tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/private/property_contexts

871 lines
50 KiB
Text
Raw Normal View History

Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
##########################
# property service keys
#
#
Align SELinux property policy with init property_perms. Introduce a net_radio_prop type for net. properties that can be set by radio or system. Introduce a system_radio_prop type for sys. properties that can be set by radio or system. Introduce a dhcp_prop type for properties that can be set by dhcp or system. Drop the rild_prop vs radio_prop distinction; this was an early experiment to see if we could separate properties settable by rild versus other radio UID processes but it did not pan out. Remove the ability to set properties from unconfineddomain. Allow init to set any property. Allow recovery to set ctl_default_prop to restart adbd. Change-Id: I5ccafcb31ec4004dfefcec8718907f6b6f3e0dfd Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-06-19 16:27:02 +02:00
net.rmnet u:object_r:net_radio_prop:s0
net.gprs u:object_r:net_radio_prop:s0
net.ppp u:object_r:net_radio_prop:s0
net.qmi u:object_r:net_radio_prop:s0
net.lte u:object_r:net_radio_prop:s0
net.cdma u:object_r:net_radio_prop:s0
Move net.dns* to it's own label. Move net.dns* from net_radio_prop to the newly created label net_dns_prop. This allows finer grain control over this specific property. Prior to this change, this property was readable to all SELinux domains, and writable by the following SELinux domains: * system_server * system_app (apps which run as UID=system) * netmgrd * radio This change: 1) Removes read access to this property to everyone EXCEPT untrusted_app and system_server. 2) Limit write access to system_server. In particular, this change removes read access to priv_apps. Any priv_app which ships with the system should not be reading this property. Bug: 34115651 Test: Device boots, wifi turns on, no problems browsing the internet Change-Id: I8a32e98c4f573d634485c4feac91baa35d021d38
2017-02-10 01:08:11 +01:00
net.dns u:object_r:net_dns_prop:s0
Align SELinux property policy with init property_perms. Introduce a net_radio_prop type for net. properties that can be set by radio or system. Introduce a system_radio_prop type for sys. properties that can be set by radio or system. Introduce a dhcp_prop type for properties that can be set by dhcp or system. Drop the rild_prop vs radio_prop distinction; this was an early experiment to see if we could separate properties settable by rild versus other radio UID processes but it did not pan out. Remove the ability to set properties from unconfineddomain. Allow init to set any property. Allow recovery to set ctl_default_prop to restart adbd. Change-Id: I5ccafcb31ec4004dfefcec8718907f6b6f3e0dfd Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-06-19 16:27:02 +02:00
ril. u:object_r:radio_prop:s0
Remove special case handling of "ro." properties Currently, properties that begin with "ro." are special cased to skip over the "ro." part of the prefix before matching with entries in property_contexts. A change to init is removing this special case and therefore, the "ro." prefixes must be explicitly added to property_contexts. Bug 26425619 Change-Id: I343f139a39abef99924e84e0d27699284f335d63
2016-01-11 22:06:25 +01:00
ro.ril. u:object_r:radio_prop:s0
Rework the radio vs rild property split. Only label properties with the ril. prefix with rild_prop. Allow rild and system (and radio) to set radio_prop. Only rild can set rild_prop presently.
2012-04-04 22:01:19 +02:00
gsm. u:object_r:radio_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
persist.radio u:object_r:radio_prop:s0
net. u:object_r:system_prop:s0
dev. u:object_r:system_prop:s0
Remove special case handling of "ro." properties Currently, properties that begin with "ro." are special cased to skip over the "ro." part of the prefix before matching with entries in property_contexts. A change to init is removing this special case and therefore, the "ro." prefixes must be explicitly added to property_contexts. Bug 26425619 Change-Id: I343f139a39abef99924e84e0d27699284f335d63
2016-01-11 22:06:25 +01:00
ro.runtime. u:object_r:system_prop:s0
Remove access to ro.runtime.firstboot from apps ro.runtime.firstboot system property is only used internally by system_server to distinguish between first start after boot from consecutive starts (for example, this happens when full-disk encryption is enabled). The value of the property is a millisecond-precise timestamp which can help track individual device. Thus apps should not have access to this property. Test: Device boots fine, reading ro.runtime.firstboot from an app results in an error and SELinux denial. Bug: 33700679 Change-Id: I4c3c26a35c5dd840bced3a3e53d071f45317f63c
2016-12-27 23:05:46 +01:00
ro.runtime.firstboot u:object_r:firstboot_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
hw. u:object_r:system_prop:s0
Remove special case handling of "ro." properties Currently, properties that begin with "ro." are special cased to skip over the "ro." part of the prefix before matching with entries in property_contexts. A change to init is removing this special case and therefore, the "ro." prefixes must be explicitly added to property_contexts. Bug 26425619 Change-Id: I343f139a39abef99924e84e0d27699284f335d63
2016-01-11 22:06:25 +01:00
ro.hw. u:object_r:system_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
sys. u:object_r:system_prop:s0
Allow system_server to set audio properties Defined a new signal intended to allow the system to reboot the audio/soundtrigger HAL process. Fixes: 153461865 Test: See main change in topic Change-Id: I1e4a770670bb1274fa6a23cd0641f2554d4679f7
2020-04-10 22:06:15 +02:00
sys.audio. u:object_r:audio_prop:s0
Add sysprop for init's perf_event_open LSM hook check Written exclusively by init. Made it readable by shell for CTS, and for easier platform debugging. Bug: 137092007 Change-Id: Ia5b056117502c272bc7169661069d0c8020695e2
2020-01-14 19:20:06 +01:00
sys.init.perf_lsm_hooks u:object_r:init_perf_lsm_hooks_prop:s0
Allow cppreopts to work with selinux (cherry picked from commit d3edd6b577c1e40834af69420bd77b60c359ef8e) Bug: 29278988 Change-Id: I199572377a6b5c33116c718a545159ddcf50df30
2016-06-23 00:47:09 +02:00
sys.cppreopt u:object_r:cppreopt_prop:s0
Add rules for lpdump and lpdumpd - lpdump is a binary on the device that talks to lpdumpd via binder. - lpdumpd is a daemon on the device that actually reads dynamic partition metadata. Only lpdump can talk to it. Bug: 126233777 Test: boots (sanity) Test: lpdump Change-Id: I0e21f35ac136bcbb0603940364e8117f2d6ac438
2019-03-14 23:45:03 +01:00
sys.lpdumpd u:object_r:lpdumpd_prop:s0
Enable SELinux on vold This change enables SELinux security enforcement on vold. For the vold.te file ONLY, this change is conceptually a revert of 77d4731e9d30c8971e076e2469d6957619019921 and 50e37b93ac97631dcac6961285b92af5026557af, with the following additional changes: 1) Removal of "allow vold proc:file write;" and "allow vold self:capability { sys_boot };". As of system/vold change adfba3626e76c1931649634275d241b226cd1b9a, vold no longer performs it's own reboots, so these capabilities are no longer needed. 2) Addition of the powerctl property, which vold contacts to tell init to reboot. 3) Removal of "allow vold kernel:system module_request;". As of CTS commit f2cfdf5c057140d9442fcfeb4e4a648e8258b659, Android devices no longer ship with loadable modules, hence we don't require this rule. 4) Removal of "fsetid" from "self:capability". Any setuid / setgid bits SHOULD be cleared if vold is able to change the permissions of files. IMHO, it was a mistake to ever include this capability in the first place. Testing: As much as possible, I've tested filesystem related functionality, including factory reset and device encryption. I wasn't able to test fstrim functionality, which is a fairly new feature. I didn't see any policy denials in dmesg. It's quite possible I've missed something. If we experience problems, I happy to roll back this change. Bug: 9629920 Change-Id: I683afa0dffe9f28952287bfdb7ee4e0423c2e97a
2013-06-29 05:15:37 +02:00
sys.powerctl u:object_r:powerctl_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
service. u:object_r:system_prop:s0
Align SELinux property policy with init property_perms. Introduce a net_radio_prop type for net. properties that can be set by radio or system. Introduce a system_radio_prop type for sys. properties that can be set by radio or system. Introduce a dhcp_prop type for properties that can be set by dhcp or system. Drop the rild_prop vs radio_prop distinction; this was an early experiment to see if we could separate properties settable by rild versus other radio UID processes but it did not pan out. Remove the ability to set properties from unconfineddomain. Allow init to set any property. Allow recovery to set ctl_default_prop to restart adbd. Change-Id: I5ccafcb31ec4004dfefcec8718907f6b6f3e0dfd Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-06-19 16:27:02 +02:00
dhcp. u:object_r:dhcp_prop:s0
Allow Bluetooth app to initiate DHCP service on bt-pan interface. bug:15407087 Change-Id: I3dea9c1110583f11f093d048455a1cc739d05658
2014-06-18 15:20:36 +02:00
dhcp.bt-pan.result u:object_r:pan_result_prop:s0
SELinux policy for Bluetooth properties. Properties under bluetooth. and persist.service.bdroid. are considered Bluetooth-related properties. Change-Id: Iee937d9a1184c2494deec46f9ed7090c643acda7
2013-05-06 19:18:27 +02:00
bluetooth. u:object_r:bluetooth_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
Give system_server / system_app ability to write some properties Allow writing to persist.sys and debug. This addresses the following denials (which are actually being enforced): <4>[ 131.700473] avc: denied { set } for property=debug.force_rtl scontext=u:r:system_server:s0 tcontext=u:object_r:shell_prop:s0 tclass=property_service <3>[ 131.700625] init: sys_prop: permission denied uid:1000 name:debug.force_rtl <4>[ 132.630062] avc: denied { set } for property=persist.sys.dalvik.vm.lib scontext=u:r:system_app:s0 tcontext=u:object_r:system_prop:s0 tclass=property_service <3>[ 132.630184] init: sys_prop: permission denied uid:1000 name:persist.sys.dalvik.vm.lib Change-Id: I5d114c0d963bf393f49f1bf13d1ed84137fbcca6
2013-11-01 18:45:03 +01:00
debug. u:object_r:debug_prop:s0
debuggerd: Allow "debug.db.uid" usage Allow the use of debug.db.uid on userdebug / eng builds. Setting this property allows debuggerd to suspend a process if it detects a crash. Make debug.db.uid only accessible to the su domain. This should not be used on a user build. Only support reading user input on userdebug / eng builds. Steps to reproduce with the "crasher" program: adb root adb shell setprop debug.db.uid 20000 mmm system/core/debuggerd adb sync adb shell crasher Addresses the following denials: <5>[ 580.637442] type=1400 audit(1392412124.612:149): avc: denied { read } for pid=182 comm="debuggerd" name="input" dev="tmpfs" ino=5665 scontext=u:r:debuggerd:s0 tcontext=u:object_r:input_device:s0 tclass=dir <5>[ 580.637589] type=1400 audit(1392412124.612:150): avc: denied { open } for pid=182 comm="debuggerd" name="input" dev="tmpfs" ino=5665 scontext=u:r:debuggerd:s0 tcontext=u:object_r:input_device:s0 tclass=dir <5>[ 580.637706] type=1400 audit(1392412124.612:151): avc: denied { read write } for pid=182 comm="debuggerd" name="event5" dev="tmpfs" ino=6723 scontext=u:r:debuggerd:s0 tcontext=u:object_r:input_device:s0 tclass=chr_file <5>[ 580.637823] type=1400 audit(1392412124.612:152): avc: denied { open } for pid=182 comm="debuggerd" name="event5" dev="tmpfs" ino=6723 scontext=u:r:debuggerd:s0 tcontext=u:object_r:input_device:s0 tclass=chr_file <5>[ 580.637958] type=1400 audit(1392412124.612:153): avc: denied { ioctl } for pid=182 comm="debuggerd" path="/dev/input/event5" dev="tmpfs" ino=6723 scontext=u:r:debuggerd:s0 tcontext=u:object_r:input_device:s0 tclass=chr_file Bug: 12532622 Change-Id: I63486edb73efb1ca12e9eb1994ac9e389251a3f1
2014-02-06 01:36:25 +01:00
debug.db. u:object_r:debuggerd_prop:s0
Increase communication surface between dumpstate and Shell: - Add a new 'dumpstate' context for system properties. This context will be used to share state between dumpstate and Shell. For example, as dumpstate progresses, it will update a system property, which Shell will use to display the progress in the UI as a system notification. The user could also rename the bugreport file, in which case Shell would use another system property to communicate such change to dumpstate. - Allow Shell to call 'ctl.bugreport stop' so the same system notification can be used to stop dumpstate. BUG: 25794470 Change-Id: I74b80bda07292a91358f2eea9eb8444caabc5895
2015-12-02 03:03:05 +01:00
dumpstate. u:object_r:dumpstate_prop:s0
Let system_server writes to dumpstate.options property. Currently, we define 4 hardcoded init services to launch dumpstate with different command-line options (since dumpstate must be launched by root): - bugreport - bugreportplus - bugreportwear - bugreportremote This approach does not scale well; a better option is to have just one service, and let the framework pass the extra arguments through a system property. BUG: 31649719 Test: manual Change-Id: I7ebbb7ce6a0fd3588baca6fd76653f87367ed0e5
2016-09-21 19:44:11 +02:00
dumpstate.options u:object_r:dumpstate_options_prop:s0
Adds new policy for init_svc_debug_prop. Used to restrict properties init.svc_debug_pid.* Bug: 138114550 Test: getprop | grep init.svc_debug_pid only shows results on root Change-Id: I0c10699deec4c548a2463a934e96b897ddee1678
2019-07-25 20:29:17 +02:00
init.svc_debug_pid. u:object_r:init_svc_debug_prop:s0
llkd: Add stack symbol checking llkd needs the ptrace capabilities and dac override to monitor for live lock conditions on the stack dumps. Test: compile Bug: 33808187 Change-Id: Ibc1e4cc10395fa9685c4ef0ca214daf212a5e126
2018-08-08 01:03:47 +02:00
llk. u:object_r:llkd_prop:s0
khungtask. u:object_r:llkd_prop:s0
ro.llk. u:object_r:llkd_prop:s0
ro.khungtask. u:object_r:llkd_prop:s0
limit shell's access to log.* properties Restrict the ability of the shell to set the log.* properties. Namely: only allow the shell to set such properities on eng and userdebug builds. The shell (and other domains) can continue to read log.* properties on all builds. While there: harmonize permissions for log.* and persist.log.tag. Doing so introduces two changes: - log.* is now writable from from |system_app|. This mirrors the behavior of persist.log.tag, which is writable to support "Developer options" -> "Logger buffer sizes" -> "Off". (Since this option is visible on user builds, the permission is enabled for all builds.) - persist.log.tag can now be set from |shell| on userdebug_or_eng(). BUG=28221972 TEST=manual (see below) Testing details - user build (log.tag) $ adb shell setprop log.tag.foo V $ adb shell getprop log.tag <blank line> $ adb bugreport | grep log.tag.foo [ 146.525836] init: avc: denied { set } for property=log.tag.foo pid=4644 uid=2000 gid=2000 scontext=u:r:shell:s0 tcontext=u:object_r:log_prop:s0 tclass=property_service permissive=0 [ 146.525878] init: sys_prop: permission denied uid:2000 name:log.tag.foo - userdebug build (log.tag) $ adb shell getprop log.tag.foo <blank line> $ adb shell setprop log.tag.foo V $ adb shell getprop log.tag.foo V - user build (persist.log.tag) $ adb shell getprop | grep log.tag <no match> - Developer options -> Logger buffer sizes -> Off $ adb shell getprop | grep log.tag [persist.log.tag]: [Settings] [persist.log.tag.snet_event_log]: [I] Change-Id: Idf00e7a623723a7c46bf6d01e386aeca92b2ad75
2016-04-15 20:10:06 +02:00
log. u:object_r:log_prop:s0
Regression for log.tag properties Allow log.tag and persist.log.tag as log_tag_prop Bug: 28942894 Change-Id: I05766b99b9535a79a39adc55cad004decd52956e
2016-06-06 21:10:00 +02:00
log.tag u:object_r:log_tag_prop:s0
allow system server to set log.tag.WifiHAL On eng and userdebug builds (only), allow system server to change the value of log.tag.WifiHAL. WifiStateMachine will set this property to 'D' by default. If/when a user enables "Developer options -> Enable Wi-Fi Verbose Logging", WifiStateMachine change log.tag.WifiHAL to 'V'. BUG=27857554 TEST=manual (see below) Test detail 1. on user build: $ adb shell setprop log.tag.WifiHAL V $ adb shell getprop log.tag.WifiHAL <blank line> $ adb bugreport | grep log.tag.WifiHAL <11>[ 141.918517] init: avc: denied { set } for property=log.tag.WifiHAL pid=4583 uid=2000 gid=2000 scontext=u:r:shell:s0 tcontext=u:object_r:wifi_log_prop:s0 tclass=property_service permissive=0 <11>[ 141.918566] init: sys_prop: permission denied uid:2000 name:log.tag.WifiHAL 2. on userdebug build: $ adb shell getprop log.tag.WifiHAL $ <blank line> $ adb shell setprop log.tag.WifiHAL V $ adb shell getprop log.tag.WifiHAL V 3. on userdebug build with modified WifiStateMachine: $ adb shell getprop log.tag.WifiHAL D Change-Id: I9cdd52a2b47a3dd1065262ea8c329130b7b044db
2016-04-15 20:10:39 +02:00
log.tag.WifiHAL u:object_r:wifi_log_prop:s0
expose control over unpriv perf access to shell This allows the shell user to control whether unprivileged access to perf events is allowed. To enable unprivileged access to perf: adb shell setprop security.perf_harden 0 To disable it again: adb shell setprop security.perf_harden 1 This allows Android to disable this kernel attack surface by default, while still allowing profiling tools to work automatically. It can also be manually toggled, but most developers won't ever need to do that if tools end up incorporating this. Bug: 29054680 Change-Id: Idcf6a2f6cbb35b405587deced7da1f6749b16a5f
2016-05-31 22:01:08 +02:00
security.perf_harden u:object_r:shell_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
service.adb.root u:object_r:shell_prop:s0
Add adbd_prop, system_adbd_prop property types. service.adb.tls.port contains the adbd tcp port running the TLS server. persist.sys.adb.wifi tells adbd when to enable the TLS server. Bug: 149348431 Bug: 111434128 Test: Enable wireless debugging, check if TLS port information is displayed in the Developer options > Wireless debuggging. Change-Id: I5b5c5a3d064bc003f41386ede9051609fefec53e
2020-02-12 19:18:10 +01:00
service.adb.tls.port u:object_r:adbd_prop:s0
persist.adb.wifi. u:object_r:adbd_prop:s0
persist.adb.tls_server.enable u:object_r:system_adbd_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
Label persist audio properties label all persist.audio.* properties and allow mediaserver access to them. Change-Id: If5755d9783dce298e66a25bcb7f17ff17bd83ea7
2012-11-28 02:34:54 +01:00
persist.audio. u:object_r:audio_prop:s0
Allow system apps (Settings) to configure Bluetooth properties Bug: 27078729 Change-Id: I74115521e1def661dea5575eb532b93fe7f1f4ad
2016-02-09 00:39:00 +01:00
persist.bluetooth. u:object_r:bluetooth_prop:s0
Add sepolicy for persist.nfc_cfg. Add a new nfc_cfg persist property for nfc features Bug: 142626304 Test: set property and load target files. Change-Id: I853c97e8113dbcf729cf59ad45895402b0c82b3e
2020-01-06 17:25:11 +01:00
persist.nfc_cfg. u:object_r:nfc_prop:s0
Add SELinux settings to support tracing during boot. This CL adds the SELinux settings required to support tracing during boot. https://android-review.googlesource.com/#/c/157163/ BUG: 21739901 Change-Id: Ib3a7107776141ac8cf4f1ca06674f47a0d4b6ae0
2015-06-24 08:24:17 +02:00
persist.debug. u:object_r:persist_debug_prop:s0
add logd. as logd_prop We already have ro.logd. and persist.logd. as logd_prop, but not logd. so this change adds it. New properties should be read-write by default so logd. should be preferred to ro.logd. Test: set logd.buffer_type appropriately. Change-Id: I51ed19f0093a0302709116944153f37067814d08
