tomoyo: Do not generate empty policy files

The Makefile automatically generates the tomoyo policy files, which are
not removed by make clean (because they could have been provided by the
user). Instead of generating the missing files, use /dev/null if a
given file is not provided. Store the default exception_policy in
exception_policy.conf.default.

Acked-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Michal Marek <mmarek@suse.cz>

diff --git a/security/tomoyo/.gitignore b/security/tomoyo/.gitignore
index 5caf1a6f59078d653f967341eb99fa962d730a8d..dc0f220a210bfa23fe5f383fa308cfa43e00dc3f 100644 (file)
--- a/security/tomoyo/.gitignore
+++ b/security/tomoyo/.gitignore
@@ -1,2 +1,2 @@
 builtin-policy.h
-policy/
+policy/*.conf

diff --git a/security/tomoyo/Makefile b/security/tomoyo/Makefile
index ecdefb583fcf84503a9e63785664407c3d294632..65dbcb2fd850289a192e3b24df50315bf9f3751b 100644 (file)
--- a/security/tomoyo/Makefile
+++ b/security/tomoyo/Makefile
@@ -1,41 +1,15 @@
 obj-y = audit.o common.o condition.o domain.o environ.o file.o gc.o group.o load_policy.o memory.o mount.o network.o realpath.o securityfs_if.o tomoyo.o util.o
 
-$(obj)/policy/profile.conf:
-       @mkdir -p $(obj)/policy/
-       @echo Creating an empty policy/profile.conf
-       @touch $@
-
-$(obj)/policy/exception_policy.conf:
-       @mkdir -p $(obj)/policy/
-       @echo Creating a default policy/exception_policy.conf
-       @echo initialize_domain /sbin/modprobe from any >> $@
-       @echo initialize_domain /sbin/hotplug from any >> $@
-
-$(obj)/policy/domain_policy.conf:
-       @mkdir -p $(obj)/policy/
-       @echo Creating an empty policy/domain_policy.conf
-       @touch $@
-
-$(obj)/policy/manager.conf:
-       @mkdir -p $(obj)/policy/
-       @echo Creating an empty policy/manager.conf
-       @touch $@
-
-$(obj)/policy/stat.conf:
-       @mkdir -p $(obj)/policy/
-       @echo Creating an empty policy/stat.conf
-       @touch $@
-
 targets += builtin-policy.h
 define do_policy
 echo "static char tomoyo_builtin_$(1)[] __initdata ="; \
-$(objtree)/scripts/basic/bin2c <$(obj)/policy/$(1).conf; \
+$(objtree)/scripts/basic/bin2c <$(firstword $(wildcard $(obj)/policy/$(1).conf $(srctree)/$(src)/policy/$(1).conf.default) /dev/null); \
 echo ";"
 endef
 quiet_cmd_policy  = POLICY  $@
       cmd_policy  = ($(call do_policy,profile); $(call do_policy,exception_policy); $(call do_policy,domain_policy); $(call do_policy,manager); $(call do_policy,stat)) >$@
 
-$(obj)/builtin-policy.h: $(obj)/policy/profile.conf $(obj)/policy/exception_policy.conf $(obj)/policy/domain_policy.conf $(obj)/policy/manager.conf $(obj)/policy/stat.conf FORCE
+$(obj)/builtin-policy.h: $(wildcard $(obj)/policy/*.conf $(src)/policy/*.conf.default) FORCE
        $(call if_changed,policy)
 
 $(obj)/common.o: $(obj)/builtin-policy.h

diff --git a/security/tomoyo/policy/exception_policy.conf.default b/security/tomoyo/policy/exception_policy.conf.default
new file mode 100644 (file)
index 0000000..2678df4
--- /dev/null
+++ b/security/tomoyo/policy/exception_policy.conf.default
@@ -0,0 +1,2 @@
+initialize_domain /sbin/modprobe from any
+initialize_domain /sbin/hotplug from any