sepolicy: Drop BOARD_SEPOLICY_IGNORE/REPLACE support.

With changes I431c1ab22fc53749f623937154b9ec43469d9645 and
Ia54aa263f2245c7090f4b9d9703130c19f11bd28, it is no longer
legitimate to use BOARD_SEPOLICY_IGNORE or REPLACE with
any of the *_contexts files since the CTS requires the AOSP
entries to be present in the device files.

Further, these changes render BOARD_SEPOLICY_IGNORE unusable for
most policy files since all domains and types referenced within any
of the AOSP *_contexts entries must be defined in the kernel policy, so
you cannot use BOARD_SEPOLICY_IGNORE to exclude any .te file
that defines a type referenced in any of those *_contexts files.
There does not seem to be a significant need for such a facility,
as AOSP policy is small and only domains and types used by most
devices should be defined in external/sepolicy.

BOARD_SEPOLICY_REPLACE is commonly misused to eliminate neverallow rules
from AOSP policy, which will only lead to CTS failures, especially
since change Iefe508df265f62efa92f8eb74fc65542d39e3e74 introduced neverallow
checking on the entire policy via sepolicy-analyze.  The only remaining
legitimate function of BOARD_SEPOLICY_REPLACE is to support overriding
AOSP .te files with more restrictive rule sets.  However, the need for this
facility has been significantly reduced by the fact that AOSP policy
is now fully confined + enforcing for all domains, and further restrictions
beyond AOSP carry a compatibility risk.

Builders of custom policies and custom ROMs still have the freedom to
apply patches on top of external/sepolicy to tighten rule sets (which are
likely more maintainable than maintaining a completely separate copy of
the file via BOARD_SEPOLICY_REPLACE) and/or of using their own separate
policy build system as exemplified by
https://bitbucket.org/quarksecurity/build-policies



Change-Id: I2611e983f7cbfa15f9d45ec3ea301e94132b06fa
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

Android.mk

@@ -3,36 +3,20 @@ LOCAL_PATH:= $(call my-dir)
 include $(CLEAR_VARS)
 
 # SELinux policy version.
-# Must be <= /selinux/policyvers reported by the Android kernel.
+# Must be <= /sys/fs/selinux/policyvers reported by the Android kernel.
 # Must be within the compatibility range reported by checkpolicy -V.
 POLICYVERS ?= 26
 
 MLS_SENS=1
 MLS_CATS=1024
 
-# Quick edge case error detection for BOARD_SEPOLICY_REPLACE.
-# Builds the singular path for each replace file.
-sepolicy_replace_paths :=
-$(foreach pf, $(BOARD_SEPOLICY_REPLACE), \
-  $(if $(filter $(pf), $(BOARD_SEPOLICY_UNION)), \
-    $(error Ambiguous request for sepolicy $(pf). Appears in both \
-      BOARD_SEPOLICY_REPLACE and BOARD_SEPOLICY_UNION), \
-  ) \
-  $(eval _paths := $(filter-out $(BOARD_SEPOLICY_IGNORE), \
-  $(wildcard $(addsuffix /$(pf), $(BOARD_SEPOLICY_DIRS))))) \
-  $(eval _occurrences := $(words $(_paths))) \
-  $(if $(filter 0,$(_occurrences)), \
-    $(error No sepolicy file found for $(pf) in $(BOARD_SEPOLICY_DIRS)), \
-  ) \
-  $(if $(filter 1, $(_occurrences)), \
-    $(eval sepolicy_replace_paths += $(_paths)), \
-    $(error Multiple occurrences of replace file $(pf) in $(_paths)) \
-  ) \
-  $(if $(filter 0, $(words $(wildcard $(addsuffix /$(pf), $(LOCAL_PATH))))), \
-    $(error Specified the sepolicy file $(pf) in BOARD_SEPOLICY_REPLACE, \
-      but none found in $(LOCAL_PATH)), \
-  ) \
-)
+ifdef BOARD_SEPOLICY_REPLACE
+$(error BOARD_SEPOLICY_REPLACE is no longer supported; please remove from your BoardConfig.mk or other .mk file.)
+endif
+
+ifdef BOARD_SEPOLICY_IGNORE
+$(error BOARD_SEPOLICY_IGNORE is no longer supported; please remove from your BoardConfig.mk or other .mk file.)
+endif
 
 # Quick edge case error detection for BOARD_SEPOLICY_UNION.
 # This ensures that a requested union file exists somewhere
@@ -44,24 +28,18 @@ $(foreach pf, $(BOARD_SEPOLICY_UNION), \
 )
 
 # Builds paths for all requested policy files w.r.t
-# both BOARD_SEPOLICY_REPLACE and BOARD_SEPOLICY_UNION
-# product variables.
+# BOARD_SEPOLICY_UNION variables.
 # $(1): the set of policy name paths to build
 build_policy = $(foreach type, $(1), \
-  $(filter-out $(BOARD_SEPOLICY_IGNORE), \
     $(foreach expanded_type, $(notdir $(wildcard $(addsuffix /$(type), $(LOCAL_PATH)))), \
-      $(if $(filter $(expanded_type), $(BOARD_SEPOLICY_REPLACE)), \
-        $(wildcard $(addsuffix $(expanded_type), $(sort $(dir $(sepolicy_replace_paths))))), \
         $(LOCAL_PATH)/$(expanded_type) \
       ) \
-    ) \
     $(foreach union_policy, $(wildcard $(addsuffix /$(type), $(BOARD_SEPOLICY_DIRS))), \
       $(if $(filter $(notdir $(union_policy)), $(BOARD_SEPOLICY_UNION)), \
         $(union_policy), \
       ) \
     ) \
-  ) \
-)
+  )
 
 sepolicy_build_files := security_classes \
                         initial_sids \
@@ -355,7 +333,6 @@ $(LOCAL_BUILT_MODULE) : $(built_sepolicy) $(built_pc) $(built_fc) $(built_sc) $(
 
 build_policy :=
 sepolicy_build_files :=
-sepolicy_replace_paths :=
 built_sepolicy :=
 built_sc :=
 built_fc :=

README

@@ -9,12 +9,10 @@ Policy Generation:
 Additional, per device, policy files can be added into the
 policy build.
 