2020-07-14 18:55:35 +02:00
logd. u:object_r:logd_prop:s0
selinux: logd Development settings - logd Development Settings failed to access persist.logd.size Change-Id: I0732b44fcbffbf3c187bcb23df2db807fa3e8fde
2014-06-12 21:47:22 +02:00
persist.logd. u:object_r:logd_prop:s0
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
ro.logd. u:object_r:logd_prop:s0
SELinux rule for ro.device_owner and persist.logd.security They are introduced for the device owner process logging feature. That is, for enterprise-owned devices with device owner app provisioned, the device owner may choose to turn on additional device-wide logging for auditing and intrusion detection purposes. Logging includes histories of app process startup, commands issued over ADB and lockscreen unlocking attempts. These logs will available to the device owner for analysis, potentially shipped to a remote server if it chooses to. ro.device_owner will be a master switch to turn off logging, if the device has no device owner provisioned. persist.logd.security is a switch that device owner can toggle (via DevicePoliyManager) to enable/disable logging. Writing to both properties should be only allowed by the system server. Bug: 22860162 Change-Id: Iabfe2347b094914813b9d6e0c808877c25ccd038
2016-01-04 16:20:45 +01:00
persist.logd.security u:object_r:device_logging_prop:s0
logpersist: reserve persist.logd.logpersistd shell, system_app and logd access granted on debug builds only Bug: 28936216 Change-Id: Ib9648e8565cc0ea0077cf0950b0e4ac6fe0a3135
2016-06-06 21:18:46 +02:00
persist.logd.logpersistd u:object_r:logpersistd_logging_prop:s0
logcatd: trampoline persist.logd.logpersistd to logd.logpersistd Bug: 28936216 Change-Id: I90dc7ca296dc5c9b6d13e7920ebb864981a112b5
2016-07-08 17:41:08 +02:00
logd.logpersistd u:object_r:logpersistd_logging_prop:s0
Regression for log.tag properties Allow log.tag and persist.log.tag as log_tag_prop Bug: 28942894 Change-Id: I05766b99b9535a79a39adc55cad004decd52956e
2016-06-06 21:10:00 +02:00
persist.log.tag u:object_r:log_tag_prop:s0
persist.mmc.* only set in init Bug: 26976972 Change-Id: I0e44bfc6774807a3bd2ba05637a432675d855118
2016-02-04 19:55:43 +01:00
persist.mmc. u:object_r:mmc_prop:s0
Revert "Temporarily revert the SELinux policy for persist.netd.stable_secret." This change must only be submitted when device-specific policies have been reverted. This reverts commit 07e631d2e0a01226ea83e517305d1eceb1b1a158. Bug: 17613910 Test: builds Change-Id: Ie33e293107bf1eba2498f2422d941544c76b8cad Merged-In: I356c39a5dc955b3d7c28d8c7baf2887a17beb272
2017-07-11 02:43:19 +02:00
persist.netd.stable_secret u:object_r:netd_stable_secret_prop:s0
Add label for persist.pm.mock-upgrade This property is used for testing purposes when verifying the behavior when an OTA occurs. It should be readable by the system server, and be settable by the shell. Test: Set property from shell, read with PackageManager Bug: 140992644 Change-Id: I39ad9b7961208f02fa45011215c2ff5ac03b7380
2019-10-09 18:09:48 +02:00
persist.pm.mock-upgrade u:object_r:mock_ota_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
persist.sys. u:object_r:system_prop:s0
Allow logd.auditd to reboot to safe mode Bug: 26902605 Change-Id: Ica825cf2af74f5624cf4091544bd24bb5482dbe7
2016-02-06 00:42:32 +01:00
persist.sys.safemode u:object_r:safemode_prop:s0
Add persist.sys.theme. This property will be set by system_server (to indicate the currently selected theme for device), and can be accessed by vendor init.rc. avc: denied { read } for property=persist.sys.theme pid=0 uid=0 gid=0 scontext=u:r:vendor_init:s0 tcontext=u:object_r:theme_prop:s0 tclass=file Bug: 113028175 Test: Set a vendor init trigger that waits on `persist.sys.theme`. Check that the trigger fires without denial. Change-Id: Ia85b1a8dfc118efdbb9337ca017c8fb7958dc386 Merged-In: Ibb4e392d5059b76059f36f7d11ba82cd65cbe970 (cherry picked from commit 75182a1ea645d3fa1e4c3e9f77851d90ff7cc803)
2019-06-15 02:00:16 +02:00
persist.sys.theme u:object_r:theme_prop:s0
Sepolicy: add dynamic_system_prop and allow shell and system_app (Settings) to set it to enable Dynamic System Update. Also allow priv_app (user of the API) to read it. Bug: 119647479 Bug: 129060539 Test: run the following command on crosshatch-user: adb shell setprop persist.sys.fflag.override.settings_dynamic_system 1 Change-Id: I24a5382649c64d36fd05a59bc87faca87e6f0eb8 Merged-In: I24a5382649c64d36fd05a59bc87faca87e6f0eb8
2019-04-26 10:14:52 +02:00
persist.sys.fflag.override.settings_dynamic_system u:object_r:dynamic_system_prop:s0
Add ro.sys.safemode property. Bug: 28008032 Change-Id: I29e076ee9c62a0fb3b386f79509935a1961f95e1
2016-03-03 01:14:17 +01:00
ro.sys.safemode u:object_r:safemode_prop:s0
Allow logd.auditd to reboot to safe mode Bug: 26902605 Change-Id: Ica825cf2af74f5624cf4091544bd24bb5482dbe7
2016-02-06 00:42:32 +01:00
persist.sys.audit_safemode u:object_r:safemode_prop:s0
Revert^2 "SELinux policy for system server JVMTI" This reverts commit baa06ee2cd8b2f6c8bd0c2d873dc2888d6296353. Reason for revert: Added missing property name in vendor_init.te. Bug: none Test: none (other than neverallow checking) Change-Id: I9e93bf4ea6ca3a4634f8f4cbce2f13c5f410883b
2019-11-25 23:03:59 +01:00
persist.sys.dalvik.jvmtiagent u:object_r:system_jvmti_agent_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
persist.service. u:object_r:system_prop:s0
SELinux policy for Bluetooth properties. Properties under bluetooth. and persist.service.bdroid. are considered Bluetooth-related properties. Change-Id: Iee937d9a1184c2494deec46f9ed7090c643acda7
2013-05-06 19:18:27 +02:00
persist.service.bdroid. u:object_r:bluetooth_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
persist.security. u:object_r:system_prop:s0
sepolicy: allow shell to read/write traced prop This is to fix the CTS failures given by the bugs below where devices where traced is not enabled by default causes test failures. Bug: 78215159 Bug: 78347829 Change-Id: Ib0f6a1cdb770528dbbeb857368534ff5040e464e
2018-04-20 20:09:45 +02:00
persist.traced.enable u:object_r:traced_enabled_prop:s0
Allow traced to lazily start heapprofd. Bug: 126724929 Change-Id: I15f0ae10d5e45fc65850635230e377b6f77ad4d7
2019-03-13 19:22:23 +01:00
traced.lazy. u:object_r:traced_lazy_prop:s0
Add persist.heapprofd.enable property. This is analoguous to what Perfetto does with persist.traced.enable. Test: m Test: flash walleye Test: setprop persist.heapprofd.enable 1 setprop persist.heapprofd.enable 0 Change-Id: I997272ef8c6fe078aca2388ed0cf2ecc3de612a5
2018-12-10 17:20:20 +01:00
persist.heapprofd.enable u:object_r:heapprofd_enabled_prop:s0
traced_perf sepolicy tweaks * allow shell to enable/disable the daemon via a sysprop * don't audit signals, as some denials are expected * exclude zygote from the profileable set of targets on debug builds. I've not caught any crashes in practice, but believe there's a possibility that the zygote forks while holding a non-whitelisted fd due to the signal handler. Change-Id: Ib237d4edfb40b200a3bd52e6341f13c4777de3f1
2020-02-19 15:59:17 +01:00
persist.traced_perf.enable u:object_r:traced_perf_enabled_prop:s0
Add persist.vendor.overlay. to properties Allow the system_server to change. Allow the zygote to read it as well. Test: Have system_server set a property Change-Id: Ie90eec8b733fa7193861026a3a6e0fb0ba5d5318
2016-11-09 21:19:05 +01:00
persist.vendor.overlay. u:object_r:overlay_prop:s0
ro.boot.vendor.overlay. u:object_r:overlay_prop:s0
Assign a label to the ro.boottime.* properties system/core commit 331cf2fb7c16b5b25064f8d2f00284105a9b413f created a number of new properties of the form: [ro.boottime.init]: [5294587604] [ro.boottime.InputEventFind]: [10278767840] [ro.boottime.adbd]: [8359267180] ... These properties were assigned the default_prop SELinux label because a better label did not exist. Properties labeled with the default_prop label are readable to any SELinux domain, which is overly broad. bullhead:/ $ getprop -Z ro.boottime.adbd u:object_r:default_prop:s0 Instead, create a new label for the ro.boottime.* properties so we can apply more fine grain read access control to these properties. bullhead:/ $ getprop -Z ro.boottime.adbd u:object_r:boottime_prop:s0 New SELinux property labels have minimal permissions by default. As a result, after this change, ro.boottime.* properties will only be readable to system_server, bootstat, init (because it manages the property space), and "adb root" (because no SELinux permissions are enforced there). Additional read access can be granted as-needed. This is part of a larger effort to implement fine-grain access control on the properties managed by init. Test: Device boots and no SELinux denials on boot. Change-Id: Ibf981cb81898f4356fdc5c1b6f15dd93c0d6d84d
2016-12-14 04:50:36 +01:00
ro.boottime. u:object_r:boottime_prop:s0
Restrict access to ro.serialno and ro.boot.serialno This restricts access to ro.serialno and ro.boot.serialno, the two system properties which contain the device's serial number, to a select few SELinux domains which need the access. In particular, this removes access to these properties from Android apps. Apps can access the serial number via the public android.os.Build API. System properties are not public API for apps. The reason for the restriction is that serial number is a globally unique identifier which cannot be reset by the user. Thus, it can be used as a super-cookie by apps. Apps need to wean themselves off of identifiers not resettable by the user. Test: Set up fresh GMS device, install some apps via Play, update some apps, use Chrome Test: Access the device via ADB (ADBD exposes serial number) Test: Enable MTP over USB, use mtp-detect to confirm that serial number is reported in MTP DeviceInfo Bug: 31402365 Bug: 33700679 Change-Id: I4713133b8d78dbc63d8272503e80cd2ffd63a2a7
2016-12-21 00:31:37 +01:00
ro.serialno u:object_r:serialno_prop:s0
Restrict access to Bluetooth system properties This removes access to Bluetooth system properties from arbitrary SELinux domains. Access remains granted to init, bluetooth, and system_app domains. neverallow rules / CTS enforce that access is not granted to Zygote and processes spawned from Zygote expcept for system_app and bluetooth. The reason is that some of these properties may leak persistent identifiers not resettable by the user. Test: Bluetooth pairing and data transfer works Bug: 33700679 Change-Id: Icdcb3927a423c4011a62942340a498cc1b302472
2016-12-28 03:05:46 +01:00
ro.boot.btmacaddr u:object_r:bluetooth_prop:s0
Restrict access to ro.serialno and ro.boot.serialno This restricts access to ro.serialno and ro.boot.serialno, the two system properties which contain the device's serial number, to a select few SELinux domains which need the access. In particular, this removes access to these properties from Android apps. Apps can access the serial number via the public android.os.Build API. System properties are not public API for apps. The reason for the restriction is that serial number is a globally unique identifier which cannot be reset by the user. Thus, it can be used as a super-cookie by apps. Apps need to wean themselves off of identifiers not resettable by the user. Test: Set up fresh GMS device, install some apps via Play, update some apps, use Chrome Test: Access the device via ADB (ADBD exposes serial number) Test: Enable MTP over USB, use mtp-detect to confirm that serial number is reported in MTP DeviceInfo Bug: 31402365 Bug: 33700679 Change-Id: I4713133b8d78dbc63d8272503e80cd2ffd63a2a7
2016-12-21 00:31:37 +01:00
ro.boot.serialno u:object_r:serialno_prop:s0
Restrict access to Bluetooth system properties This removes access to Bluetooth system properties from arbitrary SELinux domains. Access remains granted to init, bluetooth, and system_app domains. neverallow rules / CTS enforce that access is not granted to Zygote and processes spawned from Zygote expcept for system_app and bluetooth. The reason is that some of these properties may leak persistent identifiers not resettable by the user. Test: Bluetooth pairing and data transfer works Bug: 33700679 Change-Id: Icdcb3927a423c4011a62942340a498cc1b302472
2016-12-28 03:05:46 +01:00
ro.bt. u:object_r:bluetooth_prop:s0
Switch /data/misc/reboot/last_reboot_reason to persistent property Switch from /data/misc/reboot/last_reboot_reason to persistent Android property persist.sys.boot.reason for indicating why the device is rebooted or shutdown. Introduce protection for all boot reason properties Protect the following properties with these labels ro.boot.bootreason u:object_r:bootloader_boot_reason_prop:s0 sys.boot.reason u:object_r:sys_boot_reason_prop:s0 persist.sys.boot.reason u:object_r:last_boot_reason_prop:s0 Setup the current as-need access rules for each. ToDo: Remove u:object_r:reboot_data_file after internal fixes. Test: system/core/bootstat/boot_reason_test.sh Bug: 64687998 Change-Id: I3771c73933e8ae2d94aee936c7a38b6282611b80
2017-08-14 23:25:10 +02:00
ro.boot.bootreason u:object_r:bootloader_boot_reason_prop:s0
persist.sys.boot.reason u:object_r:last_boot_reason_prop:s0
sys.boot.reason u:object_r:system_boot_reason_prop:s0
persist.sys.boot.reason is cleared once read by bootstat To ensure a surprise reboot does not take the last boot reason on face value especially if coming from more than one boot sessions ago. We shift and clear the value from persist.sys.boot.reason to sys.boot.reason.last and establish a correct last reboot reason in the canonical sys.boot.reason property. As a result, the power manager should read the canonical sys.boot.reason for a definitive result rather than relying on the possibly incorrect values in the persistent storage. sys.boot.reason should be a core property as it represents the canonical boot reason API. Test: compile Bug: 86671991 Bug: 63736262 Change-Id: If3742c487d6c0ab69c464f056bf48c786b66a945
2018-06-05 18:41:59 +02:00
sys.boot.reason.last u:object_r:last_boot_reason_prop:s0
Revert "Revert "Put pm.* property in new pm_prop context"" This reverts commit 248b6dc64444ea3260fba8e9cb390e59e2b941ab. Reason for revert: The dashboard complains that devices don't boot after this revert. Change-Id: I6a4648b64b096cbaa97c67aae6bc38b76d54cb48
2017-11-16 06:28:14 +01:00
pm. u:object_r:pm_prop:s0
FrameworksServicesTests: allow access to test.sys.boot.reason property com.android.server.power.PowerManagerServiceTest#testGetLastShutdownReasonInternal due to "RuntimeException: failed to set system property" W/roidJUnitRunner: type=1400 audit(0.0:6): avc: denied { write } for name="property_service" dev="tmpfs" ino=13178 scontext=u:r:platform_app:s0:c512,c768 tcontext=u:object_r:property_socket:s0 tclass=sock_file permissive=0 W/libc : Unable to set property "test.sys.boot.reason" to "shutdown,thermal": connection failed; errno=13 (Permission denied) Had to use precise property definition as com.android.phone accesses test properties as well. Test: compile Bug: 78245377 Change-Id: I2cc810846f8615f2a2fae8e0d4f41de585b7abd7
2015-10-25 01:20:18 +02:00
test.sys.boot.reason u:object_r:test_boot_reason_prop:s0
Add userspace_reboot_test_prop This property type represents properties used in CTS tests of userspace reboot. For example, test.userspace_reboot.requested property which is used to check that userspace reboot was successful and didn't result in full reboot, e.g.: * before test setprop test.userspace_reboot.requested 1 * adb reboot userspace * wait for boot to complete * verify that value of test.userspace_reboot.requested is still 1 Test: adb shell setprop test.userspace_reboot.requested 1 Bug: 150901232 Change-Id: I45d187f386149cec08318ea8545ab864b5810ca8 Merged-In: I45d187f386149cec08318ea8545ab864b5810ca8 (cherry picked from commit 3bd53a9ceecc37c79090c59776408b3d4733b036)
2020-03-12 15:45:00 +01:00
test.userspace_reboot.requested u:object_r:userspace_reboot_test_prop:s0
Selinux: Allow lmkd write access to sys.lmk. properties Allow lmkd write access to sys.lmk. properties to be able to set sys.lmk.minfree_levels. Bug: 111521182 Test: getprop sys.lmk.minfree_levels returns value set by lmkd Change-Id: I86ff11d75917966857d3a76876a56799bb92a5ad Signed-off-by: Suren Baghdasaryan <surenb@google.com>
2018-07-25 02:04:18 +02:00
sys.lmk. u:object_r:system_lmk_prop:s0
Allow traced to notify traceur via property This CL introduces allows traced to set the sys.traceur.trace_end_signal property at the end of the tracer. In turn that property notifies the the Traceur app. This is to allowing Traceur to be killed during a long-trace and avoid wasting resources making it a persistent service. See aosp/886616 for the matching traceur change. Test: manual Bug: 116754732 Change-Id: I89e2f02b3f973813ce8ff3507d397a06502f84c1
2019-02-01 23:52:02 +01:00
sys.trace. u:object_r:system_trace_prop:s0
Move policy files Update the file_contexts for the new location of the policy files, as well as update the policy for the management of these types. Change-Id: Idc475901ed437efb325807897e620904f4ff03e9
2013-01-23 23:02:43 +01:00
Support TCP based fastbootd in recovery mode. The IPv6 link-local address is used to avoid expose device to out of network segment. BUG: 155198345 Test: manual test. Change-Id: I0ce8c12de9976c01e57a6433c7fb50235e907dc5
2020-04-24 08:43:13 +02:00
# Fastbootd protocol control property
fastbootd.protocol u:object_r:fastbootd_protocol_prop:s0 exact enum usb tcp
Allow vendor_init to set service.adb.tcp.port adbd and apps (SystemUI and CTS test apps) need to read it. BUG: 162205386 Test: Connect to device which sets service.adb.tcp.port in vendor partition through TCP adb. Change-Id: Ia37dd0dd3239381feb2a4484179a0c7847166b29
2020-07-28 00:15:53 +02:00
# adbd protoctl configuration property
service.adb.tcp.port u:object_r:adbd_config_prop:s0 exact int
SELinux rule for ro.device_owner and persist.logd.security They are introduced for the device owner process logging feature. That is, for enterprise-owned devices with device owner app provisioned, the device owner may choose to turn on additional device-wide logging for auditing and intrusion detection purposes. Logging includes histories of app process startup, commands issued over ADB and lockscreen unlocking attempts. These logs will available to the device owner for analysis, potentially shipped to a remote server if it chooses to. ro.device_owner will be a master switch to turn off logging, if the device has no device owner provisioned. persist.logd.security is a switch that device owner can toggle (via DevicePoliyManager) to enable/disable logging. Writing to both properties should be only allowed by the system server. Bug: 22860162 Change-Id: Iabfe2347b094914813b9d6e0c808877c25ccd038
2016-01-04 16:20:45 +01:00
# Boolean property set by system server upon boot indicating
Rename ro.device_owner system property This is renamed to ro.organization_owned to cover the extended usage now that there is a new management mode for fully-managed organization owned devices: organization-owned managed profile. A device is considered fully-managed if there is a device owner or an organization-owned managed profile. Bug: 148437300 Test: atest FrameworksServicesTests:DevicePolicyManagerTest Test: atest FrameworksServicesTests:SecurityEventTest Test: atest FrameworksCoreTests:EventLogTest Test: atest com.android.cts.devicepolicy.DeviceOwnerTest#testSecurityLoggingWithSingleUser Test: atest com.android.cts.devicepolicy.DeviceOwnerTest#testSecurityLoggingWithTwoUsers Test: atest com.android.cts.devicepolicy.DeviceOwnerTest#testSecurityLoggingEnabledLogged Change-Id: Ic3288fe343d3b51c59f08678e114fe9a81cb39a4
