tequilaOS/platform_external_selinux
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
5484 commits 1 branch 0 tags 17 MiB
Commit graph

5484 commits

This branch
This branch
All branches
Author SHA1 Message Date
Android Build Coastguard Worker
c24af7f6a6 Snap for 11784291 from 9753881e4c to 24Q3-release 
Change-Id: I821bdf67470d72efa360c8e5168c930ab07a4ab8
 2024-04-30 23:18:35 +00:00
Xin Li
9753881e4c [automerger skipped] Empty merge of Android 24Q2 Release (ab/11526283) to aosp-main-future am: 83d75ece5d -s ours 
am skip reason: Merged-In Ie0bb4b46ea66b59e09a8d3702079ddcb13b8b027 with SHA-1 b0bbd007d9 is already in history

Original change: https://googleplex-android-review.googlesource.com/c/platform/external/selinux/+/27144070

Change-Id: I6b061430ff67ad17fba4258431cf6d6897277526
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2024-04-29 22:16:25 +00:00
Xin Li
83d75ece5d Empty merge of Android 24Q2 Release (ab/11526283) to aosp-main-future 
Bug: 337098550
Merged-In: Ie0bb4b46ea66b59e09a8d3702079ddcb13b8b027
Change-Id: I28157ec3be1da5f7a000850915363568f996fcd9
 2024-04-29 11:51:00 -07:00
Android Build Coastguard Worker
3b6b530fd0 Snap for 11772614 from 1e9017a411 to 24Q3-release 
Change-Id: I7c6dcab88f24936076a8ef9409657621ed91f6da
 2024-04-27 01:17:17 +00:00
Ellen Arteca
1e9017a411 Add /data/storage_area to app data directories am: 261afd394b am: b0bbd007d9 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2957472

Change-Id: I32c8694969a9b0e8c9440fda713b383a12118d0e
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2024-04-26 03:58:09 +00:00
Ellen Arteca
b0bbd007d9 Add /data/storage_area to app data directories am: 261afd394b 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2957472

Change-Id: Ie0bb4b46ea66b59e09a8d3702079ddcb13b8b027
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2024-04-26 03:43:51 +00:00
Ellen Arteca
261afd394b Add /data/storage_area to app data directories 
libselinux has special handling for the app data directories such as
/data/user/$userId/$pkgName and /data/user_de/$userId/$pkgName, because
their SELinux contexts are determined differently from "normal" files.

/data/storage_area/$userId/$pkgName will be a new app data directory
(with a different SELinux context, but determined through the same process).
THerefore, add it to the list of app data directories.

Bug: 325129836

Change-Id: I4371c23193e6ad07207bc1f22cfd6d1580ccd600
 2024-04-18 17:47:11 +00:00
Android Build Coastguard Worker
7509d7792d Snap for 11722130 from 5159c81252 to 24Q3-release 
Change-Id: I807ad3b9246450fa38645510a318aa7c69d6aefc
 2024-04-16 23:16:38 +00:00
Steven Moreland
5159c81252 checkpolicy: disable leak detection am: c8d5fc8b44 am: adce3dbbb6 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/3042635

Change-Id: I5fc62e0ded1efeac59d8e9feb1036df8c8c9fd57
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2024-04-16 01:04:32 +00:00
Steven Moreland
adce3dbbb6 checkpolicy: disable leak detection am: c8d5fc8b44 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/3042635

Change-Id: Ic922a1591efa5376b48e1249cb80bf0ca5269701
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2024-04-16 00:44:32 +00:00
Steven Moreland
c8d5fc8b44 checkpolicy: disable leak detection 
Breaking ASAN host builds.

