tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/private/service_contexts

189 lines
14 KiB
Text
Raw Normal View History

Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
accessibility u:object_r:accessibility_service:s0
account u:object_r:account_service:s0
activity u:object_r:activity_service:s0
alarm u:object_r:alarm_service:s0
update_engine: Allow to access bootctrl_block_device. update_engine needs to access bootctrl_block_device to get and set the slot to boot. avc: denied { write } for name="mmcblk0boot1" dev="tmpfs" ino=1266 scontext=u:r:update_engine:s0 tcontext=u:object_r:bootctrl_block_device:s0 tclass=blk_file avc: denied { open } for path="/dev/block/mmcblk0boot1" dev="tmpfs" ino=1266 scontext=u:r:update_engine:s0 tcontext=u:object_r:bootctrl_block_device:s0 tclass=blk_file Also track the name change of the native binder service. avc: denied { add } for service=android.os.UpdateEngineService pid=210 uid=0 scontext=u:r:update_engine:s0 tcontext=u:object_r:default_android_service:s0 tclass=service_manager Bug: 27106053 Change-Id: Idbfef18578489db33fead0721e8f26d63db5ce09 (cherry picked from commit 3ec34ceb43b15c30e9c7bf1720ebea24f868d07a)
2016-02-09 23:12:58 +01:00
android.os.UpdateEngineService u:object_r:update_engine_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
android.security.keystore u:object_r:keystore_service:s0
SELinux permissions for gatekeeper TEE proxy sets up: - execute permissions - binder permission (system_server->gatekeeper->keystore) - prevents dumpstate and shell from finding GK binder service - neverallow rules for prohibited clients Change-Id: I1817933a91de625db469a20c7a4c8e2ca46efa1e
2015-04-04 01:46:33 +02:00
android.service.gatekeeper.IGateKeeperService u:object_r:gatekeeper_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
appops u:object_r:appops_service:s0
appwidget u:object_r:appwidget_service:s0
assetatlas u:object_r:assetatlas_service:s0
audio u:object_r:audio_service:s0
Creates an autofill system service. BUG: 31001899 Test: manual Change-Id: I8d462b40d931310eab26bafa09645ac88f13fc97
2016-10-18 01:25:36 +02:00
autofill u:object_r:autofill_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
backup u:object_r:backup_service:s0
Mark batteryproperties service as app_api_service. Applications do not explicitly request handles to the batteryproperties service, but the BatteryManager obtains a reference to it and uses it for its underlying property queries. Mark it as an app_api_service so that all applications may use this API. Also remove the batterypropreg service label, as this does not appear to be used and may have been a duplication of batteryproperties. As a result, remove the healthd_service type and replace it with a more specific batteryproperties_service type. (cherry-picked from commit: 9ed71eff4bed91653cba393ea6cb42f041d4e257) Bug: 27442760 Change-Id: I537c17c09145b302728377bf856c1147e4cc37e9
2016-03-14 20:21:18 +01:00
batteryproperties u:object_r:batteryproperties_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
batterystats u:object_r:batterystats_service:s0
battery u:object_r:battery_service:s0
Added SELinux policy for BinderCallsStatsService Test: manual Bug: 75318418 Merged-In: I700c1b8b613dba1c99f4fbffdd905c0052c1b2e7 Change-Id: I700c1b8b613dba1c99f4fbffdd905c0052c1b2e7
2018-01-11 03:11:22 +01:00
binder_calls_stats u:object_r:binder_calls_stats_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
bluetooth_manager u:object_r:bluetooth_manager_service:s0
Add missing services to service_contexts. Add missing services related to battery, bluetooth, time, and radio to service_contexts. Change-Id: I8bf05feb173d49637048c779757013806837fede
2014-06-26 21:36:43 +02:00
bluetooth u:object_r:bluetooth_service:s0
Add SEPolicy for new Java-based Broadcast Radio service. Bug: b/36863239 Test: manual Change-Id: I7e929926efbb1570ea9723ef3810a511c71dc11a (cherry picked from commit 38f0928fb05793b91651ba9787e4da8c2cd5afd3)
2017-06-22 16:55:16 +02:00
broadcastradio u:object_r:broadcastradio_service:s0
Whitelist new carrier config service. This service will be implemented in packages/services/Telephony. Bug: 19483786 Change-Id: Ia9a90bc859108d8657cae551d657e2fcdc261f88