2020-02-17 12:00:13 +01:00
# if device is fully owned by organization instead of being
# a personal device.
ro.organization_owned u:object_r:device_logging_prop:s0
SELinux rule for ro.device_owner and persist.logd.security They are introduced for the device owner process logging feature. That is, for enterprise-owned devices with device owner app provisioned, the device owner may choose to turn on additional device-wide logging for auditing and intrusion detection purposes. Logging includes histories of app process startup, commands issued over ADB and lockscreen unlocking attempts. These logs will available to the device owner for analysis, potentially shipped to a remote server if it chooses to. ro.device_owner will be a master switch to turn off logging, if the device has no device owner provisioned. persist.logd.security is a switch that device owner can toggle (via DevicePoliyManager) to enable/disable logging. Writing to both properties should be only allowed by the system server. Bug: 22860162 Change-Id: Iabfe2347b094914813b9d6e0c808877c25ccd038
2016-01-04 16:20:45 +01:00
Move policy files Update the file_contexts for the new location of the policy files, as well as update the policy for the management of these types. Change-Id: Idc475901ed437efb325807897e620904f4ff03e9
2013-01-23 23:02:43 +01:00
# selinux non-persistent properties
New "selinux.restorecon" control property. This new property is used as a control verb for running a recursive restorecon at the path contained in the property value. Defines a new label and grants access to vold, which invokes it when mounting private adopted volumes. Bug: 21121357 Change-Id: I8ff12a146e54a505aa5b43a542578891563d647a
2015-06-09 20:01:04 +02:00
selinux.restorecon_recursive u:object_r:restorecon_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
# default property context
* u:object_r:default_prop:s0
# data partition encryption properties
vold. u:object_r:vold_prop:s0
Remove special case handling of "ro." properties Currently, properties that begin with "ro." are special cased to skip over the "ro." part of the prefix before matching with entries in property_contexts. A change to init is removing this special case and therefore, the "ro." prefixes must be explicitly added to property_contexts. Bug 26425619 Change-Id: I343f139a39abef99924e84e0d27699284f335d63
2016-01-11 22:06:25 +01:00
ro.crypto. u:object_r:vold_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
allow system_server to set ro.build.fingerprint Some devices leave "ro.build.fingerprint" undefined at build time, since they need to build it from the components at runtime. See https://android.googlesource.com/platform/frameworks/base/+/5568772e8161205b86905d815783505fd3d461d8 for details. Allow system_server to set ro.build.fingerprint Addresses the following denial/error: avc: denied { set } for property=build.fingerprint scontext=u:r:system_server:s0 tcontext=u:object_r:default_prop:s0 tclass=property_service init: sys_prop: permission denied uid:1000 name:ro.build.fingerprint Bug: 18188956 Change-Id: I98b25773904a7be3e3d2926daa82c1d08f9bcc29
2014-11-18 23:36:23 +01:00
# ro.build.fingerprint is either set in /system/build.prop, or is
# set at runtime by system_server.
Relabel ro.build. properties - exported_fingerprint_prop is deleted - other ro.build. properties become build_prop Bug: 155844385 Test: sepolicy_tests Change-Id: Ic1194e8e7c23394e5a7c6176f9f9598109bb5fb7 Merged-In: Ic1194e8e7c23394e5a7c6176f9f9598109bb5fb7 (cherry picked from commit 1d63d5d0756d0d47ef6ec816b3c35b3b96bd50d4)
2020-05-06 13:07:33 +02:00
ro.build.fingerprint u:object_r:fingerprint_prop:s0 exact string
allow system_server to set ro.build.fingerprint Some devices leave "ro.build.fingerprint" undefined at build time, since they need to build it from the components at runtime. See https://android.googlesource.com/platform/frameworks/base/+/5568772e8161205b86905d815783505fd3d461d8 for details. Allow system_server to set ro.build.fingerprint Addresses the following denial/error: avc: denied { set } for property=build.fingerprint scontext=u:r:system_server:s0 tcontext=u:object_r:default_prop:s0 tclass=property_service init: sys_prop: permission denied uid:1000 name:ro.build.fingerprint Bug: 18188956 Change-Id: I98b25773904a7be3e3d2926daa82c1d08f9bcc29
2014-11-18 23:36:23 +01:00
make ro.persistent_properties.ready accessible for hidl client - compared to ro.boottime, this one does not pass time info bug: 35178781 bug: 34274385 Test: reboot Change-Id: I6a7bf636a3f201653e2890751d5fa210274c9ede
2017-03-01 04:21:31 +01:00
ro.persistent_properties.ready u:object_r:persistent_properties_ready_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
# ctl properties
Replace ctl_default_prop access with explicit service property keys. The ctl_default_prop label is a bit too generic for some of the priveleged domains when describing access rights. Instead, be explicit about which services are being started and stopped by introducing new ctl property keys. Change-Id: I1d0c6f6b3e8bd63da30bd6c7b084da44f063246a Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-02-18 19:24:26 +01:00
ctl.bootanim u:object_r:ctl_bootanim_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
ctl.dumpstate u:object_r:ctl_dumpstate_prop:s0
Replace ctl_default_prop access with explicit service property keys. The ctl_default_prop label is a bit too generic for some of the priveleged domains when describing access rights. Instead, be explicit about which services are being started and stopped by introducing new ctl property keys. Change-Id: I1d0c6f6b3e8bd63da30bd6c7b084da44f063246a Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-02-18 19:24:26 +01:00
ctl.fuse_ u:object_r:ctl_fuse_prop:s0
ctl.mdnsd u:object_r:ctl_mdnsd_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
ctl.ril-daemon u:object_r:ctl_rildaemon_prop:s0
Allow system_app to start bugreport and to create /data/anr/traces.txt. Resolves denials such as: avc: denied { set } for property =ctl.bugreport scontext=u:r:system_app:s0 tcontext=u:object_r:ctl_default_prop:s0 tclass=property_service avc: denied { write } for pid=4415 comm=5369676E616C2043617463686572 name="anr" dev="dm-0" ino=358337 scontext=u:r:system_app:s0 tcontext=u:object_r:anr_data_file:s0 tclass=dir avc: denied { add_name } for pid=4415 comm=5369676E616C2043617463686572 name="traces.txt" scontext=u:r:system_app:s0 tcontext=u:object_r:anr_data_file:s0 tclass=dir avc: denied { create } for pid=4415 comm=5369676E616C2043617463686572 name="traces.txt" scontext=u:r:system_app:s0 tcontext=u:object_r:anr_data_file:s0 tclass=file Change-Id: I71d0ede049136d72f28bdc85d52fcefa2f7d128f Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-03-06 20:47:22 +01:00
ctl.bugreport u:object_r:ctl_bugreport_prop:s0
Create context for ctl.console (cherry picked from commit c2e31a77825b4b404549396f5bcf1834d6ab0d3a) Change-Id: I92218709fa8cdb71c0369aca8fdd7922df45f7d0
2015-04-24 23:39:16 +02:00
ctl.console u:object_r:ctl_console_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
ctl. u:object_r:ctl_default_prop:s0
Allow NFC to read/write nfc. system properties. (cherry pick of commit 05383ebfb439bed8436912ed28db550e8842b343) Bug: 17298769 Change-Id: I1994ff9f9da9b13249099f6c9bcec88dcdc2bb97
2014-09-26 00:13:41 +02:00
Update sepolicy to use inclusive language See https://source.android.com/setup/contribute/respectful-code for reference #inclusivefixit Bug: 161896447 Test: Build Change-Id: If612f2270c8ba1d7fc2cbda3b2e8ca3818c0a1be
2020-07-27 18:30:34 +02:00
# Don't allow uncontrolled access to all services
Finer grained permissions for ctl. properties Currently, permissions for ctl. property apply to each action verb, so if a domain has permissions for controlling service 'foo', then it can start, stop, and restart foo. This change implements finer grainer permissions such that permission can be given to strictly start a given service, but not stop or restart it. This new permission scheme is mandatory for the new control functions, sigstop_on, sigstop_off, interface_start, interface_stop, interface_restart. Bug: 78511553 Test: see appropriate successes and failures based on permissions Merged-In: Ibe0cc0d6028fb0ed7d6bcba626721e0d84cc20fa Change-Id: Ibe0cc0d6028fb0ed7d6bcba626721e0d84cc20fa (cherry picked from commit 2208f96e9e6264553fcc8a58b86f4f21a092468c)
2018-05-04 02:00:16 +02:00
ctl.sigstop_on$ u:object_r:ctl_sigstop_prop:s0
ctl.sigstop_off$ u:object_r:ctl_sigstop_prop:s0
ctl.start$ u:object_r:ctl_start_prop:s0
ctl.stop$ u:object_r:ctl_stop_prop:s0
ctl.restart$ u:object_r:ctl_restart_prop:s0
ctl.interface_start$ u:object_r:ctl_interface_start_prop:s0
ctl.interface_stop$ u:object_r:ctl_interface_stop_prop:s0
ctl.interface_restart$ u:object_r:ctl_interface_restart_prop:s0
Revert "Revert "Reduce the number of processes that can start adbd"" This reverts commit b5dc6137adf0c5ced252c6bedc48b00317e0a4e0. Reason for revert: Reverted incorrect change Change-Id: Ieafa3338e28ffeed40bcceb73486cffbfbd08b9d
2018-06-26 21:52:21 +02:00
# Restrict access to starting/stopping adbd
ctl.start$adbd u:object_r:ctl_adbd_prop:s0
ctl.stop$adbd u:object_r:ctl_adbd_prop:s0
ctl.restart$adbd u:object_r:ctl_adbd_prop:s0
Allow system_server and shell to start gsid on-demand. gsid is started lazily to reduce memory pressure. It can be started either via gsi_tool (invoked by adb shell), or by DynamicAndroidService via system_server. Bug: 126622385 Test: no denials running "gsi_tool status" Change-Id: I90a5f3f28fe4f294fb60e7c87a62e76716fbd5c0
2019-02-28 03:31:11 +01:00
# Restrict access to starting/stopping gsid.
ctl.start$gsid u:object_r:ctl_gsid_prop:s0
ctl.stop$gsid u:object_r:ctl_gsid_prop:s0
ctl.restart$gsid u:object_r:ctl_gsid_prop:s0
Allow apexd to stop itself apexd stops itself when it finds that it is running on a device with flattened APEXes (i.e. ro.apex.updatable = false). Bug: 133907211 Test: launch sdk_phone_x86_64 adb logcat -d | grep apexd | wc -l returns 3 Change-Id: I7fa161b069aa34adb028194b55f367fe740a0cfc
2019-06-13 02:45:05 +02:00
# Restrict access to stopping apexd.
ctl.stop$apexd u:object_r:ctl_apexd_prop:s0
Fix: dumpstate HAL service property context http://aosp/678384 changed property format Fixes: 137695210 Test: inject timeout and take BR see dumpstate restarted Change-Id: Ie24e2d42e92410a935ca4c9364b476d72aa459f3
2019-07-17 18:39:33 +02:00
# Restrict access to restart dumpstate
ctl.interface_restart$android.hardware.dumpstate u:object_r:ctl_dumpstate_prop:s0
Allow NFC to read/write nfc. system properties. (cherry pick of commit 05383ebfb439bed8436912ed28db550e8842b343) Bug: 17298769 Change-Id: I1994ff9f9da9b13249099f6c9bcec88dcdc2bb97
2014-09-26 00:13:41 +02:00
# NFC properties
nfc. u:object_r:nfc_prop:s0
Dependencies for new goldfish service domains. In order to support the new goldfish service domains in a change with the same Change-Id for the build project, we need the following changes in external/sepolicy: - /system/bin/logcat needs its own type so that it can be used as an entrypoint for the goldfish-logcat service. A neverallow rule prevents us from allowing entrypoint to any type not in exec_type. - The config. and dalvik. property namespaces need to be labeled with something other than default_prop so that the qemu-props service can set them. A neverallow rule prevents us from allowing qemu-props to set default_prop. We allow rx_file_perms to logcat_exec for any domain that was previously allowed read_logd() as many programs will read the logs by running logcat. We do not do this for all domains as it would violate a neverallow rule on the kernel domain executing any file without transitioning to another domain, and as we ultimately want to apply the same restriction to the init domain (and possibly others). Change-Id: Idce1fb5ed9680af84788ae69a5ace684c6663974 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-09-04 14:44:49 +02:00
# These properties are not normally set by processes other than init.
# They are only distinguished here for setting by qemu-props on the
# emulator/goldfish.
config. u:object_r:config_prop:s0
Remove special case handling of "ro." properties Currently, properties that begin with "ro." are special cased to skip over the "ro." part of the prefix before matching with entries in property_contexts. A change to init is removing this special case and therefore, the "ro." prefixes must be explicitly added to property_contexts. Bug 26425619 Change-Id: I343f139a39abef99924e84e0d27699284f335d63
2016-01-11 22:06:25 +01:00
ro.config. u:object_r:config_prop:s0
Dependencies for new goldfish service domains. In order to support the new goldfish service domains in a change with the same Change-Id for the build project, we need the following changes in external/sepolicy: - /system/bin/logcat needs its own type so that it can be used as an entrypoint for the goldfish-logcat service. A neverallow rule prevents us from allowing entrypoint to any type not in exec_type. - The config. and dalvik. property namespaces need to be labeled with something other than default_prop so that the qemu-props service can set them. A neverallow rule prevents us from allowing qemu-props to set default_prop. We allow rx_file_perms to logcat_exec for any domain that was previously allowed read_logd() as many programs will read the logs by running logcat. We do not do this for all domains as it would violate a neverallow rule on the kernel domain executing any file without transitioning to another domain, and as we ultimately want to apply the same restriction to the init domain (and possibly others). Change-Id: Idce1fb5ed9680af84788ae69a5ace684c6663974 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-09-04 14:44:49 +02:00
dalvik. u:object_r:dalvik_prop:s0
Remove special case handling of "ro." properties Currently, properties that begin with "ro." are special cased to skip over the "ro." part of the prefix before matching with entries in property_contexts. A change to init is removing this special case and therefore, the "ro." prefixes must be explicitly added to property_contexts. Bug 26425619 Change-Id: I343f139a39abef99924e84e0d27699284f335d63
2016-01-11 22:06:25 +01:00
ro.dalvik. u:object_r:dalvik_prop:s0
Separate permissions to set WiFi related properties wificond would like to be able to set WiFi related properties without access to the rest of the system properties. Today, this only involves marking the driver as loaded or unloaded. avc: denied { write } for name="property_service" dev="tmpfs" ino=10100 scontext=u:r:wificond:s0 tcontext=u:object_r:property_socket:s0 tclass=sock_file permissive=0 Bug: 29579539 Test: No avc denials related to system properties across various WiFi events. Change-Id: I6d9f1de3fbef04cb7750cc3753634f9e02fdb71f (cherry picked from commit 1ebfdd6a14fb21705664c8e144f151b39c3d73f8)
2016-06-29 20:28:20 +02:00
# Shared between system server and wificond
sepolicy: Relabel wifi. properties as wifi_prop * These properties are used by the wifi hal and it works as expected on devices with compatible property. However, on devices without compatible property, these prperties are labeled as "default_prop" because public/property_contexts is not used. Thus they can't be set by the hal. * To tackle the problem, label them as "wifi_prop" in private/property_contexts which also works on devices without compatible property. The label will be overridden later by public/property_contexts rules if exist. Change-Id: If8b8bd5bea64f2ea08864cc62f6dc405cb394e00
2019-12-29 16:17:07 +01:00
wifi. u:object_r:wifi_prop:s0
Separate permissions to set WiFi related properties wificond would like to be able to set WiFi related properties without access to the rest of the system properties. Today, this only involves marking the driver as loaded or unloaded. avc: denied { write } for name="property_service" dev="tmpfs" ino=10100 scontext=u:r:wificond:s0 tcontext=u:object_r:property_socket:s0 tclass=sock_file permissive=0 Bug: 29579539 Test: No avc denials related to system properties across various WiFi events. Change-Id: I6d9f1de3fbef04cb7750cc3753634f9e02fdb71f (cherry picked from commit 1ebfdd6a14fb21705664c8e144f151b39c3d73f8)
2016-06-29 20:28:20 +02:00
wlan. u:object_r:wifi_prop:s0
sepolicy: allow hwservicemanager to set properties Allow hwservicemanager to set properties starting with the prefix "hwservicemanager." b/31458381 b/31240290 Test: passing build and runtime tests Change-Id: Id92e2170f52893bbf236987ee59383df2264952f Signed-off-by: Iliyan Malchev <malchev@google.com>
2016-09-20 00:23:41 +02:00
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
# Lowpan properties
lowpan. u:object_r:lowpan_prop:s0
ro.lowpan. u:object_r:lowpan_prop:s0
Property to enable heap profile from process startup. This is world-readable so it can be checked in libc's process init. Test: m Test: flash sailfish Bug: 117821125 Change-Id: Iac7317ceb75b5ad9cfb9adabdf16929263fa8a9d
2018-11-08 14:58:13 +01:00
# heapprofd properties
heapprofd. u:object_r:heapprofd_prop:s0
sepolicy: allow hwservicemanager to set properties Allow hwservicemanager to set properties starting with the prefix "hwservicemanager." b/31458381 b/31240290 Test: passing build and runtime tests Change-Id: Id92e2170f52893bbf236987ee59383df2264952f Signed-off-by: Iliyan Malchev <malchev@google.com>
2016-09-20 00:23:41 +02:00
# hwservicemanager properties
hwservicemanager. u:object_r:hwservicemanager_prop:s0
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
Correct labels on files / props in odm_dlkm. All files under odm_dlkm are tagged vendor_file. All build props for odm_dlkm are mapped as build_vendor_prop. Test: build and `ls /odm_dlkm -lZ` `adb shell getprop -Z | grep odm_dlkm` Bug: 154633114 Change-Id: Ifca69d0b7a8da945910a9cb0fa907735cd866f12
