tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/private/file.te

111 lines
4.4 KiB
Text
Raw Normal View History

Label /proc/config.gz Add a label to /proc/config.gz, so we can distinguish this file from other /proc files in security policy. For now, only init is allowed read access. All others are denied. TODO: clarify exactly who needs access. Further access will be granted in a future commit. Bug: 35126415 Test: policy compiles and no device boot problems. Change-Id: I8b480890495ce5b8aa3f8c7eb00e14159f177860
2017-02-16 21:04:40 +01:00
# /proc/config.gz
proc_type attribute for files under /proc. With this attribute it will be easier to reference /proc files. Bug: 74182216 Test: policy builds Change-Id: I5b7da508d821e45f122832261a742a201e8fdf2c
2018-02-16 03:07:18 +01:00
type config_gz, fs_type, proc_type;
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
# /data/misc/storaged
type storaged_data_file, file_type, data_file_type, core_data_file_type;
Add window trace files SELinux policy rules - Allow system_server to create and write to /data/misc/wmtrace/* - Allow surfaceflinger to create and write files from /data/misc/wmtrace/* - Allow dumpstate to read files from /data/misc/wmtrace/* permissions are restricted to userdebug or eng builds Bug: 64831661 Test: adb shell cmd window tracing start && adb shell cmd window tracing stop Test: adb shell su root service call SurfaceFlinger 1025 i32 1 >/dev/null && adb shell su root service call SurfaceFlinger 1025 i32 0 >/dev/null Test: adb bugreport ~/tmp.zip && adb shell su root dmesg | grep 'avc: ' Change-Id: I0b15166560739d73d7749201f3ad197dbcf5791c
2017-11-17 17:23:32 +01:00
# /data/misc/wmtrace for wm traces
type wm_trace_data_file, file_type, data_file_type, core_data_file_type;
SELinux policies for Perfetto cmdline client (/system/bin/perfetto) Instead of having statsd linking the perfetto client library and talk directly to its socket, we let just statsd exec() the /system/bin/perfetto cmdline client. There are two reasons for this: 1) Simplify the interaction between statsd and perfetto, reduce dependencies, binary size bloat and isolate faults. 2) The cmdline client also takes care of handing the trace to Dropbox. This allows to expose the binder interaction surface to the short-lived cmdline client and avoid to grant binder access to the perfetto traced daemon. This cmdline client will be used by: - statsd - the shell user (for our UI and Studio) Bug: 70942310 Change-Id: I8cdde181481ad0a1a5cae5937ac446cedac54a1f
2018-01-24 17:07:09 +01:00
Add /data/misc/a11ytrace folder to store accessibility trace files. Bug: 157601519 Test: adb shell cmd accessibility start-trace adb shell cmd accessibility stop-trace Change-Id: Id4224cee800fe3e10f33794c96048366a0bf09bb
2021-02-09 21:03:40 +01:00
# /data/misc/a11ytrace for accessibility traces
type accessibility_trace_data_file, file_type, data_file_type, core_data_file_type;
SELinux policies for Perfetto cmdline client (/system/bin/perfetto) Instead of having statsd linking the perfetto client library and talk directly to its socket, we let just statsd exec() the /system/bin/perfetto cmdline client. There are two reasons for this: 1) Simplify the interaction between statsd and perfetto, reduce dependencies, binary size bloat and isolate faults. 2) The cmdline client also takes care of handing the trace to Dropbox. This allows to expose the binder interaction surface to the short-lived cmdline client and avoid to grant binder access to the perfetto traced daemon. This cmdline client will be used by: - statsd - the shell user (for our UI and Studio) Bug: 70942310 Change-Id: I8cdde181481ad0a1a5cae5937ac446cedac54a1f
2018-01-24 17:07:09 +01:00
# /data/misc/perfetto-traces for perfetto traces
type perfetto_traces_data_file, file_type, data_file_type, core_data_file_type;
