tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/private/compat/28.0/28.0.ignore.cil

156 lines
3.6 KiB
Text
Raw Normal View History

Add mapping files for 28.0.[ignore.]cil Steps taken to produce the mapping files: 1. Add prebuilts/api/28.0/[plat_pub_versioned.cil|vendor_sepolicy.cil] from the /vendor/etc/selinux/[plat_pub_versioned.cil|vendor_sepolicy.cil] files built on pi-dev with lunch target aosp_arm64-eng 2. Add new file private/compat/28.0/28.0.cil by doing the following: - copy /system/etc/selinux/mapping/28.0.cil from pi-dev aosp_arm64-eng device to private/compat/28.0/28.0.cil - remove all attribute declaration statement (typeattribute ...) and sort lines alphabetically - some selinux types were added/renamed/deleted w.r.t 28 sepolicy. Find all such types using treble_sepolicy_tests_28.0 test. - for all these types figure out where to map them by looking at 27.0.[ignore.]cil files and add approprite entries to 28.0.[ignore.]cil. This change also enables treble_sepolicy_tests_28.0 and install 28.0.cil mapping onto the device. Bug: 72458734 Test: m selinux_policy Change-Id: I90e17c0b43af436da4b62c16179c198b5c74002c
2018-07-11 11:30:44 +02:00
;; new_objects - a collection of types that have been introduced that have no
;; analogue in older policy. Thus, we do not need to map these types to
;; previous ones. Add here to pass checkapi tests.
Only maintain maps between current and previous selinux versions. New maintenance scheme for mapping files: Say, V is the current SELinux platform version, then at any point in time we only maintain (V->V-1) mapping. (V->V-n) map is constructed from top (V->V-n+1) and bottom (V-n+1->V-n) without changes to previously maintained mapping files. Caveats: - 26.0.cil doesn't technically represent 27.0->26.0 map, but rather current->26.0. We'll fully migrate to the scheme with future releases. Bug: 67510052 Test: adding new public type only requires changing the latest compat map Change-Id: Iab5564e887ef2c8004cb493505dd56c6220c61f8
2018-09-30 02:47:10 +02:00
(type new_objects)
Add mapping files for 28.0.[ignore.]cil Steps taken to produce the mapping files: 1. Add prebuilts/api/28.0/[plat_pub_versioned.cil|vendor_sepolicy.cil] from the /vendor/etc/selinux/[plat_pub_versioned.cil|vendor_sepolicy.cil] files built on pi-dev with lunch target aosp_arm64-eng 2. Add new file private/compat/28.0/28.0.cil by doing the following: - copy /system/etc/selinux/mapping/28.0.cil from pi-dev aosp_arm64-eng device to private/compat/28.0/28.0.cil - remove all attribute declaration statement (typeattribute ...) and sort lines alphabetically - some selinux types were added/renamed/deleted w.r.t 28 sepolicy. Find all such types using treble_sepolicy_tests_28.0 test. - for all these types figure out where to map them by looking at 27.0.[ignore.]cil files and add approprite entries to 28.0.[ignore.]cil. This change also enables treble_sepolicy_tests_28.0 and install 28.0.cil mapping onto the device. Bug: 72458734 Test: m selinux_policy Change-Id: I90e17c0b43af436da4b62c16179c198b5c74002c
2018-07-11 11:30:44 +02:00
(typeattribute new_objects)
(typeattributeset new_objects
Only maintain maps between current and previous selinux versions. New maintenance scheme for mapping files: Say, V is the current SELinux platform version, then at any point in time we only maintain (V->V-1) mapping. (V->V-n) map is constructed from top (V->V-n+1) and bottom (V-n+1->V-n) without changes to previously maintained mapping files. Caveats: - 26.0.cil doesn't technically represent 27.0->26.0 map, but rather current->26.0. We'll fully migrate to the scheme with future releases. Bug: 67510052 Test: adding new public type only requires changing the latest compat map Change-Id: Iab5564e887ef2c8004cb493505dd56c6220c61f8
2018-09-30 02:47:10 +02:00
( new_objects
activity_task_service
Add mapping files for 28.0.[ignore.]cil Steps taken to produce the mapping files: 1. Add prebuilts/api/28.0/[plat_pub_versioned.cil|vendor_sepolicy.cil] from the /vendor/etc/selinux/[plat_pub_versioned.cil|vendor_sepolicy.cil] files built on pi-dev with lunch target aosp_arm64-eng 2. Add new file private/compat/28.0/28.0.cil by doing the following: - copy /system/etc/selinux/mapping/28.0.cil from pi-dev aosp_arm64-eng device to private/compat/28.0/28.0.cil - remove all attribute declaration statement (typeattribute ...) and sort lines alphabetically - some selinux types were added/renamed/deleted w.r.t 28 sepolicy. Find all such types using treble_sepolicy_tests_28.0 test. - for all these types figure out where to map them by looking at 27.0.[ignore.]cil files and add approprite entries to 28.0.[ignore.]cil. This change also enables treble_sepolicy_tests_28.0 and install 28.0.cil mapping onto the device. Bug: 72458734 Test: m selinux_policy Change-Id: I90e17c0b43af436da4b62c16179c198b5c74002c
2018-07-11 11:30:44 +02:00
adb_service
Add policy for apexd. apexd is a new daemon for managing APEX packages installed on the device. It hosts a single binder service, "apexservice". Bug: 112455435 Test: builds, binder service can be registered, apexes can be accessed, verified and mounted Change-Id: I634ad100f10b2edcd9a9c0df0d33896fa5d4ed97
2018-08-17 09:35:42 +02:00
apex_data_file
Add policy for /metadata/apex. This is an area that apexd can use to store session metadata, which won't be rolled back with filesystem checkpointing. Bug: 126740531 Test: builds Change-Id: I5abbc500dc1b92aa46830829be76e7a4381eef91
2019-03-12 16:37:13 +01:00
apex_metadata_file
Add policy for apexd. apexd is a new daemon for managing APEX packages installed on the device. It hosts a single binder service, "apexservice". Bug: 112455435 Test: builds, binder service can be registered, apexes can be accessed, verified and mounted Change-Id: I634ad100f10b2edcd9a9c0df0d33896fa5d4ed97
2018-08-17 09:35:42 +02:00
apex_mnt_dir
apex_service
apexd
apexd_exec
apexd exports its status via sysprop A sysprop apexd.status is set by apexd, to that other components (i.e. init) can determine whether APEXs are all successfully mounted or no (i.e., being mounted). The sysprop is only writable by apexd. Bug: 117403679 Test: adb shell getprop apexd.status returns 'ready'. Change-Id: I81bcb96e6c5cb9d899f29ffa84f91eab3820be25
2018-11-01 12:05:20 +01:00
apexd_prop
Add policy for apexd. apexd is a new daemon for managing APEX packages installed on the device. It hosts a single binder service, "apexservice". Bug: 112455435 Test: builds, binder service can be registered, apexes can be accessed, verified and mounted Change-Id: I634ad100f10b2edcd9a9c0df0d33896fa5d4ed97