2020-07-16 02:11:17 +02:00
# Common default properties for vendor, odm, vendor_dlkm, and odm_dlkm.
Add default namespaces of odm properties Since /odm is an extension of /vendor, its default property contexts should be consistent with ones of /vendor. Bug: 36796459 Test: tested on wahoo devices Change-Id: Ia67ebe81e9c7102aab35a34f14738ed9a24811d3
2018-01-18 05:25:28 +01:00
init.svc.odm. u:object_r:vendor_default_prop:s0
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
init.svc.vendor. u:object_r:vendor_default_prop:s0
ro.hardware. u:object_r:vendor_default_prop:s0
Add default namespaces of odm properties Since /odm is an extension of /vendor, its default property contexts should be consistent with ones of /vendor. Bug: 36796459 Test: tested on wahoo devices Change-Id: Ia67ebe81e9c7102aab35a34f14738ed9a24811d3
2018-01-18 05:25:28 +01:00
ro.odm. u:object_r:vendor_default_prop:s0
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
ro.vendor. u:object_r:vendor_default_prop:s0
Correct labels on files / props in vendor_dlkm. All files under vendor_dlkm are tagged vendor_file. All build props for vendor_dlkm are mapped as build_vendor_prop. Test: build and `ls /vendor_dlkm -lZ` `adb shell getprop -Z | grep vendor_dlkm` Bug: 154633114 Change-Id: Ie9dc26d948357767fec09aca645606310ad3425c
2020-05-14 05:44:19 +02:00
ro.vendor_dlkm. u:object_r:vendor_default_prop:s0
Correct labels on files / props in odm_dlkm. All files under odm_dlkm are tagged vendor_file. All build props for odm_dlkm are mapped as build_vendor_prop. Test: build and `ls /odm_dlkm -lZ` `adb shell getprop -Z | grep odm_dlkm` Bug: 154633114 Change-Id: Ifca69d0b7a8da945910a9cb0fa907735cd866f12
2020-07-16 02:11:17 +02:00
ro.odm_dlkm. u:object_r:vendor_default_prop:s0
Add default namespaces of odm properties Since /odm is an extension of /vendor, its default property contexts should be consistent with ones of /vendor. Bug: 36796459 Test: tested on wahoo devices Change-Id: Ia67ebe81e9c7102aab35a34f14738ed9a24811d3
2018-01-18 05:25:28 +01:00
odm. u:object_r:vendor_default_prop:s0
persist.odm. u:object_r:vendor_default_prop:s0
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
persist.vendor. u:object_r:vendor_default_prop:s0
vendor. u:object_r:vendor_default_prop:s0
Add label for time (zone) system properties This adds a label for system properties that will affect system-wide time / time detection logic. The first example will be something like: persist.time.detection_impl_version Bug: 78217059 Test: build Change-Id: I46044f1e28170760001da9acf2496a1e3037e48a
2018-06-25 16:36:51 +02:00
# Properties that relate to time / time zone detection behavior.
persist.time. u:object_r:time_prop:s0
sepolicy for server configurable flags Test: manual on device Change-Id: Ibafe1b345489c88a49a7ed3e2e61e5cc5e1880a1
2018-10-26 05:09:55 +02:00
# Properties that relate to server configurable flags
Sepolicies for server configural flags reset Test: m -j succeeded and manual tested on device Change-Id: I3415c58335361a9da4ef2368e61bc4e0250a91bb
2018-11-09 01:46:19 +01:00
device_config.reset_performed u:object_r:device_config_reset_performed_prop:s0
Update sepolicy with new native boot flag for activity_manager Whitelist the persistent system properties that will be used as flags in activity manager experiments. Bug: 120794810 Test: m, flash, test getting flag value in ActivityManagerService.java Change-Id: I90a10bc87d6db3a64347b62fd02e6f0b12ac9fa8
2019-01-17 22:30:05 +01:00
persist.device_config.activity_manager_native_boot. u:object_r:device_config_activity_manager_native_boot_prop:s0
sepolicy for server configurable flags Test: manual on device Change-Id: Ibafe1b345489c88a49a7ed3e2e61e5cc5e1880a1
2018-10-26 05:09:55 +02:00
persist.device_config.attempted_boot_count u:object_r:device_config_boot_count_prop:s0
Permissions for input_native_boot flags For input experiments that are enabled at boot time, allow system_server to read and write the device config flags. Bug: 120794829 Test: presubmit Change-Id: I0f075a7579c593d4e07c3e31be529e34554068a6
2019-01-14 23:18:38 +01:00
persist.device_config.input_native_boot. u:object_r:device_config_input_native_boot_prop:s0
SEPolicy updates for adding native flag namespace(netd). For experiment flag testing, we add a flag netd and have SEPolicy updates. Test: add sepolicy, m -j, check GetServerConfigurableFlag function in netd Bug:122050512 Change-Id: I21c844c277afc358085d80447f16e4c0d4eba5b3
2018-12-27 11:01:25 +01:00
persist.device_config.netd_native. u:object_r:device_config_netd_native_prop:s0
Rename runtime -> runtime_native property namespace The convention for native properties is to use _native suffix. Bug: 123524494 Bug: 120794191 Test: set a property and ensure it can be read in AndroidRuntime.cpp Change-Id: I69feab9be78f24d812b8f953d3ec06a5d8d18f15
2019-01-29 18:57:11 +01:00
persist.device_config.runtime_native. u:object_r:device_config_runtime_native_prop:s0
Add device_config_runtime_native_boot_prop Some runtime properties require reboots and should be in the native_boot namespace instead of native. Bug: 120794191 Bug: 123524494 Test: set a property and ensure it can be read in AndroidRuntime.cpp Change-Id: I1d1e984dcba26dd04d34a7d30fc63e1b75a8a311
2019-02-01 22:43:11 +01:00
persist.device_config.runtime_native_boot. u:object_r:device_config_runtime_native_boot_prop:s0
SEPolicy updates for adding native flag namespace(media). Test: add sepolicy, build, check GetServerConfigurableFlag function Bug: 123658514 Change-Id: I798b0ef901068c53070e768305acd38118a7e886
2019-01-31 00:28:31 +01:00
persist.device_config.media_native. u:object_r:device_config_media_native_prop:s0
Add native flags namespace storage_native_boot Grant SEPolicy write permissions for device_config_storage_native_boot. Test: build and flash - device successfully boots Bug: 140803239 Change-Id: I6e4f5889aee9384b47faacb31e2b1938250428ef
2019-09-23 16:14:47 +02:00
persist.device_config.storage_native_boot. u:object_r:device_config_storage_native_boot_prop:s0
Whitelisting window_manager_native_boot system property Bug: 147096935 Test: build, boot Change-Id: Iadeefa3cfc9bb17eb19b60dbd18de047fa01b673
2020-01-16 19:52:34 +01:00
persist.device_config.window_manager_native_boot. u:object_r:device_config_window_manager_native_boot_prop:s0
Whitelist prop persist.device_config.configuration. For system prop flags from DeviceConfig namespace "Configuration". Test: Build and run on local device Bug: 149420506 Change-Id: If4196b4bf231e7c52f98b92cc0031a08dad06120
2020-02-27 23:05:05 +01:00
persist.device_config.configuration. u:object_r:device_config_configuration_prop:s0
apexd_prop is defined for PRODUCT_COMPATIBLE_PROPERTY = false case apexd_prop is also defined in private/propery_contexts in order to make the type to exist even when PRODUCT_COMPATIBLE_PROPERTY is false (i.e., Pixel 1). Bug: 119220815 Test: m plat_property_contexts for sailfish the built plat_property_contexts has apexd_prop defined Change-Id: I9ef71410533c1f64fc6a3112cfcb199d23aaf3db
2018-11-08 03:24:34 +01:00
Re-add sys_traced prop Add permissions for: persist.device_config.global_settings.sys_traced Bug: b/71737179 Test: As follows: patch aosp/891475 patch aosp/891853 patch ag/6224352 $ adb shell walleye:/ $ ps -A | grep traced nobody 1135 1 52288 2200 0 0 S traced nobody 1136 1 52288 2256 0 0 S traced_probes walleye:/ $ settings put global sys_traced 0 walleye:/ $ ps -A | grep traced 1|walleye:/ $ walleye:/ $ settings put global sys_traced 1 1|walleye:/ $ ps -A | grep traced nobody 12386 1 52288 2208 0 0 S traced nobody 12387 1 52288 2248 0 0 S traced_probes Change-Id: I8898672c8fdc9c5d87a31b90f6c7d5c03bef78ed
2019-04-05 17:41:30 +02:00
# Properties that relate to legacy server configurable flags
persist.device_config.global_settings.sys_traced u:object_r:device_config_sys_traced_prop:s0
apexd_prop is defined for PRODUCT_COMPATIBLE_PROPERTY = false case apexd_prop is also defined in private/propery_contexts in order to make the type to exist even when PRODUCT_COMPATIBLE_PROPERTY is false (i.e., Pixel 1). Bug: 119220815 Test: m plat_property_contexts for sailfish the built plat_property_contexts has apexd_prop defined Change-Id: I9ef71410533c1f64fc6a3112cfcb199d23aaf3db
2018-11-08 03:24:34 +01:00
apexd. u:object_r:apexd_prop:s0
Add persist.apexd. property context. For persistent properties related to apexd. Bug: 121302351 Test: apexd can get the prop Change-Id: Id9fd25923385188f46a9804155168c52f6b1187e
2019-01-09 12:04:03 +01:00
persist.apexd. u:object_r:apexd_prop:s0
Add permissions for bpf.progs_loaded property Change-Id: If4e550e4186415c5a1088bb53b0755b69f92560a Signed-off-by: Joel Fernandes <joelaf@google.com>
2019-01-11 14:32:45 +01:00
bpf.progs_loaded u:object_r:bpf_progs_loaded_prop:s0
Add sepolicy for gsid properties, and allow system_server to read them. Bug: 123777418 Test: manual test Change-Id: I9f8c721dfd074e638573d85cf1d8045a69c3854e
2019-02-07 22:14:20 +01:00
gsid. u:object_r:gsid_prop:s0
ro.gsid. u:object_r:gsid_prop:s0
NNAPI property to disable extensions use on GSI/AOSP product partition. Property is NNAPI client-readable and writeable only by init/build.prop. Bug: 129666983 Bug: 120483623 Test: flashed crosshatch/Cts tests for NNAPI Change-Id: Ic4c0f176440610a2c54c078863f3d5382323cc65
2019-04-02 16:34:16 +02:00
# Property for disabling NNAPI vendor extensions on product image (used on GSI /product image,
# which can't use NNAPI vendor extensions).
ro.nnapi.extensions.deny_on_product u:object_r:nnapi_ext_deny_product_prop:s0
Use a property instead of file to communicate cold boot done Ueventd can't set properties currently, but this is an artificial limitation, since ueventd communicates to init that it has finished cold boot via a file, and init polls this file instead of returning to the epoll loop, where properties are handled. A related change replaces that file with a property and thus frees ueventd to be able to set properties. This change creates the cold_boot_done property type for this property and gives only ueventd permissions to set it. Bug: 62301678 Test: boot, check that properties are set Change-Id: I40843b423b192ea841db6a82f648e5bab9738e0e
2019-06-18 18:53:51 +02:00
# Property that is set once ueventd finishes cold boot.
ro.cold_boot_done u:object_r:cold_boot_done_prop:s0
Allow charger to read ro.charger.* Allow charger to read system properties with this prefix so that charger's behavior is controlled by runtime. Test: run offline charging on walleye Bug: 124118169 Change-Id: I4266b2d043a5323b4adbd1636ada46b7e08ca667
2019-07-08 19:57:46 +02:00
# Charger properties
Add charger related property contexts ro.enable_boot_charger_mode and sys.boot_from_charger_mode are moved to new property contexts for charger props to remove exported*_prop. Bug: 155844385 Test: boot device with ro.enable_boot_charger_mode Change-Id: I17d195d3c9c002a42125d46a5efcdb890f1c2a5c
2020-07-10 07:15:15 +02:00
ro.charger. u:object_r:charger_prop:s0
sys.boot_from_charger_mode u:object_r:charger_status_prop:s0 exact int
ro.enable_boot_charger_mode u:object_r:charger_config_prop:s0 exact bool
Allow update_engine to read virtual ab feature flag. Test: adb shell getprop -Z [the two flags] Bug: 135752105 Change-Id: I3e0372e969ea0161787c32560a8c40fed2953619
2019-07-25 22:28:19 +02:00
# Virtual A/B properties
ro.virtual_ab.enabled u:object_r:virtual_ab_prop:s0
ro.virtual_ab.retrofit u:object_r:virtual_ab_prop:s0
Add a new context for property ota.warm_reset The property is set to inform kernel to do a warm_reset on the next reboot. This is useful to persist the logs to debug device boot failures. More details in http://go/rvc-ota-persist-logs. The property is set to 1 by update_engine after an OTA. And it's set to 0 by update_verifier or vold after we mark the current slot boot successful. The property is read by vendor_init. And according to its value, vendor_init writes a particular sysfs file to schedule a warm reset on the following reboot. Without the new context, the denial message says: [ 13.423163] audit: type=1107 audit(1746393.166:8): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=u:r:init:s0 msg='avc: denied { read } for property=ota.warm_reset pid=0 uid=0 gid=0 scontext=u:r:vendor_init:s0 tcontext=u:object_r:default_prop:s0 tclass=file permissive=0' [ 23.096497] init: Unable to set property 'OTA.warm_reset' from uid:0 gid:2001 pid:841: SELinux permission check failed [ 23.096574] type=1107 audit(1573768000.668:42): uid=0 auid=4294967295 ses=4294967295 subj=u:r:init:s0 msg='avc: denied { set } for property=OTA.warm_reset pid=841 uid=0 gid=2001 scontext=u:r:update_verifier:s0 tcontext=u:object_r:default_prop:s0 tclass=property_service permissive=0' [ 23.108430] update_verifier: Failed to reset the warm reset flag Bug: 143489994 Test: check the property can be set by update_engine, and read by vendor_init Change-Id: I87c12a53a138b72ecfed3ab6a4d846c20f5a8484
2019-11-14 23:18:40 +01:00
# Property to set/clear the warm reset flag after an OTA update.
ota.warm_reset u:object_r:ota_prop:s0
Add sepolicy for sdkext module prop Add a domain for derive_sdk which is allowed to set persist.com.android.sdkext.sdk_info, readable by all apps (but should only be read by the BCP). Bug: 137191822 Test: run derive_sdk, getprop persist.com.android.sdkext.sdk_info Change-Id: I389116f45faad11fa5baa8d617dda30fb9acec7a
2019-11-25 14:10:10 +01:00
# Module properties
Rename sdkext sepolicy to sdkextensions The module is getting renamed, so rename all the policy relating to it at the same time. Bug: 137191822 Test: presubmit Change-Id: Ia9d966ca9884ce068bd96cf5734e4a459158c85b Merged-In: Ia9d966ca9884ce068bd96cf5734e4a459158c85b (cherry picked from commit 6505573c36dcc6153af37895e968400f722119ea)
2020-01-06 18:29:13 +01:00
com.android.sdkext. u:object_r:module_sdkextensions_prop:s0
persist.com.android.sdkext. u:object_r:module_sdkextensions_prop:s0
Add userspace_reboot_log_prop This properties are used to compute UserspaceRebootAtom and are going to be written by system_server. Also removed now unused userspace_reboot_prop. Test: builds Bug: 148767783 Change-Id: Iee44b4ca9f5d3913ac71b2ac6959c232f060f0ed
2020-02-07 01:10:29 +01:00
# Userspace reboot properties
sys.userspace_reboot.log. u:object_r:userspace_reboot_log_prop:s0
persist.sys.userspace_reboot.log. u:object_r:userspace_reboot_log_prop:s0
selinux policy for buffer queue config Test: boot and check for no policy violations Change-Id: I1ea2a79b9a45b503dcb061c196c5af1d0ddab653