SEPolicy changes to allow kcov access in userdebug. This includes the SELinux policy changes to allow for kcov access in userdebug builds for coverage-guided kernel fuzzing. Bug: 117990869 Test: Ran syzkaller with Android untrusted_app sandbox with coverage. Change-Id: I1fcaad447c7cdc2a3360383b5dcd76e8a0f93f09
2018-11-29 19:37:18 +01:00
Allow dumpstate to snapshot traces and attach them to bug reports Feature description: if a background trace is happening at the time dumpstate is invoked, the tracing daemon will snapshot the trace into a fixed path (/data/misc/perfetto-traces/bugreport/). Dumpstate will attach the trace, if present, to the bugreport. From a SELinux viewpoint this involves the following permissions: - Allow dumpstate to exec+trans perfetto --save-for-bugreport (this will just send an IPC to traced, which will save the trace). - Allow dumpstate to list, read and unlink the trace file. - Create a dedicated label for bugreport traces, to prevent that dumpstate gets access to other traces not meant for bug reporting. Note that this does NOT allow dumpstate to serialze arbitary traces. Traces must be marked as "eligible for bugreport" upfront in the trace config (which is not under dumpstate control), by setting bugreport_score > 0. Design doc: go/perfetto-betterbug Bug: 170334305 Test: manual: 1. start a perfetto trace with bugreport_score > 0 2. adb shell dumpstate 3. check that the bugreport zip contains the trace Change-Id: I259c3ee9d5be08d6b22c796b32875d7de703a230
2021-01-07 18:12:21 +01:00
# /data/misc/perfetto-traces/bugreport for perfetto traces for bugreports.
type perfetto_traces_bugreport_data_file, file_type, data_file_type, core_data_file_type;
Create directory for shell<>perfetto interaction Users are unable to pass config files directly to perfetto via `perfetto -c /path/to/config` and have to resort to awkward quirks like `cat config | perfetto -c -'. This is because /system/bin/perfetto runs in its own SELinux domain for reasons explained in the bug. This causes problem to test infrastructures authors. Instead of allowing the use of /data/local/tmp which is too ill-scoped we create a dedicated folder and allow only shell and perfetto to operate on it. Bug: 170404111 Test: manual, see aosp/1459023 Change-Id: I6fefe066f93f1f389c6f45bd18214f8e8b07079e
2020-10-13 22:13:09 +02:00
# /data/misc/perfetto-configs for perfetto configs
type perfetto_configs_data_file, file_type, data_file_type, core_data_file_type;
Create a separate label for sandbox root directory Currently, app process can freely execute path at `/data/misc_ce/0/sdksandbox/<package-name>` since it's labeled as system file. They can't read or write, but use 403/404 error to figure out if an app is installed or not. By changing the selinux label of the parent directory: `/data/misc_ce/0/sdksandbox`, we can restrict app process from executing inside the directory and avoid the privacy leak. Sandbox process should only have "search" permission on the new label so that it can pass through it to its data directory located in `/data/misc_ce/0/sdksandbox/<package-name>/<per-sdk-dir>`. Bug: 214241165 Test: atest SdkSandboxStorageHostTest Test: `adb shell cd /data/misc_ce/0/sdksandbox` gives error Test: manual test to verify webview still works Ignore-AOSP-First: Test is missing in AOSP. Will cherry-pick to AOSP once merged here. Change-Id: Id8771b322d4eb5532eaf719f203ca94035e2a8ed
2022-05-11 22:43:54 +02:00
# /data/misc_{ce/de}/<user>/sdksandbox root data directory for sdk sandbox processes
type sdk_sandbox_system_data_file, file_type, data_file_type, core_data_file_type;