-They can be configured through the use of four variables,
+They can be configured through the use of two variables,
 they are:
-1. BOARD_SEPOLICY_REPLACE
-2. BOARD_SEPOLICY_UNION
-3. BOARD_SEPOLICY_DIRS
-4. BOARD_SEPOLICY_IGNORE
+1. BOARD_SEPOLICY_UNION
+2. BOARD_SEPOLICY_DIRS
 
 The variables should be set in the BoardConfig.mk file in
 the device or vendor directories.
@@ -24,12 +22,8 @@ BOARD_SEPOLICY_UNION is a list of files that will be
 file in external/sepolicy. Note, to add a unique file you
 would use this variable.
 
-BOARD_SEPOLICY_REPLACE is a list of files that will be
-used instead of the corresponding file in external/sepolicy.
-
 BOARD_SEPOLICY_DIRS contains a list of directories to search
-for BOARD_SEPOLICY_UNION and BOARD_SEPOLICY_REPLACE files. Order
-matters in this list.
+for BOARD_SEPOLICY_UNION files. Order matters in this list.
 eg.) If you have BOARD_SEPOLICY_UNION += widget.te and have 2
 instances of widget.te files on BOARD_SEPOLICY_DIRS search path.
 The first one found (at the first search dir containing the file)
@@ -37,43 +31,9 @@ gets processed first.
 Reviewing out/target/product/<device>/etc/sepolicy_intermediates/policy.conf
 will help sort out ordering issues.
 
-It is an error to specify a BOARD_POLICY_REPLACE file that does
-not exist in external/sepolicy.
-
-It is an error to specify a BOARD_POLICY_REPLACE file that appears
-multiple times on the policy search path defined by BOARD_SEPOLICY_DIRS.
-eg.) if you specify shell.te in BOARD_SEPOLICY_REPLACE and
-BOARD_SEPOLICY_DIRS is set to
-"vendor/widget/common/sepolicy device/widget/x/sepolicy" and shell.te
-appears in both locations, it is an error. Unless it is in
-BOARD_SEPOLICY_IGNORE to be filtered out. See BOARD_SEPOLICY_IGNORE
-for more details.
-
-It is an error to specify the same file name in both
-BOARD_POLICY_REPLACE and BOARD_POLICY_UNION.
-
-It is an error to specify a BOARD_SEPOLICY_DIRS that has no entries when
-specifying BOARD_SEPOLICY_REPLACE.
-
 It is an error to specify a BOARD_POLICY_UNION file that
 doesn't appear in any of the BOARD_SEPOLICY_DIRS locations.
 
-BOARD_SEPOLICY_IGNORE is a list of paths (directory + filename) of
-files that are not to be included in the resulting policy. This list
-is passed to filter-out to remove any paths you may want to ignore. This
-is useful if you have numerous config directories that contain a file
-and you want to NOT include a particular file in your resulting
-policy file, either by UNION or REPLACE.
-Eg.) Suppose the following:
-     BOARD_SEPOLICY_DIRS += X Y
-     BOARD_SEPOLICY_REPLACE += A
-     BOARD_SEPOLICY_IGNORE += X/A
-
-     Directories X and Y contain A.
-
-     The resulting policy is created by using Y/A only, thus X/A was
-     ignored.
-
 Example BoardConfig.mk Usage:
 From the Tuna device BoardConfig.mk, device/samsung/tuna/BoardConfig.mk
 
@@ -95,8 +55,7 @@ mac_permissions.xml:
     top of that file. The seinfo string, previously mentioned, is the same string
     that is referenced in seapp_contexts.
 
-    This file can be replaced through BOARD_SEPOLICY_REPLACE containing the
-    value "mac_permissions.xml", or appended to by using the BOARD_SEPOLICY_UNION
+    This file can be appended to by using the BOARD_SEPOLICY_UNION
     variable. It is important to note the final processed version of this file
     is stripped of comments and whitespace. This is to preserve space on the
     system.img. If one wishes to view it in a more human friendly format,
@@ -114,8 +73,8 @@ mac_permissions.xml:
       keys.conf
         The keys.conf file is used for controlling the mapping of "tags" found in
         the mac_permissions.xml signature stanzas with actual public keys found in
-        pem files. The configuration file can be used in BOARD_SEPOLICY_UNION and
-        BOARD_SEPOLICY_REPLACE variables and is processed via m4.
+        pem files. The configuration file can be used in BOARD_SEPOLICY_UNION
+        variables and is processed via m4.
 
         The script allows for mapping any string contained in TARGET_BUILD_VARIANT
         with specific path to a pem file. Typically TARGET_BUILD_VARIANT is either