2015-03-25 22:46:54 +01:00
carrier_config u:object_r:radio_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
clipboard u:object_r:clipboard_service:s0
com.android.net.IProxyService u:object_r:IProxyService_service:s0
commontime_management u:object_r:commontime_management_service:s0
New service name for IpConnectivity metrics (cherry picked from commit f412cc623f26c95706e0966daa49207028487281) Bug: 31254800 Change-Id: If8708c8a4e0ea7655f31028881248a14cf2ba5f7
2016-09-09 08:57:24 +02:00
common_time.clock u:object_r:mediaserver_service:s0
common_time.config u:object_r:mediaserver_service:s0
Remove underscore from Companion service name Fixes: 37536706 Test: Ensure no boot-time error and companion functionality works Change-Id: I80ced92cb62aa10e1847980eb9a169af3bcd21f0
2017-04-20 20:19:16 +02:00
companiondevice u:object_r:companion_device_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
connectivity u:object_r:connectivity_service:s0
New service name for IpConnectivity metrics (cherry picked from commit f412cc623f26c95706e0966daa49207028487281) Bug: 31254800 Change-Id: If8708c8a4e0ea7655f31028881248a14cf2ba5f7
2016-09-09 08:57:24 +02:00
connmetrics u:object_r:connmetrics_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
consumer_ir u:object_r:consumer_ir_service:s0
content u:object_r:content_service:s0
Change the name advertised by the context hub service. Bring the context hub service advertised name into compliance with the other Android services. This changes the name from "contexthub_service" to "context". Test: GTS tests pass. Change-Id: I8490d60f89bdb97813e328b9ddf08270470fda76
2016-12-27 18:29:15 +01:00
contexthub u:object_r:contexthub_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
country_detector u:object_r:country_detector_service:s0
Add coverage service. Bug: 31077138 Test: Device boots, coverage service works when tested manually. Change-Id: Ia855cfefd5c25be5d1d8db48908c04b3616b5504
2016-12-01 03:27:03 +01:00
coverage u:object_r:coverage_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
cpuinfo u:object_r:cpuinfo_service:s0
Add selinux policy for CrossProfileAppsService CrossProfileAppsService allows apps to do limited cross profile operations, like checking the caller package is installed in the specified user. It is similar to LauncherAppsService in some sense. Change-Id: I26e383a57c32c4dc9b779752b20000b283a5bfdc Fix: 67765768 Test: Built with ag/3063260. Can boot and verified those APIs are working.
2017-10-13 15:48:32 +02:00
crossprofileapps u:object_r:crossprofileapps_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
dbinfo u:object_r:dbinfo_service:s0
device_policy u:object_r:device_policy_service:s0
Move device serial behing a permission - selinux Build serial is non-user resettable freely available device identifier. It can be used by ad-netowrks to track the user across apps which violates the user's privacy. This change deprecates Build.SERIAL and adds a new Build.getSerial() API which requires holding the read_phone_state permission. The Build.SERIAL value is set to "undefined" for apps targeting high enough SDK and for legacy app the value is still available. bug:31402365 Change-Id: I6309aa58c8993b3db4fea7b55aae05592408b6e4
2016-09-12 20:58:08 +02:00
device_identifiers u:object_r:device_identifiers_service:s0
Add rule for new deviceidle service. Change-Id: I283663caea0ee1597645856fb31f13b26e902315
2015-03-19 02:33:47 +01:00
deviceidle u:object_r:deviceidle_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
devicestoragemonitor u:object_r:devicestoragemonitor_service:s0
diskstats u:object_r:diskstats_service:s0
display u:object_r:display_service:s0
Change name in the rules after renaming dns_listener -> netd_listener Change-Id: I4737a087f2d00e1028d1cb43d9eda814a008dbe8
2016-09-01 11:08:57 +02:00
netd_listener u:object_r:netd_listener_service:s0
Add network watchlist service SELinux policy rules Bug: 63908748 Test: built, flashed, able to boot Change-Id: I3cfead1d687112b5f8cd485c8f84083c566fbce2
2017-11-13 18:52:05 +01:00
network_watchlist u:object_r:network_watchlist_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