Move sdk_sandbox sepolicy to AOSP. Bug: 224796470 Bug: 203670791 Bug: 204989872 Bug: 211761016 Bug: 217543371 Bug: 217559719 Bug: 215105355 Bug: 220320098 Test: make, ensure device boots Change-Id: Ia96ae5407f5a83390ce1b610da0d49264e90d7e2 Merged-In: Ib085c49f29dab47268e479fe5266490a66adaa87 Merged-In: I2215ffe74e0fa19ff936e90c08c4ebfd177e5258 Merged-In: I478c9a16032dc1f1286f5295fc080cbe574f09c9 Merged-In: Ibf478466e5d6ab0ee08fca4da3b4bae974a82db0 Merged-In: I5d519605d9fbe80c7b4c9fb6572bc72425f6e90a Merged-In: I05d2071e023d0de8a93dcd111674f8d8102a21ce Merged-In: I6572a7a5c46c52c9421d0e9c9fc653ddbd6de145 Merged-In: I1b6d1a778cb658bdfd930b684e4ba0640031b226 Merged-In: I9fb98e0caee75bdaaa35d11d174004505f236799
2022-03-15 18:28:02 +01:00
# /data/misc_{ce/de}/<user>/sdksandbox/<app-name>/* subdirectory for sdk sandbox processes
type sdk_sandbox_data_file, file_type, data_file_type, core_data_file_type, app_data_file_type;
SEPolicy changes to allow kcov access in userdebug. This includes the SELinux policy changes to allow for kcov access in userdebug builds for coverage-guided kernel fuzzing. Bug: 117990869 Test: Ran syzkaller with Android untrusted_app sandbox with coverage. Change-Id: I1fcaad447c7cdc2a3360383b5dcd76e8a0f93f09
2018-11-29 19:37:18 +01:00
# /sys/kernel/debug/kcov for coverage guided kernel fuzzing in userdebug builds.
type debugfs_kcov, fs_type, debugfs_type;
rename rs_data_file to app_exec_data_file There are multiple trusted system components which may be responsible for creating executable code within an application's home directory. Renderscript is just one of those trusted components. Generalize rs_data_file to app_exec_data_file. This label is intended to be used for any executable code created by trusted components placed into an application's home directory. Introduce a typealias statement to ensure files with the previous label continue to be understood by policy. This change is effectively a no-op, as it just renames a type, but neither adds or removes any rules. Bug: 121375718 Bug: 112357170 Test: cts-tradefed run cts-dev -m CtsRenderscriptTestCases Change-Id: I17dca5e3e8a1237eb236761862174744fb2196c0
2019-01-11 18:37:46 +01:00
# App executable files in /data/data directories
type app_exec_data_file, file_type, data_file_type, core_data_file_type;
typealias app_exec_data_file alias rs_data_file;
Add initial sepolicy for app data snapshots. Define a rollback_data_file label and apply it to the snapshots directory. This change contains just enough detail to allow vold_prepare_subdirs to prepare these directories correctly. A follow up change will flesh out the access policy on these directories in more detail. Test: make, manual Bug: 112431924 Change-Id: I4fa7187d9558697016af4918df6e34aac1957176
2019-01-14 16:02:12 +01:00
# /data/misc_[ce|de]/rollback : Used by installd to store snapshots
# of application data.
type rollback_data_file, file_type, data_file_type, core_data_file_type;
Add linker config generator and output file to sepolicy Sepolicy for linkerconfig generator and ld.config.txt file from generator Bug: 135004088 Test: m -j & tested from device Change-Id: I2ea7653a33996dde67a84a2e7a0efa660886434a
2019-07-08 12:02:05 +02:00
Add context for checkin directory Checkin apps use /data/misc_ce/<id>/checkin to backup the checkin metadata. So users won't lose the checkin tokens when they clear the app's storage. One example is when GMScore is used for checkin, users may clear GMScore data via "settings". If the device accidentally loses the token without backup, it won't be able to checkin again until factory reset. The contents in checkin dir will be cleaned up when a user is removed from the device. We also plan to add Gmscore test to ensure the dir is cleaned up at checkin time, thus prevent other Gmscore modules from using this storage by mistake. Bug: 197636740 Test: boot device, check selinux label, check gmscore writes to the new dir Change-Id: If3ff5e0fb75b4d49ce80d91b0086b58db002e4fb