2020-01-20 06:11:07 +01:00
# Integer property which is used in libgui to configure the number of frames
# tracked by buffer queue's frame event timing history. The property is set
# by devices with video decoding pipelines long enough to overflow the default
# history size.
ro.lib_gui.frame_event_history_size u:object_r:bq_config_prop:s0
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Move audio config props to audio_config_prop Bug: 155844385 Test: sepolicy_tests Change-Id: Ic199925b5e3e1c80f1e692c8c5fc2cbb73eda0f5
2020-05-06 12:17:42 +02:00
af.fast_track_multiplier u:object_r:audio_config_prop:s0 exact int
ro.af.client_heap_size_kbyte u:object_r:audio_config_prop:s0 exact int
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Move audio config props to audio_config_prop Bug: 155844385 Test: sepolicy_tests Change-Id: Ic199925b5e3e1c80f1e692c8c5fc2cbb73eda0f5
2020-05-06 12:17:42 +02:00
audio.camerasound.force u:object_r:audio_config_prop:s0 exact bool
audio.deep_buffer.media u:object_r:audio_config_prop:s0 exact bool
audio.offload.video u:object_r:audio_config_prop:s0 exact bool
audio.offload.min.duration.secs u:object_r:audio_config_prop:s0 exact int
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Move ro.audio.* props to audio_config_prop Bug: 155844385 Test: boot, play sound and see no denials Change-Id: If457a6a1fe083d77a3387051edcf40fb12a0624c
2020-06-23 16:52:55 +02:00
ro.audio.ignore_effects u:object_r:audio_config_prop:s0 exact bool
ro.audio.monitorRotation u:object_r:audio_config_prop:s0 exact bool
Move more properties out of exported3_default_prop This is to remove exported3_default_prop. Contexts of these properties are changed. - ro.boot.wificountrycode This becomes wifi_config_prop - ro.opengles.version This becomes graphics_config_prop. Also it's read by various domains, so graphics_config_prop is now readable from coredomain. - persist.config.calibration_fac This becomes camera_calibration_prop. It's only readable by appdomain. Bug: 155844385 Test: no denials on Pixel devices Test: connect wifi Change-Id: If2b6c10fa124e29d1612a8f94ae18b223849e2a9
2020-07-20 13:26:07 +02:00
persist.config.calibration_fac u:object_r:camera_calibration_prop:s0 exact string
Move camera config props to camera_config_prop Bug: 155844385 Test: sepolicy_tests Change-Id: Iebe81d9af48e68e6499272bd5815e959f5945567
2020-05-06 17:36:05 +02:00
config.disable_cameraservice u:object_r:camera_config_prop:s0 exact bool
camera.disable_zsl_mode u:object_r:camera_config_prop:s0 exact bool
camera.fifo.disable u:object_r:camera_config_prop:s0 exact bool
ro.camera.notify_nfc u:object_r:camera_config_prop:s0 exact bool
ro.camera.enableLazyHal u:object_r:camera_config_prop:s0 exact bool
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Add missing dalvik.vm properties. Add missing properties identified by SRC=frameworks/native/cmds/installd/dexopt.cpp; \ CTX=system/sepolicy/private/property_contexts; \ for i in `grep -oE 'dalvik\.vm\.[^"]*' $SRC`; do \ grep -qF "$i " $CTX || echo "$i"; \ done Test: aosp_taimen-userdebug boots. Change-Id: I0678e0bfb1d50045ade37f504311ad39801f2135
2020-04-27 12:34:33 +02:00
# Should always_debuggable be bool? It's checked against the string "1".
dalvik.vm.always_debuggable u:object_r:dalvik_config_prop:s0 exact int
dalvik.vm.appimageformat u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.backgroundgctype u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.boot-dex2oat-cpu-set u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.boot-dex2oat-threads u:object_r:dalvik_config_prop:s0 exact int
dalvik.vm.boot-image u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.checkjni u:object_r:dalvik_config_prop:s0 exact bool
dalvik.vm.dex2oat-Xms u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.dex2oat-Xmx u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.dex2oat-cpu-set u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.dex2oat-filter u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.dex2oat-flags u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.dex2oat-max-image-block-size u:object_r:dalvik_config_prop:s0 exact int
dalvik.vm.dex2oat-minidebuginfo u:object_r:dalvik_config_prop:s0 exact bool
dalvik.vm.dex2oat-resolve-startup-strings u:object_r:dalvik_config_prop:s0 exact bool
dalvik.vm.dex2oat-threads u:object_r:dalvik_config_prop:s0 exact int
dalvik.vm.dex2oat-updatable-bcp-packages-file u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.dex2oat-very-large u:object_r:dalvik_config_prop:s0 exact int
dalvik.vm.dex2oat-swap u:object_r:dalvik_config_prop:s0 exact bool
dalvik.vm.dex2oat64.enabled u:object_r:dalvik_config_prop:s0 exact bool
dalvik.vm.dexopt.secondary u:object_r:dalvik_config_prop:s0 exact bool
dalvik.vm.execution-mode u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.extra-opts u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.foreground-heap-growth-multiplier u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.gctype u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.heapgrowthlimit u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.heapmaxfree u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.heapminfree u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.heapsize u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.heapstartsize u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.heaptargetutilization u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.hot-startup-method-samples u:object_r:dalvik_config_prop:s0 exact int
dalvik.vm.image-dex2oat-Xms u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.image-dex2oat-Xmx u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.image-dex2oat-cpu-set u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.image-dex2oat-filter u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.image-dex2oat-flags u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.image-dex2oat-threads u:object_r:dalvik_config_prop:s0 exact int
dalvik.vm.isa.arm.features u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.isa.arm.variant u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.isa.arm64.features u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.isa.arm64.variant u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.isa.mips.features u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.isa.mips.variant u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.isa.mips64.features u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.isa.mips64.variant u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.isa.unknown.features u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.isa.unknown.variant u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.isa.x86.features u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.isa.x86.variant u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.isa.x86_64.features u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.isa.x86_64.variant u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.jitinitialsize u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.jitmaxsize u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.jitprithreadweight u:object_r:dalvik_config_prop:s0 exact int
dalvik.vm.jitthreshold u:object_r:dalvik_config_prop:s0 exact int
dalvik.vm.jittransitionweight u:object_r:dalvik_config_prop:s0 exact int
dalvik.vm.jniopts u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.lockprof.threshold u:object_r:dalvik_config_prop:s0 exact int
dalvik.vm.method-trace u:object_r:dalvik_config_prop:s0 exact bool
dalvik.vm.method-trace-file u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.method-trace-file-siz u:object_r:dalvik_config_prop:s0 exact int
dalvik.vm.method-trace-stream u:object_r:dalvik_config_prop:s0 exact bool
dalvik.vm.profilesystemserver u:object_r:dalvik_config_prop:s0 exact bool
dalvik.vm.profilebootclasspath u:object_r:dalvik_config_prop:s0 exact bool
dalvik.vm.restore-dex2oat-cpu-set u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.restore-dex2oat-threads u:object_r:dalvik_config_prop:s0 exact int
dalvik.vm.usejit u:object_r:dalvik_config_prop:s0 exact bool
dalvik.vm.usejitprofiles u:object_r:dalvik_config_prop:s0 exact bool
dalvik.vm.zygote.max-boot-retry u:object_r:dalvik_config_prop:s0 exact int
Relabel various exported3_default_prop This removes bad context names "exported*_prop". Property contexts of following properties are changed. All properties are settable only by vendor-init. - ro.config.per_app_memcg This becomes lmkd_config_prop. - ro.zygote This becomes dalvik_config_prop. - ro.oem_unlock_supported This becomes oem_unlock_prop. It's readable by system_app which includes Settings apps. - ro.storage_manager.enabled This becomes storagemanagr_config_prop. It's readable by coredomain. Various domains in coredomain seem to read it. - sendbug.preferred.domain This bcomes sendbug_config_prop. It's readable by appdomain. There are still 3 more exported3_default_prop, which are going to be tracked individually. Bug: 155844385 Test: selinux denial check on Pixel devices Change-Id: I340c903ca7bda98a92d0f157c65f6833ed00df05
2020-07-16 15:25:47 +02:00
ro.zygote u:object_r:dalvik_config_prop:s0 exact string
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Add new context dalvik_runtime_prop persist.sys.dalvik.vm.lib.2 is moved to a new context dalvik_runtime_prop from bad context name. Bug: 154885206 Test: boot device and see logcat Change-Id: I9dea95105c266088d5f071bf2d890048f0999b0b
2020-05-12 15:51:48 +02:00
persist.sys.dalvik.vm.lib.2 u:object_r:dalvik_runtime_prop:s0 exact string
Add keyguard_config_prop for keyguard property keyguard.no_require_sim becomes keyguard_config_prop to remove exported*_default_prop Bug: 155844385 Test: boot and see no denials Change-Id: Icffa88b650a1d35d8c1cd29f89daf0644a79ddd3
2020-07-07 05:46:24 +02:00
keyguard.no_require_sim u:object_r:keyguard_config_prop:s0 exact bool
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Relabel media.recorder.show_manufacturer_and_model To remove exported*_default_prop Bug: 155844385 Test: capture video Test: atest writerTest Change-Id: I74223c8daa44acf0aba33bff31cfe21f6242f941
2020-07-06 15:24:11 +02:00
media.recorder.show_manufacturer_and_model u:object_r:media_config_prop:s0 exact bool
Move media.* properties to media_config_prop Bug: 154885206 Bug: 155844385 Test: m selinux_policy Change-Id: Idfbafd29c51f7ce4512ea0d88fc7534e28eb1738
2020-05-11 10:33:27 +02:00
media.stagefright.cache-params u:object_r:media_config_prop:s0 exact string
media.stagefright.thumbnail.prefer_hw_codecs u:object_r:media_config_prop:s0 exact bool
persist.sys.media.avsync u:object_r:media_config_prop:s0 exact bool
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
persist.bluetooth.a2dp_offload.cap u:object_r:bluetooth_a2dp_offload_prop:s0 exact string
persist.bluetooth.a2dp_offload.disabled u:object_r:bluetooth_a2dp_offload_prop:s0 exact bool
persist.bluetooth.bluetooth_audio_hal.disabled u:object_r:bluetooth_audio_hal_prop:s0 exact bool
persist.bluetooth.btsnoopenable u:object_r:exported_bluetooth_prop:s0 exact bool
persist.radio.multisim.config u:object_r:exported3_radio_prop:s0 exact string
Add ro.hdmi.cec.source.send_standby_on_sleep Bug: 161205654 Test: manually tested that system property takes effect. Change-Id: I0e6eb8048f05de91d96680ff1a64ce142a2f5c94
2020-07-27 09:40:39 +02:00
persist.sys.hdmi.keep_awake u:object_r:hdmi_config_prop:s0 exact bool
ro.hdmi.cec_device_types u:object_r:hdmi_config_prop:s0 exact string
ro.hdmi.device_type u:object_r:hdmi_config_prop:s0 exact string
ro.hdmi.wake_on_hotplug u:object_r:hdmi_config_prop:s0 exact bool
ro.hdmi.cec.source.send_standby_on_sleep u:object_r:hdmi_config_prop:s0 exact enum to_tv broadcast none
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
pm.dexopt.ab-ota u:object_r:exported_pm_prop:s0 exact string
pm.dexopt.bg-dexopt u:object_r:exported_pm_prop:s0 exact string
pm.dexopt.boot u:object_r:exported_pm_prop:s0 exact string
pm.dexopt.disable_bg_dexopt u:object_r:exported_pm_prop:s0 exact bool
pm.dexopt.downgrade_after_inactive_days u:object_r:exported_pm_prop:s0 exact int
pm.dexopt.first-boot u:object_r:exported_pm_prop:s0 exact string
pm.dexopt.inactive u:object_r:exported_pm_prop:s0 exact string
pm.dexopt.install u:object_r:exported_pm_prop:s0 exact string
pm.dexopt.shared u:object_r:exported_pm_prop:s0 exact string
ro.apk_verity.mode u:object_r:apk_verity_prop:s0 exact int
ro.bluetooth.a2dp_offload.supported u:object_r:bluetooth_a2dp_offload_prop:s0 exact bool
ro.boot.vendor.overlay.theme u:object_r:exported_overlay_prop:s0 exact string
ro.bt.bdaddr_path u:object_r:exported_bluetooth_prop:s0 exact string
Export missing audio volume properties The following properties are used in AudioService: ro.config.alarm_vol_default ro.config.alarm_vol_steps ro.config.media_vol_default ro.config.system_vol_default ro.config.system_vol_steps ro.config.vc_call_vol_default Test: properties can be set from vendor with PRODUCT_COMPATIBLE_PROPERTY_OVERRIDE := true Change-Id: Ib90103173989fcb0723f3d8465df3cd03334cc53
2020-03-10 22:51:09 +01:00
ro.config.alarm_alert u:object_r:systemsound_config_prop:s0 exact string
ro.config.alarm_vol_default u:object_r:systemsound_config_prop:s0 exact int
ro.config.alarm_vol_steps u:object_r:systemsound_config_prop:s0 exact int
ro.config.media_vol_default u:object_r:systemsound_config_prop:s0 exact int
ro.config.media_vol_steps u:object_r:systemsound_config_prop:s0 exact int
ro.config.notification_sound u:object_r:systemsound_config_prop:s0 exact string
ro.config.ringtone u:object_r:systemsound_config_prop:s0 exact string
ro.config.system_vol_default u:object_r:systemsound_config_prop:s0 exact int
ro.config.system_vol_steps u:object_r:systemsound_config_prop:s0 exact int
ro.config.vc_call_vol_default u:object_r:systemsound_config_prop:s0 exact int
Rename exported2_config_prop to systemsound_config_prop Fixing bad names (exported*_prop) on property contexts. Bug: 152468650 Test: m sepolicy_tests Change-Id: Ie98212ee0fa89966e70faa83322b65b613f3b3f5
2020-04-01 03:01:16 +02:00
Add new context packagemanager_config_prop To remove bad context names exported[23]_default_prop Bug: 155844385 Test: m selinux_policy Change-Id: Ic4bbc8e45d810368a96f6985c2234798e73be82d Merged-In: Ic4bbc8e45d810368a96f6985c2234798e73be82d (cherry picked from commit 072b01438e02e9d3cfba04c768e7a440549cc8b1)
2020-06-16 13:00:41 +02:00
ro.control_privapp_permissions u:object_r:packagemanager_config_prop:s0 exact enum disable enforce log
ro.cp_system_other_odex u:object_r:packagemanager_config_prop:s0 exact bool
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Rename exported and exported2 vold prop This is a subtask to clean up bad context names "exported*_prop". Bug: 152469526 Test: m Change-Id: Ie2d4046732e9d6562294fa664dcd7f019aa7c229
2020-04-06 13:49:17 +02:00
ro.crypto.allow_encrypt_override u:object_r:vold_config_prop:s0 exact bool
ro.crypto.dm_default_key.options_format.version u:object_r:vold_config_prop:s0 exact int
ro.crypto.fde_algorithm u:object_r:vold_config_prop:s0 exact string
ro.crypto.fde_sector_size u:object_r:vold_config_prop:s0 exact int
ro.crypto.scrypt_params u:object_r:vold_config_prop:s0 exact string
ro.crypto.set_dun u:object_r:vold_config_prop:s0 exact bool
ro.crypto.volume.contents_mode u:object_r:vold_config_prop:s0 exact string
ro.crypto.volume.filenames_mode u:object_r:vold_config_prop:s0 exact string
ro.crypto.volume.metadata.encryption u:object_r:vold_config_prop:s0 exact string
ro.crypto.volume.metadata.method u:object_r:vold_config_prop:s0 exact string
ro.crypto.volume.options u:object_r:vold_config_prop:s0 exact string
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Rename exported_dalvik_prop to dalvik_config_prop This is to clean up bad name "exported_dalvik_prop" Bug: 154465224 Test: sepolicy_tests Test: treble_sepolicy_tests 26.0 ~ 29.0 Change-Id: Ie5e738b5985c1db1bca7a857971d8490a7980b5b
2020-04-20 12:36:33 +02:00
ro.dalvik.vm.native.bridge u:object_r:dalvik_config_prop:s0 exact string
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Add external_storage properties. Since these need to be set from a vendor context. Bug: 152170470 Bug: 153525566 Test: N/A Change-Id: I2e90ad08fa0a5bd2b4759d92f95d35cec2b316df
2020-04-10 14:11:49 +02:00
external_storage.projid.enabled u:object_r:storage_config_prop:s0 exact bool
external_storage.casefold.enabled u:object_r:storage_config_prop:s0 exact bool
Add sdcardfs variable to storage_config_props This property allows us to disable sdcardfs if it is present. The old property ended up getting repurposed, so a new one was needed. Mediaprovider will also need to access this to determine what actions it needs to take. Test: builds Bug: 155222498 Change-Id: I66ac106613cbb374f54659601e4ba3f61eaecd2f
2020-05-12 07:50:40 +02:00
external_storage.sdcardfs.enabled u:object_r:storage_config_prop:s0 exact bool
Add external_storage properties. Since these need to be set from a vendor context. Bug: 152170470 Bug: 153525566 Test: N/A Change-Id: I2e90ad08fa0a5bd2b4759d92f95d35cec2b316df
2020-04-10 14:11:49 +02:00
Relabel various exported3_default_prop This removes bad context names "exported*_prop". Property contexts of following properties are changed. All properties are settable only by vendor-init. - ro.config.per_app_memcg This becomes lmkd_config_prop. - ro.zygote This becomes dalvik_config_prop. - ro.oem_unlock_supported This becomes oem_unlock_prop. It's readable by system_app which includes Settings apps. - ro.storage_manager.enabled This becomes storagemanagr_config_prop. It's readable by coredomain. Various domains in coredomain seem to read it. - sendbug.preferred.domain This bcomes sendbug_config_prop. It's readable by appdomain. There are still 3 more exported3_default_prop, which are going to be tracked individually. Bug: 155844385 Test: selinux denial check on Pixel devices Change-Id: I340c903ca7bda98a92d0f157c65f6833ed00df05
2020-07-16 15:25:47 +02:00