Bugs: me
Test: build with SANITIZE_HOST=address
Change-Id: Idb72d16d8fbe4d082b94994854e488f57ef4bb26
 2024-04-15 23:02:00 +00:00
Android Build Coastguard Worker
424ab95075 Snap for 11533280 from 7b38f24445 to 24Q3-release 
Change-Id: I1f989b9597c60a757380b22e157a09cd34017d08
 2024-03-06 00:16:03 +00:00
Thiébaud Weksteen
7b38f24445 Merge "Add build flags for libselinux" into main am: c23cbe8ca5 am: c20d8480e5 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2971894

Change-Id: I4eb1f132ab8eaaeaf0f1d809cbf20d0e62714050
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2024-03-05 00:43:19 +00:00
Thiébaud Weksteen
c20d8480e5 Merge "Add build flags for libselinux" into main am: c23cbe8ca5 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2971894

Change-Id: Iab88e01241410a5803177f30093e5b444692af6a
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2024-03-05 00:00:47 +00:00
Thiébaud Weksteen
c23cbe8ca5 Merge "Add build flags for libselinux" into main 2024-03-04 23:28:31 +00:00
Android Build Coastguard Worker
712a126dd0 Snap for 11517216 from 90b4df940c to 24Q3-release 
Change-Id: I08a8c2db229f7bb7ce6184302e0bf6c0fe7d3a8e
 2024-03-01 00:16:52 +00:00
Thiébaud Weksteen
90b4df940c Merge "Add selabel_get_digests_all_partial_matches binary" into main am: 2273a74d00 am: b39171460b 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2981571

Change-Id: I39221e1cee469f8b5ff4373e3145193c66549e12
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2024-02-29 02:48:13 +00:00
Thiébaud Weksteen
b39171460b Merge "Add selabel_get_digests_all_partial_matches binary" into main am: 2273a74d00 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2981571

Change-Id: Icc0c501c6a3841b4bede6bdf2821c3627d6cb67e
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2024-02-29 02:06:03 +00:00
Thiébaud Weksteen
2273a74d00 Merge "Add selabel_get_digests_all_partial_matches binary" into main 2024-02-29 01:16:38 +00:00
Thiébaud Weksteen
f3007e9fd4 Add selabel_get_digests_all_partial_matches binary 
Add build rule for selabel_get_digests_all_partial_matches. It is not
included by default in the system image, but can be useful to debug
the computation of security.sehash.

Bug: 317296680
Test: adb remount; adb push selabel_get_digests_all_partial_matches
  /system/bin; selabel_get_digests_all_partial_matches -r /data/data
Change-Id: I2b7e8d994f15539849d69ded5695293c4f2cf8b2
 2024-02-28 13:26:57 +11:00
Android Build Coastguard Worker
dc547f9368 Snap for 11504269 from 9f17ca222e to 24Q3-release 
Change-Id: I3936cb1a45631c56f76c41fcc58a937dcae1d68a
 2024-02-28 00:17:02 +00:00
Ellen Arteca
9f17ca222e The order the fields were printed in did not match the order in which their values are listed; likely a typo am: cd26ca2162 am: b97284595c 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2976012

Change-Id: Id0e5050becc4c085afcfe419b2d86995fa003bee
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2024-02-27 12:27:49 +00:00
Ellen Arteca
b97284595c The order the fields were printed in did not match the order in which their values are listed; likely a typo am: cd26ca2162 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2976012

Change-Id: I515a85b6ae5eb66afe302ac15db733790d348df5
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2024-02-27 11:46:40 +00:00
Ellen Arteca
cd26ca2162 The order the fields were printed in did not match the order in which their values are listed; likely a typo 
Change-Id: I2e00216ef7e3cedd274fb16aa361637d9a98ba2c
 2024-02-26 09:14:18 +00:00
Thiébaud Weksteen
8f719500fd Add build flags for libselinux 
Consider /data/data as an app data directory (and skip any restorcon) if
the flag release_selinux_data_data_ignore is enabled.

Test: boot;
      setfattr -x security.sehash /data;
      setfattr -x security.sehash /data/data;
      reboot, restorecon ignores /data/data
Bug: 317296680
Change-Id: If341864555398cd042dbe5b89085821cc2f8a0c0
 2024-02-23 15:46:51 +11:00
Daniel Chapin
a7b5fa81da Revert "Use generic isSelector" am: 27d4f93b76 am: fd16119838 am: 05a74fd219 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2858485

Change-Id: Ib50610278ec483c87d4d2c52f60ee340744c821b
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-12-05 06:55:43 +00:00
Daniel Chapin
6e81ec7ec2 Revert "Use generic isSelector" am: 27d4f93b76 am: a772618e5c am: a9be036f81 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2858485