2021-10-06 07:13:20 +02:00
# /data/misc_ce/checkin for checkin apps.
type checkin_data_file, file_type, data_file_type, core_data_file_type;
update_engine: rules to apply virtual A/B OTA - /data/gsi/ota/* now has the type ota_image_data_file. At runtime during an OTA, update_engine uses libsnapshot to talk to gsid to create these images as a backing storage of snapshots. These "COW images" stores the changes update_engine has applied to the partitions. If the update is successful, these changes will be merged to the partitions, and these images will be teared down. If the update fails, these images will be deleted after rolling back to the previous slot. - /metadata/gsi/ota/* now has the type ota_metadata_file. At runtime during an OTA, update_engine and gsid stores update states and information of the created snapshots there. At next boot, init reads these files to re-create the snapshots. Beside these assignments, this CL also allows gsid and update_engine to have the these permissions to do these operations. Bug: 135752105 Test: apply OTA, no failure Change-Id: Ibd53cacb6b4ee569c33cffbc18b1b801b62265de
2019-08-07 22:01:15 +02:00
# /data/gsi/ota
type ota_image_data_file, file_type, data_file_type, core_data_file_type;
Setting up SELinux policy for Emergency number database Test: Manual; https://paste.googleplex.com/6222197494382592 Bug: 136027884 Change-Id: I29214de6b5b5a62bff246c1256567844f4ce55c7
2019-10-15 22:13:56 +02:00
Support copy-on-write persistent data block when running a DSU The persistent data block is protected by a copy-on-write scratchpad when running a Dynamic System Update (DSU). The copy-on-write scratchpad uses a backing file for write operations. This CL adds permissions to write the backing file for the PersistentDataBlockService. Bug: 175852148 Test: gsi_tool install & vts_kernel_net_tests Change-Id: Id0efe407e707fc382679c0eee249af52f877f5d2
2020-12-25 10:32:13 +01:00
# /data/gsi_persistent_data
type gsi_persistent_data_file, file_type, data_file_type, core_data_file_type;
Setting up SELinux policy for Emergency number database Test: Manual; https://paste.googleplex.com/6222197494382592 Bug: 136027884 Change-Id: I29214de6b5b5a62bff246c1256567844f4ce55c7
2019-10-15 22:13:56 +02:00
# /data/misc/emergencynumberdb
type emergency_data_file, file_type, data_file_type, core_data_file_type;
Add sepolicy for profcollectd This does not yet list all the required capabilities for profcollectd, but it at least allows the service to start under permissive mode. Bug: 79161490 Test: start profcollectd Change-Id: I92c6192fa9b31840b2aba26f83a6dc9f9e835030
2020-06-18 06:43:23 +02:00
# /data/misc/profcollectd
type profcollectd_data_file, file_type, data_file_type, core_data_file_type;
Permissions for odrefresh and /data/misc/apexdata/com.android.art odrefresh is the process responsible for checking and creating ART compilation artifacts that live in the ART APEX data directory (/data/misc/apexdata/com.android.art). There are two types of change here: 1) enabling odrefresh to run dex2oat and write updated boot class path and system server AOT artifacts into the ART APEX data directory. 2) enabling the zygote and assorted diagnostic tools to use the updated AOT artifacts. odrefresh uses two file contexts: apex_art_data_file and apex_art_staging_data_file. When odrefresh invokes dex2oat, the generated files have the apex_art_staging_data_file label (which allows writing). odrefresh then moves these files from the staging area to their installation area and gives them the apex_art_data_file label. Bug: 160683548 Test: adb root && adb shell /apex/com.android.art/bin/odrefresh Change-Id: I9fa290e0c9c1b7b82be4dacb9f2f8cb8c11e4895
2020-10-16 16:29:55 +02:00