2018-08-17 09:35:42 +02:00
apexd_tmpfs
Initial selinux policy support for memfd Move all app tmpfs types to appdomain_tmpfs. These are still protected by mls categories and DAC. TODO clean up other app tmpfs types in a separate change. Treble-ize tmpfs passing between graphics composer HAL and surfaceflinger. Bug: 122854450 Test: boot Blueline with memfd enabled. Change-Id: Ib98aaba062f10972af6ae80fb85b7a0f60a32eee
2019-01-29 23:43:45 +01:00
appdomain_tmpfs
app_binding_service
app_prediction_service
Initial sepolicy for app_zygote. The application zygote is a new sort of zygote process that is a child of the regular zygote. Each application zygote is tied to the application for which it's launched. Once it's started, it will pre-load some of the code for that specific application, much like the regular zygote does for framework code. Once the application zygote is up and running, it can spawn isolated service processes that run in the isolated_app domain. These services can then benefit from already having the relevant application code and data pre-loaded. The policy is largely the same as the webview_zygote domain, however there are a few crucial points where the policy is different. 1) The app_zygote runs under the UID of the application that spawned it. 2) During app_zygote launch, it will call a callback that is controlled by the application, that allows the application to pre-load code and data that it thinks is relevant. Especially point 2 is imporant: it means that untrusted code can run in the app_zygote context. This context is severely limited, and the main concern is around the setgid/setuid capabilities. Those conerns are mitigated by installing a seccomp filter that only allows setgid/setuid to be called in a safe range. Bug: 111434506 Test: app_zygote can start and fork children without denials. Change-Id: I1cc49ee0042d41e5ac6eb81d8f8a10ba448d4832
2018-11-05 11:39:15 +01:00
app_zygote
Properly Treble-ize tmpfs access This is being done in preparation for the migration from ashmem to memfd. In order for tmpfs objects to be usable across the Treble boundary, they need to be declared in public policy whereas, they're currently all declared in private policy as part of the tmpfs_domain() macro. Remove the type declaration from the macro, and remove tmpfs_domain() from the init_daemon_domain() macro to avoid having to declare the *_tmpfs types for all init launched domains. tmpfs is mostly used by apps and the media frameworks. Bug: 122854450 Test: Boot Taimen and blueline. Watch videos, make phone calls, browse internet, send text, install angry birds...play angry birds, keep playing angry birds... Change-Id: I20a47d2bb22e61b16187015c7bc7ca10accf6358
2019-01-24 00:07:40 +01:00
app_zygote_tmpfs
sepolicy for ashmemd all_untrusted_apps apart from untrusted_app_{25, 27} and mediaprovider are now expected to go to ashmemd for /dev/ashmem fds. Give coredomain access to ashmemd, because ashmemd is the default way for coredomain to get a /dev/ashmem fd. Bug: 113362644 Test: device boots, ashmemd running Test: Chrome app works Test: "lsof /system/lib64/libashmemd_client.so" shows libashmemd_client.so being loaded into apps. Change-Id: I279448c3104c5d08a1fefe31730488924ce1b37a
2019-01-27 22:39:19 +01:00
ashmemd
ashmem_device_service
Add selinux setting for attention Bug: 126472144 Test: adb shell dumpsys attention Change-Id: Ie421b719c8fc0414ee664055aa5d007c081edf17
2019-03-12 02:40:44 +01:00
attention_service
Rename biometric_prompt_service to biometric_service Bug: 111461540 Bug: 112570477 Test: builds Change-Id: Icc68720ebe931c2d917703b2d34aa0f4eec3f549 Merged-In: Icc68720ebe931c2d917703b2d34aa0f4eec3f549
2018-09-21 05:32:32 +02:00
biometric_service
Add rules for accessing the related bluetooth_audio_hal_prop This change allows those daemons of the audio and Bluetooth which include HALs to access the bluetooth_audio_hal_prop. This property is used to force disable the new BluetoothAudio HAL. - persist.bluetooth.bluetooth_audio_hal.disabled Bug: 128825244 Test: audio HAL can access the property Change-Id: I87a8ba57cfbcd7d3e4548aa96bc915d0cc6b2b74
2019-03-18 04:07:32 +01:00
bluetooth_audio_hal_prop
Add permissions for bpf.progs_loaded property Change-Id: If4e550e4186415c5a1088bb53b0755b69f92560a Signed-off-by: Joel Fernandes <joelaf@google.com>
2019-01-11 14:32:45 +01:00
bpf_progs_loaded_prop
Add sepolicy for BugreportManagerService BUG:111441001 Test: boots Change-Id: I71a54e8335c5ce7f9d97af3dbbd62e663bb66d33
2019-01-11 18:26:10 +01:00
bugreport_service
sepolicy changes to configure cgroup.rc and task_profiles.json access cgroups.json file contains cgroup information required to mount cgroup controllers and is readable only by init process. cgroup.rc contains cgroup map information consisting of the list of cgroups available in the system and their mounting locations. It is created by init process and should be readable by any processes that uses cgroups and should be writable only by init process. task_profiles.json file contains task profiles used to operate on cgroups. This information should be readable by any process that uses cgroups and should be writable only by init process. Bug: 111307099 Test: builds, boots Change-Id: Ib2c87c0fc3663c7fc69628f05c846519b65948b5 Signed-off-by: Suren Baghdasaryan <surenb@google.com>
2019-01-11 02:10:31 +01:00
cgroup_desc_file
cgroup_rc_file
Move /sbin/charger to /system/bin/charger. With the CLs in the same topic, it's being built as a dynamically linked executable. And this applies to normal boot (including charger mode) and recovery mode both. /system/bin/charger under normal boot will be labeled as charger_exec, which has the attribute of system_file_type. The file in recovery image will still be labeled as rootfs. So we keep the domain_trans rule for rootfs file, but allowing for recovery mode only. Bug: 73660730 Test: Boot into charger mode on taimen. Check that charger UI works. Test: Boot into recovery mode. Check that charger process works. Change-Id: I062d81c346578cdfce1cc2dce18c829387a1fdbc
2018-09-08 00:05:33 +02:00
charger_exec
Renamed "intelligence" to "content_capture" Bug: 111276913 Test: manual verification Change-Id: If76dc7bfdad87789a58fc94e0fd280deae1a41ab
2018-12-04 02:35:05 +01:00
content_capture_service
