Skip to content

Commit 7f232b2

Browse files
DreamConnectedDreamConnected
authored
Merge pull request #53 from DreamConnected/main
add lsm selinux, add seccomp backend
2 parents 2ad3967 + 9977f2d commit 7f232b2

11 files changed

Lines changed: 725 additions & 44 deletions

File tree

‎.github/workflows/code-test.yml‎

Lines changed: 25 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
- name: Set up Android NDK
1313
uses: nttld/setup-ndk@v1
1414
with:
15-
ndk-version: r27c
15+
ndk-version: r28c
1616

1717
- name: Install dependencies
1818
run: |
@@ -21,10 +21,30 @@ jobs:
2121
pipx ensurepath
2222
pipx install meson==0.61
2323
pipx install ninja
24+
25+
- name: Download Dependencies
26+
run: |
27+
libssl=$(curl -s https://api.github.com/repos/android-dev-stub/libssl-android-stub-dev/releases/latest | grep browser_download_url | cut -d'"' -f4 |grep -E 'zip$')
28+
libssl_file=$(curl -s https://api.github.com/repos/android-dev-stub/libssl-android-stub-dev/releases/latest | grep name | cut -d'"' -f4 |grep -E 'zip$')
29+
wget -q ${libssl} && sudo unzip -q -o ${libssl_file} -d / && echo 1/4 ${libssl} ${libssl_file}
30+
31+
libcap=$(curl -s https://api.github.com/repos/android-dev-stub/libcap-android-stub-dev/releases/latest | grep browser_download_url | cut -d'"' -f4 |grep -E 'zip$')
32+
libcap_file=$(curl -s https://api.github.com/repos/android-dev-stub/libcap-android-stub-dev/releases/latest | grep name | cut -d'"' -f4 |grep -E 'zip$')
33+
wget -q ${libcap} && sudo unzip -q -o ${libcap_file} -d / && echo 2/4 ${libcap} ${libcap_file}
34+
35+
libselinux=$(curl -s https://api.github.com/repos/android-dev-stub/libselinux-android-stub-dev/releases/latest | grep browser_download_url | cut -d'"' -f4 |grep -E 'zip$')
36+
libselinux_file=$(curl -s https://api.github.com/repos/android-dev-stub/libselinux-android-stub-dev/releases/latest | grep name | cut -d'"' -f4 |grep -E 'zip$')
37+
wget -q ${libselinux} && sudo unzip -q -o ${libselinux_file} -d / && echo 3/4 ${libselinux} ${libselinux_file}
2438
39+
libminijail=$(curl -s https://api.github.com/repos/android-dev-stub/libminijail-dev/releases/latest | grep browser_download_url | cut -d'"' -f4 |grep -E 'zip$')
40+
libminijail_file=$(curl -s https://api.github.com/repos/android-dev-stub/libminijail-dev/releases/latest | grep name | cut -d'"' -f4 |grep -E 'zip$')
41+
wget -q ${libminijail} && sudo unzip -q -o ${libminijail_file} -d / && echo 4/4 ${libminijail} ${libminijail_file}
42+
2543
- name: Test build
2644
run: |
2745
sed -i "s|android-ndk-r27c|$ANDROID_NDK_HOME|g" aarch64-android-api30.txt
46+
export PKG_CONFIG_PATH=/data/sysroot/lib/pkgconfig:$PKG_CONFIG_PATH
47+
export LDFLAGS="-L/data/sysroot/lib -lcap -lselinux -lminijail -lssl"
2848
2949
meson setup build \
3050
-Dprefix=/data/share \
@@ -38,11 +58,12 @@ jobs:
3858
--localstatedir=/data/share/var \
3959
-Dmemfd-rexec=true \
4060
--buildtype debug \
41-
-Dcapabilities=false \
61+
-Dcapabilities=true \
4262
-Dseccomp=false \
43-
-Dselinux=false \
63+
-Dseccomp-minijail=true \
64+
-Dselinux=true \
4465
-Dapparmor=false \
45-
-Dopenssl=false \
66+
-Dopenssl=true \
4667
-Ddbus=false \
4768
-Dandroid-log=true \
4869
-Dandroid-audio=true \
@@ -59,8 +80,3 @@ jobs:
5980
name: android-aarch64-lxc-shared-api30
6081
path: /data/share/*
6182