ro.config.per_app_memcg u:object_r:lmkd_config_prop:s0 exact bool
Move ro.lmk. properties to lmkd_config_prop Bug: 155844385 Test: sepolicy_tests Change-Id: I6a4412b3e7d3c46eae699bd8e7d2941f56b31773
2020-05-06 10:11:46 +02:00
ro.lmk.critical u:object_r:lmkd_config_prop:s0 exact int
ro.lmk.critical_upgrade u:object_r:lmkd_config_prop:s0 exact bool
ro.lmk.debug u:object_r:lmkd_config_prop:s0 exact bool
ro.lmk.downgrade_pressure u:object_r:lmkd_config_prop:s0 exact int
ro.lmk.kill_heaviest_task u:object_r:lmkd_config_prop:s0 exact bool
ro.lmk.kill_timeout_ms u:object_r:lmkd_config_prop:s0 exact int
ro.lmk.low u:object_r:lmkd_config_prop:s0 exact int
ro.lmk.medium u:object_r:lmkd_config_prop:s0 exact int
ro.lmk.psi_partial_stall_ms u:object_r:lmkd_config_prop:s0 exact int
ro.lmk.psi_complete_stall_ms u:object_r:lmkd_config_prop:s0 exact int
ro.lmk.swap_free_low_percentage u:object_r:lmkd_config_prop:s0 exact int
ro.lmk.swap_util_max u:object_r:lmkd_config_prop:s0 exact int
ro.lmk.thrashing_limit u:object_r:lmkd_config_prop:s0 exact int
ro.lmk.thrashing_limit_decay u:object_r:lmkd_config_prop:s0 exact int
ro.lmk.use_minfree_levels u:object_r:lmkd_config_prop:s0 exact bool
ro.lmk.upgrade_pressure u:object_r:lmkd_config_prop:s0 exact int
Add lmkd. property policies lmkd.reinit property allows vendors to trigger lmkd reinitialization. Add lmkd_prop to support lmkd.* properties inlcuding lmkd.reinit. Bug: 155149944 Test: setprop lmkd.reinit 1 Signed-off-by: Suren Baghdasaryan <surenb@google.com> Change-Id: I6ba598bad7ebb40fd6f23de473f25f32e53c996d
2020-05-05 21:41:02 +02:00
lmkd.reinit u:object_r:lmkd_prop:s0 exact int
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Allow XML file paths to be customized with sysprop Three properties are declared as vendor-init-settable: ro.media.xml_variant.codecs ro.media.xml_variant.codecs_performance ro.media.xml_variant.profiles media_codecs.xml can now be named media_codecs${ro.media.xml_variant.codecs}.xml media_codecs_performance.xml can now be named media_codecs_performance${ro.media.xml_variant.codecs_performance}.xml media_profiles_V1_0 can now be named media_profiles${ro.media.xml_variant.profiles}.xml Test: Rename "media_codecs.xml" to "media_codecs_test.xml", set ro.media.xml_variant.codecs to "_test", then call "stagefright -i". Test: Rename "media_codecs_performance.xml" to "media_codecs_performance_test.xml", set ro.media.xml_variant.codecs_performance to "_test", then run android.media.cts.VideoDecoderPerfTest. Test: Rename "media_profiles_V1_0.xml" to "media_profiles_test.xml", set ro.media.xml_variant.profiles to "_test", then run vts_mediaProfiles_validate_test. Bug: 142102953 Change-Id: I407a0a327fcc8e799bb4079b11048a497565be48
2020-03-07 13:15:38 +01:00
ro.media.xml_variant.codecs u:object_r:media_variant_prop:s0 exact string
ro.media.xml_variant.codecs_performance u:object_r:media_variant_prop:s0 exact string
ro.media.xml_variant.profiles u:object_r:media_variant_prop:s0 exact string
Relabel minui properties as recovery_config_prop To clean up bad context name exported[23]_default_prop Bug: 155844385 Test: m selinux_policy Test: enter recovery mode Change-Id: I312b6fa911a90dfc069a973c7916c67d92b7baa5
2020-06-16 12:18:24 +02:00
ro.minui.default_rotation u:object_r:recovery_config_prop:s0 exact string
ro.minui.overscan_percent u:object_r:recovery_config_prop:s0 exact int
ro.minui.pixel_format u:object_r:recovery_config_prop:s0 exact string
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Relabel various exported3_default_prop This removes bad context names "exported*_prop". Property contexts of following properties are changed. All properties are settable only by vendor-init. - ro.config.per_app_memcg This becomes lmkd_config_prop. - ro.zygote This becomes dalvik_config_prop. - ro.oem_unlock_supported This becomes oem_unlock_prop. It's readable by system_app which includes Settings apps. - ro.storage_manager.enabled This becomes storagemanagr_config_prop. It's readable by coredomain. Various domains in coredomain seem to read it. - sendbug.preferred.domain This bcomes sendbug_config_prop. It's readable by appdomain. There are still 3 more exported3_default_prop, which are going to be tracked individually. Bug: 155844385 Test: selinux denial check on Pixel devices Change-Id: I340c903ca7bda98a92d0f157c65f6833ed00df05
2020-07-16 15:25:47 +02:00
ro.oem_unlock_supported u:object_r:oem_unlock_prop:s0 exact int
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
ro.rebootescrow.device u:object_r:rebootescrow_hal_prop:s0 exact string
Relabel various exported3_default_prop This removes bad context names "exported*_prop". Property contexts of following properties are changed. All properties are settable only by vendor-init. - ro.config.per_app_memcg This becomes lmkd_config_prop. - ro.zygote This becomes dalvik_config_prop. - ro.oem_unlock_supported This becomes oem_unlock_prop. It's readable by system_app which includes Settings apps. - ro.storage_manager.enabled This becomes storagemanagr_config_prop. It's readable by coredomain. Various domains in coredomain seem to read it. - sendbug.preferred.domain This bcomes sendbug_config_prop. It's readable by appdomain. There are still 3 more exported3_default_prop, which are going to be tracked individually. Bug: 155844385 Test: selinux denial check on Pixel devices Change-Id: I340c903ca7bda98a92d0f157c65f6833ed00df05
2020-07-16 15:25:47 +02:00
ro.storage_manager.enabled u:object_r:storagemanager_config_prop:s0 exact bool
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
ro.vehicle.hal u:object_r:vehicle_hal_prop:s0 exact string
ro.vendor.build.security_patch u:object_r:vendor_security_patch_level_prop:s0 exact string
Rename context names of zram properties Moving from old bad name "exported*_prop". Bug: 154885206 Bug: 155844385 Test: m selinux_policy Change-Id: I21af42980e5e6e2c3cabea6c36825fa2836a55bc
2020-05-08 13:42:25 +02:00
ro.zram.mark_idle_delay_mins u:object_r:zram_config_prop:s0 exact int
ro.zram.first_wb_delay_mins u:object_r:zram_config_prop:s0 exact int
ro.zram.periodic_wb_delay_hours u:object_r:zram_config_prop:s0 exact int
zram.force_writeback u:object_r:zram_config_prop:s0 exact bool
persist.sys.zram_enabled u:object_r:zram_control_prop:s0 exact bool
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Relabel various exported3_default_prop This removes bad context names "exported*_prop". Property contexts of following properties are changed. All properties are settable only by vendor-init. - ro.config.per_app_memcg This becomes lmkd_config_prop. - ro.zygote This becomes dalvik_config_prop. - ro.oem_unlock_supported This becomes oem_unlock_prop. It's readable by system_app which includes Settings apps. - ro.storage_manager.enabled This becomes storagemanagr_config_prop. It's readable by coredomain. Various domains in coredomain seem to read it. - sendbug.preferred.domain This bcomes sendbug_config_prop. It's readable by appdomain. There are still 3 more exported3_default_prop, which are going to be tracked individually. Bug: 155844385 Test: selinux denial check on Pixel devices Change-Id: I340c903ca7bda98a92d0f157c65f6833ed00df05
2020-07-16 15:25:47 +02:00
sendbug.preferred.domain u:object_r:sendbug_config_prop:s0 exact string
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Rename system_radio_prop For whatever reason sys.usb.config* has been labeled as system_radio_prop, which doesn't make sense. Changing context name as usb_prop. For the same reason exported_system_radio_prop is also renamed to usb-related names. Bug: 71814576 Bug: 154885206 Test: m selinux_policy Change-Id: If30bc620dbeac926a8b9bcde908357fda739a6c1 Merged-In: If30bc620dbeac926a8b9bcde908357fda739a6c1 (cherry picked from commit 44fbcdb677d040a7ff9949db8457347a5299b4a0)
2020-04-27 14:13:01 +02:00
persist.sys.usb.usbradio.config u:object_r:usb_control_prop:s0 exact string
sys.usb.config u:object_r:usb_control_prop:s0 exact string
sys.usb.configfs u:object_r:usb_control_prop:s0 exact int
sys.usb.controller u:object_r:usb_control_prop:s0 exact string
sys.usb.state u:object_r:usb_control_prop:s0 exact string
sys.usb.mtp.device_type u:object_r:usb_config_prop:s0 exact int
sys.usb.config. u:object_r:usb_prop:s0
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Rename contexts of ffs props Bug: 71814576 Bug: 154885206 Test: m sepolicy_test Change-Id: Idacc3635851b14b833bccca177d784f4bb92c763
2020-04-27 16:49:15 +02:00
sys.usb.ffs.aio_compat u:object_r:ffs_config_prop:s0 exact bool
sys.usb.ffs.max_read u:object_r:ffs_config_prop:s0 exact int
sys.usb.ffs.max_write u:object_r:ffs_config_prop:s0 exact int
sys.usb.ffs.ready u:object_r:ffs_control_prop:s0 exact bool
sys.usb.ffs.mtp.ready u:object_r:ffs_control_prop:s0 exact bool
Add tombstone_config_prop and move related prop tombstoned.max_tombstone_coun becomes tombstone_config_prop to remove exported*_default_prop Bug: 155844385 Test: tombstoned is running and logcat shows no denials Change-Id: I57bebb5766d790dc52d40a6d106f480e0e34fa4e
2020-07-07 06:35:34 +02:00
tombstoned.max_tombstone_count u:object_r:tombstone_config_prop:s0 exact int
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Rename exported and exported2 vold prop This is a subtask to clean up bad context names "exported*_prop". Bug: 152469526 Test: m Change-Id: Ie2d4046732e9d6562294fa664dcd7f019aa7c229
2020-04-06 13:49:17 +02:00
vold.post_fs_data_done u:object_r:vold_config_prop:s0 exact int
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
apexd.status u:object_r:apexd_prop:s0 exact enum starting activated ready
Add boot_status_prop for boot completed props Assigning a new context boot_status_prop for following two properties: - sys.boot_completed - dev.bootcomplete Bug: 154885206 Test: boot cf_x86 and crosshatch, see no denials Change-Id: Ieadabf90a9a1b54b52a1283bd648c11c95d558dd Merged-In: Ieadabf90a9a1b54b52a1283bd648c11c95d558dd (cherry picked from commit 2973c9605555c119243ef85119576b2d01a12060)
2020-04-24 08:03:01 +02:00
dev.bootcomplete u:object_r:boot_status_prop:s0 exact bool
sys.boot_completed u:object_r:boot_status_prop:s0 exact bool
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Move props out of exported3_system_prop This is to remove bad context name "exported3_system_prop". - persist.sys.device_provisioned -> provisioned_prop - sys.retaildemo.enabled -> retaildemo_prop Bug: 154885206 Test: boot device and see no denials Change-Id: Ia19a19d93d0689deb56d66fe0b039ace44e4836f
2020-05-13 18:38:40 +02:00
persist.sys.device_provisioned u:object_r:provisioned_prop:s0 exact string
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
persist.sys.theme u:object_r:theme_prop:s0 exact string
Move props out of exported3_system_prop This is to remove bad context name "exported3_system_prop". - persist.sys.device_provisioned -> provisioned_prop - sys.retaildemo.enabled -> retaildemo_prop Bug: 154885206 Test: boot device and see no denials Change-Id: Ia19a19d93d0689deb56d66fe0b039ace44e4836f
2020-05-13 18:38:40 +02:00
sys.retaildemo.enabled u:object_r:retaildemo_prop:s0 exact int
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
sys.user.0.ce_available u:object_r:exported3_system_prop:s0 exact bool
Move aac_drc props to aac_drc_prop Bug: 155844385 Test: sepolicy_tests Change-Id: I1755672b5cef876955f93020c519aaaabf814bbf
2020-05-06 11:30:20 +02:00
aac_drc_boost u:object_r:aac_drc_prop:s0 exact int
aac_drc_cut u:object_r:aac_drc_prop:s0 exact int
aac_drc_enc_target_level u:object_r:aac_drc_prop:s0 exact int
aac_drc_heavy u:object_r:aac_drc_prop:s0 exact int
aac_drc_reference_level u:object_r:aac_drc_prop:s0 exact int
ro.aac_drc_effect_type u:object_r:aac_drc_prop:s0 exact int
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
build.version.extensions. u:object_r:module_sdkextensions_prop:s0 prefix int
Relabel drm related props from exported*_prop To clean up bad context name exported[23]_default_prop Bug: 155844385 Test: m selinux_policy Change-Id: I9f9ddb0d44c4cea9bd1724df730bb7be9a6fb2d2
2020-05-25 08:36:44 +02:00
drm.64bit.enabled u:object_r:mediadrm_config_prop:s0 exact bool
media.mediadrmservice.enable u:object_r:mediadrm_config_prop:s0 exact bool
drm.service.enabled u:object_r:drm_service_config_prop:s0 exact bool
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
dumpstate.dry_run u:object_r:exported_dumpstate_prop:s0 exact bool
dumpstate.unroot u:object_r:exported_dumpstate_prop:s0 exact bool
Remove exported2_default_prop This cleans up remaining exported2_default_prop. Three properties are changed. - ro.arch It becomes build_prop. - hal.instrumentation.enable It becomes hal_instrumentation_prop. - ro.property_service.version It becomes property_service_version_prop. Bug: 155844385 Test: selinux denial test on Pixel devices Change-Id: I7ee0bd8c522cc09ee82ef89e6a13bbbf65291291
2020-07-24 17:34:56 +02:00
hal.instrumentation.enable u:object_r:hal_instrumentation_prop:s0 exact bool
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Add contexts for init.svc.* props To remove bad context names "exported*_prop". Other init.svc.* properties explicitly become system internal prop. Bug: 155844385 Test: boot and see no denials Change-Id: I7a3b4103a4cea77035a6e831e3b6a49a45f15a35
2020-05-14 12:43:08 +02:00
# default contexts only accessible by coredomain
Fix init.svc. property contexts entry It should be prefix, not exact Bug: N/A Test: see selinux contexts of init.svc. properties Change-Id: I3fd71c80f752773b784ddb1d7bfa9ab1854d281f
2020-07-22 12:14:56 +02:00
init.svc. u:object_r:init_service_status_private_prop:s0 prefix string
Add contexts for init.svc.* props To remove bad context names "exported*_prop". Other init.svc.* properties explicitly become system internal prop. Bug: 155844385 Test: boot and see no denials Change-Id: I7a3b4103a4cea77035a6e831e3b6a49a45f15a35
2020-05-14 12:43:08 +02:00
# vendor-init-readable init service props
init.svc.bugreport u:object_r:init_service_status_prop:s0 exact string
Allow init.svc.bugreportd to be vendor readable Export the new bugreport entry which was added in b/111441001, similarly to previously exported properties. Bug: 161999587 Test: m selinux_policy Change-Id: I139567ba028e90d3e07df94f57ccf7d5d5225209
2020-07-24 19:54:08 +02:00
init.svc.bugreportd u:object_r:init_service_status_prop:s0 exact string
Add contexts for init.svc.* props To remove bad context names "exported*_prop". Other init.svc.* properties explicitly become system internal prop. Bug: 155844385 Test: boot and see no denials Change-Id: I7a3b4103a4cea77035a6e831e3b6a49a45f15a35
2020-05-14 12:43:08 +02:00
init.svc.console u:object_r:init_service_status_prop:s0 exact string
init.svc.dumpstatez u:object_r:init_service_status_prop:s0 exact string
init.svc.mediadrm u:object_r:init_service_status_prop:s0 exact string
Allow init.svc.statsd to be world readable Instead of having hacky entry "init.svc." in vendor's sepolicy, this adds init.svc.statsd explicitly which should be readable by CTS. Bug: 161922998 Test: m selinux_policy Change-Id: I3fd3bab40d2ccf2581bd7ab55894a693cdf446b2 Merged-In: I3fd3bab40d2ccf2581bd7ab55894a693cdf446b2 (cherry picked from commit 116190b00473c5628d5c5bb73460f7d48a05f0db)
2020-07-23 01:33:24 +02:00
init.svc.statsd u:object_r:init_service_status_prop:s0 exact string
Add contexts for init.svc.* props To remove bad context names "exported*_prop". Other init.svc.* properties explicitly become system internal prop. Bug: 155844385 Test: boot and see no denials Change-Id: I7a3b4103a4cea77035a6e831e3b6a49a45f15a35
2020-05-14 12:43:08 +02:00
init.svc.surfaceflinger u:object_r:init_service_status_prop:s0 exact string
init.svc.tombstoned u:object_r:init_service_status_prop:s0 exact string
init.svc.zygote u:object_r:init_service_status_prop:s0 exact string
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Move libc.debug. props to libc_debug_prop Bug: 155844385 Test: sepolicy_tests Change-Id: I15421ada0c58c3c8d07d824e83cf44f6c4590ca8
2020-05-06 15:20:35 +02:00
libc.debug.malloc.options u:object_r:libc_debug_prop:s0 exact string
libc.debug.malloc.program u:object_r:libc_debug_prop:s0 exact string
libc.debug.hooks.enable u:object_r:libc_debug_prop:s0 exact string
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
net.redirect_socket_calls.hooked u:object_r:socket_hook_prop:s0 exact bool
persist.sys.locale u:object_r:exported_system_prop:s0 exact string
persist.sys.timezone u:object_r:exported_system_prop:s0 exact string
persist.sys.test_harness u:object_r:test_harness_prop:s0 exact bool
Remove exported2_default_prop This cleans up remaining exported2_default_prop. Three properties are changed. - ro.arch It becomes build_prop. - hal.instrumentation.enable It becomes hal_instrumentation_prop. - ro.property_service.version It becomes property_service_version_prop. Bug: 155844385 Test: selinux denial test on Pixel devices Change-Id: I7ee0bd8c522cc09ee82ef89e6a13bbbf65291291
2020-07-24 17:34:56 +02:00
ro.arch u:object_r:build_prop:s0 exact string
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Add bootloader_prop for ro.boot. properties ro.boot. properties assigned as "exported2_default_prop" are now "bootloader_prop", to remove bad context name "exported2_default_prop". Two things to clarify: 1) We have both the prefix entry and the exact entries. Although the exact entries may be redundant, we may want to keep them. Vendors are still allowed to have properties starting with "ro.boot." on vendor_property_contexts file. The exact entries can prevent vendors from modifying them to random contexts. 2) ro.boot. is special as it is originally for kernel command line "androidboot.". But some ro.boot. properties are being used as if they were normal. To avoid regression, ro.boot. properties having contexts other than "exported2_default_prop" are not changed here. They will be tracked later. Bug: 155844385 Test: m selinux_policy Change-Id: Ic0f4117ae68a828787304187457b5e1e105a52c7 Merged-In: Ic0f4117ae68a828787304187457b5e1e105a52c7