Adding policy for content suggestions. Cherry-picked from aosp/852612 (commit Ic0b3f85fad24ccedc0a8e9935c198bc8503bb415), and is a manual merge for ag/5836696 (commit I360ce12f33e333766f6f30614c87811d05e663a4) Bug: 120865921 Test: Manual verification Change-Id: Ic0b3f85fad24ccedc0a8e9935c198bc8503bb415
2018-12-18 00:39:58 +01:00
content_suggestions_service
Add new cpu variant related rules to SELinux I added ro.bionic.(2nd_)?_(arch|cpu_variant) to vendor system properties. And have init to write them to files under dev/. This change set SELinux rules for these properties and files. For the system properties: vendor/default.prop will set them. init will read them. For the files /dev/cpu_variant:.*: init will write them. bionic libc will read them. (Basically world readable). This is to allow libc select the right optimized routine at runtime. Like memcpy / strcmp etc. Test: getprop to make sure the properties are set. Test: ls -laZ to make sure /dev/cpu_variant:.* are correctly labeled. Change-Id: I41662493dce30eae6d41bf0985709045c44247d3
2018-11-06 00:03:16 +01:00
cpu_variant_prop
Allow apexd to stop itself apexd stops itself when it finds that it is running on a device with flattened APEXes (i.e. ro.apex.updatable = false). Bug: 133907211 Test: launch sdk_phone_x86_64 adb logcat -d | grep apexd | wc -l returns 3 Change-Id: I7fa161b069aa34adb028194b55f367fe740a0cfc
2019-06-13 02:45:05 +02:00
ctl_apexd_prop
Allow system_server and shell to start gsid on-demand. gsid is started lazily to reduce memory pressure. It can be started either via gsi_tool (invoked by adb shell), or by DynamicAndroidService via system_server. Bug: 126622385 Test: no denials running "gsi_tool status" Change-Id: I90a5f3f28fe4f294fb60e7c87a62e76716fbd5c0
2019-02-28 03:31:11 +01:00
ctl_gsid_prop
Add new cpu variant related rules to SELinux I added ro.bionic.(2nd_)?_(arch|cpu_variant) to vendor system properties. And have init to write them to files under dev/. This change set SELinux rules for these properties and files. For the system properties: vendor/default.prop will set them. init will read them. For the files /dev/cpu_variant:.*: init will write them. bionic libc will read them. (Basically world readable). This is to allow libc select the right optimized routine at runtime. Like memcpy / strcmp etc. Test: getprop to make sure the properties are set. Test: ls -laZ to make sure /dev/cpu_variant:.* are correctly labeled. Change-Id: I41662493dce30eae6d41bf0985709045c44247d3
2018-11-06 00:03:16 +01:00
dev_cpu_variant
Update sepolicy with new native boot flag for activity_manager Whitelist the persistent system properties that will be used as flags in activity manager experiments. Bug: 120794810 Test: m, flash, test getting flag value in ActivityManagerService.java Change-Id: I90a10bc87d6db3a64347b62fd02e6f0b12ac9fa8
2019-01-17 22:30:05 +01:00
device_config_activity_manager_native_boot_prop
sepolicy for server configurable flags Test: manual on device Change-Id: Ibafe1b345489c88a49a7ed3e2e61e5cc5e1880a1
2018-10-26 05:09:55 +02:00
device_config_boot_count_prop
Permissions for input_native_boot flags For input experiments that are enabled at boot time, allow system_server to read and write the device config flags. Bug: 120794829 Test: presubmit Change-Id: I0f075a7579c593d4e07c3e31be529e34554068a6
2019-01-14 23:18:38 +01:00
device_config_input_native_boot_prop
SEPolicy updates for adding native flag namespace(netd). For experiment flag testing, we add a flag netd and have SEPolicy updates. Test: add sepolicy, m -j, check GetServerConfigurableFlag function in netd Bug:122050512 Change-Id: I21c844c277afc358085d80447f16e4c0d4eba5b3
2018-12-27 11:01:25 +01:00
device_config_netd_native_prop
SEPolicy updates for DeviceConfig Service. Add a DeviceConfig service in system_server to edit configuration flags. This is intended to be a command line tool for local overrides and/or tool for tests that adopt shell permissions. Test: None Bug:109919982 Bug:113101834 Change-Id: Ib7bed752849b1ed102747e3202dd7aed48d2c6d5
2018-12-07 17:27:29 +01:00
device_config_reset_performed_prop
Add device_config_runtime_native_boot_prop Some runtime properties require reboots and should be in the native_boot namespace instead of native. Bug: 120794191 Bug: 123524494 Test: set a property and ensure it can be read in AndroidRuntime.cpp Change-Id: I1d1e984dcba26dd04d34a7d30fc63e1b75a8a311
2019-02-01 22:43:11 +01:00
device_config_runtime_native_boot_prop
Rename runtime -> runtime_native property namespace The convention for native properties is to use _native suffix. Bug: 123524494 Bug: 120794191 Test: set a property and ensure it can be read in AndroidRuntime.cpp Change-Id: I69feab9be78f24d812b8f953d3ec06a5d8d18f15
2019-01-29 18:57:11 +01:00
device_config_runtime_native_prop
SEPolicy updates for adding native flag namespace(media). Test: add sepolicy, build, check GetServerConfigurableFlag function Bug: 123658514 Change-Id: I798b0ef901068c53070e768305acd38118a7e886
2019-01-31 00:28:31 +01:00
device_config_media_native_prop
SEPolicy updates for DeviceConfig Service. Add a DeviceConfig service in system_server to edit configuration flags. This is intended to be a command line tool for local overrides and/or tool for tests that adopt shell permissions. Test: None Bug:109919982 Bug:113101834 Change-Id: Ib7bed752849b1ed102747e3202dd7aed48d2c6d5
2018-12-07 17:27:29 +01:00
device_config_service
Re-add sys_traced prop Add permissions for: persist.device_config.global_settings.sys_traced Bug: b/71737179 Test: As follows: patch aosp/891475 patch aosp/891853 patch ag/6224352 $ adb shell walleye:/ $ ps -A | grep traced nobody 1135 1 52288 2200 0 0 S traced nobody 1136 1 52288 2256 0 0 S traced_probes walleye:/ $ settings put global sys_traced 0 walleye:/ $ ps -A | grep traced 1|walleye:/ $ walleye:/ $ settings put global sys_traced 1 1|walleye:/ $ ps -A | grep traced nobody 12386 1 52288 2208 0 0 S traced nobody 12387 1 52288 2248 0 0 S traced_probes Change-Id: I8898672c8fdc9c5d87a31b90f6c7d5c03bef78ed
2019-04-05 17:41:30 +02:00
device_config_sys_traced_prop
Add sepolicy for resolver service Bug: 126141549 Test: built, flashed, booted Change-Id: I34260e1e5cc238fbe92574f928252680c1e6b417
2019-02-25 13:12:15 +01:00
dnsresolver_service
Rename dynamic_android to dynamic_system Per API review, dynamic_android should be renamed to dynamic_system. Bug: 126613281 Test: run DynamicSystemInstallationService via adb Change-Id: Ia908cdd0c21b3a82f59b30e03a985dc260530230
2019-03-14 05:35:32 +01:00
dynamic_system_service
