added to "#ifdef UNIT_TEST" blocks in each .c file, or we had to depend on link-time optimizations that would throw out the unused routines. First, this is a problem because all the compile-time warnings had to be explicitly silenced, so reviewing the build logs becomes difficult on failures, and we can potentially (in really unlucky situations) test something that isn't actually part of the "real" parser. Second, not all compilers will allow this kind of linking (e.g. mips gcc), and the missing symbols at link time will fail the entire build even though they're technically not needed. To solve all of this, I've moved all of the global variables used in lex, yacc, and main to parser_common.c, and adjusted the .h files. On top of this, I made sure to fully link the tst builds so all symbols are resolved (including aare lib) and removedonly tst build-log silencing (for now, deferring to another future patchset to consolidate the build silencing). Signed-off-by: Kees Cook <kees.cook@canonical.com>
2011-05-13 02:12:49 -07:00
.SILENT: $(AAREOBJECT)
.PHONY: $(AAREOBJECT)
$(AAREOBJECT):
Author: Michael (kensington) parser/Makefile has a number of issues. * Some warnings are produced: "make[1]: warning: jobserver unavailable: using -j1. Add `+' to parent make rule." * CXX is not always respected * LDFLAGS are not always respected modified to apply and retain $(Q) by John Johansen Signed-off-by: John Johansen <john.johansen@canoncial.com>
2011-11-10 09:36:52 -08:00
$(MAKE) -C $(AAREDIR) CFLAGS="$(EXTRA_CXXFLAGS)"
Add dfa support to the parser
2007-02-27 02:29:16 +00:00
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
.PHONY: install-rhel4
install-rhel4: install-redhat
.PHONY: install-redhat
install-redhat:
install -m 755 -d $(DESTDIR)/etc/init.d
install -m 755 rc.apparmor.$(subst install-,,$@) $(DESTDIR)/etc/init.d/apparmor
.PHONY: install-suse
install-suse:
install -m 755 -d $(DESTDIR)/etc/init.d
install -m 755 rc.apparmor.$(subst install-,,$(@)) $(DESTDIR)/etc/init.d/boot.apparmor
install -m 755 -d $(DESTDIR)/sbin
ln -sf /etc/init.d/boot.apparmor $(DESTDIR)/sbin/rcapparmor
ln -sf rcapparmor $(DESTDIR)/sbin/rcsubdomain
Add dfa support to the parser
2007-02-27 02:29:16 +00:00
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
.PHONY: install-slackware
install-slackware:
install -m 755 -d $(APPARMOR_BIN_PREFIX)/install
install -m 755 frob_slack_rc $(APPARMOR_BIN_PREFIX)/install
install -m 755 -d $(DESTDIR)/etc/rc.d
install -m 755 rc.apparmor.$(subst install-,,$(@)) $(DESTDIR)/etc/rc.d/rc.apparmor
Add an empty install-debian: target to keep the makefile from blowing up when running on Debian/Ubuntu systems and also make the init script skip *.dpkg-new files when loading profiles.
2007-03-30 16:09:50 +00:00
.PHONY: install-debian
install-debian:
Submitted By: Mario Fetka (mario dot fetka at gmail dot com) Description: fix compile on build Patch from Gentoo community: - fix up a couple of missing semicolons in syntax (bison compensates by emitting it's own) - Fix yet another variable tyop in rc.apparmor.functions - dump stderr of ls in rc.apparmor.functions to /dev/null - add an install-unknown make target
2008-11-18 17:33:38 +00:00
.PHONY: install-unknown
install-unknown:
In some cases, it is desirable to build the parser without building the binary portions (Hurd). This patch splits up the build targets so this is possible: "main" becomes "arch" "indep" is created and depends on "docs" po building is moved from "main" to "indep" "all" has "tests" removed (standard build practices are to "make" then "make check" so I think "tests"/"check" should stay separate from "all"). redundant chunk is removed (this exists twice in the Makefile): -.SILENT: check -check: tests "install" is split into "install-indep" and "install-arch" "install-arch" requires "arch" and only installs the binaries "install-indep" requires "indep" and only install non-binaries Additionally, update the README to mention the "check" target both for the parser and the utils. Signed-off-by: Kees Cook <kees.cook@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>
2011-05-27 14:57:43 -07:00
INSTALLDEPS=arch
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
ifdef DISTRO
INSTALLDEPS+=install-$(DISTRO)
endif
.PHONY: install
In some cases, it is desirable to build the parser without building the binary portions (Hurd). This patch splits up the build targets so this is possible: "main" becomes "arch" "indep" is created and depends on "docs" po building is moved from "main" to "indep" "all" has "tests" removed (standard build practices are to "make" then "make check" so I think "tests"/"check" should stay separate from "all"). redundant chunk is removed (this exists twice in the Makefile): -.SILENT: check -check: tests "install" is split into "install-indep" and "install-arch" "install-arch" requires "arch" and only installs the binaries "install-indep" requires "indep" and only install non-binaries Additionally, update the README to mention the "check" target both for the parser and the utils. Signed-off-by: Kees Cook <kees.cook@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>
2011-05-27 14:57:43 -07:00
install: install-indep install-arch
.PHONY: install-arch
install-arch: $(INSTALLDEPS)
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
install -m 755 -d $(DESTDIR)/sbin
install -m 755 ${TOOLS} $(DESTDIR)/sbin
