In an effort to ensure that our development community does not
introduce new code without corresponding SELinux changes, Android
closely monitors the number of SELinux denials which occur during
boot. This monitoring occurs both in treehugger, as well as various
dashboards. If SELinux denials are dropped during early boot, this
could result in non-determinism for the various SELinux treehugger
tests.
Introduce /system/bin/auditctl. This tool, model after
https://linux.die.net/man/8/auditctl , allows for configuring the
throttling rate for the kernel auditing system.
Remove any throttling from early boot. This will hopefully reduce
treehugger flakiness by making denial generation more predictible
during early boot.
Reapply the throttling at boot complete, to avoid denial of service
attacks against the auditing subsystem.
Delete pre-existing unittests for logd / SELinux integration. It's
intended that all throttling decisions be made in the kernel, and
shouldn't be a concern of logd.
Bug: 118815957
Test: Perform an operation which generates lots of SELinux denials,
and count how many occur before and after the time period.
Change-Id: I6c787dbdd4a28208dc854b543e1727ae92e5eeed
This CL installs mini-keyctl for fsverity
Bug: 112038861
Test: build, flash and check mini-keyctl is properly installed.
Change-Id: Ib3adc1b7c92cae28caf72544987c7f3f23eafbbc
Also add simpleperf_app_runner in shell utilities.
Bug: 118835348
Test: build and boot.
Test: run simpleperf_app_runner manually.
Change-Id: I538503dabfa8ff192f4b3029206a62613eacdf32
tcpdump accidentally fell off the device when its Android.mk was converted
to Android.bp.
Bug: http://b/111654811
Test: builds
Change-Id: Ia49a6722b47c9017b6e573cb88f7a93f3d95db5d
This reverts commit 90a018a87a.
Not a clean revert because things have changed slightly, and I'm sticking
with the egrep/fgrep shell scripts for now.
Bug: http://b/111849261
Bug: https://bugs.exim.org/show_bug.cgi?id=2294
Test: manual
Change-Id: I72ae637c84f0eb1c2b5291db73ebff1628d54110
This allows a product to selectively include binaries for the
partitions relevant to it. For example, mainline will only include
the system copies.
Bug: 80410283
Test: make
Change-Id: I1d1d62a3c8afff19cd45388adc323587f5043243
adbd has been built as a static executable since the same binary was
copied to the recovery partition where shared library is not supported.
However, since we now support shared library in the recovery partition,
adbd is built as a dynamic executable.
In addition, the dependency from adbd to libdebuggerd_handler is removed
as debuggerd is handled by the dynamic linker.
A few more modules in /system/core are marked as recovery_available:
true as they are transitive dependencies of the dynamic linker.
This change also includes ld.config.recovery.txt which is the linker
config file for the recovery mode. It is installed to /etc/ld.config.txt
and contains linker namespace config for the dynamic binaries under
/sbin.
Bug: 63673171
Test: `adb reboot recovery; adb devices` shows the device ID
Test: Select 'mount /system' in the recovery mode, then `adb shell`.
$ lsof -p `pidof adbd` shows that libm.so, libc.so, etc. are loaded from
the /lib directory.
Change-Id: I363d5a787863f1677ee40afb5d5841321ddaae77
We have moved away from BSD dd and grep, which is also shown in the
section for Android Q.
Test: N/A
Change-Id: I13484879e697a1cf2c8b82d7e28a167cb34c00fa
Add a non-toybox version of getprop, so that we can interface with the
new C++ PropertyInfoAreaFile class to return property context
information.
Bug: 36001741
Test: Compared toolbox getprop results with toybox getprop
Change-Id: I4e90aa5b843cb5cfcbe85f05f23ae8e22729b26e
Add a non-toybox version of getprop, so that we can interface with the
new C++ PropertyInfoAreaFile class to return property context
information.
Bug: 36001741
Test: Compared toolbox getprop results with toybox getprop
Change-Id: I5f98f9e895d0620a2d9686bc0608490e7d9c3120
The gzip module was removed and replaced with an implementation in
toybox. Remove the required modules reference.
Bug: 63400769
Change-Id: I032d7ddc59105b3c6fb87084983266655772756a
Test: m -j checkbuild
Bug: 38240024
Test: Verified that grep is installed in /vendor/bin. See details in
testing done comment in https://android-review.googlesource.com/412061 .
Change-Id: I06007014779310bc24c65f7343111c5217ba6ff0
This is definitely a FAQ, and it doesn't make sense for me to maintain
this on Google+ when I have the power to just check it in (and now have
a sensible place to do so).
Bug: N/A
Test: N/A
Change-Id: I649803ac846917a45f4b7b89cffe5b450179c479
