Received-SPF: pass (google.com: domain of selinux-refpolicy-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: How is policy.31 created from modules under /usr/share/selinux
To:     Ashish Mishra <ashishm@mvista.com>,
        Richard Haines <richard_c_haines@btinternet.com>
Cc:     selinux-refpolicy@vger.kernel.org, Paul Moore <paul@paul-moore.com>
References: <CAP2OjcjCFYiyMfqa=X__X6g0U0143U5Fd-xGaKJgGNabFUpr7w@mail.gmail.com>
 <858c9383f7c75e1e39bafaeab6388cd6af902c4f.camel@btinternet.com>
 <CAP2OjciTWXRsYWw9VtOJGUOGj9B35HMXBHF94O6Qc=csg5=Spw@mail.gmail.com>
 <e82841a8b652f4b4b697ba1e417fdac56f443adb.camel@btinternet.com>
 <CAP2OjchJjMo8zMVvHk-_esu-53E0=367yV8cuZtwQwubi7+q=Q@mail.gmail.com>
 <0b58a502b5036e8b92b274068fbea53ca915992e.camel@btinternet.com>
 <CAP2Ojcg7DgQsEHJP3TZj=Q9NjZjqb3ugw+D2UYC4qmqt-PcZWw@mail.gmail.com>
From:   Chris PeBenito <pebenito@ieee.org>
Message-ID: <2806a33b-87ad-61b1-9143-5a24d770a180@ieee.org>
Date:   Tue, 8 Dec 2020 10:36:37 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.5.0
MIME-Version: 1.0
In-Reply-To: <CAP2Ojcg7DgQsEHJP3TZj=Q9NjZjqb3ugw+D2UYC4qmqt-PcZWw@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Precedence: bulk

(SELinux main mail list to BCC since this is a refpolicy question.)

On 12/7/20 8:26 AM, Ashish Mishra wrote:
>   4)  Further debugging I can confirm that the final binary (policy.31)
> seems to be
>        using HARD-CODDED location of /etc/selinux instead of what is
> being passed as DESTDIR.
>       The policy.31 is created not at custom-embedded-rootfs location.
> 
>        Due to this :
>          - policy.31 is created in /etc/selinux/refpolicy/policy/policy.31
>            instead of what i was expecting at
> /tmp/custom-embedded-rootfs/etc/selinux/refpolicy/policy/policy.31
>            as DESTDIR=${ROOT}  and i do get *.pp at the expected
> location of /tmp/custom-embedded-rootfs/etc/selinux/refpolicy/src/policy
>                   ${MAKE} -C ${ROOT}/etc/selinux/${PKG}/src/policy load
> DESTDIR=${ROOT}


I can't reproduce your issue.  I use monolithic policy regularly in the way 
you're using it.

Here's the Makefile variables:

 From Makefile:
   topdir := $(DESTDIR)/etc/selinux
   installdir := $(topdir)/$(strip $(NAME))
   policypath := $(installdir)/policy

 From Rules.monolithic:
   loadpath = $(policypath)/$(notdir $(polver))

$(notdir $(polver)) is "policy.31" and NAME is what you have in build.conf, e.g. 
"refopolicy".


Then the install target for monolithic looks like this (with "echo"s removed):

$(loadpath): $(policy_conf)
         @$(INSTALL) -d -m 0755 $(@D)
         $(verbose) $(CHECKPOLICY) -U $(UNK_PERMS)  $^ -o $@

-- 
Chris PeBenito