2020-07-23 10:54:35 +02:00
# ro.boot. properties are set based on kernel commandline arguments, which are vendor owned.
ro.boot. u:object_r:bootloader_prop:s0
ro.boot.avb_version u:object_r:bootloader_prop:s0 exact string
ro.boot.baseband u:object_r:bootloader_prop:s0 exact string
ro.boot.bootdevice u:object_r:bootloader_prop:s0 exact string
ro.boot.bootloader u:object_r:bootloader_prop:s0 exact string
ro.boot.boottime u:object_r:bootloader_prop:s0 exact string
ro.boot.console u:object_r:bootloader_prop:s0 exact string
ro.boot.hardware u:object_r:bootloader_prop:s0 exact string
ro.boot.hardware.color u:object_r:bootloader_prop:s0 exact string
ro.boot.hardware.sku u:object_r:bootloader_prop:s0 exact string
ro.boot.keymaster u:object_r:bootloader_prop:s0 exact string
ro.boot.mode u:object_r:bootloader_prop:s0 exact string
ro.boot.revision u:object_r:bootloader_prop:s0 exact string
ro.boot.vbmeta.avb_version u:object_r:bootloader_prop:s0 exact string
ro.boot.verifiedbootstate u:object_r:bootloader_prop:s0 exact string
ro.boot.veritymode u:object_r:bootloader_prop:s0 exact string
Move ro.boot related properties to bootloader_prop These 5 properties are all set by property_service, and their values are same as ro.boot.X. Bug: 155844385 Test: m selinux_policy Change-Id: I98fdee73684dc670f61ecef83d6a749b4f24ff54 Merged-In: I98fdee73684dc670f61ecef83d6a749b4f24ff54
2020-07-24 09:53:56 +02:00
# These ro.X properties are set to values of ro.boot.X by property_service.
ro.baseband u:object_r:bootloader_prop:s0 exact string
ro.bootloader u:object_r:bootloader_prop:s0 exact string
ro.bootmode u:object_r:bootloader_prop:s0 exact string
ro.hardware u:object_r:bootloader_prop:s0 exact string
ro.revision u:object_r:bootloader_prop:s0 exact string
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
ro.boot.dynamic_partitions u:object_r:exported_default_prop:s0 exact string
ro.boot.dynamic_partitions_retrofit u:object_r:exported_default_prop:s0 exact string
Relabel ro.build. properties - exported_fingerprint_prop is deleted - other ro.build. properties become build_prop Bug: 155844385 Test: sepolicy_tests Change-Id: Ic1194e8e7c23394e5a7c6176f9f9598109bb5fb7 Merged-In: Ic1194e8e7c23394e5a7c6176f9f9598109bb5fb7 (cherry picked from commit 1d63d5d0756d0d47ef6ec816b3c35b3b96bd50d4)
2020-05-06 13:07:33 +02:00
ro.build.date u:object_r:build_prop:s0 exact string
ro.build.date.utc u:object_r:build_prop:s0 exact int
ro.build.description u:object_r:build_prop:s0 exact string
ro.build.display.id u:object_r:build_prop:s0 exact string
ro.build.host u:object_r:build_prop:s0 exact string
ro.build.id u:object_r:build_prop:s0 exact string
ro.build.product u:object_r:build_prop:s0 exact string
ro.build.system_root_image u:object_r:build_prop:s0 exact bool
ro.build.tags u:object_r:build_prop:s0 exact string
Refine build.prop related properties 1) build_odm_prop and build_vendor_prop are added These contexts will contain world-readable properties from /odm/build.prop and /vendor/build.prop, respectively. 2) move more properties to build_prop Following properties are set by /system/build.prop and now assigned as build_prop: - ro.adb.secure - ro.build.type - ro.product.cpu.abi - ro.product.cpu.abilist - ro.product.cpu.abilist32 - ro.product.cpu.abilist64 - ro.secure Following properties are set by init/property_service.cpp and now assigned as build_prop: - ro.product.brand - ro.product.device - ro.product.manufacturer - ro.product.model - ro.product.name Bug: 71814576 Bug: 155844385 Test: boot device and see no denials Change-Id: Idd4f81de4d2d0fc4bdec2d7ecb08bb8e078dab58
2020-05-19 15:02:58 +02:00
ro.build.type u:object_r:build_prop:s0 exact string
Relabel ro.build. properties - exported_fingerprint_prop is deleted - other ro.build. properties become build_prop Bug: 155844385 Test: sepolicy_tests Change-Id: Ic1194e8e7c23394e5a7c6176f9f9598109bb5fb7 Merged-In: Ic1194e8e7c23394e5a7c6176f9f9598109bb5fb7 (cherry picked from commit 1d63d5d0756d0d47ef6ec816b3c35b3b96bd50d4)
2020-05-06 13:07:33 +02:00
ro.build.user u:object_r:build_prop:s0 exact string
ro.build.version.base_os u:object_r:build_prop:s0 exact string
ro.build.version.codename u:object_r:build_prop:s0 exact string
ro.build.version.incremental u:object_r:build_prop:s0 exact string
ro.build.version.preview_sdk u:object_r:build_prop:s0 exact int
ro.build.version.release u:object_r:build_prop:s0 exact string
ro.build.version.release_or_codename u:object_r:build_prop:s0 exact string
ro.build.version.sdk u:object_r:build_prop:s0 exact int
ro.build.version.security_patch u:object_r:build_prop:s0 exact string
ro.debuggable u:object_r:build_prop:s0 exact bool
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Refine build.prop related properties 1) build_odm_prop and build_vendor_prop are added These contexts will contain world-readable properties from /odm/build.prop and /vendor/build.prop, respectively. 2) move more properties to build_prop Following properties are set by /system/build.prop and now assigned as build_prop: - ro.adb.secure - ro.build.type - ro.product.cpu.abi - ro.product.cpu.abilist - ro.product.cpu.abilist32 - ro.product.cpu.abilist64 - ro.secure Following properties are set by init/property_service.cpp and now assigned as build_prop: - ro.product.brand - ro.product.device - ro.product.manufacturer - ro.product.model - ro.product.name Bug: 71814576 Bug: 155844385 Test: boot device and see no denials Change-Id: Idd4f81de4d2d0fc4bdec2d7ecb08bb8e078dab58
2020-05-19 15:02:58 +02:00
ro.product.cpu.abi u:object_r:build_prop:s0 exact string
ro.product.cpu.abilist u:object_r:build_prop:s0 exact string
ro.product.cpu.abilist32 u:object_r:build_prop:s0 exact string
ro.product.cpu.abilist64 u:object_r:build_prop:s0 exact string
ro.adb.secure u:object_r:build_prop:s0 exact bool
ro.secure u:object_r:build_prop:s0 exact int
# These 5 properties are set by property_service
ro.product.brand u:object_r:build_prop:s0 exact string
ro.product.device u:object_r:build_prop:s0 exact string
ro.product.manufacturer u:object_r:build_prop:s0 exact string
ro.product.model u:object_r:build_prop:s0 exact string
ro.product.name u:object_r:build_prop:s0 exact string
# All odm build props are set by /odm/build.prop
ro.odm.build.date u:object_r:build_odm_prop:s0 exact string
ro.odm.build.date.utc u:object_r:build_odm_prop:s0 exact int
ro.odm.build.fingerprint u:object_r:build_odm_prop:s0 exact string
ro.odm.build.version.incremental u:object_r:build_odm_prop:s0 exact string
ro.product.odm.brand u:object_r:build_odm_prop:s0 exact string
ro.product.odm.device u:object_r:build_odm_prop:s0 exact string
ro.product.odm.manufacturer u:object_r:build_odm_prop:s0 exact string
ro.product.odm.model u:object_r:build_odm_prop:s0 exact string
ro.product.odm.name u:object_r:build_odm_prop:s0 exact string
Fix path for vendor_dlkm build prop. vendor_dlkm build props are loaded from /vendor_dlkm/etc/build.prop. Test: none Bug: 154633114 Change-Id: Ic96ebba2486c891fb05431265e477184353bd7d0
2020-07-16 02:12:15 +02:00
# All vendor_dlkm build props are set by /vendor_dlkm/etc/build.prop
Correct labels on files / props in vendor_dlkm. All files under vendor_dlkm are tagged vendor_file. All build props for vendor_dlkm are mapped as build_vendor_prop. Test: build and `ls /vendor_dlkm -lZ` `adb shell getprop -Z | grep vendor_dlkm` Bug: 154633114 Change-Id: Ie9dc26d948357767fec09aca645606310ad3425c
2020-05-14 05:44:19 +02:00
ro.vendor_dlkm.build.date u:object_r:build_vendor_prop:s0 exact string
ro.vendor_dlkm.build.date.utc u:object_r:build_vendor_prop:s0 exact int
ro.vendor_dlkm.build.fingerprint u:object_r:build_vendor_prop:s0 exact string
ro.vendor_dlkm.build.version.incremental u:object_r:build_vendor_prop:s0 exact string
Correct labels on files / props in odm_dlkm. All files under odm_dlkm are tagged vendor_file. All build props for odm_dlkm are mapped as build_vendor_prop. Test: build and `ls /odm_dlkm -lZ` `adb shell getprop -Z | grep odm_dlkm` Bug: 154633114 Change-Id: Ifca69d0b7a8da945910a9cb0fa907735cd866f12
2020-07-16 02:11:17 +02:00
# All odm_dlkm build props are set by /odm_dlkm/etc/build.prop
ro.odm_dlkm.build.date u:object_r:build_vendor_prop:s0 exact string
ro.odm_dlkm.build.date.utc u:object_r:build_vendor_prop:s0 exact int
ro.odm_dlkm.build.fingerprint u:object_r:build_vendor_prop:s0 exact string
ro.odm_dlkm.build.version.incremental u:object_r:build_vendor_prop:s0 exact string
Refine build.prop related properties 1) build_odm_prop and build_vendor_prop are added These contexts will contain world-readable properties from /odm/build.prop and /vendor/build.prop, respectively. 2) move more properties to build_prop Following properties are set by /system/build.prop and now assigned as build_prop: - ro.adb.secure - ro.build.type - ro.product.cpu.abi - ro.product.cpu.abilist - ro.product.cpu.abilist32 - ro.product.cpu.abilist64 - ro.secure Following properties are set by init/property_service.cpp and now assigned as build_prop: - ro.product.brand - ro.product.device - ro.product.manufacturer - ro.product.model - ro.product.name Bug: 71814576 Bug: 155844385 Test: boot device and see no denials Change-Id: Idd4f81de4d2d0fc4bdec2d7ecb08bb8e078dab58
2020-05-19 15:02:58 +02:00
# All vendor build props are set by /vendor/build.prop
ro.vendor.build.date u:object_r:build_vendor_prop:s0 exact string
ro.vendor.build.date.utc u:object_r:build_vendor_prop:s0 exact int
ro.vendor.build.fingerprint u:object_r:build_vendor_prop:s0 exact string
ro.vendor.build.version.incremental u:object_r:build_vendor_prop:s0 exact string
ro.product.board u:object_r:build_vendor_prop:s0 exact string
ro.product.first_api_level u:object_r:build_vendor_prop:s0 exact int
ro.product.vendor.brand u:object_r:build_vendor_prop:s0 exact string
ro.product.vendor.device u:object_r:build_vendor_prop:s0 exact string
ro.product.vendor.manufacturer u:object_r:build_vendor_prop:s0 exact string
ro.product.vendor.model u:object_r:build_vendor_prop:s0 exact string
ro.product.vendor.name u:object_r:build_vendor_prop:s0 exact string
Rename exported and exported2 vold prop This is a subtask to clean up bad context names "exported*_prop". Bug: 152469526 Test: m Change-Id: Ie2d4046732e9d6562294fa664dcd7f019aa7c229
2020-04-06 13:49:17 +02:00
ro.crypto.state u:object_r:vold_status_prop:s0 exact enum encrypted unencrypted unsupported
ro.crypto.type u:object_r:vold_status_prop:s0 exact enum block file none
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Remove exported2_default_prop This cleans up remaining exported2_default_prop. Three properties are changed. - ro.arch It becomes build_prop. - hal.instrumentation.enable It becomes hal_instrumentation_prop. - ro.property_service.version It becomes property_service_version_prop. Bug: 155844385 Test: selinux denial test on Pixel devices Change-Id: I7ee0bd8c522cc09ee82ef89e6a13bbbf65291291
2020-07-24 17:34:56 +02:00
ro.property_service.version u:object_r:property_service_version_prop:s0 exact int
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
ro.vendor.redirect_socket_calls u:object_r:vendor_socket_hook_prop:s0 exact bool
service.bootanim.exit u:object_r:exported_system_prop:s0 exact int
sys.init.userspace_reboot.in_progress u:object_r:userspace_reboot_exported_prop:s0 exact bool
sys.use_memfd u:object_r:use_memfd_prop:s0 exact bool
Rename exported and exported2 vold prop This is a subtask to clean up bad context names "exported*_prop". Bug: 152469526 Test: m Change-Id: Ie2d4046732e9d6562294fa664dcd7f019aa7c229
2020-04-06 13:49:17 +02:00
vold.decrypt u:object_r:vold_status_prop:s0 exact string
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Add aaudio_config_prop and move aaudio properties To remove ambiguous context name exported_default_prop Bug: 71814576 Test: boot and see no denials Change-Id: I40eb92653fabc509419e07bb4bfa7301a8762352
2020-06-23 15:01:45 +02:00
aaudio.hw_burst_min_usec u:object_r:aaudio_config_prop:s0 exact int
aaudio.minimum_sleep_usec u:object_r:aaudio_config_prop:s0 exact int
aaudio.mixer_bursts u:object_r:aaudio_config_prop:s0 exact int
aaudio.mmap_exclusive_policy u:object_r:aaudio_config_prop:s0 exact int
aaudio.mmap_policy u:object_r:aaudio_config_prop:s0 exact int
aaudio.wakeup_delay_usec u:object_r:aaudio_config_prop:s0 exact int
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
persist.rcs.supported u:object_r:exported_default_prop:s0 exact int
ro.bionic.2nd_arch u:object_r:cpu_variant_prop:s0 exact string
ro.bionic.2nd_cpu_variant u:object_r:cpu_variant_prop:s0 exact string
ro.bionic.arch u:object_r:cpu_variant_prop:s0 exact string
ro.bionic.cpu_variant u:object_r:cpu_variant_prop:s0 exact string
ro.board.platform u:object_r:exported_default_prop:s0 exact string
ro.boot.fake_battery u:object_r:exported_default_prop:s0 exact int
Add sepolicy for ro.boot.fstab_suffix The fstab_suffix can be passed as 'androidboot.fstab_suffix=' on the kernel command line, or as an Android DT node. It specifies an override suffix for the fsmgr fstab search: /odm/etc/fstab.${fstab_suffix} /vendor/etc/fstab.${fstab_suffix} /fstab.${fstab_suffix} Bug: 142424832 Change-Id: I9c0acf7a5ae3cdba505460247decf2de9997cac1
2020-05-21 18:15:57 +02:00
ro.boot.fstab_suffix u:object_r:exported_default_prop:s0 exact string
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
ro.boot.hardware.revision u:object_r:exported_default_prop:s0 exact string
ro.boot.product.hardware.sku u:object_r:exported_default_prop:s0 exact string
ro.boot.product.vendor.sku u:object_r:exported_default_prop:s0 exact string
ro.boot.slot_suffix u:object_r:exported_default_prop:s0 exact string
ro.boringcrypto.hwrand u:object_r:exported_default_prop:s0 exact bool
ro.build.ab_update u:object_r:exported_default_prop:s0 exact string
ro.build.expect.baseband u:object_r:exported_default_prop:s0 exact string
ro.build.expect.bootloader u:object_r:exported_default_prop:s0 exact string
ro.carrier u:object_r:exported_default_prop:s0 exact string
ro.config.low_ram u:object_r:exported_config_prop:s0 exact bool
ro.config.vc_call_vol_steps u:object_r:exported_config_prop:s0 exact int
ro.frp.pst u:object_r:exported_default_prop:s0 exact string
ro.hardware.activity_recognition u:object_r:exported_default_prop:s0 exact string
ro.hardware.audio u:object_r:exported_default_prop:s0 exact string
ro.hardware.audio.a2dp u:object_r:exported_default_prop:s0 exact string
ro.hardware.audio.hearing_aid u:object_r:exported_default_prop:s0 exact string
ro.hardware.audio.primary u:object_r:exported_default_prop:s0 exact string
ro.hardware.audio.usb u:object_r:exported_default_prop:s0 exact string
ro.hardware.audio_policy u:object_r:exported_default_prop:s0 exact string
ro.hardware.bootctrl u:object_r:exported_default_prop:s0 exact string
ro.hardware.camera u:object_r:exported_default_prop:s0 exact string
ro.hardware.consumerir u:object_r:exported_default_prop:s0 exact string
ro.hardware.context_hub u:object_r:exported_default_prop:s0 exact string
ro.hardware.egl u:object_r:exported_default_prop:s0 exact string
ro.hardware.fingerprint u:object_r:exported_default_prop:s0 exact string
ro.hardware.flp u:object_r:exported_default_prop:s0 exact string
ro.hardware.gatekeeper u:object_r:exported_default_prop:s0 exact string
ro.hardware.gps u:object_r:exported_default_prop:s0 exact string
ro.hardware.gralloc u:object_r:exported_default_prop:s0 exact string
ro.hardware.hdmi_cec u:object_r:exported_default_prop:s0 exact string
ro.hardware.hwcomposer u:object_r:exported_default_prop:s0 exact string
ro.hardware.input u:object_r:exported_default_prop:s0 exact string
ro.hardware.keystore u:object_r:exported_default_prop:s0 exact string
ro.hardware.keystore_desede u:object_r:exported_default_prop:s0 exact string
ro.hardware.lights u:object_r:exported_default_prop:s0 exact string
ro.hardware.local_time u:object_r:exported_default_prop:s0 exact string
ro.hardware.memtrack u:object_r:exported_default_prop:s0 exact string
ro.hardware.nfc u:object_r:exported_default_prop:s0 exact string
ro.hardware.nfc_nci u:object_r:exported_default_prop:s0 exact string
ro.hardware.nfc_tag u:object_r:exported_default_prop:s0 exact string
ro.hardware.nvram u:object_r:exported_default_prop:s0 exact string
ro.hardware.power u:object_r:exported_default_prop:s0 exact string
ro.hardware.radio u:object_r:exported_default_prop:s0 exact string
ro.hardware.sensors u:object_r:exported_default_prop:s0 exact string
ro.hardware.sound_trigger u:object_r:exported_default_prop:s0 exact string
ro.hardware.thermal u:object_r:exported_default_prop:s0 exact string