62-
- name: Upload artifacts lxc-module
63-
uses: actions/upload-artifact@v4.3.1
64-
with:
65-
name: android-lxc-module
66-
path: lxc-module.zip

‎.github/workflows/main.yml‎

Lines changed: 24 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ on:
55
ndk_version:
66
description: 'Android NDK version'
77
required: false
8-
default: 'r27c'
8+
default: 'r29c'
99

1010
jobs:
1111
build:
@@ -30,30 +30,27 @@ jobs:
3030
3131
- name: Download Dependencies
3232
run: |
33-
libssl=$(curl -s https://api.github.com/repos/DreamConnected/libopenssl-dev/releases/latest | grep browser_download_url | cut -d'"' -f4 |grep -E 'zip$')
34-
libssl_file=$(curl -s https://api.github.com/repos/DreamConnected/libopenssl-dev/releases/latest | grep name | cut -d'"' -f4 |grep -E 'zip$')
35-
wget -q ${libssl} && sudo unzip -q -o ${libssl_file} -d / && echo 1/5 ${libssl} ${libssl_file}
33+
libssl=$(curl -s https://api.github.com/repos/android-dev-stub/libssl-android-stub-dev/releases/latest | grep browser_download_url | cut -d'"' -f4 |grep -E 'zip$')
34+
libssl_file=$(curl -s https://api.github.com/repos/android-dev-stub/libssl-android-stub-dev/releases/latest | grep name | cut -d'"' -f4 |grep -E 'zip$')
35+
wget -q ${libssl} && sudo unzip -q -o ${libssl_file} -d / && echo 1/4 ${libssl} ${libssl_file}
3636
37-
libcap=$(curl -s https://api.github.com/repos/DreamConnected/AndroidLibcapBuild/releases/latest | grep browser_download_url | cut -d'"' -f4 |grep -E 'zip$')
38-
libcap_file=$(curl -s https://api.github.com/repos/DreamConnected/AndroidLibcapBuild/releases/latest | grep name | cut -d'"' -f4 |grep -E 'zip$')
39-
wget -q ${libcap} && sudo unzip -q -o ${libcap_file} -d / && echo 2/5 ${libcap} ${libcap_file}
37+
libcap=$(curl -s https://api.github.com/repos/android-dev-stub/libcap-android-stub-dev/releases/latest | grep browser_download_url | cut -d'"' -f4 |grep -E 'zip$')
38+
libcap_file=$(curl -s https://api.github.com/repos/android-dev-stub/libcap-android-stub-dev/releases/latest | grep name | cut -d'"' -f4 |grep -E 'zip$')
39+
wget -q ${libcap} && sudo unzip -q -o ${libcap_file} -d / && echo 2/4 ${libcap} ${libcap_file}
4040
41-
libapparmor=$(curl -s https://api.github.com/repos/DreamConnected/libapparmor-dev/releases/latest | grep browser_download_url | cut -d'"' -f4 |grep -E 'zip$')
42-
libapparmor_file=$(curl -s https://api.github.com/repos/DreamConnected/libapparmor-dev/releases/latest | grep name | cut -d'"' -f4 |grep -E 'zip$')
43-
wget -q ${libapparmor} && sudo unzip -q -o ${libapparmor_file} -d / && echo 3/5 ${libapparmor} ${libapparmor_file}
44-
45-
libselinux=$(curl -s https://api.github.com/repos/DreamConnected/libselinux-dev/releases/latest | grep browser_download_url | cut -d'"' -f4 |grep -E 'zip$')
46-
libselinux_file=$(curl -s https://api.github.com/repos/DreamConnected/libselinux-dev/releases/latest | grep name | cut -d'"' -f4 |grep -E 'zip$')
47-
wget -q ${libselinux} && sudo unzip -q -o ${libselinux_file} -d / && echo 4/5 ${libselinux} ${libselinux_file}
48-
49-
libseccomp=$(curl -s https://api.github.com/repos/DreamConnected/libseccomp-dev/releases/latest | grep browser_download_url | cut -d'"' -f4 |grep -E 'zip$')
50-
libseccomp_file=$(curl -s https://api.github.com/repos/DreamConnected/libseccomp-dev/releases/latest | grep name | cut -d'"' -f4 |grep -E 'zip$')
51-
