tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/private/compat/28.0/28.0.ignore.cil

74 lines
1.7 KiB
Text
Raw Normal View History

Add mapping files for 28.0.[ignore.]cil Steps taken to produce the mapping files: 1. Add prebuilts/api/28.0/[plat_pub_versioned.cil|vendor_sepolicy.cil] from the /vendor/etc/selinux/[plat_pub_versioned.cil|vendor_sepolicy.cil] files built on pi-dev with lunch target aosp_arm64-eng 2. Add new file private/compat/28.0/28.0.cil by doing the following: - copy /system/etc/selinux/mapping/28.0.cil from pi-dev aosp_arm64-eng device to private/compat/28.0/28.0.cil - remove all attribute declaration statement (typeattribute ...) and sort lines alphabetically - some selinux types were added/renamed/deleted w.r.t 28 sepolicy. Find all such types using treble_sepolicy_tests_28.0 test. - for all these types figure out where to map them by looking at 27.0.[ignore.]cil files and add approprite entries to 28.0.[ignore.]cil. This change also enables treble_sepolicy_tests_28.0 and install 28.0.cil mapping onto the device. Bug: 72458734 Test: m selinux_policy Change-Id: I90e17c0b43af436da4b62c16179c198b5c74002c
2018-07-11 11:30:44 +02:00
;; new_objects - a collection of types that have been introduced that have no
;; analogue in older policy. Thus, we do not need to map these types to
;; previous ones. Add here to pass checkapi tests.
Only maintain maps between current and previous selinux versions. New maintenance scheme for mapping files: Say, V is the current SELinux platform version, then at any point in time we only maintain (V->V-1) mapping. (V->V-n) map is constructed from top (V->V-n+1) and bottom (V-n+1->V-n) without changes to previously maintained mapping files. Caveats: - 26.0.cil doesn't technically represent 27.0->26.0 map, but rather current->26.0. We'll fully migrate to the scheme with future releases. Bug: 67510052 Test: adding new public type only requires changing the latest compat map Change-Id: Iab5564e887ef2c8004cb493505dd56c6220c61f8
2018-09-30 02:47:10 +02:00
(type new_objects)
Add mapping files for 28.0.[ignore.]cil Steps taken to produce the mapping files: 1. Add prebuilts/api/28.0/[plat_pub_versioned.cil|vendor_sepolicy.cil] from the /vendor/etc/selinux/[plat_pub_versioned.cil|vendor_sepolicy.cil] files built on pi-dev with lunch target aosp_arm64-eng 2. Add new file private/compat/28.0/28.0.cil by doing the following: - copy /system/etc/selinux/mapping/28.0.cil from pi-dev aosp_arm64-eng device to private/compat/28.0/28.0.cil - remove all attribute declaration statement (typeattribute ...) and sort lines alphabetically - some selinux types were added/renamed/deleted w.r.t 28 sepolicy. Find all such types using treble_sepolicy_tests_28.0 test. - for all these types figure out where to map them by looking at 27.0.[ignore.]cil files and add approprite entries to 28.0.[ignore.]cil. This change also enables treble_sepolicy_tests_28.0 and install 28.0.cil mapping onto the device. Bug: 72458734 Test: m selinux_policy Change-Id: I90e17c0b43af436da4b62c16179c198b5c74002c
2018-07-11 11:30:44 +02:00
(typeattribute new_objects)
(typeattributeset new_objects
Only maintain maps between current and previous selinux versions. New maintenance scheme for mapping files: Say, V is the current SELinux platform version, then at any point in time we only maintain (V->V-1) mapping. (V->V-n) map is constructed from top (V->V-n+1) and bottom (V-n+1->V-n) without changes to previously maintained mapping files. Caveats: - 26.0.cil doesn't technically represent 27.0->26.0 map, but rather current->26.0. We'll fully migrate to the scheme with future releases. Bug: 67510052 Test: adding new public type only requires changing the latest compat map Change-Id: Iab5564e887ef2c8004cb493505dd56c6220c61f8
2018-09-30 02:47:10 +02:00
( new_objects
activity_task_service
