tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/public/flags_health_check.te

33 lines
2 KiB
Text
Raw Normal View History

sepolicy for server configurable flags Test: manual on device Change-Id: Ibafe1b345489c88a49a7ed3e2e61e5cc5e1880a1
2018-10-26 05:09:55 +02:00
# The flags_health_check command run by init.
type flags_health_check, domain, coredomain;
type flags_health_check_exec, system_file_type, exec_type, file_type;
set_prop(flags_health_check, device_config_boot_count_prop)
Sepolicies for server configural flags reset Test: m -j succeeded and manual tested on device Change-Id: I3415c58335361a9da4ef2368e61bc4e0250a91bb
2018-11-09 01:46:19 +01:00
set_prop(flags_health_check, device_config_reset_performed_prop)
Add device_config_runtime_native_boot_prop Some runtime properties require reboots and should be in the native_boot namespace instead of native. Bug: 120794191 Bug: 123524494 Test: set a property and ensure it can be read in AndroidRuntime.cpp Change-Id: I1d1e984dcba26dd04d34a7d30fc63e1b75a8a311
2019-02-01 22:43:11 +01:00
set_prop(flags_health_check, device_config_runtime_native_boot_prop)
Rename runtime -> runtime_native property namespace The convention for native properties is to use _native suffix. Bug: 123524494 Bug: 120794191 Test: set a property and ensure it can be read in AndroidRuntime.cpp Change-Id: I69feab9be78f24d812b8f953d3ec06a5d8d18f15
2019-01-29 18:57:11 +01:00
set_prop(flags_health_check, device_config_runtime_native_prop)
Permissions for input_native_boot flags For input experiments that are enabled at boot time, allow system_server to read and write the device config flags. Bug: 120794829 Test: presubmit Change-Id: I0f075a7579c593d4e07c3e31be529e34554068a6
2019-01-14 23:18:38 +01:00
set_prop(flags_health_check, device_config_input_native_boot_prop)
SEPolicy updates for adding native flag namespace(netd). For experiment flag testing, we add a flag netd and have SEPolicy updates. Test: add sepolicy, m -j, check GetServerConfigurableFlag function in netd Bug:122050512 Change-Id: I21c844c277afc358085d80447f16e4c0d4eba5b3
2018-12-27 11:01:25 +01:00
set_prop(flags_health_check, device_config_netd_native_prop)
Update sepolicy with new native boot flag for activity_manager Whitelist the persistent system properties that will be used as flags in activity manager experiments. Bug: 120794810 Test: m, flash, test getting flag value in ActivityManagerService.java Change-Id: I90a10bc87d6db3a64347b62fd02e6f0b12ac9fa8
2019-01-17 22:30:05 +01:00
set_prop(flags_health_check, device_config_activity_manager_native_boot_prop)
SEPolicy updates for adding native flag namespace(media). Test: add sepolicy, build, check GetServerConfigurableFlag function Bug: 123658514 Change-Id: I798b0ef901068c53070e768305acd38118a7e886
2019-01-31 00:28:31 +01:00
set_prop(flags_health_check, device_config_media_native_prop)
Re-add sys_traced prop Add permissions for: persist.device_config.global_settings.sys_traced Bug: b/71737179 Test: As follows: patch aosp/891475 patch aosp/891853 patch ag/6224352 $ adb shell walleye:/ $ ps -A | grep traced nobody 1135 1 52288 2200 0 0 S traced nobody 1136 1 52288 2256 0 0 S traced_probes walleye:/ $ settings put global sys_traced 0 walleye:/ $ ps -A | grep traced 1|walleye:/ $ walleye:/ $ settings put global sys_traced 1 1|walleye:/ $ ps -A | grep traced nobody 12386 1 52288 2208 0 0 S traced nobody 12387 1 52288 2248 0 0 S traced_probes Change-Id: I8898672c8fdc9c5d87a31b90f6c7d5c03bef78ed
2019-04-05 17:41:30 +02:00
set_prop(flags_health_check, device_config_sys_traced_prop)
sepolicies for sys prop enabling flag health check device_config_flags_health_check_prop is used for enabling/disabling program flags_health_check which is executed during device booting. "1" means enabling health check actions in flags_health_check, other values mean flags_health_check will not perform any action. Test: build succeeded & manual test Change-Id: I93739dc5d155e057d72d08fd13097eb63c1193b5
2018-11-16 01:27:18 +01:00
grant permissions of dir /data/server_configurable_flags grant rw_dir_perms of dir /data/server_configurable_flags to flags_health_check.te, in order to enable flags_health_check to record reset flags data as file under this dir for later use. See function: server_configurable_flags::ServerConfigurableFlagsReset for how the permission is used. Test: manual on device Change-Id: I1df7b8cadfbe279f26bf828e9e725ce170a376f7
2018-11-20 20:17:35 +01:00
allow flags_health_check server_configurable_flags_data_file:dir rw_dir_perms;
Sepolicies for server configural flags reset Test: m -j succeeded and manual tested on device Change-Id: I3415c58335361a9da4ef2368e61bc4e0250a91bb
2018-11-09 01:46:19 +01:00
allow flags_health_check server_configurable_flags_data_file:file create_file_perms;
sepolicy for server configurable flags Test: manual on device Change-Id: Ibafe1b345489c88a49a7ed3e2e61e5cc5e1880a1
2018-10-26 05:09:55 +02:00
# system property device_config_boot_count_prop is used for deciding when to perform server
# configurable flags related disaster recovery. Mistakenly set up by unrelated components can, at a
# wrong timing, trigger server configurable flag related disaster recovery, which will override
# server configured values of all flags with default values.
neverallow { domain -init -flags_health_check } device_config_boot_count_prop:property_service set;
Sepolicies for server configural flags reset Test: m -j succeeded and manual tested on device Change-Id: I3415c58335361a9da4ef2368e61bc4e0250a91bb
2018-11-09 01:46:19 +01:00
# system property device_config_reset_performed_prop is used for indicating whether server
# configurable flags have been reset during booting. Mistakenly modified by unrelated components can
# cause bad server configurable flags synced back to device.
neverallow { domain -init -flags_health_check } device_config_reset_performed_prop:property_service set;
# server_configurable_flags_data_file is used for storing whether server configurable flags which
# have been reset during current booting. Mistakenly modified by unrelated components can
# cause bad server configurable flags synced back to device.
neverallow { domain -init -flags_health_check } server_configurable_flags_data_file:file no_w_file_perms;
Reference in a new issue Copy permalink