DockObserver u:object_r:DockObserver_service:s0
dreams u:object_r:dreams_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
drm.drmManager u:object_r:drmserver_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
dropbox u:object_r:dropbox_service:s0
Added permissions for the dumpstate service. - Allow dumpstate to create the dumpservice service. - Allow System Server and Shell to find that service. - Don't allow anyone else to create that service. - Don't allow anyone else to find that service. BUG: 31636879 Test: manual verification Change-Id: I642fe873560a2b123e6bafde645467d45a5f5711
2016-10-29 00:52:15 +02:00
dumpstate u:object_r:dumpstate_service:s0
Define selinux context for econtroller. Bug: 33075886 Test: N/A Change-Id: I1654ee20fa6125cf3ed5c0796e85f289db5a9745
2017-03-02 19:36:17 +01:00
econtroller u:object_r:radio_service:s0
Add EuiccCardManager and EuiccCardController. Bug: 38206971 Test: test on phone Change-Id: Id34ab2673c7a16744fba77eb5c176e2e8b474299
2017-12-22 03:42:24 +01:00
euicc_card_controller u:object_r:radio_service:s0
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
lowpan u:object_r:lowpan_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
ethernet u:object_r:ethernet_service:s0
fingerprint u:object_r:fingerprint_service:s0
Declare new Fonts service Merged-In: Id2b849d7fa22989225066ebe487fc98d319743ea Bug: 34190490 Test: CTS in internal master Change-Id: I27ab62469f3a405c59eda1a2a249899e845bed56
2017-01-23 12:10:24 +01:00
font u:object_r:font_service:s0
Add selinux policy for fingerprintd Change-Id: Ibcb714248c28abf21272986facaade376dcbd7ef
2015-05-13 00:16:06 +02:00
android.hardware.fingerprint.IFingerprintDaemon u:object_r:fingerprintd_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
gfxinfo u:object_r:gfxinfo_service:s0
Add graphicsstats service Change-Id: I156b139b57f46c695ece35b7b26a3087d87b25df
2015-03-23 15:56:37 +01:00
graphicsstats u:object_r:graphicsstats_service:s0
Define gpu_service and allow surfaceflinger to provide it Bug: 26620936 and 27352427 Change-Id: I3d6d2e479d95133693790a97827e45e9dd30bc4a
2016-03-27 07:56:27 +02:00
gpu u:object_r:gpu_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
hardware u:object_r:hardware_service:s0
Renamed hardwareproperties to hardware_properties Bug: 27531271 Change-Id: I3c5eee86d09696373ab155f93ba6c85da224cb51
2016-03-09 18:13:11 +01:00
hardware_properties u:object_r:hardware_properties_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
hdmi_control u:object_r:hdmi_control_service:s0
Add incident command and incidentd daemon se policy. Test: adb shell incident Bug: 31122534 Change-Id: I4ac9c9ab86867f09b63550707673149fe60f1906
2016-11-21 08:23:04 +01:00
incident u:object_r:incident_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
inputflinger u:object_r:inputflinger_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
input_method u:object_r:input_method_service:s0
input u:object_r:input_service:s0
Rules for new installd Binder interface. Most of this CL mirrors what we've already done for the "netd" Binder interface, while sorting a few lists alphabetically. Migrating installd to Binder will allow us to get rid of one of the few lingering text-based command protocols, improving system maintainability and security. Test: builds, boots Bug: 13758960, 30944031 Change-Id: I59b89f916fd12e22f9813ace6673be38314c97b7
2016-12-05 19:19:11 +01:00
installd u:object_r:installd_service:s0
Preemptively adding services for pending commits. Adding services to service_contexts for the pending commits Icf5997dd6a6ba5e1de675cf5f4334c78c2c037f1 and Ibe79be30b80c18ec45ff69db7527c7a4adf0ee08. Change-Id: Ie898866d1ab3abba6211943e87bcec77ba568567
2014-06-27 22:20:15 +02:00
iphonesubinfo_msim u:object_r:radio_service:s0
iphonesubinfo2 u:object_r:radio_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
iphonesubinfo u:object_r:radio_service:s0
Add missing services to service_contexts. Add missing services to service_contexts that we did not include in earlier patch that added SELinux checks in service_manager. Change-Id: I889d999bf0b745bfcb75a3553b207777dc5700b7
2014-06-17 17:13:36 +02:00