Change-Id: Ic52cbb7c1e50bd97ca3e928f619e876d575e962e
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-12-05 06:55:18 +00:00
Daniel Chapin
05a74fd219 Revert "Use generic isSelector" am: 27d4f93b76 am: fd16119838 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2858485

Change-Id: I52e564e9ce90b0118f0e1ed576ca784385151b32
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-12-05 06:06:46 +00:00
Daniel Chapin
a9be036f81 Revert "Use generic isSelector" am: 27d4f93b76 am: a772618e5c 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2858485

Change-Id: I335a819d7c851b62c3b0a123fbfe34c176469127
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-12-05 06:04:37 +00:00
Daniel Chapin
a772618e5c Revert "Use generic isSelector" am: 27d4f93b76 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2858485

Change-Id: Id3421f08cf85f2744b757cdd4e89726f98f1b9a5
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-12-05 05:28:47 +00:00
Daniel Chapin
fd16119838 Revert "Use generic isSelector" am: 27d4f93b76 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2858485

Change-Id: I71ff5b24278be5ee64a1d46ba39550c2826720e0
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-12-05 05:16:50 +00:00
Daniel Chapin
27d4f93b76 Revert "Use generic isSelector" 
This reverts commit 3d85f1e116.

Reason for revert: Droidfood blocking bug: b/314704483

Change-Id: I4cec1f1c4de25c28536c4f56cfd297ab1a9f3812
 2023-12-05 00:52:17 +00:00
Thiébaud Weksteen
5f0adaf824 Use generic isSelector am: 3d85f1e116 am: d26a4af638 am: 57857be7cb 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2839485

Change-Id: I907beaae8a76e6d3209fa6eb1d21298b5170e3f5
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-12-01 04:23:37 +00:00
Thiébaud Weksteen
2e514132bf Use generic isSelector am: 3d85f1e116 am: bce1d3689b am: 28f879de16 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2839485

Change-Id: I067484d72885ba209b0944a326474b2008cec004
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-12-01 04:23:22 +00:00
Thiébaud Weksteen
57857be7cb Use generic isSelector am: 3d85f1e116 am: d26a4af638 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2839485

Change-Id: I96867dca9a2731cf062a795fcfdf034beb9e9cab
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-12-01 04:05:52 +00:00
Thiébaud Weksteen
28f879de16 Use generic isSelector am: 3d85f1e116 am: bce1d3689b 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2839485

Change-Id: I408f1d9edea15863dde0e50ca5f2000ebf8fad5c
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-12-01 03:51:40 +00:00
Thiébaud Weksteen
d26a4af638 Use generic isSelector am: 3d85f1e116 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2839485

Change-Id: Iebf082e0c29320766b69c5ea6b9fb151c8676a25
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-12-01 03:34:32 +00:00
Thiébaud Weksteen
bce1d3689b Use generic isSelector am: 3d85f1e116 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2839485

Change-Id: I0aad333ba1526c0a61ea2d55c528b1e7373897e7
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-12-01 03:19:18 +00:00
Thiébaud Weksteen
3d85f1e116 Use generic isSelector 
seapp_contexts supports multiple boolean attributes: isPrivApp,
isEphemeralApp, isIsolatedComputeApp, isSdkSandboxAudit,
isSdkSandboxNext, fromRunAs. Each of these exists to support a specific
labelling scenario from the framework. When a new predicate is required,
an update to libselinux is also required. This change generically
handles any attribute starting with "is" and maps it directly
(case-insensitive) to the same seinfo field.

It is assumed that only one of these is required at a time. An error is
raised if seapp_contexts contains multiple is-selector within one rule.
An error is raised if seinfo contains multiple is-selector.

The order for comparison between seapp_contexts is altered: an entry
with an is-selector will be prioritized over one with an unspecifed
is-selector. This is not quite the previous order (e.g., isPrivApp <
targetSdkVersion < fromRunAs), but it is understood that the previous
order was not intentional and emerged from the incremental contributions
to this library.

The boolean info.isPreinstalledApp is replaced by checking the first
byte of info.partition.

