tequilaOS/platform_system_core
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
No description
67320 commits 1 branch 0 tags 215 MiB
C++ 89.4%
C 7.3%
Shell 1.4%
Python 0.6%
Rust 0.5%
Other 0.7%
Find a file
David Anderson 491e4da372 init: Add an selinux transition for snapuserd. 
With compressed VAB updates, it is not possible to mount /system without
first running snapuserd, which is the userspace component to the dm-user
kernel module. This poses a problem because as soon as selinux
enforcement is enabled, snapuserd (running in a kernel context) does not
have access to read and decompress the underlying system partition.

To account for this, we split SelinuxInitialize into multiple steps:

First, sepolicy is read into an in-memory string.

Second, the device-mapper tables for all snapshots are rebuilt. This
flushes any pending reads and creates new dm-user devices. The original
kernel-privileged snapuserd is then killed.

Third, sepolicy is loaded from the in-memory string.

Fourth, we re-launch snapuserd and connect it to the newly created
dm-user devices. As part of this step we restorecon device-mapper
devices and /dev/block/by-name/super, since the new snapuserd is in a
limited context.

Finally, we set enforcing mode.

This sequence ensures that snapuserd has appropriate privileges with a
minimal number of permissive audits.

Bug: 173476209
Test: full OTA with VABC applies and boots
Change-Id: Ie4e0f5166b01c31a6f337afc26fc58b96217604e
2021-01-08 16:39:51 -08:00
bootstat Merge Android R (rvc-dev-plus-aosp-without-vendor@6692709) 2020-08-29 01:42:13 -07:00
cli-test cli-test: support checking exit status. 2020-09-25 16:43:35 -07:00
code_coverage extend syscall minijail for clang code coverage 2020-07-13 13:39:05 -07:00
cpio Remove EXCLUDE_FS_CONFIG_STRUCTURES 2020-03-04 15:34:09 -08:00
debuggerd Update for v5.10 kernel headers. 2020-12-14 22:36:37 -08:00
deprecated-adf remove deprecated bp 'subdirs' 2020-01-14 12:18:40 -08:00
diagnose_usb Make the udev vs plugdev distinction a bit clearer. 2020-07-31 15:09:35 -07:00
fastboot fastboot: f2fs: handle return code correctly 2020-12-29 19:56:36 +00:00
fs_mgr init: Add an selinux transition for snapuserd. 2021-01-08 16:39:51 -08:00
gatekeeperd Add @SensitiveData to GateKeeperService 2020-11-04 13:51:04 -08:00
healthd Merge "health: Add CAP_BLOCK_SUSPEND" 2020-10-15 20:24:17 +00:00
include Remove include/backtrace symlink. 2020-10-20 12:46:14 -07:00
init init: Add an selinux transition for snapuserd. 2021-01-08 16:39:51 -08:00
janitors Add the two best build system janitors. 2019-03-25 10:25:13 -07:00
libappfuse Update for v5.10 kernel headers. 2020-12-14 22:36:37 -08:00
libasyncio Revert "Revert "Set apex_available property"" 2020-03-26 00:23:56 +00:00
libbinderwrapper Make libbinderwrapper available in /vendor partition 2018-04-06 08:41:21 +09:00
libcrypto_utils libcrypto_utils: switch to C++. 2020-08-21 10:34:56 -07:00
libcutils Merge "libcutils: make it clearer that libcutils is just janitors." 2020-12-10 20:51:21 +00:00
libdiskconfig Rename target.linux[_x86[_64]] to target.linux_glibc[_x86[_64]] 2017-10-02 10:44:29 -07:00
libgrallocusage gralloc: Set min_sdk_version 2020-04-23 23:50:08 +09:00
libkeyutils Update language to comply with Android's inclusive language guidance 2020-07-31 16:36:06 -06:00