ims u:object_r:radio_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
imms u:object_r:imms_service:s0
Add IpSecService SEPolicy Add a new type and context for IpSec to system SEPolicy Bug: 35923241 Test: service starts + talks to NetD Change-Id: I69356c8525b426d344fcc4858fc499ab12405b20 (cherry picked from commit 641b1a7ae0fde04424d7725165e91d1cde62390a)
2017-03-02 21:25:58 +01:00
ipsec u:object_r:ipsec_service:s0
Preemptively adding services for pending commits. Adding services to service_contexts for the pending commits Icf5997dd6a6ba5e1de675cf5f4334c78c2c037f1 and Ibe79be30b80c18ec45ff69db7527c7a4adf0ee08. Change-Id: Ie898866d1ab3abba6211943e87bcec77ba568567
2014-06-27 22:20:15 +02:00
isms_msim u:object_r:radio_service:s0
isms2 u:object_r:radio_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
isms u:object_r:radio_service:s0
Add missing services to service_contexts. Add missing services to service_contexts that we did not include in earlier patch that added SELinux checks in service_manager. Change-Id: I889d999bf0b745bfcb75a3553b207777dc5700b7
2014-06-17 17:13:36 +02:00
isub u:object_r:radio_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
jobscheduler u:object_r:jobscheduler_service:s0
launcherapps u:object_r:launcherapps_service:s0
location u:object_r:location_service:s0
lock_settings u:object_r:lock_settings_service:s0
service_contexts: add aaudio service Test: test_aaudio.cpp Bug: 33398120 Change-Id: I0712f60c898136154d729ceb1103ee021cc6ab82 Signed-off-by: Phil Burk <philburk@google.com> (cherry picked from commit 8b9d93f24505a2737f156f3b20a0fca3af8ac345)
2017-02-02 20:53:20 +01:00
media.aaudio u:object_r:audioserver_service:s0
Add rules for running audio services in audioserver audioserver has the same rules as mediaserver so there is no loss of rights or permissions. media.log moves to audioserver. TBD: Pare down permissions. Bug: 24511453 Change-Id: I0fff24c14b712bb3d498f75e8fd66c2eb795171d
2015-09-09 19:48:04 +02:00
media.audio_flinger u:object_r:audioserver_service:s0
media.audio_policy u:object_r:audioserver_service:s0
selinux: Update policies for cameraserver Update policies for cameraserver so it has the same permissions as mediaserver. Bug: 24511454 Change-Id: I1191e2ac36c00b942282f8dc3db9903551945adb
2015-12-04 01:10:05 +01:00
media.camera u:object_r:cameraserver_service:s0
camera: Add AIDL interface for CameraServiceProxy. - Update selinux policy for CameraServiceProxy. Bug: 21267484 Change-Id: Ib821582794ddd1e3574b5dc6c79f7cb197b57f10
2015-05-20 02:26:31 +02:00
media.camera.proxy u:object_r:cameraproxy_service:s0
Add rules for running audio services in audioserver audioserver has the same rules as mediaserver so there is no loss of rights or permissions. media.log moves to audioserver. TBD: Pare down permissions. Bug: 24511453 Change-Id: I0fff24c14b712bb3d498f75e8fd66c2eb795171d
2015-09-09 19:48:04 +02:00
media.log u:object_r:audioserver_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
media.player u:object_r:mediaserver_service:s0
rename mediaanalytics->mediametrics, wider access reflect the change from "mediaanalytics" to "mediametrics" Also incorporates a broader access to the service -- e.g. anyone. This reflects that a number of metrics submissions come from application space and not only from our controlled, trusted media related processes. The metrics service (in another commit) checks on the source of any incoming metrics data and limits what is allowed from unprivileged clients. Bug: 34615027 Test: clean build, service running and accessible Change-Id: I657c343ea1faed536c3ee1940f1e7a178e813a42
2017-01-24 21:53:45 +01:00
media.metrics u:object_r:mediametrics_service:s0
Update selinux policies for mediaextractor process Change-Id: If761e0370bf9731a2856d0de2c6a6af1671143bd
2015-09-22 19:56:03 +02:00
media.extractor u:object_r:mediaextractor_service:s0
Allow mediaextractor to load libraries from apk_data_file This is an experimental feature only on userdebug and eng build. Test: play MP4 file. install & uninstall media update apk. Bug: 67908547 Change-Id: I513cdbfda962f00079e886b7a42f9928e81f6474
2017-11-06 20:19:07 +01:00