Add mapping files for 28.0.[ignore.]cil Steps taken to produce the mapping files: 1. Add prebuilts/api/28.0/[plat_pub_versioned.cil|vendor_sepolicy.cil] from the /vendor/etc/selinux/[plat_pub_versioned.cil|vendor_sepolicy.cil] files built on pi-dev with lunch target aosp_arm64-eng 2. Add new file private/compat/28.0/28.0.cil by doing the following: - copy /system/etc/selinux/mapping/28.0.cil from pi-dev aosp_arm64-eng device to private/compat/28.0/28.0.cil - remove all attribute declaration statement (typeattribute ...) and sort lines alphabetically - some selinux types were added/renamed/deleted w.r.t 28 sepolicy. Find all such types using treble_sepolicy_tests_28.0 test. - for all these types figure out where to map them by looking at 27.0.[ignore.]cil files and add approprite entries to 28.0.[ignore.]cil. This change also enables treble_sepolicy_tests_28.0 and install 28.0.cil mapping onto the device. Bug: 72458734 Test: m selinux_policy Change-Id: I90e17c0b43af436da4b62c16179c198b5c74002c
2018-07-11 11:30:44 +02:00
adb_service
Add app_binding system service Bug: 109809543 Test: Build and boot with the new service in the internal branch. Change-Id: Iaee365771c3e8e5b8f5f3b6112bbf902c6bb02bd
2018-09-05 02:13:16 +02:00
app_binding_service
Add policy for apexd. apexd is a new daemon for managing APEX packages installed on the device. It hosts a single binder service, "apexservice". Bug: 112455435 Test: builds, binder service can be registered, apexes can be accessed, verified and mounted Change-Id: I634ad100f10b2edcd9a9c0df0d33896fa5d4ed97
2018-08-17 09:35:42 +02:00
apex_data_file
apex_mnt_dir
apex_key_file
apex_service
apexd
apexd_exec
apexd exports its status via sysprop A sysprop apexd.status is set by apexd, to that other components (i.e. init) can determine whether APEXs are all successfully mounted or no (i.e., being mounted). The sysprop is only writable by apexd. Bug: 117403679 Test: adb shell getprop apexd.status returns 'ready'. Change-Id: I81bcb96e6c5cb9d899f29ffa84f91eab3820be25
2018-11-01 12:05:20 +01:00
apexd_prop
Add policy for apexd. apexd is a new daemon for managing APEX packages installed on the device. It hosts a single binder service, "apexservice". Bug: 112455435 Test: builds, binder service can be registered, apexes can be accessed, verified and mounted Change-Id: I634ad100f10b2edcd9a9c0df0d33896fa5d4ed97
2018-08-17 09:35:42 +02:00
apexd_tmpfs
Rename biometric_prompt_service to biometric_service Bug: 111461540 Bug: 112570477 Test: builds Change-Id: Icc68720ebe931c2d917703b2d34aa0f4eec3f549 Merged-In: Icc68720ebe931c2d917703b2d34aa0f4eec3f549
2018-09-21 05:32:32 +02:00
biometric_service
Add new cpu variant related rules to SELinux I added ro.bionic.(2nd_)?_(arch|cpu_variant) to vendor system properties. And have init to write them to files under dev/. This change set SELinux rules for these properties and files. For the system properties: vendor/default.prop will set them. init will read them. For the files /dev/cpu_variant:.*: init will write them. bionic libc will read them. (Basically world readable). This is to allow libc select the right optimized routine at runtime. Like memcpy / strcmp etc. Test: getprop to make sure the properties are set. Test: ls -laZ to make sure /dev/cpu_variant:.* are correctly labeled. Change-Id: I41662493dce30eae6d41bf0985709045c44247d3
2018-11-06 00:03:16 +01:00
cpu_variant_prop
dev_cpu_variant
sepolicy for server configurable flags Test: manual on device Change-Id: Ibafe1b345489c88a49a7ed3e2e61e5cc5e1880a1
2018-10-26 05:09:55 +02:00
device_config_boot_count_prop
Sepolicies for server configural flags reset Test: m -j succeeded and manual tested on device Change-Id: I3415c58335361a9da4ef2368e61bc4e0250a91bb
2018-11-09 01:46:19 +01:00
device_config_reset_performed_prop
sepolicies for sys prop enabling flag health check device_config_flags_health_check_prop is used for enabling/disabling program flags_health_check which is executed during device booting. "1" means enabling health check actions in flags_health_check, other values mean flags_health_check will not perform any action. Test: build succeeded & manual test Change-Id: I93739dc5d155e057d72d08fd13097eb63c1193b5