In some cases, it is desirable to build the parser without building the binary portions (Hurd). This patch splits up the build targets so this is possible: "main" becomes "arch" "indep" is created and depends on "docs" po building is moved from "main" to "indep" "all" has "tests" removed (standard build practices are to "make" then "make check" so I think "tests"/"check" should stay separate from "all"). redundant chunk is removed (this exists twice in the Makefile): -.SILENT: check -check: tests "install" is split into "install-indep" and "install-arch" "install-arch" requires "arch" and only installs the binaries "install-indep" requires "indep" and only install non-binaries Additionally, update the README to mention the "check" target both for the parser and the utils. Signed-off-by: Kees Cook <kees.cook@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>
2011-05-27 14:57:43 -07:00
.PHONY: install-indep
install-indep:
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
install -m 755 -d $(INSTALL_CONFDIR)
install -m 644 subdomain.conf $(INSTALL_CONFDIR)
Add an example parser.conf file Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Kees Cook <kees@ubuntu.com>
2011-10-07 14:43:54 -07:00
install -m 644 parser.conf $(INSTALL_CONFDIR)
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
install -m 755 -d ${DESTDIR}/var/lib/apparmor
install -m 755 -d $(APPARMOR_BIN_PREFIX)
install -m 755 rc.apparmor.functions $(APPARMOR_BIN_PREFIX)
Author: Michael (kensington) parser/Makefile has a number of issues. * Some warnings are produced: "make[1]: warning: jobserver unavailable: using -j1. Add `+' to parent make rule." * CXX is not always respected * LDFLAGS are not always respected modified to apply and retain $(Q) by John Johansen Signed-off-by: John Johansen <john.johansen@canoncial.com>
2011-11-10 09:36:52 -08:00
$(MAKE) -C po install NAME=${NAME} DESTDIR=${DESTDIR}
$(MAKE) install_manpages DESTDIR=${DESTDIR}
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
Make the build process significantly quieter with respect to the unit and regression tests to avoid developer confusion.
2006-05-31 21:30:50 +00:00
.SILENT: clean
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
.PHONY: clean
Move some common manpage cleanup to common/Make.rules (and clean up pod2html tmpfiles). Also mark manpages to be ignored by svn.
2007-04-03 20:12:16 +00:00
clean: _clean
Subject: Add manpages to the parser package Move the apparmor.d(5), apparmor(7), apparmor_parser(8), subdomain.conf(5) and apparmor.vim(5) (for lack of a better location) into the apparmor-parser package.
2007-04-03 19:04:10 +00:00
rm -f core core.* *.o *.s *.a *~
Move some common manpage cleanup to common/Make.rules (and clean up pod2html tmpfiles). Also mark manpages to be ignored by svn.
2007-04-03 20:12:16 +00:00
rm -f $(TOOLS) $(TESTS)
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
rm -f $(LEX_C_FILES)
rm -f $(YACC_C_FILES)
rm -f parser_version.h
rm -f $(NAME)*.tar.gz $(NAME)*.tgz
Patch by jjohansen@suse.de Acked-By: Steve Beattie <sbeattie@suse.de> Support for basic network mediation keywords.
2007-07-27 20:29:47 +00:00
rm -f af_names.h
autogenerate the capability names file
2007-11-16 09:32:38 +00:00
rm -f cap_names.h
various changes in building techdoc.tex: - make table of contents, footnotes etc. clickable hyperlinks - use timestamp of techdoc.tex (instead of build time) as creationdate in the PDF metadata - don't include build date on first page of the PDF - make clean: - delete techdoc.out (created by pdftex) - fix deletion of techdoc.txt (was techdo_r_.txt) The initial target was to get reproduceable PDF builds (therefore the timestamp-related changes), the other things came up during discussing this patch with David Haller. The only remaining difference in the PDF from build to build is the /ID line. This line can't be controlled in pdflatex and is now filtered out by build-compare in the openSUSE build service (bnc#760867). Credits go to David Haller for writing large parts of this patch (but he didn't notice the techdo_r_.txt ;-) Signed-Off-By: Christian Boltz <apparmor@cboltz.de>
2012-05-09 00:41:06 +02:00
rm -rf techdoc.aux techdoc.out techdoc.log techdoc.pdf techdoc.toc techdoc.txt techdoc/
Author: Michael (kensington) parser/Makefile has a number of issues. * Some warnings are produced: "make[1]: warning: jobserver unavailable: using -j1. Add `+' to parent make rule." * CXX is not always respected * LDFLAGS are not always respected modified to apply and retain $(Q) by John Johansen Signed-off-by: John Johansen <john.johansen@canoncial.com>
2011-11-10 09:36:52 -08:00
$(MAKE) -s -C $(AAREDIR) clean
$(MAKE) -s -C po clean
$(MAKE) -s -C tst clean
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
Make the build process significantly quieter with respect to the unit and regression tests to avoid developer confusion.
2006-05-31 21:30:50 +00:00
.SILENT: dist_clean
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
dist_clean:
Author: Michael (kensington) parser/Makefile has a number of issues. * Some warnings are produced: "make[1]: warning: jobserver unavailable: using -j1. Add `+' to parent make rule." * CXX is not always respected * LDFLAGS are not always respected modified to apply and retain $(Q) by John Johansen Signed-off-by: John Johansen <john.johansen@canoncial.com>
2011-11-10 09:36:52 -08:00
@$(MAKE) clean
Make the build process significantly quieter with respect to the unit and regression tests to avoid developer confusion.
2006-05-31 21:30:50 +00:00
@rm -f $(LEX_C_FILES) $(YACC_C_FILES)
Reference in a new issue Copy permalink