media.extractor.update u:object_r:mediaextractor_update_service:s0
selinux rules for codec process Bug: 22775369 Change-Id: Ic6abe3d0e18ba6f7554d027e0ec05fd19011709b
2016-02-03 01:10:37 +01:00
media.codec u:object_r:mediacodec_service:s0
media: allow media server to add resource manager service Bug: 19620911 Change-Id: I170b9d46bd49b1ad8bac6e37d0745893d79c14fe
2015-03-12 23:54:37 +01:00
media.resource_manager u:object_r:mediaserver_service:s0
Add rules for running audio services in audioserver audioserver has the same rules as mediaserver so there is no loss of rights or permissions. media.log moves to audioserver. TBD: Pare down permissions. Bug: 24511453 Change-Id: I0fff24c14b712bb3d498f75e8fd66c2eb795171d
2015-09-09 19:48:04 +02:00
media.sound_trigger_hw u:object_r:audioserver_service:s0
Add mediadrm service Part of media security hardening This is an intermediate step toward moving mediadrm to a new service separate from mediaserver. This first step allows mediadrmservice to run based on the system property media.mediadrmservice.enable so it can be selectively enabled on devices that support using native_handles for secure buffers. bug: 22990512 Change-Id: I2208c1e87a6bd8d5bfaed06b1fdcb0509c11cff2
2016-02-12 18:05:42 +01:00
media.drm u:object_r:mediadrmserver_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
media_projection u:object_r:media_projection_service:s0
Allow mediaserver to access media_resource_monitor Bug: 26175834 Change-Id: I49244f8e6165ea5a871955f07b3c4ea40cbd7c59
2015-12-15 06:19:21 +01:00
media_resource_monitor u:object_r:media_session_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
media_router u:object_r:media_router_service:s0
media_session u:object_r:media_session_service:s0
meminfo u:object_r:meminfo_service:s0
midi u:object_r:midi_service:s0
mount u:object_r:mount_service:s0
Rename the netd service from "android.net.INetd" to "netd". Bug: 27239233 Change-Id: Icc9d14008d2ff6334a8ec66805f7289aedd5d97d
2016-02-23 14:21:22 +01:00
netd u:object_r:netd_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
netpolicy u:object_r:netpolicy_service:s0
netstats u:object_r:netstats_service:s0
network_management u:object_r:network_management_service:s0
network_score u:object_r:network_score_service:s0
Add NetworkTimeUpdateService NetworkTimeUpdateService has been registered as a system service, so that its dump state can be included into bugreports. Bug: 23983739 Change-Id: I0d364009ba4630dcfd1d22c647195e33eedaa4e0
2016-02-27 02:21:47 +01:00
network_time_update_service u:object_r:network_time_update_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
nfc u:object_r:nfc_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
notification u:object_r:notification_service:s0
SE Linux policies for OemLockService Bug: 34766843 Test: gts-tradefed run gts -m GtsBootloaderServiceTestCases -t \ com.google.android.bootloader.gts.BootloaderServiceTest Change-Id: I8b939e0dbe8351a54f20c303921f606c3462c17d
2017-02-17 14:51:32 +01:00
oem_lock u:object_r:oem_lock_service:s0
Selinux: introduce policy for OTA preopt Add permissions to dex2oat, introduce otapreopt binary and otadexopt service. Bug: 25612095 Change-Id: I80fcba2785e80b2931d7d82bb07474f6cd0099f7
2015-12-03 06:23:30 +01:00
otadexopt u:object_r:otadexopt_service:s0
Add service 'overlay' to service_contexts The 'overlay' service is the Overlay Manager Service, which tracks packages and their Runtime Resource Overlay overlay packages. Change-Id: I897dea6a32c653d31be88a7b3fc56ee4538cf178 Co-authored-by: Martin Wallgren <martin.wallgren@sonymobile.com> Signed-off-by: Zoran Jovanovic <zoran.jovanovic@sonymobile.com> Bug: 31052947 Test: boot the Android framework
2015-06-22 09:31:25 +02:00
overlay u:object_r:overlay_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
package u:object_r:package_service:s0
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
package_native u:object_r:package_native_service:s0
Sepolicy: Introduce perfprofd binder service Add policy for the perfprofd binder service. For now, only allow su to talk to it. Test: m Change-Id: I690f75460bf513cb326314cce633fa25453515d6
2017-12-22 22:05:28 +01:00