2018-11-16 01:27:18 +01:00
device_config_flags_health_check_prop
Add placeholder sepolicy for iris and face See aosp/660242 and aosp/608396 Fixes: 116530289 Test: builds Change-Id: I220ece0d6751839fe764ff91fd7bd20c50104f8f
2018-09-01 03:14:16 +02:00
face_service
Add sepolicy for fastbootd Also allow adb and fastboot to talk to recovery through recovery_socket. This enables changing between modes with usb commands. Test: No selinux denials Bug: 78793464 Change-Id: I80c54d4eaf3b94a1fe26d2280af4e57cb1593790
2018-05-29 19:54:16 +02:00
fastbootd
sepolicy for server configurable flags Test: manual on device Change-Id: Ibafe1b345489c88a49a7ed3e2e61e5cc5e1880a1
2018-10-26 05:09:55 +02:00
flags_health_check
flags_health_check_exec
Sepolicy for bufferhub hwservice Bug: 118124442 Test: device can boot with android.frameworks.bufferhub@1.0-service running Change-Id: I1d186d5350671b0d2dd4e831429b8fba828316e0
2018-10-21 03:33:41 +02:00
fwk_bufferhub_hwservice
Update sepolicies for stats hal Bug: 116732452 Test: No sepolicy violations observed with this change (cherry picked from commit I1958182dd8ecc496625da2a2a834f71f5d43e7bb) Change-Id: Ib386767d8acfacf9fedafd9a79dd555ce233f41c
2018-09-28 22:34:37 +02:00
fwk_stats_hwservice
Add color_service selinux policy Bug: 111215474 Test: boots Change-Id: I98955bcd02f643400c3eb97232467c09a2c5c1e5
2018-08-18 03:47:47 +02:00
color_display_service
Add atrace HAL 1.0 sepolicy Bug: 111098596 Test: atrace/systrace (cherry picked from commit 9ed5cf6e430a864630c2451bf35f18ac7668c12b) Change-Id: I97772ff21754d03a0aea0d53b39e8da5312a17c0
2018-09-20 01:06:28 +02:00
hal_atrace_hwservice
health.filesystem HAL renamed to health.storage ...to reflect that the HAL operates on storage devices, not filesystem. Bug: 111655771 Test: compiles Change-Id: Ibb0572cb1878359e5944aa6711331f0c7993ba6e Merged-In: Ibb0572cb1878359e5944aa6711331f0c7993ba6e
2018-09-19 19:24:45 +02:00
hal_health_storage_hwservice
Sepolicy for system suspend HAL. Bug: 78888165 Test: device can boot with HAL running. Change-Id: I3bf7c8203e038b892176c97ec006152a2904c7be
2018-04-09 02:15:08 +02:00
hal_system_suspend_default
hal_system_suspend_default_exec
hal_system_suspend_default_tmpfs
Add heapprofd selinux config. This does not actually grant any permissions but just adds the necessary boilerplate for a new service. Bug: 117762471 Bug: 117761873 Change-Id: I7cdd2ae368616cfd54fc685c15f775604bfc80d4
2018-10-15 19:02:02 +02:00
heapprofd
heapprofd_exec
Property to enable heap profile from process startup. This is world-readable so it can be checked in libc's process init. Test: m Test: flash sailfish Bug: 117821125 Change-Id: Iac7317ceb75b5ad9cfb9adabdf16929263fa8a9d
2018-11-08 14:58:13 +01:00
heapprofd_prop
Add heapprofd selinux config. This does not actually grant any permissions but just adds the necessary boilerplate for a new service. Bug: 117762471 Bug: 117761873 Change-Id: I7cdd2ae368616cfd54fc685c15f775604bfc80d4
2018-10-15 19:02:02 +02:00
heapprofd_socket
Add idmap2 and idmap2d Bug: 78815803 Test: builds, boots Test: manual: adb shell idmap2 create ... Test: manual: adb shell ps | grep -e idmap2d Change-Id: I60852e15d99329896ff9de6559d1e7cd1c67e33d
2018-06-15 08:08:19 +02:00
idmap_service
New service: intelligence_service Bug: 111276913 Test: manual verification Change-Id: Icb309bb07e4e4b39cdc912b1d3dc1ece9cb55f5f
2018-08-31 00:09:50 +02:00
intelligence_service
Add placeholder sepolicy for iris and face See aosp/660242 and aosp/608396 Fixes: 116530289 Test: builds Change-Id: I220ece0d6751839fe764ff91fd7bd20c50104f8f
2018-09-01 03:14:16 +02:00
iris_service
