This helps to ensure that when a new system image is installed,
old userdata policy isn't applied over the top of it.
Bug: 8841348
Change-Id: I135af32250aa62979763e775842ce0af3c8b6f9f
This forces a policy reload + fixcon to deal with dynamically
delivered policy changing labels on device nodes.
It's implemented as a new keyword in init.
Bug: 8702843
Change-Id: I803cf1ecf6ff8318ce25dcc5cda4f292adc9738c
Failing to set properties due to an exhausted pool leads
to difficult to debug problems. This change adds an
error log to make the situation a bit easier to handle.
Change-Id: Icc1d97a80882fb23e74428a0195f1d28dba68fa8
Move the responsibility for rebooting the system from the
reboot command to init. Init is in a better position to take
actions to bring the system down cleanly, including making sure
filesystems are mounted read-only.
The only UIDs which can perform an init triggered reboot are
root, system, and shell.
Modify the reboot command so that it calls into init to perform
the reboot. The reboot command no longer requires CAP_SYS_BOOT.
Remove the -n reboot option and code which supports it. Anyone needing
to do an unclean shutdown can just do a 'echo c > /proc/sysrq-trigger'.
Modify adb so that it calls into init to perform a shutdown.
Bug: 8646621
Change-Id: I84c0513acb549720cb0e8c9fcbda0050f5c396f5
Currently, the output of e2fsck is not saved, and we have no insight
into how many errors e2fsck is finding and fixing. Using the new
abbreviated logging feature in liblogwrap, up to the first 100 lines,
and last 4K bytes of the output of e2fsck is captured by fs_mgr, and
added to the kernel log.
Usually, the filesystem will be clean, and this will only add a few
lines to the kernel log on boot, but when things go wrong, it should
save enough to indicate what the problem is, without potentially
filling the kernel log with only e2fsck output if the filesystem is
really corrupted.
Change-Id: I9c264798e6fe721c8f818b5ce15d0975027ddbdd
This change enables labeling of dynamically created sysfs nodes
with specific SELinux security contexts.
Change-Id: If8b8d66120453123c1371ce063b6f20e8b96b6ef
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
With the old strdup() mechanism, it may return NULL if insufficient memory was
available. So we check the return value or do not use strdup to avoid null
pointer issue.
Change-Id: Id684948d6cb6c2f06327f29a2ba692f9542fce80
Signed-off-by: Hong-Mei Li <a21834@motorola.com>
Adding a new location for policy files under
/data, the new location is /data/security. The
new location is used before attempting to use
any other location.
This requires a new directory to be created by
the init script and an update to the location of
the property_contexts file for property service.
Change-Id: I955a722ac3e51fa6c1b97201b8bdef3f601cf09d
Adding a new location for policy files under
/data, the new location is /data/security. The
new location is used before attempting to use
any other location.
This requires a new directory to be created by
the init script and an update to the location of
the property_contexts file for property service.
Change-Id: I955a722ac3e51fa6c1b97201b8bdef3f601cf09d
When using device tree, platform devices may not have a
/devices/platform/ path prefix, but can be rooted in
/devices/.
Modify the platform device tracking code to store the device
path as well as the name. This way, when we create symlinks, we
can correctly skip the base platform device prefix and get to the
proper device node path.
Change-Id: I939ef8fbcb45c5c803cd9a054e40136a912efc72
Signed-off-by: Dima Zavin <dima@android.com>
This logic has been moved to platform/frameworks/base commit
8a0a929422682ba3eb6a205dc6c0638e68b909de and is no longer needed
here.
This reverts commit 01b1dee0ab.
When using device tree, platform devices may not have a
/devices/platform/ path prefix, but can be rooted in
/devices/.
Modify the platform device tracking code to store the device
path as well as the name. This way, when we create symlinks, we
can correctly skip the base platform device prefix and get to the
proper device node path.
Change-Id: I939ef8fbcb45c5c803cd9a054e40136a912efc72
Signed-off-by: Dima Zavin <dima@android.com>
Property triggers may cause an action to be queued twice, resulting
in a loop in the action queue. Keep actions that are not on the queue
in the list_empty state (act->qlist->next == act->qlist), and only
add them to the list if they are in that state.
Bug: 8335133
Change-Id: I3a3ec18176cf19cbaa3a45220a03c7560eacfe79
This reverts commit 87980b5c9f
Getting more reports of app crashes (e.g. 7990090), so given timeline for MR2, want to revert.
Change-Id: Ic2d101d2d1156b3864d5c9b88aa8c94cd5aa345f
# By Stephen Smalley
# Via Android Git Automerger (1) and others
* commit '7480c0079d8c7fcfd5b3d9decfdabfebde162781':
Label sockets consistently with the seclabel value if specified.
Currently, system properties are passed via the environment
variable ANDROID_PROPERTY_WORKSPACE and a file descriptor passed
from parent to child. This is insecure for setuid executables,
as the environment variable can be changed by the caller.
