#
# Makefile for the security policy.
#
# Targets:
# 
# install - compile and install the policy configuration.
# load    - compile, install, and load the policy configuration.
# reload  - compile, install, and load/reload the policy configuration.
# relabel - relabel filesystems based on the file contexts configuration.
# policy  - compile the policy configuration locally for testing/development.
#
# The default target is 'install'.
#

# Set to y if MLS is enabled in the module.
MLS=n

FLASKDIR = ../flask/
PREFIX = /usr/local/selinux
BINDIR = $(PREFIX)/bin
LOADPOLICY  = $(BINDIR)/load_policy
CHECKPOLICY = $(BINDIR)/checkpolicy
SETFILES = $(BINDIR)/setfiles

POLICYVER := policy.$(shell $(CHECKPOLICY) -V)
INSTALLDIR = /etc/security/selinux
LOADPATH = $(INSTALLDIR)/$(POLICYVER)
SRCINSTALLDIR = $(INSTALLDIR)/src
POLICYCONF = $(SRCINSTALLDIR)/policy.conf

POLICYFILES = $(addprefix $(FLASKDIR),security_classes initial_sids access_vectors)
ifeq ($(MLS),y)
POLICYFILES += mls
endif
POLICYFILES += tmp/te-rbac.m4
POLICYFILES += users 
POLICYFILES += tmp/constraints-contexts.m4

FC = file_contexts/file_contexts
FCFILES=file_contexts/types.fc $(patsubst domains/program/%.te,file_contexts/program/%.fc, $(wildcard domains/program/*.te))


install: $(LOADPATH)

$(LOADPATH):  $(POLICYCONF) $(CHECKPOLICY)
	mkdir -p $(INSTALLDIR)
	$(CHECKPOLICY) -o $@ $(POLICYCONF)
# Note: Can't use install, so not sure how to deal with mode, user, and group
#	other than by default.

policy: $(POLICYVER)

$(POLICYVER):  policy.conf $(CHECKPOLICY)
	$(CHECKPOLICY) -o $@ policy.conf

$(POLICYCONF): policy.conf 
	mkdir -p $(SRCINSTALLDIR)
	install -m 644 -o root -g root policy.conf $@

reload tmp/load: $(LOADPATH)
	$(LOADPOLICY) $(LOADPATH)
	touch tmp/load

load: tmp/load

policy.conf: $(POLICYFILES) 
	mkdir -p tmp
	cat $^ > $@

install-src: 
	rm -rf $(SRCINSTALLDIR)/policy.old
	-mv $(SRCINSTALLDIR)/policy $(SRCINSTALLDIR)/policy.old
	mkdir -p $(SRCINSTALLDIR)/policy
	cp -R . $(SRCINSTALLDIR)/policy

ALLTEFILES := attrib.te tmp/program_used_flags.te tmp/all_macros.te tmp/all_types.te tmp/all_domains.te assert.te 
TE_RBAC_MACRO_FILES := tmp/all.te rbac
CONSTRAINT_CONTEXT_MACRO_FILES := tmp/program_used_flags.te tmp/all_macros.te constraints initial_sid_contexts fs_use genfs_contexts net_contexts

tmp/te-rbac.m4: $(TE_RBAC_MACRO_FILES)
	m4 -Imacros -s $^ > $@

tmp/constraints-contexts.m4: $(CONSTRAINT_CONTEXT_MACRO_FILES)
	m4 -Imacros -s $^ > $@

tmp/all.te: $(ALLTEFILES)
	cat $^ > $@

tmp/program_used_flags.te: $(wildcard domains/program/*.te) domains/program
	mkdir -p tmp
	( cd domains/program/ ; for n in *.te ; do echo "define(\`$$n')"; done ) > $@
	( cd domains/misc/ ; for n in *.te ; do echo "define(\`$$n')"; done ) >> $@

tmp/all_macros.te:  macros $(wildcard macros/*.te) tmp/all_program_macros.te
	cat $(wildcard macros/*.te) tmp/all_program_macros.te > $@

tmp/all_program_macros.te: macros/program $(wildcard macros/program/*.te)
	cat $(wildcard macros/program/*.te) > $@

tmp/all_types.te: $(wildcard types/*.te) types
	cat types/*.te > $@

tmp/all_domains.te: $(wildcard domains/*.te domains/misc/*.te domains/program/*.te) domains domains/misc domains/program
	cat domains/*.te domains/misc/*.te domains/program/*.te > $@

relabel:  $(FC) $(SETFILES)
	$(SETFILES) $(FC) `mount | awk '/(ext[23]|reiserfs)/{print $$3}'`

reset:  $(FC) $(SETFILES)
	$(SETFILES) -R $(FC) `mount | awk '/(ext[23]|reiserfs)/{print $$3}'`

$(FC): $(FCFILES) file_contexts/program 
	cat $(FCFILES) > $@

clean:
	rm -f policy.conf
	rm -f tmp/*
	rm -f $(FC)
