Commit graph

10 commits

Author SHA1 Message Date
TreeHugger Robot
cf3dd6faed Merge "configstore: sandbox with seccomp filter" 2017-08-07 21:07:57 +00:00
Justin Yun
723c2dbd43 Update make file for vndk enabled. am: 608d773ef8
am: d66371512c

Change-Id: I35b778c39c2349346278deb6dea56b8cd3701f7d
2017-08-05 02:17:38 +00:00
Justin Yun
608d773ef8 Update make file for vndk enabled.
Update the Android.bp generated with hidl-gen.

Test: build with and without BOARD_VNDK_VERSION=current
Bug: 63866913
Change-Id: I1a9db1df49e0f13c5790da2b118ae9ec63ba34a7
2017-08-04 14:12:23 +09:00
Steven Moreland
6ae7aad171 Update makefiles (frameworks.jar).
Test: links at runtime and buildtime
Bug: 35771640
Change-Id: Ic7a71653d659115205e5bdbb782f73b774af0b29
2017-08-03 23:02:46 +00:00
Tri Vo
f5d136c231 Update Android.bp HIDL makefiles
Allow HAL definition libs to be static.

Bug: 32920003
Bug: 64040096
Test: update-all-google-makefiles.sh
Change-Id: I1483d572bea6799717d1614fb7d52fe225e31104
2017-08-03 00:30:01 +00:00
Jiyong Park
e786494ff3 Remove TODO comment for configstore threadpool size
No problem with current configuration has been reported.

Bug: 34857894
Test: not required
Change-Id: Ie23b234eccb2707323032e37b27b387eb96918e5
2017-07-14 10:53:26 +09:00
Jeff Vander Stoep
ed95043d64 configstore: sandbox with seccomp filter
Configstore HAL is accessible to third party apps and thus requires
a tight sandbox that reflects the limited system access this HAL
needs.

We use two primary mechanisms to sandbox configstore, selinux and
seccomp, with the goal of restricting its access to userspace and
the kernel. The addition of a seccomp filter is primarily aimed
at reducing the kernel's attack surface that is reachable by
configstore HAL.

Seccomp filters are architecture dependent, so filters need to be
added for each architecture. This change adds a seccomp filter for
arm64 and issues a non-fatal runtime warning for other architectures
which still require a seccomp filter.

Bug: 36453956
Test: boot Marlin and Angler. Verify that configstore is not aborting
    due to seccomp violations.
Test: "cat proc/<configstore pid>/status | grep seccomp " returns:
    seccomp: 2
    Which indicates that configstore is using seccomp-bpf.

Change-Id: Iab014ff357b7329085a5e18a92f51838d2c72371
2017-07-12 12:58:01 -07:00
Jae Shin
6e3ec61aab Add structural test VtsHalConfigstoreV1_1Target
Add vts test module for configstore@1.1

Test: make vts -j40 && run commandAndExit vts -m
VtsHalConfigstoreV1_1Target
Bug: 63071317

Change-Id: I405f4409bc2ac4acdf07728b950ba9b653eb3328
2017-07-03 13:47:11 +09:00
Steven Moreland
f04fdeb83e Update internal makefiles.
These makefiles are not in dev topic branches
or AOSP currently so they were not updated. This
update adds hidl-generated-module defaults.

Test: pass
Change-Id: Ie52c54877d795bf5358aa600e6d1a13a4f166d25
2017-06-05 17:47:36 -07:00
Jaesoo Lee
812e85e126 configstore: configstore HAL is up-revisioned to 1.1
This change provides a reference implementation of the configstore HAL
v1.1.

Bug: 37727469
Test: Built sailfish-userdebug and configstore-1.1 works
Change-Id: I75e7fd1da8e90ae48d779a3ba28957c5a93a5529
2017-05-17 15:30:17 +09:00