Sepolicy: add dynamic_system_prop and allow shell and system_app (Settings) to set it to enable Dynamic System Update. Also allow priv_app (user of the API) to read it. Bug: 119647479 Bug: 129060539 Test: run the following command on crosshatch-user: adb shell setprop persist.sys.fflag.override.settings_dynamic_system 1 Change-Id: I24a5382649c64d36fd05a59bc87faca87e6f0eb8 Merged-In: I24a5382649c64d36fd05a59bc87faca87e6f0eb8
2019-04-26 10:14:52 +02:00
dynamic_system_prop
Add placeholder sepolicy for iris and face See aosp/660242 and aosp/608396 Fixes: 116530289 Test: builds Change-Id: I220ece0d6751839fe764ff91fd7bd20c50104f8f
2018-09-01 03:14:16 +02:00
face_service
Add placeholder iris and face policy for vold data directory This is PS1 of aosp/828283 which was reverted. Using PS1 shouldn't cause the same issue. Test: vold is able to create directories, ag/5534962 Bug: 116528212 Change-Id: I84aca49a8dae0a087498120780dea0962aca04b3
2018-11-16 00:28:07 +01:00
face_vendor_data_file
Add sepolicy for fastbootd Also allow adb and fastboot to talk to recovery through recovery_socket. This enables changing between modes with usb commands. Test: No selinux denials Bug: 78793464 Change-Id: I80c54d4eaf3b94a1fe26d2280af4e57cb1593790
2018-05-29 19:54:16 +02:00
fastbootd
sepolicy for server configurable flags Test: manual on device Change-Id: Ibafe1b345489c88a49a7ed3e2e61e5cc5e1880a1
2018-10-26 05:09:55 +02:00
flags_health_check
flags_health_check_exec
Sepolicy for bufferhub hwservice Bug: 118124442 Test: device can boot with android.frameworks.bufferhub@1.0-service running Change-Id: I1d186d5350671b0d2dd4e831429b8fba828316e0
2018-10-21 03:33:41 +02:00
fwk_bufferhub_hwservice
Add selinux rules for HIDL ICameraServer. Bug: 110364143 Test: lshal->android.frameworks.cameraservice.service@2.0::ICameraService/default is registered. Change-Id: I689ca5a570c169581b2bfb9d117fcdafced0a7e0 Signed-off-by: Jayant Chowdhary <jchowdhary@google.com>
2018-08-17 01:21:13 +02:00
fwk_camera_hwservice
Update sepolicies for stats hal Bug: 116732452 Test: No sepolicy violations observed with this change (cherry picked from commit I1958182dd8ecc496625da2a2a834f71f5d43e7bb) Change-Id: Ib386767d8acfacf9fedafd9a79dd555ce233f41c
2018-09-28 22:34:37 +02:00
fwk_stats_hwservice
Game Driver: sepolicy update for plumbing GpuStats into GpuService Allow all the app process with GUI to send GPU health metrics stats to GpuService during the GraphicsEnvironment setup stage for the process. Bug: 123529932 Test: Build, flash and boot. No selinux denials. Change-Id: Ic7687dac3c8a3ea43fa744a6ae8a45716951c4df
2019-02-08 00:00:55 +01:00
gpuservice
Full sepolicy for gsid. Bug: 122556707 Test: manual test Change-Id: I2536deefb3aa75deee4aeae7df074349b705b0f0
2019-01-23 04:05:29 +01:00
gsi_data_file
gsi_metadata_file
sepolicy for gsid Bug: 122556707 Test: gsid starts Change-Id: Ib05ddb79051436f51cd236de04027a3b12ee87a9 Signed-off-by: Sandeep Patil <sspatil@google.com>
2019-01-14 23:38:17 +01:00
gsi_service
gsid
gsid_exec
Add sepolicy for gsid properties, and allow system_server to read them. Bug: 123777418 Test: manual test Change-Id: I9f8c721dfd074e638573d85cf1d8045a69c3854e
2019-02-07 22:14:20 +01:00
gsid_prop
Add color_service selinux policy Bug: 111215474 Test: boots Change-Id: I98955bcd02f643400c3eb97232467c09a2c5c1e5
2018-08-18 03:47:47 +02:00
color_display_service
Add new external vibrator service to system_server Bug: 111457573 Test: N/A Change-Id: I457fd9d13cc481f2687ab39d22240c6ea7231183
2019-01-22 21:55:08 +01:00
external_vibrator_service
Add atrace HAL 1.0 sepolicy Bug: 111098596 Test: atrace/systrace (cherry picked from commit 9ed5cf6e430a864630c2451bf35f18ac7668c12b) Change-Id: I97772ff21754d03a0aea0d53b39e8da5312a17c0
2018-09-20 01:06:28 +02:00
hal_atrace_hwservice
Added placeholder SELinux policy for the biometric face HAL. Notes: - Added face hal domain, context and file types for the default SELinux policy. - Please see aosp/q/topic:"Face+Authentication" Bug: 80155388 Test: Built successfully. Change-Id: I2e02cf6df009c5ca476dfd842b493c6b76b7712a
2018-05-24 09:59:40 +02:00
hal_face_hwservice
Initial selinux policy support for memfd Move all app tmpfs types to appdomain_tmpfs. These are still protected by mls categories and DAC. TODO clean up other app tmpfs types in a separate change. Treble-ize tmpfs passing between graphics composer HAL and surfaceflinger. Bug: 122854450 Test: boot Blueline with memfd enabled. Change-Id: Ib98aaba062f10972af6ae80fb85b7a0f60a32eee
2019-01-29 23:43:45 +01:00
hal_graphics_composer_server_tmpfs
health.filesystem HAL renamed to health.storage ...to reflect that the HAL operates on storage devices, not filesystem. Bug: 111655771 Test: compiles Change-Id: Ibb0572cb1878359e5944aa6711331f0c7993ba6e Merged-In: Ibb0572cb1878359e5944aa6711331f0c7993ba6e
2018-09-19 19:24:45 +02:00
hal_health_storage_hwservice
Permissions for InputClassifier HAL Add the required permissions for the InputClassifier HAL. Bug: 62940136 Test: no selinux denials in logcat when HAL is used inside input flinger. Change-Id: Ibc9b115a83719421d56ecb4bca2fd196ec71fd76
2018-01-17 21:27:06 +01:00
hal_input_classifier_hwservice
Add power.stats HAL 1.0 sepolicy BUG: 117424656 BUG: 111185513 Test: run vts -m VtsHalPowerStatsV1_0Target Change-Id: Icb0790219df4189c0dabbe41221e69e56d000755
2018-10-19 22:19:36 +02:00
hal_power_stats_hwservice
Add heapprofd selinux config. This does not actually grant any permissions but just adds the necessary boilerplate for a new service. Bug: 117762471 Bug: 117761873 Change-Id: I7cdd2ae368616cfd54fc685c15f775604bfc80d4
2018-10-15 19:02:02 +02:00
heapprofd
Add persist.heapprofd.enable property. This is analoguous to what Perfetto does with persist.traced.enable. Test: m Test: flash walleye Test: setprop persist.heapprofd.enable 1 setprop persist.heapprofd.enable 0 Change-Id: I997272ef8c6fe078aca2388ed0cf2ecc3de612a5
2018-12-10 17:20:20 +01:00
heapprofd_enabled_prop
Add heapprofd selinux config. This does not actually grant any permissions but just adds the necessary boilerplate for a new service. Bug: 117762471 Bug: 117761873 Change-Id: I7cdd2ae368616cfd54fc685c15f775604bfc80d4
2018-10-15 19:02:02 +02:00
heapprofd_exec
Property to enable heap profile from process startup. This is world-readable so it can be checked in libc's process init. Test: m Test: flash sailfish Bug: 117821125 Change-Id: Iac7317ceb75b5ad9cfb9adabdf16929263fa8a9d
2018-11-08 14:58:13 +01:00
heapprofd_prop