Test: atest --host libselinux_test
Bug: 307635909
Change-Id: Ice3b84870e3255f6d9357d9750acbe9691b45aad
 2023-12-01 10:42:50 +11:00
Thiébaud Weksteen
148c2f327d Refactor the parsing of seinfo am: 7fd89c00f7 am: c4b477c1de am: f87183c61b 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2836178

Change-Id: I40a776d1e79ab6927464cb1bd5a5b612cd5c2292
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-11-21 23:35:07 +00:00
Thiébaud Weksteen
4268b21150 Refactor the parsing of seinfo am: 7fd89c00f7 am: 4bf49f0fb0 am: 6af667a24b 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2836178

Change-Id: I5742cf04e29ef3e54b81cdc2134170fbf3960f74
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-11-21 23:33:39 +00:00
Thiébaud Weksteen
f87183c61b Refactor the parsing of seinfo am: 7fd89c00f7 am: c4b477c1de 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2836178

Change-Id: Ia03b4d9c99c43b1644c949f5ca6cfb11147f383d
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-11-21 23:32:50 +00:00
Thiébaud Weksteen
6af667a24b Refactor the parsing of seinfo am: 7fd89c00f7 am: 4bf49f0fb0 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2836178

Change-Id: I5b172e06cd5efe1c18a0eb9bf7f69593aeb76d29
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-11-21 23:00:27 +00:00
Thiébaud Weksteen
c4b477c1de Refactor the parsing of seinfo am: 7fd89c00f7 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2836178

Change-Id: I11bfae9f5cb86c03642d30afb7b8f1ea46c9efb0
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-11-21 22:47:45 +00:00
Thiébaud Weksteen
4bf49f0fb0 Refactor the parsing of seinfo am: 7fd89c00f7 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2836178

Change-Id: Ifa4dbb6ccaa95af13c388fb60736517b77b34475
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-11-21 22:28:21 +00:00
Thiébaud Weksteen
7fd89c00f7 Refactor the parsing of seinfo 
The seinfo string contains many attributes provided by the caller to
match an seapp_contexts rule. Its usage has evolved organically and now
contains multiple fields for various purposes.

Refactor the parsing of seinfo, relying on strtok as the string
informally follows the convention of using colons between attributes and
an equal sign to separate an attribute and its value. For instance,

  default:privapp:targetSdkVersion=10000:partition=system:complete

A new internal structure is introduced to capture the attributes. The
new parse_seinfo function replaces seinfo_parse (which only parsed the
first attribute, historically the original seinfo), get_partition and
get_app_targetSdkVersion.

The new function is expected to behave similarly to the previous code.
Unknown attributes are now logged, but still ignored. The "complete"
attribute is now interpreted (as the last attribute), but not required.

Unit tests are added to cover standard and edge cases.

Test: boot and verify denial logs
Test: atest --host libselinux_test
Bug: 307635909
Change-Id: Ia0e3522c42c80e6e631ff1af644e03f53d88da93
 2023-11-21 13:59:42 +11:00
Sandro Montanari
9db97963d2 Introduce sdk_sandbox_audit SELinux domain am: 90c0d6546d am: 1163af38b5 am: bc58ce3f60 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2797594

Change-Id: I015b80f186fa32a50feff8ab92241718d17ad8e9
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-10-26 14:08:54 +00:00
Sandro Montanari
490887b089 Introduce sdk_sandbox_audit SELinux domain am: 90c0d6546d am: 1fb35a146a am: 7c4998952f 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2797594

Change-Id: I7a127b33fa31edb7413f52f96ac3d84dba8e8d6f
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-10-26 14:07:57 +00:00
Sandro Montanari
bc58ce3f60 Introduce sdk_sandbox_audit SELinux domain am: 90c0d6546d am: 1163af38b5 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2797594

Change-Id: Ife97c50400054605e3e9fe62574a05ee65bc3e31
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-10-26 13:37:52 +00:00
Sandro Montanari
7c4998952f Introduce sdk_sandbox_audit SELinux domain am: 90c0d6546d am: 1fb35a146a 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2797594

Change-Id: I21ce6a808a1db942978cf7195c59c1611766e50c
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-10-26 13:36:05 +00:00