# Compile text policies into kernel-loadable binaries:
#   checkmodule -M -m -o mypol.mod mypol.te
#   semodule_package -o mypol.pp -m mypol.mod
#
# Run with no arguments to show available targets.
#
# USAGE
#   1. Fiddle with new .te file.
#   2. Run "make load" until it works.
#   3. Run "make install" and "make clean".
#   4. Run "make diff" and checkin any changes.

SHELL   := /bin/sh
TXT      = $(wildcard *.te)
POLICIES = $(TXT:.te=.pp)
LOAD     = $(POLICIES:.pp=.ld)

# Run these at boot.
DEST     = /usr/local/etc/selinux

# Suffix rules
.POSIX:
.SUFFIXES: .ld .mod .pp .te

.te.mod:
	checkmodule -M -m -o $@ $<

.mod.pp:
	semodule_package -o $@ -m $<

# ".ld" is a fake suffix -- use it to compare all policies with the
# ones in the installation directory, only load the ones that changed.
# There's a smart way to do this, damned if I know what it is.
.pp.ld:
	-@cmp -s $? $(DEST)/$? || { echo $?; semodule -i $?; }

# -------------------------------------------------------------------------
# Real work starts here

help: ## show all targets
	@egrep -h '\s##\s' $(MAKEFILE_LIST) | sort | \
	awk 'BEGIN {FS = ":.*?## "} \
		{printf "\033[36m%-20s\033[0m %s\n", $$1, $$2}'

all: $(POLICIES) ## read all .te files, create .pp files.

clean: ## remove all .pp files plus intermediate (.mod) files.
	rm -f *.mod
	rm -f *.pp

diff: ## compare .te files to checked-in versions.
	-test -d 'RCS' && rcsdiff RCS/*

install: ## move all .pp files to DEST directory read at system boot.
	mkdir -p $(DEST) && mv $(POLICIES) $(DEST) && chown root $(DEST)/*

load: $(LOAD) ## only load .pp files that differ from those in DEST

loadall: ## load every .pp file in this directory.
	semodule -i $(POLICIES)