Make the /dev/__properties__ file accessible, so an app can
get properties directly from the file, rather than relying on
environment variables.
Preserve the environment variable for compatibility with pre-existing
apps.
Bug: 8045561
Change-Id: If81e2b705eca43ddd8b491871aceff59c0e00387
Currently, system properties are passed via the environment
variable ANDROID_PROPERTY_WORKSPACE and a file descriptor passed
from parent to child. This is insecure for setuid executables,
as the environment variable can be changed by the caller.
Modify system property handling so that we get the properties
from a root owned properties file, rather than using an
environment variable.
Related to bug: 8029617
Change-Id: I18610128e11c4037ed6f4dec6eba20f69fa647eb
As it turns out, no, 64K is not enough. A device provisioning
tool was generating many uevents as it manipulated the GPT,
causing events near the end of the process (including events
as a result of the final BLKRRPART ioctl()) to get lost.
It's not clear what the best value for this should be, but
increasing to 256K fixed the problem in this case.
Change-Id: I4883b34e96c89e8a6fa581bc9cd121bb021b5694
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
Change setsebool syntax from name=value to name value.
This is to make it consistent with setprop and similar commands.
Update both the init built-in command and the toolbox command
for consistency.
Change-Id: I2c8e016ba26731c4a2ad4a49ae3b89362bf8f8a8
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
This is necessary to ensure that the adbd socket is created in the
adbd domain rather than the init domain.
Change-Id: Id4997d7f074aeefea62b41c87b46a6609e03f527
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
In "init: harden property service" patch, dirfd() is invoked
without checking whether opendir() return successfully. It may
fail if load_persistent_properties() is invoked before userdata
partition is mounted; then dirfd(NULL) will make init crash.
This may happen if "is_charger" is true.
Change-Id: I216fb743a3c9fa050f92fcb31b62e766346d84bb
Signed-off-by: Yi-wei Zhao <gbjc64@motorola.com>
Some Android programs have problems with memory which grows
from the top down. Temporarily set ADDR_COMPAT_LAYOUT to
avoid breaking those programs.
Bug: 7188322
Change-Id: I61760500e670b4563838c63b82d4a0b6e354a86e
* commit 'e3bdaeb603ab7ac941b35b41856c6b8ebf47c6bb':
Use sigemptyset to initialise signal mask as it is more portable. Referencing sa_restorer fails on MIPS
On first boot, the directory is created with root:root ownership and
then chowned. chown clears the ISUID and ISGID bits, so we need to chmod
the directory again after chown.
Change-Id: I02dfe7a19a637678256b4e7cc09e6b5431e6f11e
This is a set of changes to the init property service
implementation to apply a SELinux check over who can
change what properties. Also included control hooks
for the 'ctl' keys.
Change-Id: I5a18809bf5536f6459a36b6bf0d622b9f5061aa0
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
To support runtime policy management, add support for reloading
policy from /data/system. This can be triggered by setting the
selinux.loadpolicy property to 1, whether from init.rc after
mounting /data or from the system_server (e.g. upon invocation of
a new device admin API for provisioning policy). ueventd and
installd are restarted upon policy reloads to pick up the new
policy configurations relevant to their operation.
Change-Id: I97479aecef8cec23b32f60e09cc778cc5520b691
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
When devices are provisioned, bd address path is set in ro.bt.bdaddr_path.
On devices where this property is not present, a random bd address is
generated and saved to the property: persist.service.bdroid.bdaddr
This change allows bluetooth process to update this property
bug 6885309
Change-Id: I2e8a2471a0e890da82e6bbec6a2ef67ec8e1f8f4
Now get_android_id function returns -EINVAL if the uid/gid is not in the list
of android ids. This will allow ueventd to catch invalid ids and report the
error.
Change-Id: I943b04dd64d518891623e1ee2d561b8061af4863
Signed-off-by: Veeren Mandalia <v.mandalia@sta.samsung.com>
Automatically set the SELinux security label on directories created
by init.rc. This avoids the need to separately call restorecon on
each such directory from the init.rc file. Also restorecon /dev
and /dev/socket after initial policy load so that they are labeled
correctly before any other dev nodes or sockets are created.
Change-Id: If6af6c4887cdead949737cebdd673957e9273ead
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Change uevents may be triggered after new files are created on a device
in /sys, run the sys permissions fixup when they occur.
Change-Id: Iec2725c9f8a032e5124190444edaf189a766b0b2
The wait command was currently implemented but
undocumented and only used internally. This change
adds a second option toi (optionally) override the default
timeout of 5 seconds.
The wait command can be used to wait for a file to appear
during the boot process, for example a disk or other device,
and is a better alternative than an unconditional sleep.
Change-Id: Ia11d8419c0ea84deec0e1bf5adfca5bc76ff38b7
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
This device is required by libdrm for GPUs like IvyBridge.
Change-Id: I0ac47056a9cec2100f3e6eaa5591571fe6bbc145
Signed-off-by: Lukasz Anaczkowski <lukasz.anaczkowski@intel.com>
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