ro.hardware.tv_input u:object_r:exported_default_prop:s0 exact string
ro.hardware.type u:object_r:exported_default_prop:s0 exact string
ro.hardware.vehicle u:object_r:exported_default_prop:s0 exact string
ro.hardware.vibrator u:object_r:exported_default_prop:s0 exact string
ro.hardware.virtual_device u:object_r:exported_default_prop:s0 exact string
ro.hardware.vulkan u:object_r:exported_default_prop:s0 exact string
ro.hwui.use_vulkan u:object_r:exported_default_prop:s0 exact bool
ro.kernel.qemu u:object_r:exported_default_prop:s0 exact bool
ro.kernel.qemu. u:object_r:exported_default_prop:s0
ro.kernel.android.bootanim u:object_r:exported_default_prop:s0 exact int
property_contexts: Add ro.kernel.ebpf.supported This prop allows vendors to specify whether their devices have basic eBPF compatibility (ie. Linux kernel 4.9 with P VINTF). Make it exported_default_prop because the shared library libbpf_android is used in a lot of places. See: https://r.android.com/1261922 Bug: 151753987 Signed-off-by: Felix <google@ix5.org> Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: Ifd9af558d84ea1619a6af7fce81b700fdfb22b9f
2020-04-22 21:18:29 +02:00
ro.kernel.ebpf.supported u:object_r:exported_default_prop:s0 exact bool
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
ro.oem.key1 u:object_r:exported_default_prop:s0 exact string
Refine build.prop related properties 1) build_odm_prop and build_vendor_prop are added These contexts will contain world-readable properties from /odm/build.prop and /vendor/build.prop, respectively. 2) move more properties to build_prop Following properties are set by /system/build.prop and now assigned as build_prop: - ro.adb.secure - ro.build.type - ro.product.cpu.abi - ro.product.cpu.abilist - ro.product.cpu.abilist32 - ro.product.cpu.abilist64 - ro.secure Following properties are set by init/property_service.cpp and now assigned as build_prop: - ro.product.brand - ro.product.device - ro.product.manufacturer - ro.product.model - ro.product.name Bug: 71814576 Bug: 155844385 Test: boot device and see no denials Change-Id: Idd4f81de4d2d0fc4bdec2d7ecb08bb8e078dab58
2020-05-19 15:02:58 +02:00
ro.product.vndk.version u:object_r:vndk_prop:s0 exact string
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
ro.vndk.lite u:object_r:vndk_prop:s0 exact bool
ro.vndk.version u:object_r:vndk_prop:s0 exact string
Add property contexts for vts props vts_config_prop and vts_status_prop are added to remove exported*_prop. ro.vts.coverage becomes vts_config_prop, and vts.native_server.on becomes vts_status_prop. Bug: 155844385 Test: Run some vts and then getprop, e.g. atest \ VtsHalAudioEffectV4_0TargetTest && adb shell getprop Test: ro.vts.coverage is read without denials Change-Id: Ic3532ef0ae7083db8d619d80e2b73249f87981ce
2020-07-13 19:10:37 +02:00
ro.vts.coverage u:object_r:vts_config_prop:s0 exact int
vts.native_server.on u:object_r:vts_status_prop:s0 exact bool
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Add wifi_hal_prop and remove exported_wifi_prop To remove bad context names "exported*_prop" Bug: 155844385 Test: boot and see no denials Change-Id: Icd30be64355699618735d4012461835eca8cd651 Merged-In: Icd30be64355699618735d4012461835eca8cd651 (cherry picked from commit 37c2d4d0c9669f3c7590f3dfccfac3c9725d1b5a) (cherry picked from commit 3b66e9b9f855ad0694efed405a30d64265854784)
2020-06-25 14:20:42 +02:00
wifi.active.interface u:object_r:wifi_hal_prop:s0 exact string
wifi.aware.interface u:object_r:wifi_hal_prop:s0 exact string
wifi.concurrent.interface u:object_r:wifi_hal_prop:s0 exact string
wifi.direct.interface u:object_r:wifi_hal_prop:s0 exact string
wifi.interface u:object_r:wifi_hal_prop:s0 exact string
wlan.driver.status u:object_r:wifi_hal_prop:s0 exact enum ok unloaded
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Move more properties out of exported3_default_prop This is to remove exported3_default_prop. Contexts of these properties are changed. - ro.boot.wificountrycode This becomes wifi_config_prop - ro.opengles.version This becomes graphics_config_prop. Also it's read by various domains, so graphics_config_prop is now readable from coredomain. - persist.config.calibration_fac This becomes camera_calibration_prop. It's only readable by appdomain. Bug: 155844385 Test: no denials on Pixel devices Test: connect wifi Change-Id: If2b6c10fa124e29d1612a8f94ae18b223849e2a9
2020-07-20 13:26:07 +02:00
ro.boot.wificountrycode u:object_r:wifi_config_prop:s0 exact string
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
ro.apex.updatable u:object_r:exported_default_prop:s0 exact bool
Define vendor-specific property ro.incremental.enable [cherry-picking] Make ro.incremental.enable a vendor-specific property. Allow system_server and vold to read this property. Test: manual BUG: 155212902 Change-Id: I8ff8837af635fa8e7b5bb02e5f6de5ac15b5023b Merged-In: I8ff8837af635fa8e7b5bb02e5f6de5ac15b5023b
2020-04-28 22:24:54 +02:00
# Property to enable incremental feature
ro.incremental.enable u:object_r:incremental_prop:s0
Use properties for various userspace reboot timeouts Test: adb reboot userspace Bug: 146560409 Change-Id: I62408f0e59622c2dab1245897c3057d02c5716a9
2020-03-25 01:13:13 +01:00
# Properties to configure userspace reboot.
init.userspace_reboot.is_supported u:object_r:userspace_reboot_config_prop:s0 exact bool
init.userspace_reboot.sigkill.timeoutmillis u:object_r:userspace_reboot_config_prop:s0 exact int
init.userspace_reboot.sigterm.timeoutmillis u:object_r:userspace_reboot_config_prop:s0 exact int
Add init.userspace_reboot.started.timeoutmillis property This property controls how much userspace reboot watchdog will wait for userspace reboot to start before falling back to hard reboot. Test: builds Bug: 152803929 Change-Id: I6955e8c94708e7e4161e4f334b03c052d42c0f9f
2020-04-11 03:00:01 +02:00
init.userspace_reboot.started.timeoutmillis u:object_r:userspace_reboot_config_prop:s0 exact int
Use properties for various userspace reboot timeouts Test: adb reboot userspace Bug: 146560409 Change-Id: I62408f0e59622c2dab1245897c3057d02c5716a9
2020-03-25 01:13:13 +01:00
init.userspace_reboot.userdata_remount.timeoutmillis u:object_r:userspace_reboot_config_prop:s0 exact int
init.userspace_reboot.watchdog.timeoutmillis u:object_r:userspace_reboot_config_prop:s0 exact int
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
sys.shutdown.requested u:object_r:exported_system_prop:s0 exact string
Rename surfaceflinger properties' contexts Cleaning up exported*_system_prop and moving surfaceflinger properties to new property contexts. Bug: 152468529 Bug: 154885206 Test: boot cf_x86 and crosshatch Change-Id: I7f8a684e9cbabce2f55a5292d7b2283ac0716cd9
2020-04-24 14:25:17 +02:00
# surfaceflinger properties
Create surfaceflinger_prop and migrate props This is a subtask of removing exported*_prop. Bug: 152468529 Test: m && boot crosshatch Change-Id: I9d6ec7ade96a3a53288f23d155cc829c2107bb6f
2020-04-02 08:55:07 +02:00
ro.surface_flinger.default_composition_dataspace u:object_r:surfaceflinger_prop:s0 exact int
ro.surface_flinger.default_composition_pixel_format u:object_r:surfaceflinger_prop:s0 exact int
ro.surface_flinger.force_hwc_copy_for_virtual_displays u:object_r:surfaceflinger_prop:s0 exact bool
ro.surface_flinger.has_HDR_display u:object_r:surfaceflinger_prop:s0 exact bool
ro.surface_flinger.has_wide_color_display u:object_r:surfaceflinger_prop:s0 exact bool
ro.surface_flinger.max_frame_buffer_acquired_buffers u:object_r:surfaceflinger_prop:s0 exact int
ro.surface_flinger.max_graphics_height u:object_r:surfaceflinger_prop:s0 exact int
ro.surface_flinger.max_graphics_width u:object_r:surfaceflinger_prop:s0 exact int
ro.surface_flinger.max_virtual_display_dimension u:object_r:surfaceflinger_prop:s0 exact int
ro.surface_flinger.primary_display_orientation u:object_r:surfaceflinger_prop:s0 exact enum ORIENTATION_0 ORIENTATION_180 ORIENTATION_270 ORIENTATION_90
ro.surface_flinger.present_time_offset_from_vsync_ns u:object_r:surfaceflinger_prop:s0 exact int
ro.surface_flinger.running_without_sync_framework u:object_r:surfaceflinger_prop:s0 exact bool
ro.surface_flinger.start_graphics_allocator_service u:object_r:surfaceflinger_prop:s0 exact bool
ro.surface_flinger.use_color_management u:object_r:surfaceflinger_prop:s0 exact bool
ro.surface_flinger.use_context_priority u:object_r:surfaceflinger_prop:s0 exact bool
ro.surface_flinger.use_vr_flinger u:object_r:surfaceflinger_prop:s0 exact bool
ro.surface_flinger.vsync_event_phase_offset_ns u:object_r:surfaceflinger_prop:s0 exact int
ro.surface_flinger.vsync_sf_event_phase_offset_ns u:object_r:surfaceflinger_prop:s0 exact int
ro.surface_flinger.wcg_composition_dataspace u:object_r:surfaceflinger_prop:s0 exact int
ro.surface_flinger.wcg_composition_pixel_format u:object_r:surfaceflinger_prop:s0 exact int
ro.surface_flinger.display_primary_red u:object_r:surfaceflinger_prop:s0 exact string
ro.surface_flinger.display_primary_green u:object_r:surfaceflinger_prop:s0 exact string
ro.surface_flinger.display_primary_blue u:object_r:surfaceflinger_prop:s0 exact string
ro.surface_flinger.display_primary_white u:object_r:surfaceflinger_prop:s0 exact string
ro.surface_flinger.protected_contents u:object_r:surfaceflinger_prop:s0 exact bool
ro.surface_flinger.set_idle_timer_ms u:object_r:surfaceflinger_prop:s0 exact int
ro.surface_flinger.set_touch_timer_ms u:object_r:surfaceflinger_prop:s0 exact int
ro.surface_flinger.set_display_power_timer_ms u:object_r:surfaceflinger_prop:s0 exact int
ro.surface_flinger.support_kernel_idle_timer u:object_r:surfaceflinger_prop:s0 exact bool
ro.surface_flinger.use_smart_90_for_video u:object_r:surfaceflinger_prop:s0 exact bool
ro.surface_flinger.use_content_detection_for_refresh_rate u:object_r:surfaceflinger_prop:s0 exact bool
ro.surface_flinger.color_space_agnostic_dataspace u:object_r:surfaceflinger_prop:s0 exact int
ro.surface_flinger.refresh_rate_switching u:object_r:surfaceflinger_prop:s0 exact bool
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Rename surfaceflinger properties' contexts Cleaning up exported*_system_prop and moving surfaceflinger properties to new property contexts. Bug: 152468529 Bug: 154885206 Test: boot cf_x86 and crosshatch Change-Id: I7f8a684e9cbabce2f55a5292d7b2283ac0716cd9
2020-04-24 14:25:17 +02:00
ro.sf.disable_triple_buffer u:object_r:surfaceflinger_prop:s0 exact bool
ro.sf.lcd_density u:object_r:surfaceflinger_prop:s0 exact int
persist.sys.sf.color_mode u:object_r:surfaceflinger_color_prop:s0 exact int
persist.sys.sf.color_saturation u:object_r:surfaceflinger_color_prop:s0 exact string
persist.sys.sf.native_mode u:object_r:surfaceflinger_color_prop:s0 exact int
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
# Binder cache properties. These are world-readable
cache_key.app_inactive u:object_r:binder_cache_system_server_prop:s0
cache_key.is_compat_change_enabled u:object_r:binder_cache_system_server_prop:s0
cache_key.get_packages_for_uid u:object_r:binder_cache_system_server_prop:s0
cache_key.has_system_feature u:object_r:binder_cache_system_server_prop:s0
cache_key.is_interactive u:object_r:binder_cache_system_server_prop:s0
cache_key.is_power_save_mode u:object_r:binder_cache_system_server_prop:s0
cache_key.is_user_unlocked u:object_r:binder_cache_system_server_prop:s0
cache_key.volume_list u:object_r:binder_cache_system_server_prop:s0
cache_key.display_info u:object_r:binder_cache_system_server_prop:s0
cache_key.location_enabled u:object_r:binder_cache_system_server_prop:s0
cache_key.package_info u:object_r:binder_cache_system_server_prop:s0
cache_key.bluetooth. u:object_r:binder_cache_bluetooth_server_prop:s0 prefix string
cache_key.system_server. u:object_r:binder_cache_system_server_prop:s0 prefix string
cache_key.telephony. u:object_r:binder_cache_telephony_server_prop:s0 prefix string
Add contexts for exported telephony props To remove bad context names, two contexts are added. - telephony_config_prop - telephony_status_prop exported_radio_prop, exported2_radio_prop are removed. Cleaning up exported3_radio_prop will be a follow-up task. Exempt-From-Owner-Approval: cherry-pick Bug: 152471138 Bug: 155844385 Test: boot and see no denials Test: usim works on blueline Change-Id: Iff9a4635c709f3ebe266cd811df3a1b4d3a242c2 Merged-In: Iff9a4635c709f3ebe266cd811df3a1b4d3a242c2 (cherry picked from commit 4d36eae8affaffce00063d37fe7f1d570cca1f1f)
2020-05-14 14:47:43 +02:00
gsm.sim.operator.numeric u:object_r:telephony_status_prop:s0 exact string
persist.radio.airplane_mode_on u:object_r:telephony_status_prop:s0 exact bool
ro.com.android.dataroaming u:object_r:telephony_config_prop:s0 exact bool
ro.com.android.prov_mobiledata u:object_r:telephony_config_prop:s0 exact bool
ro.radio.noril u:object_r:telephony_config_prop:s0 exact string
ro.telephony.call_ring.multiple u:object_r:telephony_config_prop:s0 exact bool
ro.telephony.default_cdma_sub u:object_r:telephony_config_prop:s0 exact int
ro.telephony.default_network u:object_r:telephony_config_prop:s0 exact string
ro.telephony.iwlan_operation_mode u:object_r:telephony_config_prop:s0 exact enum default legacy AP-assisted
telephony.active_modems.max_count u:object_r:telephony_config_prop:s0 exact int
telephony.lteOnCdmaDevice u:object_r:telephony_config_prop:s0 exact int
persist.dbg.volte_avail_ovr u:object_r:telephony_config_prop:s0 exact int
persist.dbg.vt_avail_ovr u:object_r:telephony_config_prop:s0 exact int
persist.dbg.wfc_avail_ovr u:object_r:telephony_config_prop:s0 exact int
Update sepolicy for GPU profiling properties. A device must indicate whether GPU profiling is supported or not through setting these two properties properly. CTS needs to read these two properties in order to run corresponding compliance tests. Hence need to update sepolicy for these two properties. Bug: b/157832445 Test: Test on Pixel 4 Change-Id: I6f400ecbbd5e78b645bb620fa24747e9367c2ff3 Merged-In: I6f400ecbbd5e78b645bb620fa24747e9367c2ff3
2020-06-03 21:20:41 +02:00
Define sepolicy for locale filter property Bug: 154133013 Test: Manual Change-Id: I28ae279e4fd47553fcf4ab9421944f552490b49f
2020-07-08 23:11:03 +02:00
# System locale list filter configuration
ro.localization.locale_filter u:object_r:localization_prop:s0 exact string
Update sepolicy for GPU profiling properties. A device must indicate whether GPU profiling is supported or not through setting these two properties properly. CTS needs to read these two properties in order to run corresponding compliance tests. Hence need to update sepolicy for these two properties. Bug: b/157832445 Test: Test on Pixel 4 Change-Id: I6f400ecbbd5e78b645bb620fa24747e9367c2ff3 Merged-In: I6f400ecbbd5e78b645bb620fa24747e9367c2ff3
2020-06-03 21:20:41 +02:00
# Graphics related properties
Move more properties out of exported3_default_prop This is to remove exported3_default_prop. Contexts of these properties are changed. - ro.boot.wificountrycode This becomes wifi_config_prop - ro.opengles.version This becomes graphics_config_prop. Also it's read by various domains, so graphics_config_prop is now readable from coredomain. - persist.config.calibration_fac This becomes camera_calibration_prop. It's only readable by appdomain. Bug: 155844385 Test: no denials on Pixel devices Test: connect wifi Change-Id: If2b6c10fa124e29d1612a8f94ae18b223849e2a9
2020-07-20 13:26:07 +02:00
ro.opengles.version u:object_r:graphics_config_prop:s0 exact int
Move ro.gfx.* properties to graphics_config_prop To clean up bad context names exported*_prop. Bug: 155844385 Test: boot and see no denials Change-Id: Ie92e4293b8271bc137222a4c21637c740b06e156
2020-06-22 15:22:55 +02:00
ro.gfx.driver.0 u:object_r:graphics_config_prop:s0 exact string
ro.gfx.driver.1 u:object_r:graphics_config_prop:s0 exact string
ro.gfx.angle.supported u:object_r:graphics_config_prop:s0 exact bool
Update sepolicy for GPU profiling properties. A device must indicate whether GPU profiling is supported or not through setting these two properties properly. CTS needs to read these two properties in order to run corresponding compliance tests. Hence need to update sepolicy for these two properties. Bug: b/157832445 Test: Test on Pixel 4 Change-Id: I6f400ecbbd5e78b645bb620fa24747e9367c2ff3 Merged-In: I6f400ecbbd5e78b645bb620fa24747e9367c2ff3
2020-06-03 21:20:41 +02:00
graphics.gpu.profiler.support u:object_r:graphics_config_prop:s0 exact bool
graphics.gpu.profiler.vulkan_layer_apk u:object_r:graphics_config_prop:s0 exact string
Reference in a new issue Copy permalink