wget -q ${libseccomp} && sudo unzip -q -o ${libseccomp_file} -d / && echo 5/5 ${libseccomp} ${libseccomp_file}
41+
libselinux=$(curl -s https://api.github.com/repos/android-dev-stub/libselinux-android-stub-dev/releases/latest | grep browser_download_url | cut -d'"' -f4 |grep -E 'zip$')
42+
libselinux_file=$(curl -s https://api.github.com/repos/android-dev-stub/libselinux-android-stub-dev/releases/latest | grep name | cut -d'"' -f4 |grep -E 'zip$')
43+
wget -q ${libselinux} && sudo unzip -q -o ${libselinux_file} -d / && echo 3/4 ${libselinux} ${libselinux_file}
5244
45+
libminijail=$(curl -s https://api.github.com/repos/android-dev-stub/libminijail-dev/releases/latest | grep browser_download_url | cut -d'"' -f4 |grep -E 'zip$')
46+
libminijail_file=$(curl -s https://api.github.com/repos/android-dev-stub/libminijail-dev/releases/latest | grep name | cut -d'"' -f4 |grep -E 'zip$')
47+
wget -q ${libminijail} && sudo unzip -q -o ${libminijail_file} -d / && echo 4/4 ${libminijail} ${libminijail_file}
48+
5349
- name: Build lxc
5450
run: |
5551
sed -i "s|android-ndk-r27c|$ANDROID_NDK_HOME|g" aarch64-android-api30.txt
56-
export PKG_CONFIG_PATH=/data/sysroot/lib/pkgconfig:/data/sysroot/lib64/pkgconfig:$PKG_CONFIG_PATH
52+
export PKG_CONFIG_PATH=/data/sysroot/lib/pkgconfig:$PKG_CONFIG_PATH
53+
export LDFLAGS="-L/data/sysroot/lib -lcap -lselinux -lminijail -lssl"
5754
5855
meson setup build \
5956
-Dprefix=/data/share \
@@ -68,12 +65,15 @@ jobs:
6865
-Dmemfd-rexec=false \
6966
--buildtype release \
7067
-Dcapabilities=true \
71-
-Dseccomp=true \
68+
-Dseccomp=false \
69+
-Dseccomp-minijail=true \
7270
-Dselinux=true \
73-
-Dapparmor=true \
71+
-Dapparmor=false \
7472
-Dopenssl=true \
7573
-Ddbus=false \
7674
-Dandroid-log=true \
75+
-Dandroid-audio=false \
76+
-Dandroid-network=false \
7777
-Dlandlock-monitor=false \
7878
-Dinstall-state-dirs=true \
7979
--cross-file aarch64-android-api30.txt
@@ -82,16 +82,10 @@ jobs:
8282
sudo /usr/local/bin/ninja -C build install
8383
echo "RELEASE_TAG=$(meson introspect meson.build --projectinfo | jq -r '.version')-$(git log -1 --format=%h)" >> $GITHUB_ENV
8484
85-
- name: Upload artifacts sysroot
86-
uses: actions/upload-artifact@v4.3.1
87-
with:
88-
name: android-${{ github.event.inputs.target_arch || 'aarch64' }}-deps
89-
path: /data/sysroot/*
90-
9185
- name: Upload artifacts lxc
9286
uses: actions/upload-artifact@v4.3.1
9387
with:
94-
name: android-${{ github.event.inputs.target_arch || 'aarch64' }}-lxc
88+
name: android-aarch64-lxc
9589
path: /data/share/*
9690

9791
- name: Upload artifacts lxc-module
@@ -102,8 +96,7 @@ jobs:
10296

10397
- name: Create a TAR file for artifact
10498
run: |
105-
tar -czvf android-${{ github.event.inputs.target_arch || 'aarch64' }}-api30-lxc.tar.gz -C /data/share .
106-
tar -czvf android-${{ github.event.inputs.target_arch || 'aarch64' }}-api30-sysroot.tar.gz -C /data/sysroot .
99+
tar -czvf android-aarch64-api30-lxc.tar.gz -C /data/share .
107100
108101
- name: Create Release and Upload Release Asset
109102
uses: softprops/action-gh-release@v1
@@ -114,6 +107,5 @@ jobs:
114107
draft: false
115108
prerelease: false
116109
files: |
117-
android-${{ github.event.inputs.target_arch || 'aarch64' }}-api30-lxc.tar.gz
118-
android-${{ github.event.inputs.target_arch || 'aarch64' }}-api30-sysroot.tar.gz
110+
android-aarch64-api30-lxc.tar.gz
119111
lxc-module.zip

0 commit comments

Comments
 (0)