libmodprobe Add new owners to various sub-projects. 2020-12-11 12:45:45 -08:00
libnetutils Add apex_available to libnetutils 2020-11-05 18:40:31 +09:00
libpackagelistparser Make libraries {vendor_,}ramdisk_available. 2020-10-28 10:57:51 -07:00
libprocessgroup Merge "Revert "libprocessgroup: move freezer to uid/pid hierarchy"" 2021-01-05 23:33:12 +00:00
libqtaguid Redirect qtaguid native call to netd fwmark client 2017-11-09 18:02:22 -08:00
libsparse Add assemble_cvd to com.android.virt 2021-01-05 14:46:01 +09:00
libstats Migrate to packages/modules/StatsD/lib/* 2020-12-10 19:11:56 +00:00
libsuspend Remove libsuspend from VNDK. 2018-08-14 13:39:55 -07:00
libsync Make the connection between implementation and llndk_library explicit 2020-10-19 13:38:05 -07:00
libsystem Add product_available to product available modules 2020-12-04 09:59:20 +09:00
libsysutils SocketClient: don't ignore SIGPIPE 2020-07-31 15:53:18 -07:00
libusbhost Prevent infinite loop on zero length USB descriptors 2020-02-21 11:11:02 -08:00
libutils Add product_available to product available modules 2020-12-04 09:59:20 +09:00
libvndksupport Make the connection between implementation and llndk_library explicit 2020-10-19 13:38:05 -07:00
llkd llkd: Use more inclusive language 2020-06-19 06:51:59 -07:00
property_service Add new owners to various sub-projects. 2020-12-11 12:45:45 -08:00
qemu_pipe Add Android Studio Emulator team mebers to OWNERS 2020-12-08 16:08:59 -08:00
reboot adb: replace reboot service with exec of /system/bin/reboot. 2019-10-23 14:33:36 -07:00
rootdir Merge "Add boot animation progress system property." 2021-01-07 09:23:35 +00:00
run-as Use libcutils_headers for android_filesystem_config.h 2020-09-18 22:48:42 +00:00
sdcard Move layout_version to /data/misc/installd 2019-08-21 10:12:18 -07:00
set-verity-state set-verity-state: Link to libfs_mgr_binder. 2019-12-30 13:42:57 -08:00
shell_and_utilities Add shell_and_utilities_vendor_ramdisk 2020-10-28 10:57:51 -07:00
storaged storaged: ignore SIGPIPE 2020-03-17 09:31:01 -07:00
toolbox iorap: Remove toggling iorapd on/off when using 'start' command. 2020-11-16 18:45:47 +00:00
trusty Merge "Revert^2 "Revise KeymasterMessage versioning system"" 2021-01-06 22:58:32 +00:00
usbd Remove libhwbinder/libhidltransport deps 2019-09-05 14:17:42 -07:00
watchdogd Move watchdogd out of init 2018-08-02 12:25:58 -07:00
.clang-format Add a 2 width option of clang format. 2017-03-10 13:01:39 -08:00
.clang-format-2 Move clang-formats to build. 2019-01-18 14:26:33 -08:00
.clang-format-4 Move clang-formats to build. 2019-01-18 14:26:33 -08:00
.gitignore Ignore adb/*.pyc files 2015-08-11 12:59:58 -07:00
CleanSpec.mk snapshotctl don't auto-merge. 2020-03-03 13:19:49 -08:00
METADATA Add METADATA to system/core: Apache2+BSD=NOTICE 2020-04-29 13:16:41 -07:00
MODULE_LICENSE_APACHE2 auto import from //depot/cupcake/@135843 2013-07-30 13:56:49 -07:00
NOTICE Fix omission in NOTICE file. 2013-07-30 13:56:55 -07:00
OWNERS Remove baligh@ from owners. CodeShuffle done. 2020-10-17 00:28:10 +00:00
PREUPLOAD.cfg Add AOSP preupload hook. 2020-04-23 11:02:00 -07:00
TEST_MAPPING Move CtsLiblogTestCases and CtsLogdTestCases to system/logging/TEST_MAPPING 2020-11-02 12:44:37 -08:00