# /data/misc/apexdata/com.android.art
Refactor apex data file types. We ended up with 4 labels for specific APEX files that were all identical; I've replaced them with a single one (apex_system_server_data_file). Additionally I created an attribute to be applied to a "standard" APEX module data file type that establishes the basics (it can be managed by vold_prepare_subdirs and apexd), to make it easier to add new such types - which I'm about to do. Fix: 189415223 Test: Presubmits Change-Id: I4406f6680aa8aa0e38afddb2f3ba75f8bfbb8c3c
2021-07-12 15:21:48 +02:00
type apex_art_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type;
Permissions for odrefresh and /data/misc/apexdata/com.android.art odrefresh is the process responsible for checking and creating ART compilation artifacts that live in the ART APEX data directory (/data/misc/apexdata/com.android.art). There are two types of change here: 1) enabling odrefresh to run dex2oat and write updated boot class path and system server AOT artifacts into the ART APEX data directory. 2) enabling the zygote and assorted diagnostic tools to use the updated AOT artifacts. odrefresh uses two file contexts: apex_art_data_file and apex_art_staging_data_file. When odrefresh invokes dex2oat, the generated files have the apex_art_staging_data_file label (which allows writing). odrefresh then moves these files from the staging area to their installation area and gives them the apex_art_data_file label. Bug: 160683548 Test: adb root && adb shell /apex/com.android.art/bin/odrefresh Change-Id: I9fa290e0c9c1b7b82be4dacb9f2f8cb8c11e4895
2020-10-16 16:29:55 +02:00
# /data/misc/apexdata/com.android.art/staging
type apex_art_staging_data_file, file_type, data_file_type, core_data_file_type;
Add /data/fonts/files directory The updated font files will be stored to /data/fonts/files and all application will read it for drawing text. Thus, /data/fonts/files needs to be readable by apps and only writable by system_server (and init). Bug: 173517579 Test: atest CtsGraphicsTestCases Test: Manually done Change-Id: Ia76b109704f6214eb3f1798e8d21260343eda231
2021-01-21 22:08:31 +01:00
Add policy for CompOS APEX data files. Grant access to odsign to read & delete pending key files. Eventually we will grant the CompOS daemon write access. Bug: 190166662 Test: Via odsign; no denials seen. Change-Id: I6d3c3e5b2aec8ef65bd28cbb274d18263534ce66
2021-07-12 16:12:37 +02:00
# /data/misc/apexdata/com.android.compos
type apex_compos_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type;
Support legacy apexdata labels This partly reverts fa10a14fac28f9c407b4ff800972f9cef75fcf35. There we removed individual labels for various apexdata labels, replacing them with apex_system_server_data_file. Unfortunately that doesn't handle upgrade scenarios well, e.g. when updating system but keeping the old vendor sepolicy. The directories keep their old labels, and vold_prepare_subdirs is unable to relabel them as there is no policy to allow it to. So we bring back the legacy labels, in private not public, and add the rules needed to ensure system_server and vold_prepare_subdirs have the access they need. All the other access needed is obtained via the apex_data_file_type attribute. Bug: 217581286 Test: Reset labels using chcon, reboot, directories are relabeled, no denials Change-Id: If696882450f2634e382f217dab8f9f3882bff03f
2022-02-08 16:44:06 +01:00
# legacy labels for various /data/misc[_ce|_de]/*/apexdata directories - retained
# for backward compatibility b/217581286
type apex_appsearch_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type;
type apex_permission_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type;
type apex_scheduling_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type;
[MS82.3] Add sepolicy to access connectivity apex directory Test: m Bug: 230289468 Change-Id: I7e43c09f929a418c6c7b6bcfc3696a242c19f2d8 Merged-In: I7e43c09f929a418c6c7b6bcfc3696a242c19f2d8 (cherry picked from commit 441c149894e6ddd89dd6318e557c5728c8eebb00)
2022-05-03 15:44:35 +02:00