Add mapping files for 28.0.[ignore.]cil Steps taken to produce the mapping files: 1. Add prebuilts/api/28.0/[plat_pub_versioned.cil|vendor_sepolicy.cil] from the /vendor/etc/selinux/[plat_pub_versioned.cil|vendor_sepolicy.cil] files built on pi-dev with lunch target aosp_arm64-eng 2. Add new file private/compat/28.0/28.0.cil by doing the following: - copy /system/etc/selinux/mapping/28.0.cil from pi-dev aosp_arm64-eng device to private/compat/28.0/28.0.cil - remove all attribute declaration statement (typeattribute ...) and sort lines alphabetically - some selinux types were added/renamed/deleted w.r.t 28 sepolicy. Find all such types using treble_sepolicy_tests_28.0 test. - for all these types figure out where to map them by looking at 27.0.[ignore.]cil files and add approprite entries to 28.0.[ignore.]cil. This change also enables treble_sepolicy_tests_28.0 and install 28.0.cil mapping onto the device. Bug: 72458734 Test: m selinux_policy Change-Id: I90e17c0b43af436da4b62c16179c198b5c74002c
2018-07-11 11:30:44 +02:00
llkd
llkd_exec
llkd: Add stack symbol checking llkd needs the ptrace capabilities and dac override to monitor for live lock conditions on the stack dumps. Test: compile Bug: 33808187 Change-Id: Ibc1e4cc10395fa9685c4ef0ca214daf212a5e126
2018-08-08 01:03:47 +02:00
llkd_prop
Add mapping files for 28.0.[ignore.]cil Steps taken to produce the mapping files: 1. Add prebuilts/api/28.0/[plat_pub_versioned.cil|vendor_sepolicy.cil] from the /vendor/etc/selinux/[plat_pub_versioned.cil|vendor_sepolicy.cil] files built on pi-dev with lunch target aosp_arm64-eng 2. Add new file private/compat/28.0/28.0.cil by doing the following: - copy /system/etc/selinux/mapping/28.0.cil from pi-dev aosp_arm64-eng device to private/compat/28.0/28.0.cil - remove all attribute declaration statement (typeattribute ...) and sort lines alphabetically - some selinux types were added/renamed/deleted w.r.t 28 sepolicy. Find all such types using treble_sepolicy_tests_28.0 test. - for all these types figure out where to map them by looking at 27.0.[ignore.]cil files and add approprite entries to 28.0.[ignore.]cil. This change also enables treble_sepolicy_tests_28.0 and install 28.0.cil mapping onto the device. Bug: 72458734 Test: m selinux_policy Change-Id: I90e17c0b43af436da4b62c16179c198b5c74002c
2018-07-11 11:30:44 +02:00
llkd_tmpfs
Add looper_stats_service to SE policy. Test: Built and flashed an image. Bug: 113651685 Change-Id: Ide239432ea8a5701d91c00edd06ad3e52560a3f7
2018-08-30 14:04:55 +02:00
looper_stats_service
iorapd: Add new binder service iorapd. This daemon is very locked down. Only system_server can access it. Bug: 72170747 Change-Id: I7b72b9191cb192be96001d84d067c28292c9688f
2018-10-05 23:48:29 +02:00
iorapd
iorapd_exec
iorapd_data_file
iorapd_service
iorapd_tmpfs
add mediaswcodec service Set up a new service for sw media codec services. Bug: 111407413 Test: cts-tradefed run cts-dev --module CtsMediaTestCases --compatibility:module-arg CtsMediaTestCases:include-annotation:android.platform.test.annotations.RequiresDevice Change-Id: Ia1c6a9ef3f0c1d84b2be8756eb1853ffa0597f8e
2018-09-20 21:07:44 +02:00
mediaswcodec
mediaswcodec_exec
mediaswcodec_tmpfs
Add mapping files for 28.0.[ignore.]cil Steps taken to produce the mapping files: 1. Add prebuilts/api/28.0/[plat_pub_versioned.cil|vendor_sepolicy.cil] from the /vendor/etc/selinux/[plat_pub_versioned.cil|vendor_sepolicy.cil] files built on pi-dev with lunch target aosp_arm64-eng 2. Add new file private/compat/28.0/28.0.cil by doing the following: - copy /system/etc/selinux/mapping/28.0.cil from pi-dev aosp_arm64-eng device to private/compat/28.0/28.0.cil - remove all attribute declaration statement (typeattribute ...) and sort lines alphabetically - some selinux types were added/renamed/deleted w.r.t 28 sepolicy. Find all such types using treble_sepolicy_tests_28.0 test. - for all these types figure out where to map them by looking at 27.0.[ignore.]cil files and add approprite entries to 28.0.[ignore.]cil. This change also enables treble_sepolicy_tests_28.0 and install 28.0.cil mapping onto the device. Bug: 72458734 Test: m selinux_policy Change-Id: I90e17c0b43af436da4b62c16179c198b5c74002c
2018-07-11 11:30:44 +02:00
mnt_product_file