perfprofd u:object_r:perfprofd_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
permission u:object_r:permission_service:s0
persistent_data_block u:object_r:persistent_data_block_service:s0
Preemptively adding services for pending commits. Adding services to service_contexts for the pending commits Icf5997dd6a6ba5e1de675cf5f4334c78c2c037f1 and Ibe79be30b80c18ec45ff69db7527c7a4adf0ee08. Change-Id: Ie898866d1ab3abba6211943e87bcec77ba568567
2014-06-27 22:20:15 +02:00
phone_msim u:object_r:radio_service:s0
phone1 u:object_r:radio_service:s0
phone2 u:object_r:radio_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
phone u:object_r:radio_service:s0
Add CAP_IPC_LOCK and pinner to system_server Add pinner service to system_service services. Add CAP_IPC_LOCK permissions to system_server in order to allow system_server to pin more memory than the lockedmem ulimit. bug 28251566 Change-Id: I990c73d25fce4f2cc9a2db0015aa238fa7b0e984
2016-05-02 20:04:39 +02:00
pinner u:object_r:pinner_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
power u:object_r:power_service:s0
print u:object_r:print_service:s0
Add security policy for ProcessInfoService. Bug: 19186859 Change-Id: Ic08858f346d6b66e7bfc9da6faa2c6e38d9b2e82
2015-01-29 03:15:01 +01:00
processinfo u:object_r:processinfo_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
procstats u:object_r:procstats_service:s0
Add missing services to service_contexts. Add missing services related to battery, bluetooth, time, and radio to service_contexts. Change-Id: I8bf05feb173d49637048c779757013806837fede
2014-06-26 21:36:43 +02:00
radio.phonesubinfo u:object_r:radio_service:s0
radio.phone u:object_r:radio_service:s0
radio.sms u:object_r:radio_service:s0
Add recovery service. RecoverySystemService is separated from PowerManagerService as a dedicated system service to handle recovery related requests (such as invoking uncrypt to uncrypt an OTA package on /data or to set up / clear the bootloader control block (i.e. /misc) and etc). The matching CL in frameworks/base is in: Change-Id: Ic606fcf5b31c54ce54f0ab12c1768fef0fa64560. Bug: 26830925 Change-Id: Iee0583c458f784bfa422d0f7af5d1f2681d9609e (cherry picked from commit 65b5fde912285ebeeefc9c7486f4453dd86d994f)
2016-02-03 21:43:58 +01:00
recovery u:object_r:recovery_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
restrictions u:object_r:restrictions_service:s0
rttmanager u:object_r:rttmanager_service:s0
samplingprofiler u:object_r:samplingprofiler_service:s0
scheduling_policy u:object_r:scheduling_policy_service:s0
search u:object_r:search_service:s0
SE Policy for Secure Element app and Secure Element HAL Test: App startup on boot Change-Id: I7740aafc088aadf676328e3f1bb8db5175d97102
2018-01-04 19:33:20 +01:00
secure_element u:object_r:secure_element_service:s0
fix lax service context lookup (II) As fallout from the corresponding fix in libselinux, this patch adds the missing services without changing semantics. Test: bullhead builds and boots Bug: 31353148 Change-Id: I21026c9435ffef956a59d61c4903174ac7b1ef95
2016-09-08 14:15:19 +02:00
sec_key_att_app_id_provider u:object_r:sec_key_att_app_id_provider_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
sensorservice u:object_r:sensorservice_service:s0
serial u:object_r:serial_service:s0
servicediscovery u:object_r:servicediscovery_service:s0
Allow new settings system service. Test: N/A Change-Id: Ib3c85118bf752152f5ca75ec13371073fc2873cc
2016-10-21 00:57:39 +02:00
settings u:object_r:settings_service:s0
Add new system service "shortcut". Bug 27325877 Change-Id: Idf2f9ae816e1f3d822a6286a4cf738c14e29a45e
2016-03-02 00:11:41 +01:00
shortcut u:object_r:shortcut_service:s0
Preemptively adding services for pending commits. Adding services to service_contexts for the pending commits Icf5997dd6a6ba5e1de675cf5f4334c78c2c037f1 and Ibe79be30b80c18ec45ff69db7527c7a4adf0ee08. Change-Id: Ie898866d1ab3abba6211943e87bcec77ba568567
2014-06-27 22:20:15 +02:00
simphonebook_msim u:object_r:radio_service:s0
simphonebook2 u:object_r:radio_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
simphonebook u:object_r:radio_service:s0
sip u:object_r:radio_service:s0