Add heapprofd selinux config. This does not actually grant any permissions but just adds the necessary boilerplate for a new service. Bug: 117762471 Bug: 117761873 Change-Id: I7cdd2ae368616cfd54fc685c15f775604bfc80d4
2018-10-15 19:02:02 +02:00
heapprofd_socket
Add idmap2 and idmap2d Bug: 78815803 Test: builds, boots Test: manual: adb shell idmap2 create ... Test: manual: adb shell ps | grep -e idmap2d Change-Id: I60852e15d99329896ff9de6559d1e7cd1c67e33d
2018-06-15 08:08:19 +02:00
idmap_service
Add placeholder sepolicy for iris and face See aosp/660242 and aosp/608396 Fixes: 116530289 Test: builds Change-Id: I220ece0d6751839fe764ff91fd7bd20c50104f8f
2018-09-01 03:14:16 +02:00
iris_service
Add placeholder iris and face policy for vold data directory This is PS1 of aosp/828283 which was reverted. Using PS1 shouldn't cause the same issue. Test: vold is able to create directories, ag/5534962 Bug: 116528212 Change-Id: I84aca49a8dae0a087498120780dea0962aca04b3
2018-11-16 00:28:07 +01:00
iris_vendor_data_file
Add mapping files for 28.0.[ignore.]cil Steps taken to produce the mapping files: 1. Add prebuilts/api/28.0/[plat_pub_versioned.cil|vendor_sepolicy.cil] from the /vendor/etc/selinux/[plat_pub_versioned.cil|vendor_sepolicy.cil] files built on pi-dev with lunch target aosp_arm64-eng 2. Add new file private/compat/28.0/28.0.cil by doing the following: - copy /system/etc/selinux/mapping/28.0.cil from pi-dev aosp_arm64-eng device to private/compat/28.0/28.0.cil - remove all attribute declaration statement (typeattribute ...) and sort lines alphabetically - some selinux types were added/renamed/deleted w.r.t 28 sepolicy. Find all such types using treble_sepolicy_tests_28.0 test. - for all these types figure out where to map them by looking at 27.0.[ignore.]cil files and add approprite entries to 28.0.[ignore.]cil. This change also enables treble_sepolicy_tests_28.0 and install 28.0.cil mapping onto the device. Bug: 72458734 Test: m selinux_policy Change-Id: I90e17c0b43af436da4b62c16179c198b5c74002c
2018-07-11 11:30:44 +02:00
llkd
llkd_exec
llkd: Add stack symbol checking llkd needs the ptrace capabilities and dac override to monitor for live lock conditions on the stack dumps. Test: compile Bug: 33808187 Change-Id: Ibc1e4cc10395fa9685c4ef0ca214daf212a5e126
2018-08-08 01:03:47 +02:00
llkd_prop
Add mapping files for 28.0.[ignore.]cil Steps taken to produce the mapping files: 1. Add prebuilts/api/28.0/[plat_pub_versioned.cil|vendor_sepolicy.cil] from the /vendor/etc/selinux/[plat_pub_versioned.cil|vendor_sepolicy.cil] files built on pi-dev with lunch target aosp_arm64-eng 2. Add new file private/compat/28.0/28.0.cil by doing the following: - copy /system/etc/selinux/mapping/28.0.cil from pi-dev aosp_arm64-eng device to private/compat/28.0/28.0.cil - remove all attribute declaration statement (typeattribute ...) and sort lines alphabetically - some selinux types were added/renamed/deleted w.r.t 28 sepolicy. Find all such types using treble_sepolicy_tests_28.0 test. - for all these types figure out where to map them by looking at 27.0.[ignore.]cil files and add approprite entries to 28.0.[ignore.]cil. This change also enables treble_sepolicy_tests_28.0 and install 28.0.cil mapping onto the device. Bug: 72458734 Test: m selinux_policy Change-Id: I90e17c0b43af436da4b62c16179c198b5c74002c
2018-07-11 11:30:44 +02:00
llkd_tmpfs
Add looper_stats_service to SE policy. Test: Built and flashed an image. Bug: 113651685 Change-Id: Ide239432ea8a5701d91c00edd06ad3e52560a3f7
2018-08-30 14:04:55 +02:00
looper_stats_service
Add rules for lpdump and lpdumpd - lpdump is a binary on the device that talks to lpdumpd via binder. - lpdumpd is a daemon on the device that actually reads dynamic partition metadata. Only lpdump can talk to it. Bug: 126233777 Test: boots (sanity) Test: lpdump Change-Id: I0e21f35ac136bcbb0603940364e8117f2d6ac438
2019-03-14 23:45:03 +01:00
lpdumpd
lpdumpd_exec
lpdumpd_prop
lpdump_service
iorapd: Add new binder service iorapd. This daemon is very locked down. Only system_server can access it. Bug: 72170747 Change-Id: I7b72b9191cb192be96001d84d067c28292c9688f
2018-10-05 23:48:29 +02:00
iorapd
iorapd_exec
iorapd_data_file
iorapd_service
iorapd_tmpfs
add mediaswcodec service Set up a new service for sw media codec services. Bug: 111407413 Test: cts-tradefed run cts-dev --module CtsMediaTestCases --compatibility:module-arg CtsMediaTestCases:include-annotation:android.platform.test.annotations.RequiresDevice Change-Id: Ia1c6a9ef3f0c1d84b2be8756eb1853ffa0597f8e
2018-09-20 21:07:44 +02:00
mediaswcodec
mediaswcodec_exec
mediaswcodec_tmpfs
Add mapping files for 28.0.[ignore.]cil Steps taken to produce the mapping files: 1. Add prebuilts/api/28.0/[plat_pub_versioned.cil|vendor_sepolicy.cil] from the /vendor/etc/selinux/[plat_pub_versioned.cil|vendor_sepolicy.cil] files built on pi-dev with lunch target aosp_arm64-eng 2. Add new file private/compat/28.0/28.0.cil by doing the following: - copy /system/etc/selinux/mapping/28.0.cil from pi-dev aosp_arm64-eng device to private/compat/28.0/28.0.cil - remove all attribute declaration statement (typeattribute ...) and sort lines alphabetically - some selinux types were added/renamed/deleted w.r.t 28 sepolicy. Find all such types using treble_sepolicy_tests_28.0 test. - for all these types figure out where to map them by looking at 27.0.[ignore.]cil files and add approprite entries to 28.0.[ignore.]cil. This change also enables treble_sepolicy_tests_28.0 and install 28.0.cil mapping onto the device. Bug: 72458734 Test: m selinux_policy Change-Id: I90e17c0b43af436da4b62c16179c198b5c74002c
2018-07-11 11:30:44 +02:00
mnt_product_file
sepolicy changes for network stack app The networking stack app hosts services that used to be in the system server (IpClient, NetworkMonitor for now), but in a different process to be packaged as a mainline module. Test: booted, verified networking stack working when in app Change-Id: I300a556f51b35c17378af961cea1ec937444e597
2018-11-14 09:07:41 +01:00
network_stack
Add selinux policies for network stack service The policies allow the system server to register a network_stack_service used to communicate with the network stack process. Test: atest FrameworksNetTests Bug: b/112869080 Change-Id: Ib9b7d9150fe4afcce03c8b3dbb36b81c67e39366
2018-12-14 06:13:52 +01:00
network_stack_service