type apex_tethering_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type;
Support legacy apexdata labels This partly reverts fa10a14fac28f9c407b4ff800972f9cef75fcf35. There we removed individual labels for various apexdata labels, replacing them with apex_system_server_data_file. Unfortunately that doesn't handle upgrade scenarios well, e.g. when updating system but keeping the old vendor sepolicy. The directories keep their old labels, and vold_prepare_subdirs is unable to relabel them as there is no policy to allow it to. So we bring back the legacy labels, in private not public, and add the rules needed to ensure system_server and vold_prepare_subdirs have the access they need. All the other access needed is obtained via the apex_data_file_type attribute. Bug: 217581286 Test: Reset labels using chcon, reboot, directories are relabeled, no denials Change-Id: If696882450f2634e382f217dab8f9f3882bff03f
2022-02-08 16:44:06 +01:00
type apex_wifi_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type;
Add /data/fonts/files directory The updated font files will be stored to /data/fonts/files and all application will read it for drawing text. Thus, /data/fonts/files needs to be readable by apps and only writable by system_server (and init). Bug: 173517579 Test: atest CtsGraphicsTestCases Test: Manually done Change-Id: Ia76b109704f6214eb3f1798e8d21260343eda231
2021-01-21 22:08:31 +01:00
# /data/font/files
type font_data_file, file_type, data_file_type, core_data_file_type;
SELinux policy for on-device signing binary. Bug: 165630556 Test: no denials on boot Change-Id: I9d75659fb1eaea562c626ff54521f6dfb02da6b3
2020-11-27 12:23:54 +01:00
dmesgd: sepolicies dmesgd is a daemon that collects kernel memory error reports. When system_server notices that a kernel error occured, it sets the dmesgd.start system property to 1, which results in init starting dmesgd. Once that happens, dmesgd runs `dmesg` and parses its output to collect the last error report. That report, together with the headers containing device- and build-specific information is stored in Dropbox. Empirically, dmesgd needs the following permissions: - execute shell (for popen()) and toolbox (for dmesg), read system_log (for dmesg) - read /proc/version (to generate headers) - perform Binder calls to servicemanager and system_server, find dropbox_service (for dropbox) - create files in /data/misc/dmesgd (to store persistent state) Bug: 215095687 Test: run dmesgd on a user device with injected KFENCE bugs Change-Id: Iff21a2ffd99fc31b89a58ac774299b5e922721ea
2022-01-28 19:48:27 +01:00
# /data/misc/dmesgd
type dmesgd_data_file, file_type, data_file_type, core_data_file_type;
Add odrefresh_data_file for odrefresh metrics Metrics are written to /data/misc/odrefresh by odrefresh during early boot, then native code in ART system_server initialization passes them to statsd and deletes the metrics files. This hand-off is necessary because statsd does not start until after odsign and odrefresh have run. Bug: 169925964 Test: manual Change-Id: I8054519a714907819886dd6e5e78f3b5796d0898
2021-04-09 16:17:38 +02:00
# /data/misc/odrefresh
type odrefresh_data_file, file_type, data_file_type, core_data_file_type;
SELinux policy for on-device signing binary. Bug: 165630556 Test: no denials on boot Change-Id: I9d75659fb1eaea562c626ff54521f6dfb02da6b3
2020-11-27 12:23:54 +01:00
# /data/misc/odsign
type odsign_data_file, file_type, data_file_type, core_data_file_type;
Revert^2 "Introduce derive_classpath." 5fd85de907f9c22ab7a540b5b3dda156962c18bc Bug: 180105615 Test: manual boot of cuttlefish and gphone emulator Change-Id: I9e43268d3b745e65b5ccc0a4896a7e55a253659d
2021-03-19 12:08:49 +01:00
Selinux setup for /data/misc/odsign/metrics/ odsign will be writing(metrics) to file /data/misc/odsign/metrics/odsign-metrics.txt & system_server needs from it. Test: adb pull /data/misc/odsign/metrics/odsign-metrics.txt after reboot Bug: 202926606 Change-Id: I020efcee8ca7f5b81f1aa3374bbf2b3a7403186d