Add selinux for slice service Test: make/sync Bug: 68751119 Change-Id: Ie3c60ff68b563cef07f20d15f298d6b62e9356bc
2017-12-04 20:41:54 +01:00
slice u:object_r:slice_service:s0
Setting up SELinux policy for statsd and stats service Bug: 63757906 Test: manual testing conducted Change-Id: Id03413ce82b5646d4bceddc59e16c7d5ee5bc193
2017-12-19 00:14:33 +01:00
stats u:object_r:stats_service:s0
Adding statscompanion_service and a dontaudit for find/add Instead of removing the denial generating code, a dontaudit and a service label will be provided so that the team working on this new feature doesn't have to get slowed up with local revision patches. The dontaudit should be removed upon resolution of the linked bug. Bug: 67468181 Test: statscompanion denials aren't audited Change-Id: Ib4554a7b6c714e7409ea504f5d0b82d5e1283cf7
2017-10-24 01:25:11 +02:00
statscompanion u:object_r:statscompanion_service:s0
Allow "soundtrigger" system service to run. In the same process as voiceinteraction. Please see related CL ag/852049 Bug: 22860713 Change-Id: I43ebfdba2aafb151dd7db0814570027e1164508a
2016-01-26 03:22:07 +01:00
soundtrigger u:object_r:voiceinteraction_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
statusbar u:object_r:statusbar_service:s0
Storaged permissions for task I/O Allow storaged to read /proc/[pid]/io Grant binder access to storaged Add storaged service Grant storaged_exec access to dumpstate Grant storaged binder_call to dumpstate Bug: 32221677 Change-Id: Iecc9dba266c5566817a99ac6251eb943a0bac630
2016-07-01 21:18:54 +02:00
storaged u:object_r:storaged_service:s0
storaged: add storaged_pri service "storaged" service will be used by external clients, e.g. vold, dumpsys "storaged_pri" service will only be used by storaged cmdline. Bug: 63740245 Change-Id: I7a60eb4ce321aced9589bbb8474d2d9e75ab7042
2017-10-16 22:57:06 +02:00
storaged_pri u:object_r:storaged_service:s0
Define policy for new StorageStatsManager API. Test: builds Bug: 32206268 Change-Id: I236105b029178f96da519c2295c66c686dcae7cb
2017-01-11 02:09:13 +01:00
storagestats u:object_r:storagestats_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
SurfaceFlinger u:object_r:surfaceflinger_service:s0
Add rules for system_update service. system_update service manages system update information: system updater (priv_app) publishes the pending system update info through the service, while other apps can read the info accordingly (design doc in go/pi-ota-platform-api). This CL adds the service type, and grants priv_app to access the service. Bug: 67437079 Test: Build and flash marlin image. The system_update service works. Change-Id: I7a3eaee3ecd3e2e16b410413e917ec603566b375
2017-10-17 06:57:12 +02:00
system_update u:object_r:system_update_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
task u:object_r:task_service:s0
Add system_api_service and app_api_service attributes. System services differ in designed access level. Add attributes reflecting this distinction and label services appropriately. Begin moving access to the newly labeled services by removing them from tmp_system_server_service into the newly made system_server_service attribute. Reflect the move of system_server_service from a type to an attribute by removing access to system_server_service where appropriate. Change-Id: I7fd06823328daaea6d6f96e4d6bd00332382230b
2015-04-03 01:50:08 +02:00
telecom u:object_r:telecom_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
telephony.registry u:object_r:registry_service:s0
Declare new textclassification system service. Bug: 34781862 Test: none Change-Id: Ie628dca592a68ed67a68dda2f3d3e0516e995c80
2017-02-04 05:09:28 +01:00
textclassification u:object_r:textclassification_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
textservices u:object_r:textservices_service:s0
Enable the TimeZoneManagerService Add policy changes to enable a new service. The service is currently switched off in config, but this change is needed before it could be enabled. Bug: 31008728 Test: make droid Merged-In: I29c4509304978afb2187fe2e7f401144c6c3b4c6 Change-Id: I29c4509304978afb2187fe2e7f401144c6c3b4c6
2017-01-11 17:27:02 +01:00
timezone u:object_r:timezone_service:s0