Properly Treble-ize tmpfs access This is being done in preparation for the migration from ashmem to memfd. In order for tmpfs objects to be usable across the Treble boundary, they need to be declared in public policy whereas, they're currently all declared in private policy as part of the tmpfs_domain() macro. Remove the type declaration from the macro, and remove tmpfs_domain() from the init_daemon_domain() macro to avoid having to declare the *_tmpfs types for all init launched domains. tmpfs is mostly used by apps and the media frameworks. Bug: 122854450 Test: Boot Taimen and blueline. Watch videos, make phone calls, browse internet, send text, install angry birds...play angry birds, keep playing angry birds... Change-Id: I20a47d2bb22e61b16187015c7bc7ca10accf6358
2019-01-24 00:07:40 +01:00
network_stack_tmpfs
NNAPI property to disable extensions use on GSI/AOSP product partition. Property is NNAPI client-readable and writeable only by init/build.prop. Bug: 129666983 Bug: 120483623 Test: flashed crosshatch/Cts tests for NNAPI Change-Id: Ic4c0f176440610a2c54c078863f3d5382323cc65
2019-04-02 16:34:16 +02:00
nnapi_ext_deny_product_prop
fs_mgr: add overlayfs handling for squashfs system filesystems /cache/overlay directory in support of overlayfs mounts on userdebug and eng devices. Overlayfs in turn can be capable of supporting adb remount for read-only or restricted-storage filesystems like squashfs or right-sized (zero free space) system partitions respectively. Test: compile Bug: 109821005 Bug: 110985612 Change-Id: I3ece03886db7cc97f864497cf93ec6c6c39bccd1
2018-06-13 17:02:29 +02:00
overlayfs_file
Add sepolicy for /metadata/password_slots. The device OS and an installed GSI will both attempt to write authentication data to the same weaver slots. To prevent this, we can use the /metadata partition (required for GSI support) to communicate which slots are in use between OS images. To do this we define a new /metadata/password_slots directory and define sepolicy to allow system_server (see PasswordSlotManager) to access it. Bug: 123716647 Test: no denials on crosshatch Change-Id: I8e3679d332503b5fb8a8eb6455de068c22eba30b
2019-02-28 23:11:34 +01:00
password_slot_metadata_file
Create new permissionmgr_service We're creating a new PermissionManagerService that will handle all of the permission related APIs. These are currently being routed through PackageManagerService. Test: Device boots Change-Id: I7d08561dd33b692209c30d413cdca0ff567358f1
2018-12-14 22:08:43 +01:00
permissionmgr_service
Introduce a `postinstall_apex_mnt_dir` label for `/postinstall/apex`. Directory `/postinstall/apex` is used as a mount point for a tmpfs filesystem during A/B OTA updates. APEX packages from the new system partition are mounted ("activated") in subdirectories of `/postinstall/apex`, so that they are available when `otapreopt` is running. Directory `/postinstall/apex` used to be of type `tmpfs` for SELinux purposes. The new `postinstall_apex_mnt_dir` label is more restrictive, and tightens permissions granted to `otapreopt_chroot`, `otapreopt` (running as `postinstall_dexopt`), and `dex2oat`, regarding the apexd logic recently added to `otapreopt_chroot`. Test: A/B OTA update test (asit/dexoptota/self_full). Bug: 113373927 Bug: 120796514 Change-Id: I03f0b0433d9c066a0c607f864d60ca62fc68c990
2019-01-24 15:32:17 +01:00
postinstall_apex_mnt_dir
Add sepolicy for fastbootd Also allow adb and fastboot to talk to recovery through recovery_socket. This enables changing between modes with usb commands. Test: No selinux denials Bug: 78793464 Change-Id: I80c54d4eaf3b94a1fe26d2280af4e57cb1593790
2018-05-29 19:54:16 +02:00
recovery_socket
Add SELinux service for RoleManagerService Test: ensure no build failures; add RoleManagerService as a boot phase ensure no SecurityException in logcat on boot Change-Id: Ia0803c0fb084fe2b12f5c20f5e46354d0dd1aedf
2018-11-09 02:37:45 +01:00
role_service
Add sepolicy for RollbackManagerService. Bug: 112431924 Test: atest RollbackTest Change-Id: I30453a8d5352a31e3e6af6c37a20b5473904d356
2018-10-02 12:20:32 +02:00
rollback_service
sepolicy: Add "rs" and "rs_exec" to public policy Add "rs" and "rs_exec" types to public policy. Access to these types might be needed for device specific customization. Bug: 121306110 Test: Manual using application Change-Id: Ief35d3353625adfbf468447de74aa80651dd9451
2018-12-21 18:31:47 +01:00
rs
rs_exec
SELinux policy for rss_hwm_reset rss_hwm_reset is binary that reset RSS high-water mark counters for all currently running processes. It runs in a separate process because it needs dac_override capability. Bug: 119603799 Test: no errors in logcat Change-Id: I6221a5eca3427bf532830575d8fba98eb3e65c29
2018-11-15 14:04:13 +01:00
rss_hwm_reset
rss_hwm_reset_exec
Add permissions in runas_app domain to debug/profile debuggable apps. runas_app domain is used by lldb/ndk-gdb/simpleperf to debug/profile debuggable apps. But it misses permissions to ptrace app processes and read /proc/<app_pid> directory. Bug: none Test: build and boot marlin. Test: run lldb and simpleperf on apps with target sdk version 24-29. Change-Id: I9e6f940ec81a8285eae8db3b77fb1251a25dedd0
2019-01-08 01:37:24 +01:00
runas_app
Properly Treble-ize tmpfs access This is being done in preparation for the migration from ashmem to memfd. In order for tmpfs objects to be usable across the Treble boundary, they need to be declared in public policy whereas, they're currently all declared in private policy as part of the tmpfs_domain() macro. Remove the type declaration from the macro, and remove tmpfs_domain() from the init_daemon_domain() macro to avoid having to declare the *_tmpfs types for all init launched domains. tmpfs is mostly used by apps and the media frameworks. Bug: 122854450 Test: Boot Taimen and blueline. Watch videos, make phone calls, browse internet, send text, install angry birds...play angry birds, keep playing angry birds... Change-Id: I20a47d2bb22e61b16187015c7bc7ca10accf6358
2019-01-24 00:07:40 +01:00
runas_app_tmpfs
Don't use apexd when TARGET_FLATTEN_APEX == true /system/apex/com.android.runtime is labeled as runtime_apex_dir and init is allowed to mount on it. When TARGET_FLATTEN_APEX is true (= ro.apex.updatable is unset or set to false), apexd is not used to activate the built-in flattened APEXes. Init simply bind-mounts /system/apex to /apex. However, there is a special case here. The runtime APEX is installed as either /system/apex/com.android.runtime.debug or /system/apex/com.android.runtime.release, whereas it should be activated on /apex/com.android.runtime - without the .debug or .release suffix. To handle that case, the build system creates an empty directory /system/apex/com.android.runtime and the .debug or .release directory is bind-mounted to the empty directory by init at runtime. Bug: 132413565 Test: marlin is bootable Merged-In: I3fde5ff831429723fecd1fa5c10e44f636a63f09 Change-Id: I3fde5ff831429723fecd1fa5c10e44f636a63f09 (cherry picked from commit 99902a175b62d242a40ab7957b284f667a03b424)
