[PATCH 04/24] Add security policy support

[Ahmad Fatoum]

On 8/22/25 12:20, Sascha Hauer wrote:
> On Wed, Aug 20, 2025 at 03:17:48PM +0200, Sascha Hauer wrote:
>> diff --git a/scripts/Makefile.policy b/scripts/Makefile.policy
>> new file mode 100644
>> index 0000000000000000000000000000000000000000..4c71774bbbc98f9de9cf5463e5ef431de60be6ac
>> --- /dev/null
>> +++ b/scripts/Makefile.policy
>> @@ -0,0 +1,39 @@
>> +# SPDX-License-Identifier: GPL-2.0-only
>> +
>> +real-policy-y   := $(addprefix $(obj)/, $(policy-y))
>> +
>> +targets         += $(addsuffix .tmp, $(real-policy-y))
>> +
>> +# policy-list
>> +# ---------------------------------------------------------------------------
>> +
>> +subdir-policylist := $(addsuffix /policy-list, $(subdir-ym))
>> +real-policy-y   += $(subdir-policylist)
> 
> Not sure what this line is good for, but it has the effect that subdirs
> are added to real-policy-y...

The code was taken partially from dtbs-list handling in the kernel,
where the top-level Makefile hardcodes the path to
arch/$SRCARCH/boot/dts and then Makefile.dtbs would collect the
dtbs-list in subdirectories.

>> +ifneq ($(policy-y)$(policy-),)
>> +always-y        += $(obj)/policy-list
>> +
>> +$(subdir-policylist): $(obj)/%/policy-list: $(obj)/% ;
>> +
>> +$(obj)/policy-list: $(real-policy-y) FORCE
>> +	$(call if_changed,gen_order_src)
> 
> ...and then this fails because it tries to do a cat on the subdir.
> 
> It worked during testing because all policy-y was in leaf
> directories, but I just added a policy-y to common/Makefile.

Ah, I think we can drop the subdir-.

Thanks,
Ahmad

> 
> Sascha
> 
> 

-- 
Pengutronix e.K.                  |                             |
Steuerwalder Str. 21              | http://www.pengutronix.de/  |
31137 Hildesheim, Germany         | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686  | Fax:   +49-5121-206917-5555 |