2022-02-24 12:50:35 +01:00
# /data/misc/odsign_metrics
type odsign_metrics_file, file_type, data_file_type, core_data_file_type;
Set sepolicy for VirtualizationService data directory and mk_cdisk. Bug: 184131523 Test: atest VirtualizationTestCases Test: flashed on VIM3L and ran microdroid manually Change-Id: I6d1b69b63debf44431cd542a0ee85748fcc4191b
2021-05-19 19:10:43 +02:00
# /data/misc/virtualizationservice
type virtualizationservice_data_file, file_type, data_file_type, core_data_file_type;
Revert^2 "Introduce derive_classpath." 5fd85de907f9c22ab7a540b5b3dda156962c18bc Bug: 180105615 Test: manual boot of cuttlefish and gphone emulator Change-Id: I9e43268d3b745e65b5ccc0a4896a7e55a253659d
2021-03-19 12:08:49 +01:00
# /data/system/environ
type environ_system_data_file, file_type, data_file_type, core_data_file_type;
Add crosvm domain and give virtmanager and crosvm necessary permissions. Bug: 183583115 Test: make TARGET_KERNEL_USE=5.4 TARGET_VIM3L=true Change-Id: I566436fa2d27597566014f2a63198a88d6d2dbd6
2021-03-29 19:19:12 +02:00
Label /data/bootanim with bootanim_data_file. Bug: 16529906 Test: /data/bootanim is labeled correctly. BootAnimation can access this folder. Change-Id: Ic6a438d7a139b4864c4795dcac613cb819a81631
2021-12-23 23:37:41 +01:00
# /data/bootanim
type bootanim_data_file, file_type, data_file_type, core_data_file_type;
Add crosvm domain and give virtmanager and crosvm necessary permissions. Bug: 183583115 Test: make TARGET_KERNEL_USE=5.4 TARGET_VIM3L=true Change-Id: I566436fa2d27597566014f2a63198a88d6d2dbd6
2021-03-29 19:19:12 +02:00
# /dev/kvm
type kvm_device, dev_type;
Enable odrefresh to work with composd. composd spawns odrefresh in its usual domain. odrefresh then spawns fd_server in a different domain, and makes binder calls back to composd to perform individual compilation steps. fd_server is fairly generic, and part of the virt APEX, but this instance is specific to composd (e.g. it has access to ART files), so I named the domain composd_fd_server. Bug: 186126194 Test: Run composd_cmd, artifacts generated Change-Id: I5a431dd00b5b396a67021c618fc6edcfb25aa21b
2021-09-21 14:32:24 +02:00
# /apex/com.android.virt/bin/fd_server
type fd_server_exec, system_file_type, exec_type, file_type;
Add type and mapping for /metadata/sepolicy Test: make -j; launch_cvd; adb shell ls -laZ /metadata Bug: 199914227 Change-Id: I573af0949d92f401589238dab8c3e9fbe2ee7efe
2021-11-17 08:51:11 +01:00
Modify sepolicy for compos key changes Add the compos_key_helper domain for the process which has access to the signing key, make sure it can't be crashdumped. Also extend that protection to diced & its HAL. Rename compos_verify_key to compos_verify, because it doesn't verify keys any more. Move exec types used by Microdroid to file.te in the host rather than their own dedicated files. Bug: 218494522 Test: atest CompOsSigningHostTest CompOsDenialHostTest Change-Id: I942667355d8ce29b3a9eb093e0b9c4f6ee0df6c1
2022-02-14 15:33:37 +01:00
# /apex/com.android.compos/bin/compsvc
type compos_exec, exec_type, file_type, system_file_type;
# /apex/com.android.compos/bin/compos_key_helper
type compos_key_helper_exec, exec_type, file_type, system_file_type;
Add type and mapping for /metadata/sepolicy Test: make -j; launch_cvd; adb shell ls -laZ /metadata Bug: 199914227 Change-Id: I573af0949d92f401589238dab8c3e9fbe2ee7efe
2021-11-17 08:51:11 +01:00
# /metadata/sepolicy
type sepolicy_metadata_file, file_type;
Policy for using Apex sepolicy Bug: 199914227 Test: aosp/1910032 Change-Id: I0726facbf0c28c486ef6501718a6013a040e4b0e
2021-12-03 15:21:54 +01:00
# /dev/selinux/test - used to verify that apex sepolicy is loaded and
# property labeled.
type sepolicy_test_file, file_type;
Reference in a new issue Copy permalink