2019-05-13 05:54:39 +02:00
runtime_apex_dir
Track add of RuntimeService in system server Adds the necessary incantations for the new service. Bug: 118242715 Bug: 119026403 Test: build / boot / adb shell dumpsys Change-Id: Ibb1a356067863316d70586a61ede9f5973c1ae15
2018-11-20 20:41:15 +01:00
runtime_service
Add sepolicy for installing GSIs to external storage. To install GSIs on external storage (such as sdcards), gsid needs some additional privileges: - proc_cmdline and device-tree access to call ReadDefaultFstab(). This is ultimately used to check whether system's dm-verity has check_at_most_once enabled, which is disallowed with sdcards. - vfat read/write access to write files to the sdcard. Note that adopted sdcards are not supported here. - read access to the sdcard block device. To enable this without providing access to vold_block_device, a new sdcard_block_device label was added. Devices must apply this label appropriately to enable gsid access. - FIBMAP access for VFAT filesystems, as they do not support FIEMAP. This only appears to work by granting SYS_RAWIO. Bug: 126230649 Test: adb shell su root gsi_tool install --install_dir=/mnt/media_rw/... works without setenforce 0 Change-Id: I88d8d83e5f61d4c0490f912f226fe1fe38cd60ab
2019-03-16 00:41:15 +01:00
sdcard_block_device
Add selinux policy for new SensorPrivacyService Test: manually verified SensorPrivacyService is accessible Bug: 110842805 Change-Id: Idd215f338f2da0dab4898ea06fa08d9b4a1bcb5f
2018-12-05 07:38:01 +01:00
sensor_privacy_service
SEPolicy for Staged Installs. Test: basic workflow between apexd and PackageManager tested with changes being developed. Bug: 118865310 Change-Id: I1ae866f33e9b22493585e108c4fd45400493c7ac
2019-01-02 15:20:52 +01:00
server_configurable_flags_data_file
Add sepolicy for simpleperf_app_runner. Bug: 118835348 Test: build and boot pixel 3. Test: run simpleperf_app_runner manually. Change-Id: Ifb6c2ab78e075684bc197d06f761becced8281d1
2019-01-11 00:34:08 +01:00
simpleperf_app_runner
simpleperf_app_runner_exec
Properly Treble-ize tmpfs access This is being done in preparation for the migration from ashmem to memfd. In order for tmpfs objects to be usable across the Treble boundary, they need to be declared in public policy whereas, they're currently all declared in private policy as part of the tmpfs_domain() macro. Remove the type declaration from the macro, and remove tmpfs_domain() from the init_daemon_domain() macro to avoid having to declare the *_tmpfs types for all init launched domains. tmpfs is mostly used by apps and the media frameworks. Bug: 122854450 Test: Boot Taimen and blueline. Watch videos, make phone calls, browse internet, send text, install angry birds...play angry birds, keep playing angry birds... Change-Id: I20a47d2bb22e61b16187015c7bc7ca10accf6358
2019-01-24 00:07:40 +01:00
su_tmpfs
Define 'super_block_device' type Bug: 78793464 Test: fastboot getvar partition-size:super 'super_block_device' corresponds to the super partition required for flashing dynamic partitions. Change-Id: I323634b6797ead7c5face117a7028bf9ab947aea
2018-08-17 20:07:09 +02:00
super_block_device
Add Label to f2fs sysfs files Test: ls -lZ /sys/fs/f2fs Bug: 123367711 Change-Id: I0035feb8409b7ec8e11510795fb7d8845992694e
2019-02-15 23:29:05 +01:00
sysfs_fs_f2fs
Sepolicy for IAshmem HIDL interface Change-Id: Id78f995661120f136d671ea0084db358e7662122 Bug: 133443879 Test: Manually check logcat for sepolicy denials (logcat | grep IAshmem)
2019-05-21 21:34:22 +02:00
system_ashmem_hwservice
Allow bootstrap bionic only to init, ueventd, and apexd The bootstrap bionic (/system/lib/bootstrap/*) are only to the early processes that are executed before the bionic libraries become available via the runtime APEX. Allowing them to other processes is not needed and sometimes causes a problem like b/123183824. Bug: 123183824 Test: device boots to the UI Test: atest CtsJniTestCases:android.jni.cts.JniStaticTest#test_linker_namespaces Change-Id: Id7bba2e8ed1c9faf6aa85dbbdd89add04826b160
2019-03-14 18:45:33 +01:00
system_bootstrap_lib_file
system/etc/event-log-tags available to all This was a regression in Q, and the file is an implementation of liblog. Bug: 113083310 Test: use tags from vendor and see no denials Change-Id: I726cc1fcfad39afc197b21e431a687a3e4c8ee4a
2019-01-10 22:59:37 +01:00
system_event_log_tags_file
Selinux: Allow lmkd write access to sys.lmk. properties Allow lmkd write access to sys.lmk. properties to be able to set sys.lmk.minfree_levels. Bug: 111521182 Test: getprop sys.lmk.minfree_levels returns value set by lmkd Change-Id: I86ff11d75917966857d3a76876a56799bb92a5ad Signed-off-by: Suren Baghdasaryan <surenb@google.com>
2018-07-25 02:04:18 +02:00
system_lmk_prop
Sepolicy for system suspend HAL. Bug: 78888165 Test: device can boot with HAL running. Change-Id: I3bf7c8203e038b892176c97ec006152a2904c7be
2018-04-09 02:15:08 +02:00
system_suspend_hwservice
SEPolicy for Suspend Control interface. Bug: 121210355 Test: manual Change-Id: I9c46c72f0219309140ed2fb008ef57b4bca6ff2b
2019-01-21 14:45:47 +01:00
system_suspend_control_service
Allow traced to notify traceur via property This CL introduces allows traced to set the sys.traceur.trace_end_signal property at the end of the tracer. In turn that property notifies the the Traceur app. This is to allowing Traceur to be killed during a long-trace and avoid wasting resources making it a persistent service. See aosp/886616 for the matching traceur change. Test: manual Bug: 116754732 Change-Id: I89e2f02b3f973813ce8ff3507d397a06502f84c1
2019-02-01 23:52:02 +01:00
system_trace_prop
SEPolicy for Staged Installs. Test: basic workflow between apexd and PackageManager tested with changes being developed. Bug: 118865310 Change-Id: I1ae866f33e9b22493585e108c4fd45400493c7ac
2019-01-02 15:20:52 +01:00
staging_data_file
