tequilaOS/platform_external_selinux
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_external_selinux/libselinux/exported.map.txt

57 lines
2.2 KiB
Text
Raw Normal View History

Make libselinux symbols versioned Since R, stub variants of libselinux are created. They are used when libselinux is requested from APEXes. Depending on the min_sdk_version requirement of the APEX, we need to use different versions of libselinux stubs. For example, an APEX that started with Android R should be linked with R stub of libselinux, even it's built in Android S source tree which might have a few more APIs. Otherwise, the APEX built in S won't be able to work on R devices. The stub generator (build/soong/cc/gen_stub_libs.py) uses symbol version for identifying which version of Android the symbol was first introduced. So, in this change, the existing symbols are all assigned with a symbol version LIBSELINUX_R. For the symbols that will be added for S should be assigned with a different symbol version, e.g. LIBSELINUX_S { # introduced=S new_symbol; new_symbol2; }; Bug: 151053366 Bug: 150999716 Test: m Change-Id: I2d5966fbc9d255cc6a12aede88ee5f89987b5089
2020-03-12 06:25:48 +01:00
LIBSELINUX_R {
libselinux: be strict about what symbols we export Make sure shared libraries we create export only the minimum number of symbols, and not a bit more. We want to be careful what SELinux APIs we (directly or indirectly) expose to other processes. Test: Android compiles. Link time restrictions only. Change-Id: Ia6d1788cd944b46f1e97f621f4466fb8ada29191
2017-01-18 02:50:23 +01:00
global:
Annotate symbols correctly Currently, tagging a symbol with #apex (# systemapi or # llndk) is not required when the symbol is in a non-NDK library. However, this is considered dangerous because such a symbol will automatically be promoted to NDK APIs when the library is promoted to an NDK library. When that happens, the native API council won't be able to notice the promotion because promoting a non-NDK library into an NDK library doesn't require an update of the map.txt file, but Android.bp only. To prevent that, we should mandate those tags for Mainline APIs regardless of whether the library the API belongs to is an NDK library or not. Upcoming changes in build/soong will enforce this. This change is to prepare for the enforcement. Note that this is a build-time only change. There's no behavior change at runtime. Bug: 184712170 Test: m Change-Id: I168fbdcf0a2a9b4e987a5410db941c0b4e4d9c35
2022-09-26 15:15:00 +02:00
fgetfilecon; # llndk systemapi
fgetfilecon_raw; # llndk systemapi
freecon; # llndk systemapi
fsetfilecon; # llndk systemapi
getcon; # llndk systemapi
getfilecon; # llndk systemapi
getpeercon; # llndk systemapi
getpidcon; # llndk systemapi
is_selinux_enabled; # llndk systemapi
lgetfilecon; # llndk systemapi
lsetfilecon; # llndk systemapi
security_compute_create; # llndk systemapi
security_get_initial_context; # llndk systemapi
security_getenforce; # llndk systemapi
security_load_policy; # llndk systemapi
security_policyvers; # llndk systemapi
security_setenforce; # llndk systemapi
selabel_close; # llndk systemapi
selabel_lookup; # llndk systemapi
selabel_lookup_best_match; # llndk systemapi
selabel_open; # llndk systemapi
selinux_android_file_context_handle; # llndk systemapi
selinux_android_hw_service_context_handle; # llndk systemapi
selinux_android_load_policy; # llndk systemapi
selinux_android_load_policy_from_fd; # llndk systemapi
selinux_android_restorecon; # llndk systemapi
selinux_android_restorecon_pkgdir; # llndk systemapi
selinux_android_seapp_context_init; # llndk systemapi
selinux_android_service_context_handle; # llndk systemapi
selinux_android_set_sehandle; # llndk systemapi
selinux_android_setcon; # llndk systemapi
selinux_android_setcontext; # llndk systemapi
selinux_android_vendor_service_context_handle; # llndk systemapi
selinux_check_access; # llndk systemapi
selinux_log_callback; # llndk systemapi
selinux_set_callback; # llndk systemapi
selinux_status_open; # llndk systemapi
selinux_status_updated; # llndk systemapi
selinux_vendor_log_callback; # llndk systemapi
set_selinuxmnt; # llndk systemapi
setcon; # llndk systemapi
setexeccon; # llndk systemapi
setfilecon; # llndk systemapi
setfscreatecon; # llndk systemapi
setsockcreatecon; # llndk systemapi
setsockcreatecon_raw; # llndk systemapi
string_to_security_class; # llndk systemapi
libselinux: be strict about what symbols we export Make sure shared libraries we create export only the minimum number of symbols, and not a bit more. We want to be careful what SELinux APIs we (directly or indirectly) expose to other processes. Test: Android compiles. Link time restrictions only. Change-Id: Ia6d1788cd944b46f1e97f621f4466fb8ada29191
2017-01-18 02:50:23 +01:00
local: *;
};
Expose ability to set level from uid. Extract the existing level computation into a helper function. Add selinux_android_context_with_level() to take a context string and return a new one with appropriate level based on user and/or app id. Test: builds Bug: 141677108 Change-Id: I4618d4c74d1a2b94de9e934a8caf2e24049f0477
2020-02-10 13:18:49 +01:00
LIBSELINUX_S { # introduced=S
Annotate symbols correctly Currently, tagging a symbol with #apex (# systemapi or # llndk) is not required when the symbol is in a non-NDK library. However, this is considered dangerous because such a symbol will automatically be promoted to NDK APIs when the library is promoted to an NDK library. When that happens, the native API council won't be able to notice the promotion because promoting a non-NDK library into an NDK library doesn't require an update of the map.txt file, but Android.bp only. To prevent that, we should mandate those tags for Mainline APIs regardless of whether the library the API belongs to is an NDK library or not. Upcoming changes in build/soong will enforce this. This change is to prepare for the enforcement. Note that this is a build-time only change. There's no behavior change at runtime. Bug: 184712170 Test: m Change-Id: I168fbdcf0a2a9b4e987a5410db941c0b4e4d9c35
2022-09-26 15:15:00 +02:00
selinux_android_context_with_level; # llndk systemapi
selinux_android_keystore2_key_context_handle; # llndk systemapi
Expose ability to set level from uid. Extract the existing level computation into a helper function. Add selinux_android_context_with_level() to take a context string and return a new one with appropriate level based on user and/or app id. Test: builds Bug: 141677108 Change-Id: I4618d4c74d1a2b94de9e934a8caf2e24049f0477
2020-02-10 13:18:49 +01:00
};
Reference in a new issue Copy permalink