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
thermalservice u:object_r:thermal_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
trust u:object_r:trust_service:s0
tv_input u:object_r:tv_input_service:s0
uimode u:object_r:uimode_service:s0
updatelock u:object_r:updatelock_service:s0
usagestats u:object_r:usagestats_service:s0
usb u:object_r:usb_service:s0
user u:object_r:user_service:s0
vibrator u:object_r:vibrator_service:s0
Add policies for new services. Bug: 30989383 Bug: 34731101 Test: manual Change-Id: Icf9d48568b505c6b788f2f5f456f2d709969fbeb
2017-02-10 00:15:11 +01:00
virtual_touchpad u:object_r:virtual_touchpad_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
voiceinteraction u:object_r:voiceinteraction_service:s0
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
vold u:object_r:vold_service:s0
VR: Add sepolicy for VR HWC service VR HWC is being split out of VR Window Manager. It creates a HW binder interface used by SurfaceFlinger which implements the HWComposer HAL and a regular binder interface which will be used by a system app to receive the SurfaceFlinger output. Bug: b/36051907 Test: Ran in permissive mode and ensured no permission errors show in logcat. Change-Id: If1360bc8fa339a80100124c4e89e69c64b29d2ae
2017-03-14 21:26:17 +01:00
vr_hwc u:object_r:vr_hwc_service:s0
Update selinux policy for VrManager AIDL. Bug: 27884853 Change-Id: I097306a324bdc25c5d22868f0342e175ce0dbb9a
2016-04-06 03:12:21 +02:00
vrmanager u:object_r:vr_manager_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
wallpaper u:object_r:wallpaper_service:s0
webviewupdate u:object_r:webviewupdate_service:s0
wifip2p u:object_r:wifip2p_service:s0
wifiscanner u:object_r:wifiscanner_service:s0
wifi u:object_r:wifi_service:s0
sepolicy: add sepolicy binder support for wificond This allows wificond to publish binder interface using service manager. Denial warnings: wificond: type=1400 audit(0.0:8): avc: denied { call } for scontext=u:r:wificond:s0 tcontext=u:r:servicemanager:s0 tclass=binder permissive=1 wificond: type=1400 audit(0.0:9): avc: denied { transfer } for scontext=u:r:wificond:s0 tcontext=u:r:servicemanager:s0 tclass=binder permissive=1 servicemanager: type=1400 audit(0.0:10): avc: denied { search } for name="6085" dev="proc" ino=40626 scontext=u:r:servicemanager:s0 tcontext=u:r:wificond:s0 tclass=dir permissive=1 servicemanager: type=1400 audit(0.0:11): avc: denied { read } for name="current" dev="proc" ino=40641 scontext=u:r:servicemanager:s0 tcontext=u:r:wificond:s0 tclass=file permissive=1 servicemanager: type=1400 audit(0.0:12): avc: denied { open } for path="/proc/6085/attr/current" dev="proc" ino=40641 scontext=u:r:servicemanager:s0 tcontext=u:r:wificond:s0 tclass=file permissive=1 servicemanager: type=1400 audit(0.0:13): avc: denied { getattr } for scontext=u:r:servicemanager:s0 tcontext=u:r:wificond:s0 tclass=process permissive=1 SELinux : avc: denied { add } for service=wificond pid=6085 uid=0 scontext=u:r:wificond:s0 tcontext=u:object_r:wifi_service:s0 tclass=service_manager permissive=1 BUG=28867093 TEST=compile TEST=use a client to call wificond service through binder Change-Id: I9312892caff171f17b04c30a415c07036b39ea7f (cherry picked from commit d56bcb1c5452c8dcdda7e4ef5d0f44b91b6bb08b)
2016-06-03 19:08:56 +02:00
wificond u:object_r:wificond_service:s0
[NAN-AWARE] Add Aware service Add Aware service - new name for NAN. But do not remove NAN yet. Enables smooth transition. Bug: 32263750 Test: device boots and all Wi-Fi unit-tests pass Change-Id: Ieb9f1ebf1d2f31ee27f228562b4601023da5282d
2016-11-04 21:37:17 +01:00
wifiaware u:object_r:wifiaware_service:s0
[RTT] Update Wi-Fi RTT service name Finalize Wi-Fi RTT service name per API review. Note: CL 1 of 2 - adding new entry here, will remove old entry in next CL. Bug: 65108607 Test: integration tests Change-Id: I065ce9d570510180fa8c8f09e1025ac795706405
2018-01-05 03:10:36 +01:00
wifirtt u:object_r:rttmanager_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
window u:object_r:window_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
* u:object_r:default_android_service:s0
Reference in a new issue Copy permalink