sepolicy changes to configure cgroup.rc and task_profiles.json access cgroups.json file contains cgroup information required to mount cgroup controllers and is readable only by init process. cgroup.rc contains cgroup map information consisting of the list of cgroups available in the system and their mounting locations. It is created by init process and should be readable by any processes that uses cgroups and should be writable only by init process. task_profiles.json file contains task profiles used to operate on cgroups. This information should be readable by any process that uses cgroups and should be writable only by init process. Bug: 111307099 Test: builds, boots Change-Id: Ib2c87c0fc3663c7fc69628f05c846519b65948b5 Signed-off-by: Suren Baghdasaryan <surenb@google.com>
2019-01-11 02:10:31 +01:00
task_profiles_file
Add the testharness service to sepolicy rules The testharness service will manage Test Harness Mode and provide a command-line interface for users to enable Test Harness Mode; however it does not directly provide a public API. Bug: 80137798 Test: make Test: flash crosshatch Change-Id: Ie396e40fcea8914b4dd2247f2314e029b66ad84e
2019-01-15 22:39:30 +01:00
testharness_service
test_harness_prop
Add persist.sys.theme. This property will be set by system_server (to indicate the currently selected theme for device), and can be accessed by vendor init.rc. avc: denied { read } for property=persist.sys.theme pid=0 uid=0 gid=0 scontext=u:r:vendor_init:s0 tcontext=u:object_r:theme_prop:s0 tclass=file Bug: 113028175 Test: Set a vendor init trigger that waits on `persist.sys.theme`. Check that the trigger fires without denial. Change-Id: Ibb4e392d5059b76059f36f7d11ba82cd65cbe970
2019-06-15 02:00:16 +02:00
theme_prop
Add mapping files for 28.0.[ignore.]cil Steps taken to produce the mapping files: 1. Add prebuilts/api/28.0/[plat_pub_versioned.cil|vendor_sepolicy.cil] from the /vendor/etc/selinux/[plat_pub_versioned.cil|vendor_sepolicy.cil] files built on pi-dev with lunch target aosp_arm64-eng 2. Add new file private/compat/28.0/28.0.cil by doing the following: - copy /system/etc/selinux/mapping/28.0.cil from pi-dev aosp_arm64-eng device to private/compat/28.0/28.0.cil - remove all attribute declaration statement (typeattribute ...) and sort lines alphabetically - some selinux types were added/renamed/deleted w.r.t 28 sepolicy. Find all such types using treble_sepolicy_tests_28.0 test. - for all these types figure out where to map them by looking at 27.0.[ignore.]cil files and add approprite entries to 28.0.[ignore.]cil. This change also enables treble_sepolicy_tests_28.0 and install 28.0.cil mapping onto the device. Bug: 72458734 Test: m selinux_policy Change-Id: I90e17c0b43af436da4b62c16179c198b5c74002c
2018-07-11 11:30:44 +02:00
time_prop
timedetector_service
timezonedetector_service
Allow traced to lazily start heapprofd. Bug: 126724929 Change-Id: I15f0ae10d5e45fc65850635230e377b6f77ad4d7
2019-03-13 19:22:23 +01:00
traced_lazy_prop
Added sepolicy for uri_grants service Bug: 80414790 Test: boots Change-Id: I15233721fa138e0fdf1a30f66d52b64cbab18b81
2018-07-22 08:21:08 +02:00
uri_grants_service
Add permissions for sys.use_memfd property Will be used to forcefully turn on memfd if device supports it. Currently used only for debugging. Change-Id: I46a1b7169677ea552d4b092e7501da587c42ba1a Signed-off-by: Joel Fernandes <joelaf@google.com>
2019-01-31 23:43:57 +01:00
use_memfd_prop
Adding vendor_apex_file for /vendor/apex apexd needs to read /vendor/apex dir and files in it. Bug: 131190070 Bug: 123378252 Test: 1. Add apex to /vendor/apex -> see if boot succeeds with new policy 2. Add flattened apex to /vendor/apex -> see if only root files are labelled as vendor_apex_file Change-Id: I37795ab6d659ac82639ba5e34d628fe1b5cdb350
2019-04-24 03:45:40 +02:00
vendor_apex_file
sepolicy for vendor cgroups.json and task_profiles.json files Vendors should be able to specify additional cgroups and task profiles without changing system files. Add access rules for /vendor/etc/cgroups.json and /vendor/etc/task_profiles.json files which will augment cgroups and task profiles specified in /etc/cgroups.json and /etc/task_profiles.json system files. As with system files /vendor/etc/cgroups.json is readable only by init process. task_profiles.json is readable by any process that uses cgroups. Bug: 124960615 Change-Id: I12fcff0159b4e7935ce15cc19ae36230da0524fc Signed-off-by: Suren Baghdasaryan <surenb@google.com>
2019-02-20 00:02:14 +01:00
vendor_cgroup_desc_file
Allow system_server to read vendor_file Input device configuration files .idc, .kl that are placed in /vendor are currently not accessible. Allow the read access here. Bug: 112880217 Test: move .idc and .kl files from /system to /vendor, then observe logcat. With this patch, avc denials disappear. Change-Id: I72ad62b9adf415f787565adced73fd8aaff38832
2018-10-08 21:04:15 +02:00
vendor_idc_file
vendor_keychars_file
vendor_keylayout_file
Add vendor_misc_writer. The space between 2K and 16K in /misc is currently reserved for vendor's use (as claimed in bootloader_message.h), but we don't allow vendor module to access misc_block_device other than vendor_init. The change in the topic adds a `misc_writer` tool as a vendor module, which allows writing data to the vendor space to bridge the gap in the short term. This CL adds matching labels to grant access. Long term goal is to move /misc as vendor owned, then to provide HAL access from core domain (b/132906936). Bug: 132906936 Test: Build crosshatch that includes misc_writer module. Invoke /vendor/bin/misc_writer to write data to /misc. Change-Id: I4c18d78171a839ae5497b3a61800193ef9e51b3b
2019-05-16 23:44:11 +02:00
vendor_misc_writer
vendor_misc_writer_exec
sepolicy for vendor cgroups.json and task_profiles.json files Vendors should be able to specify additional cgroups and task profiles without changing system files. Add access rules for /vendor/etc/cgroups.json and /vendor/etc/task_profiles.json files which will augment cgroups and task profiles specified in /etc/cgroups.json and /etc/task_profiles.json system files. As with system files /vendor/etc/cgroups.json is readable only by init process. task_profiles.json is readable by any process that uses cgroups. Bug: 124960615 Change-Id: I12fcff0159b4e7935ce15cc19ae36230da0524fc Signed-off-by: Suren Baghdasaryan <surenb@google.com>
2019-02-20 00:02:14 +01:00
vendor_task_profiles_file
Move watchdogd out of init and into its own domain Bug: 73660730 Test: watchdogd still runs Change-Id: I31697c7c6fa2f7009731ff48c659af051838e42f
2018-08-02 00:48:20 +02:00
vrflinger_vsync_service
watchdogd_tmpfs))
Reference in a new issue Copy permalink