fs_mgr: add overlayfs handling for squashfs system filesystems /cache/overlay directory in support of overlayfs mounts on userdebug and eng devices. Overlayfs in turn can be capable of supporting adb remount for read-only or restricted-storage filesystems like squashfs or right-sized (zero free space) system partitions respectively. Test: compile Bug: 109821005 Bug: 110985612 Change-Id: I3ece03886db7cc97f864497cf93ec6c6c39bccd1
2018-06-13 17:02:29 +02:00
overlayfs_file
Add sepolicy for fastbootd Also allow adb and fastboot to talk to recovery through recovery_socket. This enables changing between modes with usb commands. Test: No selinux denials Bug: 78793464 Change-Id: I80c54d4eaf3b94a1fe26d2280af4e57cb1593790
2018-05-29 19:54:16 +02:00
recovery_socket
Add SELinux service for RoleManagerService Test: ensure no build failures; add RoleManagerService as a boot phase ensure no SecurityException in logcat on boot Change-Id: Ia0803c0fb084fe2b12f5c20f5e46354d0dd1aedf
2018-11-09 02:37:45 +01:00
role_service
Define 'super_block_device' type Bug: 78793464 Test: fastboot getvar partition-size:super 'super_block_device' corresponds to the super partition required for flashing dynamic partitions. Change-Id: I323634b6797ead7c5face117a7028bf9ab947aea
2018-08-17 20:07:09 +02:00
super_block_device
Selinux: Allow lmkd write access to sys.lmk. properties Allow lmkd write access to sys.lmk. properties to be able to set sys.lmk.minfree_levels. Bug: 111521182 Test: getprop sys.lmk.minfree_levels returns value set by lmkd Change-Id: I86ff11d75917966857d3a76876a56799bb92a5ad Signed-off-by: Suren Baghdasaryan <surenb@google.com>
2018-07-25 02:04:18 +02:00
system_lmk_prop
Sepolicy for system suspend HAL. Bug: 78888165 Test: device can boot with HAL running. Change-Id: I3bf7c8203e038b892176c97ec006152a2904c7be
2018-04-09 02:15:08 +02:00
system_suspend_hwservice
Sepolicies for server configural flags reset Test: m -j succeeded and manual tested on device Change-Id: I3415c58335361a9da4ef2368e61bc4e0250a91bb
2018-11-09 01:46:19 +01:00
server_configurable_flags_data_file
Add mapping files for 28.0.[ignore.]cil Steps taken to produce the mapping files: 1. Add prebuilts/api/28.0/[plat_pub_versioned.cil|vendor_sepolicy.cil] from the /vendor/etc/selinux/[plat_pub_versioned.cil|vendor_sepolicy.cil] files built on pi-dev with lunch target aosp_arm64-eng 2. Add new file private/compat/28.0/28.0.cil by doing the following: - copy /system/etc/selinux/mapping/28.0.cil from pi-dev aosp_arm64-eng device to private/compat/28.0/28.0.cil - remove all attribute declaration statement (typeattribute ...) and sort lines alphabetically - some selinux types were added/renamed/deleted w.r.t 28 sepolicy. Find all such types using treble_sepolicy_tests_28.0 test. - for all these types figure out where to map them by looking at 27.0.[ignore.]cil files and add approprite entries to 28.0.[ignore.]cil. This change also enables treble_sepolicy_tests_28.0 and install 28.0.cil mapping onto the device. Bug: 72458734 Test: m selinux_policy Change-Id: I90e17c0b43af436da4b62c16179c198b5c74002c
2018-07-11 11:30:44 +02:00
time_prop
timedetector_service
timezonedetector_service
Added sepolicy for uri_grants service Bug: 80414790 Test: boots Change-Id: I15233721fa138e0fdf1a30f66d52b64cbab18b81
2018-07-22 08:21:08 +02:00
uri_grants_service
Allow system_server to read vendor_file Input device configuration files .idc, .kl that are placed in /vendor are currently not accessible. Allow the read access here. Bug: 112880217 Test: move .idc and .kl files from /system to /vendor, then observe logcat. With this patch, avc denials disappear. Change-Id: I72ad62b9adf415f787565adced73fd8aaff38832
2018-10-08 21:04:15 +02:00
vendor_idc_file
vendor_keychars_file
vendor_keylayout_file
Move watchdogd out of init and into its own domain Bug: 73660730 Test: watchdogd still runs Change-Id: I31697c7c6fa2f7009731ff48c659af051838e42f
2018-08-02 00:48:20 +02:00
vrflinger_vsync_service
watchdogd_tmpfs))
Reference in a new issue Copy permalink